cisagov / cyhy-core

Core code for Cyber Hygiene (CyHy)
Other
8 stars 10 forks source link

Allow restricted IPs to be added with an override flag #98

Open mcdonnnj opened 4 months ago

mcdonnnj commented 4 months ago

💡 Summary

We need to provide a flag that will allow users of the cyhy-ip tool to add restricted IPs if desired.

Motivation and context

Although generally undesirable there are specific scenarios where this is necessary. The most common is if a restricted IP is removed while a scan for the IP is in progress. When the scan completes it may cause host information for the remote IP to be updated (including re-opening tickets). The cleanest way to resolve this is to re-add and then remove the affected IP to ensure any re-opened tickets are once again closed. Currently this is not readily possible using the provided tools.

Implementation notes

This should only bypass the final check to fail if restricted IPs are provided. It should still output all logging information that informs a user that a restricted IP is included and warn that a restricted IP will be added to the database. We should also add the same flag to cyhy-tool to ensure parity between the tools.

Acceptance criteria