@Test public void executeTest() throws Exception { mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn( true); when(PacmanUtils.getPacmanHost(anyString())).thenReturn("host"); when(PacmanUtils.isHavingPublicAccess(anyObject(),anyString())).thenReturn( true); when(PacmanUtils.createAnnotation(anyString(),anyObject(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getAnnotation("123")); assertThat(elasticSearchPublicAccessRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.isHavingPublicAccess(anyObject(),anyString())).thenReturn( false); assertThat(elasticSearchPublicAccessRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.getRouteTableId(anyString(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getSetString("123")); when(PacmanUtils.isIgwFound(anyString(),anyString(),anyString(),anyObject(),anyObject(),anyString(),anyString(),anyString())).thenReturn(true); when(PacmanUtils.getSecurityGrouplist(anyString(),anyString(),anyObject())).thenReturn(CommonTestUtils.getListSecurityGroupId()); when(PacmanUtils.checkAccessibleToAll(anyObject(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getMapBoolean("123")); when(PacmanUtils.setAnnotation(anyObject(),anyObject(),anyString(),anyString(),anyObject())).thenReturn(CommonTestUtils.getAnnotation("123")); assertThat(elasticSearchPublicAccessRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getWithOutEndPointMoreMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.getSecurityGrouplist(anyString(),anyString(),anyObject())).thenReturn(CommonTestUtils.getListSecurityGroupId()); when(PacmanUtils.getRouteTableId(anyString(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getEmptySetString()); when(PacmanUtils.isIgwFound(anyString(),anyString(),anyString(),anyObject(),anyObject(),anyString(),anyString(),anyString())).thenReturn(false); assertThat(elasticSearchPublicAccessRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getAnotherMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> elasticSearchPublicAccessRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========ElasticSearchPublicAccessRule started========="); JsonParser jsonParser = new JsonParser(); Set<String> routeTableIdSet = new HashSet<>(); Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); Map<String, Boolean> openPortsMap = new HashMap<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); Gson gson = new Gson(); Annotation annotation = null; Boolean isIgwExists = false; String routetableAssociationsEsURL = null; String routetableRoutesEsURL = null; String routetableEsURL = null; String sgRulesUrl = null; String endPoint = resourceAttributes.get(PacmanRuleConstants.END_POINT); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String vpcId = resourceAttributes.get(PacmanRuleConstants.VPC_ID); String subnetId = resourceAttributes.get(PacmanRuleConstants.SUBNETID); String securityGroupId = resourceAttributes.get(PacmanRuleConstants.EC2_WITH_SECURITYGROUP_ID); String internetGateWay = ruleParam.get(PacmanRuleConstants.INTERNET_GATEWAY); String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String targetType = resourceAttributes.get(PacmanRuleConstants.ENTITY_TYPE); String description = targetType + " has publicly accessible ports"; String pacmanHost = PacmanUtils.getPacmanHost(PacmanRuleConstants.ES_URI); logger.debug("========pacmanHost {} =========", pacmanHost); if (!StringUtils.isNullOrEmpty(pacmanHost)) { routetableAssociationsEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ASSOCIATIONS_URL); routetableRoutesEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ROUTES_URL); routetableEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_URL); sgRulesUrl = ruleParam.get(PacmanRuleConstants.ES_SG_RULES_URL); routetableAssociationsEsURL = pacmanHost + routetableAssociationsEsURL; routetableRoutesEsURL = pacmanHost + routetableRoutesEsURL; routetableEsURL = pacmanHost + routetableEsURL; sgRulesUrl = pacmanHost + sgRulesUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,internetGateWay, severity, category, routetableAssociationsEsURL, routetableRoutesEsURL, routetableEsURL, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } try { if (!StringUtils.isNullOrEmpty(endPoint)) { if (resourceAttributes.containsKey(PacmanRuleConstants.ACCESS_POLICIES)) { JsonObject accessPoliciesJson = (JsonObject) jsonParser.parse(resourceAttributes.get(PacmanRuleConstants.ACCESS_POLICIES)); if (accessPoliciesJson.has(PacmanRuleConstants.STATEMENT)) { JsonArray statments = accessPoliciesJson.get(PacmanRuleConstants.STATEMENT).getAsJsonArray(); if (PacmanUtils.isHavingPublicAccess(statments,"http: accessPoliciesJson.add("endPoint", gson.fromJson(endPoint, JsonElement.class)); description = "Elastic search is open to internet " + accessPoliciesJson ; annotation = PacmanUtils.createAnnotation(null, ruleParam, description, severity, category); if(null!=annotation){ annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); } } else { logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } } } } else { if (!StringUtils.isNullOrEmpty(subnetId)) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableAssociationsEsURL, "subnet"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, subnetId, "Subnet", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (!isIgwExists && routeTableIdSet.isEmpty() && (!StringUtils.isNullOrEmpty(vpcId))) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableEsURL, "vpc"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, vpcId, "VPC", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (isIgwExists) { List<GroupIdentifier> listSecurityGroupID = new ArrayList<>(); listSecurityGroupID = PacmanUtils.getSecurityGrouplist(securityGroupId, ",", listSecurityGroupID); securityGroupsSet.addAll(listSecurityGroupID); issue.put(PacmanRuleConstants.SEC_GRP,org.apache.commons.lang3.StringUtils.join(listSecurityGroupID, "/")); } else { logger.info("Elasticsearch is not publically accessble"); } logger.info("calling Global IP method"); if (!securityGroupsSet.isEmpty()) { openPortsMap = PacmanUtils.checkAccessibleToAll(securityGroupsSet, "ANY", sgRulesUrl, cidrIp,cidrIpv6,""); } if (!openPortsMap.isEmpty()) { annotation = PacmanUtils.setAnnotation(openPortsMap,ruleParam, subnetId, description, issue); if (null != annotation) { annotation.put("endpoint", endPoint); annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }
ElasticSearchPublicAccessRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========ElasticSearchPublicAccessRule started========="); JsonParser jsonParser = new JsonParser(); Set<String> routeTableIdSet = new HashSet<>(); Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); Map<String, Boolean> openPortsMap = new HashMap<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); Gson gson = new Gson(); Annotation annotation = null; Boolean isIgwExists = false; String routetableAssociationsEsURL = null; String routetableRoutesEsURL = null; String routetableEsURL = null; String sgRulesUrl = null; String endPoint = resourceAttributes.get(PacmanRuleConstants.END_POINT); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String vpcId = resourceAttributes.get(PacmanRuleConstants.VPC_ID); String subnetId = resourceAttributes.get(PacmanRuleConstants.SUBNETID); String securityGroupId = resourceAttributes.get(PacmanRuleConstants.EC2_WITH_SECURITYGROUP_ID); String internetGateWay = ruleParam.get(PacmanRuleConstants.INTERNET_GATEWAY); String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String targetType = resourceAttributes.get(PacmanRuleConstants.ENTITY_TYPE); String description = targetType + " has publicly accessible ports"; String pacmanHost = PacmanUtils.getPacmanHost(PacmanRuleConstants.ES_URI); logger.debug("========pacmanHost {} =========", pacmanHost); if (!StringUtils.isNullOrEmpty(pacmanHost)) { routetableAssociationsEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ASSOCIATIONS_URL); routetableRoutesEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ROUTES_URL); routetableEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_URL); sgRulesUrl = ruleParam.get(PacmanRuleConstants.ES_SG_RULES_URL); routetableAssociationsEsURL = pacmanHost + routetableAssociationsEsURL; routetableRoutesEsURL = pacmanHost + routetableRoutesEsURL; routetableEsURL = pacmanHost + routetableEsURL; sgRulesUrl = pacmanHost + sgRulesUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,internetGateWay, severity, category, routetableAssociationsEsURL, routetableRoutesEsURL, routetableEsURL, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } try { if (!StringUtils.isNullOrEmpty(endPoint)) { if (resourceAttributes.containsKey(PacmanRuleConstants.ACCESS_POLICIES)) { JsonObject accessPoliciesJson = (JsonObject) jsonParser.parse(resourceAttributes.get(PacmanRuleConstants.ACCESS_POLICIES)); if (accessPoliciesJson.has(PacmanRuleConstants.STATEMENT)) { JsonArray statments = accessPoliciesJson.get(PacmanRuleConstants.STATEMENT).getAsJsonArray(); if (PacmanUtils.isHavingPublicAccess(statments,"http: accessPoliciesJson.add("endPoint", gson.fromJson(endPoint, JsonElement.class)); description = "Elastic search is open to internet " + accessPoliciesJson ; annotation = PacmanUtils.createAnnotation(null, ruleParam, description, severity, category); if(null!=annotation){ annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); } } else { logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } } } } else { if (!StringUtils.isNullOrEmpty(subnetId)) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableAssociationsEsURL, "subnet"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, subnetId, "Subnet", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (!isIgwExists && routeTableIdSet.isEmpty() && (!StringUtils.isNullOrEmpty(vpcId))) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableEsURL, "vpc"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, vpcId, "VPC", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (isIgwExists) { List<GroupIdentifier> listSecurityGroupID = new ArrayList<>(); listSecurityGroupID = PacmanUtils.getSecurityGrouplist(securityGroupId, ",", listSecurityGroupID); securityGroupsSet.addAll(listSecurityGroupID); issue.put(PacmanRuleConstants.SEC_GRP,org.apache.commons.lang3.StringUtils.join(listSecurityGroupID, "/")); } else { logger.info("Elasticsearch is not publically accessble"); } logger.info("calling Global IP method"); if (!securityGroupsSet.isEmpty()) { openPortsMap = PacmanUtils.checkAccessibleToAll(securityGroupsSet, "ANY", sgRulesUrl, cidrIp,cidrIpv6,""); } if (!openPortsMap.isEmpty()) { annotation = PacmanUtils.setAnnotation(openPortsMap,ruleParam, subnetId, description, issue); if (null != annotation) { annotation.put("endpoint", endPoint); annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } }
ElasticSearchPublicAccessRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========ElasticSearchPublicAccessRule started========="); JsonParser jsonParser = new JsonParser(); Set<String> routeTableIdSet = new HashSet<>(); Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); Map<String, Boolean> openPortsMap = new HashMap<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); Gson gson = new Gson(); Annotation annotation = null; Boolean isIgwExists = false; String routetableAssociationsEsURL = null; String routetableRoutesEsURL = null; String routetableEsURL = null; String sgRulesUrl = null; String endPoint = resourceAttributes.get(PacmanRuleConstants.END_POINT); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String vpcId = resourceAttributes.get(PacmanRuleConstants.VPC_ID); String subnetId = resourceAttributes.get(PacmanRuleConstants.SUBNETID); String securityGroupId = resourceAttributes.get(PacmanRuleConstants.EC2_WITH_SECURITYGROUP_ID); String internetGateWay = ruleParam.get(PacmanRuleConstants.INTERNET_GATEWAY); String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String targetType = resourceAttributes.get(PacmanRuleConstants.ENTITY_TYPE); String description = targetType + " has publicly accessible ports"; String pacmanHost = PacmanUtils.getPacmanHost(PacmanRuleConstants.ES_URI); logger.debug("========pacmanHost {} =========", pacmanHost); if (!StringUtils.isNullOrEmpty(pacmanHost)) { routetableAssociationsEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ASSOCIATIONS_URL); routetableRoutesEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ROUTES_URL); routetableEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_URL); sgRulesUrl = ruleParam.get(PacmanRuleConstants.ES_SG_RULES_URL); routetableAssociationsEsURL = pacmanHost + routetableAssociationsEsURL; routetableRoutesEsURL = pacmanHost + routetableRoutesEsURL; routetableEsURL = pacmanHost + routetableEsURL; sgRulesUrl = pacmanHost + sgRulesUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,internetGateWay, severity, category, routetableAssociationsEsURL, routetableRoutesEsURL, routetableEsURL, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } try { if (!StringUtils.isNullOrEmpty(endPoint)) { if (resourceAttributes.containsKey(PacmanRuleConstants.ACCESS_POLICIES)) { JsonObject accessPoliciesJson = (JsonObject) jsonParser.parse(resourceAttributes.get(PacmanRuleConstants.ACCESS_POLICIES)); if (accessPoliciesJson.has(PacmanRuleConstants.STATEMENT)) { JsonArray statments = accessPoliciesJson.get(PacmanRuleConstants.STATEMENT).getAsJsonArray(); if (PacmanUtils.isHavingPublicAccess(statments,"http: accessPoliciesJson.add("endPoint", gson.fromJson(endPoint, JsonElement.class)); description = "Elastic search is open to internet " + accessPoliciesJson ; annotation = PacmanUtils.createAnnotation(null, ruleParam, description, severity, category); if(null!=annotation){ annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); } } else { logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } } } } else { if (!StringUtils.isNullOrEmpty(subnetId)) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableAssociationsEsURL, "subnet"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, subnetId, "Subnet", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (!isIgwExists && routeTableIdSet.isEmpty() && (!StringUtils.isNullOrEmpty(vpcId))) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableEsURL, "vpc"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, vpcId, "VPC", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (isIgwExists) { List<GroupIdentifier> listSecurityGroupID = new ArrayList<>(); listSecurityGroupID = PacmanUtils.getSecurityGrouplist(securityGroupId, ",", listSecurityGroupID); securityGroupsSet.addAll(listSecurityGroupID); issue.put(PacmanRuleConstants.SEC_GRP,org.apache.commons.lang3.StringUtils.join(listSecurityGroupID, "/")); } else { logger.info("Elasticsearch is not publically accessble"); } logger.info("calling Global IP method"); if (!securityGroupsSet.isEmpty()) { openPortsMap = PacmanUtils.checkAccessibleToAll(securityGroupsSet, "ANY", sgRulesUrl, cidrIp,cidrIpv6,""); } if (!openPortsMap.isEmpty()) { annotation = PacmanUtils.setAnnotation(openPortsMap,ruleParam, subnetId, description, issue); if (null != annotation) { annotation.put("endpoint", endPoint); annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  }
ElasticSearchPublicAccessRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========ElasticSearchPublicAccessRule started========="); JsonParser jsonParser = new JsonParser(); Set<String> routeTableIdSet = new HashSet<>(); Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); Map<String, Boolean> openPortsMap = new HashMap<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); Gson gson = new Gson(); Annotation annotation = null; Boolean isIgwExists = false; String routetableAssociationsEsURL = null; String routetableRoutesEsURL = null; String routetableEsURL = null; String sgRulesUrl = null; String endPoint = resourceAttributes.get(PacmanRuleConstants.END_POINT); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String vpcId = resourceAttributes.get(PacmanRuleConstants.VPC_ID); String subnetId = resourceAttributes.get(PacmanRuleConstants.SUBNETID); String securityGroupId = resourceAttributes.get(PacmanRuleConstants.EC2_WITH_SECURITYGROUP_ID); String internetGateWay = ruleParam.get(PacmanRuleConstants.INTERNET_GATEWAY); String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String targetType = resourceAttributes.get(PacmanRuleConstants.ENTITY_TYPE); String description = targetType + " has publicly accessible ports"; String pacmanHost = PacmanUtils.getPacmanHost(PacmanRuleConstants.ES_URI); logger.debug("========pacmanHost {} =========", pacmanHost); if (!StringUtils.isNullOrEmpty(pacmanHost)) { routetableAssociationsEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ASSOCIATIONS_URL); routetableRoutesEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ROUTES_URL); routetableEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_URL); sgRulesUrl = ruleParam.get(PacmanRuleConstants.ES_SG_RULES_URL); routetableAssociationsEsURL = pacmanHost + routetableAssociationsEsURL; routetableRoutesEsURL = pacmanHost + routetableRoutesEsURL; routetableEsURL = pacmanHost + routetableEsURL; sgRulesUrl = pacmanHost + sgRulesUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,internetGateWay, severity, category, routetableAssociationsEsURL, routetableRoutesEsURL, routetableEsURL, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } try { if (!StringUtils.isNullOrEmpty(endPoint)) { if (resourceAttributes.containsKey(PacmanRuleConstants.ACCESS_POLICIES)) { JsonObject accessPoliciesJson = (JsonObject) jsonParser.parse(resourceAttributes.get(PacmanRuleConstants.ACCESS_POLICIES)); if (accessPoliciesJson.has(PacmanRuleConstants.STATEMENT)) { JsonArray statments = accessPoliciesJson.get(PacmanRuleConstants.STATEMENT).getAsJsonArray(); if (PacmanUtils.isHavingPublicAccess(statments,"http: accessPoliciesJson.add("endPoint", gson.fromJson(endPoint, JsonElement.class)); description = "Elastic search is open to internet " + accessPoliciesJson ; annotation = PacmanUtils.createAnnotation(null, ruleParam, description, severity, category); if(null!=annotation){ annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); } } else { logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } } } } else { if (!StringUtils.isNullOrEmpty(subnetId)) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableAssociationsEsURL, "subnet"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, subnetId, "Subnet", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (!isIgwExists && routeTableIdSet.isEmpty() && (!StringUtils.isNullOrEmpty(vpcId))) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableEsURL, "vpc"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, vpcId, "VPC", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (isIgwExists) { List<GroupIdentifier> listSecurityGroupID = new ArrayList<>(); listSecurityGroupID = PacmanUtils.getSecurityGrouplist(securityGroupId, ",", listSecurityGroupID); securityGroupsSet.addAll(listSecurityGroupID); issue.put(PacmanRuleConstants.SEC_GRP,org.apache.commons.lang3.StringUtils.join(listSecurityGroupID, "/")); } else { logger.info("Elasticsearch is not publically accessble"); } logger.info("calling Global IP method"); if (!securityGroupsSet.isEmpty()) { openPortsMap = PacmanUtils.checkAccessibleToAll(securityGroupsSet, "ANY", sgRulesUrl, cidrIp,cidrIpv6,""); } if (!openPortsMap.isEmpty()) { annotation = PacmanUtils.setAnnotation(openPortsMap,ruleParam, subnetId, description, issue); if (null != annotation) { annotation.put("endpoint", endPoint); annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); @Override String getHelpText(); }
ElasticSearchPublicAccessRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========ElasticSearchPublicAccessRule started========="); JsonParser jsonParser = new JsonParser(); Set<String> routeTableIdSet = new HashSet<>(); Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); Map<String, Boolean> openPortsMap = new HashMap<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); Gson gson = new Gson(); Annotation annotation = null; Boolean isIgwExists = false; String routetableAssociationsEsURL = null; String routetableRoutesEsURL = null; String routetableEsURL = null; String sgRulesUrl = null; String endPoint = resourceAttributes.get(PacmanRuleConstants.END_POINT); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String vpcId = resourceAttributes.get(PacmanRuleConstants.VPC_ID); String subnetId = resourceAttributes.get(PacmanRuleConstants.SUBNETID); String securityGroupId = resourceAttributes.get(PacmanRuleConstants.EC2_WITH_SECURITYGROUP_ID); String internetGateWay = ruleParam.get(PacmanRuleConstants.INTERNET_GATEWAY); String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String targetType = resourceAttributes.get(PacmanRuleConstants.ENTITY_TYPE); String description = targetType + " has publicly accessible ports"; String pacmanHost = PacmanUtils.getPacmanHost(PacmanRuleConstants.ES_URI); logger.debug("========pacmanHost {} =========", pacmanHost); if (!StringUtils.isNullOrEmpty(pacmanHost)) { routetableAssociationsEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ASSOCIATIONS_URL); routetableRoutesEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_ROUTES_URL); routetableEsURL = ruleParam.get(PacmanRuleConstants.ES_ROUTE_TABLE_URL); sgRulesUrl = ruleParam.get(PacmanRuleConstants.ES_SG_RULES_URL); routetableAssociationsEsURL = pacmanHost + routetableAssociationsEsURL; routetableRoutesEsURL = pacmanHost + routetableRoutesEsURL; routetableEsURL = pacmanHost + routetableEsURL; sgRulesUrl = pacmanHost + sgRulesUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,internetGateWay, severity, category, routetableAssociationsEsURL, routetableRoutesEsURL, routetableEsURL, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } try { if (!StringUtils.isNullOrEmpty(endPoint)) { if (resourceAttributes.containsKey(PacmanRuleConstants.ACCESS_POLICIES)) { JsonObject accessPoliciesJson = (JsonObject) jsonParser.parse(resourceAttributes.get(PacmanRuleConstants.ACCESS_POLICIES)); if (accessPoliciesJson.has(PacmanRuleConstants.STATEMENT)) { JsonArray statments = accessPoliciesJson.get(PacmanRuleConstants.STATEMENT).getAsJsonArray(); if (PacmanUtils.isHavingPublicAccess(statments,"http: accessPoliciesJson.add("endPoint", gson.fromJson(endPoint, JsonElement.class)); description = "Elastic search is open to internet " + accessPoliciesJson ; annotation = PacmanUtils.createAnnotation(null, ruleParam, description, severity, category); if(null!=annotation){ annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); } } else { logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } } } } else { if (!StringUtils.isNullOrEmpty(subnetId)) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableAssociationsEsURL, "subnet"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, subnetId, "Subnet", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (!isIgwExists && routeTableIdSet.isEmpty() && (!StringUtils.isNullOrEmpty(vpcId))) { routeTableIdSet = PacmanUtils.getRouteTableId(subnetId, vpcId, routetableEsURL, "vpc"); logger.debug("======routeTableId : {}", routeTableIdSet); if(!routeTableIdSet.isEmpty()){ isIgwExists = PacmanUtils.isIgwFound(cidrIp, vpcId, "VPC", issue, routeTableIdSet, routetableRoutesEsURL, internetGateWay,cidrIpv6); } } if (isIgwExists) { List<GroupIdentifier> listSecurityGroupID = new ArrayList<>(); listSecurityGroupID = PacmanUtils.getSecurityGrouplist(securityGroupId, ",", listSecurityGroupID); securityGroupsSet.addAll(listSecurityGroupID); issue.put(PacmanRuleConstants.SEC_GRP,org.apache.commons.lang3.StringUtils.join(listSecurityGroupID, "/")); } else { logger.info("Elasticsearch is not publically accessble"); } logger.info("calling Global IP method"); if (!securityGroupsSet.isEmpty()) { openPortsMap = PacmanUtils.checkAccessibleToAll(securityGroupsSet, "ANY", sgRulesUrl, cidrIp,cidrIpv6,""); } if (!openPortsMap.isEmpty()) { annotation = PacmanUtils.setAnnotation(openPortsMap,ruleParam, subnetId, description, issue); if (null != annotation) { annotation.put("endpoint", endPoint); annotation.put(PacmanRuleConstants.RESOURCE_DISPLAY_ID, resourceAttributes.get("domainname")); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } logger.debug("========ElasticSearchPublicAccessRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); @Override String getHelpText();  }