tls_test_kit 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 637a1d287aea85271e8d2c7e97042fc922b03600b72efac611c87b0ef19abf3a
-  data.tar.gz: e7bd1094ee57e891cb694dab80f8e364ba3a5cce7da6329f6731ef792c9fabe1
+  metadata.gz: 617f7c08027781a37ba09b5789c399a09fbb94aaade12b47b9316d0bbbff637a
+  data.tar.gz: b99cefffc333f375d190639de5c8bfbdef155471c5c81e25ac118dbe51206be1
 SHA512:
-  metadata.gz: 4390ba4c72e204c2e87dd4afde53b9a705aeb320706cf99e3f6b190488f534a56bd8b285375b546b20d3948aabdfdbf3d1837ef6fb6b2d74b1877288b6ccb8c7
-  data.tar.gz: 18bc3706515b94ec75ac4877db75e6563e50ed7754130b951a475017c812c59cf2054abf0209bb1c686f174fe47b847459c2e831f37c565d1582823fdb94cbf7
+  metadata.gz: cbc416cedcc9df7f002667ec293af63d9864085eca995db7c955bd9c1650dfc7aefebc03ed9e4914a7e502b3257015d74d38a28cca829476431769fd4df417db
+  data.tar.gz: 381c6169d8191420743f435179790ebc9dbc11304df8ee9605022c269b86eebb06d6820ab545e3109040bf3277c5135bfad581bab9930649a49dd2e755b3ca5e

data/lib/tls_test_kit/tls_version_test.rb

@@ -6,6 +6,8 @@ module TLSTestKit
     )
     id :tls_version_test
 
+    output :incorrectly_permitted_tls_versions_messages
+
     class << self
       def versions
         {
@@ -59,6 +61,10 @@ module TLSTestKit
       def version_required?(version)
         required_versions.include? version
       end
+
+      def incorrectly_permitted_tls_version_message_type
+        config.options[:incorrectly_permitted_tls_version_message_type] || 'error'
+      end
     end
 
     input :url
@@ -69,6 +75,8 @@ module TLSTestKit
       port = uri.port
       tls_support_verified = false
 
+      incorrectly_permitted_tls_versions = []
+
       self.class.versions.each do |version, version_string|
         http = Net::HTTP.new(host, port)
         http.use_ssl = true
@@ -78,30 +86,48 @@ module TLSTestKit
         begin
           http.request_get(uri)
           if self.class.version_forbidden? version
-            add_message('error', "Server incorrectly allowed #{version_string} connection.")
+            message =
+              "#{url} accepted #{version_string} connection even though #{version_string} connections should be denied. " \
+              'The system may deny content from being sent over this connection, but this must be manually verified.'
+            incorrectly_permitted_tls_versions << version_string
+
+            add_message(self.class.incorrectly_permitted_tls_version_message_type, message)
           elsif self.class.version_required? version
-            add_message('info', "Server correctly allowed #{version_string} connection as required.")
+            add_message('info', "#{url} correctly accepted #{version_string} connection as required.")
             tls_support_verified = true
           else
-            add_message('info', "Server allowed #{version_string} connection.")
+            add_message('info', "#{url} accepted #{version_string} connection.")
             tls_support_verified = true
           end
         rescue StandardError => e
           if self.class.version_required? version
-            add_message('error', "Server incorrectly denied #{version_string} connection: #{e.message}")
+            add_message('error', "#{url} incorrectly denied #{version_string} connection: #{e.message}")
           elsif self.class.version_forbidden? version
-            add_message('info', "Server correctly denied #{version_string} connection as required.")
+            add_message('info', "#{url} correctly denied #{version_string} connection as required.")
           else
-            add_message('info', "Server denied #{version_string} connection.")
+            add_message('info', "#{url} denied #{version_string} connection.")
           end
         end
       end
 
+      if incorrectly_permitted_tls_versions.present?
+        count = incorrectly_permitted_tls_versions.length
+        message =
+          "#{url} did not deny TLS connections for #{'version'.pluralize(count)} " \
+          "#{incorrectly_permitted_tls_versions.join(', ')}. The system may deny content from being sent over this" \
+          'connection, but this must be manually verified.'
+        output incorrectly_permitted_tls_versions_messages: message
+      end
+
       errors_found = messages.any? { |message| message[:type] == 'error' }
 
       assert !errors_found, 'Server did not permit/deny the connections with the correct TLS versions'
 
       assert tls_support_verified, 'Server did not support any allowed TLS versions.'
+
+      if incorrectly_permitted_tls_versions.present?
+        pass "Server accepted TLS connections using versions which should be denied: #{incorrectly_permitted_tls_versions.join(', ')}"
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tls_test_kit
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Stephen MacVicar
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-03 00:00:00.000000000 Z
+date: 2022-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inferno_core
@@ -96,7 +96,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/inferno_framework/tls-test-kit
   source_code_uri: https://github.com/inferno_framework/tls-test-kit
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -112,7 +112,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Inferno tests for server TLS support
 test_files: []