mirror of
https://github.com/securego/gosec.git
synced 2024-12-26 04:25:52 +00:00
edb362fc9d
* Add a tool which generates the TLS rule configuration from Mozilla server side TLS configuration * Update README * Remove trailing space in README * Update dependencies * Fix the commends of the generated functions
132 lines
4.8 KiB
Go
132 lines
4.8 KiB
Go
package rules
|
|
|
|
import (
|
|
"go/ast"
|
|
|
|
"github.com/GoASTScanner/gas"
|
|
)
|
|
|
|
// NewModernTLSCheck creates a check for Modern TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewModernTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0303,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|
|
|
|
// NewIntermediateTLSCheck creates a check for Intermediate TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewIntermediateTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0301,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|
|
|
|
// NewOldTLSCheck creates a check for Old TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewOldTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0300,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_SEED_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_SEED_CBC_SHA",
|
|
"TLS_RSA_WITH_SEED_CBC_SHA",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|