cipherrun 0.3.0

A fast, modular, and scalable TLS/SSL security scanner written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

// Policy violation reporting

use crate::policy::PolicyAction;
use serde::{Deserialize, Serialize};

/// Represents a policy violation
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyViolation {
    pub rule_path: String, // e.g., "protocols.prohibited"
    pub rule_name: String, // e.g., "Prohibited Protocol Check"
    pub action: PolicyAction,
    pub description: String,
    pub evidence: Option<String>,
    pub remediation: Option<String>,
}

impl PolicyViolation {
    pub fn new(
        rule_path: impl Into<String>,
        rule_name: impl Into<String>,
        action: PolicyAction,
        description: impl Into<String>,
    ) -> Self {
        Self {
            rule_path: rule_path.into(),
            rule_name: rule_name.into(),
            action,
            description: description.into(),
            evidence: None,
            remediation: None,
        }
    }

    pub fn with_evidence(mut self, evidence: impl Into<String>) -> Self {
        self.evidence = Some(evidence.into());
        self
    }

    pub fn with_remediation(mut self, remediation: impl Into<String>) -> Self {
        self.remediation = Some(remediation.into());
        self
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_policy_violation_builder() {
        let violation = PolicyViolation::new(
            "protocols.prohibited",
            "Prohibited Protocol",
            PolicyAction::Fail,
            "TLS 1.0 is prohibited",
        )
        .with_evidence("Server accepts TLS 1.0")
        .with_remediation("Disable TLS 1.0 in server configuration");

        assert_eq!(violation.rule_path, "protocols.prohibited");
        assert_eq!(violation.rule_name, "Prohibited Protocol");
        assert!(violation.evidence.is_some());
        assert!(violation.remediation.is_some());
    }
}