tlsinspect

type ChainCert struct {
	Position     int       `json:"position"`
	Subject      string    `json:"subject"`
	Issuer       string    `json:"issuer"`
	NotAfter     time.Time `json:"not_after"`
	SHA256       string    `json:"sha256"`
	Key          string    `json:"key"`
	Signature    string    `json:"signature_algorithm"`
	IsCA         bool      `json:"is_ca"`
	SelfSigned   bool      `json:"self_signed"`
	IssuedByNext bool      `json:"issued_by_next"` // chain order check
}

type Connector struct {
	Target    Target
	Adapter   protocol.Adapter
	Detection protocol.Detection
	SNI       string
	IPs       []string // resolved addresses (empty when using a proxy)
	// contains filtered or unexported fields
}

type Finding struct {
	ID        string `json:"id"`
	Severity  string `json:"severity"`
	What      string `json:"what"`
	Why       string `json:"why"`
	Evidence  string `json:"evidence"`
	Reference string `json:"reference,omitempty"`
}

type InspectOptions struct {
	Roots          *x509.CertPool // nil = system trust store
	TrustStoreName string         // for display
	Hostname       string         // name to validate; default SNI or host
	ALPN           []string       // default depends on protocol
	Resumption     bool           // test session resumption (one extra handshake)
	Now            time.Time
	WarningDays    int
}

type OCSPInfo struct {
	Stapled    bool      `json:"stapled"`
	Status     string    `json:"status,omitempty"` // good, revoked, unknown
	ProducedAt time.Time `json:"produced_at,omitempty"`
	ThisUpdate time.Time `json:"this_update,omitempty"`
	NextUpdate time.Time `json:"next_update,omitempty"`
	RevokedAt  time.Time `json:"revoked_at,omitempty"`
	Error      string    `json:"error,omitempty"`
	Responders []string  `json:"responders,omitempty"`
	MustStaple bool      `json:"must_staple"`
}

type Options struct {
	Dialer   netdial.Dialer
	Protocol string        // explicit --protocol
	SNI      string        // override; "" = host (omitted for IP targets)
	IP       string        // connect to this address instead of resolving
	Timeout  time.Duration // per connection
}

type Result struct {
	Target      string                `json:"target"`
	Host        string                `json:"host"`
	Port        int                   `json:"port"`
	SNI         string                `json:"sni,omitempty"`
	IPs         []string              `json:"resolved_ips,omitempty"`
	ConnectedTo string                `json:"connected_to"`
	Protocol    protocol.Detection    `json:"protocol"`
	Transcript  []string              `json:"starttls_transcript,omitempty"`
	TLS         SessionInfo           `json:"tls"`
	Certificate *certificate.Info     `json:"certificate,omitempty"`
	Chain       []ChainCert           `json:"chain"`
	Validation  Validation            `json:"validation"`
	OCSP        *OCSPInfo             `json:"ocsp,omitempty"`
	Findings    []certificate.Finding `json:"certificate_findings"`
	Duration    string                `json:"duration"`
	Error       string                `json:"error,omitempty"` // handshake error when only partial data is available
}

type ScanOptions struct {
	Inspect     InspectOptions
	Concurrency int
	SkipCiphers bool
}

type ScanResult struct {
	Connection *Result                 `json:"connection"`
	Versions   []scanner.VersionResult `json:"versions"`
	Ciphers    []scanner.CipherResult  `json:"ciphers,omitempty"`
	Groups     scanner.GroupResult     `json:"groups"`
	Behaviour  scanner.Extras          `json:"behaviour"`
	Summary    []SummaryItem           `json:"summary"`
	Findings   []Finding               `json:"findings"`
	ScannedAt  time.Time               `json:"scanned_at"`
	Duration   string                  `json:"duration"`
}

type SessionInfo struct {
	Version           string   `json:"version"`
	Cipher            string   `json:"cipher"`
	CipherStrength    string   `json:"cipher_strength"`
	KeyExchangeGroup  string   `json:"key_exchange_group,omitempty"`
	ALPN              string   `json:"alpn,omitempty"`
	OfferedALPN       []string `json:"offered_alpn,omitempty"`
	HelloRetryRequest bool     `json:"hello_retry_request"`
	OCSPStapled       bool     `json:"ocsp_stapled"`
	SCTsInHandshake   int      `json:"scts_in_handshake"`
	SessionResumption *bool    `json:"session_resumption,omitempty"`
	Handshake         string   `json:"handshake"` // go (full handshake) or probe (certificate only)
}

type Snapshot struct {
	Kind       string    `json:"kind"` // inspect or scan
	Target     string    `json:"target"`
	Protocol   string    `json:"protocol"`
	ScannedAt  time.Time `json:"scanned_at"`
	LeafSHA256 string    `json:"leaf_sha256"`
	Subject    string    `json:"subject"`
	Issuer     string    `json:"issuer"`
	SANs       []string  `json:"sans"`
	NotAfter   time.Time `json:"not_after"`
	Key        string    `json:"key"`
	Trusted    bool      `json:"trusted"`
	Negotiated string    `json:"negotiated_version"`
	Cipher     string    `json:"negotiated_cipher"`
	Versions   []string  `json:"versions,omitempty"` // scan only
	Suites     []string  `json:"cipher_suites,omitempty"`
}

type SummaryItem struct {
	Check  string `json:"check"`
	Status string `json:"status"` // PASS, FAIL, WARN, ENABLED, DISABLED, NONE, ...
	Level  string `json:"level"`  // good, warn, bad, info: how to read the status
	Detail string `json:"detail,omitempty"`
}

type Target struct {
	Host     string
	Port     int
	Protocol string // from a URL scheme or --protocol; "" = autodetect
}

type Validation struct {
	Trusted       bool     `json:"trusted"`
	TrustStore    string   `json:"trust_store"`
	HostnameValid bool     `json:"hostname_valid"`
	Hostname      string   `json:"hostname"`
	ChainOrdered  bool     `json:"chain_ordered"`
	VerifiedChain []string `json:"verified_chain,omitempty"`
	Missing       []string `json:"missing_intermediates,omitempty"` // supplied by the verifier, not the server
	Error         string   `json:"error,omitempty"`
	Reason        string   `json:"reason,omitempty"`
}