From 08f47815d6e574fb17941d0da9b09a879e3ef8da Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 28 Sep 2021 15:05:33 +0200 Subject: [PATCH 01/11] Adding template folder for new scanner files Includes all generic files that we use for the scanners. "New-scanner" gets replaced in the makefile with a provided scanner name. Based on nmap and whatweb directories. Signed-off-by: Sebastian --- .templates/new-scanner/.gitignore | 5 ++ .templates/new-scanner/.helm-docs.gotmpl | 31 ++++++++ .templates/new-scanner/.helmignore | 40 ++++++++++ .templates/new-scanner/Chart.yaml | 26 ++++++ .templates/new-scanner/Makefile | 12 +++ .../new-scanner/cascading-rules/.gitkeep | 0 .templates/new-scanner/docs/.gitkeep | 0 .../new-scanner/examples/localhost/scan.yaml | 14 ++++ .templates/new-scanner/parser/.dockerignore | 5 ++ .templates/new-scanner/parser/Dockerfile | 24 ++++++ .../parser/__testFiles__/empty.json | 2 + .../parser/__testFiles__/example.com.json | 3 + .../parser/package-lock.json.license | 3 + .templates/new-scanner/parser/package.json | 14 ++++ .../new-scanner/parser/package.json.license | 3 + .templates/new-scanner/parser/parser.js | 33 ++++++++ .templates/new-scanner/parser/parser.test.js | 39 +++++++++ .templates/new-scanner/scanner/Dockerfile | 6 ++ .../templates/cascading-rules.yaml | 15 ++++ .../new-scanner-parse-definition.yaml | 14 ++++ .../templates/new-scanner-scan-type.yaml | 42 ++++++++++ .templates/new-scanner/values.yaml | 79 +++++++++++++++++++ 22 files changed, 410 insertions(+) create mode 100644 .templates/new-scanner/.gitignore create mode 100644 .templates/new-scanner/.helm-docs.gotmpl create mode 100644 .templates/new-scanner/.helmignore create mode 100644 .templates/new-scanner/Chart.yaml create mode 100644 .templates/new-scanner/Makefile create mode 100644 .templates/new-scanner/cascading-rules/.gitkeep create mode 100644 .templates/new-scanner/docs/.gitkeep create mode 100644 .templates/new-scanner/examples/localhost/scan.yaml create mode 100644 .templates/new-scanner/parser/.dockerignore create mode 100644 .templates/new-scanner/parser/Dockerfile create mode 100644 .templates/new-scanner/parser/__testFiles__/empty.json create mode 100644 .templates/new-scanner/parser/__testFiles__/example.com.json create mode 100644 .templates/new-scanner/parser/package-lock.json.license create mode 100644 .templates/new-scanner/parser/package.json create mode 100644 .templates/new-scanner/parser/package.json.license create mode 100644 .templates/new-scanner/parser/parser.js create mode 100644 .templates/new-scanner/parser/parser.test.js create mode 100644 .templates/new-scanner/scanner/Dockerfile create mode 100644 .templates/new-scanner/templates/cascading-rules.yaml create mode 100644 .templates/new-scanner/templates/new-scanner-parse-definition.yaml create mode 100644 .templates/new-scanner/templates/new-scanner-scan-type.yaml create mode 100644 .templates/new-scanner/values.yaml diff --git a/.templates/new-scanner/.gitignore b/.templates/new-scanner/.gitignore new file mode 100644 index 0000000000..2783dbcddf --- /dev/null +++ b/.templates/new-scanner/.gitignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +*.tar diff --git a/.templates/new-scanner/.helm-docs.gotmpl b/.templates/new-scanner/.helm-docs.gotmpl new file mode 100644 index 0000000000..d50837d0dc --- /dev/null +++ b/.templates/new-scanner/.helm-docs.gotmpl @@ -0,0 +1,31 @@ +{{- /* +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 +*/ -}} + +{{- define "extra.docsSection" -}} +--- +title: "new-scanner" +category: "scanner" +type: "Network" +state: "released" +appVersion: "{{ template "chart.appVersion" . }}" +usecase: "NEW SCANNER USECASE" +--- + +ADD A [LOGO]() HERE! + +{{- end }} + +{{- define "extra.dockerDeploymentSection" -}} +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `{{ template "chart.appVersion" . }}` +{{- end }} + +{{- define "extra.chartAboutSection" -}} +## What is new-scanner? + +Please write some information about the new scanner. +{{- end }} diff --git a/.templates/new-scanner/.helmignore b/.templates/new-scanner/.helmignore new file mode 100644 index 0000000000..fb9c1d2d6f --- /dev/null +++ b/.templates/new-scanner/.helmignore @@ -0,0 +1,40 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Node.js files +node_modules/* +package.json +package-lock.json +src/* +config/* +Dockerfile +.dockerignore +*.tar +parser/* +scanner/* +integration-tests/* +examples/* +docs/* +Makefile diff --git a/.templates/new-scanner/Chart.yaml b/.templates/new-scanner/Chart.yaml new file mode 100644 index 0000000000..afb7c25558 --- /dev/null +++ b/.templates/new-scanner/Chart.yaml @@ -0,0 +1,26 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: v2 +name: new-scanner +description: A Helm chart for the new-scanner security Scanner that integrates with the secureCodeBox. + +type: application +# version - gets automatically set to the secureCodeBox release version when the helm charts gets published +version: v3.1.0-alpha1 +appVersion: # Set appVersion +kubeVersion: ">=v1.11.0-0" + +keywords: + - security + - new-scanner + - scanner + - secureCodeBox +home: https://docs.securecodebox.io/docs/scanners/new-scanner +icon: https://docs.securecodebox.io/img/integrationIcons/new-scanner.svg # Upload new icon +sources: + - https://github.com/secureCodeBox/secureCodeBox +maintainers: + - name: iteratec GmbH + email: secureCodeBox@iteratec.com diff --git a/.templates/new-scanner/Makefile b/.templates/new-scanner/Makefile new file mode 100644 index 0000000000..3a9537d787 --- /dev/null +++ b/.templates/new-scanner/Makefile @@ -0,0 +1,12 @@ +#!/usr/bin/make -f +# +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +# + +include_guard = set +scanner = nmap +custom_scanner = set + +include ../../scanners.mk diff --git a/.templates/new-scanner/cascading-rules/.gitkeep b/.templates/new-scanner/cascading-rules/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.templates/new-scanner/docs/.gitkeep b/.templates/new-scanner/docs/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.templates/new-scanner/examples/localhost/scan.yaml b/.templates/new-scanner/examples/localhost/scan.yaml new file mode 100644 index 0000000000..50d74e0cf7 --- /dev/null +++ b/.templates/new-scanner/examples/localhost/scan.yaml @@ -0,0 +1,14 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: "execution.securecodebox.io/v1" +kind: Scan +metadata: + name: "new-scanner-localhost" +spec: + scanType: "new-scanner" + parameters: + # Note: Localhost here isn't "your" localhost, but the scanner container. + # This container doesn't have any ports open... + - localhost diff --git a/.templates/new-scanner/parser/.dockerignore b/.templates/new-scanner/parser/.dockerignore new file mode 100644 index 0000000000..8d754920ee --- /dev/null +++ b/.templates/new-scanner/parser/.dockerignore @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +node_modules/ diff --git a/.templates/new-scanner/parser/Dockerfile b/.templates/new-scanner/parser/Dockerfile new file mode 100644 index 0000000000..857051eff5 --- /dev/null +++ b/.templates/new-scanner/parser/Dockerfile @@ -0,0 +1,24 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +# No additional dependencies +ARG namespace +ARG baseImageTag +FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest} +WORKDIR /home/app/parser-wrapper/parser/ +COPY --chown=app:app ./parser.js ./parser.js + +# Additional packages +# ARG namespace +# ARG baseImageTag +# FROM node:14-alpine as build +# RUN mkdir -p /home/app +# WORKDIR /home/app +# COPY package.json package-lock.json ./ +# RUN npm ci --production +# +# FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest} +# WORKDIR /home/app/parser-wrapper/parser/ +# COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ +# COPY --chown=app:app ./parser.js ./parser.js diff --git a/.templates/new-scanner/parser/__testFiles__/empty.json b/.templates/new-scanner/parser/__testFiles__/empty.json new file mode 100644 index 0000000000..0d4f101c7a --- /dev/null +++ b/.templates/new-scanner/parser/__testFiles__/empty.json @@ -0,0 +1,2 @@ +[ +] diff --git a/.templates/new-scanner/parser/__testFiles__/example.com.json b/.templates/new-scanner/parser/__testFiles__/example.com.json new file mode 100644 index 0000000000..2a7fbcca4f --- /dev/null +++ b/.templates/new-scanner/parser/__testFiles__/example.com.json @@ -0,0 +1,3 @@ +[ +{"target":"http://example.com"} +] diff --git a/.templates/new-scanner/parser/package-lock.json.license b/.templates/new-scanner/parser/package-lock.json.license new file mode 100644 index 0000000000..c59b85a5b5 --- /dev/null +++ b/.templates/new-scanner/parser/package-lock.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 diff --git a/.templates/new-scanner/parser/package.json b/.templates/new-scanner/parser/package.json new file mode 100644 index 0000000000..6c697fa507 --- /dev/null +++ b/.templates/new-scanner/parser/package.json @@ -0,0 +1,14 @@ +{ + "name": "@securecodebox/parser-new-scanner", + "version": "1.0.0", + "description": "Parses result files for the type: 'new-scanner-json'", + "main": "", + "scripts": {}, + "keywords": [], + "author": "iteratec GmbH", + "license": "Apache-2.0", + "dependencies": { + "lodash": "^4.17.21" + }, + "devDependencies": {} +} diff --git a/.templates/new-scanner/parser/package.json.license b/.templates/new-scanner/parser/package.json.license new file mode 100644 index 0000000000..c59b85a5b5 --- /dev/null +++ b/.templates/new-scanner/parser/package.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 diff --git a/.templates/new-scanner/parser/parser.js b/.templates/new-scanner/parser/parser.js new file mode 100644 index 0000000000..038f350123 --- /dev/null +++ b/.templates/new-scanner/parser/parser.js @@ -0,0 +1,33 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +async function parse(fileContent) { + const targets = parseResultFile(fileContent); + return transformToFindings(targets); +} + +function transformToFindings(targets) { + + const targetFindings = []; + + // Code to transform the scanner results to scb findings + + return [...targetFindings]; +} + +/** + * Parses a given new-scanner result file and extracts all targets + * @param {*} fileContent + */ +function parseResultFile(fileContent) { + let targetList = []; + + for(const rawTarget of fileContent) { + // Code to transform raw target findings to usable js format + // If scanner is only able to output xml files, you have to transform them first (look at nmap parser for example) + } + return targetList; +} + +module.exports.parse = parse; diff --git a/.templates/new-scanner/parser/parser.test.js b/.templates/new-scanner/parser/parser.test.js new file mode 100644 index 0000000000..7454c613fa --- /dev/null +++ b/.templates/new-scanner/parser/parser.test.js @@ -0,0 +1,39 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +const fs = require("fs"); +const util = require("util"); + +const { + validateParser, +} = require("@securecodebox/parser-sdk-nodejs/parser-utils"); + +// eslint-disable-next-line security/detect-non-literal-fs-filename +const readFile = util.promisify(fs.readFile); + +const { parse } = require("./parser"); + +test("should properly parse new-scanner json file", async () => { + const fileContent = JSON.parse( + await readFile(__dirname + "/__testFiles__/example.com.json", { + encoding: "utf8", + }) + ); + const findings = await parse(fileContent); + // validate findings + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchInlineSnapshot(); +}); + +test("should properly parse empty json file", async () => { + const fileContent = JSON.parse( + await readFile(__dirname + "/__testFiles__/empty.json", { + encoding: "utf8", + }) + ); + const findings = await parse(fileContent); + // validate findings + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchInlineSnapshot(); +}); diff --git a/.templates/new-scanner/scanner/Dockerfile b/.templates/new-scanner/scanner/Dockerfile new file mode 100644 index 0000000000..ef0552d604 --- /dev/null +++ b/.templates/new-scanner/scanner/Dockerfile @@ -0,0 +1,6 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +# Write your dockerfile for the scanner new-scanner here +# Alternatively, you can use an existing image from docker-hub diff --git a/.templates/new-scanner/templates/cascading-rules.yaml b/.templates/new-scanner/templates/cascading-rules.yaml new file mode 100644 index 0000000000..97dd683b66 --- /dev/null +++ b/.templates/new-scanner/templates/cascading-rules.yaml @@ -0,0 +1,15 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +# We only want to import the default cascading rules if they are enabled +{{ if .Values.cascadingRules.enabled }} +# The CascadingRules are not directly in the /templates directory as their curly bracket syntax clashes with helms templates ... :( +# We import them as raw files to avoid these clashes as escaping them is even more messy +{{ range $path, $_ := .Files.Glob "cascading-rules/*" }} +# Include File +{{ $.Files.Get $path }} +# Separate multiple files +--- +{{ end }} +{{ end }} diff --git a/.templates/new-scanner/templates/new-scanner-parse-definition.yaml b/.templates/new-scanner/templates/new-scanner-parse-definition.yaml new file mode 100644 index 0000000000..b2e8d0a628 --- /dev/null +++ b/.templates/new-scanner/templates/new-scanner-parse-definition.yaml @@ -0,0 +1,14 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: "execution.securecodebox.io/v1" +kind: ParseDefinition +metadata: + name: "new-scanner-json" +spec: + image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" + imagePullPolicy: {{ .Values.parser.image.pullPolicy }} + ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }} + env: + {{- toYaml .Values.parser.env | nindent 4 }} diff --git a/.templates/new-scanner/templates/new-scanner-scan-type.yaml b/.templates/new-scanner/templates/new-scanner-scan-type.yaml new file mode 100644 index 0000000000..3b6fa5d955 --- /dev/null +++ b/.templates/new-scanner/templates/new-scanner-scan-type.yaml @@ -0,0 +1,42 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: "execution.securecodebox.io/v1" +kind: ScanType +metadata: + name: "new-scanner{{ .Values.scanner.nameAppend | default ""}}" +spec: + extractResults: + type: nmap-xml + location: "/home/securecodebox/new-scanner-results.json" + jobTemplate: + spec: + {{- if .Values.scanner.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ .Values.scanner.ttlSecondsAfterFinished }} + {{- end }} + backoffLimit: {{ .Values.scanner.backoffLimit }} + {{- if .Values.scanner.activeDeadlineSeconds }} + activeDeadlineSeconds: {{ .Values.scanner.activeDeadlineSeconds }} + {{- end }} + template: + spec: + restartPolicy: OnFailure + containers: + - name: new-scanner + image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.scanner.image.pullPolicy }} + command: ["new-scanner", "/home/securecodebox/new-scanner-results.xml"] # Replace output command + resources: + {{- toYaml .Values.scanner.resources | nindent 16 }} + securityContext: + {{- toYaml .Values.scanner.securityContext | nindent 16 }} + env: + {{- toYaml .Values.scanner.env | nindent 16 }} + volumeMounts: + {{- toYaml .Values.scanner.extraVolumeMounts | nindent 16 }} + {{- if .Values.scanner.extraContainers }} + {{- toYaml .Values.scanner.extraContainers | nindent 12 }} + {{- end }} + volumes: + {{- toYaml .Values.scanner.extraVolumes | nindent 12 }} diff --git a/.templates/new-scanner/values.yaml b/.templates/new-scanner/values.yaml new file mode 100644 index 0000000000..b6e4a70cef --- /dev/null +++ b/.templates/new-scanner/values.yaml @@ -0,0 +1,79 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +parser: + image: + # parser.image.repository -- Parser image repository + repository: docker.io/securecodebox/scanner-new-scanner + # parser.image.tag -- Parser image tag + # @default -- defaults to the charts appVersion + tag: null + # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + pullPolicy: IfNotPresent + + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + +scanner: + image: + # scanner.image.repository -- Container Image to run the scan + repository: docker.io/securecodebox/scanner-new-scanner + # scanner.image.tag -- defaults to the charts version + tag: null + # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + pullPolicy: IfNotPresent + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + + # -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # -- There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) + activeDeadlineSeconds: null + # -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) + # @default -- 3 + backoffLimit: 3 + + # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) + resources: {} + # resources: + # requests: + # memory: "256Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + + # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + + # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumes: [] + + # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumeMounts: [] + + # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + extraContainers: [] + + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: true From 856d56f45de0143a75cc0f543f9597bacf8a9126 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 28 Sep 2021 15:07:03 +0200 Subject: [PATCH 02/11] Adding create-new-scanner command to Makefile The new commands copies all files from the template directory .templates/new-scanner to a new folder with name provided as an argument to the make command (make create-new-scanner NAME=SCANNER-NAME). Replaces every occurence of new-scanner in file contents or names with the provided name Signed-off-by: Sebastian --- Makefile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/Makefile b/Makefile index ad61497342..e5cca96aa8 100644 --- a/Makefile +++ b/Makefile @@ -42,6 +42,20 @@ test-all: ## Runs all makefile based test suites. cd -; \ done; +.PHONY: +create-new-scanner: ## Creates templates for a new scanner, pass NAME=NEW-SCANNER +ifdef NAME + @mkdir scanners/$(NAME) ; \ + rsync -a ./.templates/new-scanner/ ./scanners/$(NAME) ; \ + echo "Copyied template files to new directory ./scanners/$(NAME)"; \ + cd scanners/$(NAME) ; \ + find . -type f -exec sed -i 's/new-scanner/$(NAME)/g' {} + ; \ + mv "./templates/new-scanner-parse-definition.yaml" "templates/$(NAME)-parse-definition.yaml" ; \ + mv "./templates/new-scanner-scan-type.yaml" "templates/$(NAME)-scan-type.yaml" ; +else + @echo "Scanner name not defined, please provide via make create-new-scanner NAME=NEW-SCANNER"; +endif + .PHONY: help: ## Display this help screen. @grep -h -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \ From c60ce4f59d2494708bec28abaa7c9ad444ebd37f Mon Sep 17 00:00:00 2001 From: SebieF Date: Tue, 28 Sep 2021 13:07:32 +0000 Subject: [PATCH 03/11] Updating Helm Docs Signed-off-by: GitHub Actions --- .templates/new-scanner/README.md | 49 ++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 .templates/new-scanner/README.md diff --git a/.templates/new-scanner/README.md b/.templates/new-scanner/README.md new file mode 100644 index 0000000000..6895361b65 --- /dev/null +++ b/.templates/new-scanner/README.md @@ -0,0 +1,49 @@ +--- +title: "new-scanner" +category: "scanner" +type: "Network" +state: "released" +appVersion: "" +usecase: "NEW SCANNER USECASE" +--- + +ADD A [LOGO]() HERE! + + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is new-scanner? + +Please write some information about the new scanner. + +## Deployment +The new-scanner chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install new-scanner secureCodeBox/new-scanner +``` + From 6f874f0e5558f9f7d2474249ea643f7bab0e4d56 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Wed, 29 Sep 2021 10:13:34 +0200 Subject: [PATCH 04/11] Adding quotes to Chart.yaml template Consistency with other files Signed-off-by: Sebastian --- .templates/new-scanner/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.templates/new-scanner/Chart.yaml b/.templates/new-scanner/Chart.yaml index afb7c25558..1fbbaa7dc5 100644 --- a/.templates/new-scanner/Chart.yaml +++ b/.templates/new-scanner/Chart.yaml @@ -9,7 +9,7 @@ description: A Helm chart for the new-scanner security Scanner that integrates w type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -appVersion: # Set appVersion +appVersion: "" # Set appVersion kubeVersion: ">=v1.11.0-0" keywords: From 2e4a5e96e6e05b618ee75638f2a923b3888e229f Mon Sep 17 00:00:00 2001 From: Sebastian Date: Thu, 30 Sep 2021 12:10:49 +0200 Subject: [PATCH 05/11] Making new-scanner-scan-type.yaml consistent with existing scan type files 1. Replacing array command with list of parameters 2. Replacing incorrect copied "nmap-json" type with "new-scanner-json" Signed-off-by: Sebastian --- .templates/new-scanner/templates/new-scanner-scan-type.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.templates/new-scanner/templates/new-scanner-scan-type.yaml b/.templates/new-scanner/templates/new-scanner-scan-type.yaml index 3b6fa5d955..3df087e78b 100644 --- a/.templates/new-scanner/templates/new-scanner-scan-type.yaml +++ b/.templates/new-scanner/templates/new-scanner-scan-type.yaml @@ -8,7 +8,7 @@ metadata: name: "new-scanner{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: - type: nmap-xml + type: new-scanner-json location: "/home/securecodebox/new-scanner-results.json" jobTemplate: spec: @@ -26,7 +26,9 @@ spec: - name: new-scanner image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.scanner.image.pullPolicy }} - command: ["new-scanner", "/home/securecodebox/new-scanner-results.xml"] # Replace output command + command: + - "new-scanner" + - "/home/securecodebox/new-scanner-results.xml" # Replace output command resources: {{- toYaml .Values.scanner.resources | nindent 16 }} securityContext: From 07682839418702f8a06c4fc920ac2194ee39f822 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 5 Oct 2021 15:29:53 +0200 Subject: [PATCH 06/11] Make template files consistent with current used files Signed-off-by: Sebastian --- .templates/new-scanner/templates/new-scanner-scan-type.yaml | 2 +- .templates/new-scanner/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.templates/new-scanner/templates/new-scanner-scan-type.yaml b/.templates/new-scanner/templates/new-scanner-scan-type.yaml index 3df087e78b..bcc15a1c2c 100644 --- a/.templates/new-scanner/templates/new-scanner-scan-type.yaml +++ b/.templates/new-scanner/templates/new-scanner-scan-type.yaml @@ -28,7 +28,7 @@ spec: imagePullPolicy: {{ .Values.scanner.image.pullPolicy }} command: - "new-scanner" - - "/home/securecodebox/new-scanner-results.xml" # Replace output command + - "/home/securecodebox/new-scanner-results.json" # Replace output command resources: {{- toYaml .Values.scanner.resources | nindent 16 }} securityContext: diff --git a/.templates/new-scanner/values.yaml b/.templates/new-scanner/values.yaml index b6e4a70cef..be49b8636f 100644 --- a/.templates/new-scanner/values.yaml +++ b/.templates/new-scanner/values.yaml @@ -7,11 +7,11 @@ parser: # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/scanner-new-scanner # parser.image.tag -- Parser image tag - # @default -- defaults to the charts appVersion + # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-new-scanner - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent From a1a39e602b3e108a0ab43d3b4e8d3957e4093fd5 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 5 Oct 2021 15:30:06 +0200 Subject: [PATCH 07/11] Replacing old name nmap with generic name Signed-off-by: Sebastian --- .templates/new-scanner/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.templates/new-scanner/Makefile b/.templates/new-scanner/Makefile index 3a9537d787..40ae26bf37 100644 --- a/.templates/new-scanner/Makefile +++ b/.templates/new-scanner/Makefile @@ -6,7 +6,7 @@ # include_guard = set -scanner = nmap +scanner = new-scanner custom_scanner = set include ../../scanners.mk From e1a19682843cfd86f968481bd73e2ddea56ecd9c Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 12 Oct 2021 13:08:39 +0200 Subject: [PATCH 08/11] Removing autogenerated files Signed-off-by: Sebastian --- .templates/new-scanner/README.md | 49 ------------------- .../parser/package-lock.json.license | 3 -- .../new-scanner/parser/package.json.license | 3 -- 3 files changed, 55 deletions(-) delete mode 100644 .templates/new-scanner/README.md delete mode 100644 .templates/new-scanner/parser/package-lock.json.license delete mode 100644 .templates/new-scanner/parser/package.json.license diff --git a/.templates/new-scanner/README.md b/.templates/new-scanner/README.md deleted file mode 100644 index 6895361b65..0000000000 --- a/.templates/new-scanner/README.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "new-scanner" -category: "scanner" -type: "Network" -state: "released" -appVersion: "" -usecase: "NEW SCANNER USECASE" ---- - -ADD A [LOGO]() HERE! - - - - -

- License Apache-2.0 - GitHub release (latest SemVer) - OWASP Incubator Project - Artifact HUB - GitHub Repo stars - Twitter Follower -

- -## What is new-scanner? - -Please write some information about the new scanner. - -## Deployment -The new-scanner chart can be deployed via helm: - -```bash -# Install HelmChart (use -n to configure another namespace) -helm upgrade --install new-scanner secureCodeBox/new-scanner -``` - diff --git a/.templates/new-scanner/parser/package-lock.json.license b/.templates/new-scanner/parser/package-lock.json.license deleted file mode 100644 index c59b85a5b5..0000000000 --- a/.templates/new-scanner/parser/package-lock.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: 2021 iteratec GmbH - -SPDX-License-Identifier: Apache-2.0 diff --git a/.templates/new-scanner/parser/package.json.license b/.templates/new-scanner/parser/package.json.license deleted file mode 100644 index c59b85a5b5..0000000000 --- a/.templates/new-scanner/parser/package.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: 2021 iteratec GmbH - -SPDX-License-Identifier: Apache-2.0 From 1fd58770b3a9c4e38bb8a954033819e356c4048f Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 12 Oct 2021 13:08:54 +0200 Subject: [PATCH 09/11] Removing optional file that is not always used Signed-off-by: Sebastian --- .templates/new-scanner/parser/package.json | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 .templates/new-scanner/parser/package.json diff --git a/.templates/new-scanner/parser/package.json b/.templates/new-scanner/parser/package.json deleted file mode 100644 index 6c697fa507..0000000000 --- a/.templates/new-scanner/parser/package.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "name": "@securecodebox/parser-new-scanner", - "version": "1.0.0", - "description": "Parses result files for the type: 'new-scanner-json'", - "main": "", - "scripts": {}, - "keywords": [], - "author": "iteratec GmbH", - "license": "Apache-2.0", - "dependencies": { - "lodash": "^4.17.21" - }, - "devDependencies": {} -} From 8819b3927a70a69ea3badf73b26a5368000bd294 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 12 Oct 2021 13:09:25 +0200 Subject: [PATCH 10/11] Fixing typo Signed-off-by: Sebastian --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 47e22c734c..87ef02800f 100644 --- a/Makefile +++ b/Makefile @@ -152,7 +152,7 @@ create-new-scanner: ## Creates templates for a new scanner, pass NAME=NEW-SCANNE ifdef NAME @mkdir scanners/$(NAME) ; \ rsync -a ./.templates/new-scanner/ ./scanners/$(NAME) ; \ - echo "Copyied template files to new directory ./scanners/$(NAME)"; \ + echo "Copied template files to new directory ./scanners/$(NAME)"; \ cd scanners/$(NAME) ; \ find . -type f -exec sed -i 's/new-scanner/$(NAME)/g' {} + ; \ mv "./templates/new-scanner-parse-definition.yaml" "templates/$(NAME)-parse-definition.yaml" ; \ From adba333b6af30b6de003a24f618e6b4747374ae1 Mon Sep 17 00:00:00 2001 From: SebieF Date: Tue, 12 Oct 2021 11:09:52 +0000 Subject: [PATCH 11/11] Updating Helm Docs Signed-off-by: GitHub Actions --- .templates/new-scanner/README.md | 49 ++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 .templates/new-scanner/README.md diff --git a/.templates/new-scanner/README.md b/.templates/new-scanner/README.md new file mode 100644 index 0000000000..6895361b65 --- /dev/null +++ b/.templates/new-scanner/README.md @@ -0,0 +1,49 @@ +--- +title: "new-scanner" +category: "scanner" +type: "Network" +state: "released" +appVersion: "" +usecase: "NEW SCANNER USECASE" +--- + +ADD A [LOGO]() HERE! + + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is new-scanner? + +Please write some information about the new scanner. + +## Deployment +The new-scanner chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install new-scanner secureCodeBox/new-scanner +``` +