From 15c92d2dad1ecc6fdc9521b3f2c8ff651020840b Mon Sep 17 00:00:00 2001 From: Nakul Chander <1407686+theencee@users.noreply.github.com> Date: Fri, 4 Nov 2022 14:15:14 -0700 Subject: [PATCH 1/4] X-Smart-Branch-Parent: master From 481443e4eebecc89f7fb41964fcbe587f663f4fc Mon Sep 17 00:00:00 2001 From: Nakul Chander <1407686+theencee@users.noreply.github.com> Date: Wed, 2 Nov 2022 11:22:14 -0700 Subject: [PATCH 2/4] ROX-11826: Disable kernel support package uploads for managed central --- central/main.go | 20 +++++-------------- central/probeupload/service/service_impl.go | 3 ++- .../templates/01-central-13-deployment.yaml | 2 ++ pkg/env/kernel_package_upload.go | 6 ++++++ pkg/httputil/handler.go | 17 +++++++++++++++- 5 files changed, 31 insertions(+), 17 deletions(-) create mode 100644 pkg/env/kernel_package_upload.go diff --git a/central/main.go b/central/main.go index 15adcbed479eb..ec18277d25280 100644 --- a/central/main.go +++ b/central/main.go @@ -164,6 +164,7 @@ import ( "github.com/stackrox/rox/pkg/grpc/authz/user" "github.com/stackrox/rox/pkg/grpc/errors" "github.com/stackrox/rox/pkg/grpc/routes" + "github.com/stackrox/rox/pkg/httputil" "github.com/stackrox/rox/pkg/httputil/proxy" "github.com/stackrox/rox/pkg/logging" pkgMetrics "github.com/stackrox/rox/pkg/metrics" @@ -673,13 +674,13 @@ func customRoutes() (customRoutes []routes.CustomRoute) { customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/db/backup", Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), + ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/api/extensions/backup", Authorizer: user.WithRole(role.Admin), - ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), + ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ @@ -704,13 +705,13 @@ func customRoutes() (customRoutes []routes.CustomRoute) { customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/db/backup", Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), + ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/api/extensions/backup", Authorizer: user.WithRole(role.Admin), - ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), + ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), Compression: true, }) } @@ -753,17 +754,6 @@ func customRoutes() (customRoutes []routes.CustomRoute) { return } -func notImplementedOnManagedServices(fn http.Handler) http.Handler { - if !env.ManagedCentral.BooleanSetting() { - return fn - } - return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { - errMsg := "api is not supported in a managed central environment." - log.Error(errMsg) - http.Error(w, errMsg, http.StatusNotImplemented) - }) -} - func debugRoutes() []routes.CustomRoute { customRoutes := make([]routes.CustomRoute, 0, len(routes.DebugRoutes)) diff --git a/central/probeupload/service/service_impl.go b/central/probeupload/service/service_impl.go index c669d6381b49a..5eaa690da4ef2 100644 --- a/central/probeupload/service/service_impl.go +++ b/central/probeupload/service/service_impl.go @@ -14,6 +14,7 @@ import ( "github.com/stackrox/rox/central/role/resources" v1 "github.com/stackrox/rox/generated/api/v1" "github.com/stackrox/rox/pkg/auth/permissions" + "github.com/stackrox/rox/pkg/env" "github.com/stackrox/rox/pkg/grpc/authz" "github.com/stackrox/rox/pkg/grpc/authz/idcheck" "github.com/stackrox/rox/pkg/grpc/authz/perrpc" @@ -79,7 +80,7 @@ func (s *service) CustomRoutes() []routes.CustomRoute { { Route: "/api/extensions/probeupload", Authorizer: user.With(permissions.Modify(resources.ProbeUpload)), - ServerHandler: http.HandlerFunc(s.handleProbeUpload), + ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.DisableKernelPackageUpload.BooleanSetting(), http.HandlerFunc(s.handleProbeUpload)), Compression: false, }, { diff --git a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml index ff5e82d3c7e2a..bb5dc736a01c2 100644 --- a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml +++ b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml @@ -109,6 +109,8 @@ spec: value: "true" - name: ROX_ENABLE_CENTRAL_DIAGNOSTICS value: "false" + - name: ROX_DISABLE_KERNEL_PACKAGE_UPLOAD + value: "true" {{- end }} {{- if ._rox.central.db.enabled }} - name: ROX_POSTGRES_DATASTORE diff --git a/pkg/env/kernel_package_upload.go b/pkg/env/kernel_package_upload.go new file mode 100644 index 0000000000000..ff45861f0d684 --- /dev/null +++ b/pkg/env/kernel_package_upload.go @@ -0,0 +1,6 @@ +package env + +var ( + // DisableKernelPackageUpload is set to true to signal that kernel support package uploads should be disabled. + DisableKernelPackageUpload = RegisterBooleanSetting("ROX_DISABLE_KERNEL_PACKAGE_UPLOAD", false) +) diff --git a/pkg/httputil/handler.go b/pkg/httputil/handler.go index 876af2a30142d..0806cc91b2ee2 100644 --- a/pkg/httputil/handler.go +++ b/pkg/httputil/handler.go @@ -1,6 +1,8 @@ package httputil -import "net/http" +import ( + "net/http" +) // WrapHandlerFunc wraps a function returning an error into an HTTP handler func that returns a 200 OK with empty // contents upon success, and sends an error formatted according to `WriteError` to the client otherwise. @@ -13,3 +15,16 @@ func WrapHandlerFunc(handlerFn func(req *http.Request) error) http.HandlerFunc { } }) } + +// HandlerNotImplementedIfSettingDisabled takes a handler func and returns a handler func that will error out if +// specified boolean is disabled, otherwise it will return the given handler func +func HandlerNotImplementedIfSettingDisabled(enabled bool, fn http.Handler) http.Handler { + if enabled { + return fn + } + return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + errMsg := "api is disabled due to central setting" + log.Error(errMsg) + http.Error(w, errMsg, http.StatusNotImplemented) + }) +} From 550cad2f71ee877521bab2f668d295ead98d0f62 Mon Sep 17 00:00:00 2001 From: Nakul Chander <1407686+theencee@users.noreply.github.com> Date: Fri, 4 Nov 2022 14:12:35 -0700 Subject: [PATCH 3/4] review comments --- central/main.go | 40 +++++++++++-------- central/probeupload/service/service_impl.go | 11 +++-- .../templates/01-central-13-deployment.yaml | 4 +- pkg/env/kernel_package_upload.go | 4 +- pkg/httputil/handler.go | 9 +---- pkg/utils/if_then_else.go | 9 +++++ 6 files changed, 46 insertions(+), 31 deletions(-) create mode 100644 pkg/utils/if_then_else.go diff --git a/central/main.go b/central/main.go index ec18277d25280..aa7596dc2e234 100644 --- a/central/main.go +++ b/central/main.go @@ -672,16 +672,20 @@ func customRoutes() (customRoutes []routes.CustomRoute) { if env.PostgresDatastoreEnabled.BooleanSetting() { customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/db/backup", - Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), - Compression: true, + Route: "/db/backup", + Authorizer: dbAuthz.DBReadAccessAuthorizer(), + ServerHandler: utils.IfThenElse[http.Handler]( + env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), + globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/api/extensions/backup", - Authorizer: user.WithRole(role.Admin), - ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), - Compression: true, + Route: "/api/extensions/backup", + Authorizer: user.WithRole(role.Admin), + ServerHandler: utils.IfThenElse[http.Handler]( + env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), + globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/api/export/csv/node/cve", @@ -703,16 +707,20 @@ func customRoutes() (customRoutes []routes.CustomRoute) { }) } else { customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/db/backup", - Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), - Compression: true, + Route: "/db/backup", + Authorizer: dbAuthz.DBReadAccessAuthorizer(), + ServerHandler: utils.IfThenElse[http.Handler]( + env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), + globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/api/extensions/backup", - Authorizer: user.WithRole(role.Admin), - ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.ManagedCentral.BooleanSetting(), globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), - Compression: true, + Route: "/api/extensions/backup", + Authorizer: user.WithRole(role.Admin), + ServerHandler: utils.IfThenElse[http.Handler]( + env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), + globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), + Compression: true, }) } diff --git a/central/probeupload/service/service_impl.go b/central/probeupload/service/service_impl.go index 5eaa690da4ef2..030f251edcf03 100644 --- a/central/probeupload/service/service_impl.go +++ b/central/probeupload/service/service_impl.go @@ -23,6 +23,7 @@ import ( "github.com/stackrox/rox/pkg/httputil" "github.com/stackrox/rox/pkg/logging" "github.com/stackrox/rox/pkg/probeupload" + "github.com/stackrox/rox/pkg/utils" "google.golang.org/grpc" "google.golang.org/grpc/codes" ) @@ -78,10 +79,12 @@ func (s *service) GetExistingProbes(ctx context.Context, req *v1.GetExistingProb func (s *service) CustomRoutes() []routes.CustomRoute { return []routes.CustomRoute{ { - Route: "/api/extensions/probeupload", - Authorizer: user.With(permissions.Modify(resources.ProbeUpload)), - ServerHandler: httputil.HandlerNotImplementedIfSettingDisabled(!env.DisableKernelPackageUpload.BooleanSetting(), http.HandlerFunc(s.handleProbeUpload)), - Compression: false, + Route: "/api/extensions/probeupload", + Authorizer: user.With(permissions.Modify(resources.ProbeUpload)), + ServerHandler: utils.IfThenElse[http.Handler]( + env.EnableKernelPackageUpload.BooleanSetting(), http.HandlerFunc(s.handleProbeUpload), + httputil.NotImplementedHandler("api is not supported because kernel package upload is disabled.")), + Compression: false, }, { Route: "/kernel-objects/", diff --git a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml index bb5dc736a01c2..c66da004aea62 100644 --- a/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml +++ b/image/templates/helm/stackrox-central/templates/01-central-13-deployment.yaml @@ -109,8 +109,8 @@ spec: value: "true" - name: ROX_ENABLE_CENTRAL_DIAGNOSTICS value: "false" - - name: ROX_DISABLE_KERNEL_PACKAGE_UPLOAD - value: "true" + - name: ROX_ENABLE_KERNEL_PACKAGE_UPLOAD + value: "false" {{- end }} {{- if ._rox.central.db.enabled }} - name: ROX_POSTGRES_DATASTORE diff --git a/pkg/env/kernel_package_upload.go b/pkg/env/kernel_package_upload.go index ff45861f0d684..001c5eccc9988 100644 --- a/pkg/env/kernel_package_upload.go +++ b/pkg/env/kernel_package_upload.go @@ -1,6 +1,6 @@ package env var ( - // DisableKernelPackageUpload is set to true to signal that kernel support package uploads should be disabled. - DisableKernelPackageUpload = RegisterBooleanSetting("ROX_DISABLE_KERNEL_PACKAGE_UPLOAD", false) + // EnableKernelPackageUpload is set to true to signal that kernel support package uploads should be supported. + EnableKernelPackageUpload = RegisterBooleanSetting("ROX_ENABLE_KERNEL_PACKAGE_UPLOAD", true) ) diff --git a/pkg/httputil/handler.go b/pkg/httputil/handler.go index 0806cc91b2ee2..a725cb1e5f176 100644 --- a/pkg/httputil/handler.go +++ b/pkg/httputil/handler.go @@ -16,14 +16,9 @@ func WrapHandlerFunc(handlerFn func(req *http.Request) error) http.HandlerFunc { }) } -// HandlerNotImplementedIfSettingDisabled takes a handler func and returns a handler func that will error out if -// specified boolean is disabled, otherwise it will return the given handler func -func HandlerNotImplementedIfSettingDisabled(enabled bool, fn http.Handler) http.Handler { - if enabled { - return fn - } +// NotImplementedHandler returns an HTTP Handler func that returns 501 Not Implemented with a custom error message. +func NotImplementedHandler(errMsg string) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { - errMsg := "api is disabled due to central setting" log.Error(errMsg) http.Error(w, errMsg, http.StatusNotImplemented) }) diff --git a/pkg/utils/if_then_else.go b/pkg/utils/if_then_else.go new file mode 100644 index 0000000000000..e5e1ba12e8b61 --- /dev/null +++ b/pkg/utils/if_then_else.go @@ -0,0 +1,9 @@ +package utils + +// IfThenElse is a ternary operator function that will return `a` if `cond` is true, otherwise it will return `b` +func IfThenElse[T any](cond bool, a, b T) T { + if cond { + return a + } + return b +} From 78dad7d4c0548599d54c36dcf1a96f1b349d8d35 Mon Sep 17 00:00:00 2001 From: Nakul Chander <1407686+theencee@users.noreply.github.com> Date: Fri, 4 Nov 2022 14:20:25 -0700 Subject: [PATCH 4/4] cleanup --- central/main.go | 46 ++++++++++++++++++++++------------------------ 1 file changed, 22 insertions(+), 24 deletions(-) diff --git a/central/main.go b/central/main.go index aa7596dc2e234..1d936d0c07020 100644 --- a/central/main.go +++ b/central/main.go @@ -672,20 +672,16 @@ func customRoutes() (customRoutes []routes.CustomRoute) { if env.PostgresDatastoreEnabled.BooleanSetting() { customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/db/backup", - Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: utils.IfThenElse[http.Handler]( - env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), - globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), - Compression: true, + Route: "/db/backup", + Authorizer: dbAuthz.DBReadAccessAuthorizer(), + ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), false)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/api/extensions/backup", - Authorizer: user.WithRole(role.Admin), - ServerHandler: utils.IfThenElse[http.Handler]( - env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), - globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), - Compression: true, + Route: "/api/extensions/backup", + Authorizer: user.WithRole(role.Admin), + ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(nil, nil, globaldb.GetPostgres(), true)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ Route: "/api/export/csv/node/cve", @@ -707,20 +703,16 @@ func customRoutes() (customRoutes []routes.CustomRoute) { }) } else { customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/db/backup", - Authorizer: dbAuthz.DBReadAccessAuthorizer(), - ServerHandler: utils.IfThenElse[http.Handler]( - env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), - globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), - Compression: true, + Route: "/db/backup", + Authorizer: dbAuthz.DBReadAccessAuthorizer(), + ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, false)), + Compression: true, }) customRoutes = append(customRoutes, routes.CustomRoute{ - Route: "/api/extensions/backup", - Authorizer: user.WithRole(role.Admin), - ServerHandler: utils.IfThenElse[http.Handler]( - env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), - globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), - Compression: true, + Route: "/api/extensions/backup", + Authorizer: user.WithRole(role.Admin), + ServerHandler: notImplementedOnManagedServices(globaldbHandlers.BackupDB(globaldb.GetGlobalDB(), globaldb.GetRocksDB(), nil, true)), + Compression: true, }) } @@ -762,6 +754,12 @@ func customRoutes() (customRoutes []routes.CustomRoute) { return } +func notImplementedOnManagedServices(fn http.Handler) http.Handler { + return utils.IfThenElse[http.Handler]( + env.ManagedCentral.BooleanSetting(), httputil.NotImplementedHandler("api is not supported in a managed central environment."), + fn) +} + func debugRoutes() []routes.CustomRoute { customRoutes := make([]routes.CustomRoute, 0, len(routes.DebugRoutes))