Skip to content

Commit e3eee2b

Browse files
nichtsfreinichtsfrei
committed
Add: container-image-scanner-user-flows
1 parent 9c5ad80 commit e3eee2b

10 files changed

Lines changed: 263 additions & 9 deletions

File tree

‎.github/workflows/functional.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
# TODO: make version robust
4444
- run: curl -L https://github.com/Orange-OpenSource/hurl/releases/download/7.1.0/hurl_7.1.0_amd64.deb -o hurl.deb
4545
- run: sudo apt-get install -y ./hurl.deb
46-
- run: cd compose && OPENVAS_IMAGE="${{ inputs.image }}" make test-environment-up
46+
- run: cd compose && OPENVAS_IMAGE="${{ inputs.image }}" make test-environment-running
4747
- run: cd compose/tests/smoketest && make
4848
- run: cd compose && make test-environment-logs
4949
if: always()

‎compose/Makefile‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,16 @@ HAS_DOCKER_COMPOSE_V2 := $(shell docker compose version >/dev/null 2>&1 && echo
22
HAS_DOCKER_COMPOSE_V1 := $(shell command -v docker-compose 2>/dev/null)
33

44
ifeq ($(HAS_DOCKER_COMPOSE_V2),1)
5-
# docker compose cannot deal with default veriables?
5+
CCMD := docker
66
CMD := docker compose
77
else ifneq ($(HAS_DOCKER_COMPOSE_V1),)
88
CMD := docker-compose
99
else
10+
CCMD := podman
1011
CMD := podman-compose
1112
endif
1213

13-
TEST_ENVIRONMENTS := -f base.yaml -f mtls.yaml -f tests/victim.yaml
14+
TEST_ENVIRONMENTS := -f base.yaml -f mtls.yaml -f tests/victim.yaml -f local-registry.yaml
1415

1516
ifndef OPENVAS_IMAGE
1617
OPENVAS_IMAGE := ghcr.io/greenbone/openvas-scanner:stable
@@ -37,9 +38,8 @@ test-environment-down:
3738

3839
.PHONY: test-environment-logs
3940
test-environment-logs:
40-
${CMD} ${TEST_ENVIRONMENTS} logs openvasd
41-
42-
41+
${CMD} ${TEST_ENVIRONMENTS} logs
42+
4343
.PHONY: test-environment-up
4444
test-environment-up: openvasd-server.key client-certs/client1.pem
4545
OPENVAS_IMAGE=${OPENVAS_IMAGE} ${CMD} ${TEST_ENVIRONMENTS} up -d
@@ -49,6 +49,32 @@ local-test-environment-up: openvasd-server.key client-certs/client1.pem
4949
cd .. && podman build -f .docker/prod.Dockerfile -t localhost/openvas:latest --build-arg BIN_VERSION=0.0.1 .
5050
OPENVAS_IMAGE=localhost/openvas:latest ${CMD} ${TEST_ENVIRONMENTS} up
5151

52+
define check_container_status
53+
$(CCMD) ps -a --format '{{.Names}}' \
54+
| grep '$(1)' \
55+
| xargs $(CCMD) inspect -f '{{.State.Status}}' \
56+
| grep -qx '$(2)'
57+
endef
58+
59+
define wait_for_status
60+
@printf "Waiting for $(1) to be $(2): "
61+
while ! $(call check_container_status,$(1),$(2)); do \
62+
sleep 1; \
63+
done
64+
@printf "$(2)\n"
65+
endef
66+
67+
.PHONY: wait-for-services
68+
wait-for-services:
69+
@$(call wait_for_status,openvasd,running)
70+
@$(call wait_for_status,registry_seed,exited)
71+
72+
.PHONY: test-environment-up
73+
test-environment-running: test-environment-up wait-for-services
74+
75+
.PHONY: local-test-environment-up
76+
local-test-environment-running: local-test-environment-up wait-for-services
77+
5278
.PHONY: smoketests
53-
smoketests: test-environment-up
79+
smoketests: wait-for-images
5480
cd tests && make smoketests

‎compose/local-registry.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: greenbone-community-edition
2+
3+
services:
4+
auth_server:
5+
image: docker.io/cesanta/docker_auth
6+
container_name: auth_server
7+
ports:
8+
- "127.0.0.1:5001:5001"
9+
volumes:
10+
# assumes to be started from Makefile above
11+
- ./local-registry:/config
12+
- ${OPENVASD_SERVER_PEM:-./openvasd-server.pem}:/server.pem:ro
13+
- ${OPENVASD_SERVER_KEY:-./openvasd-server.key}:/server.key:ro
14+
restart: unless-stopped
15+
16+
registry:
17+
image: docker.io/registry:2
18+
container_name: registry
19+
ports:
20+
- "127.0.0.1:5000:5000"
21+
volumes:
22+
- ${OPENVASD_SERVER_PEM:-./openvasd-server.pem}:/server.pem:ro
23+
- ${OPENVASD_SERVER_KEY:-./openvasd-server.key}:/server.key:ro
24+
environment:
25+
REGISTRY_AUTH: token
26+
REGISTRY_HTTP_TLS_CERTIFICATE: /server.pem
27+
REGISTRY_HTTP_TLS_KEY: /server.key
28+
REGISTRY_AUTH_TOKEN_REALM: https://auth_server:5001/auth
29+
REGISTRY_AUTH_TOKEN_SERVICE: registry:5000
30+
REGISTRY_AUTH_TOKEN_ISSUER: MyAuthServer
31+
REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE: /server.pem
32+
depends_on:
33+
- auth_server
34+
restart: unless-stopped
35+
36+
registry_seed:
37+
build:
38+
context: ./local-registry
39+
dockerfile: skopeo.Dockerfile
40+
depends_on:
41+
- registry
42+
environment:
43+
REGISTRY: registry:5000
44+
USERNAME: test
45+
PASSWORD: test
46+
IMAGES: >
47+
docker.io/nichtsfrei/victim:latest
48+
docker.io/openeuler/openeuler:latest
49+
docker.io/openeuler/openeuler:24.03-lts-sp1
50+
docker.io/openeuler/openeuler:20.03-lts-sp4
51+
restart: "no"

‎compose/local-registry/auth_config.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
server:
2+
addr: ":5001"
3+
certificate: "/server.pem"
4+
key: "/server.key"
5+
6+
token:
7+
issuer: "MyAuthServer"
8+
expiration: 900
9+
10+
# allow all usernames and password
11+
# we just use to replicate token based registry
12+
ext_auth:
13+
command: "true"
14+
args: []
15+
16+
acl:
17+
- match: { account: "/.+/" }
18+
actions: ["*"]
19+
comment: "Allow full access to any user"
20+

‎compose/local-registry/skopeo-push-registry.bash‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
# debug marker (change this to verify rebuilds)
5+
echo "gosh i hate infrastructure"
6+
7+
# configurable variables (can be overridden via env)
8+
REGISTRY="${REGISTRY:-registry:5000}"
9+
USERNAME="${USERNAME:-dummy}"
10+
PASSWORD="${PASSWORD:-dummy}"
11+
12+
IMAGES="${IMAGES:-\
13+
docker.io/nichtsfrei/victim:latest \
14+
docker.io/openeuler/openeuler:latest \
15+
docker.io/openeuler/openeuler:24.03-lts-sp1 \
16+
docker.io/openeuler/openeuler:20.03-lts-sp4\
17+
}"
18+
19+
echo "Using registry: $REGISTRY"
20+
echo "Images: $IMAGES"
21+
22+
skopeo login \
23+
--tls-verify=false \
24+
--username "$USERNAME" \
25+
--password "$PASSWORD" \
26+
"$REGISTRY"
27+
28+
for img in $IMAGES; do
29+
name=${img#docker.io/}
30+
echo "Copying $img -> $REGISTRY/$name"
31+
32+
skopeo copy \
33+
--dest-tls-verify=false \
34+
"docker://$img" \
35+
"docker://$REGISTRY/$name"
36+
done
37+
38+
touch /state/push-done

‎compose/local-registry/skopeo.Dockerfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
FROM quay.io/skopeo/stable:latest
2+
3+
COPY skopeo-push-registry.bash /usr/local/bin/skopeo-push-registry.bash
4+
RUN mkdir /state
5+
RUN chmod +x /usr/local/bin/skopeo-push-registry.bash
6+
7+
ENTRYPOINT ["/usr/local/bin/skopeo-push-registry.bash"]

‎compose/tests/smoketest/Makefile‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,13 @@ SCANS_USER_FLOW := ${MAKEFILE_PATH}/scans-user-flows
2929
SCANS_USER_FLOW := $(basename $(notdir $(wildcard $(SCANS_USER_FLOW)/*.json)))
3030
SCANS_USER_FLOW := $(addprefix scans-user-flow-,$(SCANS_USER_FLOW))
3131

32-
all: up-and-running notus scans-user-flow-victim-simple-auth-ssh
32+
CONTAINER_IMAGE_SCANNER_USER_FLOW := ${MAKEFILE_PATH}/container-image-scanner-user-flows
33+
CONTAINER_IMAGE_SCANNER_USER_FLOW := $(basename $(notdir $(wildcard $(CONTAINER_IMAGE_SCANNER_USER_FLOW)/*.json)))
34+
CONTAINER_IMAGE_SCANNER_USER_FLOW := $(addprefix container-image-scanner-user-flow-,$(CONTAINER_IMAGE_SCANNER_USER_FLOW))
35+
36+
37+
38+
all: up-and-running notus scans-user-flow-victim-simple-auth-ssh container-image-scanner-user-flow-local-registry-full
3339

3440
.PHONY: up-and-running
3541
up-and-running:
@@ -53,3 +59,9 @@ $(SCANS_USER_FLOW):
5359
$(eval SCAN_CONFIG := $(patsubst scans-user-flow-%,%,$@))
5460
${HURL_BASE} --variable scan_config=${SCAN_CONFIG}.json ${MAKEFILE_PATH}/scans-user-flows/*.hurl
5561

62+
.PHONY: $(CONTAINER_IMAGE_SCANNER_USER_FLOW)
63+
$(CONTAINER_IMAGE_SCANNER_USER_FLOW):
64+
$(eval SCAN_CONFIG := $(patsubst container-image-scanner-user-flow-%,%,$@))
65+
${HURL_BASE} --variable scan_config=${SCAN_CONFIG}.json ${MAKEFILE_PATH}/container-image-scanner-user-flows/*.hurl
66+
67+

‎compose/tests/smoketest/container-image-scanner-user-flows/local-registry-full.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"target": {
3+
"hosts": [
4+
"oci://registry:5000"
5+
],
6+
"credentials": [
7+
{
8+
"service": "generic",
9+
"up": {
10+
"username": "holla",
11+
"password": "diewaldfee"
12+
}
13+
}
14+
]
15+
},
16+
"scan_preferences": [
17+
{
18+
"id": "accept_invalid_certs",
19+
"value": "true"
20+
}
21+
]
22+
}

‎compose/tests/smoketest/container-image-scanner-user-flows/start-scan-flow.hurl‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
POST {{server}}/container-image-scanner/scans
2+
Content-Type: application/json
3+
file,{{scan_config}}; # WARN: scan_config is set on the root of the file, not path of hurl execution
4+
HTTP 201
5+
[Captures]
6+
scan_id: body replace "\"" ""
7+
8+
GET {{server}}/container-image-scanner/scans/{{scan_id}}
9+
HTTP 200
10+
[Asserts]
11+
jsonpath "$.scan_id" == {{scan_id}}
12+
13+
POST {{server}}/container-image-scanner/scans/{{scan_id}}
14+
{
15+
"action": "start"
16+
}
17+
HTTP 204
18+
19+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/status
20+
HTTP 200
21+
22+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/status
23+
[Options]
24+
retry: 3600 # about 60m
25+
retry-interval: 1s
26+
HTTP 200
27+
[Asserts]
28+
jsonpath "$.status" == "succeeded"
29+
30+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/status
31+
HTTP 200
32+
[Captures]
33+
host_info_all: jsonpath "$.host_info.all"
34+
[Asserts]
35+
jsonpath "$.start_time" exists
36+
jsonpath "$.end_time" exists
37+
jsonpath "$.host_info.all" > 0
38+
jsonpath "$.host_info.excluded" == 0
39+
jsonpath "$.host_info.dead" == 0
40+
jsonpath "$.host_info.alive" == {{host_info_all}}
41+
jsonpath "$.host_info.queued" == 0
42+
jsonpath "$.host_info.finished" == {{host_info_all}}
43+
44+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results
45+
HTTP 200
46+
[Captures]
47+
result_count: jsonpath "$.*" count
48+
[Asserts]
49+
jsonpath "$.*" count > 3 # needed for further testing
50+
51+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results/{{result_count}}
52+
HTTP 404
53+
54+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results?range={{result_count}}-{{result_count}}
55+
HTTP 200
56+
[Asserts]
57+
jsonpath "$.*" count == 0
58+
59+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results?range=0-{{result_count}}
60+
HTTP 200
61+
[Asserts]
62+
jsonpath "$.*" count == {{result_count}}
63+
64+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results?range=0-1
65+
HTTP 200
66+
[Asserts]
67+
jsonpath "$.*" count == 2
68+
69+
GET {{server}}/container-image-scanner/scans/{{scan_id}}/results/2
70+
HTTP 200
71+
[Asserts]
72+
jsonpath "$.id" == 2
73+
74+
DELETE {{server}}/container-image-scanner/scans/{{scan_id}}
75+
HTTP 204
76+
77+
GET {{server}}/container-image-scanner/scans/{{scan_id}}
78+
HTTP 404

‎compose/tests/smoketest/scans-user-flows/start-scan-flow.hurl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ result_count: jsonpath "$.*" count
4949
jsonpath "$.*" count > 3 # needed for further testing
5050

5151
GET {{server}}/scans/{{scan_id}}/results/{{result_count}}
52-
HTTP 404 # why not 404?
52+
HTTP 404
5353

5454
GET {{server}}/scans/{{scan_id}}/results?range={{result_count}}-{{result_count}}
5555
HTTP 200

0 commit comments

Comments
 (0)