ruby-sslyze 0.2.1 → 1.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +6 -4
- data/.travis.yml +15 -7
- data/ChangeLog.md +29 -12
- data/Gemfile +3 -2
- data/LICENSE.txt +1 -1
- data/README.md +5 -5
- data/Rakefile +1 -1
- data/lib/sslyze/cipher_suites.rb +176 -0
- data/lib/sslyze/program.rb +8 -8
- data/lib/sslyze/task.rb +40 -33
- data/lib/sslyze/version.rb +1 -1
- data/lib/sslyze/{certificate/domain_name.rb → x509/domain.rb} +5 -3
- data/lib/sslyze/x509/extension.rb +15 -0
- data/lib/sslyze/x509/extension_set.rb +140 -0
- data/lib/sslyze/x509/extensions.rb +6 -0
- data/lib/sslyze/x509/extensions/basic_constraints.rb +41 -0
- data/lib/sslyze/x509/extensions/certificate_policies.rb +108 -0
- data/lib/sslyze/x509/extensions/crl_distribution_points.rb +47 -0
- data/lib/sslyze/x509/extensions/extended_key_usage.rb +58 -0
- data/lib/sslyze/x509/extensions/key_usage.rb +66 -0
- data/lib/sslyze/x509/extensions/subject_alt_name.rb +144 -0
- data/lib/sslyze/x509/name.rb +194 -0
- data/lib/sslyze/x509/public_key.rb +53 -0
- data/lib/sslyze/xml.rb +26 -37
- data/lib/sslyze/xml/attributes.rb +5 -0
- data/lib/sslyze/xml/attributes/error.rb +30 -0
- data/lib/sslyze/xml/attributes/exception.rb +30 -0
- data/lib/sslyze/xml/attributes/is_supported.rb +29 -0
- data/lib/sslyze/xml/attributes/is_vulnerable.rb +29 -0
- data/lib/sslyze/xml/attributes/title.rb +31 -0
- data/lib/sslyze/xml/certinfo.rb +67 -0
- data/lib/sslyze/xml/certinfo/certificate.rb +202 -0
- data/lib/sslyze/xml/certinfo/certificate_validation.rb +69 -0
- data/lib/sslyze/xml/certinfo/certificate_validation/hostname_validation.rb +54 -0
- data/lib/sslyze/xml/certinfo/certificate_validation/path_validation.rb +84 -0
- data/lib/sslyze/xml/certinfo/certificate_validation/verified_certificate_chain.rb +41 -0
- data/lib/sslyze/xml/certinfo/has_certificates.rb +102 -0
- data/lib/sslyze/xml/certinfo/ocsp_stapling.rb +45 -0
- data/lib/sslyze/xml/certinfo/ocsp_stapling/ocsp_response.rb +87 -0
- data/lib/sslyze/xml/certinfo/received_certificate_chain.rb +48 -0
- data/lib/sslyze/xml/compression.rb +33 -0
- data/lib/sslyze/xml/compression/compression_method.rb +38 -0
- data/lib/sslyze/xml/fallback.rb +34 -0
- data/lib/sslyze/xml/fallback/tls_fallback_scsv.rb +27 -0
- data/lib/sslyze/xml/heartbleed.rb +38 -0
- data/lib/sslyze/xml/heartbleed/openssl_heartbleed.rb +29 -0
- data/lib/sslyze/xml/http_headers.rb +42 -0
- data/lib/sslyze/xml/http_headers/http_public_key_pinning.rb +121 -0
- data/lib/sslyze/xml/http_headers/http_strict_transport_security.rb +59 -0
- data/lib/sslyze/xml/invalid_target.rb +33 -0
- data/lib/sslyze/xml/openssl_ccs.rb +34 -0
- data/lib/sslyze/xml/openssl_ccs/openssl_ccs_injection.rb +26 -0
- data/lib/sslyze/xml/plugin.rb +27 -0
- data/lib/sslyze/xml/protocol.rb +143 -0
- data/lib/sslyze/xml/protocol/cipher_suite.rb +93 -0
- data/lib/sslyze/xml/protocol/cipher_suite/key_exchange.rb +127 -0
- data/lib/sslyze/xml/reneg.rb +28 -0
- data/lib/sslyze/xml/reneg/session_renegotiation.rb +51 -0
- data/lib/sslyze/xml/resum.rb +42 -0
- data/lib/sslyze/xml/resum/session_resumption_with_session_ids.rb +94 -0
- data/lib/sslyze/xml/resum/session_resumption_with_tls_tickets.rb +69 -0
- data/lib/sslyze/xml/resum_rate.rb +30 -0
- data/lib/sslyze/xml/target.rb +371 -0
- data/lib/sslyze/xml/types.rb +19 -0
- data/ruby-sslyze.gemspec +3 -3
- data/spec/spec_helper.rb +2 -4
- data/spec/sslyze.xml +2356 -2580
- data/spec/x509/domain_spec.rb +125 -0
- data/spec/x509/extension_set_spec.rb +208 -0
- data/spec/x509/extension_spec.rb +58 -0
- data/spec/x509/extensions/basic_constraints_spec.rb +41 -0
- data/spec/x509/extensions/certificate_policies_spec.rb +38 -0
- data/spec/x509/extensions/crl_distribution_points_spec.rb +38 -0
- data/spec/x509/extensions/extended_key_usage_spec.rb +58 -0
- data/spec/x509/extensions/key_usage_spec.rb +84 -0
- data/spec/x509/extensions/subject_alt_name_spec.rb +146 -0
- data/spec/x509/name_spec.rb +85 -0
- data/spec/x509/public_key_spec.rb +113 -0
- data/spec/xml/certinfo/certificate_spec.rb +166 -0
- data/spec/xml/certinfo/certificate_validation/hostname_validation_spec.rb +23 -0
- data/spec/xml/certinfo/certificate_validation/path_validation_spec.rb +107 -0
- data/spec/xml/certinfo/certificate_validation/verified_certificate_chain_spec.rb +163 -0
- data/spec/xml/certinfo/certificate_validation_spec.rb +40 -0
- data/spec/xml/certinfo/ocsp_stapling/ocsp_response_spec.rb +61 -0
- data/spec/xml/certinfo/ocsp_stapling_spec.rb +31 -0
- data/spec/xml/certinfo/received_certificate_chain_spec.rb +165 -0
- data/spec/xml/certinfo_spec.rb +45 -0
- data/spec/xml/compression/compression_method_spec.rb +23 -0
- data/spec/xml/compression_spec.rb +23 -0
- data/spec/xml/heartbleed/openssl_heartbleed_spec.rb +17 -0
- data/spec/xml/heartbleed_spec.rb +37 -0
- data/spec/xml/http_headers/http_public_key_pinning_spec.rb +73 -0
- data/spec/xml/http_headers/http_strict_transport_security_spec.rb +107 -0
- data/spec/xml/http_headers_spec.rb +63 -0
- data/spec/xml/invalid_target_spec.rb +23 -0
- data/spec/xml/plugin_examples.rb +14 -0
- data/spec/{key_exchange_spec.rb → xml/protocol/cipher_suite/key_exchange_spec.rb} +9 -3
- data/spec/xml/protocol/cipher_suite_spec.rb +66 -0
- data/spec/xml/protocol_spec.rb +115 -0
- data/spec/xml/reneg/session_renegotiation_spec.rb +23 -0
- data/spec/xml/reneg_spec.rb +35 -0
- data/spec/xml/resum/session_resumption_with_session_ids_spec.rb +103 -0
- data/spec/xml/resum/session_resumption_with_tls_tickets_spec.rb +121 -0
- data/spec/xml/resum_rate_spec.rb +30 -0
- data/spec/xml/resum_spec.rb +47 -0
- data/spec/{target_spec.rb → xml/target_spec.rb} +73 -27
- data/spec/xml_spec.rb +13 -21
- metadata +138 -61
- data/lib/sslyze/cert_info.rb +0 -57
- data/lib/sslyze/certificate.rb +0 -139
- data/lib/sslyze/certificate/extensions.rb +0 -127
- data/lib/sslyze/certificate/extensions/authority_information_access.rb +0 -38
- data/lib/sslyze/certificate/extensions/extension.rb +0 -26
- data/lib/sslyze/certificate/extensions/x509v3_basic_constraints.rb +0 -60
- data/lib/sslyze/certificate/extensions/x509v3_certificate_policies.rb +0 -50
- data/lib/sslyze/certificate/extensions/x509v3_crl_distribution_points.rb +0 -32
- data/lib/sslyze/certificate/extensions/x509v3_extended_key_usage.rb +0 -32
- data/lib/sslyze/certificate/extensions/x509v3_key_usage.rb +0 -50
- data/lib/sslyze/certificate/extensions/x509v3_subject_alternative_name.rb +0 -71
- data/lib/sslyze/certificate/issuer.rb +0 -56
- data/lib/sslyze/certificate/public_key.rb +0 -9
- data/lib/sslyze/certificate/subject.rb +0 -117
- data/lib/sslyze/certificate/subject_public_key_info.rb +0 -53
- data/lib/sslyze/certificate/validity.rb +0 -9
- data/lib/sslyze/certificate_chain.rb +0 -89
- data/lib/sslyze/certificate_validation.rb +0 -70
- data/lib/sslyze/cipher_suite.rb +0 -237
- data/lib/sslyze/invalid_target.rb +0 -35
- data/lib/sslyze/key_exchange.rb +0 -106
- data/lib/sslyze/ocsp_response.rb +0 -87
- data/lib/sslyze/protocol.rb +0 -133
- data/lib/sslyze/target.rb +0 -312
- data/lib/sslyze/types.rb +0 -17
- data/spec/cert_info_spec.rb +0 -29
- data/spec/certificate/subject_name_spec.rb +0 -72
- data/spec/certificate_chain_spec.rb +0 -61
- data/spec/certificate_spec.rb +0 -330
- data/spec/certificate_validation_spec.rb +0 -39
- data/spec/cipher_suite_spec.rb +0 -50
- data/spec/invalid_target_spec.rb +0 -21
- data/spec/issuer_spec.rb +0 -33
- data/spec/ocsp_response_spec.rb +0 -59
- data/spec/protocol_spec.rb +0 -99
- data/spec/subject_public_key_info_spec.rb +0 -35
- data/spec/subject_spec.rb +0 -69
@@ -1,35 +0,0 @@
|
|
1
|
-
module SSLyze
|
2
|
-
#
|
3
|
-
# Represents the `<invalidTarget>` XML element.
|
4
|
-
#
|
5
|
-
class InvalidTarget
|
6
|
-
|
7
|
-
#
|
8
|
-
# Initializes the invalid target.
|
9
|
-
#
|
10
|
-
# @param [Nokogiri::XML::Node] node
|
11
|
-
# The `<invalid>` XML element.
|
12
|
-
#
|
13
|
-
def initialize(node)
|
14
|
-
@node = node
|
15
|
-
end
|
16
|
-
|
17
|
-
#
|
18
|
-
# The host name of the target.
|
19
|
-
#
|
20
|
-
# @return [String]
|
21
|
-
#
|
22
|
-
def host
|
23
|
-
@host ||= @node.text
|
24
|
-
end
|
25
|
-
|
26
|
-
#
|
27
|
-
# The error from the scan.
|
28
|
-
#
|
29
|
-
# @return [String]
|
30
|
-
#
|
31
|
-
def error
|
32
|
-
@ip ||= @node['error']
|
33
|
-
end
|
34
|
-
end
|
35
|
-
end
|
data/lib/sslyze/key_exchange.rb
DELETED
@@ -1,106 +0,0 @@
|
|
1
|
-
module SSLyze
|
2
|
-
#
|
3
|
-
# Key exchange information.
|
4
|
-
#
|
5
|
-
class KeyExchange
|
6
|
-
|
7
|
-
#
|
8
|
-
# Initializes the key exchange information.
|
9
|
-
#
|
10
|
-
# @param [Nokogiri::XML::Node] node
|
11
|
-
# The `<keyExchange>` information.
|
12
|
-
#
|
13
|
-
def initialize(node)
|
14
|
-
@node = node
|
15
|
-
end
|
16
|
-
|
17
|
-
#
|
18
|
-
# @return [String]
|
19
|
-
#
|
20
|
-
def a
|
21
|
-
@a ||= @node['A']
|
22
|
-
end
|
23
|
-
|
24
|
-
#
|
25
|
-
# @return [String]
|
26
|
-
#
|
27
|
-
def b
|
28
|
-
@b ||= @node['B']
|
29
|
-
end
|
30
|
-
|
31
|
-
#
|
32
|
-
# @return [Integer]
|
33
|
-
#
|
34
|
-
def cofactor
|
35
|
-
@cofactor ||= @node['Cofactor'].to_i
|
36
|
-
end
|
37
|
-
|
38
|
-
#
|
39
|
-
# @return [String]
|
40
|
-
#
|
41
|
-
def field_type
|
42
|
-
@field_type ||= @node['Field_Type']
|
43
|
-
end
|
44
|
-
|
45
|
-
#
|
46
|
-
# @return [String]
|
47
|
-
#
|
48
|
-
def generator
|
49
|
-
@generator ||= @node['Generator']
|
50
|
-
end
|
51
|
-
|
52
|
-
#
|
53
|
-
# @return [Symbol]
|
54
|
-
#
|
55
|
-
def generator_type
|
56
|
-
@generator ||= @node['GeneratorType'].to_sym
|
57
|
-
end
|
58
|
-
|
59
|
-
#
|
60
|
-
# @return [Integer]
|
61
|
-
#
|
62
|
-
def group_size
|
63
|
-
@group_size ||= @node['GroupSize'].to_i
|
64
|
-
end
|
65
|
-
|
66
|
-
#
|
67
|
-
# @return [String]
|
68
|
-
#
|
69
|
-
def prime
|
70
|
-
@prime ||= @node['Prime']
|
71
|
-
end
|
72
|
-
|
73
|
-
#
|
74
|
-
# @return [String]
|
75
|
-
#
|
76
|
-
def seed
|
77
|
-
@seed ||= @node['Seed']
|
78
|
-
end
|
79
|
-
|
80
|
-
#
|
81
|
-
# @return [:DH, :ECDHE]
|
82
|
-
#
|
83
|
-
def type
|
84
|
-
@type ||= @node['Type'].to_sym
|
85
|
-
end
|
86
|
-
|
87
|
-
#
|
88
|
-
# Determines if DH key exchange was used.
|
89
|
-
#
|
90
|
-
# @return [Boolean]
|
91
|
-
#
|
92
|
-
def dh?
|
93
|
-
type == :DH
|
94
|
-
end
|
95
|
-
|
96
|
-
#
|
97
|
-
# Determines if ECDHE key exchange was used.
|
98
|
-
#
|
99
|
-
# @return [Boolean]
|
100
|
-
#
|
101
|
-
def ecdhe?
|
102
|
-
type == :ECDHE
|
103
|
-
end
|
104
|
-
|
105
|
-
end
|
106
|
-
end
|
data/lib/sslyze/ocsp_response.rb
DELETED
@@ -1,87 +0,0 @@
|
|
1
|
-
require 'sslyze/types'
|
2
|
-
|
3
|
-
require 'time'
|
4
|
-
|
5
|
-
module SSLyze
|
6
|
-
#
|
7
|
-
# Represents the `<ocspResponse>` XML element.
|
8
|
-
#
|
9
|
-
class OCSPResponse
|
10
|
-
|
11
|
-
include Types
|
12
|
-
|
13
|
-
#
|
14
|
-
# Initializes the OCSP response.
|
15
|
-
#
|
16
|
-
# @param [Nokogiri::XML::Node] node
|
17
|
-
# The `<ocspResponse>` XML element.
|
18
|
-
#
|
19
|
-
def initialize(node)
|
20
|
-
@node = node
|
21
|
-
end
|
22
|
-
|
23
|
-
#
|
24
|
-
# Specifies whether the response was trusted.
|
25
|
-
#
|
26
|
-
# @return [Boolean]
|
27
|
-
#
|
28
|
-
def trusted?
|
29
|
-
Boolean[@node['isTrustedByMozillaCAStore']]
|
30
|
-
end
|
31
|
-
|
32
|
-
#
|
33
|
-
# The response type.
|
34
|
-
#
|
35
|
-
# @return [String]
|
36
|
-
#
|
37
|
-
def type
|
38
|
-
@type ||= @node.at('responseType').inner_text
|
39
|
-
end
|
40
|
-
|
41
|
-
#
|
42
|
-
# The responder ID.
|
43
|
-
#
|
44
|
-
# @return [String]
|
45
|
-
#
|
46
|
-
def responder_id
|
47
|
-
@id ||= @node.at('responderID').inner_text
|
48
|
-
end
|
49
|
-
|
50
|
-
#
|
51
|
-
# The OCSP version.
|
52
|
-
#
|
53
|
-
# @return [Integer]
|
54
|
-
#
|
55
|
-
def version
|
56
|
-
@version ||= @node.at('version').inner_text.to_i
|
57
|
-
end
|
58
|
-
|
59
|
-
#
|
60
|
-
# The response status.
|
61
|
-
#
|
62
|
-
# @return [Symbol]
|
63
|
-
#
|
64
|
-
def status
|
65
|
-
@status ||= @node.at('responseStatus').inner_text.to_sym
|
66
|
-
end
|
67
|
-
|
68
|
-
#
|
69
|
-
# Determines whether the OCSP response was a success.
|
70
|
-
#
|
71
|
-
# @return [Boolean]
|
72
|
-
#
|
73
|
-
def successful?
|
74
|
-
status == :successful
|
75
|
-
end
|
76
|
-
|
77
|
-
#
|
78
|
-
# When the response was produced.
|
79
|
-
#
|
80
|
-
# @return [Time]
|
81
|
-
#
|
82
|
-
def produced_at
|
83
|
-
@produced_at ||= Time.parse(@node.at('producedAt').inner_text)
|
84
|
-
end
|
85
|
-
|
86
|
-
end
|
87
|
-
end
|
data/lib/sslyze/protocol.rb
DELETED
@@ -1,133 +0,0 @@
|
|
1
|
-
require 'sslyze/cipher_suite'
|
2
|
-
|
3
|
-
module SSLyze
|
4
|
-
#
|
5
|
-
# Represents the `<sslv2>`, `<sslv3>`, `<tls1>`, `<tls1_1>`, `<tlsv1_2>`
|
6
|
-
# XML elements.
|
7
|
-
#
|
8
|
-
class Protocol
|
9
|
-
|
10
|
-
# SSL protocol name.
|
11
|
-
#
|
12
|
-
# @return [Symbol]
|
13
|
-
attr_reader :name
|
14
|
-
|
15
|
-
#
|
16
|
-
# Initializes the protocol.
|
17
|
-
#
|
18
|
-
# @param [Nokogiri::XML::Node] node
|
19
|
-
# The XML element.
|
20
|
-
#
|
21
|
-
def initialize(node)
|
22
|
-
@node = node
|
23
|
-
@name = @node.name.to_sym
|
24
|
-
end
|
25
|
-
|
26
|
-
#
|
27
|
-
# Descriptive title.
|
28
|
-
#
|
29
|
-
# @return [String]
|
30
|
-
#
|
31
|
-
def title
|
32
|
-
@title ||= @node['title']
|
33
|
-
end
|
34
|
-
|
35
|
-
#
|
36
|
-
# @raise [NotImplemnetedError]
|
37
|
-
#
|
38
|
-
# @todo figure out what `<errors />` contains.
|
39
|
-
#
|
40
|
-
def each_error
|
41
|
-
raise(NotImplementedError,"#{__method__} not implemented")
|
42
|
-
end
|
43
|
-
|
44
|
-
#
|
45
|
-
# Enumerates over every rejected cipher suite.
|
46
|
-
#
|
47
|
-
# @yield [cipher_suite]
|
48
|
-
#
|
49
|
-
# @yieldparam [CipherSuite] cipher_suite
|
50
|
-
#
|
51
|
-
# @return [Enumerator]
|
52
|
-
#
|
53
|
-
def each_rejected_cipher_suite
|
54
|
-
return enum_for(__method__) unless block_given?
|
55
|
-
|
56
|
-
@node.search('rejectedCipherSuites/cipherSuite').each do |cipher_suite|
|
57
|
-
yield CipherSuite.new(cipher_suite)
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
#
|
62
|
-
# The rejected cipher suites.
|
63
|
-
#
|
64
|
-
# @return [Array<CipherSuite>]
|
65
|
-
#
|
66
|
-
def rejected_cipher_suites
|
67
|
-
each_rejected_cipher_suite.to_a
|
68
|
-
end
|
69
|
-
|
70
|
-
#
|
71
|
-
# Enumerates over every accepted cipher suite.
|
72
|
-
#
|
73
|
-
# @yield [cipher_suite]
|
74
|
-
#
|
75
|
-
# @yieldparam [CipherSuite] cipher_suite
|
76
|
-
#
|
77
|
-
# @return [Enumerator]
|
78
|
-
#
|
79
|
-
def each_accepted_cipher_suite
|
80
|
-
return enum_for(__method__) unless block_given?
|
81
|
-
|
82
|
-
@node.search('acceptedCipherSuites/cipherSuite').each do |cipher_suite|
|
83
|
-
yield CipherSuite.new(cipher_suite)
|
84
|
-
end
|
85
|
-
end
|
86
|
-
|
87
|
-
#
|
88
|
-
# The accepted cipher suites.
|
89
|
-
#
|
90
|
-
# @return [Array<CipherSuite>]
|
91
|
-
#
|
92
|
-
def accepted_cipher_suites
|
93
|
-
each_accepted_cipher_suite.to_a
|
94
|
-
end
|
95
|
-
|
96
|
-
#
|
97
|
-
# Enumerates over every preferred cipher suite.
|
98
|
-
#
|
99
|
-
# @yield [cipher_suite]
|
100
|
-
#
|
101
|
-
# @yieldparam [CipherSuite] cipher_suite
|
102
|
-
#
|
103
|
-
# @return [Enumerator]
|
104
|
-
#
|
105
|
-
def each_preferred_cipher_suite
|
106
|
-
return enum_for(__method__) unless block_given?
|
107
|
-
|
108
|
-
@node.search('preferredCipherSuites/cipherSuite').each do |cipher_suite|
|
109
|
-
yield CipherSuite.new(cipher_suite)
|
110
|
-
end
|
111
|
-
end
|
112
|
-
|
113
|
-
#
|
114
|
-
# The preferred cipher suites.
|
115
|
-
#
|
116
|
-
# @return [Array<CipherSuite>]
|
117
|
-
#
|
118
|
-
def preferred_cipher_suites
|
119
|
-
each_preferred_cipher_suite.to_a
|
120
|
-
end
|
121
|
-
|
122
|
-
#
|
123
|
-
# Determines whether the protocol is supported.
|
124
|
-
#
|
125
|
-
# @return [Boolean]
|
126
|
-
# Specifies whether any cipher suite was accepted.
|
127
|
-
#
|
128
|
-
def supported?
|
129
|
-
each_accepted_cipher_suite.any?
|
130
|
-
end
|
131
|
-
|
132
|
-
end
|
133
|
-
end
|
data/lib/sslyze/target.rb
DELETED
@@ -1,312 +0,0 @@
|
|
1
|
-
require 'sslyze/types'
|
2
|
-
require 'sslyze/cert_info'
|
3
|
-
require 'sslyze/protocol'
|
4
|
-
|
5
|
-
module SSLyze
|
6
|
-
#
|
7
|
-
# Represents the `<target>` XML element.
|
8
|
-
#
|
9
|
-
class Target
|
10
|
-
|
11
|
-
include Types
|
12
|
-
|
13
|
-
#
|
14
|
-
# Initializes the target.
|
15
|
-
#
|
16
|
-
# @param [Nokogiri::XML::Node] node
|
17
|
-
# The `<target>` XML element.
|
18
|
-
#
|
19
|
-
def initialize(node)
|
20
|
-
@node = node
|
21
|
-
end
|
22
|
-
|
23
|
-
#
|
24
|
-
# The host name of the target.
|
25
|
-
#
|
26
|
-
# @return [String]
|
27
|
-
#
|
28
|
-
def host
|
29
|
-
@host ||= @node['host']
|
30
|
-
end
|
31
|
-
|
32
|
-
#
|
33
|
-
# The IP address of the target.
|
34
|
-
#
|
35
|
-
# @return [String]
|
36
|
-
#
|
37
|
-
def ip
|
38
|
-
@ip ||= @node['ip']
|
39
|
-
end
|
40
|
-
|
41
|
-
#
|
42
|
-
# The port number that was scanned.
|
43
|
-
#
|
44
|
-
# @return [Integer]
|
45
|
-
#
|
46
|
-
def port
|
47
|
-
@port ||= @node['port'].to_i
|
48
|
-
end
|
49
|
-
|
50
|
-
#
|
51
|
-
# Certificate information.
|
52
|
-
#
|
53
|
-
# @return [CertInfo, nil]
|
54
|
-
#
|
55
|
-
def cert_info
|
56
|
-
@cert_info ||= if (certinfo = @node.at('certinfo'))
|
57
|
-
CertInfo.new(certinfo)
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
#
|
62
|
-
# Which compression algorithms are supported.
|
63
|
-
#
|
64
|
-
# @return [Hash{Symbol => Boolean}]
|
65
|
-
# The algorithm name and support status.
|
66
|
-
#
|
67
|
-
def compression
|
68
|
-
unless @compression
|
69
|
-
@compression = {}
|
70
|
-
|
71
|
-
@node.search('compression/compressionMethod').map do |compression|
|
72
|
-
type = compression['type'].downcase.to_sym
|
73
|
-
supported = Boolean[compression['isSupported']]
|
74
|
-
|
75
|
-
@compression[type] = supported
|
76
|
-
end
|
77
|
-
end
|
78
|
-
|
79
|
-
return @compression
|
80
|
-
end
|
81
|
-
|
82
|
-
#
|
83
|
-
# Specifies whether the service was vulnerable to Heartbleed.
|
84
|
-
#
|
85
|
-
# @return [Boolean, nil]
|
86
|
-
#
|
87
|
-
def heartbleed?
|
88
|
-
if (heartbleed = @node.at('heartbleed/openSslHeartbleed'))
|
89
|
-
Boolean[heartbleed['isVulnerable']]
|
90
|
-
end
|
91
|
-
end
|
92
|
-
|
93
|
-
#
|
94
|
-
# Represents the `<sessionRenegotiation>` XML element.
|
95
|
-
#
|
96
|
-
class SessionRenegotiation < Struct.new(:client_initiated, :secure)
|
97
|
-
|
98
|
-
def client_initiated?
|
99
|
-
client_initiated == true
|
100
|
-
end
|
101
|
-
|
102
|
-
def secure?
|
103
|
-
secure == true
|
104
|
-
end
|
105
|
-
|
106
|
-
end
|
107
|
-
|
108
|
-
#
|
109
|
-
# Specifies whether the service supports Session Renegotiation.
|
110
|
-
#
|
111
|
-
# @return [SessionRenegotiation, nil]
|
112
|
-
#
|
113
|
-
def session_renegotiation
|
114
|
-
@session_renegotiation ||= (
|
115
|
-
if (sessionRenegotiation = @node.at('reneg/sessionRenegotiation'))
|
116
|
-
|
117
|
-
SessionRenegotiation.new(
|
118
|
-
Boolean[sessionRenegotiation['canBeClientInitiated']],
|
119
|
-
Boolean[sessionRenegotiation['isSecure']]
|
120
|
-
)
|
121
|
-
end
|
122
|
-
)
|
123
|
-
end
|
124
|
-
|
125
|
-
#
|
126
|
-
# SSLv2 protocol information.
|
127
|
-
#
|
128
|
-
# @return [Protocol, nil]
|
129
|
-
#
|
130
|
-
def sslv2
|
131
|
-
@sslv2 ||= if (node = @node.at('sslv2'))
|
132
|
-
Protocol.new(node)
|
133
|
-
end
|
134
|
-
end
|
135
|
-
|
136
|
-
alias ssl_v2 sslv2
|
137
|
-
|
138
|
-
#
|
139
|
-
# SSLv3 protocol information.
|
140
|
-
#
|
141
|
-
# @return [Protocol, nil]
|
142
|
-
#
|
143
|
-
def sslv3
|
144
|
-
@sslv3 ||= if (node = @node.at('sslv3'))
|
145
|
-
Protocol.new(node)
|
146
|
-
end
|
147
|
-
end
|
148
|
-
|
149
|
-
alias ssl_v3 sslv3
|
150
|
-
|
151
|
-
#
|
152
|
-
# TLSv1 protocol information.
|
153
|
-
#
|
154
|
-
# @return [Protocol, nil]
|
155
|
-
#
|
156
|
-
def tlsv1
|
157
|
-
@tlsv1 ||= if (node = @node.at('tlsv1'))
|
158
|
-
Protocol.new(node)
|
159
|
-
end
|
160
|
-
end
|
161
|
-
|
162
|
-
alias tls_v1 tlsv1
|
163
|
-
|
164
|
-
#
|
165
|
-
# TLSv1.1 protocol information.
|
166
|
-
#
|
167
|
-
# @return [Protocol, nil]
|
168
|
-
#
|
169
|
-
def tlsv1_1
|
170
|
-
@tlsv1_1 ||= if (node = @node.at('tlsv1_1'))
|
171
|
-
Protocol.new(node)
|
172
|
-
end
|
173
|
-
end
|
174
|
-
|
175
|
-
alias tls_v1_1 tlsv1_1
|
176
|
-
|
177
|
-
#
|
178
|
-
# TLSv1.2 protocol information.
|
179
|
-
#
|
180
|
-
# @return [Protocol, nil]
|
181
|
-
#
|
182
|
-
def tlsv1_2
|
183
|
-
@tlsv1_2 ||= if (node = @node.at('tlsv1_2'))
|
184
|
-
Protocol.new(node)
|
185
|
-
end
|
186
|
-
end
|
187
|
-
|
188
|
-
alias tls_v1_2 tlsv1_2
|
189
|
-
|
190
|
-
#
|
191
|
-
# Iterates over every SSL protocol.
|
192
|
-
#
|
193
|
-
# @yield [protocol]
|
194
|
-
# The given block will be passed each SSL protocol.
|
195
|
-
#
|
196
|
-
# @yieldparam [Protocol] protocol
|
197
|
-
# A SSL protocol.
|
198
|
-
#
|
199
|
-
# @return [Enumerator]
|
200
|
-
# If a no block was given, an Enumerator will be returned.
|
201
|
-
#
|
202
|
-
# @see #sslv2
|
203
|
-
# @see #sslv3
|
204
|
-
#
|
205
|
-
def each_ssl_protocol
|
206
|
-
return enum_for(__method__) unless block_given?
|
207
|
-
|
208
|
-
yield sslv2 if sslv2
|
209
|
-
yield sslv3 if sslv3
|
210
|
-
end
|
211
|
-
|
212
|
-
#
|
213
|
-
# All supported SSL protocols.
|
214
|
-
#
|
215
|
-
# @return [Array<Protocol>]
|
216
|
-
#
|
217
|
-
def ssl_protocols
|
218
|
-
each_ssl_protocol.to_a
|
219
|
-
end
|
220
|
-
|
221
|
-
#
|
222
|
-
# Iterates over every TLS protocol.
|
223
|
-
#
|
224
|
-
# @yield [protocol]
|
225
|
-
# The given block will be passed each TLS protocol.
|
226
|
-
#
|
227
|
-
# @yieldparam [Protocol] protocol
|
228
|
-
# A TLS protocol.
|
229
|
-
#
|
230
|
-
# @return [Enumerator]
|
231
|
-
# If a no block was given, an Enumerator will be returned.
|
232
|
-
#
|
233
|
-
# @see #tlsv1
|
234
|
-
# @see #tlsv1_1
|
235
|
-
# @see #tlsv1_2
|
236
|
-
#
|
237
|
-
def each_tls_protocol
|
238
|
-
return enum_for(__method__) unless block_given?
|
239
|
-
|
240
|
-
yield tlsv1 if tlsv1
|
241
|
-
yield tlsv1_1 if tlsv1_1
|
242
|
-
yield tlsv1_2 if tlsv1_2
|
243
|
-
end
|
244
|
-
|
245
|
-
#
|
246
|
-
# All supported TLS protocols.
|
247
|
-
#
|
248
|
-
# @return [Array<Protocol>]
|
249
|
-
#
|
250
|
-
def tls_protocols
|
251
|
-
each_tls_protocol.to_a
|
252
|
-
end
|
253
|
-
|
254
|
-
#
|
255
|
-
# Iterates over every SSL/TLS protocol.
|
256
|
-
#
|
257
|
-
# @yield [protocol]
|
258
|
-
# The given block will be passed each SSL/TLS protocol.
|
259
|
-
#
|
260
|
-
# @yieldparam [Protocol] protocol
|
261
|
-
# A SSL/TLS protocol.
|
262
|
-
#
|
263
|
-
# @return [Enumerator]
|
264
|
-
# If a no block was given, an Enumerator will be returned.
|
265
|
-
#
|
266
|
-
# @see #sslv2
|
267
|
-
# @see #sslv3
|
268
|
-
# @see #tlsv1
|
269
|
-
# @see #tlsv1_1
|
270
|
-
# @see #tlsv1_2
|
271
|
-
#
|
272
|
-
def each_protocol(&block)
|
273
|
-
return enum_for(__method__) unless block
|
274
|
-
|
275
|
-
each_ssl_protocol(&block)
|
276
|
-
each_tls_protocol(&block)
|
277
|
-
end
|
278
|
-
|
279
|
-
#
|
280
|
-
# All supported SSL/TLS protocols.
|
281
|
-
#
|
282
|
-
# @return [Array<Protocol>]
|
283
|
-
#
|
284
|
-
def protocols
|
285
|
-
each_protocol.to_a
|
286
|
-
end
|
287
|
-
|
288
|
-
#
|
289
|
-
# Convert the target to a String.
|
290
|
-
#
|
291
|
-
# @return [String]
|
292
|
-
# The host and port.
|
293
|
-
#
|
294
|
-
def to_s
|
295
|
-
"#{host}:#{port}"
|
296
|
-
end
|
297
|
-
|
298
|
-
#
|
299
|
-
# Compares the other target to this target.
|
300
|
-
#
|
301
|
-
# @param [Target] other
|
302
|
-
# The other target.
|
303
|
-
#
|
304
|
-
# @return [Boolean]
|
305
|
-
# Whether the other target has the same host and port.
|
306
|
-
#
|
307
|
-
def ==(other)
|
308
|
-
other.kind_of?(self.class) && other.host == host && other.port == port
|
309
|
-
end
|
310
|
-
|
311
|
-
end
|
312
|
-
end
|