Documentation
¶
Index ¶
- Variables
- func CalculateEntropy(password string) float64
- func ContainsDictionaryWord(s string, dictionary map[string]struct{}) bool
- func CustomEnvironment() *exec.Environment
- func ExpandLayers(layers map[string][]string) []map[string]any
- func FlattenAllVars(data map[string]any) (map[string]any, error)
- func FlattenVar(key string, data map[string]any, visited map[string]any) (any, error)
- func GenerateIniFromConfig(cfg *GeneratorConfig) string
- func GoTemplate(s *u.SshExec, src, dest string, data map[string]any, mode os.FileMode) (err error)
- func HelmChartValidation(chartPath string, valuesFile []string) bool
- func IncludeVars(filename string) map[string]interface{}
- func IniGetVal(inifilepath, section, option string) string
- func IniSetVal(inifilepath, section, option, value string) error
- func IsLikelyPasswordOrToken[W string | map[string]struct{}](value, check_mode string, words_source W, word_len int, ...) bool
- func LoadWordDictionary(filename string, word_len int) (map[string]struct{}, error)
- func MaskCredential(inputstr string) string
- func MaskCredentialByte(inputbytes []byte) string
- func ParseInventoryGenerator(inventoryFile string) *aini.InventoryData
- func TemplateDirTree(srcDirpath, targetRoot string, tmplData map[string]interface{}) error
- func TemplateFile(src, dest string, data map[string]interface{}, fileMode os.FileMode)
- func TemplateFileOld(src, dest string, data map[string]interface{}, fileMode os.FileMode)
- func TemplateFromStringWithConfig(source string, config *config.Config) (*exec.Template, error)
- func TemplateString(srcString string, data map[string]interface{}) string
- func ValidateYamlDir(yaml_dir string, yamlobj *map[string]interface{}) bool
- func ValidateYamlFile(yaml_file string, yamlobj *map[string]interface{}) map[string]interface{}
- type GeneratorConfig
- type Group
- type GroupConfig
- type Host
- type HostConfig
- type IniInventory
- type Inventory
- type PasswordStrength
Constants ¶
This section is empty.
Variables ¶
var CustomConfig = config.Config{ BlockStartString: "{%", BlockEndString: "%}", VariableStartString: "{{", VariableEndString: "}}", CommentStartString: "{#", CommentEndString: "#}", AutoEscape: false, StrictUndefined: false, TrimBlocks: true, LeftStripBlocks: true, }
var MaskCredentialPattern *regexp.Regexp = regexp.MustCompile(`(?i)(password|token|pass|passkey|secret|secret_key|access_key|PAT)([:=]{1,1})[\s]*[^\s]+`)
MaskCredential RegexPattern
Functions ¶
func CalculateEntropy ¶
CalculateEntropy calculates the Shannon entropy in bits.
func ContainsDictionaryWord ¶
Function to check if a string contains any dictionary words using a map
func CustomEnvironment ¶
func CustomEnvironment() *exec.Environment
func FlattenAllVars ¶
FlattenAllVars flattens all variables in the data map
func FlattenVar ¶
FlattenVar recursively resolves all template variables in a string until no more {{ }} patterns remain visited map has key "cached" -> map[string]any that use to cache between recursion and "visited" -> bool to mark key visited or not, this will be deleted after the recursion complete
func GenerateIniFromConfig ¶
func GenerateIniFromConfig(cfg *GeneratorConfig) string
func GoTemplate ¶
Take local jinja2 template file, template it and copy to remote hosts
func HelmChartValidation ¶
Validate helm template. Pretty simple for now, not assess the set new var directive or include directive or long access var within range etc. `trivy` and `helm lint` with k8s validation should cover that job This only deals with when var is not defined, helm content rendered as empty string. `helm lint` wont give you error for that. Walk through the template, search for all string pattern with {{ .Values.<XXX> }} - then extract the var name. Load the helm values files into map, merge them and check the var name (or path access) in there. If not print outout error If there is helm template `if` statement to test the value then do not fail If there is a helm `default` function of filter to test the value and set the default value then do not fail
func IncludeVars ¶
Validate a yaml file and load it into a map
func IsLikelyPasswordOrToken ¶
func IsLikelyPasswordOrToken[W string | map[string]struct{}](value, check_mode string, words_source W, word_len int, entropy_threshold float64) bool
Heuristic detect if the values is likely a real password etc possible values for check_mode: letter, digit, letter+digit, letter+digit+word if any other values it will be the same effect as letter+digit+word+special if you provide `letter` means the function will detect letter(s) in the value AND as long as it is greater than the entropy_threshold level it will return true Same `letter+digit` - the value must contain at least letter and digit so on word means if the value is an english word it return false (not 100% if entropy is high it might return true) The word check requires `words_file_path` to be set to a path of the words file; if the value is empty string then it have the default value is "words.txt". You need to be sure to create the file yourself. Link to download https://github.com/dwyl/english-words/blob/master/words.txt These rules to reduce the false positive detection as people might put there as an example of password rather then real password, we only want to spot out real password.
func LoadWordDictionary ¶
Load dictionary words from a file and return a map for faster lookups
func MaskCredentialByte ¶
Mask all credentials pattern
func ParseInventoryGenerator ¶
func ParseInventoryGenerator(inventoryFile string) *aini.InventoryData
func TemplateDirTree ¶
TemplateDirTree read all templates files in the src directory and template to the target directory keeping the directory structure the same as source. Src and Target Path should be absolute path. They should not overlap to avoid recursive loop
func TemplateFile ¶
Template a file using template string and convert windows new line to unix. This is work around the gonja2 windows new line problem
func TemplateFileOld ¶
One day if the upstream lib fixed we can restore this func
func TemplateString ¶
func ValidateYamlDir ¶
Validate directory containing yaml files. Optionally return the unmarshalled object if you pass yamlobj not nil
func ValidateYamlFile ¶
Validate yaml files. Optionally return the unmarshalled object if you pass yamlobj not nil
Types ¶
type GeneratorConfig ¶
type GeneratorConfig struct {
Plugin string `yaml:"plugin"`
Hosts HostConfig `yaml:"hosts"`
Layers map[string][]string `yaml:"layers"`
}
type GroupConfig ¶
type GroupConfig struct {
Name string `yaml:"name"`
Vars map[string]string `yaml:"vars"`
Parents []GroupConfig `yaml:"parents"`
}
type HostConfig ¶
type HostConfig struct {
Name string `yaml:"name"`
Vars map[string]string `yaml:"vars"`
Parents []GroupConfig `yaml:"parents"`
}
type IniInventory ¶
type PasswordStrength ¶
type PasswordStrength string
Password strength
const ( WeakPassword PasswordStrength = "weak" MediumPassword PasswordStrength = "medium" StrongPassword PasswordStrength = "strong" VeryStrongPassword PasswordStrength = "very strong" QuantumReadyPassword PasswordStrength = "quantum ready password" )
func CheckPasswordStrength ¶
func CheckPasswordStrength(password string) (PasswordStrength, float64, error)
Optimized password strength check
Source Files