torizon_audit 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 500ba44874ca4f8acf49a1b7f16d861353cf049be7be4b0518689a722d4277ed
+  data.tar.gz: dee0a4946b52cb837bc847bd87d91d6baf0b13672726400e6917891939ddef92
+SHA512:
+  metadata.gz: fb17aabf9a1ef454d77df1afdd2a5f75254fd910b54862a063a05322192af17ff05f9dfc3b192ec728f04559385ba060d2537a4390df8ab0398a47f9c751863f
+  data.tar.gz: 9b8b2345dedd9f1a0f3d7140c16a9bfa46b8c6aee3885fc1217ea642253b65cf356d099d9d4391d54225ef7198b9d9976fd3d5bd68f25f5a16fc1d0930f7a242

data/lib/torizon_audit.rb

@@ -0,0 +1,147 @@
+require "bundler/setup"
+require "optparse"
+require "optparse/time"
+require "json"
+require "elasticsearch"
+
+
+class Query
+  def self.timeFormat(t)
+    return t.strftime("%Y-%m-%dT%0k:%0M:%0SZ")
+  end
+
+  def self.matchQuery(key, value, analyzer="standard", operator="OR")
+    return {
+      "match" => {
+        key => {
+          "query" => value,
+          "analyzer" => analyzer,
+          "operator" => operator
+        }
+      }
+    }
+  end
+
+  def initialize(maxNumLogs = 10000)
+    @query = {
+      "from" => 0, 
+      "size" => maxNumLogs,
+      "query" => {
+        "bool" => {
+          "filter" => [
+            {
+              "range" => {
+                "@timestamp" => {
+                  "gte" => "2023-03-13T00:00:00.00Z",
+                  "lte" => Query.timeFormat(Time.now),
+                  "format" => "strict_date_optional_time"
+                }
+              }
+            },
+          ]
+        }
+      }
+    }
+  end
+  def timeRange(from, to)
+    @query["query"]["bool"]["filter"].find{|h| h.key?("range")}["range"]["@timestamp"]["gte"] = from
+    @query["query"]["bool"]["filter"].find{|h| h.key?("range")}["range"]["@timestamp"]["lte"] = to
+  end
+
+  def httpMethod(method)
+    @query["query"]["bool"]["filter"].append(Query.matchQuery("request_method", method))
+  end
+
+  def appName(name) 
+    @query["query"]["bool"]["filter"].append(Query.matchQuery("kubernetes.labels.app", name))
+  end
+
+  def uri(path)
+    @query["query"]["bool"]["filter"].append(Query.matchQuery("uri", path, "standard", "AND"))
+  end
+  
+  def originNamespace(namespace)
+    @query["query"]["bool"]["filter"].append(Query.matchQuery("origin_namespace", namespace))
+  end
+
+  def toJson()
+    return @query.to_json
+  end
+
+  def to_s 
+    @query.to_s
+  end
+end
+
+# TODO:
+# Keys rotated offline (tuf-reposerver, director, keyserver)
+# PUT, POST, DELETE 
+
+class Audit
+  @@actionsMap = {
+    "api/v1/user_repo/targets$"  => {"PUT" => "Upload signed targets.json"},
+    "api/v1/user_repo/targets/.*"  => {"PUT" => "Create Tuf Target", "POST" => "Create TUF target", "PATCH" => "Modify TUF target", "DELETE" => "Delete TUF target"},
+    "api/v1/user_repo/trusted-delegations/.*/remote/refresh"  => {"PUT" => "Refresh remote delegation"},
+    "api/v1/user_repo/trusted-delegations/.*"  => {"PUT" => "Create or modify trusted-delegations"},
+    "api/v1/user_repo/delegations/.*"  => {"PUT" => "Create or modify delegation metadata"},
+    "api/v1/multi_target_updates"  => {"POST" => "Create multi-target-update"},
+    "api/v1/assignments"  => {"POST" => "Create device assignment"},
+    "api/v1/admin/repo/offline-updates/.*"  => {"POST" => "Create or modify lockbox", "PUT" => "Create or modify lockbox"},
+    "api/accounts/users/clients$"  => {"POST" => "Create third-party API client"},
+    "api/accounts/users/clients/.*"  => {"DELETE" => "Revoke third-party API client"},
+    "api/accounts/users/.*/keys/credentials.zip"  => {"GET" => "Download credentials.zip"},
+    "api/accounts/organizations/share/.*/users$" => {"POST" => "Share organization with user"},
+    "api/accounts/organizations/share/.*/users/.*" => {"DELETE" => "Revoke organization access for user", "PUT" => "Change organization access level for user"},
+    "api/accounts/devices$" => {"POST" => "Provision device"},
+    "api/v1/device_groups$" => {"POST" => "Create device fleet"},
+    "api/v1/device_groups/.*/devices/.*" => {"POST" => "Add device to fleet", "DELETE" => "Remove device from fleet"},
+    "api/v1/device_groups/.*/rename" => {"PUT" => "Rename device fleet"},
+    "api/v1/device_groups/.*" => {"DELETE" => "Delete device fleet"},
+    "api/v1/devices/.*" => {"DELETE" => "Delete device"},
+  }
+
+  def initialize(client)
+    @client = client
+  end
+
+  def findAction(method, uri)
+    @@actionsMap.each {|uriPattern, methodActions|
+      if uri.match(uriPattern)
+        if methodActions.key?(method)
+          return methodActions[method]
+        end
+      end
+    }
+    return "Unknown Action"
+  end
+
+  def userActions(from, to, namespace, dropUnknownActions = true)
+    query = Query.new()
+    query.timeRange(Query.timeFormat(from), Query.timeFormat(to))
+    query.appName("ota-kong-kong")
+    query.originNamespace(namespace)
+
+    response = @client.search index: 'logstash*', body: query.toJson
+
+    actions =  response["hits"]["hits"].map{ |obj|
+      src = obj["_source"]
+      {
+        "method" => src.key?("request_method") ? src["request_method"] : "",
+        "path" => src.key?("uri") ? src["uri"]: "",
+        "at" => src.key?("@timestamp") ? src["@timestamp"]: "",
+        "namespace" => src.key?("namespace") ? src["namespace"]: "",
+        "origin_namespace" => src.key?("origin_namespace") ? src["origin_namespace"]: "",
+        "status_code" => src.key?("status") ? src["status"]: "",
+        "ip" => src.key?("client_addr") ? src["client_addr"]: "",
+        "query" => src.key?("query_string") ? src["query_string"]: "",
+        "log_id" => obj.key?("_id") ? obj["_id"]: "",
+        "action" => self.findAction(src.key?("request_method") ? src["request_method"] : "", src.key?("uri") ? src["uri"]: "")
+      }
+    }
+    if dropUnknownActions
+      return actions.select{|req| req["action"]  != "Unknown Action"} 
+    end
+    return actions
+  end
+
+end

metadata

@@ -0,0 +1,43 @@
+--- !ruby/object:Gem::Specification
+name: torizon_audit
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Ben Clouser
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2023-03-15 00:00:00.000000000 Z
+dependencies: []
+description: Fetch user actions from torizon platform
+email: ben.clouser@toradex.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/torizon_audit.rb
+homepage:
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.25
+signing_key:
+specification_version: 4
+summary: Fetch user actions from torizon platform
+test_files: []