Fix network interface scanner (#578)

forseti-security · Aug 22, 2017 · ba2d6d1 · ba2d6d1
1 parent a16d8ca
commit ba2d6d1
Show file tree

Hide file tree

Showing 6 changed files with 13 additions and 12 deletions.
diff --git a/configs/forseti_conf.yaml.in b/configs/forseti_conf.yaml.in
@@ -129,6 +129,8 @@ scanner:
           enabled: true
         - name: iap
           enabled: true
+        - name: instance_network_interface
+          enabled: true
 
 ##############################################################################
 

diff --git a/configs/forseti_conf.yaml.sample b/configs/forseti_conf.yaml.sample
@@ -124,6 +124,8 @@ scanner:
           enabled: true
         - name: iap
           enabled: true
+        - name: instance_network_interface
+          enabled: true
 
 ##############################################################################
 

diff --git a/google/cloud/security/common/data_access/violation_dao.py b/google/cloud/security/common/data_access/violation_dao.py
@@ -65,7 +65,7 @@ def insert_violations(self, violations, resource_name,
         # TODO: Remove this exception handling by moving the check for
         # violations table outside of the scanners.
         except MySQLdb.OperationalError, e:
-            if 'already exists' in str(e):
+            if e[0] == 1050:
                 LOGGER.debug('Violations table already exists: %s', e)
                 snapshot_table = self._create_snapshot_table_name(
                     resource_name, snapshot_timestamp)

diff --git a/google/cloud/security/scanner/scanner_requirements_map.py b/google/cloud/security/scanner/scanner_requirements_map.py
@@ -42,12 +42,12 @@
         {'module_name': 'iam_rules_scanner',
          'class_name': 'IamPolicyScanner',
          'rules_filename': 'iam_rules.yaml'},
-    'instance_network_interface':
-        {'module_name': 'instance_network_interface_scanner',
-         'class_name': 'InstanceNetworkInterfaceScanner',
-         'rules_filename': 'instance_network_interface_rules.yaml'},
     'iap':
         {'module_name': 'iap_scanner',
          'class_name': 'IapScanner',
          'rules_filename': 'iap_rules.yaml'},
+    'instance_network_interface':
+        {'module_name': 'instance_network_interface_scanner',
+         'class_name': 'InstanceNetworkInterfaceScanner',
+         'rules_filename': 'instance_network_interface_rules.yaml'},
 }
diff --git a/google/cloud/security/scanner/scanners/iam_rules_scanner.py b/google/cloud/security/scanner/scanners/iam_rules_scanner.py
@@ -157,7 +157,7 @@ def _find_violations(self, policies):
         """
         policies = itertools.chain(*policies)
         all_violations = []
-        LOGGER.info('Finding policy violations...')
+        LOGGER.info('Finding IAM policy violations...')
         for (resource, policy) in policies:
             LOGGER.debug('%s => %s', resource, policy)
             violations = self.rules_engine.find_policy_violations(

diff --git a/google/cloud/security/scanner/scanners/instance_network_interface_scanner.py b/google/cloud/security/scanner/scanners/instance_network_interface_scanner.py
@@ -96,12 +96,9 @@ def get_instance_networks_interfaces(self):
            Raises:
                MySQLError if a MySQL error occurs.
         """
-        instances = instance_dao.InstanceDao().get_instances(
+        instances = instance_dao.InstanceDao(self.global_configs).get_instances(
             self.snapshot_timestamp)
-        network_interfaces = []
-        for instance in instances:
-            network_interfaces += instance.create_network_interfaces()
-        return network_interfaces
+        return [instance.create_network_interfaces() for instance in instances]
 
     @staticmethod
     def parse_instance_network_instance(instance_object):
@@ -124,7 +121,7 @@ def _get_project_policies(self):
         project_policies = {}
         project_policies = (
             project_dao
-            .ProjectDao()
+            .ProjectDao(self.global_configs)
             .get_project_policies('projects',
                                   self.
                                   snapshot_timestamp))