cipherrun 0.3.0

A fast, modular, and scalable TLS/SSL security scanner written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154

// Framework definitions and structures

use crate::compliance::{Rule, Severity};
use serde::{Deserialize, Serialize};

/// A compliance framework (e.g., PCI-DSS, NIST)
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ComplianceFramework {
    /// Unique identifier (e.g., "pci-dss-v4")
    pub id: String,
    /// Human-readable name
    pub name: String,
    /// Version number
    pub version: String,
    /// Description of the framework
    pub description: String,
    /// Organization that publishes this framework
    pub organization: String,
    /// Effective date of this version
    #[serde(skip_serializing_if = "Option::is_none")]
    pub effective_date: Option<String>,
    /// List of requirements in this framework
    pub requirements: Vec<Requirement>,
}

/// A single requirement within a compliance framework
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Requirement {
    /// Requirement identifier (e.g., "PCI-4.2.1")
    pub id: String,
    /// Short name of the requirement
    pub name: String,
    /// Detailed description
    pub description: String,
    /// Category (e.g., "Protocol Security")
    pub category: String,
    /// Severity if this requirement is not met
    pub severity: Severity,
    /// Remediation advice
    #[serde(default)]
    pub remediation: String,
    /// Rules that define how to check this requirement
    pub rules: Vec<Rule>,
}

impl ComplianceFramework {
    /// Get a requirement by ID
    pub fn get_requirement(&self, id: &str) -> Option<&Requirement> {
        self.requirements.iter().find(|r| r.id == id)
    }

    /// Get all requirements in a specific category
    pub fn requirements_by_category(&self, category: &str) -> Vec<&Requirement> {
        self.requirements
            .iter()
            .filter(|r| r.category == category)
            .collect()
    }

    /// Get all requirements with a specific severity
    pub fn requirements_by_severity(&self, severity: Severity) -> Vec<&Requirement> {
        self.requirements
            .iter()
            .filter(|r| r.severity == severity)
            .collect()
    }

    /// Get all unique categories in this framework
    pub fn categories(&self) -> Vec<String> {
        let mut categories: Vec<String> = self
            .requirements
            .iter()
            .map(|r| r.category.clone())
            .collect();
        categories.sort();
        categories.dedup();
        categories
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_framework_get_requirement() {
        let framework = ComplianceFramework {
            id: "test".to_string(),
            name: "Test".to_string(),
            version: "1.0".to_string(),
            description: "Test framework".to_string(),
            organization: "Test Org".to_string(),
            effective_date: None,
            requirements: vec![Requirement {
                id: "TEST-1".to_string(),
                name: "Test Requirement".to_string(),
                description: "".to_string(),
                category: "Security".to_string(),
                severity: Severity::High,
                remediation: "".to_string(),
                rules: vec![],
            }],
        };

        assert!(framework.get_requirement("TEST-1").is_some());
        assert!(framework.get_requirement("TEST-2").is_none());
    }

    #[test]
    fn test_framework_categories() {
        let framework = ComplianceFramework {
            id: "test".to_string(),
            name: "Test".to_string(),
            version: "1.0".to_string(),
            description: "Test framework".to_string(),
            organization: "Test Org".to_string(),
            effective_date: None,
            requirements: vec![
                Requirement {
                    id: "TEST-1".to_string(),
                    name: "Test 1".to_string(),
                    description: "".to_string(),
                    category: "Protocol Security".to_string(),
                    severity: Severity::High,
                    remediation: "".to_string(),
                    rules: vec![],
                },
                Requirement {
                    id: "TEST-2".to_string(),
                    name: "Test 2".to_string(),
                    description: "".to_string(),
                    category: "Cipher Security".to_string(),
                    severity: Severity::High,
                    remediation: "".to_string(),
                    rules: vec![],
                },
                Requirement {
                    id: "TEST-3".to_string(),
                    name: "Test 3".to_string(),
                    description: "".to_string(),
                    category: "Protocol Security".to_string(),
                    severity: Severity::Medium,
                    remediation: "".to_string(),
                    rules: vec![],
                },
            ],
        };

        let categories = framework.categories();
        assert_eq!(categories.len(), 2);
        assert!(categories.contains(&"Protocol Security".to_string()));
        assert!(categories.contains(&"Cipher Security".to_string()));
    }
}