forked from cloudflare/cfssl
-
Notifications
You must be signed in to change notification settings - Fork 0
/
scan_common.go
186 lines (155 loc) · 4.5 KB
/
scan_common.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
package scan
import (
"net"
"regexp"
"time"
"github.com/cloudflare/cf-tls/tls"
"github.com/cloudflare/cfssl/log"
)
var (
// Network is the default network to use.
Network = "tcp"
// Dialer is the default dialer to use, with a 1s timeout.
Dialer = &net.Dialer{Timeout: time.Second}
)
// Grade gives a subjective rating of the host's success in a scan.
type Grade int
const (
// Bad describes a host with serious misconfiguration or vulnerability.
Bad Grade = iota
// Warning describes a host with non-ideal configuration that maintains support for Warning clients.
Warning
// Good describes host performing the expected state-of-the-art.
Good
// Skipped descibes the "grade" of a scan that has been skipped.
Skipped
)
// String gives the name of the Grade as a string.
func (g Grade) String() string {
switch g {
case Bad:
return "Bad"
case Warning:
return "Warning"
case Good:
return "Good"
case Skipped:
return "Skipped"
default:
return "Invalid"
}
}
// Output is the result of a scan, to be stored for potential use by later Scanners.
type Output interface{}
type scanFunc func(string) (Grade, Output, error)
// multiscan scans all DNS addresses returned for the host, returning the lowest grade
// and the concatenation of all the output.
func multiscan(host string, scan scanFunc) (grade Grade, output Output, err error) {
domain, port, _ := net.SplitHostPort(host)
var addrs []string
addrs, err = net.LookupHost(domain)
if err != nil {
return
}
grade = Good
out := make(map[string]Output)
for _, addr := range addrs {
var g Grade
var o Output
g, o, err = scan(net.JoinHostPort(addr, port))
if err != nil {
grade = Bad
return
}
if g < grade {
grade = g
}
out[addr] = o
}
output = out
return
}
// Scanner describes a type of scan to perform on a host.
type Scanner struct {
// Description describes the nature of the scan to be performed.
Description string `json:"description"`
// scan is the function that scans the given host and provides a Grade and Output.
scan scanFunc
}
// Scan performs the scan to be performed on the given host and stores its result.
func (s *Scanner) Scan(host string) (Grade, Output, error) {
grade, output, err := s.scan(host)
if err != nil {
log.Infof("scan: %v", err)
return grade, output, err
}
return grade, output, err
}
// Family defines a set of related scans meant to be run together in sequence.
type Family struct {
// Description gives a short description of the scans performed scan/scan_common.goon the host.
Description string `json:"description"`
// Scanners is a list of scanners that are to be run in sequence.
Scanners map[string]*Scanner `json:"scanners"`
}
// FamilySet contains a set of Families to run Scans from.
type FamilySet map[string]*Family
// Default contains each scan Family that is defined
var Default = FamilySet{
"Connectivity": Connectivity,
"TLSHandshake": TLSHandshake,
"TLSSession": TLSSession,
"PKI": PKI,
"Broad": Broad,
}
// ScannerResult contains the result for a single scan.
type ScannerResult struct {
Grade string `json:"grade"`
Output Output `json:"output,omitempty"`
Error string `json:"error,omitempty"`
}
// FamilyResult contains a scan response for a single Family
type FamilyResult map[string]ScannerResult
// RunScans interates over AllScans, running scans matching the family and scanner
// regular expressions.
func (fs FamilySet) RunScans(host, family, scanner string) (map[string]FamilyResult, error) {
if _, _, err := net.SplitHostPort(host); err != nil {
host = net.JoinHostPort(host, "443")
}
familyRegexp, err := regexp.Compile(family)
if err != nil {
return nil, err
}
scannerRegexp, err := regexp.Compile(scanner)
if err != nil {
return nil, err
}
familyResults := make(map[string]FamilyResult)
for familyName, family := range fs {
if familyRegexp.MatchString(familyName) {
scannerResults := make(map[string]ScannerResult)
for scannerName, scanner := range family.Scanners {
if scannerRegexp.MatchString(scannerName) {
grade, output, err := scanner.Scan(host)
result := ScannerResult{
Grade: grade.String(),
Output: output,
}
if err != nil {
result.Error = err.Error()
}
scannerResults[scannerName] = result
}
}
familyResults[familyName] = scannerResults
}
}
return familyResults, nil
}
func defaultTLSConfig(host string) *tls.Config {
h, _, err := net.SplitHostPort(host)
if err != nil {
h = host
}
return &tls.Config{ServerName: h, InsecureSkipVerify: true}
}