tls

Documentation

Overview

Package tls runs the modern TLS probe — protocol enumeration, cipher enumeration per legacy protocol, certificate-chain extraction with system-root validation, OCSP-stapling presence and presence-based weakness heuristics. SSLv2 and SSLv3 are handled by dedicated raw-probe packages (internal/sslv2, internal/sslv3).

Index

• func DeriveWeaknesses(protocols []scan.ProtocolSupport, ciphers []scan.Cipher, serverHeader string) []scan.VulnerabilityFinding
• func Probe(ctx context.Context, target *safehttp.Target) *scan.TLSReport

Functions

func DeriveWeaknesses

func DeriveWeaknesses(protocols []scan.ProtocolSupport, ciphers []scan.Cipher, serverHeader string) []scan.VulnerabilityFinding

DeriveWeaknesses turns the observed TLS protocols + ciphers and the HTTP Server header into a list of presence-based vulnerability findings. Active-probing-only weaknesses are emitted as info-level placeholders so the report stays exhaustive.

The function is called by the scan orchestrator after both the TLS and headers probes complete, because Heartbleed and Ticketbleed need the HTTP Server header to fingerprint the running software.

func Probe

func Probe(ctx context.Context, target *safehttp.Target) *scan.TLSReport

Probe runs the full modern-TLS probe against target and returns a partially-populated TLSReport. The Grade and Scores fields are left zero — they are filled in by the scoring engine in Phase 6.