mig/investigator.go

384 строки
8.9 KiB
Go

// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
//
// Contributor: Julien Vehent jvehent@mozilla.com [:ulfr]
package mig /* import "mig.ninja/mig" */
import (
"fmt"
"time"
)
type Investigator struct {
ID float64 `json:"id,omitempty"`
Name string `json:"name"`
PGPFingerprint string `json:"pgpfingerprint"`
PublicKey []byte `json:"publickey,omitempty"`
PrivateKey []byte `json:"privatekey,omitempty"`
Status string `json:"status"`
CreatedAt time.Time `json:"createdat"`
LastModified time.Time `json:"lastmodified"`
APIKey string `json:"apikey,omitempty"`
Permissions InvestigatorPerms `json:"permissions"`
}
// Check an investigator has given permission pv
func (i *Investigator) CheckPermission(pv int64) bool {
switch pv {
case PermSearch:
return i.Permissions.Search
case PermAction:
return i.Permissions.Action
case PermActionCreate:
return i.Permissions.ActionCreate
case PermCommand:
return i.Permissions.Command
case PermAgent:
return i.Permissions.Agent
case PermDashboard:
return i.Permissions.Dashboard
case PermLoader:
return i.Permissions.Loader
case PermLoaderStatus:
return i.Permissions.LoaderStatus
case PermLoaderExpect:
return i.Permissions.LoaderExpect
case PermLoaderKey:
return i.Permissions.LoaderKey
case PermLoaderNew:
return i.Permissions.LoaderNew
case PermManifest:
return i.Permissions.Manifest
case PermManifestSign:
return i.Permissions.ManifestSign
case PermManifestNew:
return i.Permissions.ManifestNew
case PermManifestLoaders:
return i.Permissions.ManifestLoaders
case PermInvestigator:
return i.Permissions.Investigator
case PermInvestigatorCreate:
return i.Permissions.InvestigatorCreate
case PermInvestigatorUpdate:
return i.Permissions.InvestigatorUpdate
}
return false
}
// Describes permissions assigned to an investigator
type InvestigatorPerms struct {
Search bool `json:"search"`
Action bool `json:"action"`
ActionCreate bool `json:"action_create"`
Command bool `json:"command"`
Agent bool `json:"agent"`
Dashboard bool `json:"dashboard"`
Loader bool `json:"loader"`
LoaderStatus bool `json:"loader_status"`
LoaderExpect bool `json:"loader_expect"`
LoaderKey bool `json:"loader_key"`
LoaderNew bool `json:"loader_new"`
Manifest bool `json:"manifest"`
ManifestSign bool `json:"manifest_sign"`
ManifestStatus bool `json:"manifest_status"`
ManifestNew bool `json:"manifest_new"`
ManifestLoaders bool `json:"manifest_loaders"`
Investigator bool `json:"investigator"`
InvestigatorCreate bool `json:"investigator_create"`
InvestigatorUpdate bool `json:"investigator_update"`
}
// Convert a permission bit mask into a boolean permission set
func (ip *InvestigatorPerms) FromMask(mask int64) {
if (mask & PermSearch) != 0 {
ip.Search = true
}
if (mask & PermAction) != 0 {
ip.Action = true
}
if (mask & PermActionCreate) != 0 {
ip.ActionCreate = true
}
if (mask & PermCommand) != 0 {
ip.Command = true
}
if (mask & PermAgent) != 0 {
ip.Agent = true
}
if (mask & PermDashboard) != 0 {
ip.Dashboard = true
}
if (mask & PermLoader) != 0 {
ip.Loader = true
}
if (mask & PermLoaderStatus) != 0 {
ip.LoaderStatus = true
}
if (mask & PermLoaderExpect) != 0 {
ip.LoaderExpect = true
}
if (mask & PermLoaderKey) != 0 {
ip.LoaderKey = true
}
if (mask & PermLoaderNew) != 0 {
ip.LoaderNew = true
}
if (mask & PermManifest) != 0 {
ip.Manifest = true
}
if (mask & PermManifestSign) != 0 {
ip.ManifestSign = true
}
if (mask & PermManifestNew) != 0 {
ip.ManifestNew = true
}
if (mask & PermManifestStatus) != 0 {
ip.ManifestStatus = true
}
if (mask & PermManifestLoaders) != 0 {
ip.ManifestLoaders = true
}
if (mask & PermInvestigator) != 0 {
ip.Investigator = true
}
if (mask & PermInvestigatorCreate) != 0 {
ip.InvestigatorCreate = true
}
if (mask & PermInvestigatorUpdate) != 0 {
ip.InvestigatorUpdate = true
}
}
// Convert a boolean permission set to a permission bit mask
func (ip *InvestigatorPerms) ToMask() (ret int64) {
if ip.Search {
ret |= PermSearch
}
if ip.Action {
ret |= PermAction
}
if ip.ActionCreate {
ret |= PermActionCreate
}
if ip.Command {
ret |= PermCommand
}
if ip.Agent {
ret |= PermAgent
}
if ip.Dashboard {
ret |= PermDashboard
}
if ip.Loader {
ret |= PermLoader
}
if ip.LoaderStatus {
ret |= PermLoaderStatus
}
if ip.LoaderExpect {
ret |= PermLoaderExpect
}
if ip.LoaderKey {
ret |= PermLoaderKey
}
if ip.LoaderNew {
ret |= PermLoaderNew
}
if ip.Manifest {
ret |= PermManifest
}
if ip.ManifestSign {
ret |= PermManifestSign
}
if ip.ManifestNew {
ret |= PermManifestNew
}
if ip.ManifestStatus {
ret |= PermManifestStatus
}
if ip.ManifestLoaders {
ret |= PermManifestLoaders
}
if ip.Investigator {
ret |= PermInvestigator
}
if ip.InvestigatorCreate {
ret |= PermInvestigatorCreate
}
if ip.InvestigatorUpdate {
ret |= PermInvestigatorUpdate
}
return ret
}
// Convert an existing boolean permission set to a descriptive string, used
// primarily in mig-console for summarizing permissions assigned to an
// investigator
func (ip *InvestigatorPerms) ToDescriptive() string {
cf := func(want int64, have int64) (bool, int64) {
var (
wantcnt, havecnt int64
n uint = 64
sb uint
)
for sb = 0; sb < n; sb++ {
wantcnt += (want >> sb) & 0x01
}
for sb = 0; sb < n; sb++ {
havecnt += ((have & want) >> sb) & 0x01
}
return (havecnt == wantcnt), havecnt
}
ret := ""
// Compare the permissions applied to the investigator to the various
// permission sets; if the user has the full set of permissions from the
// set we note that
tv := InvestigatorPerms{}
tv.DefaultSet()
fs, part := cf(tv.ToMask(), ip.ToMask())
if fs {
ret = "Default"
} else if part > 0 {
ret = "Default(partial)"
}
av := ""
tv = InvestigatorPerms{}
tv.AdminSet()
fs, part = cf(tv.ToMask(), ip.ToMask())
if fs {
av = "PermAdmin"
} else if part > 0 {
av = "PermAdmin(partial)"
}
if ret != "" && av != "" {
ret += ","
}
ret += av
av = ""
tv = InvestigatorPerms{}
tv.LoaderSet()
fs, part = cf(tv.ToMask(), ip.ToMask())
if fs {
av = "PermLoader"
} else if part > 0 {
av = "PermLoader(partial)"
}
if ret != "" && av != "" {
ret += ","
}
ret += av
av = ""
tv = InvestigatorPerms{}
tv.ManifestSet()
fs, part = cf(tv.ToMask(), ip.ToMask())
if fs {
av = "PermManifest"
} else if part > 0 {
av = "PermManifest(partial)"
}
if ret != "" && av != "" {
ret += ","
}
ret += av
return ret
}
// Describe permission sets that can be applied; note default is omitted as this
// is currently always applied
var PermSets = []string{"PermManifest", "PermLoader", "PermAdmin"}
// Apply permission sets in slice sl to the investigator
func (ip *InvestigatorPerms) FromSetList(sl []string) error {
for _, x := range sl {
switch x {
case "PermManifest":
ip.ManifestSet()
case "PermLoader":
ip.LoaderSet()
case "PermAdmin":
ip.AdminSet()
default:
return fmt.Errorf("invalid permission %q", x)
}
}
return nil
}
// Set a default set of permissions on the investigator
func (ip *InvestigatorPerms) DefaultSet() {
ip.Search = true
ip.Action = true
ip.ActionCreate = true
ip.Command = true
ip.Agent = true
ip.Dashboard = true
}
// Set manifest related permissions on the investigator
func (ip *InvestigatorPerms) ManifestSet() {
ip.Manifest = true
ip.ManifestSign = true
ip.ManifestNew = true
ip.ManifestStatus = true
ip.ManifestLoaders = true
}
// Set loader related permissions on the investigator
func (ip *InvestigatorPerms) LoaderSet() {
ip.Loader = true
ip.LoaderStatus = true
ip.LoaderExpect = true
ip.LoaderKey = true
ip.LoaderNew = true
}
// Set administrative permissions on the investigator
func (ip *InvestigatorPerms) AdminSet() {
ip.Investigator = true
ip.InvestigatorCreate = true
ip.InvestigatorUpdate = true
}
// Permissions that can be assigned to investigators
const (
PermSearch = 1 << iota
PermAction
PermActionCreate
PermCommand
PermAgent
PermDashboard
PermLoader
PermLoaderStatus
PermLoaderExpect
PermLoaderKey
PermLoaderNew
PermManifest
PermManifestSign
PermManifestNew
PermManifestStatus
PermManifestLoaders
PermInvestigator
PermInvestigatorCreate
PermInvestigatorUpdate
)
const (
StatusActiveInvestigator string = "active"
StatusDisabledInvestigator string = "disabled"
)
// InvestigatorAPIAuthHelper is a small struct used to pass information between
// the database and the API, and is used primarily for authorizing requests using
// API keys.
type InvestigatorAPIAuthHelper struct {
ID float64 // Investigator ID
APIKey []byte // Key hash
Salt []byte // Key salt
}