vulnerability.go

package rest

import (
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"net/http"
	"regexp"
	"sort"
	"strconv"
	"strings"

	"github.com/julienschmidt/httprouter"
	log "github.com/sirupsen/logrus"

	"github.com/neuvector/neuvector/controller/api"
	"github.com/neuvector/neuvector/share"
	"github.com/neuvector/neuvector/share/utils"
)

var reservedVulProfEntryNames utils.Set = utils.NewSet(api.VulnerabilityNameRecent, api.VulnerabilityNameRecentWithoutFix)

func handlerVulnerabilityProfileList(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug("")
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	var resp api.RESTVulnerabilityProfilesData
	resp.Profiles = cacher.GetAllVulnerabilityProfiles(acc)

	// Sort by name, keep 'default' at the top
	sort.Slice(resp.Profiles, func(i, j int) bool {
		if resp.Profiles[i].Name == share.DefaultVulnerabilityProfileName {
			return true
		}
		return resp.Profiles[i].Name < resp.Profiles[j].Name
	})

	log.WithFields(log.Fields{"entries": len(resp.Profiles)}).Debug("Response")
	restRespSuccess(w, r, &resp, acc, login, nil, "Get vulnerability profile list")
}

func handlerVulnerabilityProfileShow(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug("")
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	name := ps.ByName("name")

	cp, err := cacher.GetVulnerabilityProfile(name, acc)
	if cp == nil {
		restRespNotFoundLogAccessDenied(w, login, err)
		return
	}

	resp := api.RESTVulnerabilityProfileData{Profile: cp}
	restRespSuccess(w, r, &resp, acc, login, nil, "Get vulnerability profile detail")
}

func checkVulnerabilityProfileEntry(e *api.RESTVulnerabilityProfileEntry) (*share.CLUSVulnerabilityProfileEntry, error) {
	ce := share.CLUSVulnerabilityProfileEntry{
		ID:      e.ID,
		Comment: e.Comment,
		Days:    e.Days,
		Domains: make([]string, 0),
		Images:  make([]string, 0),
	}

	if strings.HasPrefix(e.Name, "_") {
		if !reservedVulProfEntryNames.Contains(e.Name) {
			return nil, errors.New("Reserved entry name is invalid")
		}

		ce.Name = e.Name
		ce.NameFilter = e.Name
	} else if e.Name == "" {
		return nil, errors.New("Invalid vulnerability profile entry name")
	} else {
		s := strings.Replace(e.Name, "*", ".*", -1)
		// case insensitive
		if _, err := regexp.Compile("(?i)" + s); err != nil {
			log.WithFields(log.Fields{"entry": e.Name, "error": err}).Error("Invalid empty name")
			return nil, errors.New("Invalid vulnerability profile entry name")
		}

		ce.Name = e.Name
		ce.NameFilter = s
	}

	for _, d := range e.Domains {
		s := strings.Replace(d, "*", ".*", -1)
		if _, err := regexp.Compile(s); err != nil {
			log.WithFields(log.Fields{"domain": s, "error": err}).Error("Invalid empty namespace filter")
			return nil, fmt.Errorf("Invalid namespace filter: %s", d)
		}

		ce.Domains = append(ce.Domains, d)
	}

	for _, d := range e.Images {
		if d == "" {
			log.Error("Invalid empty image filter")
			return nil, fmt.Errorf("Invalid empty image filter")
		}
		if strings.HasPrefix(d, "https:") || strings.HasPrefix(d, "http:") {
			log.WithFields(log.Fields{"image": d}).Error("Invalid image filter")
			return nil, fmt.Errorf("Image filter with registry is not accepted: %s", d)
		}
		if colon := strings.LastIndex(d, ":"); colon != -1 {
			if slash := strings.LastIndex(d, "/"); slash != -1 && colon < slash {
				log.WithFields(log.Fields{"image": d}).Error("Invalid image filter")
				return nil, fmt.Errorf("Image filter with registry is not accepted: %s", d)
			}
			// if colon is the last char, append latest
			if colon == len(d)-1 {
				d = fmt.Sprintf("%slatest", d)
			}
		} else {
			// append latest if without tag
			d = fmt.Sprintf("%s:latest", d)
		}

		s := strings.Replace(d, "*", ".*", -1)
		if _, err := regexp.Compile(s); err != nil {
			log.WithFields(log.Fields{"image": d, "error": err}).Error("Invalid image filter")
			return nil, fmt.Errorf("Invalid image name: %s", d)
		}

		ce.Images = append(ce.Images, d)
	}

	return &ce, nil
}

func configVulnerabilityProfileEntry(cvp *share.CLUSVulnerabilityProfile, re *api.RESTVulnerabilityProfileEntry, create bool) error {
	ids := utils.NewSet()
	for _, ce := range cvp.Entries {
		ids.Add(ce.ID)
	}

	ce, err := checkVulnerabilityProfileEntry(re)
	if err != nil {
		return err
	}

	if create {
		if re.ID == 0 {
			re.ID = getAvailableRuleID(ruleTypeVulProf, ids, share.UserCreated)
			if re.ID == 0 {
				return errors.New("Failed to locate available entry ID")
			}

			ids.Add(re.ID)
		} else if ids.Contains(re.ID) {
			return errors.New("Duplicate entry ID")
		} else if re.ID < api.StartingLocalVulProfRuleID {
			return errors.New("Invalid entry ID")
		}

		ce.ID = re.ID
		cvp.Entries = append(cvp.Entries, ce)
	} else {
		if !ids.Contains(re.ID) {
			return errors.New("Failed to find entry ID")
		}

		for i, old := range cvp.Entries {
			if old.ID == re.ID {
				cvp.Entries[i] = ce
			}
		}
	}

	return nil
}

func configVulnerabilityProfile(rvp *api.RESTVulnerabilityProfileConfig) (*share.CLUSVulnerabilityProfile, error) {
	cvp := &share.CLUSVulnerabilityProfile{Name: rvp.Name, Entries: make([]*share.CLUSVulnerabilityProfileEntry, 0)}

	if rvp.Entries != nil {
		ids := utils.NewSet()
		for _, re := range *rvp.Entries {
			if ids.Contains(re.ID) {
				return nil, errors.New("Duplicate entry ID")
			}
			if re.ID != 0 {
				ids.Add(re.ID)
			}
		}
		for _, re := range *rvp.Entries {
			ce, err := checkVulnerabilityProfileEntry(re)
			if err != nil {
				return nil, err
			}

			if re.ID == 0 {
				re.ID = getAvailableRuleID(ruleTypeVulProf, ids, share.UserCreated)
				if re.ID == 0 {
					return nil, errors.New("Failed to locate available rule ID")
				}

				ids.Add(re.ID)
			}

			ce.ID = re.ID
			cvp.Entries = append(cvp.Entries, ce)
		}
	}

	return cvp, nil
}

func handlerVulnerabilityProfileConfig(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug("")
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	name := ps.ByName("name")
	if name != share.DefaultVulnerabilityProfileName {
		log.Error("Only the default vulnerability profile is allowed")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Only the default vulnerability profile is allowed")
		return
	}

	// Read request
	body, _ := ioutil.ReadAll(r.Body)

	var rconf api.RESTVulnerabilityProfileConfigData
	err := json.Unmarshal(body, &rconf)
	if err != nil || rconf.Config == nil {
		log.WithFields(log.Fields{"error": err}).Error("Request error")
		restRespError(w, http.StatusBadRequest, api.RESTErrInvalidRequest)
		return
	}

	rvp := rconf.Config

	if rvp.Name != name {
		e := "Profile name mismatch"
		log.WithFields(log.Fields{"profile": rvp.Name}).Error(e)
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, e)
		return
	}

	retry := 0
	for retry < retryClusterMax {
		cvp, rev, err := clusHelper.GetVulnerabilityProfile(name, acc)
		if cvp == nil {
			restRespNotFoundLogAccessDenied(w, login, err)
			return
		}

		// clean up current entries
		if cvp, err = configVulnerabilityProfile(rvp); err != nil {
			log.WithFields(log.Fields{"error": err}).Error("Failed to configure vulnerability profile")
			restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, err.Error())
			return
		}

		if !acc.Authorize(cvp, nil) {
			restRespAccessDenied(w, login)
			return
		}

		if err := clusHelper.PutVulnerabilityProfile(cvp, rev); err != nil {
			log.WithFields(log.Fields{"error": err, "rev": rev}).Error("")
			retry++
		} else {
			break
		}
	}

	if retry >= retryClusterMax {
		restRespError(w, http.StatusInternalServerError, api.RESTErrFailWriteCluster)
		return
	}

	restRespSuccess(w, r, nil, acc, login, &rconf, fmt.Sprintf("Configure vulnerability profile '%v'", rvp.Name))
}

func handlerVulnerabilityProfileEntryCreate(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug("")
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	name := ps.ByName("name")
	if name != share.DefaultVulnerabilityProfileName {
		log.Error("Only the default vulnerability profile is allowed")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Only the default vulnerability profile is allowed")
		return
	}

	// Read request
	body, _ := ioutil.ReadAll(r.Body)

	var rconf api.RESTVulnerabilityProfileEntryConfigData
	err := json.Unmarshal(body, &rconf)
	if err != nil || rconf.Config == nil {
		log.WithFields(log.Fields{"error": err}).Error("Request error")
		restRespError(w, http.StatusBadRequest, api.RESTErrInvalidRequest)
		return
	}

	re := rconf.Config

	retry := 0
	for retry < retryClusterMax {
		cvp, rev, err := clusHelper.GetVulnerabilityProfile(name, acc)
		if cvp == nil {
			restRespNotFoundLogAccessDenied(w, login, err)
			return
		}

		if err := configVulnerabilityProfileEntry(cvp, re, true); err != nil {
			log.WithFields(log.Fields{"name": name, "id": re.ID, "error": err}).Error("Failed to configure vulnerability profile entry")
			restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, err.Error())
			return
		}

		if !acc.Authorize(cvp, nil) {
			restRespAccessDenied(w, login)
			return
		}

		if err := clusHelper.PutVulnerabilityProfile(cvp, rev); err != nil {
			log.WithFields(log.Fields{"name": name, "error": err, "rev": rev}).Error("")
			retry++
		} else {
			break
		}
	}

	if retry >= retryClusterMax {
		restRespError(w, http.StatusInternalServerError, api.RESTErrFailWriteCluster)
		return
	}

	restRespSuccess(w, r, nil, acc, login, &rconf, fmt.Sprintf("Create vulnerability profile entry '%v'", re.ID))
}

func handlerVulnerabilityProfileEntryConfig(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug("")
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	name := ps.ByName("name")
	idStr := ps.ByName("id")
	if name != share.DefaultVulnerabilityProfileName {
		log.Error("Only the default vulnerability profile is allowed")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Only the default vulnerability profile is allowed")
		return
	}
	id, err := strconv.ParseInt(idStr, 10, 32)
	if err != nil || id <= 0 {
		log.Error("Invalid vulnerability profile entry id")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Invalid vulnerability profile entry id")
		return
	}

	// Read request
	body, _ := ioutil.ReadAll(r.Body)

	var rconf api.RESTVulnerabilityProfileEntryConfigData
	err = json.Unmarshal(body, &rconf)
	if err != nil || rconf.Config == nil {
		log.WithFields(log.Fields{"error": err}).Error("Request error")
		restRespError(w, http.StatusBadRequest, api.RESTErrInvalidRequest)
		return
	}

	if uint32(id) != rconf.Config.ID {
		e := "Entry ID mismatch"
		log.WithFields(log.Fields{"name": name, "id": rconf.Config.ID}).Error(e)
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, e)
		return
	}

	re := rconf.Config

	retry := 0
	for retry < retryClusterMax {
		cvp, rev, err := clusHelper.GetVulnerabilityProfile(name, acc)
		if cvp == nil {
			restRespNotFoundLogAccessDenied(w, login, err)
			return
		}

		if err := configVulnerabilityProfileEntry(cvp, re, false); err != nil {
			log.WithFields(log.Fields{"name": name, "id": id, "error": err}).Error("Failed to configure vulnerability profile entry")
			restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, err.Error())
			return
		}

		if !acc.Authorize(cvp, nil) {
			restRespAccessDenied(w, login)
			return
		}

		if err := clusHelper.PutVulnerabilityProfile(cvp, rev); err != nil {
			log.WithFields(log.Fields{"name": name, "error": err, "rev": rev}).Error("")
			retry++
		} else {
			break
		}
	}

	if retry >= retryClusterMax {
		restRespError(w, http.StatusInternalServerError, api.RESTErrFailWriteCluster)
		return
	}

	restRespSuccess(w, r, nil, acc, login, &rconf, fmt.Sprintf("Configure vulnerability profile entry '%v'", re.ID))
}

func handlerVulnerabilityProfileEntryDelete(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	log.WithFields(log.Fields{"URL": r.URL.String()}).Debug()
	defer r.Body.Close()

	acc, login := getAccessControl(w, r, "")
	if acc == nil {
		return
	}

	name := ps.ByName("name")
	idStr := ps.ByName("id")
	if name != share.DefaultVulnerabilityProfileName {
		log.Error("Only the default vulnerability profile is allowed")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Only the default vulnerability profile is allowed")
		return
	}
	id, err := strconv.ParseInt(idStr, 10, 32)
	if err != nil || id <= 0 {
		log.Error("Invalid vulnerability profile entry id")
		restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Invalid vulnerability profile entry id")
		return
	}

	retry := 0
	for retry < retryClusterMax {
		cvp, rev, err := clusHelper.GetVulnerabilityProfile(name, acc)
		if cvp == nil {
			restRespNotFoundLogAccessDenied(w, login, err)
			return
		}

		var deled bool
		for i, ce := range cvp.Entries {
			if ce.ID == uint32(id) {
				copy(cvp.Entries[i:], cvp.Entries[i+1:])
				cvp.Entries[len(cvp.Entries)-1] = nil
				cvp.Entries = cvp.Entries[:len(cvp.Entries)-1]
				deled = true
				break
			}
		}

		if !deled {
			log.WithFields(log.Fields{"name": name, "id": id}).Error("Entry not found")
			restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Unable to find specified entry")
			return
		}

		if !acc.Authorize(cvp, nil) {
			restRespAccessDenied(w, login)
			return
		}

		if err := clusHelper.PutVulnerabilityProfile(cvp, rev); err != nil {
			log.WithFields(log.Fields{"name": name, "error": err, "rev": rev}).Error("")
			retry++
		} else {
			break
		}
	}

	if retry >= retryClusterMax {
		restRespError(w, http.StatusInternalServerError, api.RESTErrFailWriteCluster)
		return
	}

	restRespSuccess(w, r, nil, acc, login, nil, fmt.Sprintf("Delete vulnerability profile entry '%v'", id))
}