Class: SSLScan::Result

Inherits:
Object
  • Object
show all
Defined in:
lib/ssl_scan/result.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Result

Returns a new instance of Result.



12
13
14
15
16
17
 
# File 'lib/ssl_scan/result.rb', line 12

def initialize()
  @cert = nil
  @ciphers = Set.new
  @peer_verified = false
  @supported_versions = [:SSLv2, :SSLv3, :TLSv1]
end

Instance Attribute Details

#ciphers ⇒ Object (readonly)

Returns the value of attribute ciphers.



8
9
10
 
# File 'lib/ssl_scan/result.rb', line 8

def ciphers
  @ciphers
end

#openssl_sslv2 ⇒ Object

Returns the value of attribute openssl_sslv2.



6
7
8
 
# File 'lib/ssl_scan/result.rb', line 6

def openssl_sslv2
  @openssl_sslv2
end

#peer_verified ⇒ Object (readonly)

Returns the value of attribute peer_verified.



10
11
12
 
# File 'lib/ssl_scan/result.rb', line 10

def peer_verified
  @peer_verified
end

#supported_versions ⇒ Object (readonly)

Returns the value of attribute supported_versions.



9
10
11
 
# File 'lib/ssl_scan/result.rb', line 9

def supported_versions
  @supported_versions
end

Instance Method Details

#accepted(version = :all) ⇒ Array

Returns all accepted ciphers matching the supplied version

Parameters:

  • version (Symbol, Array) (defaults to: :all) —

    The SSL Version to filter on

Returns:

  • (Array) —

    An array of accepted cipher details matching the supplied versions

Raises:



54
55
56
 
# File 'lib/ssl_scan/result.rb', line 54

def accepted(version = :all)
  enum_ciphers(:accepted, version)
end

#add_cipher(version, cipher, key_length, status) ⇒ Object

Adds the details of a cipher test to the Result object.

Parameters:

  • version (Symbol) —

    the SSL Version

  • cipher (String) —

    the SSL cipher

  • key_length (Fixnum) —

    the length of encryption key

  • status (Symbol) —

    :accepted or :rejected



115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
 
# File 'lib/ssl_scan/result.rb', line 115

def add_cipher(version, cipher, key_length, status)
  unless @supported_versions.include? version
    raise ArgumentError, "Must be a supported SSL Version"
  end
  unless OpenSSL::SSL::SSLContext.new(version).ciphers.flatten.include? cipher
    raise ArgumentError, "Must be a valid SSL Cipher for #{version}!"
  end
  unless key_length.kind_of? Fixnum
    raise ArgumentError, "Must supply a valid key length"
  end
  unless [:accepted, :rejected, :failed].include? status
    raise ArgumentError, "Status must be either :accepted or :rejected"
  end

  strong_cipher_ctx = OpenSSL::SSL::SSLContext.new(version)
  # OpenSSL Directive For Strong Ciphers
  # See: http://www.rapid7.com/vulndb/lookup/ssl-weak-ciphers
  strong_cipher_ctx.ciphers = "ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM"

  if strong_cipher_ctx.ciphers.flatten.include? cipher
    weak = false
  else
    weak = true
  end

  cipher_details = {:version => version, :cipher => cipher, :key_length => key_length, :weak => weak, :status => status}
  @ciphers << cipher_details
end

#cert ⇒ Object 



19
20
21
 
# File 'lib/ssl_scan/result.rb', line 19

def cert
  @cert
end

#cert=(input) ⇒ Object 



23
24
25
26
27
28
 
# File 'lib/ssl_scan/result.rb', line 23

def cert=(input)
  unless input.kind_of? OpenSSL::X509::Certificate or input.nil?
    raise ArgumentError, "Must be an X509 Cert!"
  end
  @cert = input
end

#each_accepted(version = :all) ⇒ Object 



70
71
72
73
74
 
# File 'lib/ssl_scan/result.rb', line 70

def each_accepted(version = :all)
  accepted(version).each do |cipher_result|
    yield cipher_result
  end
end

#each_rejected(version = :all) ⇒ Object 



76
77
78
79
80
 
# File 'lib/ssl_scan/result.rb', line 76

def each_rejected(version = :all)
  rejected(version).each do |cipher_result|
    yield cipher_result
  end
end

#failed(version = :all) ⇒ Object 



66
67
68
 
# File 'lib/ssl_scan/result.rb', line 66

def failed(version = :all)
  enum_ciphers(:failed, version)
end

#rejected(version = :all) ⇒ Array

Returns all rejected ciphers matching the supplied version

Parameters:

  • version (Symbol, Array) (defaults to: :all) —

    The SSL Version to filter on

Returns:

  • (Array) —

    An array of rejected cipher details matching the supplied versions

Raises:



62
63
64
 
# File 'lib/ssl_scan/result.rb', line 62

def rejected(version = :all)
  enum_ciphers(:rejected, version)
end

#sslv2 ⇒ Object 



30
31
32
 
# File 'lib/ssl_scan/result.rb', line 30

def sslv2
  @ciphers.reject{|cipher| cipher[:version] != :SSLv2 }
end

#sslv3 ⇒ Object 



34
35
36
 
# File 'lib/ssl_scan/result.rb', line 34

def sslv3
  @ciphers.reject{|cipher| cipher[:version] != :SSLv3 }
end

#standards_compliant? ⇒ Boolean

Returns:

  • (Boolean) 


102
103
104
105
106
107
108
 
# File 'lib/ssl_scan/result.rb', line 102

def standards_compliant?
  if supports_ssl?
    return false if supports_sslv2?
    return false if supports_weak_ciphers?
  end
  true
end

#strong_ciphers ⇒ Object 



46
47
48
 
# File 'lib/ssl_scan/result.rb', line 46

def strong_ciphers
  accepted.reject{|cipher| cipher[:weak] }
end

#supports_ssl? ⇒ Boolean

Returns:

  • (Boolean) 


94
95
96
 
# File 'lib/ssl_scan/result.rb', line 94

def supports_ssl?
  supports_sslv2? or supports_sslv3? or supports_tlsv1?
end

#supports_sslv2? ⇒ Boolean

Returns:

  • (Boolean) 


82
83
84
 
# File 'lib/ssl_scan/result.rb', line 82

def supports_sslv2?
  !(accepted(:SSLv2).empty?)
end

#supports_sslv3? ⇒ Boolean

Returns:

  • (Boolean) 


86
87
88
 
# File 'lib/ssl_scan/result.rb', line 86

def supports_sslv3?
  !(accepted(:SSLv3).empty?)
end

#supports_tlsv1? ⇒ Boolean

Returns:

  • (Boolean) 


90
91
92
 
# File 'lib/ssl_scan/result.rb', line 90

def supports_tlsv1?
  !(accepted(:TLSv1).empty?)
end

#supports_weak_ciphers? ⇒ Boolean

Returns:

  • (Boolean) 


98
99
100
 
# File 'lib/ssl_scan/result.rb', line 98

def supports_weak_ciphers?
  !(weak_ciphers.empty?)
end

#tlsv1 ⇒ Object 



38
39
40
 
# File 'lib/ssl_scan/result.rb', line 38

def tlsv1
  @ciphers.reject{|cipher| cipher[:version] != :TLSv1 }
end

#weak_ciphers ⇒ Object 



42
43
44
 
# File 'lib/ssl_scan/result.rb', line 42

def weak_ciphers
  accepted.reject{|cipher| cipher[:weak] == false }
end