Make more TLS checks trigger on the default `medium' level

* doc/emacs/misc.texi (Network Security): Update the doc to say
what's on the different levels.

* lisp/net/nsm.el (nsm-protocol-check--intermediary-sha1): Check
intermediary certificates for SHA1.
(nsm-protocol-check--3des): Check for 3DES ciphers.
(network-security-protocol-checks): Put most of the checks on
`medium'.

3 files changed, 56 insertions, 17 deletions

diff --git a/doc/emacs/misc.texi b/doc/emacs/misc.texi
index 177cc8fa469..78f28ccfad9 100644
--- a/doc/emacs/misc.texi
+++ b/doc/emacs/misc.texi
@@ -352,19 +352,6 @@ over these connections.  Similarly, if you're sending email via
 connection to be encrypted.  If the connection isn't encrypted,
 @acronym{NSM} will warn you.
 
-@end table
-
-If @code{network-security-level} is @code{high}, the following checks
-will be made, in addition to the above:
-
-@table @asis
-@item a validated certificate changes the public key
-Servers change their keys occasionally, and that is normally nothing
-to be concerned about.  However, if you are worried that your network
-connections are being hijacked by agencies who have access to pliable
-Certificate Authorities which issue new certificates for third-party
-services, you may want to keep track of these changes.
-
 @item Diffie-Hellman low prime bits
 When doing the public key exchange, the number of prime bits
 should be high to ensure that the channel can't be eavesdropped on by
@@ -374,10 +361,34 @@ third parties.  If this number is too low, you will be warned.
 The @acronym{RC4} stream cipher is believed to be of low quality and
 may allow eavesdropping by third parties.
 
+@item @acronym{SHA1} in the host certificate or in intermediary certificates
+It is believed that if an intermediary certificate uses
+the @acronym{SHA1} hashing algorithm, then third parties can issue
+certificates pretending to be that issuing instance.  These
+connections are therefore vulnerable to man-in-the-middle attacks.
+
 @item @acronym{SSL1}, @acronym{SSL2} and @acronym{SSL3}
 The protocols older than @acronym{TLS1.0} are believed to be
 vulnerable to a variety of attacks, and you may want to avoid using
 these if what you're doing requires higher security.
+
+@end table
+
+If @code{network-security-level} is @code{high}, the following checks
+will be made, in addition to the above:
+
+@table @asis
+@item @acronym{3DES} cipther
+The @acronym{RC4} stream cipher is believed by some to be of low
+quality and may allow eavesdropping by third parties.
+
+@item a validated certificate changes the public key
+Servers change their keys occasionally, and that is normally nothing
+to be concerned about.  However, if you are worried that your network
+connections are being hijacked by agencies who have access to pliable
+Certificate Authorities which issue new certificates for third-party
+services, you may want to keep track of these changes.
+
 @end table
 
 Finally, if @code{network-security-level} is @code{paranoid}, you will
diff --git a/etc/NEWS b/etc/NEWS
index 8ee4831b6ed..d86d5e9817e 100644
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -136,6 +136,10 @@ of what checks to run via the `network-security-protocol-checks'
 variable.
 
 +++
+** Most of the checks for outdated, believed-to-be-weak TLS algorithms
+and ciphers are now switched on by default.
+
++++
 ** New function 'fill-polish-nobreak-p', to be used in 'fill-nobreak-predicate'.
 It blocks line breaking after a one-letter word, also in the case when
 this word is preceded by a non-space, but non-alphanumeric character.
diff --git a/lisp/net/nsm.el b/lisp/net/nsm.el
index 97bfc7d62f1..2c4f8bf5ed5 100644
--- a/lisp/net/nsm.el
+++ b/lisp/net/nsm.el
@@ -182,10 +182,12 @@ unencrypted."
           process))))))
 
 (defvar network-security-protocol-checks
-  '((diffie-hellman-prime-bits high 1024)
-    (rc4 high)
-    (signature-sha1 high)
-    (ssl high))
+  '((diffie-hellman-prime-bits medium 1024)
+    (rc4 medium)
+    (signature-sha1 medium)
+    (intermediary-sha1 medium)
+    (3des high)
+    (ssl medium))
   "This variable specifies what TLS connection checks to perform.
 It's an alist where the first element is the name of the check,
 the second is the security level where the check kicks in, and the
@@ -230,6 +232,13 @@ HOST PORT STATUS OPTIONAL-PARAMETER.")
          "The Diffie-Hellman prime bits (%s) used for this connection to %s:%s is less than what is considered safe (%s)."
          prime-bits host port bits))))
 
+(defun nsm-protocol-check--3des (host port status _)
+  (or (not (string-match "\\b3DES\\b" (plist-get status :cipher)))
+      (nsm-query
+       host port status :rc4
+       "The connection to %s:%s uses the 3DES cipher (%s), which is believed to be unsafe."
+       host port (plist-get status :cipher))))
+
 (defun nsm-protocol-check--rc4 (host port status _)
   (or (not (string-match "\\bRC4\\b" (nsm--encryption status)))
       (nsm-query
@@ -246,6 +255,21 @@ HOST PORT STATUS OPTIONAL-PARAMETER.")
          "The certificate used to verify the connection to %s:%s uses the SHA1 algorithm (%s), which is believed to be unsafe."
          host port signature-algorithm))))
 
+(defun nsm-protocol-check--intermediary-sha1 (host port status _)
+  ;; We want to check all intermediary certificates, so we skip the
+  ;; first, reverse the list and then skip the first again, so we miss
+  ;; the first and final certificates in the chain.
+  (cl-loop for certificate in (cdr (reverse
+                                    (cdr (plist-get status :certificates))))
+           for algo = (plist-get certificate :signature-algorithm)
+           when (and (string-match "\\bSHA1\\b" algo)
+                     (not (nsm-query
+                           host port status :signature-sha1
+                           "An intermediary certificate used to verify the connection to %s:%s uses the SHA1 algorithm (%s), which is believed to be unsafe."
+                           host port algo)))
+           do (cl-return nil)
+           finally (cl-return t)))
+
 (defun nsm-protocol-check--ssl (host port status _)
   (let ((protocol (plist-get status :protocol)))
     (or (not protocol)