flareguard 0.1.0

package/src/zone/reporters/terminal.rs

@@ -0,0 +1,322 @@
+use crate::zone::models::{AggregateAuditReport, RiskLevel};
+use colored::*;
+use comfy_table::modifiers::UTF8_ROUND_CORNERS;
+use comfy_table::presets::UTF8_FULL;
+use comfy_table::{Attribute, Cell, CellAlignment, Color, ContentArrangement, Table};
+
+pub fn render_terminal(report: &AggregateAuditReport, verbose: bool) -> String {
+    let mut out = String::new();
+
+    // 1. Executive Header Banner
+    out.push_str(&format!(
+        "\n{}\n",
+        "╔══════════════════════════════════════════════════════════════════════════════╗"
+            .cyan()
+            .bold()
+    ));
+    out.push_str(&format!(
+        "║  {}  ║\n",
+        "🛡️  CLOUDFLARE ZONE SECURITY AUDITOR (cf-zone-auditor)"
+            .bright_white()
+            .bold()
+    ));
+    out.push_str(&format!(
+        "║  {}  ║\n",
+        "   Posture Assessment & Compliance Enforcement Suite".dimmed()
+    ));
+    out.push_str(&format!(
+        "{}\n\n",
+        "╚══════════════════════════════════════════════════════════════════════════════╝"
+            .cyan()
+            .bold()
+    ));
+
+    // 2. Executive Score Card & Summary
+    let grade_colored = match report.overall_grade.as_str() {
+        "A+" => "A+ (EXCELLENT)".bright_green().bold(),
+        "A" => "A (STRONG)".bright_green().bold(),
+        "B" => "B (GOOD)".green().bold(),
+        "C" => "C (MODERATE RISK)".yellow().bold(),
+        "D" => "D (HIGH RISK)".bright_yellow().bold(),
+        _ => "F (CRITICAL VULNERABILITIES)".bright_red().bold(),
+    };
+
+    let score_colored = if report.average_score >= 90.0 {
+        format!("{:.1} / 100", report.average_score)
+            .bright_green()
+            .bold()
+    } else if report.average_score >= 80.0 {
+        format!("{:.1} / 100", report.average_score).green().bold()
+    } else if report.average_score >= 70.0 {
+        format!("{:.1} / 100", report.average_score).yellow().bold()
+    } else {
+        format!("{:.1} / 100", report.average_score)
+            .bright_red()
+            .bold()
+    };
+
+    out.push_str(&format!(
+        "  📊 {} {}\n",
+        "Audited Timestamp:".dimmed(),
+        report.timestamp.to_rfc3339()
+    ));
+    if let Some(ref acc) = report.account_id {
+        out.push_str(&format!("  🏢 {} {}\n", "Account ID:".dimmed(), acc));
+    }
+    out.push_str(&format!(
+        "  🌐 {} {}\n",
+        "Total Zones Audited:".dimmed(),
+        report.total_zones.to_string().bold()
+    ));
+    out.push_str(&format!(
+        "  🏆 {} {}\n",
+        "Account Security Score:".dimmed(),
+        score_colored
+    ));
+    out.push_str(&format!(
+        "  🎖️ {} {}\n",
+        "Overall Health Grade:".dimmed(),
+        grade_colored
+    ));
+    out.push_str(&format!(
+        "  🚨 {} [ {} {} | {} {} | {} {} | {} {} | {} {} ]\n\n",
+        "Findings Summary:".dimmed(),
+        report
+            .total_findings
+            .critical
+            .to_string()
+            .bright_red()
+            .bold(),
+        "CRITICAL".bright_red(),
+        report
+            .total_findings
+            .high
+            .to_string()
+            .bright_yellow()
+            .bold(),
+        "HIGH".bright_yellow(),
+        report.total_findings.medium.to_string().yellow(),
+        "MEDIUM".yellow(),
+        report.total_findings.low.to_string().cyan(),
+        "LOW".cyan(),
+        report.total_findings.info.to_string().white(),
+        "INFO".white(),
+    ));
+
+    // 3. Multi-Zone Posture Overview Table
+    let mut table = Table::new();
+    table
+        .load_preset(UTF8_FULL)
+        .apply_modifier(UTF8_ROUND_CORNERS)
+        .set_content_arrangement(ContentArrangement::Dynamic)
+        .set_header(vec![
+            Cell::new("Zone Name").add_attribute(Attribute::Bold),
+            Cell::new("Plan").add_attribute(Attribute::Bold),
+            Cell::new("SSL Mode").add_attribute(Attribute::Bold),
+            Cell::new("Min TLS").add_attribute(Attribute::Bold),
+            Cell::new("Always HTTPS").add_attribute(Attribute::Bold),
+            Cell::new("HSTS").add_attribute(Attribute::Bold),
+            Cell::new("WAF").add_attribute(Attribute::Bold),
+            Cell::new("DNSSEC").add_attribute(Attribute::Bold),
+            Cell::new("Score")
+                .add_attribute(Attribute::Bold)
+                .set_alignment(CellAlignment::Center),
+            Cell::new("Grade")
+                .add_attribute(Attribute::Bold)
+                .set_alignment(CellAlignment::Center),
+        ]);
+
+    for z in &report.zone_reports {
+        let ssl_cell = format_ssl_cell(&z.settings_summary.ssl_mode);
+        let tls_cell = format_tls_cell(&z.settings_summary.min_tls);
+        let https_cell = format_bool_cell(&z.settings_summary.always_https);
+        let hsts_cell = format_bool_cell(&z.settings_summary.hsts_status);
+        let waf_cell = format_bool_cell(&z.settings_summary.waf_status);
+        let dnssec_cell = format_dnssec_cell(&z.settings_summary.dnssec_status);
+        let score_cell = format_score_cell(z.score);
+        let grade_cell = format_grade_cell(&z.grade);
+
+        table.add_row(vec![
+            Cell::new(&z.zone_name).add_attribute(Attribute::Bold),
+            Cell::new(&z.plan_name),
+            ssl_cell,
+            tls_cell,
+            https_cell,
+            hsts_cell,
+            waf_cell,
+            dnssec_cell,
+            score_cell,
+            grade_cell,
+        ]);
+    }
+
+    out.push_str(&table.to_string());
+    out.push_str("\n\n");
+
+    // 4. Detailed Findings Breakdown (if there are findings or verbose mode)
+    let has_any_findings = report.zone_reports.iter().any(|z| !z.findings.is_empty());
+    if has_any_findings {
+        out.push_str(&format!(
+            "{}\n",
+            "🔍 DETAILED SECURITY FINDINGS & REMEDIATION PLAN"
+                .bright_cyan()
+                .bold()
+        ));
+        out.push_str(&format!(
+            "{}\n\n",
+            "──────────────────────────────────────────────────────────────────────────────"
+                .dimmed()
+        ));
+
+        for z in &report.zone_reports {
+            if z.findings.is_empty() {
+                if verbose {
+                    out.push_str(&format!(
+                        "  ✅ {}: {} (Score: {}/100, Grade: {})\n\n",
+                        z.zone_name.bold(),
+                        "All security checks passed with zero findings!".bright_green(),
+                        z.score,
+                        z.grade.bright_green()
+                    ));
+                }
+                continue;
+            }
+
+            out.push_str(&format!(
+                "  📁 Zone: {}  [ Score: {} | Grade: {} | {} findings ]\n",
+                z.zone_name.bright_white().bold(),
+                format_score_text(z.score),
+                z.grade.bold(),
+                z.findings.len()
+            ));
+
+            let mut finding_table = Table::new();
+            finding_table
+                .load_preset(UTF8_FULL)
+                .apply_modifier(UTF8_ROUND_CORNERS)
+                .set_content_arrangement(ContentArrangement::Dynamic)
+                .set_header(vec![
+                    Cell::new("ID").add_attribute(Attribute::Bold),
+                    Cell::new("Severity").add_attribute(Attribute::Bold),
+                    Cell::new("Title & Finding").add_attribute(Attribute::Bold),
+                    Cell::new("Current vs Expected").add_attribute(Attribute::Bold),
+                    Cell::new("Remediation Guidance").add_attribute(Attribute::Bold),
+                ]);
+
+            for f in &z.findings {
+                let sev_cell = match f.risk_level {
+                    RiskLevel::Critical => Cell::new("CRITICAL")
+                        .fg(Color::Red)
+                        .add_attribute(Attribute::Bold),
+                    RiskLevel::High => Cell::new("HIGH")
+                        .fg(Color::Yellow)
+                        .add_attribute(Attribute::Bold),
+                    RiskLevel::Medium => Cell::new("MEDIUM").fg(Color::Yellow),
+                    RiskLevel::Low => Cell::new("LOW").fg(Color::Cyan),
+                    RiskLevel::Info => Cell::new("INFO").fg(Color::White),
+                };
+
+                let desc_text = format!("{}\n{}", f.title.bold(), f.description.dimmed());
+                let value_text = format!(
+                    "Actual:   {}\nExpected: {}",
+                    f.actual_value, f.expected_value
+                );
+
+                finding_table.add_row(vec![
+                    Cell::new(&f.rule_id).add_attribute(Attribute::Bold),
+                    sev_cell,
+                    Cell::new(desc_text),
+                    Cell::new(value_text),
+                    Cell::new(&f.remediation),
+                ]);
+            }
+
+            out.push_str(&finding_table.to_string());
+            out.push_str("\n\n");
+        }
+    } else {
+        out.push_str(&format!(
+            "🎉 {}\n\n",
+            "EXCELLENT: All audited zones passed 100% of security posture checks!"
+                .bright_green()
+                .bold()
+        ));
+    }
+
+    out
+}
+
+fn format_ssl_cell(mode: &str) -> Cell {
+    let m = mode.to_lowercase();
+    if m == "strict" {
+        Cell::new("strict").fg(Color::Green)
+    } else if m == "full" {
+        Cell::new("full").fg(Color::Yellow)
+    } else {
+        Cell::new(&m).fg(Color::Red).add_attribute(Attribute::Bold)
+    }
+}
+
+fn format_tls_cell(tls: &str) -> Cell {
+    if tls.contains("1.3") || tls.contains("1.2") {
+        Cell::new(tls).fg(Color::Green)
+    } else {
+        Cell::new(tls).fg(Color::Red).add_attribute(Attribute::Bold)
+    }
+}
+
+fn format_bool_cell(status: &str) -> Cell {
+    let s = status.to_lowercase();
+    if s == "enabled" || s == "active" || s == "on" || s == "true" {
+        Cell::new("Enabled").fg(Color::Green)
+    } else {
+        Cell::new("Disabled").fg(Color::Red)
+    }
+}
+
+fn format_dnssec_cell(status: &str) -> Cell {
+    let s = status.to_lowercase();
+    if s == "active" {
+        Cell::new("Active").fg(Color::Green)
+    } else if s == "pending" {
+        Cell::new("Pending").fg(Color::Yellow)
+    } else {
+        Cell::new("Disabled").fg(Color::Red)
+    }
+}
+
+fn format_score_cell(score: u32) -> Cell {
+    let cell = Cell::new(score.to_string()).set_alignment(CellAlignment::Center);
+    if score >= 90 {
+        cell.fg(Color::Green).add_attribute(Attribute::Bold)
+    } else if score >= 80 {
+        cell.fg(Color::Green)
+    } else if score >= 70 {
+        cell.fg(Color::Yellow)
+    } else {
+        cell.fg(Color::Red).add_attribute(Attribute::Bold)
+    }
+}
+
+fn format_score_text(score: u32) -> ColoredString {
+    if score >= 90 {
+        format!("{}/100", score).bright_green().bold()
+    } else if score >= 80 {
+        format!("{}/100", score).green().bold()
+    } else if score >= 70 {
+        format!("{}/100", score).yellow().bold()
+    } else {
+        format!("{}/100", score).bright_red().bold()
+    }
+}
+
+fn format_grade_cell(grade: &str) -> Cell {
+    let cell = Cell::new(grade).set_alignment(CellAlignment::Center);
+    match grade {
+        "A+" | "A" => cell.fg(Color::Green).add_attribute(Attribute::Bold),
+        "B" => cell.fg(Color::Green),
+        "C" => cell.fg(Color::Yellow),
+        "D" => cell.fg(Color::Yellow).add_attribute(Attribute::Bold),
+        _ => cell.fg(Color::Red).add_attribute(Attribute::Bold),
+    }
+}

package/src/zone/rules/definitions.rs

@@ -0,0 +1,201 @@
+use crate::zone::models::{RiskLevel, RuleCategory};
+
+/// Metadata definition for a security audit rule
+#[derive(Debug, Clone)]
+pub struct RuleDefinition {
+    pub id: &'static str,
+    pub name: &'static str,
+    pub category: RuleCategory,
+    pub default_severity: RiskLevel,
+    pub title: &'static str,
+    pub description: &'static str,
+    pub remediation: &'static str,
+    pub doc_url: &'static str,
+}
+
+pub const ALL_RULES: &[RuleDefinition] = &[
+    RuleDefinition {
+        id: "CF-SSL-001",
+        name: "SSLModeCheck",
+        category: RuleCategory::SslTls,
+        default_severity: RiskLevel::Critical,
+        title: "Insecure SSL/TLS Encryption Mode",
+        description: "SSL mode is set to 'off' or 'flexible'. Flexible SSL does not encrypt traffic between Cloudflare edge servers and origin servers, exposing sensitive payload data to Man-In-The-Middle (MITM) attacks.",
+        remediation: "Navigate to SSL/TLS > Overview in Cloudflare Dashboard and set SSL/TLS encryption mode to 'Full (strict)'. Ensure a valid SSL certificate is installed on the origin server.",
+        doc_url: "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/",
+    },
+    RuleDefinition {
+        id: "CF-SSL-002",
+        name: "SSLNotStrict",
+        category: RuleCategory::SslTls,
+        default_severity: RiskLevel::Medium,
+        title: "SSL/TLS Mode is Full (Non-Strict)",
+        description: "SSL mode is set to 'full' instead of 'full (strict)'. Full mode does not validate the origin certificate against a trusted CA, leaving the connection susceptible to origin spoofing.",
+        remediation: "Upgrade SSL/TLS mode to 'Full (strict)' after validating origin server certificates (Cloudflare Origin CA or public CA).",
+        doc_url: "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/",
+    },
+    RuleDefinition {
+        id: "CF-TLS-001",
+        name: "MinimumTlsVersion",
+        category: RuleCategory::SslTls,
+        default_severity: RiskLevel::High,
+        title: "Deprecated Minimum TLS Version (< 1.2)",
+        description: "Minimum TLS version is set below TLS 1.2 (e.g. TLS 1.0 or 1.1). Legacy TLS protocols contain known cryptographic weaknesses (POODLE, BEAST) and fail PCI-DSS compliance.",
+        remediation: "Go to SSL/TLS > Edge Certificates > Minimum TLS Version and select 'TLS 1.2' or 'TLS 1.3'.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/minimum-tls-version/",
+    },
+    RuleDefinition {
+        id: "CF-TLS-002",
+        name: "Tls13Disabled",
+        category: RuleCategory::SslTls,
+        default_severity: RiskLevel::Low,
+        title: "TLS 1.3 Protocol Disabled",
+        description: "TLS 1.3 is disabled. TLS 1.3 provides significant latency improvements (0-RTT/1-RTT handshakes) and modern AEAD cipher suites.",
+        remediation: "Enable TLS 1.3 under SSL/TLS > Edge Certificates > TLS 1.3 in the Cloudflare Dashboard.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/",
+    },
+    RuleDefinition {
+        id: "CF-HTTPS-001",
+        name: "AlwaysUseHttps",
+        category: RuleCategory::HttpsEnforcement,
+        default_severity: RiskLevel::High,
+        title: "Always Use HTTPS Disabled",
+        description: "Unencrypted HTTP requests are not automatically redirected to HTTPS, allowing plaintext HTTP communication if requested by clients.",
+        remediation: "Enable 'Always Use HTTPS' in SSL/TLS > Edge Certificates in Cloudflare Dashboard.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/",
+    },
+    RuleDefinition {
+        id: "CF-HTTPS-002",
+        name: "AutomaticHttpsRewrites",
+        category: RuleCategory::HttpsEnforcement,
+        default_severity: RiskLevel::Medium,
+        title: "Automatic HTTPS Rewrites Disabled",
+        description: "Automatic HTTPS rewrites is disabled, which may cause mixed-content warnings when HTTP resources are embedded in secure HTTPS pages.",
+        remediation: "Enable 'Automatic HTTPS Rewrites' under SSL/TLS > Edge Certificates.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/automatic-https-rewrites/",
+    },
+    RuleDefinition {
+        id: "CF-HSTS-001",
+        name: "HstsDisabled",
+        category: RuleCategory::Hsts,
+        default_severity: RiskLevel::High,
+        title: "HTTP Strict Transport Security (HSTS) Disabled",
+        description: "HSTS header is not enabled for the zone. Without HSTS, browsers may allow initial unencrypted HTTP connections susceptible to SSL stripping attacks.",
+        remediation: "Enable HSTS under SSL/TLS > Edge Certificates > HTTP Strict Transport Security (HSTS).",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/",
+    },
+    RuleDefinition {
+        id: "CF-HSTS-002",
+        name: "HstsMaxAgeTooShort",
+        category: RuleCategory::Hsts,
+        default_severity: RiskLevel::Medium,
+        title: "HSTS Max-Age Duration Too Short (< 6 Months)",
+        description: "HSTS max-age duration is less than 15,552,000 seconds (6 months). A short max-age duration fails modern security baselines and HSTS preload requirements (minimum 1 year / 31,536,000s).",
+        remediation: "Increase HSTS max-age to at least 6 months (15,552,000 seconds) or preferably 1 year (31,536,000 seconds) in HSTS settings.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/",
+    },
+    RuleDefinition {
+        id: "CF-HSTS-003",
+        name: "HstsIncludeSubdomainsMissing",
+        category: RuleCategory::Hsts,
+        default_severity: RiskLevel::Medium,
+        title: "HSTS Include Subdomains Disabled",
+        description: "HSTS does not apply to all subdomains (includeSubDomains is false). Unprotected subdomains remain vulnerable to downgrade attacks.",
+        remediation: "Check 'Apply HSTS policy to subdomains (includeSubDomains)' in HSTS settings.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/",
+    },
+    RuleDefinition {
+        id: "CF-HSTS-004",
+        name: "HstsPreloadDisabled",
+        category: RuleCategory::Hsts,
+        default_severity: RiskLevel::Low,
+        title: "HSTS Preload Directive Missing",
+        description: "HSTS preload directive is not enabled. Without preloading, first-time site visitors are not protected by browser-baked HSTS lists.",
+        remediation: "Enable 'Preload' in HSTS settings and submit the domain to hstspreload.org.",
+        doc_url: "https://hstspreload.org/",
+    },
+    RuleDefinition {
+        id: "CF-HSTS-005",
+        name: "HstsNoSniffMissing",
+        category: RuleCategory::Hsts,
+        default_severity: RiskLevel::Low,
+        title: "HSTS No-Sniff Header Disabled",
+        description: "X-Content-Type-Options: nosniff header is disabled in HSTS security header configuration.",
+        remediation: "Enable 'No-Sniff' in HSTS settings to prevent MIME type sniffing attacks.",
+        doc_url: "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/",
+    },
+    RuleDefinition {
+        id: "CF-WAF-001",
+        name: "WafManagedRulesDisabled",
+        category: RuleCategory::WafSecurity,
+        default_severity: RiskLevel::High,
+        title: "WAF Managed Rulesets Inactive",
+        description: "Cloudflare Web Application Firewall (WAF) managed rules are disabled or not configured. The zone lacks automated zero-day protection against OWASP Top 10 vulnerabilities.",
+        remediation: "Enable Cloudflare Managed Ruleset and OWASP Core Ruleset under Security > WAF > Managed Rules.",
+        doc_url: "https://developers.cloudflare.com/waf/managed-rules/",
+    },
+    RuleDefinition {
+        id: "CF-BOT-001",
+        name: "BotFightModeDisabled",
+        category: RuleCategory::BotManagement,
+        default_severity: RiskLevel::Medium,
+        title: "Bot Fight Mode / Bot Protection Inactive",
+        description: "Bot Fight Mode or Super Bot Fight Mode is disabled. Automated credential stuffing, scrapers, and malicious bot traffic are not actively mitigated.",
+        remediation: "Enable 'Bot Fight Mode' under Security > Bots in the Cloudflare Dashboard.",
+        doc_url: "https://developers.cloudflare.com/bots/get-started/free/",
+    },
+    RuleDefinition {
+        id: "CF-RATE-001",
+        name: "RateLimitingNotConfigured",
+        category: RuleCategory::WafSecurity,
+        default_severity: RiskLevel::Low,
+        title: "No Rate Limiting Rules Configured",
+        description: "No rate limiting rules are configured for this zone. Critical endpoints (e.g. login, search, APIs) may be susceptible to brute force or Layer 7 DoS attacks.",
+        remediation: "Configure rate limiting rules for authentication, API, and sensitive endpoints under Security > WAF > Rate Limiting.",
+        doc_url: "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+    },
+    RuleDefinition {
+        id: "CF-DNS-001",
+        name: "DnssecDisabled",
+        category: RuleCategory::Dnssec,
+        default_severity: RiskLevel::Medium,
+        title: "DNSSEC Not Enabled",
+        description: "DNSSEC (Domain Name System Security Extensions) is disabled or inactive. Domain resolution is susceptible to DNS cache poisoning and spoofing.",
+        remediation: "Enable DNSSEC under DNS > Settings > Enable DNSSEC and add the DS record to your domain registrar.",
+        doc_url: "https://developers.cloudflare.com/dns/dnssec/",
+    },
+    RuleDefinition {
+        id: "CF-SEC-001",
+        name: "PermissiveIpAccessRule",
+        category: RuleCategory::AccessControl,
+        default_severity: RiskLevel::Critical,
+        title: "Overly Permissive IP Access Rule (0.0.0.0/0 or Wildcard Whitelist)",
+        description: "An IP Access Rule or Firewall Rule is configured to allow or whitelist '0.0.0.0/0', '::/0', or wide subnets, effectively bypassing security controls globally.",
+        remediation: "Review Security > WAF > Tools > IP Access Rules and remove any broad allow/whitelist rules for 0.0.0.0/0 or excessive CIDR blocks.",
+        doc_url: "https://developers.cloudflare.com/waf/tools/ip-access-rules/",
+    },
+    RuleDefinition {
+        id: "CF-SEC-002",
+        name: "InsecureSecurityLevel",
+        category: RuleCategory::SecurityLevel,
+        default_severity: RiskLevel::High,
+        title: "Zone Security Level Set to Ineffective Setting ('Essentially Off' or 'Low')",
+        description: "Zone Security Level is set to 'Essentially Off' or 'Low', disabling IP reputation scoring and bot challenge protection.",
+        remediation: "Set Security Level to 'Medium' or 'High' under Security > Settings in Cloudflare Dashboard.",
+        doc_url: "https://developers.cloudflare.com/waf/reference/security-level/",
+    },
+    RuleDefinition {
+        id: "CF-SEC-003",
+        name: "BrowserIntegrityCheckDisabled",
+        category: RuleCategory::SecurityLevel,
+        default_severity: RiskLevel::Low,
+        title: "Browser Integrity Check Disabled",
+        description: "Browser Integrity Check is disabled. HTTP headers commonly used by spammers and threat actors will not be challenged.",
+        remediation: "Enable 'Browser Integrity Check' under Security > Settings in Cloudflare Dashboard.",
+        doc_url: "https://developers.cloudflare.com/waf/reference/browser-integrity-check/",
+    },
+];
+
+pub fn get_rule_by_id(id: &str) -> Option<&'static RuleDefinition> {
+    ALL_RULES.iter().find(|r| r.id == id)
+}