ROX-13627: Extend GetNodeVulnerabilities API by supporting Node Inventory

Makefile

@@ -1,7 +1,7 @@
 # Store tooling in a location that does not affect the system.
 GOBIN := $(CURDIR)/.gobin
 export GOBIN
-PATH := $(GOBIN):$(PATH)
+PATH := $(GOBIN):"$(PATH)"
 export PATH
 
 # Set to empty string to echo some command lines which are hidden by default.

api/v1/common/convert.go

@@ -33,3 +33,14 @@ func toFeatureNameVersions(keys FeatureKeySet) []*scannerV1.FeatureNameVersion {
 	}
 	return features
 }
+
+// HasUncertifiedRHEL returns true if Notes contain CERTIFIED_RHEL_SCAN_UNAVAILABLE; false otherwise
+func HasUncertifiedRHEL(notes []scannerV1.Note) bool {
+	for _, note := range notes {
+		if note == scannerV1.Note_CERTIFIED_RHEL_SCAN_UNAVAILABLE {
+			return true
+		}
+	}
+
+	return false
+}

api/v1/features/convert.go

@@ -0,0 +1,53 @@
+package features
+
+import (
+	log "github.com/sirupsen/logrus"
+	apiV1 "github.com/stackrox/scanner/api/v1"
+	"github.com/stackrox/scanner/api/v1/convert"
+	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
+)
+
+// ConvertFeatures converts api Features into v1 (proto) Feature pointers.
+func ConvertFeatures(apiFeatures []apiV1.Feature) []*v1.Feature {
+	features := make([]*v1.Feature, 0, len(apiFeatures))
+	for _, a := range apiFeatures {
+		vulns := convertVulnerabilities(a.Vulnerabilities)
+
+		features = append(features, &v1.Feature{
+			Name:                a.Name,
+			Version:             a.Version,
+			FeatureType:         a.VersionFormat,
+			AddedByLayer:        a.AddedBy,
+			Location:            a.Location,
+			Vulnerabilities:     vulns,
+			FixedBy:             a.FixedBy,
+			ProvidedExecutables: a.Executables,
+		})
+	}
+	return features
+}
+
+func convertVulnerabilities(apiVulns []apiV1.Vulnerability) []*v1.Vulnerability {
+	vulns := make([]*v1.Vulnerability, 0, len(apiVulns))
+	for _, v := range apiVulns {
+		metadata, err := convert.MetadataMap(v.Metadata)
+		if err != nil {
+			log.Errorf("error converting metadata map: %v", err)
+			continue
+		}
+		if metadata == nil {
+			log.Warnf("metadata is nil for %s; skipping...", v.Name)
+			continue
+		}
+
+		vulns = append(vulns, &v1.Vulnerability{
+			Name:        v.Name,
+			Description: v.Description,
+			Link:        v.Link,
+			MetadataV2:  metadata,
+			FixedBy:     v.FixedBy,
+			Severity:    v.Severity,
+		})
+	}
+	return vulns
+}

api/v1/imagescan/convert.go

@@ -4,7 +4,6 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
 	"github.com/stackrox/rox/pkg/utils"
 	apiV1 "github.com/stackrox/scanner/api/v1"
 	"github.com/stackrox/scanner/api/v1/common"
@@ -39,51 +38,6 @@ var (
 	}()
 )
 
-func convertVulnerabilities(apiVulns []apiV1.Vulnerability) []*v1.Vulnerability {
-	vulns := make([]*v1.Vulnerability, 0, len(apiVulns))
-	for _, v := range apiVulns {
-		metadata, err := convert.MetadataMap(v.Metadata)
-		if err != nil {
-			log.Errorf("error converting metadata map: %v", err)
-			continue
-		}
-		if metadata == nil {
-			log.Warnf("metadata is nil for %s; skipping...", v.Name)
-			continue
-		}
-
-		vulns = append(vulns, &v1.Vulnerability{
-			Name:        v.Name,
-			Description: v.Description,
-			Link:        v.Link,
-			MetadataV2:  metadata,
-			FixedBy:     v.FixedBy,
-			Severity:    v.Severity,
-		})
-	}
-	return vulns
-}
-
-// ConvertFeatures converts api Features into v1 (proto) Feature pointers.
-func ConvertFeatures(apiFeatures []apiV1.Feature) []*v1.Feature {
-	features := make([]*v1.Feature, 0, len(apiFeatures))
-	for _, a := range apiFeatures {
-		vulns := convertVulnerabilities(a.Vulnerabilities)
-
-		features = append(features, &v1.Feature{
-			Name:                a.Name,
-			Version:             a.Version,
-			FeatureType:         a.VersionFormat,
-			AddedByLayer:        a.AddedBy,
-			Location:            a.Location,
-			Vulnerabilities:     vulns,
-			FixedBy:             a.FixedBy,
-			ProvidedExecutables: a.Executables,
-		})
-	}
-	return features
-}
-
 func convertLanguageLevelComponents(layersToComponents []*component.LayerToComponents) map[string]*v1.LanguageLevelComponents {
 	converted := make(map[string]*v1.LanguageLevelComponents, len(layersToComponents))
 	for _, layerToComponents := range layersToComponents {

api/v1/imagescan/service.go

@@ -9,6 +9,7 @@ import (
 	apiGRPC "github.com/stackrox/scanner/api/grpc"
 	apiV1 "github.com/stackrox/scanner/api/v1"
 	"github.com/stackrox/scanner/api/v1/common"
+	"github.com/stackrox/scanner/api/v1/features"
 	"github.com/stackrox/scanner/cpe/nvdtoolscache"
 	"github.com/stackrox/scanner/database"
 	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
@@ -91,7 +92,7 @@ func (s *serviceImpl) GetImageScan(_ context.Context, req *v1.GetImageScanReques
 		Status:         v1.ScanStatus_SUCCEEDED,
 		Image: &v1.Image{
 			Namespace: layer.NamespaceName,
-			Features:  ConvertFeatures(layer.Features),
+			Features:  features.ConvertFeatures(layer.Features),
 		},
 		Notes: convertNotes(notes),
 	}, nil
@@ -206,7 +207,7 @@ func (s *serviceImpl) getImageComponents(ctx context.Context, req *v1.GetImageCo
 }
 
 func (s *serviceImpl) GetImageVulnerabilities(_ context.Context, req *v1.GetImageVulnerabilitiesRequest) (*v1.GetImageVulnerabilitiesResponse, error) {
-	layer, err := apiV1.GetVulnerabilitiesForComponents(s.db, req.GetComponents(), hasUncertifiedRHEL(req.GetNotes()))
+	layer, err := apiV1.GetVulnerabilitiesForComponents(s.db, req.GetComponents(), common.HasUncertifiedRHEL(req.GetNotes()))
 	if err != nil {
 		return nil, status.Error(codes.Internal, err.Error())
 	}
@@ -216,21 +217,11 @@ func (s *serviceImpl) GetImageVulnerabilities(_ context.Context, req *v1.GetImag
 		Status:         v1.ScanStatus_SUCCEEDED,
 		Image: &v1.Image{
 			Namespace: layer.NamespaceName,
-			Features:  ConvertFeatures(layer.Features),
+			Features:  features.ConvertFeatures(layer.Features),
 		},
 	}, nil
 }
 
-func hasUncertifiedRHEL(notes []v1.Note) bool {
-	for _, note := range notes {
-		if note == v1.Note_CERTIFIED_RHEL_SCAN_UNAVAILABLE {
-			return true
-		}
-	}
-
-	return false
-}
-
 func (s *serviceImpl) GetLanguageLevelComponents(_ context.Context, req *v1.GetLanguageLevelComponentsRequest) (*v1.GetLanguageLevelComponentsResponse, error) {
 	layerName, lineage, err := s.getLayerNameFromImageReq(req)
 	if err != nil {

api/v1/nodescan/service.go

@@ -10,7 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stackrox/rox/pkg/stringutils"
 	apiGRPC "github.com/stackrox/scanner/api/grpc"
+	apiV1 "github.com/stackrox/scanner/api/v1"
+	"github.com/stackrox/scanner/api/v1/common"
 	"github.com/stackrox/scanner/api/v1/convert"
+	"github.com/stackrox/scanner/api/v1/features"
 	"github.com/stackrox/scanner/cpe/nvdtoolscache"
 	"github.com/stackrox/scanner/database"
 	"github.com/stackrox/scanner/ext/kernelparser"
@@ -247,10 +250,10 @@ func (s *serviceImpl) GetNodeVulnerabilities(_ context.Context, req *v1.GetNodeV
 	case nil: // Normal
 	case kernelparser.ErrNodeUnsupported:
 		// The node is unsupported, exit early.
-		resp.Notes = append(resp.Notes, v1.NodeNote_NODE_UNSUPPORTED)
+		resp.NodeNotes = append(resp.GetNodeNotes(), v1.NodeNote_NODE_UNSUPPORTED)
 		return resp, nil
 	case kernelparser.ErrKernelUnsupported:
-		resp.Notes = append(resp.Notes, v1.NodeNote_NODE_KERNEL_UNSUPPORTED)
+		resp.NodeNotes = append(resp.GetNodeNotes(), v1.NodeNote_NODE_KERNEL_UNSUPPORTED)
 	default:
 		return nil, status.Error(codes.Internal, err.Error())
 	}
@@ -270,6 +273,14 @@ func (s *serviceImpl) GetNodeVulnerabilities(_ context.Context, req *v1.GetNodeV
 		return nil, status.Error(codes.Internal, err.Error())
 	}
 
+	// Handle the new format of the request and scan node inventory additionally
+	if req.GetComponents() != nil {
+		layer, err := apiV1.GetVulnerabilitiesForComponents(s.db, req.GetComponents(), common.HasUncertifiedRHEL(req.GetNotes()))
+		if err != nil {
+			return nil, status.Error(codes.Internal, err.Error())
+		}
+		resp.Features = features.ConvertFeatures(layer.Features)
+	}
 	return resp, nil
 }
 

e2etests/grpc_full_test.go

@@ -11,7 +11,7 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/stackrox/scanner/api/v1/imagescan"
+	"github.com/stackrox/scanner/api/v1/features"
 	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -43,7 +43,7 @@ func verifyImage(t *testing.T, imgScan *v1.Image, test testCase) {
 		feature.Vulnerabilities = filteredVulns
 	}
 
-	for _, feature := range imagescan.ConvertFeatures(test.expectedFeatures) {
+	for _, feature := range features.ConvertFeatures(test.expectedFeatures) {
 		t.Run(fmt.Sprintf("%s/%s/%s", test.image, feature.Name, feature.Version), func(t *testing.T) {
 			matching := getMatchingGRPCFeature(t, imgScan.Features, feature, false)
 			if matching.Vulnerabilities != nil {
@@ -96,7 +96,7 @@ func verifyImage(t *testing.T, imgScan *v1.Image, test testCase) {
 		})
 	}
 
-	for _, feature := range imagescan.ConvertFeatures(test.unexpectedFeatures) {
+	for _, feature := range features.ConvertFeatures(test.unexpectedFeatures) {
 		assert.Nil(t, getMatchingGRPCFeature(t, imgScan.Features, feature, true))
 	}
 }

e2etests/grpc_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	apiV1 "github.com/stackrox/scanner/api/v1"
+	"github.com/stackrox/scanner/api/v1/common"
 	v1 "github.com/stackrox/scanner/generated/scanner/api/v1"
 	namespaces "github.com/stackrox/scanner/pkg/wellknownnamespaces"
 	"github.com/stretchr/testify/assert"
@@ -34,23 +35,13 @@ func TestGRPCGetImageComponents(t *testing.T) {
 			require.NotNil(t, imgComponentsResp.GetStatus())
 
 			assert.Equal(t, imgComponentsResp.GetStatus(), v1.ScanStatus_SUCCEEDED, "Image %s", testCase.image)
-			assert.Equal(t, testCase.uncertifiedRHEL, hasUncertifiedRHEL(imgComponentsResp.GetNotes()), "Image %s", testCase.image)
+			assert.Equal(t, testCase.uncertifiedRHEL, common.HasUncertifiedRHEL(imgComponentsResp.GetNotes()), "Image %s", testCase.image)
 			assert.Equal(t, testCase.namespace, imgComponentsResp.GetComponents().GetNamespace())
 			verifyComponents(t, imgComponentsResp.GetComponents(), testCase)
 		})
 	}
 }
 
-func hasUncertifiedRHEL(notes []v1.Note) bool {
-	for _, note := range notes {
-		if note == v1.Note_CERTIFIED_RHEL_SCAN_UNAVAILABLE {
-			return true
-		}
-	}
-
-	return false
-}
-
 func verifyComponents(t *testing.T, components *v1.Components, test testCase) {
 	assert.True(t, len(components.RhelComponents) == 0 || len(components.OsComponents) == 0)