Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dast): ccp, sshconfig missing #3705

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(dast): ccp, sshconfig missing #3705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 56 additions & 32 deletions .github/workflows/.dast-nuclei-cmd-api-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
name: DAST_Scan_Nuclei

env:
NODEJS_VERSION: v18.18.2

on:
push:
branches: [main, dev]

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove these new lines

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @jagpreetsinghsasan ,

I've compared this per line and no changes on my end. Not sure why these empty lines are tagged as changes.

Any suggestions for this?

Thank you!

Rayn

pull_request:
branches: [main, dev]

jobs:
nuclei-scan:
runs-on: ubuntu-22.04
Expand All @@ -25,30 +25,30 @@ jobs:
libvcx \
indy-cli \
&& sudo rm -f /etc/apt/sources.list.d/sovrin.list*

- name: Set up NodeJS ${{ env.NODEJS_VERSION }}
uses: actions/[email protected]
with:
node-version: ${{ env.NODEJS_VERSION }}

- name: Install jq
run: sudo apt update && sudo apt install -y jq

- name: Verify jq
run: jq --version

- uses: actions/[email protected]

- uses: actions/[email protected]
with:
go-version: 1.23

- run: go install -v github.com/projectdiscovery/nuclei/v3/cmd/[email protected]

- run: nuclei --version

- run: npm run configure

- name: Create URLs file for Nuclei
run: |
echo https://localhost:4000/ > urls.txt
Expand All @@ -73,58 +73,82 @@ jobs:
echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics
echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record
} >> urls.txt

- run: yarn generate-api-server-config

- run: jq '.authorizationProtocol = "NONE"' .config.json > .config2.json && mv .config2.json .config.json


# Delete the first and the second items in the array (remove keychain and manual consortium plugins)
- run: jq 'del(.plugins[0,1])' .config.json > .config2.json && mv .config2.json .config.json

- name: Install Keychain manual plugin into the API server
run: jq '.plugins += [{ "packageName":"@hyperledger/cactus-plugin-keychain-memory","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-keychain-memory/","instanceId":"0daacd05-d1cd-4eab-9332-4ad1aff4b909","keychainId":"d29d728e-eaa0-4e2d-b187-d132242b0d9a"}}]' .config.json > .config2.json && mv .config2.json .config.json

- name: Install Fabric connector into the API server
run: jq '.plugins += [{ "packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL", "options":{ "packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/[email protected]/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json > .config2.json && mv .config2.json .config.json

- name: Install Besu connector into the API server
run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-besu/", "rpcApiHttpHost":"http://127.0.0.1:8545", "rpcApiWsHost":"ws://127.0.0.1:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json > .config2.json && mv .config2.json .config.json

- name: Run Besu all-in-one image
run: |
docker run -d -p 0.0.0.0:8545:8545/tcp -p 0.0.0.0:8546:8546/tcp -p 0.0.0.0:8888:8888/tcp -p 0.0.0.0:9001:9001/tcp -p 0.0.0.0:9545:9545/tcp ghcr.io/hyperledger/cactus-besu-all-in-one:v2.0.0-rc.7
until curl --fail -X POST --data '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' localhost:8545; do sleep 5; done

- name: Print API Server Config File - ./.config.json
run: cat .config.json

- name: Print Nuclei Config File - ./.nuclei-config.yaml
run: cat .nuclei-config.yaml

- name: Print Nuclei URL List File - ./urls.txt
run: cat urls.txt

- name: Generate Audience and Issuer
id: generate_ids
run: |
echo "audience=$(uuidgen)" >> "$GITHUB_ENV"
echo "issuer=$(uuidgen)" >> "$GITHUB_ENV"

- name: Generate RSA Keys
run: |
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -in private_key.pem -pubout -out public_key.pem

- run: jq '.expressJwtOptions.secret = "$(cat public_key.pem)" |
.expressJwtOptions.algorithms = ["RS256"] |
.expressJwtOptions.issuer = "${{ env.issuer }}" |
.expressJwtOptions.audience = "${{ env.audience }}"' .config.json > .config2.json && mv .config2.json .config.json

- name: Generate Auth Bearer Token
run: |
HEADER_B64=$(echo '{"alg":"RS256"}' | openssl base64 -e -A | tr -d '=' | tr '/+' '_-')
PAYLOAD_B64=$(echo '{"scope":"read:health","iss":"${{ env.issuer }}","aud":"${{ env.audience }}"}' | openssl base64 -e -A | tr -d '=' | tr '/+' '_-')

SIGNATURE=$(echo -n "$HEADER_B64.$PAYLOAD_B64" | openssl dgst -sha256 -sign private_key.pem | openssl base64 -e -A | tr -d '=' | tr '/+' '_-')
JWT="$HEADER_B64.$PAYLOAD_B64.$SIGNATURE"
echo "dast_jwt=$JWT" >> "$GITHUB_ENV"

- name: Start API Server & Run DAST
uses: BerniWittmann/[email protected]
env:
# Needed because the wait-on syntax otherwise keeps thinking that
# there is a problem due to our self signed certificates on the
# test instance of the API server
NODE_TLS_REJECT_UNAUTHORIZED: 0
# Needed because the wait-on syntax otherwise keeps thinking that
# there is a problem due to our self signed certificates on the
# test instance of the API server
NODE_TLS_REJECT_UNAUTHORIZED: 0
with:
build: yarn --version
start: yarn start:api-server
command: "nuclei -version"
command-windows: echo "The project build is not supported on the Windows operating system. Please use Linux or macOS"
wait-on: "https://localhost:4000/api/v1/api-server/healthcheck"
# wait for 10 minutes for the server to respond
wait-on-timeout: 120

wait-on-command: |
curl -X GET https://localhost:4000/api/v1/api-server/healthcheck -k -H "Authorization: Bearer ${{ env.dast_jwt }}"

- name: Run the dast nuclei scan
run: "nuclei -list=urls.txt -dast -severity=high,critical -sarif-export ~/nuclei.sarif -output=nuclei.log"

- name: GitHub Workflow artifacts
uses: actions/[email protected]
with:
name: nuclei.log
path: nuclei.log
path: nuclei.log
15 changes: 11 additions & 4 deletions ...ctus-plugin-ledger-connector-fabric/src/main/typescript/plugin-ledger-connector-fabric.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,15 +307,22 @@ export class PluginLedgerConnectorFabric
this.sshDebugOn = opts.sshDebugOn === true;
if (this.opts.sshConfig) {
this.sshConfig = this.opts.sshConfig;

if (this.sshDebugOn) {
this.sshConfig = this.enableSshDebugLogs(this.sshConfig);
}
} else if (this.opts.sshConfigB64) {
const sshConfigBuffer = Buffer.from(this.opts.sshConfigB64, "base64");
const sshConfigString = sshConfigBuffer.toString("utf-8");
this.sshConfig = JSON.parse(sshConfigString);

if (this.sshDebugOn) {
this.sshConfig = this.enableSshDebugLogs(this.sshConfig);
}
} else {
throw new Error("Cannot instantiate Fabric connector without SSH config");
}
if (this.sshDebugOn) {
this.sshConfig = this.enableSshDebugLogs(this.sshConfig);
// TODO: Temporarily commenting this code so that we do not have breaking changes, will be fixed by ISSUE_NUM
// throw new Error("Cannot instantiate Fabric connector without SSH config");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before this comment please add this

TODO: Temporarily commenting this code so that we do not have breaking changes, will be fixed by ISSUE_NUM

this.sshConfig = {};
}

this.signCallback = opts.signCallback;
Expand Down
Loading