ssl

type Authentication uint8

type CertDeployment struct {
	Certificates  []*Certificate // Certificates of this specific deployment
	ValidatedBy   []string       // Name(s) of the trust store(s) that successfully validated this deployment
	HasValidOrder bool           // Indicates whether the certificate chain was sent in valid order
}

type Certificate struct {
	Type                   string             // 'leaf' / 'intermediate' / 'root'
	Version                int                // Version of the X.509 standard.
	Serial                 big.Int            // Serial number chosen by the CA (not necessarily globally unique / random).
	Subject                []string           // Object Identifiers (OIDs) of the subject.
	SubjectCN              string             // Subject's common name.
	Issuer                 []string           // Object Identifiers (OIDs) of the issuer.
	IssuerCN               string             // Issuer's common name.
	AlternativeNames       []string           // Subject's alternative names.
	ValidFrom              time.Time          // The initial date at which the certificate is valid.
	ValidTo                time.Time          // The expiration date of the certificate.
	PublicKeyAlgorithm     PublicKey          // The algorithm corresponding to the public key.
	PublicKeyInfo          string             // Some additional info on the public key, depending on the public key's type.
	PublicKeyBits          uint64             // The public key's bit-size.
	PublicKeyStrength      int                // The public key's strength corresponding to the key size.
	SignatureAlgorithm     SignatureAlgorithm // The signature algorithm.
	SignatureHashAlgorithm SignatureHash      // The signature hash algorithm.
	CrlUrls                []string           // URL(s) for the certificate revocation list.
	OcspUrls               []string           // URL(s) for the  online certificate status protocol
	KeyUsage               []string           // Key usage flags set in the certificate.
	ExtendedKeyUsage       []string           // Extended key usage flags set in the certificate.
	BasicConstraintsValid  bool               // Indicates whether Ca and MaxPathLen is valid. All three fields belong to the "basic constraint extension"
	Ca                     bool               // Indicates whether the certificate is of a CA.
	MaxPathLength          int                // Maximum number of non-self-issued intermediate certificates that follow this certificate (leaf certificate not counting). See also: http://www.pkiglobe.org/
	Sha1Fingerprint        string             // SHA1 fingerprint of the certificate.
}

type Cipher struct {
	Id                  string
	IanaName            string
	OpensslName         string
	Protocol            Protocol       // SSL/TLS version used.
	KeyExchange         KeyExchange    // The key exchange algorithm.
	KeyExchangeBits     int            // The encryption's key bit-size - only set if ephemeral key exchange or export cipher.
	KeyExchangeStrength int            // The encryption's strength corresponding to the key size - only set if ephemeral key exchange or export cipher.
	KeyExchangeInfo     []string       // Additional info on the key exchange - only set if ephemeral key exchange
	ForwardSecrecy      bool           // Set if the key exchange algorithm supports forward secrecy.
	Authentication      Authentication // The authentication algorithm.
	Encryption          Encryption     // The encryption algorithm.
	EncryptionMode      EncryptionMode // The encryption's mode.
	EncryptionBits      int            // The encryption's key bit-size.
	EncryptionStrength  int            // The encryption's strength corresponding to the key size.
	BlockCipher         bool           // Indicates whether the encryption method is a block cipher.
	BlockSize           int            // The encryption's block size if it is a block cipher.
	StreamCipher        bool           // Indicates whether the encryption method is a stream cipher.
	Mac                 Mac            // The message authentication code algorithm.
	MacBits             int            // The mac's digest size in bits.
	MacStrength         int            // The mac's strength corresponding to the digest size.
	Prf                 Prf            // The pseudo-random function family algorithm (if any).
	PrfBits             int            // The prf's digest size in bits.
	PrfStrength         int            // The prf's strength corresponding to the digest size.
	Export              bool           // Indicates whether the cipher suite is an old export cipher suite.
	Draft               bool           // Indicates whether the cipher suite is a draft.
}

type CipherInfo struct {
	Id          string         `json:"cipher_suite"` // Cipher suite id
	OpensslName string         `json:"openssl_name"` // OpenSSL name of the cipher (SSLyze uses it)
	IanaName    string         `json:"iana_name"`    // IANA name
	Kx          KeyExchange    `json:"kx"`           // Key exchange protocol
	Au          Authentication `json:"au"`           // Key exchange authentication
	Enc         Encryption     `json:"enc"`          // (Bulk) encryption algorithm
	EncBits     int            `json:"enc_bits"`     //
	EncMode     EncryptionMode `json:"enc_mode"`     //
	Mac         Mac            `json:"mac"`          // Message authentication code algorithm
	Prf         Prf            `json:"prf"`          // Pseudorandom function family if existing
	Export      bool           `json:"export"`       // export indicator, if the string is not empty it's an exportable cipher
}

type Curve string

type Data struct {
	Vhost                 string             // The target's hostname
	Issues                *Issues            // Cipher basic info
	Ciphers               map[string]*Cipher // Map of [protocol + "|" + cipher id] = cipher
	CertDeployments       []*CertDeployment  // A server can have multiple certificate chains, e.g. in order to support older clients. Unfortunately SSLyze does not return any information on which chain is linked to which client (/Cipher/Server name used for SNI...)
	EllipticCurves        *EllipticCurves    // Information about the elliptic curves that the target supports or rejects
	ComplianceTestDetails string             // Details to the check against Mozilla's SSL config. Each target will have its own IsCompliant flag, but this variable contains further details of the check.
}

type EllipticCurve struct {
	Name       string
	OpenSSLnid int
}

type EllipticCurves struct {
	RejectedCurves         []EllipticCurve // The curves that the target rejects
	SupportedCurves        []EllipticCurve // The curves that the target accepts
	SupportECDHKeyExchange bool            // Indicates whether the target supports ECDH Key Exchange
}

type Encryption uint8

type EncryptionMode uint8

type Issues struct {
	// ATTENTION: When changing any of the following structs, change the compareResultData function accordingly!
	AnyChainInvalid              bool     // Indicates whether any certificate chain is invalid.
	AnyChainInvalidOrder         bool     // Indicates whether any certificate chain has an invalid order.
	LowestProtocol               Protocol // The lowest SSL / TLS version that is supported by the server.
	MinStrength                  int      // The minimum of EncryptionStrength, MacStrength(/PrfStrength) and PublicKeyStrength across all ciphers and certificates.
	InsecureRenegotiation        bool     // Indicates whether the server supports secure renegotiation.
	AcceptsClientRenegotiation   bool     // If set renegotiation can be initialized by the client.
	InsecureClientRenegotiation  bool     // Combination of InsecureRenegotiation and AcceptsClientRenegotiation.
	SessionResumptionWithId      bool     // If set a session resumption using IDs is possible.
	SessionResumptionWithTickets bool     // If set a session resumption using session tickets is possible.
	NoPerfectForwardSecrecy      bool     // If this is set, the server supports at least one cipher suite that does not provide prefect forward secrecy.
	Compression                  bool     // If set compression for the payload is available (leading to CRIME vulnerability).
	ExportSuite                  bool     // Indicates whether the server supports an export cipher suite.
	DraftSuite                   bool     // Indicates whether the server supports a draft cipher suite.
	Sslv2Enabled                 bool     // Indicates the presence of at least one SSLv2 cipher suite.
	Sslv3Enabled                 bool     // Indicates the presence of at least one SSLv3 cipher suite.
	Rc4Enabled                   bool     // Indicates the presence of at least one cipher suite with RC4 encryption.
	Md2Enabled                   bool     // Indicates the presence of at least one cipher suite with MD2 mac (/prf).
	Md5Enabled                   bool     // Indicates the presence of at least one cipher suite with MD5 mac (/prf).
	Sha1Enabled                  bool     // Indicates the presence of at least one cipher suite with SHA1 mac (/prf).
	EarlyDataSupported           bool     // Early data can have a negative impact if session management is not implemented carefully.
	CcsInjection                 bool     // 									(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224)
	Beast                        bool     // 									(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389)
	Heartbleed                   bool     // http://heartbleed.com/				(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160)
	Lucky13                      bool     // 									(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169)
	Poodle                       bool     // 									(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566) (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8730)
	Freak                        bool     // https://freakattack.com			(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204)
	Logjam                       bool     // https://weakdh.org/logjam.html		(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000) (Currently only export ciphers are tested)
	Sweet32                      bool     // https://sweet32.info/ 				(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183)
	Drown                        bool     // https://drownattack.com/ 			(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800)
	IsCompliantToMozillaConfig   bool     // https://ssl-config.mozilla.org/    Check if the server's SSL config complies with the recommended one from Mozilla
}

type KeyExchange uint8

type Mac uint8

type Prf uint8

type Protocol uint8

type PublicKey uint8

type Result struct {
	Data      []*Data
	Status    string // Final scan status (success or graceful error). Should be stored along with the scan results.
	Exception bool   // Indicates if something went wrong badly and results shall be discarded. This should never be

}

type Scanner struct {
	Label    string
	Started  time.Time
	Finished time.Time
	// contains filtered or unexported fields
}

type SignatureAlgorithm uint8

type SignatureHash uint8