Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 072f06a

Browse files
J12934J12934
authored
Merge pull request #83 from secureCodeBox/result-download-links
Add Presigned URLs to download Scan Results to Scan Status
2 parents 5c95723 + 5eb0518 commit 072f06a

10 files changed

Lines changed: 49 additions & 68 deletions

File tree

‎operator/PROJECT‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ resources:
1717
- group: execution
1818
kind: ScheduledScan
1919
version: v1
20-
- group: targets
21-
kind: Host
22-
version: v1
2320
- group: cascading
2421
kind: CascadingRule
2522
version: v1

‎operator/apis/execution/v1/scan_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ type ScanStatus struct {
5252
// RawResultFile Filename of the result file of the scanner. e.g. `nmap-result.xml`
5353
RawResultFile string `json:"rawResultFile,omitempty"`
5454

55+
// FindingDownloadLink link to download the finding json file from. Valid for 7 days
56+
FindingDownloadLink string `json:"findingDownloadLink,omitempty"`
57+
// RawResultDownloadLink link to download the raw result file from. Valid for 7 days
58+
RawResultDownloadLink string `json:"rawResultDownloadLink,omitempty"`
59+
5560
Findings FindingStats `json:"findings,omitempty"`
5661

5762
ReadAndWriteHookStatus []HookStatus `json:"readAndWriteHookStatus,omitempty"`

‎operator/config/crd/bases/execution.experimental.securecodebox.io_scans.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,10 @@ spec:
218218
properties:
219219
errorDescription:
220220
type: string
221+
findingDownloadLink:
222+
description: FindingDownloadLink link to download the finding json file
223+
from. Valid for 7 days
224+
type: string
221225
findings:
222226
description: FindingStats contains the general stats about the results
223227
of the scan
@@ -257,6 +261,10 @@ spec:
257261
parser & hooks) has been marked as "Done"
258262
format: date-time
259263
type: string
264+
rawResultDownloadLink:
265+
description: RawResultDownloadLink link to download the raw result file
266+
from. Valid for 7 days
267+
type: string
260268
rawResultFile:
261269
description: RawResultFile Filename of the result file of the scanner.
262270
e.g. `nmap-result.xml`

‎operator/config/crd/kustomization.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,12 @@
22
# since it depends on service name and namespace that are out of this kustomize package.
33
# It should be run by config/default
44
resources:
5-
- bases/execution.experimental.securecodebox.io_scans.yaml
6-
- bases/execution.experimental.securecodebox.io_scantypes.yaml
7-
- bases/execution.experimental.securecodebox.io_scancompletionhooks.yaml
8-
- bases/execution.experimental.securecodebox.io_parsedefinitions.yaml
9-
- bases/execution.experimental.securecodebox.io_scheduledscans.yaml
10-
- bases/targets.experimental.securecodebox.io_hosts.yaml
11-
- bases/cascading.experimental.securecodebox.io_cascadingrules.yaml
5+
- bases/execution.experimental.securecodebox.io_scans.yaml
6+
- bases/execution.experimental.securecodebox.io_scantypes.yaml
7+
- bases/execution.experimental.securecodebox.io_scancompletionhooks.yaml
8+
- bases/execution.experimental.securecodebox.io_parsedefinitions.yaml
9+
- bases/execution.experimental.securecodebox.io_scheduledscans.yaml
10+
- bases/cascading.experimental.securecodebox.io_cascadingrules.yaml
1211
# +kubebuilder:scaffold:crdkustomizeresource
1312

1413
patchesStrategicMerge:
@@ -36,4 +35,4 @@ patchesStrategicMerge:
3635

3736
# the following config is for teaching kustomize how to do kustomization for CRDs.
3837
configurations:
39-
- kustomizeconfig.yaml
38+
- kustomizeconfig.yaml

‎operator/config/rbac/host_editor_role.yaml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎operator/config/rbac/host_viewer_role.yaml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎operator/controllers/execution/scans/hook_reconciler.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -82,20 +82,20 @@ func (r *ScanReconciler) executeReadAndWriteHooks(scan *executionv1.Scan) error
8282

8383
switch nonCompletedHook.State {
8484
case executionv1.Pending:
85-
rawFileURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile)
85+
rawFileURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile, defaultPresignDuration)
8686
if err != nil {
8787
return err
8888
}
89-
findingsFileURL, err := r.PresignedGetURL(scan.UID, "findings.json")
89+
findingsFileURL, err := r.PresignedGetURL(scan.UID, "findings.json", defaultPresignDuration)
9090
if err != nil {
9191
return err
9292
}
9393

94-
rawFileUploadURL, err := r.PresignedPutURL(scan.UID, scan.Status.RawResultFile)
94+
rawFileUploadURL, err := r.PresignedPutURL(scan.UID, scan.Status.RawResultFile, defaultPresignDuration)
9595
if err != nil {
9696
return err
9797
}
98-
findingsUploadURL, err := r.PresignedPutURL(scan.UID, "findings.json")
98+
findingsUploadURL, err := r.PresignedPutURL(scan.UID, "findings.json", defaultPresignDuration)
9999
if err != nil {
100100
return err
101101
}
@@ -242,11 +242,11 @@ func (r *ScanReconciler) startReadOnlyHooks(scan *executionv1.Scan) error {
242242
continue
243243
}
244244

245-
rawFileURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile)
245+
rawFileURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile, defaultPresignDuration)
246246
if err != nil {
247247
return err
248248
}
249-
findingsFileURL, err := r.PresignedGetURL(scan.UID, "findings.json")
249+
findingsFileURL, err := r.PresignedGetURL(scan.UID, "findings.json", defaultPresignDuration)
250250
if err != nil {
251251
return err
252252
}

‎operator/controllers/execution/scans/parse_reconciler.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
4949
}
5050
log.Info("Matching ParseDefinition Found", "ParseDefinition", parseType)
5151

52-
findingsUploadURL, err := r.PresignedPutURL(scan.UID, "findings.json")
52+
findingsUploadURL, err := r.PresignedPutURL(scan.UID, "findings.json", defaultPresignDuration)
5353
if err != nil {
5454
r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
5555
return err
5656
}
57-
rawResultDownloadURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile)
57+
rawResultDownloadURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile, defaultPresignDuration)
5858
if err != nil {
5959
return err
6060
}

‎operator/controllers/execution/scans/scan_controller.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ var (
5252
// https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#finalizers
5353
var s3StorageFinalizer = "s3.storage.experimental.securecodebox.io"
5454

55+
const defaultPresignDuration = 12 * time.Hour
56+
5557
// +kubebuilder:rbac:groups=execution.experimental.securecodebox.io,resources=scans,verbs=get;list;watch;create;update;patch;delete
5658
// +kubebuilder:rbac:groups=execution.experimental.securecodebox.io,resources=scans/status,verbs=get;update;patch
5759
// +kubebuilder:rbac:groups=execution.experimental.securecodebox.io,resources=scantypes,verbs=get;list;watch
@@ -147,11 +149,11 @@ func (r *ScanReconciler) handleFinalizer(scan *executionv1.Scan) error {
147149
}
148150

149151
// PresignedGetURL returns a presigned URL from the s3 (or compatible) serice.
150-
func (r *ScanReconciler) PresignedGetURL(scanID types.UID, filename string) (string, error) {
152+
func (r *ScanReconciler) PresignedGetURL(scanID types.UID, filename string, duration time.Duration) (string, error) {
151153
bucketName := os.Getenv("S3_BUCKET")
152154

153155
reqParams := make(url.Values)
154-
rawResultDownloadURL, err := r.MinioClient.PresignedGetObject(bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), 12*time.Hour, reqParams)
156+
rawResultDownloadURL, err := r.MinioClient.PresignedGetObject(bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), duration, reqParams)
155157
if err != nil {
156158
r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
157159
return "", err
@@ -160,10 +162,10 @@ func (r *ScanReconciler) PresignedGetURL(scanID types.UID, filename string) (str
160162
}
161163

162164
// PresignedPutURL returns a presigned URL from the s3 (or compatible) serice.
163-
func (r *ScanReconciler) PresignedPutURL(scanID types.UID, filename string) (string, error) {
165+
func (r *ScanReconciler) PresignedPutURL(scanID types.UID, filename string, duration time.Duration) (string, error) {
164166
bucketName := os.Getenv("S3_BUCKET")
165167

166-
rawResultDownloadURL, err := r.MinioClient.PresignedPutObject(bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), 12*time.Hour)
168+
rawResultDownloadURL, err := r.MinioClient.PresignedPutObject(bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), duration)
167169
if err != nil {
168170
r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
169171
return "", err

‎operator/controllers/execution/scans/scan_reconciler.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"os"
88
"path/filepath"
99
"strings"
10+
"time"
1011

1112
executionv1 "github.com/secureCodeBox/secureCodeBox-v2/operator/apis/execution/v1"
1213
util "github.com/secureCodeBox/secureCodeBox-v2/operator/utils"
@@ -89,6 +90,19 @@ func (r *ScanReconciler) startScan(scan *executionv1.Scan) error {
8990
scan.Status.State = "Scanning"
9091
scan.Status.RawResultType = scanType.Spec.ExtractResults.Type
9192
scan.Status.RawResultFile = filepath.Base(scanType.Spec.ExtractResults.Location)
93+
94+
findingsDownloadURL, err := r.PresignedGetURL(scan.UID, "findings.json", 7*24*time.Hour)
95+
if err != nil {
96+
r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
97+
return err
98+
}
99+
scan.Status.FindingDownloadLink = findingsDownloadURL
100+
rawResultDownloadURL, err := r.PresignedGetURL(scan.UID, scan.Status.RawResultFile, 7*24*time.Hour)
101+
if err != nil {
102+
return err
103+
}
104+
scan.Status.RawResultDownloadLink = rawResultDownloadURL
105+
92106
if err := r.Status().Update(ctx, scan); err != nil {
93107
log.Error(err, "unable to update Scan status")
94108
return err
@@ -129,7 +143,7 @@ func (r *ScanReconciler) checkIfScanIsCompleted(scan *executionv1.Scan) error {
129143

130144
func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *executionv1.ScanType) (*batch.Job, error) {
131145
filename := filepath.Base(scanType.Spec.ExtractResults.Location)
132-
resultUploadURL, err := r.PresignedPutURL(scan.UID, filename)
146+
resultUploadURL, err := r.PresignedPutURL(scan.UID, filename, defaultPresignDuration)
133147
if err != nil {
134148
r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
135149
return nil, err

0 commit comments

Comments
 (0)