rules:
  - id: c-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: SSL_CTX_new(SSLv3_method())
          - pattern: SSL_CTX_new(SSLv3_client_method())
          - pattern: SSL_CTX_new(SSLv3_server_method())
          - pattern: SSL_CTX_new(TLSv1_method())
          - pattern: SSL_CTX_new(TLSv1_client_method())
          - pattern: SSL_CTX_new(TLSv1_server_method())
          - pattern: SSL_CTX_new(TLSv1_1_method())
          - pattern: SSL_CTX_new(TLSv1_1_client_method())
          - pattern: SSL_CTX_new(TLSv1_1_server_method())
          - pattern: SSL_CTX_set_max_proto_version($CTX, TLS1_VERSION)
          - pattern: SSL_CTX_set_max_proto_version($CTX, TLS1_1_VERSION)
          - pattern: SSL_CTX_set_max_proto_version($CTX, SSL3_VERSION)
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      technology: [c, cpp, openssl, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: c-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: SSL_CTX_set_verify($CTX, SSL_VERIFY_NONE, ...)
          - pattern: SSL_set_verify($SSL, SSL_VERIFY_NONE, ...)
    message: >-
      TLS certificate verification is disabled -- connections are vulnerable to MITM attacks. Always enable
      certificate validation.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      technology: [c, cpp, openssl, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: c-tls-weak-cipher-suite
    patterns:
      - pattern-either:
          - pattern: SSL_CTX_set_cipher_list($CTX, "RC4-SHA:...")
          - pattern: SSL_CTX_set_cipher_list($CTX, "DES-CBC-SHA:...")
          - pattern: SSL_CTX_set_cipher_list($CTX, "NULL-SHA:...")
          - pattern: SSL_CTX_set_cipher_list($CTX, "aNULL:...")
          - pattern: SSL_CTX_set_cipher_list($CTX, "eNULL:...")
          - pattern: SSL_CTX_set_ciphersuites($CTX, "RC4-SHA:...")
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      technology: [c, cpp, openssl, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8
