2017-07-13 00:24:09 +00:00
|
|
|
package cmd
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"os"
|
|
|
|
"os/exec"
|
2017-08-11 16:59:57 +00:00
|
|
|
"regexp"
|
2017-07-13 00:24:09 +00:00
|
|
|
"strings"
|
|
|
|
|
|
|
|
"github.com/aquasecurity/kube-bench/check"
|
|
|
|
"github.com/fatih/color"
|
2017-07-25 00:34:07 +00:00
|
|
|
"github.com/golang/glog"
|
2017-07-13 00:24:09 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
// Print colors
|
|
|
|
colors = map[check.State]*color.Color{
|
|
|
|
check.PASS: color.New(color.FgGreen),
|
|
|
|
check.FAIL: color.New(color.FgRed),
|
|
|
|
check.WARN: color.New(color.FgYellow),
|
|
|
|
check.INFO: color.New(color.FgBlue),
|
|
|
|
}
|
|
|
|
)
|
|
|
|
|
2017-08-06 16:59:03 +00:00
|
|
|
func printlnWarn(msg string) {
|
2017-07-25 00:34:07 +00:00
|
|
|
fmt.Fprintf(os.Stderr, "[%s] %s\n",
|
|
|
|
colors[check.WARN].Sprintf("%s", check.WARN),
|
|
|
|
msg,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2017-08-06 16:59:03 +00:00
|
|
|
func sprintlnWarn(msg string) string {
|
2017-07-25 00:34:07 +00:00
|
|
|
return fmt.Sprintf("[%s] %s",
|
|
|
|
colors[check.WARN].Sprintf("%s", check.WARN),
|
|
|
|
msg,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
func exitWithError(err error) {
|
|
|
|
fmt.Fprintf(os.Stderr, "\n%v\n", err)
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
|
|
|
|
func continueWithError(err error, msg string) string {
|
2017-07-13 00:24:09 +00:00
|
|
|
if err != nil {
|
2017-07-25 00:34:07 +00:00
|
|
|
glog.V(1).Info(err)
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
2017-07-25 00:34:07 +00:00
|
|
|
|
|
|
|
if msg != "" {
|
|
|
|
fmt.Fprintf(os.Stderr, "%s\n", msg)
|
|
|
|
}
|
|
|
|
|
|
|
|
return ""
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func cleanIDs(list string) []string {
|
|
|
|
list = strings.Trim(list, ",")
|
|
|
|
ids := strings.Split(list, ",")
|
|
|
|
|
|
|
|
for _, id := range ids {
|
|
|
|
id = strings.Trim(id, " ")
|
|
|
|
}
|
|
|
|
|
|
|
|
return ids
|
|
|
|
}
|
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
func verifyConf(confPath ...string) {
|
|
|
|
var missing string
|
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
for _, c := range confPath {
|
|
|
|
if _, err := os.Stat(c); err != nil && os.IsNotExist(err) {
|
2017-08-15 15:47:01 +00:00
|
|
|
e := fmt.Errorf("configuration file %s not found", c)
|
|
|
|
continueWithError(e, "")
|
2017-07-25 00:34:07 +00:00
|
|
|
missing += c + ", "
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
if len(missing) > 0 {
|
|
|
|
missing = strings.Trim(missing, ", ")
|
2017-08-06 16:59:03 +00:00
|
|
|
printlnWarn(fmt.Sprintf("Missing kubernetes config files: %s", missing))
|
2017-07-25 00:34:07 +00:00
|
|
|
}
|
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
func verifyBin(binPath ...string) {
|
|
|
|
var binSlice []string
|
|
|
|
var bin string
|
|
|
|
var missing string
|
|
|
|
var notRunning string
|
2017-07-13 00:24:09 +00:00
|
|
|
|
|
|
|
// Construct proc name for ps(1)
|
|
|
|
for _, b := range binPath {
|
2017-07-13 01:01:18 +00:00
|
|
|
_, err := exec.LookPath(b)
|
2017-07-25 00:34:07 +00:00
|
|
|
bin = bin + "," + b
|
|
|
|
binSlice = append(binSlice, b)
|
|
|
|
if err != nil {
|
2017-08-15 15:47:01 +00:00
|
|
|
e := fmt.Errorf("executable file %s not found", b)
|
|
|
|
continueWithError(e, "")
|
2017-07-25 00:34:07 +00:00
|
|
|
missing += b + ", "
|
|
|
|
}
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
2017-07-25 00:34:07 +00:00
|
|
|
bin = strings.Trim(bin, ",")
|
2017-07-13 01:01:18 +00:00
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
cmd := exec.Command("ps", "-C", bin, "-o", "cmd", "--no-headers")
|
2017-07-13 00:24:09 +00:00
|
|
|
out, err := cmd.Output()
|
2017-07-25 00:34:07 +00:00
|
|
|
if err != nil {
|
|
|
|
continueWithError(fmt.Errorf("%s: %s", cmd.Args, err), "")
|
|
|
|
}
|
2017-07-13 00:24:09 +00:00
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
for _, b := range binSlice {
|
2017-07-13 00:24:09 +00:00
|
|
|
matched := strings.Contains(string(out), b)
|
|
|
|
|
|
|
|
if !matched {
|
2017-07-25 00:34:07 +00:00
|
|
|
notRunning += b + ", "
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-25 00:34:07 +00:00
|
|
|
if len(missing) > 0 {
|
|
|
|
missing = strings.Trim(missing, ", ")
|
2017-08-06 16:59:03 +00:00
|
|
|
printlnWarn(fmt.Sprintf("Missing kubernetes binaries: %s", missing))
|
2017-07-25 00:34:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if len(notRunning) > 0 {
|
|
|
|
notRunning = strings.Trim(notRunning, ", ")
|
2017-08-06 16:59:03 +00:00
|
|
|
printlnWarn(fmt.Sprintf("Kubernetes binaries not running: %s", notRunning))
|
2017-07-25 00:34:07 +00:00
|
|
|
}
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
|
|
|
|
2017-08-11 16:59:57 +00:00
|
|
|
func verifyKubeVersion(major string, minor string) {
|
2017-07-13 00:24:09 +00:00
|
|
|
// These executables might not be on the user's path.
|
|
|
|
|
2017-08-11 16:59:57 +00:00
|
|
|
_, err := exec.LookPath("kubectl")
|
2017-07-25 00:34:07 +00:00
|
|
|
if err != nil {
|
2017-08-06 16:59:03 +00:00
|
|
|
continueWithError(err, sprintlnWarn("Kubernetes version check skipped"))
|
2017-07-25 00:34:07 +00:00
|
|
|
return
|
|
|
|
}
|
2017-07-13 01:01:18 +00:00
|
|
|
|
2017-08-11 16:59:57 +00:00
|
|
|
cmd := exec.Command("kubectl", "version")
|
2017-07-13 00:24:09 +00:00
|
|
|
out, err := cmd.Output()
|
2017-07-25 00:34:07 +00:00
|
|
|
if err != nil {
|
2017-08-11 16:59:57 +00:00
|
|
|
s := fmt.Sprintf("Kubernetes version check skipped with error %v", err)
|
|
|
|
continueWithError(err, sprintlnWarn(s))
|
2017-07-25 00:34:07 +00:00
|
|
|
return
|
|
|
|
}
|
2017-07-13 00:24:09 +00:00
|
|
|
|
2017-08-11 16:59:57 +00:00
|
|
|
msg := checkVersion("Client", string(out), major, minor)
|
|
|
|
if msg != "" {
|
|
|
|
continueWithError(fmt.Errorf(msg), msg)
|
|
|
|
}
|
|
|
|
|
|
|
|
msg = checkVersion("Server", string(out), major, minor)
|
|
|
|
if msg != "" {
|
|
|
|
continueWithError(fmt.Errorf(msg), msg)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
var regexVersionMajor = regexp.MustCompile("Major:\"([0-9]+)\"")
|
|
|
|
var regexVersionMinor = regexp.MustCompile("Minor:\"([0-9]+)\"")
|
|
|
|
|
|
|
|
func checkVersion(x string, s string, expMajor string, expMinor string) string {
|
|
|
|
regexVersion, err := regexp.Compile(x + " Version: version.Info{(.*)}")
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Sprintf("Error checking Kubernetes version: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ss := regexVersion.FindString(s)
|
|
|
|
major := versionMatch(regexVersionMajor, ss)
|
|
|
|
minor := versionMatch(regexVersionMinor, ss)
|
|
|
|
if major == "" || minor == "" {
|
|
|
|
return fmt.Sprintf("Couldn't find %s version from kubectl output '%s'", x, s)
|
|
|
|
}
|
|
|
|
|
|
|
|
if major != expMajor || minor != expMinor {
|
|
|
|
return fmt.Sprintf("Unexpected %s version %s.%s", x, major, minor)
|
|
|
|
}
|
|
|
|
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
|
|
|
|
func versionMatch(r *regexp.Regexp, s string) string {
|
|
|
|
match := r.FindStringSubmatch(s)
|
|
|
|
if len(match) < 2 {
|
|
|
|
return ""
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|
2017-08-11 16:59:57 +00:00
|
|
|
return match[1]
|
2017-07-13 00:24:09 +00:00
|
|
|
}
|