a Cloudflare rule that never applies because the record is grey-clouded

"""Find Cloudflare rules that can never fire because the record is not proxied.

Rules only apply to proxied traffic. A grey-clouded record resolves straight to the
origin, so the rule is never consulted -- which looks identical to a rule that
matches and does nothing.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("cloudflare_proxy_audit")

API = "https://api.cloudflare.com/client/v4"
# Records that SHOULD be unproxied. Proxying these breaks them, so they are not
# findings -- reporting them would train people to ignore the output.
NEVER_PROXY = {"MX", "TXT", "NS", "SRV", "CAA", "PTR"}


def unproxied_http_records(records):
    """Pure decision function.

    Only A, AAAA and CNAME records can be proxied at all. Mail and metadata records
    are correctly grey and must not be reported.
    """
    return [r for r in records
            if r.get("type") in {"A", "AAAA", "CNAME"}
            and r.get("type") not in NEVER_PROXY
            and not r.get("proxied", False)]


def dead_rules(rule_targets, unproxied_names):
    """Which configured hostnames point at something Cloudflare never sees?"""
    grey = {r["name"] for r in unproxied_names}
    return [t for t in rule_targets if t in grey]


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--zone-id", required=True)
    ap.add_argument("--rule-target", nargs="*", default=[],
                    help="hostnames your rules apply to")
    args = ap.parse_args()

    token = os.environ.get("CF_API_TOKEN")
    if not token:
        log.error("set CF_API_TOKEN")
        return 2
    s = requests.Session()
    s.headers.update({"Authorization": f"Bearer {token}"})

    r = s.get(f"{API}/zones/{args.zone_id}/dns_records",
              params={"per_page": 500}, timeout=30)
    r.raise_for_status()
    records = r.json().get("result", [])

    grey = unproxied_http_records(records)
    log.info("%d record(s); %d HTTP record(s) not proxied", len(records), len(grey))
    for rec in grey:
        log.warning("DNS ONLY  %-40s %s -> %s  (origin IP is public; rules will not run)",
                    rec["name"], rec["type"], rec.get("content"))

    dead = dead_rules(args.rule_target, grey)
    for t in dead:
        log.error("RULE DEAD  a rule targeting %s can never fire -- that hostname "
                  "bypasses Cloudflare entirely", t)
    return 1 if dead else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Find Cloudflare rules that can never fire because the record is not proxied.
 *
 * Rules only apply to proxied traffic. A grey-clouded record resolves straight to
 * the origin, so the rule is never consulted.
 */
const API = 'https://api.cloudflare.com/client/v4';
// Records that SHOULD be unproxied. Reporting them would train people to ignore output.
const NEVER_PROXY = new Set(['MX', 'TXT', 'NS', 'SRV', 'CAA', 'PTR']);

/**
 * Pure decision function. Only A, AAAA and CNAME can be proxied at all; mail and
 * metadata records are correctly grey.
 */
export function unproxiedHttpRecords(records) {
  return records.filter((r) => ['A', 'AAAA', 'CNAME'].includes(r.type)
    && !NEVER_PROXY.has(r.type) && !r.proxied);
}

export function deadRules(ruleTargets, unproxied) {
  const grey = new Set(unproxied.map((r) => r.name));
  return ruleTargets.filter((t) => grey.has(t));
}

async function main() {
  const zone = process.argv[process.argv.indexOf('--zone-id') + 1];
  const at = process.argv.indexOf('--rule-target');
  const targets = at === -1 ? [] : process.argv.slice(at + 1).filter((a) => !a.startsWith('--'));
  const token = process.env.CF_API_TOKEN;
  if (!token) { console.error('set CF_API_TOKEN'); process.exit(2); }

  const res = await fetch(`${API}/zones/${zone}/dns_records?per_page=500`,
    { headers: { Authorization: `Bearer ${token}` } });
  const { result: records = [] } = await res.json();

  const grey = unproxiedHttpRecords(records);
  console.log(`${records.length} record(s); ${grey.length} HTTP record(s) not proxied`);
  for (const rec of grey) {
    console.warn(`DNS ONLY  ${rec.name.padEnd(40)} ${rec.type} -> ${rec.content}  (origin IP is public)`);
  }
  const dead = deadRules(targets, grey);
  for (const t of dead) {
    console.error(`RULE DEAD  a rule targeting ${t} can never fire -- that hostname bypasses Cloudflare`);
  }
  process.exit(dead.length ? 1 : 0);
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from cloudflare_proxy_audit import unproxied_http_records, dead_rules


def rec(name, rtype="A", proxied=True):
    return {"name": name, "type": rtype, "proxied": proxied, "content": "203.0.113.1"}


def test_a_proxied_record_is_not_reported():
    assert unproxied_http_records([rec("app.example.com")]) == []


def test_a_grey_clouded_a_record_is_reported():
    out = unproxied_http_records([rec("app.example.com", proxied=False)])
    assert len(out) == 1


def test_mx_records_are_never_reported():
    """MX must be grey. Reporting it is how a report becomes noise."""
    assert unproxied_http_records([rec("example.com", "MX", proxied=False)]) == []


def test_txt_records_are_never_reported():
    assert unproxied_http_records([rec("example.com", "TXT", proxied=False)]) == []


def test_a_rule_on_a_grey_hostname_is_dead():
    grey = unproxied_http_records([rec("app.example.com", proxied=False)])
    assert dead_rules(["app.example.com"], grey) == ["app.example.com"]


def test_a_rule_on_a_proxied_hostname_is_live():
    grey = unproxied_http_records([rec("app.example.com", proxied=True)])
    assert dead_rules(["app.example.com"], grey) == []

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { unproxiedHttpRecords, deadRules } from './cloudflare-proxy-audit.mjs';

const rec = (name, type = 'A', proxied = true) => ({ name, type, proxied, content: '203.0.113.1' });

test('a proxied record is not reported', () => {
  assert.deepEqual(unproxiedHttpRecords([rec('app.example.com')]), []);
});

test('a grey-clouded A record is reported', () => {
  assert.equal(unproxiedHttpRecords([rec('app.example.com', 'A', false)]).length, 1);
});

test('MX records are never reported', () => {
  assert.deepEqual(unproxiedHttpRecords([rec('example.com', 'MX', false)]), []);
});

test('a rule on a grey hostname is dead', () => {
  const grey = unproxiedHttpRecords([rec('app.example.com', 'A', false)]);
  assert.deepEqual(deadRules(['app.example.com'], grey), ['app.example.com']);
});