threatx.go

package main

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"io/ioutil"
	"net/http"
	"os"

	log "github.com/sirupsen/logrus"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// ThreatXSecret contains a single Incapsula API Secret
type ThreatXSecret struct {
	Name         string `json:"name"`
	APIToken     string `json:"api_token"`
	CustomerName string `json:"customer_name"`
	AuthToken    string `json:"auth_token"`
}

type ThreatXSite struct {
	Hash                      int64           `json:"hash,omitempty"`
	Hostname                  string          `json:"hostname,omitempty"`
	Backend                   [][]interface{} `json:"backend,omitempty"`
	IsEnabled                 bool            `json:"isEnabled,omitempty"`
	RequestBlocking           bool            `json:"request_blocking,omitempty"`
	RiskBasedBlocking         bool            `json:"risk_based_blocking,omitempty"`
	ManualActionBlocking      bool            `json:"manual_action_blocking,omitempty"`
	StaticCachingEnabled      bool            `json:"static_caching_enabled,omitempty"`
	DynamicCachingEnabled     bool            `json:"dynamic_caching_enabled,omitempty"`
	SslEnabled                bool            `json:"ssl_enabled,omitempty"`
	SslBlob                   string          `json:"ssl_blob,omitempty"`
	SslExpTime                interface{}     `json:"ssl_exp_time,omitempty"`
	SslTerminateOnly          bool            `json:"ssl_terminate_only,omitempty"`
	OverrideResolve           interface{}     `json:"override_resolve,omitempty"`
	SslProtocols              interface{}     `json:"ssl_protocols,omitempty"`
	SslCiphers                interface{}     `json:"ssl_ciphers,omitempty"`
	SslRedirect               bool            `json:"ssl_redirect,omitempty"`
	AdvancedCaching           interface{}     `json:"advanced_caching,omitempty"`
	TimeCreated               int             `json:"time_created,omitempty"`
	CustomHTTPPort            int             `json:"custom_http_port,omitempty"`
	CustomHTTPSPort           int             `json:"custom_https_port,omitempty"`
	HTTP2Enabled              bool            `json:"http2_enabled,omitempty"`
	CustomResponseHeaders     interface{}     `json:"custom_response_headers,omitempty"`
	SetRealIPFrom             interface{}     `json:"set_real_ip_from,omitempty"`
	ClientMaxBodySize         interface{}     `json:"client_max_body_size,omitempty"`
	ProxyReadTimeout          interface{}     `json:"proxy_read_timeout,omitempty"`
	ProxySendTimeout          interface{}     `json:"proxy_send_timeout,omitempty"`
	WildcardSubdomainsEnabled bool            `json:"wildcard_subdomains_enabled,omitempty"`
}

type AutoGenerated struct {
	Ok ThreatXSite `json:"Ok"`
}

type ThreatXGetRequest struct {
	Command      string `json:"command"`
	Token        string `json:"token"`
	CustomerName string `json:"customer_name"`
	Name         string `json:"name"`
}

// Get retrieves a single Incapsula secret by name from k8s secrets
func (s *ThreatXSecret) Get(ctx context.Context) error {
	l := log.WithFields(log.Fields{
		"func":    "ThreatXSecret.Get",
		"name":    s.Name,
		"context": ctx,
	})
	l.Info("start")
	gopt := metav1.GetOptions{}
	sc, err := k8sClient.CoreV1().Secrets(os.Getenv("SECRETS_NAMESPACE")).Get(ctx, s.Name, gopt)
	if err != nil {
		return err
	}
	s.APIToken = string(sc.Data["api_token"])
	s.CustomerName = string(sc.Data["customer_name"])
	l.Info("end")
	return nil
}

// ThreatxLogin retrieves the api token from k8s secret and then generates a short-term token against ThreatX API
func (s *ThreatXSecret) ThreatxLogin(ctx context.Context) error {
	l := log.WithFields(log.Fields{
		"action": "ThreatxLogin",
	})
	l.Info("start")
	var e error
	var r struct {
		Command  string `json:"command"`
		APIToken string `json:"api_token"`
		Token    string `json:"token"`
	}
	r.Command = "login"
	gerr := s.Get(ctx)
	if gerr != nil {
		l.Error(gerr)
		return gerr
	}
	r.APIToken = s.APIToken
	jd, jerr := json.Marshal(r)
	if jerr != nil {
		l.Error(jerr)
		return jerr
	}
	l.Debugf("request=%s", string(jd))
	c := &http.Client{}
	req, err := http.NewRequest("POST", os.Getenv("THREATX_API")+"/v1/login", bytes.NewBuffer(jd))
	if err != nil {
		l.Error(err)
		return err
	}
	resp, err := c.Do(req)
	if err != nil {
		l.Error(err)
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != 200 {
		l.Error(err)
		return err
	}
	bd, berr := ioutil.ReadAll(resp.Body)
	if berr != nil {
		l.Error(berr)
		return berr
	}
	l.Debugf("response=%s", string(bd))
	type Resp struct {
		Ok struct {
			Token  string `json:"token"`
			Status bool   `json:"status"`
		} `json:"Ok"`
	}
	var rr *Resp
	jerr = json.Unmarshal(bd, &rr)
	if jerr != nil {
		l.Error(jerr)
		return jerr
	}
	s.AuthToken = rr.Ok.Token
	l.Debugf("auth_token=%s", s.AuthToken)
	return e
}

// Get retrieves a single ThreatX site from the API
func (tx *ThreatXSite) Get(ctx context.Context, sec *ThreatXSecret) error {
	l := log.WithFields(log.Fields{
		"func": "ThreatXSite.Get",
	})
	l.Info("start")
	var e error
	if sec.AuthToken == "" {
		l.Error("auth_token is empty")
		return errors.New("auth_token is empty")
	}
	tgr := ThreatXGetRequest{
		Command:      "get",
		Token:        sec.AuthToken,
		CustomerName: sec.CustomerName,
		Name:         tx.Hostname,
	}
	jd, jerr := json.Marshal(tgr)
	if jerr != nil {
		l.Error(jerr)
		return jerr
	}
	l.Debugf("request=%s", string(jd))
	c := &http.Client{}
	req, err := http.NewRequest("POST", os.Getenv("THREATX_API")+"/v2/sites", bytes.NewBuffer(jd))
	if err != nil {
		l.Error(err)
		return err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")
	resp, err := c.Do(req)
	if err != nil {
		l.Error(err)
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != 200 {
		l.Error(err)
		return err
	}
	type Resp struct {
		Ok ThreatXSite `json:"Ok"`
	}
	var rr Resp
	bd, berr := ioutil.ReadAll(resp.Body)
	if berr != nil {
		l.Error(berr)
		return berr
	}
	l.Debugf("response=%s", string(bd))
	jerr = json.Unmarshal(bd, &rr)
	if jerr != nil {
		l.Error(jerr)
		return jerr
	}
	*tx = rr.Ok
	l.Info("end")
	return e
}

// Update updates a single ThreatX site
func (tx *ThreatXSite) Update(ctx context.Context, sec *ThreatXSecret) error {
	l := log.WithFields(log.Fields{
		"func": "ThreatXSite.Update",
	})
	l.Info("start")
	if sec.AuthToken == "" {
		l.Error("auth_token is empty")
		return errors.New("auth_token is empty")
	}
	type TReq struct {
		Command      string      `json:"command"`
		Token        string      `json:"token"`
		CustomerName string      `json:"customer_name"`
		Name         string      `json:"name"`
		ThreatXSite  ThreatXSite `json:"site"`
	}
	r := &TReq{
		Command:      "update",
		Token:        sec.AuthToken,
		CustomerName: sec.CustomerName,
		Name:         tx.Hostname,
		ThreatXSite:  *tx,
	}
	jd, jerr := json.Marshal(r)
	if jerr != nil {
		l.Error(jerr)
		return jerr
	}
	l.Debugf("request=%s", string(jd))
	c := &http.Client{}
	req, err := http.NewRequest("POST", os.Getenv("THREATX_API")+"/v2/sites", bytes.NewBuffer(jd))
	if err != nil {
		l.Error(err)
		return err
	}
	req.Header.Set("Content-Type", "application/json")
	resp, err := c.Do(req)
	if err != nil {
		l.Error(err)
		return err
	}
	defer resp.Body.Close()
	bd, berr := ioutil.ReadAll(resp.Body)
	if berr != nil {
		l.Error(berr)
		return berr
	}
	if resp.StatusCode != 200 {
		l.Errorf("response=%d", resp.StatusCode)
		l.Errorf("response_body=%s", bd)

		return err
	}
	l.Debugf("response=%s", string(bd))
	l.Info("end")
	return nil
}

// ThreatxCerts accepts a slice of Secrets and returns only those configured
// for replication to ThreatX
func ThreatxCerts(s []corev1.Secret) []corev1.Secret {
	var c []corev1.Secret
	for _, v := range s {
		if v.Annotations[operatorName+"/threatx-hostname"] != "" && cacheChanged(v) {
			c = append(c, v)
		}
	}
	return c
}

// handleThreatxCerts handles the sync of all ThreatX-enabled certs
func handleThreatxCerts(ss []corev1.Secret) {
	ss = ThreatxCerts(ss)
	l := log.WithFields(
		log.Fields{
			"action": "handleThreatxCerts",
		},
	)
	l.Print("handleThreatxCerts")
	ctx := context.Background()
	for i, s := range ss {
		l.Debugf("processing secret %s (%d/%d)", s.ObjectMeta.Name, i+1, len(ss))
		ts := &ThreatXSecret{
			Name: s.Annotations[operatorName+"/threatx-secret-name"],
		}
		l.Debugf("getting secret %s", ts.Name)
		gerr := ts.Get(ctx)
		if gerr != nil {
			l.WithFields(log.Fields{
				"hostname":   s.Annotations[operatorName+"/threatx-hostname"],
				"secretName": s.Annotations[operatorName+"/threatx-secret-name"],
			}).Printf("is.Get error=%v", gerr)
			continue
		}
		l.Debugf("logging in")
		lerr := ts.ThreatxLogin(ctx)
		if lerr != nil {
			l.WithFields(log.Fields{
				"hostname":   s.Annotations[operatorName+"/threatx-hostname"],
				"secretName": s.Annotations[operatorName+"/threatx-secret-name"],
			}).Printf("ThreatxLogin error=%v", lerr)
			continue
		}
		l.Debugf("secret %+v", ts)
		txs := &ThreatXSite{
			Hostname: s.Annotations[operatorName+"/threatx-hostname"],
		}
		l.Debugf("getting site %s", s.Annotations[operatorName+"/threatx-hostname"])
		err := txs.Get(ctx, ts)
		if err != nil {
			l.WithFields(log.Fields{
				"hostname":   s.Annotations[operatorName+"/threatx-hostname"],
				"secretName": s.Annotations[operatorName+"/threatx-secret-name"],
			}).Printf("is.Get error=%v", err)
			continue
		}
		l.Debugf("updating site %s", s.Annotations[operatorName+"/threatx-hostname"])
		c := secretToCert(s)
		// https://support.threatx.com/hc/en-us/articles/360000661851-API-Reference-Guide-1-34-0#Actortags:-delete
		txs.SslBlob = string(c.Certificate) + string(c.Chain) + string(c.Key)
		txs.SslEnabled = true
		l.Debugf("updating secret %s", s.Annotations[operatorName+"/threatx-secret-name"])
		uerr := txs.Update(
			ctx,
			ts,
		)
		if uerr != nil {
			l.WithFields(log.Fields{
				"hostname":   s.Annotations[operatorName+"/threatx-hostname"],
				"secretName": s.Annotations[operatorName+"/threatx-secret-name"],
			}).Printf("ThreatX Update error=%v", uerr)
			continue
		}
		addToCache(c)
	}
}