mirror of
https://github.com/securego/gosec.git
synced 2024-11-05 19:45:51 +00:00
141 lines
5.2 KiB
Go
141 lines
5.2 KiB
Go
package rules
|
|
|
|
import (
|
|
"go/ast"
|
|
|
|
"github.com/securego/gosec"
|
|
)
|
|
|
|
// NewModernTLSCheck creates a check for Modern TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewModernTLSCheck(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
MetaData: gosec.MetaData{ID: id},
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0303,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|
|
|
|
// NewIntermediateTLSCheck creates a check for Intermediate TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewIntermediateTLSCheck(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
MetaData: gosec.MetaData{ID: id},
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0301,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|
|
|
|
// NewOldTLSCheck creates a check for Old TLS ciphers
|
|
// DO NOT EDIT - generated by tlsconfig tool
|
|
func NewOldTLSCheck(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
|
|
return &insecureConfigTLS{
|
|
MetaData: gosec.MetaData{ID: id},
|
|
requiredType: "crypto/tls.Config",
|
|
MinVersion: 0x0300,
|
|
MaxVersion: 0x0303,
|
|
goodCiphers: []string{
|
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
|
|
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_128_GCM_SHA256",
|
|
"TLS_RSA_WITH_AES_256_GCM_SHA384",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_AES_256_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
|
|
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
|
|
"TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
|
"TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
|
"TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
|
"TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
|
"TLS_DHE_RSA_WITH_SEED_CBC_SHA",
|
|
"TLS_DHE_DSS_WITH_SEED_CBC_SHA",
|
|
"TLS_RSA_WITH_SEED_CBC_SHA",
|
|
},
|
|
}, []ast.Node{(*ast.CompositeLit)(nil)}
|
|
}
|