cryptcheck/lib/cryptcheck/tls/grade.rb

module CryptCheck
	module Tls
		class TlsNotSupportedGrade
			attr_reader :server, :score, :grade

			def initialize(server)
				@server, @score, @grade = server, -1, 'X'
			end
		end

		class Grade
			attr_reader :server, :protocol_score, :key_exchange_score, :cipher_strengths_score, :score, :grade, :error, :warning, :success

			def initialize(server)
				@server = server
				calculate_protocol_score
				calculate_key_exchange_score
				calculate_cipher_strengths_score
				@score = @protocol_score*0.3 + @key_exchange_score*0.3 + @cipher_strengths_score*0.4
				calculate_error
				calculate_warning
				calculate_success
				calculate_grade
				calculate_perfect
			end

			def display
				color = case self.grade
							when 'A+'
								:blue
							when 'A'
								:green
							when 'B', 'C'
								:yellow
							when 'E', 'F'
								:red
							when 'M', 'T'
								{ color: :white, background: :red }
						end

				Logger.info { "Grade : #{self.grade.colorize color }" }
				Logger.info { '' }
				Logger.info { "Protocole : #{self.protocol_score} / 100" }
				Logger.info { "Key exchange : #{self.key_exchange_score} / 100" }
				Logger.info { "Ciphers strength : #{self.cipher_strengths_score} / 100" }
				Logger.info { "Overall score : #{self.score} / 100" }
				Logger.info { '' }
				Logger.info { "Errors : #{self.error.join(' ').colorize :red }" } unless self.error.empty?
				Logger.info { "Warnings : #{self.warning.join(' ').colorize :yellow }" } unless self.warning.empty?
				Logger.info { "Best practices : #{self.success.join(' ').colorize :green }" } unless self.success.empty?
			end

			private
			def calculate_grade
				@grade = case @score
							 when 0...20 then
								 'F'
							 when 20...35 then
								 'E'
							 when 35...50 then
								 'D'
							 when 50...65 then
								 'C'
							 when 65...80 then
								 'B'
							 else
								 'A'
						 end

				@grade = [@grade, 'B'].max if !@server.tlsv1_2? or @server.key_size < 2048
				@grade = [@grade, 'C'].max if @server.des3?
				@grade = [@grade, 'F'].max unless @error.empty?

				@grade = 'M' unless @server.cert_valid
				@grade = 'T' unless @server.cert_trusted
			end

			def calculate_error
				@error = []

				@error << :md5_sig if @server.md5_sig?

				@error << :md5 if @server.md5?

				@error << :anonymous if @server.anonymous?

				@error << :dss if @server.dss?

				@error << :null if @server.null?
				@error << :export if @server.export?
				@error << :des if @server.des?
				@error << :rc4 if @server.rc4?
			end

			def calculate_warning
				@warning = []

				@warning << :sha1_sig if @server.sha1_sig?

				#@warning << :sha1 if @server.sha1?

				@warning << :des3 if @server.des3?
			end

			def calculate_success
				@success = []
				@success << :pfs if @server.pfs_only?
			end

			ALL_ERROR   = %i(md5_sig md5 anonymous dss null export des rc4)
			ALL_WARNING = %i(sha1_sig des3)
			ALL_SUCCESS = %i(pfs)

			def all_error
				ALL_ERROR
			end

			def all_warning
				ALL_WARNING
			end

			def all_success
				ALL_SUCCESS
			end

			def calculate_perfect
				@grade = 'A+' if @grade == 'A' and @error.empty? and @warning.empty? and (ALL_SUCCESS & @success) == ALL_SUCCESS
			end

			METHODS_SCORES = { SSLv2: 0, SSLv3: 80, TLSv1: 90, TLSv1_1: 95, TLSv1_2: 100 }

			def calculate_protocol_score
				methods         = @server.supported_methods
				worst, best     = methods[:worst], methods[:best]
				@protocol_score = (METHODS_SCORES[worst] + METHODS_SCORES[best]) / 2
			end

			def calculate_key_exchange_score
				@key_exchange_score = case @server.key_size
										  when 0 then
											  0
										  when 0...512 then
											  20
										  when 512...1024 then
											  40
										  when 1024...2048 then
											  80
										  when 2048...4096 then
											  90
										  else
											  100
									  end
			end

			def calculate_cipher_strength_score(cipher_strength)
				case cipher_strength
					when 0 then
						0
					when 0...128 then
						20
					when 128...256 then
						80
					else
						100
				end
			end

			def calculate_cipher_strengths_score
				strength                = @server.cipher_size
				worst, best             = strength[:min], strength[:max]
				@cipher_strengths_score = (calculate_cipher_strength_score(worst) + calculate_cipher_strength_score(best)) / 2
			end
		end
	end
end