-
Notifications
You must be signed in to change notification settings - Fork 552
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1601 from snyk/feat/iac-experimental-local-exec
IaC local execution experimental release #1
- Loading branch information
Showing
12 changed files
with
369 additions
and
2 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,86 @@ | ||
import * as fs from 'fs'; | ||
import * as YAML from 'js-yaml'; | ||
import { isLocalFolder } from '../../../../lib/detect'; | ||
import { getFileType } from '../../../../lib/iac/iac-parser'; | ||
import * as util from 'util'; | ||
import { IacFileTypes } from '../../../../lib/iac/constants'; | ||
import { IacFileScanResult, IacFileMetadata, IacFileData } from './types'; | ||
import { buildPolicyEngine } from './policy-engine'; | ||
import { formatResults } from './results-formatter'; | ||
|
||
const readFileContentsAsync = util.promisify(fs.readFile); | ||
const REQUIRED_K8S_FIELDS = ['apiVersion', 'kind', 'metadata']; | ||
|
||
// this method executes the local processing engine and then formats the results to adapt with the CLI output. | ||
// the current version is dependent on files to be present locally which are not part of the source code. | ||
// without these files this method would fail. | ||
// if you're interested in trying out the experimental local execution model for IaC scanning, please reach-out. | ||
export async function test(pathToScan: string, options) { | ||
// TODO: add support for proper typing of old TestResult interface. | ||
const results = await localProcessing(pathToScan); | ||
const formattedResults = formatResults(results, options); | ||
const singleFileFormattedResult = formattedResults[0]; | ||
|
||
return singleFileFormattedResult as any; | ||
} | ||
|
||
async function localProcessing( | ||
pathToScan: string, | ||
): Promise<IacFileScanResult[]> { | ||
const policyEngine = await buildPolicyEngine(); | ||
const filePathsToScan = await getFilePathsToScan(pathToScan); | ||
const fileDataToScan = await parseFileContentsForPolicyEngine( | ||
filePathsToScan, | ||
); | ||
const scanResults = await policyEngine.scanFiles(fileDataToScan); | ||
return scanResults; | ||
} | ||
|
||
async function getFilePathsToScan(pathToScan): Promise<IacFileMetadata[]> { | ||
if (isLocalFolder(pathToScan)) { | ||
throw new Error( | ||
'IaC Experimental version does not support directory scan yet.', | ||
); | ||
} | ||
if (getFileType(pathToScan) === 'tf') { | ||
throw new Error( | ||
'IaC Experimental version does not support Terraform scan yet.', | ||
); | ||
} | ||
|
||
return [ | ||
{ filePath: pathToScan, fileType: getFileType(pathToScan) as IacFileTypes }, | ||
]; | ||
} | ||
|
||
async function parseFileContentsForPolicyEngine( | ||
filesMetadata: IacFileMetadata[], | ||
): Promise<IacFileData[]> { | ||
const parsedFileData: Array<IacFileData> = []; | ||
for (const fileMetadata of filesMetadata) { | ||
const fileContent = await readFileContentsAsync( | ||
fileMetadata.filePath, | ||
'utf-8', | ||
); | ||
const yamlDocuments = YAML.safeLoadAll(fileContent); | ||
|
||
yamlDocuments.forEach((parsedYamlDocument, docId) => { | ||
if ( | ||
REQUIRED_K8S_FIELDS.every((requiredField) => | ||
parsedYamlDocument.hasOwnProperty(requiredField), | ||
) | ||
) { | ||
parsedFileData.push({ | ||
...fileMetadata, | ||
fileContent: fileContent, | ||
jsonContent: parsedYamlDocument, | ||
docId, | ||
}); | ||
} else { | ||
throw new Error('Invalid K8s File!'); | ||
} | ||
}); | ||
} | ||
|
||
return parsedFileData; | ||
} |
63 changes: 63 additions & 0 deletions
63
src/cli/commands/test/iac-local-execution/policy-engine.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
import { | ||
OpaWasmInstance, | ||
IacFileData, | ||
IacFileScanResult, | ||
PolicyMetadata, | ||
} from './types'; | ||
import { loadPolicy } from '@open-policy-agent/opa-wasm'; | ||
import * as fs from 'fs'; | ||
import * as path from 'path'; | ||
|
||
const LOCAL_POLICY_ENGINE_DIR = `.iac-data`; | ||
const LOCAL_POLICY_ENGINE_WASM_PATH = `${LOCAL_POLICY_ENGINE_DIR}${path.sep}policy.wasm`; | ||
const LOCAL_POLICY_ENGINE_DATA_PATH = `${LOCAL_POLICY_ENGINE_DIR}${path.sep}data.json`; | ||
|
||
export async function buildPolicyEngine(): Promise<PolicyEngine> { | ||
const policyEngineCoreDataPath = `${process.cwd()}/${LOCAL_POLICY_ENGINE_WASM_PATH}`; | ||
const policyEngineMetaDataPath = `${process.cwd()}/${LOCAL_POLICY_ENGINE_DATA_PATH}`; | ||
try { | ||
const wasmFile = fs.readFileSync(policyEngineCoreDataPath); | ||
const policyMetaData = fs.readFileSync(policyEngineMetaDataPath); | ||
const policyMetadataAsJson: Record<string, any> = JSON.parse( | ||
policyMetaData.toString(), | ||
); | ||
|
||
const opaWasmInstance: OpaWasmInstance = await loadPolicy( | ||
Buffer.from(wasmFile), | ||
); | ||
opaWasmInstance.setData(policyMetadataAsJson); | ||
|
||
return new PolicyEngine(opaWasmInstance); | ||
} catch (err) { | ||
throw new Error( | ||
`Failed to build policy engine from path: ${LOCAL_POLICY_ENGINE_DIR}: \n err: ${err.message}`, | ||
); | ||
} | ||
} | ||
|
||
class PolicyEngine { | ||
constructor(private opaWasmInstance: OpaWasmInstance) { | ||
this.opaWasmInstance = opaWasmInstance; | ||
} | ||
|
||
private evaluate(data: Record<string, any>): PolicyMetadata[] { | ||
return this.opaWasmInstance.evaluate(data)[0].result; | ||
} | ||
|
||
public async scanFiles( | ||
filesToScan: IacFileData[], | ||
): Promise<IacFileScanResult[]> { | ||
try { | ||
return filesToScan.map((iacFile: IacFileData) => { | ||
const violatedPolicies = this.evaluate(iacFile.jsonContent); | ||
return { | ||
...iacFile, | ||
violatedPolicies, | ||
}; | ||
}); | ||
} catch (err) { | ||
// TODO: to distinguish between different failure reasons | ||
throw new Error(`Failed to run policy engine: ${err}`); | ||
} | ||
} | ||
} |
121 changes: 121 additions & 0 deletions
121
src/cli/commands/test/iac-local-execution/results-formatter.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,121 @@ | ||
import { IacFileScanResult, PolicyMetadata } from './types'; | ||
import { SEVERITY } from '../../../../lib/snyk-test/common'; | ||
// import { | ||
// issuesToLineNumbers, | ||
// CloudConfigFileTypes, | ||
// } from '@snyk/cloud-config-parser'; | ||
|
||
const SEVERITIES = [SEVERITY.LOW, SEVERITY.MEDIUM, SEVERITY.HIGH]; | ||
|
||
export function formatResults( | ||
iacLocalExecutionResults: Array<IacFileScanResult>, | ||
options: { severityThreshold?: SEVERITY }, | ||
) { | ||
const iacLocalExecutionGroupedResults = groupMultiDocResults( | ||
iacLocalExecutionResults, | ||
); | ||
return iacLocalExecutionGroupedResults.map((iacScanResult) => | ||
iacLocalFileScanToFormattedResult(iacScanResult, options.severityThreshold), | ||
); | ||
} | ||
|
||
// | ||
// function getFileTypeForLineNumber( | ||
// fileType: string, | ||
// ): CloudConfigFileTypes { | ||
// switch (fileType) { | ||
// case 'yaml': | ||
// case 'yml': | ||
// return CloudConfigFileTypes.YAML; | ||
// case 'json': | ||
// return CloudConfigFileTypes.JSON; | ||
// default: | ||
// return CloudConfigFileTypes.YAML; | ||
// } | ||
// } | ||
|
||
function iacLocalFileScanToFormattedResult( | ||
iacFileScanResult: IacFileScanResult, | ||
severityThreshold?: SEVERITY, | ||
) { | ||
const formattedIssues = iacFileScanResult.violatedPolicies.map((policy) => { | ||
// TODO: make sure we handle this issue with annotations: | ||
// https:/snyk/registry/pull/17277 | ||
const cloudConfigPath = [`[DocId:${iacFileScanResult.docId}]`].concat( | ||
policy.msg.split('.'), | ||
); | ||
const lineNumber = -1; | ||
// TODO: once package becomes public, restore the commented out code for having the issue-to-line-number functionality | ||
// try { | ||
// lineNumber = issuesToLineNumbers( | ||
// iacFileScanResult.fileContent, | ||
// getFileTypeForLineNumber(iacFileScanResult.fileType), | ||
// cloudConfigPath, | ||
// ); | ||
// } catch (err) { | ||
// // | ||
// } | ||
|
||
return { | ||
...policy, | ||
id: policy.publicId, | ||
from: [], | ||
name: policy.title, | ||
cloudConfigPath, | ||
isIgnored: false, | ||
iacDescription: { | ||
issue: policy.issue, | ||
impact: policy.impact, | ||
resolve: policy.resolve, | ||
}, | ||
severity: policy.severity, | ||
lineNumber: lineNumber, | ||
}; | ||
}); | ||
return { | ||
result: { | ||
cloudConfigResults: filterPoliciesBySeverity( | ||
formattedIssues, | ||
severityThreshold, | ||
), | ||
}, | ||
isPrivate: true, | ||
packageManager: 'k8sconfig', | ||
targetFile: iacFileScanResult.filePath, | ||
}; | ||
} | ||
|
||
function groupMultiDocResults( | ||
scanResults: Array<IacFileScanResult>, | ||
): Array<IacFileScanResult> { | ||
const groupedData = scanResults.reduce((memo, result) => { | ||
if (memo[result.filePath]) { | ||
memo[result.filePath].violatedPolicies = memo[ | ||
result.filePath | ||
].violatedPolicies.concat(result.violatedPolicies); | ||
} else { | ||
memo[result.filePath] = result; | ||
} | ||
|
||
return memo; | ||
}, {} as IacFileScanResult); | ||
|
||
return Object.values(groupedData); | ||
} | ||
|
||
function filterPoliciesBySeverity( | ||
violatedPolicies: PolicyMetadata[], | ||
severityThreshold?: SEVERITY, | ||
): PolicyMetadata[] { | ||
if (!severityThreshold || severityThreshold === SEVERITY.LOW) { | ||
return violatedPolicies; | ||
} | ||
|
||
const severitiesToInclude = SEVERITIES.slice( | ||
SEVERITIES.indexOf(severityThreshold), | ||
); | ||
|
||
return violatedPolicies.filter((policy) => | ||
severitiesToInclude.includes(policy.severity), | ||
); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,33 @@ | ||
import { SEVERITY } from '../../../../lib/snyk-test/common'; | ||
import { IacFileInDirectory } from '../../../../lib/types'; | ||
|
||
export type IacFileMetadata = IacFileInDirectory; | ||
export interface IacFileData extends IacFileMetadata { | ||
jsonContent: Record<string, any>; | ||
fileContent: string; | ||
docId?: number; | ||
} | ||
export interface IacFileScanResult extends IacFileData { | ||
violatedPolicies: PolicyMetadata[]; | ||
} | ||
|
||
export interface OpaWasmInstance { | ||
evaluate: (data: Record<string, any>) => { results: PolicyMetadata[] }; | ||
setData: (data: Record<string, any>) => void; | ||
} | ||
|
||
export interface PolicyMetadata { | ||
id: string; | ||
publicId: string; | ||
type: string; | ||
subType: string; | ||
title: string; | ||
description: string; | ||
severity: SEVERITY; | ||
msg: string; | ||
policyEngineType: 'opa'; | ||
issue: string; | ||
impact: string; | ||
resolve: string; | ||
references: string[]; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
{".circleci":{"jobs":{"run_tests":{"docker":[{"image":"circleci/golang:1.14"}],"steps":["checkout",{"restore_cache":{"keys":["go-mod-v4-{{ checksum \"go.sum\" }}"]}},{"run":"go build"},{"save_cache":{"key":"go-mod-v4-{{ checksum \"go.sum\" }}","paths":["/go/pkg/mod"]}},{"run":{"command":"./cloud-config-opa-policies test .\n","name":"Run Tests"}}]}},"version":2.1,"workflows":{"build_and_push":{"jobs":["run_tests"]},"version":2}},"ecosystems":{"kubernetes":{"SNYK_CC_K8S_1":{"description":"","id":"1","impact":"Compromised container could potentially modify the underlying host’s kernel by loading unauthorized modules (i.e. drivers).","issue":"Container is running in privileged mode","policyEngineType":"opa","publicId":"SNYK-CC-K8S-1","references":["CIS Kubernetes Benchmark 1.6.0 - 5.2.1 Minimize the admission of privileged containers","https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged","https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/"],"resolve":"Remove `securityContext.privileged` attribute, or set value to `false`","severity":"high","subType":"Deployment","title":"Container is running in privileged mode","type":"k8s"}}}} |
Binary file not shown.
Oops, something went wrong.