ssl

type Authentication uint8

type Certificate struct {
	Type                   string             // 'leaf' / 'intermediate' / 'root'
	Version                int                // Version of the X.509 standard.
	Serial                 big.Int            // Serial number chosen by the CA (not necessarily globally unique / random).
	Subject                []string           // Object Identifiers (OIDs) of the subject.
	SubjectCN              string             // Subject's common name.
	Issuer                 []string           // Object Identifiers (OIDs) of the issuer.
	IssuerCN               string             // Issuer's common name.
	AlternativeNames       []string           // Subject's alternative names.
	ValidFrom              time.Time          // The initial date at which the certificate is valid.
	ValidTo                time.Time          // The expiration date of the certificate.
	PublicKeyAlgorithm     PublicKey          // The algorithm corresponding to the public key.
	PublicKeyInfo          string             // Some additional info on the public key, depending on the public key's type.
	PublicKeyBits          uint64             // The public key's bit-size.
	PublicKeyStrength      int                // The public key's strength corresponding to the key size.
	SignatureAlgorithm     SignatureAlgorithm // The signature algorithm.
	SignatureHashAlgorithm SignatureHash      // The signature hash algorithm.
	CrlUrls                []string           // URL(s) for the certificate revocation list.
	OcspUrls               []string           // URL(s) for the  online certificate status protocol
	KeyUsage               []string           // Key usage flags set in the certificate.
	ExtendedKeyUsage       []string           // Extended key usage flags set in the certificate.
	BasicConstraintsValid  bool               // Indicates whether Ca and MaxPathLen is valid. All three fields belong to the "basic constraint extension"
	Ca                     bool               // Indicates whether the certificate is of a CA.
	MaxPathLength          int                // Maximum number of non-self-issued intermediate certificates that follow this certificate (leaf certificate not counting). See also: http://www.pkiglobe.org/
	Sha1Fingerprint        string             // SHA1 fingerprint of the certificate.
}

type Chain struct {
	Certificates  []*Certificate // Certificates of this specific deployment
	ValidatedBy   []string       // Name(s) of the trust store(s) that successfully validated this deployment
	HasValidOrder bool           // Indicates whether the certificate chain was sent in valid order
}

type Cipher struct {
	Id                  string
	IanaName            string
	OpensslName         string
	Protocol            Protocol       // SSL/TLS version used.
	KeyExchange         KeyExchange    // The key exchange algorithm.
	KeyExchangeBits     int            // The encryption's key bit-size - only set if ephemeral key exchange or export cipher.
	KeyExchangeStrength int            // The encryption's strength corresponding to the key size - only set if ephemeral key exchange or export cipher.
	KeyExchangeInfo     []string       // Additional info on the key exchange - only set if ephemeral key exchange
	ForwardSecrecy      bool           // Set if the key exchange algorithm supports forward secrecy.
	Authentication      Authentication // The authentication algorithm.
	Encryption          Encryption     // The encryption algorithm.
	EncryptionMode      EncryptionMode // The encryption's mode.
	EncryptionBits      int            // The encryption's key bit-size.
	EncryptionStrength  int            // The encryption's strength corresponding to the key size.
	BlockCipher         bool           // Indicates whether the encryption method is a block cipher.
	BlockSize           int            // The encryption's block size if it is a block cipher.
	StreamCipher        bool           // Indicates whether the encryption method is a stream cipher.
	Mac                 Mac            // The message authentication code algorithm.
	MacBits             int            // The mac's digest size in bits.
	MacStrength         int            // The mac's strength corresponding to the digest size.
	Prf                 Prf            // The pseudo-random function family algorithm (if any).
	PrfBits             int            // The prf's digest size in bits.
	PrfStrength         int            // The prf's strength corresponding to the digest size.
	Export              bool           // Indicates whether the cipher suite is an old export cipher suite.
	Draft               bool           // Indicates whether the cipher suite is a draft.
}

type CipherInfo struct {
	Id          string         `json:"cipher_suite"` // Cipher suite id
	OpensslName string         `json:"openssl_name"` // OpenSSL name of the cipher (SSLyze uses it)
	IanaName    string         `json:"iana_name"`    // IANA name
	Kx          KeyExchange    `json:"kx"`           // Key exchange protocol
	Au          Authentication `json:"au"`           // Key exchange authentication
	Enc         Encryption     `json:"enc"`          // (Bulk) encryption algorithm
	EncBits     int            `json:"enc_bits"`     //
	EncMode     EncryptionMode `json:"enc_mode"`     //
	Mac         Mac            `json:"mac"`          // Message authentication code algorithm
	Prf         Prf            `json:"prf"`          // Pseudorandom function family if existing
	Export      bool           `json:"export"`       // export indicator, if the string is not empty it's an exportable cipher
}

type Curve string

type Curves struct {
	SupportedCurves        []EllipticCurve // The curves that the target accepts
	RejectedCurves         []EllipticCurve // The curves that the target rejects
	SupportEcdhKeyExchange bool            // Indicates whether the target supports ECDH Key Exchange
}

type Data struct {
	Vhost    string             // The target's hostname
	Ciphers  map[string]*Cipher // The target's supported cipher suites. Key format: "protocol|cipher_id"
	Chains   []*Chain           // The target's certificate chains
	Settings *Settings          // The target's SSL/TLS configuration details
	Issues   *Issues            // The target's identified security concerns and vulnerabilities
	Curves   *Curves            // The target's supported or rejected elliptic curves
}

type EllipticCurve struct {
	Name       string
	OpenSslNid int
}

type Encryption uint8

type EncryptionMode uint8

type Issues struct {
	// Any 'true' value indicates a vulnerability, they all should be false!
	LowEncryptionStrength   bool // Indicates whether the minimum of encryption strength is lower than 128 bit.
	AnyChainInvalid         bool // Indicates whether any certificate chain is invalid.
	AnyChainInvalidOrder    bool // Indicates whether any certificate chain has an invalid order.
	ClientRenegotiationDos  bool // Indicates whether the server is vulnerable to client renegotiation DOS.
	CcsInjection            bool // 								(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224)
	EarlyDataSupported      bool // Early data can have a negative impact if session management is not implemented carefully.
	NoPerfectForwardSecrecy bool // If this is set, the server supports at least one cipher suite that does not provide prefect forward secrecy.
	Sslv2Enabled            bool // Indicates the presence of at least one SSLv2 cipher suite.
	Sslv3Enabled            bool // Indicates the presence of at least one SSLv3 cipher suite.
	Tlsv1_0Enabled          bool // Indicates the presence of at least one TLS 1.0 cipher suite.
	Tlsv1_1Enabled          bool // Indicates the presence of at least one TLS 1.1 cipher suite.
	ExportSuite             bool // Indicates whether the server supports an export cipher suite.
	DraftSuite              bool // Indicates whether the server supports a draft cipher suite.
	Md2Enabled              bool // Indicates the presence of at least one cipher suite with MD2 mac (/prf).
	Md5Enabled              bool // Indicates the presence of at least one cipher suite with MD5 mac (/prf).
	Rc4Enabled              bool // Indicates the presence of at least one cipher suite with RC4 encryption.
	Sha1Enabled             bool // Indicates the presence of at least one cipher suite with SHA1 mac (/prf).
	Beast                   bool // 								(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389)
	Crime                   bool // True if TLS compression is supported by the server, thereby enabling the CRIME attack. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4929)
	Drown                   bool // https://drownattack.com/ 		(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800)
	Freak                   bool // https://freakattack.com			(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204)
	Heartbleed              bool // http://heartbleed.com/			(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160)
	Logjam                  bool // https://weakdh.org/logjam.html	(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000) (Currently only export ciphers are tested)
	Lucky13                 bool // 								(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169)
	Poodle                  bool // 								(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8730)
	Robot                   bool // https://robotattack.org/
	Sweet32                 bool // https://sweet32.info/ 			(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183)
}

type KeyExchange uint8

type Mac uint8

type Prf uint8

type Protocol uint8

type PublicKey uint8

type Result struct {
	Data      []*Data
	Status    string // Final scan status (success or graceful error). Should be stored along with the scan results.
	Exception bool   // Indicates if something went wrong badly and results shall be discarded. This should never be

}

type Scanner struct {
	Label    string
	Started  time.Time
	Finished time.Time
	// contains filtered or unexported fields
}

type Settings struct {
	// Any 'false' value indicates place for improvement, ideally they would be true!
	LowestProtocol               Protocol // The lowest SSL / TLS version that is supported by the server.
	MinStrength                  int      // The minimum of EncryptionStrength, MacStrength(/PrfStrength) and PublicKeyStrength across all ciphers and certificates.
	Ems                          bool     // Extended Master Secret to prevent triple handshake and related TLS attacks
	TlsFallbackScsv              bool     // TLS_FALLBACK_SCSV mechanism to prevent downgrade attacks
	SecureRenegotiation          bool     // Indicates whether the server supports secure renegotiation.
	SessionResumptionWithId      bool     // If set a session resumption using IDs is possible.
	SessionResumptionWithTickets bool     // If set a session resumption using session tickets is possible.
	IsCompliantToMozillaConfig   bool     // https://ssl-config.mozilla.org/    Check if the server's SSL config complies with the recommended one from Mozilla
}

type SignatureAlgorithm uint8

type SignatureHash uint8