[POC] DogTags #1947
+1,149
−906
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -62,6 +62,7 @@ func RegisterFossRoutes( | |
| authenticator api.Authenticator, | ||
| authorizer auth.Authorizer, | ||
| ingestSchema upload.IngestSchema, | ||
| dogtagsService v2.DogtagsService, | ||
| ) { | ||
| router.With(func() mux.MiddlewareFunc { | ||
| return middleware.DefaultRateLimitMiddleware(rdms) | ||
|
|
@@ -80,6 +81,6 @@ func RegisterFossRoutes( | |
| routerInst.PathPrefix("/ui", static.AssetHandler), | ||
| ) | ||
|
|
||
| var resources = v2.NewResources(rdms, graphDB, cfg, apiCache, graphQuery, collectorManifests, authorizer, authenticator, ingestSchema, dogtagsService) | ||
| NewV2API(resources, routerInst) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -156,6 +156,8 @@ func NewV2API(resources v2.Resources, routerInst *router.Router) { | |||||
| routerInst.GET("/api/v2/features", resources.GetFlags).RequirePermissions(permissions.AppReadApplicationConfiguration), | ||||||
| routerInst.PUT("/api/v2/features/{feature_id}/toggle", resources.ToggleFlag).RequirePermissions(permissions.AppWriteApplicationConfiguration), | ||||||
|
|
||||||
| routerInst.GET("/api/v2/dogtags", resources.GetDogtags), | ||||||
|
|
||||||
|
Comment on lines
+159
to
+160
There was a problem hiding this comment. Guard Right now the new route is wide open—no - routerInst.GET("/api/v2/dogtags", resources.GetDogtags),
+ routerInst.GET("/api/v2/dogtags", resources.GetDogtags).RequirePermissions(permissions.AppReadApplicationConfiguration),📝 Committable suggestion
Suggested change
🤖 Prompt for AI AgentsThere was a problem hiding this comment. This is startup level application settings. What options we even show the user to login, or if the application starts up at all should be listed here. I'm not sure that these should be private? Human talk needed. There was a problem hiding this comment. @kpom-specter, you raise a valid point about public vs. private information. Let me outline the considerations for your team discussion: Arguments for keeping it public (no auth):
Arguments for requiring auth:
Possible middle-ground approach:
OR
Recommendation: The decision ultimately depends on your security model and whether unauthenticated users genuinely need any of this information to use the application. |
||||||
| routerInst.POST("/api/v2/clear-database", resources.HandleDatabaseWipe).RequirePermissions(permissions.WipeDB), | ||||||
|
|
||||||
| // Asset Groups API | ||||||
|
|
@@ -215,15 +217,15 @@ func NewV2API(resources v2.Resources, routerInst *router.Router) { | |||||
| routerInst.POST("/api/v2/graphs/cypher", resources.CypherQuery).RequirePermissions(permissions.GraphDBRead), | ||||||
| routerInst.GET("/api/v2/saved-queries", resources.ListSavedQueries).RequirePermissions(permissions.SavedQueriesRead), | ||||||
| routerInst.POST("/api/v2/saved-queries", resources.CreateSavedQuery).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.GET("/api/v2/saved-queries/export", resources.ExportSavedQueries).RequirePermissions(permissions.SavedQueriesRead), | ||||||
| routerInst.POST("/api/v2/saved-queries/import", resources.ImportSavedQueries).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.GET(fmt.Sprintf("/api/v2/saved-queries/{%s}", api.URIPathVariableSavedQueryID), resources.GetSavedQuery).RequirePermissions(permissions.SavedQueriesRead), | ||||||
| routerInst.PUT(fmt.Sprintf("/api/v2/saved-queries/{%s}", api.URIPathVariableSavedQueryID), resources.UpdateSavedQuery).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.DELETE(fmt.Sprintf("/api/v2/saved-queries/{%s}", api.URIPathVariableSavedQueryID), resources.DeleteSavedQuery).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.GET(fmt.Sprintf("/api/v2/saved-queries/{%s}/permissions", api.URIPathVariableSavedQueryID), resources.GetSavedQueryPermissions).RequirePermissions(permissions.SavedQueriesRead), | ||||||
| routerInst.DELETE(fmt.Sprintf("/api/v2/saved-queries/{%s}/permissions", api.URIPathVariableSavedQueryID), resources.DeleteSavedQueryPermissions).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.PUT(fmt.Sprintf("/api/v2/saved-queries/{%s}/permissions", api.URIPathVariableSavedQueryID), resources.ShareSavedQueries).RequirePermissions(permissions.SavedQueriesWrite), | ||||||
| routerInst.GET(fmt.Sprintf("/api/v2/saved-queries/{%s}/export", api.URIPathVariableSavedQueryID), resources.ExportSavedQuery).RequirePermissions(permissions.SavedQueriesRead), | ||||||
|
|
||||||
| // Azure Entity API | ||||||
| routerInst.GET("/api/v2/azure/{entity_type}", resources.GetAZEntity).RequirePermissions(permissions.GraphDBRead), | ||||||
|
|
||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -57,3 +57,15 @@ func CheckUserAccessToEnvironments(ctx context.Context, db database.EnvironmentA | |||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| return true, nil | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| // ExtractEnvironmentIDsFromUser is a helper function | ||||||||||||||||||||||||||||||||||||||||||||
| // to extract a user's environments from their model as a list of strings | ||||||||||||||||||||||||||||||||||||||||||||
| func ExtractEnvironmentIDsFromUser(user *model.User) []string { | ||||||||||||||||||||||||||||||||||||||||||||
| list := make([]string, 0, len(user.EnvironmentAccessControl)) | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| for _, envAccess := range user.EnvironmentAccessControl { | ||||||||||||||||||||||||||||||||||||||||||||
| list = append(list, envAccess.EnvironmentID) | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| return list | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+63
to
+71
There was a problem hiding this comment. Guard against nil pointer dereference. If Apply this diff to add a nil check: func ExtractEnvironmentIDsFromUser(user *model.User) []string {
+ if user == nil {
+ return []string{}
+ }
list := make([]string, 0, len(user.EnvironmentAccessControl))
for _, envAccess := range user.EnvironmentAccessControl {
list = append(list, envAccess.EnvironmentID)
}
return list
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| package v2 | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "github.com/specterops/bloodhound/cmd/api/src/api" | ||
| ) | ||
|
|
||
| type DogtagsResponse struct { | ||
| Data map[string]interface{} `json:"data"` | ||
| } | ||
|
|
||
| type DogtagEvaluation struct { | ||
| Value interface{} `json:"value"` | ||
| Reason string `json:"reason,omitempty"` | ||
| Variant string `json:"variant,omitempty"` | ||
| Metadata interface{} `json:"metadata,omitempty"` | ||
| } | ||
|
|
||
| func (s Resources) GetDogtags(response http.ResponseWriter, request *http.Request) { | ||
| if s.DogtagsService == nil { | ||
| api.WriteErrorResponse(request.Context(), api.BuildErrorResponse( | ||
| http.StatusServiceUnavailable, | ||
| "Dogtags service not available", | ||
| request, | ||
| ), response) | ||
| return | ||
| } | ||
|
|
||
| flags := s.DogtagsService.GetAllFlags(request.Context()) | ||
|
|
||
| api.WriteBasicResponse(request.Context(), flags, http.StatusOK, response) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package v2_test | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "testing" | ||
|
|
||
| v2 "github.com/specterops/bloodhound/cmd/api/src/api/v2" | ||
| "github.com/specterops/bloodhound/cmd/api/src/services/dogtags" | ||
| ) | ||
|
|
||
| // Mock DogtagsService for testing | ||
| type mockDogtagsService struct { | ||
| flags map[dogtags.FlagKey]interface{} | ||
| } | ||
|
|
||
| func (m *mockDogtagsService) GetAllFlags(ctx context.Context) map[dogtags.FlagKey]interface{} { | ||
| return m.flags | ||
| } | ||
|
|
||
|
|
||
| func TestGetDogtags(t *testing.T) { | ||
| // Setup mock provider | ||
| mockProvider := &mockDogtagsService{ | ||
| flags: map[dogtags.FlagKey]interface{}{ | ||
| dogtags.BypassCypherQueryLimits: true, | ||
| dogtags.CypherMutability: false, | ||
| dogtags.ZoneAllocation: int64(100), | ||
| dogtags.LabelAllocation: int64(50), | ||
| }, | ||
| } | ||
|
|
||
| // Create resources with service using mock provider | ||
| resources := v2.Resources{ | ||
| DogtagsService: mockProvider, | ||
| } | ||
|
|
||
| // Create test request | ||
| req := httptest.NewRequest("GET", "/api/v2/dogtags", nil) | ||
| w := httptest.NewRecorder() | ||
|
|
||
| // Call the handler | ||
| resources.GetDogtags(w, req) | ||
|
|
||
| // Check response | ||
| resp := w.Result() | ||
| if resp.StatusCode != http.StatusOK { | ||
| t.Errorf("Expected status 200, got %d", resp.StatusCode) | ||
| } | ||
|
|
||
| // Parse response body - WriteBasicResponse wraps the flags | ||
| var rawResponse map[string]interface{} | ||
| if err := json.NewDecoder(resp.Body).Decode(&rawResponse); err != nil { | ||
| t.Fatalf("Failed to decode response: %v", err) | ||
| } | ||
|
|
||
| // Extract the actual flags data | ||
| flagsData, ok := rawResponse["data"].(map[string]interface{}) | ||
| if !ok { | ||
| t.Fatalf("Expected 'data' field with flags, got: %+v", rawResponse) | ||
| } | ||
|
|
||
| // Verify response data - JSON unmarshaling converts numbers to float64 | ||
| expectedFlags := map[string]interface{}{ | ||
| "bypass_cypher_query_limits": true, | ||
| "cypher_mutability": false, | ||
| "zone_allocation": float64(100), | ||
| "label_allocation": float64(50), | ||
| } | ||
|
|
||
| for key, expectedValue := range expectedFlags { | ||
| if actualValue, exists := flagsData[key]; !exists { | ||
| t.Errorf("Expected flag %s to exist in response", key) | ||
| } else if actualValue != expectedValue { | ||
| t.Errorf("Expected flag %s to be %v, got %v", key, expectedValue, actualValue) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func TestGetDogtagsServiceNotAvailable(t *testing.T) { | ||
| // Create resources without dogtags service (nil) | ||
| resources := v2.Resources{ | ||
| DogtagsService: nil, | ||
| } | ||
|
|
||
| // Create test request | ||
| req := httptest.NewRequest("GET", "/api/v2/dogtags", nil) | ||
| w := httptest.NewRecorder() | ||
|
|
||
| // Call the handler | ||
| resources.GetDogtags(w, req) | ||
|
|
||
| // Check response | ||
| resp := w.Result() | ||
| if resp.StatusCode != http.StatusServiceUnavailable { | ||
| t.Errorf("Expected status 503, got %d", resp.StatusCode) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,6 +26,7 @@ import ( | |
| "github.com/specterops/bloodhound/cmd/api/src/model" | ||
| "github.com/specterops/bloodhound/cmd/api/src/queries" | ||
| "github.com/specterops/bloodhound/cmd/api/src/serde" | ||
| "github.com/specterops/bloodhound/cmd/api/src/services/dogtags" | ||
| "github.com/specterops/bloodhound/cmd/api/src/services/fs" | ||
| "github.com/specterops/bloodhound/cmd/api/src/services/upload" | ||
| "github.com/specterops/bloodhound/packages/go/cache" | ||
|
|
@@ -101,6 +102,9 @@ type CreateOIDCProviderRequest struct { | |
| ClientId string `json:"client_id"` | ||
| } | ||
|
|
||
| // DogtagsService alias for the interface from dogtags package | ||
| type DogtagsService = dogtags.Service | ||
|
|
||
| // Resources holds the database and configuration dependencies to be passed around the API functions | ||
| type Resources struct { | ||
| Decoder *schema.Decoder | ||
|
|
@@ -115,6 +119,7 @@ type Resources struct { | |
| Authenticator api.Authenticator | ||
| IngestSchema upload.IngestSchema | ||
| FileService fs.Service | ||
| DogtagsService DogtagsService | ||
| } | ||
|
|
||
| func NewResources( | ||
|
|
@@ -127,6 +132,7 @@ func NewResources( | |
| authorizer auth.Authorizer, | ||
| authenticator api.Authenticator, | ||
| ingestSchema upload.IngestSchema, | ||
| dogtagsService DogtagsService, | ||
| ) Resources { | ||
| return Resources{ | ||
| Decoder: schema.NewDecoder(), | ||
|
|
@@ -141,5 +147,6 @@ func NewResources( | |
| Authenticator: authenticator, | ||
| IngestSchema: ingestSchema, | ||
| FileService: &fs.Client{}, | ||
| DogtagsService: dogtagsService, | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -166,6 +166,7 @@ type Configuration struct { | |
| RecreateDefaultAdmin bool `json:"recreate_default_admin"` | ||
| EnableUserAnalytics bool `json:"enable_user_analytics"` | ||
| ForceDownloadEmbeddedCollectors bool `json:"force_download_embedded_collectors"` | ||
| DogTagsFilePath string `json:"dogtags_file_path"` | ||
| } | ||
|
|
||
| func (s Configuration) TempDirectory() string { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -85,6 +85,7 @@ func NewDefaultConfiguration() (Configuration, error) { | |
| ExpireNow: true, | ||
| }, | ||
| EnableUserAnalytics: false, | ||
| DogTagsFilePath: "", // Empty uses provider defaults | ||
| }, nil | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,6 +20,7 @@ import ( | |
| "log/slog" | ||
| "time" | ||
|
|
||
| "github.com/specterops/bloodhound/cmd/api/src/daemons/ha" | ||
| "github.com/specterops/bloodhound/cmd/api/src/model/appcfg" | ||
| "github.com/specterops/dawgs/graph" | ||
| ) | ||
|
|
@@ -48,7 +49,20 @@ func DefaultOptions() Options { | |
| } | ||
|
|
||
| func NewChangelog(dawgsDB graph.Database, flagProvider appcfg.GetFlagByKeyer, opts Options) *Changelog { | ||
| // Use dummy HA implementation for BHCE (always primary) | ||
| flagManager := newFeatureFlagManager(flagGetter(dawgsDB, flagProvider), opts.PollInterval, ha.NewDummyHA()) | ||
| coordinator := newIngestionCoordinator(dawgsDB) | ||
|
|
||
| return &Changelog{ | ||
| flagManager: flagManager, | ||
| coordinator: coordinator, | ||
| options: opts, | ||
| } | ||
| } | ||
|
|
||
| // NewChangelogWithHA creates a changelog with a real HA implementation for high-availability deployments. | ||
| func NewChangelogWithHA(dawgsDB graph.Database, flagProvider appcfg.GetFlagByKeyer, opts Options, haMutex ha.HAMutex) *Changelog { | ||
| flagManager := newFeatureFlagManager(flagGetter(dawgsDB, flagProvider), opts.PollInterval, haMutex) | ||
| coordinator := newIngestionCoordinator(dawgsDB) | ||
|
|
||
| return &Changelog{ | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Guard against digest refs and add explicit trust inspect
Notary v1 trust is tag-based; digest references won’t validate signatures as intended. Enforce tag usage and inspect trust metadata explicitly.
Apply this diff to harden the validation step:
📝 Committable suggestion
🤖 Prompt for AI Agents