Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add support for client_certificate_v2 posture rule #1685

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

add support for client_certificate_v2 posture rule #1685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/1685.txt
View file
Open in desktop
@@ -0,0 +1,3 @@
```release-note:enhancement
device_posture_rule: support extended_key_usage, check_private_key, and locations for client_certificate_v2 posture rule
```
79 changes: 44 additions & 35 deletions device_posture_rule.go
View file
Open in desktop
Expand Up @@ -165,41 +165,50 @@ type DevicePostureRuleMatch struct {

// DevicePostureRuleInput represents the value to be checked against.
type DevicePostureRuleInput struct {
ID string `json:"id,omitempty"`
Path string `json:"path,omitempty"`
Exists bool `json:"exists,omitempty"`
Thumbprint string `json:"thumbprint,omitempty"`
Sha256 string `json:"sha256,omitempty"`
Running bool `json:"running,omitempty"`
RequireAll bool `json:"requireAll,omitempty"`
CheckDisks []string `json:"checkDisks,omitempty"`
Enabled bool `json:"enabled,omitempty"`
Version string `json:"version,omitempty"`
VersionOperator string `json:"versionOperator,omitempty"`
Overall string `json:"overall,omitempty"`
SensorConfig string `json:"sensor_config,omitempty"`
Os string `json:"os,omitempty"`
OsDistroName string `json:"os_distro_name,omitempty"`
OsDistroRevision string `json:"os_distro_revision,omitempty"`
OSVersionExtra string `json:"os_version_extra,omitempty"`
Operator string `json:"operator,omitempty"`
Domain string `json:"domain,omitempty"`
ComplianceStatus string `json:"compliance_status,omitempty"`
ConnectionID string `json:"connection_id,omitempty"`
IssueCount string `json:"issue_count,omitempty"`
CountOperator string `json:"countOperator,omitempty"`
TotalScore int `json:"total_score,omitempty"`
ScoreOperator string `json:"scoreOperator,omitempty"`
CertificateID string `json:"certificate_id,omitempty"`
CommonName string `json:"cn,omitempty"`
ActiveThreats int `json:"active_threats,omitempty"`
NetworkStatus string `json:"network_status,omitempty"`
Infected bool `json:"infected,omitempty"`
IsActive bool `json:"is_active,omitempty"`
EidLastSeen string `json:"eid_last_seen,omitempty"`
RiskLevel string `json:"risk_level,omitempty"`
State string `json:"state,omitempty"`
LastSeen string `json:"last_seen,omitempty"`
ID string `json:"id,omitempty"`
Path string `json:"path,omitempty"`
Exists bool `json:"exists,omitempty"`
Thumbprint string `json:"thumbprint,omitempty"`
Sha256 string `json:"sha256,omitempty"`
Running bool `json:"running,omitempty"`
RequireAll bool `json:"requireAll,omitempty"`
CheckDisks []string `json:"checkDisks,omitempty"`
Enabled bool `json:"enabled,omitempty"`
Version string `json:"version,omitempty"`
VersionOperator string `json:"versionOperator,omitempty"`
Overall string `json:"overall,omitempty"`
SensorConfig string `json:"sensor_config,omitempty"`
Os string `json:"os,omitempty"`
OsDistroName string `json:"os_distro_name,omitempty"`
OsDistroRevision string `json:"os_distro_revision,omitempty"`
OSVersionExtra string `json:"os_version_extra,omitempty"`
Operator string `json:"operator,omitempty"`
Domain string `json:"domain,omitempty"`
ComplianceStatus string `json:"compliance_status,omitempty"`
ConnectionID string `json:"connection_id,omitempty"`
IssueCount string `json:"issue_count,omitempty"`
CountOperator string `json:"countOperator,omitempty"`
TotalScore int `json:"total_score,omitempty"`
ScoreOperator string `json:"scoreOperator,omitempty"`
CertificateID string `json:"certificate_id,omitempty"`
CommonName string `json:"cn,omitempty"`
ActiveThreats int `json:"active_threats,omitempty"`
NetworkStatus string `json:"network_status,omitempty"`
Infected bool `json:"infected,omitempty"`
IsActive bool `json:"is_active,omitempty"`
EidLastSeen string `json:"eid_last_seen,omitempty"`
RiskLevel string `json:"risk_level,omitempty"`
State string `json:"state,omitempty"`
LastSeen string `json:"last_seen,omitempty"`
ExtendedKeyUsage []string `json:"extended_key_usage,omitempty"`
CheckPrivateKey bool `json:"check_private_key,omitempty"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you'll want this to be a *bool - see https://github.com/cloudflare/cloudflare-go/blob/master/docs/conventions.md#booleans

Locations CertificateLocations `json:"locations,omitempty"`
}

// Locations struct for client certificate rule v2
type CertificateLocations struct {
Paths []string `json:"paths,omitempty"`
TrustStores []string `json:"trust_stores,omitempty"`
}

// DevicePostureRuleListResponse represents the response from the list
Expand Down
63 changes: 63 additions & 0 deletions device_posture_rule_test.go
View file
Open in desktop
Expand Up @@ -645,6 +645,69 @@ func TestDevicePostureClientCertificateRule(t *testing.T) {
}
}

func TestDevicePostureClientCertificateRuleV2(t *testing.T) {
setup()
defer teardown()

handler := func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, http.MethodGet, r.Method, "Expected method 'GET', got %s", r.Method)
w.Header().Set("content-type", "application/json")
fmt.Fprintf(w, `{
"success": true,
"errors": [],
"messages": [],
"result": {
"id": "480f4f69-1a28-4fdd-9240-1ed29f0ac1db",
"schedule": "1h",
"expiration": "1h",
"type": "client_certificate_v2",
"name": "My rule name",
"description": "My description",
"match": [
{
"platform": "windows"
}
],
"input": {
"certificate_id": "d2c04b78-3ba2-4294-8efa-4e85aef0777f",
"cn": "example.com",
"extended_key_usage": ["clientAuth", "emailProtection"],
"locations": {"trust_stores": ["system"]},
"check_private_key": true
}
}
}
`)
}

want := DevicePostureRule{
ID: "480f4f69-1a28-4fdd-9240-1ed29f0ac1db",
Name: "My rule name",
Description: "My description",
Type: "client_certificate_v2",
Schedule: "1h",
Expiration: "1h",
Match: []DevicePostureRuleMatch{{Platform: "windows"}},
Input: DevicePostureRuleInput{
CertificateID: "d2c04b78-3ba2-4294-8efa-4e85aef0777f",
CommonName: "example.com",
CheckPrivateKey: true,
ExtendedKeyUsage: []string{"clientAuth", "emailProtection"},
Locations: CertificateLocations{
TrustStores: []string{"system"},
},
},
}

mux.HandleFunc("/accounts/"+testAccountID+"/devices/posture/480f4f69-1a28-4fdd-9240-1ed29f0ac1db", handler)

actual, err := client.DevicePostureRule(context.Background(), testAccountID, "480f4f69-1a28-4fdd-9240-1ed29f0ac1db")

if assert.NoError(t, err) {
assert.Equal(t, want, actual)
}
}

func TestCreateDevicePostureRule(t *testing.T) {
setup()
defer teardown()
Expand Down