From d3299453f740baa031f2c606db0794a6bc40c967 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Wed, 1 Sep 2021 17:20:26 +0200 Subject: [PATCH 01/28] Makefiles: add generic scanner makefile Signed-off-by: Jop Zitman --- scanners.mk | 184 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 184 insertions(+) create mode 100644 scanners.mk diff --git a/scanners.mk b/scanners.mk new file mode 100644 index 0000000000..b3afc1a151 --- /dev/null +++ b/scanners.mk @@ -0,0 +1,184 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# +# +# This Makefile is intended to be used for developement and testing only. +# For using this scanner/hook in production please use the helm chart. +# See: +# +# This Makefile expects some additional software to be installed: +# - git +# - node + npm +# - docker +# - kind +# - kubectl +# - helm +# - yq + +ifeq ($(include_guard),) + $(error you should never run this makefile directly!) +endif +ifeq ($(scanner),) + $(error scanner ENV is not set) +endif + +# Thx to https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile +EXECUTABLES = make docker kind git node npm npx kubectl helm yq +K := $(foreach exec,$(EXECUTABLES),\ + $(if $(shell which $(exec)),some string,$(error "ERROR: The prerequisites are not met to execute this makefile! No '$(exec)' found in your PATH"))) + + +# Variables you might want to override: +# +# IMG_NS: Defines the namespace under which the images are build. +# For `securecodebox/scanner-nmap` `securecodebox` is the namespace +# Defaults to `securecodebox` +# +# BASE_IMG_TAG: Defines the tag of the base image used to build this scanner/hook +# +# IMG_TAG: Tag used to tag the newly created image. Defaults to the shortend commit hash +# prefixed with `sha-` e.g. `sha-ef8de4b7` +# +# JEST_VERSION Defines the jest version used for executing the tests. Defaults to latest +# +# Examples: +# make all IMG_TAG=main +# make deploy IMG_TAG=$(git rev-parse --short HEAD) +# make integration-tests +# + +SHELL = /bin/sh + +IMG_NS ?= securecodebox +GIT_TAG ?= $$(git rev-parse --short HEAD) +BASE_IMG_TAG ?= latest +IMG_TAG ?= "sha-$(GIT_TAG)" +JEST_VERSION ?= latest + +scanner-prefix = scanner +parser-prefix = parser + +ifeq ($(custom_scanner),) + docker-build: | docker-build-parser + docker-export: | docker-export-parser + kind-import: | kind-import-parser + deploy: deploy-without-scanner +else + docker-build: | docker-build-parser docker-build-scanner + docker-export: | docker-export-parser docker-export-scanner + kind-import: | kind-import-parser kind-import-scanner + deploy: deploy-with-scanner +endif + + +test: | unit-tests-parser docker-build docker-export kind-import deploy deploy-test-deps integration-tests + +all: | clean install-deps unit-tests-parser docker-build docker-export kind-import deploy deploy-test-deps integration-tests + +.PHONY: unit-tests-parser install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test + +unit-tests-parser: + @echo ".: ๐Ÿงช Starting unit-tests for '$(scanner)' parser with 'jest@$(JEST_VERSION)'." + npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage --passWithNoTests ${scanner}/parser/ + +install-deps: + @echo ".: โš™๏ธ Installing all scanner specific dependencies." + cd ./.. && npm ci + cd ../../parser-sdk/nodejs && npm ci + cd ./parser/ && npm ci + +docker-build-parser: + @echo ".: โš™๏ธ Build parser with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." + docker build --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -f ./parser/Dockerfile ./parser + +docker-export-parser: + @echo ".: โš™๏ธ Saving new docker image archive to '$(parser-prefix)-$(scanner).tar'." + docker save $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -o $(parser-prefix)-$(scanner).tar + +kind-import-parser: + @echo ".: ๐Ÿ’พ Importing the image archive '$(parser-prefix)-$(scanner).tar' to local kind cluster." + kind load image-archive ./$(parser-prefix)-$(scanner).tar + +docker-build-scanner: + @echo ".: โš™๏ธ Build custom scanner with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." + docker build --build-arg=scannerVersion=$(shell yq e .appVersion ./Chart.yaml) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(scanner-prefix)-$(scanner):$(IMG_TAG) -f ./scanner/Dockerfile ./scanner + +docker-export-scanner: + @echo ".: โš™๏ธ Saving new docker image archive to '$(scanner-prefix)-$(scanner).tar'."; \ + docker save $(IMG_NS)/$(scanner-prefix)-$(scanner):$(IMG_TAG) -o $(scanner-prefix)-$(scanner).tar; \ + +kind-import-scanner: + @echo ".: ๐Ÿ’พ Importing the image archive '$(scanner-prefix)-$(scanner).tar' to local kind cluster." + kind load image-archive ./$(scanner-prefix)-$(scanner).tar + +deploy-without-scanner: + @echo ".: ๐Ÿ’พ Deploying '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(scanner) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ + --set="parser.image.tag=$(IMG_TAG)" + +deploy-with-scanner: + @echo ".: ๐Ÿ’พ Deploying '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(scanner) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ + --set="scanner.image.tag=$(IMG_TAG)" + +deploy-test-deps: deploy-test-dep-namespace + +deploy-test-dep-namespace: + # If not exists create namespace where the tests will be executed + kubectl create namespace demo-targets --dry-run=client -o yaml | kubectl apply -f - + +deploy-test-dep-dummy-ssh: + # Install dummy-ssh app + helm -n demo-targets upgrade --install dummy-ssh ../../demo-targets/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait + +deploy-test-dep-unsafe-https: + # Install unsafe-https app + helm -n demo-targets upgrade --install unsafe-https ../../demo-targets/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait + +deploy-test-dep-bodgeit: + # Install bodgeit app + helm -n demo-targets upgrade --install bodgeit ../../demo-targets/bodgeit/ --set="fullnameOverride=bodgeit" --wait + +deploy-test-dep-petstore: + # Install bodgeit app + helm -n demo-targets upgrade --install petstore ../../demo-targets/swagger-petstore/ --set="fullnameOverride=petstore" --wait + +deploy-test-dep-old-wordpress: + # Install old-wordpress app + helm -n demo-targets upgrade --install old-wordpress ../../demo-targets/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait + +deploy-test-dep-juiceshop: + # Install juiceshop app + helm -n demo-targets upgrade --install juiceshop ../../demo-targets/juice-shop/ --set="fullnameOverride=juiceshop" --wait + +deploy-test-dep-nginx: + # Delete leftover nginx's. Unfortunately can't create deployment only if not exists (like namespaces) + kubectl delete deployment nginx --namespace demo-targets --ignore-not-found --wait + kubectl delete svc nginx --namespace demo-targets --ignore-not-found --wait + # Install plain nginx server + kubectl create deployment --image nginx:alpine nginx --namespace demo-targets + kubectl expose deployment nginx --port 80 --namespace demo-targets + +install-integration-test-deps: + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests scanner/${scanner}.test.js + +clean: + @echo ".: ๐Ÿงน Cleaning up all generated files." + rm -f ./$(parser-prefix)-$(scanner).tar + rm -rf ./parser/node_modules + rm -rf ./parser/coverage + rm -rf ./integration-tests/node_modules + rm -rf ./integration-tests/coverage + rm -rf ../node_modules + rm -rf ../coverage From 4a7688531128d80792dc8850ce3fded3c4e610cd Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Wed, 1 Sep 2021 17:20:44 +0200 Subject: [PATCH 02/28] Makefiles: add scanner specific makefiles Signed-off-by: Jop Zitman --- scanners/amass/.gitignore | 4 + scanners/amass/Makefile | 102 +------------------- scanners/angularjs-csti-scanner/.gitignore | 5 + scanners/angularjs-csti-scanner/.helmignore | 44 +++++++-- scanners/angularjs-csti-scanner/Makefile | 12 +++ scanners/git-repo-scanner/.gitignore | 5 + scanners/git-repo-scanner/.helmignore | 44 +++++++-- scanners/git-repo-scanner/Makefile | 12 +++ scanners/gitleaks/.gitignore | 5 + scanners/gitleaks/.helmignore | 42 ++++++-- scanners/gitleaks/Makefile | 12 +++ scanners/kube-hunter/.gitignore | 5 + scanners/kube-hunter/.helmignore | 42 ++++++-- scanners/kube-hunter/Makefile | 12 +++ scanners/kubeaudit/.gitignore | 5 + scanners/kubeaudit/.helmignore | 42 ++++++-- scanners/kubeaudit/Makefile | 27 ++++++ scanners/ncrack/.gitignore | 5 + scanners/ncrack/.helmignore | 42 ++++++-- scanners/ncrack/Makefile | 14 +++ scanners/nikto/.gitignore | 5 + scanners/nikto/.helmignore | 42 ++++++-- scanners/nmap/.gitignore | 5 + scanners/nmap/.helmignore | 42 ++++++-- scanners/nmap/Makefile | 12 +++ scanners/screenshooter/.gitignore | 5 + scanners/screenshooter/.helmignore | 42 ++++++-- scanners/screenshooter/Makefile | 12 +++ scanners/ssh-scan/.gitignore | 5 + scanners/ssh-scan/.helmignore | 42 ++++++-- scanners/ssh-scan/Makefile | 13 +++ scanners/sslyze/.gitignore | 5 + scanners/sslyze/.helmignore | 42 ++++++-- scanners/sslyze/Makefile | 13 +++ scanners/test-scan/.gitignore | 5 + scanners/test-scan/.helmignore | 42 ++++++-- scanners/test-scan/Makefile | 12 +++ scanners/trivy/.gitignore | 5 + scanners/trivy/.helmignore | 42 ++++++-- scanners/trivy/Makefile | 11 +++ scanners/wpscan/.gitignore | 5 + scanners/wpscan/.helmignore | 43 +++++++-- scanners/wpscan/Makefile | 13 +++ scanners/zap-advanced/.gitignore | 3 +- scanners/zap-advanced/.helmignore | 51 +++++++--- scanners/zap-advanced/Makefile | 37 +++++++ scanners/zap/.gitignore | 5 + scanners/zap/.helmignore | 43 +++++++-- scanners/zap/Makefile | 13 +++ 49 files changed, 872 insertions(+), 224 deletions(-) create mode 100644 scanners/angularjs-csti-scanner/.gitignore create mode 100644 scanners/angularjs-csti-scanner/Makefile create mode 100644 scanners/git-repo-scanner/.gitignore create mode 100644 scanners/git-repo-scanner/Makefile create mode 100644 scanners/gitleaks/.gitignore create mode 100644 scanners/gitleaks/Makefile create mode 100644 scanners/kube-hunter/.gitignore create mode 100644 scanners/kube-hunter/Makefile create mode 100644 scanners/kubeaudit/.gitignore create mode 100644 scanners/kubeaudit/Makefile create mode 100644 scanners/ncrack/.gitignore create mode 100644 scanners/ncrack/Makefile create mode 100644 scanners/nikto/.gitignore create mode 100644 scanners/nmap/.gitignore create mode 100644 scanners/nmap/Makefile create mode 100644 scanners/screenshooter/.gitignore create mode 100644 scanners/screenshooter/Makefile create mode 100644 scanners/ssh-scan/.gitignore create mode 100644 scanners/ssh-scan/Makefile create mode 100644 scanners/sslyze/.gitignore create mode 100644 scanners/sslyze/Makefile create mode 100644 scanners/test-scan/.gitignore create mode 100644 scanners/test-scan/Makefile create mode 100644 scanners/trivy/.gitignore create mode 100644 scanners/trivy/Makefile create mode 100644 scanners/wpscan/.gitignore create mode 100644 scanners/wpscan/Makefile create mode 100644 scanners/zap-advanced/Makefile create mode 100644 scanners/zap/.gitignore create mode 100644 scanners/zap/Makefile diff --git a/scanners/amass/.gitignore b/scanners/amass/.gitignore index d874ad67cc..2783dbcddf 100644 --- a/scanners/amass/.gitignore +++ b/scanners/amass/.gitignore @@ -1 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + *.tar diff --git a/scanners/amass/Makefile b/scanners/amass/Makefile index 29ef87974c..6c4ece5958 100644 --- a/scanners/amass/Makefile +++ b/scanners/amass/Makefile @@ -4,109 +4,15 @@ # # SPDX-License-Identifier: Apache-2.0 # -# -# This Makefile is intended to be used for developement and testing only. -# For using this scanner/hook in production please use the helm chart. -# See: -# -# This Makefile expects some additional software to be installed: -# - git -# - node + npm -# - docker -# - kind -# - kubectl -# - helm - -# Thx to https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile -EXECUTABLES = make docker kind git node npm npx kubectl helm -K := $(foreach exec,$(EXECUTABLES),\ - $(if $(shell which $(exec)),some string,$(error "ERROR: The prerequisites are not met to execute this makefile! No '$(exec)' found in your PATH"))) - - -# Variables you might want to override: -# -# IMG_NS: Defines the namespace under which the images are build. -# For `securecodebox/scanner-nmap` `securecodebox` is the namespace -# Defaults to `securecodebox` -# -# BASE_IMG_TAG: Defines the tag of the base image used to build this scanner/hook -# -# IMG_TAG: Tag used to tag the newly created image. Defaults to the shortend commit hash -# prefixed with `sha-` e.g. `sha-ef8de4b7` -# -# JEST_VERSION Defines the jest version used for executing the tests. Defaults to latest -# -# Examples: -# make all IMG_TAG=main -# make deploy IMG_TAG=$(git rev-parse --short HEAD) -# make integration-tests -# - -SHELL = /bin/sh - -IMG_NS ?= securecodebox -GIT_TAG ?= $$(git rev-parse --short HEAD) -BASE_IMG_TAG ?= latest -IMG_TAG ?= "sha-$(GIT_TAG)" -JEST_VERSION ?= latest +include_guard = set scanner = amass -scanner-prefix = scanner -parser-prefix = parser - -build: | install-deps docker-build - -test: | unit-tests docker-export kind-import deploy deploy-test-deps integration-tests - -all: | clean install-deps unit-tests docker-build docker-export kind-import deploy deploy-test-deps integration-tests - -.PHONY: unit-tests install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test - -unit-tests: - @echo ".: ๐Ÿงช Starting unit-tests for '$(scanner)' parser with 'jest@$(JEST_VERSION)'." - cd parser && npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage . - -install-deps: - @echo ".: โš™๏ธ Installing all scanner specific dependencies." - cd ./.. && npm ci - cd ../../parser-sdk/nodejs && npm ci - cd ./parser/ && npm ci - -docker-build: - @echo ".: โš™๏ธ Build With BASE_IMG_TAG: '$(BASE_IMG_TAG)'." - docker build --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -f ./parser/Dockerfile ./parser - -docker-export: - @echo ".: โš™๏ธ Saving new docker image archive to '$(parser-prefix)-$(scanner).tar'." - docker save $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -o $(parser-prefix)-$(scanner).tar - -kind-import: - @echo ".: ๐Ÿ’พ Importing the image archive '$(parser-prefix)-$(scanner).tar' to local kind cluster." - kind load image-archive ./$(parser-prefix)-$(scanner).tar - -deploy: - @echo ".: ๐Ÿ’พ Deploying '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." - helm -n integration-tests upgrade --install $(scanner) ./ --wait \ - --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ - --set="parser.image.tag=$(IMG_TAG)" - -deploy-test-deps: - -install-integration-test-deps: +include ../../scanners.mk integration-tests: @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." kubectl -n integration-tests delete scans --all cd ../../tests/integration/ && npm ci - npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage ./integration-tests - -clean: - @echo ".: ๐Ÿงน Cleaning up all generated files." - rm -f ./$(parser-prefix)-$(scanner).tar - rm -rf ./parser/node_modules - rm -rf ./parser/coverage - rm -rf ./integration-tests/node_modules - rm -rf ./integration-tests/coverage - rm -rf ../node_modules - rm -rf ../coverage + cd ../../scanners/${scanner} + npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests ${scanner}/integration-tests diff --git a/scanners/angularjs-csti-scanner/.gitignore b/scanners/angularjs-csti-scanner/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/angularjs-csti-scanner/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/angularjs-csti-scanner/.helmignore b/scanners/angularjs-csti-scanner/.helmignore index 24bfe82395..fb9c1d2d6f 100644 --- a/scanners/angularjs-csti-scanner/.helmignore +++ b/scanners/angularjs-csti-scanner/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ -Makefile \ No newline at end of file +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* +Makefile diff --git a/scanners/angularjs-csti-scanner/Makefile b/scanners/angularjs-csti-scanner/Makefile new file mode 100644 index 0000000000..1b6157243e --- /dev/null +++ b/scanners/angularjs-csti-scanner/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = angularjs-csti-scanner +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/git-repo-scanner/.gitignore b/scanners/git-repo-scanner/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/git-repo-scanner/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/git-repo-scanner/.helmignore b/scanners/git-repo-scanner/.helmignore index 24bfe82395..fb9c1d2d6f 100644 --- a/scanners/git-repo-scanner/.helmignore +++ b/scanners/git-repo-scanner/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ -Makefile \ No newline at end of file +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* +Makefile diff --git a/scanners/git-repo-scanner/Makefile b/scanners/git-repo-scanner/Makefile new file mode 100644 index 0000000000..7311e086db --- /dev/null +++ b/scanners/git-repo-scanner/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = git-repo-scanner +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/gitleaks/.gitignore b/scanners/gitleaks/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/gitleaks/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/gitleaks/.helmignore b/scanners/gitleaks/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/gitleaks/.helmignore +++ b/scanners/gitleaks/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/gitleaks/Makefile b/scanners/gitleaks/Makefile new file mode 100644 index 0000000000..cd91103cd2 --- /dev/null +++ b/scanners/gitleaks/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = gitleaks +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/kube-hunter/.gitignore b/scanners/kube-hunter/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/kube-hunter/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/kube-hunter/.helmignore b/scanners/kube-hunter/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/kube-hunter/.helmignore +++ b/scanners/kube-hunter/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/kube-hunter/Makefile b/scanners/kube-hunter/Makefile new file mode 100644 index 0000000000..b10d90da53 --- /dev/null +++ b/scanners/kube-hunter/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = kube-hunter +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/kubeaudit/.gitignore b/scanners/kubeaudit/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/kubeaudit/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/kubeaudit/.helmignore b/scanners/kubeaudit/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/kubeaudit/.helmignore +++ b/scanners/kubeaudit/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/kubeaudit/Makefile b/scanners/kubeaudit/Makefile new file mode 100644 index 0000000000..9ab8f1084a --- /dev/null +++ b/scanners/kubeaudit/Makefile @@ -0,0 +1,27 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = kubeaudit +custom_scanner = set + +include ../../scanners.mk + +deploy-with-scanner: + @echo ".: ๐Ÿ’พ Deploying custom '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(scanner) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-zap" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="kubeauditScope=cluster" + +deploy-test-deps: + # If not exists create namespace where the tests will be executed + kubectl create namespace kubeaudit-tests --dry-run=client -o yaml | kubectl apply -f - + # Install jshop in kubeaudit-tests namespace + helm -n kubeaudit-tests upgrade --install juice-shop ../../demo-targets/juice-shop/ --wait diff --git a/scanners/ncrack/.gitignore b/scanners/ncrack/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/ncrack/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/ncrack/.helmignore b/scanners/ncrack/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/ncrack/.helmignore +++ b/scanners/ncrack/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/ncrack/Makefile b/scanners/ncrack/Makefile new file mode 100644 index 0000000000..0457181599 --- /dev/null +++ b/scanners/ncrack/Makefile @@ -0,0 +1,14 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = ncrack +custom_scanner = set + +include ../../scanners.mk + +deploy-test-deps: deploy-test-dep-dummy-ssh diff --git a/scanners/nikto/.gitignore b/scanners/nikto/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/nikto/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/nikto/.helmignore b/scanners/nikto/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/nikto/.helmignore +++ b/scanners/nikto/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/nmap/.gitignore b/scanners/nmap/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/nmap/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/nmap/.helmignore b/scanners/nmap/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/nmap/.helmignore +++ b/scanners/nmap/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/nmap/Makefile b/scanners/nmap/Makefile new file mode 100644 index 0000000000..3a9537d787 --- /dev/null +++ b/scanners/nmap/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = nmap +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/screenshooter/.gitignore b/scanners/screenshooter/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/screenshooter/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/screenshooter/.helmignore b/scanners/screenshooter/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/screenshooter/.helmignore +++ b/scanners/screenshooter/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/screenshooter/Makefile b/scanners/screenshooter/Makefile new file mode 100644 index 0000000000..59364924ef --- /dev/null +++ b/scanners/screenshooter/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = screenshooter +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/ssh-scan/.gitignore b/scanners/ssh-scan/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/ssh-scan/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/ssh-scan/.helmignore b/scanners/ssh-scan/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/ssh-scan/.helmignore +++ b/scanners/ssh-scan/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/ssh-scan/Makefile b/scanners/ssh-scan/Makefile new file mode 100644 index 0000000000..d5bf2c6e00 --- /dev/null +++ b/scanners/ssh-scan/Makefile @@ -0,0 +1,13 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = ssh-scan + +include ../../scanners.mk + +deploy-test-deps: deploy-test-dep-dummy-ssh diff --git a/scanners/sslyze/.gitignore b/scanners/sslyze/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/sslyze/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/sslyze/.helmignore b/scanners/sslyze/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/sslyze/.helmignore +++ b/scanners/sslyze/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/sslyze/Makefile b/scanners/sslyze/Makefile new file mode 100644 index 0000000000..d03720b427 --- /dev/null +++ b/scanners/sslyze/Makefile @@ -0,0 +1,13 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = sslyze + +include ../../scanners.mk + +deploy-test-deps: deploy-test-dep-unsafe-https diff --git a/scanners/test-scan/.gitignore b/scanners/test-scan/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/test-scan/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/test-scan/.helmignore b/scanners/test-scan/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/test-scan/.helmignore +++ b/scanners/test-scan/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/test-scan/Makefile b/scanners/test-scan/Makefile new file mode 100644 index 0000000000..c9535b25a2 --- /dev/null +++ b/scanners/test-scan/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = test-scan +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/trivy/.gitignore b/scanners/trivy/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/trivy/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/trivy/.helmignore b/scanners/trivy/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/trivy/.helmignore +++ b/scanners/trivy/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/trivy/Makefile b/scanners/trivy/Makefile new file mode 100644 index 0000000000..b8a8962f38 --- /dev/null +++ b/scanners/trivy/Makefile @@ -0,0 +1,11 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = trivy + +include ../../scanners.mk diff --git a/scanners/wpscan/.gitignore b/scanners/wpscan/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/wpscan/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/wpscan/.helmignore b/scanners/wpscan/.helmignore index e661d8214b..fb9c1d2d6f 100644 --- a/scanners/wpscan/.helmignore +++ b/scanners/wpscan/.helmignore @@ -1,13 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/wpscan/Makefile b/scanners/wpscan/Makefile new file mode 100644 index 0000000000..19fdf7ccca --- /dev/null +++ b/scanners/wpscan/Makefile @@ -0,0 +1,13 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = wpscan + +include ../../scanners.mk + +deploy-test-deps: deploy-test-dep-old-wordpress diff --git a/scanners/zap-advanced/.gitignore b/scanners/zap-advanced/.gitignore index c342664f17..c8d3087d64 100644 --- a/scanners/zap-advanced/.gitignore +++ b/scanners/zap-advanced/.gitignore @@ -2,4 +2,5 @@ # # SPDX-License-Identifier: Apache-2.0 -/scanner/tests/results/* \ No newline at end of file +*.tar +/scanner/tests/results/* diff --git a/scanners/zap-advanced/.helmignore b/scanners/zap-advanced/.helmignore index b887daa2e3..fb9c1d2d6f 100644 --- a/scanners/zap-advanced/.helmignore +++ b/scanners/zap-advanced/.helmignore @@ -1,21 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -# this doesn't look too good but is required so that the scanners/scripts folder is included -scanner/*.* -scanner/zapclient/ -scanner/tests/ -scanner/venv/ -scanner/.pytest_cache/ -scanner/.idea/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile - -*.monopic diff --git a/scanners/zap-advanced/Makefile b/scanners/zap-advanced/Makefile new file mode 100644 index 0000000000..a962969c10 --- /dev/null +++ b/scanners/zap-advanced/Makefile @@ -0,0 +1,37 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = zap-advanced +custom_scanner = set + +include ../../scanners.mk + +unit-tests-parser: + $(MAKE) -f ../../scanners.mk unit-tests-parser include_guard=set scanner=zap + +install-deps: + cd ../zap/ && $(MAKE) install-deps + +docker-build-parser: + cd ../zap/ && $(MAKE) docker-build-parser + +docker-export-parser: + cd ../zap/ && $(MAKE) docker-export-parser + +kind-import-parser: + cd ../zap/ && $(MAKE) kind-import-parser + +deploy-with-scanner: + @echo ".: ๐Ÿ’พ Deploying custom '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(scanner) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-zap" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ + --set="scanner.image.tag=$(IMG_TAG)" + +deploy-test-deps: deploy-test-dep-nginx deploy-test-dep-bodgeit deploy-test-dep-juiceshop deploy-test-dep-petstore diff --git a/scanners/zap/.gitignore b/scanners/zap/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/zap/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/zap/.helmignore b/scanners/zap/.helmignore index e661d8214b..fb9c1d2d6f 100644 --- a/scanners/zap/.helmignore +++ b/scanners/zap/.helmignore @@ -1,13 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/zap/Makefile b/scanners/zap/Makefile new file mode 100644 index 0000000000..ade80a24c3 --- /dev/null +++ b/scanners/zap/Makefile @@ -0,0 +1,13 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = zap + +include ../../scanners.mk + +deploy-test-deps: deploy-test-dep-nginx From 42e237dc9877343ed0407adfda4cb9fa1165f680 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Wed, 1 Sep 2021 22:45:10 +0200 Subject: [PATCH 03/28] Makefiles: add test-scan integration test Signed-off-by: Jop Zitman --- scanners/test-scan/Makefile | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/scanners/test-scan/Makefile b/scanners/test-scan/Makefile index c9535b25a2..323f2050f2 100644 --- a/scanners/test-scan/Makefile +++ b/scanners/test-scan/Makefile @@ -10,3 +10,20 @@ scanner = test-scan custom_scanner = set include ../../scanners.mk + +deploy-with-scanner: + @echo ".: ๐Ÿ’พ Deploying '$(name)' '$(scanner-prefix)' HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install test-scan . \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(name)" \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(name)" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" \ + --set="parser.env[1].name=PRODUCE_INVALID_FINDINGS" \ + --set-string="parser.env[1].value=true" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests generic/findings-validation.test.js From 2b5b0d5236b873346b1322d69d1ac573e8d41eae Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Wed, 1 Sep 2021 23:15:04 +0200 Subject: [PATCH 04/28] Makefiles: add generic hook and common makefile (sharing with scanner makefile) Signed-off-by: Jop Zitman --- common.mk | 149 ++++++++++++++++++++++++++++++++++++++++++++++++++++ hooks.mk | 32 +++++++++++ scanners.mk | 144 +++++++------------------------------------------- 3 files changed, 200 insertions(+), 125 deletions(-) create mode 100644 common.mk create mode 100644 hooks.mk diff --git a/common.mk b/common.mk new file mode 100644 index 0000000000..d68f1251e6 --- /dev/null +++ b/common.mk @@ -0,0 +1,149 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# +# +# This Makefile is intended to be used for developement and testing only. +# For using this scanner/hook in production please use the helm chart. +# See: +# +# This Makefile expects some additional software to be installed: +# - git +# - node + npm +# - docker +# - kind +# - kubectl +# - helm +# - yq + +ifeq ($(include_guard),) + $(error you should never run this makefile directly!) +endif +ifeq ($(name),) + $(error name ENV is not set) +endif + +# Thx to https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile +EXECUTABLES = make docker kind git node npm npx kubectl helm yq +K := $(foreach exec,$(EXECUTABLES),\ + $(if $(shell which $(exec)),some string,$(error "ERROR: The prerequisites are not met to execute this makefile! No '$(exec)' found in your PATH"))) + +# Variables you might want to override: +# +# IMG_NS: Defines the namespace under which the images are build. +# For `securecodebox/scanner-nmap` `securecodebox` is the namespace +# Defaults to `securecodebox` +# +# BASE_IMG_TAG: Defines the tag of the base image used to build this scanner/hook +# +# IMG_TAG: Tag used to tag the newly created image. Defaults to the shortend commit hash +# prefixed with `sha-` e.g. `sha-ef8de4b7` +# +# JEST_VERSION Defines the jest version used for executing the tests. Defaults to latest +# +# Examples: +# make all IMG_TAG=main +# make deploy IMG_TAG=$(git rev-parse --short HEAD) +# make integration-tests +# + +SHELL = /bin/sh + +IMG_NS ?= securecodebox +GIT_TAG ?= $$(git rev-parse --short HEAD) +BASE_IMG_TAG ?= latest +IMG_TAG ?= "sha-$(GIT_TAG)" +JEST_VERSION ?= latest + +parser-prefix = parser +scanner-prefix = scanner +hook-prefix = hook + +test: | unit-tests docker-build docker-export kind-import deploy deploy-test-deps integration-tests + +.PHONY: help unit-tests-hook install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test + +install-deps-js: + @echo ".: โš™๏ธ Installing all $(module) specific dependencies." + cd ./.. && npm ci + cd ../../${module}-sdk/nodejs && npm ci + cd ./${module}/ && npm ci + +unit-test-js: install-deps-js + @echo ".: ๐Ÿงช Starting unit-tests for '$(name)' $(module) with 'jest@$(JEST_VERSION)'." + npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage --passWithNoTests ${name}/${module}/ + +common-docker-build: + @echo ".: โš™๏ธ Build '$(name)' $(module) with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." + docker build --build-arg=scannerVersion=$(shell yq e .appVersion ./Chart.yaml) --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(module)-$(name):$(IMG_TAG) -f ./$(module)/Dockerfile ./$(module) + +common-docker-export: + @echo ".: โš™๏ธ Saving new docker image archive to '$(module)-$(name).tar'." + docker save $(IMG_NS)/$(module)-$(name):$(IMG_TAG) -o $(module)-$(name).tar + +common-kind-import: + @echo ".: ๐Ÿ’พ Importing the image archive '$(module)-$(name).tar' to local kind cluster." + kind load image-archive ./$(module)-$(name).tar + +deploy-test-deps: deploy-test-dep-namespace + +deploy-test-dep-namespace: + # If not exists create namespace where the tests will be executed + kubectl create namespace demo-targets --dry-run=client -o yaml | kubectl apply -f - + +deploy-test-dep-dummy-ssh: + # Install dummy-ssh app + helm -n demo-targets upgrade --install dummy-ssh ../../demo-targets/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait + +deploy-test-dep-unsafe-https: + # Install unsafe-https app + helm -n demo-targets upgrade --install unsafe-https ../../demo-targets/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait + +deploy-test-dep-bodgeit: + # Install bodgeit app + helm -n demo-targets upgrade --install bodgeit ../../demo-targets/bodgeit/ --set="fullnameOverride=bodgeit" --wait + +deploy-test-dep-petstore: + # Install bodgeit app + helm -n demo-targets upgrade --install petstore ../../demo-targets/swagger-petstore/ --set="fullnameOverride=petstore" --wait + +deploy-test-dep-old-wordpress: + # Install old-wordpress app + helm -n demo-targets upgrade --install old-wordpress ../../demo-targets/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait + +deploy-test-dep-juiceshop: + # Install juiceshop app + helm -n demo-targets upgrade --install juiceshop ../../demo-targets/juice-shop/ --set="fullnameOverride=juiceshop" --wait + +deploy-test-dep-nginx: + # Delete leftover nginx's. Unfortunately can't create deployment only if not exists (like namespaces) + kubectl delete deployment nginx --namespace demo-targets --ignore-not-found --wait + kubectl delete svc nginx --namespace demo-targets --ignore-not-found --wait + # Install plain nginx server + kubectl create deployment --image nginx:alpine nginx --namespace demo-targets + kubectl expose deployment nginx --port 80 --namespace demo-targets + +deploy-test-dep-http-webhook: + helm -n integration-tests upgrade --install http-webhook ../../demo-targets/http-webhook/ + +deploy-test-dep-test-scan: + cd ../../scanners/test-scan/ && $(MAKE) docker-build docker-export kind-import && \ + helm -n integration-tests upgrade --install test-scan . \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-test-scan" \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-test-scan" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" + +clean: + @echo ".: ๐Ÿงน Cleaning up all generated files." + rm -f ./$(module)-$(name).tar + rm -rf ./$(module)/node_modules + rm -rf ./$(module)/coverage + rm -rf ./integration-tests/node_modules + rm -rf ./integration-tests/coverage + rm -rf ../node_modules + rm -rf ../coverage diff --git a/hooks.mk b/hooks.mk new file mode 100644 index 0000000000..5815f24de1 --- /dev/null +++ b/hooks.mk @@ -0,0 +1,32 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# +# +# This Makefile is intended to be used for developement and testing only. +# For using this scanner/hook in production please use the helm chart. +# See: +# +# This Makefile expects some additional software to be installed: +# - git +# - node + npm +# - docker +# - kind +# - kubectl +# - helm +# - yq + +module = hook +prefix = hook +name = ${hook} + +include ../../common.mk + +docker-build: | common-docker-build +docker-export: | common-docker-export +kind-import: | common-kind-import + +unit-tests: + @$(MAKE) -s unit-test-js module=$(hook-prefix) diff --git a/scanners.mk b/scanners.mk index b3afc1a151..55da86dcec 100644 --- a/scanners.mk +++ b/scanners.mk @@ -18,48 +18,9 @@ # - helm # - yq -ifeq ($(include_guard),) - $(error you should never run this makefile directly!) -endif -ifeq ($(scanner),) - $(error scanner ENV is not set) -endif - -# Thx to https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile -EXECUTABLES = make docker kind git node npm npx kubectl helm yq -K := $(foreach exec,$(EXECUTABLES),\ - $(if $(shell which $(exec)),some string,$(error "ERROR: The prerequisites are not met to execute this makefile! No '$(exec)' found in your PATH"))) - - -# Variables you might want to override: -# -# IMG_NS: Defines the namespace under which the images are build. -# For `securecodebox/scanner-nmap` `securecodebox` is the namespace -# Defaults to `securecodebox` -# -# BASE_IMG_TAG: Defines the tag of the base image used to build this scanner/hook -# -# IMG_TAG: Tag used to tag the newly created image. Defaults to the shortend commit hash -# prefixed with `sha-` e.g. `sha-ef8de4b7` -# -# JEST_VERSION Defines the jest version used for executing the tests. Defaults to latest -# -# Examples: -# make all IMG_TAG=main -# make deploy IMG_TAG=$(git rev-parse --short HEAD) -# make integration-tests -# +name = ${scanner} -SHELL = /bin/sh - -IMG_NS ?= securecodebox -GIT_TAG ?= $$(git rev-parse --short HEAD) -BASE_IMG_TAG ?= latest -IMG_TAG ?= "sha-$(GIT_TAG)" -JEST_VERSION ?= latest - -scanner-prefix = scanner -parser-prefix = parser +include ../../common.mk ifeq ($(custom_scanner),) docker-build: | docker-build-parser @@ -73,112 +34,45 @@ else deploy: deploy-with-scanner endif - -test: | unit-tests-parser docker-build docker-export kind-import deploy deploy-test-deps integration-tests - -all: | clean install-deps unit-tests-parser docker-build docker-export kind-import deploy deploy-test-deps integration-tests - -.PHONY: unit-tests-parser install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test - -unit-tests-parser: - @echo ".: ๐Ÿงช Starting unit-tests for '$(scanner)' parser with 'jest@$(JEST_VERSION)'." - npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage --passWithNoTests ${scanner}/parser/ +unit-tests: + @$(MAKE) -s unit-test-js module=$(parser-prefix) install-deps: - @echo ".: โš™๏ธ Installing all scanner specific dependencies." - cd ./.. && npm ci - cd ../../parser-sdk/nodejs && npm ci - cd ./parser/ && npm ci + @$(MAKE) -s install-deps-js module=$(parser-prefix) docker-build-parser: - @echo ".: โš™๏ธ Build parser with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." - docker build --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -f ./parser/Dockerfile ./parser + @$(MAKE) -s common-docker-build module=$(parser-prefix) docker-export-parser: - @echo ".: โš™๏ธ Saving new docker image archive to '$(parser-prefix)-$(scanner).tar'." - docker save $(IMG_NS)/$(parser-prefix)-$(scanner):$(IMG_TAG) -o $(parser-prefix)-$(scanner).tar + @$(MAKE) -s common-docker-export module=$(parser-prefix) kind-import-parser: - @echo ".: ๐Ÿ’พ Importing the image archive '$(parser-prefix)-$(scanner).tar' to local kind cluster." - kind load image-archive ./$(parser-prefix)-$(scanner).tar + @$(MAKE) -s common-kind-import module=$(parser-prefix) docker-build-scanner: - @echo ".: โš™๏ธ Build custom scanner with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." - docker build --build-arg=scannerVersion=$(shell yq e .appVersion ./Chart.yaml) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(scanner-prefix)-$(scanner):$(IMG_TAG) -f ./scanner/Dockerfile ./scanner + @$(MAKE) -s common-docker-build module=$(scanner-prefix) docker-export-scanner: - @echo ".: โš™๏ธ Saving new docker image archive to '$(scanner-prefix)-$(scanner).tar'."; \ - docker save $(IMG_NS)/$(scanner-prefix)-$(scanner):$(IMG_TAG) -o $(scanner-prefix)-$(scanner).tar; \ + @$(MAKE) -s common-docker-export module=$(scanner-prefix) kind-import-scanner: - @echo ".: ๐Ÿ’พ Importing the image archive '$(scanner-prefix)-$(scanner).tar' to local kind cluster." - kind load image-archive ./$(scanner-prefix)-$(scanner).tar + @$(MAKE) -s common-kind-import module=$(scanner-prefix) deploy-without-scanner: - @echo ".: ๐Ÿ’พ Deploying '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." - helm -n integration-tests upgrade --install $(scanner) ./ --wait \ - --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(scanner-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(name) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(name)" \ --set="parser.image.tag=$(IMG_TAG)" deploy-with-scanner: - @echo ".: ๐Ÿ’พ Deploying '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." - helm -n integration-tests upgrade --install $(scanner) ./ --wait \ - --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(scanner-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(name) ./ --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(name)" \ --set="parser.image.tag=$(IMG_TAG)" \ - --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(name)" \ --set="scanner.image.tag=$(IMG_TAG)" -deploy-test-deps: deploy-test-dep-namespace - -deploy-test-dep-namespace: - # If not exists create namespace where the tests will be executed - kubectl create namespace demo-targets --dry-run=client -o yaml | kubectl apply -f - - -deploy-test-dep-dummy-ssh: - # Install dummy-ssh app - helm -n demo-targets upgrade --install dummy-ssh ../../demo-targets/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait - -deploy-test-dep-unsafe-https: - # Install unsafe-https app - helm -n demo-targets upgrade --install unsafe-https ../../demo-targets/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait - -deploy-test-dep-bodgeit: - # Install bodgeit app - helm -n demo-targets upgrade --install bodgeit ../../demo-targets/bodgeit/ --set="fullnameOverride=bodgeit" --wait - -deploy-test-dep-petstore: - # Install bodgeit app - helm -n demo-targets upgrade --install petstore ../../demo-targets/swagger-petstore/ --set="fullnameOverride=petstore" --wait - -deploy-test-dep-old-wordpress: - # Install old-wordpress app - helm -n demo-targets upgrade --install old-wordpress ../../demo-targets/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait - -deploy-test-dep-juiceshop: - # Install juiceshop app - helm -n demo-targets upgrade --install juiceshop ../../demo-targets/juice-shop/ --set="fullnameOverride=juiceshop" --wait - -deploy-test-dep-nginx: - # Delete leftover nginx's. Unfortunately can't create deployment only if not exists (like namespaces) - kubectl delete deployment nginx --namespace demo-targets --ignore-not-found --wait - kubectl delete svc nginx --namespace demo-targets --ignore-not-found --wait - # Install plain nginx server - kubectl create deployment --image nginx:alpine nginx --namespace demo-targets - kubectl expose deployment nginx --port 80 --namespace demo-targets - -install-integration-test-deps: - integration-tests: @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." kubectl -n integration-tests delete scans --all - cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests scanner/${scanner}.test.js - -clean: - @echo ".: ๐Ÿงน Cleaning up all generated files." - rm -f ./$(parser-prefix)-$(scanner).tar - rm -rf ./parser/node_modules - rm -rf ./parser/coverage - rm -rf ./integration-tests/node_modules - rm -rf ./integration-tests/coverage - rm -rf ../node_modules - rm -rf ../coverage + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests ${scanner-prefix}/${name}.test.js From 33a47c0438cf41f7feaf5563ae02b3df0c55083d Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Wed, 1 Sep 2021 23:15:53 +0200 Subject: [PATCH 05/28] Makefiles: implement update-field and generic-webhook makefiles (covering all generic integration tests) Signed-off-by: Jop Zitman --- hooks/generic-webhook/.helmignore | 7 +++---- hooks/generic-webhook/Makefile | 26 ++++++++++++++++++++++++++ hooks/update-field/.helmignore | 7 +++---- hooks/update-field/Makefile | 31 +++++++++++++++++++++++++++++++ 4 files changed, 63 insertions(+), 8 deletions(-) create mode 100644 hooks/generic-webhook/Makefile create mode 100644 hooks/update-field/Makefile diff --git a/hooks/generic-webhook/.helmignore b/hooks/generic-webhook/.helmignore index 8b8e4f4170..13b0d2f116 100644 --- a/hooks/generic-webhook/.helmignore +++ b/hooks/generic-webhook/.helmignore @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - # Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. @@ -32,9 +31,9 @@ src/* config/* Dockerfile .dockerignore -docs/* +*.tar hook/* integration-tests/* examples/* -coverage/* -Makefile \ No newline at end of file +docs/* +Makefile diff --git a/hooks/generic-webhook/Makefile b/hooks/generic-webhook/Makefile new file mode 100644 index 0000000000..3a3eeeea34 --- /dev/null +++ b/hooks/generic-webhook/Makefile @@ -0,0 +1,26 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = generic-webhook + +include ../../hooks.mk + + +deploy-test-deps: deploy-test-dep-http-webhook deploy-test-dep-test-scan + +deploy: + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install ro-hook . \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" \ + --set="webhookUrl=http://http-webhook/hallo-welt" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests generic/read-write-hook.test.js diff --git a/hooks/update-field/.helmignore b/hooks/update-field/.helmignore index 8b8e4f4170..13b0d2f116 100644 --- a/hooks/update-field/.helmignore +++ b/hooks/update-field/.helmignore @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - # Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. @@ -32,9 +31,9 @@ src/* config/* Dockerfile .dockerignore -docs/* +*.tar hook/* integration-tests/* examples/* -coverage/* -Makefile \ No newline at end of file +docs/* +Makefile diff --git a/hooks/update-field/Makefile b/hooks/update-field/Makefile new file mode 100644 index 0000000000..a79225bb5b --- /dev/null +++ b/hooks/update-field/Makefile @@ -0,0 +1,31 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = update-field + +include ../../hooks.mk + +deploy-test-deps: deploy-test-dep-test-scan + +deploy: + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install update-category . --wait \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" \ + --set="attribute.name=category" \ + --set="attribute.value=fancy-category" + helm -n integration-tests upgrade --install update-severity . --wait \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" \ + --set="attribute.name=severity" \ + --set="attribute.value=high" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests generic/read-write-hook.test.js From 69e9de90ece585065aa07a389526908c3cf18e93 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 12:53:08 +0200 Subject: [PATCH 06/28] Makefiles: implement notification hook makefile Signed-off-by: Jop Zitman --- hooks/notification/.helmignore | 2 +- hooks/notification/Makefile | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 hooks/notification/Makefile diff --git a/hooks/notification/.helmignore b/hooks/notification/.helmignore index e6386b0850..59e402ece3 100644 --- a/hooks/notification/.helmignore +++ b/hooks/notification/.helmignore @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - # Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. @@ -33,6 +32,7 @@ config/* Dockerfile .dockerignore docs/* +*.tar hook/* integration-tests/* examples/* diff --git a/hooks/notification/Makefile b/hooks/notification/Makefile new file mode 100644 index 0000000000..eb5fd0c684 --- /dev/null +++ b/hooks/notification/Makefile @@ -0,0 +1,26 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = notification + +include ../../hooks.mk + +deploy-test-deps: deploy-test-dep-test-scan deploy-test-dep-http-webhook + +deploy: + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install notification-hook . \ + --values ../../tests/integration/hooks/__testFiles__/notification-values.yaml \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" \ + --set="hook.image.pullPolicy=Never" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests hooks/notification.test.js From 942476d02e68b7831b116678510571e1509eabb5 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 13:49:47 +0200 Subject: [PATCH 07/28] Makefiles: implement cascading-scans hook makefile & move its tests to the integration-tests namespace Signed-off-by: Jop Zitman --- hooks/cascading-scans/.helmignore | 1 + hooks/cascading-scans/Makefile | 68 +++++++++++++++++++ tests/integration/helpers.js | 2 - .../scanner/cascade-nmap-sslyze.test.js | 2 +- 4 files changed, 70 insertions(+), 3 deletions(-) create mode 100644 hooks/cascading-scans/Makefile diff --git a/hooks/cascading-scans/.helmignore b/hooks/cascading-scans/.helmignore index c675d2c530..b2af8e6080 100644 --- a/hooks/cascading-scans/.helmignore +++ b/hooks/cascading-scans/.helmignore @@ -33,6 +33,7 @@ config/* Dockerfile .dockerignore docs/* +*.tar hook/* integration-tests/* examples/* diff --git a/hooks/cascading-scans/Makefile b/hooks/cascading-scans/Makefile new file mode 100644 index 0000000000..efe84f6d85 --- /dev/null +++ b/hooks/cascading-scans/Makefile @@ -0,0 +1,68 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = cascading-scans + +include ../../hooks.mk + +test-2: | unit-tests docker-build docker-export kind-import deploy deploy-test-deps-2 integration-tests-2 + +deploy-test-dep-nmap: + cd ../../scanners/nmap/ && $(MAKE) -s docker-build docker-export kind-import && \ + helm -n integration-tests upgrade --install nmap . \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-nmap" \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-nmap" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" + +deploy-test-dep-ncrack: + printf "root\nadmin\n" > users.txt + printf "THEPASSWORDYOUCREATED\n123456\npassword\n" > passwords.txt + kubectl create secret generic --from-file users.txt --from-file passwords.txt ncrack-lists -n integration-tests --dry-run=client -o yaml | kubectl apply -f - + cd ../../scanners/ncrack/ && $(MAKE) -s docker-build docker-export kind-import && \ + helm -n integration-tests upgrade --install ncrack . \ + --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-ncrack" \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-ncrack" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="scanner.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" \ + --set="scanner.extraVolumes[0].name=ncrack-lists" \ + --set="scanner.extraVolumes[0].secret.secretName=ncrack-lists" \ + --set="scanner.extraVolumeMounts[0].name=ncrack-lists" \ + --set="scanner.extraVolumeMounts[0].mountPath=/ncrack/" + +deploy-test-dep-sslyze: + cd ../../scanners/sslyze/ && $(MAKE) -s docker-build docker-export kind-import && \ + helm -n integration-tests upgrade --install sslyze . --wait \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-sslyze" \ + --set="parser.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" + +deploy-test-deps: deploy-test-dep-nmap deploy-test-dep-ncrack + +deploy: + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'cascading-scans'." + helm -n integration-tests upgrade --install dssh . --wait \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'cascading-scans'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests scanner/cascade-nmap-ncrack.test.js + +deploy-test-deps-2: deploy-test-dep-unsafe-https deploy-test-dep-nmap deploy-test-dep-sslyze + +integration-tests-2: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'cascading-scans'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests scanner/cascade-nmap-sslyze.test.js diff --git a/tests/integration/helpers.js b/tests/integration/helpers.js index 66fafae9a5..10028f3285 100644 --- a/tests/integration/helpers.js +++ b/tests/integration/helpers.js @@ -173,8 +173,6 @@ async function scan(name, scanType, parameters = [], timeout = 180) { * @returns {scan.findings} returns findings { categories, severities, count } */ async function cascadingScan(name, scanType, parameters = [], { nameCascade, matchLabels }, timeout = 180) { - namespace = "cascading-tests"; - const scanDefinition = { apiVersion: "execution.securecodebox.io/v1", kind: "Scan", diff --git a/tests/integration/scanner/cascade-nmap-sslyze.test.js b/tests/integration/scanner/cascade-nmap-sslyze.test.js index 2ddb83995c..1d4eab7737 100644 --- a/tests/integration/scanner/cascade-nmap-sslyze.test.js +++ b/tests/integration/scanner/cascade-nmap-sslyze.test.js @@ -12,7 +12,7 @@ test( const { categories, severities, count } = await cascadingScan( "nmap-unsafe-https-sslyze", "nmap", - ["-Pn", "-sV", "unsafe-https", "-p", "443"], + ["-Pn", "-sV", "unsafe-https.demo-targets.svc", "-p", "443"], { nameCascade: "https-tls-scan", matchLabels: { From a27aff141ea59f562e9de7445998d430ed0c1920 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 13:58:37 +0200 Subject: [PATCH 08/28] Makefiles: add kubernetes cleanup targets Signed-off-by: Jop Zitman --- common.mk | 12 +++++++++++- hooks/cascading-scans/Makefile | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/common.mk b/common.mk index d68f1251e6..33639897c4 100644 --- a/common.mk +++ b/common.mk @@ -61,7 +61,7 @@ parser-prefix = parser scanner-prefix = scanner hook-prefix = hook -test: | unit-tests docker-build docker-export kind-import deploy deploy-test-deps integration-tests +test: | clean-integration-tests unit-tests docker-build docker-export kind-import deploy deploy-test-deps integration-tests .PHONY: help unit-tests-hook install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test @@ -147,3 +147,13 @@ clean: rm -rf ./integration-tests/coverage rm -rf ../node_modules rm -rf ../coverage + +clean-integration-tests: + @echo ".: ๐Ÿงน Resetting 'integration-tests' namespace" + kubectl delete namespace integration-tests --wait || true + kubectl create namespace integration-tests + +clean-demo-targets: + @echo ".: ๐Ÿงน Resetting 'demo-targets' namespace" + kubectl delete namespace demo-targets --wait || true + kubectl create namespace demo-targets diff --git a/hooks/cascading-scans/Makefile b/hooks/cascading-scans/Makefile index efe84f6d85..c28c857eb0 100644 --- a/hooks/cascading-scans/Makefile +++ b/hooks/cascading-scans/Makefile @@ -10,7 +10,7 @@ hook = cascading-scans include ../../hooks.mk -test-2: | unit-tests docker-build docker-export kind-import deploy deploy-test-deps-2 integration-tests-2 +test-2: | clean-integration-tests unit-tests docker-build docker-export kind-import deploy deploy-test-deps-2 integration-tests-2 deploy-test-dep-nmap: cd ../../scanners/nmap/ && $(MAKE) -s docker-build docker-export kind-import && \ From 25d174cc9e6ac34f4bc04c475cee62137584cea7 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 14:10:03 +0200 Subject: [PATCH 09/28] Makefiles: add default makefiles for hooks without integration tests Signed-off-by: Jop Zitman --- hooks.mk | 11 +++++++++++ hooks/finding-post-processing/.helmignore | 2 +- hooks/finding-post-processing/Makefile | 11 +++++++++++ hooks/persistence-defectdojo/.helmignore | 14 ++------------ hooks/persistence-defectdojo/Makefile | 11 +++++++++++ hooks/persistence-elastic/.gitignore | 3 ++- hooks/persistence-elastic/.helmignore | 3 +-- hooks/persistence-elastic/Makefile | 11 +++++++++++ 8 files changed, 50 insertions(+), 16 deletions(-) create mode 100644 hooks/finding-post-processing/Makefile create mode 100644 hooks/persistence-defectdojo/Makefile create mode 100644 hooks/persistence-elastic/Makefile diff --git a/hooks.mk b/hooks.mk index 5815f24de1..89d9231860 100644 --- a/hooks.mk +++ b/hooks.mk @@ -30,3 +30,14 @@ kind-import: | common-kind-import unit-tests: @$(MAKE) -s unit-test-js module=$(hook-prefix) + +deploy: + @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." + helm -n integration-tests upgrade --install $(name) . --wait \ + --set="hook.image.repository=docker.io/$(IMG_NS)/$(hook-prefix)-$(name)" \ + --set="hook.image.tag=$(IMG_TAG)" + +integration-tests: + @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." + kubectl -n integration-tests delete scans --all + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests hooks/$(name)-$(hook-prefix).test.js diff --git a/hooks/finding-post-processing/.helmignore b/hooks/finding-post-processing/.helmignore index c675d2c530..a166d1464d 100644 --- a/hooks/finding-post-processing/.helmignore +++ b/hooks/finding-post-processing/.helmignore @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - # Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. @@ -33,6 +32,7 @@ config/* Dockerfile .dockerignore docs/* +*.tar hook/* integration-tests/* examples/* diff --git a/hooks/finding-post-processing/Makefile b/hooks/finding-post-processing/Makefile new file mode 100644 index 0000000000..a246e30c5f --- /dev/null +++ b/hooks/finding-post-processing/Makefile @@ -0,0 +1,11 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = finding-post-processing + +include ../../hooks.mk diff --git a/hooks/persistence-defectdojo/.helmignore b/hooks/persistence-defectdojo/.helmignore index 2a4062abcb..b2af8e6080 100644 --- a/hooks/persistence-defectdojo/.helmignore +++ b/hooks/persistence-defectdojo/.helmignore @@ -32,20 +32,10 @@ src/* config/* Dockerfile .dockerignore -gradle/ -.gradle/ -.settings/ -bin/ -build/ -src/ -gradlew -gradlew.bat -settings.gradle -update.sh -build/ docs/* +*.tar hook/* integration-tests/* examples/* coverage/* -Makefile \ No newline at end of file +Makefile diff --git a/hooks/persistence-defectdojo/Makefile b/hooks/persistence-defectdojo/Makefile new file mode 100644 index 0000000000..23d5151684 --- /dev/null +++ b/hooks/persistence-defectdojo/Makefile @@ -0,0 +1,11 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = persistence-defectdojo + +include ../../hooks.mk diff --git a/hooks/persistence-elastic/.gitignore b/hooks/persistence-elastic/.gitignore index 8d754920ee..b2ced8602b 100644 --- a/hooks/persistence-elastic/.gitignore +++ b/hooks/persistence-elastic/.gitignore @@ -2,4 +2,5 @@ # # SPDX-License-Identifier: Apache-2.0 -node_modules/ +node_modules + diff --git a/hooks/persistence-elastic/.helmignore b/hooks/persistence-elastic/.helmignore index d97d8f3052..a166d1464d 100644 --- a/hooks/persistence-elastic/.helmignore +++ b/hooks/persistence-elastic/.helmignore @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 - # Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. @@ -33,9 +32,9 @@ config/* Dockerfile .dockerignore docs/* +*.tar hook/* integration-tests/* examples/* coverage/* -dashboardImporter/* Makefile diff --git a/hooks/persistence-elastic/Makefile b/hooks/persistence-elastic/Makefile new file mode 100644 index 0000000000..10febce9e5 --- /dev/null +++ b/hooks/persistence-elastic/Makefile @@ -0,0 +1,11 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +hook = persistence-elastic + +include ../../hooks.mk From 315668f390677968aafe256916e5bdfc0dd2e2ab Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 14:26:43 +0200 Subject: [PATCH 10/28] Makefiles: add pytest Signed-off-by: Jop Zitman --- common.mk | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/common.mk b/common.mk index 33639897c4..8cf45c6604 100644 --- a/common.mk +++ b/common.mk @@ -66,7 +66,7 @@ test: | clean-integration-tests unit-tests docker-build docker-export kind-impor .PHONY: help unit-tests-hook install-deps docker-build docker-export kind-import deploy deploy-test-deps integration-tests all build test install-deps-js: - @echo ".: โš™๏ธ Installing all $(module) specific dependencies." + @echo ".: โš™๏ธ Installing all $(module) specific javascript dependencies." cd ./.. && npm ci cd ../../${module}-sdk/nodejs && npm ci cd ./${module}/ && npm ci @@ -75,6 +75,14 @@ unit-test-js: install-deps-js @echo ".: ๐Ÿงช Starting unit-tests for '$(name)' $(module) with 'jest@$(JEST_VERSION)'." npx --yes --package jest@$(JEST_VERSION) jest --ci --colors --coverage --passWithNoTests ${name}/${module}/ +install-deps-py: + @echo ".: โš™๏ธ Installing all $(module) specific python dependencies." + python -m pip install --upgrade pip setuptools wheel pytest + cd ./$(module)/ && pip install -r requirements.txt + +unit-test-py: install-deps-py + pytest --ignore-glob='*_local.py' --ignore=tests/docker ./$(module) + common-docker-build: @echo ".: โš™๏ธ Build '$(name)' $(module) with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." docker build --build-arg=scannerVersion=$(shell yq e .appVersion ./Chart.yaml) --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(module)-$(name):$(IMG_TAG) -f ./$(module)/Dockerfile ./$(module) From 552969b83c147298f09710a30e48b64a3f96cfaf Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 14:27:07 +0200 Subject: [PATCH 11/28] Makefiles: refactor module variable Signed-off-by: Jop Zitman --- hooks.mk | 4 +++- scanners.mk | 8 +++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/hooks.mk b/hooks.mk index 89d9231860..3a55ee62dd 100644 --- a/hooks.mk +++ b/hooks.mk @@ -24,12 +24,14 @@ name = ${hook} include ../../common.mk +module = $(hook-prefix) + docker-build: | common-docker-build docker-export: | common-docker-export kind-import: | common-kind-import unit-tests: - @$(MAKE) -s unit-test-js module=$(hook-prefix) + @$(MAKE) -s unit-test-js deploy: @echo ".: ๐Ÿ’พ Deploying '$(name)' $(hook-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." diff --git a/scanners.mk b/scanners.mk index 55da86dcec..4ba48bac78 100644 --- a/scanners.mk +++ b/scanners.mk @@ -22,6 +22,8 @@ name = ${scanner} include ../../common.mk +module = $(scanner-prefix) + ifeq ($(custom_scanner),) docker-build: | docker-build-parser docker-export: | docker-export-parser @@ -50,13 +52,13 @@ kind-import-parser: @$(MAKE) -s common-kind-import module=$(parser-prefix) docker-build-scanner: - @$(MAKE) -s common-docker-build module=$(scanner-prefix) + @$(MAKE) -s common-docker-build docker-export-scanner: - @$(MAKE) -s common-docker-export module=$(scanner-prefix) + @$(MAKE) -s common-docker-export kind-import-scanner: - @$(MAKE) -s common-kind-import module=$(scanner-prefix) + @$(MAKE) -s common-kind-import deploy-without-scanner: @echo ".: ๐Ÿ’พ Deploying '$(name)' $(scanner-prefix) HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." From 4f800f1ad2fac1920afdaf995273772ed520dfa3 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 20:34:51 +0200 Subject: [PATCH 12/28] Makefiles: change workdir for python unit tests Signed-off-by: Jop Zitman --- common.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common.mk b/common.mk index 8cf45c6604..eded4ea4ed 100644 --- a/common.mk +++ b/common.mk @@ -81,7 +81,7 @@ install-deps-py: cd ./$(module)/ && pip install -r requirements.txt unit-test-py: install-deps-py - pytest --ignore-glob='*_local.py' --ignore=tests/docker ./$(module) + cd ./$(module)/ && pytest --ignore-glob='*_local.py' --ignore=tests/docker common-docker-build: @echo ".: โš™๏ธ Build '$(name)' $(module) with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." From 381e63fdccea1c46a9dc705c44f5d08de817ac19 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 20:39:02 +0200 Subject: [PATCH 13/28] Makefiles: add python unit tests to git-repo-scanner and zap Signed-off-by: Jop Zitman --- scanners/git-repo-scanner/Makefile | 3 +++ scanners/zap-advanced/Makefile | 3 +++ 2 files changed, 6 insertions(+) diff --git a/scanners/git-repo-scanner/Makefile b/scanners/git-repo-scanner/Makefile index 7311e086db..982468f0c7 100644 --- a/scanners/git-repo-scanner/Makefile +++ b/scanners/git-repo-scanner/Makefile @@ -10,3 +10,6 @@ scanner = git-repo-scanner custom_scanner = set include ../../scanners.mk + +unit-tests: + @$(MAKE) -s unit-test-py diff --git a/scanners/zap-advanced/Makefile b/scanners/zap-advanced/Makefile index a962969c10..f505bc538b 100644 --- a/scanners/zap-advanced/Makefile +++ b/scanners/zap-advanced/Makefile @@ -11,6 +11,9 @@ custom_scanner = set include ../../scanners.mk +unit-tests: + @$(MAKE) -s unit-test-py + unit-tests-parser: $(MAKE) -f ../../scanners.mk unit-tests-parser include_guard=set scanner=zap From 5c48966dd670a89e0700e30e53250063ab90d0d1 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 20:43:00 +0200 Subject: [PATCH 14/28] Makefiles: add java unit tests to defectdojo persistence hook Signed-off-by: Jop Zitman --- common.mk | 3 +++ hooks/persistence-defectdojo/Makefile | 3 +++ 2 files changed, 6 insertions(+) diff --git a/common.mk b/common.mk index eded4ea4ed..443207e513 100644 --- a/common.mk +++ b/common.mk @@ -83,6 +83,9 @@ install-deps-py: unit-test-py: install-deps-py cd ./$(module)/ && pytest --ignore-glob='*_local.py' --ignore=tests/docker +unit-test-java: + cd ./$(module)/ && ./gradlew test + common-docker-build: @echo ".: โš™๏ธ Build '$(name)' $(module) with BASE_IMG_TAG: '$(BASE_IMG_TAG)'." docker build --build-arg=scannerVersion=$(shell yq e .appVersion ./Chart.yaml) --build-arg=baseImageTag=$(BASE_IMG_TAG) --build-arg=namespace=$(IMG_NS) -t $(IMG_NS)/$(module)-$(name):$(IMG_TAG) -f ./$(module)/Dockerfile ./$(module) diff --git a/hooks/persistence-defectdojo/Makefile b/hooks/persistence-defectdojo/Makefile index 23d5151684..a5285ce29b 100644 --- a/hooks/persistence-defectdojo/Makefile +++ b/hooks/persistence-defectdojo/Makefile @@ -9,3 +9,6 @@ include_guard = set hook = persistence-defectdojo include ../../hooks.mk + +unit-tests: + @$(MAKE) -s unit-test-java From 7422725c2ec949157f8e53f5b049a0e7e3674881 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 20:43:43 +0200 Subject: [PATCH 15/28] Makefiles: add java & python executables to requirements Signed-off-by: Jop Zitman --- common.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common.mk b/common.mk index 443207e513..79de838af8 100644 --- a/common.mk +++ b/common.mk @@ -26,7 +26,7 @@ ifeq ($(name),) endif # Thx to https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile -EXECUTABLES = make docker kind git node npm npx kubectl helm yq +EXECUTABLES = make docker kind git node npm npx kubectl helm yq java python K := $(foreach exec,$(EXECUTABLES),\ $(if $(shell which $(exec)),some string,$(error "ERROR: The prerequisites are not met to execute this makefile! No '$(exec)' found in your PATH"))) From d5cf27e5a89fd08ef713102879f94398a17416c6 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:41:26 +0200 Subject: [PATCH 16/28] Makefiles: fix operator Makefile helm deploy Signed-off-by: Jop Zitman --- operator/.helmignore | 1 + operator/Makefile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/operator/.helmignore b/operator/.helmignore index 6400802b76..ea43987c6a 100644 --- a/operator/.helmignore +++ b/operator/.helmignore @@ -41,3 +41,4 @@ Makefile PROJECT README.md.gotmpl docs/ +*.tar diff --git a/operator/Makefile b/operator/Makefile index 00b9878786..25ebabcfee 100644 --- a/operator/Makefile +++ b/operator/Makefile @@ -108,7 +108,7 @@ helm-deploy: --set="image.pullPolicy=IfNotPresent" \ --set="lurker.image.repository=docker.io/$(IMG_NS)/$(LURKER_IMG)" \ --set="lurker.image.tag=$(IMG_TAG)" \ - --set="lurker.pullPolicy=IfNotPresent" + --set="lurker.image.pullPolicy=IfNotPresent" install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config. $(KUSTOMIZE) build config/crd | kubectl apply -f - From 232a2284b161fc031afbeaba4653612cf9f4e586 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:41:53 +0200 Subject: [PATCH 17/28] Makefiles: fix kubeaudit parser repository Signed-off-by: Jop Zitman --- scanners/kubeaudit/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/kubeaudit/Makefile b/scanners/kubeaudit/Makefile index 9ab8f1084a..f659c0037b 100644 --- a/scanners/kubeaudit/Makefile +++ b/scanners/kubeaudit/Makefile @@ -14,7 +14,7 @@ include ../../scanners.mk deploy-with-scanner: @echo ".: ๐Ÿ’พ Deploying custom '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." helm -n integration-tests upgrade --install $(scanner) ./ --wait \ - --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-zap" \ + --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(scanner)" \ --set="parser.image.tag=$(IMG_TAG)" \ --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ --set="scanner.image.tag=$(IMG_TAG)" \ From 67b0444a72f546073699a842ee5400bde03988a7 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:47:26 +0200 Subject: [PATCH 18/28] Makefiles: fix generic webhook tests Signed-off-by: Jop Zitman --- hooks/generic-webhook/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/generic-webhook/Makefile b/hooks/generic-webhook/Makefile index 3a3eeeea34..a66c55526e 100644 --- a/hooks/generic-webhook/Makefile +++ b/hooks/generic-webhook/Makefile @@ -23,4 +23,4 @@ deploy: integration-tests: @echo ".: ๐Ÿฉบ Starting integration test in kind namespace 'integration-tests'." kubectl -n integration-tests delete scans --all - cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests generic/read-write-hook.test.js + cd ../../tests/integration/ && npm ci && npx --yes --package jest@$(JEST_VERSION) jest --verbose --ci --colors --coverage --passWithNoTests generic/read-only-write-hook.test.js From db125d4652309aa4a875ee879276734ac873effc Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:47:44 +0200 Subject: [PATCH 19/28] Makefiles: add test-all to root Makefile to run all makefile based test suites Signed-off-by: Jop Zitman --- Makefile | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Makefile b/Makefile index 4cda6807d8..ae84a27019 100644 --- a/Makefile +++ b/Makefile @@ -31,6 +31,17 @@ npm-ci-all: ## Runs npm ci in all node module subfolders. npm-test-all: ## Runs all Jest based test suites. npm test +test-all: ## Runs all makefile based test suites. + @echo ".: โš™ Installing the operator for makefile based testing." + cd ./operator && $(MAKE) -s docker-build docker-export kind-import helm-deploy + @echo ".: โš™ Running make test for all scanner and hook modules." + for dir in scanners/*/ hooks/*/ ; do \ + cd $$dir; \ + echo ".: โš™ Running make test for '$$dir'."; \ + $(MAKE) -s test || exit 1 ; \ + cd -; \ + done; + .PHONY: help: ## Display this help screen. @grep -h -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \ From 24e5798db771f631ecbceeac5431a2d30be57ece Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:49:28 +0200 Subject: [PATCH 20/28] Makefiles: add *.tar to hook gitignores Signed-off-by: Jop Zitman --- hooks/cascading-scans/.gitignore | 1 + hooks/finding-post-processing/.gitignore | 2 +- hooks/generic-webhook/.gitignore | 1 + hooks/notification/.gitignore | 1 + hooks/persistence-defectdojo/.gitignore | 2 ++ hooks/persistence-elastic/.gitignore | 2 +- hooks/update-field/.gitignore | 1 + 7 files changed, 8 insertions(+), 2 deletions(-) diff --git a/hooks/cascading-scans/.gitignore b/hooks/cascading-scans/.gitignore index 6a7dc3f1a2..f316ccb5f6 100644 --- a/hooks/cascading-scans/.gitignore +++ b/hooks/cascading-scans/.gitignore @@ -6,3 +6,4 @@ node_modules *.map **.js !**.test.js +*.tar diff --git a/hooks/finding-post-processing/.gitignore b/hooks/finding-post-processing/.gitignore index b2ced8602b..e913556e3e 100644 --- a/hooks/finding-post-processing/.gitignore +++ b/hooks/finding-post-processing/.gitignore @@ -3,4 +3,4 @@ # SPDX-License-Identifier: Apache-2.0 node_modules - +*.tar diff --git a/hooks/generic-webhook/.gitignore b/hooks/generic-webhook/.gitignore index 9e931e1f36..e913556e3e 100644 --- a/hooks/generic-webhook/.gitignore +++ b/hooks/generic-webhook/.gitignore @@ -3,3 +3,4 @@ # SPDX-License-Identifier: Apache-2.0 node_modules +*.tar diff --git a/hooks/notification/.gitignore b/hooks/notification/.gitignore index 2b6f55a4ef..5451060830 100644 --- a/hooks/notification/.gitignore +++ b/hooks/notification/.gitignore @@ -5,3 +5,4 @@ node_modules **.js **.js.map +*.tar diff --git a/hooks/persistence-defectdojo/.gitignore b/hooks/persistence-defectdojo/.gitignore index fd68a3378a..d8e5a5d2a6 100644 --- a/hooks/persistence-defectdojo/.gitignore +++ b/hooks/persistence-defectdojo/.gitignore @@ -37,3 +37,5 @@ out/ ### VS Code ### .vscode/ + +*.tar diff --git a/hooks/persistence-elastic/.gitignore b/hooks/persistence-elastic/.gitignore index b2ced8602b..e913556e3e 100644 --- a/hooks/persistence-elastic/.gitignore +++ b/hooks/persistence-elastic/.gitignore @@ -3,4 +3,4 @@ # SPDX-License-Identifier: Apache-2.0 node_modules - +*.tar diff --git a/hooks/update-field/.gitignore b/hooks/update-field/.gitignore index 8d754920ee..c200405640 100644 --- a/hooks/update-field/.gitignore +++ b/hooks/update-field/.gitignore @@ -3,3 +3,4 @@ # SPDX-License-Identifier: Apache-2.0 node_modules/ +*.tar From 7d53bc6a29184bc8894c288a92ef815172f103dd Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:53:35 +0200 Subject: [PATCH 21/28] Makefiles: run internal makefiles silent Signed-off-by: Jop Zitman --- scanners/zap-advanced/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/scanners/zap-advanced/Makefile b/scanners/zap-advanced/Makefile index f505bc538b..0e1d9be283 100644 --- a/scanners/zap-advanced/Makefile +++ b/scanners/zap-advanced/Makefile @@ -15,19 +15,19 @@ unit-tests: @$(MAKE) -s unit-test-py unit-tests-parser: - $(MAKE) -f ../../scanners.mk unit-tests-parser include_guard=set scanner=zap + $(MAKE) -s -f ../../scanners.mk unit-tests-parser include_guard=set scanner=zap install-deps: - cd ../zap/ && $(MAKE) install-deps + cd ../zap/ && $(MAKE) -s install-deps docker-build-parser: - cd ../zap/ && $(MAKE) docker-build-parser + cd ../zap/ && $(MAKE) -s docker-build-parser docker-export-parser: - cd ../zap/ && $(MAKE) docker-export-parser + cd ../zap/ && $(MAKE) -s docker-export-parser kind-import-parser: - cd ../zap/ && $(MAKE) kind-import-parser + cd ../zap/ && $(MAKE) -s kind-import-parser deploy-with-scanner: @echo ".: ๐Ÿ’พ Deploying custom '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." From 4bb2877f196de9298b9e80cfccb0e74d854a5d00 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Sun, 5 Sep 2021 21:58:55 +0200 Subject: [PATCH 22/28] Makefiles: add makefiles for newly added scanners Signed-off-by: Jop Zitman --- scanners/typo3scan/.gitignore | 5 ++++ scanners/typo3scan/.helmignore | 16 ++++++++++++- scanners/typo3scan/Makefile | 12 ++++++++++ scanners/whatweb/.gitignore | 5 ++++ scanners/whatweb/.helmignore | 42 ++++++++++++++++++++++++++++------ scanners/whatweb/Makefile | 12 ++++++++++ 6 files changed, 84 insertions(+), 8 deletions(-) create mode 100644 scanners/typo3scan/.gitignore create mode 100644 scanners/typo3scan/Makefile create mode 100644 scanners/whatweb/.gitignore create mode 100644 scanners/whatweb/Makefile diff --git a/scanners/typo3scan/.gitignore b/scanners/typo3scan/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/typo3scan/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/typo3scan/.helmignore b/scanners/typo3scan/.helmignore index 30a540feb0..fb9c1d2d6f 100644 --- a/scanners/typo3scan/.helmignore +++ b/scanners/typo3scan/.helmignore @@ -17,10 +17,24 @@ *.swp *.bak *.tmp -*.orig *~ # Various IDEs .project .idea/ *.tmproj .vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* +Makefile diff --git a/scanners/typo3scan/Makefile b/scanners/typo3scan/Makefile new file mode 100644 index 0000000000..65085a8b16 --- /dev/null +++ b/scanners/typo3scan/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = typo3scan +custom_scanner = set + +include ../../scanners.mk diff --git a/scanners/whatweb/.gitignore b/scanners/whatweb/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/scanners/whatweb/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/scanners/whatweb/.helmignore b/scanners/whatweb/.helmignore index 64b2887490..fb9c1d2d6f 100644 --- a/scanners/whatweb/.helmignore +++ b/scanners/whatweb/.helmignore @@ -1,12 +1,40 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. .DS_Store - -parser/ -scanner/ -examples/ -docs/ -integration-tests/ -coverage/ +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* Makefile diff --git a/scanners/whatweb/Makefile b/scanners/whatweb/Makefile new file mode 100644 index 0000000000..9ea77fd9df --- /dev/null +++ b/scanners/whatweb/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = whatweb +custom_scanner = set + +include ../../scanners.mk From 2165ebc864ef917c9a0ca51eac2b5554fef32895 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Thu, 9 Sep 2021 13:29:44 +0200 Subject: [PATCH 23/28] Also install top level dependencies in make file Required for hook integration tests, as the require ts-jest to be installed Signed-off-by: Jannik Hollenbach --- common.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/common.mk b/common.mk index 79de838af8..5edb1cf8b1 100644 --- a/common.mk +++ b/common.mk @@ -68,6 +68,7 @@ test: | clean-integration-tests unit-tests docker-build docker-export kind-impor install-deps-js: @echo ".: โš™๏ธ Installing all $(module) specific javascript dependencies." cd ./.. && npm ci + cd ./../.. && npm ci cd ../../${module}-sdk/nodejs && npm ci cd ./${module}/ && npm ci From bc0b0b0fdd4fbc8b064ce5bba2ff7baf199ca997 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Thu, 9 Sep 2021 15:46:06 +0200 Subject: [PATCH 24/28] Also run cascading scans in CI in integration-tests namespace Signed-off-by: Jannik Hollenbach --- .github/workflows/ci.yaml | 44 ++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2b415efd10..a7709816d2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -186,7 +186,7 @@ jobs: push: true tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} - + - name: Update Docker Hub Description uses: peter-evans/dockerhub-description@v2 with: @@ -246,7 +246,7 @@ jobs: push: true tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} - + - name: Update Docker Hub Description uses: peter-evans/dockerhub-description@v2 with: @@ -300,7 +300,7 @@ jobs: tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} -# ---- New Makefile based CI Pipeline steps ---- + # ---- New Makefile based CI Pipeline steps ---- makefile-scanner: name: "Make Scanners" @@ -1115,15 +1115,16 @@ jobs: - name: "cascading Scans ncrack Integration Tests" run: | - kubectl -n integration-tests delete scans --all - # We'll run these in a separate namespace so that only the cascadingRules we want to test will be used - kubectl create namespace cascading-tests + + # We'll recreate the namespace so that no cascadingRules of previous tests can exist in there + kubectl delete namespace integration-tests + kubectl create namespace integration-tests # Install cascading-scans hook - helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests \ + helm upgrade --install dssh ./hooks/cascading-scans/ -n integration-tests \ --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install nmap - helm -n cascading-tests install nmap ./scanners/nmap/ \ + helm -n integration-tests install nmap ./scanners/nmap/ \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-nmap" \ @@ -1133,8 +1134,8 @@ jobs: # Install ncrack printf "root\nadmin\n" > users.txt printf "THEPASSWORDYOUCREATED\n123456\npassword\n" > passwords.txt - kubectl create secret generic --from-file users.txt --from-file passwords.txt ncrack-lists -n cascading-tests - cat < Date: Fri, 10 Sep 2021 09:51:36 +0200 Subject: [PATCH 25/28] Only delete integration-tests namespace if it exists Signed-off-by: Jannik Hollenbach --- .github/workflows/ci.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index a7709816d2..67a9092c02 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1117,8 +1117,11 @@ jobs: run: | # We'll recreate the namespace so that no cascadingRules of previous tests can exist in there - kubectl delete namespace integration-tests + if kubectl get namespace integration-tests; then + kubectl delete namespace integration-tests + fi kubectl create namespace integration-tests + # Install cascading-scans hook helm upgrade --install dssh ./hooks/cascading-scans/ -n integration-tests \ --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ @@ -1163,8 +1166,11 @@ jobs: - name: "cascading Scans sslyze Integration Tests" run: | + # We'll recreate the namespace so that no cascadingRules of previous tests can exist in there - kubectl delete namespace integration-tests + if kubectl get namespace integration-tests; then + kubectl delete namespace integration-tests + fi kubectl create namespace integration-tests # Install cascading-scans hook From 0d1d821844b63ad1296fbafc4f5aaac0f86941c5 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Fri, 10 Sep 2021 09:52:12 +0200 Subject: [PATCH 26/28] Add makefile for nuclei Signed-off-by: Jannik Hollenbach --- scanners/nuclei/Makefile | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 scanners/nuclei/Makefile diff --git a/scanners/nuclei/Makefile b/scanners/nuclei/Makefile new file mode 100644 index 0000000000..eda94fde93 --- /dev/null +++ b/scanners/nuclei/Makefile @@ -0,0 +1,11 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = nuclei + +include ../../scanners.mk From 1b0c7fab11cfdc0faa7602be50580fff4cc2d91a Mon Sep 17 00:00:00 2001 From: Yannik Fuhrmeister Date: Tue, 14 Sep 2021 12:42:28 +0200 Subject: [PATCH 27/28] Fix The Links For WhatWeb To GitHub And Website Signed-off-by: Yannik Fuhrmeister --- scanners/whatweb/.helm-docs.gotmpl | 2 +- scanners/whatweb/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/whatweb/.helm-docs.gotmpl b/scanners/whatweb/.helm-docs.gotmpl index d3c1316c50..d08098b33c 100644 --- a/scanners/whatweb/.helm-docs.gotmpl +++ b/scanners/whatweb/.helm-docs.gotmpl @@ -28,5 +28,5 @@ usecase: "Website identification" ## What is WHATWEB? Whatweb identifies websites. It can recognize technology used to build a website, such as content management systems (CMS), JavaScript libraries, web server and much more. This makes whatweb especially interesting to use in a cascading-rules pipeline. -To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb]. +To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb](https://morningstarsecurity.com/research/whatweb) or the [GitHub repository](https://github.com/urbanadventurer/WhatWeb). {{- end }} diff --git a/scanners/whatweb/README.md b/scanners/whatweb/README.md index b3663de809..6820234c56 100644 --- a/scanners/whatweb/README.md +++ b/scanners/whatweb/README.md @@ -38,7 +38,7 @@ Otherwise your changes will be reverted/overwritten automatically due to the bui ## What is WHATWEB? Whatweb identifies websites. It can recognize technology used to build a website, such as content management systems (CMS), JavaScript libraries, web server and much more. This makes whatweb especially interesting to use in a cascading-rules pipeline. -To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb]. +To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb](https://morningstarsecurity.com/research/whatweb) or the [GitHub repository](https://github.com/urbanadventurer/WhatWeb). ## Deployment The whatweb chart can be deployed via helm: From 505f4db29f14f04160018ac7bf4dedce539ca29c Mon Sep 17 00:00:00 2001 From: fuhrmeistery Date: Tue, 14 Sep 2021 10:43:54 +0000 Subject: [PATCH 28/28] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/whatweb/docs/README.ArtifactHub.md | 2 +- scanners/whatweb/docs/README.DockerHub-Parser.md | 2 +- scanners/whatweb/docs/README.DockerHub-Scanner.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/whatweb/docs/README.ArtifactHub.md b/scanners/whatweb/docs/README.ArtifactHub.md index 3ac39d003b..f828a368b1 100644 --- a/scanners/whatweb/docs/README.ArtifactHub.md +++ b/scanners/whatweb/docs/README.ArtifactHub.md @@ -43,7 +43,7 @@ You can find resources to help you get started on our [documentation website](ht ## What is WHATWEB? Whatweb identifies websites. It can recognize technology used to build a website, such as content management systems (CMS), JavaScript libraries, web server and much more. This makes whatweb especially interesting to use in a cascading-rules pipeline. -To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb]. +To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb](https://morningstarsecurity.com/research/whatweb) or the [GitHub repository](https://github.com/urbanadventurer/WhatWeb). ## Deployment The whatweb chart can be deployed via helm: diff --git a/scanners/whatweb/docs/README.DockerHub-Parser.md b/scanners/whatweb/docs/README.DockerHub-Parser.md index 64d0399050..3377b7acef 100644 --- a/scanners/whatweb/docs/README.DockerHub-Parser.md +++ b/scanners/whatweb/docs/README.DockerHub-Parser.md @@ -54,7 +54,7 @@ docker pull securecodebox/parser-whatweb ## What is WHATWEB? Whatweb identifies websites. It can recognize technology used to build a website, such as content management systems (CMS), JavaScript libraries, web server and much more. This makes whatweb especially interesting to use in a cascading-rules pipeline. -To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb]. +To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb](https://morningstarsecurity.com/research/whatweb) or the [GitHub repository](https://github.com/urbanadventurer/WhatWeb). ## Community diff --git a/scanners/whatweb/docs/README.DockerHub-Scanner.md b/scanners/whatweb/docs/README.DockerHub-Scanner.md index 1ed7856855..a3bb571f99 100644 --- a/scanners/whatweb/docs/README.DockerHub-Scanner.md +++ b/scanners/whatweb/docs/README.DockerHub-Scanner.md @@ -54,5 +54,5 @@ docker pull securecodebox/scanner-whatweb ## What is WHATWEB? Whatweb identifies websites. It can recognize technology used to build a website, such as content management systems (CMS), JavaScript libraries, web server and much more. This makes whatweb especially interesting to use in a cascading-rules pipeline. -To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb]. +To learn more about the whatweb scanner itself visit [https://morningstarsecurity.com/research/whatweb](https://morningstarsecurity.com/research/whatweb) or the [GitHub repository](https://github.com/urbanadventurer/WhatWeb).