mirror of
https://github.com/openziti/ziti.git
synced 2026-10-23 20:26:05 +00:00
Andrew Martinez
b4f6223ad1
* fixes openziti/ziti#4321 compare process hashes and fingerprints case-insensitively - normalizes configured hashes and signer fingerprints to lowercase unseparated hex in the PROCESS and PROCESS_MULTI stores, on load as well as on save, so values stored before this change read back normalized without a migration - replaces the PROCESS store's lowercase-only pass, PROCESS_MULTI stored its values verbatim - adds store tests for both types covering configured values and values written straight to bolt - updates the process multi patch round-trip test, the management API now returns normalized values rather than the submitted strings - removes the trailing newline from the signer fingerprint literal in the process and process-multi OIDC posture tests
114 lines
2.4 KiB
Go
114 lines
2.4 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package model
|
|
|
|
import (
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/openziti/ziti/v2/common/posture"
|
|
)
|
|
|
|
type PostureResponseProcess struct {
|
|
*PostureResponse
|
|
Path string
|
|
IsRunning bool
|
|
BinaryHash string
|
|
SignerFingerprints []string
|
|
}
|
|
|
|
func (pr *PostureResponseProcess) Apply(postureData *PostureData) {
|
|
found := false
|
|
|
|
for i, fingerprint := range pr.SignerFingerprints {
|
|
pr.SignerFingerprints[i] = posture.CleanHexString(fingerprint)
|
|
}
|
|
|
|
pr.BinaryHash = posture.CleanHexString(pr.BinaryHash)
|
|
|
|
for i, process := range postureData.Processes {
|
|
if process.PostureCheckId == pr.PostureCheckId {
|
|
postureData.Processes[i] = pr
|
|
postureData.Processes[i].LastUpdatedAt = time.Now()
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
|
|
if !found {
|
|
pr.LastUpdatedAt = time.Now().UTC()
|
|
postureData.Processes = append(postureData.Processes, pr)
|
|
}
|
|
|
|
if pr.Path != "" {
|
|
postureData.ProcessPathMap[pr.Path] = pr
|
|
}
|
|
}
|
|
|
|
func (pr *PostureResponseProcess) VerifyMultiCriteria(process *ProcessMulti) bool {
|
|
if !pr.IsRunning {
|
|
return false
|
|
}
|
|
|
|
if pr.TimedOut {
|
|
return false
|
|
}
|
|
|
|
foundValidHash := false
|
|
|
|
if len(process.Hashes) == 0 {
|
|
foundValidHash = true //no hash to check for
|
|
} else {
|
|
for _, validHash := range process.Hashes {
|
|
if strings.EqualFold(validHash, pr.BinaryHash) {
|
|
foundValidHash = true
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
if !foundValidHash {
|
|
return false
|
|
}
|
|
|
|
foundValidSigner := false
|
|
|
|
if len(process.SignerFingerprints) == 0 {
|
|
foundValidSigner = true //no signerByIssuer to check for
|
|
} else {
|
|
for _, validSigner := range process.SignerFingerprints {
|
|
validSigner := strings.ToLower(validSigner)
|
|
for _, signer := range pr.SignerFingerprints {
|
|
if strings.ToLower(signer) == validSigner {
|
|
foundValidSigner = true
|
|
break
|
|
}
|
|
}
|
|
|
|
if foundValidSigner {
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
if !foundValidSigner {
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|