mirror of
https://github.com/project-zot/zot.git
synced 2024-12-16 21:56:37 -05:00
7c78f80a96
1. Move existing CVE DB download generator/task login under the cve package 2. Add a new CVE scanner task generator and task type to run in the background, as well as tests for it 3. Move the CVE cache in its own package 4. Add a CVE scanner methods to check if an entry is present in the cache, and to retreive the results 5. Modify the FilterTags MetaDB method to not exit on first error This is needed in order to pass all tags to the generator, instead of the generator stopping at the first set of invalid data 6. Integrate the new scanning task generator with the existing zot code. 7. Fix an issue where the CVE scan results for multiarch images was not cached 8. Rewrite some of the older CVE tests to use the new image-utils test package 9. Use the CVE scanner as attribute of the controller instead of CveInfo. Remove functionality of CVE DB update from CveInfo, it is now responsible, as the name states, only for providing CVE information. 10. The logic to get maximum severity and cve count for image sumaries now uses only the scanner cache. 11. Removed the GetCVESummaryForImage method from CveInfo as it was only used in tests Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
105 lines
3.3 KiB
Go
105 lines
3.3 KiB
Go
//go:build search
|
|
// +build search
|
|
|
|
package extensions
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
gqlHandler "github.com/99designs/gqlgen/graphql/handler"
|
|
"github.com/gorilla/mux"
|
|
|
|
"zotregistry.io/zot/pkg/api/config"
|
|
"zotregistry.io/zot/pkg/api/constants"
|
|
zcommon "zotregistry.io/zot/pkg/common"
|
|
"zotregistry.io/zot/pkg/extensions/search"
|
|
cveinfo "zotregistry.io/zot/pkg/extensions/search/cve"
|
|
"zotregistry.io/zot/pkg/extensions/search/gql_generated"
|
|
"zotregistry.io/zot/pkg/log"
|
|
mTypes "zotregistry.io/zot/pkg/meta/types"
|
|
"zotregistry.io/zot/pkg/scheduler"
|
|
"zotregistry.io/zot/pkg/storage"
|
|
)
|
|
|
|
const scanInterval = 15 * time.Minute
|
|
|
|
type CveScanner cveinfo.Scanner
|
|
|
|
func IsBuiltWithSearchExtension() bool {
|
|
return true
|
|
}
|
|
|
|
func GetCveScanner(conf *config.Config, storeController storage.StoreController,
|
|
metaDB mTypes.MetaDB, log log.Logger,
|
|
) CveScanner {
|
|
if !conf.IsCveScanningEnabled() {
|
|
return nil
|
|
}
|
|
|
|
dbRepository := conf.Extensions.Search.CVE.Trivy.DBRepository
|
|
javaDBRepository := conf.Extensions.Search.CVE.Trivy.JavaDBRepository
|
|
|
|
return cveinfo.NewScanner(storeController, metaDB, dbRepository, javaDBRepository, log)
|
|
}
|
|
|
|
func EnableSearchExtension(conf *config.Config, storeController storage.StoreController,
|
|
metaDB mTypes.MetaDB, taskScheduler *scheduler.Scheduler, cveScanner CveScanner, log log.Logger,
|
|
) {
|
|
if conf.IsCveScanningEnabled() {
|
|
updateInterval := conf.Extensions.Search.CVE.UpdateInterval
|
|
|
|
downloadTrivyDB(updateInterval, taskScheduler, cveScanner, log)
|
|
startScanner(scanInterval, metaDB, taskScheduler, cveScanner, log)
|
|
} else {
|
|
log.Info().Msg("CVE config not provided, skipping CVE update")
|
|
}
|
|
}
|
|
|
|
func downloadTrivyDB(interval time.Duration, sch *scheduler.Scheduler, cveScanner CveScanner, log log.Logger) {
|
|
generator := cveinfo.NewDBUpdateTaskGenerator(interval, cveScanner, log)
|
|
|
|
log.Info().Msg("Submitting CVE DB update scheduler")
|
|
sch.SubmitGenerator(generator, interval, scheduler.HighPriority)
|
|
}
|
|
|
|
func startScanner(interval time.Duration, metaDB mTypes.MetaDB, sch *scheduler.Scheduler,
|
|
cveScanner CveScanner, log log.Logger,
|
|
) {
|
|
generator := cveinfo.NewScanTaskGenerator(metaDB, cveScanner, log)
|
|
|
|
log.Info().Msg("Submitting CVE scan scheduler")
|
|
sch.SubmitGenerator(generator, interval, scheduler.MediumPriority)
|
|
}
|
|
|
|
func SetupSearchRoutes(conf *config.Config, router *mux.Router, storeController storage.StoreController,
|
|
metaDB mTypes.MetaDB, cveScanner CveScanner, log log.Logger,
|
|
) {
|
|
if !conf.IsSearchEnabled() {
|
|
log.Info().Msg("skip enabling the search route as the config prerequisites are not met")
|
|
|
|
return
|
|
}
|
|
|
|
log.Info().Msg("setting up search routes")
|
|
|
|
var cveInfo cveinfo.CveInfo
|
|
if conf.IsCveScanningEnabled() {
|
|
cveInfo = cveinfo.NewCVEInfo(cveScanner, metaDB, log)
|
|
} else {
|
|
cveInfo = nil
|
|
}
|
|
|
|
resConfig := search.GetResolverConfig(log, storeController, metaDB, cveInfo)
|
|
|
|
allowedMethods := zcommon.AllowedMethods(http.MethodGet, http.MethodPost)
|
|
|
|
extRouter := router.PathPrefix(constants.ExtSearchPrefix).Subrouter()
|
|
extRouter.Use(zcommon.CORSHeadersMiddleware(conf.HTTP.AllowOrigin))
|
|
extRouter.Use(zcommon.ACHeadersMiddleware(conf, allowedMethods...))
|
|
extRouter.Use(zcommon.AddExtensionSecurityHeaders())
|
|
extRouter.Methods(allowedMethods...).
|
|
Handler(gqlHandler.NewDefaultServer(gql_generated.NewExecutableSchema(resConfig)))
|
|
|
|
log.Info().Msg("finished setting up search routes")
|
|
}
|