Examples with ToolScanExternalServiceException com.epam.pipeline.exception.ToolScanExternalServiceException used on opensource projects

Example 1 with ToolScanExternalServiceException

use of com.epam.pipeline.exception.ToolScanExternalServiceException in project cloud-pipeline by epam.

the class AggregatingToolScanManager method doScan.

private ToolVersionScanResult doScan(Tool tool, String tag, DockerRegistry registry) throws ToolScanExternalServiceException {
    if (clairService == null) {
        LOGGER.error("Clair service is not configured!");
        ToolVersionScanResult result = new ToolVersionScanResult();
        result.setToolId(tool.getId());
        result.setVersion(tag);
        result.setStatus(ToolScanStatus.NOT_SCANNED);
        return result;
    }
    try {
        String clairRef = scanLayers(tool, tag, registry);
        String digest = getDockerClient(tool.getImage(), registry).getVersionAttributes(registry, tool.getImage(), tag).getDigest();
        ClairScanResult clairResult = getScanResult(tool, clairService.getScanResult(clairRef));
        DockerComponentScanResult dockerScanResult = dockerComponentService == null ? null : getScanResult(tool, dockerComponentService.getScanResult(clairRef));
        return convertResults(clairResult, dockerScanResult, tool, tag, digest);
    } catch (IOException e) {
        throw new ToolScanExternalServiceException(tool, e);
    }
}

Example 2 with ToolScanExternalServiceException

use of com.epam.pipeline.exception.ToolScanExternalServiceException in project cloud-pipeline by epam.

the class AggregatingToolScanManager method scanLayers.

private String scanLayers(Tool tool, String tag, DockerRegistry registry) throws IOException, ToolScanExternalServiceException {
    List<String> layers = fetchLayers(tool, tag, registry);
    String lastLayer = null;
    for (int i = 0; i < layers.size(); i++) {
        String layerDigest = layers.get(i);
        // Debug: use "172.31.38.143:5000" as registry path
        Response<ClairScanRequest> clairResp;
        Response<DockerComponentLayerScanResult> dockerCompResp;
        String layerRef = getLayerName(tool.getImage(), tag);
        ClairScanRequest clairRequest;
        DockerComponentScanRequest dockerComponentScanRequest;
        if (registry.isPipelineAuth()) {
            clairRequest = new ClairScanRequest(layerRef, layerDigest, registry.getPath(), tool.getImage(), lastLayer, dockerRegistryManager.getImageToken(registry, tool.getImage()));
            dockerComponentScanRequest = new DockerComponentScanRequest(layerRef, layerDigest, registry.getPath(), tool.getImage(), lastLayer, dockerRegistryManager.getImageToken(registry, tool.getImage()));
        } else {
            clairRequest = new ClairScanRequest(layerRef, layerDigest, registry.getPath(), tool.getImage(), lastLayer, registry.getUserName(), registry.getPassword());
            dockerComponentScanRequest = new DockerComponentScanRequest(layerRef, layerDigest, registry.getPath(), tool.getImage(), lastLayer, registry.getUserName(), registry.getPassword());
        }
        clairResp = clairService.scanLayer(clairRequest).execute();
        dockerCompResp = dockerComponentService == null ? null : dockerComponentService.scanLayer(dockerComponentScanRequest).execute();
        if (!clairResp.isSuccessful()) {
            String errorBody = clairResp.errorBody() != null ? clairResp.errorBody().string() : null;
            throw new ToolScanExternalServiceException(tool, String.format("Service: %s : Failed on %d of %d layers: %s:%s response code: %d", ClairService.class, i + 1, layers.size(), clairResp.message(), errorBody, clairResp.code()));
        }
        if (dockerCompResp != null && !dockerCompResp.isSuccessful()) {
            String errorBody = dockerCompResp.errorBody() != null ? dockerCompResp.errorBody().string() : null;
            throw new ToolScanExternalServiceException(tool, String.format("Service: %s : Failed on %d of %d layers: %s:%s response code: %d", DockerComponentScanService.class, i + 1, layers.size(), dockerCompResp.message(), errorBody, dockerCompResp.code()));
        }
        ClairScanRequest clairFulfilled = clairResp.body();
        lastLayer = clairFulfilled.getLayer().getName();
        LOGGER.debug("Scanning {}:{}, done {} of {} layers", tool.getImage(), tag, i + 1, layers.size());
    }
    return lastLayer;
}

Example 3 with ToolScanExternalServiceException

use of com.epam.pipeline.exception.ToolScanExternalServiceException in project cloud-pipeline by epam.

the class AggregatingToolScanManager method fetchLayers.

private List<String> fetchLayers(Tool tool, String tag, DockerRegistry registry) throws ToolScanExternalServiceException {
    DockerClient dockerClient = getDockerClient(tool.getImage(), registry);
    ManifestV2 manifest = dockerClient.getManifest(registry, tool.getImage(), tag).orElseThrow(() -> new ToolScanExternalServiceException(tool, messageHelper.getMessage(MessageConstants.ERROR_REGISTRY_COULD_NOT_GET_MANIFEST, tool.getImage())));
    return manifest.getLayers().stream().map(c -> c.getDigest()).collect(Collectors.toList());
}

Example 4 with ToolScanExternalServiceException

use of com.epam.pipeline.exception.ToolScanExternalServiceException in project cloud-pipeline by epam.

the class ToolScanScheduler method scheduledToolScan.

/**
 * A scheduled scan, that runs for all the registries, all tools and all tool versions, sends them to Tool Scanning
 * System and stores scanning results to the database.
 */
public void scheduledToolScan() {
    if (!preferenceManager.getPreference(SystemPreferences.DOCKER_SECURITY_TOOL_SCAN_ENABLED)) {
        LOGGER.info(messageHelper.getMessage(MessageConstants.ERROR_TOOL_SCAN_DISABLED));
        return;
    } else {
        LOGGER.info(messageHelper.getMessage(MessageConstants.INFO_TOOL_SCAN_SCHEDULED_STARTED));
    }
    boolean scanAllRegistries = preferenceManager.getPreference(SystemPreferences.DOCKER_SECURITY_TOOL_SCAN_ALL_REGISTRIES);
    List<DockerRegistry> registries = scanAllRegistries ? dockerRegistryDao.loadAllDockerRegistry() : dockerRegistryDao.loadDockerRegistriesWithSecurityScanEnabled();
    for (DockerRegistry registry : registries) {
        LOGGER.info(messageHelper.getMessage(MessageConstants.INFO_TOOL_SCAN_REGISTRY_STARTED, registry.getPath()));
        for (Tool tool : registry.getTools()) {
            DockerClient dockerClient = getDockerClient(registry, tool);
            try {
                List<String> versions = toolManager.loadTags(tool.getId());
                for (String version : versions) {
                    try {
                        ToolVersionScanResult result = toolScanManager.scanTool(tool, version, false);
                        toolManager.updateToolVulnerabilities(result.getVulnerabilities(), tool.getId(), version);
                        toolManager.updateToolDependencies(result.getDependencies(), tool.getId(), version);
                        toolManager.updateToolVersionScanStatus(tool.getId(), ToolScanStatus.COMPLETED, new Date(), version, result.getLastLayerRef(), result.getDigest());
                        updateToolVersion(tool, version, registry, dockerClient);
                    } catch (ToolScanExternalServiceException e) {
                        LOGGER.error(messageHelper.getMessage(MessageConstants.ERROR_TOOL_SCAN_FAILED, tool.getImage(), version), e);
                        toolManager.updateToolVersionScanStatus(tool.getId(), ToolScanStatus.FAILED, new Date(), version, null, null);
                    }
                }
            } catch (Exception e) {
                LOGGER.error(messageHelper.getMessage(MessageConstants.ERROR_TOOL_SCAN_FAILED, tool.getImage()), e);
                toolManager.updateToolVersionScanStatus(tool.getId(), ToolScanStatus.FAILED, new Date(), "latest", null, null);
            }
        }
    }
    LOGGER.info(messageHelper.getMessage(MessageConstants.INFO_TOOL_SCAN_SCHEDULED_DONE));
}