fix: iteration and attribute read

prowler/providers/cloudflare/services/firewall/firewall_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.cloudflare.services.firewall.firewall_service import Firewall
+from prowler.providers.common.provider import Provider
+
+firewall_client = Firewall(Provider.get_global_provider())

prowler/providers/cloudflare/services/firewall/firewall_service.py

@@ -0,0 +1,77 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.cloudflare.lib.service.service import CloudflareService
+from prowler.providers.cloudflare.services.zones.zones_client import zones_client
+
+
+class Firewall(CloudflareService):
+    """Retrieve Cloudflare firewall rules for all zones."""
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        self.rules: list["CloudflareFirewallRule"] = []
+        self._list_rulesets()
+
+    def _list_rulesets(self) -> None:
+        """List firewall rulesets for all zones."""
+        logger.info("Firewall - Listing firewall rulesets...")
+        try:
+            for zone in zones_client.zones.values():
+                try:
+                    # Get all rulesets for the zone
+                    rulesets = self.client.rulesets.list(zone_id=zone.id)
+                    for ruleset in rulesets:
+                        ruleset_id = getattr(ruleset, "id", None)
+                        phase = getattr(ruleset, "phase", None)
+                        if not ruleset_id:
+                            continue
+
+                        # Get rules within each ruleset
+                        try:
+                            ruleset_detail = self.client.rulesets.get(
+                                ruleset_id=ruleset_id, zone_id=zone.id
+                            )
+                            rules = getattr(ruleset_detail, "rules", []) or []
+                            for rule in rules:
+                                self.rules.append(
+                                    CloudflareFirewallRule(
+                                        id=getattr(rule, "id", None),
+                                        zone_id=zone.id,
+                                        zone_name=zone.name,
+                                        ruleset_id=ruleset_id,
+                                        phase=phase,
+                                        action=getattr(rule, "action", None),
+                                        expression=getattr(rule, "expression", None),
+                                        description=getattr(rule, "description", None),
+                                        enabled=getattr(rule, "enabled", True),
+                                    )
+                                )
+                        except Exception as error:
+                            logger.debug(
+                                f"{zone.id} ruleset {ruleset_id} -- {error.__class__.__name__}: {error}"
+                            )
+                except Exception as error:
+                    logger.error(
+                        f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class CloudflareFirewallRule(BaseModel):
+    """Cloudflare firewall rule representation."""
+
+    id: Optional[str] = None
+    zone_id: str
+    zone_name: str
+    ruleset_id: Optional[str] = None
+    phase: Optional[str] = None
+    action: Optional[str] = None
+    expression: Optional[str] = None
+    description: Optional[str] = None
+    enabled: bool = True

prowler/providers/cloudflare/services/zones/zones_always_online_disabled/zones_always_online_disabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_always_online_disabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_bot_fight_mode_enabled/zones_bot_fight_mode_enabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_bot_fight_mode_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_challenge_passage_configured/zones_challenge_passage_configured.py

@@ -8,7 +8,7 @@ class zones_challenge_passage_configured(Check):
         # Recommended challenge TTL is 1 hour (3600 seconds)
         recommended_ttl = 3600
 
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_development_mode_disabled/zones_development_mode_disabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_development_mode_disabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_hotlink_protection_enabled/zones_hotlink_protection_enabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_hotlink_protection_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_ip_geolocation_enabled/zones_ip_geolocation_enabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_ip_geolocation_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_rate_limiting_enabled/zones_rate_limiting_enabled.py

@@ -9,7 +9,7 @@ class zones_rate_limiting_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
 
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,
@@ -19,7 +19,7 @@ class zones_rate_limiting_enabled(Check):
             rate_limit_rules = [
                 rule
                 for rule in firewall_client.rules
-                if rule.zone.id == zone.id
+                if rule.zone_id == zone.id
                 and rule.phase == "http_ratelimit"
                 and rule.enabled
             ]

prowler/providers/cloudflare/services/zones/zones_server_side_excludes_enabled/zones_server_side_excludes_enabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_server_side_excludes_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,

prowler/providers/cloudflare/services/zones/zones_waf_enabled/zones_waf_enabled.py

@@ -5,7 +5,7 @@ from prowler.providers.cloudflare.services.zones.zones_client import zones_clien
 class zones_waf_enabled(Check):
     def execute(self) -> list[CheckReportCloudflare]:
         findings = []
-        for zone in zones_client.zones:
+        for zone in zones_client.zones.values():
             report = CheckReportCloudflare(
                 metadata=self.metadata(),
                 resource=zone,