You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
107 lines
2.6 KiB
107 lines
2.6 KiB
require 'timeout'
|
|
|
|
module SSLCheck
|
|
class NoSslTlsGrade
|
|
attr_reader :server, :score, :grade
|
|
|
|
def initialize(server)
|
|
@server, @score, @grade = server, -1, 'X'
|
|
end
|
|
end
|
|
|
|
class Grade
|
|
attr_reader :server, :score, :grade, :warning, :success
|
|
|
|
def initialize(server)
|
|
@server = server
|
|
protocol_score
|
|
key_exchange_score
|
|
cipher_strengths_score
|
|
@score = @protocol_score*0.3 + @key_exchange_score*0.3 + @cipher_strengths_score*0.4
|
|
calculate_grade
|
|
warning
|
|
success
|
|
perfect
|
|
end
|
|
|
|
private
|
|
def calculate_grade
|
|
@grade = case @score
|
|
when 0...20 then 'F'
|
|
when 20...35 then 'E'
|
|
when 35...50 then 'D'
|
|
when 50...65 then 'C'
|
|
when 65...80 then 'B'
|
|
else 'A'
|
|
end
|
|
|
|
@grade = [@grade, 'B'].max if !@server.tlsv1_2? or @server.key_size < 2048
|
|
@grade = [@grade, 'C'].max if @server.des3?
|
|
@grade = [@grade, 'E'].max if @server.rc4? or @server.des?
|
|
@grade = [@grade, 'F'].max if @server.ssl? or @server.key_size < 1024
|
|
|
|
@grade = 'M' unless @server.cert_valid
|
|
@grade = 'T' unless @server.cert_trusted
|
|
end
|
|
|
|
def warning
|
|
@warning = []
|
|
|
|
@warning << :md5_sig if @server.md5_sig?
|
|
@warning << :sha1_sig if @server.sha1_sig?
|
|
|
|
@warning << :md5 if @server.md5?
|
|
#@warning << :sha1 if @server.sha1?
|
|
|
|
@warning << :rc4 if @server.rc4?
|
|
@warning << :des if @server.des?
|
|
@warning << :des3 if @server.des3?
|
|
end
|
|
|
|
def success
|
|
@success = []
|
|
@success << :pfs if @server.pfs_only?
|
|
@success << :hsts if @server.hsts?
|
|
@success << :hsts_long if @server.hsts_long?
|
|
end
|
|
|
|
ALL_WARNING = %i(md5_sig md5 rc4 des)
|
|
ALL_SUCCESS = %i(pfs hsts hsts_long)
|
|
def perfect
|
|
@grade = 'A+' if @grade == 'A' and (ALL_WARNING & @warning).empty? and (ALL_SUCCESS & @success) == ALL_SUCCESS
|
|
end
|
|
|
|
METHODS_SCORES = { SSLv2: 0, SSLv3: 80, TLSv1: 90, TLSv1_1: 95, TLSv1_2: 100 }
|
|
def protocol_score
|
|
methods = @server.supported_methods
|
|
worst, best = methods[:worst], methods[:best]
|
|
@protocol_score = (METHODS_SCORES[worst] + METHODS_SCORES[best]) / 2
|
|
end
|
|
|
|
def key_exchange_score
|
|
@key_exchange_score = case @server.key_size
|
|
when 0 then 0
|
|
when 0...512 then 20
|
|
when 512...1024 then 40
|
|
when 1024...2048 then 80
|
|
when 2048...4096 then 90
|
|
else 100
|
|
end
|
|
end
|
|
|
|
def cipher_strength_score(cipher_strength)
|
|
case cipher_strength
|
|
when 0 then 0
|
|
when 0...128 then 20
|
|
when 128...256 then 80
|
|
else 100
|
|
end
|
|
end
|
|
|
|
def cipher_strengths_score
|
|
strength = @server.cipher_size
|
|
worst, best = strength[:min], strength[:max]
|
|
@cipher_strengths_score = (cipher_strength_score(worst) + cipher_strength_score(best)) / 2
|
|
end
|
|
end
|
|
end
|
|
|