"noforwardsecrecy" handler to detect cipher suites not using DHE

[mkenne11]

Added the "noforwardsecrecy" connection handler to detect TLS ciphers negotiated between client and server which don't support forward secrecy i.e. Ephemeral Diffie-Hellman methods DHE or ECDHE.

[chadbrubaker]

Sorry for not commenting here earlier, missed the PR.

Can you make your handler a data handler(and probably a passive one) instead of a connection handler since it just passively checks the connection, you could add it to https://github.com/google/nogotofail/blob/dev/nogotofail/mitm/connection/handlers/data/ssl.py which has similar data handlers.

Also you probably don't need to buffer for the server hello, its small enough to always come in in one recv(), its fine to keep it though but if you do make it store the buffer internally but still pass the traffic through (ie: always return response but store response if you need more data).

[mkenne11]

Chad - I made the suggested changes to the noforwardsecrecy handler in my local forked repo. If you have a chance have a look before I create a pull request:
https://github.com/mkenne11/nogotofail/blob/010d791f214deed3b07d75318e071f019bd27337/nogotofail/mitm/connection/handlers/data/ssl.py#l99

I did find one app (AirAsia) whose "server hello" response was large and needed to be buffered.

Let me know if I didn't address your last comment i.e. ... store the buffer internally but still pass the traffic through (ie: always return response but store response if you need more data).

[chadbrubaker]

You want to make sure to avoid buffering after you've found what you're looking for or you will probably run into issues once it becomes encrypted.

Let me create a base handler that does all the buffering for you, this has been a request I've gotten a couple times already now.

[mkenne11]

Closed and replaced by PR #98.