Add Istio request handler and business logics for fetching Istio CVEs

api/v1/convert/istio.go

@@ -0,0 +1,49 @@
+package convert
+
+import (
+	"github.com/hashicorp/go-version"
+	log "github.com/sirupsen/logrus"
+	"github.com/stackrox/istio-cves/types"
+	"github.com/stackrox/rox/pkg/stringutils"
+	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
+	"github.com/stackrox/scanner/pkg/istioutil"
+	pkgtypes "github.com/stackrox/scanner/pkg/types"
+)
+
+// IstioVulnerabilities converts istio cve schema to vulnerability.
+func IstioVulnerabilities(vStr string, istioVulns []types.Vuln) []*v1.Vulnerability {
+	res := make([]*v1.Vulnerability, 0, len(istioVulns))
+	v, err := version.NewVersion(vStr)
+	if err != nil {
+		log.Infof("Failed to get version: %s", vStr)
+		return nil
+	}
+	for _, istioVuln := range istioVulns {
+		m, err := pkgtypes.ConvertMetadataFromIstio(istioVuln)
+		if err != nil {
+			log.Errorf("unable to convert metadata for %s: %istioVuln", istioVuln.Name, err)
+			continue
+		}
+		if m.IsNilOrEmpty() {
+			log.Warnf("nil or empty metadata for %s", istioVuln.Name)
+			continue
+		}
+
+		link := stringutils.OrDefault(istioVuln.Link, "https://istio.io/latest/news/security/")
+		_, fixedBy, err := istioutil.IsAffected(v, istioVuln)
+		if err != nil {
+			log.Errorf("unable to get fixedBy for %s: %istioVuln", istioVuln.Name, err)
+			continue
+		}
+
+		res = append(res, &v1.Vulnerability{
+			Name:        istioVuln.Name,
+			Description: istioVuln.Description,
+			Link:        link,
+			MetadataV2:  Metadata(m),
+			FixedBy:     fixedBy,
+			Severity:    string(DatabaseSeverityToSeverity(m.GetDatabaseSeverity())),
+		})
+	}
+	return res
+}

api/v1/orchestratorscan/openshift_test.go

@@ -141,7 +141,7 @@ func TestOpenShiftVulnVersion(t *testing.T) {
 				resp[record.Pkg.ID] = vulns
 				return resp, nil
 			}
-			service := NewService(db, nil)
+			service := NewService(db, nil, nil)
 			req := &scannerV1.GetOpenShiftVulnerabilitiesRequest{
 				OpenShiftVersion: c.version,
 			}

api/v1/orchestratorscan/service.go

@@ -12,6 +12,7 @@ import (
 	"github.com/stackrox/scanner/api/v1/convert"
 	"github.com/stackrox/scanner/database"
 	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
+	istioCache "github.com/stackrox/scanner/istio/cache"
 	k8scache "github.com/stackrox/scanner/k8s/cache"
 	"github.com/stackrox/scanner/pkg/version"
 	"google.golang.org/grpc"
@@ -27,20 +28,22 @@ type Service interface {
 }
 
 // NewService returns the service for scanning
-func NewService(db database.Datastore, k8sCache k8scache.Cache) Service {
+func NewService(db database.Datastore, k8sCache k8scache.Cache, istioCache istioCache.Cache) Service {
 	return &serviceImpl{
-		version:  version.Version,
-		db:       db,
-		k8sCache: k8sCache,
+		version:    version.Version,
+		db:         db,
+		k8sCache:   k8sCache,
+		istioCache: istioCache,
 	}
 }
 
 type serviceImpl struct {
 	v1.UnimplementedOrchestratorScanServiceServer
 
-	version  string
-	db       database.Datastore
-	k8sCache k8scache.Cache
+	version    string
+	db         database.Datastore
+	k8sCache   k8scache.Cache
+	istioCache istioCache.Cache
 }
 
 func filterInvalidVulns(vulns []*v1.Vulnerability) []*v1.Vulnerability {
@@ -107,6 +110,29 @@ func (s *serviceImpl) GetKubeVulnerabilities(_ context.Context, req *v1.GetKubeV
 	return resp, nil
 }
 
+// GetIstioVulnerabilities returns Istio vulnerabilities for requested Kubernetes version.
+func (s *serviceImpl) GetIstioVulnerabilities(_ context.Context, req *v1.GetIstioVulnerabilitiesRequest) (*v1.GetIstioVulnerabilitiesResponse, error) {
+	resp := &v1.GetIstioVulnerabilitiesResponse{
+		ScannerVersion: s.version,
+	}
+
+	if req.GetIstioVersion() == "" {
+		return nil, errors.New("Can't get vulnerabilities for empty version.")
+	}
+	version, err := convert.TruncateVersion(req.GetIstioVersion())
+	if err != nil {
+		log.Warnf("Unable to convert Istio version of %s - %v. Skipping...", version, err)
+		return nil, nil
+	}
+
+	vulns := s.istioCache.GetVulnsByVersion(version)
+	converted := convert.IstioVulnerabilities(version, vulns)
+
+	resp.Vulnerabilities = filterInvalidVulns(converted)
+
+	return resp, nil
+}
+
 func (s *serviceImpl) getOpenShiftVulns(version *openShiftVersion) ([]*database.RHELv2Vulnerability, error) {
 	pkg := &database.RHELv2Package{
 		Name: version.CreatePkgName(),

cmd/clair/main.go

@@ -39,6 +39,7 @@ import (
 	"github.com/stackrox/scanner/api/v1/vulndefs"
 	"github.com/stackrox/scanner/cpe/nvdtoolscache"
 	"github.com/stackrox/scanner/database"
+	istiocache "github.com/stackrox/scanner/istio/cache"
 	k8scache "github.com/stackrox/scanner/k8s/cache"
 	"github.com/stackrox/scanner/pkg/analyzer"
 	"github.com/stackrox/scanner/pkg/clairify/metrics"
@@ -119,6 +120,7 @@ func Boot(config *Config, slimMode bool) {
 
 	var nvdVulnCache nvdtoolscache.Cache
 	var k8sVulnCache k8scache.Cache
+	var istioVulnCache istiocache.Cache
 
 	if !slimMode {
 		wg.Add(1)
@@ -132,6 +134,12 @@ func Boot(config *Config, slimMode bool) {
 			defer wg.Add(-1)
 			k8sVulnCache = k8scache.Singleton()
 		}()
+
+		wg.Add(1)
+		go func() {
+			defer wg.Add(-1)
+			istioVulnCache = istiocache.Singleton()
+		}()
 	}
 
 	var repoToCPE *repo2cpe.Mapping
@@ -180,7 +188,7 @@ func Boot(config *Config, slimMode bool) {
 	grpcAPI.Register(
 		ping.NewService(),
 		imagescan.NewService(db, nvdVulnCache),
-		orchestratorscan.NewService(db, k8sVulnCache),
+		orchestratorscan.NewService(db, k8sVulnCache, istioVulnCache),
 		nodescan.NewService(db, nvdVulnCache, k8sVulnCache),
 		vulndefs.NewService(db),
 	)

e2etests/orchestrator_scan_test.go

@@ -20,6 +20,60 @@ var (
 	patchRegex = regexp.MustCompile(`^[0-9]+\.[0-9]+\.([0-9]+)$`)
 )
 
+func TestGRPCGetIstioVulnerabilities(t *testing.T) {
+	conn := connectToScanner(t)
+	client := v1.NewOrchestratorScanServiceClient(conn)
+
+	type istionVulnStruct struct {
+		version  string
+		name     string
+		fixedBy  string
+		severity string
+		score    float32
+	}
+
+	testCases := []istionVulnStruct{
+		{
+			version:  "1.13.6",
+			name:     "ISTIO-SECURITY-2022-006",
+			fixedBy:  "1.13.7",
+			severity: "Moderate",
+			score:    5.9,
+		},
+		{
+			version:  "1.14.0",
+			name:     "ISTIO-SECURITY-2022-007",
+			fixedBy:  "1.14.5",
+			severity: "Important",
+			score:    7.5,
+		},
+	}
+
+	testSet := make(map[string]istionVulnStruct)
+
+	for _, c := range testCases {
+		t.Run(fmt.Sprintf("case-%s", c.version), func(t *testing.T) {
+			req := &v1.GetIstioVulnerabilitiesRequest{IstioVersion: c.version}
+			resp, err := client.GetIstioVulnerabilities(context.Background(), req)
+			assert.NoError(t, err)
+
+			for _, vuln := range resp.GetVulnerabilities() {
+				assert.NotNil(t, vuln.GetMetadataV2().GetCvssV3())
+				assert.NotEmpty(t, vuln.Name)
+				assert.NotEmpty(t, vuln.FixedBy)
+				assert.NotEmpty(t, vuln.Severity)
+				sample := istionVulnStruct{version: c.version, name: vuln.Name, fixedBy: vuln.FixedBy, severity: vuln.Severity, score: vuln.GetMetadataV2().GetCvssV3().Score}
+				testSet[vuln.Name] = sample
+			}
+
+			assert.NotEmpty(t, testSet[c.name])
+			assert.Equal(t, c.fixedBy, testSet[c.name].fixedBy)
+			assert.Equal(t, c.severity, testSet[c.name].severity)
+			assert.Equal(t, c.score, testSet[c.name].score)
+		})
+	}
+}
+
 func TestGRPCGetOpenShiftVulnerabilities(t *testing.T) {
 	conn := connectToScanner(t)
 	client := v1.NewOrchestratorScanServiceClient(conn)