Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add support for client_certificate_v2 posture rule #1685

Merged
merged 4 commits into from
Jul 23, 2024
Merged

add support for client_certificate_v2 posture rule #1685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bbc7d15
add support for client_certificate_v2 posture rule
jlu-cloudflare Jul 17, 2024
7e0f00f
Merge branch 'master' into master
jacobbednarz Jul 17, 2024
5e0fb0f
fix lint
jacobbednarz Jul 18, 2024
f6ecccb
fix lint by changing bool to *bool in device_posture_rule.go
jlu-cloudflare Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/1685.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
device_posture_rule: support extended_key_usage, check_private_key, and locations for client_certificate_v2 posture rule
```
79 changes: 44 additions & 35 deletions device_posture_rule.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,41 +165,50 @@ type DevicePostureRuleMatch struct {

// DevicePostureRuleInput represents the value to be checked against.
type DevicePostureRuleInput struct {
ID string `json:"id,omitempty"`
Path string `json:"path,omitempty"`
Exists bool `json:"exists,omitempty"`
Thumbprint string `json:"thumbprint,omitempty"`
Sha256 string `json:"sha256,omitempty"`
Running bool `json:"running,omitempty"`
RequireAll bool `json:"requireAll,omitempty"`
CheckDisks []string `json:"checkDisks,omitempty"`
Enabled bool `json:"enabled,omitempty"`
Version string `json:"version,omitempty"`
VersionOperator string `json:"versionOperator,omitempty"`
Overall string `json:"overall,omitempty"`
SensorConfig string `json:"sensor_config,omitempty"`
Os string `json:"os,omitempty"`
OsDistroName string `json:"os_distro_name,omitempty"`
OsDistroRevision string `json:"os_distro_revision,omitempty"`
OSVersionExtra string `json:"os_version_extra,omitempty"`
Operator string `json:"operator,omitempty"`
Domain string `json:"domain,omitempty"`
ComplianceStatus string `json:"compliance_status,omitempty"`
ConnectionID string `json:"connection_id,omitempty"`
IssueCount string `json:"issue_count,omitempty"`
CountOperator string `json:"countOperator,omitempty"`
TotalScore int `json:"total_score,omitempty"`
ScoreOperator string `json:"scoreOperator,omitempty"`
CertificateID string `json:"certificate_id,omitempty"`
CommonName string `json:"cn,omitempty"`
ActiveThreats int `json:"active_threats,omitempty"`
NetworkStatus string `json:"network_status,omitempty"`
Infected bool `json:"infected,omitempty"`
IsActive bool `json:"is_active,omitempty"`
EidLastSeen string `json:"eid_last_seen,omitempty"`
RiskLevel string `json:"risk_level,omitempty"`
State string `json:"state,omitempty"`
LastSeen string `json:"last_seen,omitempty"`
ID string `json:"id,omitempty"`
Path string `json:"path,omitempty"`
Exists *bool `json:"exists,omitempty"`
Thumbprint string `json:"thumbprint,omitempty"`
Sha256 string `json:"sha256,omitempty"`
Running *bool `json:"running,omitempty"`
RequireAll *bool `json:"requireAll,omitempty"`
CheckDisks []string `json:"checkDisks,omitempty"`
Enabled *bool `json:"enabled,omitempty"`
Version string `json:"version,omitempty"`
VersionOperator string `json:"versionOperator,omitempty"`
Overall string `json:"overall,omitempty"`
SensorConfig string `json:"sensor_config,omitempty"`
Os string `json:"os,omitempty"`
OsDistroName string `json:"os_distro_name,omitempty"`
OsDistroRevision string `json:"os_distro_revision,omitempty"`
OSVersionExtra string `json:"os_version_extra,omitempty"`
Operator string `json:"operator,omitempty"`
Domain string `json:"domain,omitempty"`
ComplianceStatus string `json:"compliance_status,omitempty"`
ConnectionID string `json:"connection_id,omitempty"`
IssueCount string `json:"issue_count,omitempty"`
CountOperator string `json:"countOperator,omitempty"`
TotalScore int `json:"total_score,omitempty"`
ScoreOperator string `json:"scoreOperator,omitempty"`
CertificateID string `json:"certificate_id,omitempty"`
CommonName string `json:"cn,omitempty"`
ActiveThreats int `json:"active_threats,omitempty"`
NetworkStatus string `json:"network_status,omitempty"`
Infected *bool `json:"infected,omitempty"`
IsActive *bool `json:"is_active,omitempty"`
EidLastSeen string `json:"eid_last_seen,omitempty"`
RiskLevel string `json:"risk_level,omitempty"`
State string `json:"state,omitempty"`
LastSeen string `json:"last_seen,omitempty"`
ExtendedKeyUsage []string `json:"extended_key_usage,omitempty"`
CheckPrivateKey *bool `json:"check_private_key,omitempty"`
Locations CertificateLocations `json:"locations,omitempty"`
}

// Locations struct for client certificate rule v2.
type CertificateLocations struct {
Paths []string `json:"paths,omitempty"`
TrustStores []string `json:"trust_stores,omitempty"`
}

// DevicePostureRuleListResponse represents the response from the list
Expand Down
71 changes: 67 additions & 4 deletions device_posture_rule_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,10 +354,10 @@ func TestDevicePostureRules(t *testing.T) {
Input: DevicePostureRuleInput{
ID: "9e597887-345e-4a32-a09c-68811b129768",
Path: "/tmp/data.zta",
Exists: true,
Exists: BoolPtr(true),
Thumbprint: "asdfasdfasdfasdf",
Sha256: "D75398FC796D659DEB4170569DCFEC63E3897C71E3AE8642FD3139A554AEE21E",
Running: true,
Running: BoolPtr(true),
},
}}

Expand Down Expand Up @@ -413,7 +413,7 @@ func TestDevicePostureFileRule(t *testing.T) {
Match: []DevicePostureRuleMatch{{Platform: "ios"}},
Input: DevicePostureRuleInput{
Path: "/tmp/test",
Exists: true,
Exists: BoolPtr(true),
Sha256: "42b4daec3962691f5893a966245e5ea30f9f8df7254e7b7af43a171e3e29c857",
},
}
Expand Down Expand Up @@ -468,7 +468,7 @@ func TestDevicePostureDiskEncryptionRule(t *testing.T) {
Expiration: "1h",
Match: []DevicePostureRuleMatch{{Platform: "ios"}},
Input: DevicePostureRuleInput{
RequireAll: true,
RequireAll: BoolPtr(true),
CheckDisks: []string{"C", "D"},
},
}
Expand Down Expand Up @@ -645,6 +645,69 @@ func TestDevicePostureClientCertificateRule(t *testing.T) {
}
}

func TestDevicePostureClientCertificateRuleV2(t *testing.T) {
setup()
defer teardown()

handler := func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, http.MethodGet, r.Method, "Expected method 'GET', got %s", r.Method)
w.Header().Set("content-type", "application/json")
fmt.Fprintf(w, `{
"success": true,
"errors": [],
"messages": [],
"result": {
"id": "480f4f69-1a28-4fdd-9240-1ed29f0ac1db",
"schedule": "1h",
"expiration": "1h",
"type": "client_certificate_v2",
"name": "My rule name",
"description": "My description",
"match": [
{
"platform": "windows"
}
],
"input": {
"certificate_id": "d2c04b78-3ba2-4294-8efa-4e85aef0777f",
"cn": "example.com",
"extended_key_usage": ["clientAuth", "emailProtection"],
"locations": {"trust_stores": ["system"]},
"check_private_key": true
}
}
}
`)
}

want := DevicePostureRule{
ID: "480f4f69-1a28-4fdd-9240-1ed29f0ac1db",
Name: "My rule name",
Description: "My description",
Type: "client_certificate_v2",
Schedule: "1h",
Expiration: "1h",
Match: []DevicePostureRuleMatch{{Platform: "windows"}},
Input: DevicePostureRuleInput{
CertificateID: "d2c04b78-3ba2-4294-8efa-4e85aef0777f",
CommonName: "example.com",
CheckPrivateKey: BoolPtr(true),
ExtendedKeyUsage: []string{"clientAuth", "emailProtection"},
Locations: CertificateLocations{
TrustStores: []string{"system"},
},
},
}

mux.HandleFunc("/accounts/"+testAccountID+"/devices/posture/480f4f69-1a28-4fdd-9240-1ed29f0ac1db", handler)

actual, err := client.DevicePostureRule(context.Background(), testAccountID, "480f4f69-1a28-4fdd-9240-1ed29f0ac1db")

if assert.NoError(t, err) {
assert.Equal(t, want, actual)
}
}

func TestCreateDevicePostureRule(t *testing.T) {
setup()
defer teardown()
Expand Down
Loading