vulnerability_exceptions.go

//
// Author:: Darren Murray (<darren.murray@lacework.net>)
// Copyright:: Copyright 2021, Lacework Inc.
// License:: Apache License, Version 2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package api

import (
	"fmt"
	"strings"
	"time"

	"github.com/pkg/errors"
)

// VulnerabilityExceptionsService is the service that interacts with
// the VulnerabilityExceptions schema from the Lacework APIv2 Server
type VulnerabilityExceptionsService struct {
	client *Client
}

// vulnerabilityExceptionResourceScope is an interface for the 2 types of vulnerability exceptions resource scopes:
// 'VulnerabilityExceptionContainerResourceScope' or 'VulnerabilityExceptionHostResourceScope'
type vulnerabilityExceptionResourceScope interface {
	Type() vulnerabilityExceptionType
	Scope() VulnerabilityExceptionResourceScope
}

// vulnerabilityExceptionReason represents the types of vulnerability exceptions reasons:
// 'False Positive', 'Accepted Risk', 'Compensating Controls', 'Fix Pending' or 'Other'
type vulnerabilityExceptionReason int

const (
	VulnerabilityExceptionReasonAcceptedRisk vulnerabilityExceptionReason = iota
	VulnerabilityExceptionReasonAcceptedFalsePositive
	VulnerabilityExceptionReasonCompensatingControls
	VulnerabilityExceptionReasonFixPending
	VulnerabilityExceptionReasonOther
	VulnerabilityExceptionReasonUnknown
)

var VulnerabilityExceptionReasons = map[vulnerabilityExceptionReason]string{
	VulnerabilityExceptionReasonAcceptedRisk:          "Accepted Risk",
	VulnerabilityExceptionReasonAcceptedFalsePositive: "False Positive",
	VulnerabilityExceptionReasonCompensatingControls:  "Compensating Controls",
	VulnerabilityExceptionReasonFixPending:            "Fix Pending",
	VulnerabilityExceptionReasonOther:                 "Other",
	VulnerabilityExceptionReasonUnknown:               "Unknown",
}

func (i vulnerabilityExceptionReason) String() string {
	return VulnerabilityExceptionReasons[i]
}

func NewVulnerabilityExceptionReason(reason string) vulnerabilityExceptionReason {
	switch reason {
	case "Accepted Risk":
		return VulnerabilityExceptionReasonAcceptedRisk
	case "False Positive":
		return VulnerabilityExceptionReasonAcceptedFalsePositive
	case "Compensating Controls":
		return VulnerabilityExceptionReasonCompensatingControls
	case "Fix Pending":
		return VulnerabilityExceptionReasonFixPending
	case "Other":
		return VulnerabilityExceptionReasonOther
	default:
		return VulnerabilityExceptionReasonUnknown
	}
}

// vulnerabilityExceptionType represents the types of vulnerability exceptions 'Host' or 'Container'
type vulnerabilityExceptionType int

const (
	VulnerabilityExceptionTypeHost vulnerabilityExceptionType = iota
	VulnerabilityExceptionTypeContainer
)

var VulnerabilityExceptionTypes = map[vulnerabilityExceptionType]string{
	VulnerabilityExceptionTypeHost:      "Host",
	VulnerabilityExceptionTypeContainer: "Container",
}

func (i vulnerabilityExceptionType) String() string {
	return VulnerabilityExceptionTypes[i]
}

// vulnerabilityExceptionSeverity represents the types of vulnerability severities:
// 'Critical', 'High', 'Medium', 'Low' or 'Info'
type vulnerabilityExceptionSeverity string

type VulnerabilityExceptionSeverities []vulnerabilityExceptionSeverity

func (sevs VulnerabilityExceptionSeverities) ToStringSlice() []string {
	var res []string
	for _, i := range sevs {
		switch i {
		case VulnerabilityExceptionSeverityCritical:
			res = append(res, "Critical")
		case VulnerabilityExceptionSeverityHigh:
			res = append(res, "High")
		case VulnerabilityExceptionSeverityMedium:
			res = append(res, "Medium")
		case VulnerabilityExceptionSeverityLow:
			res = append(res, "Low")
		case VulnerabilityExceptionSeverityInfo:
			res = append(res, "Info")
		default:
			continue
		}
	}
	return res
}

func NewVulnerabilityExceptionSeverities(sevSlice []string) VulnerabilityExceptionSeverities {
	var res VulnerabilityExceptionSeverities
	for _, i := range sevSlice {
		sev := convertVulnerabilityExceptionSeverity(i)
		if sev != VulnerabilityExceptionSeverityUnknown {
			res = append(res, sev)
		}
	}
	return res
}

func convertVulnerabilityExceptionSeverity(sev string) vulnerabilityExceptionSeverity {
	switch strings.ToLower(sev) {
	case "critical":
		return VulnerabilityExceptionSeverityCritical
	case "high":
		return VulnerabilityExceptionSeverityHigh
	case "medium":
		return VulnerabilityExceptionSeverityMedium
	case "low":
		return VulnerabilityExceptionSeverityLow
	case "info":
		return VulnerabilityExceptionSeverityInfo
	default:
		return VulnerabilityExceptionSeverityUnknown
	}
}

const (
	VulnerabilityExceptionSeverityCritical vulnerabilityExceptionSeverity = "Critical"
	VulnerabilityExceptionSeverityHigh     vulnerabilityExceptionSeverity = "High"
	VulnerabilityExceptionSeverityMedium   vulnerabilityExceptionSeverity = "Medium"
	VulnerabilityExceptionSeverityLow      vulnerabilityExceptionSeverity = "Low"
	VulnerabilityExceptionSeverityInfo     vulnerabilityExceptionSeverity = "Info"
	VulnerabilityExceptionSeverityUnknown  vulnerabilityExceptionSeverity = "Unknown"
)

// NewVulnerabilityException returns an instance of the VulnerabilityException struct
//
// Basic usage: Initialize a new VulnerabilityException struct, then
//
//	             use the new instance to do CRUD operations
//
//	  client, err := api.NewClient("account")
//	  if err != nil {
//	    return err
//	  }
//
//	  exception := api.VulnerabilityExceptionConfig{
//	      Type:            api.VulnerabilityExceptionTypeHost,
//	      Description:     "This is a vuln exception",
//	      ExceptionReason: api.VulnerabilityExceptionReasonCompensatingControls,
//	      Severities:      api.VulnerabilityExceptionSeverities{api.VulnerabilityExceptionSeverityCritical},
//	      Fixable: 		  true,
//	      ResourceScope:   api.VulnerabilityExceptionContainerResourceScope{
//	         ImageID:    []string{""},
//	         ImageTag:   []string{""},
//	         Registry:   []string{""},
//	         Repository: []string{""},
//	         Namespace:  []string{""},
//	      },
//	      ExpiryTime: time.Now().AddDate(0, 1, 0),
//	  }
//
//		 vulnerabilityException := api.NewVulnerabilityException("vulnerabilityException", exception)
//
//	  client.V2.VulnerabilityExceptions.Create(vulnerabilityException)
func NewVulnerabilityException(name string, exception VulnerabilityExceptionConfig) VulnerabilityException {
	var (
		packages      = aggregatePackages(exception.Package)
		vulnException = VulnerabilityException{
			Enabled:         1,
			ExceptionName:   name,
			ExceptionReason: exception.ExceptionReason.String(),
			Props:           VulnerabilityExceptionProps{Description: exception.Description},
			VulnerabilityCriteria: VulnerabilityExceptionCriteria{
				Severity: exception.Severities.ToStringSlice(),
				Package:  packages,
				Cve:      exception.Cve,
				Fixable:  exception.FixableEnabled(),
			},
		}
	)

	if !exception.ExpiryTime.IsZero() {
		vulnException.ExpiryTime = exception.ExpiryTime.UTC().Format(time.RFC3339)
	}

	vulnException.ExceptionType = exception.Type.String()
	vulnException.setResourceScope(exception.ResourceScope)

	return vulnException
}

func aggregatePackages(packages []VulnerabilityExceptionPackage) []map[string][]string {
	var packs []map[string][]string
	for _, pck := range packages {
		var packagesMap = make(map[string][]string)
		//aggregate packages with same name
		if len(packs) > 0 {
			if _, ok := packs[0][pck.Name]; ok {
				packs[0][pck.Name] = append(packs[0][pck.Name], pck.Version)
				continue
			}
		}
		packagesMap[pck.Name] = []string{pck.Version}
		packs = append(packs, packagesMap)
	}
	return packs
}

func (exception *VulnerabilityException) setResourceScope(scope vulnerabilityExceptionResourceScope) {
	if scope == nil {
		return
	}
	switch scope.Type() {
	case VulnerabilityExceptionTypeContainer:
		ctr := scope.Scope()
		exception.ResourceScope = &VulnerabilityExceptionResourceScope{
			ImageID:    ctr.ImageID,
			ImageTag:   ctr.ImageTag,
			Registry:   ctr.Registry,
			Repository: ctr.Repository,
			Namespace:  ctr.Namespace,
		}
	case VulnerabilityExceptionTypeHost:
		host := scope.Scope()
		exception.ResourceScope = &VulnerabilityExceptionResourceScope{
			Hostname:    host.Hostname,
			ClusterName: host.ClusterName,
			ExternalIP:  host.ExternalIP,
			Namespace:   host.Namespace,
		}
	default:
		exception.ResourceScope = &VulnerabilityExceptionResourceScope{}
	}
}

func (exception VulnerabilityException) Status() string {
	if exception.Enabled == 1 {
		return "Enabled"
	}
	return "Disabled"
}

func (cfg VulnerabilityExceptionConfig) FixableEnabled() []int {
	if cfg.Fixable == nil {
		return nil
	}

	if *cfg.Fixable {
		return []int{1}
	}
	return []int{0}
}

// List returns a list of Vulnerability Exceptions
func (svc *VulnerabilityExceptionsService) List() (response VulnerabilityExceptionsResponse, err error) {
	err = svc.client.RequestDecoder("GET", apiV2VulnerabilityExceptions, nil, &response)
	return
}

// Create creates a single Vulnerability Exception
func (svc *VulnerabilityExceptionsService) Create(vuln VulnerabilityException) (
	response VulnerabilityExceptionResponse,
	err error,
) {
	err = svc.client.RequestEncoderDecoder("POST", apiV2VulnerabilityExceptions, vuln, &response)
	return
}

// Delete deletes a Vulnerability Exception that matches the provided guid
func (svc *VulnerabilityExceptionsService) Delete(guid string) error {
	if guid == "" {
		return errors.New("specify an intgGuid")
	}

	return svc.client.RequestDecoder(
		"DELETE",
		fmt.Sprintf(apiV2VulnerabilityExceptionFromGUID, guid),
		nil,
		nil,
	)
}

// Update updates a single Vulnerability Exception.
func (svc *VulnerabilityExceptionsService) Update(data VulnerabilityException) (
	response VulnerabilityExceptionResponse,
	err error,
) {
	if data.Guid == "" {
		err = errors.New("specify a Guid")
		return
	}
	apiPath := fmt.Sprintf(apiV2VulnerabilityExceptionFromGUID, data.Guid)
	// Request is invalid if it contains the ID field. We set the id field to empty
	data.Guid = ""
	err = svc.client.RequestEncoderDecoder("PATCH", apiPath, data, &response)
	return
}

// Get returns a raw response of the Vulnerability Exception with the matching guid.
func (svc *VulnerabilityExceptionsService) Get(guid string, response interface{}) error {
	if guid == "" {
		return errors.New("specify a Guid")
	}
	apiPath := fmt.Sprintf(apiV2VulnerabilityExceptionFromGUID, guid)
	return svc.client.RequestDecoder("GET", apiPath, nil, &response)
}

type VulnerabilityExceptionConfig struct {
	Description     string
	Type            vulnerabilityExceptionType
	ExceptionReason vulnerabilityExceptionReason
	Severities      VulnerabilityExceptionSeverities
	Cve             []string
	Package         []VulnerabilityExceptionPackage
	Fixable         *bool
	ResourceScope   vulnerabilityExceptionResourceScope
	ExpiryTime      time.Time
}

type VulnerabilityExceptionContainerResourceScope struct {
	ImageID    []string `json:"imageId,omitempty"`
	ImageTag   []string `json:"imageTag,omitempty"`
	Registry   []string `json:"registry,omitempty"`
	Repository []string `json:"repository,omitempty"`
	Namespace  []string `json:"namespace,omitempty"`
}

func (ctr VulnerabilityExceptionContainerResourceScope) Type() vulnerabilityExceptionType {
	return VulnerabilityExceptionTypeContainer
}

func (ctr VulnerabilityExceptionContainerResourceScope) Scope() VulnerabilityExceptionResourceScope {
	return VulnerabilityExceptionResourceScope{
		ImageID:    ctr.ImageID,
		ImageTag:   ctr.ImageTag,
		Registry:   ctr.Registry,
		Repository: ctr.Repository,
		Namespace:  ctr.Namespace,
	}
}

func (host VulnerabilityExceptionHostResourceScope) Scope() VulnerabilityExceptionResourceScope {
	return VulnerabilityExceptionResourceScope{
		Hostname:    host.Hostname,
		ExternalIP:  host.ExternalIP,
		ClusterName: host.ClusterName,
		Namespace:   host.Namespace,
	}
}

type VulnerabilityExceptionHostResourceScope struct {
	Hostname    []string `json:"hostname,omitempty"`
	ExternalIP  []string `json:"externalIp,omitempty"`
	ClusterName []string `json:"clusterName,omitempty"`
	Namespace   []string `json:"namespace,omitempty"`
}

func (host VulnerabilityExceptionHostResourceScope) Type() vulnerabilityExceptionType {
	return VulnerabilityExceptionTypeHost
}

type VulnerabilityException struct {
	Guid                  string                               `json:"exceptionGuid,omitempty"`
	Enabled               int                                  `json:"state"`
	ExceptionName         string                               `json:"exceptionName"`
	ExceptionType         string                               `json:"exceptionType"`
	ExceptionReason       string                               `json:"exceptionReason"`
	Props                 VulnerabilityExceptionProps          `json:"props"`
	VulnerabilityCriteria VulnerabilityExceptionCriteria       `json:"vulnerabilityCriteria"`
	ResourceScope         *VulnerabilityExceptionResourceScope `json:"resourceScope,omitempty"`
	CreatedTime           string                               `json:"createdTime,omitempty"`
	UpdatedTime           string                               `json:"updatedTime,omitempty"`
	ExpiryTime            string                               `json:"expiryTime,omitempty"`
}

type VulnerabilityExceptionProps struct {
	Description string `json:"description,omitempty"`
	CreatedBy   string `json:"createdBy,omitempty"`
	UpdatedBy   string `json:"updatedBy,omitempty"`
}

type VulnerabilityExceptionResourceScope struct {
	// Container properties
	ImageID    []string `json:"imageId,omitempty"`
	ImageTag   []string `json:"imageTag,omitempty"`
	Registry   []string `json:"registry,omitempty"`
	Repository []string `json:"repository,omitempty"`

	// Host properties
	Hostname    []string `json:"hostname,omitempty"`
	ExternalIP  []string `json:"externalIp,omitempty"`
	ClusterName []string `json:"clusterName,omitempty"`

	// Shared properties
	Namespace []string `json:"namespace,omitempty"`
}

type VulnerabilityExceptionCriteria struct {
	Cve      []string              `json:"cve,omitempty"`
	Package  []map[string][]string `json:"package,omitempty"`
	Severity []string              `json:"severity,omitempty"`
	Fixable  []int                 `json:"fixable,omitempty"`
}

type VulnerabilityExceptionResponse struct {
	Data VulnerabilityException `json:"data"`
}

type VulnerabilityExceptionsResponse struct {
	Data []VulnerabilityException `json:"data"`
}

type VulnerabilityExceptionPackage struct {
	Name    string
	Version string
}

func (vc VulnerabilityExceptionCriteria) FixableEnabled() *bool {
	if vc.Fixable == nil || len(vc.Fixable) == 0 {
		return nil
	}

	if len(vc.Fixable) > 0 {
		truePtr := vc.Fixable[0] == 1
		return &truePtr
	}
	falsePtr := false
	return &falsePtr
}

func NewVulnerabilityExceptionPackages(packageMap []map[string]string) []VulnerabilityExceptionPackage {
	var packages []VulnerabilityExceptionPackage
	for _, m := range packageMap {
		for k, v := range m {
			pck := VulnerabilityExceptionPackage{
				Name:    k,
				Version: v,
			}
			packages = append(packages, pck)
		}
	}
	return packages
}