scanner

type AcceptedSuite struct {
	Suite
	KeyExchange *KeyExchange `json:"key_exchange_params,omitempty"`
}

type AlertError struct {
	Level       byte
	Description byte
}

type CipherResult struct {
	Version         string          `json:"version"`
	ID              uint16          `json:"id"`
	Suites          []AcceptedSuite `json:"suites"`
	ServerPreferred *bool           `json:"server_order,omitempty"` // nil when fewer than two suites
	Error           string          `json:"error,omitempty"`
}

type Dialer func(ctx context.Context) (net.Conn, error)

type Extras struct {
	SecureRenegotiation  *bool    `json:"secure_renegotiation,omitempty"` // RFC 5746
	FallbackSCSV         *bool    `json:"fallback_scsv,omitempty"`        // RFC 7507; nil if not testable
	Compression          *bool    `json:"compression,omitempty"`          // TLS compression accepted (CRIME)
	SessionTickets       *bool    `json:"session_tickets,omitempty"`
	ExtendedMasterSecret *bool    `json:"extended_master_secret,omitempty"`
	EncryptThenMAC       *bool    `json:"encrypt_then_mac,omitempty"`
	Extensions           []string `json:"server_extensions,omitempty"` // at the highest TLS ≤1.2 version
}

type GroupResult struct {
	TLS13 []string `json:"tls13,omitempty"`
	TLS12 []string `json:"tls12,omitempty"` // ECDHE curves accepted with TLS ≤1.2
}

type Hello struct {
	Version           uint16   // legacy_version field
	RecordVersion     uint16   // record layer version; 0 = min(Version, TLS 1.0)
	Suites            []uint16 // cipher suites in preference order
	ServerName        string   // SNI; omitted for IP addresses and when empty
	SupportedVersions []uint16 // TLS 1.3 supported_versions; nil omits the extension
	Groups            []uint16 // supported_groups; nil = default for the version
	KeyShares         []uint16 // groups to send key shares for (TLS 1.3); nil = x25519
	NoKeyShares       bool     // send an empty key_share (forces HelloRetryRequest)
	Compression       []byte   // compression methods; nil = null only
	ALPN              []string
	Fallback          bool // append TLS_FALLBACK_SCSV
	NoRenegotiation   bool // omit TLS_EMPTY_RENEGOTIATION_INFO_SCSV
}

type KeyExchange struct {
	Kind    string `json:"kind"` // ECDH or DH
	Group   string `json:"group,omitempty"`
	GroupID uint16 `json:"group_id,omitempty"`
	Bits    int    `json:"bits"`
}

type Prober struct {
	Dial        Dialer
	ServerName  string
	Timeout     time.Duration // per probe; default 10s
	Concurrency int           // parallel probes; default 8
}

type ServerHello struct {
	LegacyVersion uint16
	Version       uint16 // negotiated version (supported_versions if present)
	CipherSuite   uint16
	Compression   byte
	SessionIDLen  int
	Extensions    []uint16 // extension types in order received

	HelloRetry    bool
	KeyShareGroup uint16
	// Filled from later handshake messages for TLS ≤1.2 when requested.
	Certificates [][]byte // DER, as sent
	KeyExchange  *KeyExchange
	// contains filtered or unexported fields
}

type Suite struct {
	ID       uint16   `json:"id"`
	Name     string   `json:"name"`
	KeyExch  string   `json:"key_exchange"`   // ECDHE, DHE, RSA, ECDH, DH, PSK, SRP, TLS1.3, NULL
	Auth     string   `json:"authentication"` // RSA, ECDSA, DSS, anon, PSK, SRP, any, NULL
	Cipher   string   `json:"cipher"`         // AES, 3DES, RC4, CHACHA20, ...
	Bits     int      `json:"bits"`
	Mode     string   `json:"mode"` // GCM, CCM, CCM8, CBC, POLY1305, stream, none
	MAC      string   `json:"mac"`  // AEAD, SHA, SHA256, SHA384, MD5
	Export   bool     `json:"export"`
	TLS13    bool     `json:"tls13"`
	Strength string   `json:"strength"` // modern, deprecated, weak, insecure
	Reasons  []string `json:"reasons,omitempty"`
}

type VersionResult struct {
	Version   string `json:"version"`
	ID        uint16 `json:"id"`
	Supported bool   `json:"supported"`
	Error     string `json:"error,omitempty"` // probe failed (not a rejection)
}