firewall_objects/service/application/

mod.rs

//! Application object definitions and lightweight match helpers.
//!
//! This module exposes the types used to describe Layer-7 applications and
//! provides simple matching primitives. Sample application entries live in the
//! [`catalog`] submodule so consumers can replace or extend them as needed.
//!
//! Feature flags:
//! - `serde` – Enables serialization for the public structs.

pub mod catalog;

use crate::service::TransportService;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ApplicationIndicators<'a> {
    pub dns_suffixes: &'a [&'a str],
    pub tls_sni_suffixes: &'a [&'a str],
    pub http_hosts: &'a [&'a str],
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ApplicationDefinition<'a> {
    pub name: &'a str,
    pub category: &'a str,
    pub transports: &'a [TransportService],
    pub indicators: ApplicationIndicators<'a>,
}

#[derive(Default)]
pub struct ApplicationMatchInput<'a> {
    pub dns_query: Option<&'a str>,
    pub tls_sni: Option<&'a str>,
    pub http_host: Option<&'a str>,
}

/// Owned application object suitable for serialization and CRUD operations.
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
#[derive(Debug, Clone, PartialEq)]
pub struct ApplicationObj {
    pub name: String,
    pub category: String,
    pub transports: Vec<TransportService>,
    pub dns_suffixes: Vec<String>,
    pub tls_sni_suffixes: Vec<String>,
    pub http_hosts: Vec<String>,
}

impl<'a> ApplicationDefinition<'a> {
    /// Returns true when the provided metadata satisfies this application's indicators.
    ///
    /// ```
    /// use firewall_objects::service::application::{
    ///     ApplicationDefinition, ApplicationIndicators, ApplicationMatchInput,
    /// };
    /// use firewall_objects::service::TransportService;
    ///
    /// let app = ApplicationDefinition {
    ///     name: "example",
    ///     category: "test",
    ///     transports: &[TransportService::tcp(443)],
    ///     indicators: ApplicationIndicators {
    ///         dns_suffixes: &[".example.com"],
    ///         tls_sni_suffixes: &[],
    ///         http_hosts: &["example.com"],
    ///     },
    /// };
    ///
    /// let input = ApplicationMatchInput {
    ///     http_host: Some("example.com"),
    ///     ..Default::default()
    /// };
    ///
    /// assert!(app.matches(&input));
    /// ```
    pub fn matches(&self, input: &ApplicationMatchInput<'_>) -> bool {
        self.indicators.matches(input)
    }
}

impl<'a> ApplicationIndicators<'a> {
    pub fn matches(&self, input: &ApplicationMatchInput<'_>) -> bool {
        if let Some(query) = input.dns_query
            && self
                .dns_suffixes
                .iter()
                .any(|suffix| query.to_ascii_lowercase().ends_with(suffix))
        {
            return true;
        }

        if let Some(sni) = input.tls_sni
            && self
                .tls_sni_suffixes
                .iter()
                .any(|suffix| sni.to_ascii_lowercase().ends_with(suffix))
        {
            return true;
        }

        if let Some(host) = input.http_host
            && self
                .http_hosts
                .iter()
                .any(|expected| host.eq_ignore_ascii_case(expected))
        {
            return true;
        }

        false
    }
}

impl ApplicationObj {
    /// Evaluate indicators against observed metadata.
    pub fn matches(&self, input: &ApplicationMatchInput<'_>) -> bool {
        let dns_query = input.dns_query.map(|v| v.to_ascii_lowercase());
        if let Some(ref query) = dns_query
            && self
                .dns_suffixes
                .iter()
                .any(|suffix| query.ends_with(suffix))
        {
            return true;
        }

        let tls_sni = input.tls_sni.map(|v| v.to_ascii_lowercase());
        if let Some(ref sni) = tls_sni
            && self
                .tls_sni_suffixes
                .iter()
                .any(|suffix| sni.ends_with(suffix))
        {
            return true;
        }

        if let Some(host) = input.http_host
            && self
                .http_hosts
                .iter()
                .any(|expected| host.eq_ignore_ascii_case(expected))
        {
            return true;
        }

        false
    }
}

impl<'a> From<ApplicationDefinition<'a>> for ApplicationObj {
    fn from(def: ApplicationDefinition<'a>) -> Self {
        Self {
            name: def.name.to_string(),
            category: def.category.to_string(),
            transports: def.transports.to_vec(),
            dns_suffixes: def
                .indicators
                .dns_suffixes
                .iter()
                .map(|s| s.to_string())
                .collect(),
            tls_sni_suffixes: def
                .indicators
                .tls_sni_suffixes
                .iter()
                .map(|s| s.to_string())
                .collect(),
            http_hosts: def
                .indicators
                .http_hosts
                .iter()
                .map(|s| s.to_string())
                .collect(),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn matches_dns_and_http() {
        let app = ApplicationDefinition {
            name: "demo",
            category: "qa",
            transports: &[TransportService::tcp(443)],
            indicators: ApplicationIndicators {
                dns_suffixes: &[".demo.local"],
                tls_sni_suffixes: &[".demo.local"],
                http_hosts: &["demo.local"],
            },
        };

        let dns = ApplicationMatchInput {
            dns_query: Some("api.demo.local"),
            ..Default::default()
        };
        assert!(app.matches(&dns));

        let http = ApplicationMatchInput {
            http_host: Some("Demo.Local"),
            ..Default::default()
        };
        assert!(app.matches(&http));
    }

    #[test]
    fn owned_application_matches_metadata() {
        let def = ApplicationDefinition {
            name: "owned",
            category: "sample",
            transports: &[TransportService::tcp(8443)],
            indicators: ApplicationIndicators {
                dns_suffixes: &[".owned.local"],
                tls_sni_suffixes: &[],
                http_hosts: &["owned.local"],
            },
        };
        let obj: ApplicationObj = def.into();
        let input = ApplicationMatchInput {
            http_host: Some("owned.local"),
            ..Default::default()
        };
        assert!(obj.matches(&input));
    }
}