421 lines
14 KiB
C#
421 lines
14 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.Collections.Immutable;
|
|
using System.Globalization;
|
|
using System.Linq;
|
|
using StellaOps.Policy;
|
|
using StellaOps.Policy.Engine.Compilation;
|
|
|
|
namespace StellaOps.Policy.Engine.Evaluation;
|
|
|
|
/// <summary>
|
|
/// Deterministically evaluates compiled policy IR against advisory/VEX/SBOM inputs.
|
|
/// </summary>
|
|
internal sealed class PolicyEvaluator
|
|
{
|
|
public PolicyEvaluationResult Evaluate(PolicyEvaluationRequest request)
|
|
{
|
|
if (request is null)
|
|
{
|
|
throw new ArgumentNullException(nameof(request));
|
|
}
|
|
|
|
if (request.Document is null)
|
|
{
|
|
throw new ArgumentNullException(nameof(request.Document));
|
|
}
|
|
|
|
var evaluator = new PolicyExpressionEvaluator(request.Context);
|
|
var orderedRules = request.Document.Rules
|
|
.Select(static (rule, index) => new { rule, index })
|
|
.OrderBy(x => x.rule.Priority)
|
|
.ThenBy(x => x.index)
|
|
.ToImmutableArray();
|
|
|
|
foreach (var entry in orderedRules)
|
|
{
|
|
var rule = entry.rule;
|
|
if (!evaluator.EvaluateBoolean(rule.When))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
var runtime = new PolicyRuntimeState(request.Context.Severity.Normalized);
|
|
foreach (var action in rule.ThenActions)
|
|
{
|
|
ApplyAction(rule.Name, action, evaluator, runtime);
|
|
}
|
|
|
|
if (runtime.Status is null)
|
|
{
|
|
runtime.Status = "affected";
|
|
}
|
|
|
|
var baseResult = new PolicyEvaluationResult(
|
|
Matched: true,
|
|
Status: runtime.Status,
|
|
Severity: runtime.Severity,
|
|
RuleName: rule.Name,
|
|
Priority: rule.Priority,
|
|
Annotations: runtime.Annotations.ToImmutableDictionary(StringComparer.OrdinalIgnoreCase),
|
|
Warnings: runtime.Warnings.ToImmutableArray(),
|
|
AppliedException: null);
|
|
|
|
return ApplyExceptions(request, baseResult);
|
|
}
|
|
|
|
var defaultResult = PolicyEvaluationResult.CreateDefault(request.Context.Severity.Normalized);
|
|
return ApplyExceptions(request, defaultResult);
|
|
}
|
|
|
|
private static void ApplyAction(
|
|
string ruleName,
|
|
PolicyIrAction action,
|
|
PolicyExpressionEvaluator evaluator,
|
|
PolicyRuntimeState runtime)
|
|
{
|
|
switch (action)
|
|
{
|
|
case PolicyIrAssignmentAction assign:
|
|
ApplyAssignment(assign, evaluator, runtime);
|
|
break;
|
|
case PolicyIrAnnotateAction annotate:
|
|
ApplyAnnotate(annotate, evaluator, runtime);
|
|
break;
|
|
case PolicyIrWarnAction warn:
|
|
ApplyWarn(warn, evaluator, runtime);
|
|
break;
|
|
case PolicyIrEscalateAction escalate:
|
|
ApplyEscalate(escalate, evaluator, runtime);
|
|
break;
|
|
case PolicyIrRequireVexAction require:
|
|
var allSatisfied = true;
|
|
foreach (var condition in require.Conditions.Values)
|
|
{
|
|
if (!evaluator.EvaluateBoolean(condition))
|
|
{
|
|
allSatisfied = false;
|
|
break;
|
|
}
|
|
}
|
|
|
|
runtime.Status ??= allSatisfied ? "affected" : "suppressed";
|
|
break;
|
|
case PolicyIrIgnoreAction ignore:
|
|
runtime.Status = "ignored";
|
|
break;
|
|
case PolicyIrDeferAction defer:
|
|
runtime.Status = "deferred";
|
|
break;
|
|
default:
|
|
runtime.Warnings.Add($"Unhandled action '{action.GetType().Name}' in rule '{ruleName}'.");
|
|
break;
|
|
}
|
|
}
|
|
|
|
private static void ApplyAssignment(PolicyIrAssignmentAction assign, PolicyExpressionEvaluator evaluator, PolicyRuntimeState runtime)
|
|
{
|
|
var value = evaluator.Evaluate(assign.Value);
|
|
var stringValue = value.AsString();
|
|
if (assign.Target.Length == 0)
|
|
{
|
|
return;
|
|
}
|
|
|
|
var target = assign.Target[0];
|
|
switch (target)
|
|
{
|
|
case "status":
|
|
runtime.Status = stringValue ?? runtime.Status ?? "affected";
|
|
break;
|
|
case "severity":
|
|
runtime.Severity = stringValue;
|
|
break;
|
|
default:
|
|
runtime.Annotations[target] = stringValue ?? value.Raw?.ToString() ?? string.Empty;
|
|
break;
|
|
}
|
|
}
|
|
|
|
private static void ApplyAnnotate(PolicyIrAnnotateAction annotate, PolicyExpressionEvaluator evaluator, PolicyRuntimeState runtime)
|
|
{
|
|
var key = annotate.Target.Length > 0 ? annotate.Target[^1] : "annotation";
|
|
var value = evaluator.Evaluate(annotate.Value).AsString() ?? string.Empty;
|
|
runtime.Annotations[key] = value;
|
|
}
|
|
|
|
private static void ApplyWarn(PolicyIrWarnAction warn, PolicyExpressionEvaluator evaluator, PolicyRuntimeState runtime)
|
|
{
|
|
var message = warn.Message is null ? "" : evaluator.Evaluate(warn.Message).AsString();
|
|
if (!string.IsNullOrWhiteSpace(message))
|
|
{
|
|
runtime.Warnings.Add(message!);
|
|
}
|
|
else
|
|
{
|
|
runtime.Warnings.Add("Policy rule emitted a warning.");
|
|
}
|
|
|
|
runtime.Status ??= "warned";
|
|
}
|
|
|
|
private static void ApplyEscalate(PolicyIrEscalateAction escalate, PolicyExpressionEvaluator evaluator, PolicyRuntimeState runtime)
|
|
{
|
|
if (escalate.To is not null)
|
|
{
|
|
runtime.Severity = evaluator.Evaluate(escalate.To).AsString() ?? runtime.Severity;
|
|
}
|
|
|
|
if (escalate.When is not null && !evaluator.EvaluateBoolean(escalate.When))
|
|
{
|
|
return;
|
|
}
|
|
}
|
|
|
|
private sealed class PolicyRuntimeState
|
|
{
|
|
public PolicyRuntimeState(string? initialSeverity)
|
|
{
|
|
Severity = initialSeverity;
|
|
}
|
|
|
|
public string? Status { get; set; }
|
|
|
|
public string? Severity { get; set; }
|
|
|
|
public Dictionary<string, string> Annotations { get; } = new(StringComparer.OrdinalIgnoreCase);
|
|
|
|
public List<string> Warnings { get; } = new();
|
|
}
|
|
|
|
private static PolicyEvaluationResult ApplyExceptions(PolicyEvaluationRequest request, PolicyEvaluationResult baseResult)
|
|
{
|
|
var exceptions = request.Context.Exceptions;
|
|
if (exceptions.IsEmpty)
|
|
{
|
|
return baseResult;
|
|
}
|
|
|
|
PolicyEvaluationExceptionInstance? winningInstance = null;
|
|
PolicyExceptionEffect? winningEffect = null;
|
|
var winningScore = -1;
|
|
|
|
foreach (var instance in exceptions.Instances)
|
|
{
|
|
if (!exceptions.Effects.TryGetValue(instance.EffectId, out var effect))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
if (!MatchesScope(instance.Scope, request, baseResult))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
var specificity = ComputeSpecificity(instance.Scope);
|
|
if (specificity < 0)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
if (winningInstance is null
|
|
|| specificity > winningScore
|
|
|| (specificity == winningScore && instance.CreatedAt > winningInstance.CreatedAt)
|
|
|| (specificity == winningScore && instance.CreatedAt == winningInstance!.CreatedAt
|
|
&& string.CompareOrdinal(instance.Id, winningInstance.Id) < 0))
|
|
{
|
|
winningInstance = instance;
|
|
winningEffect = effect;
|
|
winningScore = specificity;
|
|
}
|
|
}
|
|
|
|
if (winningInstance is null || winningEffect is null)
|
|
{
|
|
return baseResult;
|
|
}
|
|
|
|
return ApplyExceptionEffect(baseResult, winningInstance, winningEffect);
|
|
}
|
|
|
|
private static bool MatchesScope(
|
|
PolicyEvaluationExceptionScope scope,
|
|
PolicyEvaluationRequest request,
|
|
PolicyEvaluationResult baseResult)
|
|
{
|
|
if (scope.RuleNames.Count > 0)
|
|
{
|
|
if (string.IsNullOrEmpty(baseResult.RuleName)
|
|
|| !scope.RuleNames.Contains(baseResult.RuleName))
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (scope.Severities.Count > 0)
|
|
{
|
|
var severity = request.Context.Severity.Normalized;
|
|
if (string.IsNullOrEmpty(severity)
|
|
|| !scope.Severities.Contains(severity))
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (scope.Sources.Count > 0)
|
|
{
|
|
var source = request.Context.Advisory.Source;
|
|
if (string.IsNullOrEmpty(source)
|
|
|| !scope.Sources.Contains(source))
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (scope.Tags.Count > 0)
|
|
{
|
|
var sbom = request.Context.Sbom;
|
|
var hasMatch = scope.Tags.Any(sbom.HasTag);
|
|
if (!hasMatch)
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
private static int ComputeSpecificity(PolicyEvaluationExceptionScope scope)
|
|
{
|
|
var score = 0;
|
|
|
|
if (scope.RuleNames.Count > 0)
|
|
{
|
|
score += 1_000 + scope.RuleNames.Count * 25;
|
|
}
|
|
|
|
if (scope.Severities.Count > 0)
|
|
{
|
|
score += 500 + scope.Severities.Count * 10;
|
|
}
|
|
|
|
if (scope.Sources.Count > 0)
|
|
{
|
|
score += 250 + scope.Sources.Count * 10;
|
|
}
|
|
|
|
if (scope.Tags.Count > 0)
|
|
{
|
|
score += 100 + scope.Tags.Count * 5;
|
|
}
|
|
|
|
return score;
|
|
}
|
|
|
|
private static PolicyEvaluationResult ApplyExceptionEffect(
|
|
PolicyEvaluationResult baseResult,
|
|
PolicyEvaluationExceptionInstance instance,
|
|
PolicyExceptionEffect effect)
|
|
{
|
|
var annotationsBuilder = baseResult.Annotations.ToBuilder();
|
|
annotationsBuilder["exception.id"] = instance.Id;
|
|
annotationsBuilder["exception.effectId"] = effect.Id;
|
|
annotationsBuilder["exception.effectType"] = effect.Effect.ToString();
|
|
|
|
if (!string.IsNullOrWhiteSpace(effect.Name))
|
|
{
|
|
annotationsBuilder["exception.effectName"] = effect.Name!;
|
|
}
|
|
|
|
if (!string.IsNullOrWhiteSpace(effect.RoutingTemplate))
|
|
{
|
|
annotationsBuilder["exception.routingTemplate"] = effect.RoutingTemplate!;
|
|
}
|
|
|
|
if (effect.MaxDurationDays is int durationDays)
|
|
{
|
|
annotationsBuilder["exception.maxDurationDays"] = durationDays.ToString(CultureInfo.InvariantCulture);
|
|
}
|
|
|
|
foreach (var pair in instance.Metadata)
|
|
{
|
|
annotationsBuilder[$"exception.meta.{pair.Key}"] = pair.Value;
|
|
}
|
|
|
|
var metadataBuilder = ImmutableDictionary.CreateBuilder<string, string>(StringComparer.OrdinalIgnoreCase);
|
|
if (!string.IsNullOrWhiteSpace(effect.RoutingTemplate))
|
|
{
|
|
metadataBuilder["routingTemplate"] = effect.RoutingTemplate!;
|
|
}
|
|
|
|
if (effect.MaxDurationDays is int metadataDuration)
|
|
{
|
|
metadataBuilder["maxDurationDays"] = metadataDuration.ToString(CultureInfo.InvariantCulture);
|
|
}
|
|
|
|
if (!string.IsNullOrWhiteSpace(effect.RequiredControlId))
|
|
{
|
|
metadataBuilder["requiredControlId"] = effect.RequiredControlId!;
|
|
}
|
|
|
|
if (!string.IsNullOrWhiteSpace(effect.Name))
|
|
{
|
|
metadataBuilder["effectName"] = effect.Name!;
|
|
}
|
|
|
|
foreach (var pair in instance.Metadata)
|
|
{
|
|
metadataBuilder[pair.Key] = pair.Value;
|
|
}
|
|
|
|
var newStatus = baseResult.Status;
|
|
var newSeverity = baseResult.Severity;
|
|
var warnings = baseResult.Warnings;
|
|
|
|
switch (effect.Effect)
|
|
{
|
|
case PolicyExceptionEffectType.Suppress:
|
|
newStatus = "suppressed";
|
|
annotationsBuilder["exception.status"] = newStatus;
|
|
break;
|
|
case PolicyExceptionEffectType.Defer:
|
|
newStatus = "deferred";
|
|
annotationsBuilder["exception.status"] = newStatus;
|
|
break;
|
|
case PolicyExceptionEffectType.Downgrade:
|
|
if (effect.DowngradeSeverity is { } downgradeSeverity)
|
|
{
|
|
newSeverity = downgradeSeverity.ToString();
|
|
annotationsBuilder["exception.severity"] = newSeverity!;
|
|
}
|
|
break;
|
|
case PolicyExceptionEffectType.RequireControl:
|
|
if (!string.IsNullOrWhiteSpace(effect.RequiredControlId))
|
|
{
|
|
annotationsBuilder["exception.requiredControl"] = effect.RequiredControlId!;
|
|
warnings = warnings.Add($"Exception '{instance.Id}' requires control '{effect.RequiredControlId}'.");
|
|
}
|
|
break;
|
|
}
|
|
|
|
var application = new PolicyExceptionApplication(
|
|
ExceptionId: instance.Id,
|
|
EffectId: instance.EffectId,
|
|
EffectType: effect.Effect,
|
|
OriginalStatus: baseResult.Status,
|
|
OriginalSeverity: baseResult.Severity,
|
|
AppliedStatus: newStatus,
|
|
AppliedSeverity: newSeverity,
|
|
Metadata: metadataBuilder.ToImmutable());
|
|
|
|
return baseResult with
|
|
{
|
|
Status = newStatus,
|
|
Severity = newSeverity,
|
|
Annotations = annotationsBuilder.ToImmutable(),
|
|
Warnings = warnings,
|
|
AppliedException = application,
|
|
};
|
|
}
|
|
}
|