@@ -15,6 +15,7 @@ import (
1515 "github.com/pkg/errors"
1616 log "github.com/sirupsen/logrus"
1717 "github.com/spf13/cobra"
18+ "github.com/stackrox/istio-cves/types"
1819 "github.com/stackrox/k8s-cves/pkg/validation"
1920 "github.com/stackrox/rox/pkg/utils"
2021 "github.com/stackrox/scanner/cmd/updater/common"
@@ -24,11 +25,14 @@ import (
2425 "github.com/stackrox/scanner/ext/vulnsrc/alpine"
2526 "github.com/stackrox/scanner/ext/vulnsrc/ubuntu"
2627 "github.com/stackrox/scanner/pkg/vulndump"
28+ "github.com/stackrox/scanner/pkg/vulnloader/istioloader"
2729 "github.com/stackrox/scanner/pkg/vulnloader/k8sloader"
2830 "github.com/stackrox/scanner/pkg/vulnloader/nvdloader"
2931 namespaces "github.com/stackrox/scanner/pkg/wellknownnamespaces"
3032)
3133
34+ type generateDiffFunc func (outputDir string , baseF , headF * zip.File ) error
35+
3236func generateK8sDiff (outputDir string , baseF , headF * zip.File ) error {
3337 headReader , err := headF .Open ()
3438 if err != nil {
@@ -69,9 +73,57 @@ func generateK8sDiff(outputDir string, baseF, headF *zip.File) error {
6973 return nil
7074}
7175
76+ func generateIstioDiff (outputDir string , baseF , headF * zip.File ) error {
77+ headReader , err := headF .Open ()
78+ if err != nil {
79+ return errors .Wrap (err , "opening file" )
80+ }
81+ defer utils .IgnoreError (headReader .Close )
82+ istioDump , err := istioloader .LoadYAMLFileFromReader (headReader )
83+ if err != nil {
84+ return errors .Wrap (err , "reading Istio dump" )
85+ }
86+
87+ var baseIstioDump types.Vuln
88+ if baseF != nil {
89+ baseReader , err := baseF .Open ()
90+ if err != nil {
91+ return errors .Wrap (err , "opening file" )
92+ }
93+ defer utils .IgnoreError (baseReader .Close )
94+ baseIstioDump , err = istioloader .LoadYAMLFileFromReader (baseReader )
95+ if err != nil {
96+ return errors .Wrap (err , "reading base Istio dump" )
97+ }
98+ }
99+
100+ outF , err := os .Create (filepath .Join (outputDir , filepath .Base (headF .Name )))
101+ if err != nil {
102+ return errors .Wrap (err , "creating Istio output file" )
103+ }
104+ defer utils .IgnoreError (outF .Close )
105+
106+ if ! reflect .DeepEqual (baseIstioDump , istioDump ) {
107+ log .Infof ("Istio CVE file %q is in the diff" , headF .Name )
108+ if _ , err := io .Copy (outF , headReader ); err != nil {
109+ return errors .Wrap (err , "copying Istio CVE file" )
110+ }
111+ }
112+
113+ return nil
114+ }
115+
72116func generateK8sDiffs (outputDir string , baseZipR * zip.ReadCloser , headZipR * zip.ReadCloser ) error {
73- k8sSubDir := filepath .Join (outputDir , vulndump .K8sDirName )
74- if err := os .MkdirAll (k8sSubDir , 0755 ); err != nil {
117+ return generateDiffsHelper (outputDir , baseZipR , headZipR , vulndump .K8sDirName , generateK8sDiff )
118+ }
119+
120+ func generateIstioDiffs (outputDir string , baseZipR * zip.ReadCloser , headZipR * zip.ReadCloser ) error {
121+ return generateDiffsHelper (outputDir , baseZipR , headZipR , vulndump .IstioDirName , generateIstioDiff )
122+ }
123+
124+ func generateDiffsHelper (outputDir string , baseZipR * zip.ReadCloser , headZipR * zip.ReadCloser , dirName string , generateDiffs generateDiffFunc ) error {
125+ subDir := filepath .Join (outputDir , dirName )
126+ if err := os .MkdirAll (subDir , 0755 ); err != nil {
75127 return errors .Wrap (err , "creating subdir for Kubernetes" )
76128 }
77129
@@ -84,7 +136,7 @@ func generateK8sDiffs(outputDir string, baseZipR *zip.ReadCloser, headZipR *zip.
84136 continue
85137 }
86138
87- if filepath .Dir (name ) == vulndump . K8sDirName && filepath .Ext (name ) == ".yaml" {
139+ if filepath .Dir (name ) == dirName && filepath .Ext (name ) == ".yaml" {
88140 baseFiles [name ] = baseF
89141 }
90142 }
@@ -98,12 +150,12 @@ func generateK8sDiffs(outputDir string, baseZipR *zip.ReadCloser, headZipR *zip.
98150 continue
99151 }
100152
101- // Only look at YAML files in the k8s/ folder.
102- if filepath .Dir (name ) != vulndump . K8sDirName || filepath .Ext (name ) != ".yaml" {
153+ // Only look at YAML files in the <dirName> folder.
154+ if filepath .Dir (name ) != dirName || filepath .Ext (name ) != ".yaml" {
103155 continue
104156 }
105- if err := generateK8sDiff ( k8sSubDir , baseFiles [name ], headF ); err != nil {
106- return errors .Wrapf (err , "generating Kubernetes diff for file %q" , headF .Name )
157+ if err := generateDiffs ( subDir , baseFiles [name ], headF ); err != nil {
158+ return errors .Wrapf (err , "generating diffs for file %q" , headF .Name )
107159 }
108160 }
109161 return nil
@@ -343,6 +395,7 @@ func generateOSVulnsDiff(outputDir string, baseZipR, headZipR *zip.ReadCloser, c
343395type config struct {
344396 SkipFixableCentOSVulns bool `json:"skipFixableCentOSVulns"`
345397 IgnoreKubernetesVulns bool `json:"ignoreKubernetesVulns"`
398+ IgnoreIstioVulns bool `json:"ignoreIstioVulns"`
346399 SkipUbuntuLinuxKernelVulns bool `json:"skipUbuntuLinuxKernelVulns"`
347400 SkipSeverityComparison bool `json:"skipSeverityComparison"`
348401 SkipRHELv2Vulns bool `json:"skipRHELv2Vulns"`
@@ -409,6 +462,16 @@ func Command() *cobra.Command {
409462 log .Info ("Done generating Kubernetes diff" )
410463 }
411464
465+ if cfg .IgnoreIstioVulns {
466+ log .Info ("Skipping Istio diff" )
467+ } else {
468+ log .Info ("Generating Istio diff..." )
469+ if err := generateIstioDiffs (stagingDir , baseZipR , headZipR ); err != nil {
470+ return errors .Wrap (err , "creating Istio diff" )
471+ }
472+ log .Info ("Done generating Isio diff" )
473+ }
474+
412475 log .Info ("Generating NVD diff..." )
413476 if err := generateNVDDiffs (stagingDir , baseManifest .Until , headZipR ); err != nil {
414477 return errors .Wrap (err , "creating NVD diff" )
@@ -440,7 +503,7 @@ func Command() *cobra.Command {
440503 }
441504
442505 log .Info ("Zipping up the dump..." )
443- err = vulndump .WriteZip (stagingDir , outFile , cfg .IgnoreKubernetesVulns , cfg .SkipRHELv2Vulns )
506+ err = vulndump .WriteZip (stagingDir , outFile , cfg .IgnoreKubernetesVulns , cfg .SkipRHELv2Vulns , cfg . IgnoreIstioVulns )
444507 if err != nil {
445508 return errors .Wrap (err , "writing final zip" )
446509 }
0 commit comments