kriterion 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 42aff9f85dd3bbed3821c4028322c8918b5dc3e0ec7a5ce46691b6eb737aef7b
+  data.tar.gz: 62929aa1fd49a1f16739c0914b4739678e7e551198796635a1b52d092a88ebcb
+SHA512:
+  metadata.gz: 3ae4cf132a87e5d2834c9cb13f6e7ff9c352856192ba8efa041eb28a31c21f6b28f12afa5513a2303f3d4ff56925ba80d3226cd0ff049128e87059c534f1e4bc
+  data.tar.gz: 04d59dc56805ce22a40d77cdd7779a17b8baf43db965d93c2d3b6db2740f7e57e11cef86c3b9bb2790a16734d9995769134c40a9e38e45ab1c9754314341c072

data/.gitignore

@@ -0,0 +1,2 @@
+pkg
+.DS_Store

data/.ruby-version

@@ -0,0 +1 @@
+2.5.1

data/.travis.yml

@@ -0,0 +1,5 @@
+sudo: false
+language: ruby
+rvm:
+  - 2.4.3
+before_install: gem install bundler -v 1.16.1

data/Dockerfile

@@ -0,0 +1,18 @@
+FROM ruby:2.5
+
+# throw errors if Gemfile has been modified since Gemfile.lock
+RUN bundle config --global frozen 1
+
+WORKDIR /app
+
+COPY . .
+RUN bundle install -j 8
+
+ENV mongo_database kriterion
+ENV mongo_hostname mongodb
+ENV mongo_port 27017
+ENV queue reports
+ENV uri http://restmq:8888
+
+ENTRYPOINT ["bundle", "exec", "kriterion", "worker"]
+CMD ["--debug"]

data/Gemfile

@@ -0,0 +1,12 @@
+source 'https://rubygems.org'
+
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
+
+# Specify your gem's dependencies in kriterion.gemspec
+gemspec
+
+group :development do
+  gem 'nokogiri'
+  gem 'pry'
+  gem 'pry-byebug'
+end

data/Gemfile.lock

@@ -0,0 +1,62 @@
+PATH
+  remote: .
+  specs:
+    kriterion (0.0.1)
+      cri (~> 2.10)
+      httparty (~> 0.16)
+      mongo (~> 2.5)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bson (4.3.0)
+    byebug (10.0.2)
+    coderay (1.1.2)
+    colored (1.2)
+    cri (2.10.1)
+      colored (~> 1.2)
+    diff-lcs (1.3)
+    httparty (0.16.2)
+      multi_xml (>= 0.5.2)
+    method_source (0.9.0)
+    mini_portile2 (2.3.0)
+    mongo (2.6.1)
+      bson (>= 4.3.0, < 5.0.0)
+    multi_xml (0.6.0)
+    nokogiri (1.8.4)
+      mini_portile2 (~> 2.3.0)
+    pry (0.11.3)
+      coderay (~> 1.1.0)
+      method_source (~> 0.9.0)
+    pry-byebug (3.6.0)
+      byebug (~> 10.0)
+      pry (~> 0.10)
+    rake (10.5.0)
+    rspec (3.7.0)
+      rspec-core (~> 3.7.0)
+      rspec-expectations (~> 3.7.0)
+      rspec-mocks (~> 3.7.0)
+    rspec-core (3.7.1)
+      rspec-support (~> 3.7.0)
+    rspec-expectations (3.7.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.7.0)
+    rspec-mocks (3.7.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.7.0)
+    rspec-support (3.7.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 1.16)
+  kriterion!
+  nokogiri
+  pry
+  pry-byebug
+  rake (~> 10.0)
+  rspec (~> 3.0)
+
+BUNDLED WITH
+   1.16.3

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Dylan Ratcliffe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,58 @@
+# Kriterion
+
+Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/kriterion`. To experiment with that code, run `bin/console` for an interactive prompt.
+
+TODO: Delete this and the text above, and describe your gem
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'kriterion'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install kriterion
+
+## Usage
+
+TODO: Write usage instructions here
+
+## Development
+
+This project requires MongoDB and RestMQ to be up and working. You can run them up manually using the commands below, or run `docker-compose up` to spin up everything.
+
+### Docker Containers
+
+#### `kriterion_worker`
+
+**Building:** `docker build -t kriterion_worker .`
+
+**Running:** `docker run -t kriterion_worker`
+
+#### `mongo`
+
+**Building:** This comes from [DockerHub](https://hub.docker.com/_/mongo/)
+
+**Running:** `docker run -p 27017:27017 mongo`
+
+#### `restmq`
+
+**Building:** This comes from [DockerHub](https://hub.docker.com/r/pablozaiden/restmq/)
+
+**Running:** `docker run --rm  -p 6379:6379 -p 8888:8888 pablozaiden/restmq`
+
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/kriterion.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/bin/update_stigs.rb

@@ -0,0 +1,42 @@
+require 'nokogiri'
+require 'json'
+require 'open-uri'
+require 'pry'
+
+main_page = Nokogiri::HTML(open("https://www.stigviewer.com/stigs"))
+
+main_page.search('td').each do |td|
+  begin
+    standard      = {}
+    standard_link = td.children[1].attributes['href'].value
+    puts "Searching #{standard_link} for JSON"
+    standard_page = Nokogiri::HTML(open("https://www.stigviewer.com#{standard_link}"))
+    json_link     = standard_page.at_css('[id="json"]').attributes['href'].value
+    puts "Downloading JSON: #{json_link}"
+    stig          = JSON.parse(open("https://www.stigviewer.com#{json_link}").read)['stig']
+
+    # Map elements
+    standard['name'] = "stig_#{stig['slug']}"
+    standard['date'] = stig['date']
+    standard['description'] = stig['description']
+    standard['title'] = stig['title']
+    standard['version'] = stig['version']
+    standard['item_syntax'] = '^\w-\d+$'
+    standard['section_separator'] = nil
+    standard['items'] = stig['findings'].map { |id,details|
+      {
+        'id'          => id,
+        'title'       => details['title'],
+        'description' => details['description'],
+        'severity'    => details['severity'],
+      }
+    }
+
+    puts "Writing standard #{standard['name']}"
+    File.write("standards/#{standard['name']}.json", JSON.pretty_generate(standard))
+  rescue
+    puts 'Something went wrong, pretending it didn\'t happen'
+  end
+end
+
+puts 'done'

data/criterion.gemspec

@@ -0,0 +1,31 @@
+
+lib = File.expand_path("../lib", __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'kriterion/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'kriterion'
+  spec.version       = Kriterion::VERSION
+  spec.authors       = ['Dylan Ratcliffe']
+  spec.email         = ['dylan.ratcliffe@puppet.com']
+
+  spec.summary       = "Exposes Puppet's compliance information in a REST API"
+  # spec.description   = %q{TODO: Write a longer description or delete this line.}
+  spec.homepage      = 'https://github.com/dylanratcliffe/kriterion'
+  spec.license       = 'MIT'
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.bindir        = 'exe'
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ['lib']
+
+  spec.add_runtime_dependency 'cri', '~> 2.10'
+  spec.add_runtime_dependency 'httparty', '~> 0.16'
+  spec.add_runtime_dependency 'mongo', '~> 2.5'
+
+  spec.add_development_dependency 'bundler', '~> 1.16'
+  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+end

data/docker-compose.yml

@@ -0,0 +1,14 @@
+version: '3'
+services:
+  worker:
+    build: .
+    tty: true
+  mongodb:
+    image: mongo:latest
+    ports:
+      - "27017:27017"
+  restmq:
+    image: pablozaiden/restmq:latest
+    ports:
+      - "6379:6379"
+      - "8888:8888"

data/exe/kriterion

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+
+require 'kriterion/cli'
+
+begin
+  Kriterion::CLI.command.run(ARGV)
+rescue Interrupt
+  $stderr.puts "Aborted!"
+  exit(1)
+rescue SystemExit => e
+  exit(e.status)
+rescue Exception => e
+  $stderr.puts "\nError while running: #{e.inspect}"
+  $stderr.puts e.backtrace.join("\n").red if ARGV.include? '--trace'
+  exit(1)
+end

data/lib/kriterion.rb

@@ -0,0 +1,16 @@
+require 'json'
+
+class Kriterion
+  ROOT = File.dirname __dir__
+
+  def self.standards(paths)
+    standards = {}
+    paths.each do |path|
+      Dir["#{path}/*.json"].each do |file|
+        standard = JSON.parse(File.read(file))
+        standards[standard['name']] = standard
+      end
+    end
+    standards
+  end
+end

data/lib/kriterion/api.rb

@@ -0,0 +1,27 @@
+require 'json'
+require 'mongo'
+require 'kriterion/logs'
+include Kriterion::Logs
+
+class Kriterion
+  class API
+    attr_reader :mongo
+    attr_reader :standards_dir
+
+    def initialize(opts)
+      if opts[:debug]
+        logger.level = Kriterion::Logs::DEBUG
+      end
+
+      @mongo_hostname = opts[:mongo_hostname]
+      @mongo_port     = opts[:mongo_port]
+      @mongo_database = opts[:mongo_database]
+      @mongo          = Mongo::Client.new([ "#{@mongo_hostname}:#{@mongo_port}" ], :database => @mongo_database)
+      @standards_dir  = opts[:standards_dir]
+    end
+
+    def run
+      # Find all standards and add them to mongodb
+    end
+  end
+end

data/lib/kriterion/backend.rb

@@ -0,0 +1,13 @@
+class Kriterion
+  class Backend
+    @@nackend = nil
+
+    def self.set(backend)
+      @@backend = backend
+    end
+
+    def self.get
+      @@backend
+    end
+  end
+end

data/lib/kriterion/backend/mongodb.rb

@@ -0,0 +1,235 @@
+require 'kriterion/resource'
+require 'kriterion/standard'
+require 'kriterion/section'
+require 'kriterion/backend'
+require 'kriterion/metrics'
+require 'kriterion/event'
+require 'kriterion/item'
+require 'kriterion/logs'
+require 'benchmark'
+require 'mongo'
+include Kriterion::Logs
+
+class Kriterion
+  class Backend
+    class MongoDB < Kriterion::Backend
+      attr_reader :hostname
+      attr_reader :port
+      attr_reader :database
+      attr_reader :client
+      attr_reader :standards_db
+      attr_reader :sections_db
+      attr_reader :items_db
+      attr_reader :resources_db
+      attr_reader :events_db
+      attr_reader :standard_details_db
+      attr_reader :metrics
+
+      def initialize(opts)
+        logger.info 'Initializing MongoDB backend'
+        @metrics             = opts[:metrics] || Kriterion::Metrics.new
+        @hostname            = opts[:hostname]
+        @port                = opts[:port]
+        @database            = opts[:database]
+        @client              = Mongo::Client.new(
+          ["#{@hostname}:#{@port}"], database: @database
+        )
+        @client.logger.level = logger.level
+        @standards_db        = @client[:standards]
+        @sections_db         = @client[:sections]
+        @items_db            = @client[:items]
+        @resources_db        = @client[:resources]
+        @events_db           = @client[:events]
+        @standard_details_db = @client[:standard_details]
+      end
+
+      def get_standard(name, opts = {})
+        standard = nil
+        metrics[:backend_get_standard] += Benchmark.realtime do
+          # Set recursion to false by default
+          opts[:recurse] = opts[:recurse] || false
+
+          standard = sanitise_standard(find_standard(name))
+          return nil if standard.nil?
+
+          find_children!(standard) if opts[:recurse]
+        end
+
+        standard
+      end
+
+      def find_sections(query)
+        sections_db.find(
+          query
+        ).map do |section|
+          Kriterion::Section.new(section)
+        end
+      end
+
+      def add_standard(standard)
+        insert_into_db(standards_db, standard)
+      end
+
+      def add_section(section)
+        insert_into_db(sections_db, section)
+      end
+
+      def add_item(item)
+        insert_into_db(items_db, item)
+      end
+
+      def add_resource(resource)
+        insert_into_db(resources_db, resource)
+      end
+
+      def add_event(event)
+        insert_into_db(events_db, event)
+      end
+
+      def add_unchanged_node(resource, certname)
+        resources_db.update_one(
+          { resource: resource.resource },
+          '$addToSet' => {
+            unchanged_nodes: certname
+          }
+        )
+      end
+
+      def update_compliance!(thing)
+        databases = {
+          Kriterion::Standard => standards_db,
+          Kriterion::Section  => sections_db,
+          Kriterion::Item     => items_db,
+          Kriterion::Resource => resources_db
+        }
+
+        databases[thing.class].update_one(
+          { uuid: thing.uuid },
+          '$set' => {
+            compliance: thing.compliance
+          }
+        )
+      end
+
+      def purge_events!(certname)
+        # Delete all events for this certname
+        events_db.delete_many(
+          certname: certname
+        )
+
+        # Delete all instances of this certname under "unchanged_nodes"
+        resources_db.update_many(
+          {}, # Don't pass a query as we want to purge everything
+          '$pull' => { # Remove this node from unchanged nodes
+            unchanged_nodes: certname
+          }
+        )
+      end
+
+      private
+
+      def find_children!(object)
+        accepted_objects = [
+          Kriterion::Standard,
+          Kriterion::Section,
+          Kriterion::Item,
+          Kriterion::Resource,
+          Kriterion::Event
+        ]
+
+        unless accepted_objects.include?(object.class)
+          raise "Unsupported object type #{object.class.name}"
+        end
+
+        case object
+        when Kriterion::Item
+          result = resources_db.find(
+            parent_uuid: object.uuid
+          )
+
+          result.each do |resource|
+            resource = Kriterion::Resource.new(resource)
+            find_children! resource
+            object.resources << resource
+          end
+        when Kriterion::Resource
+          result = events_db.find(
+            resource: object.resource
+          )
+
+          result.each do |event|
+            event = Kriterion::Event.new(event)
+            find_children! event
+            object.events << event
+          end
+        when Kriterion::Event
+          nil
+        else
+          # We can safely assume this is a Kriterion::Standard or
+          # Kriterion::Section, which are treated the same
+
+          # Find all child sections and add them to the standard
+          find_child_sections(object).each do |section|
+            object.sections << section
+            # Also recurse and find all children of each child we find
+            find_children!(section)
+          end
+
+          # Find all direct child items
+          find_child_items(object).each do |item|
+            object.items << item
+            find_children!(item)
+          end
+        end
+      end
+
+      def insert_into_db(database, thing)
+        result = database.insert_one(thing.to_h)
+        raise "Insertion of #{thing} failed" unless result.ok?
+        thing
+      end
+
+      def find_child_items(parent)
+        results = items_db.find(
+          parent_type: parent.type,
+          parent_uuid: parent.uuid
+        )
+
+        results.map do |item|
+          Kriterion::Item.new(item)
+        end
+      end
+
+      def find_child_sections(parent)
+        result = sections_db.find(
+          parent_type: parent.type,
+          parent_uuid: parent.uuid
+        )
+        result.map do |section|
+          Kriterion::Section.new(section)
+        end
+      end
+
+      def find_standard(name)
+        result = standards_db.find(name: name)
+        count  = result.count
+        case count
+        when 0
+          nil
+        when 1
+          result.first
+        else
+          raise "Found > 1 standards with name: #{name}"
+        end
+      end
+
+      # Takes a result and sanities it to Kriterion::Standard object
+      def sanitise_standard(result)
+        return nil if result.nil?
+        # Compile the regex from a lazy-compiled BSON regex back to a ruby one
+        result['item_syntax'] = result['item_syntax'].compile
+        Kriterion::Standard.new(result)
+      end
+    end
+  end
+end