abide_dev_utils 0.9.7 → 0.11.0

data/lib/abide_dev_utils/cem/benchmark.rb

@@ -0,0 +1,291 @@
+# frozen_string_literal: true
+
+require 'abide_dev_utils/errors'
+require 'abide_dev_utils/ppt/facter_utils'
+require 'abide_dev_utils/cem/mapping/mapper'
+
+module AbideDevUtils
+  module CEM
+    # Repesents a benchmark for purposes of organizing data for markdown representation
+    class Benchmark
+      attr_reader :osname, :major_version, :os_facts, :osfamily, :hiera_conf, :module_name, :framework, :rules
+
+      def initialize(osname, major_version, hiera_conf, module_name, framework: 'cis')
+        @osname = osname
+        @major_version = major_version
+        @os_facts = AbideDevUtils::Ppt::FacterUtils.recursive_facts_for_os(@osname, @major_version)
+        @osfamily = @os_facts['os']['family']
+        @hiera_conf = hiera_conf
+        @module_name = module_name
+        @framework = framework
+        @rules = {}
+        @map_cache = {}
+        @rules_in_map = {}
+        load_rules
+      end
+
+      # Creates Benchmark objects from a Puppet module
+      # @param pupmod [AbideDevUtils::Ppt::PuppetModule] A PuppetModule instance
+      # @param skip_errors [Boolean] True skips errors and loads non-erroring benchmarks, false raises the error.
+      # @return [Array<AbideDevUtils::CEM::Benchmark>] Array of Benchmark instances
+      def self.benchmarks_from_puppet_module(pupmod, ignore_all_errors: false, ignore_framework_mismatch: true)
+        frameworks = pupmod.hiera_conf.local_hiera_files(hierarchy_name: 'Mapping Data').each_with_object([]) do |hf, ary|
+          parts = hf.path.split(pupmod.hiera_conf.default_datadir)[-1].split('/')
+          ary << parts[2] unless ary.include?(parts[2])
+        end
+        pupmod.supported_os.each_with_object([]) do |supp_os, ary|
+          osname, majver = supp_os.split('::')
+          if majver.is_a?(Array)
+            majver.sort.each do |v|
+              frameworks.each do |fw|
+                benchmark = Benchmark.new(osname, v, pupmod.hiera_conf, pupmod.name(strip_namespace: true), framework: fw)
+                ary << benchmark
+              rescue StandardError => e
+                raise e unless ignore_all_errors || (e.instance_of?(AbideDevUtils::Errors::MappingDataFrameworkMismatchError) && ignore_framework_mismatch)
+              end
+            end
+          else
+            frameworks.each do |fw|
+              benchmark = Benchmark.new(osname, majver, pupmod.hiera_conf, pupmod.name(strip_namespace: true), framework: fw)
+              ary << benchmark
+            rescue StandardError => e
+              raise e unless ignore_all_errors || (e.instance_of?(AbideDevUtils::Errors::MappingDataFrameworkMismatchError) && ignore_framework_mismatch)
+            end
+          end
+        end
+      end
+
+      def mapper
+        @mapper ||= AbideDevUtils::CEM::Mapping::Mapper.new(module_name, framework, load_mapping_data)
+      end
+
+      def map_data
+        mapper.map_data
+      end
+
+      def resource_data
+        @resource_data ||= load_resource_data
+      end
+
+      def title
+        mapper.title
+      end
+
+      def version
+        mapper.version
+      end
+
+      def title_key
+        @title_key ||= "#{title} #{version}"
+      end
+
+      def add_rule(rule_hash)
+        @rules << rule_hash
+      end
+
+      def rules_in_map(mtype, level: nil, profile: nil)
+        real_mtype = map_type(mtype)
+        cache_key = [real_mtype, level, profile].compact.join('-')
+        return @rules_in_map[cache_key] if @rules_in_map.key?(cache_key)
+
+        all_rim = mapper.each_with_array_like(real_mtype) do |(lvl, profs), arr|
+          next if lvl == 'benchmark' || (!level.nil? && lvl != level)
+
+          profs.each do |prof, maps|
+            next if !profile.nil? && prof != profile
+
+            # CIS and STIG differ in that STIG does not have profiles
+            control_ids = maps.respond_to?(:keys) ? maps.keys : prof
+            arr << control_ids
+          end
+        end
+        @rules_in_map[cache_key] = all_rim.flatten.uniq
+        @rules_in_map[cache_key]
+      end
+
+      def map(control_id, level: nil, profile: nil)
+        mapper.get(control_id, level: level, profile: profile)
+      end
+
+      def map_type(control_id)
+        mapper.map_type(control_id)
+      end
+
+      private
+
+      def load_rules
+        resource_data["#{module_name}::resources"].each do |_, rdata|
+          unless rdata.key?('controls')
+            puts "Controls key not found in #{rdata}"
+            next
+          end
+          rdata['controls'].each do |control, control_data|
+            rule_title = map(control)
+            next if rule_title.nil? || rule_title.empty?
+
+            rule_title.find { |id| map_type(id) == 'title' }
+            alternate_ids = map(rule_title)
+
+            next unless rule_title.is_a?(String)
+
+            @rules[rule_title] = {} unless @rules&.key?(rule_title)
+            @rules[rule_title]['number'] = alternate_ids.find { |id| map_type(id) == 'number' }
+            @rules[rule_title]['alternate_ids'] = alternate_ids
+            @rules[rule_title]['params'] = [] unless @rules[rule_title].key?('params')
+            @rules[rule_title]['level'] = [] unless @rules[rule_title].key?('level')
+            @rules[rule_title]['profile'] = [] unless @rules[rule_title].key?('profile')
+            param_hashes(control_data).each do |param_hash|
+              next if @rules[rule_title]['params'].include?(param_hash[:name])
+
+              @rules[rule_title]['params'] << param_hash
+            end
+            levels, profiles = find_levels_and_profiles(control)
+            unless @rules[rule_title]['level'] == levels
+              @rules[rule_title]['level'] = @rules[rule_title]['level'] | levels
+            end
+            unless @rules[rule_title]['profile'] == profiles
+              @rules[rule_title]['profile'] = @rules[rule_title]['profile'] | profiles
+            end
+            @rules[rule_title]['resource'] = rdata['type']
+          end
+        end
+        @rules = sort_rules
+      end
+
+      def param_hashes(control_data)
+        return [] if control_data.nil? || control_data.empty?
+
+        p_hashes = []
+        if !control_data.respond_to?(:each) && control_data == 'no_params'
+          p_hashes << no_params
+        else
+          control_data.each do |param, param_val|
+            p_hashes << {
+              name: param,
+              type: ruby_class_to_puppet_type(param_val.class.to_s),
+              default: param_val,
+            }
+          end
+        end
+        p_hashes
+      end
+
+      def no_params
+        { name: 'No parameters', type: nil, default: nil }
+      end
+
+      # We sort the rules by their control number so they
+      # appear in the REFERENCE in benchmark order
+      def sort_rules
+        sorted = @rules.dup.sort_by do |_, v|
+          control_num_to_int(v['number'])
+        end
+        sorted.to_h
+      end
+
+      # In order to sort the rules by their control number,
+      # we need to convert the control number to an integer.
+      # This is a rough conversion, but should be sufficient
+      # for the purposes of sorting. The multipliers are
+      # the 20th, 15th, 10th, and 5th numbers in the Fibonacci
+      # sequence, then 1 after that. The reason for this is to
+      # ensure a "spiraled" wieghting of the sections in the control
+      # number, with 1st section having the most sorting weight, 2nd
+      # having second most, etc. However, the differences in the multipliers
+      # are such that it would be difficult for the product of a lesser-weighted
+      # section to be greater than a greater-weighted section.
+      def control_num_to_int(control_num)
+        multipliers = [6765, 610, 55, 5, 1]
+        nsum = 0
+        midx = 0
+        control_num.split('.').each do |num|
+          multiplier = midx >= multipliers.length ? 1 : multipliers[midx]
+          nsum += num.to_i * multiplier
+          midx += 1
+        end
+        nsum
+      end
+
+      def find_levels_and_profiles(control_id)
+        levels = []
+        profiles = []
+        mapper.each_like(control_id) do |lvl, profile_hash|
+          next if lvl == 'benchmark'
+
+          profile_hash.each do |prof, _|
+            unless map(control_id, level: lvl, profile: prof).nil?
+              levels << lvl
+              profiles << prof
+            end
+          end
+        end
+        [levels, profiles]
+      end
+
+      def ruby_class_to_puppet_type(class_name)
+        pup_type = class_name.split('::').last.capitalize
+        case pup_type
+        when %r{(Trueclass|Falseclass)}
+          'Boolean'
+        when %r{(String|Pathname)}
+          'String'
+        when %r{(Integer|Fixnum)}
+          'Integer'
+        when %r{(Float|Double)}
+          'Float'
+        else
+          pup_type
+        end
+      end
+
+      def load_mapping_data
+        files = case module_name
+                when /_windows$/
+                  cem_windows_mapping_files
+                when /_linux$/
+                  cem_linux_mapping_files
+                else
+                  raise "Module name '#{module_name}' is not a CEM module"
+                end
+        validate_mapping_files_framework(files).each_with_object({}) do |f, h|
+          next unless f.path.include?(framework)
+
+          h[File.basename(f.path, '.yaml')] = YAML.load_file(f.path)
+        end
+      end
+
+      def cem_linux_mapping_files
+        facts = [['os.name', osname], ['os.release.major', major_version]]
+        mapping_files = hiera_conf.local_hiera_files_with_facts(*facts, hierarchy_name: 'Mapping Data')
+        raise AbideDevUtils::Errors::MappingFilesNotFoundError, facts if mapping_files.nil? || mapping_files.empty?
+
+        mapping_files
+      end
+
+      def cem_windows_mapping_files
+        facts = ['os.release.major', major_version]
+        mapping_files = hiera_conf.local_hiera_files_with_fact(facts[0], facts[1], hierarchy_name: 'Mapping Data')
+        raise AbideDevUtils::Errors::MappingFilesNotFoundError, facts if mapping_files.nil? || mapping_files.empty?
+
+        mapping_files
+      end
+
+      def validate_mapping_files_framework(files)
+        validated_files = files.select { |f| f.path_parts.include?(framework) }
+        if validated_files.nil? || validated_files.empty?
+          raise AbideDevUtils::Errors::MappingDataFrameworkMismatchError, framework
+        end
+
+        validated_files
+      end
+
+      def load_resource_data
+        facts = [['os.family', osfamily], ['os.name', osname], ['os.release.major', major_version]]
+        rdata_files = hiera_conf.local_hiera_files_with_facts(*facts, hierarchy_name: 'Resource Data')
+        raise AbideDevUtils::Errors::ResourceDataNotFoundError, facts if rdata_files.nil? || rdata_files.empty?
+
+        YAML.load_file(rdata_files[0].path)
+      end
+    end
+  end
+end

data/lib/abide_dev_utils/cem/coverage_report.rb

@@ -0,0 +1,348 @@
+# frozen_string_literal: true
+
+require 'date'
+require 'json'
+require 'pathname'
+require 'yaml'
+require 'abide_dev_utils/ppt'
+require 'abide_dev_utils/validate'
+require 'abide_dev_utils/cem/benchmark'
+
+module AbideDevUtils
+  module CEM
+    # Methods and objects used to construct a report of what CEM enforces versus what
+    # the various compliance frameworks expect to be enforced.
+    module CoverageReport
+      # def self.generate(outfile: 'cem_coverage.yaml', **_filters)
+      #   pupmod = AbideDevUtils::Ppt::PuppetModule.new
+      #   # filter = Filter.new(pupmod, **filters)
+      #   benchmarks = AbideDevUtils::CEM::Benchmark.benchmarks_from_puppet_module(pupmod)
+      #   Report.new(benchmarks).generate(outfile: outfile)
+      # end
+
+      def self.basic_coverage(format_func: :to_yaml, ignore_benchmark_errors: false)
+        pupmod = AbideDevUtils::Ppt::PuppetModule.new
+        # filter = Filter.new(pupmod, **filters)
+        benchmarks = AbideDevUtils::CEM::Benchmark.benchmarks_from_puppet_module(pupmod,
+                                                                                 ignore_all_errors: ignore_benchmark_errors)
+        benchmarks.map do |b|
+          AbideDevUtils::CEM::CoverageReport::BenchmarkReport.new(b).basic_coverage.send(format_func)
+        end
+      end
+
+      class Filter
+        KEY_FACT_MAP = {
+          os_family: 'os.family',
+          os_name: 'os.name',
+          os_release_major: 'os.release.major',
+        }.freeze
+
+        attr_reader(*KEY_FACT_MAP.keys)
+
+        def initialize(pupmod, **filters)
+          @pupmod = pupmod
+          @benchmark = filters[:benchmark]
+          @profile = filters[:profile]
+          @level = filters[:level]
+          KEY_FACT_MAP.each_key do |k|
+            instance_variable_set "@#{k}", filters[k]
+          end
+        end
+
+        def resource_data
+          @resource_data ||= find_resource_data
+        end
+
+        def mapping_data
+          @mapping_data ||= find_mapping_data
+        end
+
+        private
+
+        def find_resource_data
+          fact_array = fact_array_for(:os_family, :os_name, :os_release_major)
+          @pupmod.hiera_conf.local_hiera_files_with_facts(*fact_array, hierarchy_name: 'Resource Data').map do |f|
+            YAML.load_file(f.path)
+          end
+        rescue NoMethodError
+          @pupmod.hiera_conf.local_hiera_files(hierarchy_name: 'Resource Data').map { |f| YAML.load_file(f.path) }
+        end
+
+        def find_mapping_data
+          fact_array = fact_array_for(:os_name, :os_release_major)
+          begin
+            data_array = @pupmod.hiera_conf.local_hiera_files_with_facts(*fact_array, hierarchy_name: 'Mapping Data').map do |f|
+              YAML.load_file(f.path)
+            end
+          rescue NoMethodError
+            data_array = @pupmod.hiera_conf.local_hiera_files(hierarchy_name: 'Mapping Data').map { |f| YAML.load_file(f.path) }
+          end
+          filter_mapping_data_array_by_benchmark!(data_array)
+          filter_mapping_data_array_by_profile!(data_array)
+          filter_mapping_data_array_by_level!(data_array)
+          data_array
+        end
+
+        def filter_mapping_data_array_by_benchmark!(data_array)
+          return unless @benchmark
+
+          data_array.select! do |d|
+            d.keys.all? do |k|
+              k == 'benchmark' || k.match?(/::#{@benchmark}::/)
+            end
+          end
+        end
+
+        def filter_mapping_data_array_by_profile!(data_array)
+          return unless @profile
+
+          data_array.reject! { |d| nested_hash_value(d, @profile).nil? }
+        end
+
+        def filter_mapping_data_array_by_level!(data_array)
+          return unless @level
+
+          data_array.reject! { |d| nested_hash_value(d, @level).nil? }
+        end
+
+        def nested_hash_value(obj, key)
+          if obj.respond_to?(:key?) && obj.key?(key)
+            obj[key]
+          elsif obj.respond_to?(:each)
+            r = nil
+            obj.find { |*a| r = nested_hash_value(a.last, key) }
+            r
+          end
+        end
+
+        def filter_stig_mapping_data(data_array); end
+
+        def fact_array_for(*keys)
+          keys.each_with_object([]) { |(k, _), a| a << fact_filter_value(k) }.compact
+        end
+
+        def fact_filter_value(key)
+          value = instance_variable_get("@#{key}")
+          return if value.nil? || value.empty?
+
+          [KEY_FACT_MAP[key], value]
+        end
+      end
+
+      class OldReport
+        def initialize(benchmarks)
+          @benchmarks = benchmarks
+        end
+
+        def self.generate
+          coverage = {}
+          coverage['classes'] = {}
+          all_cap = ClassUtils.find_all_classes_and_paths(puppet_class_dir)
+          invalid_classes = find_invalid_classes(all_cap)
+          valid_classes = find_valid_classes(all_cap, invalid_classes)
+          coverage['classes']['invalid'] = invalid_classes
+          coverage['classes']['valid'] = valid_classes
+          hiera = YAML.safe_load(File.open(hiera_path))
+          profile&.gsub!(/^profile_/, '') unless profile.nil?
+
+          matcher = profile.nil? ? /^profile_/ : /^profile_#{profile}/
+          hiera.each do |k, v|
+            key_base = k.split('::')[-1]
+            coverage['benchmark'] = v if key_base == 'title'
+            next unless key_base.match?(matcher)
+
+            coverage[key_base] = generate_uncovered_data(v, valid_classes)
+          end
+          coverage
+        end
+
+        def self.generate_uncovered_data(ctrl_list, valid_classes)
+          out_hash = {}
+          out_hash[:num_total] = ctrl_list.length
+          out_hash[:uncovered] = []
+          out_hash[:covered] = []
+          ctrl_list.each do |c|
+            if valid_classes.include?(c)
+              out_hash[:covered] << c
+            else
+              out_hash[:uncovered] << c
+            end
+          end
+          out_hash[:num_covered] = out_hash[:covered].length
+          out_hash[:num_uncovered] = out_hash[:uncovered].length
+          out_hash[:coverage] = Float(
+            (Float(out_hash[:num_covered]) / Float(out_hash[:num_total])) * 100.0
+          ).floor(3)
+          out_hash
+        end
+
+        def self.find_valid_classes(all_cap, invalid_classes)
+          all_classes = all_cap.dup.transpose[0]
+          return [] if all_classes.nil?
+
+          return all_classes - invalid_classes unless invalid_classes.nil?
+
+          all_classes
+        end
+
+        def self.find_invalid_classes(all_cap)
+          invalid_classes = []
+          all_cap.each do |cap|
+            invalid_classes << cap[0] unless class_valid?(cap[1])
+          end
+          invalid_classes
+        end
+
+        def self.class_valid?(manifest_path)
+          compiler = Puppet::Pal::Compiler.new(nil)
+          ast = compiler.parse_file(manifest_path)
+          ast.body.body.statements.each do |s|
+            next unless s.respond_to?(:arguments)
+            next unless s.arguments.respond_to?(:each)
+
+            s.arguments.each do |i|
+              return false if i.value == 'Not implemented'
+            end
+          end
+          true
+        end
+      end
+
+      # Class manages organizing report data into various output formats
+      class ReportOutput
+        attr_reader :controls_in_resource_data, :rules_in_map, :timestamp,
+                    :title
+
+        def initialize(benchmark, controls_in_resource_data, rules_in_map)
+          @benchmark = benchmark
+          @controls_in_resource_data = controls_in_resource_data
+          @rules_in_map = rules_in_map
+          @timestamp = DateTime.now.iso8601
+          @title = "Coverage Report for #{@benchmark.title_key}"
+        end
+
+        def uncovered
+          @uncovered ||= rules_in_map - controls_in_resource_data
+        end
+
+        def uncovered_count
+          @uncovered_count ||= uncovered.length
+        end
+
+        def covered
+          @covered ||= rules_in_map - uncovered
+        end
+
+        def covered_count
+          @covered_count ||= covered.length
+        end
+
+        def total_count
+          @total_count ||= rules_in_map.length
+        end
+
+        def percentage
+          @percentage ||= covered_count.to_f / total_count
+        end
+
+        def to_h
+          {
+            title: title,
+            timestamp: timestamp,
+            benchmark: benchmark_hash,
+            coverage: coverage_hash,
+          }
+        end
+
+        def to_json(opts = nil)
+          JSON.generate(to_h, opts)
+        end
+
+        def to_yaml
+          to_h.to_yaml
+        end
+
+        def benchmark_hash
+          {
+            title: @benchmark.title,
+            version: @benchmark.version,
+            framework: @benchmark.framework,
+          }
+        end
+
+        def coverage_hash
+          {
+            total_count: total_count,
+            uncovered_count: uncovered_count,
+            uncovered: uncovered,
+            covered_count: covered_count,
+            covered: covered,
+            percentage: percentage,
+            controls_in_resource_data: controls_in_resource_data,
+            rules_in_map: rules_in_map,
+          }
+        end
+      end
+
+      # Creates ReportOutput objects based on the given Benchmark
+      class BenchmarkReport
+        def initialize(benchmark)
+          @benchmark = benchmark
+        end
+
+        def controls_in_resource_data
+          @controls_in_resource_data ||= find_controls_in_resource_data
+        end
+
+        def controls_in_mapping_data
+          @controls_in_mapping_data ||= find_controls_in_mapping_data
+        end
+
+        def basic_coverage(level: nil, profile: nil)
+          map_type = @benchmark.map_type(controls_in_resource_data[0])
+          rules_in_map = @benchmark.rules_in_map(map_type, level: level, profile: profile)
+          AbideDevUtils::CEM::CoverageReport::ReportOutput.new(@benchmark, controls_in_resource_data, rules_in_map)
+        end
+
+        private
+
+        def find_controls_in_resource_data
+          controls = @benchmark.resource_data["#{@benchmark.module_name}::resources"].each_with_object([]) do |(rname, rval), arr|
+            arr << case rval['controls'].class.to_s
+                   when 'Hash'
+                     rval['controls'].keys
+                   when 'Array'
+                     rval['controls']
+                   else
+                     raise "Invalid controls type: #{rval['controls'].class}"
+                   end
+          end
+          controls.flatten.uniq.select do |c|
+            case @benchmark.framework
+            when 'cis'
+              @benchmark.map_type(c) != 'vulnid'
+            when 'stig'
+              @benchmark.map_type(c) == 'vulnid'
+            else
+              raise "Cannot find controls for framework #{@benchmark.framework}"
+            end
+          end
+        end
+
+        def find_controls_in_mapping_data
+          controls = @benchmark.map_data[0].each_with_object([]) do |(_, mapping), arr|
+            mapping.each do |level, profs|
+              next if level == 'benchmark'
+
+              profs.each do |_, ctrls|
+                arr << ctrls.keys
+                arr << ctrls.values
+              end
+            end
+          end
+          controls.flatten.uniq
+        end
+      end
+    end
+  end
+end