Skip to content

Commit be60387

Browse files
amirmalkaamirmalka
authored
deprecate control name in posture exception policies (#157)
* deprecate control name in posture exception policies Signed-off-by: Amir Malka <[email protected]> * deprecate control name in posture exception policies Signed-off-by: Amir Malka <[email protected]> --------- Signed-off-by: Amir Malka <[email protected]>
1 parent 4b74aec commit be60387

File tree

3 files changed

+21
-30
lines changed

3 files changed

+21
-30
lines changed

‎exceptions/exceptionprocessor.go

+7-10
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,14 @@ func (p *Processor) SetFrameworkExceptions(frameworkReport *reporthandling.Frame
3535
// SetControlExceptions add exceptions to control report
3636
func (p *Processor) SetControlExceptions(controlReport *reporthandling.ControlReport, exceptionsPolicies []armotypes.PostureExceptionPolicy, clusterName, frameworkName string) {
3737
for r := range controlReport.RuleReports {
38-
p.SetRuleExceptions(&controlReport.RuleReports[r], exceptionsPolicies, clusterName, frameworkName, controlReport.Name, controlReport.ControlID)
38+
p.SetRuleExceptions(&controlReport.RuleReports[r], exceptionsPolicies, clusterName, frameworkName, controlReport.ControlID)
3939
}
4040
}
4141

4242
// SetRuleExceptions add exceptions to rule report
43-
func (p *Processor) SetRuleExceptions(ruleReport *reporthandling.RuleReport, exceptionsPolicies []armotypes.PostureExceptionPolicy, clusterName, frameworkName, controlName, controlID string) {
43+
func (p *Processor) SetRuleExceptions(ruleReport *reporthandling.RuleReport, exceptionsPolicies []armotypes.PostureExceptionPolicy, clusterName, frameworkName, controlID string) {
4444
// adding exceptions to the rules
45-
ruleExceptions := p.ListRuleExceptions(exceptionsPolicies, frameworkName, controlName, controlID, ruleReport.Name)
45+
ruleExceptions := p.ListRuleExceptions(exceptionsPolicies, frameworkName, controlID, ruleReport.Name)
4646
p.SetRuleResponsExceptions(ruleReport.RuleResponses, ruleExceptions, clusterName)
4747
}
4848

@@ -68,11 +68,11 @@ func (p *Processor) SetRuleResponsExceptions(results []reporthandling.RuleRespon
6868
}
6969
}
7070

71-
func (p *Processor) ListRuleExceptions(exceptionPolicies []armotypes.PostureExceptionPolicy, frameworkName, controlName, controlID, ruleName string) []armotypes.PostureExceptionPolicy {
71+
func (p *Processor) ListRuleExceptions(exceptionPolicies []armotypes.PostureExceptionPolicy, frameworkName, controlID, ruleName string) []armotypes.PostureExceptionPolicy {
7272
ruleExceptions := make([]armotypes.PostureExceptionPolicy, 0, len(exceptionPolicies))
7373

7474
for i := range exceptionPolicies {
75-
if p.ruleHasExceptions(&exceptionPolicies[i], frameworkName, controlName, controlID, ruleName) {
75+
if p.ruleHasExceptions(&exceptionPolicies[i], frameworkName, controlID, ruleName) {
7676
ruleExceptions = append(ruleExceptions, exceptionPolicies[i])
7777
}
7878
}
@@ -81,21 +81,18 @@ func (p *Processor) ListRuleExceptions(exceptionPolicies []armotypes.PostureExce
8181

8282
}
8383

84-
func (p *Processor) ruleHasExceptions(exceptionPolicy *armotypes.PostureExceptionPolicy, frameworkName, controlName, controlID, ruleName string) bool {
84+
func (p *Processor) ruleHasExceptions(exceptionPolicy *armotypes.PostureExceptionPolicy, frameworkName, controlID, ruleName string) bool {
8585
if len(exceptionPolicy.PosturePolicies) == 0 {
8686
return true // empty policy -> apply all
8787
}
8888

8989
for _, posturePolicy := range exceptionPolicy.PosturePolicies {
90-
if posturePolicy.FrameworkName == "" && posturePolicy.ControlName == "" && posturePolicy.ControlID == "" && posturePolicy.RuleName == "" {
90+
if posturePolicy.FrameworkName == "" && posturePolicy.ControlID == "" && posturePolicy.RuleName == "" {
9191
return true // empty policy -> apply all
9292
}
9393
if posturePolicy.FrameworkName != "" && frameworkName != "" && !(strings.EqualFold(posturePolicy.FrameworkName, frameworkName) || p.regexCompareI(posturePolicy.FrameworkName, frameworkName)) {
9494
continue // policy does not match
9595
}
96-
if posturePolicy.ControlName != "" && controlName != "" && !(strings.EqualFold(posturePolicy.ControlName, controlName) || p.regexCompareI(posturePolicy.ControlName, controlName)) {
97-
continue // policy does not match
98-
}
9996
if posturePolicy.ControlID != "" && controlID != "" && !(strings.EqualFold(posturePolicy.ControlID, controlID) || p.regexCompareI(posturePolicy.ControlID, controlID)) {
10097
continue // policy does not match
10198
}

‎exceptions/exceptionprocessor_test.go

+12-18
Original file line numberDiff line numberDiff line change
@@ -109,64 +109,58 @@ func emptyPostureExceptionPolicyAlertOnlyMock() *armotypes.PostureExceptionPolic
109109
func TestListRuleExceptions(t *testing.T) {
110110
p := NewProcessor()
111111
exceptionPolicies := []armotypes.PostureExceptionPolicy{*postureExceptionPolicyAlertOnlyMock()}
112-
res1 := p.ListRuleExceptions(exceptionPolicies, "MITRE", "", "", "")
112+
res1 := p.ListRuleExceptions(exceptionPolicies, "MITRE", "", "")
113113
assert.Equal(t, 1, len(res1))
114114

115-
res2 := p.ListRuleExceptions(exceptionPolicies, "", "hostPath mount", "", "")
115+
res2 := p.ListRuleExceptions(exceptionPolicies, "", "", "")
116116
assert.Equal(t, len(res2), 1)
117117

118-
res3 := p.ListRuleExceptions(exceptionPolicies, "NSA", "", "", "")
118+
res3 := p.ListRuleExceptions(exceptionPolicies, "NSA", "", "")
119119
assert.Equal(t, len(res3), 0)
120120

121121
}
122122

123123
func TestListRuleExceptionsRegex(t *testing.T) {
124124
p := NewProcessor()
125125
exceptionPolicy := emptyPostureExceptionPolicyAlertOnlyMock()
126-
res1 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "", "")
126+
res1 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "")
127127
assert.Equal(t, 1, len(res1))
128128

129129
exceptionPolicy.PosturePolicies = append(exceptionPolicy.PosturePolicies, armotypes.PosturePolicy{
130130
FrameworkName: "MIT.*",
131131
})
132132

133-
res2 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "", "")
134-
assert.Equal(t, 1, len(res2))
135-
136-
res2 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "2MITRE", "", "", "")
133+
res2 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "2MITRE", "", "")
137134
assert.Equal(t, 0, len(res2))
138135

139136
exceptionPolicy.PosturePolicies[0] = armotypes.PosturePolicy{
140137
FrameworkName: "mit.*",
141138
}
142-
res2 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "", "")
139+
res2 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "")
143140
assert.Equal(t, 1, len(res2))
144141

145142
exceptionPolicy.PosturePolicies[0] = armotypes.PosturePolicy{
146143
FrameworkName: "mitre",
147144
}
148-
res2 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "", "")
145+
res2 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "")
149146
assert.Equal(t, 1, len(res2))
150147

151148
exceptionPolicy.PosturePolicies[0] = armotypes.PosturePolicy{
152149
FrameworkName: "MITRE",
153-
ControlName: "my.*",
150+
ControlName: "my.*", // deprecated
154151
RuleName: "rule.*vk",
155152
}
156153

157-
res3 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "", "")
154+
res3 := p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "")
158155
assert.Equal(t, 1, len(res3))
159156

160-
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "my-control", "", "")
157+
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "")
161158
assert.Equal(t, 1, len(res3))
162159

163-
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "control-my", "", "")
164-
assert.Equal(t, 0, len(res3))
165-
166-
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "my-control", "", "rulebla -bla vk")
160+
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "rulebla -bla vk")
167161
assert.Equal(t, 1, len(res3))
168162

169-
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "control-my", "", "rulebla -bla")
163+
res3 = p.ListRuleExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, "MITRE", "", "rulebla -bla")
170164
assert.Equal(t, 0, len(res3))
171165
}
172166

‎reporthandling/results/v1/resourcesresults/exceptions.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ func (control *ResourceAssociatedControl) setExceptions(workload workloadinterfa
6060
}
6161

6262
for i := range control.ResourceAssociatedRules {
63-
exceptionsPolicies = processor.ListRuleExceptions(exceptionsPolicies, "", control.GetName(), control.GetID(), "")
63+
exceptionsPolicies = processor.ListRuleExceptions(exceptionsPolicies, "", control.GetID(), "")
6464
control.ResourceAssociatedRules[i].setExceptions(workload, exceptionsPolicies, clusterName, processor)
6565
// Update rule status according to exceptions
6666
control.ResourceAssociatedRules[i].SetStatus(control.ResourceAssociatedRules[i].GetStatus(nil).Status(), nil)
@@ -76,6 +76,6 @@ func (rule *ResourceAssociatedRule) setExceptions(workload workloadinterface.IMe
7676
return
7777
}
7878

79-
ruleExceptions := processor.ListRuleExceptions(exceptionsPolicies, "", "", "", rule.GetName())
79+
ruleExceptions := processor.ListRuleExceptions(exceptionsPolicies, "", "", rule.GetName())
8080
rule.Exception = processor.GetResourceExceptions(ruleExceptions, workload, clusterName)
8181
}

0 commit comments

Comments
 (0)