@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/lib/threat-intelligence-runtime.mjs

@@ -4,6 +4,7 @@
 // must declare exact input exposure, reviewed terms, and bounded request and
 // output budgets before producing separately attributed normalized evidence.
 import { createObservation } from "./observation.mjs";
+import { THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_RESULT_STATES, } from "./threat-intelligence-types.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";
@@ -11,16 +12,7 @@ const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
 const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
 const CURATED_CONNECTOR_CONTRACT_VERSION = 1;
 const CURATED_CONNECTOR_RESULT_SCHEMA = 'whoisleuth.curated-connector-result';
-const RESULT_STATES = new Set([
-    'success',
-    'partial',
-    'not_found',
-    'unsupported',
-    'skipped',
-    'rate_limited',
-    'unavailable',
-    'error',
-]);
+const RESULT_STATES = new Set(THREAT_INTELLIGENCE_RESULT_STATES);
 const TERMINAL_STATES_WITHOUT_FINDINGS = new Set([
     'not_found',
     'unsupported',
@@ -29,7 +21,7 @@ const TERMINAL_STATES_WITHOUT_FINDINGS = new Set([
     'unavailable',
     'error',
 ]);
-const CATEGORIES = new Set(['phishing', 'malware', 'spam', 'suspicious', 'abuse', 'unknown']);
+const CATEGORIES = new Set(THREAT_INTELLIGENCE_CATEGORIES);
 const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'unknown']);
 const CONFIDENCES = new Set(['high', 'medium', 'low', 'unknown']);
 const CONNECTOR_RELATIONSHIP_TYPES = new Set([

package/lib/threat-intelligence-types.mjs

@@ -1,3 +1,20 @@
 // Provider-neutral types shared by threat-intelligence and curated connector
 // manifests, fixture harnesses, normalizers, and result builders.
-export {};
+export const THREAT_INTELLIGENCE_CATEGORIES = Object.freeze([
+    'phishing',
+    'malware',
+    'spam',
+    'suspicious',
+    'abuse',
+    'unknown',
+]);
+export const THREAT_INTELLIGENCE_RESULT_STATES = Object.freeze([
+    'success',
+    'partial',
+    'not_found',
+    'unsupported',
+    'skipped',
+    'rate_limited',
+    'unavailable',
+    'error',
+]);

package/lib/tls-intelligence.mjs

@@ -11,18 +11,19 @@ import * as net from 'node:net';
 import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
 import { createObservation } from "./observation.mjs";
+import { MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
 import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
 const TLS_PROFILE_VERSION = 3;
 const TLS_PORT = 443;
 const TLS_TIMEOUT_MS = 5000;
 const MAX_RESOLVED_ADDRESSES = 64;
-const MAX_CHAIN_CERTIFICATES = 8;
-const MAX_ALT_NAMES = 50;
+const MAX_CHAIN_CERTIFICATES = MAX_LOOKUP_TLS_CHAIN_CERTIFICATES;
+const MAX_ALT_NAMES = MAX_LOOKUP_TLS_ALT_NAMES;
 const MAX_SAN_ENTRIES = 100;
 const MAX_EXTENDED_KEY_USAGES = 16;
 const MAX_AIA_LOCATIONS = 32;
-const MAX_NAME_VALUES = 4;
+const MAX_NAME_VALUES = MAX_LOOKUP_TLS_NAME_VALUES;
 const MAX_TEXT_LENGTH = 256;
 const MAX_ERROR_LENGTH = 240;
 const MAX_SERIAL_LENGTH = 128;
@@ -577,7 +578,7 @@ function tlsFindings(profile) {
         findings.push({ id: 'hostname_mismatch', tone: 'warning', label: 'Hostname mismatch', detail: 'The observed leaf certificate did not match the SNI hostname.' });
     if (profile.certificate?.subjectAltNames?.dnsNames.some((name) => name.startsWith('*.')))
         findings.push({ id: 'wildcard_certificate', tone: 'neutral', label: 'Wildcard certificate', detail: 'The leaf certificate includes at least one wildcard DNS name. Wildcard use is common and is not inherently suspicious.' });
-    return findings;
+    return findings.slice(0, MAX_LOOKUP_TLS_FINDINGS);
 }
 function buildTlsObservation(handshake = {}, options = {}) {
     const state = tracker();
@@ -590,7 +591,9 @@ function buildTlsObservation(handshake = {}, options = {}) {
     const authorized = typeof handshake.authorized === 'boolean' ? handshake.authorized : null;
     const hostnameMatches = typeof handshake.hostnameMatches === 'boolean' ? handshake.hostnameMatches : null;
     const authorizationError = authorized === false
-        ? boundedString(handshake.authorizationError, MAX_ERROR_LENGTH, state)
+        ? boundedString(handshake.authorizationError instanceof Error
+            ? handshake.authorizationError.message
+            : handshake.authorizationError, MAX_ERROR_LENGTH, state)
         : null;
     const hostnameError = hostnameMatches === false
         ? boundedString(handshake.hostnameError, MAX_ERROR_LENGTH, state)
@@ -780,6 +783,9 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 port: TLS_PORT,
                 servername: normalizedHostname,
                 rejectUnauthorized: false,
+                // Keep runtime CA-path authorization independent from the separately
+                // recorded endpoint-identity comparison below.
+                checkServerIdentity: () => undefined,
                 ALPNProtocols: ['h2', 'http/1.1'],
             }, () => {
                 try {

package/lib/tlsa-evidence.mjs

@@ -128,7 +128,15 @@ function analyzeTlsaEvidence(input) {
     const normalized = raw.slice(0, MAX_TLSA_RECORDS).map(normalizeTlsaRecord);
     const rejectedCount = normalized.filter((item) => item === null).length + Math.max(0, raw.length - MAX_TLSA_RECORDS);
     const records = normalized.filter((item) => item !== null);
+    const smtpRelayService = service.port === 25 && service.transport === 'tcp';
     const results = records.map((item) => {
+        if (smtpRelayService && (item.usage === 0 || item.usage === 1)) {
+            return Object.freeze({
+                ...item,
+                state: 'unsupported',
+                reason: 'PKIX-TA and PKIX-EE certificate usages are not treated as usable TLSA records for SMTP relay on port 25.',
+            });
+        }
         const materials = item.usage === 0 || item.usage === 2
             ? authorityMaterials
             : leafMaterial ? [leafMaterial] : [];
@@ -147,6 +155,7 @@ function analyzeTlsaEvidence(input) {
     const hasMatch = results.some((item) => item.state === 'matched');
     const hasDifferent = results.some((item) => item.state === 'different');
     const hasUnavailable = results.some((item) => item.state === 'unavailable');
+    const hasUnsupported = results.some((item) => item.state === 'unsupported');
     const limitations = [
         'This offline comparison does not connect to the target, retrieve DNS, negotiate SMTP STARTTLS, or validate a DNSSEC chain.',
         'A TLSA match is usable as DANE evidence only when the DNSSEC state was independently validated for the same observation.',
@@ -155,24 +164,45 @@ function analyzeTlsaEvidence(input) {
     if (dnssecState !== 'validated' && hasMatch) {
         limitations.push('Certificate material matched, but DNSSEC was not validated, so the result remains partial.');
     }
-    const matchedPkixDependent = results.some((item) => item.state === 'matched' && (item.usage === 0 || item.usage === 1));
-    const matchedDaneOnly = results.some((item) => item.state === 'matched' && (item.usage === 2 || item.usage === 3));
+    if (smtpRelayService && hasUnsupported) {
+        limitations.push('RFC 7672 leaves SMTP relay treatment of PKIX-TA usage 0 and PKIX-EE usage 1 undefined; this review treats those records as unusable and they cannot complete SMTP DANE assurance.');
+    }
+    const matchedPkixTa = results.some((item) => item.state === 'matched' && item.usage === 0);
+    const matchedPkixEe = results.some((item) => item.state === 'matched' && item.usage === 1);
+    const matchedPkixDependent = matchedPkixTa || matchedPkixEe;
+    const matchedDaneEe = results.some((item) => item.state === 'matched' && item.usage === 3);
+    const hasPkixTaAssociation = results.some((item) => item.usage === 0);
+    const hasDaneTaAssociation = results.some((item) => item.usage === 2);
     if (matchedPkixDependent && pkixValidationState !== 'validated') {
         limitations.push('A PKIX-dependent association matched, but a validated PKIX path was not supplied, so the result is not complete.');
     }
     if (authorityMaterialRejectedCount > 0 || authorityMaterialTruncated) {
         limitations.push('Authority certificate material was malformed or exceeded the review bound, so an unmatched trust-anchor association remains partial.');
     }
+    if (hasPkixTaAssociation) {
+        limitations.push('PKIX-TA usage 0 association bytes were compared, but the supplied authority material was not proven to be part of the independently validated leaf path, so the usage-0 association cannot complete PKIX-TA assurance.');
+    }
+    if (hasDaneTaAssociation) {
+        limitations.push('DANE-TA usage 2 association bytes were compared, but no certificate path from the observed leaf to the supplied trust-anchor material was constructed or validated, so the usage-2 association cannot complete DANE-TA assurance.');
+    }
+    if (hasUnavailable || rejectedCount > 0 || truncated) {
+        limitations.push('Some TLSA associations or required certificate material were unavailable, malformed, or beyond the review bound, so the comparison remains incomplete.');
+    }
+    const comparisonMaterialComplete = !hasUnavailable
+        && rejectedCount === 0
+        && !truncated
+        && authorityMaterialRejectedCount === 0
+        && !authorityMaterialTruncated;
     const trustedMatch = dnssecState === 'validated'
-        && (matchedDaneOnly || matchedPkixDependent && pkixValidationState === 'validated');
+        && (matchedDaneEe || matchedPkixEe && pkixValidationState === 'validated');
     const state = results.length === 0
         ? 'unavailable'
-        : hasDifferent && !hasMatch && rejectedCount === 0 && !truncated
-            && authorityMaterialRejectedCount === 0 && !authorityMaterialTruncated
+        : dnssecState === 'validated' && hasDifferent && !hasMatch && comparisonMaterialComplete
+            && !hasPkixTaAssociation && !hasDaneTaAssociation
             ? 'different'
-            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneOnly)
+            : hasMatch && (dnssecState === 'bogus' || matchedPkixDependent && pkixValidationState === 'failed' && !matchedDaneEe)
                 ? 'untrusted'
-                : trustedMatch && !hasUnavailable && rejectedCount === 0 && !truncated
+                : trustedMatch && comparisonMaterialComplete
                     ? 'matched'
                     : 'partial';
     return Object.freeze({

package/package.json

@@ -33,7 +33,7 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.45.0",
+  "version": "1.47.4",
   "dependencies": {
     "@peculiar/x509": "2.0.0",
     "maxmind": "5.0.7",