From 07fa3b45891d796731f30a3283d88f86ae2f0c5b Mon Sep 17 00:00:00 2001 From: dingfei Date: Fri, 6 Jan 2023 17:28:36 +0800 Subject: [PATCH] bug fix of cannot read local artifacts --- core/cautils/scaninfo.go | 6 +++++- core/core/download.go | 4 ++-- core/core/initutils.go | 8 ++++++-- core/core/scan.go | 4 ++-- httphandler/handlerequests/v1/datastructuremethods.go | 2 +- 5 files changed, 16 insertions(+), 8 deletions(-) diff --git a/core/cautils/scaninfo.go b/core/cautils/scaninfo.go index 651fbda7..7fd846ad 100644 --- a/core/cautils/scaninfo.go +++ b/core/cautils/scaninfo.go @@ -11,7 +11,7 @@ import ( apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" giturl "github.com/kubescape/go-git-url" - logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/kubescape/v2/core/cautils/getter" @@ -104,6 +104,7 @@ type ScanInfo struct { PolicyIdentifier []PolicyIdentifier // TODO - remove from object UseExceptions string // Load file with exceptions configuration ControlsInputs string // Load file with inputs for controls + AttackTracks string // Load file with attack tracks UseFrom []string // Load framework from local file (instead of download). Use when running offline UseDefault bool // Load framework from cached file (instead of download). Use when running offline UseArtifactsFrom string // Load artifacts from local path. Use when running offline @@ -179,6 +180,9 @@ func (scanInfo *ScanInfo) setUseArtifactsFrom() { scanInfo.ControlsInputs = filepath.Join(scanInfo.UseArtifactsFrom, localControlInputsFilename) // set exceptions scanInfo.UseExceptions = filepath.Join(scanInfo.UseArtifactsFrom, LocalExceptionsFilename) + + // set attack tracks + scanInfo.AttackTracks = filepath.Join(scanInfo.UseArtifactsFrom, LocalAttackTracksFilename) } func (scanInfo *ScanInfo) setUseFrom() { diff --git a/core/core/download.go b/core/core/download.go index bd7d8203..54be4fc6 100644 --- a/core/core/download.go +++ b/core/core/download.go @@ -6,7 +6,7 @@ import ( "path/filepath" "strings" - logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/kubescape/v2/core/cautils/getter" metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" @@ -137,7 +137,7 @@ func downloadAttackTracks(downloadInfo *metav1.DownloadInfo) error { var err error tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) - attackTracksGetter := getAttackTracksGetter(tenant.GetAccountID(), nil) + attackTracksGetter := getAttackTracksGetter("", tenant.GetAccountID(), nil) attackTracks, err := attackTracksGetter.GetAttackTracks() if err != nil { diff --git a/core/core/initutils.go b/core/core/initutils.go index f03fa4ec..11cb88ba 100644 --- a/core/core/initutils.go +++ b/core/core/initutils.go @@ -4,7 +4,7 @@ import ( "fmt" "os" - logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/kubescape/v2/core/cautils" @@ -247,7 +247,10 @@ func listFrameworksNames(policyGetter getter.IPolicyGetter) []string { return getter.NativeFrameworks } -func getAttackTracksGetter(accountID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IAttackTracksGetter { +func getAttackTracksGetter(attackTracks, accountID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IAttackTracksGetter { + if len(attackTracks) > 0 { + return getter.NewLoadPolicy([]string{attackTracks}) + } if accountID != "" { g := getter.GetKSCloudAPIConnector() // download attack tracks from Kubescape Cloud backend return g @@ -255,6 +258,7 @@ func getAttackTracksGetter(accountID string, downloadReleasedPolicy *getter.Down if downloadReleasedPolicy == nil { downloadReleasedPolicy = getter.NewDownloadReleasedPolicy() } + if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { // if failed to pull attack tracks, fallback to cache logger.L().Warning("failed to get attack tracks from github release, loading attack tracks from cache", helpers.Error(err)) return getter.NewLoadPolicy([]string{getter.GetDefaultPath(cautils.LocalAttackTracksFilename)}) diff --git a/core/core/scan.go b/core/core/scan.go index c2531c2d..c643a0dc 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -7,7 +7,7 @@ import ( "github.com/kubescape/k8s-interface/k8sinterface" - logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/cautils/getter" @@ -137,7 +137,7 @@ func (ks *Kubescape) Scan(scanInfo *cautils.ScanInfo) (*resultshandling.ResultsH scanInfo.Getters.PolicyGetter = getPolicyGetter(scanInfo.UseFrom, interfaces.tenantConfig.GetTenantEmail(), scanInfo.FrameworkScan, downloadReleasedPolicy) scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(scanInfo.ControlsInputs, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(scanInfo.UseExceptions, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) - scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) + scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(scanInfo.AttackTracks, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) // TODO - list supported frameworks/controls if scanInfo.ScanAll { diff --git a/httphandler/handlerequests/v1/datastructuremethods.go b/httphandler/handlerequests/v1/datastructuremethods.go index 83c01132..d55a6d59 100644 --- a/httphandler/handlerequests/v1/datastructuremethods.go +++ b/httphandler/handlerequests/v1/datastructuremethods.go @@ -32,7 +32,7 @@ func ToScanInfo(scanRequest *utilsmetav1.PostScanRequest) *cautils.ScanInfo { // UseCachedArtifacts if scanRequest.UseCachedArtifacts != nil { - if useCachedArtifacts := cautils.NewBoolPtr(scanRequest.UseCachedArtifacts); useCachedArtifacts.Get() != nil && !*useCachedArtifacts.Get() { + if useCachedArtifacts := cautils.NewBoolPtr(scanRequest.UseCachedArtifacts); useCachedArtifacts.Get() != nil && *useCachedArtifacts.Get() { scanInfo.UseArtifactsFrom = getter.DefaultLocalStore // Load files from cache (this will prevent kubescape fom downloading the artifacts every time) } }