utils

package
v0.31.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 30, 2026 License: MIT Imports: 10 Imported by: 0

Documentation ¶

Index ¶

Constants ¶

View Source 
const (
	DefaultMaxConcurrency = 20
	DefaultTLS13Tries     = 10
)

Variables ¶

View Source 
var AllCipherSuites = []CipherSuite{
	{tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_RSA_WITH_3DES_EDE_CBC_SHA"},
	{tls.TLS_RSA_WITH_AES_128_CBC_SHA, "TLS_RSA_WITH_AES_128_CBC_SHA"},
	{tls.TLS_RSA_WITH_AES_256_CBC_SHA, "TLS_RSA_WITH_AES_256_CBC_SHA"},
	{tls.TLS_RSA_WITH_AES_128_GCM_SHA256, "TLS_RSA_WITH_AES_128_GCM_SHA256"},
	{tls.TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS_RSA_WITH_AES_256_GCM_SHA384"},
	{tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"},
	{tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"},
	{tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"},
	{tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"},
	{tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"},
	{tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"},
	{tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"},
	{tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
	{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"},
	{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"},
	{tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"},
	{tls.TLS_AES_128_GCM_SHA256, "TLS_AES_128_GCM_SHA256"},
	{tls.TLS_AES_256_GCM_SHA384, "TLS_AES_256_GCM_SHA384"},
	{tls.TLS_CHACHA20_POLY1305_SHA256, "TLS_CHACHA20_POLY1305_SHA256"},
}

AllCipherSuites contains the cipher suites actively offered by TLS 1.0-1.2 probing. Some legacy suites remain classified below for negotiated evidence and policy output, but are not actively offered because Go and CodeQL treat them as insecure client configurations.

View Source 
var CipherClassification = map[string]string{
	"TLS_RSA_WITH_RC4_128_SHA":                "🔴 INSECURE",
	"TLS_RSA_WITH_3DES_EDE_CBC_SHA":           "🔴 INSECURE",
	"TLS_RSA_WITH_AES_128_CBC_SHA":            "🟠 WEAK",
	"TLS_RSA_WITH_AES_256_CBC_SHA":            "🟠 WEAK",
	"TLS_RSA_WITH_AES_128_CBC_SHA256":         "🟠 WEAK",
	"TLS_RSA_WITH_AES_128_GCM_SHA256":         "🟢 SECURE",
	"TLS_RSA_WITH_AES_256_GCM_SHA384":         "🟢 SECURE",
	"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA":        "🔴 INSECURE",
	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":    "🟡 ACCEPTABLE",
	"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA":    "🟡 ACCEPTABLE",
	"TLS_ECDHE_RSA_WITH_RC4_128_SHA":          "🔴 INSECURE",
	"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA":     "🔴 INSECURE",
	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":      "🟡 ACCEPTABLE",
	"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":      "🟡 ACCEPTABLE",
	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": "🟢 SECURE",
	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":   "🟢 SECURE",
	"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": "🟢 SECURE",
	"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": "🟢 SECURE",
	"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":   "🟢 SECURE",
	"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":   "🟢 SECURE",
	"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305":  "🟢 MODERN",
	"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305":    "🟢 MODERN",
	"TLS_AES_128_GCM_SHA256":                  "🟢 MODERN",
	"TLS_AES_256_GCM_SHA384":                  "🟢 MODERN",
	"TLS_CHACHA20_POLY1305_SHA256":            "🟢 MODERN",
}
View Source 
var CipherSeverityByName = map[string]CipherSeverity{
	"TLS_RSA_WITH_RC4_128_SHA":                CipherSeverityInsecure,
	"TLS_RSA_WITH_3DES_EDE_CBC_SHA":           CipherSeverityInsecure,
	"TLS_RSA_WITH_AES_128_CBC_SHA":            CipherSeverityWeak,
	"TLS_RSA_WITH_AES_256_CBC_SHA":            CipherSeverityWeak,
	"TLS_RSA_WITH_AES_128_CBC_SHA256":         CipherSeverityWeak,
	"TLS_RSA_WITH_AES_128_GCM_SHA256":         CipherSeveritySecure,
	"TLS_RSA_WITH_AES_256_GCM_SHA384":         CipherSeveritySecure,
	"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA":        CipherSeverityInsecure,
	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":    CipherSeverityAcceptable,
	"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA":    CipherSeverityAcceptable,
	"TLS_ECDHE_RSA_WITH_RC4_128_SHA":          CipherSeverityInsecure,
	"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA":     CipherSeverityInsecure,
	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":      CipherSeverityAcceptable,
	"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":      CipherSeverityAcceptable,
	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": CipherSeveritySecure,
	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":   CipherSeveritySecure,
	"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": CipherSeveritySecure,
	"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": CipherSeveritySecure,
	"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":   CipherSeveritySecure,
	"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":   CipherSeveritySecure,
	"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305":  CipherSeverityModern,
	"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305":    CipherSeverityModern,
	"TLS_AES_128_GCM_SHA256":                  CipherSeverityModern,
	"TLS_AES_256_GCM_SHA384":                  CipherSeverityModern,
	"TLS_CHACHA20_POLY1305_SHA256":            CipherSeverityModern,
}

CipherSeverityByName drives policy decisions; CipherClassification is only the human-facing display label used in reports.

View Source 
var TLSVersions = map[uint16]string{
	tls.VersionTLS10: "TLS 1.0",
	tls.VersionTLS11: "TLS 1.1",
	tls.VersionTLS12: "TLS 1.2",
	tls.VersionTLS13: "TLS 1.3",
}

Functions ¶

func CipherClassificationForVersion ¶ added in v0.9.3 

func CipherClassificationForVersion(version uint16, name string) (string, bool)

func ClearScreen ¶ 

func ClearScreen()

func ClearScreenTo ¶ added in v0.8.7 

func ClearScreenTo(w io.Writer)

func FilterTLSVersions ¶ 

func FilterTLSVersions(minVersion uint16) []uint16

func IsCipherSuiteCompatibleWith ¶ 

func IsCipherSuiteCompatibleWith(version uint16, id uint16) bool

func IsLegacyCBCForVersion ¶ added in v0.9.3 

func IsLegacyCBCForVersion(version uint16, name string) bool

func TLSVersionToUint16 ¶ 

func TLSVersionToUint16(ver string) uint16

func UniqueStrings ¶ 

func UniqueStrings(input []string) []string

Types ¶

type CertInfo ¶ 

type CertInfo struct {
	CommonName string
	PEM        string
}

func ExtractCertInfos ¶ 

func ExtractCertInfos(certs []*x509.Certificate) []CertInfo

type CipherSeverity ¶ added in v0.8.12 

type CipherSeverity string
const (
	CipherSeverityInsecure   CipherSeverity = "insecure"
	CipherSeverityWeak       CipherSeverity = "weak"
	CipherSeverityAcceptable CipherSeverity = "acceptable"
	CipherSeveritySecure     CipherSeverity = "secure"
	CipherSeverityModern     CipherSeverity = "modern"
	CipherSeverityUnknown    CipherSeverity = "unknown"
)

func CipherSuiteSeverity ¶ added in v0.8.12 

func CipherSuiteSeverity(name string) CipherSeverity

func CipherSuiteSeverityForVersion ¶ added in v0.9.3 

func CipherSuiteSeverityForVersion(version uint16, name string) CipherSeverity

type CipherSuite ¶ 

type CipherSuite struct {
	ID   uint16
	Name string
}

Source Files ¶

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.