Skip to content

Commit e95c0ed

Browse files
xfhgxfhg
committed
v1-prerelease
1 parent 515c8e5 commit e95c0ed

File tree

5 files changed

+152
-17
lines changed

5 files changed

+152
-17
lines changed

‎CHANGELOG.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
6+
## [[Unreleased]] - feature/loadremote
7+
Commit: [55e24a0](https://github.com/xfhg/intercept/commit/55e24a0)
8+
9+
Summary: Capability to load the main policy file from remote endpoint (and check their SHA256)
10+
11+
### Added
12+
- Added this CHANGELOG
13+
- Added shorthand for policy (-p)
14+
- Added shorthand for tag filtering "tags_any" (-f)
15+
- Added sha256 checksum on command line for policy (--checksum)
16+
- INTERCEPT can now load a remote policy (ex: https://raw.githubusercontent.com/xfhg/intercept/master/playground/policies/test_scan.yaml)
17+
- INTERCEPT can verify the checksum of remote policies
18+
19+
### Changed
20+
- Modified go build version to 1.23
21+
22+
### Removed
23+

‎cmd/audit.go‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,18 @@ type Performance struct {
1818
}
1919

2020
var (
21-
targetDir string
22-
tagsAny string
23-
tagsAll string
24-
environment string
25-
envDetection bool
26-
debugOutput bool
27-
rgPath string
28-
gossPath string
29-
policyFile string
30-
outputType string
31-
policyData *PolicyFile
21+
targetDir string
22+
tagsAny string
23+
tagsAll string
24+
environment string
25+
envDetection bool
26+
debugOutput bool
27+
rgPath string
28+
gossPath string
29+
policyFile string
30+
policyFileSHA256 string
31+
outputType string
32+
policyData *PolicyFile
3233
)
3334

3435
var runAuditPerfCmd = &cobra.Command{
@@ -41,12 +42,13 @@ var runAuditPerfCmd = &cobra.Command{
4142
func init() {
4243
rootCmd.AddCommand(runAuditPerfCmd)
4344
runAuditPerfCmd.Flags().StringVarP(&targetDir, "target", "t", "", "Target directory to audit")
44-
runAuditPerfCmd.Flags().StringVar(&tagsAny, "tags_any", "", "Filter policies that match any of the provided tags (comma-separated)")
45+
runAuditPerfCmd.Flags().StringVarP(&tagsAny, "tags_any", "f", "", "Filter policies that match any of the provided tags (comma-separated)")
4546
runAuditPerfCmd.Flags().StringVar(&tagsAll, "tags_all", "", "Filter policies that match all of the provided tags (comma-separated)")
46-
runAuditPerfCmd.Flags().StringVar(&environment, "environment", "", "Filter policies that match the specified environment")
47+
runAuditPerfCmd.Flags().StringVarP(&environment, "environment", "e", "", "Filter policies that match the specified environment")
4748
runAuditPerfCmd.Flags().BoolVar(&envDetection, "env-detection", false, "Enable environment detection if no environment is specified")
4849
runAuditPerfCmd.Flags().BoolVar(&debugOutput, "debug", false, "Enable debug verbose output")
49-
runAuditPerfCmd.Flags().StringVar(&policyFile, "policy", "", "policy file")
50+
runAuditPerfCmd.Flags().StringVarP(&policyFile, "policy", "p", "", "policy FILE or URL")
51+
runAuditPerfCmd.Flags().StringVar(&policyFileSHA256, "checksum", "", "policy file SHA256 checksum")
5052
runAuditPerfCmd.Flags().StringVar(&outputType, "output", "sarif", "output type")
5153
}
5254

@@ -56,7 +58,22 @@ func runAuditPerf(cmd *cobra.Command, args []string) {
5658

5759
perf := Performance{StartTime: time.Now()}
5860

59-
policyData, err = LoadPolicyFile(policyFile)
61+
sourceType, processedInput, err := DeterminePolicySource(policyFile)
62+
if err != nil {
63+
log.Fatal().Err(err)
64+
}
65+
66+
switch sourceType {
67+
case LocalFile:
68+
policyData, err = LoadPolicyFile(processedInput)
69+
case RemoteURL:
70+
policyData, err = LoadRemotePolicy(processedInput, policyFileSHA256)
71+
default:
72+
log.Fatal().Msg("unknown policy source type")
73+
}
74+
75+
//policyData, err = LoadPolicyFile(policyFile)
76+
6077
if err != nil {
6178
log.Fatal().Err(err).Str("file", policyFile).Msg("Error loading policy file")
6279
}

‎cmd/aux.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"encoding/json"
77
"fmt"
88
"io"
9+
"net/url"
910
"os"
1011
"path/filepath"
1112
"strconv"
@@ -411,3 +412,13 @@ func PathInfo(path string) (exists bool, isDir bool, err error) {
411412
func GetDirectory(path string) string {
412413
return filepath.Dir(path) + "/"
413414
}
415+
416+
// isURL checks if the input string is a valid URL
417+
func isURL(input string) bool {
418+
// Check for common URL schemes
419+
if strings.HasPrefix(input, "http://") || strings.HasPrefix(input, "https://") {
420+
_, err := url.ParseRequestURI(input)
421+
return err == nil
422+
}
423+
return false
424+
}

‎cmd/policy.go‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
package cmd
22

33
import (
4+
"fmt"
5+
"net/http"
46
"os"
7+
"path/filepath"
58
"sync"
69

10+
"github.com/go-resty/resty/v2"
711
"gopkg.in/yaml.v3"
812
)
913

@@ -108,6 +112,13 @@ type PolicyFile struct {
108112
Policies []Policy `yaml:"Policies"`
109113
}
110114

115+
type PolicySourceType int
116+
117+
const (
118+
LocalFile PolicySourceType = iota
119+
RemoteURL
120+
)
121+
111122
func LoadPolicyFile(filename string) (*PolicyFile, error) {
112123
data, err := os.ReadFile(filename)
113124
if err != nil {
@@ -130,6 +141,79 @@ func LoadPolicyFile(filename string) (*PolicyFile, error) {
130141
return &policyFile, nil
131142
}
132143

144+
// Load Remote
145+
146+
// LoadRemotePolicy loads a policy file from a remote HTTPS endpoint
147+
func LoadRemotePolicy(url string, expectedChecksum string) (*PolicyFile, error) {
148+
// Create a temporary directory to store the downloaded file
149+
tempDir, err := os.MkdirTemp(outputDir, "_remote")
150+
if err != nil {
151+
return nil, fmt.Errorf("failed to create temporary directory: %w", err)
152+
}
153+
defer os.RemoveAll(tempDir) // Clean up the temporary directory when done
154+
155+
// Generate a temporary file name
156+
tempFile := filepath.Join(tempDir, "remote_policy.yaml")
157+
158+
// Create a resty client
159+
client := resty.New()
160+
161+
// Download the file
162+
resp, err := client.R().SetOutput(tempFile).Get(url)
163+
if err != nil {
164+
return nil, fmt.Errorf("failed to download policy file: %w", err)
165+
}
166+
167+
if resp.StatusCode() != http.StatusOK {
168+
return nil, fmt.Errorf("failed to download policy file: HTTP status %d", resp.StatusCode())
169+
}
170+
171+
// If a checksum is provided, validate it
172+
if expectedChecksum != "" {
173+
actualChecksum, err := calculateSHA256(tempFile)
174+
if err != nil {
175+
log.Fatal().Err(err).Msg("failed to calculate policy checksum")
176+
}
177+
178+
if actualChecksum != expectedChecksum {
179+
log.Fatal().Msgf("Policy checksum mismatch: expected %s, got %s", expectedChecksum, actualChecksum)
180+
181+
}
182+
}
183+
184+
// Load the policy file
185+
policyFile, err := LoadPolicyFile(tempFile)
186+
if err != nil {
187+
log.Fatal().Err(err).Msg("failed to load policy file")
188+
}
189+
190+
return policyFile, nil
191+
}
192+
193+
func DeterminePolicySource(input string) (PolicySourceType, string, error) {
194+
// First, check if it's a valid URL
195+
if isURL(input) {
196+
return RemoteURL, input, nil
197+
}
198+
199+
// If not a URL, treat it as a file path
200+
absPath, err := filepath.Abs(input)
201+
if err != nil {
202+
return LocalFile, "", err
203+
}
204+
205+
// Check if the file exists
206+
_, err = os.Stat(absPath)
207+
if err != nil {
208+
if os.IsNotExist(err) {
209+
return LocalFile, "", fmt.Errorf("file does not exist: %s", absPath)
210+
}
211+
return LocalFile, "", err
212+
}
213+
214+
return LocalFile, absPath, nil
215+
}
216+
133217
// Policy store
134218

135219
var (

‎cmd/version.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ var versionCmd = &cobra.Command{
99
Short: "Print the build info of intercept",
1010
Long: `Print the build version number of intercept along with its signature`,
1111
Run: func(cmd *cobra.Command, args []string) {
12-
log.Info().Msgf("Intercept build version %s", buildVersion)
13-
log.Info().Msgf("Intercept signature [%s]", buildSignature)
12+
log.Log().Msgf("Intercept build version %s", buildVersion)
13+
log.Log().Msgf("Intercept signature [%s]", buildSignature)
1414
},
1515
}
1616

0 commit comments

Comments
 (0)