diff --git a/controller/internal/routes/posture_response_router.go b/controller/internal/routes/posture_response_router.go index 0ea65f485..f860679b0 100644 --- a/controller/internal/routes/posture_response_router.go +++ b/controller/internal/routes/posture_response_router.go @@ -103,7 +103,7 @@ func (r *PostureResponseRouter) Create(ae *env.AppEnv, rc *response.RequestConte subType := &model.PostureResponseProcess{ IsRunning: apiPostureResponse.IsRunning, BinaryHash: apiPostureResponse.Hash, - SignerFingerprint: apiPostureResponse.SignerFingerprint, + SignerFingerprints: apiPostureResponse.SignerFingerprints, } subType.PostureResponse = postureResponse diff --git a/controller/model/posture_check_model_process.go b/controller/model/posture_check_model_process.go index 81509965c..49cace8c0 100644 --- a/controller/model/posture_check_model_process.go +++ b/controller/model/posture_check_model_process.go @@ -43,7 +43,16 @@ func (p *PostureCheckProcess) Evaluate(pd *PostureData) bool { } if p.Fingerprint != "" { - if !strings.EqualFold(p.Fingerprint, process.SignerFingerprint) { + isFingerprintValid := false + + for _, fingerprint := range process.SignerFingerprints { + if strings.EqualFold(p.Fingerprint, fingerprint) { + isFingerprintValid = true + break + } + } + + if !isFingerprintValid { return false } } diff --git a/controller/model/posture_check_model_process_test.go b/controller/model/posture_check_model_process_test.go index 23162699b..39e148768 100644 --- a/controller/model/posture_check_model_process_test.go +++ b/controller/model/posture_check_model_process_test.go @@ -23,53 +23,6 @@ import ( "time" ) -// Returns a process check and posture data that will pass with matching id, hash, signer, and running state. Can -// be altered to test various pass/fail states -func newMatchingProcessCheckAndData() (*PostureCheckProcess, *PostureData) { - postureCheckId := "30qhj45" - binaryHash := "b4f3228217a2bae3f21f6b6df3750d0723a5c3973db9aad360a8f25bc31e3676d38180cf0abc89d7fca7a26e1919a1e52739ed3116011acc7e96630313da56b8" - signerFingerprint := "950248b9e8b0dd41938018a871a13dd92bed4614" - - postureResponse := &PostureResponse{ - PostureCheckId: postureCheckId, - TypeId: PostureCheckTypeProcess, - TimedOut: false, - LastUpdatedAt: time.Now(), - } - - postureResponseProcess := &PostureResponseProcess{ - IsRunning: true, - BinaryHash: binaryHash, - SignerFingerprint: signerFingerprint, - } - - postureResponse.SubType = postureResponseProcess - postureResponseProcess.PostureResponse = postureResponse - - validPostureData := &PostureData{ - Mac: nil, - Domain: nil, - Os: nil, - Processes: []*PostureResponseProcess{ - postureResponseProcess, - }, - } - - processCheck := &PostureCheckProcess{ - PostureCheckId: postureCheckId, - OperatingSystem: "Windows", - Path: `C:\some\path\some.exe`, - Hashes: []string{ - "something that will never match 1", - binaryHash, - "something that will never match 2", - }, - Fingerprint: signerFingerprint, - } - - return processCheck, validPostureData -} - func TestPostureCheckModelProcess_Evaluate(t *testing.T) { t.Run("returns true for valid id, running, hash, and fingerprint", func(t *testing.T) { @@ -103,7 +56,7 @@ func TestPostureCheckModelProcess_Evaluate(t *testing.T) { t.Run("returns true for valid id, running, hash, and fingerprint with mismatched signer case", func(t *testing.T) { processCheck, postureData := newMatchingProcessCheckAndData() - postureData.Processes[0].SignerFingerprint = strings.ToUpper(postureData.Processes[0].SignerFingerprint) + postureData.Processes[0].SignerFingerprints[0] = strings.ToUpper(postureData.Processes[0].SignerFingerprints[0]) result := processCheck.Evaluate(postureData) req := require.New(t) @@ -165,7 +118,7 @@ func TestPostureCheckModelProcess_Evaluate(t *testing.T) { t.Run("returns false if signers do not match", func(t *testing.T) { processCheck, postureData := newMatchingProcessCheckAndData() - postureData.Processes[0].SignerFingerprint = "does not match" + postureData.Processes[0].SignerFingerprints = []string{"does not match"} result := processCheck.Evaluate(postureData) @@ -187,7 +140,7 @@ func TestPostureCheckModelProcess_Evaluate(t *testing.T) { processCheck, postureData := newMatchingProcessCheckAndData() postureData.Processes[0].IsRunning = false postureData.Processes[0].BinaryHash = "does not match" - postureData.Processes[0].SignerFingerprint = "does not match" + postureData.Processes[0].SignerFingerprints = []string{"does not match"} result := processCheck.Evaluate(postureData) @@ -195,3 +148,50 @@ func TestPostureCheckModelProcess_Evaluate(t *testing.T) { req.False(result) }) } + +// Returns a process check and posture data that will pass with matching id, hash, signer, and running state. Can +// be altered to test various pass/fail states +func newMatchingProcessCheckAndData() (*PostureCheckProcess, *PostureData) { + postureCheckId := "30qhj45" + binaryHash := "b4f3228217a2bae3f21f6b6df3750d0723a5c3973db9aad360a8f25bc31e3676d38180cf0abc89d7fca7a26e1919a1e52739ed3116011acc7e96630313da56b8" + signerFingerprint := "950248b9e8b0dd41938018a871a13dd92bed4614" + + postureResponse := &PostureResponse{ + PostureCheckId: postureCheckId, + TypeId: PostureCheckTypeProcess, + TimedOut: false, + LastUpdatedAt: time.Now(), + } + + postureResponseProcess := &PostureResponseProcess{ + IsRunning: true, + BinaryHash: binaryHash, + SignerFingerprints: []string{signerFingerprint}, + } + + postureResponse.SubType = postureResponseProcess + postureResponseProcess.PostureResponse = postureResponse + + validPostureData := &PostureData{ + Mac: nil, + Domain: nil, + Os: nil, + Processes: []*PostureResponseProcess{ + postureResponseProcess, + }, + } + + processCheck := &PostureCheckProcess{ + PostureCheckId: postureCheckId, + OperatingSystem: "Windows", + Path: `C:\some\path\some.exe`, + Hashes: []string{ + "something that will never match 1", + binaryHash, + "something that will never match 2", + }, + Fingerprint: signerFingerprint, + } + + return processCheck, validPostureData +} \ No newline at end of file diff --git a/controller/model/posture_response_model.go b/controller/model/posture_response_model.go index c8dff4d57..a0e81b959 100644 --- a/controller/model/posture_response_model.go +++ b/controller/model/posture_response_model.go @@ -225,15 +225,18 @@ func (pr *PostureResponseOs) Apply(postureData *PostureData) { type PostureResponseProcess struct { *PostureResponse - IsRunning bool `json:"isRunning"` - BinaryHash string `json:"binaryHash"` - SignerFingerprint string `json:"signerFingerprint"` + IsRunning bool `json:"isRunning"` + BinaryHash string `json:"binaryHash"` + SignerFingerprints []string `json:"signerFingerprints"` } func (pr *PostureResponseProcess) Apply(postureData *PostureData) { found := false - pr.SignerFingerprint = CleanHexString(pr.SignerFingerprint) + for i, fingerprint := range pr.SignerFingerprints { + pr.SignerFingerprints[i] = CleanHexString(fingerprint) + } + pr.BinaryHash = CleanHexString(pr.BinaryHash) for i, process := range postureData.Processes { diff --git a/rest_model/posture_response_process_create.go b/rest_model/posture_response_process_create.go index 56e66336c..f4cf45d1c 100644 --- a/rest_model/posture_response_process_create.go +++ b/rest_model/posture_response_process_create.go @@ -51,8 +51,8 @@ type PostureResponseProcessCreate struct { // is running IsRunning bool `json:"isRunning,omitempty"` - // signer fingerprint - SignerFingerprint string `json:"signerFingerprint,omitempty"` + // signer fingerprints + SignerFingerprints []string `json:"signerFingerprints"` } // ID gets the id of this subtype @@ -84,8 +84,8 @@ func (m *PostureResponseProcessCreate) UnmarshalJSON(raw []byte) error { // is running IsRunning bool `json:"isRunning,omitempty"` - // signer fingerprint - SignerFingerprint string `json:"signerFingerprint,omitempty"` + // signer fingerprints + SignerFingerprints []string `json:"signerFingerprints"` } buf := bytes.NewBuffer(raw) dec := json.NewDecoder(buf) @@ -121,7 +121,7 @@ func (m *PostureResponseProcessCreate) UnmarshalJSON(raw []byte) error { result.Hash = data.Hash result.IsRunning = data.IsRunning - result.SignerFingerprint = data.SignerFingerprint + result.SignerFingerprints = data.SignerFingerprints *m = result @@ -140,15 +140,15 @@ func (m PostureResponseProcessCreate) MarshalJSON() ([]byte, error) { // is running IsRunning bool `json:"isRunning,omitempty"` - // signer fingerprint - SignerFingerprint string `json:"signerFingerprint,omitempty"` + // signer fingerprints + SignerFingerprints []string `json:"signerFingerprints"` }{ Hash: m.Hash, IsRunning: m.IsRunning, - SignerFingerprint: m.SignerFingerprint, + SignerFingerprints: m.SignerFingerprints, }) if err != nil { return nil, err diff --git a/rest_server/embedded_spec.go b/rest_server/embedded_spec.go index 48aa34651..526808ff9 100644 --- a/rest_server/embedded_spec.go +++ b/rest_server/embedded_spec.go @@ -5515,8 +5515,11 @@ func init() { "isRunning": { "type": "boolean" }, - "signerFingerprint": { - "type": "string" + "signerFingerprints": { + "type": "array", + "items": { + "type": "string" + } } } } @@ -23186,8 +23189,11 @@ func init() { "isRunning": { "type": "boolean" }, - "signerFingerprint": { - "type": "string" + "signerFingerprints": { + "type": "array", + "items": { + "type": "string" + } } } } diff --git a/specs/swagger.yml b/specs/swagger.yml index 46e9eb2d8..c0f9ebadd 100644 --- a/specs/swagger.yml +++ b/specs/swagger.yml @@ -6633,6 +6633,8 @@ definitions: type: boolean hash: type: string - signerFingerprint: - type: string + signerFingerprints: + type: array + items: + type: string x-class: "PROCESS" \ No newline at end of file