stackrox · vikin91 · Nov 3, 2022 · Nov 15, 2022 · Nov 3, 2022 · Nov 25, 2022
diff --git a/SCANNER_VERSION b/SCANNER_VERSION
@@ -1 +1 @@
-2.27.2
+2.27.x-24-g7c97e9281e
diff --git a/central/sensor/service/pipeline/all/factory.go b/central/sensor/service/pipeline/all/factory.go
@@ -20,7 +20,6 @@ import (
 	"github.com/stackrox/rox/central/sensor/service/pipeline/networkflowupdate"
 	"github.com/stackrox/rox/central/sensor/service/pipeline/networkpolicies"
 	"github.com/stackrox/rox/central/sensor/service/pipeline/nodes"
-	"github.com/stackrox/rox/central/sensor/service/pipeline/nodescansv2"
 	"github.com/stackrox/rox/central/sensor/service/pipeline/podevents"
 	"github.com/stackrox/rox/central/sensor/service/pipeline/processindicators"
 	"github.com/stackrox/rox/central/sensor/service/pipeline/reprocessing"
@@ -65,9 +64,6 @@ func (s *factoryImpl) PipelineForCluster(ctx context.Context, clusterID string)
 		alerts.GetPipeline(),
 		auditlogstateupdate.GetPipeline(),
 	}
-	if features.RHCOSNodeScanning.Enabled() {
-		pipelines = append(pipelines, nodescansv2.GetPipeline())
-	}
 	if features.ComplianceOperatorCheckResults.Enabled() {
 		pipelines = append(pipelines,
 			complianceoperatorresults.GetPipeline(),

diff --git a/central/sensor/service/pipeline/nodescansv2/pipeline.go b/central/sensor/service/pipeline/nodescansv2/pipeline.go
diff --git a/compliance/collection/main.go b/compliance/collection/main.go
@@ -277,8 +277,15 @@ func main() {
 		go manageSendingToSensor(ctx, cli, sensorC)
 
 		// TODO(ROX-12971): Replace with real scanner
-		scanner := nodescanv2.FakeNodeScanner{}
-		nodeScansC := manageNodeScanLoop(ctx, env.NodeRescanInterval.DurationSetting(), &scanner)
+		var scanner nodescanv2.NodeScanner
+		if features.UseFakeNodeInventory.Enabled() {
+			log.Infof("Using FakeNodeScanner")
+			scanner = &nodescanv2.FakeNodeScanner{}
+		} else {
+			log.Infof("Using real NodeScan")
+			scanner = &nodescanv2.NodeScan{}
+		}
+		nodeScansC := manageNodeScanLoop(ctx, env.NodeRescanInterval.DurationSetting(), scanner)
 		// multiplex producers (nodeScansC) into the output channel (sensorC)
 		go func() {
 			for {
@@ -301,3 +308,37 @@ func main() {
 	stoppedSig.Wait()
 	log.Info("Successfully closed Sensor communication")
 }
+
+/*
+No certificates found in /usr/local/share/ca-certificates
+No certificates found in /etc/pki/injected-ca-trust
+main: 2022/11/25 12:24:19.063168 main.go:249: Info: Running StackRox Version: 3.73.x-50-gea9729f302
+main: 2022/11/25 12:24:19.064314 main.go:257: Info: Initialized Sensor gRPC stream connection
+main: 2022/11/25 12:24:19.064428 main.go:274: Info: Node Rescan interval: 10m0s
+main: 2022/11/25 12:24:19.064451 main.go:285: Info: Using real NodeScan
+time="2022-11-25T12:24:19Z" level=info msg="add files from directory" directory=usr/lib/ root=/host
+time="2022-11-25T12:24:19Z" level=info msg="add files from directory" directory=var/lib/ root=/host
+main: 2022/11/25 12:24:19.132677 main.go:243: Info: Successfully connected to Sensor at sensor.stackrox.svc:443
+time="2022-11-25T12:24:23Z" level=info msg="add files from directory" directory=root/buildinfo/ root=/host
+time="2022-11-25T12:24:23Z" level=info msg="add files from directory" directory=etc/ root=/host
+collection/nodescanv2: 2022/11/25 12:24:23.250073 nodescan.go:23: Info: Finished node inventory /host scan
+collection/nodescanv2: 2022/11/25 12:24:23.250250 nodescan.go:27: Info: Components found under /host: &{<nil> [] <nil> []}
+panic: runtime error: invalid memory address or nil pointer dereference
+[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x18c2287]
+
+goroutine 60 [running]:
+github.com/stackrox/rox/compliance/collection/nodescanv2.convertRHELComponents(0x0)
+    github.com/stackrox/rox/compliance/collection/nodescanv2/nodescan.go:54 +0x47
+github.com/stackrox/rox/compliance/collection/nodescanv2.protoComponentsFromScanComponents(...)
+    github.com/stackrox/rox/compliance/collection/nodescanv2/nodescan.go:46
+github.com/stackrox/rox/compliance/collection/nodescanv2.(*NodeScan).Scan(0x8bb2c97000?, {0xc00005a03e, 0x6})
+    github.com/stackrox/rox/compliance/collection/nodescanv2/nodescan.go:32 +0x1bb
+main.scanNode({0xc00005a03e, 0x6}, {0x23bdee0?, 0x379dac8?})
+    github.com/stackrox/rox/compliance/collection/main.go:184 +0x3b
+main.manageNodeScanLoop.func1()
+    github.com/stackrox/rox/compliance/collection/main.go:159 +0xf6
+created by main.manageNodeScanLoop
+    github.com/stackrox/rox/compliance/collection/main.go:154 +0x125
+Stream closed EOF for stackrox/collector-46n76 (compliance)
+
+*/
diff --git a/compliance/collection/nodescanv2/fake_nodescan.go b/compliance/collection/nodescanv2/fake_nodescan.go
@@ -23,24 +23,56 @@ func (f *FakeNodeScanner) Scan(nodeName string) (*storage.NodeInventory, error)
 		NodeName: nodeName,
 		ScanTime: timestamp.TimestampNow(),
 		Components: &scannerV1.Components{
-			Namespace: "Testme OS",
+			Namespace: "Red Hat Enterprise Linux CoreOS 45.82.202008101249-0 (Ootpa)",
 			RhelComponents: []*scannerV1.RHELComponent{
 				{
+					Id:        int64(6661),
 					Name:      "vim-minimal",
 					Namespace: "rhel:8",
-					Version:   "2:7.4.629-6.el8.x86_64",
+					Version:   "2:7.4.629-6.el8",
 					Arch:      "x86_64",
-					Module:    "FakeMod",
-					Cpes:      []string{"cpe:/a:redhat:enterprise_linux:8::baseos"},
-					AddedBy:   "FakeLayer",
+					Module:    "",
+					Cpes:      []string{"cpe:/a:redhat:enterprise_linux:8::baseos", "cpe:/o:redhat:enterprise_linux:8::coreos"},
+					AddedBy:   "FakeNodeScanner",
 				},
 				{
-					Name:      "libsolv",
+					Id:        int64(6662),
+					Name:      "tar",
 					Namespace: "rhel:8",
-					Version:   "0.7.7-1.el8.x86_64",
+					Version:   "1.27.1.el8",
 					Arch:      "x86_64",
-					Module:    "FakeMod",
-					AddedBy:   "FakeLayer",
+					Cpes: []string{
+						"cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:rhel:8.3::appstream",
+						"cpe:/a:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:rhel:8.3::baseos",
+					},
+					Module:  "",
+					AddedBy: "FakeNodeScanner",
+				},
+				{
+					Id:        int64(6663),
+					Name:      "lz4-libs",
+					Namespace: "rhel:8",
+					Version:   "1.8.3-3.el8_4",
+					Arch:      "x86_64",
+					Module:    "NoModule",
+					Cpes: []string{
+						"cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:rhel:8.3::appstream",
+						"cpe:/a:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:rhel:8.3::baseos",
+					},
+					AddedBy: "FakeNodeScanner",
+				},
+				{
+					Id:        int64(6664),
+					Name:      "libksba",
+					Namespace: "rhel:8",
+					Version:   "1.3.5-7.el8",
+					Arch:      "x86_64",
+					Module:    "",
+					Cpes: []string{
+						"cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:rhel:8.3::appstream",
+						"cpe:/a:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:rhel:8.3::baseos",
+					},
+					AddedBy: "FakeNodeScanner",
 				},
 			},
 			LanguageComponents: nil,

diff --git a/compliance/collection/nodescanv2/fake_nodescan_test.go b/compliance/collection/nodescanv2/fake_nodescan_test.go
@@ -0,0 +1,23 @@
+package nodescanv2
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/suite"
+)
+
+func TestFakeNodeScan(t *testing.T) {
+	suite.Run(t, &NodeScanSuite{})
+}
+
+type FakeNodeScanSuite struct {
+	suite.Suite
+}
+
+func (n *FakeNodeScanSuite) TestMessageFormat() {
+	fns, err := (&FakeNodeScanner{}).Scan("someNode")
+	n.Nil(err)
+	n.NotNil(fns)
+	n.IsType(&storage.NodeInventory{}, fns)
+}
diff --git a/compliance/collection/nodescanv2/nodescan.go b/compliance/collection/nodescanv2/nodescan.go
@@ -1,8 +1,11 @@
 package nodescanv2
 
 import (
-	"github.com/pkg/errors"
+	timestamp "github.com/gogo/protobuf/types"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/scanner/database"
+	scannerV1 "github.com/stackrox/scanner/generated/scanner/api/v1"
+	"github.com/stackrox/scanner/pkg/analyzer/nodes"
 )
 
 // NodeScanner defines an interface for V2 NodeScanning
@@ -16,5 +19,61 @@ type NodeScan struct {
 
 // Scan scans the current node and returns the results as storage.NodeInventory object
 func (n *NodeScan) Scan(nodeName string) (*storage.NodeInventory, error) {
-	return nil, errors.New("Not implemented")
+	componentsHost, err := nodes.Analyze(nodeName, "/host/", false)
+	log.Info("Finished node inventory /host scan")
+	if err != nil {
+		log.Errorf("Error scanning node /host inventory: %v", err)
+	}
+	log.Infof("Components found under /host: %v", componentsHost)
+	if err != nil {
+		return nil, err
+	}
+
+	var protoComponents *scannerV1.Components
+	if componentsHost != nil {
+		protoComponents = protoComponentsFromScanComponents(componentsHost)
+	}
+	m := &storage.NodeInventory{
+		NodeName:   nodeName,
+		ScanTime:   timestamp.TimestampNow(),
+		Components: protoComponents,
+	}
+	return m, nil
+}
+
+func protoComponentsFromScanComponents(c *nodes.Components) *scannerV1.Components {
+	var components []*scannerV1.RHELComponent
+	// For now, we only care about RHEL components, but this must be extended once we support non-RHCOS
+	if c.CertifiedRHELComponents != nil {
+		components = convertRHELComponents(c.CertifiedRHELComponents)
+	}
+	pc := scannerV1.Components{
+		Namespace:          c.OSNamespace.Name,
+		OsComponents:       nil,
+		RhelComponents:     components,
+		LanguageComponents: nil,
+	}
+	return &pc
+}
+
+func convertRHELComponents(rc *database.RHELv2Components) []*scannerV1.RHELComponent {
+	v1rhelc := make([]*scannerV1.RHELComponent, 0)
+	if rc.Packages == nil {
+		log.Warn("No RHEL packages found in scan result")
+		return v1rhelc
+	}
+	for _, rhelc := range rc.Packages {
+		v1rhelc = append(v1rhelc, &scannerV1.RHELComponent{
+			Id:          0,
+			Name:        rhelc.Name,
+			Namespace:   rc.Dist, // check
+			Version:     rhelc.Version,
+			Arch:        rhelc.Arch,
+			Module:      rhelc.Module,
+			Cpes:        rc.CPEs, // do we just append all here?
+			Executables: rhelc.Executables,
+			// AddedBy:     "",                // do we know?
+		})
+	}
+	return v1rhelc
 }
diff --git a/deploy/k8s/deploy-local.sh b/deploy/k8s/deploy-local.sh
@@ -11,3 +11,4 @@ export POD_SECURITY_POLICIES="${POD_SECURITY_POLICIES:-false}"
 
 # shellcheck source=/dev/null
 "$DIR"/deploy.sh
+
Original file line number	Diff line number	Diff line change
Expand Up		@@ -11,3 +11,4 @@ export POD_SECURITY_POLICIES="${POD_SECURITY_POLICIES:-false}"

		# shellcheck source=/dev/null
		"$DIR"/deploy.sh