From 27c97684b97a893fe8ec48491572cd4f24029005 Mon Sep 17 00:00:00 2001 From: yiscah Date: Tue, 14 Sep 2021 13:38:53 +0300 Subject: [PATCH 1/6] delete redundant rule responses --- cautils/opapolicy/datastructuresmethods.go | 57 +++++++++++++++++++++- 1 file changed, 55 insertions(+), 2 deletions(-) diff --git a/cautils/opapolicy/datastructuresmethods.go b/cautils/opapolicy/datastructuresmethods.go index c503707f..1316270b 100644 --- a/cautils/opapolicy/datastructuresmethods.go +++ b/cautils/opapolicy/datastructuresmethods.go @@ -3,6 +3,8 @@ package opapolicy import ( "bytes" "encoding/json" + + "github.com/armosec/kubescape/cautils/k8sinterface" ) func (pn *PolicyNotification) ToJSONBytesBuffer() (*bytes.Buffer, error) { @@ -120,14 +122,65 @@ func (ruleReport *RuleReport) GetNumberOfResources() int { func (ruleReport *RuleReport) GetNumberOfFailedResources() int { sum := 0 - for i := range ruleReport.RuleResponses { + for i := 0; i < len(ruleReport.RuleResponses); i++ { if ruleReport.RuleResponses[i].GetSingleResultStatus() == "failed" { - sum += 1 + if !ruleReport.DeleteIfRedundantResponse(&ruleReport.RuleResponses[i], i) { + sum += 1 + } else { + i-- + } } } return sum } +func (ruleReport *RuleReport) DeleteIfRedundantResponse(RuleResponse *RuleResponse, index int) bool { + if b, rr := ruleReport.IsDuplicateResponseOfResource(RuleResponse, index); b { + rr.AddMessageToResponse(RuleResponse.AlertMessage) + ruleReport.RuleResponses = removeResponse(ruleReport.RuleResponses, index) + return true + } + return false +} + +func (ruleResponse *RuleResponse) AddMessageToResponse(message string) { + // fmt.Printf("adding message\n") + var messages []string + if m, exist := ruleResponse.AlertObject.ExternalObjects["additionalMessages"]; exist { + switch t := m.(type) { + case []string: + messages = append(t, message) + } + } else { + messages = append(messages, message) + } + if ruleResponse.AlertObject.ExternalObjects == nil { + ruleResponse.AlertObject.ExternalObjects = make(map[string]interface{}) + } + ruleResponse.AlertObject.ExternalObjects["additionalMessages"] = messages +} + +func (ruleReport *RuleReport) IsDuplicateResponseOfResource(RuleResponse *RuleResponse, index int) (bool, *RuleResponse) { + for i := range ruleReport.RuleResponses { + if i != index { + for j := range ruleReport.RuleResponses[i].AlertObject.K8SApiObjects { + for k := range RuleResponse.AlertObject.K8SApiObjects { + w1 := k8sinterface.NewWorkloadObj(ruleReport.RuleResponses[i].AlertObject.K8SApiObjects[j]) + w2 := k8sinterface.NewWorkloadObj(RuleResponse.AlertObject.K8SApiObjects[k]) + if w1.GetName() == w2.GetName() && w1.GetNamespace() == w2.GetNamespace() { + return true, &ruleReport.RuleResponses[i] + } + } + } + } + } + return false, nil +} + +func removeResponse(slice []RuleResponse, index int) []RuleResponse { + return append(slice[:index], slice[index+1:]...) +} + func (ruleReport *RuleReport) GetNumberOfWarningResources() int { sum := 0 for i := range ruleReport.RuleResponses { From 033ed17125b749608fb4d5e9d7fdc0d6459b42e1 Mon Sep 17 00:00:00 2001 From: yiscah Date: Tue, 14 Sep 2021 14:58:10 +0300 Subject: [PATCH 2/6] controlReport status is passed only if ALL ruleReports passed --- cautils/opapolicy/datastructuresmethods.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cautils/opapolicy/datastructuresmethods.go b/cautils/opapolicy/datastructuresmethods.go index 1316270b..32610c18 100644 --- a/cautils/opapolicy/datastructuresmethods.go +++ b/cautils/opapolicy/datastructuresmethods.go @@ -85,11 +85,11 @@ func (controlReport *ControlReport) ListControlsInputKinds() []string { func (controlReport *ControlReport) Passed() bool { for i := range controlReport.RuleReports { - if len(controlReport.RuleReports[i].RuleResponses) == 0 { - return true + if len(controlReport.RuleReports[i].RuleResponses) != 0 { + return false } } - return false + return true } func (controlReport *ControlReport) Warning() bool { From c869f2c962e911ff80a6231073742b1cc15a76d9 Mon Sep 17 00:00:00 2001 From: yiscah Date: Tue, 14 Sep 2021 16:36:57 +0300 Subject: [PATCH 3/6] append to msg, loop backward on ruleresponses, don't check redundant role/clusterrole k8sresources --- cautils/opapolicy/datastructuresmethods.go | 26 ++++++---------------- 1 file changed, 7 insertions(+), 19 deletions(-) diff --git a/cautils/opapolicy/datastructuresmethods.go b/cautils/opapolicy/datastructuresmethods.go index 32610c18..97250456 100644 --- a/cautils/opapolicy/datastructuresmethods.go +++ b/cautils/opapolicy/datastructuresmethods.go @@ -122,13 +122,14 @@ func (ruleReport *RuleReport) GetNumberOfResources() int { func (ruleReport *RuleReport) GetNumberOfFailedResources() int { sum := 0 - for i := 0; i < len(ruleReport.RuleResponses); i++ { + for i := len(ruleReport.RuleResponses) - 1; i >= 0; i-- { if ruleReport.RuleResponses[i].GetSingleResultStatus() == "failed" { if !ruleReport.DeleteIfRedundantResponse(&ruleReport.RuleResponses[i], i) { - sum += 1 - } else { - i-- + sum++ } + // else { + // i-- + // } } } return sum @@ -144,20 +145,7 @@ func (ruleReport *RuleReport) DeleteIfRedundantResponse(RuleResponse *RuleRespon } func (ruleResponse *RuleResponse) AddMessageToResponse(message string) { - // fmt.Printf("adding message\n") - var messages []string - if m, exist := ruleResponse.AlertObject.ExternalObjects["additionalMessages"]; exist { - switch t := m.(type) { - case []string: - messages = append(t, message) - } - } else { - messages = append(messages, message) - } - if ruleResponse.AlertObject.ExternalObjects == nil { - ruleResponse.AlertObject.ExternalObjects = make(map[string]interface{}) - } - ruleResponse.AlertObject.ExternalObjects["additionalMessages"] = messages + ruleResponse.AlertMessage += message } func (ruleReport *RuleReport) IsDuplicateResponseOfResource(RuleResponse *RuleResponse, index int) (bool, *RuleResponse) { @@ -167,7 +155,7 @@ func (ruleReport *RuleReport) IsDuplicateResponseOfResource(RuleResponse *RuleRe for k := range RuleResponse.AlertObject.K8SApiObjects { w1 := k8sinterface.NewWorkloadObj(ruleReport.RuleResponses[i].AlertObject.K8SApiObjects[j]) w2 := k8sinterface.NewWorkloadObj(RuleResponse.AlertObject.K8SApiObjects[k]) - if w1.GetName() == w2.GetName() && w1.GetNamespace() == w2.GetNamespace() { + if w1.GetName() == w2.GetName() && w1.GetNamespace() == w2.GetNamespace() && w1.GetKind() != "Role" && w1.GetKind() != "ClusterRole" { return true, &ruleReport.RuleResponses[i] } } From a48c6802018d691c77032a04f441d262c4f6c028 Mon Sep 17 00:00:00 2001 From: Ben Hirschberg Date: Tue, 14 Sep 2021 16:36:57 +0300 Subject: [PATCH 4/6] build dev branch --- .github/workflows/build_dev.yaml | 36 ++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/build_dev.yaml diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml new file mode 100644 index 00000000..26507b80 --- /dev/null +++ b/.github/workflows/build_dev.yaml @@ -0,0 +1,36 @@ +name: build + +on: + push: + branches: [ dev ] + pull_request: + branches: [ dev ] + types: [ closed ] +jobs: + build: + name: Create cross-platform dev build + needs: once + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest, macos-latest, windows-latest] + steps: + - uses: actions/checkout@v1 + + - name: Set up Go + uses: actions/setup-go@v2 + with: + go-version: 1.16 + - name: Build + env: + RELEASE: v1.0.${{ github.run_number }} + ArmoBEServer: api.armo.cloud + ArmoERServer: report.euprod1.cyberarmorsoft.com + ArmoWebsite: portal.armo.cloud + run: mkdir -p build/${{ matrix.os }} && go mod tidy && go build -ldflags "-w -s -X github.com/armosec/kubescape/cmd.BuildNumber=$RELEASE -X github.com/armosec/kubescape/cautils/getter.ArmoBEURL=$ArmoBEServer -X github.com/armosec/kubescape/cautils/getter.ArmoERURL=$ArmoERServer -X github.com/armosec/kubescape/cautils/getter.ArmoFEURL=$ArmoWebsite" -o build/${{ matrix.os }}/kubescape # && md5sum build/${{ matrix.os }}/kubescape > build/${{ matrix.os }}/kubescape.md5 + + - name: Upload build artifacts + uses: actions/upload-artifact@v2 + with: + name: kubescape-${{ matrix.os }} + path: build/${{ matrix.os }}/kubescape From ec6c3da5ec8ed35ef09ee4427b10ddce85b11ec5 Mon Sep 17 00:00:00 2001 From: Ben Hirschberg Date: Tue, 14 Sep 2021 16:40:12 +0300 Subject: [PATCH 5/6] no needs :) --- .github/workflows/build_dev.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index 26507b80..38387b7a 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -9,7 +9,6 @@ on: jobs: build: name: Create cross-platform dev build - needs: once runs-on: ${{ matrix.os }} strategy: matrix: From a5e2ebf6471fed2995a3ad201a27e630a6152a85 Mon Sep 17 00:00:00 2001 From: Benyamin Hirschberg <59160382+BenHirschbergCa@users.noreply.github.com> Date: Tue, 14 Sep 2021 16:51:16 +0300 Subject: [PATCH 6/6] Update datastructuresmethods.go --- cautils/opapolicy/datastructuresmethods.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/cautils/opapolicy/datastructuresmethods.go b/cautils/opapolicy/datastructuresmethods.go index 97250456..57a499e8 100644 --- a/cautils/opapolicy/datastructuresmethods.go +++ b/cautils/opapolicy/datastructuresmethods.go @@ -127,9 +127,6 @@ func (ruleReport *RuleReport) GetNumberOfFailedResources() int { if !ruleReport.DeleteIfRedundantResponse(&ruleReport.RuleResponses[i], i) { sum++ } - // else { - // i-- - // } } } return sum