Documentation
¶
Index ¶
- Constants
- Variables
- func CountVulTrait(traits []*VulTrait) (int, int, int)
- func DeepCopyRESTBenchCheck(orig api.RESTBenchCheck) api.RESTBenchCheck
- func DownloadFromUrl(url, fileName string) error
- func FillVul(vul *share.ScanVulnerability)
- func FillVulTraits(cvedb CVEDBType, baseOS string, vts []*VulTrait, showTag string, ...) []*api.RESTVulnerability
- func GatherVulTrait(traits []*VulTrait) ([]string, []string, []string, []string, []FixedVulInfo, []FixedVulInfo)
- func GetAwsFuncPackages(fileName string) ([]*share.ScanAppPackage, error)
- func GetCISFolder(platform, flavor, cloudPlatform string)
- func GetCVERecord(name, dbKey, baseOS string) *api.RESTVulnerability
- func GetComplianceFilterMap() map[string]int
- func GetComplianceMeta(version string) ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
- func GetCosignSignatureTagFromDigest(digest string) string
- func GetDpkgStatus(fullpath, kernel string) ([]byte, error)
- func GetImageBenchMeta() ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
- func GetK8sCISMeta(remediationFolder string, cis_bench_items map[string]api.RESTBenchCheck)
- func GetRpmPackages(fullpath, kernel string) ([]byte, error)
- func GetScannerDB() *share.CLUSScannerDB
- func GetSecretBenchMessage(stype, loc, evidence string) string
- func GetSetIDBenchMessage(stype, loc, evidence string) string
- func ImageBench2REST(cmds []string, secrets []*share.ScanSecretLog, ...) []*api.RESTBenchItem
- func InitComplianceMeta(platform, flavor, cloudPlatform string)
- func InitImageBenchMeta() ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
- func IsAppsPkgFile(filename, fullpath string) bool
- func IsJava(filename string) bool
- func IsRlangPackage(filename string) bool
- func LoadConfig(primeConfig string, params *UpdateConfigParams, updateCompliance bool) bool
- func NormalizeImageCmd(cmd string) string
- func ParseImageCmds(cmds []string) (bool, bool, bool)
- func ParseImageName(image string) (string, string, string, error)
- func ParseRegistryURI(ur string) (string, error)
- func Perf_getRandomCVEs(count int) []string
- func PrepareBackup()
- func PrepareBenchMeta(items map[string]api.RESTBenchCheck, metaMap map[string]api.RESTBenchMeta)
- func ScanErrorToStr(e share.ScanErrorCode) string
- func ScanModule2REST(m *share.ScanModule) *api.RESTScanModule
- func ScanRepoResult2REST(result *share.ScanResult, tagMap map[string][]string) *api.RESTScanRepoReport
- func ScanSecrets2REST(s *share.ScanSecretLog) *api.RESTScanSecret
- func ScanSetIdPerm2REST(p *share.ScanSetIdPermLog) *api.RESTScanSetIdPerm
- func ScanVul2REST(cvedb CVEDBType, baseOS string, vul *share.ScanVulnerability) *api.RESTVulnerability
- func SetScannerDB(newDB *share.CLUSScannerDB)
- func UnquoteChar(s string, quote byte) (value rune, multibyte bool, tail string, err error)
- func UpdateComplianceConfigs()
- type AppPackage
- type BuildInfo
- type BuildSetting
- type CISBenchmarkConfig
- type CISCheck
- type CISCheckWithTags
- type CVEDBType
- type CacheRecord
- type CacherData
- type ComposerLock
- type ComposerPackage
- type Config
- type FixedVulInfo
- type Group
- type ImageInfo
- type Module
- type Option
- type PrimeCISBenchmarkConfig
- type RPMPackage
- type RegClient
- type ScanApps
- type ScanUtil
- type UpdateConfigParams
- type VPFInterface
- type VulTrait
Constants ¶
const ( AppFileName = "apps_pkg" WPVerFileSuffix = "wp-includes/version.php" ComposerFile = "/composer.lock" )
const ( V1 = "v1" V2 = "v2" )
const ( DpkgStatus = "var/lib/dpkg/status" DpkgStatusDir = "var/lib/dpkg/status.d/" // used by distroless images )
Variables ¶
var OSPkgFiles utils.Set = utils.NewSet( DpkgStatus, DpkgStatusDir, apkPackages, "etc/lsb-release", "etc/os-release", "usr/lib/os-release", "etc/centos-release", "etc/redhat-release", "etc/system-release", "etc/fedora-release", "etc/apt/sources.list", ).Union(RPMPkgFiles)
var RPMPkgFiles utils.Set = utils.NewSet(
"var/lib/rpm/Packages",
"usr/lib/sysimage/rpm/Packages",
"var/lib/rpm/Packages.db",
"usr/lib/sysimage/rpm/Packages.db",
"var/lib/rpm/rpmdb.sqlite",
"usr/lib/sysimage/rpm/rpmdb.sqlite",
)
var ( // ReadPrimeConfig indicate if the controller pod read the prime config before ReadPrimeConfig bool )
Functions ¶
func DeepCopyRESTBenchCheck ¶
func DeepCopyRESTBenchCheck(orig api.RESTBenchCheck) api.RESTBenchCheck
func FillVul ¶
func FillVul(vul *share.ScanVulnerability)
This is use when grpc structure is returned
func FillVulTraits ¶
func GatherVulTrait ¶
func GatherVulTrait(traits []*VulTrait) ([]string, []string, []string, []string, []FixedVulInfo, []FixedVulInfo)
func GetAwsFuncPackages ¶
func GetAwsFuncPackages(fileName string) ([]*share.ScanAppPackage, error)
func GetCISFolder ¶
func GetCISFolder(platform, flavor, cloudPlatform string)
func GetCVERecord ¶
func GetCVERecord(name, dbKey, baseOS string) *api.RESTVulnerability
func GetComplianceFilterMap ¶
func GetComplianceMeta ¶
func GetComplianceMeta(version string) ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
version V2 Return the Tags map[string]share.TagDetails version V1 Return the Tags []string for backward compatible
func GetCosignSignatureTagFromDigest ¶
GetCosignSignatureTagFromDigest takes an image digest and returns the default tag used by Cosign to store signature data for the given digest.
Example transition ¶
Given Image Digest: sha256:5e9473a466b637e566f32ede17c23d8b2fd7e575765a9ebd5169b9dbc8bb5d16
Resulting Signature Tag: sha256-5e9473a466b637e566f32ede17c23d8b2fd7e575765a9ebd5169b9dbc8bb5d16.sig
func GetDpkgStatus ¶
func GetImageBenchMeta ¶
func GetImageBenchMeta() ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
Image just return v1
func GetK8sCISMeta ¶
func GetK8sCISMeta(remediationFolder string, cis_bench_items map[string]api.RESTBenchCheck)
func GetRpmPackages ¶
func GetScannerDB ¶
func GetScannerDB() *share.CLUSScannerDB
func GetSecretBenchMessage ¶
func GetSetIDBenchMessage ¶
func ImageBench2REST ¶
func ImageBench2REST(cmds []string, secrets []*share.ScanSecretLog, setids []*share.ScanSetIdPermLog, complianceProfileFilter map[string][]string) []*api.RESTBenchItem
func InitComplianceMeta ¶
func InitComplianceMeta(platform, flavor, cloudPlatform string)
func InitImageBenchMeta ¶
func InitImageBenchMeta() ([]api.RESTBenchMeta, map[string]api.RESTBenchMeta)
func IsAppsPkgFile ¶
func IsRlangPackage ¶
func LoadConfig ¶
func LoadConfig(primeConfig string, params *UpdateConfigParams, updateCompliance bool) bool
func NormalizeImageCmd ¶
func ParseImageName ¶
Not a strict parsing, if the input is wrong, we just cannot get the image.
func ParseRegistryURI ¶
func PrepareBackup ¶
func PrepareBackup()
func PrepareBenchMeta ¶
func PrepareBenchMeta(items map[string]api.RESTBenchCheck, metaMap map[string]api.RESTBenchMeta)
func ScanErrorToStr ¶
func ScanErrorToStr(e share.ScanErrorCode) string
func ScanModule2REST ¶
func ScanModule2REST(m *share.ScanModule) *api.RESTScanModule
func ScanRepoResult2REST ¶
func ScanRepoResult2REST(result *share.ScanResult, tagMap map[string][]string) *api.RESTScanRepoReport
func ScanSecrets2REST ¶
func ScanSecrets2REST(s *share.ScanSecretLog) *api.RESTScanSecret
func ScanSetIdPerm2REST ¶
func ScanSetIdPerm2REST(p *share.ScanSetIdPermLog) *api.RESTScanSetIdPerm
func ScanVul2REST ¶
func ScanVul2REST(cvedb CVEDBType, baseOS string, vul *share.ScanVulnerability) *api.RESTVulnerability
Functions can be used in both controllers and scanner
func SetScannerDB ¶
func SetScannerDB(newDB *share.CLUSScannerDB)
func UnquoteChar ¶
func UpdateComplianceConfigs ¶
func UpdateComplianceConfigs()
Types ¶
type AppPackage ¶
type BuildInfo ¶
type BuildInfo struct { // GoVersion is the version of the Go toolchain that built the binary // (for example, "go1.19.2"). GoVersion string // Path is the package path of the main package for the binary // (for example, "golang.org/x/tools/cmd/stringer"). Path string // Main describes the module that contains the main package for the binary. Main Module // Deps describes all the dependency modules, both direct and indirect, // that contributed packages to the build of this binary. Deps []*Module // Settings describes the build settings used to build the binary. Settings []BuildSetting }
BuildInfo represents the build information read from a Go binary.
type BuildSetting ¶
type BuildSetting struct {
// Key and Value describe the build setting.
// Key must not contain an equals sign, space, tab, or newline.
// Value must not contain newlines ('\n').
Key, Value string
}
A BuildSetting is a key-value pair describing one setting that influenced a build.
Defined keys include:
- -buildmode: the buildmode flag used (typically "exe")
- -compiler: the compiler toolchain flag used (typically "gc")
- CGO_ENABLED: the effective CGO_ENABLED environment variable
- CGO_CFLAGS: the effective CGO_CFLAGS environment variable
- CGO_CPPFLAGS: the effective CGO_CPPFLAGS environment variable
- CGO_CXXFLAGS: the effective CGO_CPPFLAGS environment variable
- CGO_LDFLAGS: the effective CGO_CPPFLAGS environment variable
- GOARCH: the architecture target
- GOAMD64/GOARM64/GO386/etc: the architecture feature level for GOARCH
- GOOS: the operating system target
- vcs: the version control system for the source tree where the build ran
- vcs.revision: the revision identifier for the current commit or checkout
- vcs.time: the modification time associated with vcs.revision, in RFC3339 format
- vcs.modified: true or false indicating whether the source tree had local modifications
type CISBenchmarkConfig ¶
type CISBenchmarkConfig struct {
Groups []Group `yaml:"groups"`
}
type CISCheck ¶
type CISCheck struct { ID string `yaml:"id"` Description string `yaml:"description"` Type string `yaml:"type"` Category string `yaml:"category"` Scored bool `yaml:"scored"` Profile string `yaml:"profile"` Automated bool `yaml:"automated"` Tags map[string]share.TagDetails `yaml:"tags,omitempty"` Remediation string `yaml:"remediation"` }
type CISCheckWithTags ¶
type CISCheckWithTags struct { ID string `yaml:"id"` Tags map[string]share.TagDetails `yaml:"tags,omitempty"` }
type CVEDBType ¶
type CVEDBType map[string]*share.ScanVulnerability
type CacheRecord ¶
type CacherData ¶
type CacherData struct { CacheRecords []CacheRecord `json:"cache_records,omitempty"` MissCnt uint64 `json:"cache_misses,omitempty"` HitCnt uint64 `json:"cache_hits,omitempty"` CurRecordSize uint64 `json:"current_record_size"` }
type ComposerLock ¶
type ComposerLock struct { Packages []ComposerPackage `json:"packages"` DevPackages []ComposerPackage `json:"packages-dev"` }
type ComposerPackage ¶
type FixedVulInfo ¶
type FixedVulInfo struct {
PubTS int64
}
type Module ¶
type Module struct { Path string // module path Version string // module version Sum string // checksum Replace *Module // replaced by this module }
A Module describes a single module included in a build.
type PrimeCISBenchmarkConfig ¶
type PrimeCISBenchmarkConfig struct {
CISChecksWithTags []CISCheckWithTags `yaml:"checks"`
}
type RPMPackage ¶
type RegClient ¶
func NewRegClient ¶
func NewRegClient(url, token, username, password, proxy string, trace httptrace.HTTPTrace) *RegClient
If token is given, the Authorization header will be added with token appended.
func (*RegClient) GetImageInfo ¶
func (rc *RegClient) GetImageInfo(ctx context.Context, name, tag string, manifestReqType registry.ManifestRequestType) (*ImageInfo, share.ScanErrorCode)
type ScanApps ¶
type ScanApps struct {
// contains filtered or unexported fields
}
func NewScanApps ¶
func (*ScanApps) Data ¶
func (s *ScanApps) Data() map[string][]AppPackage
func (*ScanApps) ExtractAppPkg ¶
type ScanUtil ¶
type ScanUtil struct {
// contains filtered or unexported fields
}
func NewScanUtil ¶
func NewScanUtil(sys *system.SystemTools) *ScanUtil
Scan normally doesn't require contaiener runtime socket, except for local image scan
func (*ScanUtil) GetAppPackages ¶
func (s *ScanUtil) GetAppPackages(path string) ([]AppPackage, []byte, share.ScanErrorCode)
func (*ScanUtil) GetRunningPackages ¶
func (s *ScanUtil) GetRunningPackages(id string, objType share.ScanObjectType, pid int, kernel string, pidHost bool) ([]byte, share.ScanErrorCode)
type UpdateConfigParams ¶
type UpdateConfigParams struct { Metas *[]api.RESTBenchMeta MetaMap map[string]api.RESTBenchMeta MetasV2 *[]api.RESTBenchMeta MetaMapV2 map[string]api.RESTBenchMeta FilterMap map[string]int }
type VPFInterface ¶
type VPFInterface interface { GetUpdatedTime() time.Time FilterVulREST(vuls []*api.RESTVulnerability, idns []api.RESTIDName, showTag string) []*api.RESTVulnerability FilterVulTraits(traits []*VulTrait, idns []api.RESTIDName) utils.Set FilterVuls(vuls []*share.ScanVulnerability, idns []api.RESTIDName) []*share.ScanVulnerability // contains filtered or unexported methods }
func MakeVulnerabilityProfileFilter ¶
func MakeVulnerabilityProfileFilter(vf *api.RESTVulnerabilityProfile) VPFInterface
type VulTrait ¶
type VulTrait struct { Name string // contains filtered or unexported fields }
These are the unique attributes of vul. that can be different in different workload, other info can get from cvedb
func ExtractVulnerability ¶
func ExtractVulnerability(vuls []*share.ScanVulnerability) []*VulTrait