@Test public void executeTest() throws Exception { mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn( true); when(PacmanUtils.formatUrl(anyObject(),anyString())).thenReturn("host"); when(PacmanUtils.checkAccessibleToAll(anyObject(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getMapBoolean("r_123 ")); assertThat(checkForSecurityGroupWithAnywhereAccess.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.checkAccessibleToAll(anyObject(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn(CommonTestUtils.getEmptyMapBoolean("r_123 ")); assertThat(checkForSecurityGroupWithAnywhereAccess.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.checkAccessibleToAll(anyObject(),anyString(),anyString(),anyString(),anyString(),anyString())).thenThrow(new Exception()); assertThatThrownBy( () -> checkForSecurityGroupWithAnywhereAccess.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(RuleExecutionFailedExeption.class); assertThatThrownBy( () -> checkForSecurityGroupWithAnywhereAccess.execute(CommonTestUtils.getOneMoreMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(RuleExecutionFailedExeption.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> checkForSecurityGroupWithAnywhereAccess.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
@SuppressWarnings("deprecation") public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========CheckForSecurityGroupWithAnywhereAccess started========="); Annotation annotation = null; Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); GroupIdentifier groupIdentifier = new GroupIdentifier(); List<GroupIdentifier> list = new ArrayList<>(); String securityGroupId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String portToCheck = ruleParam.get(PacmanRuleConstants.PORT_TO_CHECK); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String sgRulesUrl = null; String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String description = null; String formattedUrl = PacmanUtils.formatUrl(ruleParam,PacmanRuleConstants.ES_SG_RULES_URL); if(!StringUtils.isEmpty(formattedUrl)){ sgRulesUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,portToCheck, severity, category, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (!StringUtils.isEmpty(securityGroupId)) { groupIdentifier.setGroupId(securityGroupId); list.add(groupIdentifier); securityGroupsSet.addAll(list); try { Map<String, Boolean> sgOpen = PacmanUtils.checkAccessibleToAll(securityGroupsSet, portToCheck, sgRulesUrl, cidrIp,cidrIpv6,""); if (!sgOpen.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); if (!portToCheck.equalsIgnoreCase("any")) { description = "Security Group has port : " + portToCheck + " publicly open"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } else { description = "One of the inbound rule is open to internet for this sg"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } issue.put("cidr_ip", cidrIp); issue.put("cidr_ip_v6", cidrIpv6); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended with an annotation {} :=========", annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info("Security group doesn't have any port with global access : {} ",securityGroupId); } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } } else { logger.error("Resource Id not found!!"); throw new RuleExecutionFailedExeption("Resource Id not found!!"); } logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }
CheckForSecurityGroupWithAnywhereAccess extends BaseRule { @SuppressWarnings("deprecation") public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========CheckForSecurityGroupWithAnywhereAccess started========="); Annotation annotation = null; Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); GroupIdentifier groupIdentifier = new GroupIdentifier(); List<GroupIdentifier> list = new ArrayList<>(); String securityGroupId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String portToCheck = ruleParam.get(PacmanRuleConstants.PORT_TO_CHECK); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String sgRulesUrl = null; String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String description = null; String formattedUrl = PacmanUtils.formatUrl(ruleParam,PacmanRuleConstants.ES_SG_RULES_URL); if(!StringUtils.isEmpty(formattedUrl)){ sgRulesUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,portToCheck, severity, category, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (!StringUtils.isEmpty(securityGroupId)) { groupIdentifier.setGroupId(securityGroupId); list.add(groupIdentifier); securityGroupsSet.addAll(list); try { Map<String, Boolean> sgOpen = PacmanUtils.checkAccessibleToAll(securityGroupsSet, portToCheck, sgRulesUrl, cidrIp,cidrIpv6,""); if (!sgOpen.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); if (!portToCheck.equalsIgnoreCase("any")) { description = "Security Group has port : " + portToCheck + " publicly open"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } else { description = "One of the inbound rule is open to internet for this sg"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } issue.put("cidr_ip", cidrIp); issue.put("cidr_ip_v6", cidrIpv6); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended with an annotation {} :=========", annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info("Security group doesn't have any port with global access : {} ",securityGroupId); } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } } else { logger.error("Resource Id not found!!"); throw new RuleExecutionFailedExeption("Resource Id not found!!"); } logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); } }
CheckForSecurityGroupWithAnywhereAccess extends BaseRule { @SuppressWarnings("deprecation") public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========CheckForSecurityGroupWithAnywhereAccess started========="); Annotation annotation = null; Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); GroupIdentifier groupIdentifier = new GroupIdentifier(); List<GroupIdentifier> list = new ArrayList<>(); String securityGroupId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String portToCheck = ruleParam.get(PacmanRuleConstants.PORT_TO_CHECK); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String sgRulesUrl = null; String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String description = null; String formattedUrl = PacmanUtils.formatUrl(ruleParam,PacmanRuleConstants.ES_SG_RULES_URL); if(!StringUtils.isEmpty(formattedUrl)){ sgRulesUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,portToCheck, severity, category, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (!StringUtils.isEmpty(securityGroupId)) { groupIdentifier.setGroupId(securityGroupId); list.add(groupIdentifier); securityGroupsSet.addAll(list); try { Map<String, Boolean> sgOpen = PacmanUtils.checkAccessibleToAll(securityGroupsSet, portToCheck, sgRulesUrl, cidrIp,cidrIpv6,""); if (!sgOpen.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); if (!portToCheck.equalsIgnoreCase("any")) { description = "Security Group has port : " + portToCheck + " publicly open"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } else { description = "One of the inbound rule is open to internet for this sg"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } issue.put("cidr_ip", cidrIp); issue.put("cidr_ip_v6", cidrIpv6); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended with an annotation {} :=========", annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info("Security group doesn't have any port with global access : {} ",securityGroupId); } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } } else { logger.error("Resource Id not found!!"); throw new RuleExecutionFailedExeption("Resource Id not found!!"); } logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  }
CheckForSecurityGroupWithAnywhereAccess extends BaseRule { @SuppressWarnings("deprecation") public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========CheckForSecurityGroupWithAnywhereAccess started========="); Annotation annotation = null; Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); GroupIdentifier groupIdentifier = new GroupIdentifier(); List<GroupIdentifier> list = new ArrayList<>(); String securityGroupId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String portToCheck = ruleParam.get(PacmanRuleConstants.PORT_TO_CHECK); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String sgRulesUrl = null; String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String description = null; String formattedUrl = PacmanUtils.formatUrl(ruleParam,PacmanRuleConstants.ES_SG_RULES_URL); if(!StringUtils.isEmpty(formattedUrl)){ sgRulesUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,portToCheck, severity, category, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (!StringUtils.isEmpty(securityGroupId)) { groupIdentifier.setGroupId(securityGroupId); list.add(groupIdentifier); securityGroupsSet.addAll(list); try { Map<String, Boolean> sgOpen = PacmanUtils.checkAccessibleToAll(securityGroupsSet, portToCheck, sgRulesUrl, cidrIp,cidrIpv6,""); if (!sgOpen.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); if (!portToCheck.equalsIgnoreCase("any")) { description = "Security Group has port : " + portToCheck + " publicly open"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } else { description = "One of the inbound rule is open to internet for this sg"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } issue.put("cidr_ip", cidrIp); issue.put("cidr_ip_v6", cidrIpv6); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended with an annotation {} :=========", annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info("Security group doesn't have any port with global access : {} ",securityGroupId); } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } } else { logger.error("Resource Id not found!!"); throw new RuleExecutionFailedExeption("Resource Id not found!!"); } logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  @SuppressWarnings("deprecation") RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); String getHelpText(); }
CheckForSecurityGroupWithAnywhereAccess extends BaseRule { @SuppressWarnings("deprecation") public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========CheckForSecurityGroupWithAnywhereAccess started========="); Annotation annotation = null; Set<GroupIdentifier> securityGroupsSet = new HashSet<>(); GroupIdentifier groupIdentifier = new GroupIdentifier(); List<GroupIdentifier> list = new ArrayList<>(); String securityGroupId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String portToCheck = ruleParam.get(PacmanRuleConstants.PORT_TO_CHECK); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String sgRulesUrl = null; String cidrIp = ruleParam.get(PacmanRuleConstants.CIDR_IP); String cidrIpv6 = ruleParam.get(PacmanRuleConstants.CIDRIPV6); String description = null; String formattedUrl = PacmanUtils.formatUrl(ruleParam,PacmanRuleConstants.ES_SG_RULES_URL); if(!StringUtils.isEmpty(formattedUrl)){ sgRulesUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(cidrIpv6,portToCheck, severity, category, sgRulesUrl, cidrIp)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (!StringUtils.isEmpty(securityGroupId)) { groupIdentifier.setGroupId(securityGroupId); list.add(groupIdentifier); securityGroupsSet.addAll(list); try { Map<String, Boolean> sgOpen = PacmanUtils.checkAccessibleToAll(securityGroupsSet, portToCheck, sgRulesUrl, cidrIp,cidrIpv6,""); if (!sgOpen.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); if (!portToCheck.equalsIgnoreCase("any")) { description = "Security Group has port : " + portToCheck + " publicly open"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } else { description = "One of the inbound rule is open to internet for this sg"; annotation.put(PacmanSdkConstants.DESCRIPTION, description); issue.put(PacmanRuleConstants.VIOLATION_REASON, description); } issue.put("cidr_ip", cidrIp); issue.put("cidr_ip_v6", cidrIpv6); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended with an annotation {} :=========", annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info("Security group doesn't have any port with global access : {} ",securityGroupId); } } catch (Exception e) { logger.error(e.getMessage()); throw new RuleExecutionFailedExeption(e.getMessage()); } } else { logger.error("Resource Id not found!!"); throw new RuleExecutionFailedExeption("Resource Id not found!!"); } logger.debug("========CheckForSecurityGroupWithAnywhereAccess ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  @SuppressWarnings("deprecation") RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); String getHelpText();  }