From bf9de1c64dde98cd3be3fa4514ddad006bf85962 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 30 Sep 2021 12:16:05 +0200 Subject: [PATCH 1/3] Add presigned head url to scan object Signed-off-by: Jop Zitman --- operator/apis/execution/v1/scan_types.go | 5 +++++ .../bases/execution.securecodebox.io_scans.yaml | 8 ++++++++ .../controllers/execution/scans/scan_controller.go | 12 ++++++++++++ .../controllers/execution/scans/scan_reconciler.go | 14 ++++++++++++++ .../crds/execution.securecodebox.io_scans.yaml | 8 ++++++++ 5 files changed, 47 insertions(+) diff --git a/operator/apis/execution/v1/scan_types.go b/operator/apis/execution/v1/scan_types.go index 6bddae27e5..d74b5f4cf8 100644 --- a/operator/apis/execution/v1/scan_types.go +++ b/operator/apis/execution/v1/scan_types.go @@ -81,6 +81,11 @@ type ScanStatus struct { // RawResultDownloadLink link to download the raw result file from. Valid for 7 days RawResultDownloadLink string `json:"rawResultDownloadLink,omitempty"` + // FindingHeadLink link to send HEAD request to the finding json file. Valid for 7 days + FindingHeadLink string `json:"findingHeadLink,omitempty"` + // RawResultHeadLink link to send HEAD request to raw result file from. Valid for 7 days + RawResultHeadLink string `json:"rawResultHeadLink,omitempty"` + Findings FindingStats `json:"findings,omitempty"` ReadAndWriteHookStatus []HookStatus `json:"readAndWriteHookStatus,omitempty"` diff --git a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml index cc38bfe839..ba6a65520c 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml @@ -1717,6 +1717,10 @@ spec: description: FindingDownloadLink link to download the finding json file from. Valid for 7 days type: string + findingHeadLink: + description: FindingHeadLink link to send HEAD request to the finding + json file. Valid for 7 days + type: string findings: description: FindingStats contains the general stats about the results of the scan @@ -1764,6 +1768,10 @@ spec: description: RawResultFile Filename of the result file of the scanner. e.g. `nmap-result.xml` type: string + rawResultHeadLink: + description: RawResultHeadLink link to send HEAD request to raw result + file from. Valid for 7 days + type: string rawResultType: description: RawResultType determines which kind of ParseDefinition will be used to turn the raw results of the scanner into findings diff --git a/operator/controllers/execution/scans/scan_controller.go b/operator/controllers/execution/scans/scan_controller.go index 7a8e2a11b9..9b9b66478c 100644 --- a/operator/controllers/execution/scans/scan_controller.go +++ b/operator/controllers/execution/scans/scan_controller.go @@ -162,6 +162,18 @@ func (r *ScanReconciler) PresignedPutURL(scanID types.UID, filename string, dura return rawResultDownloadURL.String(), nil } +// PresignedHeadURL returns a presigned URL from the s3 (or compatible) serice. +func (r *ScanReconciler) PresignedHeadURL(scanID types.UID, filename string, duration time.Duration) (string, error) { + bucketName := os.Getenv("S3_BUCKET") + + rawResultHeadURL, err := r.MinioClient.PresignedHeadObject(context.Background(), bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), duration, nil) + if err != nil { + r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider") + return "", err + } + return rawResultHeadURL.String(), nil +} + func (r *ScanReconciler) initS3Connection() *minio.Client { endpoint := os.Getenv("S3_ENDPOINT") if os.Getenv("S3_PORT") != "" { diff --git a/operator/controllers/execution/scans/scan_reconciler.go b/operator/controllers/execution/scans/scan_reconciler.go index 891f7bc07f..8c8c3d6731 100644 --- a/operator/controllers/execution/scans/scan_reconciler.go +++ b/operator/controllers/execution/scans/scan_reconciler.go @@ -107,6 +107,20 @@ func (r *ScanReconciler) startScan(scan *executionv1.Scan) error { } scan.Status.RawResultDownloadLink = rawResultDownloadURL + findingsHeadURL, err := r.PresignedHeadURL(scan.UID, "findings.json", 7*24*time.Hour) + if err != nil { + r.Log.Error(err, "Could not get presigned head url from s3 or compatible storage provider") + return err + } + scan.Status.FindingHeadLink = findingsHeadURL + + rawResultsHeadURL, err := r.PresignedHeadURL(scan.UID, scan.Status.RawResultFile, 7*24*time.Hour) + if err != nil { + r.Log.Error(err, "Could not get presigned head url from s3 or compatible storage provider") + return err + } + scan.Status.RawResultHeadLink = rawResultsHeadURL + if err := r.Status().Update(ctx, scan); err != nil { log.Error(err, "unable to update Scan status") return err diff --git a/operator/crds/execution.securecodebox.io_scans.yaml b/operator/crds/execution.securecodebox.io_scans.yaml index 398dfd7f4e..611548f37f 100644 --- a/operator/crds/execution.securecodebox.io_scans.yaml +++ b/operator/crds/execution.securecodebox.io_scans.yaml @@ -1724,6 +1724,10 @@ spec: description: FindingDownloadLink link to download the finding json file from. Valid for 7 days type: string + findingHeadLink: + description: FindingHeadLink link to send HEAD request to the finding + json file. Valid for 7 days + type: string findings: description: FindingStats contains the general stats about the results of the scan @@ -1771,6 +1775,10 @@ spec: description: RawResultFile Filename of the result file of the scanner. e.g. `nmap-result.xml` type: string + rawResultHeadLink: + description: RawResultHeadLink link to send HEAD request to raw result + file from. Valid for 7 days + type: string rawResultType: description: RawResultType determines which kind of ParseDefinition will be used to turn the raw results of the scanner into findings From 316cd10fd40be937ea58725feacd848fbe3392e2 Mon Sep 17 00:00:00 2001 From: EndPositive Date: Tue, 5 Oct 2021 18:33:52 +0200 Subject: [PATCH 2/3] Update operator/apis/execution/v1/scan_types.go Co-authored-by: Jannik Hollenbach Signed-off-by: Jop Zitman --- operator/apis/execution/v1/scan_types.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/operator/apis/execution/v1/scan_types.go b/operator/apis/execution/v1/scan_types.go index d74b5f4cf8..a1c0c6d3b8 100644 --- a/operator/apis/execution/v1/scan_types.go +++ b/operator/apis/execution/v1/scan_types.go @@ -83,7 +83,7 @@ type ScanStatus struct { // FindingHeadLink link to send HEAD request to the finding json file. Valid for 7 days FindingHeadLink string `json:"findingHeadLink,omitempty"` - // RawResultHeadLink link to send HEAD request to raw result file from. Valid for 7 days + // RawResultHeadLink link to send HEAD request to raw result file. Valid for 7 days RawResultHeadLink string `json:"rawResultHeadLink,omitempty"` Findings FindingStats `json:"findings,omitempty"` From 94209839a14fb8a500bc312f9558e1f9c99f3544 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Tue, 5 Oct 2021 19:41:12 +0200 Subject: [PATCH 3/3] Regenerate CRD's Signed-off-by: Jop Zitman --- operator/config/crd/bases/execution.securecodebox.io_scans.yaml | 2 +- operator/crds/execution.securecodebox.io_scans.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml index ba6a65520c..d51ebee3d2 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml @@ -1770,7 +1770,7 @@ spec: type: string rawResultHeadLink: description: RawResultHeadLink link to send HEAD request to raw result - file from. Valid for 7 days + file. Valid for 7 days type: string rawResultType: description: RawResultType determines which kind of ParseDefinition diff --git a/operator/crds/execution.securecodebox.io_scans.yaml b/operator/crds/execution.securecodebox.io_scans.yaml index 611548f37f..8d636a9787 100644 --- a/operator/crds/execution.securecodebox.io_scans.yaml +++ b/operator/crds/execution.securecodebox.io_scans.yaml @@ -1777,7 +1777,7 @@ spec: type: string rawResultHeadLink: description: RawResultHeadLink link to send HEAD request to raw result - file from. Valid for 7 days + file. Valid for 7 days type: string rawResultType: description: RawResultType determines which kind of ParseDefinition