internal/checks/cis_test.go
Rama main · réplica de lectura del repositorio original.
package checks
import (
"slices"
"strings"
"testing"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"github.com/sophotechlabs/spinoza/internal/api"
)
func controlNamed(t *testing.T, posture api.FrameworkPosture, id string) api.FrameworkControl {
t.Helper()
for _, one := range posture.Controls {
if one.Control == id {
return one
}
}
t.Fatalf("no control named %q among the %d the posture carried", id, len(posture.Controls))
return api.FrameworkControl{}
}
func builtInIDs() map[string]bool {
out := map[string]bool{}
for _, entry := range registry() {
out[entry.id] = true
}
return out
}
func cisNamed() map[string]bool {
out := map[string]bool{}
for _, one := range catalog() {
if one.framework != cisBenchmark {
continue
}
for _, id := range one.checks {
out[id] = true
}
}
return out
}
func TestNoTwoControlsInTheCatalogShareAnID(t *testing.T) {
seen := map[string]bool{}
for _, one := range catalog() {
key := one.framework + "\x00" + one.id
if seen[key] {
t.Fatalf("%s carries %s twice", one.framework, one.id)
}
seen[key] = true
}
}
func TestEveryCheckAControlNamesIsARuleTheAuditShips(t *testing.T) {
built := builtInIDs()
for _, one := range catalog() {
named := map[string]bool{}
for _, id := range one.checks {
if !built[id] {
t.Fatalf("%s %s names %q, which is not a check the audit ships", one.framework, one.id, id)
}
if named[id] {
t.Fatalf("%s %s names %q twice", one.framework, one.id, id)
}
named[id] = true
}
}
}
func TestTheCatalogHoldsAllThreeStatesOfCoverage(t *testing.T) {
counted := map[string]int{}
for _, one := range catalog() {
counted[one.state()]++
}
for _, state := range []string{controlCovered, controlUncovered, controlOutOfScope} {
if counted[state] == 0 {
t.Fatalf("the catalog holds no %s control, so that state is never shown", state)
}
}
}
func TestAControlWithNoCheckBehindItIsReportedAsUncovered(t *testing.T) {
uncovered := []string{}
for _, one := range catalog() {
if one.state() == controlUncovered {
uncovered = append(uncovered, one.id)
}
}
posture := Posture(report(t), cisBenchmark)
for _, id := range uncovered {
one := controlNamed(t, posture, id)
if one.Covered {
t.Fatalf("%s has no check behind it and still reports as covered", id)
}
if len(one.Checks) != 0 {
t.Fatalf("%s has no check behind it and still names %v", id, one.Checks)
}
if one.Title == "" {
t.Fatalf("%s came back without a title, so nothing says what is missing", id)
}
}
if len(uncovered) == 0 {
t.Fatal("no control is uncovered, so the uncovered state is never exercised")
}
}
func TestAnOutOfScopeControlCarriesTheReasonItCannotBeDecided(t *testing.T) {
posture := Posture(report(t), cisBenchmark)
seen := 0
for _, one := range catalog() {
if one.state() != controlOutOfScope {
continue
}
seen++
if len(one.checks) != 0 {
t.Fatalf("%s is out of scope and still names %v", one.id, one.checks)
}
carried := controlNamed(t, posture, one.id)
if carried.Scope != controlOutOfScope {
t.Fatalf("%s came back in scope %q", one.id, carried.Scope)
}
if carried.Reason != one.outOfScope {
t.Fatalf("%s reads %q, which drops the reason %q", one.id, carried.Reason, one.outOfScope)
}
if carried.Title != one.title {
t.Fatalf("%s title reads %q, want %q", one.id, carried.Title, one.title)
}
}
if seen == 0 {
t.Fatal("no control is out of scope, so the reason is never shown")
}
}
func TestTheCISLabelAndTheCatalogNameTheSameRules(t *testing.T) {
named := cisNamed()
labeled := map[string]bool{}
for _, entry := range registry() {
if !slices.Contains(entry.frameworks, cisBenchmark) {
continue
}
labeled[entry.id] = true
if !named[entry.id] {
t.Fatalf("%s carries the CIS label and no control in the catalog names it", entry.id)
}
}
for id := range named {
if !labeled[id] {
t.Fatalf("a CIS control names %s and the rule does not carry the CIS label", id)
}
}
if len(labeled) == 0 {
t.Fatal("no rule carries the CIS label at all")
}
}
func privilegedPod() *unstructured.Unstructured {
return deployment("api", podSpec(container("app", withSecurity(map[string]any{"privileged": true}))))
}
func TestAControlCountsWhatTheChecksBehindItFound(t *testing.T) {
found := report(t, privilegedPod())
posture := Posture(found, cisBenchmark)
tests := []struct {
control string
failing int
objects int
}{
{control: "5.2.2", failing: 1, objects: 1},
{control: "5.2.6", failing: 1, objects: 1},
{control: "5.2.4", failing: 0, objects: 0},
}
for _, one := range tests {
t.Run(one.control, func(t *testing.T) {
got := controlNamed(t, posture, one.control)
if got.Failing != one.failing {
t.Fatalf("failing = %d, want %d", got.Failing, one.failing)
}
if got.Objects != one.objects {
t.Fatalf("objects = %d, want %d", got.Objects, one.objects)
}
if !got.Covered {
t.Fatal("the control reports as uncovered")
}
})
}
}
func TestAControlAddsUpTheChecksBehindItRatherThanOneOfThem(t *testing.T) {
found := report(t, privilegedPod())
posture := Posture(found, cisBenchmark)
one := controlNamed(t, posture, "5.2.9")
behind := 0
for _, id := range one.Checks {
behind += groupNamed(t, found, id).Total
}
if one.Failing != behind {
t.Fatalf("5.2.9 counted %d against %d across %v", one.Failing, behind, one.Checks)
}
if behind == 0 {
t.Fatal("nothing failed behind 5.2.9, so the sum proves nothing")
}
}
func TestAControlWhoseChecksDidNotRunSaysItsCountsArePartial(t *testing.T) {
stood := api.CheckReport{Groups: []api.CheckGroup{{
ID: "privileged-containers",
Skipped: "not audited: the cluster would not let this read pods",
}}}
posture := Posture(stood, cisBenchmark)
if !strings.Contains(posture.Reason, "5.2.2") {
t.Fatalf("reason = %q, which does not name the control nothing decided", posture.Reason)
}
if got := controlNamed(t, posture, "5.2.2").Failing; got != 0 {
t.Fatalf("failing = %d on a check that never ran", got)
}
}
func TestAReportThatRanEveryCheckIsNotMarkedPartial(t *testing.T) {
posture := Posture(report(t), cisBenchmark)
if strings.Contains(posture.Reason, "counts are partial") {
t.Fatalf("reason = %q on a run where every check reported", posture.Reason)
}
}
func TestThePostureListsEveryFrameworkTheCatalogKnows(t *testing.T) {
posture := Posture(report(t), "")
for _, want := range []string{pssBaseline, pssRestricted, nsaCisa, cisBenchmark} {
if !slices.Contains(posture.Frameworks, want) {
t.Fatalf("frameworks = %v, which leaves out %s", posture.Frameworks, want)
}
}
}
func TestNarrowingToOneFrameworkLeavesTheOthersOut(t *testing.T) {
tests := []struct {
name string
asked string
}{
{name: "cis", asked: cisBenchmark},
{name: "baseline", asked: pssBaseline},
{name: "restricted", asked: pssRestricted},
}
for _, one := range tests {
t.Run(one.name, func(t *testing.T) {
posture := Posture(report(t), one.asked)
if len(posture.Controls) == 0 {
t.Fatalf("%s narrowed to nothing", one.asked)
}
for _, control := range posture.Controls {
if control.Framework != one.asked {
t.Fatalf("asked for %s and got a control of %s", one.asked, control.Framework)
}
}
if !slices.Contains(posture.Frameworks, nsaCisa) {
t.Fatalf("narrowing dropped %s from the framework list", nsaCisa)
}
})
}
}
func TestAFrameworkWithNoNumberedControlsSaysSoRatherThanAnsweringEmpty(t *testing.T) {
posture := Posture(report(t), nsaCisa)
if len(posture.Controls) != 0 {
t.Fatalf("%s carried %d controls", nsaCisa, len(posture.Controls))
}
if !strings.Contains(posture.Reason, nsaCisa) {
t.Fatalf("reason = %q, which does not say why the list is empty", posture.Reason)
}
}
func TestAFrameworkNobodyKnowsIsNamedRatherThanAnsweredEmpty(t *testing.T) {
posture := Posture(report(t), "SOC 2")
if len(posture.Controls) != 0 {
t.Fatalf("an unknown framework carried %d controls", len(posture.Controls))
}
if !strings.Contains(posture.Reason, "SOC 2") {
t.Fatalf("reason = %q, which does not name what was asked for", posture.Reason)
}
if len(posture.Frameworks) == 0 {
t.Fatal("an unknown framework hid the frameworks that are known")
}
}
func TestEveryPSSControlUpstreamShipsIsInTheCatalog(t *testing.T) {
held := map[string]bool{}
for _, one := range catalog() {
if one.framework == pssBaseline || one.framework == pssRestricted {
held[one.id] = true
}
}
for _, entry := range registry() {
if entry.upstream == "" {
continue
}
if !held[string(entry.upstream)] {
t.Fatalf("%s answers upstream control %s and the catalog does not list it",
entry.id, entry.upstream)
}
}
}