Swarm and Nomad support

glitch/__main__.py

@@ -18,6 +18,8 @@
 from glitch.parsers.puppet import PuppetParser
 from glitch.parsers.terraform import TerraformParser
 from glitch.parsers.gha import GithubActionsParser
+from glitch.parsers.swarm import SwarmParser
+from glitch.parsers.nomad import NomadParser
 from glitch.exceptions import throw_exception
 from glitch.repair.interactive.main import run_infrafix
 from pkg_resources import resource_filename
@@ -90,6 +92,10 @@ def __get_parser(tech: Tech) -> Parser:
         return TerraformParser()
     elif tech == Tech.gha:
         return GithubActionsParser()
+    elif tech == Tech.swarm:
+        return SwarmParser()
+    elif tech == Tech.nomad:
+        return NomadParser()
     else:
         raise ValueError(f"Invalid tech: {tech}")
 

glitch/analysis/rules.py

@@ -26,6 +26,31 @@ class Error:
             Tech.docker: {
                 "sec_non_official_image": "Use of non-official Docker image - Use of non-official images should be avoided or taken into careful consideration. (CWE-829)",
             },
+            Tech.swarm: {
+                "sec_non_official_image": "Use of non-official Docker image - Use of non-official images should be avoided or taken into careful consideration. (CWE-829)",
+                "sec_image_integrity": "Use of image is not tagged with digest - The images downloaded from the internet should be checked. (CWE-353)",
+                "sec_unstable_tag": "Unstable version/release image tag - Prefer specifying a release version or better yet a specific version digest (CWE-353)",
+                "sec_no_image_tag": "The image is not tagged - Prefer specifying a release version or better yet specific version digest",
+                "arc_no_apig": "No API Gateway - If following a microservices architecture you should use in front of your services an API Gateway instead of directly exposing them.",
+                "arc_no_logging": "Log Collection not found - It is advised to setup logging for your services.",
+                "arc_missing_healthchecks": "Missing Healthchecks - You should setup healthchecks for your services, or check if the images used already have default ones.",
+                "sec_mounted_docker_socket": "Docker socket mounted to a container - Avoid mounting the Docker socket to container, if the container is compromised its access to the Docker socket allows control of all other containers, and even acquiring control of the host machine.",
+                "sec_privileged_containers": "Use of Privileged Containers - Developers should always try to give and use the least privileges possible. Use of privileged containers severely thins out the security and isolation provided by container runtimes, its use should be avoided as much as possible (CWE-250)",
+                "sec_depr_off_imgs" : "Use of deprecated official Docker images - Use of official deprecated images should be avoided as it makes you open to vulnerabilities, quality issues and unfixed bugs (CWE-1104)",
+            },
+            Tech.nomad: {
+                "sec_non_official_image": "Use of non-official Docker image - Use of non-official images should be avoided or taken into careful consideration. (CWE-829)",
+                "sec_image_integrity": "Container image is not tagged with digest - The images downloaded from the internet should be checked. (CWE-353)",
+                "sec_unstable_tag": "Unstable version/release image tag - Prefer specifying a release version or better yet a specific version digest (CWE-353)",
+                "sec_no_image_tag": "Container Image is not tagged - Prefer specifying a release version or better yet specific version digest (CWE-353)",
+                "arc_no_apig": "No API Gateway - If following a microservices architecture you should use in front of your services an API Gateway instead of directly exposing them.",
+                "arc_no_logging": "Log Collection not found - It is advised to setup logging for your services.",
+                "arc_missing_healthchecks": "Missing Healthchecks - You should setup healthchecks for your services, or check if the images used already have default ones.",
+                "sec_mounted_docker_socket": "Docker socket mounted to a container - Avoid mounting the Docker socket to container, if the container is compromised its access to the Docker socket allows control of all other containers, and even acquiring control of the host machine.",
+                "sec_privileged_containers": "Use of Privileged Containers - Developers should always try to give and use the least privileges possible. Use of privileged containers severely thins out the security and isolation provided by container runtimes, its use should be avoided as much as possible (CWE-250)",
+                "arc_multiple_services": "Multiple Services per Deployment Unit - If you are following a Microservices architecture you are violating the idependent deployability rule by deploying multiple microservices in the same group.",
+                "sec_depr_off_imgs" : "Use of deprecated official Docker images - Use of official deprecated images should be avoided as it makes you open to vulnerabilities, quality issues and unfixed bugs (CWE-1104)",
+            },
             Tech.terraform: {
                 "sec_integrity_policy": "Integrity Policy - Image tag is prone to be mutable or integrity monitoring is disabled. (CWE-471)",
                 "sec_ssl_tls_policy": "SSL/TLS/mTLS Policy - Developers should use SSL/TLS/mTLS protocols and their secure versions. (CWE-326)",

glitch/analysis/security/deprecated_official_images.py

@@ -0,0 +1,46 @@
+from glitch.analysis.rules import Error
+from glitch.analysis.security.smell_checker import SecuritySmellChecker
+from glitch.analysis.security.visitor import SecurityVisitor
+from glitch.repr.inter import CodeElement, KeyValue, Hash, String
+from typing import List
+
+
+class DeprecatedOfficialDockerImages(SecuritySmellChecker):
+    def check(self, element: CodeElement, file: str) -> List[Error]:
+        errors: List[Error] = []
+        image = ""
+        bad_element = element
+        if isinstance(element, KeyValue) and element.name == "image":
+            if isinstance(element.value, String):
+                image = element.value.value
+        elif (
+            isinstance(element, KeyValue)
+            and element.name == "config"
+            and isinstance(element.value, Hash)
+        ):
+            for k, v in element.value.value.items():
+                if isinstance(k, String) and k.value == "image":
+                    image = v.value
+                    bad_element = v
+                    break
+        if image != "":
+            img_name, _, _ = SecurityVisitor.image_parser(image)
+            for obsolete_img in SecurityVisitor.DEPRECATED_OFFICIAL_DOCKER_IMAGES:
+                obsolete_img_dockerio = f"docker.io/library/{obsolete_img}"
+                obsolete_img_library = f"library/{obsolete_img}"
+                obsolete_img_complete_link = (
+                    f"registry.hub.docker.com/library/{obsolete_img}"
+                )
+
+                if (
+                    img_name == obsolete_img
+                    or img_name == obsolete_img_dockerio
+                    or img_name == obsolete_img_library
+                    or img_name == obsolete_img_complete_link
+                ):
+                    errors.append(
+                        Error("sec_depr_off_imgs", bad_element, file, repr(bad_element))
+                    )
+                    break
+
+        return errors

glitch/analysis/security/docker_socket_mounted.py

@@ -0,0 +1,46 @@
+from glitch.analysis.rules import Error
+from glitch.analysis.security.smell_checker import SecuritySmellChecker
+from glitch.repr.inter import CodeElement, KeyValue, Hash, String,Array
+from typing import List
+
+
+class DockerSocketMountedInsideContainerUse(SecuritySmellChecker):
+    def check(self, element: CodeElement, file: str) -> List[Error]:
+        errors: List[Error] = []
+        if isinstance(element, KeyValue):
+            if element.name == "volumes" and isinstance(element.value, Array):
+                for volume in element.value.value:
+                    if isinstance(volume, String) and volume.value.split(":")[
+                        0
+                    ].startswith("/var/run/docker.sock"):
+                        errors.append(
+                            Error(
+                                "sec_mounted_docker_socket", volume, file, repr(volume)
+                            )
+                        )
+                        break
+            elif element.name == "config" and isinstance(element.value, Hash):
+                found_socket_exposed = False
+                for k, v in element.value.value.items():
+                    if (
+                        isinstance(k, String)
+                        and k.value == "volumes"
+                        and isinstance(v, Array)
+                    ):
+                        for volume in v.value:
+                            if isinstance(volume, String) and volume.value.split(":")[
+                                0
+                            ].startswith("/var/run/docker.sock"):
+                                errors.append(
+                                    Error(
+                                        "sec_mounted_docker_socket",
+                                        volume,
+                                        file,
+                                        repr(volume),
+                                    )
+                                )
+                                found_socket_exposed = True
+                                break
+                        if found_socket_exposed:
+                            break
+        return errors

glitch/analysis/security/hard_secr.py

@@ -28,10 +28,13 @@ def __check_pair(
             SecurityVisitor.PASSWORDS + SecurityVisitor.SECRETS + SecurityVisitor.USERS
         ):
             secr_checker = StringChecker(
-                lambda s: re.match(
+                lambda s: (re.match(
                     r"[_A-Za-z0-9$\/\.\[\]-]*{text}\b".format(text=item), s
                 )
-                is not None
+                is not None) or (re.match(
+                    r"[_A-Za-z0-9$\/\.\[\]-]*{text}\b".format(text=item.upper()), s
+                )
+                is not None)
             )
             if secr_checker.check(name) and not whitelist_checker.check(name):
                 if not var_checker.check(value):
@@ -77,6 +80,9 @@ def check(self, element: CodeElement, file: str) -> List[Error]:
             )
         elif isinstance(element, KeyValue) and isinstance(element.value, Hash):
             for key, value in element.value.value.items():
+                #HACK: ignore cases where values are obtained via environment variables
+                if isinstance(value,String) and value.value.startswith("${") and value.value.endswith("}"):
+                    continue
                 errors += self.__check_pair(element, key, value, file)
 
         return errors

glitch/analysis/security/multiple_services_per_deplyment_unit.py

@@ -0,0 +1,43 @@
+from glitch.analysis.rules import Error
+from glitch.analysis.security.smell_checker import SecuritySmellChecker
+from glitch.analysis.security.visitor import SecurityVisitor
+from glitch.repr.inter import CodeElement, Hash, String, UnitBlock, UnitBlockType
+from typing import List
+
+
+class MultipleServicesPerDeploymentUnitCheck(SecuritySmellChecker):
+    def check(self, element: CodeElement, file: str) -> List[Error]:
+        # FIXME: Besides log collectors, there are other types of agents/sidecars for observability (some of which are also on the log collector list)
+        # and proxies which should also be allowed besides the main microservice
+        errors: List[Error] = []
+        if isinstance(element, UnitBlock) and element.type == UnitBlockType.block:
+            main_service_found = False
+            for au in element.atomic_units:
+                if au.type in ["task.docker", "task.podman"]:
+                    image_name = ""
+                    for att in au.attributes:
+                        if att.name == "config" and isinstance(att.value, Hash):
+                            for k, v in att.value.value.items():
+                                if isinstance(k, String) and k.value == "image":
+                                    image_name, _, _ = SecurityVisitor.image_parser(
+                                        v.value
+                                    )
+                                    break
+                            if image_name != "":
+                                break
+
+                    if image_name in SecurityVisitor.LOG_AGGREGATORS_AND_COLLECTORS:
+                        continue
+
+                    elif main_service_found:
+                        errors.append(
+                            Error("arc_multiple_services", au, file, repr(au))
+                        )
+                    else:
+                        main_service_found = True
+                elif main_service_found:
+                    # when there are other types of tasks that aren't docker or podman based
+                    # and one that is likely the main microservice has already been found
+                    errors.append(Error("arc_multiple_services", au, file, repr(au)))
+
+        return errors

glitch/analysis/security/no_api_gateway.py

@@ -0,0 +1,127 @@
+from glitch.analysis.rules import Error
+from glitch.analysis.security.smell_checker import SecuritySmellChecker
+from glitch.analysis.security.visitor import SecurityVisitor
+from glitch.repr.inter import (
+    CodeElement,
+    Hash,
+    Array,
+    VariableReference,
+    String,
+    UnitBlock,
+    UnitBlockType,
+)
+from typing import List, Dict, Any
+
+
+class NoAPIGatewayCheck(SecuritySmellChecker):
+    def check(self, element: CodeElement, file: str) -> List[Error]:
+        errors: List[Error] = []
+        # Tries to follow an logic similar to the one presented for Kubernetes pods ond doi: 10.5220/0011845500003488
+
+        if isinstance(element, UnitBlock) and element.type == UnitBlockType.block:
+            has_api_gateway = False
+
+            network_info: Dict[str, Any] = {
+                "mode": "bridge",  # default network mode
+                "ports": [],
+            }
+
+            network_mode_element = None
+            for att in element.attributes:
+                if att.name == "network" and isinstance(att.value, Hash):
+                    for k, v in att.value.value.items():
+                        if isinstance(k, String) and k.value == "mode":
+                            if v.value == "host":
+                                network_mode_element = v
+                            network_info["mode"] = v.value
+                        elif (
+                            isinstance(k, String) or isinstance(k, VariableReference)
+                        ) and k.value == "port":
+                            port_info: Dict[str, Any] = {
+                                "name": "",
+                            }
+                            for _k, _v in v.value.items():
+                                if isinstance(_k, String) and _k.value == "port":
+                                    port_info["name"] = _v.value
+                                elif isinstance(_k, String) and _k.value in [
+                                    "static",
+                                    "to",
+                                ]:
+                                    port_info[_k.value] = _v.value
+                            network_info["ports"].append(port_info)
+
+            for au in element.atomic_units:
+                for att in au.attributes:
+                    if att.name == "config" and isinstance(att.value, Hash):
+                        temp_errors: List[Error] = []
+                        is_api_gateway = False
+
+                        if (
+                            isinstance(au.name, String)
+                            and "gateway" in au.name.value.strip().lower()
+                        ):
+                            is_api_gateway = True
+                            has_api_gateway = True
+
+                        for k, v in att.value.value.items():
+                            if (
+                                isinstance(k, String)
+                                and k.value == "ports"
+                                and isinstance(v, Array)
+                                and not is_api_gateway
+                            ):
+                                for port in v.value:
+                                    if isinstance(port, String):
+                                        for exp_port in network_info["ports"]:
+                                            if exp_port["name"] == port.value:
+                                                if network_info["mode"] == "host":
+                                                    temp_errors.append(
+                                                        Error(
+                                                            "arc_no_apig",
+                                                            port,
+                                                            file,
+                                                            repr(port),
+                                                        )
+                                                    )
+
+                                                elif network_info[
+                                                    "mode"
+                                                ] == "bridge" and (
+                                                    "to" in exp_port.keys()
+                                                    or "static" in exp_port.keys()
+                                                ):
+                                                    temp_errors.append(
+                                                        Error(
+                                                            "arc_no_apig",
+                                                            port,
+                                                            file,
+                                                            repr(port),
+                                                        )
+                                                    )
+
+                            if isinstance(k, String) and k.value == "image":
+                                image_name, _, _ = SecurityVisitor.image_parser(v.value)
+                                if (
+                                    image_name in SecurityVisitor.API_GATEWAYS
+                                    or is_api_gateway
+                                ):
+                                    is_api_gateway = True
+                                    has_api_gateway = True
+                                else:
+                                    errors += temp_errors
+                                    temp_errors = []
+
+                        if not is_api_gateway:
+                            errors += temp_errors
+
+            if not has_api_gateway and network_info["mode"] == "host":
+                errors.append(
+                    Error(
+                        "arc_no_apig",
+                        network_mode_element,
+                        file,
+                        repr(network_mode_element),
+                    )
+                )
+
+        return errors