policy

Documentation

Overview

Package policy evaluates TLS scan evidence against built-in and configurable policy gates.

The modern policy is intentionally conservative: legacy protocol support, weak or unclassified cipher evidence, invalid certificates and expired certificates fail the policy. Callers can also require or forbid TLS versions and ALPN protocols, and can enforce minimum certificate key size or validity windows.

Policy results are structured so CLI, JSON, SARIF and JUnit output can share the same failure evidence.

Index

• Constants
• func ParseALPNProtocols(value string) []string
• func ParseFailOn(value string) []string
• func ParseTLSVersions(value string) ([]uint16, error)
• func RequiresCipherProbe(config Config) bool
• func ValidateConfig(config Config) error
• type Config
• type Failure
• type Result
  • func Evaluate(results []scan.TLSScanResult, config Config, now time.Time) Result

Constants

const (
	NameNone   = ""
	NameModern = "modern"

	CheckLegacyTLS   = "legacy-tls"
	CheckWeakCipher  = "weak-cipher"
	CheckInvalidCert = "invalid-cert"
	CheckExpiredCert = "expired-cert"

	CheckRequiredTLS    = "required-tls"
	CheckForbiddenTLS   = "forbidden-tls"
	CheckRequiredALPN   = "required-alpn"
	CheckForbiddenALPN  = "forbidden-alpn"
	CheckMinCertKeyBits = "min-cert-key-bits"
	CheckMinCertDays    = "min-cert-days"
)

Functions

func ParseALPNProtocols

func ParseALPNProtocols(value string) []string

func ParseFailOn

func ParseFailOn(value string) []string

func ParseTLSVersions

func ParseTLSVersions(value string) ([]uint16, error)

func RequiresCipherProbe

func RequiresCipherProbe(config Config) bool

func ValidateConfig

func ValidateConfig(config Config) error

Types

type Config

type Config struct {
	Name                       string
	FailOn                     []string
	RequiredTLSVersions        []uint16
	ForbiddenTLSVersions       []uint16
	RequiredALPNProtocols      []string
	ForbiddenALPNProtocols     []string
	MinCertificateKeyBits      int
	MinCertificateValidityDays int
}

type Failure

type Failure struct {
	Check   string `json:"check"`
	Version string `json:"version,omitempty"`
	Message string `json:"message"`
}

type Result

type Result struct {
	Enabled  bool      `json:"enabled"`
	Name     string    `json:"name,omitempty"`
	Passed   bool      `json:"passed"`
	Failures []Failure `json:"failures,omitempty"`
}

func Evaluate

func Evaluate(results []scan.TLSScanResult, config Config, now time.Time) Result