rules:
  # =============================================================================
  # OCAML TLS CONFIGURATION VULNERABILITY RULES
  # =============================================================================
  # Uses pattern-regex because opengrep's OCaml AST parser does not yet support
  # pattern/pattern-either for function call matching.
  # =============================================================================

  - id: ocaml-tls-version-too-old
    pattern-regex: "Ssl\\.create_context\\s+Ssl\\.(?:SSLv3|TLSv1|TLSv1_1)\\b"
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [ocaml]
    metadata:
      category: security
      technology: [ocaml, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: ocaml-tls-cert-validation-disabled
    pattern-regex: "(?:Ssl\\.set_verify\\s+\\S+\\s+\\[\\]\\s+None|Ssl\\.set_verify_depth\\s+\\S+\\s+0|X509\\.Authenticator\\.null)\\b"
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled. This allows man-in-the-middle
      attacks and completely defeats TLS security.
    severity: ERROR
    languages: [ocaml]
    metadata:
      category: security
      technology: [ocaml, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: ocaml-tls-weak-cipher-suite
    pattern-regex: "Ssl\\.set_cipher_list\\s+\\S+\\s+['\"](?:RC4|DES-CBC|NULL|aNULL)"
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [ocaml]
    metadata:
      category: security
      technology: [ocaml, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8
