abide_dev_utils 0.9.7 → 0.11.0

data/lib/abide_dev_utils/cem/generate/reference.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'yaml'
+require 'abide_dev_utils/markdown'
+require 'abide_dev_utils/ppt'
+require 'abide_dev_utils/cem/benchmark'
+
+module AbideDevUtils
+  module CEM
+    module Generate
+      # Holds objects and methods for generating a reference doc
+      module Reference
+        MAPPING_PATH_KEY = 'Mapping Data'
+        RESOURCE_DATA_PATH_KEY = 'Resource Data'
+
+        def self.generate(data = {})
+          pupmod = AbideDevUtils::Ppt::PuppetModule.new
+          doc_title = case pupmod.name
+                      when 'puppetlabs-cem_linux'
+                        'CEM Linux Reference'
+                      when 'puppetlabs-cem_windows'
+                        'CEM Windows Reference'
+                      else
+                        'Reference'
+                      end
+          benchmarks = AbideDevUtils::CEM::Benchmark.benchmarks_from_puppet_module(pupmod)
+          case data.fetch(:format, 'markdown')
+          when 'markdown'
+            MarkdownGenerator.new(benchmarks).generate(doc_title)
+          else
+            raise "Format #{data[:format]} is unsupported! Only `markdown` format supported"
+          end
+        end
+
+        def self.generate_markdown
+          AbideDevUtils::Markdown.new('REFERENCE.md').generate
+        end
+
+        def self.config_example(control, params_array)
+          out_str = ['cem_windows::config:', '  control_configs:', "    \"#{control}\":"]
+          indent = '      '
+          params_array.each do |param_hash|
+            val = case param_hash[:type]
+                  when 'String'
+                    "'#{param_hash[:default]}'"
+                  else
+                    param_hash[:default]
+                  end
+
+            out_str << "#{indent}#{param_hash[:name]}: #{val}"
+          end
+          out_str.join("\n")
+        end
+
+        # Generates a markdown reference doc
+        class MarkdownGenerator
+          def initialize(benchmarks)
+            @benchmarks = benchmarks
+            @md = AbideDevUtils::Markdown.new('REFERENCE.md')
+          end
+
+          def generate(doc_title = 'Reference')
+            md.add_title(doc_title)
+            benchmarks.each do |benchmark|
+              md.add_h1(benchmark.title_key)
+              benchmark.rules.each do |title, rule|
+                md.add_h2("#{rule['number']} #{title}")
+                md.add_ul('Parameters:')
+                rule['params'].each do |p|
+                  md.add_ul("#{md.code(p[:name])} - [ #{md.code(p[:type])} ] - #{md.italic('Default:')} #{md.code(p[:default])}", indent: 1)
+                end
+                md.add_ul('Config Example:')
+                example = config_example(benchmark.module_name, title, rule['params'])
+                md.add_code_block(example, language: 'yaml')
+                md.add_ul('Supported Levels:')
+                rule['level'].each do |l|
+                  md.add_ul(md.code(l), indent: 1)
+                end
+                md.add_ul('Supported Profiles:')
+                rule['profile'].each do |l|
+                  md.add_ul(md.code(l), indent: 1)
+                end
+                md.add_ul('Alternate Config IDs:')
+                rule['alternate_ids'].each do |l|
+                  md.add_ul(md.code(l), indent: 1)
+                end
+                md.add_ul("Resource: #{md.code(rule['resource'].capitalize)}")
+              end
+            end
+            md.to_file
+          end
+
+          private
+
+          attr_reader :benchmarks, :md
+
+          def config_example(module_name, control, params_array)
+            out_str = ["#{module_name}::config:", '  control_configs:', "    \"#{control}\":"]
+            indent = '      '
+            params_array.each do |param_hash|
+              val = case param_hash[:type]
+                    when 'String'
+                      "'#{param_hash[:default]}'"
+                    else
+                      param_hash[:default]
+                    end
+              out_str << "#{indent}#{param_hash[:name]}: #{val}"
+            end
+            out_str.join("\n")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/abide_dev_utils/cem/generate.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module AbideDevUtils
+  module CEM
+    # Holds objects and methods for `abide cem generate` subcommands
+    module Generate
+      require 'abide_dev_utils/cem/generate/reference'
+    end
+  end
+end

data/lib/abide_dev_utils/cem/mapping/mapper.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+module AbideDevUtils
+  module CEM
+    module Mapping
+      # Handles interacting with mapping data
+      class Mapper
+        MAP_TYPES = %w[hiera_title_num number hiera_title vulnid title].freeze
+
+        attr_reader :module_name, :framework, :map_data
+
+        def initialize(module_name, framework, map_data)
+          @module_name = module_name
+          @framework = framework
+          load_framework(@framework)
+          @map_data = map_data
+          @cache = {}
+          @rule_cache = {}
+        end
+
+        def title
+          @title ||= benchmark_data['title']
+        end
+
+        def version
+          @version ||= benchmark_data['version']
+        end
+
+        def each_like(identifier)
+          mtype, mtop = map_type_and_top_key(identifier)
+          map_data[mtype][mtop].each { |key, val| yield key, val }
+        end
+
+        def each_with_array_like(identifier)
+          mtype, mtop = map_type_and_top_key(identifier)
+          map_data[mtype][mtop].each_with_object([]) { |(key, val), ary| yield [key, val], ary }
+        end
+
+        def get(control_id, level: nil, profile: nil)
+          return cache_get(control_id, level, profile) if cached?(control_id, level, profile)
+
+          value = get_map(control_id, level: level, profile: profile)
+          return if value.nil? || value.empty?
+
+          cache_set(value, control_id, level, profile)
+          value
+        end
+
+        def map_type(control_id)
+          return control_id if MAP_TYPES.include?(control_id)
+
+          case control_id
+          when %r{^c[0-9_]+$}
+            'hiera_title_num'
+          when %r{^[0-9][0-9.]*$}
+            'number'
+          when %r{^[a-z][a-z0-9_]+$}
+            'hiera_title'
+          when %r{^V-[0-9]{6}$}
+            'vulnid'
+          else
+            'title'
+          end
+        end
+
+        private
+
+        def load_framework(framework)
+          case framework.downcase
+          when 'cis'
+            self.class.include AbideDevUtils::CEM::Mapping::MixinCIS
+            extend AbideDevUtils::CEM::Mapping::MixinCIS
+          when 'stig'
+            self.class.include AbideDevUtils::CEM::Mapping::MixinSTIG
+            extend AbideDevUtils::CEM::Mapping::MixinSTIG
+          else
+            raise "Invalid framework: #{framework}"
+          end
+        end
+
+        def map_type_and_top_key(identifier)
+          mtype = MAP_TYPES.include?(identifier) ? identifier : map_type(identifier)
+          [mtype, map_top_key(mtype)]
+        end
+
+        def cached?(control_id, *args)
+          @cache.key?(cache_key(control_id, *args))
+        end
+
+        def cache_get(control_id, *args)
+          ckey = cache_key(control_id, *args)
+          @cache[ckey] if cached?(control_id, *args)
+        end
+
+        def cache_set(value, control_id, *args)
+          @cache[cache_key(control_id, *args)] = value unless value.nil?
+        end
+
+        def default_map_type
+          @default_map_type ||= (framework == 'stig' ? 'vulnid' : map_data.keys.first)
+        end
+
+        def benchmark_data
+          @benchmark_data ||= map_data[default_map_type][map_top_key(default_map_type)]['benchmark']
+        end
+
+        def cache_key(control_id, *args)
+          args.unshift(control_id).compact.join('-')
+        end
+
+        def map_top_key(mtype)
+          [module_name, 'mappings', framework, mtype].join('::')
+        end
+      end
+
+      # Mixin module used by Mapper to implement CIS-specific mapping behavior
+      module MixinCIS
+        def get_map(control_id, level: nil, profile: nil, **_)
+          mtype, mtop = map_type_and_top_key(control_id)
+          return if mtype == 'vulnid'
+
+          return map_data[mtype][mtop][level][profile][control_id] unless level.nil? || profile.nil?
+
+          map_data[mtype][mtop].each do |lvl, profile_hash|
+            next if lvl == 'benchmark'
+
+            profile_hash.each do |prof, control_hash|
+              return map_data[mtype][mtop][lvl][prof][control_id] if control_hash.key?(control_id)
+            end
+          end
+        end
+      end
+
+      # Mixin module used by Mapper to implement STIG-specific mapping behavior
+      module MixinSTIG
+        def get_map(control_id, level: nil, **_)
+          mtype, mtop = map_type_and_top_key(control_id)
+          return map_data[mtype][mtop][level][control_id] unless level.nil?
+
+          begin
+            map_data[mtype][mtop].each do |lvl, control_hash|
+              next if lvl == 'benchmark'
+
+              return control_hash[control_id] if control_hash.key?(control_id)
+            end
+          rescue NoMethodError => e
+            require 'pry'
+            binding.pry
+            #raise "Control ID: #{control_id}, Level: #{level}, #{e.message}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/abide_dev_utils/cem.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'abide_dev_utils/xccdf'
+require 'abide_dev_utils/cem/coverage_report'
+require 'abide_dev_utils/cem/generate'
+
+module AbideDevUtils
+  # Methods for working with Compliance Enforcement Modules (CEM)
+  module CEM
+    def self.xccdf
+      return @xccdf if defined?(@xccdf)
+
+      xccdf = Object.new
+      xccdf.extend AbideDevUtils::XCCDF::Common
+      @xccdf = xccdf
+      @xccdf
+    end
+
+    def self.rule_id_format(rule_id)
+      case rule_id
+      when /^c[0-9_]+$/
+        :hiera_title_num
+      when /^[a-z][a-z0-9_]+$/
+        :hiera_title
+      when /^[0-9.]+$/
+        :number
+      else
+        :title
+      end
+    end
+
+    def self.rule_identifiers(rule_id)
+      {
+        number: xccdf.control_parts(rule_id).first,
+        hiera_title: xccdf.name_normalize_control(rule_id),
+        hiera_title_num: xccdf.number_normalize_control(rule_id),
+      }
+    end
+
+    def self.update_legacy_config_from_diff(config_hiera, diff)
+      new_config_hiera = config_hiera.dup
+      new_control_configs = {}
+      change_report = []
+      changes = diff.select { |d| d[:type][0] == :number }
+      config_hiera['config']['control_configs'].each do |key, val_hash|
+        key_id_format = rule_id_format(key)
+        changed = false
+        changes.each do |change|
+          if key_id_format == :title
+            next unless change[:title] == key
+          else
+            next unless rule_identifiers(change[:self].id)[key_id_format] == key
+          end
+
+          changed = true
+          new_key = if key_id_format == :title
+                      change[:other_title]
+                    else
+                      rule_identifiers(change[:other].id)[key_id_format]
+                    end
+          new_control_configs[new_key] = val_hash
+          change_report << {
+            type: :identifier_update,
+            from: key,
+            to: new_key,
+          }
+        end
+        new_control_configs[key] = val_hash unless changed
+      end
+      new_config_hiera['config']['control_configs'] = new_control_configs
+      [new_config_hiera, change_report]
+    end
+  end
+end

data/lib/abide_dev_utils/cli/cem.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require 'abide_dev_utils/cem'
+require 'abide_dev_utils/files'
+require 'abide_dev_utils/output'
+require 'abide_dev_utils/validate'
+require 'abide_dev_utils/xccdf/diff/benchmark'
+require 'abide_dev_utils/cli/abstract'
+
+module Abide
+  module CLI
+    class CemCommand < AbideCommand
+      CMD_NAME = 'cem'
+      CMD_SHORT = 'Commands related to Puppet CEM'
+      CMD_LONG = 'Namespace for commands related to Puppet CEM'
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: true)
+        add_command(CemGenerate.new)
+        add_command(CemUpdateConfig.new)
+      end
+    end
+
+    class CemGenerate < AbideCommand
+      CMD_NAME = 'generate'
+      CMD_SHORT = 'Holds subcommands for generating objects / files'
+      CMD_LONG = 'Holds subcommands for generating objects / files'
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: true)
+        add_command(CemGenerateCoverageReport.new)
+        add_command(CemGenerateReference.new)
+      end
+    end
+
+    class CemGenerateCoverageReport < AbideCommand
+      CMD_NAME = 'coverage-report'
+      CMD_SHORT = 'Generates control coverage report'
+      CMD_LONG = <<-EOLC.chomp
+      Generates report of resources that are associated with controls in mapping data. This command must
+      be run from a module directory.
+      EOLC
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: false)
+        options.on('-o [FILE]', '--out-file [FILE]', 'Path to save the coverage report') { |f| @data[:file] = f }
+        options.on('-f [FORMAT]', '--format [FORMAT]', 'The format to output the report in (hash, json, yaml)') do |f|
+          @data[:format] = f
+        end
+        options.on('-I', '--ignore-benchmark-errors', 'Ignores errors while generating benchmark reports') do
+          @data[:ignore_all] = true
+        end
+        options.on('-v', '--verbose', 'Will output the report to the console') { @data[:verbose] = true }
+        options.on('-q', '--quiet', 'Will not output anything to the console') { @data[:quiet] = true }
+      end
+
+      def execute
+        file_name = @data.fetch(:file, 'coverage_report')
+        out_format = @data.fetch(:format, 'yaml')
+        quiet = @data.fetch(:quiet, false)
+        console = @data.fetch(:verbose, false) && !quiet
+        ignore_all = @data.fetch(:ignore_all, false)
+        AbideDevUtils::Output.simple('Generating coverage report...') unless quiet
+        coverage = AbideDevUtils::CEM::CoverageReport.basic_coverage(format_func: :to_h, ignore_benchmark_errors: ignore_all)
+        AbideDevUtils::Output.simple("Saving coverage report to #{file_name}...")
+        case out_format
+        when /yaml/i
+          AbideDevUtils::Output.yaml(coverage, console: console, file: file_name)
+        when /json/i
+          AbideDevUtils::Output.json(coverage, console: console, file: file_name)
+        else
+          File.open(file_name, 'w') do |f|
+            AbideDevUtils::Output.simple(coverage.to_s, stream: f)
+          end
+        end
+      end
+    end
+
+    class CemGenerateReference < AbideCommand
+      CMD_NAME = 'reference'
+      CMD_SHORT = 'Generates a reference doc for the module'
+      CMD_LONG = 'Generates a reference doc for the module'
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: false)
+        options.on('-o [FILE]', '--out-file [FILE]', 'Path to save the updated config file') do |o|
+          @data[:out_file] = o
+        end
+        options.on('-f [FORMAT]', '--format [FORMAT]', 'Format to save reference as') do |f|
+          @data[:format] = f
+        end
+        options.on('-v', '--verbose', 'Verbose output') do
+          @data[:verbose] = true
+        end
+        options.on('-q', '--quiet', 'Quiet output') do
+          @data[:quiet] = true
+        end
+      end
+
+      def execute
+        AbideDevUtils::Validate.puppet_module_directory
+        AbideDevUtils::CEM::Generate::Reference.generate(@data)
+      end
+    end
+
+    class CemUpdateConfig < AbideCommand
+      CMD_NAME = 'update-config'
+      CMD_SHORT = 'Updates the Puppet CEM config'
+      CMD_LONG = 'Updates the Puppet CEM config'
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: true)
+        add_command(CemUpdateConfigFromDiff.new)
+      end
+    end
+
+    class CemUpdateConfigFromDiff < AbideCommand
+      CMD_NAME = 'from-diff'
+      CMD_SHORT = 'Update by diffing two XCCDF files'
+      CMD_LONG = 'Update by diffing two XCCDF files'
+      CMD_CONFIG_FILE = 'Path to the Puppet CEM config file'
+      CMD_CURRENT_XCCDF = 'Path to the current XCCDF file'
+      CMD_NEW_XCCDF = 'Path to the new XCCDF file'
+      def initialize
+        super(CMD_NAME, CMD_SHORT, CMD_LONG, takes_commands: false)
+        argument_desc(CONFIG_FILE: CMD_CONFIG_FILE, CURRENT_XCCDF: CMD_CURRENT_XCCDF, NEW_XCCDF: CMD_NEW_XCCDF)
+        options.on('-o [FILE]', '--out-file [FILE]', 'Path to save the updated config file') do |o|
+          @data[:out_file] = o
+        end
+        options.on('-v', '--verbose', 'Verbose output') do
+          @data[:verbose] = true
+        end
+        options.on('-q', '--quiet', 'Quiet output') do
+          @data[:quiet] = true
+        end
+      end
+
+      def help_arguments
+        <<~ARGHELP
+          Arguments:
+            CONFIG_FILE:   #{CMD_CONFIG_FILE}
+            CURRENT_XCCDF: #{CMD_CURRENT_XCCDF}
+            NEW_XCCDF:     #{CMD_NEW_XCCDF}
+        ARGHELP
+      end
+
+      def execute(config_file, cur_xccdf, new_xccdf)
+        AbideDevUtils::Validate.file(config_file, extension: 'yaml')
+        AbideDevUtils::Validate.file(cur_xccdf, extension: 'xml')
+        config_hiera = AbideDevUtils::Files::Reader.read(config_file, safe: true)
+        diff = AbideDevUtils::XCCDF::Diff::BenchmarkDiff.new(cur_xccdf, new_xccdf).diff[:diff][:number_title]
+        new_config_hiera, change_report = AbideDevUtils::CEM.update_legacy_config_from_diff(config_hiera, diff)
+        AbideDevUtils::Output.yaml(new_config_hiera, console: @data[:verbose], file: @data[:out_file])
+        AbideDevUtils::Output.simple(change_report) unless @data[:quiet]
+      end
+    end
+  end
+end

data/lib/abide_dev_utils/cli/jira.rb

@@ -37,7 +37,7 @@ module Abide
 
       def execute
         client = JIRA.client
-        myself = JIRA.get_myself(client)
+        myself = JIRA.myself(client)
         return if myself.attrs['name'].empty?
 
         Abide::CLI::OUTPUT.simple("Successfully authenticated user #{myself.attrs['name']}!")

data/lib/abide_dev_utils/cli/xccdf.rb

@@ -34,6 +34,9 @@ module Abide
         options.on('-d [DIR]', '--files-output-directory [DIR]', 'Directory to save files data/mappings by default') do |d|
           @data[:dir] = d
         end
+        options.on('-V', '--version-output-dir', 'If saving to a directory, version the output directory') do
+          @data[:version_output_dir] = true
+        end
         options.on('-q', '--quiet', 'Show no output in the terminal') { @data[:quiet] = true }
         options.on('-p [PREFIX]', '--parent-key-prefix [PREFIX]', 'A prefix to append to the parent key') do |p|
           @data[:parent_key_prefix] = p
@@ -104,13 +107,24 @@ module Abide
         options.on('-p [PROFILE]', '--profile', 'Only diff and specific profile in the benchmarks') do |x|
           @data[:profile] = x
         end
+        options.on('-l [LEVEL]', '--level', 'Only diff the specific level in the benchmarks') do |x|
+          @data[:level] = x
+        end
+        options.on('-r', '--raw', 'Output the diff in raw hash format') { @data[:raw] = true }
         options.on('-q', '--quiet', 'Show no output in the terminal') { @data[:quiet] = false }
         options.on('--no-diff-profiles', 'Do not diff the profiles in the XCCDF files') { @data[:diff_profiles] = false }
         options.on('--no-diff-controls', 'Do not diff the controls in the XCCDF files') { @data[:diff_controls] = false }
+        options.on('--old-style', 'Use old-style diffs') { @data[:old_style] = true }
       end
 
       def execute(file1, file2)
-        diffreport = AbideDevUtils::XCCDF.diff(file1, file2, @data)
+        diffreport = if @data[:old_style]
+                       AbideDevUtils::XCCDF.diff(file1, file2, @data)
+                     else
+                       dr = AbideDevUtils::XCCDF.new_style_diff(file1, file2, @data)
+                       dr[:diff][:number_title].map! { |d| d[:text] }
+                       dr
+                     end
         AbideDevUtils::Output.yaml(diffreport, console: @data.fetch(:quiet, true), file: @data.fetch(:outfile, nil))
       end
     end

data/lib/abide_dev_utils/cli.rb

@@ -2,6 +2,7 @@
 
 require 'cmdparse'
 require 'abide_dev_utils/version'
+require 'abide_dev_utils/cli/cem'
 require 'abide_dev_utils/constants'
 require 'abide_dev_utils/cli/comply'
 require 'abide_dev_utils/cli/puppet'
@@ -22,6 +23,7 @@ module Abide
       parser.main_options.banner = ROOT_CMD_BANNER
       parser.add_command(CmdParse::HelpCommand.new, default: true)
       parser.add_command(CmdParse::VersionCommand.new(add_switches: true))
+      parser.add_command(CemCommand.new)
       parser.add_command(ComplyCommand.new)
       parser.add_command(PuppetCommand.new)
       parser.add_command(XccdfCommand.new)

data/lib/abide_dev_utils/errors/cem.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'abide_dev_utils/errors/base'
+
+module AbideDevUtils
+  module Errors
+    # Raised by Benchmark when mapping data cannot be loaded
+    class MappingFilesNotFoundError < GenericError
+      @default = 'Mapping files not found using facts:'
+    end
+
+    # Raised by Benchmark when mapping files are not found for the specified framework
+    class MappingDataFrameworkMismatchError < GenericError
+      @default = 'Mapping data could not be found for the specified framework:'
+    end
+
+    # Raised by Benchmark when resource data cannot be loaded
+    class ResourceDataNotFoundError < GenericError
+      @default = 'Resource data not found using facts:'
+    end
+  end
+end

data/lib/abide_dev_utils/errors/general.rb

@@ -9,7 +9,12 @@ module AbideDevUtils
       @default = 'Object is empty and should not be:'
     end
 
-    # Raised when a an object is initialized with a nil param
+    # Raised when something is not a string, or is an empty string
+    class NotPopulatedStringError < GenericError
+      @default = 'Object is either not a String or is empty:'
+    end
+
+    # Raised when an object is initialized with a nil param
     class NewObjectParamNilError < GenericError
       @default = 'Object init parameter is nil and should not be:'
     end
@@ -54,8 +59,9 @@ module AbideDevUtils
       @default = 'Object does not respond to #to_hash or #to_h:'
     end
 
+    # Raised when conflicting CLI options are specified for a command
     class CliOptionsConflict < GenericError
-      @default = "Console options conflict."
+      @default = 'Console options conflict:'
     end
   end
 end

data/lib/abide_dev_utils/errors/ppt.rb

@@ -5,6 +5,10 @@ require 'abide_dev_utils/errors/base'
 module AbideDevUtils
   module Errors
     module Ppt
+      class NotModuleDirError < GenericError
+        @default = 'Path is not a Puppet module directory:'
+      end
+
       class ObjClassPathError < GenericError
         @default = 'Invalid path for class:'
       end

data/lib/abide_dev_utils/errors.rb

@@ -1,9 +1,15 @@
 # frozen_string_literal: true
 
 require 'abide_dev_utils/errors/base'
+require 'abide_dev_utils/errors/cem'
 require 'abide_dev_utils/errors/comply'
 require 'abide_dev_utils/errors/gcloud'
 require 'abide_dev_utils/errors/general'
 require 'abide_dev_utils/errors/jira'
 require 'abide_dev_utils/errors/xccdf'
 require 'abide_dev_utils/errors/ppt'
+
+module AbideDevUtils
+  # Namespace for Error objects
+  module Errors; end
+end