diff --git a/.drone-manifest.yml b/.drone-manifest.yml deleted file mode 100644 index 3414963..0000000 --- a/.drone-manifest.yml +++ /dev/null @@ -1,22 +0,0 @@ -image: happydomain/checker-http:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}} -{{#if build.tags}} -tags: -{{#each build.tags}} - - {{this}} -{{/each}} -{{/if}} -manifests: - - image: happydomain/checker-http:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64 - platform: - architecture: amd64 - os: linux - - image: happydomain/checker-http:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm64 - platform: - architecture: arm64 - os: linux - variant: v8 - - image: happydomain/checker-http:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm - platform: - architecture: arm - os: linux - variant: v7 diff --git a/.drone.yml b/.drone.yml deleted file mode 100644 index 6b02e29..0000000 --- a/.drone.yml +++ /dev/null @@ -1,187 +0,0 @@ ---- -kind: pipeline -type: docker -name: build-amd64 - -platform: - os: linux - arch: amd64 - -steps: - - name: checker build - image: golang:1-alpine - commands: - - apk add --no-cache git make - - make - environment: - CHECKER_VERSION: "${DRONE_BRANCH}-${DRONE_COMMIT}" - CGO_ENABLED: 0 - when: - event: - exclude: - - tag - - - name: checker build tag - image: golang:1-alpine - commands: - - apk add --no-cache git make - - make - environment: - CHECKER_VERSION: "${DRONE_SEMVER}" - CGO_ENABLED: 0 - when: - event: - - tag - - - name: publish on Docker Hub - image: plugins/docker - settings: - repo: happydomain/checker-http - auto_tag: true - auto_tag_suffix: ${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} - dockerfile: Dockerfile - build_args: - - CHECKER_VERSION=${DRONE_BRANCH}-${DRONE_COMMIT} - username: - from_secret: docker_username - password: - from_secret: docker_password - when: - event: - exclude: - - tag - - - name: publish on Docker Hub (tag) - image: plugins/docker - settings: - repo: happydomain/checker-http - auto_tag: true - auto_tag_suffix: ${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} - dockerfile: Dockerfile - build_args: - - CHECKER_VERSION=${DRONE_SEMVER} - username: - from_secret: docker_username - password: - from_secret: docker_password - when: - event: - - tag - -trigger: - branch: - exclude: - - renovate/* - event: - - cron - - push - - tag - ---- -kind: pipeline -type: docker -name: build-arm64 - -platform: - os: linux - arch: arm64 - -steps: - - name: checker build - image: golang:1-alpine - commands: - - apk add --no-cache git make - - make - environment: - CHECKER_VERSION: "${DRONE_BRANCH}-${DRONE_COMMIT}" - CGO_ENABLED: 0 - when: - event: - exclude: - - tag - - - name: checker build tag - image: golang:1-alpine - commands: - - apk add --no-cache git make - - make - environment: - CHECKER_VERSION: "${DRONE_SEMVER}" - CGO_ENABLED: 0 - when: - event: - - tag - - - name: publish on Docker Hub - image: plugins/docker - settings: - repo: happydomain/checker-http - auto_tag: true - auto_tag_suffix: ${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} - dockerfile: Dockerfile - build_args: - - CHECKER_VERSION=${DRONE_BRANCH}-${DRONE_COMMIT} - username: - from_secret: docker_username - password: - from_secret: docker_password - when: - event: - exclude: - - tag - - - name: publish on Docker Hub (tag) - image: plugins/docker - settings: - repo: happydomain/checker-http - auto_tag: true - auto_tag_suffix: ${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} - dockerfile: Dockerfile - build_args: - - CHECKER_VERSION=${DRONE_SEMVER} - username: - from_secret: docker_username - password: - from_secret: docker_password - when: - event: - - tag - -trigger: - event: - - cron - - push - - tag - ---- -kind: pipeline -name: docker-manifest - -platform: - os: linux - arch: arm64 - -steps: - - name: publish on Docker Hub - image: plugins/manifest - settings: - auto_tag: true - ignore_missing: true - spec: .drone-manifest.yml - username: - from_secret: docker_username - password: - from_secret: docker_password - -trigger: - branch: - exclude: - - renovate/* - event: - - cron - - push - - tag - -depends_on: - - build-amd64 - - build-arm64 diff --git a/README.md b/README.md index ca92a97..79ac2ad 100644 --- a/README.md +++ b/README.md @@ -9,30 +9,26 @@ Deep TLS / certificate analysis is intentionally **delegated to [checker-tls](https://git.happydns.org/checker-tls)** - this checker only relies on TLS for transport. -## Rules +## What it checks -| Code | Description | Severity | -|-------------------------------|-------------------------------------------------------------------------------------------------------------------|---------------------| -| `http.tcp_reachable` | Verifies that every probed IP accepts an HTTP connection on the standard port. | CRITICAL | -| `https.tcp_reachable` | Verifies that every probed IP accepts an HTTPS connection on the standard port. | CRITICAL | -| `http.https_redirect` | Plain HTTP responses must redirect to an HTTPS URL on the same host. | WARNING | -| `http.redirect_chain` | Inspects the redirect chain (RFC 9110 §15.4) for loops, excessive length, and scheme downgrades. | WARNING | -| `http.redirect_permanence` | HTTP→HTTPS upgrade should use 301 or 308 (permanent) rather than 302/307 (temporary). | WARNING | -| `http.hsts` | Verifies the presence and quality of the Strict-Transport-Security header on HTTPS responses. | WARNING | -| `http.csp` | Verifies the presence and quality of the Content-Security-Policy header on HTTPS responses. | WARNING | -| `http.x_frame_options` | Verifies that responses set X-Frame-Options or a CSP frame-ancestors directive. | WARNING | -| `http.x_content_type_options` | Verifies that responses set X-Content-Type-Options: nosniff. | WARNING | -| `http.x_xss_protection` | Reports the value of the legacy X-XSS-Protection header (disabled is preferred; CSP is the proper replacement). | INFO | -| `http.referrer_policy` | Verifies that responses set a Referrer-Policy header with a privacy-preserving value. | WARNING | -| `http.permissions_policy` | Verifies that the Permissions-Policy header restricts powerful APIs (camera, microphone, geolocation, …). | WARNING | -| `http.coop` | Verifies the Cross-Origin-Opener-Policy (COOP) header for cross-origin process isolation. | WARNING | -| `http.coep` | Verifies the Cross-Origin-Embedder-Policy (COEP) header, required (with COOP) to enable cross-origin isolation. | WARNING | -| `http.corp` | Verifies the Cross-Origin-Resource-Policy (CORP) header restricts cross-origin/cross-site embedding of responses. | WARNING | -| `http.cookie_flags` | Verifies that cookies set over HTTPS use the Secure, HttpOnly and SameSite attributes. | WARNING | -| `http.cookie_prefixes` | Verifies cookies using the __Secure- / __Host- name prefixes meet the RFC 6265bis constraints. | WARNING | -| `http.cookie_size` | Flags cookies whose Set-Cookie line exceeds the 4096-byte minimum browsers must support (RFC 6265 §6.1). | WARNING | -| `http.sri` | Reports cross-origin script and stylesheet tags that are missing Subresource Integrity (integrity=) attributes. | WARNING | -| `http.security_txt` | Reports whether /.well-known/security.txt (RFC 9116) is published. | WARNING | +| Rule | What it verifies | +| --------------------------------- | --------------------------------------------------------------------------------- | +| `http.tcp_reachable` | Port 80 accepts connections on every A/AAAA address. | +| `https.tcp_reachable` | Port 443 accepts connections on every A/AAAA address. | +| `http.https_redirect` | Plain HTTP redirects to HTTPS (warning if not). | +| `http.hsts` | `Strict-Transport-Security` is present with a sufficient `max-age`. | +| `http.csp` | `Content-Security-Policy` is set; flags `'unsafe-inline'` / `'unsafe-eval'`. | +| `http.x_frame_options` | `X-Frame-Options` or CSP `frame-ancestors` provides clickjacking protection. | +| `http.x_content_type_options` | `X-Content-Type-Options: nosniff` is set. | +| `http.x_xss_protection` | Reports the legacy `X-XSS-Protection` header (recommendation: disable). | +| `http.referrer_policy` | `Referrer-Policy` is set to a privacy-preserving value (W3C Referrer Policy). | +| `http.permissions_policy` | `Permissions-Policy` is set (W3C Permissions Policy, replaces Feature-Policy). | +| `http.coop` | `Cross-Origin-Opener-Policy` isolates the document from cross-origin windows. | +| `http.coep` | `Cross-Origin-Embedder-Policy` requires CORP/CORS opt-in for embedded resources. | +| `http.corp` | `Cross-Origin-Resource-Policy` restricts cross-origin embedding of responses. | +| `http.cookie_flags` | Every Set-Cookie has `Secure`, `HttpOnly`, and a `SameSite` attribute. | +| `http.sri` | Cross-origin `