tlsmodel

type AdvancedScanRequest struct {
	Config ScanConfig
	//Next two fields will be automatically set once scan starts
	Day        string //Date the scan was run in the format yyyy-mm-dd
	ScanID     string //Non-empty ScanID means this is a ScanRequest to resume an existing, possibly incomplete, scan
	ScanGroups []ScanGroup
}

type BasicScanSummary struct {
	HostCount         int
	PortCount         int
	BestGrade         string
	BestGradeExample  GradeExample
	WorstGrade        string
	WorstGradeExample GradeExample
	HostGrades        map[string]GradePair //mapping of "host IP" -> "BestGrade x WorstGrade"
	GradeToHostPorts  map[string][]string  //mapping of "grade" -> []{"hostIP:Port" ...}, e.g. "A+" -> []{"10.10.10.10:443"}
}

type CertificateMessage struct {
	// Raw          []byte
	Certificates [][]byte
	Certs        []*x509.Certificate
}

type CipherConfig struct {
	CipherID               uint16
	Cipher                 string
	KeyExchange            string
	Authentication         string
	IsExport               bool
	SupportsForwardSecrecy bool
	Encryption             string
	MACPRF                 string //MAC (TLS <=1.1) or PseudoRandomFunction (TLS >= 1.2)
}

type CipherConfigParameters struct {
	RSABitLength           int //The RSA key from the certificate
	SupportedGroupStrength int
	SupportedGroups        []string //The Supported Groups that have the indicated strength
}

type CipherMetrics struct {
	Authentication        int
	KeyExchangeStrength   int
	ForwardSecrecy        int
	EncryptionKeyStrength int
	MacPRF                int
	Performance           int
	OverallScore          int
	ConfigParams          CipherConfigParameters
	CipherConfig          CipherConfig
}

type CipherMetricsSorter []CipherMetrics

type CurveID uint16

type GradeExample struct {
	Grade, Server, Port, HostName string
}

type GradePair struct {
	Best, Worst string
}

type GroupedHost struct {
	ScanGroup    ScanGroup
	Hosts        []string
	IPAndDomains []IPAndDomain
}

type HelloAndKey struct {
	Hello  ServerHelloMessage
	Key    ServerKeyExchangeMsg
	HasKey bool
}

type HostAndPort struct {
	Hostname string
	Port     string
}

type HumanCertificate struct {
	Subject            string
	SubjectSerialNo    string
	SubjectCN          string
	SubjectAN          string
	SerialNumber       string
	Issuer             string
	PublicKeyAlgorithm string
	ValidFrom          string
	ValidUntil         string
	Key                string
	SignatureAlgorithm string
	Signature          string
	OcspStapling       bool
	RevocationDetail   string
	Version            int
	IsCA               bool
	HasChainIssue      bool
}

type HumanScanResult struct {
	Server                                 string //IP address
	HostName                               string
	Port                                   string
	SupportsTLS                            bool
	SupportedProtocols                     []string
	HasCipherPreferenceOrderByProtocol     map[string]bool
	CipherPreferenceOrderByProtocol        map[string][]string
	OcspStaplingByProtocol                 map[string]bool
	SelectedCipherByProtocol               map[string]string
	ALPNByProtocol                         map[string]string
	SecureRenegotiationSupportedByProtocol map[string]bool
	CipherSuiteByProtocol                  map[string][]string
	// ServerHelloMessageByProtocolByCipher   map[string]map[string]ServerHelloMessage
	CertificatesPerProtocol    map[string][]HumanCertificate
	CertificatesWithChainIssue map[string]bool
	// KeyExchangeByProtocolByCipher          map[string]map[string]ServerKeyExchangeMsg
	IsSTARTTLS              bool
	IsSSH                   bool
	SupportsTLSFallbackSCSV bool
	Score                   SecurityScore
	GroupID                 int //ScanRequest Host Group index
}

type IPAndDomain struct {
	IP, Domain string
}

type KeyExchangeAlgorithm int

type KeyShare struct {
	Group CurveID
	Data  []byte
}

type PersistedScanRequest struct {
	Request      AdvancedScanRequest
	GroupedHosts []GroupedHost
	ScanStart    time.Time
	ScanEnd      time.Time
	Progress     int
	HostCount    int
}

type ScanConfig struct {
	ProtocolsOnly bool
	Timeout       int
	//Number of Packets per Second to send out during underlying port scan
	PacketsPerSecond int
	//Suppress certificate output
	HideCerts bool
	//Suppress output of TLS status of closed ports or ports with no TLS
	HideNoTLS bool
	//control whether to produce a running commentary of scan progress or stay quiet till the end
	Quiet       bool
	ServicePort int
}

type ScanData struct {
	ScanRequest AdvancedScanRequest
	Results     map[int][]HumanScanResult //ScanGroup index (in the ASR) -> human scan results
}

type ScanGroup struct {
	Description string   `yaml:"description"` //Freeform text used in reporting
	CIDRRanges  []string `yaml:"cidrRanges"`
}

type ScanProgress struct {
	ScanID      string
	Progress    float32
	ScanResults []HumanScanResult // this is the latest scan results delta, at the end of scan all cummulative scans are sent
	Narrative   string            //freeflow text
}

type ScanResult struct {
	Server                                 string //IP address
	HostName                               string
	Port                                   string
	SupportedProtocols                     []uint16
	HasCipherPreferenceOrderByProtocol     map[uint16]bool
	CipherPreferenceOrderByProtocol        map[uint16][]uint16
	OcspStaplingByProtocol                 map[uint16]bool
	SelectedCipherByProtocol               map[uint16]uint16
	ALPNByProtocol                         map[uint16]string
	SecureRenegotiationSupportedByProtocol map[uint16]bool
	CipherSuiteByProtocol                  map[uint16][]uint16
	ServerHelloMessageByProtocolByCipher   map[uint16]map[uint16]ServerHelloMessage
	CertificatesPerProtocol                map[uint16]CertificateMessage
	KeyExchangeByProtocolByCipher          map[uint16]map[uint16]ServerKeyExchangeMsg
	IsSTARTTLS                             bool
	IsSSH                                  bool
	SupportsTLSFallbackSCSV                bool
	Score                                  SecurityScore
	CertificatesWithChainIssue             map[string]bool //Cert Serial Number -> true
	GroupID                                int             //ScanRequest Host Group index
}

type ScanResultSorter []ScanResult

type ScanResultSummary struct {
	Request   AdvancedScanRequest
	ScanStart time.Time
	ScanEnd   time.Time
	Progress  int
	BasicScanSummary
}

type SecurityScore struct {
	ProtocolScore         int
	KeyExchangeScore      int
	CipherEncryptionScore int
	CertificateScore      int
	Grade                 string
	Warnings              []string
}

type ServerHelloMessage struct {
	Raw                          []byte
	Vers                         uint16
	Random                       []byte
	SessionID                    []byte
	CipherSuite                  uint16
	CompressionMethod            uint8
	NextProtoNeg                 bool
	NextProtos                   []string
	OcspStapling                 bool
	Scts                         [][]byte
	TicketSupported              bool
	SecureRenegotiation          []byte
	SecureRenegotiationSupported bool
	AlpnProtocol                 string
	SupportedVersion             uint16
	ServerShare                  KeyShare
	SelectedIdentityPresent      bool
	SelectedIdentity             uint16
	SupportedPoints              []uint8
	// contains filtered or unexported fields
}

type ServerKeyExchangeMsg struct {
	// Raw []byte
	Key   []byte
	Group CurveID // for TLS v1.3
}

type TLSAuditConfig struct {
	DailySchedules   []string    `yaml:"dailySchedules"` // in the format 13:45, 01:20 etc
	ServicePort      int         `yaml:"servicePort"`
	IsProduction     bool        `yaml:"isProduction"`
	PacketsPerSecond int         `yaml:"packetsPerSecond"`
	Timeout          int         `yaml:"timeout"`
	ScanGroups       []ScanGroup `yaml:"scanGroups"`
}

type TLSAuditSnapshot struct {
	Timestamp   time.Time
	ScanResults []ScanResult
}

type TLSAuditSnapshotHuman struct {
	Timestamp   time.Time
	ScanResults []HumanScanResult
}