Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sharang ParnerkarandClaude Opus 4.8
|
dadccb9264 |
@@ -34,24 +34,6 @@ SCAN_SCHEDULE=0 0 */6 * * *
|
||||
CVE_MONITOR_SCHEDULE=0 0 0 * * *
|
||||
GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
|
||||
|
||||
# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
|
||||
# enabled; requires the agent container to have Docker access (socket mount).
|
||||
# When on, a PLC/SPS target with control logic but no reachable device gets its
|
||||
# logic instantiated on a throwaway OpenPLC, probed, then torn down.
|
||||
PLC_RUNTIME_ENABLED=0
|
||||
PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
|
||||
PLC_RUNTIME_NETWORK=certifai
|
||||
PLC_RUNTIME_MEMORY=512m
|
||||
PLC_RUNTIME_CPUS=0.5
|
||||
PLC_RUNTIME_MAX_LIFETIME_SECS=180
|
||||
PLC_RUNTIME_OPENPLC_USER=openplc
|
||||
PLC_RUNTIME_OPENPLC_PASSWORD=openplc
|
||||
|
||||
# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
|
||||
# When set, mounts the runner-facing queue + artifact endpoints behind this
|
||||
# bearer token; runners present the same token. Unset = endpoints not mounted.
|
||||
WERKBANK_RUNNER_TOKEN=
|
||||
|
||||
# Dashboard
|
||||
DASHBOARD_PORT=8080
|
||||
AGENT_API_URL=http://localhost:3001
|
||||
|
||||
+10
-22
@@ -107,10 +107,6 @@ jobs:
|
||||
run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
|
||||
- name: Clippy (mcp)
|
||||
run: cargo clippy -p compliance-mcp -- -D warnings
|
||||
- name: Clippy (werkbank-exec)
|
||||
run: cargo clippy -p werkbank-exec -- -D warnings
|
||||
- name: Clippy (control-map)
|
||||
run: cargo clippy -p control-map -- -D warnings
|
||||
|
||||
# Security audit
|
||||
- name: Security Audit
|
||||
@@ -119,8 +115,8 @@ jobs:
|
||||
RUSTC_WRAPPER: ""
|
||||
|
||||
# Tests (reuses compilation artifacts from clippy)
|
||||
- name: Tests (core + agent + werkbank-exec + control-map)
|
||||
run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
|
||||
- name: Tests (core + agent)
|
||||
run: cargo test -p compliance-core -p compliance-agent --lib
|
||||
- name: Tests (dashboard server)
|
||||
run: cargo test -p compliance-dashboard --features server --no-default-features
|
||||
- name: Tests (dashboard web)
|
||||
@@ -206,13 +202,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.meghsakha.com/certifai/compliance-agent
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-agent
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -232,13 +226,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.meghsakha.com/certifai/compliance-dashboard
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-dashboard
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -256,12 +248,10 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.meghsakha.com/certifai/compliance-docs
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-docs
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -281,13 +271,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.meghsakha.com/certifai/compliance-mcp
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-mcp
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
|
||||
Generated
+8
-53
@@ -666,7 +666,6 @@ dependencies = [
|
||||
"compliance-core",
|
||||
"compliance-dast",
|
||||
"compliance-graph",
|
||||
"control-map",
|
||||
"dashmap",
|
||||
"dotenvy",
|
||||
"futures-core",
|
||||
@@ -680,7 +679,6 @@ dependencies = [
|
||||
"rand 0.9.2",
|
||||
"regex",
|
||||
"reqwest",
|
||||
"roxmltree",
|
||||
"secrecy",
|
||||
"serde",
|
||||
"serde_json",
|
||||
@@ -700,7 +698,6 @@ dependencies = [
|
||||
"urlencoding",
|
||||
"uuid",
|
||||
"walkdir",
|
||||
"werkbank-exec",
|
||||
"zip",
|
||||
]
|
||||
|
||||
@@ -725,7 +722,6 @@ dependencies = [
|
||||
"sha2",
|
||||
"thiserror 2.0.18",
|
||||
"tokio",
|
||||
"toml",
|
||||
"tracing",
|
||||
"tracing-opentelemetry",
|
||||
"tracing-subscriber",
|
||||
@@ -969,15 +965,6 @@ dependencies = [
|
||||
"charset",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.18",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "convert_case"
|
||||
version = "0.8.0"
|
||||
@@ -2116,7 +2103,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"windows-sys 0.61.2",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -3711,7 +3698,7 @@ version = "0.50.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
|
||||
dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
"windows-sys 0.60.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -4641,12 +4628,6 @@ dependencies = [
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "roxmltree"
|
||||
version = "0.20.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
|
||||
|
||||
[[package]]
|
||||
name = "rust-stemmers"
|
||||
version = "1.2.0"
|
||||
@@ -4698,7 +4679,7 @@ dependencies = [
|
||||
"errno",
|
||||
"libc",
|
||||
"linux-raw-sys 0.4.15",
|
||||
"windows-sys 0.59.0",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -4711,7 +4692,7 @@ dependencies = [
|
||||
"errno",
|
||||
"libc",
|
||||
"linux-raw-sys 0.12.1",
|
||||
"windows-sys 0.61.2",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -5099,12 +5080,6 @@ dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha1_smol"
|
||||
version = "1.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
|
||||
|
||||
[[package]]
|
||||
name = "sha2"
|
||||
version = "0.10.9"
|
||||
@@ -5240,7 +5215,7 @@ version = "0.8.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
|
||||
dependencies = [
|
||||
"heck 0.5.0",
|
||||
"heck 0.4.1",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
@@ -5595,10 +5570,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
|
||||
dependencies = [
|
||||
"fastrand",
|
||||
"getrandom 0.4.1",
|
||||
"getrandom 0.3.4",
|
||||
"once_cell",
|
||||
"rustix 1.1.4",
|
||||
"windows-sys 0.61.2",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -6488,7 +6463,6 @@ dependencies = [
|
||||
"getrandom 0.4.1",
|
||||
"js-sys",
|
||||
"serde_core",
|
||||
"sha1_smol",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
@@ -6732,25 +6706,6 @@ dependencies = [
|
||||
"rustls-pki-types",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "werkbank-exec"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"compliance-core",
|
||||
"compliance-dast",
|
||||
"futures-util",
|
||||
"hex",
|
||||
"regex",
|
||||
"reqwest",
|
||||
"secrecy",
|
||||
"sha2",
|
||||
"thiserror 2.0.18",
|
||||
"tokio",
|
||||
"tracing",
|
||||
"uuid",
|
||||
"walkdir",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "which"
|
||||
version = "6.0.3"
|
||||
@@ -6791,7 +6746,7 @@ version = "0.1.11"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
|
||||
dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
"windows-sys 0.48.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
||||
+2
-5
@@ -7,8 +7,6 @@ members = [
|
||||
"compliance-dast",
|
||||
"compliance-mcp",
|
||||
"compliance-smoke",
|
||||
"werkbank-exec",
|
||||
"control-map",
|
||||
]
|
||||
resolver = "2"
|
||||
|
||||
@@ -18,7 +16,6 @@ expect_used = "deny"
|
||||
|
||||
[workspace.dependencies]
|
||||
compliance-core = { path = "compliance-core", default-features = false }
|
||||
control-map = { path = "control-map" }
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
tokio = { version = "1", features = ["full"] }
|
||||
@@ -26,11 +23,11 @@ tracing = "0.1"
|
||||
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
||||
chrono = { version = "0.4", features = ["serde"] }
|
||||
mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
|
||||
reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
|
||||
reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
|
||||
thiserror = "2"
|
||||
sha2 = "0.10"
|
||||
hex = "0.4"
|
||||
uuid = { version = "1", features = ["v4", "v5", "serde"] }
|
||||
uuid = { version = "1", features = ["v4", "serde"] }
|
||||
secrecy = { version = "0.10", features = ["serde"] }
|
||||
regex = "1"
|
||||
zip = { version = "2", features = ["aes-crypto", "deflate"] }
|
||||
|
||||
@@ -8,12 +8,8 @@ workspace = true
|
||||
|
||||
[dependencies]
|
||||
compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
|
||||
control-map = { workspace = true }
|
||||
compliance-graph = { path = "../compliance-graph" }
|
||||
compliance-dast = { path = "../compliance-dast" }
|
||||
# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
|
||||
# used by the Werkbank runner.
|
||||
werkbank-exec = { path = "../werkbank-exec" }
|
||||
# Native firmware build/target detection for bare-metal & RTOS artifacts.
|
||||
# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
|
||||
# available to the onboarding classifier. NOTE: CI must be able to fetch this
|
||||
@@ -38,7 +34,7 @@ hex = { workspace = true }
|
||||
uuid = { workspace = true }
|
||||
secrecy = { workspace = true }
|
||||
regex = { workspace = true }
|
||||
axum = { version = "0.8", features = ["multipart"] }
|
||||
axum = "0.8"
|
||||
tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
|
||||
git2 = "0.20"
|
||||
octocrab = "0.44"
|
||||
@@ -46,8 +42,6 @@ tokio-cron-scheduler = "0.13"
|
||||
dotenvy = "0.15"
|
||||
hmac = "0.12"
|
||||
walkdir = "2"
|
||||
# Read-only XML tree parsing for PLCopen project files (POU extraction).
|
||||
roxmltree = "0.20"
|
||||
base64 = "0.22"
|
||||
urlencoding = "2"
|
||||
futures-util = "0.3"
|
||||
@@ -69,5 +63,5 @@ tokio = { workspace = true }
|
||||
mongodb = { workspace = true }
|
||||
uuid = { workspace = true }
|
||||
secrecy = { workspace = true }
|
||||
axum = { version = "0.8", features = ["multipart"] }
|
||||
axum = "0.8"
|
||||
tower-http = { version = "0.6", features = ["cors"] }
|
||||
|
||||
@@ -1,117 +0,0 @@
|
||||
# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
|
||||
# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
|
||||
# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
|
||||
# not matter). Detection here is deterministic; the grounded LLM judge downstream
|
||||
# only confirms/refutes — it never detects. Keep patterns tight: a false positive
|
||||
# that the judge refutes marks the whole finding a false positive.
|
||||
rules:
|
||||
# --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
|
||||
- id: cra-ai-1-flask-debug-enabled
|
||||
languages: [python]
|
||||
severity: WARNING
|
||||
message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
|
||||
metadata:
|
||||
cwe: ["CWE-489: Active Debug Code"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: '$APP.run(..., debug=True, ...)'
|
||||
|
||||
- id: cra-ai-1-django-debug-true
|
||||
languages: [python]
|
||||
severity: WARNING
|
||||
message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
|
||||
metadata:
|
||||
cwe: ["CWE-489: Active Debug Code"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: 'DEBUG = True'
|
||||
|
||||
- id: cra-ai-1-tls-verify-disabled
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
|
||||
metadata:
|
||||
cwe: ["CWE-295: Improper Certificate Validation"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: 'requests.$M(..., verify=False, ...)'
|
||||
|
||||
- id: cra-ai-1-cors-wildcard
|
||||
languages: [javascript, typescript]
|
||||
severity: WARNING
|
||||
message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
|
||||
metadata:
|
||||
cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
|
||||
- pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
|
||||
|
||||
# --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
|
||||
- id: cra-ai-7-weak-password-hash
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
|
||||
metadata:
|
||||
cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
|
||||
control: cra-ai-7
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'hashlib.md5($PW)'
|
||||
- pattern: 'hashlib.sha1($PW)'
|
||||
- metavariable-regex:
|
||||
metavariable: $PW
|
||||
regex: '(?i).*(pass|pwd|secret|cred|token).*'
|
||||
|
||||
# --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
|
||||
- id: cra-ai-10-session-cookie-insecure
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
|
||||
metadata:
|
||||
cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
|
||||
control: cra-ai-10
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'SESSION_COOKIE_SECURE = False'
|
||||
- pattern: 'SESSION_COOKIE_HTTPONLY = False'
|
||||
|
||||
- id: cra-ai-10-express-cookie-insecure
|
||||
languages: [javascript, typescript]
|
||||
severity: ERROR
|
||||
message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
|
||||
metadata:
|
||||
cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
|
||||
control: cra-ai-10
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
|
||||
- pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
|
||||
|
||||
# --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
|
||||
- id: cra-ai-14-python-weak-cipher
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
|
||||
metadata:
|
||||
cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
|
||||
control: cra-ai-14
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'AES.new($K, AES.MODE_ECB, ...)'
|
||||
- pattern: 'DES.new(...)'
|
||||
- pattern: 'DES3.new(...)'
|
||||
|
||||
- id: cra-ai-14-node-weak-cipher
|
||||
languages: [javascript, typescript]
|
||||
severity: ERROR
|
||||
message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
|
||||
metadata:
|
||||
cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
|
||||
control: cra-ai-14
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'crypto.createCipheriv("des-ecb", ...)'
|
||||
- pattern: 'crypto.createCipheriv("des", ...)'
|
||||
- pattern: 'crypto.createCipher(...)'
|
||||
@@ -10,12 +10,10 @@ pub mod issues;
|
||||
pub mod mcp_tokens;
|
||||
pub mod notifications;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod pentest_handlers;
|
||||
pub use pentest_handlers as pentest;
|
||||
pub mod sbom;
|
||||
pub mod scans;
|
||||
pub mod werkbank_jobs;
|
||||
|
||||
// Re-export all handler functions so routes.rs can use `handlers::function_name`
|
||||
pub use dto::*;
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::extract::{Extension, Multipart, Path, Query};
|
||||
use axum::extract::{Extension, Path, Query};
|
||||
use axum::http::StatusCode;
|
||||
use axum::Json;
|
||||
use mongodb::bson::{doc, oid::ObjectId, to_bson};
|
||||
@@ -377,116 +377,6 @@ pub async fn add_artifact(
|
||||
get_target(Extension(agent), tenant, Path(id)).await
|
||||
}
|
||||
|
||||
/// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
|
||||
/// its file (PLC project, firmware image, source archive, mobile package). The
|
||||
/// bytes are written to the artifact blob store and referenced by `stored_path`,
|
||||
/// so ingest resolves them locally (no URL fetch).
|
||||
///
|
||||
/// Multipart fields: `file` (required), `kind` (required, snake_case
|
||||
/// `ArtifactKind`), `plc_format` (optional, for PLC projects).
|
||||
#[tracing::instrument(skip_all, fields(target_id = %id))]
|
||||
pub async fn upload_artifact(
|
||||
Extension(agent): AgentExt,
|
||||
tenant: TenantCtx,
|
||||
Path(id): Path<String>,
|
||||
mut multipart: Multipart,
|
||||
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
|
||||
let oid = parse_oid(&id)?;
|
||||
let db = tenant_db(&agent, &tenant).await?;
|
||||
if db
|
||||
.onboarded_targets()
|
||||
.find_one(doc! { "_id": oid })
|
||||
.await
|
||||
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
|
||||
.is_none()
|
||||
{
|
||||
return Err(StatusCode::NOT_FOUND);
|
||||
}
|
||||
|
||||
let mut kind: Option<ArtifactKind> = None;
|
||||
let mut plc_format: Option<PlcFormat> = None;
|
||||
let mut filename = String::from("upload.bin");
|
||||
let mut bytes: Option<axum::body::Bytes> = None;
|
||||
|
||||
while let Some(field) = multipart
|
||||
.next_field()
|
||||
.await
|
||||
.map_err(|_| StatusCode::BAD_REQUEST)?
|
||||
{
|
||||
match field.name().unwrap_or("") {
|
||||
"kind" => {
|
||||
let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||
kind = parse_enum(&v);
|
||||
}
|
||||
"plc_format" => {
|
||||
let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||
plc_format = parse_enum(&v);
|
||||
}
|
||||
"file" => {
|
||||
if let Some(fname) = field.file_name() {
|
||||
filename = fname.to_string();
|
||||
}
|
||||
bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
|
||||
let (Some(kind), Some(bytes)) = (kind, bytes) else {
|
||||
return Err(StatusCode::BAD_REQUEST);
|
||||
};
|
||||
|
||||
// Store the uploaded bytes under the artifact blob store.
|
||||
let safe_name: String = filename
|
||||
.chars()
|
||||
.map(|c| {
|
||||
if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
|
||||
c
|
||||
} else {
|
||||
'_'
|
||||
}
|
||||
})
|
||||
.collect();
|
||||
let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
|
||||
.join("uploads")
|
||||
.join(&id);
|
||||
std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
|
||||
std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
// Build the artifact for this kind, referencing the stored file.
|
||||
let mut artifact = match kind {
|
||||
ArtifactKind::PlcProject => Artifact::plc_project(
|
||||
filename.clone(),
|
||||
plc_format.unwrap_or(PlcFormat::PlcopenXml),
|
||||
),
|
||||
ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
|
||||
ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
|
||||
ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
|
||||
// Non-file kinds (git repo, live URL, container ref, text) use the JSON
|
||||
// add-artifact endpoint, not upload.
|
||||
_ => return Err(StatusCode::BAD_REQUEST),
|
||||
};
|
||||
artifact.stored_path = Some(dest.to_string_lossy().to_string());
|
||||
artifact.size_bytes = Some(bytes.len() as u64);
|
||||
|
||||
let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
db.onboarded_targets()
|
||||
.update_one(
|
||||
doc! { "_id": oid },
|
||||
doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
|
||||
)
|
||||
.await
|
||||
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
get_target(Extension(agent), tenant, Path(id)).await
|
||||
}
|
||||
|
||||
/// Deserialize a snake_case enum value from a plain string.
|
||||
fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
|
||||
serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
|
||||
}
|
||||
|
||||
/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
|
||||
#[tracing::instrument(skip_all, fields(target_id = %id))]
|
||||
pub async fn applicable_scans_for_target(
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
//! OSCAL assessment endpoint.
|
||||
//!
|
||||
//! Returns a standard OSCAL assessment-results document for a target's findings,
|
||||
//! driven by each finding's stamped `control_refs` (from the scan's control-triage
|
||||
//! stage): mapped findings target their controls, unmapped findings are reported
|
||||
//! as-is. See `compliance_core::models::oscal_assessment`.
|
||||
|
||||
use axum::extract::Extension;
|
||||
use axum::http::StatusCode;
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use axum::Json;
|
||||
use mongodb::bson::doc;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
use compliance_core::tenant_ctx::TenantCtx;
|
||||
|
||||
use super::dto::{collect_cursor_async, tenant_db, AgentExt};
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct AssessRequest {
|
||||
/// The target / repo id whose findings are assessed.
|
||||
pub target_id: String,
|
||||
}
|
||||
|
||||
/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
|
||||
pub async fn assess_target(
|
||||
Extension(agent): AgentExt,
|
||||
tenant: TenantCtx,
|
||||
Json(req): Json<AssessRequest>,
|
||||
) -> Response {
|
||||
let db = match tenant_db(&agent, &tenant).await {
|
||||
Ok(db) => db,
|
||||
Err(code) => return code.into_response(),
|
||||
};
|
||||
|
||||
let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
|
||||
{
|
||||
Ok(cursor) => collect_cursor_async(cursor).await,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
|
||||
return StatusCode::INTERNAL_SERVER_ERROR.into_response();
|
||||
}
|
||||
};
|
||||
|
||||
Json(assess(&findings, chrono::Utc::now())).into_response()
|
||||
}
|
||||
@@ -1,289 +0,0 @@
|
||||
//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
|
||||
//!
|
||||
//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
|
||||
//! and post the result back. Machine auth is a **static bearer token**
|
||||
//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
|
||||
//! tenants (each request names its `tenant`). Routes are only mounted when the
|
||||
//! token is configured; with none set they don't exist (404).
|
||||
//!
|
||||
//! On completion the runner's findings are persisted against the job's target,
|
||||
//! so a job run by a remote runner lands the same findings an in-process run
|
||||
//! would (WB-05, the control-plane cut-over).
|
||||
|
||||
use axum::extract::{Extension, Path, Request};
|
||||
use axum::http::{header, StatusCode};
|
||||
use axum::middleware::Next;
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use axum::Json;
|
||||
use mongodb::bson::{doc, oid::ObjectId};
|
||||
use secrecy::ExposeSecret;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::time::Duration;
|
||||
|
||||
use compliance_core::models::werkbank::{
|
||||
CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
|
||||
};
|
||||
use compliance_core::models::ArtifactKind;
|
||||
|
||||
use super::dto::AgentExt;
|
||||
use crate::database::Database;
|
||||
use crate::werkbank::JobQueue;
|
||||
|
||||
/// Gate the runner endpoints behind the static runner bearer token.
|
||||
pub async fn require_runner_token(
|
||||
Extension(agent): AgentExt,
|
||||
request: Request,
|
||||
next: Next,
|
||||
) -> Response {
|
||||
let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
|
||||
return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
|
||||
};
|
||||
let presented = request
|
||||
.headers()
|
||||
.get(header::AUTHORIZATION)
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.and_then(|s| s.strip_prefix("Bearer "))
|
||||
.map(str::trim)
|
||||
.filter(|s| !s.is_empty());
|
||||
let Some(presented) = presented else {
|
||||
return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
|
||||
};
|
||||
if !constant_time_eq(presented, expected.expose_secret()) {
|
||||
return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
|
||||
}
|
||||
next.run(request).await
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
|
||||
pub async fn lease(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<LeaseRequest>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
|
||||
let leased = queue
|
||||
.lease(
|
||||
&req.runner_id,
|
||||
req.executor,
|
||||
&req.labels,
|
||||
Duration::from_secs(req.lease_ttl_secs),
|
||||
chrono::Utc::now(),
|
||||
)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(match leased {
|
||||
Some(job) => Json(job).into_response(),
|
||||
None => StatusCode::NO_CONTENT.into_response(),
|
||||
})
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
|
||||
pub async fn heartbeat(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<HeartbeatRequest>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
|
||||
let ack = queue
|
||||
.heartbeat(
|
||||
&req.job_id,
|
||||
&req.lease_token,
|
||||
Duration::from_secs(req.lease_ttl_secs),
|
||||
chrono::Utc::now(),
|
||||
)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(match ack {
|
||||
Some(ack) => Json(ack).into_response(),
|
||||
// Lease lost — the runner should abandon the job.
|
||||
None => StatusCode::CONFLICT.into_response(),
|
||||
})
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
|
||||
pub async fn complete(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<CompleteRequest>,
|
||||
) -> Result<Json<CompleteResponse>, StatusCode> {
|
||||
let db = tenant_db(&agent, &req.tenant).await?;
|
||||
let queue = JobQueue::new(&db);
|
||||
let now = chrono::Utc::now();
|
||||
let recorded = queue
|
||||
.complete(&req.job_id, &req.lease_token, &req.result, now)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
|
||||
// Only persist findings for the run that actually recorded the result, so a
|
||||
// duplicate/late completion can't double-insert.
|
||||
if recorded {
|
||||
if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
|
||||
persist_findings(&db, &record.job.target_id, &req.result).await;
|
||||
}
|
||||
}
|
||||
Ok(Json(CompleteResponse { recorded }))
|
||||
}
|
||||
|
||||
/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
|
||||
/// program a runner needs to load). The hash is validated against traversal by
|
||||
/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
|
||||
/// input.
|
||||
#[tracing::instrument(skip_all, fields(hash = %hash))]
|
||||
pub async fn serve_artifact(
|
||||
Extension(agent): AgentExt,
|
||||
Path(hash): Path<String>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let base = std::path::Path::new(&agent.config.artifact_store_base_path);
|
||||
match crate::ingest::blob::read_blob(base, &hash) {
|
||||
Ok(bytes) => {
|
||||
Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
|
||||
}
|
||||
Err(_) => Err(StatusCode::NOT_FOUND),
|
||||
}
|
||||
}
|
||||
|
||||
/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
|
||||
/// stash it as a content-addressed blob (which the runner fetches via
|
||||
/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
|
||||
/// half of the loop — a runner then leases it, provisions, and posts results.
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct EnqueueRequest {
|
||||
/// The tenant whose queue to enqueue into.
|
||||
pub tenant: String,
|
||||
/// The onboarded target to test.
|
||||
pub target_id: String,
|
||||
}
|
||||
|
||||
/// The enqueued job's id.
|
||||
#[derive(Debug, Serialize)]
|
||||
pub struct EnqueueResponse {
|
||||
/// The new job id.
|
||||
pub job_id: String,
|
||||
/// Whether this call inserted it (false = already queued).
|
||||
pub enqueued: bool,
|
||||
}
|
||||
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
|
||||
pub async fn enqueue(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<EnqueueRequest>,
|
||||
) -> Result<Json<EnqueueResponse>, StatusCode> {
|
||||
let db = tenant_db(&agent, &req.tenant).await?;
|
||||
let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||
let target = db
|
||||
.onboarded_targets()
|
||||
.find_one(doc! { "_id": oid })
|
||||
.await
|
||||
.map_err(internal)?
|
||||
.ok_or(StatusCode::NOT_FOUND)?;
|
||||
|
||||
// Extract the control-logic program from the target's PLC-source artifacts
|
||||
// (same selection as the in-process PLC scan).
|
||||
let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
|
||||
let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
|
||||
let program = target
|
||||
.artifacts
|
||||
.iter()
|
||||
.filter(|a| {
|
||||
matches!(
|
||||
a.kind,
|
||||
ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
|
||||
)
|
||||
})
|
||||
.find_map(|a| {
|
||||
let path = ingest_set
|
||||
.get(&a.id)
|
||||
.and_then(|ia| ia.working_path.clone())?;
|
||||
werkbank_exec::plc::extract_program(&path)
|
||||
})
|
||||
.ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
|
||||
|
||||
// Stash the program source so the runner can fetch it by hash.
|
||||
let base = std::path::Path::new(&agent.config.artifact_store_base_path);
|
||||
let hash =
|
||||
crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
|
||||
|
||||
let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
|
||||
let job = Job::plc_provision(
|
||||
&job_id,
|
||||
&req.tenant,
|
||||
&req.target_id,
|
||||
InputRef::blob(hash),
|
||||
agent.config.plc_runtime.max_lifetime_secs,
|
||||
);
|
||||
let enqueued = JobQueue::new(&db)
|
||||
.enqueue(job, chrono::Utc::now())
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(Json(EnqueueResponse { job_id, enqueued }))
|
||||
}
|
||||
|
||||
/// Persist a job result's findings against its target: general findings
|
||||
/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
|
||||
/// is logged, not surfaced to the runner (its result is already recorded).
|
||||
async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
|
||||
for finding in &result.findings {
|
||||
let exists = db
|
||||
.findings()
|
||||
.find_one(doc! { "fingerprint": &finding.fingerprint })
|
||||
.await
|
||||
.ok()
|
||||
.flatten()
|
||||
.is_some();
|
||||
if !exists {
|
||||
if let Err(e) = db.findings().insert_one(finding).await {
|
||||
tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
for finding in &result.dast_findings {
|
||||
if let Err(e) = db.dast_findings().insert_one(finding).await {
|
||||
tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
|
||||
}
|
||||
}
|
||||
tracing::info!(
|
||||
target_id,
|
||||
findings = result.findings.len(),
|
||||
dast = result.dast_findings.len(),
|
||||
"werkbank: persisted runner results"
|
||||
);
|
||||
}
|
||||
|
||||
/// Resolve the tenant-scoped database for a request.
|
||||
async fn tenant_db(
|
||||
agent: &crate::agent::ComplianceAgent,
|
||||
tenant: &str,
|
||||
) -> Result<Database, StatusCode> {
|
||||
agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
|
||||
}
|
||||
|
||||
/// Map any internal error to a 500.
|
||||
fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
|
||||
tracing::error!("werkbank endpoint error: {e}");
|
||||
StatusCode::INTERNAL_SERVER_ERROR
|
||||
}
|
||||
|
||||
/// Length-checked, constant-time-ish token comparison.
|
||||
fn constant_time_eq(a: &str, b: &str) -> bool {
|
||||
if a.len() != b.len() {
|
||||
return false;
|
||||
}
|
||||
let mut diff = 0u8;
|
||||
for (x, y) in a.bytes().zip(b.bytes()) {
|
||||
diff |= x ^ y;
|
||||
}
|
||||
diff == 0
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::constant_time_eq;
|
||||
|
||||
#[test]
|
||||
fn token_compare() {
|
||||
assert!(constant_time_eq("secret", "secret"));
|
||||
assert!(!constant_time_eq("secret", "secrex"));
|
||||
assert!(!constant_time_eq("secret", "secretx"));
|
||||
assert!(!constant_time_eq("", "x"));
|
||||
}
|
||||
}
|
||||
@@ -6,7 +6,6 @@ use crate::api::handlers;
|
||||
pub fn build_router() -> Router {
|
||||
Router::new()
|
||||
.route("/api/v1/health", get(handlers::health))
|
||||
.route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
|
||||
.route("/api/v1/stats/overview", get(handlers::stats_overview))
|
||||
.route(
|
||||
"/api/v1/settings/ssh-public-key",
|
||||
@@ -27,10 +26,6 @@ pub fn build_router() -> Router {
|
||||
"/api/v1/targets/{id}/artifacts",
|
||||
post(handlers::onboarding::add_artifact),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/targets/{id}/artifacts/upload",
|
||||
post(handlers::onboarding::upload_artifact),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/targets/{id}/applicable-scans",
|
||||
get(handlers::onboarding::applicable_scans_for_target),
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::extract::{DefaultBodyLimit, Request};
|
||||
use axum::extract::Request;
|
||||
use axum::http::HeaderValue;
|
||||
use axum::middleware::Next;
|
||||
use axum::response::Response;
|
||||
use axum::routing::{delete, get, post};
|
||||
use axum::routing::{delete, get};
|
||||
use axum::{middleware, Extension, Router};
|
||||
use tokio::sync::RwLock;
|
||||
use tower_http::cors::CorsLayer;
|
||||
@@ -72,46 +72,8 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
|
||||
Router::new()
|
||||
};
|
||||
|
||||
// Werkbank runner API. Like admin, only mounted when its bearer token is
|
||||
// configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
|
||||
let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
|
||||
tracing::info!(
|
||||
"Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
|
||||
);
|
||||
Router::new()
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
post(handlers::werkbank_jobs::lease),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/heartbeat",
|
||||
post(handlers::werkbank_jobs::heartbeat),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
post(handlers::werkbank_jobs::complete),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
post(handlers::werkbank_jobs::enqueue),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/artifacts/{hash}",
|
||||
get(handlers::werkbank_jobs::serve_artifact),
|
||||
)
|
||||
.layer(middleware::from_fn(
|
||||
handlers::werkbank_jobs::require_runner_token,
|
||||
))
|
||||
} else {
|
||||
Router::new()
|
||||
};
|
||||
|
||||
let mut app = routes::build_router()
|
||||
.merge(admin_router)
|
||||
.merge(werkbank_router)
|
||||
// Allow large artifact uploads (PLC .projectarchive, firmware images,
|
||||
// mobile packages) — axum's default request-body limit is only 2 MiB.
|
||||
.layer(DefaultBodyLimit::max(512 * 1024 * 1024))
|
||||
.layer(Extension(Arc::new(agent.clone())))
|
||||
.layer(CorsLayer::permissive())
|
||||
.layer(TraceLayer::new_for_http())
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
|
||||
use compliance_core::AgentConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
@@ -64,47 +63,5 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
|
||||
pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
|
||||
admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
|
||||
tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
|
||||
plc_runtime: load_plc_runtime_config(),
|
||||
werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
|
||||
breakpilot: load_breakpilot_config(),
|
||||
})
|
||||
}
|
||||
|
||||
/// Build the ephemeral soft-PLC provisioning config from the environment,
|
||||
/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
|
||||
/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
|
||||
fn load_plc_runtime_config() -> PlcRuntimeConfig {
|
||||
let d = PlcRuntimeConfig::default();
|
||||
PlcRuntimeConfig {
|
||||
enabled: env_var_opt("PLC_RUNTIME_ENABLED")
|
||||
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
||||
.unwrap_or(d.enabled),
|
||||
image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
|
||||
network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
|
||||
memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
|
||||
cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
|
||||
max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
|
||||
.and_then(|v| v.parse().ok())
|
||||
.unwrap_or(d.max_lifetime_secs),
|
||||
openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
|
||||
openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
|
||||
.unwrap_or(d.openplc_password),
|
||||
}
|
||||
}
|
||||
|
||||
/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
|
||||
/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
|
||||
fn load_breakpilot_config() -> BreakpilotConfig {
|
||||
let d = BreakpilotConfig::default();
|
||||
BreakpilotConfig {
|
||||
base_url: env_var_opt("BREAKPILOT_BASE_URL"),
|
||||
token: env_secret_opt("BREAKPILOT_TOKEN"),
|
||||
snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
|
||||
semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
|
||||
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
||||
.unwrap_or(d.semantic_mapping),
|
||||
grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
|
||||
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
||||
.unwrap_or(d.grounded_control_checks),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
//! The grounded control checker: judge each candidate region for a control, then
|
||||
//! keep only the verdicts that survive the grounding gate.
|
||||
//!
|
||||
//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
|
||||
//! the whole recognize → ground path is then exercised without an LLM. With the
|
||||
//! real judge, determinism comes from temperature 0 plus the gate.
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
|
||||
pub struct GroundedControlChecker<J> {
|
||||
judge: J,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> GroundedControlChecker<J> {
|
||||
pub fn new(judge: J) -> Self {
|
||||
Self { judge }
|
||||
}
|
||||
|
||||
/// Judge every candidate region for `spec` and return the grounded findings.
|
||||
/// A verdict that doesn't quote real code in its region is dropped by
|
||||
/// [`ground`], so nothing fabricated reaches the caller.
|
||||
pub async fn check(
|
||||
&self,
|
||||
spec: &ControlCheckSpec,
|
||||
regions: &[CandidateRegion],
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let mut findings = Vec::new();
|
||||
for region in regions {
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
if let Some(finding) = ground(spec, region, &verdict, repo_id) {
|
||||
findings.push(finding);
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
/// Deterministic stub: returns a fixed verdict for every region, so the
|
||||
/// recognize → ground composition is tested without an LLM.
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region(content: &str) -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: content.into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn keeps_grounded_and_drops_ungrounded() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let regions = vec![
|
||||
region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
|
||||
region("totally unrelated code\n"), // snippet absent → dropped
|
||||
];
|
||||
let findings = checker.check(&spec(), ®ions, "repo").await;
|
||||
assert_eq!(findings.len(), 1);
|
||||
assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
|
||||
assert_eq!(findings[0].line_number, Some(2));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn non_violation_yields_nothing() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
},
|
||||
});
|
||||
let findings = checker
|
||||
.check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
|
||||
.await;
|
||||
assert!(findings.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -1,245 +0,0 @@
|
||||
//! In-memory embedding index over the control corpus, for region → control
|
||||
//! retrieval.
|
||||
//!
|
||||
//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
|
||||
//! controls carry none), so we map by *similarity*: embed each control's
|
||||
//! requirement text once, then for a code region pull the top-K nearest controls
|
||||
//! to hand to the grounded judge. This is the retrieval half of the semantic path.
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use compliance_core::control_check::ControlCheckSpec;
|
||||
use compliance_core::error::CoreError;
|
||||
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// A control spec paired with its requirement-text embedding.
|
||||
pub struct ControlIndex {
|
||||
entries: Vec<(ControlCheckSpec, Vec<f64>)>,
|
||||
}
|
||||
|
||||
/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
|
||||
/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
|
||||
#[derive(Serialize, Deserialize)]
|
||||
struct PersistedIndex {
|
||||
corpus_hash: String,
|
||||
entries: Vec<PersistedEntry>,
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize)]
|
||||
struct PersistedEntry {
|
||||
spec: ControlCheckSpec,
|
||||
embedding: Vec<f64>,
|
||||
}
|
||||
|
||||
/// Stable hash of the corpus identity (each control's id + requirement text, in
|
||||
/// order). Same catalog → same hash → the cached embeddings are reused instead of
|
||||
/// re-embedding the whole corpus.
|
||||
fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for s in specs {
|
||||
hasher.update(s.control_id.as_bytes());
|
||||
hasher.update([0u8]);
|
||||
hasher.update(s.requirement.as_bytes());
|
||||
hasher.update([0u8]);
|
||||
}
|
||||
format!("{:x}", hasher.finalize())
|
||||
}
|
||||
|
||||
impl ControlIndex {
|
||||
/// Build directly from precomputed embeddings (used by tests + callers that
|
||||
/// already embedded the corpus).
|
||||
pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
|
||||
Self { entries }
|
||||
}
|
||||
|
||||
/// Load the index from `cache_path` if it still matches the current corpus,
|
||||
/// otherwise embed the corpus and persist it there. This turns the per-scan
|
||||
/// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
|
||||
/// that survives across scans; the cache self-invalidates when the catalog
|
||||
/// changes (its [`corpus_hash`] no longer matches).
|
||||
pub async fn load_or_build(
|
||||
llm: &LlmClient,
|
||||
specs: Vec<ControlCheckSpec>,
|
||||
cache_path: &Path,
|
||||
) -> Result<Self, CoreError> {
|
||||
let hash = corpus_hash(&specs);
|
||||
if let Some(index) = Self::load_cache(cache_path, &hash).await {
|
||||
tracing::debug!(
|
||||
controls = index.len(),
|
||||
"reusing cached control embedding index"
|
||||
);
|
||||
return Ok(index);
|
||||
}
|
||||
let index = Self::build(llm, specs).await?;
|
||||
if let Err(e) = index.write_cache(cache_path, &hash).await {
|
||||
tracing::warn!(error = %e, "failed to persist control embedding index");
|
||||
}
|
||||
Ok(index)
|
||||
}
|
||||
|
||||
/// Read a persisted index, returning it only if its corpus hash matches.
|
||||
async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
|
||||
let raw = tokio::fs::read(path).await.ok()?;
|
||||
let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
|
||||
if persisted.corpus_hash != hash {
|
||||
return None;
|
||||
}
|
||||
Some(Self {
|
||||
entries: persisted
|
||||
.entries
|
||||
.into_iter()
|
||||
.map(|e| (e.spec, e.embedding))
|
||||
.collect(),
|
||||
})
|
||||
}
|
||||
|
||||
/// Persist the index atomically (temp file + rename) keyed by corpus hash.
|
||||
async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
|
||||
if let Some(parent) = path.parent() {
|
||||
tokio::fs::create_dir_all(parent).await?;
|
||||
}
|
||||
let persisted = PersistedIndex {
|
||||
corpus_hash: hash.to_string(),
|
||||
entries: self
|
||||
.entries
|
||||
.iter()
|
||||
.map(|(spec, emb)| PersistedEntry {
|
||||
spec: spec.clone(),
|
||||
embedding: emb.clone(),
|
||||
})
|
||||
.collect(),
|
||||
};
|
||||
let raw = serde_json::to_vec(&persisted)?;
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
tokio::fs::write(&tmp, &raw).await?;
|
||||
tokio::fs::rename(&tmp, path).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Build by embedding each control's requirement text.
|
||||
pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
|
||||
if specs.is_empty() {
|
||||
return Ok(Self {
|
||||
entries: Vec::new(),
|
||||
});
|
||||
}
|
||||
let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
|
||||
let embeddings = llm
|
||||
.embed(texts)
|
||||
.await
|
||||
.map_err(|e| CoreError::Llm(e.to_string()))?;
|
||||
Ok(Self {
|
||||
entries: specs.into_iter().zip(embeddings).collect(),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn len(&self) -> usize {
|
||||
self.entries.len()
|
||||
}
|
||||
|
||||
pub fn is_empty(&self) -> bool {
|
||||
self.entries.is_empty()
|
||||
}
|
||||
|
||||
/// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
|
||||
pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
|
||||
let mut scored: Vec<(f64, &ControlCheckSpec)> = self
|
||||
.entries
|
||||
.iter()
|
||||
.map(|(spec, emb)| (cosine(query, emb), spec))
|
||||
.collect();
|
||||
scored.sort_by(|a, b| b.0.total_cmp(&a.0));
|
||||
scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
|
||||
}
|
||||
}
|
||||
|
||||
/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
|
||||
fn cosine(a: &[f64], b: &[f64]) -> f64 {
|
||||
if a.len() != b.len() || a.is_empty() {
|
||||
return 0.0;
|
||||
}
|
||||
let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
|
||||
let na: f64 = a.iter().map(|x| x * x).sum();
|
||||
let nb: f64 = b.iter().map(|x| x * x).sum();
|
||||
if na == 0.0 || nb == 0.0 {
|
||||
return 0.0;
|
||||
}
|
||||
dot / (na.sqrt() * nb.sqrt())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
fn spec(id: &str) -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: id.into(),
|
||||
title: id.into(),
|
||||
requirement: id.into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nearest_ranks_by_cosine() {
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("a"), vec![1.0, 0.0]),
|
||||
(spec("b"), vec![0.0, 1.0]),
|
||||
(spec("c"), vec![0.7, 0.7]),
|
||||
]);
|
||||
let hits = index.nearest(&[0.9, 0.1], 2);
|
||||
assert_eq!(hits.len(), 2);
|
||||
assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cosine_edges_are_zero() {
|
||||
assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
|
||||
assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
|
||||
assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn corpus_hash_is_stable_and_identity_sensitive() {
|
||||
let a = corpus_hash(&[spec("x"), spec("y")]);
|
||||
assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
|
||||
assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
|
||||
assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
async fn cache_round_trips_and_misses_on_corpus_change() {
|
||||
let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
|
||||
let path = dir.join("control-index.json");
|
||||
let specs = [spec("a"), spec("b")];
|
||||
let hash = corpus_hash(&specs);
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("a"), vec![1.0, 0.0]),
|
||||
(spec("b"), vec![0.0, 1.0]),
|
||||
]);
|
||||
index.write_cache(&path, &hash).await.unwrap();
|
||||
|
||||
// matching corpus hash → hit
|
||||
let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
|
||||
assert_eq!(loaded.len(), 2);
|
||||
assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
|
||||
// corpus changed → miss (forces a rebuild)
|
||||
assert!(ControlIndex::load_cache(&path, "differenthash")
|
||||
.await
|
||||
.is_none());
|
||||
// absent file → miss, not an error
|
||||
assert!(
|
||||
ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
|
||||
.await
|
||||
.is_none()
|
||||
);
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
}
|
||||
@@ -1,167 +0,0 @@
|
||||
//! The "recognize" stage: judge whether a code region violates a control.
|
||||
//!
|
||||
//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
|
||||
//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
|
||||
//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
|
||||
//! and everything it returns is then re-checked by the grounding gate
|
||||
//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
|
||||
//! smart; it is never trusted.
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
|
||||
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Prompt/logic version — part of the verdict cache key, bump on any change here.
|
||||
pub const PROMPT_VERSION: &str = "control-judge-v1";
|
||||
|
||||
const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
|
||||
You are given ONE compliance control (a requirement) and ONE code region. Decide \
|
||||
ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
|
||||
shown — never assume code that is not present. (2) If and only if it violates, copy \
|
||||
the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
|
||||
region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
|
||||
violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
|
||||
Respond with STRICT JSON only, no prose: \
|
||||
{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
|
||||
|
||||
/// Judges one (control, region). Async-in-trait so a stub can drive tests.
|
||||
#[allow(async_fn_in_trait)]
|
||||
pub trait ControlJudge: Send + Sync {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
|
||||
}
|
||||
|
||||
/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
|
||||
pub struct LlmControlJudge {
|
||||
llm: Arc<LlmClient>,
|
||||
}
|
||||
|
||||
impl LlmControlJudge {
|
||||
pub fn new(llm: Arc<LlmClient>) -> Self {
|
||||
Self { llm }
|
||||
}
|
||||
}
|
||||
|
||||
impl ControlJudge for LlmControlJudge {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
|
||||
let user = build_user_prompt(spec, region);
|
||||
match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
|
||||
Ok(response) => parse_verdict(&response),
|
||||
Err(e) => {
|
||||
// Fail closed: a transient model error yields no finding, never a
|
||||
// fabricated one.
|
||||
tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
|
||||
format!(
|
||||
"CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
|
||||
id = spec.control_id,
|
||||
title = spec.title,
|
||||
req = spec.requirement,
|
||||
file = region.file,
|
||||
line = region.start_line,
|
||||
code = region.content,
|
||||
)
|
||||
}
|
||||
|
||||
#[derive(Debug, Default, Deserialize)]
|
||||
struct RawVerdict {
|
||||
#[serde(default)]
|
||||
violates: bool,
|
||||
#[serde(default)]
|
||||
snippet: String,
|
||||
#[serde(default)]
|
||||
cwe: Option<String>,
|
||||
#[serde(default)]
|
||||
confidence: f64,
|
||||
}
|
||||
|
||||
/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
|
||||
/// degrades to a non-violation (never a fabricated finding).
|
||||
fn parse_verdict(response: &str) -> LlmVerdict {
|
||||
let cleaned = response
|
||||
.trim()
|
||||
.trim_start_matches("```json")
|
||||
.trim_start_matches("```")
|
||||
.trim_end_matches("```")
|
||||
.trim();
|
||||
match serde_json::from_str::<RawVerdict>(cleaned) {
|
||||
Ok(raw) => LlmVerdict {
|
||||
violates: raw.violates,
|
||||
snippet: raw.snippet,
|
||||
cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
|
||||
confidence: raw.confidence,
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn no_violation() -> LlmVerdict {
|
||||
LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_plain_and_fenced_json() {
|
||||
let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
|
||||
let v = parse_verdict(plain);
|
||||
assert!(v.violates);
|
||||
assert_eq!(v.snippet, "PASSWORD = \"x\"");
|
||||
assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
|
||||
|
||||
let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
|
||||
assert!(!parse_verdict(fenced).violates);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn garbage_and_empty_cwe_are_safe() {
|
||||
assert!(!parse_verdict("not json at all").violates); // fail closed
|
||||
let no_cwe =
|
||||
parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": " ", "confidence": 0.5}"#);
|
||||
assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn user_prompt_carries_control_and_code() {
|
||||
let region = CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "PASSWORD = \"admin\"".into(),
|
||||
};
|
||||
let p = build_user_prompt(&spec(), ®ion);
|
||||
assert!(p.contains("cra-ai-8"));
|
||||
assert!(p.contains("Products must not ship default credentials"));
|
||||
assert!(p.contains("PASSWORD = \"admin\""));
|
||||
assert!(p.contains("src/auth.py"));
|
||||
}
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
//! Controls corpus providers.
|
||||
//!
|
||||
//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
|
||||
//! the control corpus the mapping engine assesses findings against. Currently:
|
||||
//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
|
||||
//! and snapshots it locally.
|
||||
|
||||
mod checker;
|
||||
mod index;
|
||||
mod judge;
|
||||
mod oscal_provider;
|
||||
mod scan_triage;
|
||||
mod semantic;
|
||||
mod surface;
|
||||
mod triage;
|
||||
|
||||
pub use checker::GroundedControlChecker;
|
||||
pub use index::ControlIndex;
|
||||
pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
|
||||
pub use oscal_provider::OscalControlsProvider;
|
||||
pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
|
||||
pub use semantic::SemanticControlChecker;
|
||||
pub use triage::{ControlTriage, TriageOutcome};
|
||||
@@ -1,229 +0,0 @@
|
||||
//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
|
||||
//! catalog export.
|
||||
//!
|
||||
//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
|
||||
//! the exact bytes to disk (so scans are deterministic and keep working offline /
|
||||
//! on-prem), and maps the catalog into the corpus controls the mapping engine
|
||||
//! consumes. The producer owns the catalog; we own the assessment — this is the
|
||||
//! ingest half of the loop.
|
||||
|
||||
use std::path::PathBuf;
|
||||
|
||||
use secrecy::{ExposeSecret, SecretString};
|
||||
|
||||
use compliance_core::error::CoreError;
|
||||
use compliance_core::models::onboarding::ComplianceFramework;
|
||||
use compliance_core::models::oscal::OscalDocument;
|
||||
use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
|
||||
|
||||
/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
|
||||
/// and snapshots it locally for deterministic / offline reuse.
|
||||
pub struct OscalControlsProvider {
|
||||
http: reqwest::Client,
|
||||
base_url: String,
|
||||
token: Option<SecretString>,
|
||||
snapshot_dir: PathBuf,
|
||||
}
|
||||
|
||||
impl OscalControlsProvider {
|
||||
/// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
|
||||
/// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
|
||||
/// snapshots are written so a later scan can reuse them without the network.
|
||||
pub fn new(
|
||||
http: reqwest::Client,
|
||||
base_url: impl Into<String>,
|
||||
token: Option<SecretString>,
|
||||
snapshot_dir: impl Into<PathBuf>,
|
||||
) -> Self {
|
||||
Self {
|
||||
http,
|
||||
base_url: base_url.into(),
|
||||
token,
|
||||
snapshot_dir: snapshot_dir.into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn catalog_url(&self, framework: &str) -> String {
|
||||
format!(
|
||||
"{}/api/compliance/v1/oscal/catalog?framework={framework}",
|
||||
self.base_url.trim_end_matches('/')
|
||||
)
|
||||
}
|
||||
|
||||
fn snapshot_path(&self, framework: &str) -> PathBuf {
|
||||
self.snapshot_dir
|
||||
.join(format!("oscal-catalog-{framework}.json"))
|
||||
}
|
||||
|
||||
/// Fetch the raw catalog bytes for a framework token over HTTP.
|
||||
async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
|
||||
let mut req = self.http.get(self.catalog_url(framework));
|
||||
if let Some(token) = &self.token {
|
||||
req = req.bearer_auth(token.expose_secret());
|
||||
}
|
||||
let resp = req
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| CoreError::Http(e.to_string()))?;
|
||||
if !resp.status().is_success() {
|
||||
return Err(CoreError::Http(format!(
|
||||
"catalog fetch for {framework} returned HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
resp.bytes()
|
||||
.await
|
||||
.map(|b| b.to_vec())
|
||||
.map_err(|e| CoreError::Http(e.to_string()))
|
||||
}
|
||||
|
||||
/// Write a catalog snapshot atomically (temp file + rename).
|
||||
async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
|
||||
tokio::fs::create_dir_all(&self.snapshot_dir).await?;
|
||||
let path = self.snapshot_path(framework);
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
tokio::fs::write(&tmp, raw).await?;
|
||||
tokio::fs::rename(&tmp, &path).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Read a previously written snapshot, if one exists.
|
||||
async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
|
||||
match tokio::fs::read(self.snapshot_path(framework)).await {
|
||||
Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
|
||||
Err(e) => Err(e.into()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Load the catalog for a framework token: fetch fresh + snapshot the exact
|
||||
/// bytes; on network failure, fall back to the last snapshot so scans run.
|
||||
async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
|
||||
match self.fetch_raw(framework).await {
|
||||
Ok(raw) => {
|
||||
let doc: OscalDocument = serde_json::from_slice(&raw)?;
|
||||
if let Err(e) = self.write_snapshot(framework, &raw).await {
|
||||
tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
|
||||
}
|
||||
Ok(doc)
|
||||
}
|
||||
Err(fetch_err) => match self.read_snapshot(framework).await? {
|
||||
Some(doc) => {
|
||||
tracing::warn!(
|
||||
framework, error = %fetch_err,
|
||||
"OSCAL catalog fetch failed; falling back to snapshot"
|
||||
);
|
||||
Ok(doc)
|
||||
}
|
||||
None => Err(fetch_err),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
/// Load the OSCAL catalog for a compliance framework.
|
||||
pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
|
||||
self.load_token(&framework.to_string()).await
|
||||
}
|
||||
|
||||
/// Load the code-checkable master-controls catalog
|
||||
/// (`?framework=master-controls`).
|
||||
pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
|
||||
self.load_token("master-controls").await
|
||||
}
|
||||
}
|
||||
|
||||
/// Order controls whose title/text mention the query context first (stable), then
|
||||
/// truncate to the requested limit. Naive relevance — refined when the assessment
|
||||
/// layer lands.
|
||||
fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
|
||||
if !context.is_empty() {
|
||||
let needle = context.to_lowercase();
|
||||
controls.sort_by_key(|c| {
|
||||
let hit =
|
||||
c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
|
||||
u8::from(!hit)
|
||||
});
|
||||
}
|
||||
controls.truncate(limit);
|
||||
controls
|
||||
}
|
||||
|
||||
impl ControlsProvider for OscalControlsProvider {
|
||||
fn name(&self) -> &str {
|
||||
"breakpilot-oscal"
|
||||
}
|
||||
|
||||
async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
|
||||
let mut out: Vec<Control> = Vec::new();
|
||||
for &framework in query.frameworks {
|
||||
match self.load(framework).await {
|
||||
Ok(doc) => out.extend(doc.to_controls()),
|
||||
Err(e) => {
|
||||
tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(rank_and_truncate(out, query.context, query.limit))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
|
||||
"version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
|
||||
"groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
|
||||
"props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
|
||||
|
||||
fn provider(dir: &std::path::Path) -> OscalControlsProvider {
|
||||
OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn builds_catalog_url_and_snapshot_path() {
|
||||
let p = provider(std::path::Path::new("/snap"));
|
||||
assert_eq!(
|
||||
p.catalog_url("cra"),
|
||||
"http://unused/api/compliance/v1/oscal/catalog?framework=cra"
|
||||
);
|
||||
assert_eq!(
|
||||
p.snapshot_path("cra"),
|
||||
std::path::Path::new("/snap/oscal-catalog-cra.json")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ranks_context_hits_first_then_truncates() {
|
||||
let mk = |id: &str, title: &str| Control {
|
||||
id: id.into(),
|
||||
framework: ComplianceFramework::Cra,
|
||||
title: title.into(),
|
||||
text: String::new(),
|
||||
source: None,
|
||||
};
|
||||
let controls = vec![
|
||||
mk("a", "logging policy"),
|
||||
mk("b", "multi-factor auth"),
|
||||
mk("c", "backup"),
|
||||
];
|
||||
let ranked = rank_and_truncate(controls, "auth", 2);
|
||||
assert_eq!(ranked.len(), 2);
|
||||
assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn snapshot_round_trip_and_offline_fallback() {
|
||||
let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
|
||||
let p = provider(&dir);
|
||||
assert!(p.read_snapshot("cra").await.unwrap().is_none());
|
||||
p.write_snapshot("cra", MINI_CATALOG.as_bytes())
|
||||
.await
|
||||
.unwrap();
|
||||
let doc = p.read_snapshot("cra").await.unwrap().unwrap();
|
||||
assert_eq!(doc.to_controls().len(), 1);
|
||||
assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
}
|
||||
@@ -1,300 +0,0 @@
|
||||
//! Scan-pipeline integration for control triage.
|
||||
//!
|
||||
//! After the deterministic tools have produced findings, this stamps each finding
|
||||
//! with the compliance control(s) it's evidence for and marks control-level false
|
||||
//! positives — using the ingested OSCAL catalog for control text, the
|
||||
//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
|
||||
//! confirm. Skipped entirely unless breakpilot is configured.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::path::Path;
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::finding::{Finding, FindingStatus, Severity};
|
||||
use compliance_core::models::onboarding::ComplianceFramework;
|
||||
use compliance_core::AgentConfig;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::surface;
|
||||
use super::{
|
||||
ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
|
||||
SemanticControlChecker, TriageOutcome,
|
||||
};
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Nearest master controls judged per code region in the semantic pass.
|
||||
const SEMANTIC_TOP_K: usize = 5;
|
||||
|
||||
/// Lines of context to read on each side of a finding's line.
|
||||
const REGION_WINDOW: usize = 6;
|
||||
|
||||
/// Triage every finding in `findings` against the CRA control map: stamp
|
||||
/// `control_refs` on confirmed findings and flag control false positives. Returns
|
||||
/// the number of findings tagged with at least one control.
|
||||
pub async fn triage_repo_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
findings: &mut [Finding],
|
||||
) -> usize {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let specs = build_specs(&provider).await;
|
||||
if specs.is_empty() {
|
||||
return 0;
|
||||
}
|
||||
let map = match ControlMap::cra() {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "control map failed to load; skipping control triage");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
|
||||
|
||||
let mut tagged = 0;
|
||||
for finding in findings.iter_mut() {
|
||||
let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
|
||||
continue;
|
||||
};
|
||||
let Some(region) = fetch_region(repo_path, &file, line) else {
|
||||
continue;
|
||||
};
|
||||
match triage.triage(finding, ®ion).await {
|
||||
TriageOutcome::Confirmed(controls) => {
|
||||
finding.control_refs = controls;
|
||||
tagged += 1;
|
||||
}
|
||||
TriageOutcome::FalsePositive => {
|
||||
finding.status = FindingStatus::FalsePositive;
|
||||
finding.triage_action = Some("control_false_positive".to_string());
|
||||
}
|
||||
TriageOutcome::Unmapped => {}
|
||||
}
|
||||
}
|
||||
tagged
|
||||
}
|
||||
|
||||
/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
|
||||
async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
|
||||
let mut specs = HashMap::new();
|
||||
match provider.load(ComplianceFramework::Cra).await {
|
||||
Ok(doc) => {
|
||||
for control in doc.to_controls() {
|
||||
specs.insert(
|
||||
control.id.clone(),
|
||||
ControlCheckSpec {
|
||||
control_id: control.id,
|
||||
title: control.title,
|
||||
requirement: control.text,
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
},
|
||||
);
|
||||
}
|
||||
}
|
||||
Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
|
||||
}
|
||||
specs
|
||||
}
|
||||
|
||||
/// Absence-based control pass (the grounded half of the hybrid coverage): for each
|
||||
/// control with a [`surface`] definition, deterministically retrieve the code
|
||||
/// surfaces it governs (login routes, logging setup, update/download code) and have
|
||||
/// the grounded judge decide whether the control holds there. Returns net-new
|
||||
/// findings, each already tagged with its control and grounded to a real snippet.
|
||||
///
|
||||
/// Gated: the orchestrator runs this only when `breakpilot.grounded_control_checks`
|
||||
/// is set. Absence detection is the least deterministic path (the judge decides
|
||||
/// presence/absence, not a syntactic pattern), so it stays off until tuned live.
|
||||
pub async fn grounded_surface_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return Vec::new();
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let specs = build_specs(&provider).await;
|
||||
if specs.is_empty() {
|
||||
return Vec::new();
|
||||
}
|
||||
let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
|
||||
|
||||
let mut out = Vec::new();
|
||||
for surf in surface::SURFACES {
|
||||
let Some(spec) = specs.get(surf.control_id) else {
|
||||
continue; // catalog doesn't carry this control
|
||||
};
|
||||
let regions = surface::retrieve(repo_path, surf.terms);
|
||||
if regions.is_empty() {
|
||||
continue;
|
||||
}
|
||||
out.extend(checker.check(spec, ®ions, repo_id).await);
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Read a window of lines around `line` (1-based) from `repo_path/file`.
|
||||
fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
|
||||
let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
|
||||
let lines: Vec<&str> = content.lines().collect();
|
||||
if lines.is_empty() {
|
||||
return None;
|
||||
}
|
||||
let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
|
||||
let start = center.saturating_sub(REGION_WINDOW);
|
||||
let end = (center + REGION_WINDOW + 1).min(lines.len());
|
||||
Some(CandidateRegion {
|
||||
file: file.to_string(),
|
||||
start_line: (start as u32) + 1,
|
||||
content: lines[start..end].join("\n"),
|
||||
})
|
||||
}
|
||||
|
||||
/// Master-controls **semantic** pass: for each finding's code region, retrieve the
|
||||
/// top-K nearest master controls by embedding, have the grounded judge confirm,
|
||||
/// and stamp the confirmed control ids onto the finding — the scale path for the
|
||||
/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
|
||||
/// of findings that gained a master-control ref.
|
||||
///
|
||||
/// Gated: the orchestrator runs this only when `breakpilot.semantic_mapping` is
|
||||
/// set (default off, flipped on once the master-controls catalog is live). The
|
||||
/// control embedding index is built once and cached to `snapshot_dir` keyed by
|
||||
/// corpus hash ([`ControlIndex::load_or_build`]), so only the first scan after a
|
||||
/// catalog change pays the embedding cost.
|
||||
pub async fn semantic_stamp_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
findings: &mut [Finding],
|
||||
) -> usize {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return 0;
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let doc = match provider.load_master_controls().await {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let specs: Vec<ControlCheckSpec> = doc
|
||||
.to_controls()
|
||||
.into_iter()
|
||||
.map(|c| ControlCheckSpec {
|
||||
control_id: c.id,
|
||||
title: c.title,
|
||||
requirement: c.text,
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
})
|
||||
.collect();
|
||||
let cache_path =
|
||||
Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
|
||||
let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
|
||||
Ok(i) if !i.is_empty() => i,
|
||||
Ok(_) => return 0,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "failed to embed master-controls corpus");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
|
||||
|
||||
let mut tagged = 0;
|
||||
for finding in findings.iter_mut() {
|
||||
if finding.status == FindingStatus::FalsePositive {
|
||||
continue;
|
||||
}
|
||||
let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
|
||||
continue;
|
||||
};
|
||||
let Some(region) = fetch_region(repo_path, &file, line) else {
|
||||
continue;
|
||||
};
|
||||
// Retrieve on the finding's intent + the code, not the region alone: two
|
||||
// findings in one file share overlapping windows and otherwise embed alike,
|
||||
// collapsing onto the same controls. The finding's title/description carry
|
||||
// the discriminating signal (e.g. "brute-force protection" vs "weak hash").
|
||||
// The raw `region` still goes to the judge for snippet grounding.
|
||||
let query = format!(
|
||||
"{}\n{}\n\n{}",
|
||||
finding.title, finding.description, region.content
|
||||
);
|
||||
let query_emb = match llm.embed(vec![query]).await {
|
||||
Ok(mut embs) => match embs.pop() {
|
||||
Some(v) => v,
|
||||
None => continue,
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "query embed failed; skipping finding");
|
||||
continue;
|
||||
}
|
||||
};
|
||||
let confirmed = checker
|
||||
.check(
|
||||
&index,
|
||||
®ion,
|
||||
&query_emb,
|
||||
SEMANTIC_TOP_K,
|
||||
&finding.repo_id,
|
||||
)
|
||||
.await;
|
||||
let before = finding.control_refs.len();
|
||||
for f in confirmed {
|
||||
for cref in f.control_refs {
|
||||
if !finding.control_refs.contains(&cref) {
|
||||
finding.control_refs.push(cref);
|
||||
}
|
||||
}
|
||||
}
|
||||
if finding.control_refs.len() > before {
|
||||
tagged += 1;
|
||||
}
|
||||
}
|
||||
tagged
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn fetch_region_windows_around_the_line() {
|
||||
let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
let file = "a.py";
|
||||
std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
|
||||
let r = fetch_region(&dir, file, 4).unwrap();
|
||||
assert!(r.content.contains("SECRET=1"));
|
||||
assert_eq!(r.start_line, 1); // window clamps to file start
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fetch_region_missing_file_is_none() {
|
||||
assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
|
||||
}
|
||||
}
|
||||
@@ -1,121 +0,0 @@
|
||||
//! Semantic control mapping: retrieve the top-K controls nearest a code region,
|
||||
//! then confirm each with the grounded judge.
|
||||
//!
|
||||
//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
|
||||
//! what scales to the full master-control corpus: the LLM only ever judges a
|
||||
//! handful of retrieved candidates, and every surviving verdict is still anchored
|
||||
//! to real code by the grounding gate.
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion};
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use super::index::ControlIndex;
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// Retrieve → judge → ground, generic over the judge so tests use a stub.
|
||||
pub struct SemanticControlChecker<J> {
|
||||
judge: J,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> SemanticControlChecker<J> {
|
||||
pub fn new(judge: J) -> Self {
|
||||
Self { judge }
|
||||
}
|
||||
|
||||
/// Map a code region to the controls it violates. `query_embedding` is the
|
||||
/// caller-supplied retrieval embedding — typically the finding's intent
|
||||
/// (title/description) plus the region, so retrieval keys on what the finding
|
||||
/// is *about*, not just the ambient code. The top-`k` nearest controls in
|
||||
/// `index` are then judged against the raw `region` and grounded.
|
||||
pub async fn check(
|
||||
&self,
|
||||
index: &ControlIndex,
|
||||
region: &CandidateRegion,
|
||||
query_embedding: &[f64],
|
||||
k: usize,
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let candidates = index.nearest(query_embedding, k);
|
||||
let mut findings = Vec::new();
|
||||
for spec in &candidates {
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
if let Some(finding) = ground(spec, region, &verdict, repo_id) {
|
||||
findings.push(finding);
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec(id: &str) -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: id.into(),
|
||||
title: id.into(),
|
||||
requirement: id.into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn retrieves_then_grounds_the_nearest_control() {
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("mc-near"), vec![1.0, 0.0]),
|
||||
(spec("mc-far"), vec![0.0, 1.0]),
|
||||
]);
|
||||
let checker = SemanticControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let region = CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: "PASSWORD = \"admin\"\n".into(),
|
||||
};
|
||||
// Query embedding nearest to mc-near; k=1 → only mc-near is judged.
|
||||
let findings = checker
|
||||
.check(&index, ®ion, &[0.95, 0.05], 1, "repo")
|
||||
.await;
|
||||
assert_eq!(findings.len(), 1);
|
||||
assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn ungrounded_verdict_is_dropped() {
|
||||
let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
|
||||
let checker = SemanticControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "not in the region".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let region = CandidateRegion {
|
||||
file: "f".into(),
|
||||
start_line: 1,
|
||||
content: "real code\n".into(),
|
||||
};
|
||||
let findings = checker.check(&index, ®ion, &[1.0, 0.0], 1, "repo").await;
|
||||
assert!(findings.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -1,258 +0,0 @@
|
||||
//! Surface retrieval for absence-based controls.
|
||||
//!
|
||||
//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
|
||||
//! security logging, no signature check on an update — so there's no offending
|
||||
//! pattern for semgrep to match. Instead we deterministically locate the code
|
||||
//! *surface* the control governs (a login route, a logging setup, update/download
|
||||
//! code) by identifier/route terms, then hand each surface region to the grounded
|
||||
//! judge, which decides whether the control is satisfied there. The resulting
|
||||
//! finding grounds to the surface snippet, so nothing fabricated survives.
|
||||
//!
|
||||
//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
|
||||
//! capped per control to keep the downstream LLM cost predictable.
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
use compliance_core::control_check::CandidateRegion;
|
||||
|
||||
/// An absence-based control and the case-insensitive terms that mark the code
|
||||
/// surface it governs.
|
||||
pub struct Surface {
|
||||
pub control_id: &'static str,
|
||||
pub terms: &'static [&'static str],
|
||||
}
|
||||
|
||||
/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
|
||||
/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
|
||||
pub const SURFACES: &[Surface] = &[
|
||||
Surface {
|
||||
control_id: "cra-ai-6", // Integritaetspruefung
|
||||
terms: &[
|
||||
"checksum",
|
||||
"sha256",
|
||||
"signature",
|
||||
"hmac",
|
||||
"integrity",
|
||||
"verify",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-11", // Brute-Force-Schutz
|
||||
terms: &[
|
||||
"login",
|
||||
"signin",
|
||||
"authenticate",
|
||||
"/auth",
|
||||
"password",
|
||||
"ratelimit",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
|
||||
terms: &[
|
||||
"authorize",
|
||||
"permission",
|
||||
"role",
|
||||
"rbac",
|
||||
"require_role",
|
||||
"has_role",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-24", // Security-Logging
|
||||
terms: &["login", "authorize", "permission", "role", "admin", "audit"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
|
||||
terms: &["logging", "logger", "getlogger", "audit_log"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-28", // Sichere Update-Mechanismen
|
||||
terms: &["update", "upgrade", "download", "firmware"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-29", // Update-Authentizitaet
|
||||
terms: &["update", "signature", "verify", "pubkey", "certificate"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-30", // Update-Integritaet
|
||||
terms: &["update", "checksum", "digest", "integrity", "verify"],
|
||||
},
|
||||
];
|
||||
|
||||
/// Source file extensions worth reading (skip binaries/assets/lockfiles).
|
||||
const CODE_EXTS: &[&str] = &[
|
||||
"py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
|
||||
];
|
||||
/// Directories never worth walking.
|
||||
const SKIP_DIRS: &[&str] = &[
|
||||
".git",
|
||||
"node_modules",
|
||||
"target",
|
||||
"vendor",
|
||||
".venv",
|
||||
"__pycache__",
|
||||
"dist",
|
||||
"build",
|
||||
];
|
||||
/// Lines of context on each side of a hit.
|
||||
const WINDOW: usize = 6;
|
||||
/// Cap on regions per control, to bound downstream LLM calls.
|
||||
const MAX_REGIONS_PER_CONTROL: usize = 8;
|
||||
/// Skip files larger than this (generated/minified).
|
||||
const MAX_FILE_BYTES: u64 = 512 * 1024;
|
||||
|
||||
/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
|
||||
/// `repo_path` whose lines mention any of `terms`. Hits close together within a
|
||||
/// file are merged into one region; results are capped to bound LLM cost.
|
||||
pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
|
||||
let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
|
||||
let mut regions = Vec::new();
|
||||
for entry in walk(repo_path) {
|
||||
if regions.len() >= MAX_REGIONS_PER_CONTROL {
|
||||
break;
|
||||
}
|
||||
let path = entry.path();
|
||||
if !has_code_ext(path) {
|
||||
continue;
|
||||
}
|
||||
let Ok(meta) = entry.metadata() else { continue };
|
||||
if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
|
||||
continue;
|
||||
}
|
||||
let Ok(content) = std::fs::read_to_string(path) else {
|
||||
continue;
|
||||
};
|
||||
let rel = path
|
||||
.strip_prefix(repo_path)
|
||||
.unwrap_or(path)
|
||||
.to_string_lossy()
|
||||
.to_string();
|
||||
let lines: Vec<&str> = content.lines().collect();
|
||||
let hits: Vec<usize> = lines
|
||||
.iter()
|
||||
.enumerate()
|
||||
.filter(|(_, line)| {
|
||||
let ll = line.to_lowercase();
|
||||
lowered.iter().any(|t| ll.contains(t.as_str()))
|
||||
})
|
||||
.map(|(i, _)| i)
|
||||
.collect();
|
||||
for center in merge_centers(&hits) {
|
||||
if regions.len() >= MAX_REGIONS_PER_CONTROL {
|
||||
break;
|
||||
}
|
||||
let start = center.saturating_sub(WINDOW);
|
||||
let end = (center + WINDOW + 1).min(lines.len());
|
||||
regions.push(CandidateRegion {
|
||||
file: rel.clone(),
|
||||
start_line: (start as u32) + 1,
|
||||
content: lines[start..end].join("\n"),
|
||||
});
|
||||
}
|
||||
}
|
||||
regions
|
||||
}
|
||||
|
||||
/// Collapse ascending hit indices that fall within one window into a single
|
||||
/// representative center, so overlapping regions aren't judged repeatedly.
|
||||
fn merge_centers(hits: &[usize]) -> Vec<usize> {
|
||||
let mut out: Vec<usize> = Vec::new();
|
||||
for &h in hits {
|
||||
match out.last() {
|
||||
Some(&last) if h.saturating_sub(last) <= WINDOW => {}
|
||||
_ => out.push(h),
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn has_code_ext(path: &Path) -> bool {
|
||||
path.extension()
|
||||
.and_then(|e| e.to_str())
|
||||
.is_some_and(|e| CODE_EXTS.contains(&e))
|
||||
}
|
||||
|
||||
fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
|
||||
walkdir::WalkDir::new(root)
|
||||
.into_iter()
|
||||
.filter_entry(|e| {
|
||||
let name = e.file_name().to_string_lossy();
|
||||
!SKIP_DIRS.contains(&name.as_ref())
|
||||
})
|
||||
.filter_map(|e| e.ok())
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn write(dir: &Path, rel: &str, body: &str) {
|
||||
let p = dir.join(rel);
|
||||
if let Some(parent) = p.parent() {
|
||||
std::fs::create_dir_all(parent).unwrap();
|
||||
}
|
||||
std::fs::write(p, body).unwrap();
|
||||
}
|
||||
|
||||
fn terms_for(control_id: &str) -> &'static [&'static str] {
|
||||
SURFACES
|
||||
.iter()
|
||||
.find(|s| s.control_id == control_id)
|
||||
.unwrap()
|
||||
.terms
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn surfaces_cover_the_absence_based_controls() {
|
||||
assert_eq!(SURFACES.len(), 8);
|
||||
for id in [
|
||||
"cra-ai-6",
|
||||
"cra-ai-11",
|
||||
"cra-ai-12",
|
||||
"cra-ai-24",
|
||||
"cra-ai-27",
|
||||
"cra-ai-28",
|
||||
"cra-ai-29",
|
||||
"cra-ai-30",
|
||||
] {
|
||||
assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn retrieves_matching_region_with_context() {
|
||||
let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
write(
|
||||
&dir,
|
||||
"app/auth.py",
|
||||
"import x\n\n\n\n\n\n\ndef login(u, p):\n return check(u, p)\n",
|
||||
);
|
||||
let regions = retrieve(&dir, terms_for("cra-ai-11"));
|
||||
assert_eq!(regions.len(), 1);
|
||||
assert!(regions[0].content.contains("def login"));
|
||||
assert_eq!(regions[0].file, "app/auth.py");
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn skips_non_code_and_vendored() {
|
||||
let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
write(&dir, "README.md", "login and password and audit\n"); // not code ext
|
||||
write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
|
||||
assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn merges_adjacent_hits_into_one_region() {
|
||||
// Two hits one line apart collapse to a single center/region.
|
||||
assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
|
||||
assert_eq!(merge_centers(&[]), Vec::<usize>::new());
|
||||
assert_eq!(merge_centers(&[5]), vec![5]);
|
||||
}
|
||||
}
|
||||
@@ -1,234 +0,0 @@
|
||||
//! Triage step: confirm/refute a deterministic tool finding against the controls
|
||||
//! it maps to (via the `control-map` LUT), grounding the judgment.
|
||||
//!
|
||||
//! This is where the LLM finally enters — as a **false-positive filter over tool
|
||||
//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
|
||||
//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
|
||||
//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
|
||||
//! judge then confirms or refutes each, and only judgments anchored to real code
|
||||
//! survive.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// What triage decided for one tool finding.
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum TriageOutcome {
|
||||
/// The finding maps to no control in the LUT — keep it, untagged.
|
||||
Unmapped,
|
||||
/// Maps to controls and the grounded judge confirmed at least one — keep the
|
||||
/// finding and tag it with these control ids.
|
||||
Confirmed(Vec<String>),
|
||||
/// Maps to controls but the judge grounded none — treat as a false positive.
|
||||
FalsePositive,
|
||||
}
|
||||
|
||||
/// Triages tool findings against the control map, confirming with a grounded judge.
|
||||
pub struct ControlTriage<J> {
|
||||
judge: J,
|
||||
map: ControlMap,
|
||||
/// Control requirement specs (by control id), built from the ingested catalog.
|
||||
specs: HashMap<String, ControlCheckSpec>,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> ControlTriage<J> {
|
||||
pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
|
||||
Self { judge, map, specs }
|
||||
}
|
||||
|
||||
/// Triage one tool finding. `region` is the code around the finding, used as
|
||||
/// the grounding evidence for the judge.
|
||||
pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
|
||||
// Match by CWE (off-the-shelf findings) and/or rule id (our custom
|
||||
// detectors, which carry no LUT-bound CWE). A finding with neither is
|
||||
// simply unmapped.
|
||||
let mapped = self.map.controls_for_finding(
|
||||
&finding.scanner,
|
||||
finding.cwe.as_deref(),
|
||||
finding.rule_id.as_deref(),
|
||||
);
|
||||
if mapped.is_empty() {
|
||||
return TriageOutcome::Unmapped;
|
||||
}
|
||||
|
||||
let mut confirmed = Vec::new();
|
||||
for entry in mapped {
|
||||
let Some(spec) = self.specs.get(&entry.control) else {
|
||||
continue;
|
||||
};
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
// The verdict only counts if it grounds to real code in the region.
|
||||
if ground(spec, region, &verdict, &finding.repo_id).is_some() {
|
||||
confirmed.push(entry.control.clone());
|
||||
}
|
||||
}
|
||||
|
||||
if confirmed.is_empty() {
|
||||
TriageOutcome::FalsePositive
|
||||
} else {
|
||||
TriageOutcome::Confirmed(confirmed)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
use compliance_core::models::scan::ScanType;
|
||||
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn specs() -> HashMap<String, ControlCheckSpec> {
|
||||
let mut m = HashMap::new();
|
||||
m.insert(
|
||||
"cra-ai-8".to_string(),
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
},
|
||||
);
|
||||
m
|
||||
}
|
||||
|
||||
fn semgrep_finding(cwe: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
"fp1".into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = Some(cwe.into());
|
||||
f
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: "PASSWORD = \"admin123\"\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn confirmed_finding_is_tagged_with_control() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn refuted_mapped_finding_is_false_positive() {
|
||||
// Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.1,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::FalsePositive);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn custom_rule_finding_without_cwe_is_confirmed() {
|
||||
// A custom detector finding carries a rule id but no LUT-bound CWE; it must
|
||||
// still map (by rule id) and confirm.
|
||||
let mut specs = specs();
|
||||
specs.insert(
|
||||
"cra-ai-1".to_string(),
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-1".into(),
|
||||
title: "Secure-by-Default".into(),
|
||||
requirement: "Ship secure defaults".into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
},
|
||||
);
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "app.run(debug=True)".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs,
|
||||
);
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
"fp".into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"flask debug".into(),
|
||||
"desc".into(),
|
||||
Severity::Medium,
|
||||
);
|
||||
f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
|
||||
let region = CandidateRegion {
|
||||
file: "app.py".into(),
|
||||
start_line: 1,
|
||||
content: "app.run(debug=True)\n".into(),
|
||||
};
|
||||
let out = triage.triage(&f, ®ion).await;
|
||||
assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unmapped_cwe_is_left_untagged() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage
|
||||
.triage(&semgrep_finding("CWE-99999"), ®ion())
|
||||
.await;
|
||||
assert_eq!(out, TriageOutcome::Unmapped);
|
||||
}
|
||||
}
|
||||
@@ -465,34 +465,6 @@ impl Database {
|
||||
)
|
||||
.await?;
|
||||
|
||||
// werkbank_jobs: unique job id (idempotent enqueue by job id)
|
||||
self.werkbank_jobs()
|
||||
.create_index(
|
||||
IndexModel::builder()
|
||||
.keys(doc! { "job.id": 1 })
|
||||
.options(IndexOptions::builder().unique(true).build())
|
||||
.build(),
|
||||
)
|
||||
.await?;
|
||||
|
||||
// werkbank_jobs: lease query — oldest queued job for an executor
|
||||
self.werkbank_jobs()
|
||||
.create_index(
|
||||
IndexModel::builder()
|
||||
.keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
|
||||
.build(),
|
||||
)
|
||||
.await?;
|
||||
|
||||
// werkbank_jobs: visibility-timeout sweep of expired leases
|
||||
self.werkbank_jobs()
|
||||
.create_index(
|
||||
IndexModel::builder()
|
||||
.keys(doc! { "status": 1, "lease_expires_at": 1 })
|
||||
.build(),
|
||||
)
|
||||
.await?;
|
||||
|
||||
tracing::info!("Database indexes ensured");
|
||||
Ok(())
|
||||
}
|
||||
@@ -591,12 +563,6 @@ impl Database {
|
||||
self.inner.collection("pentest_messages")
|
||||
}
|
||||
|
||||
/// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
|
||||
/// control plane enqueues and runners lease.
|
||||
pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
|
||||
self.inner.collection("werkbank_jobs")
|
||||
}
|
||||
|
||||
#[allow(dead_code)]
|
||||
pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
|
||||
self.inner.collection(name)
|
||||
|
||||
@@ -27,9 +27,6 @@ pub enum AgentError {
|
||||
#[error("Configuration error: {0}")]
|
||||
Config(String),
|
||||
|
||||
#[error("Dynamic-execution error: {0}")]
|
||||
Exec(#[from] werkbank_exec::ExecError),
|
||||
|
||||
#[error("{0}")]
|
||||
Other(String),
|
||||
}
|
||||
|
||||
@@ -32,30 +32,6 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
|
||||
Ok((hex::encode(hasher.finalize()), total))
|
||||
}
|
||||
|
||||
/// Store raw bytes in the content-addressed blob store under `base`, returning
|
||||
/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
|
||||
/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
|
||||
pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
|
||||
let sha = hex::encode(Sha256::digest(bytes));
|
||||
let dir = base.join("blobs").join(&sha[0..2]);
|
||||
fs::create_dir_all(&dir)?;
|
||||
let dest = dir.join(&sha);
|
||||
if !dest.exists() {
|
||||
fs::write(&dest, bytes)?;
|
||||
}
|
||||
Ok(sha)
|
||||
}
|
||||
|
||||
/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
|
||||
/// so a request can't traverse outside the blob store.
|
||||
pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
|
||||
if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
|
||||
return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
|
||||
}
|
||||
let path = base.join("blobs").join(&sha[0..2]).join(sha);
|
||||
Ok(fs::read(path)?)
|
||||
}
|
||||
|
||||
/// Copy `src` into the content-addressed blob store under `base`, returning the
|
||||
/// stored path. Idempotent: an already-present blob is not rewritten.
|
||||
pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
//! is also the reconciliation key against sibling products (a firmware sha256
|
||||
//! matches tramiton's `Artifact.sha256`).
|
||||
|
||||
pub(crate) mod blob;
|
||||
mod blob;
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::path::{Path, PathBuf};
|
||||
@@ -162,27 +162,14 @@ fn ingest_blob(
|
||||
match blob::extract_zip(&stored, &dest) {
|
||||
Ok(()) => dest,
|
||||
Err(e) => {
|
||||
// Not a zip container — this is a single uploaded file (e.g. a
|
||||
// `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
|
||||
// blob has no extension, so materialize it into a working dir
|
||||
// under its original name; extension-based scanners (PLC) can then
|
||||
// discover it and report a readable path.
|
||||
// Not a zip (e.g. a tar.gz source archive) — keep the blob and
|
||||
// note it so later stages can decide what to do.
|
||||
facts.push(DetectedFact::new(
|
||||
"archive_unextracted",
|
||||
e.to_string(),
|
||||
"ingest",
|
||||
));
|
||||
match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
|
||||
Ok(dir) => dir,
|
||||
Err(copy_err) => {
|
||||
facts.push(DetectedFact::new(
|
||||
"materialize_failed",
|
||||
copy_err.to_string(),
|
||||
"ingest",
|
||||
));
|
||||
stored.clone()
|
||||
}
|
||||
}
|
||||
stored.clone()
|
||||
}
|
||||
}
|
||||
} else {
|
||||
@@ -199,27 +186,6 @@ fn ingest_blob(
|
||||
})
|
||||
}
|
||||
|
||||
/// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
|
||||
/// "extractable" artifact turns out to be a single file rather than an archive.
|
||||
fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
|
||||
std::fs::create_dir_all(dest)?;
|
||||
std::fs::copy(stored, dest.join(name))?;
|
||||
Ok(dest.to_path_buf())
|
||||
}
|
||||
|
||||
/// A safe, single-segment file name for an artifact, preserving the original
|
||||
/// extension so scanners can identify it. Derives from `source_ref` (the
|
||||
/// uploaded/original file name); `file_name` strips any directory components,
|
||||
/// so this is traversal-safe. Falls back to the artifact id.
|
||||
fn blob_file_name(artifact: &Artifact) -> String {
|
||||
Path::new(&artifact.source_ref)
|
||||
.file_name()
|
||||
.and_then(|n| n.to_str())
|
||||
.map(str::to_string)
|
||||
.filter(|s| !s.is_empty())
|
||||
.unwrap_or_else(|| format!("artifact-{}", artifact.id))
|
||||
}
|
||||
|
||||
/// An artifact with no on-disk form: record a single fact, no hash/path.
|
||||
fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
|
||||
IngestedArtifact {
|
||||
@@ -365,52 +331,4 @@ mod tests {
|
||||
assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
|
||||
assert!(creds.auth_token.is_none());
|
||||
}
|
||||
|
||||
/// A single uploaded PLC file (not an archive) must land in a working dir
|
||||
/// under its original name so the PLC scanner can discover it by extension
|
||||
/// and report a readable path — the demo's upload → scan path.
|
||||
#[test]
|
||||
fn single_uploaded_plc_file_is_materialized_and_scannable() {
|
||||
use compliance_core::models::PlcFormat;
|
||||
|
||||
let scratch = Scratch::new();
|
||||
let store = scratch.0.join("store");
|
||||
// Simulate the upload handler: bytes written to an `uploads/` path,
|
||||
// `source_ref` carrying the original (clean) file name.
|
||||
let uploads = scratch.0.join("uploads");
|
||||
std::fs::create_dir_all(&uploads).expect("mkdir uploads");
|
||||
let uploaded = uploads.join("a1b2c3_pump_station.st");
|
||||
std::fs::write(
|
||||
&uploaded,
|
||||
"PROGRAM P\nVAR\n ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
|
||||
)
|
||||
.expect("write st");
|
||||
|
||||
let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
|
||||
artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
|
||||
|
||||
let ctx = ctx_for(&store, "t-plc");
|
||||
let out = ingest_artifact(&artifact, &ctx).expect("ingest");
|
||||
|
||||
// Working path is a directory (not the extensionless blob) holding the
|
||||
// file under its original name.
|
||||
let wp = out.working_path.expect("working path");
|
||||
assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
|
||||
assert!(wp.join("pump_station.st").is_file());
|
||||
|
||||
// The PLC scanner finds the hardcoded credential and reports a clean path.
|
||||
let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
|
||||
assert!(
|
||||
!findings.is_empty(),
|
||||
"scanner should flag the uploaded file"
|
||||
);
|
||||
assert!(findings
|
||||
.iter()
|
||||
.any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
|
||||
assert_eq!(
|
||||
findings[0].file_path.as_deref(),
|
||||
Some("pump_station.st"),
|
||||
"finding should reference the original file name"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,7 +4,6 @@ pub mod agent;
|
||||
pub mod api;
|
||||
pub mod classify;
|
||||
pub mod config;
|
||||
pub mod controls;
|
||||
pub mod database;
|
||||
pub mod error;
|
||||
pub mod ingest;
|
||||
@@ -17,4 +16,3 @@ pub mod ssh;
|
||||
#[allow(dead_code)]
|
||||
pub mod trackers;
|
||||
pub mod webhooks;
|
||||
pub mod werkbank;
|
||||
|
||||
@@ -22,11 +22,6 @@ struct EmbeddingData {
|
||||
index: usize,
|
||||
}
|
||||
|
||||
/// Max inputs per embedding request. The bge/OpenAI-like backends cap the input
|
||||
/// array (bge-multilingual-gemma2 rejects >25 with "batch size overflow"), so we
|
||||
/// chunk larger corpora — a whole control catalog (~1.8k) would otherwise 500.
|
||||
const EMBED_BATCH_SIZE: usize = 16;
|
||||
|
||||
// ── Embedding implementation ───────────────────────────────────
|
||||
|
||||
impl LlmClient {
|
||||
@@ -34,21 +29,8 @@ impl LlmClient {
|
||||
&self.embed_model
|
||||
}
|
||||
|
||||
/// Generate embeddings for a batch of texts, chunking into backend-sized
|
||||
/// requests and preserving input order across chunks.
|
||||
/// Generate embeddings for a batch of texts
|
||||
pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
|
||||
if texts.is_empty() {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
let mut out = Vec::with_capacity(texts.len());
|
||||
for chunk in texts.chunks(EMBED_BATCH_SIZE) {
|
||||
out.extend(self.embed_batch(chunk.to_vec()).await?);
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
/// Embed one backend-sized batch (≤ [`EMBED_BATCH_SIZE`]) in a single request.
|
||||
async fn embed_batch(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
|
||||
let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
|
||||
|
||||
let request_body = EmbeddingRequest {
|
||||
@@ -90,33 +72,3 @@ impl LlmClient {
|
||||
Ok(data.into_iter().map(|d| d.embedding).collect())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn client() -> LlmClient {
|
||||
LlmClient::new(
|
||||
"http://unused".into(),
|
||||
SecretString::from(String::new()),
|
||||
"m".into(),
|
||||
"e".into(),
|
||||
)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn empty_input_makes_no_request() {
|
||||
// Must short-circuit before any HTTP call (base_url is unroutable).
|
||||
let out = client().embed(Vec::new()).await.unwrap();
|
||||
assert!(out.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn batch_size_is_within_backend_cap() {
|
||||
assert!(
|
||||
EMBED_BATCH_SIZE <= 25,
|
||||
"must stay under the bge 25-input cap"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -342,9 +342,6 @@ mod tests {
|
||||
pentest_imap_password: None,
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: None,
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -204,202 +204,6 @@ impl CveScanner {
|
||||
|
||||
Ok(results)
|
||||
}
|
||||
|
||||
/// Match the CODESYS **runtime** component against NVD by CPE.
|
||||
///
|
||||
/// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
|
||||
/// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
|
||||
/// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
|
||||
/// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
|
||||
/// and keep the ones whose affected-version range covers our runtime version.
|
||||
/// Best-effort: returns empty without an NVD key, on a network error, or when
|
||||
/// no CODESYS runtime component is present.
|
||||
pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
|
||||
let Some((name, version)) = codesys_runtime(entries) else {
|
||||
return Vec::new();
|
||||
};
|
||||
let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
|
||||
?virtualMatchString=cpe:2.3:a:codesys";
|
||||
let mut req = self.http.get(url);
|
||||
if let Some(key) = &self.nvd_api_key {
|
||||
req = req.header("apiKey", key.as_str());
|
||||
}
|
||||
let body: serde_json::Value = match req.send().await {
|
||||
Ok(r) if r.status().is_success() => match r.json().await {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!("CODESYS NVD parse failed: {e}");
|
||||
return Vec::new();
|
||||
}
|
||||
},
|
||||
Ok(r) => {
|
||||
tracing::warn!("CODESYS NVD returned {}", r.status());
|
||||
return Vec::new();
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!("CODESYS NVD request failed: {e}");
|
||||
return Vec::new();
|
||||
}
|
||||
};
|
||||
|
||||
let matched = parse_codesys_nvd(&body, &version);
|
||||
let mut alerts = Vec::new();
|
||||
for cve in matched {
|
||||
if let Some(e) = entries
|
||||
.iter_mut()
|
||||
.find(|e| e.name == name && e.version == version)
|
||||
{
|
||||
e.known_vulnerabilities.push(VulnRef {
|
||||
id: cve.id.clone(),
|
||||
source: "nvd".to_string(),
|
||||
severity: None,
|
||||
url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
|
||||
});
|
||||
}
|
||||
let mut alert = CveAlert::new(
|
||||
cve.id,
|
||||
repo_id.to_string(),
|
||||
name.clone(),
|
||||
version.clone(),
|
||||
CveSource::Nvd,
|
||||
);
|
||||
alert.summary = cve.summary;
|
||||
alert.cvss_score = cve.cvss;
|
||||
alerts.push(alert);
|
||||
}
|
||||
tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
|
||||
alerts
|
||||
}
|
||||
}
|
||||
|
||||
/// The CODESYS runtime component (name + version) from an SBOM, if present. The
|
||||
/// runtime carries the version CODESYS advisories key off; the internal library
|
||||
/// components do not.
|
||||
fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
|
||||
entries
|
||||
.iter()
|
||||
.find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
|
||||
.map(|e| (e.name.clone(), e.version.clone()))
|
||||
}
|
||||
|
||||
/// A parsed NVD CVE that affects the CODESYS runtime.
|
||||
struct CodesysCve {
|
||||
id: String,
|
||||
summary: Option<String>,
|
||||
cvss: Option<f64>,
|
||||
}
|
||||
|
||||
/// Version constraints from an NVD `cpeMatch` node.
|
||||
#[derive(Default)]
|
||||
struct CpeRange {
|
||||
exact: Option<String>,
|
||||
start_incl: Option<String>,
|
||||
start_excl: Option<String>,
|
||||
end_incl: Option<String>,
|
||||
end_excl: Option<String>,
|
||||
}
|
||||
|
||||
/// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
|
||||
/// `runtime_version`.
|
||||
fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
|
||||
let mut out = Vec::new();
|
||||
let Some(vulns) = body["vulnerabilities"].as_array() else {
|
||||
return out;
|
||||
};
|
||||
for v in vulns {
|
||||
let cve = &v["cve"];
|
||||
let Some(id) = cve["id"].as_str() else {
|
||||
continue;
|
||||
};
|
||||
let covered = cve["configurations"]
|
||||
.as_array()
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.flat_map(|c| c["nodes"].as_array().into_iter().flatten())
|
||||
.flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
|
||||
.any(|cm| {
|
||||
cm["vulnerable"].as_bool() == Some(true)
|
||||
&& cm["criteria"]
|
||||
.as_str()
|
||||
.is_some_and(|c| c.contains(":codesys:"))
|
||||
&& version_matches(runtime_version, &cpe_range(cm))
|
||||
});
|
||||
if covered {
|
||||
let summary = cve["descriptions"]
|
||||
.as_array()
|
||||
.and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
|
||||
.and_then(|x| x["value"].as_str())
|
||||
.map(String::from);
|
||||
let cvss = cve["metrics"]["cvssMetricV31"]
|
||||
.as_array()
|
||||
.and_then(|m| m.first())
|
||||
.and_then(|m| m["cvssData"]["baseScore"].as_f64());
|
||||
out.push(CodesysCve {
|
||||
id: id.to_string(),
|
||||
summary,
|
||||
cvss,
|
||||
});
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Build a [`CpeRange`] from an NVD `cpeMatch` object.
|
||||
fn cpe_range(cm: &serde_json::Value) -> CpeRange {
|
||||
let exact = cm["criteria"]
|
||||
.as_str()
|
||||
.and_then(cpe_version)
|
||||
.filter(|v| v != "*" && v != "-" && !v.is_empty());
|
||||
CpeRange {
|
||||
exact,
|
||||
start_incl: cm["versionStartIncluding"].as_str().map(String::from),
|
||||
start_excl: cm["versionStartExcluding"].as_str().map(String::from),
|
||||
end_incl: cm["versionEndIncluding"].as_str().map(String::from),
|
||||
end_excl: cm["versionEndExcluding"].as_str().map(String::from),
|
||||
}
|
||||
}
|
||||
|
||||
/// The version field (6th component) of a CPE 2.3 string.
|
||||
fn cpe_version(criteria: &str) -> Option<String> {
|
||||
criteria.split(':').nth(5).map(String::from)
|
||||
}
|
||||
|
||||
/// Whether `v` satisfies a CPE version range.
|
||||
fn version_matches(v: &str, r: &CpeRange) -> bool {
|
||||
use std::cmp::Ordering::{Equal, Greater, Less};
|
||||
if let Some(exact) = &r.exact {
|
||||
return cmp_dotted(v, exact) == Equal;
|
||||
}
|
||||
let mut ok = true;
|
||||
if let Some(s) = &r.start_incl {
|
||||
ok &= cmp_dotted(v, s) != Less;
|
||||
}
|
||||
if let Some(s) = &r.start_excl {
|
||||
ok &= cmp_dotted(v, s) == Greater;
|
||||
}
|
||||
if let Some(e) = &r.end_incl {
|
||||
ok &= cmp_dotted(v, e) != Greater;
|
||||
}
|
||||
if let Some(e) = &r.end_excl {
|
||||
ok &= cmp_dotted(v, e) == Less;
|
||||
}
|
||||
ok
|
||||
}
|
||||
|
||||
/// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
|
||||
/// components count as 0, non-numeric components as 0.
|
||||
fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
|
||||
let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
|
||||
let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
|
||||
for i in 0..pa.len().max(pb.len()) {
|
||||
let x = pa.get(i).copied().unwrap_or(0);
|
||||
let y = pb.get(i).copied().unwrap_or(0);
|
||||
match x.cmp(&y) {
|
||||
std::cmp::Ordering::Equal => continue,
|
||||
other => return other,
|
||||
}
|
||||
}
|
||||
std::cmp::Ordering::Equal
|
||||
}
|
||||
|
||||
#[derive(serde::Deserialize)]
|
||||
@@ -424,90 +228,3 @@ struct OsvVuln {
|
||||
summary: Option<String>,
|
||||
severity: Option<String>,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::cmp::Ordering::{Equal, Greater, Less};
|
||||
|
||||
fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
|
||||
SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn finds_the_codesys_runtime_component() {
|
||||
let entries = vec![
|
||||
entry("Standard", "3.5.18.0", "codesys"),
|
||||
entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
|
||||
];
|
||||
assert_eq!(
|
||||
codesys_runtime(&entries),
|
||||
Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
|
||||
);
|
||||
// Internal library components are not the runtime.
|
||||
assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dotted_version_comparison() {
|
||||
assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
|
||||
assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
|
||||
assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
|
||||
assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn version_range_matching() {
|
||||
let end_excl = CpeRange {
|
||||
end_excl: Some("4.9.0.0".into()),
|
||||
..Default::default()
|
||||
};
|
||||
assert!(!version_matches("4.17.0.0", &end_excl)); // patched
|
||||
assert!(version_matches("4.5.0.0", &end_excl)); // affected
|
||||
|
||||
let exact = CpeRange {
|
||||
exact: Some("3.5.16.0".into()),
|
||||
..Default::default()
|
||||
};
|
||||
assert!(version_matches("3.5.16.0", &exact));
|
||||
assert!(!version_matches("3.5.17.0", &exact));
|
||||
|
||||
let span = CpeRange {
|
||||
start_incl: Some("3.0.0.0".into()),
|
||||
end_incl: Some("3.5.16.0".into()),
|
||||
..Default::default()
|
||||
};
|
||||
assert!(version_matches("3.5.16.0", &span));
|
||||
assert!(!version_matches("3.5.17.0", &span));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_nvd_and_matches_by_runtime_version() {
|
||||
// Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
|
||||
// <= 4.20 (our 4.17 is affected). Only the latter should match.
|
||||
let body = serde_json::json!({
|
||||
"vulnerabilities": [
|
||||
{"cve": {"id":"CVE-2023-0001",
|
||||
"descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
|
||||
"metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
|
||||
"configurations":[{"nodes":[{"cpeMatch":[
|
||||
{"vulnerable":true,
|
||||
"criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
|
||||
"versionEndExcluding":"4.9.0.0"}
|
||||
]}]}]}},
|
||||
{"cve": {"id":"CVE-2024-0002",
|
||||
"descriptions":[{"lang":"en","value":"recent runtime bug"}],
|
||||
"metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
|
||||
"configurations":[{"nodes":[{"cpeMatch":[
|
||||
{"vulnerable":true,
|
||||
"criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
|
||||
"versionEndIncluding":"4.20.0.0"}
|
||||
]}]}]}}
|
||||
]
|
||||
});
|
||||
let matched = parse_codesys_nvd(&body, "4.17.0.0");
|
||||
let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
|
||||
assert_eq!(ids, vec!["CVE-2024-0002"]);
|
||||
assert_eq!(matched[0].cvss, Some(9.8));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -10,7 +10,6 @@ pub mod lint;
|
||||
pub mod orchestrator;
|
||||
pub mod patterns;
|
||||
pub mod plan;
|
||||
pub mod plc;
|
||||
mod pr_review;
|
||||
pub mod repo_view;
|
||||
pub mod sbom;
|
||||
|
||||
@@ -215,68 +215,6 @@ impl PipelineOrchestrator {
|
||||
.await;
|
||||
tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
|
||||
|
||||
// Stage 5b: control triage — stamp findings with the compliance control(s)
|
||||
// they're evidence for and flag control false positives (grounded LLM over
|
||||
// deterministic tool output). No-op unless breakpilot is configured.
|
||||
self.update_phase(scan_run_id, "control_triage").await;
|
||||
let tagged = crate::controls::triage_repo_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&mut all_findings,
|
||||
)
|
||||
.await;
|
||||
if tagged > 0 {
|
||||
tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
|
||||
}
|
||||
|
||||
// Stage 5c: semantic control mapping — scale path for the master-controls
|
||||
// corpus (no CWE to LUT on): embed each finding's region, retrieve the
|
||||
// nearest master controls, grounded-judge, and stamp confirmed refs. Gated
|
||||
// (default off) as the corpus embedding + per-finding judging is the heavy
|
||||
// path; enabled once verified live against a deployed master-controls catalog.
|
||||
if self.config.breakpilot.semantic_mapping {
|
||||
self.update_phase(scan_run_id, "semantic_control_mapping")
|
||||
.await;
|
||||
let sem = crate::controls::semantic_stamp_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&mut all_findings,
|
||||
)
|
||||
.await;
|
||||
if sem > 0 {
|
||||
tracing::info!(
|
||||
"[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Stage 5d: grounded surface checks — the absence-based controls (no
|
||||
// rate limiting, no security logging, no update-signature check) have no
|
||||
// syntactic pattern to match, so we retrieve the code surface each governs
|
||||
// and let the grounded judge decide whether it holds, producing net-new
|
||||
// findings already tagged + grounded. Gated (default off): absence
|
||||
// detection is the least deterministic path, kept off until tuned live.
|
||||
if self.config.breakpilot.grounded_control_checks {
|
||||
self.update_phase(scan_run_id, "grounded_control_checks")
|
||||
.await;
|
||||
let grounded = crate::controls::grounded_surface_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&repo_id,
|
||||
)
|
||||
.await;
|
||||
if !grounded.is_empty() {
|
||||
tracing::info!(
|
||||
"[{repo_id}] Grounded surface checks raised {} control findings",
|
||||
grounded.len()
|
||||
);
|
||||
all_findings.extend(grounded);
|
||||
}
|
||||
}
|
||||
|
||||
// Dedup against existing findings and insert new ones
|
||||
let mut new_count = 0u32;
|
||||
let mut new_findings: Vec<Finding> = Vec::new();
|
||||
@@ -321,12 +259,67 @@ impl PipelineOrchestrator {
|
||||
.await?;
|
||||
}
|
||||
|
||||
// Persist CVE alerts and create notifications (shared with the PLC path).
|
||||
let new_notif_count = self
|
||||
.persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
|
||||
.await?;
|
||||
if new_notif_count > 0 {
|
||||
tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
|
||||
// Persist CVE alerts and create notifications
|
||||
{
|
||||
use compliance_core::models::notification::{parse_severity, CveNotification};
|
||||
|
||||
let repo_name = repo.name.clone();
|
||||
let mut new_notif_count = 0u32;
|
||||
|
||||
for alert in &cve_alerts {
|
||||
// Upsert the alert
|
||||
let filter = doc! {
|
||||
"cve_id": &alert.cve_id,
|
||||
"repo_id": &alert.repo_id,
|
||||
};
|
||||
let update = mongodb::bson::to_document(alert)
|
||||
.map(|d| doc! { "$set": d })
|
||||
.unwrap_or_else(|_| doc! {});
|
||||
self.db
|
||||
.cve_alerts()
|
||||
.update_one(filter, update)
|
||||
.upsert(true)
|
||||
.await?;
|
||||
|
||||
// Create notification (dedup by cve_id + repo + package + version)
|
||||
let notif_filter = doc! {
|
||||
"cve_id": &alert.cve_id,
|
||||
"repo_id": &alert.repo_id,
|
||||
"package_name": &alert.affected_package,
|
||||
"package_version": &alert.affected_version,
|
||||
};
|
||||
let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
|
||||
let mut notification = CveNotification::new(
|
||||
alert.cve_id.clone(),
|
||||
repo_id.clone(),
|
||||
repo_name.clone(),
|
||||
alert.affected_package.clone(),
|
||||
alert.affected_version.clone(),
|
||||
severity,
|
||||
);
|
||||
notification.cvss_score = alert.cvss_score;
|
||||
notification.summary = alert.summary.clone();
|
||||
notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
|
||||
|
||||
let notif_update = doc! {
|
||||
"$setOnInsert": mongodb::bson::to_bson(¬ification).unwrap_or_default()
|
||||
};
|
||||
if let Ok(result) = self
|
||||
.db
|
||||
.cve_notifications()
|
||||
.update_one(notif_filter, notif_update)
|
||||
.upsert(true)
|
||||
.await
|
||||
{
|
||||
if result.upserted_id.is_some() {
|
||||
new_notif_count += 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if new_notif_count > 0 {
|
||||
tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
|
||||
}
|
||||
}
|
||||
|
||||
// Stage 6: Issue Creation
|
||||
@@ -456,440 +449,33 @@ impl PipelineOrchestrator {
|
||||
// wizard-created targets, not just migrated ones.
|
||||
self.ensure_dast_target(target, &plan).await;
|
||||
|
||||
// PLC/SPS targets: the control-logic scan consumes the PLC source (an
|
||||
// uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
|
||||
// exports), so it takes over the code artifact — we don't also run the
|
||||
// SAST pipeline over it. A PLC device is reachable, so DAST still runs
|
||||
// against a WebVisu / exposed endpoint when one is provisioned.
|
||||
let mut new_count = 0u32;
|
||||
let plc = plan.has(ScanType::PlcControlLogic);
|
||||
let ics = plan.has(ScanType::IcsProbe);
|
||||
if plc {
|
||||
new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
|
||||
// Provision-and-test (#183): with the control logic but no reachable
|
||||
// device, instantiate it on an ephemeral soft-PLC and probe that
|
||||
// instead of the customer's OT network. Opt-in (needs Docker) and only
|
||||
// when there is no live URL to probe directly. Never fails the scan.
|
||||
if self.config.plc_runtime.enabled && target.live_url().is_none() {
|
||||
match self
|
||||
.run_provisioned_plc_test(target, &target_id, scan_run_id)
|
||||
.await
|
||||
{
|
||||
Ok(n) => new_count += n,
|
||||
Err(e) => {
|
||||
tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if ics {
|
||||
new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
|
||||
}
|
||||
if plc || ics {
|
||||
// PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
|
||||
// only when DAST is actually planned — a device reachable only over an
|
||||
// industrial protocol (e.g. modbus://) has no web surface to crawl, and
|
||||
// running DAST there just fails at reconnaissance. Gating here (not only
|
||||
// at provisioning) also stops a DAST target left over from an earlier
|
||||
// run from re-triggering. The control-logic scan already consumed the
|
||||
// code artifact, so the SAST pipeline is not re-run.
|
||||
if plan.has(ScanType::Dast) {
|
||||
self.update_phase(scan_run_id, "dast_scanning").await;
|
||||
self.maybe_trigger_dast(&target_id, scan_run_id).await;
|
||||
}
|
||||
return Ok(new_count);
|
||||
}
|
||||
|
||||
match target.code_artifact() {
|
||||
Some(code) if code.kind == ArtifactKind::GitRepo => {
|
||||
let repo = RepoView::from_target(target, code);
|
||||
let n = self.run_pipeline(&repo, scan_run_id).await?;
|
||||
self.finalize_target(target, &repo, n).await?;
|
||||
new_count += n;
|
||||
let new_count = self.run_pipeline(&repo, scan_run_id).await?;
|
||||
self.finalize_target(target, &repo, new_count).await?;
|
||||
Ok(new_count)
|
||||
}
|
||||
Some(_) => {
|
||||
tracing::warn!(
|
||||
target_id = %target_id,
|
||||
"Unified pipeline: source-archive scanning not yet wired; skipping"
|
||||
);
|
||||
Ok(0)
|
||||
}
|
||||
None => {
|
||||
// No code to scan (a migrated DAST target). Firmware/mobile static
|
||||
// scanners land in #128/#129; DAST for a running URL works when a
|
||||
// DastTarget row exists (provisioned above from a LiveUrl, or from
|
||||
// a migrated target).
|
||||
// No code to scan. Firmware/PLC/mobile static scanners land in
|
||||
// #128/#129/#130; DAST for a running URL still works when a
|
||||
// DastTarget row exists (migrated targets).
|
||||
tracing::info!(
|
||||
target_id = %target_id,
|
||||
"Unified pipeline: no code artifact; attempting DAST"
|
||||
"Unified pipeline: no code artifact; attempting DAST only"
|
||||
);
|
||||
self.update_phase(scan_run_id, "dast_scanning").await;
|
||||
self.maybe_trigger_dast(&target_id, scan_run_id).await;
|
||||
Ok(0)
|
||||
}
|
||||
}
|
||||
Ok(new_count)
|
||||
}
|
||||
|
||||
/// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
|
||||
/// control-logic security issues and persist the new findings.
|
||||
async fn run_plc_scan(
|
||||
&self,
|
||||
target: &OnboardedTarget,
|
||||
target_id: &str,
|
||||
scan_run_id: &str,
|
||||
) -> Result<u32, AgentError> {
|
||||
tracing::info!(target_id, "[{target_id}] PLC control-logic analysis");
|
||||
self.update_phase(scan_run_id, "plc_analysis").await;
|
||||
|
||||
let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
|
||||
let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
|
||||
// Every PLC-source artifact on the target: dedicated PLC projects plus any
|
||||
// code artifacts (git repo / source archive) holding PLCopen XML / ST
|
||||
// exports. A target can carry several (e.g. one POU export per file).
|
||||
let sources: Vec<&Artifact> = target
|
||||
.artifacts
|
||||
.iter()
|
||||
.filter(|a| {
|
||||
matches!(
|
||||
a.kind,
|
||||
ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
|
||||
)
|
||||
})
|
||||
.collect();
|
||||
if sources.is_empty() {
|
||||
tracing::warn!(target_id, "PLC scan: no PLC source artifact");
|
||||
return Ok(0);
|
||||
}
|
||||
|
||||
let mut all_findings = Vec::new();
|
||||
let mut all_sbom: Vec<SbomEntry> = Vec::new();
|
||||
let mut sbom_seen = std::collections::BTreeSet::new();
|
||||
for a in &sources {
|
||||
let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
|
||||
continue;
|
||||
};
|
||||
all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
|
||||
// Control-application SBOM: CODESYS libraries + runtime from a
|
||||
// `.projectarchive` (uploaded, or committed in the working tree).
|
||||
let archive = a
|
||||
.stored_path
|
||||
.clone()
|
||||
.unwrap_or_else(|| a.source_ref.clone());
|
||||
for e in crate::pipeline::plc::sbom::collect_sbom(
|
||||
std::path::Path::new(&archive),
|
||||
&path,
|
||||
target_id,
|
||||
) {
|
||||
if sbom_seen.insert((e.name.clone(), e.version.clone())) {
|
||||
all_sbom.push(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
tracing::info!(
|
||||
target_id,
|
||||
artifacts = sources.len(),
|
||||
found = all_findings.len(),
|
||||
"PLC control-logic analysis complete"
|
||||
);
|
||||
|
||||
let mut new_count = 0u32;
|
||||
for mut finding in all_findings {
|
||||
finding.scan_run_id = Some(scan_run_id.to_string());
|
||||
if self
|
||||
.db
|
||||
.findings()
|
||||
.find_one(doc! { "fingerprint": &finding.fingerprint })
|
||||
.await?
|
||||
.is_none()
|
||||
{
|
||||
self.db.findings().insert_one(&finding).await?;
|
||||
new_count += 1;
|
||||
}
|
||||
}
|
||||
|
||||
if !all_sbom.is_empty() {
|
||||
if let Err(e) = self
|
||||
.persist_control_app_sbom(target_id, &target.name, all_sbom)
|
||||
.await
|
||||
{
|
||||
tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
|
||||
}
|
||||
}
|
||||
Ok(new_count)
|
||||
}
|
||||
|
||||
/// Provision-and-test (#183): instantiate the target's control logic on an
|
||||
/// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
|
||||
/// endpoint, and tear the instance down. Used when a PLC/SPS target has the
|
||||
/// control logic but no reachable live device to probe directly. Guarded by
|
||||
/// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
|
||||
/// findings as a live probe.
|
||||
async fn run_provisioned_plc_test(
|
||||
&self,
|
||||
target: &OnboardedTarget,
|
||||
target_id: &str,
|
||||
scan_run_id: &str,
|
||||
) -> Result<u32, AgentError> {
|
||||
self.update_phase(scan_run_id, "plc_provision").await;
|
||||
|
||||
// Locate a loadable control-logic program among the PLC-source artifacts
|
||||
// (same selection as the static PLC scan: dedicated PLC projects plus code
|
||||
// artifacts holding PLCopen XML / ST exports).
|
||||
let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
|
||||
let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
|
||||
let program = target
|
||||
.artifacts
|
||||
.iter()
|
||||
.filter(|a| {
|
||||
matches!(
|
||||
a.kind,
|
||||
ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
|
||||
)
|
||||
})
|
||||
.find_map(|a| {
|
||||
let path = ingest_set
|
||||
.get(&a.id)
|
||||
.and_then(|ia| ia.working_path.clone())?;
|
||||
werkbank_exec::plc::extract_program(&path)
|
||||
});
|
||||
let Some(program) = program else {
|
||||
tracing::info!(
|
||||
target_id,
|
||||
"provision-and-test: no loadable control-logic program"
|
||||
);
|
||||
return Ok(0);
|
||||
};
|
||||
|
||||
let http = werkbank_exec::plc::http_client()?;
|
||||
let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
|
||||
let outcome = werkbank_exec::plc::provision_and_test(
|
||||
&provisioner,
|
||||
&http,
|
||||
&self.config.plc_runtime,
|
||||
&program,
|
||||
target_id,
|
||||
)
|
||||
.await?;
|
||||
tracing::info!(
|
||||
target_id,
|
||||
found = outcome.findings.len(),
|
||||
dast = outcome.dast.is_some(),
|
||||
"provision-and-test complete"
|
||||
);
|
||||
|
||||
let mut new_count = 0u32;
|
||||
for mut finding in outcome.findings {
|
||||
finding.scan_run_id = Some(scan_run_id.to_string());
|
||||
if self
|
||||
.db
|
||||
.findings()
|
||||
.find_one(doc! { "fingerprint": &finding.fingerprint })
|
||||
.await?
|
||||
.is_none()
|
||||
{
|
||||
self.db.findings().insert_one(&finding).await?;
|
||||
new_count += 1;
|
||||
}
|
||||
}
|
||||
|
||||
// Persist the DAST scan of the provisioned web endpoint, linked to this
|
||||
// scan run (mirrors `maybe_trigger_dast`).
|
||||
if let Some(dast) = outcome.dast {
|
||||
let mut scan_run = dast.scan_run;
|
||||
scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
|
||||
if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
|
||||
tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
|
||||
}
|
||||
for finding in &dast.findings {
|
||||
if let Err(e) = self.db.dast_findings().insert_one(finding).await {
|
||||
tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(new_count)
|
||||
}
|
||||
|
||||
/// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
|
||||
/// and persist findings for exposed / unauthenticated control access. The
|
||||
/// probe is read-only; it targets the Modbus port of the target's live URL.
|
||||
async fn run_ics_probe(
|
||||
&self,
|
||||
target: &OnboardedTarget,
|
||||
target_id: &str,
|
||||
scan_run_id: &str,
|
||||
) -> Result<u32, AgentError> {
|
||||
self.update_phase(scan_run_id, "ics_probe").await;
|
||||
let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
|
||||
tracing::warn!(target_id, "ICS probe: no live URL");
|
||||
return Ok(0);
|
||||
};
|
||||
// Short per-request budget so an unreachable device doesn't stall the scan.
|
||||
let budget = std::time::Duration::from_secs(5);
|
||||
let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
|
||||
tracing::info!(
|
||||
target_id,
|
||||
endpoint = %endpoint,
|
||||
found = findings.len(),
|
||||
"ICS probe complete"
|
||||
);
|
||||
let mut new_count = 0u32;
|
||||
for mut finding in findings {
|
||||
finding.scan_run_id = Some(scan_run_id.to_string());
|
||||
if self
|
||||
.db
|
||||
.findings()
|
||||
.find_one(doc! { "fingerprint": &finding.fingerprint })
|
||||
.await?
|
||||
.is_none()
|
||||
{
|
||||
self.db.findings().insert_one(&finding).await?;
|
||||
new_count += 1;
|
||||
}
|
||||
}
|
||||
Ok(new_count)
|
||||
}
|
||||
|
||||
/// Store a control-application SBOM (CODESYS libraries + runtime) for a target
|
||||
/// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
|
||||
/// it refreshes on re-scan and coexists with any firmware/source SBOM. The
|
||||
/// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
|
||||
/// this is where PLC-device CVE coverage comes from.
|
||||
async fn persist_control_app_sbom(
|
||||
&self,
|
||||
target_id: &str,
|
||||
target_name: &str,
|
||||
mut entries: Vec<SbomEntry>,
|
||||
) -> Result<(), AgentError> {
|
||||
if entries.is_empty() {
|
||||
return Ok(());
|
||||
}
|
||||
self.db
|
||||
.sbom_entries()
|
||||
.delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
|
||||
.await?;
|
||||
|
||||
let cve_scanner = CveScanner::new(
|
||||
self.http.clone(),
|
||||
self.config.searxng_url.clone(),
|
||||
self.config.nvd_api_key.as_ref().map(|k| {
|
||||
use secrecy::ExposeSecret;
|
||||
k.expose_secret().to_string()
|
||||
}),
|
||||
);
|
||||
let mut alerts = match tokio::time::timeout(
|
||||
std::time::Duration::from_secs(600),
|
||||
cve_scanner.scan_dependencies(target_id, &mut entries),
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(Ok(a)) => a,
|
||||
Ok(Err(e)) => {
|
||||
tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
|
||||
Vec::new()
|
||||
}
|
||||
Err(_) => {
|
||||
tracing::warn!(target_id, "control-app CVE scan timed out");
|
||||
Vec::new()
|
||||
}
|
||||
};
|
||||
// OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
|
||||
// live in NVD keyed by CPE + runtime version. Add those (best-effort).
|
||||
if let Ok(codesys) = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(120),
|
||||
cve_scanner.scan_codesys(target_id, &mut entries),
|
||||
)
|
||||
.await
|
||||
{
|
||||
alerts.extend(codesys);
|
||||
} else {
|
||||
tracing::warn!(target_id, "CODESYS CVE match timed out");
|
||||
}
|
||||
|
||||
for entry in &entries {
|
||||
let filter = doc! {
|
||||
"repo_id": &entry.repo_id,
|
||||
"name": &entry.name,
|
||||
"version": &entry.version,
|
||||
};
|
||||
if let Ok(d) = mongodb::bson::to_document(entry) {
|
||||
self.db
|
||||
.sbom_entries()
|
||||
.update_one(filter, doc! { "$set": d })
|
||||
.upsert(true)
|
||||
.await?;
|
||||
}
|
||||
}
|
||||
let new_notifs = self
|
||||
.persist_cve_alerts(target_id, target_name, &alerts)
|
||||
.await?;
|
||||
tracing::info!(
|
||||
target_id,
|
||||
components = entries.len(),
|
||||
alerts = alerts.len(),
|
||||
notifications = new_notifs,
|
||||
"control-app SBOM stored"
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Upsert CVE alerts for a target and create dedup'd CVE notifications;
|
||||
/// returns the number of newly-created notifications. Shared by the SAST
|
||||
/// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
|
||||
/// firmware, CODESYS libraries/runtime) raises the same notifications.
|
||||
async fn persist_cve_alerts(
|
||||
&self,
|
||||
repo_id: &str,
|
||||
repo_name: &str,
|
||||
alerts: &[CveAlert],
|
||||
) -> Result<u32, AgentError> {
|
||||
use compliance_core::models::notification::{parse_severity, CveNotification};
|
||||
|
||||
let mut new_notif = 0u32;
|
||||
for alert in alerts {
|
||||
let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
|
||||
let update = mongodb::bson::to_document(alert)
|
||||
.map(|d| doc! { "$set": d })
|
||||
.unwrap_or_else(|_| doc! {});
|
||||
self.db
|
||||
.cve_alerts()
|
||||
.update_one(filter, update)
|
||||
.upsert(true)
|
||||
.await?;
|
||||
|
||||
// Dedup notifications by cve + repo + package + version.
|
||||
let notif_filter = doc! {
|
||||
"cve_id": &alert.cve_id,
|
||||
"repo_id": &alert.repo_id,
|
||||
"package_name": &alert.affected_package,
|
||||
"package_version": &alert.affected_version,
|
||||
};
|
||||
let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
|
||||
let mut notification = CveNotification::new(
|
||||
alert.cve_id.clone(),
|
||||
repo_id.to_string(),
|
||||
repo_name.to_string(),
|
||||
alert.affected_package.clone(),
|
||||
alert.affected_version.clone(),
|
||||
severity,
|
||||
);
|
||||
notification.cvss_score = alert.cvss_score;
|
||||
notification.summary = alert.summary.clone();
|
||||
notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
|
||||
let notif_update = doc! {
|
||||
"$setOnInsert": mongodb::bson::to_bson(¬ification).unwrap_or_default()
|
||||
};
|
||||
if let Ok(result) = self
|
||||
.db
|
||||
.cve_notifications()
|
||||
.update_one(notif_filter, notif_update)
|
||||
.upsert(true)
|
||||
.await
|
||||
{
|
||||
if result.upserted_id.is_some() {
|
||||
new_notif += 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(new_notif)
|
||||
}
|
||||
|
||||
/// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
|
||||
|
||||
@@ -75,16 +75,10 @@ pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
|
||||
}
|
||||
|
||||
/// Resolve the artifact a scan consumes. A "code" requirement (represented by
|
||||
/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
|
||||
/// control-logic requirement (represented by `PlcProject`) prefers an uploaded
|
||||
/// PLC project but also accepts a code artifact — a git repo / source archive
|
||||
/// holding PLCopen XML / ST exports.
|
||||
/// `GitRepo`) is satisfied by a git repo *or* a source archive.
|
||||
fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
|
||||
match required {
|
||||
Some(ArtifactKind::GitRepo) => target.code_artifact(),
|
||||
Some(ArtifactKind::PlcProject) => target
|
||||
.first_of(ArtifactKind::PlcProject)
|
||||
.or_else(|| target.code_artifact()),
|
||||
Some(kind) => target.first_of(kind),
|
||||
None => target.code_artifact().or_else(|| target.artifacts.first()),
|
||||
}
|
||||
@@ -106,7 +100,6 @@ fn phase_for(scan: ScanType) -> ScanPhase {
|
||||
ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
|
||||
ScanType::MobileStatic => ScanPhase::MobileStatic,
|
||||
ScanType::ContainerScan => ScanPhase::ContainerScan,
|
||||
ScanType::IcsProbe => ScanPhase::IcsProbe,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -181,18 +174,6 @@ mod tests {
|
||||
assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_control_logic_binds_to_a_git_repo() {
|
||||
// A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
|
||||
// PlcProject: control-logic still plans, bound to the git artifact.
|
||||
let git = Artifact::git_repo("https://git/plc", "main");
|
||||
let git_id = git.id.clone();
|
||||
let t = target(TargetType::PlcSps, vec![git]);
|
||||
let plan = build_scan_plan(&t);
|
||||
let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
|
||||
assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
|
||||
let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
|
||||
|
||||
@@ -1,226 +0,0 @@
|
||||
//! Abstract syntax tree for IEC 61131-3 Structured Text (ST).
|
||||
//!
|
||||
//! This is the security-relevant subset: POUs with their variable declarations
|
||||
//! and statement bodies, enough to run semantic control-logic rules over. It is
|
||||
//! deliberately not a full language model — declarations we don't reason about
|
||||
//! (e.g. exotic type definitions) are parsed loosely and kept as raw text.
|
||||
|
||||
/// A Program Organization Unit: a PROGRAM, FUNCTION, or FUNCTION_BLOCK.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct Pou {
|
||||
pub name: String,
|
||||
pub kind: PouKind,
|
||||
/// The declared variables, across all VAR_* sections.
|
||||
pub vars: Vec<VarDecl>,
|
||||
/// The statement body.
|
||||
pub body: Vec<Stmt>,
|
||||
/// 1-based line where the POU header appears (in the source that was parsed).
|
||||
pub line: u32,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum PouKind {
|
||||
Program,
|
||||
Function,
|
||||
FunctionBlock,
|
||||
}
|
||||
|
||||
impl PouKind {
|
||||
pub fn label(self) -> &'static str {
|
||||
match self {
|
||||
PouKind::Program => "PROGRAM",
|
||||
PouKind::Function => "FUNCTION",
|
||||
PouKind::FunctionBlock => "FUNCTION_BLOCK",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A single declared variable.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct VarDecl {
|
||||
pub name: String,
|
||||
pub section: VarSection,
|
||||
/// The declared type as written (e.g. `BOOL`, `INT`, `ARRAY[0..9] OF INT`).
|
||||
pub type_name: String,
|
||||
/// Whether the type is an ARRAY, and its declared bounds `(lo, hi)` when
|
||||
/// they are literal integers — used by the array-bounds rule.
|
||||
pub array_bounds: Option<(i64, i64)>,
|
||||
/// The initializer expression, if any (`:= <expr>`).
|
||||
pub init: Option<Expr>,
|
||||
pub line: u32,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum VarSection {
|
||||
Var,
|
||||
Input,
|
||||
Output,
|
||||
InOut,
|
||||
Global,
|
||||
Temp,
|
||||
External,
|
||||
}
|
||||
|
||||
/// A statement.
|
||||
#[derive(Debug, Clone)]
|
||||
pub enum Stmt {
|
||||
Assign {
|
||||
target: Expr,
|
||||
value: Expr,
|
||||
line: u32,
|
||||
},
|
||||
If {
|
||||
/// (condition, body) for IF and each ELSIF, in order.
|
||||
branches: Vec<(Expr, Vec<Stmt>)>,
|
||||
else_body: Option<Vec<Stmt>>,
|
||||
line: u32,
|
||||
},
|
||||
Case {
|
||||
selector: Expr,
|
||||
/// (label expressions, body) per CASE arm.
|
||||
arms: Vec<(Vec<Expr>, Vec<Stmt>)>,
|
||||
else_body: Option<Vec<Stmt>>,
|
||||
line: u32,
|
||||
},
|
||||
For {
|
||||
var: String,
|
||||
from: Expr,
|
||||
to: Expr,
|
||||
by: Option<Expr>,
|
||||
body: Vec<Stmt>,
|
||||
line: u32,
|
||||
},
|
||||
While {
|
||||
cond: Expr,
|
||||
body: Vec<Stmt>,
|
||||
line: u32,
|
||||
},
|
||||
Repeat {
|
||||
body: Vec<Stmt>,
|
||||
until: Expr,
|
||||
line: u32,
|
||||
},
|
||||
/// A bare call statement, e.g. `TON1(IN := x, PT := T#5s);`.
|
||||
Call {
|
||||
callee: String,
|
||||
args: Vec<CallArg>,
|
||||
line: u32,
|
||||
},
|
||||
Return {
|
||||
line: u32,
|
||||
},
|
||||
Exit {
|
||||
line: u32,
|
||||
},
|
||||
/// `JMP label;` — an unstructured jump.
|
||||
Jump {
|
||||
label: String,
|
||||
line: u32,
|
||||
},
|
||||
/// `label:` — a jump target.
|
||||
Label {
|
||||
name: String,
|
||||
line: u32,
|
||||
},
|
||||
}
|
||||
|
||||
/// One argument in a call: positional (`name: None`) or named (`X := expr`).
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct CallArg {
|
||||
pub name: Option<String>,
|
||||
pub value: Expr,
|
||||
}
|
||||
|
||||
/// An expression.
|
||||
#[derive(Debug, Clone)]
|
||||
pub enum Expr {
|
||||
Int(i64, u32),
|
||||
Real(f64, u32),
|
||||
Bool(bool, u32),
|
||||
/// A string literal, with the unquoted contents.
|
||||
Str(String, u32),
|
||||
/// A duration / date / time literal, kept as raw text (`T#5s`, `DT#...`).
|
||||
Time(String, u32),
|
||||
Ident(String, u32),
|
||||
/// `base[index]`.
|
||||
Index {
|
||||
base: Box<Expr>,
|
||||
index: Box<Expr>,
|
||||
line: u32,
|
||||
},
|
||||
/// `base.field`.
|
||||
Member {
|
||||
base: Box<Expr>,
|
||||
field: String,
|
||||
line: u32,
|
||||
},
|
||||
Unary {
|
||||
op: UnOp,
|
||||
expr: Box<Expr>,
|
||||
line: u32,
|
||||
},
|
||||
Binary {
|
||||
op: BinOp,
|
||||
lhs: Box<Expr>,
|
||||
rhs: Box<Expr>,
|
||||
line: u32,
|
||||
},
|
||||
/// A function call used as an expression, e.g. `LIMIT(a, b, c)`.
|
||||
Call {
|
||||
callee: String,
|
||||
args: Vec<CallArg>,
|
||||
line: u32,
|
||||
},
|
||||
}
|
||||
|
||||
impl Expr {
|
||||
/// The 1-based source line this expression starts on.
|
||||
pub fn line(&self) -> u32 {
|
||||
match self {
|
||||
Expr::Int(_, l)
|
||||
| Expr::Real(_, l)
|
||||
| Expr::Bool(_, l)
|
||||
| Expr::Str(_, l)
|
||||
| Expr::Time(_, l)
|
||||
| Expr::Ident(_, l)
|
||||
| Expr::Index { line: l, .. }
|
||||
| Expr::Member { line: l, .. }
|
||||
| Expr::Unary { line: l, .. }
|
||||
| Expr::Binary { line: l, .. }
|
||||
| Expr::Call { line: l, .. } => *l,
|
||||
}
|
||||
}
|
||||
|
||||
/// If this expression is a plain identifier, its name.
|
||||
pub fn as_ident(&self) -> Option<&str> {
|
||||
match self {
|
||||
Expr::Ident(name, _) => Some(name.as_str()),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum UnOp {
|
||||
Not,
|
||||
Neg,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum BinOp {
|
||||
Add,
|
||||
Sub,
|
||||
Mul,
|
||||
Div,
|
||||
Mod,
|
||||
Pow,
|
||||
Eq,
|
||||
Ne,
|
||||
Lt,
|
||||
Le,
|
||||
Gt,
|
||||
Ge,
|
||||
And,
|
||||
Or,
|
||||
Xor,
|
||||
}
|
||||
@@ -1,372 +0,0 @@
|
||||
//! Lexer for IEC 61131-3 Structured Text.
|
||||
//!
|
||||
//! Tokenizes ST source into a flat token stream with 1-based line numbers.
|
||||
//! Keywords are case-insensitive. Handles `(* *)` and `//` comments, `'..'` and
|
||||
//! `".."` strings (with `''`/`""` escapes), based integers (`16#FF`, `2#1010`),
|
||||
//! and duration/date literals (`T#5s`, `DT#...`) kept as raw text.
|
||||
|
||||
/// A lexed token with its source line.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct Token {
|
||||
pub kind: Tok,
|
||||
pub line: u32,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq)]
|
||||
pub enum Tok {
|
||||
Int(i64),
|
||||
Real(f64),
|
||||
Str(String),
|
||||
Time(String),
|
||||
Bool(bool),
|
||||
Ident(String),
|
||||
Kw(Keyword),
|
||||
Assign, // :=
|
||||
Plus, // +
|
||||
Minus, // -
|
||||
Star, // *
|
||||
Slash, // /
|
||||
Power, // **
|
||||
LParen, // (
|
||||
RParen, // )
|
||||
LBrack, // [
|
||||
RBrack, // ]
|
||||
Dot, // .
|
||||
DotDot, // ..
|
||||
Comma, // ,
|
||||
Semi, // ;
|
||||
Colon, // :
|
||||
Lt, // <
|
||||
Le, // <=
|
||||
Gt, // >
|
||||
Ge, // >=
|
||||
Eq, // =
|
||||
Ne, // <>
|
||||
Amp, // &
|
||||
Eof,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Keyword {
|
||||
Program,
|
||||
EndProgram,
|
||||
Function,
|
||||
EndFunction,
|
||||
FunctionBlock,
|
||||
EndFunctionBlock,
|
||||
Var,
|
||||
VarInput,
|
||||
VarOutput,
|
||||
VarInOut,
|
||||
VarGlobal,
|
||||
VarTemp,
|
||||
VarExternal,
|
||||
Constant,
|
||||
EndVar,
|
||||
Array,
|
||||
Of,
|
||||
If,
|
||||
Then,
|
||||
Elsif,
|
||||
Else,
|
||||
EndIf,
|
||||
Case,
|
||||
EndCase,
|
||||
For,
|
||||
To,
|
||||
By,
|
||||
Do,
|
||||
EndFor,
|
||||
While,
|
||||
EndWhile,
|
||||
Repeat,
|
||||
Until,
|
||||
EndRepeat,
|
||||
Return,
|
||||
Exit,
|
||||
Jmp,
|
||||
Not,
|
||||
And,
|
||||
Or,
|
||||
Xor,
|
||||
Mod,
|
||||
Type,
|
||||
EndType,
|
||||
Struct,
|
||||
EndStruct,
|
||||
}
|
||||
|
||||
fn keyword_from(word: &str) -> Option<Keyword> {
|
||||
use Keyword::*;
|
||||
Some(match word.to_ascii_uppercase().as_str() {
|
||||
"PROGRAM" => Program,
|
||||
"END_PROGRAM" => EndProgram,
|
||||
"FUNCTION" => Function,
|
||||
"END_FUNCTION" => EndFunction,
|
||||
"FUNCTION_BLOCK" => FunctionBlock,
|
||||
"END_FUNCTION_BLOCK" => EndFunctionBlock,
|
||||
"VAR" => Var,
|
||||
"VAR_INPUT" => VarInput,
|
||||
"VAR_OUTPUT" => VarOutput,
|
||||
"VAR_IN_OUT" => VarInOut,
|
||||
"VAR_GLOBAL" => VarGlobal,
|
||||
"VAR_TEMP" => VarTemp,
|
||||
"VAR_EXTERNAL" => VarExternal,
|
||||
"CONSTANT" => Constant,
|
||||
"END_VAR" => EndVar,
|
||||
"ARRAY" => Array,
|
||||
"OF" => Of,
|
||||
"IF" => If,
|
||||
"THEN" => Then,
|
||||
"ELSIF" => Elsif,
|
||||
"ELSE" => Else,
|
||||
"END_IF" => EndIf,
|
||||
"CASE" => Case,
|
||||
"END_CASE" => EndCase,
|
||||
"FOR" => For,
|
||||
"TO" => To,
|
||||
"BY" => By,
|
||||
"DO" => Do,
|
||||
"END_FOR" => EndFor,
|
||||
"WHILE" => While,
|
||||
"END_WHILE" => EndWhile,
|
||||
"REPEAT" => Repeat,
|
||||
"UNTIL" => Until,
|
||||
"END_REPEAT" => EndRepeat,
|
||||
"RETURN" => Return,
|
||||
"EXIT" => Exit,
|
||||
"JMP" => Jmp,
|
||||
"NOT" => Not,
|
||||
"AND" => And,
|
||||
"OR" => Or,
|
||||
"XOR" => Xor,
|
||||
"MOD" => Mod,
|
||||
"TYPE" => Type,
|
||||
"END_TYPE" => EndType,
|
||||
"STRUCT" => Struct,
|
||||
"END_STRUCT" => EndStruct,
|
||||
_ => return None,
|
||||
})
|
||||
}
|
||||
|
||||
/// Tokenize `src`. Unknown characters are skipped (best-effort — a scanner must
|
||||
/// not die on odd input).
|
||||
pub fn lex(src: &str) -> Vec<Token> {
|
||||
let chars: Vec<char> = src.chars().collect();
|
||||
let mut i = 0usize;
|
||||
let mut line = 1u32;
|
||||
let mut out = Vec::new();
|
||||
|
||||
let bump_line = |c: char, line: &mut u32| {
|
||||
if c == '\n' {
|
||||
*line += 1;
|
||||
}
|
||||
};
|
||||
|
||||
while i < chars.len() {
|
||||
let c = chars[i];
|
||||
|
||||
// Whitespace.
|
||||
if c.is_whitespace() {
|
||||
bump_line(c, &mut line);
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Line comment: //
|
||||
if c == '/' && i + 1 < chars.len() && chars[i + 1] == '/' {
|
||||
while i < chars.len() && chars[i] != '\n' {
|
||||
i += 1;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
// Block comment: (* ... *)
|
||||
if c == '(' && i + 1 < chars.len() && chars[i + 1] == '*' {
|
||||
i += 2;
|
||||
while i + 1 < chars.len() && !(chars[i] == '*' && chars[i + 1] == ')') {
|
||||
bump_line(chars[i], &mut line);
|
||||
i += 1;
|
||||
}
|
||||
i = (i + 2).min(chars.len());
|
||||
continue;
|
||||
}
|
||||
|
||||
let tok_line = line;
|
||||
|
||||
// String literal: '...' or "..."
|
||||
if c == '\'' || c == '"' {
|
||||
let quote = c;
|
||||
i += 1;
|
||||
let mut s = String::new();
|
||||
while i < chars.len() {
|
||||
let ch = chars[i];
|
||||
if ch == quote {
|
||||
// Doubled quote is an escaped quote.
|
||||
if i + 1 < chars.len() && chars[i + 1] == quote {
|
||||
s.push(quote);
|
||||
i += 2;
|
||||
continue;
|
||||
}
|
||||
i += 1;
|
||||
break;
|
||||
}
|
||||
bump_line(ch, &mut line);
|
||||
s.push(ch);
|
||||
i += 1;
|
||||
}
|
||||
out.push(Token {
|
||||
kind: Tok::Str(s),
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
|
||||
// Identifier / keyword / time literal / boolean.
|
||||
if c.is_ascii_alphabetic() || c == '_' {
|
||||
let start = i;
|
||||
while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
|
||||
i += 1;
|
||||
}
|
||||
let word: String = chars[start..i].iter().collect();
|
||||
|
||||
// Duration/date/time literal prefix: T#, TIME#, DT#, D#, TOD#, LT# ...
|
||||
if i < chars.len() && chars[i] == '#' {
|
||||
let up = word.to_ascii_uppercase();
|
||||
if matches!(
|
||||
up.as_str(),
|
||||
"T" | "TIME" | "DT" | "D" | "TOD" | "LT" | "DATE"
|
||||
) {
|
||||
let lit_start = start;
|
||||
i += 1; // consume '#'
|
||||
while i < chars.len()
|
||||
&& (chars[i].is_ascii_alphanumeric()
|
||||
|| chars[i] == '.'
|
||||
|| chars[i] == '_'
|
||||
|| chars[i] == ':')
|
||||
{
|
||||
i += 1;
|
||||
}
|
||||
let lit: String = chars[lit_start..i].iter().collect();
|
||||
out.push(Token {
|
||||
kind: Tok::Time(lit),
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
let kind = match word.to_ascii_uppercase().as_str() {
|
||||
"TRUE" => Tok::Bool(true),
|
||||
"FALSE" => Tok::Bool(false),
|
||||
_ => match keyword_from(&word) {
|
||||
Some(kw) => Tok::Kw(kw),
|
||||
None => Tok::Ident(word),
|
||||
},
|
||||
};
|
||||
out.push(Token {
|
||||
kind,
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
|
||||
// Number: decimal, real, or based (16#..., 2#...).
|
||||
if c.is_ascii_digit() {
|
||||
let start = i;
|
||||
while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
|
||||
i += 1;
|
||||
}
|
||||
// Based literal: <base>#<digits>
|
||||
if i < chars.len() && chars[i] == '#' {
|
||||
let base_str: String = chars[start..i].iter().filter(|c| **c != '_').collect();
|
||||
i += 1;
|
||||
let dstart = i;
|
||||
while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
|
||||
i += 1;
|
||||
}
|
||||
let digits: String = chars[dstart..i].iter().filter(|c| **c != '_').collect();
|
||||
let radix = base_str.parse::<u32>().unwrap_or(10);
|
||||
let val = i64::from_str_radix(&digits, radix.clamp(2, 36)).unwrap_or(0);
|
||||
out.push(Token {
|
||||
kind: Tok::Int(val),
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
// Real: has a '.' (not '..') or exponent.
|
||||
let is_real =
|
||||
i < chars.len() && chars[i] == '.' && !(i + 1 < chars.len() && chars[i + 1] == '.');
|
||||
if is_real {
|
||||
i += 1;
|
||||
while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
|
||||
i += 1;
|
||||
}
|
||||
let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
|
||||
out.push(Token {
|
||||
kind: Tok::Real(raw.parse().unwrap_or(0.0)),
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
|
||||
out.push(Token {
|
||||
kind: Tok::Int(raw.parse().unwrap_or(0)),
|
||||
line: tok_line,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
|
||||
// Operators / punctuation (longest match first).
|
||||
let two: String = chars[i..(i + 2).min(chars.len())].iter().collect();
|
||||
let kind = match two.as_str() {
|
||||
":=" => Some(Tok::Assign),
|
||||
"<=" => Some(Tok::Le),
|
||||
">=" => Some(Tok::Ge),
|
||||
"<>" => Some(Tok::Ne),
|
||||
".." => Some(Tok::DotDot),
|
||||
"**" => Some(Tok::Power),
|
||||
_ => None,
|
||||
};
|
||||
if let Some(k) = kind {
|
||||
out.push(Token {
|
||||
kind: k,
|
||||
line: tok_line,
|
||||
});
|
||||
i += 2;
|
||||
continue;
|
||||
}
|
||||
let one = match c {
|
||||
'+' => Some(Tok::Plus),
|
||||
'-' => Some(Tok::Minus),
|
||||
'*' => Some(Tok::Star),
|
||||
'/' => Some(Tok::Slash),
|
||||
'(' => Some(Tok::LParen),
|
||||
')' => Some(Tok::RParen),
|
||||
'[' => Some(Tok::LBrack),
|
||||
']' => Some(Tok::RBrack),
|
||||
'.' => Some(Tok::Dot),
|
||||
',' => Some(Tok::Comma),
|
||||
';' => Some(Tok::Semi),
|
||||
':' => Some(Tok::Colon),
|
||||
'<' => Some(Tok::Lt),
|
||||
'>' => Some(Tok::Gt),
|
||||
'=' => Some(Tok::Eq),
|
||||
'&' => Some(Tok::Amp),
|
||||
_ => None,
|
||||
};
|
||||
if let Some(k) = one {
|
||||
out.push(Token {
|
||||
kind: k,
|
||||
line: tok_line,
|
||||
});
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
|
||||
out.push(Token {
|
||||
kind: Tok::Eof,
|
||||
line,
|
||||
});
|
||||
out
|
||||
}
|
||||
@@ -1,234 +0,0 @@
|
||||
//! PLC control-logic security scanner for IEC 61131-3 targets.
|
||||
//!
|
||||
//! Parses Structured Text (raw `.st`/`.scl`/`.exp` files and PLCopen-XML
|
||||
//! projects) into an AST and runs semantic control-logic security rules over it.
|
||||
//! Implements [`ScanType::PlcControlLogic`].
|
||||
|
||||
pub mod ast;
|
||||
pub mod lexer;
|
||||
pub mod parser;
|
||||
pub mod plcopen;
|
||||
pub mod rules;
|
||||
pub mod sbom;
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
use compliance_core::error::CoreError;
|
||||
use compliance_core::models::{Finding, ScanType};
|
||||
use compliance_core::traits::{ScanOutput, Scanner};
|
||||
|
||||
use crate::pipeline::dedup;
|
||||
|
||||
/// Scanner for `ScanType::PlcControlLogic`.
|
||||
pub struct PlcControlLogicScanner;
|
||||
|
||||
impl Scanner for PlcControlLogicScanner {
|
||||
fn name(&self) -> &str {
|
||||
"plc-control-logic"
|
||||
}
|
||||
|
||||
fn scan_type(&self) -> ScanType {
|
||||
ScanType::PlcControlLogic
|
||||
}
|
||||
|
||||
#[tracing::instrument(skip_all)]
|
||||
async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
|
||||
let findings = analyze_tree(repo_path, repo_id);
|
||||
Ok(ScanOutput {
|
||||
findings,
|
||||
sbom_entries: Vec::new(),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// Walk a PLC project tree and produce findings.
|
||||
pub(crate) fn analyze_tree(root: &Path, repo_id: &str) -> Vec<Finding> {
|
||||
let mut findings = Vec::new();
|
||||
for entry in walkdir::WalkDir::new(root)
|
||||
.into_iter()
|
||||
.filter_map(|e| e.ok())
|
||||
{
|
||||
if !entry.file_type().is_file() {
|
||||
continue;
|
||||
}
|
||||
let path = entry.path();
|
||||
let ext = path
|
||||
.extension()
|
||||
.and_then(|e| e.to_str())
|
||||
.unwrap_or("")
|
||||
.to_ascii_lowercase();
|
||||
let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
|
||||
let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
|
||||
if !is_st && !is_xml {
|
||||
continue;
|
||||
}
|
||||
let Ok(content) = std::fs::read_to_string(path) else {
|
||||
continue;
|
||||
};
|
||||
let pous = if is_xml {
|
||||
plcopen::parse_plcopen(&content)
|
||||
} else {
|
||||
parser::parse(&content)
|
||||
};
|
||||
if pous.is_empty() {
|
||||
continue;
|
||||
}
|
||||
let rel = path
|
||||
.strip_prefix(root)
|
||||
.unwrap_or(path)
|
||||
.to_string_lossy()
|
||||
.to_string();
|
||||
for pou in &pous {
|
||||
for hit in rules::analyze(pou) {
|
||||
let line_s = hit.line.to_string();
|
||||
let fingerprint =
|
||||
dedup::compute_fingerprint(&[repo_id, &rel, hit.rule_id, &pou.name, &line_s]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fingerprint,
|
||||
"plc-control-logic".to_string(),
|
||||
ScanType::PlcControlLogic,
|
||||
hit.title,
|
||||
hit.description,
|
||||
hit.severity,
|
||||
);
|
||||
f.file_path = Some(rel.clone());
|
||||
f.line_number = Some(hit.line);
|
||||
f.rule_id = Some(hit.rule_id.to_string());
|
||||
f.cwe = hit.cwe.map(String::from);
|
||||
f.remediation = Some(hit.remediation.to_string());
|
||||
findings.push(f);
|
||||
}
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::collections::HashSet;
|
||||
use std::path::PathBuf;
|
||||
|
||||
fn demo_dir() -> PathBuf {
|
||||
PathBuf::from(env!("CARGO_MANIFEST_DIR"))
|
||||
.parent()
|
||||
.expect("workspace root")
|
||||
.join("examples/plc-demo")
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scans_demo_project_end_to_end() {
|
||||
let findings = analyze_tree(&demo_dir(), "demo-target");
|
||||
assert!(!findings.is_empty(), "demo project should produce findings");
|
||||
|
||||
let rules: HashSet<&str> = findings
|
||||
.iter()
|
||||
.filter_map(|f| f.rule_id.as_deref())
|
||||
.collect();
|
||||
for r in [
|
||||
"plc-hardcoded-credential",
|
||||
"plc-default-password",
|
||||
"plc-safety-bypass",
|
||||
"plc-array-unchecked-index",
|
||||
"plc-insecure-comm",
|
||||
"plc-insecure-protocol-port",
|
||||
"plc-unstructured-jump",
|
||||
"plc-division-by-zero",
|
||||
] {
|
||||
assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
|
||||
}
|
||||
|
||||
// Every finding is well-formed for storage.
|
||||
for f in &findings {
|
||||
assert_eq!(f.repo_id, "demo-target");
|
||||
assert!(f.file_path.is_some(), "finding needs a file");
|
||||
assert!(f.line_number.is_some(), "finding needs a line");
|
||||
}
|
||||
|
||||
// The guarded division (IF ScaleFactor <> 0.0) must not be double-counted:
|
||||
// exactly one division-by-zero (the unguarded MeasuredFlow divide).
|
||||
let div0 = findings
|
||||
.iter()
|
||||
.filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
|
||||
.count();
|
||||
assert_eq!(div0, 1, "only the unguarded division should be flagged");
|
||||
}
|
||||
|
||||
/// The realistic OpenPLC-style traffic-light sample is mostly sound control
|
||||
/// logic: the scanner must surface its few genuine defects and stay quiet on
|
||||
/// the timed state machine and the guarded duty-cycle division.
|
||||
#[test]
|
||||
fn realistic_sample_flags_only_real_issues() {
|
||||
let all = analyze_tree(&demo_dir(), "demo-target");
|
||||
let tl: Vec<_> = all
|
||||
.iter()
|
||||
.filter(|f| {
|
||||
f.file_path
|
||||
.as_deref()
|
||||
.is_some_and(|p| p.ends_with("traffic_light.st"))
|
||||
})
|
||||
.collect();
|
||||
assert!(!tl.is_empty(), "traffic_light.st should produce findings");
|
||||
|
||||
let rules: HashSet<&str> = tl.iter().filter_map(|f| f.rule_id.as_deref()).collect();
|
||||
// The three planted defects: hardcoded SCADA password, cleartext Modbus
|
||||
// master (no auth), and a maintenance mode that drops the PedPermit.
|
||||
for r in [
|
||||
"plc-hardcoded-credential",
|
||||
"plc-insecure-comm",
|
||||
"plc-safety-bypass",
|
||||
] {
|
||||
assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
|
||||
}
|
||||
// Modbus/TCP on 502 is also an insecure-protocol port.
|
||||
assert!(rules.contains("plc-insecure-protocol-port"));
|
||||
|
||||
// Low false positives: the guarded `IF LampCount <> 0` division and the
|
||||
// JMP-free state machine must not trip anything.
|
||||
assert_eq!(
|
||||
tl.iter()
|
||||
.filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
|
||||
.count(),
|
||||
0,
|
||||
"the guarded duty-cycle division must not be flagged"
|
||||
);
|
||||
assert!(
|
||||
!rules.contains("plc-unstructured-jump"),
|
||||
"the CASE state machine uses no JMP"
|
||||
);
|
||||
}
|
||||
|
||||
/// Graphical logic must be analysed too: an FBD POU (blocks + in/out
|
||||
/// variables) is translated to synthetic ST, so the same rules fire on the
|
||||
/// cleartext Modbus block, the hardcoded HMI password and the safety write.
|
||||
#[test]
|
||||
fn fbd_graphical_body_is_analysed() {
|
||||
let all = analyze_tree(&demo_dir(), "demo-target");
|
||||
let fbd: Vec<_> = all
|
||||
.iter()
|
||||
.filter(|f| {
|
||||
f.file_path
|
||||
.as_deref()
|
||||
.is_some_and(|p| p.ends_with("pump_fbd.xml"))
|
||||
})
|
||||
.collect();
|
||||
assert!(
|
||||
!fbd.is_empty(),
|
||||
"pump_fbd.xml (FBD) should produce findings"
|
||||
);
|
||||
|
||||
let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
|
||||
for r in [
|
||||
"plc-insecure-comm", // Modbus_TCP_Master(AUTH := FALSE)
|
||||
"plc-insecure-protocol-port", // PORT := 502
|
||||
"plc-hardcoded-credential", // HmiPassword := 'admin123'
|
||||
"plc-safety-bypass", // Safety_Enable := FALSE
|
||||
] {
|
||||
assert!(
|
||||
rules.contains(r),
|
||||
"expected rule {r} from FBD; got {rules:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,766 +0,0 @@
|
||||
//! Recursive-descent parser for the security-relevant subset of Structured Text.
|
||||
//!
|
||||
//! Tolerant by design: it parses the POUs, variable sections, and statement
|
||||
//! bodies it understands, and skips (with statement/POU-level recovery) anything
|
||||
//! it does not, so a single odd construct never sinks the whole file.
|
||||
|
||||
use super::ast::*;
|
||||
use super::lexer::{Keyword as K, Tok, Token};
|
||||
|
||||
pub struct Parser {
|
||||
toks: Vec<Token>,
|
||||
pos: usize,
|
||||
}
|
||||
|
||||
impl Parser {
|
||||
pub fn new(toks: Vec<Token>) -> Self {
|
||||
Self { toks, pos: 0 }
|
||||
}
|
||||
|
||||
// ── token helpers ──────────────────────────────────────────────
|
||||
fn peek(&self) -> &Tok {
|
||||
&self.toks[self.pos.min(self.toks.len() - 1)].kind
|
||||
}
|
||||
fn line(&self) -> u32 {
|
||||
self.toks[self.pos.min(self.toks.len() - 1)].line
|
||||
}
|
||||
fn at_end(&self) -> bool {
|
||||
matches!(self.peek(), Tok::Eof)
|
||||
}
|
||||
fn advance(&mut self) -> Tok {
|
||||
let t = self.toks[self.pos.min(self.toks.len() - 1)].kind.clone();
|
||||
if self.pos < self.toks.len() - 1 {
|
||||
self.pos += 1;
|
||||
}
|
||||
t
|
||||
}
|
||||
fn eat(&mut self, t: &Tok) -> bool {
|
||||
if self.peek() == t {
|
||||
self.advance();
|
||||
true
|
||||
} else {
|
||||
false
|
||||
}
|
||||
}
|
||||
fn eat_kw(&mut self, k: K) -> bool {
|
||||
if matches!(self.peek(), Tok::Kw(x) if *x == k) {
|
||||
self.advance();
|
||||
true
|
||||
} else {
|
||||
false
|
||||
}
|
||||
}
|
||||
fn at_kw(&self, k: K) -> bool {
|
||||
matches!(self.peek(), Tok::Kw(x) if *x == k)
|
||||
}
|
||||
fn ident(&mut self) -> Option<String> {
|
||||
if let Tok::Ident(s) = self.peek() {
|
||||
let s = s.clone();
|
||||
self.advance();
|
||||
Some(s)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
// ── top level ──────────────────────────────────────────────────
|
||||
/// Parse every POU in the token stream.
|
||||
pub fn parse_units(&mut self) -> Vec<Pou> {
|
||||
let mut pous = Vec::new();
|
||||
while !self.at_end() {
|
||||
match self.peek() {
|
||||
Tok::Kw(K::Program) => {
|
||||
self.advance();
|
||||
if let Some(p) = self.parse_pou(PouKind::Program, K::EndProgram) {
|
||||
pous.push(p);
|
||||
}
|
||||
}
|
||||
Tok::Kw(K::Function) => {
|
||||
self.advance();
|
||||
if let Some(p) = self.parse_pou(PouKind::Function, K::EndFunction) {
|
||||
pous.push(p);
|
||||
}
|
||||
}
|
||||
Tok::Kw(K::FunctionBlock) => {
|
||||
self.advance();
|
||||
if let Some(p) = self.parse_pou(PouKind::FunctionBlock, K::EndFunctionBlock) {
|
||||
pous.push(p);
|
||||
}
|
||||
}
|
||||
// Skip TYPE...END_TYPE and anything else at top level.
|
||||
_ => {
|
||||
self.advance();
|
||||
}
|
||||
}
|
||||
}
|
||||
pous
|
||||
}
|
||||
|
||||
fn parse_pou(&mut self, kind: PouKind, end: K) -> Option<Pou> {
|
||||
let line = self.line();
|
||||
let name = self.ident().unwrap_or_else(|| "<anonymous>".to_string());
|
||||
// Optional `: return_type` for functions.
|
||||
if self.eat(&Tok::Colon) {
|
||||
let _ = self.advance(); // return type token
|
||||
}
|
||||
|
||||
let mut vars = Vec::new();
|
||||
// Variable sections precede the body.
|
||||
while let Some(section) = self.var_section_kw() {
|
||||
self.advance();
|
||||
let _ = self.eat_kw(K::Constant); // CONSTANT is informational for our rules
|
||||
self.parse_var_decls(section, &mut vars);
|
||||
}
|
||||
|
||||
// Body statements until END_<kind>.
|
||||
let mut body = Vec::new();
|
||||
while !self.at_end() && !self.at_kw(end) {
|
||||
if let Some(s) = self.parse_stmt() {
|
||||
body.push(s);
|
||||
}
|
||||
}
|
||||
self.eat_kw(end);
|
||||
|
||||
Some(Pou {
|
||||
name,
|
||||
kind,
|
||||
vars,
|
||||
body,
|
||||
line,
|
||||
})
|
||||
}
|
||||
|
||||
fn var_section_kw(&self) -> Option<VarSection> {
|
||||
match self.peek() {
|
||||
Tok::Kw(K::Var) => Some(VarSection::Var),
|
||||
Tok::Kw(K::VarInput) => Some(VarSection::Input),
|
||||
Tok::Kw(K::VarOutput) => Some(VarSection::Output),
|
||||
Tok::Kw(K::VarInOut) => Some(VarSection::InOut),
|
||||
Tok::Kw(K::VarGlobal) => Some(VarSection::Global),
|
||||
Tok::Kw(K::VarTemp) => Some(VarSection::Temp),
|
||||
Tok::Kw(K::VarExternal) => Some(VarSection::External),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_var_decls(&mut self, section: VarSection, out: &mut Vec<VarDecl>) {
|
||||
while !self.at_end() && !self.at_kw(K::EndVar) {
|
||||
let line = self.line();
|
||||
// names: a, b, c
|
||||
let mut names = Vec::new();
|
||||
match self.ident() {
|
||||
Some(n) => names.push(n),
|
||||
None => {
|
||||
// Not a declaration we understand — skip to next ; or END_VAR.
|
||||
self.sync_decl();
|
||||
continue;
|
||||
}
|
||||
}
|
||||
while self.eat(&Tok::Comma) {
|
||||
if let Some(n) = self.ident() {
|
||||
names.push(n);
|
||||
}
|
||||
}
|
||||
if !self.eat(&Tok::Colon) {
|
||||
self.sync_decl();
|
||||
continue;
|
||||
}
|
||||
let (type_name, array_bounds) = self.parse_type();
|
||||
let init = if self.eat(&Tok::Assign) {
|
||||
Some(self.parse_expr())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
self.eat(&Tok::Semi);
|
||||
for n in names {
|
||||
out.push(VarDecl {
|
||||
name: n,
|
||||
section,
|
||||
type_name: type_name.clone(),
|
||||
array_bounds,
|
||||
init: init.clone(),
|
||||
line,
|
||||
});
|
||||
}
|
||||
}
|
||||
self.eat_kw(K::EndVar);
|
||||
}
|
||||
|
||||
/// Parse a (possibly ARRAY) type, returning its rendered name and literal
|
||||
/// bounds when present.
|
||||
fn parse_type(&mut self) -> (String, Option<(i64, i64)>) {
|
||||
if self.eat_kw(K::Array) {
|
||||
let mut bounds = None;
|
||||
if self.eat(&Tok::LBrack) {
|
||||
let lo = self.int_lit();
|
||||
self.eat(&Tok::DotDot);
|
||||
let hi = self.int_lit();
|
||||
if let (Some(lo), Some(hi)) = (lo, hi) {
|
||||
bounds = Some((lo, hi));
|
||||
}
|
||||
// Skip any further dimensions / tokens to the closing bracket.
|
||||
while !self.at_end() && !self.eat(&Tok::RBrack) {
|
||||
self.advance();
|
||||
}
|
||||
}
|
||||
self.eat_kw(K::Of);
|
||||
let elem = self.type_ident();
|
||||
(format!("ARRAY OF {elem}"), bounds)
|
||||
} else {
|
||||
(self.type_ident(), None)
|
||||
}
|
||||
}
|
||||
|
||||
fn type_ident(&mut self) -> String {
|
||||
// Types can be qualified idents; keep it simple: one token, plus any
|
||||
// string-length suffix like STRING[80].
|
||||
let base = match self.advance() {
|
||||
Tok::Ident(s) => s,
|
||||
Tok::Kw(_) => "TYPE".to_string(),
|
||||
other => format!("{other:?}"),
|
||||
};
|
||||
if self.eat(&Tok::LBrack) {
|
||||
while !self.at_end() && !self.eat(&Tok::RBrack) {
|
||||
self.advance();
|
||||
}
|
||||
}
|
||||
base
|
||||
}
|
||||
|
||||
fn int_lit(&mut self) -> Option<i64> {
|
||||
match self.peek() {
|
||||
Tok::Int(n) => {
|
||||
let n = *n;
|
||||
self.advance();
|
||||
Some(n)
|
||||
}
|
||||
Tok::Minus => {
|
||||
self.advance();
|
||||
if let Tok::Int(n) = self.peek() {
|
||||
let n = -*n;
|
||||
self.advance();
|
||||
Some(n)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn sync_decl(&mut self) {
|
||||
while !self.at_end() && !self.eat(&Tok::Semi) && !self.at_kw(K::EndVar) {
|
||||
self.advance();
|
||||
}
|
||||
}
|
||||
fn sync_stmt(&mut self) {
|
||||
while !self.at_end() && !self.eat(&Tok::Semi) {
|
||||
// Stop at block terminators so recovery doesn't swallow structure.
|
||||
if matches!(
|
||||
self.peek(),
|
||||
Tok::Kw(
|
||||
K::EndIf
|
||||
| K::EndFor
|
||||
| K::EndWhile
|
||||
| K::EndCase
|
||||
| K::EndRepeat
|
||||
| K::EndProgram
|
||||
| K::EndFunction
|
||||
| K::EndFunctionBlock
|
||||
| K::Else
|
||||
| K::Elsif
|
||||
)
|
||||
) {
|
||||
return;
|
||||
}
|
||||
self.advance();
|
||||
}
|
||||
}
|
||||
|
||||
// ── statements ─────────────────────────────────────────────────
|
||||
fn parse_stmt(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
match self.peek().clone() {
|
||||
Tok::Semi => {
|
||||
self.advance();
|
||||
None
|
||||
}
|
||||
Tok::Kw(K::If) => self.parse_if(),
|
||||
Tok::Kw(K::Case) => self.parse_case(),
|
||||
Tok::Kw(K::For) => self.parse_for(),
|
||||
Tok::Kw(K::While) => self.parse_while(),
|
||||
Tok::Kw(K::Repeat) => self.parse_repeat(),
|
||||
Tok::Kw(K::Return) => {
|
||||
self.advance();
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Return { line })
|
||||
}
|
||||
Tok::Kw(K::Exit) => {
|
||||
self.advance();
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Exit { line })
|
||||
}
|
||||
Tok::Kw(K::Jmp) => {
|
||||
self.advance();
|
||||
let label = self.ident().unwrap_or_default();
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Jump { label, line })
|
||||
}
|
||||
Tok::Ident(name) => {
|
||||
// Could be `label:`, `call(...)`, or an assignment.
|
||||
// Lookahead: ident ':' (not ':=') → label.
|
||||
if matches!(
|
||||
self.toks.get(self.pos + 1).map(|t| &t.kind),
|
||||
Some(Tok::Colon)
|
||||
) && !matches!(self.toks.get(self.pos + 2).map(|t| &t.kind), Some(Tok::Eq))
|
||||
{
|
||||
self.advance(); // ident
|
||||
self.advance(); // ':'
|
||||
return Some(Stmt::Label { name, line });
|
||||
}
|
||||
let lhs = self.parse_expr();
|
||||
if self.eat(&Tok::Assign) {
|
||||
let value = self.parse_expr();
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Assign {
|
||||
target: lhs,
|
||||
value,
|
||||
line,
|
||||
})
|
||||
} else if let Expr::Call { callee, args, .. } = lhs {
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Call { callee, args, line })
|
||||
} else {
|
||||
// Bare expression / FB invocation without args recognized —
|
||||
// skip to the terminator.
|
||||
self.sync_stmt();
|
||||
None
|
||||
}
|
||||
}
|
||||
_ => {
|
||||
self.sync_stmt();
|
||||
None
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_block_until(&mut self, terms: &[K]) -> Vec<Stmt> {
|
||||
let mut body = Vec::new();
|
||||
while !self.at_end() && !terms.iter().any(|k| self.at_kw(*k)) {
|
||||
if let Some(s) = self.parse_stmt() {
|
||||
body.push(s);
|
||||
}
|
||||
}
|
||||
body
|
||||
}
|
||||
|
||||
fn parse_if(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
self.eat_kw(K::If);
|
||||
let mut branches = Vec::new();
|
||||
let cond = self.parse_expr();
|
||||
self.eat_kw(K::Then);
|
||||
let body = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
|
||||
branches.push((cond, body));
|
||||
while self.eat_kw(K::Elsif) {
|
||||
let c = self.parse_expr();
|
||||
self.eat_kw(K::Then);
|
||||
let b = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
|
||||
branches.push((c, b));
|
||||
}
|
||||
let else_body = if self.eat_kw(K::Else) {
|
||||
Some(self.parse_block_until(&[K::EndIf]))
|
||||
} else {
|
||||
None
|
||||
};
|
||||
self.eat_kw(K::EndIf);
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::If {
|
||||
branches,
|
||||
else_body,
|
||||
line,
|
||||
})
|
||||
}
|
||||
|
||||
fn parse_case(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
self.eat_kw(K::Case);
|
||||
let selector = self.parse_expr();
|
||||
self.eat_kw(K::Of);
|
||||
let mut arms = Vec::new();
|
||||
let mut else_body = None;
|
||||
while !self.at_end() && !self.at_kw(K::EndCase) {
|
||||
if self.eat_kw(K::Else) {
|
||||
else_body = Some(self.parse_block_until(&[K::EndCase]));
|
||||
break;
|
||||
}
|
||||
// labels: expr {, expr} :
|
||||
let mut labels = vec![self.parse_expr()];
|
||||
while self.eat(&Tok::Comma) {
|
||||
labels.push(self.parse_expr());
|
||||
}
|
||||
self.eat(&Tok::Colon);
|
||||
let body = self.parse_block_until(&[K::EndCase, K::Else]);
|
||||
arms.push((labels, body));
|
||||
}
|
||||
self.eat_kw(K::EndCase);
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Case {
|
||||
selector,
|
||||
arms,
|
||||
else_body,
|
||||
line,
|
||||
})
|
||||
}
|
||||
|
||||
fn parse_for(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
self.eat_kw(K::For);
|
||||
let var = self.ident().unwrap_or_default();
|
||||
self.eat(&Tok::Assign);
|
||||
let from = self.parse_expr();
|
||||
self.eat_kw(K::To);
|
||||
let to = self.parse_expr();
|
||||
let by = if self.eat_kw(K::By) {
|
||||
Some(self.parse_expr())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
self.eat_kw(K::Do);
|
||||
let body = self.parse_block_until(&[K::EndFor]);
|
||||
self.eat_kw(K::EndFor);
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::For {
|
||||
var,
|
||||
from,
|
||||
to,
|
||||
by,
|
||||
body,
|
||||
line,
|
||||
})
|
||||
}
|
||||
|
||||
fn parse_while(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
self.eat_kw(K::While);
|
||||
let cond = self.parse_expr();
|
||||
self.eat_kw(K::Do);
|
||||
let body = self.parse_block_until(&[K::EndWhile]);
|
||||
self.eat_kw(K::EndWhile);
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::While { cond, body, line })
|
||||
}
|
||||
|
||||
fn parse_repeat(&mut self) -> Option<Stmt> {
|
||||
let line = self.line();
|
||||
self.eat_kw(K::Repeat);
|
||||
let body = self.parse_block_until(&[K::Until, K::EndRepeat]);
|
||||
self.eat_kw(K::Until);
|
||||
let until = self.parse_expr();
|
||||
self.eat_kw(K::EndRepeat);
|
||||
self.eat(&Tok::Semi);
|
||||
Some(Stmt::Repeat { body, until, line })
|
||||
}
|
||||
|
||||
// ── expressions (precedence climbing) ──────────────────────────
|
||||
pub fn parse_expr(&mut self) -> Expr {
|
||||
self.parse_or()
|
||||
}
|
||||
|
||||
fn parse_or(&mut self) -> Expr {
|
||||
let mut lhs = self.parse_and();
|
||||
loop {
|
||||
let op = match self.peek() {
|
||||
Tok::Kw(K::Or) => BinOp::Or,
|
||||
Tok::Kw(K::Xor) => BinOp::Xor,
|
||||
_ => break,
|
||||
};
|
||||
let line = self.line();
|
||||
self.advance();
|
||||
let rhs = self.parse_and();
|
||||
lhs = Expr::Binary {
|
||||
op,
|
||||
lhs: Box::new(lhs),
|
||||
rhs: Box::new(rhs),
|
||||
line,
|
||||
};
|
||||
}
|
||||
lhs
|
||||
}
|
||||
|
||||
fn parse_and(&mut self) -> Expr {
|
||||
let mut lhs = self.parse_cmp();
|
||||
while matches!(self.peek(), Tok::Kw(K::And) | Tok::Amp) {
|
||||
let op = BinOp::And;
|
||||
let line = self.line();
|
||||
self.advance();
|
||||
let rhs = self.parse_cmp();
|
||||
lhs = Expr::Binary {
|
||||
op,
|
||||
lhs: Box::new(lhs),
|
||||
rhs: Box::new(rhs),
|
||||
line,
|
||||
};
|
||||
}
|
||||
lhs
|
||||
}
|
||||
|
||||
fn parse_cmp(&mut self) -> Expr {
|
||||
let mut lhs = self.parse_add();
|
||||
loop {
|
||||
let op = match self.peek() {
|
||||
Tok::Eq => BinOp::Eq,
|
||||
Tok::Ne => BinOp::Ne,
|
||||
Tok::Lt => BinOp::Lt,
|
||||
Tok::Le => BinOp::Le,
|
||||
Tok::Gt => BinOp::Gt,
|
||||
Tok::Ge => BinOp::Ge,
|
||||
_ => break,
|
||||
};
|
||||
let line = self.line();
|
||||
self.advance();
|
||||
let rhs = self.parse_add();
|
||||
lhs = Expr::Binary {
|
||||
op,
|
||||
lhs: Box::new(lhs),
|
||||
rhs: Box::new(rhs),
|
||||
line,
|
||||
};
|
||||
}
|
||||
lhs
|
||||
}
|
||||
|
||||
fn parse_add(&mut self) -> Expr {
|
||||
let mut lhs = self.parse_mul();
|
||||
loop {
|
||||
let op = match self.peek() {
|
||||
Tok::Plus => BinOp::Add,
|
||||
Tok::Minus => BinOp::Sub,
|
||||
_ => break,
|
||||
};
|
||||
let line = self.line();
|
||||
self.advance();
|
||||
let rhs = self.parse_mul();
|
||||
lhs = Expr::Binary {
|
||||
op,
|
||||
lhs: Box::new(lhs),
|
||||
rhs: Box::new(rhs),
|
||||
line,
|
||||
};
|
||||
}
|
||||
lhs
|
||||
}
|
||||
|
||||
fn parse_mul(&mut self) -> Expr {
|
||||
let mut lhs = self.parse_unary();
|
||||
loop {
|
||||
let op = match self.peek() {
|
||||
Tok::Star => BinOp::Mul,
|
||||
Tok::Slash => BinOp::Div,
|
||||
Tok::Kw(K::Mod) => BinOp::Mod,
|
||||
Tok::Power => BinOp::Pow,
|
||||
_ => break,
|
||||
};
|
||||
let line = self.line();
|
||||
self.advance();
|
||||
let rhs = self.parse_unary();
|
||||
lhs = Expr::Binary {
|
||||
op,
|
||||
lhs: Box::new(lhs),
|
||||
rhs: Box::new(rhs),
|
||||
line,
|
||||
};
|
||||
}
|
||||
lhs
|
||||
}
|
||||
|
||||
fn parse_unary(&mut self) -> Expr {
|
||||
let line = self.line();
|
||||
match self.peek() {
|
||||
Tok::Kw(K::Not) => {
|
||||
self.advance();
|
||||
Expr::Unary {
|
||||
op: UnOp::Not,
|
||||
expr: Box::new(self.parse_unary()),
|
||||
line,
|
||||
}
|
||||
}
|
||||
Tok::Minus => {
|
||||
self.advance();
|
||||
Expr::Unary {
|
||||
op: UnOp::Neg,
|
||||
expr: Box::new(self.parse_unary()),
|
||||
line,
|
||||
}
|
||||
}
|
||||
_ => self.parse_postfix(),
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_postfix(&mut self) -> Expr {
|
||||
let mut e = self.parse_primary();
|
||||
loop {
|
||||
let line = self.line();
|
||||
match self.peek() {
|
||||
Tok::LBrack => {
|
||||
self.advance();
|
||||
let index = self.parse_expr();
|
||||
self.eat(&Tok::RBrack);
|
||||
e = Expr::Index {
|
||||
base: Box::new(e),
|
||||
index: Box::new(index),
|
||||
line,
|
||||
};
|
||||
}
|
||||
Tok::Dot => {
|
||||
self.advance();
|
||||
let field = self.ident().unwrap_or_default();
|
||||
e = Expr::Member {
|
||||
base: Box::new(e),
|
||||
field,
|
||||
line,
|
||||
};
|
||||
}
|
||||
_ => break,
|
||||
}
|
||||
}
|
||||
e
|
||||
}
|
||||
|
||||
fn parse_primary(&mut self) -> Expr {
|
||||
let line = self.line();
|
||||
match self.advance() {
|
||||
Tok::Int(n) => Expr::Int(n, line),
|
||||
Tok::Real(r) => Expr::Real(r, line),
|
||||
Tok::Bool(b) => Expr::Bool(b, line),
|
||||
Tok::Str(s) => Expr::Str(s, line),
|
||||
Tok::Time(t) => Expr::Time(t, line),
|
||||
Tok::LParen => {
|
||||
let e = self.parse_expr();
|
||||
self.eat(&Tok::RParen);
|
||||
e
|
||||
}
|
||||
Tok::Ident(name) => {
|
||||
if self.eat(&Tok::LParen) {
|
||||
let args = self.parse_call_args();
|
||||
Expr::Call {
|
||||
callee: name,
|
||||
args,
|
||||
line,
|
||||
}
|
||||
} else {
|
||||
Expr::Ident(name, line)
|
||||
}
|
||||
}
|
||||
// Unrecognized start of expression — yield a placeholder identifier.
|
||||
_ => Expr::Ident(String::new(), line),
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_call_args(&mut self) -> Vec<CallArg> {
|
||||
let mut args = Vec::new();
|
||||
if self.eat(&Tok::RParen) {
|
||||
return args;
|
||||
}
|
||||
loop {
|
||||
// Named arg: ident := expr (peek two tokens).
|
||||
if let Tok::Ident(name) = self.peek().clone() {
|
||||
if matches!(
|
||||
self.toks.get(self.pos + 1).map(|t| &t.kind),
|
||||
Some(Tok::Assign)
|
||||
) {
|
||||
self.advance(); // ident
|
||||
self.advance(); // :=
|
||||
let value = self.parse_expr();
|
||||
args.push(CallArg {
|
||||
name: Some(name),
|
||||
value,
|
||||
});
|
||||
if self.eat(&Tok::Comma) {
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
let value = self.parse_expr();
|
||||
args.push(CallArg { name: None, value });
|
||||
if self.eat(&Tok::Comma) {
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
self.eat(&Tok::RParen);
|
||||
args
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse ST source into its POUs.
|
||||
pub fn parse(src: &str) -> Vec<Pou> {
|
||||
let toks = super::lexer::lex(src);
|
||||
Parser::new(toks).parse_units()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const SAMPLE: &str = r#"
|
||||
PROGRAM Main
|
||||
VAR
|
||||
idx : INT;
|
||||
pw : STRING := 'admin123';
|
||||
buf : ARRAY[0..9] OF INT;
|
||||
ok : BOOL := FALSE;
|
||||
END_VAR
|
||||
// a comment
|
||||
IF idx > 0 THEN
|
||||
buf[idx] := idx * 2;
|
||||
ELSE
|
||||
JMP done;
|
||||
END_IF;
|
||||
Comm(IP := '10.0.0.1', PORT := 502);
|
||||
done:
|
||||
ok := TRUE;
|
||||
END_PROGRAM
|
||||
"#;
|
||||
|
||||
#[test]
|
||||
fn parses_program_vars_and_body() {
|
||||
let pous = parse(SAMPLE);
|
||||
assert_eq!(pous.len(), 1, "one POU");
|
||||
let p = &pous[0];
|
||||
assert_eq!(p.name, "Main");
|
||||
assert_eq!(p.kind, PouKind::Program);
|
||||
// vars: idx, pw, buf, ok
|
||||
assert_eq!(p.vars.len(), 4);
|
||||
let pw = p.vars.iter().find(|v| v.name == "pw").expect("pw");
|
||||
assert!(matches!(&pw.init, Some(Expr::Str(s, _)) if s == "admin123"));
|
||||
let buf = p.vars.iter().find(|v| v.name == "buf").expect("buf");
|
||||
assert_eq!(buf.array_bounds, Some((0, 9)));
|
||||
// body has an IF, a Call, a Label, and an Assign
|
||||
assert!(p.body.iter().any(|s| matches!(s, Stmt::If { .. })));
|
||||
assert!(p
|
||||
.body
|
||||
.iter()
|
||||
.any(|s| matches!(s, Stmt::Call { callee, .. } if callee == "Comm")));
|
||||
assert!(p
|
||||
.body
|
||||
.iter()
|
||||
.any(|s| matches!(s, Stmt::Label { name, .. } if name == "done")));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn jmp_inside_if_is_captured() {
|
||||
let pous = parse(SAMPLE);
|
||||
let p = &pous[0];
|
||||
// find the IF, check its else branch has a JMP
|
||||
let has_jmp = p.body.iter().any(|s| match s {
|
||||
Stmt::If { else_body, .. } => else_body
|
||||
.as_ref()
|
||||
.map(|b| b.iter().any(|s| matches!(s, Stmt::Jump { .. })))
|
||||
.unwrap_or(false),
|
||||
_ => false,
|
||||
});
|
||||
assert!(has_jmp, "JMP should be parsed inside the ELSE branch");
|
||||
}
|
||||
}
|
||||
@@ -1,418 +0,0 @@
|
||||
//! PLCopen XML → Structured Text POUs.
|
||||
//!
|
||||
//! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
|
||||
//! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
|
||||
//! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
|
||||
//! each POU (a `VAR` block from the interface + statements from the body) and run
|
||||
//! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
|
||||
//! graphical — flow through one analysis path.
|
||||
//!
|
||||
//! Body languages:
|
||||
//! - **ST** — taken verbatim.
|
||||
//! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
|
||||
//! become calls (`TypeName(pin := arg, …)`), out-variables / coils become
|
||||
//! assignments, with input pins resolved by tracing connections. This lets the
|
||||
//! semantic rules see comm calls, hardcoded arguments and safety writes that
|
||||
//! live in graphical logic, not just in text.
|
||||
//! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
|
||||
//! embedded in its actions and transitions are still translated.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use roxmltree::Node;
|
||||
|
||||
use super::ast::Pou;
|
||||
use super::parser;
|
||||
|
||||
/// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
|
||||
pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
|
||||
let doc = match roxmltree::Document::parse(xml) {
|
||||
Ok(d) => d,
|
||||
Err(_) => return Vec::new(),
|
||||
};
|
||||
let mut pous = Vec::new();
|
||||
for pou in doc.descendants().filter(|n| n.has_tag_name("pou")) {
|
||||
let name = pou.attribute("name").unwrap_or("pou").to_string();
|
||||
let pou_type = pou.attribute("pouType").unwrap_or("program");
|
||||
|
||||
let Some(body) = reconstruct_body(pou) else {
|
||||
continue;
|
||||
};
|
||||
if body.trim().is_empty() {
|
||||
continue;
|
||||
}
|
||||
|
||||
let var_block = build_var_block(pou);
|
||||
let kw = match pou_type.to_ascii_lowercase().as_str() {
|
||||
"function" => "FUNCTION",
|
||||
"functionblock" | "functionblocktype" => "FUNCTION_BLOCK",
|
||||
_ => "PROGRAM",
|
||||
};
|
||||
let synthetic = format!("{kw} {name}\n{var_block}{body}\nEND_{kw}\n");
|
||||
pous.extend(parser::parse(&synthetic));
|
||||
}
|
||||
pous
|
||||
}
|
||||
|
||||
/// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
|
||||
fn tag_is(n: &Node, name: &str) -> bool {
|
||||
n.tag_name().name().eq_ignore_ascii_case(name)
|
||||
}
|
||||
|
||||
/// Reconstruct a POU's body as Structured Text, whatever language it is written
|
||||
/// in. Concatenates every language body found under `<body>` (SFC actions and
|
||||
/// transitions carry their own ST/FBD/LD sub-bodies).
|
||||
fn reconstruct_body(pou: Node) -> Option<String> {
|
||||
let mut out = String::new();
|
||||
for body in pou.descendants().filter(|n| tag_is(n, "body")) {
|
||||
for lang in body.children().filter(|n| n.is_element()) {
|
||||
let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
|
||||
"ST" | "IL" => collect_text(lang),
|
||||
"FBD" | "LD" => translate_network(lang),
|
||||
_ => continue,
|
||||
};
|
||||
if !piece.trim().is_empty() {
|
||||
out.push_str(&piece);
|
||||
if !piece.ends_with('\n') {
|
||||
out.push('\n');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if out.trim().is_empty() {
|
||||
None
|
||||
} else {
|
||||
Some(out)
|
||||
}
|
||||
}
|
||||
|
||||
// ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
|
||||
|
||||
/// Translate one FBD/LD network into ST statements: blocks → calls,
|
||||
/// out-variables and coils → assignments.
|
||||
fn translate_network(net: Node) -> String {
|
||||
let by_id = index_local_ids(net);
|
||||
let mut out = String::new();
|
||||
for el in net.children().filter(|n| n.is_element()) {
|
||||
let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
|
||||
"block" => block_call(el, &by_id).map(|c| format!("{c};")),
|
||||
"outvariable" => out_assignment(el, &by_id),
|
||||
"coil" => coil_assignment(el, &by_id),
|
||||
_ => None,
|
||||
};
|
||||
if let Some(s) = stmt {
|
||||
out.push_str(&s);
|
||||
out.push('\n');
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Index every element in a network by its `localId` so connections resolve.
|
||||
fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
|
||||
net.descendants()
|
||||
.filter(|n| n.is_element())
|
||||
.filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Build a call expression for a block: `TypeName(pin := arg, …)`.
|
||||
fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
|
||||
let ty = block.attribute("typeName")?;
|
||||
let mut args = Vec::new();
|
||||
if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
|
||||
for v in inputs.children().filter(|n| tag_is(n, "variable")) {
|
||||
let Some(expr) = input_expr(v, by_id, 0) else {
|
||||
continue;
|
||||
};
|
||||
match v.attribute("formalParameter") {
|
||||
Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
|
||||
_ => args.push(expr),
|
||||
}
|
||||
}
|
||||
}
|
||||
Some(format!("{ty}({})", args.join(", ")))
|
||||
}
|
||||
|
||||
/// `target := <traced expression>;` for an FBD out-variable.
|
||||
fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
|
||||
let target = expression_text(outvar)?;
|
||||
let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
|
||||
Some(format!("{target} := {value};"))
|
||||
}
|
||||
|
||||
/// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
|
||||
fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
|
||||
let target = child_text(coil, "variable")?;
|
||||
let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
|
||||
let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
|
||||
let rhs = if negated {
|
||||
format!("NOT ({rung})")
|
||||
} else {
|
||||
rung
|
||||
};
|
||||
Some(format!("{target} := {rhs};"))
|
||||
}
|
||||
|
||||
/// Resolve the expression feeding `node`'s single input connection.
|
||||
fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
|
||||
let refid = ref_local_id(node)?;
|
||||
Some(expr_for(&refid, by_id, depth))
|
||||
}
|
||||
|
||||
/// Build the ST expression produced by the element with this `localId`.
|
||||
fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
|
||||
if depth > 24 {
|
||||
return "0".to_string();
|
||||
}
|
||||
let Some(node) = by_id.get(local_id) else {
|
||||
return format!("__net{local_id}");
|
||||
};
|
||||
match node.tag_name().name().to_ascii_lowercase().as_str() {
|
||||
"invariable" | "inoutvariable" => {
|
||||
expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
|
||||
}
|
||||
// A block feeding another element: reference it by a synthetic result
|
||||
// name; the block is emitted as its own call statement, so we neither
|
||||
// duplicate the call nor lose it.
|
||||
"block" => format!("__blk{local_id}"),
|
||||
"contact" => {
|
||||
let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
|
||||
let negated =
|
||||
matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
|
||||
let term = if negated { format!("NOT {var}") } else { var };
|
||||
match ref_local_id(*node) {
|
||||
Some(up) => {
|
||||
let upstream = expr_for(&up, by_id, depth + 1);
|
||||
if upstream == "TRUE" {
|
||||
term
|
||||
} else {
|
||||
format!("({upstream} AND {term})")
|
||||
}
|
||||
}
|
||||
None => term,
|
||||
}
|
||||
}
|
||||
"leftpowerrail" => "TRUE".to_string(),
|
||||
_ => format!("__net{local_id}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// The `refLocalId` of `node`'s first input connection, if any.
|
||||
fn ref_local_id(node: Node) -> Option<String> {
|
||||
node.descendants()
|
||||
.find(|n| tag_is(n, "connectionPointIn"))
|
||||
.and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
|
||||
.and_then(|c| c.attribute("refLocalId"))
|
||||
.map(|s| s.to_string())
|
||||
}
|
||||
|
||||
/// Text of a node's `<expression>` child (variable name or literal).
|
||||
fn expression_text(node: Node) -> Option<String> {
|
||||
let e = node.children().find(|n| tag_is(n, "expression"))?;
|
||||
let t = collect_text(e).trim().to_string();
|
||||
if t.is_empty() {
|
||||
None
|
||||
} else {
|
||||
Some(t)
|
||||
}
|
||||
}
|
||||
|
||||
/// Text of a named child element (e.g. `<variable>` of a contact/coil).
|
||||
fn child_text(node: Node, name: &str) -> Option<String> {
|
||||
let c = node.children().find(|n| tag_is(n, name))?;
|
||||
let t = collect_text(c).trim().to_string();
|
||||
if t.is_empty() {
|
||||
None
|
||||
} else {
|
||||
Some(t)
|
||||
}
|
||||
}
|
||||
|
||||
/// Concatenate the text of a node's descendant text nodes (bodies are often
|
||||
/// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
|
||||
/// gathered: an element's `.text()` would re-yield its first child's text, which
|
||||
/// (with the text node itself) would duplicate every value.
|
||||
fn collect_text(node: Node) -> String {
|
||||
node.descendants()
|
||||
.filter(|n| n.is_text())
|
||||
.filter_map(|n| n.text())
|
||||
.collect::<String>()
|
||||
}
|
||||
|
||||
/// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
|
||||
/// sections, so declarations (types, initial values) reach the rules.
|
||||
fn build_var_block(pou: Node) -> String {
|
||||
let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
|
||||
return String::new();
|
||||
};
|
||||
let mut out = String::from("VAR\n");
|
||||
let mut any = false;
|
||||
for container in interface.children().filter(|n| n.is_element()) {
|
||||
// localVars / inputVars / outputVars / inOutVars / tempVars / globalVars / externalVars
|
||||
if !container.tag_name().name().ends_with("Vars") {
|
||||
continue;
|
||||
}
|
||||
for var in container.children().filter(|n| n.has_tag_name("variable")) {
|
||||
let Some(vname) = var.attribute("name") else {
|
||||
continue;
|
||||
};
|
||||
let ty = var
|
||||
.children()
|
||||
.find(|n| n.has_tag_name("type"))
|
||||
.map(type_name)
|
||||
.unwrap_or_else(|| "BOOL".to_string());
|
||||
let init = var
|
||||
.children()
|
||||
.find(|n| n.has_tag_name("initialValue"))
|
||||
.and_then(initial_value);
|
||||
match init {
|
||||
Some(v) => out.push_str(&format!(" {vname} : {ty} := {v};\n")),
|
||||
None => out.push_str(&format!(" {vname} : {ty};\n")),
|
||||
}
|
||||
any = true;
|
||||
}
|
||||
}
|
||||
out.push_str("END_VAR\n");
|
||||
if any {
|
||||
out
|
||||
} else {
|
||||
String::new()
|
||||
}
|
||||
}
|
||||
|
||||
/// Render a PLCopen `<type>` element as an ST type string.
|
||||
fn type_name(type_node: Node) -> String {
|
||||
let Some(inner) = type_node.children().find(|n| n.is_element()) else {
|
||||
return "BOOL".to_string();
|
||||
};
|
||||
let tag = inner.tag_name().name();
|
||||
match tag {
|
||||
"derived" => inner.attribute("name").unwrap_or("DERIVED").to_string(),
|
||||
"array" => {
|
||||
let dim = inner.children().find(|n| n.has_tag_name("dimension"));
|
||||
let (lo, hi) = dim
|
||||
.map(|d| {
|
||||
(
|
||||
d.attribute("lower").unwrap_or("0").to_string(),
|
||||
d.attribute("upper").unwrap_or("0").to_string(),
|
||||
)
|
||||
})
|
||||
.unwrap_or_else(|| ("0".to_string(), "0".to_string()));
|
||||
let base = inner
|
||||
.children()
|
||||
.find(|n| n.has_tag_name("baseType"))
|
||||
.map(type_name)
|
||||
.unwrap_or_else(|| "INT".to_string());
|
||||
format!("ARRAY[{lo}..{hi}] OF {base}")
|
||||
}
|
||||
"string" | "wstring" => "STRING".to_string(),
|
||||
// BOOL, INT, DINT, REAL, TIME, ... — the tag name is the ST type.
|
||||
other => other.to_ascii_uppercase(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Extract an initial value as an ST literal (quoting strings).
|
||||
fn initial_value(iv: Node) -> Option<String> {
|
||||
let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
|
||||
let raw = simple.attribute("value")?.trim().to_string();
|
||||
if raw.is_empty() {
|
||||
return None;
|
||||
}
|
||||
// Numbers / booleans / time literals pass through; everything else is a
|
||||
// string literal.
|
||||
let is_scalar = raw.eq_ignore_ascii_case("true")
|
||||
|| raw.eq_ignore_ascii_case("false")
|
||||
|| raw.starts_with(['T', 't', 'D', 'd']) && raw.contains('#')
|
||||
|| raw
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_digit() || c == '.' || c == '-' || c == '+');
|
||||
if is_scalar || raw.starts_with('\'') || raw.starts_with('"') {
|
||||
Some(raw)
|
||||
} else {
|
||||
Some(format!("'{}'", raw.replace('\'', "''")))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::parse_plcopen;
|
||||
use crate::pipeline::plc::rules;
|
||||
use std::collections::HashSet;
|
||||
|
||||
fn rule_ids(xml: &str) -> HashSet<&'static str> {
|
||||
parse_plcopen(xml)
|
||||
.iter()
|
||||
.flat_map(rules::analyze)
|
||||
.map(|h| h.rule_id)
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
|
||||
/// insecure comm block. Coils/contacts translate to assignments; the block
|
||||
/// translates to a call so the port rule fires.
|
||||
#[test]
|
||||
fn ld_coil_and_block_translate_and_are_analysed() {
|
||||
let xml = r#"<?xml version="1.0"?>
|
||||
<project xmlns="http://www.plcopen.org/xml/tc6_0201">
|
||||
<types><pous>
|
||||
<pou name="Rung" pouType="program">
|
||||
<interface><localVars>
|
||||
<variable name="Motor"><type><BOOL/></type></variable>
|
||||
</localVars></interface>
|
||||
<body><LD>
|
||||
<leftPowerRail localId="0"/>
|
||||
<contact localId="1"><variable>Start</variable>
|
||||
<connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
|
||||
<coil localId="2"><variable>Motor</variable>
|
||||
<connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
|
||||
<inVariable localId="3"><expression>21</expression></inVariable>
|
||||
<inVariable localId="4"><expression>FALSE</expression></inVariable>
|
||||
<block localId="10" typeName="Ftp_Send">
|
||||
<inputVariables>
|
||||
<variable formalParameter="PORT">
|
||||
<connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
|
||||
<variable formalParameter="ENCRYPT">
|
||||
<connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
|
||||
</inputVariables>
|
||||
</block>
|
||||
</LD></body>
|
||||
</pou>
|
||||
</pous></types>
|
||||
</project>"#;
|
||||
let ids = rule_ids(xml);
|
||||
// Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
|
||||
assert!(
|
||||
ids.contains("plc-insecure-protocol-port"),
|
||||
"LD block should flag port 21; got {ids:?}"
|
||||
);
|
||||
}
|
||||
|
||||
/// Doubled-text regression: a graphical expression must be extracted once,
|
||||
/// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
|
||||
#[test]
|
||||
fn graphical_expression_text_is_not_duplicated() {
|
||||
let xml = r#"<?xml version="1.0"?>
|
||||
<project xmlns="http://www.plcopen.org/xml/tc6_0201">
|
||||
<types><pous>
|
||||
<pou name="Comm" pouType="program">
|
||||
<body><FBD>
|
||||
<inVariable localId="1"><expression>502</expression></inVariable>
|
||||
<inVariable localId="2"><expression>FALSE</expression></inVariable>
|
||||
<block localId="10" typeName="Modbus_TCP_Master">
|
||||
<inputVariables>
|
||||
<variable formalParameter="PORT">
|
||||
<connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
|
||||
<variable formalParameter="AUTH">
|
||||
<connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
|
||||
</inputVariables>
|
||||
</block>
|
||||
</FBD></body>
|
||||
</pou>
|
||||
</pous></types>
|
||||
</project>"#;
|
||||
let ids = rule_ids(xml);
|
||||
assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
|
||||
assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
|
||||
}
|
||||
}
|
||||
@@ -1,632 +0,0 @@
|
||||
//! Semantic control-logic security rules over the Structured Text AST.
|
||||
//!
|
||||
//! Each rule walks the parsed [`Pou`] and yields [`RuleHit`]s the scanner turns
|
||||
//! into findings. Rules reason over structure (declarations, assignments, calls,
|
||||
//! array accesses, division, jumps) rather than raw text, so they see through
|
||||
//! formatting and comments.
|
||||
|
||||
use std::collections::{HashMap, HashSet};
|
||||
|
||||
use compliance_core::models::Severity;
|
||||
|
||||
use super::ast::*;
|
||||
|
||||
/// One rule match within a POU.
|
||||
pub struct RuleHit {
|
||||
pub line: u32,
|
||||
pub severity: Severity,
|
||||
pub rule_id: &'static str,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub cwe: Option<&'static str>,
|
||||
pub remediation: &'static str,
|
||||
}
|
||||
|
||||
/// Run every rule over a POU.
|
||||
pub fn analyze(pou: &Pou) -> Vec<RuleHit> {
|
||||
let mut hits = Vec::new();
|
||||
let ctx = Ctx::build(pou);
|
||||
|
||||
// Declaration-level rules.
|
||||
for v in &pou.vars {
|
||||
if let Some(init) = &v.init {
|
||||
check_credential_binding(&v.name, init, &pou.name, &mut hits);
|
||||
check_default_password(init, &v.name, &pou.name, &mut hits);
|
||||
}
|
||||
}
|
||||
|
||||
// Body walk.
|
||||
walk(&pou.body, pou, &ctx, &GuardSet::default(), &mut hits);
|
||||
hits
|
||||
}
|
||||
|
||||
/// Per-POU context precomputed once.
|
||||
struct Ctx {
|
||||
/// Names declared in VAR_INPUT (untrusted / externally driven).
|
||||
input_vars: HashSet<String>,
|
||||
/// Array variable name → declared (lo, hi) bounds.
|
||||
arrays: HashMap<String, (i64, i64)>,
|
||||
}
|
||||
|
||||
impl Ctx {
|
||||
fn build(pou: &Pou) -> Self {
|
||||
let mut input_vars = HashSet::new();
|
||||
let mut arrays = HashMap::new();
|
||||
for v in &pou.vars {
|
||||
if v.section == VarSection::Input {
|
||||
input_vars.insert(v.name.to_ascii_lowercase());
|
||||
}
|
||||
if let Some(b) = v.array_bounds {
|
||||
arrays.insert(v.name.to_ascii_lowercase(), b);
|
||||
}
|
||||
}
|
||||
Self { input_vars, arrays }
|
||||
}
|
||||
}
|
||||
|
||||
/// Variables proven non-zero on the current control-flow path (from enclosing
|
||||
/// `IF`/`WHILE` conditions), so guarded divisions aren't false-flagged.
|
||||
#[derive(Default, Clone)]
|
||||
struct GuardSet {
|
||||
nonzero: HashSet<String>,
|
||||
}
|
||||
|
||||
impl GuardSet {
|
||||
fn with(&self, names: Vec<String>) -> Self {
|
||||
let mut g = self.clone();
|
||||
g.nonzero.extend(names);
|
||||
g
|
||||
}
|
||||
fn is_nonzero(&self, name: &str) -> bool {
|
||||
self.nonzero.contains(name)
|
||||
}
|
||||
}
|
||||
|
||||
/// Variable names a condition proves non-zero (`v <> 0`, `v > 0`, `v >= 1`,
|
||||
/// `v < 0`, and conjunctions thereof).
|
||||
fn guards_from_cond(cond: &Expr) -> Vec<String> {
|
||||
let mut out = Vec::new();
|
||||
collect_nonzero(cond, &mut out);
|
||||
out
|
||||
}
|
||||
|
||||
fn collect_nonzero(e: &Expr, out: &mut Vec<String>) {
|
||||
let Expr::Binary { op, lhs, rhs, .. } = e else {
|
||||
return;
|
||||
};
|
||||
let is_zero = |x: &Expr| {
|
||||
matches!(x, Expr::Int(0, _)) || matches!(x, Expr::Real(r, _) if r.abs() < f64::EPSILON)
|
||||
};
|
||||
let int_of = |x: &Expr| match x {
|
||||
Expr::Int(n, _) => Some(*n),
|
||||
_ => None,
|
||||
};
|
||||
match op {
|
||||
BinOp::And => {
|
||||
collect_nonzero(lhs, out);
|
||||
collect_nonzero(rhs, out);
|
||||
}
|
||||
BinOp::Ne => {
|
||||
if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
|
||||
out.push(v.to_ascii_lowercase());
|
||||
}
|
||||
if let (true, Some(v)) = (is_zero(lhs), rhs.as_ident()) {
|
||||
out.push(v.to_ascii_lowercase());
|
||||
}
|
||||
}
|
||||
BinOp::Gt | BinOp::Lt => {
|
||||
// v > 0 or v < 0
|
||||
if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
|
||||
out.push(v.to_ascii_lowercase());
|
||||
}
|
||||
}
|
||||
BinOp::Ge => {
|
||||
// v >= n, n >= 1
|
||||
if let (Some(v), Some(n)) = (lhs.as_ident(), int_of(rhs)) {
|
||||
if n >= 1 {
|
||||
out.push(v.to_ascii_lowercase());
|
||||
}
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
|
||||
// ── the walker ─────────────────────────────────────────────────────
|
||||
fn walk(stmts: &[Stmt], pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
|
||||
for s in stmts {
|
||||
match s {
|
||||
Stmt::Assign {
|
||||
target,
|
||||
value,
|
||||
line,
|
||||
} => {
|
||||
check_safety_bypass(target, value, *line, &pou.name, hits);
|
||||
// A string bound to a secret-looking target is a credential.
|
||||
if let Some(name) = flatten_ident(target) {
|
||||
check_credential_binding(&name, value, &pou.name, hits);
|
||||
check_default_password(value, &name, &pou.name, hits);
|
||||
}
|
||||
walk_expr(target, pou, ctx, guards, hits);
|
||||
walk_expr(value, pou, ctx, guards, hits);
|
||||
}
|
||||
Stmt::Call { callee, args, line } => {
|
||||
check_insecure_comm(callee, args, *line, &pou.name, hits);
|
||||
check_credentials_in_call(callee, args, *line, &pou.name, hits);
|
||||
for a in args {
|
||||
walk_expr(&a.value, pou, ctx, guards, hits);
|
||||
}
|
||||
}
|
||||
Stmt::Jump { label, line } => hits.push(RuleHit {
|
||||
line: *line,
|
||||
severity: Severity::Medium,
|
||||
rule_id: "plc-unstructured-jump",
|
||||
title: "Unstructured jump (JMP) in control logic".to_string(),
|
||||
description: format!(
|
||||
"POU `{}` uses `JMP {label}`. Unstructured jumps make control flow hard to \
|
||||
verify and can bypass safety interlocks or leave outputs in an undefined \
|
||||
state on unexpected paths.",
|
||||
pou.name
|
||||
),
|
||||
cwe: Some("CWE-691"),
|
||||
remediation: "Replace JMP with structured constructs (IF/CASE/loops); reserve \
|
||||
jumps for well-reviewed state machines only.",
|
||||
}),
|
||||
Stmt::If {
|
||||
branches,
|
||||
else_body,
|
||||
..
|
||||
} => {
|
||||
for (cond, body) in branches {
|
||||
walk_expr(cond, pou, ctx, guards, hits);
|
||||
let child = guards.with(guards_from_cond(cond));
|
||||
walk(body, pou, ctx, &child, hits);
|
||||
}
|
||||
if let Some(b) = else_body {
|
||||
walk(b, pou, ctx, guards, hits);
|
||||
}
|
||||
}
|
||||
Stmt::Case {
|
||||
selector,
|
||||
arms,
|
||||
else_body,
|
||||
..
|
||||
} => {
|
||||
walk_expr(selector, pou, ctx, guards, hits);
|
||||
for (labels, body) in arms {
|
||||
for l in labels {
|
||||
walk_expr(l, pou, ctx, guards, hits);
|
||||
}
|
||||
walk(body, pou, ctx, guards, hits);
|
||||
}
|
||||
if let Some(b) = else_body {
|
||||
walk(b, pou, ctx, guards, hits);
|
||||
}
|
||||
}
|
||||
Stmt::For {
|
||||
from, to, by, body, ..
|
||||
} => {
|
||||
walk_expr(from, pou, ctx, guards, hits);
|
||||
walk_expr(to, pou, ctx, guards, hits);
|
||||
if let Some(b) = by {
|
||||
walk_expr(b, pou, ctx, guards, hits);
|
||||
}
|
||||
walk(body, pou, ctx, guards, hits);
|
||||
}
|
||||
Stmt::While { cond, body, .. } => {
|
||||
walk_expr(cond, pou, ctx, guards, hits);
|
||||
let child = guards.with(guards_from_cond(cond));
|
||||
walk(body, pou, ctx, &child, hits);
|
||||
}
|
||||
Stmt::Repeat { body, until, .. } => {
|
||||
walk(body, pou, ctx, guards, hits);
|
||||
walk_expr(until, pou, ctx, guards, hits);
|
||||
}
|
||||
Stmt::Return { .. } | Stmt::Exit { .. } | Stmt::Label { .. } => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn walk_expr(e: &Expr, pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
|
||||
match e {
|
||||
Expr::Index { base, index, line } => {
|
||||
check_array_bounds(base, index, *line, ctx, &pou.name, hits);
|
||||
walk_expr(base, pou, ctx, guards, hits);
|
||||
walk_expr(index, pou, ctx, guards, hits);
|
||||
}
|
||||
Expr::Binary { op, lhs, rhs, line } => {
|
||||
if matches!(op, BinOp::Div | BinOp::Mod) {
|
||||
check_division(rhs, *line, &pou.name, guards, hits);
|
||||
}
|
||||
walk_expr(lhs, pou, ctx, guards, hits);
|
||||
walk_expr(rhs, pou, ctx, guards, hits);
|
||||
}
|
||||
Expr::Unary { expr, .. } => walk_expr(expr, pou, ctx, guards, hits),
|
||||
Expr::Member { base, .. } => walk_expr(base, pou, ctx, guards, hits),
|
||||
Expr::Call { args, .. } => {
|
||||
for a in args {
|
||||
walk_expr(&a.value, pou, ctx, guards, hits);
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
|
||||
// ── individual rules ───────────────────────────────────────────────
|
||||
const SECRET_HINTS: &[&str] = &[
|
||||
"password",
|
||||
"passwd",
|
||||
"pwd",
|
||||
"secret",
|
||||
"apikey",
|
||||
"api_key",
|
||||
"token",
|
||||
"credential",
|
||||
"privkey",
|
||||
"private_key",
|
||||
"passphrase",
|
||||
];
|
||||
|
||||
const DEFAULT_PASSWORDS: &[&str] = &[
|
||||
"admin",
|
||||
"administrator",
|
||||
"password",
|
||||
"passwd",
|
||||
"1234",
|
||||
"12345",
|
||||
"123456",
|
||||
"0000",
|
||||
"1111",
|
||||
"root",
|
||||
"default",
|
||||
"admin123",
|
||||
"changeme",
|
||||
"letmein",
|
||||
"guest",
|
||||
"user",
|
||||
"system",
|
||||
"plc",
|
||||
"codesys",
|
||||
];
|
||||
|
||||
const COMM_FB_HINTS: &[&str] = &[
|
||||
"modbus", "tcp", "udp", "socket", "mqtt", "opcua", "opc_ua", "ethernet", "ethip", "enip",
|
||||
"dnp3", "ftp", "telnet", "http", "send", "connect", "sock", "comm", "profinet", "s7",
|
||||
];
|
||||
|
||||
/// Insecure cleartext service ports.
|
||||
const INSECURE_PORTS: &[i64] = &[21, 23, 80, 502, 20000, 44818, 102];
|
||||
|
||||
fn check_credential_binding(var_name: &str, value: &Expr, pou: &str, hits: &mut Vec<RuleHit>) {
|
||||
let name = var_name.to_ascii_lowercase();
|
||||
let looks_secret = SECRET_HINTS.iter().any(|h| name.contains(h));
|
||||
if looks_secret {
|
||||
if let Expr::Str(s, line) = value {
|
||||
if !s.is_empty() {
|
||||
hits.push(RuleHit {
|
||||
line: *line,
|
||||
severity: Severity::High,
|
||||
rule_id: "plc-hardcoded-credential",
|
||||
title: "Hardcoded credential in PLC program".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` binds a hardcoded secret to `{var_name}`. Credentials \
|
||||
embedded in control logic are extracted trivially from a project export \
|
||||
or a firmware dump and cannot be rotated without a redeploy."
|
||||
),
|
||||
cwe: Some("CWE-798"),
|
||||
remediation: "Store secrets outside the program (secure parameter store / \
|
||||
operator-entered, retained-but-protected memory); never commit \
|
||||
them to the POU.",
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn check_default_password(value: &Expr, var_name: &str, pou: &str, hits: &mut Vec<RuleHit>) {
|
||||
if let Expr::Str(s, line) = value {
|
||||
let lower = s.to_ascii_lowercase();
|
||||
if DEFAULT_PASSWORDS.contains(&lower.as_str()) {
|
||||
hits.push(RuleHit {
|
||||
line: *line,
|
||||
severity: Severity::Critical,
|
||||
rule_id: "plc-default-password",
|
||||
title: "Default/weak password in PLC program".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` uses the well-known default/weak password `{s}` (bound to \
|
||||
`{var_name}`). Default PLC credentials are the first thing an attacker tries."
|
||||
),
|
||||
cwe: Some("CWE-1393"),
|
||||
remediation:
|
||||
"Require a strong, unique, operator-set password; block commissioning \
|
||||
until the default is changed.",
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn check_credentials_in_call(
|
||||
callee: &str,
|
||||
args: &[CallArg],
|
||||
line: u32,
|
||||
pou: &str,
|
||||
hits: &mut Vec<RuleHit>,
|
||||
) {
|
||||
for a in args {
|
||||
if let Some(name) = &a.name {
|
||||
let n = name.to_ascii_lowercase();
|
||||
if SECRET_HINTS.iter().any(|h| n.contains(h)) {
|
||||
if let Expr::Str(s, l) = &a.value {
|
||||
if !s.is_empty() {
|
||||
hits.push(RuleHit {
|
||||
line: *l,
|
||||
severity: Severity::High,
|
||||
rule_id: "plc-hardcoded-credential",
|
||||
title: "Hardcoded credential passed to a function block".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` passes a hardcoded secret as `{name}` to `{callee}`."
|
||||
),
|
||||
cwe: Some("CWE-798"),
|
||||
remediation: "Supply credentials from protected configuration at \
|
||||
runtime, not as a literal argument.",
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
let _ = line;
|
||||
}
|
||||
|
||||
fn check_safety_bypass(target: &Expr, value: &Expr, line: u32, pou: &str, hits: &mut Vec<RuleHit>) {
|
||||
let Some(name) = flatten_ident(target) else {
|
||||
return;
|
||||
};
|
||||
let n = name.to_ascii_lowercase();
|
||||
let safety = [
|
||||
"safety",
|
||||
"estop",
|
||||
"e_stop",
|
||||
"emergency",
|
||||
"interlock",
|
||||
"guard",
|
||||
"permit",
|
||||
]
|
||||
.iter()
|
||||
.any(|h| n.contains(h));
|
||||
let watchdog = n.contains("watchdog") || n.contains("wdt");
|
||||
// A safety enable / interlock / watchdog signal driven to FALSE or 0 in
|
||||
// application logic is a bypass (e.g. `Safety_Enable := FALSE`, `Watchdog_Kick := 0`).
|
||||
let disabling = matches!(value, Expr::Bool(false, _)) || matches!(value, Expr::Int(0, _));
|
||||
if (safety || watchdog) && disabling {
|
||||
hits.push(RuleHit {
|
||||
line,
|
||||
severity: Severity::Critical,
|
||||
rule_id: "plc-safety-bypass",
|
||||
title: "Safety interlock / watchdog disabled in logic".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` disables a safety-related signal (`{name}`) in program logic. \
|
||||
Bypassing interlocks or watchdogs in code defeats the plant's protective \
|
||||
functions and is a direct hazard."
|
||||
),
|
||||
cwe: Some("CWE-1384"),
|
||||
remediation: "Never disable safety functions from application logic; safety must be \
|
||||
handled by a certified safety controller / hard-wired circuit.",
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
fn check_array_bounds(
|
||||
base: &Expr,
|
||||
index: &Expr,
|
||||
line: u32,
|
||||
ctx: &Ctx,
|
||||
pou: &str,
|
||||
hits: &mut Vec<RuleHit>,
|
||||
) {
|
||||
// Only reason about arrays we know the bounds of.
|
||||
let Some(arr_name) = base.as_ident() else {
|
||||
return;
|
||||
};
|
||||
if !ctx.arrays.contains_key(&arr_name.to_ascii_lowercase()) {
|
||||
return;
|
||||
}
|
||||
// Index by an untrusted input variable → potential out-of-bounds access.
|
||||
if let Some(idx_name) = index.as_ident() {
|
||||
if ctx.input_vars.contains(&idx_name.to_ascii_lowercase()) {
|
||||
hits.push(RuleHit {
|
||||
line,
|
||||
severity: Severity::High,
|
||||
rule_id: "plc-array-unchecked-index",
|
||||
title: "Array indexed by unvalidated input".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` indexes array `{arr_name}` with the input variable `{idx_name}` \
|
||||
without a validated bounds check. An out-of-range index corrupts adjacent \
|
||||
memory or faults the PLC (loss of control)."
|
||||
),
|
||||
cwe: Some("CWE-129"),
|
||||
remediation: "Clamp or validate the index against the array bounds (e.g. \
|
||||
`LIMIT`/explicit `IF idx >= lo AND idx <= hi`) before the access.",
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn check_division(
|
||||
divisor: &Expr,
|
||||
line: u32,
|
||||
pou: &str,
|
||||
guards: &GuardSet,
|
||||
hits: &mut Vec<RuleHit>,
|
||||
) {
|
||||
// A divisor proven non-zero by an enclosing guard is safe.
|
||||
if let Expr::Ident(name, _) = divisor {
|
||||
if guards.is_nonzero(&name.to_ascii_lowercase()) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
// Flag division by a variable (could be zero); nonzero literals are fine.
|
||||
let risky = matches!(
|
||||
divisor,
|
||||
Expr::Ident(_, _) | Expr::Member { .. } | Expr::Index { .. } | Expr::Int(0, _)
|
||||
);
|
||||
if risky {
|
||||
hits.push(RuleHit {
|
||||
line,
|
||||
severity: Severity::Medium,
|
||||
rule_id: "plc-division-by-zero",
|
||||
title: "Division by a variable without a zero-guard".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` divides by a variable that is not proven non-zero. A zero divisor \
|
||||
raises a PLC exception and can halt the scan cycle (denial of control)."
|
||||
),
|
||||
cwe: Some("CWE-369"),
|
||||
remediation: "Guard the divisor (`IF d <> 0 THEN …`) or use a safe-divide helper that \
|
||||
returns a defined value for a zero denominator.",
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
fn check_insecure_comm(
|
||||
callee: &str,
|
||||
args: &[CallArg],
|
||||
line: u32,
|
||||
pou: &str,
|
||||
hits: &mut Vec<RuleHit>,
|
||||
) {
|
||||
let c = callee.to_ascii_lowercase();
|
||||
let is_comm = COMM_FB_HINTS.iter().any(|h| c.contains(h));
|
||||
if !is_comm {
|
||||
return;
|
||||
}
|
||||
// Auth/encryption explicitly disabled.
|
||||
for a in args {
|
||||
if let Some(name) = &a.name {
|
||||
let n = name.to_ascii_lowercase();
|
||||
let security_flag = ["auth", "secure", "encrypt", "tls", "ssl", "authentication"]
|
||||
.iter()
|
||||
.any(|h| n.contains(h));
|
||||
if security_flag && matches!(a.value, Expr::Bool(false, _)) {
|
||||
hits.push(RuleHit {
|
||||
line,
|
||||
severity: Severity::High,
|
||||
rule_id: "plc-insecure-comm",
|
||||
title: "Network communication with security disabled".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` calls `{callee}` with `{name} := FALSE`, disabling \
|
||||
authentication/encryption on an industrial network link."
|
||||
),
|
||||
cwe: Some("CWE-319"),
|
||||
remediation: "Enable authentication + transport encryption; segment OT \
|
||||
networks and restrict the endpoint to trusted peers.",
|
||||
});
|
||||
}
|
||||
}
|
||||
// Well-known cleartext port literal.
|
||||
if let Expr::Int(p, _) = &a.value {
|
||||
if INSECURE_PORTS.contains(p) {
|
||||
hits.push(RuleHit {
|
||||
line,
|
||||
severity: Severity::Medium,
|
||||
rule_id: "plc-insecure-protocol-port",
|
||||
title: "Cleartext industrial protocol port".to_string(),
|
||||
description: format!(
|
||||
"POU `{pou}` opens `{callee}` on port {p}, a well-known cleartext OT \
|
||||
protocol port with no built-in authentication or encryption."
|
||||
),
|
||||
cwe: Some("CWE-319"),
|
||||
remediation: "Front the protocol with a secure gateway/VPN, or use the \
|
||||
authenticated/encrypted variant; never expose it to untrusted \
|
||||
networks.",
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
let _ = line;
|
||||
}
|
||||
|
||||
/// The dotted/base identifier of an lvalue expression (`a`, `a.b` → `a.b`,
|
||||
/// `a[i]` → `a`), for name-based rules.
|
||||
fn flatten_ident(e: &Expr) -> Option<String> {
|
||||
match e {
|
||||
Expr::Ident(n, _) => Some(n.clone()),
|
||||
Expr::Member { base, field, .. } => flatten_ident(base).map(|b| format!("{b}.{field}")),
|
||||
Expr::Index { base, .. } => flatten_ident(base),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::pipeline::plc::parser;
|
||||
|
||||
const VULN: &str = r#"
|
||||
FUNCTION_BLOCK CommCtrl
|
||||
VAR_INPUT
|
||||
cmdIndex : INT;
|
||||
END_VAR
|
||||
VAR
|
||||
Password : STRING := 'admin123';
|
||||
buffer : ARRAY[0..15] OF INT;
|
||||
Safety_Enable : BOOL := TRUE;
|
||||
divisor : INT;
|
||||
result : INT;
|
||||
END_VAR
|
||||
Safety_Enable := FALSE;
|
||||
result := 100 / divisor;
|
||||
buffer[cmdIndex] := 1;
|
||||
Modbus_Connect(IP := '192.168.0.10', PORT := 502, AUTH := FALSE);
|
||||
IF cmdIndex > 100 THEN
|
||||
JMP fault;
|
||||
END_IF;
|
||||
fault:
|
||||
result := 0;
|
||||
END_FUNCTION_BLOCK
|
||||
"#;
|
||||
|
||||
fn rule_ids(src: &str) -> Vec<&'static str> {
|
||||
parser::parse(src)
|
||||
.iter()
|
||||
.flat_map(analyze)
|
||||
.map(|h| h.rule_id)
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn vulnerable_program_triggers_every_rule() {
|
||||
let ids = rule_ids(VULN);
|
||||
for expected in [
|
||||
"plc-hardcoded-credential",
|
||||
"plc-default-password",
|
||||
"plc-safety-bypass",
|
||||
"plc-division-by-zero",
|
||||
"plc-array-unchecked-index",
|
||||
"plc-insecure-comm",
|
||||
"plc-insecure-protocol-port",
|
||||
"plc-unstructured-jump",
|
||||
] {
|
||||
assert!(
|
||||
ids.contains(&expected),
|
||||
"expected rule {expected}, got {ids:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn clean_program_has_no_findings() {
|
||||
let clean = r#"
|
||||
PROGRAM Clean
|
||||
VAR
|
||||
a : INT := 5;
|
||||
b : INT := 3;
|
||||
total : INT;
|
||||
END_VAR
|
||||
IF b <> 0 THEN
|
||||
total := a / b;
|
||||
END_IF;
|
||||
END_PROGRAM
|
||||
"#;
|
||||
assert!(rule_ids(clean).is_empty(), "clean program should be quiet");
|
||||
}
|
||||
}
|
||||
@@ -1,253 +0,0 @@
|
||||
//! Control-application dependency SBOM from a CODESYS `.projectarchive`.
|
||||
//!
|
||||
//! A `.projectarchive` is a ZIP that bundles the project plus its referenced
|
||||
//! libraries and the target runtime. Each referenced library is an entry whose
|
||||
//! path segment follows the CODESYS convention
|
||||
//! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
|
||||
//! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
|
||||
//! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
|
||||
//! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
|
||||
//! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
|
||||
//! CVEs).
|
||||
|
||||
use std::collections::BTreeSet;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use compliance_core::models::SbomEntry;
|
||||
|
||||
/// Collect the control-application SBOM from every `.projectarchive` reachable for
|
||||
/// a target: the ingested artifact file itself (an uploaded archive), plus any
|
||||
/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
|
||||
/// extracted source archive that ships the archive alongside its PLCopen XML / ST
|
||||
/// exports. Deduplicated by (name, version).
|
||||
pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
|
||||
let mut archives: Vec<PathBuf> = Vec::new();
|
||||
if artifact_file.is_file() {
|
||||
archives.push(artifact_file.to_path_buf());
|
||||
}
|
||||
for entry in walkdir::WalkDir::new(working_path)
|
||||
.max_depth(8)
|
||||
.into_iter()
|
||||
.filter_map(|e| e.ok())
|
||||
{
|
||||
let p = entry.path();
|
||||
if entry.file_type().is_file()
|
||||
&& p.extension()
|
||||
.and_then(|x| x.to_str())
|
||||
.is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
|
||||
{
|
||||
archives.push(p.to_path_buf());
|
||||
}
|
||||
}
|
||||
let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
|
||||
let mut out = Vec::new();
|
||||
for a in archives {
|
||||
for e in projectarchive_sbom(&a, repo_id) {
|
||||
if seen.insert((e.name.clone(), e.version.clone())) {
|
||||
out.push(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
|
||||
/// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
|
||||
/// `.st`/`.xml` project, which carries no library manifest).
|
||||
pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
|
||||
let Ok(file) = std::fs::File::open(archive) else {
|
||||
return Vec::new();
|
||||
};
|
||||
let Ok(mut zip) = zip::ZipArchive::new(file) else {
|
||||
return Vec::new();
|
||||
};
|
||||
let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
|
||||
let mut entries = Vec::new();
|
||||
for i in 0..zip.len() {
|
||||
let Ok(entry) = zip.by_index(i) else {
|
||||
continue;
|
||||
};
|
||||
// Entry paths use `\` (Windows-authored) and/or `/` separators; the
|
||||
// component id is one path segment.
|
||||
for seg in entry.name().split(['/', '\\']) {
|
||||
if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
|
||||
if seen.insert((name.clone(), version.clone())) {
|
||||
let mut e = SbomEntry::new(
|
||||
repo_id.to_string(),
|
||||
name.clone(),
|
||||
version.clone(),
|
||||
"codesys".to_string(),
|
||||
);
|
||||
e.purl = Some(format!(
|
||||
"pkg:codesys/{}@{version}",
|
||||
name.replace(' ', "%20")
|
||||
));
|
||||
entries.push(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
entries
|
||||
}
|
||||
|
||||
/// `Name, X.Y.Z.W (Company)` → (name, version).
|
||||
fn parse_library(seg: &str) -> Option<(String, String)> {
|
||||
let seg = seg.trim();
|
||||
// Company is the trailing "(…)".
|
||||
let open = seg.rfind(" (")?;
|
||||
let rest = &seg[open + 2..];
|
||||
let close = rest.find(')')?;
|
||||
if rest[..close].trim().is_empty() {
|
||||
return None;
|
||||
}
|
||||
let head = seg[..open].trim(); // "Name, X.Y.Z.W"
|
||||
let comma = head.rfind(", ")?;
|
||||
let name = head[..comma].trim().to_string();
|
||||
let version = head[comma + 2..].trim().to_string();
|
||||
if name.is_empty() || !is_dotted_version(&version) {
|
||||
return None;
|
||||
}
|
||||
Some((name, version))
|
||||
}
|
||||
|
||||
/// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
|
||||
fn parse_runtime(seg: &str) -> Option<(String, String)> {
|
||||
let seg = seg.trim();
|
||||
if !seg.starts_with("CODESYS Control") {
|
||||
return None;
|
||||
}
|
||||
let version = seg
|
||||
.split_whitespace()
|
||||
.find(|t| is_dotted_version(t))?
|
||||
.to_string();
|
||||
// The runtime name is the first field, before the run of padding spaces that
|
||||
// precede the descriptor's numeric columns.
|
||||
let name = seg.split(" ").next().unwrap_or(seg).trim().to_string();
|
||||
if name.is_empty() {
|
||||
return None;
|
||||
}
|
||||
Some((name, version))
|
||||
}
|
||||
|
||||
/// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
|
||||
fn is_dotted_version(s: &str) -> bool {
|
||||
let parts: Vec<&str> = s.split('.').collect();
|
||||
parts.len() >= 3
|
||||
&& parts
|
||||
.iter()
|
||||
.all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::collections::HashMap;
|
||||
use std::io::Write;
|
||||
|
||||
/// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
|
||||
/// naming (verified against Proemion/codesys-examples): a native `.project`,
|
||||
/// referenced libraries as `Name, Version (Company)` segments, and a runtime
|
||||
/// device descriptor.
|
||||
fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
|
||||
let path = dir.join("App.projectarchive");
|
||||
write_synthetic_archive(&path);
|
||||
path
|
||||
}
|
||||
|
||||
fn write_synthetic_archive(path: &Path) {
|
||||
let file = std::fs::File::create(path).expect("create");
|
||||
let mut zip = zip::ZipWriter::new(file);
|
||||
let opts: zip::write::SimpleFileOptions = Default::default();
|
||||
let names = [
|
||||
"App.project",
|
||||
r"{b0b5}\App.Device.Plc.compileinfo",
|
||||
r"{e179}\Standard, 3.5.18.0 (System) standard.compiled-library-v3",
|
||||
r"{e179}\Util, 3.5.21.0 (System) util.compiled-library-v3",
|
||||
r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS) csv utility sl.compiled-library-v3",
|
||||
r"{e179}\3SLicense, 3.5.20.0 (CODESYS) 3slicense.compiled-library-v3",
|
||||
r"{0c63}\CODESYS Control for Linux ARM SL 0000 0006 4.17.0.0 4096 .zip",
|
||||
];
|
||||
for n in names {
|
||||
zip.start_file(n, opts).expect("start");
|
||||
zip.write_all(b"x").expect("write");
|
||||
}
|
||||
zip.finish().expect("finish");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extracts_libraries_and_runtime_from_projectarchive() {
|
||||
let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&tmp).expect("mkdir");
|
||||
let archive = synthetic_archive(&tmp);
|
||||
|
||||
let entries = projectarchive_sbom(&archive, "plc-target");
|
||||
let by_name: HashMap<&str, &SbomEntry> =
|
||||
entries.iter().map(|e| (e.name.as_str(), e)).collect();
|
||||
|
||||
// Libraries with their versions.
|
||||
assert_eq!(
|
||||
by_name.get("Standard").map(|e| e.version.as_str()),
|
||||
Some("3.5.18.0")
|
||||
);
|
||||
assert_eq!(
|
||||
by_name.get("Util").map(|e| e.version.as_str()),
|
||||
Some("3.5.21.0")
|
||||
);
|
||||
assert_eq!(
|
||||
by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
|
||||
Some("1.9.0.0"),
|
||||
"multi-word library names must parse"
|
||||
);
|
||||
assert!(by_name.contains_key("3SLicense"));
|
||||
|
||||
// The runtime, from the device descriptor.
|
||||
assert_eq!(
|
||||
by_name
|
||||
.get("CODESYS Control for Linux ARM SL")
|
||||
.map(|e| e.version.as_str()),
|
||||
Some("4.17.0.0")
|
||||
);
|
||||
|
||||
// Every component is CODESYS-tagged with a purl the CVE pipeline can match,
|
||||
// and the native `.project` / compileinfo are not mistaken for components.
|
||||
for e in &entries {
|
||||
assert_eq!(e.package_manager, "codesys");
|
||||
assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
|
||||
}
|
||||
assert!(!by_name.contains_key("App"));
|
||||
|
||||
let _ = std::fs::remove_dir_all(&tmp);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
|
||||
let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
|
||||
let src = tmp.join("clone/src");
|
||||
std::fs::create_dir_all(&src).expect("mkdir");
|
||||
// Simulate a git clone that commits the archive alongside its exports.
|
||||
write_synthetic_archive(&src.join("PumpStation.projectarchive"));
|
||||
|
||||
// The artifact "file" is a git URL (not a real file), so the SBOM must
|
||||
// come from walking the cloned tree.
|
||||
let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
|
||||
let names: std::collections::HashSet<&str> =
|
||||
entries.iter().map(|e| e.name.as_str()).collect();
|
||||
assert!(
|
||||
names.contains("Standard"),
|
||||
"found libs in the committed archive"
|
||||
);
|
||||
assert!(names.contains("CODESYS Control for Linux ARM SL"));
|
||||
|
||||
let _ = std::fs::remove_dir_all(&tmp);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn non_zip_file_yields_no_sbom() {
|
||||
let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&tmp).expect("mkdir");
|
||||
let st = tmp.join("prog.st");
|
||||
std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
|
||||
assert!(projectarchive_sbom(&st, "t").is_empty());
|
||||
let _ = std::fs::remove_dir_all(&tmp);
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::path::Path;
|
||||
|
||||
use compliance_core::models::{Finding, ScanType, Severity};
|
||||
use compliance_core::traits::{ScanOutput, Scanner};
|
||||
@@ -6,30 +6,6 @@ use compliance_core::CoreError;
|
||||
|
||||
use crate::pipeline::dedup;
|
||||
|
||||
/// Custom CRA-control detectors bundled into the binary and staged to a temp file
|
||||
/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
|
||||
/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
|
||||
/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
|
||||
/// keyed back to its control by the `control-map` LUT.
|
||||
const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
|
||||
|
||||
/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
|
||||
/// rename). Returns `None` on failure — the scan then runs with auto rules only.
|
||||
async fn stage_cra_rules() -> Option<PathBuf> {
|
||||
let dir = std::env::temp_dir();
|
||||
let path = dir.join("compliance-cra-semgrep.yaml");
|
||||
let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
|
||||
if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
|
||||
tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
|
||||
return None;
|
||||
}
|
||||
if let Err(e) = tokio::fs::rename(&tmp, &path).await {
|
||||
tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
|
||||
return None;
|
||||
}
|
||||
Some(path)
|
||||
}
|
||||
|
||||
pub struct SemgrepScanner;
|
||||
|
||||
impl Scanner for SemgrepScanner {
|
||||
@@ -43,26 +19,30 @@ impl Scanner for SemgrepScanner {
|
||||
|
||||
#[tracing::instrument(skip_all)]
|
||||
async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
|
||||
let cra_rules = stage_cra_rules().await;
|
||||
let mut command = tokio::process::Command::new("semgrep");
|
||||
command.arg("--config=auto");
|
||||
if let Some(path) = &cra_rules {
|
||||
command.arg(format!("--config={}", path.display()));
|
||||
}
|
||||
command
|
||||
.args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
|
||||
.arg(repo_path);
|
||||
|
||||
let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
|
||||
.await
|
||||
.map_err(|_| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: "timed out after 10 minutes".into(),
|
||||
})?
|
||||
.map_err(|e| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: Box::new(e),
|
||||
})?;
|
||||
let output = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(600),
|
||||
tokio::process::Command::new("semgrep")
|
||||
.args([
|
||||
"--config=auto",
|
||||
"--json",
|
||||
"--quiet",
|
||||
"--max-memory",
|
||||
"500",
|
||||
"--jobs",
|
||||
"1",
|
||||
])
|
||||
.arg(repo_path)
|
||||
.output(),
|
||||
)
|
||||
.await
|
||||
.map_err(|_| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: "timed out after 10 minutes".into(),
|
||||
})?
|
||||
.map_err(|e| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: Box::new(e),
|
||||
})?;
|
||||
|
||||
if !output.status.success() && output.stdout.is_empty() {
|
||||
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||
@@ -102,7 +82,10 @@ impl Scanner for SemgrepScanner {
|
||||
finding.file_path = Some(r.path);
|
||||
finding.line_number = Some(r.start.line);
|
||||
finding.code_snippet = Some(r.extra.lines);
|
||||
finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
|
||||
finding.cwe = r
|
||||
.extra
|
||||
.metadata
|
||||
.and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
|
||||
finding
|
||||
})
|
||||
.collect();
|
||||
@@ -141,34 +124,10 @@ struct SemgrepExtra {
|
||||
metadata: Option<serde_json::Value>,
|
||||
}
|
||||
|
||||
/// semgrep emits `metadata.cwe` as a list of strings like
|
||||
/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
|
||||
/// the first entry and normalise it to just the `CWE-NNN` id.
|
||||
fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
|
||||
let raw = metadata.get("cwe")?;
|
||||
let text = match raw {
|
||||
serde_json::Value::Array(items) => items.first()?.as_str()?,
|
||||
serde_json::Value::String(s) => s.as_str(),
|
||||
_ => return None,
|
||||
};
|
||||
let id = text.split(':').next().unwrap_or(text).trim();
|
||||
(!id.is_empty()).then(|| id.to_string())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn extract_cwe_handles_list_and_normalises() {
|
||||
let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
|
||||
assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
|
||||
let bare = serde_json::json!({"cwe": "CWE-89"});
|
||||
assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
|
||||
let none = serde_json::json!({"severity": "ERROR"});
|
||||
assert_eq!(extract_cwe(&none), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deserialize_semgrep_output() {
|
||||
let json = r#"{
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
//! Werkbank control-plane: the dynamic-execution job queue.
|
||||
//!
|
||||
//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
|
||||
//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
|
||||
//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
|
||||
//! and the runner itself land in later stories.
|
||||
|
||||
pub mod queue;
|
||||
|
||||
pub use queue::{JobQueue, SweepOutcome};
|
||||
@@ -1,309 +0,0 @@
|
||||
//! The Mongo-backed Werkbank job queue (WB-02).
|
||||
//!
|
||||
//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
|
||||
//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
|
||||
//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
|
||||
//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
|
||||
//! runner dies mid-job its heartbeats stop, the lease expires, and
|
||||
//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
|
||||
//! `expired` once it has been retried too many times).
|
||||
//!
|
||||
//! All state transitions are single atomic Mongo updates guarded by the lease
|
||||
//! token, so two runners can never both own a job. Every operation takes an
|
||||
//! explicit `now` so the queue's time-dependent behaviour is deterministically
|
||||
//! testable.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use chrono::{DateTime, Utc};
|
||||
use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
|
||||
use mongodb::error::{ErrorKind, WriteFailure};
|
||||
use mongodb::options::ReturnDocument;
|
||||
use mongodb::Collection;
|
||||
|
||||
use compliance_core::models::werkbank::{
|
||||
Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
|
||||
};
|
||||
|
||||
use crate::database::Database;
|
||||
use crate::error::AgentError;
|
||||
|
||||
/// The non-terminal states a job can be swept or cancelled from.
|
||||
const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
|
||||
/// Every terminal state (no further transitions).
|
||||
const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
|
||||
|
||||
/// What a visibility-timeout sweep did.
|
||||
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
|
||||
pub struct SweepOutcome {
|
||||
/// Expired-lease jobs returned to `queued` for another runner.
|
||||
pub requeued: u64,
|
||||
/// Jobs that had exhausted their attempts and were marked `expired`.
|
||||
pub expired: u64,
|
||||
}
|
||||
|
||||
/// The Mongo-backed job queue.
|
||||
pub struct JobQueue {
|
||||
coll: Collection<JobRecord>,
|
||||
}
|
||||
|
||||
impl JobQueue {
|
||||
/// Build a queue over a tenant database's `werkbank_jobs` collection.
|
||||
pub fn new(db: &Database) -> Self {
|
||||
Self {
|
||||
coll: db.werkbank_jobs(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Enqueue a job. Idempotent by job id: a job that is already present is a
|
||||
/// no-op. Returns `true` if this call inserted it, `false` if it existed.
|
||||
pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
|
||||
let record = JobRecord::queued(job, now);
|
||||
match self.coll.insert_one(&record).await {
|
||||
Ok(_) => Ok(true),
|
||||
Err(e) if is_duplicate_key(&e) => Ok(false),
|
||||
Err(e) => Err(e.into()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Atomically lease the oldest `queued` job this runner can run — matched by
|
||||
/// executor and by labels (every label the job requires must be one the
|
||||
/// runner advertises). Returns the job plus a lease token, or `None` if
|
||||
/// nothing is runnable.
|
||||
pub async fn lease(
|
||||
&self,
|
||||
runner_id: &str,
|
||||
executor: Executor,
|
||||
runner_labels: &[String],
|
||||
lease_ttl: Duration,
|
||||
now: DateTime<Utc>,
|
||||
) -> Result<Option<LeasedJob>, AgentError> {
|
||||
let token = uuid::Uuid::new_v4().to_string();
|
||||
let expires = bson_dt(now + ttl(lease_ttl));
|
||||
let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
|
||||
|
||||
let filter = doc! {
|
||||
"status": "queued",
|
||||
"cancel_requested": { "$ne": true },
|
||||
"job.executor": executor_bson,
|
||||
// Every label the job requires must be in the runner's set — i.e. the
|
||||
// job has no label that is not offered by the runner. Absent/empty
|
||||
// job labels match any runner.
|
||||
"job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
|
||||
};
|
||||
let update = doc! {
|
||||
"$set": {
|
||||
"status": "leased",
|
||||
"lease_token": &token,
|
||||
"leased_by": runner_id,
|
||||
"lease_expires_at": expires,
|
||||
"heartbeat_at": bson_dt(now),
|
||||
"updated_at": bson_dt(now),
|
||||
},
|
||||
"$inc": { "attempts": 1 },
|
||||
};
|
||||
|
||||
let record = self
|
||||
.coll
|
||||
.find_one_and_update(filter, update)
|
||||
.sort(doc! { "created_at": 1 }) // FIFO
|
||||
.return_document(ReturnDocument::After)
|
||||
.await?;
|
||||
Ok(record.map(|r| LeasedJob {
|
||||
job: r.job,
|
||||
lease_token: token,
|
||||
}))
|
||||
}
|
||||
|
||||
/// Extend a lease and report whether the job has been asked to cancel.
|
||||
/// Transitions the job to `running` on the first heartbeat. Returns `None`
|
||||
/// when the lease is no longer valid (token mismatch, or the job is already
|
||||
/// terminal) — the runner should then abandon the work.
|
||||
pub async fn heartbeat(
|
||||
&self,
|
||||
job_id: &str,
|
||||
lease_token: &str,
|
||||
lease_ttl: Duration,
|
||||
now: DateTime<Utc>,
|
||||
) -> Result<Option<HeartbeatAck>, AgentError> {
|
||||
let filter = doc! {
|
||||
"job.id": job_id,
|
||||
"lease_token": lease_token,
|
||||
"status": { "$in": ACTIVE_STATES.to_vec() },
|
||||
};
|
||||
let update = doc! {
|
||||
"$set": {
|
||||
"status": "running",
|
||||
"lease_expires_at": bson_dt(now + ttl(lease_ttl)),
|
||||
"heartbeat_at": bson_dt(now),
|
||||
"updated_at": bson_dt(now),
|
||||
},
|
||||
};
|
||||
let record = self
|
||||
.coll
|
||||
.find_one_and_update(filter, update)
|
||||
.return_document(ReturnDocument::After)
|
||||
.await?;
|
||||
Ok(record.map(|r| HeartbeatAck {
|
||||
cancelled: r.cancel_requested,
|
||||
}))
|
||||
}
|
||||
|
||||
/// Record a job's terminal result. Guarded by the lease token and only from
|
||||
/// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
|
||||
/// late submission after the job already finished matches nothing. Returns
|
||||
/// `true` if this call recorded the result.
|
||||
pub async fn complete(
|
||||
&self,
|
||||
job_id: &str,
|
||||
lease_token: &str,
|
||||
result: &JobResult,
|
||||
now: DateTime<Utc>,
|
||||
) -> Result<bool, AgentError> {
|
||||
let status = result.status.unwrap_or(JobStatus::Failed);
|
||||
let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
|
||||
let result_bson =
|
||||
mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
|
||||
|
||||
let filter = doc! {
|
||||
"job.id": job_id,
|
||||
"lease_token": lease_token,
|
||||
"status": { "$in": ACTIVE_STATES.to_vec() },
|
||||
};
|
||||
let update = doc! {
|
||||
"$set": {
|
||||
"status": status_bson,
|
||||
"result": result_bson,
|
||||
"lease_token": Bson::Null,
|
||||
"lease_expires_at": Bson::Null,
|
||||
"updated_at": bson_dt(now),
|
||||
},
|
||||
};
|
||||
let res = self.coll.update_one(filter, update).await?;
|
||||
Ok(res.modified_count == 1)
|
||||
}
|
||||
|
||||
/// Request cancellation of a job. A still-`queued` job is cancelled outright;
|
||||
/// an in-flight one is flagged so the runner sees it on its next heartbeat and
|
||||
/// tears down. Returns `true` if a non-terminal job matched.
|
||||
pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
|
||||
let filter = doc! {
|
||||
"job.id": job_id,
|
||||
"status": { "$nin": TERMINAL_STATES.to_vec() },
|
||||
};
|
||||
// Pipeline update: flag cancellation, and if still queued flip straight to
|
||||
// cancelled (nothing is running it).
|
||||
let pipeline = vec![doc! {
|
||||
"$set": {
|
||||
"cancel_requested": true,
|
||||
"status": {
|
||||
"$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
|
||||
},
|
||||
"updated_at": bson_dt(now),
|
||||
}
|
||||
}];
|
||||
let res = self.coll.update_one(filter, pipeline).await?;
|
||||
Ok(res.matched_count == 1)
|
||||
}
|
||||
|
||||
/// Sweep leases whose visibility timeout has elapsed: return them to `queued`
|
||||
/// for another runner, or mark them `expired` once they have been leased
|
||||
/// `max_attempts` times. This is what makes a crashed runner's job recover.
|
||||
pub async fn sweep_expired(
|
||||
&self,
|
||||
now: DateTime<Utc>,
|
||||
max_attempts: u32,
|
||||
// (kept explicit rather than a const so callers can tune retry policy)
|
||||
) -> Result<SweepOutcome, AgentError> {
|
||||
let now_bson = bson_dt(now);
|
||||
let max = i64::from(max_attempts);
|
||||
|
||||
let requeue = self
|
||||
.coll
|
||||
.update_many(
|
||||
doc! {
|
||||
"status": { "$in": ACTIVE_STATES.to_vec() },
|
||||
"lease_expires_at": { "$lt": &now_bson },
|
||||
"attempts": { "$lt": max },
|
||||
},
|
||||
doc! { "$set": {
|
||||
"status": "queued",
|
||||
"lease_token": Bson::Null,
|
||||
"leased_by": Bson::Null,
|
||||
"lease_expires_at": Bson::Null,
|
||||
"updated_at": &now_bson,
|
||||
} },
|
||||
)
|
||||
.await?;
|
||||
|
||||
let expire = self
|
||||
.coll
|
||||
.update_many(
|
||||
doc! {
|
||||
"status": { "$in": ACTIVE_STATES.to_vec() },
|
||||
"lease_expires_at": { "$lt": &now_bson },
|
||||
"attempts": { "$gte": max },
|
||||
},
|
||||
doc! { "$set": {
|
||||
"status": "expired",
|
||||
"lease_token": Bson::Null,
|
||||
"lease_expires_at": Bson::Null,
|
||||
"updated_at": &now_bson,
|
||||
} },
|
||||
)
|
||||
.await?;
|
||||
|
||||
Ok(SweepOutcome {
|
||||
requeued: requeue.modified_count,
|
||||
expired: expire.modified_count,
|
||||
})
|
||||
}
|
||||
|
||||
/// Fetch a job record by job id (inspection / control-plane reads).
|
||||
pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
|
||||
Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
|
||||
}
|
||||
}
|
||||
|
||||
/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
|
||||
/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
|
||||
fn ttl(d: Duration) -> chrono::Duration {
|
||||
let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
|
||||
chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
|
||||
}
|
||||
|
||||
/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
|
||||
fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
|
||||
BsonDateTime::from_chrono(dt)
|
||||
}
|
||||
|
||||
/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
|
||||
/// id is already enqueued.
|
||||
fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
|
||||
match &*e.kind {
|
||||
ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
|
||||
_ => false,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn ttl_saturates_and_converts() {
|
||||
assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
|
||||
// An absurd TTL saturates instead of panicking.
|
||||
assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn state_constants_are_disjoint() {
|
||||
for s in ACTIVE_STATES {
|
||||
assert!(
|
||||
!TERMINAL_STATES.contains(&s),
|
||||
"{s} cannot be both active and terminal"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,145 +0,0 @@
|
||||
//! C5 live verification — the semantic master-controls path end to end against the
|
||||
//! deployed api-dev catalog. Ignored (hits api-dev + LiteLLM). Run explicitly:
|
||||
//!
|
||||
//! set -a; . ./.env; set +a
|
||||
//! BREAKPILOT_BASE_URL=https://api-dev.breakpilot.ai \
|
||||
//! cargo test -p compliance-agent --test c5_semantic_live -- --ignored --nocapture
|
||||
//!
|
||||
//! Pulls the live master-controls catalog, embeds the corpus (chunked), then for a
|
||||
//! couple of real vulnerable findings retrieves the nearest master controls and
|
||||
//! grounded-judges them, stamping master-control refs.
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_agent::llm::LlmClient;
|
||||
use compliance_core::config::BreakpilotConfig;
|
||||
use compliance_core::models::finding::{Finding, Severity};
|
||||
use compliance_core::models::scan::ScanType;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn env(k: &str) -> String {
|
||||
std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set for the live C5 test"))
|
||||
}
|
||||
|
||||
fn mk_finding(file: &str, line: u32, title: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo-c5".into(),
|
||||
format!("{file}:{line}"),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
title.into(),
|
||||
title.into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.file_path = Some(file.into());
|
||||
f.line_number = Some(line);
|
||||
f
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: requires deployed api-dev master-controls (fetch+parse only, no LLM)"]
|
||||
async fn c5_ingest_master_controls_catalog() {
|
||||
use compliance_agent::controls::OscalControlsProvider;
|
||||
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
env("BREAKPILOT_BASE_URL"),
|
||||
None,
|
||||
std::env::temp_dir().join("c5-ingest-snap"),
|
||||
);
|
||||
let doc = provider
|
||||
.load_master_controls()
|
||||
.await
|
||||
.expect("pull + parse master-controls catalog");
|
||||
let controls = doc.to_controls();
|
||||
println!(
|
||||
"\n=== C5 ingest: {} master controls parsed ===",
|
||||
controls.len()
|
||||
);
|
||||
for c in controls.iter().take(4) {
|
||||
let text: String = c.text.chars().take(90).collect();
|
||||
println!(" {} | {} | {}", c.id, c.title, text);
|
||||
}
|
||||
assert!(
|
||||
!controls.is_empty(),
|
||||
"expected a non-empty master-control corpus"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: requires deployed api-dev master-controls + LiteLLM"]
|
||||
async fn c5_semantic_stamps_master_control_refs() {
|
||||
let llm = Arc::new(LlmClient::new(
|
||||
env("LITELLM_URL"),
|
||||
SecretString::from(env("LITELLM_API_KEY")),
|
||||
env("LITELLM_MODEL"),
|
||||
env("LITELLM_EMBED_MODEL"),
|
||||
));
|
||||
|
||||
let mut config = common::dev_config("mongodb://unused".into(), "c5".into());
|
||||
let snapshot = std::env::temp_dir().join("c5-oscal-snap");
|
||||
config.breakpilot = BreakpilotConfig {
|
||||
base_url: Some(env("BREAKPILOT_BASE_URL")),
|
||||
token: None,
|
||||
snapshot_dir: snapshot.to_string_lossy().into_owned(),
|
||||
semantic_mapping: true,
|
||||
grounded_control_checks: false,
|
||||
};
|
||||
|
||||
// Fixture repo with recognizable code-checkable surfaces.
|
||||
let repo = std::env::temp_dir().join("c5-fixture-repo");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
std::fs::create_dir_all(repo.join("app")).expect("mkdir");
|
||||
std::fs::write(
|
||||
repo.join("app/auth.py"),
|
||||
concat!(
|
||||
"import hashlib\n",
|
||||
"\n",
|
||||
"def store_password(user, password):\n",
|
||||
" # weak, unsalted password hashing\n",
|
||||
" digest = hashlib.md5(password.encode()).hexdigest()\n",
|
||||
" db.save(user, digest)\n",
|
||||
"\n",
|
||||
"@app.route('/login', methods=['POST'])\n",
|
||||
"def login():\n",
|
||||
" u = request.form['username']\n",
|
||||
" p = request.form['password']\n",
|
||||
" return 'ok' if check(u, p) else ('bad', 401)\n",
|
||||
),
|
||||
)
|
||||
.expect("write fixture");
|
||||
|
||||
let mut findings = vec![
|
||||
mk_finding("app/auth.py", 5, "Weak password hash (md5, unsalted)"),
|
||||
mk_finding(
|
||||
"app/auth.py",
|
||||
9,
|
||||
"Login endpoint without brute-force protection",
|
||||
),
|
||||
];
|
||||
|
||||
let tagged =
|
||||
compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
|
||||
.await;
|
||||
|
||||
println!("\n=== C5 semantic master-controls stamping ===");
|
||||
for f in &findings {
|
||||
println!(
|
||||
" {:50} {}:{:?} -> {:?}",
|
||||
f.title,
|
||||
f.file_path.as_deref().unwrap_or(""),
|
||||
f.line_number,
|
||||
f.control_refs
|
||||
);
|
||||
}
|
||||
println!("findings that gained >=1 master-control ref: {tagged}");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
|
||||
// Live corpus — assert only that the path runs and stamps at least one ref.
|
||||
assert!(
|
||||
tagged >= 1,
|
||||
"expected at least one finding to gain a master-control ref"
|
||||
);
|
||||
}
|
||||
@@ -2,10 +2,6 @@
|
||||
//
|
||||
// Spins up the agent API server on a random port with an isolated test
|
||||
// database. Each test gets a fresh database that is dropped on cleanup.
|
||||
//
|
||||
// Included via `mod common;` in several test binaries; not every binary uses
|
||||
// every helper, so allow dead code here.
|
||||
#![allow(dead_code)]
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
@@ -15,55 +11,6 @@ use compliance_agent::database::DatabasePool;
|
||||
use compliance_core::AgentConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
/// The runner bearer token wired into the test config.
|
||||
pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
|
||||
|
||||
/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
|
||||
/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
|
||||
pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
|
||||
AgentConfig {
|
||||
mongodb_uri,
|
||||
mongodb_database: db_name,
|
||||
litellm_url: std::env::var("TEST_LITELLM_URL")
|
||||
.unwrap_or_else(|_| "http://localhost:4000".into()),
|
||||
litellm_api_key: SecretString::from(String::new()),
|
||||
litellm_model: "gpt-4o".into(),
|
||||
litellm_embed_model: "text-embedding-3-small".into(),
|
||||
agent_port: 0, // not used — we bind ourselves
|
||||
scan_schedule: String::new(),
|
||||
cve_monitor_schedule: String::new(),
|
||||
git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
|
||||
artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
|
||||
ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
|
||||
github_token: None,
|
||||
github_webhook_secret: None,
|
||||
gitlab_url: None,
|
||||
gitlab_token: None,
|
||||
gitlab_webhook_secret: None,
|
||||
jira_url: None,
|
||||
jira_email: None,
|
||||
jira_api_token: None,
|
||||
jira_project_key: None,
|
||||
searxng_url: None,
|
||||
nvd_api_key: None,
|
||||
keycloak_url: None,
|
||||
keycloak_realm: None,
|
||||
keycloak_admin_username: None,
|
||||
keycloak_admin_password: None,
|
||||
pentest_verification_email: None,
|
||||
pentest_imap_host: None,
|
||||
pentest_imap_port: None,
|
||||
pentest_imap_tls: false,
|
||||
pentest_imap_username: None,
|
||||
pentest_imap_password: None,
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
/// A running test server with a unique database.
|
||||
pub struct TestServer {
|
||||
pub base_url: String,
|
||||
@@ -86,7 +33,44 @@ impl TestServer {
|
||||
.await
|
||||
.expect("Failed to build DatabasePool");
|
||||
|
||||
let config = dev_config(mongodb_uri.clone(), db_name.clone());
|
||||
let config = AgentConfig {
|
||||
mongodb_uri: mongodb_uri.clone(),
|
||||
mongodb_database: db_name.clone(),
|
||||
litellm_url: std::env::var("TEST_LITELLM_URL")
|
||||
.unwrap_or_else(|_| "http://localhost:4000".into()),
|
||||
litellm_api_key: SecretString::from(String::new()),
|
||||
litellm_model: "gpt-4o".into(),
|
||||
litellm_embed_model: "text-embedding-3-small".into(),
|
||||
agent_port: 0, // not used — we bind ourselves
|
||||
scan_schedule: String::new(),
|
||||
cve_monitor_schedule: String::new(),
|
||||
git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
|
||||
artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
|
||||
ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
|
||||
github_token: None,
|
||||
github_webhook_secret: None,
|
||||
gitlab_url: None,
|
||||
gitlab_token: None,
|
||||
gitlab_webhook_secret: None,
|
||||
jira_url: None,
|
||||
jira_email: None,
|
||||
jira_api_token: None,
|
||||
jira_project_key: None,
|
||||
searxng_url: None,
|
||||
nvd_api_key: None,
|
||||
keycloak_url: None,
|
||||
keycloak_realm: None,
|
||||
keycloak_admin_username: None,
|
||||
keycloak_admin_password: None,
|
||||
pentest_verification_email: None,
|
||||
pentest_imap_host: None,
|
||||
pentest_imap_port: None,
|
||||
pentest_imap_tls: false,
|
||||
pentest_imap_username: None,
|
||||
pentest_imap_password: None,
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
};
|
||||
|
||||
let agent = ComplianceAgent::new(config, db_pool);
|
||||
|
||||
|
||||
@@ -1,291 +0,0 @@
|
||||
//! Integration tests for the Werkbank runner endpoints (WB-05).
|
||||
//!
|
||||
//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
|
||||
//! a runner leases a seeded job, completes it, and the result's findings are
|
||||
//! persisted against the job's target. Also checks the bearer-token gate. Skips
|
||||
//! cleanly when no Mongo is reachable.
|
||||
|
||||
#![allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::routing::{get, post};
|
||||
use axum::{middleware, Extension, Router};
|
||||
|
||||
use compliance_agent::agent::ComplianceAgent;
|
||||
use compliance_agent::api::handlers::werkbank_jobs;
|
||||
use compliance_agent::database::DatabasePool;
|
||||
use compliance_agent::werkbank::JobQueue;
|
||||
use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
|
||||
use compliance_core::models::{
|
||||
Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
|
||||
};
|
||||
|
||||
use common::{dev_config, TEST_RUNNER_TOKEN};
|
||||
|
||||
const TENANT: &str = "dev";
|
||||
|
||||
/// A running werkbank API on a random port, or `None` if no Mongo.
|
||||
struct Harness {
|
||||
base_url: String,
|
||||
client: reqwest::Client,
|
||||
pool: DatabasePool,
|
||||
db_name: String,
|
||||
}
|
||||
|
||||
async fn start() -> Option<Harness> {
|
||||
let uri = std::env::var("TEST_MONGODB_URI")
|
||||
.unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
|
||||
let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
|
||||
let pool = match DatabasePool::connect(&uri, &db_name).await {
|
||||
Ok(p) => p,
|
||||
Err(_) => {
|
||||
eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
|
||||
return None;
|
||||
}
|
||||
};
|
||||
// Touch the tenant DB so indexes are ensured before the queue is used.
|
||||
pool.for_tenant_id(TENANT).await.expect("tenant db");
|
||||
|
||||
let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
|
||||
let app = Router::new()
|
||||
.route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/heartbeat",
|
||||
post(werkbank_jobs::heartbeat),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
post(werkbank_jobs::complete),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
post(werkbank_jobs::enqueue),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/artifacts/{hash}",
|
||||
get(werkbank_jobs::serve_artifact),
|
||||
)
|
||||
.layer(middleware::from_fn(werkbank_jobs::require_runner_token))
|
||||
.layer(Extension(Arc::new(agent)));
|
||||
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let port = listener.local_addr().unwrap().port();
|
||||
tokio::spawn(async move {
|
||||
axum::serve(listener, app).await.ok();
|
||||
});
|
||||
|
||||
Some(Harness {
|
||||
base_url: format!("http://127.0.0.1:{port}"),
|
||||
client: reqwest::Client::new(),
|
||||
pool,
|
||||
db_name,
|
||||
})
|
||||
}
|
||||
|
||||
impl Harness {
|
||||
fn post(
|
||||
&self,
|
||||
path: &str,
|
||||
token: Option<&str>,
|
||||
body: serde_json::Value,
|
||||
) -> reqwest::RequestBuilder {
|
||||
let mut r = self
|
||||
.client
|
||||
.post(format!("{}{path}", self.base_url))
|
||||
.json(&body);
|
||||
if let Some(t) = token {
|
||||
r = r.bearer_auth(t);
|
||||
}
|
||||
r
|
||||
}
|
||||
async fn cleanup(&self) {
|
||||
let _ = self
|
||||
.pool
|
||||
.client()
|
||||
.database(&format!("{}_{TENANT}", self.db_name))
|
||||
.drop()
|
||||
.await;
|
||||
}
|
||||
}
|
||||
|
||||
fn finding_for(target: &str, fp: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
target.to_string(),
|
||||
fp.to_string(),
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"Modbus exposed".to_string(),
|
||||
"unauthenticated".to_string(),
|
||||
Severity::Critical,
|
||||
);
|
||||
f.rule_id = Some("ics-modbus-exposed".to_string());
|
||||
f
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn lease_complete_persists_findings_against_the_target() {
|
||||
let Some(h) = start().await else { return };
|
||||
let db = h.pool.for_tenant_id(TENANT).await.unwrap();
|
||||
let queue = JobQueue::new(&db);
|
||||
|
||||
// Seed a queued job.
|
||||
let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
|
||||
assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
|
||||
|
||||
// Lease it over HTTP.
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200, "lease should return a job");
|
||||
let leased: LeasedJob = resp.json().await.unwrap();
|
||||
assert_eq!(leased.job.id, "job-1");
|
||||
|
||||
// Complete it with a finding.
|
||||
let mut result = JobResult::succeeded("job-1");
|
||||
result.findings = vec![finding_for("target-1", "fp-abc")];
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "job_id": "job-1",
|
||||
"lease_token": leased.lease_token, "result": result
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200);
|
||||
assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
|
||||
.as_bool()
|
||||
.unwrap());
|
||||
|
||||
// The job is now succeeded, and the finding was persisted to the target.
|
||||
assert_eq!(
|
||||
queue.get("job-1").await.unwrap().unwrap().status,
|
||||
JobStatus::Succeeded
|
||||
);
|
||||
let stored = db
|
||||
.findings()
|
||||
.find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(stored.is_some(), "finding should be persisted");
|
||||
|
||||
h.cleanup().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
|
||||
let Some(h) = start().await else { return };
|
||||
let db = h.pool.for_tenant_id(TENANT).await.unwrap();
|
||||
|
||||
// A PlcSps target with a single complete ST program uploaded.
|
||||
let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
let st = dir.join("main.st");
|
||||
std::fs::write(
|
||||
&st,
|
||||
"PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n RESOURCE R\nEND_CONFIGURATION\n",
|
||||
)
|
||||
.unwrap();
|
||||
let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
|
||||
let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
|
||||
art.stored_path = Some(st.to_string_lossy().to_string());
|
||||
target.artifacts.push(art);
|
||||
let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
|
||||
let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
|
||||
|
||||
// Enqueue → a plc-provision job whose program is a content-addressed blob.
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200, "enqueue should succeed");
|
||||
let body: serde_json::Value = resp.json().await.unwrap();
|
||||
let job_id = body["job_id"].as_str().unwrap().to_string();
|
||||
|
||||
let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
|
||||
let hash = rec
|
||||
.job
|
||||
.inputs
|
||||
.get("program")
|
||||
.and_then(|i| i.blob.clone())
|
||||
.expect("program blob");
|
||||
|
||||
// Serve the blob back and confirm it's the program source (what the runner
|
||||
// would fetch).
|
||||
let served = h
|
||||
.client
|
||||
.get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
|
||||
.bearer_auth(TEST_RUNNER_TOKEN)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(served.status(), 200);
|
||||
assert!(served.text().await.unwrap().contains("CONFIGURATION"));
|
||||
|
||||
h.cleanup().await;
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn empty_queue_leases_nothing() {
|
||||
let Some(h) = start().await else { return };
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 204, "no job → 204");
|
||||
h.cleanup().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn runner_endpoints_require_the_bearer_token() {
|
||||
let Some(h) = start().await else { return };
|
||||
let body = serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
});
|
||||
|
||||
let no_token = h
|
||||
.post("/api/v1/werkbank/jobs/lease", None, body.clone())
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(no_token.status(), 401, "missing token → 401");
|
||||
|
||||
let bad_token = h
|
||||
.post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(bad_token.status(), 401, "wrong token → 401");
|
||||
|
||||
h.cleanup().await;
|
||||
}
|
||||
@@ -1,258 +0,0 @@
|
||||
//! Integration tests for the Werkbank job queue (WB-02).
|
||||
//!
|
||||
//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
|
||||
//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
|
||||
//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
|
||||
//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
|
||||
//! one; defaults to the local dev cluster).
|
||||
|
||||
#![allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use chrono::{DateTime, TimeZone, Utc};
|
||||
|
||||
use compliance_agent::database::Database;
|
||||
use compliance_agent::werkbank::JobQueue;
|
||||
use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
|
||||
|
||||
/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
|
||||
async fn setup() -> Option<(JobQueue, mongodb::Database)> {
|
||||
let uri = std::env::var("TEST_MONGODB_URI")
|
||||
.unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
|
||||
let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
|
||||
let db = match Database::connect(&uri, &db_name).await {
|
||||
Ok(d) => d,
|
||||
Err(_) => {
|
||||
eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
|
||||
return None;
|
||||
}
|
||||
};
|
||||
db.ensure_indexes().await.expect("ensure indexes");
|
||||
let queue = JobQueue::new(&db);
|
||||
Some((queue, db.inner().clone()))
|
||||
}
|
||||
|
||||
fn base_time() -> DateTime<Utc> {
|
||||
Utc.timestamp_opt(1_700_000_000, 0).unwrap()
|
||||
}
|
||||
|
||||
fn job(id: &str) -> Job {
|
||||
Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
|
||||
}
|
||||
|
||||
fn job_with_labels(id: &str, labels: &[&str]) -> Job {
|
||||
let mut j = job(id);
|
||||
j.labels = labels.iter().map(|s| s.to_string()).collect();
|
||||
j
|
||||
}
|
||||
|
||||
macro_rules! skip_if_no_mongo {
|
||||
() => {
|
||||
match setup().await {
|
||||
Some(v) => v,
|
||||
None => return,
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn enqueue_is_idempotent() {
|
||||
let (q, db) = skip_if_no_mongo!();
|
||||
let now = base_time();
|
||||
|
||||
assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
|
||||
// Same id again — no duplicate row, reports "already present".
|
||||
assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
|
||||
|
||||
let rec = q.get("j1").await.expect("get").expect("exists");
|
||||
assert_eq!(
|
||||
rec.status,
|
||||
compliance_core::models::werkbank::JobStatus::Queued
|
||||
);
|
||||
assert_eq!(rec.attempts, 0);
|
||||
|
||||
db.drop().await.ok();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn lease_matches_executor_and_labels_and_is_fifo() {
|
||||
let (q, db) = skip_if_no_mongo!();
|
||||
let t0 = base_time();
|
||||
|
||||
// Two docker jobs (j_old older than j_new) + one requiring a kvm label.
|
||||
q.enqueue(job("j_old"), t0).await.unwrap();
|
||||
q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
|
||||
.await
|
||||
.unwrap();
|
||||
q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
// Wrong executor: a shell runner leases nothing.
|
||||
assert!(q
|
||||
.lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
|
||||
// A docker runner without the kvm label gets the oldest label-free job (FIFO).
|
||||
let leased = q
|
||||
.lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
|
||||
.await
|
||||
.unwrap()
|
||||
.expect("leased");
|
||||
assert_eq!(leased.job.id, "j_old", "oldest matching job first");
|
||||
assert!(!leased.lease_token.is_empty());
|
||||
|
||||
// The kvm job stays unleased for that runner (missing label)...
|
||||
let none = q
|
||||
.lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
|
||||
.await
|
||||
.unwrap()
|
||||
.expect("next");
|
||||
assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
|
||||
|
||||
// ...but a runner advertising kvm can take it.
|
||||
let kvm = q
|
||||
.lease(
|
||||
"r2",
|
||||
Executor::Docker,
|
||||
&["kvm=true".to_string(), "arch=amd64".to_string()],
|
||||
Duration::from_secs(30),
|
||||
t0,
|
||||
)
|
||||
.await
|
||||
.unwrap()
|
||||
.expect("kvm leased");
|
||||
assert_eq!(kvm.job.id, "j_kvm");
|
||||
|
||||
// A leased job increments attempts and is no longer queued.
|
||||
let rec = q.get("j_old").await.unwrap().unwrap();
|
||||
assert_eq!(rec.attempts, 1);
|
||||
assert_eq!(rec.leased_by.as_deref(), Some("r1"));
|
||||
|
||||
db.drop().await.ok();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn heartbeat_extends_lease_and_surfaces_cancel() {
|
||||
let (q, db) = skip_if_no_mongo!();
|
||||
let now = base_time();
|
||||
|
||||
q.enqueue(job("j1"), now).await.unwrap();
|
||||
let leased = q
|
||||
.lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
// A valid heartbeat moves it to running and reports not-cancelled.
|
||||
let ack = q
|
||||
.heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
|
||||
.await
|
||||
.unwrap()
|
||||
.expect("valid lease");
|
||||
assert!(!ack.cancelled);
|
||||
assert_eq!(
|
||||
q.get("j1").await.unwrap().unwrap().status,
|
||||
compliance_core::models::werkbank::JobStatus::Running
|
||||
);
|
||||
|
||||
// A wrong token is a lost lease.
|
||||
assert!(q
|
||||
.heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
|
||||
// Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
|
||||
assert!(q.cancel("j1", now).await.unwrap());
|
||||
let ack = q
|
||||
.heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
|
||||
.await
|
||||
.unwrap()
|
||||
.expect("still leased");
|
||||
assert!(ack.cancelled);
|
||||
|
||||
db.drop().await.ok();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn complete_is_idempotent_and_token_guarded() {
|
||||
let (q, db) = skip_if_no_mongo!();
|
||||
let now = base_time();
|
||||
|
||||
q.enqueue(job("j1"), now).await.unwrap();
|
||||
let leased = q
|
||||
.lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
// Wrong token cannot complete.
|
||||
let mut result = JobResult::succeeded("j1");
|
||||
result.findings = Vec::new();
|
||||
assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
|
||||
|
||||
// The lease holder completes it once...
|
||||
assert!(q
|
||||
.complete("j1", &leased.lease_token, &result, now)
|
||||
.await
|
||||
.unwrap());
|
||||
let rec = q.get("j1").await.unwrap().unwrap();
|
||||
assert_eq!(
|
||||
rec.status,
|
||||
compliance_core::models::werkbank::JobStatus::Succeeded
|
||||
);
|
||||
assert!(rec.result.is_some());
|
||||
assert!(rec.lease_token.is_none(), "lease cleared on completion");
|
||||
|
||||
// ...and a second (duplicate) completion is a no-op.
|
||||
assert!(!q
|
||||
.complete("j1", &leased.lease_token, &result, now)
|
||||
.await
|
||||
.unwrap());
|
||||
|
||||
db.drop().await.ok();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn sweep_requeues_expired_then_expires_after_max_attempts() {
|
||||
let (q, db) = skip_if_no_mongo!();
|
||||
let t0 = base_time();
|
||||
|
||||
q.enqueue(job("j1"), t0).await.unwrap();
|
||||
|
||||
// Lease #1 with a 10s TTL; then time jumps past expiry.
|
||||
q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
let past = t0 + chrono::Duration::seconds(60);
|
||||
|
||||
// attempts=1 < max=2 → requeued.
|
||||
let swept = q.sweep_expired(past, 2).await.unwrap();
|
||||
assert_eq!(swept.requeued, 1);
|
||||
assert_eq!(swept.expired, 0);
|
||||
assert_eq!(
|
||||
q.get("j1").await.unwrap().unwrap().status,
|
||||
compliance_core::models::werkbank::JobStatus::Queued
|
||||
);
|
||||
|
||||
// Lease #2 (attempts=2), let it expire again → now expired (>= max).
|
||||
q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
let later = past + chrono::Duration::seconds(60);
|
||||
let swept = q.sweep_expired(later, 2).await.unwrap();
|
||||
assert_eq!(swept.requeued, 0);
|
||||
assert_eq!(swept.expired, 1);
|
||||
assert_eq!(
|
||||
q.get("j1").await.unwrap().unwrap().status,
|
||||
compliance_core::models::werkbank::JobStatus::Expired
|
||||
);
|
||||
|
||||
db.drop().await.ok();
|
||||
}
|
||||
@@ -50,7 +50,3 @@ axum = { version = "0.8", optional = true }
|
||||
jsonwebtoken = { version = "9", optional = true }
|
||||
reqwest = { workspace = true, optional = true }
|
||||
tokio = { workspace = true, optional = true }
|
||||
|
||||
[dev-dependencies]
|
||||
# Parse the declarative TOML job specs in the Werkbank contract tests.
|
||||
toml = "0.8"
|
||||
|
||||
@@ -64,11 +64,11 @@ struct Claims {
|
||||
const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
|
||||
|
||||
/// Path prefixes that bypass JWT validation. The admin sub-router
|
||||
/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
|
||||
/// have their own static-bearer middleware and must not be routed through the
|
||||
/// customer-JWT path — a Keycloak token always carries a single tenant_id and
|
||||
/// would semantically conflict with these cross-tenant / machine operations.
|
||||
const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
|
||||
/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
|
||||
/// not be routed through the customer-JWT path — a Keycloak token
|
||||
/// always carries a single tenant_id and would semantically conflict
|
||||
/// with cross-tenant admin operations.
|
||||
const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
|
||||
|
||||
/// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
|
||||
/// and attaches a `TenantContext` extension on success.
|
||||
|
||||
@@ -49,101 +49,6 @@ pub struct AgentConfig {
|
||||
/// of tenants to iterate. When `None` or unreachable, scheduler
|
||||
/// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
|
||||
pub tenant_registry_url: Option<String>,
|
||||
/// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
|
||||
/// default: it needs Docker access in the agent's runtime, which is a
|
||||
/// deployment opt-in.
|
||||
pub plc_runtime: PlcRuntimeConfig,
|
||||
/// Static bearer for the Werkbank runner endpoints
|
||||
/// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
|
||||
/// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
|
||||
/// `None`, those endpoints are not mounted at all.
|
||||
pub werkbank_runner_token: Option<SecretString>,
|
||||
/// Source for the OSCAL control catalog pulled from breakpilot-compliance
|
||||
/// (drives the [`crate::traits::ControlsProvider`]). Disabled when
|
||||
/// `base_url` is `None`.
|
||||
pub breakpilot: BreakpilotConfig,
|
||||
}
|
||||
|
||||
/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
|
||||
/// to snapshot it for deterministic / offline reuse.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct BreakpilotConfig {
|
||||
/// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
|
||||
/// the OSCAL controls provider.
|
||||
pub base_url: Option<String>,
|
||||
/// Optional bearer token for the catalog endpoint.
|
||||
pub token: Option<SecretString>,
|
||||
/// Directory for catalog snapshots.
|
||||
pub snapshot_dir: String,
|
||||
/// Enable the master-controls **semantic** mapping pass (embed regions,
|
||||
/// retrieve nearest controls, grounded-judge). Off by default: it is the
|
||||
/// scale path and stays gated until verified live against a deployed
|
||||
/// master-controls catalog.
|
||||
pub semantic_mapping: bool,
|
||||
/// Enable the **grounded surface** pass for absence-based controls (retrieve
|
||||
/// the code surface a control governs, judge whether it holds). Off by
|
||||
/// default: absence detection is the least deterministic path and stays gated
|
||||
/// until tuned against live scans.
|
||||
pub grounded_control_checks: bool,
|
||||
}
|
||||
|
||||
impl Default for BreakpilotConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
base_url: None,
|
||||
token: None,
|
||||
snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
|
||||
semantic_mapping: false,
|
||||
grounded_control_checks: false,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
|
||||
///
|
||||
/// When a PLC/SPS target ships control logic but no reachable live device, the
|
||||
/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
|
||||
/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
|
||||
/// over industrial protocols, then tear it down. This struct carries the knobs
|
||||
/// for that container's lifecycle and the OpenPLC web-UI credentials used to
|
||||
/// upload the program.
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct PlcRuntimeConfig {
|
||||
/// Master switch. Provision-and-test does nothing unless this is set — it
|
||||
/// shells out to `docker`, which requires the agent container to have Docker
|
||||
/// access (socket mount), an explicit deployment decision.
|
||||
pub enabled: bool,
|
||||
/// Container image for the ephemeral soft-PLC (OpenPLC).
|
||||
pub image: String,
|
||||
/// Docker network the instance joins. Must be the agent's own network so it
|
||||
/// is reachable in-cluster by container name and never published to the host.
|
||||
pub network: String,
|
||||
/// Memory cap passed to `docker run --memory` (e.g. `512m`).
|
||||
pub memory: String,
|
||||
/// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
|
||||
pub cpus: String,
|
||||
/// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
|
||||
/// no later than this even if a load/probe step hangs.
|
||||
pub max_lifetime_secs: u64,
|
||||
/// OpenPLC web-UI username for the program upload (image default `openplc`).
|
||||
pub openplc_user: String,
|
||||
/// OpenPLC web-UI password (image default `openplc`).
|
||||
pub openplc_password: SecretString,
|
||||
}
|
||||
|
||||
impl Default for PlcRuntimeConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
enabled: false,
|
||||
image: "registry.meghsakha.com/openplc:latest".to_string(),
|
||||
network: "certifai".to_string(),
|
||||
memory: "512m".to_string(),
|
||||
cpus: "0.5".to_string(),
|
||||
max_lifetime_secs: 180,
|
||||
openplc_user: "openplc".to_string(),
|
||||
openplc_password: SecretString::from("openplc".to_string()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Serialize, Deserialize)]
|
||||
|
||||
@@ -1,205 +0,0 @@
|
||||
//! Grounded control-driven checking.
|
||||
//!
|
||||
//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
|
||||
//! whose output is grounded to real code — so a hallucinated finding cannot
|
||||
//! survive. Determinism is structural, not a prompt plea:
|
||||
//!
|
||||
//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
|
||||
//! code it never saw;
|
||||
//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
|
||||
//! in the region, and the line is recomputed from that match — the model's own
|
||||
//! line number is never trusted ([`ground`]);
|
||||
//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
|
||||
//!
|
||||
//! The LLM supplies cross-language / cross-stack pattern recognition; this module
|
||||
//! supplies the determinism.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use crate::models::finding::{Finding, Severity};
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
/// A control rendered as a check the LLM judges code against.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlCheckSpec {
|
||||
/// Stable control id, e.g. `"cra-ai-8"`.
|
||||
pub control_id: String,
|
||||
/// Short control title (used in the finding title).
|
||||
pub title: String,
|
||||
/// The requirement text the LLM judges against (control objective/statement).
|
||||
pub requirement: String,
|
||||
/// CWE to fall back to when the model doesn't supply one.
|
||||
pub default_cwe: Option<String>,
|
||||
/// Severity for findings raised from this control.
|
||||
pub severity: Severity,
|
||||
}
|
||||
|
||||
/// A retrieved code region the LLM judges — never the whole repo.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct CandidateRegion {
|
||||
/// Repo-relative path.
|
||||
pub file: String,
|
||||
/// 1-based line number of the region's first line in `file`.
|
||||
pub start_line: u32,
|
||||
/// The region's source text.
|
||||
pub content: String,
|
||||
}
|
||||
|
||||
/// The LLM's structured verdict for one (control, region). `snippet` is the
|
||||
/// verbatim code the model claims proves the violation — it is the anchor the
|
||||
/// grounding gate checks.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct LlmVerdict {
|
||||
pub violates: bool,
|
||||
pub snippet: String,
|
||||
pub cwe: Option<String>,
|
||||
pub confidence: f64,
|
||||
}
|
||||
|
||||
/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
|
||||
/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
|
||||
/// finding's line is computed from the match, so a fabricated or mis-located
|
||||
/// snippet is dropped. Pure — no LLM, no I/O.
|
||||
pub fn ground(
|
||||
spec: &ControlCheckSpec,
|
||||
region: &CandidateRegion,
|
||||
verdict: &LlmVerdict,
|
||||
repo_id: &str,
|
||||
) -> Option<Finding> {
|
||||
if !verdict.violates {
|
||||
return None;
|
||||
}
|
||||
let snippet = verdict.snippet.trim();
|
||||
if snippet.is_empty() {
|
||||
return None;
|
||||
}
|
||||
// Grounding: the quoted snippet must literally exist in the retrieved region.
|
||||
let pos = region.content.find(snippet)?;
|
||||
// Recompute the real line from the match — never trust the model's number.
|
||||
let newlines_before = region.content[..pos].matches('\n').count();
|
||||
let line = region.start_line + newlines_before as u32;
|
||||
|
||||
let mut finding = Finding::new(
|
||||
repo_id.to_string(),
|
||||
control_finding_fingerprint(&spec.control_id, ®ion.file, snippet),
|
||||
"control-check".to_string(),
|
||||
ScanType::CodeReview,
|
||||
format!("{}: {}", spec.control_id, spec.title),
|
||||
format!(
|
||||
"Control {} appears violated ({}) at {}:{line}",
|
||||
spec.control_id, spec.requirement, region.file
|
||||
),
|
||||
spec.severity.clone(),
|
||||
);
|
||||
finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
|
||||
finding.file_path = Some(region.file.clone());
|
||||
finding.line_number = Some(line);
|
||||
finding.code_snippet = Some(snippet.to_string());
|
||||
finding.confidence = Some(verdict.confidence);
|
||||
// Carry the control reference on the finding.
|
||||
finding.control_refs = vec![spec.control_id.clone()];
|
||||
Some(finding)
|
||||
}
|
||||
|
||||
/// Deterministic cache key for a (control, region, model, prompt-version) verdict
|
||||
/// so identical inputs reproduce the same verdict without another LLM call.
|
||||
pub fn cache_key(
|
||||
control_id: &str,
|
||||
region_content: &str,
|
||||
model: &str,
|
||||
prompt_version: &str,
|
||||
) -> String {
|
||||
hash_parts(&[control_id, region_content, model, prompt_version])
|
||||
}
|
||||
|
||||
fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
|
||||
hash_parts(&[control_id, file, snippet])
|
||||
}
|
||||
|
||||
fn hash_parts(parts: &[&str]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for part in parts {
|
||||
hasher.update(part.as_bytes());
|
||||
hasher.update([0u8]); // domain separator between parts
|
||||
}
|
||||
hex::encode(hasher.finalize())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "def login():\n PASSWORD = \"admin123\"\n return PASSWORD\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn grounds_real_snippet_with_recomputed_line() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
let f = ground(&spec(), ®ion(), &v, "repo").expect("should ground");
|
||||
assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
|
||||
assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
|
||||
assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
|
||||
assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
|
||||
assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_fabricated_snippet_not_in_region() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "SECRET = \"totally-made-up\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.99,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &v, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_non_violation_and_empty_snippet() {
|
||||
let no = LlmVerdict {
|
||||
violates: false,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &no, "repo").is_none());
|
||||
let empty = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: " ".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &empty, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cache_key_and_fingerprint_are_deterministic() {
|
||||
assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
|
||||
assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
|
||||
assert_eq!(
|
||||
control_finding_fingerprint("c", "f", "s"),
|
||||
control_finding_fingerprint("c", "f", "s")
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod config;
|
||||
pub mod control_check;
|
||||
pub mod db;
|
||||
pub mod error;
|
||||
pub mod models;
|
||||
@@ -14,6 +13,6 @@ pub mod auth;
|
||||
#[cfg(feature = "axum")]
|
||||
pub mod tenant_ctx;
|
||||
|
||||
pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
|
||||
pub use config::{AgentConfig, DashboardConfig};
|
||||
pub use error::CoreError;
|
||||
pub use tenant::{OrgRole, TenantContext, TenantStatus};
|
||||
|
||||
@@ -76,10 +76,6 @@ pub struct Finding {
|
||||
pub triage_rationale: Option<String>,
|
||||
/// Developer feedback on finding quality
|
||||
pub developer_feedback: Option<String>,
|
||||
/// Compliance control ids this finding is evidence for (stamped by control
|
||||
/// triage against the `control-map` LUT). Empty when unmapped.
|
||||
#[serde(default)]
|
||||
pub control_refs: Vec<String>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
pub created_at: DateTime<Utc>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
@@ -122,7 +118,6 @@ impl Finding {
|
||||
triage_action: None,
|
||||
triage_rationale: None,
|
||||
developer_feedback: None,
|
||||
control_refs: Vec::new(),
|
||||
created_at: now,
|
||||
updated_at: now,
|
||||
}
|
||||
|
||||
@@ -10,14 +10,11 @@ pub mod mcp;
|
||||
pub mod mcp_token;
|
||||
pub mod notification;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod oscal_assessment;
|
||||
pub mod pentest;
|
||||
pub mod repository;
|
||||
pub mod sbom;
|
||||
pub mod scan;
|
||||
pub(crate) mod serde_helpers;
|
||||
pub mod werkbank;
|
||||
|
||||
pub use auth::AuthInfo;
|
||||
pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
|
||||
@@ -41,8 +38,6 @@ pub use onboarding::{
|
||||
GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
|
||||
TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
|
||||
};
|
||||
pub use oscal::OscalDocument;
|
||||
pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
|
||||
pub use pentest::{
|
||||
AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
|
||||
PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
|
||||
@@ -52,8 +47,3 @@ pub use pentest::{
|
||||
pub use repository::ScanTrigger;
|
||||
pub use sbom::{SbomEntry, VulnRef};
|
||||
pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
|
||||
pub use werkbank::{
|
||||
CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
|
||||
InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
|
||||
LeasedJob,
|
||||
};
|
||||
|
||||
@@ -202,9 +202,6 @@ pub enum PlcFormat {
|
||||
PlcopenXml,
|
||||
/// IEC 61131-3 Structured Text source.
|
||||
StructuredText,
|
||||
/// A CODESYS project archive (`.projectarchive` — a zip bundling the project
|
||||
/// plus its referenced libraries and runtime; the source of the control-app SBOM).
|
||||
ProjectArchive,
|
||||
}
|
||||
|
||||
/// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
|
||||
|
||||
@@ -1,250 +0,0 @@
|
||||
//! OSCAL 1.1 catalog types + mapping into the controls corpus.
|
||||
//!
|
||||
//! Deserialises the OSCAL catalog served by breakpilot-compliance
|
||||
//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
|
||||
//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
|
||||
//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
|
||||
//! producer can add detail without breaking us.
|
||||
//!
|
||||
//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
|
||||
//! and scanner routing live in our assessment layer, not here — see
|
||||
//! [`crate::traits::ControlsProvider`].
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use crate::models::onboarding::ComplianceFramework;
|
||||
use crate::traits::Control as CorpusControl;
|
||||
|
||||
/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct OscalDocument {
|
||||
pub catalog: Catalog,
|
||||
}
|
||||
|
||||
/// An OSCAL catalog: metadata + a tree of control groups.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Catalog {
|
||||
pub uuid: String,
|
||||
pub metadata: Metadata,
|
||||
#[serde(default)]
|
||||
pub groups: Vec<Group>,
|
||||
#[serde(rename = "back-matter", default)]
|
||||
pub back_matter: Option<BackMatter>,
|
||||
}
|
||||
|
||||
/// Catalog metadata (title/version + provenance props).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Metadata {
|
||||
pub title: String,
|
||||
pub version: String,
|
||||
#[serde(rename = "oscal-version")]
|
||||
pub oscal_version: String,
|
||||
#[serde(default)]
|
||||
pub props: Vec<Prop>,
|
||||
}
|
||||
|
||||
/// A name/value property, optionally namespaced.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Prop {
|
||||
pub name: String,
|
||||
pub value: String,
|
||||
#[serde(default)]
|
||||
pub ns: Option<String>,
|
||||
}
|
||||
|
||||
/// A control group (may nest sub-groups and controls).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Group {
|
||||
#[serde(default)]
|
||||
pub id: String,
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
#[serde(default)]
|
||||
pub controls: Vec<Control>,
|
||||
#[serde(default)]
|
||||
pub groups: Vec<Group>,
|
||||
}
|
||||
|
||||
/// An OSCAL control (may nest enhancement controls).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Control {
|
||||
pub id: String,
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
#[serde(default)]
|
||||
pub props: Vec<Prop>,
|
||||
#[serde(default)]
|
||||
pub parts: Vec<Part>,
|
||||
#[serde(default)]
|
||||
pub links: Vec<Link>,
|
||||
#[serde(default)]
|
||||
pub controls: Vec<Control>,
|
||||
}
|
||||
|
||||
/// A control part (e.g. the `statement`), may nest sub-parts.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Part {
|
||||
#[serde(default)]
|
||||
pub name: String,
|
||||
#[serde(default)]
|
||||
pub prose: Option<String>,
|
||||
#[serde(default)]
|
||||
pub parts: Vec<Part>,
|
||||
}
|
||||
|
||||
/// A link, e.g. a `reference` to a back-matter resource.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Link {
|
||||
pub href: String,
|
||||
#[serde(default)]
|
||||
pub rel: Option<String>,
|
||||
}
|
||||
|
||||
/// Back-matter holding referenced resources (e.g. the CRA measures).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct BackMatter {
|
||||
#[serde(default)]
|
||||
pub resources: Vec<Resource>,
|
||||
}
|
||||
|
||||
/// A back-matter resource referenced by control links.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Resource {
|
||||
pub uuid: String,
|
||||
#[serde(default)]
|
||||
pub title: Option<String>,
|
||||
#[serde(default)]
|
||||
pub description: Option<String>,
|
||||
}
|
||||
|
||||
impl Metadata {
|
||||
/// First prop value with the given name.
|
||||
pub fn prop(&self, name: &str) -> Option<&str> {
|
||||
self.props
|
||||
.iter()
|
||||
.find(|p| p.name == name)
|
||||
.map(|p| p.value.as_str())
|
||||
}
|
||||
}
|
||||
|
||||
impl Control {
|
||||
/// First prop value with the given name.
|
||||
pub fn prop(&self, name: &str) -> Option<&str> {
|
||||
self.props
|
||||
.iter()
|
||||
.find(|p| p.name == name)
|
||||
.map(|p| p.value.as_str())
|
||||
}
|
||||
|
||||
/// The control's `statement` prose, if present.
|
||||
pub fn statement(&self) -> Option<&str> {
|
||||
self.parts
|
||||
.iter()
|
||||
.find(|p| p.name == "statement")
|
||||
.and_then(|p| p.prose.as_deref())
|
||||
}
|
||||
}
|
||||
|
||||
impl OscalDocument {
|
||||
/// The framework this catalog declares (`metadata.props[name="framework"]`).
|
||||
pub fn framework(&self) -> Option<ComplianceFramework> {
|
||||
framework_from_str(self.catalog.metadata.prop("framework")?)
|
||||
}
|
||||
|
||||
/// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
|
||||
pub fn content_hash(&self) -> Option<&str> {
|
||||
self.catalog.metadata.prop("content-hash")
|
||||
}
|
||||
|
||||
/// Flatten the catalog into the corpus controls the mapping engine consumes.
|
||||
pub fn to_controls(&self) -> Vec<CorpusControl> {
|
||||
let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
|
||||
let source_label = self.catalog.metadata.title.as_str();
|
||||
let mut out = Vec::new();
|
||||
for group in &self.catalog.groups {
|
||||
collect_group(group, framework, source_label, &mut out);
|
||||
}
|
||||
out
|
||||
}
|
||||
}
|
||||
|
||||
/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
|
||||
/// serde snake_case representation.
|
||||
fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
|
||||
serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
|
||||
}
|
||||
|
||||
fn collect_group(
|
||||
group: &Group,
|
||||
framework: ComplianceFramework,
|
||||
source_label: &str,
|
||||
out: &mut Vec<CorpusControl>,
|
||||
) {
|
||||
for control in &group.controls {
|
||||
collect_control(control, framework, source_label, out);
|
||||
}
|
||||
for sub in &group.groups {
|
||||
collect_group(sub, framework, source_label, out);
|
||||
}
|
||||
}
|
||||
|
||||
fn collect_control(
|
||||
control: &Control,
|
||||
framework: ComplianceFramework,
|
||||
source_label: &str,
|
||||
out: &mut Vec<CorpusControl>,
|
||||
) {
|
||||
let source = match control.prop("annex-anchor") {
|
||||
Some(anchor) => Some(format!("{source_label} · {anchor}")),
|
||||
None => Some(source_label.to_string()),
|
||||
};
|
||||
out.push(CorpusControl {
|
||||
id: control.id.clone(),
|
||||
framework,
|
||||
title: control.title.clone(),
|
||||
text: control.statement().unwrap_or_default().to_string(),
|
||||
source,
|
||||
});
|
||||
for enhancement in &control.controls {
|
||||
collect_control(enhancement, framework, source_label, out);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
|
||||
|
||||
fn parse() -> OscalDocument {
|
||||
serde_json::from_str(CATALOG).unwrap()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_full_catalog() {
|
||||
let doc = parse();
|
||||
assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
|
||||
assert!(!doc.catalog.groups.is_empty());
|
||||
assert!(doc.catalog.back_matter.is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn maps_all_controls_to_corpus() {
|
||||
let doc = parse();
|
||||
let controls = doc.to_controls();
|
||||
assert_eq!(controls.len(), 40);
|
||||
assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
|
||||
|
||||
let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
|
||||
assert_eq!(c8.framework, ComplianceFramework::Cra);
|
||||
assert!(!c8.title.is_empty());
|
||||
assert!(!c8.text.is_empty(), "statement prose should map into text");
|
||||
assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn exposes_content_hash_for_snapshotting() {
|
||||
assert_eq!(parse().content_hash().map(str::len), Some(64));
|
||||
}
|
||||
}
|
||||
@@ -1,424 +0,0 @@
|
||||
//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
|
||||
//!
|
||||
//! The catalog (domain content) comes from the producer; the **assessment** is
|
||||
//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
|
||||
//! standard OSCAL assessment-results document: an observation per linked finding,
|
||||
//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
|
||||
//! records the full catalog set we considered.
|
||||
//!
|
||||
//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
|
||||
//! timestamp. Pure — no DB, no network.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use chrono::{DateTime, Utc};
|
||||
use serde::Serialize;
|
||||
use uuid::Uuid;
|
||||
|
||||
use crate::models::finding::{Finding, FindingStatus};
|
||||
|
||||
const OSCAL_VERSION: &str = "1.1.2";
|
||||
/// Same namespace as the catalog exporter, so ids are stable and correlatable.
|
||||
const NAMESPACE: Uuid = Uuid::from_bytes([
|
||||
0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
|
||||
]);
|
||||
|
||||
fn det_uuid(name: &str) -> String {
|
||||
Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
|
||||
}
|
||||
|
||||
/// Links findings to the catalog control-ids they provide evidence for.
|
||||
pub struct ControlLinker {
|
||||
cwe_to_controls: HashMap<u32, Vec<String>>,
|
||||
}
|
||||
|
||||
impl ControlLinker {
|
||||
/// Build a linker from an explicit CWE → control-id map.
|
||||
pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
|
||||
Self { cwe_to_controls }
|
||||
}
|
||||
|
||||
/// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
|
||||
/// `_CWE_TO_REQ`; extend as scanner coverage grows).
|
||||
pub fn cra_seed() -> Self {
|
||||
let pairs: &[(u32, &str)] = &[
|
||||
(798, "cra-ai-8"),
|
||||
(259, "cra-ai-8"),
|
||||
(1392, "cra-ai-8"),
|
||||
(327, "cra-ai-13"),
|
||||
(326, "cra-ai-13"),
|
||||
(319, "cra-ai-15"),
|
||||
(311, "cra-ai-15"),
|
||||
(89, "cra-ai-20"),
|
||||
(79, "cra-ai-20"),
|
||||
(78, "cra-ai-20"),
|
||||
(22, "cra-ai-20"),
|
||||
];
|
||||
let mut map: HashMap<u32, Vec<String>> = HashMap::new();
|
||||
for (cwe, id) in pairs {
|
||||
map.entry(*cwe).or_default().push((*id).to_string());
|
||||
}
|
||||
Self::new(map)
|
||||
}
|
||||
|
||||
/// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
|
||||
fn parse_cwe(raw: &str) -> Option<u32> {
|
||||
raw.trim_start_matches(|c: char| !c.is_ascii_digit())
|
||||
.split(|c: char| !c.is_ascii_digit())
|
||||
.next()
|
||||
.filter(|s| !s.is_empty())
|
||||
.and_then(|s| s.parse().ok())
|
||||
}
|
||||
|
||||
/// The control-ids a finding provides evidence for (via its CWE).
|
||||
pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
|
||||
finding
|
||||
.cwe
|
||||
.as_deref()
|
||||
.and_then(Self::parse_cwe)
|
||||
.and_then(|cwe| self.cwe_to_controls.get(&cwe))
|
||||
.cloned()
|
||||
.unwrap_or_default()
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a standard OSCAL assessment-results document from `findings`, using each
|
||||
/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
|
||||
/// finding is emitted as an observation — mapped findings additionally produce a
|
||||
/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
|
||||
/// (an observation carrying their CWE/tool/severity, with no control target) so
|
||||
/// nothing is lost. `at` is the assessment timestamp.
|
||||
pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
|
||||
let ts = at.to_rfc3339();
|
||||
|
||||
let mut observations = Vec::new();
|
||||
let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
|
||||
let mut mapped = 0usize;
|
||||
let mut unmapped = 0usize;
|
||||
|
||||
for finding in findings {
|
||||
if finding.status == FindingStatus::FalsePositive {
|
||||
continue; // flagged tool false positive — excluded from the report
|
||||
}
|
||||
let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
|
||||
let location = match (&finding.file_path, finding.line_number) {
|
||||
(Some(f), Some(l)) => Some(format!("{f}:{l}")),
|
||||
(Some(f), None) => Some(f.clone()),
|
||||
_ => None,
|
||||
};
|
||||
let is_mapped = !finding.control_refs.is_empty();
|
||||
if is_mapped {
|
||||
mapped += 1;
|
||||
} else {
|
||||
unmapped += 1;
|
||||
}
|
||||
let mut props = vec![
|
||||
ObsProp::new("tool", &finding.scanner),
|
||||
ObsProp::new("severity", &finding.severity.to_string()),
|
||||
ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
|
||||
];
|
||||
if let Some(cwe) = &finding.cwe {
|
||||
props.push(ObsProp::new("cwe", cwe));
|
||||
}
|
||||
observations.push(Observation {
|
||||
uuid: obs_uuid.clone(),
|
||||
title: finding.title.clone(),
|
||||
description: finding.description.clone(),
|
||||
methods: vec!["TEST".to_string()],
|
||||
collected: ts.clone(),
|
||||
props,
|
||||
relevant_evidence: vec![RelevantEvidence {
|
||||
href: location.map(|l| format!("file://{l}")),
|
||||
description: format!("[{}] {}", finding.scanner, finding.title),
|
||||
}],
|
||||
});
|
||||
for control_id in &finding.control_refs {
|
||||
obs_by_control
|
||||
.entry(control_id.clone())
|
||||
.or_default()
|
||||
.push(obs_uuid.clone());
|
||||
}
|
||||
}
|
||||
|
||||
let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
|
||||
hit_controls.sort();
|
||||
let ar_findings: Vec<ArFinding> = hit_controls
|
||||
.iter()
|
||||
.map(|control_id| ArFinding {
|
||||
uuid: det_uuid(&format!("finding:{control_id}")),
|
||||
title: format!("Findings affect {control_id}"),
|
||||
target: FindingTarget {
|
||||
target_type: "statement-id".to_string(),
|
||||
target_id: format!("{control_id}_smt"),
|
||||
status: TargetStatus {
|
||||
state: "not-satisfied".to_string(),
|
||||
},
|
||||
},
|
||||
related_observations: obs_by_control[*control_id]
|
||||
.iter()
|
||||
.map(|u| RelatedObservation {
|
||||
observation_uuid: u.clone(),
|
||||
})
|
||||
.collect(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let include_controls: Vec<SelectControlById> = hit_controls
|
||||
.iter()
|
||||
.map(|c| SelectControlById {
|
||||
control_id: (*c).clone(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let result = ArResult {
|
||||
uuid: det_uuid("result:cra"),
|
||||
title: "Automated code-compliance assessment".to_string(),
|
||||
description: format!(
|
||||
"{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
|
||||
observations.len(),
|
||||
include_controls.len()
|
||||
),
|
||||
start: ts.clone(),
|
||||
reviewed_controls: ReviewedControls {
|
||||
control_selections: vec![ControlSelection { include_controls }],
|
||||
},
|
||||
observations,
|
||||
findings: ar_findings,
|
||||
};
|
||||
|
||||
AssessmentResultsDoc {
|
||||
assessment_results: AssessmentResults {
|
||||
uuid: det_uuid("assessment-results:cra"),
|
||||
metadata: ArMetadata {
|
||||
title: "Compliance scanner — OSCAL assessment results".to_string(),
|
||||
last_modified: ts,
|
||||
version: "1.0.0".to_string(),
|
||||
oscal_version: OSCAL_VERSION.to_string(),
|
||||
},
|
||||
import_ap: ImportAp {
|
||||
href: "#cra-annex-i".to_string(),
|
||||
},
|
||||
results: vec![result],
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ── OSCAL assessment-results document (serialise) ────────────────────────────
|
||||
|
||||
/// The root OSCAL assessment-results document.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResultsDoc {
|
||||
#[serde(rename = "assessment-results")]
|
||||
pub assessment_results: AssessmentResults,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResults {
|
||||
pub uuid: String,
|
||||
pub metadata: ArMetadata,
|
||||
#[serde(rename = "import-ap")]
|
||||
pub import_ap: ImportAp,
|
||||
pub results: Vec<ArResult>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArMetadata {
|
||||
pub title: String,
|
||||
#[serde(rename = "last-modified")]
|
||||
pub last_modified: String,
|
||||
pub version: String,
|
||||
#[serde(rename = "oscal-version")]
|
||||
pub oscal_version: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ImportAp {
|
||||
pub href: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArResult {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub start: String,
|
||||
#[serde(rename = "reviewed-controls")]
|
||||
pub reviewed_controls: ReviewedControls,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub observations: Vec<Observation>,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub findings: Vec<ArFinding>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ReviewedControls {
|
||||
#[serde(rename = "control-selections")]
|
||||
pub control_selections: Vec<ControlSelection>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ControlSelection {
|
||||
#[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
|
||||
pub include_controls: Vec<SelectControlById>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct SelectControlById {
|
||||
#[serde(rename = "control-id")]
|
||||
pub control_id: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct Observation {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub methods: Vec<String>,
|
||||
pub collected: String,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub props: Vec<ObsProp>,
|
||||
#[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
|
||||
pub relevant_evidence: Vec<RelevantEvidence>,
|
||||
}
|
||||
|
||||
/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
|
||||
/// unmapped finding be reported fully as-is.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ObsProp {
|
||||
pub name: String,
|
||||
pub value: String,
|
||||
}
|
||||
|
||||
impl ObsProp {
|
||||
fn new(name: &str, value: &str) -> Self {
|
||||
Self {
|
||||
name: name.to_string(),
|
||||
value: value.to_string(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelevantEvidence {
|
||||
#[serde(skip_serializing_if = "Option::is_none")]
|
||||
pub href: Option<String>,
|
||||
pub description: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArFinding {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub target: FindingTarget,
|
||||
#[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
|
||||
pub related_observations: Vec<RelatedObservation>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct FindingTarget {
|
||||
#[serde(rename = "type")]
|
||||
pub target_type: String,
|
||||
#[serde(rename = "target-id")]
|
||||
pub target_id: String,
|
||||
pub status: TargetStatus,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct TargetStatus {
|
||||
pub state: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelatedObservation {
|
||||
#[serde(rename = "observation-uuid")]
|
||||
pub observation_uuid: String,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::models::finding::Severity;
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
fp.into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = cwe.map(Into::into);
|
||||
f.file_path = Some("src/auth.rs".into());
|
||||
f.line_number = Some(42);
|
||||
f.control_refs = refs.iter().map(|s| s.to_string()).collect();
|
||||
f
|
||||
}
|
||||
|
||||
fn at() -> DateTime<Utc> {
|
||||
DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
|
||||
.unwrap()
|
||||
.with_timezone(&Utc)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mapped_finding_becomes_control_finding() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1);
|
||||
assert_eq!(r.findings.len(), 1);
|
||||
assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
|
||||
assert_eq!(r.findings[0].target.status.state, "not-satisfied");
|
||||
assert_eq!(
|
||||
r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.len(),
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unmapped_finding_is_reported_as_is() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1); // still emitted...
|
||||
assert!(r.findings.is_empty()); // ...but no control finding
|
||||
assert!(r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.is_empty());
|
||||
let props: Vec<(&str, &str)> = r.observations[0]
|
||||
.props
|
||||
.iter()
|
||||
.map(|p| (p.name.as_str(), p.value.as_str()))
|
||||
.collect();
|
||||
assert!(props.contains(&("mapping", "unmapped")));
|
||||
assert!(props.contains(&("cwe", "CWE-319")));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn false_positive_is_excluded() {
|
||||
let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
|
||||
f.status = FindingStatus::FalsePositive;
|
||||
let doc = assess(&[f], at());
|
||||
assert!(doc.assessment_results.results[0].observations.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deterministic_and_valid_oscal() {
|
||||
let mk = || {
|
||||
vec![
|
||||
finding("f1", Some("CWE-798"), &["cra-ai-8"]),
|
||||
finding("f2", Some("CWE-319"), &[]),
|
||||
]
|
||||
};
|
||||
let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
assert_eq!(a, b);
|
||||
assert!(a.contains("\"oscal-version\":\"1.1.2\""));
|
||||
assert!(a.contains("\"not-satisfied\""));
|
||||
assert!(a.contains("\"mapping\""));
|
||||
}
|
||||
}
|
||||
@@ -24,9 +24,6 @@ pub enum ScanType {
|
||||
MobileStatic,
|
||||
/// Static analysis of a container image.
|
||||
ContainerScan,
|
||||
/// Dynamic probing of a running PLC/SPS device over industrial protocols
|
||||
/// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
|
||||
IcsProbe,
|
||||
}
|
||||
|
||||
impl std::fmt::Display for ScanType {
|
||||
@@ -46,7 +43,6 @@ impl std::fmt::Display for ScanType {
|
||||
Self::PlcControlLogic => write!(f, "plc_control_logic"),
|
||||
Self::MobileStatic => write!(f, "mobile_static"),
|
||||
Self::ContainerScan => write!(f, "container_scan"),
|
||||
Self::IcsProbe => write!(f, "ics_probe"),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -80,7 +76,6 @@ pub enum ScanPhase {
|
||||
LlmTriage,
|
||||
IssueCreation,
|
||||
DastScanning,
|
||||
IcsProbe,
|
||||
Completed,
|
||||
}
|
||||
|
||||
|
||||
@@ -1,514 +0,0 @@
|
||||
//! The Werkbank job/result contract (WB-01).
|
||||
//!
|
||||
//! The shared, dependency-free vocabulary the control plane and the Werkbank
|
||||
//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
|
||||
//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
|
||||
//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
|
||||
//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
|
||||
//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
|
||||
//!
|
||||
//! This module is intentionally free of the `mongodb`/`axum` features so the
|
||||
//! runner can depend on `compliance-core` without pulling the server stack.
|
||||
|
||||
use std::collections::BTreeMap;
|
||||
|
||||
use chrono::{DateTime, Utc};
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
use super::dast::DastFinding;
|
||||
use super::finding::Finding;
|
||||
use super::sbom::SbomEntry;
|
||||
|
||||
/// The kind of dynamic-execution job.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "kebab-case")]
|
||||
pub enum JobType {
|
||||
/// Instantiate control logic on an ephemeral soft-PLC and probe it.
|
||||
PlcProvision,
|
||||
/// Boot a firmware image under QEMU and run dynamic checks.
|
||||
QemuBoot,
|
||||
/// Crawl and dynamically test a running web endpoint.
|
||||
Dast,
|
||||
/// Run an active penetration test against a running target.
|
||||
Pentest,
|
||||
}
|
||||
|
||||
/// How a runner executes a job — the CI-runner-style classification. A runner
|
||||
/// advertises exactly one; a job requires one.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum Executor {
|
||||
/// A subprocess on the runner host (dev / trusted single-node).
|
||||
Shell,
|
||||
/// One or more containers on the runner's Docker (default; QEMU runs here).
|
||||
Docker,
|
||||
/// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
|
||||
K8s,
|
||||
}
|
||||
|
||||
/// Lifecycle state of a job in the queue.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum JobStatus {
|
||||
/// Waiting to be leased.
|
||||
Queued,
|
||||
/// Leased by a runner but not yet started.
|
||||
Leased,
|
||||
/// Executing on a runner.
|
||||
Running,
|
||||
/// Completed successfully.
|
||||
Succeeded,
|
||||
/// Completed with an error.
|
||||
Failed,
|
||||
/// The lease/lifetime deadline elapsed before completion.
|
||||
Expired,
|
||||
/// Cancelled by the control plane.
|
||||
Cancelled,
|
||||
}
|
||||
|
||||
impl JobStatus {
|
||||
/// Whether the job has reached a terminal state (no further transitions).
|
||||
pub fn is_terminal(self) -> bool {
|
||||
matches!(
|
||||
self,
|
||||
JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/// A reference to an input artifact. Resolved by the runner from a source it can
|
||||
/// reach; the blob itself never flows through the control plane (so an on-prem
|
||||
/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
|
||||
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct InputRef {
|
||||
/// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub blob: Option<String>,
|
||||
/// A URL the runner can reach (git repo, internal artifact store, …).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub url: Option<String>,
|
||||
}
|
||||
|
||||
impl InputRef {
|
||||
/// A content-addressed blob reference.
|
||||
pub fn blob(id: impl Into<String>) -> Self {
|
||||
Self {
|
||||
blob: Some(id.into()),
|
||||
url: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
|
||||
/// `extra` carries anything not modelled explicitly.
|
||||
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct JobRuntime {
|
||||
/// Container image (Docker executor).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub image: Option<String>,
|
||||
/// Memory cap (e.g. `512m`).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub memory: Option<String>,
|
||||
/// CPU cap (e.g. `0.5`).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub cpus: Option<String>,
|
||||
/// Network to join (e.g. `isolated`).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub network: Option<String>,
|
||||
/// QEMU machine type (qemu-boot).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub machine: Option<String>,
|
||||
/// QEMU target architecture (qemu-boot).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub arch: Option<String>,
|
||||
/// Executor-specific extras not modelled above.
|
||||
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
|
||||
pub extra: BTreeMap<String, String>,
|
||||
}
|
||||
|
||||
/// DAST collection settings for jobs that scan a web endpoint.
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct DastCollect {
|
||||
/// Maximum crawl depth (kept shallow for ephemeral instances).
|
||||
pub max_crawl_depth: u32,
|
||||
}
|
||||
|
||||
/// What to collect from a run.
|
||||
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct JobCollect {
|
||||
/// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
|
||||
#[serde(default)]
|
||||
pub ics_probe: bool,
|
||||
/// Run DAST against the provisioned/booted web endpoint.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub dast: Option<DastCollect>,
|
||||
/// Run an active pentest.
|
||||
#[serde(default)]
|
||||
pub pentest: bool,
|
||||
/// Collect an SBOM.
|
||||
#[serde(default)]
|
||||
pub sbom: bool,
|
||||
}
|
||||
|
||||
/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
|
||||
/// runner leases and executes.
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct Job {
|
||||
/// Unique job id (assigned by the control plane on enqueue).
|
||||
pub id: String,
|
||||
/// What kind of job this is.
|
||||
#[serde(rename = "type")]
|
||||
pub job_type: JobType,
|
||||
/// Owning tenant.
|
||||
pub tenant: String,
|
||||
/// The onboarded target this job tests.
|
||||
pub target_id: String,
|
||||
/// The executor a runner must provide to run this job.
|
||||
pub executor: Executor,
|
||||
/// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
|
||||
#[serde(default, skip_serializing_if = "Vec::is_empty")]
|
||||
pub labels: Vec<String>,
|
||||
/// Hard lifetime deadline for the whole job.
|
||||
pub timeout_secs: u64,
|
||||
/// Named input artifacts (e.g. `program`, `firmware`), by reference.
|
||||
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
|
||||
pub inputs: BTreeMap<String, InputRef>,
|
||||
/// Sandbox runtime knobs.
|
||||
#[serde(default)]
|
||||
pub runtime: JobRuntime,
|
||||
/// What to collect from the run.
|
||||
#[serde(default)]
|
||||
pub collect: JobCollect,
|
||||
}
|
||||
|
||||
impl Job {
|
||||
/// A `plc-provision` job: instantiate the control logic named `program` on an
|
||||
/// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
|
||||
pub fn plc_provision(
|
||||
id: impl Into<String>,
|
||||
tenant: impl Into<String>,
|
||||
target_id: impl Into<String>,
|
||||
program: InputRef,
|
||||
timeout_secs: u64,
|
||||
) -> Self {
|
||||
let mut inputs = BTreeMap::new();
|
||||
inputs.insert("program".to_string(), program);
|
||||
Self {
|
||||
id: id.into(),
|
||||
job_type: JobType::PlcProvision,
|
||||
tenant: tenant.into(),
|
||||
target_id: target_id.into(),
|
||||
executor: Executor::Docker,
|
||||
labels: Vec::new(),
|
||||
timeout_secs,
|
||||
inputs,
|
||||
runtime: JobRuntime::default(),
|
||||
collect: JobCollect {
|
||||
ics_probe: true,
|
||||
dast: Some(DastCollect { max_crawl_depth: 2 }),
|
||||
pentest: false,
|
||||
sbom: false,
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The outcome of running a job, posted back to the control plane. Findings and
|
||||
/// SBOM reuse the shared scanner types, so the control plane persists them
|
||||
/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
pub struct JobResult {
|
||||
/// The job this result is for.
|
||||
pub job_id: String,
|
||||
/// Terminal status of the job.
|
||||
pub status: Option<JobStatus>,
|
||||
/// General scanner findings (e.g. ICS-probe findings).
|
||||
#[serde(default, skip_serializing_if = "Vec::is_empty")]
|
||||
pub findings: Vec<Finding>,
|
||||
/// DAST findings from a web-endpoint scan.
|
||||
#[serde(default, skip_serializing_if = "Vec::is_empty")]
|
||||
pub dast_findings: Vec<DastFinding>,
|
||||
/// SBOM components collected from the run.
|
||||
#[serde(default, skip_serializing_if = "Vec::is_empty")]
|
||||
pub sbom: Vec<SbomEntry>,
|
||||
/// Error message when the job failed.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub error: Option<String>,
|
||||
/// Captured execution log (truncated by the runner).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub logs: Option<String>,
|
||||
/// When execution started on the runner.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub started_at: Option<DateTime<Utc>>,
|
||||
/// When execution finished.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub finished_at: Option<DateTime<Utc>>,
|
||||
}
|
||||
|
||||
impl JobResult {
|
||||
/// A successful result for a job.
|
||||
pub fn succeeded(job_id: impl Into<String>) -> Self {
|
||||
Self {
|
||||
job_id: job_id.into(),
|
||||
status: Some(JobStatus::Succeeded),
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
|
||||
/// A failed result carrying an error message.
|
||||
pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
|
||||
Self {
|
||||
job_id: job_id.into(),
|
||||
status: Some(JobStatus::Failed),
|
||||
error: Some(error.into()),
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
|
||||
/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
|
||||
/// eventual result. The runner never sees this record; on lease it receives a
|
||||
/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
|
||||
///
|
||||
/// Timestamps persist as native BSON dates so the queue's range queries (lease
|
||||
/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
|
||||
/// correctly.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct JobRecord {
|
||||
/// The job to run.
|
||||
pub job: Job,
|
||||
/// Current queue state.
|
||||
pub status: JobStatus,
|
||||
/// The lease token held by the current runner (proves lease ownership).
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub lease_token: Option<String>,
|
||||
/// Id of the runner holding the lease.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub leased_by: Option<String>,
|
||||
/// When the current lease expires — the visibility timeout after which a
|
||||
/// crashed runner's job is swept back to `queued`.
|
||||
#[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
|
||||
pub lease_expires_at: Option<DateTime<Utc>>,
|
||||
/// Last heartbeat from the runner.
|
||||
#[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
|
||||
pub heartbeat_at: Option<DateTime<Utc>>,
|
||||
/// How many times the job has been leased (incremented on each lease).
|
||||
#[serde(default)]
|
||||
pub attempts: u32,
|
||||
/// Set when the control plane requests cancellation; the runner sees it on
|
||||
/// its next heartbeat and aborts.
|
||||
#[serde(default)]
|
||||
pub cancel_requested: bool,
|
||||
/// The result, once the job reaches a terminal state.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub result: Option<JobResult>,
|
||||
/// When the job was enqueued.
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
pub created_at: DateTime<Utc>,
|
||||
/// Last modification.
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
pub updated_at: DateTime<Utc>,
|
||||
}
|
||||
|
||||
impl JobRecord {
|
||||
/// A freshly-enqueued (`queued`) record for a job.
|
||||
pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
|
||||
Self {
|
||||
job,
|
||||
status: JobStatus::Queued,
|
||||
lease_token: None,
|
||||
leased_by: None,
|
||||
lease_expires_at: None,
|
||||
heartbeat_at: None,
|
||||
attempts: 0,
|
||||
cancel_requested: false,
|
||||
result: None,
|
||||
created_at: now,
|
||||
updated_at: now,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A job handed to a runner on lease: what to run plus the token the runner must
|
||||
/// present to heartbeat and complete it.
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct LeasedJob {
|
||||
/// The job to execute.
|
||||
pub job: Job,
|
||||
/// The lease token proving ownership (opaque to the runner).
|
||||
pub lease_token: String,
|
||||
}
|
||||
|
||||
/// The runner's view of a heartbeat: whether the control plane has asked the job
|
||||
/// to stop. `None` from the queue means the lease was lost (token mismatch or the
|
||||
/// job already terminal) and the runner should abandon the work.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct HeartbeatAck {
|
||||
/// The control plane requested cancellation — the runner should tear down.
|
||||
pub cancelled: bool,
|
||||
}
|
||||
|
||||
// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
|
||||
// Shared so the runner (client) and the control plane (server) agree on shapes.
|
||||
|
||||
/// Runner → control plane: lease the oldest runnable job for this runner.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct LeaseRequest {
|
||||
/// The tenant queue to lease from.
|
||||
pub tenant: String,
|
||||
/// The runner id (advertised for attribution).
|
||||
pub runner_id: String,
|
||||
/// The executor this runner provides.
|
||||
pub executor: Executor,
|
||||
/// The capability labels this runner advertises.
|
||||
#[serde(default)]
|
||||
pub labels: Vec<String>,
|
||||
/// Requested lease lifetime (the visibility timeout), in seconds.
|
||||
pub lease_ttl_secs: u64,
|
||||
}
|
||||
|
||||
/// Runner → control plane: prove lease ownership and extend it.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct HeartbeatRequest {
|
||||
/// The tenant queue.
|
||||
pub tenant: String,
|
||||
/// The job being worked.
|
||||
pub job_id: String,
|
||||
/// The lease token from the [`LeasedJob`].
|
||||
pub lease_token: String,
|
||||
/// Lease lifetime to extend to, in seconds.
|
||||
pub lease_ttl_secs: u64,
|
||||
}
|
||||
|
||||
/// Runner → control plane: record a job's terminal result.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct CompleteRequest {
|
||||
/// The tenant queue.
|
||||
pub tenant: String,
|
||||
/// The job being completed.
|
||||
pub job_id: String,
|
||||
/// The lease token proving ownership.
|
||||
pub lease_token: String,
|
||||
/// The result to record.
|
||||
pub result: JobResult,
|
||||
}
|
||||
|
||||
/// Control plane → runner: whether the completion was recorded (false if the
|
||||
/// lease was already lost — token mismatch or the job had become terminal).
|
||||
#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
|
||||
pub struct CompleteResponse {
|
||||
/// Whether the result was recorded.
|
||||
pub recorded: bool,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn job_round_trips_through_json() {
|
||||
let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
|
||||
let json = serde_json::to_string(&job).expect("serialize");
|
||||
let back: Job = serde_json::from_str(&json).expect("deserialize");
|
||||
assert_eq!(job, back);
|
||||
// Enum wire forms are the kebab/lowercase the contract documents.
|
||||
assert!(json.contains("\"type\":\"plc-provision\""));
|
||||
assert!(json.contains("\"executor\":\"docker\""));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_the_design_doc_plc_provision_toml() {
|
||||
// The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
|
||||
#[derive(Deserialize)]
|
||||
struct JobFile {
|
||||
job: Job,
|
||||
}
|
||||
let src = r#"
|
||||
[job]
|
||||
id = "job_01H"
|
||||
type = "plc-provision"
|
||||
tenant = "acme"
|
||||
target_id = "64f0"
|
||||
executor = "docker"
|
||||
labels = ["arch=amd64"]
|
||||
timeout_secs = 180
|
||||
|
||||
[job.inputs]
|
||||
program = { blob = "sha256:deadbeef" }
|
||||
|
||||
[job.runtime]
|
||||
image = "openplc:latest"
|
||||
memory = "512m"
|
||||
cpus = "0.5"
|
||||
network = "isolated"
|
||||
|
||||
[job.collect]
|
||||
ics_probe = true
|
||||
dast = { max_crawl_depth = 2 }
|
||||
"#;
|
||||
let file: JobFile = toml::from_str(src).expect("parse job toml");
|
||||
let job = file.job;
|
||||
assert_eq!(job.job_type, JobType::PlcProvision);
|
||||
assert_eq!(job.executor, Executor::Docker);
|
||||
assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
|
||||
assert_eq!(
|
||||
job.inputs.get("program").and_then(|i| i.blob.as_deref()),
|
||||
Some("sha256:deadbeef")
|
||||
);
|
||||
assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
|
||||
assert!(job.collect.ics_probe);
|
||||
assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn qemu_boot_runtime_fields_parse() {
|
||||
#[derive(Deserialize)]
|
||||
struct JobFile {
|
||||
job: Job,
|
||||
}
|
||||
let src = r#"
|
||||
[job]
|
||||
id = "j2"
|
||||
type = "qemu-boot"
|
||||
tenant = "acme"
|
||||
target_id = "t"
|
||||
executor = "docker"
|
||||
labels = ["kvm=true"]
|
||||
timeout_secs = 600
|
||||
[job.inputs]
|
||||
firmware = { blob = "sha256:cafe" }
|
||||
[job.runtime]
|
||||
machine = "virt"
|
||||
arch = "arm"
|
||||
memory = "1g"
|
||||
"#;
|
||||
let file: JobFile = toml::from_str(src).expect("parse");
|
||||
assert_eq!(file.job.job_type, JobType::QemuBoot);
|
||||
assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
|
||||
assert_eq!(
|
||||
file.job
|
||||
.inputs
|
||||
.get("firmware")
|
||||
.and_then(|i| i.blob.as_deref()),
|
||||
Some("sha256:cafe")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn status_terminality() {
|
||||
assert!(JobStatus::Succeeded.is_terminal());
|
||||
assert!(JobStatus::Expired.is_terminal());
|
||||
assert!(!JobStatus::Queued.is_terminal());
|
||||
assert!(!JobStatus::Running.is_terminal());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn result_constructors() {
|
||||
assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
|
||||
let f = JobResult::failed("j", "boom");
|
||||
assert_eq!(f.status, Some(JobStatus::Failed));
|
||||
assert_eq!(f.error.as_deref(), Some("boom"));
|
||||
}
|
||||
}
|
||||
@@ -14,12 +14,8 @@ use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
|
||||
pub enum ArtifactRequirement {
|
||||
/// Source code — a git repo or a source archive.
|
||||
Code,
|
||||
/// A reachable running instance (any live URL / endpoint, scheme-agnostic —
|
||||
/// e.g. the ICS probe works off the host:port of a modbus:// or http:// ref).
|
||||
/// A reachable running instance (live URL / endpoint).
|
||||
RunningUrl,
|
||||
/// A reachable **web** endpoint — a live URL with an http(s) scheme. DAST is
|
||||
/// an HTTP crawler, so a modbus:// / opc.tcp:// endpoint does not satisfy it.
|
||||
HttpUrl,
|
||||
/// A firmware image / binary blob.
|
||||
Firmware,
|
||||
/// A PLC project (PLCopen XML or Structured Text).
|
||||
@@ -138,7 +134,7 @@ fn sast_umbrella() -> Vec<ScanRule> {
|
||||
/// The rule set for a target type. Scans that are never applicable to a type are
|
||||
/// simply absent (e.g. DAST is not listed for a PLC target).
|
||||
pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
|
||||
use ArtifactRequirement::{Firmware, HttpUrl, Mobile, Plc, RunningUrl};
|
||||
use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
|
||||
match target_type {
|
||||
TargetType::WebApp | TargetType::BackendService => {
|
||||
let mut r = sast_umbrella();
|
||||
@@ -146,7 +142,7 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
|
||||
ScanType::Dast,
|
||||
true,
|
||||
"Dynamic scan of the running endpoint",
|
||||
HttpUrl,
|
||||
RunningUrl,
|
||||
));
|
||||
r
|
||||
}
|
||||
@@ -207,62 +203,16 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
|
||||
ScanType::Dast,
|
||||
false,
|
||||
"Dynamic scan of exposed network services (if any)",
|
||||
HttpUrl,
|
||||
RunningUrl,
|
||||
));
|
||||
r
|
||||
}
|
||||
TargetType::PlcSps => {
|
||||
// A PLC/SPS device is a composite: the control application *and* the
|
||||
// device it runs on (firmware/OS + reachable runtime services). The
|
||||
// control-logic scan runs on the PLC project; the firmware and DAST
|
||||
// scans light up only when a firmware image / running endpoint is
|
||||
// attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
|
||||
// Firmware-image SBOM/CVE *execution* is shared with the firmware
|
||||
// families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
|
||||
// endpoint uses the existing DAST path.
|
||||
vec![
|
||||
ScanRule::new(
|
||||
ScanType::PlcControlLogic,
|
||||
true,
|
||||
"Control-logic security rules over the PLC program",
|
||||
Plc,
|
||||
),
|
||||
// Device-level scans are offered but opt-in (default-off): they
|
||||
// apply only when a firmware image is attached, and firmware-image
|
||||
// SBOM/CVE *execution* is shared with the firmware families and
|
||||
// still landing (#151/#128), so they must not silently auto-run.
|
||||
ScanRule::new(
|
||||
ScanType::FirmwareStatic,
|
||||
false,
|
||||
"Static analysis of the device firmware image (OS + runtime)",
|
||||
Firmware,
|
||||
),
|
||||
ScanRule::new(
|
||||
ScanType::Sbom,
|
||||
false,
|
||||
"SBOM from the device firmware image (OS packages + CODESYS runtime)",
|
||||
Firmware,
|
||||
),
|
||||
ScanRule::new(
|
||||
ScanType::Cve,
|
||||
false,
|
||||
"Match device firmware components against known CVEs",
|
||||
Firmware,
|
||||
),
|
||||
ScanRule::new(
|
||||
ScanType::Dast,
|
||||
false,
|
||||
"Dynamic scan of the running device (WebVisu / exposed services)",
|
||||
HttpUrl,
|
||||
),
|
||||
ScanRule::new(
|
||||
ScanType::IcsProbe,
|
||||
false,
|
||||
"Probe the running device over industrial protocols (Modbus/TCP, …)",
|
||||
RunningUrl,
|
||||
),
|
||||
]
|
||||
}
|
||||
TargetType::PlcSps => vec![ScanRule::new(
|
||||
ScanType::PlcControlLogic,
|
||||
true,
|
||||
"Control-logic security rules over the PLC program",
|
||||
Plc,
|
||||
)],
|
||||
}
|
||||
}
|
||||
|
||||
@@ -279,9 +229,6 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
|
||||
| TargetType::AndroidApp
|
||||
| TargetType::IosApp
|
||||
| TargetType::EmbeddedLinuxYocto
|
||||
// A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
|
||||
// the CODESYS programming protocol), so an active pentest applies.
|
||||
| TargetType::PlcSps
|
||||
)
|
||||
}
|
||||
|
||||
@@ -289,9 +236,7 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
|
||||
fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
|
||||
match req {
|
||||
ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
|
||||
ArtifactRequirement::RunningUrl | ArtifactRequirement::HttpUrl => {
|
||||
Some(ArtifactKind::LiveUrl)
|
||||
}
|
||||
ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
|
||||
ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
|
||||
ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
|
||||
ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
|
||||
@@ -300,29 +245,13 @@ fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
|
||||
}
|
||||
}
|
||||
|
||||
/// Whether a live-URL reference is an http(s) web endpoint (vs. an industrial
|
||||
/// endpoint like `modbus://` / `opc.tcp://`, which DAST cannot crawl).
|
||||
fn is_http_url(source_ref: &str) -> bool {
|
||||
let s = source_ref.trim();
|
||||
s.starts_with("http://") || s.starts_with("https://")
|
||||
}
|
||||
|
||||
/// Whether the target carries an artifact that satisfies the requirement.
|
||||
fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
|
||||
match req {
|
||||
ArtifactRequirement::Code => target.code_artifact().is_some(),
|
||||
ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
|
||||
ArtifactRequirement::HttpUrl => target
|
||||
.artifacts
|
||||
.iter()
|
||||
.any(|a| a.kind == ArtifactKind::LiveUrl && is_http_url(&a.source_ref)),
|
||||
ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
|
||||
// A PLC project artifact, or a code artifact (git repo / source archive)
|
||||
// holding the control logic as PLCopen XML / ST exports — the common way
|
||||
// CODESYS projects are version-controlled.
|
||||
ArtifactRequirement::Plc => {
|
||||
target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
|
||||
}
|
||||
ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
|
||||
ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
|
||||
ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
|
||||
ArtifactRequirement::Any => true,
|
||||
@@ -339,10 +268,6 @@ pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
|
||||
let required_artifact = representative_kind(rule.requires);
|
||||
let blocked_reason = if satisfied {
|
||||
None
|
||||
} else if rule.requires == ArtifactRequirement::HttpUrl {
|
||||
// A live URL may be present but non-HTTP (e.g. modbus://): be
|
||||
// specific so the user knows DAST needs a web endpoint.
|
||||
Some("no http(s) live URL — DAST needs a web endpoint".to_string())
|
||||
} else {
|
||||
Some(match required_artifact {
|
||||
Some(kind) => format!("no {kind} artifact provided"),
|
||||
@@ -415,124 +340,22 @@ mod tests {
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
|
||||
// A PLC project alone: control-logic runs; the device-level scans are
|
||||
// offered but blocked until a firmware image / running endpoint is added.
|
||||
fn plc_offers_only_control_logic() {
|
||||
let t = target_with(
|
||||
TargetType::PlcSps,
|
||||
vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
|
||||
);
|
||||
let opts = applicable_scans(&t);
|
||||
let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
|
||||
assert!(plc.default_on && plc.blocked_reason.is_none());
|
||||
for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
|
||||
let o = option(&opts, scan).expect("device scan offered");
|
||||
assert!(
|
||||
!o.default_on,
|
||||
"{scan} must not pre-select without a firmware image"
|
||||
);
|
||||
assert!(o.blocked_reason.is_some());
|
||||
}
|
||||
let dast = option(&opts, ScanType::Dast).expect("dast offered");
|
||||
assert!(!dast.default_on);
|
||||
assert!(dast.blocked_reason.is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_control_logic_is_satisfied_by_a_git_repo() {
|
||||
// A CODESYS project version-controlled in git (PLCopen XML / ST exports),
|
||||
// no uploaded PlcProject artifact.
|
||||
let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
|
||||
let opts = applicable_scans(&t);
|
||||
let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
|
||||
assert!(
|
||||
plc.default_on && plc.blocked_reason.is_none(),
|
||||
"a git repo should satisfy PLC control-logic"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
|
||||
// A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
|
||||
let t = target_with(
|
||||
TargetType::PlcSps,
|
||||
vec![
|
||||
Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
|
||||
Artifact::firmware_image("device.img"),
|
||||
Artifact::live_url("http://plc.local/webvisu"),
|
||||
],
|
||||
);
|
||||
let opts = applicable_scans(&t);
|
||||
for scan in [
|
||||
ScanType::PlcControlLogic,
|
||||
ScanType::FirmwareStatic,
|
||||
ScanType::Sbom,
|
||||
ScanType::Cve,
|
||||
] {
|
||||
let o = option(&opts, scan).expect("scan offered");
|
||||
assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
|
||||
}
|
||||
// Control-logic auto-runs; the device-level scans are unblocked but opt-in
|
||||
// (default-off) until firmware-image execution lands (#151/#128).
|
||||
assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
|
||||
assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
|
||||
assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
|
||||
assert!(option(&opts, ScanType::Dast)
|
||||
.unwrap()
|
||||
.blocked_reason
|
||||
.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_with_modbus_url_offers_ics_probe_but_blocks_dast() {
|
||||
// A soft-PLC reachable only over Modbus/TCP (no WebVisu). The ICS probe
|
||||
// is applicable (it works off host:port), but DAST — an HTTP crawler —
|
||||
// must be blocked so it isn't offered/run against a non-web endpoint.
|
||||
let t = target_with(
|
||||
TargetType::PlcSps,
|
||||
vec![Artifact::live_url("modbus://plc-sim:502")],
|
||||
);
|
||||
let opts = applicable_scans(&t);
|
||||
let ics = option(&opts, ScanType::IcsProbe).expect("ics probe offered");
|
||||
assert!(
|
||||
ics.blocked_reason.is_none(),
|
||||
"ICS probe should be unblocked for a modbus:// endpoint"
|
||||
);
|
||||
assert!(!ics.default_on, "ICS probe stays opt-in (default-off)");
|
||||
let dast = option(&opts, ScanType::Dast).expect("dast listed");
|
||||
assert!(
|
||||
dast.blocked_reason.is_some(),
|
||||
"DAST must be blocked without an http(s) endpoint"
|
||||
);
|
||||
assert!(!dast.default_on);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plc_with_http_webvisu_offers_both_dast_and_ics_probe() {
|
||||
// A PLC exposing a WebVisu over HTTP: both DAST (web) and the ICS probe
|
||||
// (OT ports on the same host) are applicable.
|
||||
let t = target_with(
|
||||
TargetType::PlcSps,
|
||||
vec![Artifact::live_url("http://plc.local/webvisu")],
|
||||
);
|
||||
let opts = applicable_scans(&t);
|
||||
assert!(option(&opts, ScanType::Dast)
|
||||
.expect("dast offered")
|
||||
.blocked_reason
|
||||
.is_none());
|
||||
assert!(option(&opts, ScanType::IcsProbe)
|
||||
.expect("ics probe offered")
|
||||
.blocked_reason
|
||||
.is_none());
|
||||
assert_eq!(opts.len(), 1);
|
||||
assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
|
||||
assert!(opts[0].default_on);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn pentest_support_matches_reachable_families() {
|
||||
assert!(supports_pentest(TargetType::WebApp));
|
||||
assert!(supports_pentest(TargetType::BackendService));
|
||||
assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
|
||||
// A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
|
||||
assert!(supports_pentest(TargetType::PlcSps));
|
||||
assert!(!supports_pentest(TargetType::PlcSps));
|
||||
assert!(!supports_pentest(TargetType::FirmwareBareMetal));
|
||||
assert!(!supports_pentest(TargetType::DesktopApp));
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -78,16 +78,8 @@ pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
|
||||
.then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
|
||||
}
|
||||
"live_url" => {
|
||||
// http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
|
||||
// devices probed by the ICS probe (e.g. modbus://plc:502).
|
||||
let ok = (s.starts_with("https://")
|
||||
|| s.starts_with("http://")
|
||||
|| s.starts_with("modbus://")
|
||||
|| s.starts_with("opc.tcp://"))
|
||||
&& no_space;
|
||||
(!ok).then(|| {
|
||||
"Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
|
||||
})
|
||||
let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
|
||||
(!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
|
||||
}
|
||||
"container_image" => {
|
||||
(!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
|
||||
@@ -138,37 +130,6 @@ pub async fn create_target(
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))
|
||||
}
|
||||
|
||||
/// Upload a file artifact (PLC project, firmware image, source archive, mobile
|
||||
/// package) to a target — proxied to the agent as multipart.
|
||||
#[server]
|
||||
pub async fn upload_target_artifact(
|
||||
id: String,
|
||||
kind: String,
|
||||
plc_format: Option<String>,
|
||||
filename: String,
|
||||
bytes: Vec<u8>,
|
||||
) -> Result<TargetResponse, ServerFnError> {
|
||||
let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
|
||||
"file",
|
||||
reqwest::multipart::Part::bytes(bytes).file_name(filename),
|
||||
);
|
||||
if let Some(pf) = plc_format {
|
||||
form = form.text("plc_format", pf);
|
||||
}
|
||||
let resp = super::agent_client::agent_request(
|
||||
reqwest::Method::POST,
|
||||
&format!("/api/v1/targets/{id}/artifacts/upload"),
|
||||
)
|
||||
.await?
|
||||
.multipart(form)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))?;
|
||||
resp.json()
|
||||
.await
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))
|
||||
}
|
||||
|
||||
/// Update a target's name / type / artifacts (dashboard editor).
|
||||
#[server]
|
||||
pub async fn update_target(
|
||||
@@ -204,28 +165,6 @@ pub async fn update_target(
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))
|
||||
}
|
||||
|
||||
/// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
|
||||
/// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
|
||||
#[server]
|
||||
pub async fn enable_target_scans(
|
||||
id: String,
|
||||
scans: Vec<String>,
|
||||
) -> Result<TargetResponse, ServerFnError> {
|
||||
let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
|
||||
let resp = super::agent_client::agent_request(
|
||||
reqwest::Method::PATCH,
|
||||
&format!("/api/v1/targets/{id}"),
|
||||
)
|
||||
.await?
|
||||
.json(&body)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))?;
|
||||
resp.json()
|
||||
.await
|
||||
.map_err(|e| ServerFnError::new(e.to_string()))
|
||||
}
|
||||
|
||||
/// Run kind-based classification on a target.
|
||||
#[server]
|
||||
pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
use axum::extract::DefaultBodyLimit;
|
||||
use axum::routing::{get, post};
|
||||
use axum::{middleware, Extension};
|
||||
use dioxus::prelude::*;
|
||||
@@ -67,9 +66,6 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
|
||||
// Webhook proxy: forward to agent (no auth required)
|
||||
.route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
|
||||
.serve_dioxus_application(ServeConfig::new(), app)
|
||||
// Allow large artifact uploads through the upload server function
|
||||
// (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
|
||||
.layer(DefaultBodyLimit::max(512 * 1024 * 1024))
|
||||
.layer(Extension(PendingOAuthStore::default()))
|
||||
.layer(middleware::from_fn(require_auth))
|
||||
.layer(Extension(server_state))
|
||||
|
||||
@@ -2,8 +2,8 @@ use dioxus::prelude::*;
|
||||
|
||||
use crate::components::page_header::PageHeader;
|
||||
use crate::infrastructure::onboarding::{
|
||||
create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
|
||||
upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
|
||||
create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
|
||||
validate_artifact_ref, validate_target_name, ArtifactInputDto,
|
||||
};
|
||||
|
||||
/// (value, label, one-line description) for the 9 target families.
|
||||
@@ -41,23 +41,6 @@ const ARTIFACT_KINDS: &[(&str, &str)] = &[
|
||||
|
||||
const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
|
||||
|
||||
/// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
|
||||
fn is_file_kind(kind: &str) -> bool {
|
||||
matches!(
|
||||
kind,
|
||||
"plc_project" | "firmware_image" | "source_archive" | "mobile_package"
|
||||
)
|
||||
}
|
||||
|
||||
/// A file artifact staged in the wizard, uploaded after the target is created.
|
||||
#[derive(Clone, PartialEq)]
|
||||
struct PendingFile {
|
||||
kind: String,
|
||||
plc_format: Option<String>,
|
||||
filename: String,
|
||||
bytes: Vec<u8>,
|
||||
}
|
||||
|
||||
/// One row in the applicable-scans list on the success step.
|
||||
#[component]
|
||||
fn ScanRow(scan: serde_json::Value) -> Element {
|
||||
@@ -125,10 +108,6 @@ pub fn OnboardingPage() -> Element {
|
||||
let mut new_kind = use_signal(|| "git_repo".to_string());
|
||||
let mut new_source = use_signal(String::new);
|
||||
let mut new_branch = use_signal(|| "main".to_string());
|
||||
// File-upload artifacts (PLC project, firmware image, ...).
|
||||
let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
|
||||
let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
|
||||
let mut pending_files = use_signal(Vec::<PendingFile>::new);
|
||||
|
||||
// Create + result state.
|
||||
let mut creating = use_signal(|| false);
|
||||
@@ -137,35 +116,11 @@ pub fn OnboardingPage() -> Element {
|
||||
let mut suggested = use_signal(|| Option::<String>::None);
|
||||
let mut created_id = use_signal(|| Option::<String>::None);
|
||||
let mut scan_msg = use_signal(|| Option::<String>::None);
|
||||
// Opt-in scans (default-off but unblocked) the user ticks to enable before
|
||||
// running — stored as serde scan-type names (lowercase, no underscores).
|
||||
let mut enabled_extra = use_signal(Vec::<String>::new);
|
||||
|
||||
let step_now = step();
|
||||
let name_error = validate_target_name(&name());
|
||||
let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
|
||||
let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
|
||||
// Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
|
||||
// The user ticks these to enable them before the first run. Each entry is
|
||||
// (display name for the label, serde scan-type name for the enable call —
|
||||
// lowercase, no underscores, matching ScanType's rename_all = "lowercase").
|
||||
let optin_scans: Vec<(String, String)> = scans()
|
||||
.iter()
|
||||
.filter_map(|s| {
|
||||
let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
|
||||
let default_on = s
|
||||
.get("default_on")
|
||||
.and_then(|v| v.as_bool())
|
||||
.unwrap_or(false);
|
||||
if unblocked && !default_on {
|
||||
let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
|
||||
let serde_name = display.replace('_', "");
|
||||
Some((display, serde_name))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
})
|
||||
.collect();
|
||||
let has_artifacts = !artifacts().is_empty();
|
||||
// Live validation of the artifact reference being typed (empty = no error yet).
|
||||
let new_source_error = if new_source().is_empty() {
|
||||
None
|
||||
@@ -238,36 +193,6 @@ pub fn OnboardingPage() -> Element {
|
||||
// ---- Step 1: artifacts ----
|
||||
if step_now == 1 {
|
||||
div { class: "card-header", "Attach artifacts" }
|
||||
if target_type() == "plc_sps" {
|
||||
div {
|
||||
style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
|
||||
div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
|
||||
"Attach a "
|
||||
b { "PLC project" }
|
||||
" (PLCopen XML / ST, or a .projectarchive), or a "
|
||||
b { "Git repository" }
|
||||
" of exported source — every scan is then just a pull."
|
||||
ul { style: "margin: 6px 0 0; padding-left: 18px;",
|
||||
li {
|
||||
b { "Control-logic SAST" }
|
||||
" — commit "
|
||||
b { "PLCopen XML exports" }
|
||||
" (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
|
||||
}
|
||||
li {
|
||||
b { "Library + runtime SBOM" }
|
||||
" — include the "
|
||||
b { ".projectarchive" }
|
||||
"; PLCopen XML alone carries no libraries."
|
||||
}
|
||||
li {
|
||||
"Avoid committing only the binary "
|
||||
code { ".project" }
|
||||
" — it can't be parsed and doesn't diff."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
div { style: "padding: 16px;",
|
||||
div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
|
||||
div { class: "form-group", style: "margin: 0;",
|
||||
@@ -280,143 +205,49 @@ pub fn OnboardingPage() -> Element {
|
||||
}
|
||||
}
|
||||
}
|
||||
if is_file_kind(&new_kind()) {
|
||||
div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
|
||||
label { "File" }
|
||||
input {
|
||||
r#type: "file",
|
||||
onchange: move |evt| {
|
||||
let Some(file) = evt.files().into_iter().next() else { return; };
|
||||
let name = file.name();
|
||||
// Auto-detect the PLC format from the file extension.
|
||||
let lname = name.to_ascii_lowercase();
|
||||
if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
|
||||
new_plc_format.set("project_archive".to_string());
|
||||
} else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
|
||||
new_plc_format.set("plcopen_xml".to_string());
|
||||
} else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
|
||||
new_plc_format.set("structured_text".to_string());
|
||||
}
|
||||
spawn(async move {
|
||||
if let Ok(bytes) = file.read_bytes().await {
|
||||
new_file.set(Some((name, bytes.to_vec())));
|
||||
}
|
||||
});
|
||||
},
|
||||
}
|
||||
div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
|
||||
label { "Reference (URL / path / text)" }
|
||||
input {
|
||||
r#type: "text",
|
||||
placeholder: "https://git.example.com/acme.git",
|
||||
value: "{new_source}",
|
||||
oninput: move |e| new_source.set(e.value()),
|
||||
}
|
||||
if new_kind() == "plc_project" {
|
||||
div { class: "form-group", style: "margin: 0;",
|
||||
label { "Format" }
|
||||
select {
|
||||
value: "{new_plc_format}",
|
||||
oninput: move |e| new_plc_format.set(e.value()),
|
||||
option {
|
||||
value: "plcopen_xml",
|
||||
selected: new_plc_format() == "plcopen_xml",
|
||||
"PLCopen XML",
|
||||
}
|
||||
option {
|
||||
value: "structured_text",
|
||||
selected: new_plc_format() == "structured_text",
|
||||
"Structured Text",
|
||||
}
|
||||
option {
|
||||
value: "project_archive",
|
||||
selected: new_plc_format() == "project_archive",
|
||||
"Project archive (.projectarchive)",
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
button {
|
||||
class: "btn btn-secondary",
|
||||
disabled: new_file().is_none(),
|
||||
onclick: move |_| {
|
||||
if let Some((fname, data)) = new_file() {
|
||||
let kind = new_kind();
|
||||
let plc_format = if kind == "plc_project" {
|
||||
Some(new_plc_format())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
pending_files.write().push(PendingFile {
|
||||
kind,
|
||||
plc_format,
|
||||
filename: fname,
|
||||
bytes: data,
|
||||
});
|
||||
new_file.set(None);
|
||||
}
|
||||
},
|
||||
"+ Add file"
|
||||
}
|
||||
} else {
|
||||
div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
|
||||
label { "Reference (URL / path / text)" }
|
||||
}
|
||||
if new_kind() == "git_repo" {
|
||||
div { class: "form-group", style: "margin: 0;",
|
||||
label { "Branch" }
|
||||
input {
|
||||
r#type: "text",
|
||||
placeholder: "https://git.example.com/acme.git",
|
||||
value: "{new_source}",
|
||||
oninput: move |e| new_source.set(e.value()),
|
||||
value: "{new_branch}",
|
||||
oninput: move |e| new_branch.set(e.value()),
|
||||
}
|
||||
}
|
||||
if new_kind() == "git_repo" {
|
||||
div { class: "form-group", style: "margin: 0;",
|
||||
label { "Branch" }
|
||||
input {
|
||||
r#type: "text",
|
||||
value: "{new_branch}",
|
||||
oninput: move |e| new_branch.set(e.value()),
|
||||
}
|
||||
}
|
||||
button {
|
||||
class: "btn btn-secondary",
|
||||
disabled: new_source().trim().is_empty() || new_source_error.is_some(),
|
||||
onclick: move |_| {
|
||||
let kind = new_kind();
|
||||
if !new_source().trim().is_empty()
|
||||
&& validate_artifact_ref(&kind, &new_source()).is_none()
|
||||
{
|
||||
let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
|
||||
artifacts.write().push(ArtifactInputDto {
|
||||
kind,
|
||||
source_ref: new_source(),
|
||||
branch,
|
||||
plc_format: None,
|
||||
});
|
||||
new_source.set(String::new());
|
||||
}
|
||||
}
|
||||
button {
|
||||
class: "btn btn-secondary",
|
||||
disabled: new_source().trim().is_empty() || new_source_error.is_some(),
|
||||
onclick: move |_| {
|
||||
let kind = new_kind();
|
||||
if !new_source().trim().is_empty()
|
||||
&& validate_artifact_ref(&kind, &new_source()).is_none()
|
||||
{
|
||||
let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
|
||||
artifacts.write().push(ArtifactInputDto {
|
||||
kind,
|
||||
source_ref: new_source(),
|
||||
branch,
|
||||
plc_format: None,
|
||||
});
|
||||
new_source.set(String::new());
|
||||
}
|
||||
},
|
||||
"+ Add"
|
||||
}
|
||||
},
|
||||
"+ Add"
|
||||
}
|
||||
}
|
||||
if is_file_kind(&new_kind()) {
|
||||
if let Some((fname, data)) = new_file() {
|
||||
div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
|
||||
"Selected: {fname} ({data.len()} bytes)"
|
||||
}
|
||||
}
|
||||
} else if let Some(err) = new_source_error.clone() {
|
||||
if let Some(err) = new_source_error.clone() {
|
||||
div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
|
||||
}
|
||||
// Staged file artifacts (uploaded after the target is created).
|
||||
for (i, pf) in pending_files().iter().enumerate() {
|
||||
div {
|
||||
style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
|
||||
span {
|
||||
span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
|
||||
"{pf.filename} ({pf.bytes.len()} bytes)"
|
||||
}
|
||||
button {
|
||||
class: "btn btn-ghost-danger btn-sm",
|
||||
onclick: move |_| { pending_files.write().remove(i); },
|
||||
"Remove"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
div { style: "margin-top: 16px;",
|
||||
if has_artifacts {
|
||||
@@ -480,39 +311,6 @@ pub fn OnboardingPage() -> Element {
|
||||
ScanRow { scan: s }
|
||||
}
|
||||
}
|
||||
if !optin_scans.is_empty() {
|
||||
div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
|
||||
div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
|
||||
div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
|
||||
"These are applicable but off by default (they touch a live device). Tick to enable before running."
|
||||
}
|
||||
for pair in optin_scans.clone() {
|
||||
{
|
||||
let (display, serde_name) = pair;
|
||||
let cb_name = serde_name.clone();
|
||||
rsx! {
|
||||
label {
|
||||
style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
|
||||
input {
|
||||
r#type: "checkbox",
|
||||
checked: enabled_extra().contains(&serde_name),
|
||||
onchange: move |_| {
|
||||
let mut v = enabled_extra();
|
||||
if let Some(p) = v.iter().position(|x| x == &cb_name) {
|
||||
v.remove(p);
|
||||
} else {
|
||||
v.push(cb_name.clone());
|
||||
}
|
||||
enabled_extra.set(v);
|
||||
},
|
||||
}
|
||||
"Enable {display}"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if let Some(msg) = scan_msg() {
|
||||
div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
|
||||
}
|
||||
@@ -521,21 +319,8 @@ pub fn OnboardingPage() -> Element {
|
||||
class: "btn btn-primary",
|
||||
onclick: move |_| {
|
||||
if let Some(id) = created_id() {
|
||||
let extra = enabled_extra();
|
||||
scan_msg.set(Some("Scan triggered...".to_string()));
|
||||
spawn(async move {
|
||||
// Persist any ticked opt-in scans first, so the
|
||||
// agent's build_scan_plan includes them this run.
|
||||
if !extra.is_empty() {
|
||||
if let Err(e) =
|
||||
enable_target_scans(id.clone(), extra).await
|
||||
{
|
||||
scan_msg.set(Some(format!(
|
||||
"Failed to enable opt-in scans: {e}"
|
||||
)));
|
||||
return;
|
||||
}
|
||||
}
|
||||
match trigger_target_scan(id).await {
|
||||
Ok(_) => scan_msg.set(Some(
|
||||
"Scan started — findings will appear as it runs.".to_string(),
|
||||
@@ -555,8 +340,6 @@ pub fn OnboardingPage() -> Element {
|
||||
target_type.set(String::new());
|
||||
description.set(String::new());
|
||||
artifacts.write().clear();
|
||||
pending_files.write().clear();
|
||||
new_file.set(None);
|
||||
scans.write().clear();
|
||||
suggested.set(None);
|
||||
created_id.set(None);
|
||||
@@ -595,7 +378,6 @@ pub fn OnboardingPage() -> Element {
|
||||
let tt = target_type();
|
||||
let desc = description();
|
||||
let arts = artifacts();
|
||||
let files = pending_files();
|
||||
let d = if desc.trim().is_empty() { None } else { Some(desc) };
|
||||
creating.set(true);
|
||||
error.set(None);
|
||||
@@ -610,23 +392,6 @@ pub fn OnboardingPage() -> Element {
|
||||
.map(String::from);
|
||||
if let Some(id) = id {
|
||||
created_id.set(Some(id.clone()));
|
||||
// Upload staged file artifacts now that the target exists.
|
||||
for pf in files {
|
||||
let fname = pf.filename.clone();
|
||||
if let Err(e) = upload_target_artifact(
|
||||
id.clone(),
|
||||
pf.kind,
|
||||
pf.plc_format,
|
||||
pf.filename,
|
||||
pf.bytes,
|
||||
)
|
||||
.await
|
||||
{
|
||||
error.set(Some(format!(
|
||||
"Upload failed for {fname}: {e}"
|
||||
)));
|
||||
}
|
||||
}
|
||||
if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
|
||||
scans.set(sc.data.scans);
|
||||
}
|
||||
|
||||
@@ -232,7 +232,7 @@ pub fn TargetsPage() -> Element {
|
||||
value: "{edit_type}",
|
||||
oninput: move |e| edit_type.set(e.value()),
|
||||
for (v, l) in TARGET_TYPES.iter().copied() {
|
||||
option { value: "{v}", selected: edit_type() == v, "{l}" }
|
||||
option { value: "{v}", "{l}" }
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -257,7 +257,7 @@ pub fn TargetsPage() -> Element {
|
||||
value: "{e_kind}",
|
||||
oninput: move |e| e_kind.set(e.value()),
|
||||
for (v, l) in ARTIFACT_KINDS.iter().copied() {
|
||||
option { value: "{v}", selected: e_kind() == v, "{l}" }
|
||||
option { value: "{v}", "{l}" }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,7 +4,7 @@ use rmcp::{
|
||||
|
||||
use crate::auth::current_tenant_id;
|
||||
use crate::database::{Database, DatabasePool};
|
||||
use crate::tools::{dast, findings, oscal, pentest, sbom};
|
||||
use crate::tools::{dast, findings, pentest, sbom};
|
||||
|
||||
pub struct ComplianceMcpServer {
|
||||
pool: DatabasePool,
|
||||
@@ -68,17 +68,6 @@ impl ComplianceMcpServer {
|
||||
findings::findings_summary(&db, params).await
|
||||
}
|
||||
|
||||
#[tool(
|
||||
description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
|
||||
)]
|
||||
async fn oscal_assessment(
|
||||
&self,
|
||||
Parameters(params): Parameters<oscal::OscalAssessmentParams>,
|
||||
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||
let db = self.tenant_db()?;
|
||||
oscal::oscal_assessment(&db, params).await
|
||||
}
|
||||
|
||||
// ── SBOM ──────────────────────────────────────────────
|
||||
|
||||
#[tool(
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod dast;
|
||||
pub mod findings;
|
||||
pub mod oscal;
|
||||
pub mod pentest;
|
||||
pub mod sbom;
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
//! OSCAL assessment MCP tool.
|
||||
//!
|
||||
//! Emits a standard OSCAL assessment-results document for a repo's findings —
|
||||
//! what breakpilot's scanner MCP client pulls. Mapped findings target their
|
||||
//! compliance controls (via the stamped `control_refs`); unmapped findings are
|
||||
//! reported as-is, so nothing is lost.
|
||||
|
||||
use mongodb::bson::doc;
|
||||
use rmcp::{model::*, ErrorData as McpError};
|
||||
use schemars::JsonSchema;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use crate::database::Database;
|
||||
|
||||
#[derive(Debug, Deserialize, JsonSchema)]
|
||||
pub struct OscalAssessmentParams {
|
||||
/// Repository / target id to assess.
|
||||
pub repo_id: String,
|
||||
}
|
||||
|
||||
pub async fn oscal_assessment(
|
||||
db: &Database,
|
||||
params: OscalAssessmentParams,
|
||||
) -> Result<CallToolResult, McpError> {
|
||||
let mut cursor = db
|
||||
.findings()
|
||||
.find(doc! { "repo_id": ¶ms.repo_id })
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
|
||||
|
||||
let mut findings: Vec<Finding> = Vec::new();
|
||||
while cursor
|
||||
.advance()
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
|
||||
{
|
||||
findings.push(
|
||||
cursor
|
||||
.deserialize_current()
|
||||
.map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
|
||||
);
|
||||
}
|
||||
|
||||
let document = assess(&findings, chrono::Utc::now());
|
||||
let json = serde_json::to_string_pretty(&document)
|
||||
.map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
|
||||
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
[package]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
serde = { workspace = true }
|
||||
serde_json = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
@@ -1,440 +0,0 @@
|
||||
{
|
||||
"version": "1.0",
|
||||
"framework": "cra",
|
||||
"controls": [
|
||||
{
|
||||
"control": "cra-ai-1",
|
||||
"title": "Secure-by-Default-Konfiguration",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-1-flask-debug-enabled",
|
||||
"cra-ai-1-django-debug-true",
|
||||
"cra-ai-1-tls-verify-disabled",
|
||||
"cra-ai-1-cors-wildcard"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-2",
|
||||
"title": "Minimale Angriffsflaeche",
|
||||
"scans": [],
|
||||
"note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-3",
|
||||
"title": "Sichere Systemarchitektur",
|
||||
"scans": [],
|
||||
"note": "design property (secure system architecture) — architecture review, not statically code-checkable",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-4",
|
||||
"title": "Least-Privilege-Prinzip",
|
||||
"scans": [],
|
||||
"note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-5",
|
||||
"title": "Manipulationsschutz",
|
||||
"scans": [],
|
||||
"note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-6",
|
||||
"title": "Integritaetspruefung",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-7",
|
||||
"title": "Starke Authentifizierung",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-7-weak-password-hash"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-8",
|
||||
"title": "Keine Default-Passwoerter",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-259"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-9",
|
||||
"title": "Sicheres Credential-Management",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-522"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-10",
|
||||
"title": "Sitzungsmanagement",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-10-session-cookie-insecure",
|
||||
"cra-ai-10-express-cookie-insecure"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-11",
|
||||
"title": "Brute-Force-Schutz",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-12",
|
||||
"title": "Rollenbasierte Autorisierung",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-13",
|
||||
"title": "Verschluesselung sensibler Daten",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-327",
|
||||
"CWE-326"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-14",
|
||||
"title": "Speicher-Schutz (Data at Rest)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-14-python-weak-cipher",
|
||||
"cra-ai-14-node-weak-cipher"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-15",
|
||||
"title": "Transport-Schutz (Data in Transit)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-319",
|
||||
"CWE-311"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-16",
|
||||
"title": "Sicheres Schluesselmanagement",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-321"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-17",
|
||||
"title": "Datenminimierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-18",
|
||||
"title": "Strukturierter SSDLC",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-19",
|
||||
"title": "Systematische Code Reviews",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-20",
|
||||
"title": "Automatisierte Sicherheitstests",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-89",
|
||||
"CWE-78",
|
||||
"CWE-79",
|
||||
"CWE-22"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-21",
|
||||
"title": "Supply-Chain-Security",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-22",
|
||||
"title": "Dependency-Monitoring",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-23",
|
||||
"title": "Software Bill of Materials (SBOM)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-24",
|
||||
"title": "Security-Logging",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-25",
|
||||
"title": "Ereignis-Monitoring",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-26",
|
||||
"title": "Anomalie-Erkennung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-27",
|
||||
"title": "Log-Integritaet und -Aufbewahrung",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-28",
|
||||
"title": "Sichere Update-Mechanismen",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-29",
|
||||
"title": "Update-Authentizitaet",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-30",
|
||||
"title": "Update-Integritaet",
|
||||
"scans": [],
|
||||
"note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-31",
|
||||
"title": "Lifecycle-Support",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-32",
|
||||
"title": "Schwachstellen-Identifikation",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-33",
|
||||
"title": "SBOM-Pflege und Analyse",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-34",
|
||||
"title": "Risikobasierte Priorisierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-35",
|
||||
"title": "Coordinated Vulnerability Disclosure",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-36",
|
||||
"title": "Incident-Response-Prozess",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-37",
|
||||
"title": "Fruehwarnung (24h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-38",
|
||||
"title": "Detaillierter Vorfallsbericht (72h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-39",
|
||||
"title": "Patch-Bereitstellung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-40",
|
||||
"title": "Dokumentation und Nachbereitung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,250 +0,0 @@
|
||||
//! `control-map` — the deterministic control → scan lookup table (LUT).
|
||||
//!
|
||||
//! The "transcribing" layer: it maps each compliance control to the static-scan
|
||||
//! step(s) that check it, or marks it as needing custom tooling, or as not
|
||||
//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
|
||||
//! decides coverage. The LLM only enters later, downstream, to triage/ground the
|
||||
//! *tool's* findings (that lives in the agent, not here).
|
||||
//!
|
||||
//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
|
||||
//! + query helpers.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
/// Coverage bucket for a control under static (SAST-family) scanning.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum Coverage {
|
||||
/// An existing tool's scan surfaces findings for this control.
|
||||
Covered,
|
||||
/// Code-checkable, but no existing tool digs it out — we must write tooling.
|
||||
NeedsTooling,
|
||||
/// Process / document control — out of static-scan scope.
|
||||
NotCodeCheckable,
|
||||
}
|
||||
|
||||
/// One tool binding: a scan step that (at least partially) checks a control.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ScanBinding {
|
||||
/// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
|
||||
pub tool: String,
|
||||
/// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
|
||||
pub scan_type: String,
|
||||
/// CWEs whose findings map to this control (used to attach findings back).
|
||||
#[serde(default)]
|
||||
pub cwe: Vec<String>,
|
||||
/// Optional specific rule ids this control keys on.
|
||||
#[serde(default)]
|
||||
pub rules: Vec<String>,
|
||||
}
|
||||
|
||||
/// One control's entry in the LUT.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlEntry {
|
||||
/// Control id, e.g. `"cra-ai-8"`.
|
||||
pub control: String,
|
||||
/// Human-readable title (for the reviewable view).
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
/// Coverage bucket.
|
||||
pub status: Coverage,
|
||||
/// Tool bindings (empty unless `status == Covered`).
|
||||
#[serde(default)]
|
||||
pub scans: Vec<ScanBinding>,
|
||||
/// Reviewer note — why it needs tooling / isn't code-checkable.
|
||||
#[serde(default)]
|
||||
pub note: Option<String>,
|
||||
}
|
||||
|
||||
/// The control → scan lookup table for one framework.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlMap {
|
||||
pub version: String,
|
||||
pub framework: String,
|
||||
pub controls: Vec<ControlEntry>,
|
||||
}
|
||||
|
||||
const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
|
||||
|
||||
/// Whether an authored rule id `bound` matches a scanner's emitted rule id
|
||||
/// `actual`. semgrep prefixes local-rule check_ids with a path
|
||||
/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
|
||||
/// id segment rather than requiring exact equality.
|
||||
fn rule_id_matches(bound: &str, actual: &str) -> bool {
|
||||
actual == bound || actual.ends_with(&format!(".{bound}"))
|
||||
}
|
||||
|
||||
impl ControlMap {
|
||||
/// Load the built-in CRA control map (the embedded, authored LUT).
|
||||
pub fn cra() -> Result<Self, MapError> {
|
||||
Ok(serde_json::from_str(CRA_MAP_JSON)?)
|
||||
}
|
||||
|
||||
/// The coverage entry for a control id, if present.
|
||||
pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
|
||||
self.controls.iter().find(|c| c.control == control_id)
|
||||
}
|
||||
|
||||
/// Controls whose bindings include the given `tool` + `cwe` — used to attach a
|
||||
/// raw tool finding back to the control(s) it's evidence for.
|
||||
pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
|
||||
self.controls_for_finding(tool, Some(cwe), None)
|
||||
}
|
||||
|
||||
/// Controls a tool finding is evidence for, matched by CWE and/or the specific
|
||||
/// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
|
||||
/// bind by rule id (precise — a broad CWE would over-attribute and then the
|
||||
/// grounded judge could drop a genuine finding as a control false positive).
|
||||
pub fn controls_for_finding(
|
||||
&self,
|
||||
tool: &str,
|
||||
cwe: Option<&str>,
|
||||
rule_id: Option<&str>,
|
||||
) -> Vec<&ControlEntry> {
|
||||
self.controls
|
||||
.iter()
|
||||
.filter(|c| {
|
||||
c.scans.iter().any(|s| {
|
||||
s.tool == tool
|
||||
&& (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
|
||||
|| rule_id
|
||||
.is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
|
||||
})
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Count of controls in each coverage bucket.
|
||||
pub fn summary(&self) -> CoverageSummary {
|
||||
let mut s = CoverageSummary::default();
|
||||
for c in &self.controls {
|
||||
match c.status {
|
||||
Coverage::Covered => s.covered += 1,
|
||||
Coverage::NeedsTooling => s.needs_tooling += 1,
|
||||
Coverage::NotCodeCheckable => s.not_code_checkable += 1,
|
||||
}
|
||||
}
|
||||
s
|
||||
}
|
||||
}
|
||||
|
||||
/// Coverage bucket counts.
|
||||
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
|
||||
pub struct CoverageSummary {
|
||||
pub covered: usize,
|
||||
pub needs_tooling: usize,
|
||||
pub not_code_checkable: usize,
|
||||
}
|
||||
|
||||
impl CoverageSummary {
|
||||
pub fn total(&self) -> usize {
|
||||
self.covered + self.needs_tooling + self.not_code_checkable
|
||||
}
|
||||
}
|
||||
|
||||
/// Errors loading a control map.
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum MapError {
|
||||
#[error("failed to parse control map: {0}")]
|
||||
Parse(#[from] serde_json::Error),
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn cra_map_loads_all_40_controls() {
|
||||
let map = ControlMap::cra().expect("CRA map should parse");
|
||||
assert_eq!(map.framework, "cra");
|
||||
assert_eq!(map.controls.len(), 40);
|
||||
assert_eq!(map.summary().total(), 40);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn hardcoded_password_control_is_tool_covered() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
|
||||
assert_eq!(c.status, Coverage::Covered);
|
||||
assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
|
||||
assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn finding_attaches_back_to_control_via_tool_and_cwe() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let hits = map.controls_for("semgrep", "CWE-798");
|
||||
assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn every_bucket_is_represented() {
|
||||
let s = ControlMap::cra().unwrap().summary();
|
||||
assert!(s.covered > 0);
|
||||
assert!(s.needs_tooling > 0);
|
||||
assert!(s.not_code_checkable > 0);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rule_id_matching_handles_semgrep_path_prefix() {
|
||||
let bound = "cra-ai-1-flask-debug-enabled";
|
||||
assert!(rule_id_matches(bound, bound)); // exact
|
||||
assert!(rule_id_matches(
|
||||
bound,
|
||||
"tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
|
||||
)); // semgrep path prefix
|
||||
assert!(!rule_id_matches(
|
||||
bound,
|
||||
"cra-ai-1-flask-debug-enabled-extra"
|
||||
)); // not a suffix segment
|
||||
assert!(!rule_id_matches(
|
||||
bound,
|
||||
"python.lang.security.exec-detected"
|
||||
)); // unrelated
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_rule_finding_attaches_to_control_by_rule_id() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
// cra-ai-1 is now tool-covered by custom rules.
|
||||
assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
|
||||
// A prefixed check_id still maps back to cra-ai-1 by rule id.
|
||||
let hits =
|
||||
map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
|
||||
assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn coverage_reflects_the_b_track_split() {
|
||||
let s = ControlMap::cra().unwrap().summary();
|
||||
// 9 already tool-covered + B1's 4 custom-semgrep controls.
|
||||
assert_eq!(s.covered, 13);
|
||||
// The 8 grounded surface controls stay needs_tooling until live-tuned.
|
||||
assert_eq!(s.needs_tooling, 8);
|
||||
// B3 marked the 4 pure-architectural controls not code-checkable.
|
||||
assert_eq!(s.not_code_checkable, 19);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn architectural_controls_are_not_code_checkable() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
for id in ["cra-ai-2", "cra-ai-3", "cra-ai-4", "cra-ai-5"] {
|
||||
let c = map.coverage(id).unwrap();
|
||||
assert_eq!(c.status, Coverage::NotCodeCheckable, "{id}");
|
||||
assert!(c.scans.is_empty(), "{id} should carry no scan bindings");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_rule_controls_do_not_bind_by_broad_cwe() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
// cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
|
||||
// only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
|
||||
assert!(map.controls_for("semgrep", "CWE-489").is_empty());
|
||||
// The CWE path for off-the-shelf findings is unchanged.
|
||||
assert!(map
|
||||
.controls_for("semgrep", "CWE-798")
|
||||
.iter()
|
||||
.any(|c| c.control == "cra-ai-8"));
|
||||
}
|
||||
}
|
||||
@@ -20,7 +20,6 @@ export default withMermaid(defineConfig({
|
||||
{ text: 'Getting Started', link: '/guide/getting-started' },
|
||||
{ text: 'Adding Repositories', link: '/guide/repositories' },
|
||||
{ text: 'Running Scans', link: '/guide/scanning' },
|
||||
{ text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
|
||||
{ text: 'Understanding Findings', link: '/guide/findings' },
|
||||
{ text: 'SBOM & Licenses', link: '/guide/sbom' },
|
||||
{ text: 'Issues & Tracking', link: '/guide/issues' },
|
||||
@@ -36,7 +35,6 @@ export default withMermaid(defineConfig({
|
||||
{ text: 'Pentest Architecture', link: '/features/pentest-architecture' },
|
||||
{ text: 'AI Chat', link: '/features/ai-chat' },
|
||||
{ text: 'Code Knowledge Graph', link: '/features/graph' },
|
||||
{ text: 'Compliance Control Mapping', link: '/features/control-mapping' },
|
||||
{ text: 'MCP Integration', link: '/features/mcp-server' },
|
||||
],
|
||||
},
|
||||
@@ -45,7 +43,6 @@ export default withMermaid(defineConfig({
|
||||
items: [
|
||||
{ text: 'Glossary', link: '/reference/glossary' },
|
||||
{ text: 'Tools & Scanners', link: '/reference/tools' },
|
||||
{ text: 'PLC Runtime Landscape', link: '/reference/plc-runtimes' },
|
||||
],
|
||||
},
|
||||
],
|
||||
|
||||
@@ -1,127 +0,0 @@
|
||||
# Compliance Control Mapping
|
||||
|
||||
Control mapping connects the scanner's raw output — deterministic tool findings and the code itself — to the **compliance controls** each piece of evidence supports. A hardcoded credential stops being just "CWE-798 from semgrep" and becomes evidence for *"cra-ai-8: no default passwords"* and, at scale, master control *`mc-31761` hardcoded_secrets_detection*. Findings carry those references (`control_refs`) into the dashboard and out over the MCP server as OSCAL, so the compliance report is built from real, grounded findings rather than a questionnaire.
|
||||
|
||||
## The core principle: tools detect, the LLM judges
|
||||
|
||||
The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
|
||||
|
||||
- A tool (semgrep, gitleaks, syft/osv, ZAP, nuclei) detects deterministically.
|
||||
- An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
|
||||
- The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
|
||||
|
||||
This keeps hallucination out of detection. The LLM supplies cross-language, cross-stack pattern *recognition*; the surrounding machinery supplies determinism.
|
||||
|
||||
## Coverage model
|
||||
|
||||
Every control lands in one of three buckets, recorded in the `control-map` LUT (`control-map/data/cra_control_map.json`) and never decided by an LLM:
|
||||
|
||||
| Bucket | Meaning |
|
||||
| --- | --- |
|
||||
| `covered` | An existing tool's scan surfaces findings for this control |
|
||||
| `needs_tooling` | Code-checkable, but no off-the-shelf tool digs it out — we author a detector or use the grounded surface check |
|
||||
| `not_code_checkable` | A design/process property — out of static-scan scope |
|
||||
|
||||
For the **CRA** framework (40 controls) the split is **13 covered · 8 needs_tooling · 19 not_code_checkable**. The 16 originally-uncovered controls were resolved as a hybrid:
|
||||
|
||||
- **4 custom semgrep detectors** (`cra-ai-1`, `7`, `10`, `14`) — secure-by-default, weak password hashing, insecure session cookies, weak data-at-rest ciphers. Shipped in the binary and matched back to controls **by rule id** so a broad CWE can't over-attribute.
|
||||
- **8 grounded surface checks** (`cra-ai-6`, `11`, `12`, `24`, `27`, `28`, `29`, `30`) — the absence-based controls (no rate limiting, no security logging, no update-signature check…) that have no syntactic pattern.
|
||||
- **4 marked not_code_checkable** (`cra-ai-2`, `3`, `4`, `5`) — minimal attack surface, secure architecture, least privilege, tamper protection.
|
||||
|
||||
At scale, the **master-controls** corpus (breakpilot's deduped clusters, exported as OSCAL) currently provides **~2,882 code-checkable controls** (2,143 `network` + 739 `source_code`), matched semantically.
|
||||
|
||||
## The three mapping paths
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
T[Deterministic tools\nsemgrep · gitleaks · syft/osv · ZAP] --> F[Findings]
|
||||
F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
|
||||
F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
|
||||
R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]
|
||||
B --> J{{Grounded LLM judge\ntemp 0 · verbatim snippet}}
|
||||
C --> J
|
||||
D --> J
|
||||
J -->|snippet grounds in region| S[Stamp control_refs]
|
||||
J -->|refuted / ungrounded| X[Dropped]
|
||||
```
|
||||
|
||||
All three paths converge on the same **grounded judge** and the same **grounding gate**. They differ only in how candidate (finding/region, control) pairs are produced.
|
||||
|
||||
### Stage 5b — deterministic LUT triage
|
||||
|
||||
The default path. A tool finding is matched to controls via `control_map.controls_for_finding(tool, cwe, rule_id)`; the judge then confirms each mapped control against the code region. Outcomes: `Confirmed([ids])` (stamp them), `FalsePositive` (drop the finding), or `Unmapped` (keep it untagged). Runs whenever `BREAKPILOT_BASE_URL` is set.
|
||||
|
||||
### Stage 5c — semantic retrieval (master-controls scale)
|
||||
|
||||
Master controls carry no CWE, so they can't be LUT-mapped. Instead we map by *similarity*: embed every control's requirement text once (cached), then for each finding retrieve the top-K nearest controls and hand them to the judge. Gated behind `BREAKPILOT_SEMANTIC_MAPPING` (default off). See [Semantic retrieval](#semantic-retrieval-in-detail).
|
||||
|
||||
### Stage 5d — grounded surface checks (absence-based controls)
|
||||
|
||||
Some controls are violated by an *absence* — no rate limiting on login, no security logging, no signature check on an update. There's no pattern for semgrep to match, so we deterministically retrieve the code **surface** the control governs (a login route, a logging setup, update/download code) by identifier/route terms, and let the judge decide whether the control holds there. Produces net-new, already-grounded findings. Gated behind `BREAKPILOT_GROUNDED_CHECKS` (default off).
|
||||
|
||||
## The grounding gate
|
||||
|
||||
No matter the path, a verdict becomes a finding only if it survives `compliance_core::control_check::ground`:
|
||||
|
||||
1. The judge runs at **temperature 0** with a closed prompt and must quote the offending code **verbatim** into `snippet`.
|
||||
2. That snippet must appear **literally** in the retrieved region — otherwise the verdict is dropped.
|
||||
3. The finding's line is **recomputed from the match**; the model's own line number is never trusted.
|
||||
4. Verdicts are cached by content hash, so re-scans reproduce.
|
||||
|
||||
The model is allowed to be smart; it is never trusted.
|
||||
|
||||
## Semantic retrieval in detail
|
||||
|
||||
1. **Embed the corpus once.** Each control's requirement text is embedded with `bge-multilingual-gemma2` (3584-dim — multilingual matters, the master controls are in German while code is English). The embedding backend caps input arrays at 25 per request, so `embed()` chunks at 16; the whole `ControlIndex` is persisted to `snapshot_dir` keyed by a **corpus hash**, so only the first scan after a catalog change pays the embedding cost.
|
||||
2. **Build the query from the finding's intent, not just the code.** The retrieval query is `finding.title + finding.description + region`, not the raw region. This is the single most important tuning: two findings in one file share overlapping windows and, on the code alone, embed alike and collapse onto the same controls. The finding's own words ("brute-force protection" vs "weak hash") carry the discriminating signal. The raw region still goes to the judge for grounding.
|
||||
3. **Retrieve → judge → ground.** Top-K nearest by cosine, each judged against the region, each grounded.
|
||||
|
||||
## Worked examples
|
||||
|
||||
Both examples are from the live end-to-end verification (`c5_semantic_live.rs`) against the real ~2,882-control corpus.
|
||||
|
||||
### Example 1 — a small auth file (the tuning story)
|
||||
|
||||
Two findings in one `auth.py`: a weak `hashlib.md5(password)` hash and a login endpoint with no brute-force protection.
|
||||
|
||||
| Finding | Region-only retrieval | Intent-enriched retrieval |
|
||||
| --- | --- | --- |
|
||||
| Weak md5 hash | 19874, 20683, 23149, 29985 | **`mc-23149`** (eliminate weak unsalted hashes) at rank 1, + `mc-21634` salted hashing |
|
||||
| Login w/o brute-force protection | *identical 4, reordered* | newly surfaces **`mc-19984`** brute_force_protection + **`mc-23186`** account_lockout |
|
||||
|
||||
Region-only retrieval gave both findings the *same* four password-hashing controls — the brute-force finding never found its real controls because its window is saturated with `password` tokens. Enriching the query with the finding's intent fixed it: the brute-force finding now pulls the correct rate-limiting / lockout controls out of the 2,882.
|
||||
|
||||
### Example 2 — four topically distinct vulnerabilities
|
||||
|
||||
| Finding | Top matched controls | Family |
|
||||
| --- | --- | --- |
|
||||
| SQL injection (string-concat query) | `sql_injection_prevention`, `sql_injection`, `parameterized_queries`, input_sanitization | input-validation ✓ |
|
||||
| Hardcoded API credential | `hardcoded_secrets_detection`, credential_scanning, secrets_detection | credentials ✓ |
|
||||
| TLS verification disabled (`verify=False`) | `https_enforcement`, `configuration_verification`, transport config | transport-encryption ✓ |
|
||||
| Insecure deserialization (`pickle.loads`) | `deserialization`, `deserialization_testing`, `deserialization_security` | deserialization ✓ |
|
||||
|
||||
Every finding maps to its exact control family, with the most specific control often at the top, and the four sets are distinct.
|
||||
|
||||
## Known limitations
|
||||
|
||||
- **Absence findings are weak for semantic retrieval.** Similarity matches what code *is about*, not what it *lacks*; a "missing rate limiting" finding embeds like login code. This is exactly why the grounded surface path (Stage 5d) exists — it decides presence/absence at a retrieved surface rather than by embedding distance.
|
||||
- **Generic catch-all controls co-occur.** `mc-20890 secure_development_security_code_review` appears in the top-K for many code-security findings because it is semantically near almost all of them. It's harmless (the judge grounds it, and it never crowds out the specific controls — the SQLi example didn't get it) but is a candidate for future down-weighting.
|
||||
- **Corpus classification noise.** The master-controls `verification_method` classification is imperfect — e.g. a documentation control (`eu_declaration_accuracy`) is currently tagged `source_code`. That's a corpus-side data-quality issue, separate from the mapping engine.
|
||||
|
||||
## Configuration
|
||||
|
||||
| Variable | Effect |
|
||||
| --- | --- |
|
||||
| `BREAKPILOT_BASE_URL` | breakpilot-compliance root; enables control ingest + Stage 5b. Unset disables all control mapping. |
|
||||
| `BREAKPILOT_SEMANTIC_MAPPING` | Enables Stage 5c (semantic master-controls mapping). Default off. |
|
||||
| `BREAKPILOT_GROUNDED_CHECKS` | Enables Stage 5d (grounded surface checks). Default off. |
|
||||
| `BREAKPILOT_SNAPSHOT_DIR` | Where OSCAL catalog snapshots and the cached control-embedding index live. |
|
||||
|
||||
The semantic and grounded passes are gated because they are the heavier, less deterministic paths; they stay off until verified live against a deployed catalog. The live verification lives in `compliance-agent/tests/c5_semantic_live.rs` (ignored; run with `--ignored`).
|
||||
|
||||
## Appendix — the master-controls data pipeline
|
||||
|
||||
The master-controls corpus is produced by breakpilot-compliance and pulled as an OSCAL catalog from `GET /api/compliance/v1/oscal/catalog?framework=master-controls`. Two operational lessons are worth recording, because they cost real time to diagnose:
|
||||
|
||||
- **The catalog is served from `breakpilot_db`, not `postgres`.** Diagnostics run against the wrong database will look clean while the app serves something else entirely. Confirm the app's datname (`pg_stat_activity`) before trusting any count or `EXPLAIN`.
|
||||
- **A constraint-less dump triplicated the master-control tables.** Restored without their PK/unique constraints, `master_controls` / `mc_verification` / `master_control_members` accumulated identical rows 3× (the same artifact migration `158` fixed for `doc_check_controls`). That inflated the catalog to ~26k dup'd controls and, with the indexes also missing, drove the export query to a >120s / 502. The fix (breakpilot migration `160`) ctid-dedups each table by its natural key and restores the constraints + indexes so it can't recur; the export query was also rewritten set-based (a single windowed pass instead of a per-row correlated subquery). After dedup: 41,850 → 13,950 master controls, catalog **25,938 → 2,882** code-checkable, endpoint **502 → 200 in ~3s**.
|
||||
@@ -1,163 +0,0 @@
|
||||
# PLC / SPS Projects (CODESYS)
|
||||
|
||||
Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
|
||||
as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
|
||||
the control application *and* the device it runs on.
|
||||
|
||||
| What you provide | What Certifai does |
|
||||
| --- | --- |
|
||||
| PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
|
||||
| A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
|
||||
| A device firmware image | Firmware SBOM / CVE (opt-in) |
|
||||
| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
|
||||
|
||||
## Anatomy: a soft PLC is a SoC + Linux + runtime
|
||||
|
||||
A CODESYS controller is **not** a monolithic appliance like a classic Siemens
|
||||
S7. It is **PC-based ("soft") control** — commodity silicon running a
|
||||
general-purpose Linux, with a **software PLC runtime** as just another process:
|
||||
|
||||
| Classic PLC (e.g. Siemens S7) | Soft PLC (CODESYS-on-Yocto, OpenPLC-on-Raspbian) |
|
||||
| --- | --- |
|
||||
| Proprietary hardware + firmware | Commodity SoC (x86 / ARM) |
|
||||
| Proprietary OS | General-purpose Linux (a **Yocto** image, or Raspbian) |
|
||||
| Proprietary runtime | Software runtime (**CODESYS Control**, or OpenPLC) |
|
||||
| STEP7 / TIA project | IEC 61131-3 control app (ST / LD / FBD / SFC) |
|
||||
|
||||
Because of this, the device is built along **two independent tracks**, by
|
||||
different people, on different timelines, and shipped separately. It also
|
||||
inherits the **entire Linux / IT attack surface on top of** the OT / control
|
||||
one — which is exactly why a PLC/SPS target is treated as a **composite**:
|
||||
Certifai ingests one artifact per layer and scans each with the right pipeline.
|
||||
|
||||
```mermaid
|
||||
flowchart TB
|
||||
subgraph TA["Track A · Device platform — built by the hardware OEM / vendor"]
|
||||
direction LR
|
||||
A1["Yocto / OpenEmbedded<br/>BSP + RT kernel"] --> A2["Bake in the CODESYS<br/>Control for Linux runtime"] --> A3["bitbake → device image<br/>.wic / .tar + manifest"]
|
||||
end
|
||||
subgraph TB2["Track B · Control application — built by the machine builder / customer"]
|
||||
direction LR
|
||||
B1["CODESYS IDE<br/>ST / LD / FBD / SFC + WebVisu"] --> B2["Reference CODESYS +<br/>vendor libraries"] --> B3["Compile → download<br/>to device (gateway 11740)"]
|
||||
end
|
||||
|
||||
A3 --> DEV(["Running soft-PLC device<br/>SoC + Linux + runtime + control app<br/>Modbus · OPC UA · EtherNet/IP · WebVisu"])
|
||||
B3 --> DEV
|
||||
|
||||
subgraph CERT["What Certifai scans — one layer per artifact"]
|
||||
direction LR
|
||||
S1["Firmware layer<br/>FirmwareStatic · SBOM · CVE"]
|
||||
S2["Control-logic layer<br/>PLC SAST — ST + FBD/LD"]
|
||||
S3["Control-app SBOM<br/>libraries + runtime → CVE"]
|
||||
S4["Running layer<br/>ICS probe · DAST (WebVisu)"]
|
||||
end
|
||||
|
||||
A3 -. firmware image .-> S1
|
||||
B1 -. PLCopen XML / ST via git .-> S2
|
||||
B2 -. projectarchive (zip) .-> S3
|
||||
DEV -. live URL / provisioned .-> S4
|
||||
|
||||
classDef yocto fill:#fde68a,stroke:#b45309,color:#111
|
||||
classDef codesys fill:#bfdbfe,stroke:#1d4ed8,color:#111
|
||||
classDef dev fill:#e9d5ff,stroke:#7e22ce,color:#111
|
||||
classDef cert fill:#bbf7d0,stroke:#15803d,color:#111
|
||||
class A1,A2,A3 yocto
|
||||
class B1,B2,B3 codesys
|
||||
class DEV dev
|
||||
class S1,S2,S3,S4 cert
|
||||
```
|
||||
|
||||
::: tip Where Yocto fits
|
||||
Yocto is **Track A** — the *build system* for the device platform. It produces
|
||||
the Linux image and bakes in the CODESYS runtime, so it is the **firmware
|
||||
layer**, entirely separate from the control application. Hand it to Certifai as
|
||||
its own **firmware image** artifact (scanned by the firmware pipeline, not the
|
||||
PLC pipeline). The device OS need not be Yocto — Raspbian/Debian/Buildroot, or
|
||||
even an RTOS / bare-metal, are all possible — but Yocto is the common,
|
||||
product-grade industrial choice.
|
||||
:::
|
||||
|
||||
## Two ways to deliver the project
|
||||
|
||||
You can either **upload** the project when onboarding, or point Certifai at a
|
||||
**git repository** (recommended — every scan is just a `git pull`, no re-upload).
|
||||
|
||||
### Option A — Upload
|
||||
|
||||
On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
|
||||
project** artifact and pick its format:
|
||||
|
||||
- **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
|
||||
- **Structured Text** (`.st`) — a raw ST file.
|
||||
- **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
|
||||
Archive…* with **"Referenced libraries"** ticked. This is the only form that
|
||||
also yields the **library + runtime SBOM**.
|
||||
|
||||
### Option B — Git repository (recommended)
|
||||
|
||||
Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
|
||||
runs the control-logic scan over the exported source in the repo.
|
||||
|
||||
## Best-case git repository layout
|
||||
|
||||
Because the binary `.project` does not diff or merge in git, commit **textual
|
||||
exports** for review-friendly SAST, and include the **`.projectarchive`** so the
|
||||
library/runtime SBOM is available too:
|
||||
|
||||
```text
|
||||
my-plc-project/
|
||||
├── src/
|
||||
│ ├── PLC_PRG.xml # PLCopen XML export (ST or FBD/LD) — one per POU
|
||||
│ ├── PumpController.xml
|
||||
│ ├── SafetyInterlock.xml
|
||||
│ └── GVL.xml # global variable lists, also as PLCopen XML
|
||||
├── PumpStation.projectarchive # optional but recommended → library + runtime SBOM
|
||||
└── README.md
|
||||
```
|
||||
|
||||
**Guidelines**
|
||||
|
||||
- **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
|
||||
commit those. ST, **and graphical FBD/LD**, are both analyzed.
|
||||
- Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
|
||||
- **Do not** commit only the binary `.project` — it cannot be parsed (and does not
|
||||
diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
|
||||
- CODESYS's built-in Git integration, which stores an exported representation,
|
||||
works too — as long as the committed form is PLCopen XML / textual.
|
||||
|
||||
::: tip What unlocks what
|
||||
- **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
|
||||
- **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
|
||||
**not** carry the referenced libraries.
|
||||
:::
|
||||
|
||||
## What the scanner finds
|
||||
|
||||
The control-logic rules are CWE-mapped and include: hardcoded credentials
|
||||
(CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
|
||||
(CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
|
||||
guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
|
||||
(CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
|
||||
|
||||
The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
|
||||
the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
|
||||
surface real CODESYS advisories as CVE alerts.
|
||||
|
||||
## Dynamic testing — ICS protocol probe
|
||||
|
||||
Beyond the static analysis, Certifai can **probe the running device** over
|
||||
industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
|
||||
URL) to the PLC/SPS target and enable the **ICS Probe** scan.
|
||||
|
||||
The probe is **read-only** — it never writes to the live process. It currently
|
||||
speaks **Modbus/TCP** (port 502): it confirms whether the device answers
|
||||
unauthenticated Modbus requests and reads its device identity (vendor / product /
|
||||
revision). Because Modbus/TCP has no authentication or encryption in the protocol,
|
||||
a reachable endpoint that answers is reported as an exposed control interface
|
||||
(CWE-306). OPC UA and EtherNet/IP probes are planned.
|
||||
|
||||
::: warning
|
||||
The ICS probe connects to the live device. It is **opt-in** (off by default) and
|
||||
should only be run against targets you are authorized to test. It performs reads
|
||||
only, never writes.
|
||||
:::
|
||||
@@ -1,97 +0,0 @@
|
||||
# PLC Runtime Landscape & Support
|
||||
|
||||
A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
|
||||
(see [PLC / SPS Projects](/guide/plc)).
|
||||
The **runtime** is what defines the device — it provides the IEC engine, the
|
||||
Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
|
||||
runtime ecosystems Certifai may encounter.
|
||||
|
||||
We do **not** aim to support every runtime up front. Certifai supports the
|
||||
**CODESYS family** today; everything else is a **watch-list** — when a customer
|
||||
shows up using one, we add the parser/support for it then. The dynamic OT probe
|
||||
(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
|
||||
the runtime.
|
||||
|
||||
## Support status
|
||||
|
||||
| Status | Meaning |
|
||||
| --- | --- |
|
||||
| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
|
||||
| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
|
||||
| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
|
||||
| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |
|
||||
|
||||
## 1. CODESYS and rebranded CODESYS (the largest slice)
|
||||
|
||||
Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
|
||||
customer "doesn't use CODESYS", they often do — under another name.
|
||||
|
||||
| Product / vendor | Based on | Status |
|
||||
| --- | --- | --- |
|
||||
| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
|
||||
| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
|
||||
|
||||
## 2. Other embeddable IEC 61131-3 runtime toolkits
|
||||
|
||||
Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
|
||||
device), but with **different project formats and libraries**.
|
||||
|
||||
| Toolkit | Vendor | Status |
|
||||
| --- | --- | --- |
|
||||
| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
|
||||
| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
|
||||
| **straton** | COPA-DATA | 🔭 Watch-list |
|
||||
| **logi.CAD** | logi.cals | 🔭 Watch-list |
|
||||
|
||||
## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)
|
||||
|
||||
Static analysis here needs a **per-vendor project parser**; the **dynamic OT
|
||||
probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
|
||||
protocols like S7comm / CIP).
|
||||
|
||||
| Ecosystem | Vendor | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
|
||||
| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
|
||||
| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
|
||||
| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
|
||||
| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
|
||||
| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
|
||||
| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |
|
||||
|
||||
## 4. Linux-native / containerized soft-PLC (the direction of travel)
|
||||
|
||||
| Product | Vendor | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
|
||||
| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
|
||||
| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
|
||||
|
||||
## 5. Open-source runtimes (free — our test-bench substrates)
|
||||
|
||||
Used to **reconstruct and dynamically test** a customer device without touching
|
||||
their network (provision-and-test).
|
||||
|
||||
| Runtime | Standard | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
|
||||
| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
|
||||
| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
|
||||
| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |
|
||||
|
||||
## How we add support for a new runtime
|
||||
|
||||
- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
|
||||
(and its library/package convention). This is the per-vendor work.
|
||||
- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
|
||||
device's OT ports and WebVisu, not the runtime's file format. So a brand-new
|
||||
ecosystem still gets dynamic coverage on day one.
|
||||
|
||||
::: tip Rule of thumb
|
||||
Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
|
||||
runtime (Section 1) before assuming new work — most of the long tail is.
|
||||
:::
|
||||
@@ -1,36 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!-- Demo PLCopen project — conveyor sorter. Deliberately vulnerable. -->
|
||||
<project xmlns="http://www.plcopen.org/xml/tc6_0201">
|
||||
<types>
|
||||
<pous>
|
||||
<pou name="ConveyorCtrl" pouType="program">
|
||||
<interface>
|
||||
<localVars>
|
||||
<variable name="AdminPwd">
|
||||
<type><string/></type>
|
||||
<initialValue><simpleValue value="password"/></initialValue>
|
||||
</variable>
|
||||
<variable name="Belt">
|
||||
<type>
|
||||
<array>
|
||||
<dimension lower="0" upper="3"/>
|
||||
<baseType><INT/></baseType>
|
||||
</array>
|
||||
</type>
|
||||
</variable>
|
||||
</localVars>
|
||||
<inputVars>
|
||||
<variable name="Slot"><type><INT/></type></variable>
|
||||
</inputVars>
|
||||
</interface>
|
||||
<body>
|
||||
<ST>
|
||||
<xhtml xmlns="http://www.w3.org/1999/xhtml">Belt[Slot] := 1;
|
||||
Ftp_Send(HOST := '192.168.1.5', PORT := 21, ENCRYPT := FALSE);
|
||||
</xhtml>
|
||||
</ST>
|
||||
</body>
|
||||
</pou>
|
||||
</pous>
|
||||
</types>
|
||||
</project>
|
||||
@@ -1,56 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
|
||||
the scanner analyses graphical logic, not just Structured Text: the same
|
||||
defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
|
||||
enable driven FALSE) are here wired as blocks and in/out variables. -->
|
||||
<project xmlns="http://www.plcopen.org/xml/tc6_0201">
|
||||
<types>
|
||||
<pous>
|
||||
<pou name="PumpFbdCtrl" pouType="functionBlock">
|
||||
<interface>
|
||||
<inputVars>
|
||||
<variable name="HmiPassword"><type><string/></type></variable>
|
||||
<variable name="Safety_Enable"><type><BOOL/></type></variable>
|
||||
<variable name="ServerIp"><type><string/></type></variable>
|
||||
</inputVars>
|
||||
</interface>
|
||||
<body>
|
||||
<FBD>
|
||||
<!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
|
||||
<inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
|
||||
<inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
|
||||
<inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
|
||||
<block localId="10" typeName="Modbus_TCP_Master">
|
||||
<inputVariables>
|
||||
<variable formalParameter="IP">
|
||||
<connectionPointIn><connection refLocalId="1"/></connectionPointIn>
|
||||
</variable>
|
||||
<variable formalParameter="PORT">
|
||||
<connectionPointIn><connection refLocalId="2"/></connectionPointIn>
|
||||
</variable>
|
||||
<variable formalParameter="AUTH">
|
||||
<connectionPointIn><connection refLocalId="3"/></connectionPointIn>
|
||||
</variable>
|
||||
</inputVariables>
|
||||
<outputVariables/>
|
||||
</block>
|
||||
|
||||
<!-- Hardcoded HMI password wired into an output -->
|
||||
<inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
|
||||
<outVariable localId="21">
|
||||
<expression>HmiPassword</expression>
|
||||
<connectionPointIn><connection refLocalId="20"/></connectionPointIn>
|
||||
</outVariable>
|
||||
|
||||
<!-- Safety enable driven FALSE in logic -->
|
||||
<inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
|
||||
<outVariable localId="31">
|
||||
<expression>Safety_Enable</expression>
|
||||
<connectionPointIn><connection refLocalId="30"/></connectionPointIn>
|
||||
</outVariable>
|
||||
</FBD>
|
||||
</body>
|
||||
</pou>
|
||||
</pous>
|
||||
</types>
|
||||
</project>
|
||||
@@ -1,57 +0,0 @@
|
||||
(*
|
||||
* Demo PLC program — pump-station control (IEC 61131-3 Structured Text).
|
||||
*
|
||||
* Deliberately vulnerable, for the compliance-scanner PLC control-logic demo.
|
||||
* Each issue below is flagged by pipeline::plc::rules.
|
||||
*)
|
||||
|
||||
FUNCTION_BLOCK PumpStationCtrl
|
||||
VAR_INPUT
|
||||
OperatorCmd : INT; (* HMI command index — untrusted *)
|
||||
FlowSetpoint : REAL;
|
||||
END_VAR
|
||||
VAR_OUTPUT
|
||||
PumpSpeed : REAL;
|
||||
Fault : BOOL;
|
||||
END_VAR
|
||||
VAR
|
||||
HmiPassword : STRING := 'admin123'; (* hardcoded + default credential *)
|
||||
ApiKey : STRING := 'sk_live_9c1f2a'; (* hardcoded secret *)
|
||||
PumpProfiles : ARRAY[0..7] OF REAL;
|
||||
Safety_Enable : BOOL := TRUE;
|
||||
Watchdog_Kick : INT := 1;
|
||||
MeasuredFlow : REAL;
|
||||
ScaleFactor : REAL;
|
||||
i : INT;
|
||||
END_VAR
|
||||
|
||||
(* Operator can index the profile table with an unvalidated command. *)
|
||||
PumpSpeed := PumpProfiles[OperatorCmd];
|
||||
|
||||
(* Divisor is a live process value that can read zero on a stopped line. *)
|
||||
ScaleFactor := FlowSetpoint / MeasuredFlow;
|
||||
|
||||
(* Safety interlock disabled straight from application logic. *)
|
||||
IF OperatorCmd = 99 THEN
|
||||
Safety_Enable := FALSE;
|
||||
Watchdog_Kick := 0;
|
||||
END_IF;
|
||||
|
||||
(* Unauthenticated Modbus/TCP link on the cleartext OT port. *)
|
||||
Modbus_TCP_Connect(IP := '10.10.5.20', PORT := 502, AUTH := FALSE, PASSWORD := 'plc');
|
||||
|
||||
(* Unstructured jump around the fault handler. *)
|
||||
IF MeasuredFlow > 1000.0 THEN
|
||||
JMP trip;
|
||||
END_IF;
|
||||
|
||||
(* A correctly guarded division — must NOT be flagged. *)
|
||||
IF ScaleFactor <> 0.0 THEN
|
||||
PumpSpeed := PumpSpeed / ScaleFactor;
|
||||
END_IF;
|
||||
|
||||
RETURN;
|
||||
trip:
|
||||
Fault := TRUE;
|
||||
PumpSpeed := 0.0;
|
||||
END_FUNCTION_BLOCK
|
||||
@@ -1,92 +0,0 @@
|
||||
(*
|
||||
* Pedestrian-crossing traffic-light controller.
|
||||
*
|
||||
* Structure adapted from the classic OpenPLC "traffic light" example
|
||||
* (github.com/thiagoralves/OpenPLC_v3 examples) — a timed state machine
|
||||
* driving vehicle + pedestrian lamps, extended with a SCADA/Modbus link
|
||||
* and a maintenance override so it reads like a real deployed program.
|
||||
*
|
||||
* The control logic itself is sound; the security-relevant defects are the
|
||||
* kind that slip into field code under deadline: a hardcoded SCADA password,
|
||||
* a cleartext Modbus/TCP master, and a maintenance mode that drops the
|
||||
* pedestrian safety permit. Everything else should stay quiet.
|
||||
*)
|
||||
PROGRAM TrafficLight
|
||||
VAR
|
||||
State : INT := 0; (* 0 GreenVeh, 1 Amber, 2 RedVeh/WalkPed, 3 FlashPed *)
|
||||
Tmr : TON;
|
||||
StateElapsed : TIME;
|
||||
CycleMs : DINT := 0;
|
||||
|
||||
(* Lamp outputs *)
|
||||
VehGreen : BOOL := FALSE;
|
||||
VehAmber : BOOL := FALSE;
|
||||
VehRed : BOOL := FALSE;
|
||||
PedWalk : BOOL := FALSE;
|
||||
PedStop : BOOL := TRUE;
|
||||
|
||||
(* Pedestrian safety permit — must be TRUE before the WALK phase asserts *)
|
||||
PedPermit : BOOL := TRUE;
|
||||
PedButton : BOOL := FALSE;
|
||||
|
||||
(* SCADA / remote monitoring *)
|
||||
ScadaUser : STRING := 'operator';
|
||||
ScadaPassword : STRING := 'Tr@ffic2019'; (* hardcoded SCADA credential *)
|
||||
ModbusReady : BOOL := FALSE;
|
||||
|
||||
(* Maintenance override *)
|
||||
MaintMode : BOOL := FALSE;
|
||||
LampCount : INT := 5;
|
||||
DutyPct : INT;
|
||||
END_VAR
|
||||
|
||||
(* ---- SCADA uplink: publish state to the control room over Modbus/TCP ---- *)
|
||||
IF NOT ModbusReady THEN
|
||||
Modbus_TCP_Master(IP := '10.20.0.5', PORT := 502, AUTH := FALSE, USER := ScadaUser, PASS := ScadaPassword);
|
||||
ModbusReady := TRUE;
|
||||
END_IF;
|
||||
|
||||
(* ---- Duty-cycle for the flashing pedestrian lamp (guarded division) ---- *)
|
||||
IF LampCount <> 0 THEN
|
||||
DutyPct := (CycleMs * 100) / LampCount;
|
||||
END_IF;
|
||||
|
||||
(* ---- Maintenance override: flash amber, hand control to the technician ---- *)
|
||||
IF MaintMode THEN
|
||||
VehGreen := FALSE;
|
||||
VehRed := FALSE;
|
||||
VehAmber := NOT VehAmber;
|
||||
PedPermit := FALSE; (* drops the pedestrian safety permit in code *)
|
||||
PedWalk := FALSE;
|
||||
PedStop := TRUE;
|
||||
ELSE
|
||||
(* ---- Normal timed state machine ---- *)
|
||||
Tmr(IN := TRUE, PT := T#5s);
|
||||
StateElapsed := Tmr.ET;
|
||||
|
||||
CASE State OF
|
||||
0: (* vehicles go, pedestrians stop *)
|
||||
VehGreen := TRUE; VehAmber := FALSE; VehRed := FALSE;
|
||||
PedWalk := FALSE; PedStop := TRUE;
|
||||
IF PedButton AND Tmr.Q THEN
|
||||
State := 1; Tmr(IN := FALSE);
|
||||
END_IF;
|
||||
1: (* amber transition *)
|
||||
VehGreen := FALSE; VehAmber := TRUE;
|
||||
IF Tmr.Q THEN State := 2; Tmr(IN := FALSE); END_IF;
|
||||
2: (* vehicles stop, pedestrians walk — only if permitted *)
|
||||
VehAmber := FALSE; VehRed := TRUE;
|
||||
IF PedPermit THEN
|
||||
PedWalk := TRUE; PedStop := FALSE;
|
||||
END_IF;
|
||||
IF Tmr.Q THEN State := 3; Tmr(IN := FALSE); END_IF;
|
||||
3: (* flashing don't-walk before returning to green *)
|
||||
PedWalk := NOT PedWalk;
|
||||
IF Tmr.Q THEN
|
||||
State := 0; PedButton := FALSE; Tmr(IN := FALSE);
|
||||
END_IF;
|
||||
ELSE
|
||||
State := 0;
|
||||
END_CASE;
|
||||
END_IF;
|
||||
END_PROGRAM
|
||||
@@ -1,23 +0,0 @@
|
||||
[package]
|
||||
name = "werkbank-exec"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "Shared dynamic-execution logic: soft-PLC provisioning + industrial-protocol probing, used by the compliance agent and the Werkbank runner."
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
compliance-core = { workspace = true }
|
||||
compliance-dast = { path = "../compliance-dast" }
|
||||
tokio = { workspace = true }
|
||||
reqwest = { workspace = true }
|
||||
uuid = { workspace = true }
|
||||
regex = { workspace = true }
|
||||
secrecy = { workspace = true }
|
||||
sha2 = { workspace = true }
|
||||
hex = { workspace = true }
|
||||
tracing = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
walkdir = "2"
|
||||
futures-util = "0.3"
|
||||
@@ -1,16 +0,0 @@
|
||||
//! Error type for the dynamic-execution logic.
|
||||
|
||||
/// Anything that can go wrong provisioning and testing a soft-PLC. The compliance
|
||||
/// agent maps this into its own `AgentError` at the call boundary.
|
||||
#[derive(thiserror::Error, Debug)]
|
||||
pub enum ExecError {
|
||||
/// An HTTP request (to OpenPLC) failed.
|
||||
#[error("HTTP error: {0}")]
|
||||
Http(#[from] reqwest::Error),
|
||||
/// A local IO / process error (e.g. invoking `docker`).
|
||||
#[error("IO error: {0}")]
|
||||
Io(#[from] std::io::Error),
|
||||
/// Any other failure, with a message.
|
||||
#[error("{0}")]
|
||||
Other(String),
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
//! Finding fingerprint helper (a SHA-256 over the salient parts), shared by the
|
||||
//! probe modules for stable dedup keys. Mirrors the agent's `dedup` helper.
|
||||
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
/// A stable fingerprint over the given parts (order-sensitive, separated so
|
||||
/// `["ab","c"]` and `["a","bc"]` differ).
|
||||
pub fn compute_fingerprint(parts: &[&str]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for part in parts {
|
||||
hasher.update(part.as_bytes());
|
||||
hasher.update(b"|");
|
||||
}
|
||||
hex::encode(hasher.finalize())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn deterministic_and_hex() {
|
||||
let a = compute_fingerprint(&["repo", "rule", "1"]);
|
||||
assert_eq!(a, compute_fingerprint(&["repo", "rule", "1"]));
|
||||
assert_eq!(a.len(), 64);
|
||||
assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
|
||||
assert_ne!(
|
||||
compute_fingerprint(&["ab", "c"]),
|
||||
compute_fingerprint(&["a", "bc"])
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
//! Minimal EtherNet/IP (CIP) reachability probe.
|
||||
//!
|
||||
//! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
|
||||
//! 44818 and checks for a valid encapsulation reply — confirming a CIP device
|
||||
//! without opening a session or writing anything.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::timeout;
|
||||
|
||||
/// Outcome of an EtherNet/IP handshake probe.
|
||||
#[derive(Debug, Default, PartialEq, Eq)]
|
||||
pub struct EnipProbe {
|
||||
/// A TCP connection to the port was established.
|
||||
pub reachable: bool,
|
||||
/// The endpoint returned a valid EtherNet/IP encapsulation reply.
|
||||
pub is_enip: bool,
|
||||
}
|
||||
|
||||
/// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
|
||||
pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
|
||||
let mut out = EnipProbe::default();
|
||||
let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
|
||||
return out;
|
||||
};
|
||||
out.reachable = true;
|
||||
|
||||
// Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
|
||||
// context(8) options(4). ListIdentity = command 0x0063, everything else zero.
|
||||
let mut req = vec![0u8; 24];
|
||||
req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
|
||||
if timeout(budget, stream.write_all(&req))
|
||||
.await
|
||||
.ok()
|
||||
.and_then(Result::ok)
|
||||
.is_none()
|
||||
{
|
||||
return out;
|
||||
}
|
||||
|
||||
let mut hdr = [0u8; 24];
|
||||
if timeout(budget, stream.read_exact(&mut hdr))
|
||||
.await
|
||||
.ok()
|
||||
.and_then(Result::ok)
|
||||
.is_none()
|
||||
{
|
||||
return out;
|
||||
}
|
||||
let command = u16::from_le_bytes([hdr[0], hdr[1]]);
|
||||
let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
|
||||
// Echoed command + success status = a valid EtherNet/IP encapsulation reply.
|
||||
if command == 0x0063 && status == 0 {
|
||||
out.is_enip = true;
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tokio::net::TcpListener;
|
||||
|
||||
async fn mock_server() -> std::net::SocketAddr {
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
|
||||
let addr = listener.local_addr().expect("addr");
|
||||
tokio::spawn(async move {
|
||||
let (mut sock, _) = listener.accept().await.expect("accept");
|
||||
let mut req = [0u8; 24];
|
||||
if sock.read_exact(&mut req).await.is_err() {
|
||||
return;
|
||||
}
|
||||
// Reply: echo command 0x0063, status 0, no data.
|
||||
let mut hdr = vec![0u8; 24];
|
||||
hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
|
||||
let _ = sock.write_all(&hdr).await;
|
||||
});
|
||||
addr
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_detects_an_ethernetip_device() {
|
||||
let addr = mock_server().await;
|
||||
let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
|
||||
assert!(p.reachable && p.is_enip);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_reports_unreachable_for_a_closed_port() {
|
||||
let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
|
||||
assert!(!p.reachable && !p.is_enip);
|
||||
}
|
||||
}
|
||||
@@ -1,306 +0,0 @@
|
||||
//! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
|
||||
//!
|
||||
//! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
|
||||
//! the *running* device over industrial protocols and reports exposed /
|
||||
//! unauthenticated control interfaces. It is read-only: it never writes to a live
|
||||
//! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
|
||||
|
||||
pub mod ethernetip;
|
||||
pub mod modbus;
|
||||
pub mod opcua;
|
||||
pub mod portscan;
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use compliance_core::models::{Finding, ScanType, Severity};
|
||||
|
||||
use crate::fingerprint as dedup;
|
||||
|
||||
/// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
|
||||
const MODBUS_PORT: u16 = 502;
|
||||
const OPCUA_PORT: u16 = 4840;
|
||||
const ENIP_PORT: u16 = 44818;
|
||||
|
||||
/// Probe a PLC/SPS device's industrial-protocol surface and return findings.
|
||||
/// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
|
||||
/// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
|
||||
/// the target's live-URL / host reference.
|
||||
pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
|
||||
let (host, modbus_port) = parse_endpoint(endpoint);
|
||||
let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
|
||||
findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
|
||||
findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
|
||||
findings.extend(portscan_findings(&host, repo_id, budget).await);
|
||||
findings
|
||||
}
|
||||
|
||||
/// Findings from probing the Modbus/TCP surface.
|
||||
async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
|
||||
let probe = modbus::probe(host, port, budget).await;
|
||||
let mut findings = Vec::new();
|
||||
if !probe.speaks_modbus {
|
||||
// Not reachable, or the port does not speak Modbus — nothing to report.
|
||||
return findings;
|
||||
}
|
||||
let target = format!("{host}:{port}");
|
||||
|
||||
// Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"Modbus/TCP control interface exposed without authentication".to_string(),
|
||||
format!(
|
||||
"The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
|
||||
authentication or encryption in the protocol, so any host that can reach this \
|
||||
port can read and write process variables (coils/registers) and disrupt the \
|
||||
controlled process."
|
||||
),
|
||||
Severity::Critical,
|
||||
);
|
||||
f.rule_id = Some("ics-modbus-exposed".to_string());
|
||||
f.cwe = Some("CWE-306".to_string());
|
||||
f.remediation = Some(
|
||||
"Restrict the Modbus/TCP port to a trusted control network (segmentation / \
|
||||
firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
|
||||
transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
|
||||
.to_string(),
|
||||
);
|
||||
findings.push(f);
|
||||
|
||||
if let Some(dev) = &probe.device {
|
||||
let details = [
|
||||
dev.vendor.as_deref(),
|
||||
dev.product.as_deref(),
|
||||
dev.revision.as_deref(),
|
||||
]
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.collect::<Vec<_>>()
|
||||
.join(" / ");
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"PLC device identity disclosed over Modbus".to_string(),
|
||||
format!(
|
||||
"The device at {target} discloses its identity via Modbus Read Device \
|
||||
Identification: {details}. This aids fingerprinting and targeting of \
|
||||
known-vulnerable firmware/runtime versions."
|
||||
),
|
||||
Severity::Low,
|
||||
);
|
||||
f.rule_id = Some("ics-device-disclosure".to_string());
|
||||
f.cwe = Some("CWE-200".to_string());
|
||||
f.remediation = Some(
|
||||
"Limit network reach to the device; Modbus device identification cannot be \
|
||||
disabled, so exposure is bounded by network segmentation."
|
||||
.to_string(),
|
||||
);
|
||||
findings.push(f);
|
||||
}
|
||||
|
||||
// Exposed process points: coils / holding registers that a read enumerated
|
||||
// and that, over unauthenticated Modbus/TCP, are also writable. This is the
|
||||
// concrete attack surface behind the exposure — the live variables an
|
||||
// attacker can overwrite. (Read-only to detect: we never write.)
|
||||
let coils = probe.coils_readable.unwrap_or(0);
|
||||
let registers = probe.holding_registers_readable.unwrap_or(0);
|
||||
if coils > 0 || registers > 0 {
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
|
||||
format!(
|
||||
"Reading the device at {target} enumerated {coils} coil(s) and {registers} \
|
||||
holding register(s). Coils and holding registers are read/write process points \
|
||||
in Modbus, so any host that can reach this port can not only read but overwrite \
|
||||
live process state (force coils, change setpoints) without authentication."
|
||||
),
|
||||
Severity::High,
|
||||
);
|
||||
f.rule_id = Some("ics-modbus-exposed-points".to_string());
|
||||
f.cwe = Some("CWE-306".to_string());
|
||||
f.remediation = Some(
|
||||
"Segment the Modbus/TCP port to a trusted control network; where the device \
|
||||
supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
|
||||
function codes and register ranges are reachable from outside the control zone."
|
||||
.to_string(),
|
||||
);
|
||||
findings.push(f);
|
||||
}
|
||||
findings
|
||||
}
|
||||
|
||||
/// Findings from probing the OPC UA surface (default port 4840). A reachability
|
||||
/// probe only: it flags an exposed OPC UA server for review of its security
|
||||
/// policy / authentication (deep SecurityPolicy analysis is a follow-on).
|
||||
async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
|
||||
let probe = opcua::probe(host, port, budget).await;
|
||||
let mut findings = Vec::new();
|
||||
if !probe.is_opcua {
|
||||
return findings;
|
||||
}
|
||||
let target = format!("{host}:{port}");
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"OPC UA server exposed on the network".to_string(),
|
||||
format!(
|
||||
"An OPC UA server answers at {target}. Verify it enforces message security \
|
||||
(a SecurityPolicy other than None) and rejects anonymous sessions — the common \
|
||||
default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
|
||||
unencrypted read/write of the server's address space."
|
||||
),
|
||||
Severity::Medium,
|
||||
);
|
||||
f.rule_id = Some("ics-opcua-exposed".to_string());
|
||||
f.cwe = Some("CWE-319".to_string());
|
||||
f.remediation = Some(
|
||||
"Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
|
||||
SecurityPolicy (Basic256Sha256 or better) with certificate / username \
|
||||
authentication, and disable the Anonymous user token."
|
||||
.to_string(),
|
||||
);
|
||||
findings.push(f);
|
||||
findings
|
||||
}
|
||||
|
||||
/// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
|
||||
async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
|
||||
let probe = ethernetip::probe(host, port, budget).await;
|
||||
if !probe.is_enip {
|
||||
return Vec::new();
|
||||
}
|
||||
let target = format!("{host}:{port}");
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"EtherNet/IP (CIP) interface exposed on the network".to_string(),
|
||||
format!(
|
||||
"The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
|
||||
authentication in the base protocol, so a host that can reach it can enumerate \
|
||||
and interact with the device's control objects."
|
||||
),
|
||||
Severity::High,
|
||||
);
|
||||
f.rule_id = Some("ics-ethernetip-exposed".to_string());
|
||||
f.cwe = Some("CWE-306".to_string());
|
||||
f.remediation = Some(
|
||||
"Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
|
||||
(encryption + authentication) on devices that support it."
|
||||
.to_string(),
|
||||
);
|
||||
vec![f]
|
||||
}
|
||||
|
||||
/// Findings from the service-discovery port scan of the remaining OT /
|
||||
/// insecure-management surface.
|
||||
async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
|
||||
let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
|
||||
open.into_iter()
|
||||
.map(|kp| {
|
||||
let target = format!("{host}:{}", kp.port);
|
||||
let (title, severity, cwe, description) = match kp.kind {
|
||||
portscan::PortKind::Ics => (
|
||||
format!("ICS service exposed: {}", kp.service),
|
||||
Severity::High,
|
||||
"CWE-306",
|
||||
format!(
|
||||
"{target} exposes {} ({}). Industrial protocols are typically \
|
||||
unauthenticated, so network reach implies control access.",
|
||||
kp.service, kp.note
|
||||
),
|
||||
),
|
||||
portscan::PortKind::InsecureMgmt => (
|
||||
format!("Cleartext service exposed: {}", kp.service),
|
||||
Severity::Medium,
|
||||
"CWE-319",
|
||||
format!(
|
||||
"{target} exposes {} ({}), which transmits credentials and data in \
|
||||
cleartext.",
|
||||
kp.service, kp.note
|
||||
),
|
||||
),
|
||||
};
|
||||
let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
|
||||
let mut f = Finding::new(
|
||||
repo_id.to_string(),
|
||||
fp,
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
title,
|
||||
description,
|
||||
severity,
|
||||
);
|
||||
f.rule_id = Some("ics-service-exposed".to_string());
|
||||
f.cwe = Some(cwe.to_string());
|
||||
f.remediation = Some(
|
||||
"Restrict the service to a trusted network segment; disable it if unused; \
|
||||
replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
|
||||
.to_string(),
|
||||
);
|
||||
f
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Extract `(host, port)` from a target reference. Modbus lives on its own port
|
||||
/// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
|
||||
/// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
|
||||
fn parse_endpoint(endpoint: &str) -> (String, u16) {
|
||||
let s = endpoint.trim();
|
||||
let (scheme, rest) = match s.split_once("://") {
|
||||
Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
|
||||
None => (None, s),
|
||||
};
|
||||
let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
|
||||
let (host, port) = match hostport.rsplit_once(':') {
|
||||
Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
|
||||
None => (hostport.to_string(), None),
|
||||
};
|
||||
let port = match (scheme.as_deref(), port) {
|
||||
// Explicit Modbus port, or a bare host:port the user chose.
|
||||
(Some("modbus"), Some(p)) | (None, Some(p)) => p,
|
||||
// An http(s)/WebVisu URL (or no port): Modbus is on its own port.
|
||||
_ => MODBUS_PORT,
|
||||
};
|
||||
(host, port)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::parse_endpoint;
|
||||
|
||||
#[test]
|
||||
fn endpoint_parsing_picks_the_modbus_port() {
|
||||
assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
|
||||
assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
|
||||
assert_eq!(
|
||||
parse_endpoint("modbus://plc.local:5020"),
|
||||
("plc.local".into(), 5020)
|
||||
);
|
||||
// A WebVisu URL: the http port is ignored; Modbus is on 502.
|
||||
assert_eq!(
|
||||
parse_endpoint("http://plc.local:8080/webvisu"),
|
||||
("plc.local".into(), 502)
|
||||
);
|
||||
assert_eq!(
|
||||
parse_endpoint("https://plc.local/"),
|
||||
("plc.local".into(), 502)
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,262 +0,0 @@
|
||||
//! Minimal Modbus/TCP client for dynamic ICS probing.
|
||||
//!
|
||||
//! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
|
||||
//! an endpoint that answers requests is, by design, open to any host that can
|
||||
//! reach it. The probe only *reads* — a Read Holding Registers request and a Read
|
||||
//! Device Identification request — and never writes to the live process.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::timeout;
|
||||
|
||||
/// Outcome of probing a Modbus/TCP endpoint.
|
||||
#[derive(Debug, Default, PartialEq, Eq)]
|
||||
pub struct ModbusProbe {
|
||||
/// A TCP connection to the port was established.
|
||||
pub reachable: bool,
|
||||
/// The endpoint answered a Modbus request (a normal reply or a Modbus
|
||||
/// exception) — i.e. it speaks Modbus, unauthenticated.
|
||||
pub speaks_modbus: bool,
|
||||
/// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
|
||||
pub device: Option<DeviceId>,
|
||||
/// Coils returned by a Read Coils of the first block, if that address range
|
||||
/// exists. Coils are read/write process bits, so an exposed block is an
|
||||
/// unauthenticated write surface on the live process.
|
||||
pub coils_readable: Option<u16>,
|
||||
/// Holding registers returned by a Read Holding Registers of the first block,
|
||||
/// if that range exists. Holding registers are read/write process words.
|
||||
pub holding_registers_readable: Option<u16>,
|
||||
}
|
||||
|
||||
/// Vendor / product / revision from Read Device Identification.
|
||||
#[derive(Debug, Default, PartialEq, Eq)]
|
||||
pub struct DeviceId {
|
||||
pub vendor: Option<String>,
|
||||
pub product: Option<String>,
|
||||
pub revision: Option<String>,
|
||||
}
|
||||
|
||||
/// How many coils / holding registers to request when enumerating the exposed
|
||||
/// process surface. Read-only: a normal reply means the block exists and is,
|
||||
/// over unauthenticated Modbus/TCP, also writable.
|
||||
const ENUM_QTY: u16 = 16;
|
||||
|
||||
/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
|
||||
/// Coils, and Read Device Identification requests; never writes to the device.
|
||||
pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
|
||||
let mut out = ModbusProbe::default();
|
||||
let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
|
||||
return out; // unreachable
|
||||
};
|
||||
out.reachable = true;
|
||||
|
||||
// Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
|
||||
// enumerates the exposed register block.
|
||||
let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
|
||||
if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
|
||||
// A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
|
||||
if matches!(resp.first(), Some(0x03) | Some(0x83)) {
|
||||
out.speaks_modbus = true;
|
||||
}
|
||||
if resp.first() == Some(&0x03) {
|
||||
out.holding_registers_readable = Some(register_count_from_reply(&resp));
|
||||
}
|
||||
}
|
||||
|
||||
// Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
|
||||
let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
|
||||
if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
|
||||
if matches!(resp.first(), Some(0x01) | Some(0x81)) {
|
||||
out.speaks_modbus = true;
|
||||
}
|
||||
if resp.first() == Some(&0x01) {
|
||||
out.coils_readable = Some(coil_count_from_reply(&resp));
|
||||
}
|
||||
}
|
||||
|
||||
// Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
|
||||
let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
|
||||
if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
|
||||
if resp.first() == Some(&0x2B) {
|
||||
out.speaks_modbus = true;
|
||||
out.device = parse_device_id(&resp);
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
|
||||
fn coil_count_from_reply(pdu: &[u8]) -> u16 {
|
||||
pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
|
||||
}
|
||||
|
||||
/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
|
||||
/// data…]` (2 bytes per register).
|
||||
fn register_count_from_reply(pdu: &[u8]) -> u16 {
|
||||
pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
|
||||
}
|
||||
|
||||
/// Send one Modbus PDU and return the response PDU (function code + data), or
|
||||
/// `None` on timeout / malformed reply.
|
||||
async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
|
||||
// MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
|
||||
// then the PDU. `length` counts the unit byte plus the PDU.
|
||||
let len = (pdu.len() + 1) as u16;
|
||||
let mut frame = Vec::with_capacity(7 + pdu.len());
|
||||
frame.extend_from_slice(&[0x00, 0x01]); // transaction id
|
||||
frame.extend_from_slice(&[0x00, 0x00]); // protocol id
|
||||
frame.extend_from_slice(&len.to_be_bytes());
|
||||
frame.push(unit);
|
||||
frame.extend_from_slice(pdu);
|
||||
timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
|
||||
|
||||
let mut hdr = [0u8; 7];
|
||||
timeout(budget, stream.read_exact(&mut hdr))
|
||||
.await
|
||||
.ok()?
|
||||
.ok()?;
|
||||
// Reject non-Modbus replies (protocol id must be 0).
|
||||
if hdr[2] != 0 || hdr[3] != 0 {
|
||||
return None;
|
||||
}
|
||||
let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
|
||||
if !(2..=260).contains(&plen) {
|
||||
return None;
|
||||
}
|
||||
let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
|
||||
timeout(budget, stream.read_exact(&mut body))
|
||||
.await
|
||||
.ok()?
|
||||
.ok()?;
|
||||
Some(body)
|
||||
}
|
||||
|
||||
/// Parse vendor / product / revision from a Read Device Identification PDU:
|
||||
/// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
|
||||
/// (objId, len, bytes…)…]`.
|
||||
fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
|
||||
if pdu.len() < 7 {
|
||||
return None;
|
||||
}
|
||||
let num = pdu[6] as usize;
|
||||
let mut i = 7;
|
||||
let mut dev = DeviceId::default();
|
||||
for _ in 0..num {
|
||||
if i + 2 > pdu.len() {
|
||||
break;
|
||||
}
|
||||
let id = pdu[i];
|
||||
let l = pdu[i + 1] as usize;
|
||||
i += 2;
|
||||
if i + l > pdu.len() {
|
||||
break;
|
||||
}
|
||||
let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
|
||||
i += l;
|
||||
match id {
|
||||
0x00 => dev.vendor = Some(val),
|
||||
0x01 => dev.product = Some(val),
|
||||
0x02 => dev.revision = Some(val),
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
if dev == DeviceId::default() {
|
||||
None
|
||||
} else {
|
||||
Some(dev)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tokio::net::TcpListener;
|
||||
|
||||
/// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
|
||||
/// request and a Read Device Identification request on one connection.
|
||||
async fn mock_server(with_device: bool) -> std::net::SocketAddr {
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
|
||||
let addr = listener.local_addr().expect("addr");
|
||||
tokio::spawn(async move {
|
||||
let (mut sock, _) = listener.accept().await.expect("accept");
|
||||
loop {
|
||||
let mut hdr = [0u8; 7];
|
||||
if sock.read_exact(&mut hdr).await.is_err() {
|
||||
break;
|
||||
}
|
||||
let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
|
||||
let mut pdu = vec![0u8; plen - 1];
|
||||
if sock.read_exact(&mut pdu).await.is_err() {
|
||||
break;
|
||||
}
|
||||
let reply_pdu: Vec<u8> = match pdu.first() {
|
||||
Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
|
||||
Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
|
||||
Some(0x2B) if with_device => vec![
|
||||
0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
|
||||
0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
|
||||
0x01, 0x03, b'P', b'L', b'C', // product
|
||||
],
|
||||
_ => vec![pdu[0] | 0x80, 0x01], // exception
|
||||
};
|
||||
let len = (reply_pdu.len() + 1) as u16;
|
||||
let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
|
||||
frame.extend_from_slice(&len.to_be_bytes());
|
||||
frame.push(hdr[6]);
|
||||
frame.extend_from_slice(&reply_pdu);
|
||||
if sock.write_all(&frame).await.is_err() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
});
|
||||
addr
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
|
||||
let addr = mock_server(true).await;
|
||||
let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
|
||||
assert!(p.reachable && p.speaks_modbus);
|
||||
let dev = p.device.expect("device id");
|
||||
assert_eq!(dev.vendor.as_deref(), Some("ACME"));
|
||||
assert_eq!(dev.product.as_deref(), Some("PLC"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_enumerates_exposed_process_points() {
|
||||
let addr = mock_server(false).await;
|
||||
let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
|
||||
assert!(p.speaks_modbus);
|
||||
// The mock returns a 2-byte holding-register block (1 register) and a
|
||||
// 2-byte coil block (16 coils).
|
||||
assert_eq!(p.holding_registers_readable, Some(1));
|
||||
assert_eq!(p.coils_readable, Some(16));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn reply_counts_decode_byte_counts() {
|
||||
assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
|
||||
assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
|
||||
assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_reports_unreachable_for_a_closed_port() {
|
||||
// 127.0.0.1:1 is (almost certainly) closed.
|
||||
let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
|
||||
assert!(!p.reachable && !p.speaks_modbus);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_device_identification_objects() {
|
||||
let pdu = [
|
||||
0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
|
||||
0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
|
||||
];
|
||||
let dev = parse_device_id(&pdu).expect("device");
|
||||
assert_eq!(dev.revision.as_deref(), Some("v1.23"));
|
||||
assert!(dev.vendor.is_none());
|
||||
}
|
||||
}
|
||||
@@ -1,131 +0,0 @@
|
||||
//! Minimal OPC UA reachability probe.
|
||||
//!
|
||||
//! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
|
||||
//! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
|
||||
//! listening (default port 4840). It does **not** open a secure channel or make
|
||||
//! service calls; deep analysis of the server's SecurityPolicy / user-token
|
||||
//! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
|
||||
//! done with a full OPC UA stack.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::timeout;
|
||||
|
||||
/// Outcome of an OPC UA handshake probe.
|
||||
#[derive(Debug, Default, PartialEq, Eq)]
|
||||
pub struct OpcUaProbe {
|
||||
/// A TCP connection to the port was established.
|
||||
pub reachable: bool,
|
||||
/// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
|
||||
/// either way it speaks OPC UA.
|
||||
pub is_opcua: bool,
|
||||
}
|
||||
|
||||
/// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
|
||||
pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
|
||||
let mut out = OpcUaProbe::default();
|
||||
let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
|
||||
return out;
|
||||
};
|
||||
out.reachable = true;
|
||||
|
||||
let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
|
||||
if timeout(budget, stream.write_all(&hello))
|
||||
.await
|
||||
.ok()
|
||||
.and_then(Result::ok)
|
||||
.is_none()
|
||||
{
|
||||
return out;
|
||||
}
|
||||
|
||||
// Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
|
||||
// our hello) both prove the peer speaks the OPC UA connection protocol.
|
||||
let mut mt = [0u8; 3];
|
||||
if timeout(budget, stream.read_exact(&mut mt))
|
||||
.await
|
||||
.ok()
|
||||
.and_then(Result::ok)
|
||||
.is_none()
|
||||
{
|
||||
return out;
|
||||
}
|
||||
if &mt == b"ACK" || &mt == b"ERR" {
|
||||
out.is_opcua = true;
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
|
||||
fn hello_message(endpoint_url: &str) -> Vec<u8> {
|
||||
let url = endpoint_url.as_bytes();
|
||||
let mut m = Vec::with_capacity(32 + url.len());
|
||||
m.extend_from_slice(b"HELF");
|
||||
m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
|
||||
m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
|
||||
m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
|
||||
m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
|
||||
m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
|
||||
m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
|
||||
m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
|
||||
m.extend_from_slice(url);
|
||||
let size = m.len() as u32;
|
||||
m[4..8].copy_from_slice(&size.to_le_bytes());
|
||||
m
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tokio::net::TcpListener;
|
||||
|
||||
/// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
|
||||
async fn mock_server() -> std::net::SocketAddr {
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
|
||||
let addr = listener.local_addr().expect("addr");
|
||||
tokio::spawn(async move {
|
||||
let (mut sock, _) = listener.accept().await.expect("accept");
|
||||
// Read the Hello header (8 bytes) to learn the size, then drain it.
|
||||
let mut hdr = [0u8; 8];
|
||||
if sock.read_exact(&mut hdr).await.is_err() {
|
||||
return;
|
||||
}
|
||||
let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
|
||||
let mut rest = vec![0u8; size.saturating_sub(8)];
|
||||
let _ = sock.read_exact(&mut rest).await;
|
||||
// Reply: ACK + size + 5 u32 fields.
|
||||
let mut ack = Vec::new();
|
||||
ack.extend_from_slice(b"ACKF");
|
||||
ack.extend_from_slice(&28u32.to_le_bytes());
|
||||
for _ in 0..5 {
|
||||
ack.extend_from_slice(&0u32.to_le_bytes());
|
||||
}
|
||||
let _ = sock.write_all(&ack).await;
|
||||
});
|
||||
addr
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_detects_an_opcua_server() {
|
||||
let addr = mock_server().await;
|
||||
let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
|
||||
assert!(p.reachable && p.is_opcua);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn probe_reports_unreachable_for_a_closed_port() {
|
||||
let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
|
||||
assert!(!p.reachable && !p.is_opcua);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn hello_message_is_well_formed() {
|
||||
let m = hello_message("opc.tcp://h:4840");
|
||||
assert_eq!(&m[0..4], b"HELF");
|
||||
// The embedded size equals the actual length.
|
||||
let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
|
||||
assert_eq!(size, m.len());
|
||||
}
|
||||
}
|
||||
@@ -1,137 +0,0 @@
|
||||
//! TCP service discovery for a device.
|
||||
//!
|
||||
//! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
|
||||
//! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
|
||||
//! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
|
||||
//! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use futures_util::future::join_all;
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::timeout;
|
||||
|
||||
/// Whether an open port is an industrial protocol or an insecure management service.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum PortKind {
|
||||
/// An industrial control protocol (typically unauthenticated).
|
||||
Ics,
|
||||
/// A cleartext management service (credentials/data in the clear).
|
||||
InsecureMgmt,
|
||||
}
|
||||
|
||||
/// A well-known port worth flagging when open.
|
||||
#[derive(Debug, Clone, Copy)]
|
||||
pub struct KnownPort {
|
||||
pub port: u16,
|
||||
pub service: &'static str,
|
||||
pub kind: PortKind,
|
||||
pub note: &'static str,
|
||||
}
|
||||
|
||||
/// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
|
||||
/// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
|
||||
pub const KNOWN_PORTS: &[KnownPort] = &[
|
||||
KnownPort {
|
||||
port: 102,
|
||||
service: "S7comm / ISO-TSAP",
|
||||
kind: PortKind::Ics,
|
||||
note: "Siemens S7 PLC communication",
|
||||
},
|
||||
KnownPort {
|
||||
port: 20000,
|
||||
service: "DNP3",
|
||||
kind: PortKind::Ics,
|
||||
note: "SCADA / DNP3",
|
||||
},
|
||||
KnownPort {
|
||||
port: 1911,
|
||||
service: "Niagara Fox",
|
||||
kind: PortKind::Ics,
|
||||
note: "Tridium Niagara building automation",
|
||||
},
|
||||
KnownPort {
|
||||
port: 11740,
|
||||
service: "CODESYS",
|
||||
kind: PortKind::Ics,
|
||||
note: "CODESYS programming protocol",
|
||||
},
|
||||
KnownPort {
|
||||
port: 1962,
|
||||
service: "PCWorx",
|
||||
kind: PortKind::Ics,
|
||||
note: "Phoenix Contact PCWorx",
|
||||
},
|
||||
KnownPort {
|
||||
port: 9600,
|
||||
service: "OMRON FINS",
|
||||
kind: PortKind::Ics,
|
||||
note: "Omron FINS",
|
||||
},
|
||||
KnownPort {
|
||||
port: 789,
|
||||
service: "Red Lion Crimson",
|
||||
kind: PortKind::Ics,
|
||||
note: "Red Lion controllers",
|
||||
},
|
||||
KnownPort {
|
||||
port: 23,
|
||||
service: "Telnet",
|
||||
kind: PortKind::InsecureMgmt,
|
||||
note: "cleartext remote shell",
|
||||
},
|
||||
KnownPort {
|
||||
port: 21,
|
||||
service: "FTP",
|
||||
kind: PortKind::InsecureMgmt,
|
||||
note: "cleartext file transfer",
|
||||
},
|
||||
];
|
||||
|
||||
/// Connect-scan `ports` on `host` (concurrently) and return those that accept a
|
||||
/// TCP connection.
|
||||
pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
|
||||
let checks = ports.iter().map(|kp| async move {
|
||||
let open = timeout(budget, TcpStream::connect((host, kp.port)))
|
||||
.await
|
||||
.map(|r| r.is_ok())
|
||||
.unwrap_or(false);
|
||||
(kp, open)
|
||||
});
|
||||
join_all(checks)
|
||||
.await
|
||||
.into_iter()
|
||||
.filter_map(|(kp, open)| open.then_some(kp))
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tokio::net::TcpListener;
|
||||
|
||||
#[tokio::test]
|
||||
async fn scan_reports_only_open_ports() {
|
||||
// Bind one port (open) and pick another that is closed.
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
|
||||
let open_port = listener.local_addr().expect("addr").port();
|
||||
|
||||
let ports = [
|
||||
KnownPort {
|
||||
port: open_port,
|
||||
service: "test-open",
|
||||
kind: PortKind::Ics,
|
||||
note: "",
|
||||
},
|
||||
KnownPort {
|
||||
port: 1,
|
||||
service: "test-closed",
|
||||
kind: PortKind::InsecureMgmt,
|
||||
note: "",
|
||||
},
|
||||
];
|
||||
let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
|
||||
let services: Vec<&str> = found.iter().map(|p| p.service).collect();
|
||||
assert_eq!(services, vec!["test-open"]);
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
//! Shared dynamic-execution logic for Werkbank.
|
||||
//!
|
||||
//! The soft-PLC provisioning + industrial-protocol probing that turns a control-
|
||||
//! logic artifact into findings: provision an ephemeral OpenPLC, load the program,
|
||||
//! start it, probe it over Modbus/OPC-UA/EtherNet-IP, DAST its web endpoint, tear
|
||||
//! it down. Extracted from the compliance agent (#183) so both the agent (in
|
||||
//! process) and the Werkbank runner (WB-04) run identical logic.
|
||||
//!
|
||||
//! - [`ics`] — read-only industrial-protocol probing.
|
||||
//! - [`plc`] — ephemeral soft-PLC provisioning + the provision-and-test loop.
|
||||
|
||||
pub mod error;
|
||||
pub mod ics;
|
||||
pub mod plc;
|
||||
|
||||
mod fingerprint;
|
||||
|
||||
pub use error::ExecError;
|
||||
@@ -1,422 +0,0 @@
|
||||
//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
|
||||
//!
|
||||
//! When a PLC/SPS target ships control logic but no reachable live device, the
|
||||
//! agent instantiates that logic itself instead of trying to reach the customer's
|
||||
//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
|
||||
//! loads the program, starts the runtime, probes it over industrial protocols,
|
||||
//! then tears the instance down. No customer network access, sandboxed, and
|
||||
//! reproducible — destructive tests become safe because the target is ours.
|
||||
//!
|
||||
//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
|
||||
//! - [`openplc`] loads the program into the running instance (sub-task 2).
|
||||
//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
|
||||
//! teardown, and runs the ICS probe against the provisioned endpoint.
|
||||
|
||||
pub mod openplc;
|
||||
pub mod provision;
|
||||
|
||||
use std::path::Path;
|
||||
use std::time::Duration;
|
||||
|
||||
use secrecy::ExposeSecret;
|
||||
|
||||
use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
|
||||
use compliance_core::models::Finding;
|
||||
use compliance_core::PlcRuntimeConfig;
|
||||
|
||||
use crate::error::ExecError;
|
||||
|
||||
pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
|
||||
|
||||
/// The result of a DAST scan against a provisioned web endpoint.
|
||||
#[derive(Debug)]
|
||||
pub struct DastRunResult {
|
||||
/// The scan-run record (linked to the onboarded target).
|
||||
pub scan_run: DastScanRun,
|
||||
/// The DAST findings.
|
||||
pub findings: Vec<DastFinding>,
|
||||
}
|
||||
|
||||
/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
|
||||
/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
|
||||
/// both — keeping this a plain data return means the whole run is portable to a
|
||||
/// remote execution backend that just hands the results back.
|
||||
#[derive(Debug, Default)]
|
||||
pub struct ProvisionOutcome {
|
||||
/// ICS-probe findings from the provisioned Modbus endpoint.
|
||||
pub findings: Vec<Finding>,
|
||||
/// DAST scan of the provisioned web endpoint, if it ran.
|
||||
pub dast: Option<DastRunResult>,
|
||||
}
|
||||
|
||||
/// A control-logic program ready to load into a soft-PLC: the source text plus a
|
||||
/// cosmetic file name (OpenPLC re-stores it under its own name).
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct PlcProgram {
|
||||
/// The original file name (for the upload form; OpenPLC renames on storage).
|
||||
pub file_name: String,
|
||||
/// The program source — Structured Text or PLCopen XML.
|
||||
pub source: String,
|
||||
}
|
||||
|
||||
/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
|
||||
/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
|
||||
pub fn http_client() -> Result<reqwest::Client, ExecError> {
|
||||
reqwest::Client::builder()
|
||||
.cookie_store(true)
|
||||
.timeout(Duration::from_secs(30))
|
||||
.build()
|
||||
.map_err(ExecError::Http)
|
||||
}
|
||||
|
||||
/// Pick the control-logic program to run from an ingested PLC source tree.
|
||||
///
|
||||
/// OpenPLC runs one program, so we choose the best single candidate: a complete
|
||||
/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
|
||||
/// failing that the largest ST file; failing that a PLCopen XML export. Returns
|
||||
/// `None` when the tree holds no loadable control logic.
|
||||
pub fn extract_program(root: &Path) -> Option<PlcProgram> {
|
||||
let mut st: Vec<(String, String)> = Vec::new();
|
||||
let mut xml: Vec<(String, String)> = Vec::new();
|
||||
for entry in walkdir::WalkDir::new(root)
|
||||
.into_iter()
|
||||
.filter_map(Result::ok)
|
||||
{
|
||||
if !entry.file_type().is_file() {
|
||||
continue;
|
||||
}
|
||||
let path = entry.path();
|
||||
let ext = path
|
||||
.extension()
|
||||
.and_then(|e| e.to_str())
|
||||
.unwrap_or("")
|
||||
.to_ascii_lowercase();
|
||||
let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
|
||||
let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
|
||||
if !is_st && !is_xml {
|
||||
continue;
|
||||
}
|
||||
let Ok(content) = std::fs::read_to_string(path) else {
|
||||
continue;
|
||||
};
|
||||
let name = path
|
||||
.file_name()
|
||||
.and_then(|n| n.to_str())
|
||||
.unwrap_or("program")
|
||||
.to_string();
|
||||
if is_st {
|
||||
st.push((name, content));
|
||||
} else if looks_like_plcopen(&content) {
|
||||
xml.push((name, content));
|
||||
}
|
||||
}
|
||||
|
||||
if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
|
||||
return Some(PlcProgram {
|
||||
file_name: name.clone(),
|
||||
source: source.clone(),
|
||||
});
|
||||
}
|
||||
if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
|
||||
return Some(PlcProgram {
|
||||
file_name: name.clone(),
|
||||
source: source.clone(),
|
||||
});
|
||||
}
|
||||
xml.into_iter()
|
||||
.max_by_key(|(_, c)| c.len())
|
||||
.map(|(file_name, source)| PlcProgram { file_name, source })
|
||||
}
|
||||
|
||||
/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
|
||||
fn has_configuration(source: &str) -> bool {
|
||||
source.to_ascii_uppercase().contains("CONFIGURATION")
|
||||
}
|
||||
|
||||
/// Whether an XML file looks like a PLCopen project export.
|
||||
fn looks_like_plcopen(source: &str) -> bool {
|
||||
let lower = source.to_ascii_lowercase();
|
||||
lower.contains("<project") || lower.contains("plcopen")
|
||||
}
|
||||
|
||||
/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
|
||||
/// industrial protocols, and tear it down. Returns the ICS-probe findings.
|
||||
///
|
||||
/// Teardown is guaranteed: the load/probe work runs under a hard deadline
|
||||
/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
|
||||
/// success, error, or deadline expiry.
|
||||
pub async fn provision_and_test<P: SoftPlc>(
|
||||
provisioner: &P,
|
||||
http: &reqwest::Client,
|
||||
cfg: &PlcRuntimeConfig,
|
||||
program: &PlcProgram,
|
||||
target_id: &str,
|
||||
) -> Result<ProvisionOutcome, ExecError> {
|
||||
let handle = provisioner.provision(target_id).await?;
|
||||
tracing::info!(
|
||||
target_id,
|
||||
instance = %handle.name,
|
||||
modbus = %handle.modbus_endpoint,
|
||||
"provisioned ephemeral soft-PLC"
|
||||
);
|
||||
|
||||
let deadline = Duration::from_secs(cfg.max_lifetime_secs);
|
||||
let result = tokio::time::timeout(
|
||||
deadline,
|
||||
run_dynamic_test(http, cfg, program, target_id, &handle),
|
||||
)
|
||||
.await;
|
||||
|
||||
// Guaranteed teardown — runs on success, error, and deadline expiry. The
|
||||
// inner future is panic-free (the workspace lint bans unwrap/expect), so no
|
||||
// unwind can skip this; a container leaked by an agent *crash* is swept by
|
||||
// the next run's stale reaper.
|
||||
provisioner.teardown(&handle).await;
|
||||
|
||||
match result {
|
||||
Ok(inner) => inner,
|
||||
Err(_) => {
|
||||
tracing::warn!(
|
||||
target_id,
|
||||
instance = %handle.name,
|
||||
"provision-and-test hit the lifetime deadline; torn down"
|
||||
);
|
||||
Ok(ProvisionOutcome::default())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The load → start → probe → DAST body, run under the caller's deadline.
|
||||
async fn run_dynamic_test(
|
||||
http: &reqwest::Client,
|
||||
cfg: &PlcRuntimeConfig,
|
||||
program: &PlcProgram,
|
||||
target_id: &str,
|
||||
handle: &ProvisionedRuntime,
|
||||
) -> Result<ProvisionOutcome, ExecError> {
|
||||
let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
|
||||
openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
|
||||
|
||||
let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
|
||||
openplc::load_and_start(
|
||||
http,
|
||||
&handle.webvisu_url,
|
||||
&cfg.openplc_user,
|
||||
cfg.openplc_password.expose_secret(),
|
||||
program,
|
||||
compile_budget,
|
||||
)
|
||||
.await?;
|
||||
|
||||
// Give the runtime a moment to open the Modbus/TCP server before probing.
|
||||
tokio::time::sleep(Duration::from_secs(3)).await;
|
||||
|
||||
let probe_budget = Duration::from_secs(5);
|
||||
let findings = crate::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
|
||||
tracing::info!(
|
||||
target_id,
|
||||
instance = %handle.name,
|
||||
found = findings.len(),
|
||||
"provision-and-test probe complete"
|
||||
);
|
||||
|
||||
// DAST the provisioned web endpoint (independently bounded so it can't eat
|
||||
// the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
|
||||
// not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
|
||||
// but it proves the deploy→run→probe→DAST loop end to end.
|
||||
let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
|
||||
let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
|
||||
Ok(d) => d,
|
||||
Err(_) => {
|
||||
tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
|
||||
None
|
||||
}
|
||||
};
|
||||
|
||||
Ok(ProvisionOutcome { findings, dast })
|
||||
}
|
||||
|
||||
/// Run a bounded DAST scan against the provisioned web endpoint and tag the
|
||||
/// results with our target id. Best-effort — a DAST failure never fails the run.
|
||||
async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
|
||||
let mut dt = DastTarget::new(
|
||||
"provisioned-webvisu".to_string(),
|
||||
handle.webvisu_url.clone(),
|
||||
DastTargetType::WebApp,
|
||||
);
|
||||
dt.repo_id = Some(target_id.to_string());
|
||||
dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
|
||||
|
||||
let orchestrator = compliance_dast::DastOrchestrator::new(100);
|
||||
match orchestrator.run_scan(&dt, Vec::new()).await {
|
||||
Ok((mut scan_run, mut findings)) => {
|
||||
scan_run.target_id = target_id.to_string();
|
||||
for f in &mut findings {
|
||||
f.target_id = target_id.to_string();
|
||||
}
|
||||
tracing::info!(
|
||||
target_id,
|
||||
instance = %handle.name,
|
||||
dast_findings = findings.len(),
|
||||
"provision-and-test DAST complete"
|
||||
);
|
||||
Some(DastRunResult { scan_run, findings })
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
|
||||
None
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::sync::atomic::{AtomicUsize, Ordering};
|
||||
use std::sync::Arc;
|
||||
|
||||
/// A scratch dir removed on drop.
|
||||
struct Scratch(std::path::PathBuf);
|
||||
impl Scratch {
|
||||
fn new() -> Self {
|
||||
let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&p).expect("mkdir");
|
||||
Self(p)
|
||||
}
|
||||
}
|
||||
impl Drop for Scratch {
|
||||
fn drop(&mut self) {
|
||||
let _ = std::fs::remove_dir_all(&self.0);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_prefers_a_complete_st_program() {
|
||||
let s = Scratch::new();
|
||||
std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
|
||||
std::fs::write(
|
||||
s.0.join("full.st"),
|
||||
"PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n RESOURCE R\nEND_CONFIGURATION\n",
|
||||
)
|
||||
.expect("w");
|
||||
let prog = extract_program(&s.0).expect("program");
|
||||
assert_eq!(prog.file_name, "full.st");
|
||||
assert!(prog.source.contains("CONFIGURATION"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_falls_back_to_largest_st_then_plcopen() {
|
||||
let s = Scratch::new();
|
||||
std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
|
||||
std::fs::write(
|
||||
s.0.join("big.st"),
|
||||
"PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
|
||||
)
|
||||
.expect("w");
|
||||
let prog = extract_program(&s.0).expect("program");
|
||||
assert_eq!(
|
||||
prog.file_name, "big.st",
|
||||
"largest ST wins when none complete"
|
||||
);
|
||||
|
||||
// Only a PLCopen XML present.
|
||||
let s2 = Scratch::new();
|
||||
std::fs::write(
|
||||
s2.0.join("proj.xml"),
|
||||
"<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
|
||||
)
|
||||
.expect("w");
|
||||
let prog2 = extract_program(&s2.0).expect("program");
|
||||
assert_eq!(prog2.file_name, "proj.xml");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_none_without_control_logic() {
|
||||
let s = Scratch::new();
|
||||
std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
|
||||
std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
|
||||
assert!(extract_program(&s.0).is_none());
|
||||
}
|
||||
|
||||
/// A fake provisioner recording provision/teardown calls, for lifecycle tests.
|
||||
struct FakeSoftPlc {
|
||||
provisions: Arc<AtomicUsize>,
|
||||
teardowns: Arc<AtomicUsize>,
|
||||
fail_provision: bool,
|
||||
}
|
||||
|
||||
impl SoftPlc for FakeSoftPlc {
|
||||
async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
|
||||
self.provisions.fetch_add(1, Ordering::SeqCst);
|
||||
if self.fail_provision {
|
||||
return Err(ExecError::Other("provision failed".into()));
|
||||
}
|
||||
// Unreachable address so run_dynamic_test blocks on readiness until the
|
||||
// deadline fires — exercising the teardown-on-deadline path.
|
||||
Ok(ProvisionedRuntime {
|
||||
name: "fake-plc".into(),
|
||||
modbus_endpoint: "fake-plc:502".into(),
|
||||
webvisu_url: "http://fake-plc.invalid:8080".into(),
|
||||
})
|
||||
}
|
||||
async fn teardown(&self, _handle: &ProvisionedRuntime) {
|
||||
self.teardowns.fetch_add(1, Ordering::SeqCst);
|
||||
}
|
||||
}
|
||||
|
||||
fn short_cfg() -> PlcRuntimeConfig {
|
||||
PlcRuntimeConfig {
|
||||
enabled: true,
|
||||
max_lifetime_secs: 1, // keep the deadline path fast
|
||||
..PlcRuntimeConfig::default()
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn teardown_runs_even_when_the_test_never_completes() {
|
||||
let provisions = Arc::new(AtomicUsize::new(0));
|
||||
let teardowns = Arc::new(AtomicUsize::new(0));
|
||||
let fake = FakeSoftPlc {
|
||||
provisions: provisions.clone(),
|
||||
teardowns: teardowns.clone(),
|
||||
fail_provision: false,
|
||||
};
|
||||
let http = http_client().expect("client");
|
||||
let prog = PlcProgram {
|
||||
file_name: "p.st".into(),
|
||||
source: "PROGRAM P\nEND_PROGRAM\n".into(),
|
||||
};
|
||||
let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
|
||||
.await
|
||||
.expect("ok on deadline");
|
||||
assert!(out.findings.is_empty(), "deadline path yields no findings");
|
||||
assert!(out.dast.is_none(), "deadline path runs no DAST");
|
||||
assert_eq!(provisions.load(Ordering::SeqCst), 1);
|
||||
assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn provision_failure_propagates_and_skips_teardown() {
|
||||
let provisions = Arc::new(AtomicUsize::new(0));
|
||||
let teardowns = Arc::new(AtomicUsize::new(0));
|
||||
let fake = FakeSoftPlc {
|
||||
provisions: provisions.clone(),
|
||||
teardowns: teardowns.clone(),
|
||||
fail_provision: true,
|
||||
};
|
||||
let http = http_client().expect("client");
|
||||
let prog = PlcProgram {
|
||||
file_name: "p.st".into(),
|
||||
source: String::new(),
|
||||
};
|
||||
let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
|
||||
assert!(err.is_err(), "provision failure propagates");
|
||||
assert_eq!(provisions.load(Ordering::SeqCst), 1);
|
||||
assert_eq!(
|
||||
teardowns.load(Ordering::SeqCst),
|
||||
0,
|
||||
"nothing to tear down when provisioning failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,254 +0,0 @@
|
||||
//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
|
||||
//!
|
||||
//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
|
||||
//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
|
||||
//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
|
||||
//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
|
||||
//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
|
||||
//! server-assigned `prog_file`) → `POST /upload-program-action` →
|
||||
//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use crate::error::ExecError;
|
||||
|
||||
use super::PlcProgram;
|
||||
|
||||
/// Default OpenPLC program name/description recorded in its UI.
|
||||
const PROG_NAME: &str = "certifai-provisioned";
|
||||
const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
|
||||
|
||||
/// Poll interval while waiting for readiness / compilation.
|
||||
const POLL_INTERVAL: Duration = Duration::from_secs(2);
|
||||
|
||||
/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
|
||||
/// budget elapses. A freshly-started container needs a few seconds to boot.
|
||||
pub async fn wait_ready(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
budget: Duration,
|
||||
) -> Result<(), ExecError> {
|
||||
let login = format!("{base_url}/login");
|
||||
let outcome = tokio::time::timeout(budget, async {
|
||||
loop {
|
||||
if let Ok(resp) = http.get(&login).send().await {
|
||||
if !resp.status().is_server_error() {
|
||||
return;
|
||||
}
|
||||
}
|
||||
tokio::time::sleep(POLL_INTERVAL).await;
|
||||
}
|
||||
})
|
||||
.await;
|
||||
outcome.map_err(|_| ExecError::Other(format!("OpenPLC at {base_url} did not become ready")))
|
||||
}
|
||||
|
||||
/// Log in, upload the program, compile it, and start the runtime. On success the
|
||||
/// OpenPLC Modbus/TCP server is listening on 502.
|
||||
pub async fn load_and_start(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
user: &str,
|
||||
password: &str,
|
||||
program: &PlcProgram,
|
||||
compile_budget: Duration,
|
||||
) -> Result<(), ExecError> {
|
||||
login(http, base_url, user, password).await?;
|
||||
let prog_file = upload_program(http, base_url, program).await?;
|
||||
save_program(http, base_url, &prog_file).await?;
|
||||
compile(http, base_url, &prog_file, compile_budget).await?;
|
||||
start(http, base_url).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// `POST /login` — establishes the session cookie (the client must have a cookie
|
||||
/// store; see the provision-and-test entry point).
|
||||
async fn login(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
user: &str,
|
||||
password: &str,
|
||||
) -> Result<(), ExecError> {
|
||||
let resp = http
|
||||
.post(format!("{base_url}/login"))
|
||||
.form(&[("username", user), ("password", password)])
|
||||
.send()
|
||||
.await?;
|
||||
if resp.status().is_server_error() {
|
||||
return Err(ExecError::Other(format!(
|
||||
"OpenPLC login failed: HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
|
||||
/// server-assigned name and returns it in a hidden `prog_file` form field, which
|
||||
/// we parse out for the follow-up save/compile steps.
|
||||
async fn upload_program(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
program: &PlcProgram,
|
||||
) -> Result<String, ExecError> {
|
||||
let part = reqwest::multipart::Part::text(program.source.clone())
|
||||
.file_name(program.file_name.clone())
|
||||
.mime_str("application/octet-stream")?;
|
||||
let form = reqwest::multipart::Form::new().part("file", part);
|
||||
let resp = http
|
||||
.post(format!("{base_url}/upload-program"))
|
||||
.multipart(form)
|
||||
.send()
|
||||
.await?;
|
||||
let html = resp.text().await?;
|
||||
parse_prog_file(&html).ok_or_else(|| {
|
||||
ExecError::Other("OpenPLC upload did not return a prog_file handle".to_string())
|
||||
})
|
||||
}
|
||||
|
||||
/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
|
||||
/// program list. `epoch_time` must be close to the server's clock (OpenPLC
|
||||
/// rejects stale timestamps), so we send the current time.
|
||||
async fn save_program(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
prog_file: &str,
|
||||
) -> Result<(), ExecError> {
|
||||
let epoch = std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0)
|
||||
.to_string();
|
||||
let resp = http
|
||||
.post(format!("{base_url}/upload-program-action"))
|
||||
.form(&[
|
||||
("prog_name", PROG_NAME),
|
||||
("prog_descr", PROG_DESCR),
|
||||
("prog_file", prog_file),
|
||||
("epoch_time", &epoch),
|
||||
])
|
||||
.send()
|
||||
.await?;
|
||||
if resp.status().is_server_error() {
|
||||
return Err(ExecError::Other(format!(
|
||||
"OpenPLC save-program failed: HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
|
||||
/// MatIEC reports it finished (or the budget elapses). Errors if compilation
|
||||
/// finishes with errors — a program that won't compile can't be started.
|
||||
async fn compile(
|
||||
http: &reqwest::Client,
|
||||
base_url: &str,
|
||||
prog_file: &str,
|
||||
budget: Duration,
|
||||
) -> Result<(), ExecError> {
|
||||
http.get(format!("{base_url}/compile-program"))
|
||||
.query(&[("file", prog_file)])
|
||||
.send()
|
||||
.await?;
|
||||
|
||||
let logs_url = format!("{base_url}/compilation-logs");
|
||||
let outcome = tokio::time::timeout(budget, async {
|
||||
loop {
|
||||
if let Ok(resp) = http.get(&logs_url).send().await {
|
||||
if let Ok(text) = resp.text().await {
|
||||
if compilation_finished(&text) {
|
||||
return !compilation_failed(&text);
|
||||
}
|
||||
}
|
||||
}
|
||||
tokio::time::sleep(POLL_INTERVAL).await;
|
||||
}
|
||||
})
|
||||
.await;
|
||||
match outcome {
|
||||
Ok(true) => Ok(()),
|
||||
Ok(false) => Err(ExecError::Other(
|
||||
"OpenPLC compilation finished with errors".to_string(),
|
||||
)),
|
||||
Err(_) => Err(ExecError::Other(
|
||||
"OpenPLC compilation did not finish in time".to_string(),
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
|
||||
async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), ExecError> {
|
||||
let resp = http.get(format!("{base_url}/start_plc")).send().await?;
|
||||
if resp.status().is_server_error() {
|
||||
return Err(ExecError::Other(format!(
|
||||
"OpenPLC start_plc failed: HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Extract the server-assigned `prog_file` from the `/upload-program` response,
|
||||
/// which embeds it in a hidden input. Attribute order varies, so accept both
|
||||
/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
|
||||
fn parse_prog_file(html: &str) -> Option<String> {
|
||||
// The OpenPLC template renders `value='<name>.st' id='prog_file'
|
||||
// name='prog_file'`. Match the value bound to that input, either order.
|
||||
let value_then_name =
|
||||
regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
|
||||
if let Some(c) = value_then_name.captures(html) {
|
||||
return c.get(1).map(|m| m.as_str().to_string());
|
||||
}
|
||||
let name_then_value =
|
||||
regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
|
||||
name_then_value
|
||||
.captures(html)
|
||||
.and_then(|c| c.get(1))
|
||||
.map(|m| m.as_str().to_string())
|
||||
}
|
||||
|
||||
/// Whether the MatIEC compilation log shows the build has finished (either way).
|
||||
fn compilation_finished(log: &str) -> bool {
|
||||
log.contains("Compilation finished")
|
||||
}
|
||||
|
||||
/// Whether a finished compilation ended in failure.
|
||||
fn compilation_failed(log: &str) -> bool {
|
||||
log.contains("Compilation finished with errors")
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn parses_prog_file_value_then_name() {
|
||||
let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
|
||||
name='prog_file'/></form>";
|
||||
assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_prog_file_name_then_value() {
|
||||
let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
|
||||
assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_prog_file_none_when_absent() {
|
||||
assert_eq!(parse_prog_file("<html>no form here</html>"), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn compilation_predicates() {
|
||||
assert!(!compilation_finished("Compiling..."));
|
||||
assert!(compilation_finished(
|
||||
"...\nCompilation finished successfully!\n"
|
||||
));
|
||||
assert!(compilation_finished("Compilation finished with errors!"));
|
||||
assert!(compilation_failed("Compilation finished with errors!"));
|
||||
assert!(!compilation_failed("Compilation finished successfully!"));
|
||||
}
|
||||
}
|
||||
@@ -1,306 +0,0 @@
|
||||
//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
|
||||
//!
|
||||
//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
|
||||
//! Docker network with hard resource caps and **no host port exposure**, then
|
||||
//! guarantees teardown. The container is reachable in-cluster only, by its name
|
||||
//! (the shared user-defined network's embedded DNS resolves it); it is never
|
||||
//! published to the host.
|
||||
//!
|
||||
//! The `docker` argv is produced by pure functions so provisioning is unit-tested
|
||||
//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
|
||||
//! It requires the agent's runtime to have Docker access (a socket mount), which
|
||||
//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
|
||||
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
use compliance_core::PlcRuntimeConfig;
|
||||
|
||||
use crate::error::ExecError;
|
||||
|
||||
/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
|
||||
const MODBUS_PORT: u16 = 502;
|
||||
/// The OpenPLC web-UI / WebVisu port.
|
||||
const WEBVISU_PORT: u16 = 8080;
|
||||
|
||||
/// Label key marking a container as an ephemeral PLC runtime we own.
|
||||
const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
|
||||
/// Label value for our ephemeral PLC runtimes.
|
||||
const OWNER_LABEL_VALUE: &str = "plc-runtime";
|
||||
|
||||
/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct ProvisionedRuntime {
|
||||
/// The container name — also its in-network DNS alias.
|
||||
pub name: String,
|
||||
/// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
|
||||
pub modbus_endpoint: String,
|
||||
/// `http://name:8080` — the WebVisu / OpenPLC web UI.
|
||||
pub webvisu_url: String,
|
||||
}
|
||||
|
||||
/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
|
||||
/// orchestration is unit-testable with a fake that never touches Docker.
|
||||
pub trait SoftPlc {
|
||||
/// Start a fresh instance for a target and return its handle.
|
||||
fn provision(
|
||||
&self,
|
||||
target_id: &str,
|
||||
) -> impl std::future::Future<Output = Result<ProvisionedRuntime, ExecError>> + Send;
|
||||
|
||||
/// Tear an instance down. Best-effort and idempotent — never fails the scan.
|
||||
fn teardown(&self, handle: &ProvisionedRuntime)
|
||||
-> impl std::future::Future<Output = ()> + Send;
|
||||
}
|
||||
|
||||
/// Provisions OpenPLC instances by shelling out to the Docker CLI.
|
||||
pub struct DockerSoftPlc {
|
||||
cfg: PlcRuntimeConfig,
|
||||
}
|
||||
|
||||
impl DockerSoftPlc {
|
||||
/// Build a provisioner from the PLC-runtime config.
|
||||
pub fn new(cfg: PlcRuntimeConfig) -> Self {
|
||||
Self { cfg }
|
||||
}
|
||||
}
|
||||
|
||||
impl SoftPlc for DockerSoftPlc {
|
||||
async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
|
||||
// Best-effort sweep of any container leaked by a crashed earlier run
|
||||
// before we add another. Only removes instances past their max lifetime,
|
||||
// so it can never disturb a concurrent run.
|
||||
reap_stale(&self.cfg, now_epoch()).await;
|
||||
|
||||
let name = instance_name(target_id, now_epoch(), &random_suffix());
|
||||
let args = run_args(&self.cfg, &name, target_id);
|
||||
let out = run_docker(&args).await?;
|
||||
if !out.status.success() {
|
||||
return Err(ExecError::Other(format!(
|
||||
"docker run for soft-PLC {name} failed: {}",
|
||||
String::from_utf8_lossy(&out.stderr).trim()
|
||||
)));
|
||||
}
|
||||
Ok(ProvisionedRuntime {
|
||||
modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
|
||||
webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
|
||||
name,
|
||||
})
|
||||
}
|
||||
|
||||
async fn teardown(&self, handle: &ProvisionedRuntime) {
|
||||
match run_docker(&rm_args(&handle.name)).await {
|
||||
Ok(out) if out.status.success() => {
|
||||
tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
|
||||
}
|
||||
Ok(out) => tracing::warn!(
|
||||
instance = %handle.name,
|
||||
"soft-PLC teardown non-zero exit: {}",
|
||||
String::from_utf8_lossy(&out.stderr).trim()
|
||||
),
|
||||
Err(e) => {
|
||||
tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
|
||||
/// happens in practice).
|
||||
fn now_epoch() -> u64 {
|
||||
SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0)
|
||||
}
|
||||
|
||||
/// A short random, docker-name-safe suffix.
|
||||
fn random_suffix() -> String {
|
||||
uuid::Uuid::new_v4().simple().to_string()
|
||||
}
|
||||
|
||||
/// A unique, docker-safe container name that encodes the creation epoch (for the
|
||||
/// stale reaper) and the target it belongs to. Shape:
|
||||
/// `certifai-plc-<epoch>-<target12>-<rand6>`.
|
||||
fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
|
||||
let short: String = target_id
|
||||
.chars()
|
||||
.filter(char::is_ascii_alphanumeric)
|
||||
.take(12)
|
||||
.collect();
|
||||
let rand: String = rand
|
||||
.chars()
|
||||
.filter(char::is_ascii_alphanumeric)
|
||||
.take(6)
|
||||
.collect();
|
||||
format!("certifai-plc-{epoch}-{short}-{rand}")
|
||||
}
|
||||
|
||||
/// The creation epoch encoded in an instance name, if it is one of ours.
|
||||
fn parse_epoch(name: &str) -> Option<u64> {
|
||||
name.strip_prefix("certifai-plc-")?
|
||||
.split('-')
|
||||
.next()?
|
||||
.parse()
|
||||
.ok()
|
||||
}
|
||||
|
||||
/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
|
||||
/// agent's network, resource-capped, hardened, labelled for reaping, and — by
|
||||
/// omitting any `-p` — never published to the host.
|
||||
fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
|
||||
vec![
|
||||
"run".into(),
|
||||
"-d".into(),
|
||||
"--name".into(),
|
||||
name.into(),
|
||||
"--network".into(),
|
||||
cfg.network.clone(),
|
||||
"--memory".into(),
|
||||
cfg.memory.clone(),
|
||||
"--cpus".into(),
|
||||
cfg.cpus.clone(),
|
||||
"--pids-limit".into(),
|
||||
"512".into(),
|
||||
"--security-opt".into(),
|
||||
"no-new-privileges".into(),
|
||||
"--stop-timeout".into(),
|
||||
"5".into(),
|
||||
"--label".into(),
|
||||
format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
|
||||
"--label".into(),
|
||||
format!("certifai.target={target_id}"),
|
||||
cfg.image.clone(),
|
||||
]
|
||||
}
|
||||
|
||||
/// The `docker rm -f` argv that stops and removes an instance.
|
||||
fn rm_args(name: &str) -> Vec<String> {
|
||||
vec!["rm".into(), "-f".into(), name.into()]
|
||||
}
|
||||
|
||||
/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
|
||||
fn reap_list_args() -> Vec<String> {
|
||||
vec![
|
||||
"ps".into(),
|
||||
"-a".into(),
|
||||
"--filter".into(),
|
||||
format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
|
||||
"--format".into(),
|
||||
"{{.Names}}".into(),
|
||||
]
|
||||
}
|
||||
|
||||
/// Remove any ephemeral PLC container older than twice the configured max
|
||||
/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
|
||||
/// container from a *live* run (still within its own deadline) is never swept.
|
||||
/// Best-effort: any Docker error (e.g. no daemon) is ignored.
|
||||
async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
|
||||
let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
|
||||
let Ok(out) = run_docker(&reap_list_args()).await else {
|
||||
return;
|
||||
};
|
||||
if !out.status.success() {
|
||||
return;
|
||||
}
|
||||
let names = String::from_utf8_lossy(&out.stdout);
|
||||
for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
|
||||
let Some(epoch) = parse_epoch(name) else {
|
||||
continue;
|
||||
};
|
||||
if now.saturating_sub(epoch) > cutoff {
|
||||
tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
|
||||
let _ = run_docker(&rm_args(name)).await;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Run a `docker` subcommand, capturing its output.
|
||||
async fn run_docker(args: &[String]) -> Result<std::process::Output, ExecError> {
|
||||
tokio::process::Command::new("docker")
|
||||
.args(args)
|
||||
.output()
|
||||
.await
|
||||
.map_err(ExecError::Io)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn cfg() -> PlcRuntimeConfig {
|
||||
PlcRuntimeConfig {
|
||||
enabled: true,
|
||||
image: "registry.example.com/openplc:latest".into(),
|
||||
network: "certifai".into(),
|
||||
memory: "512m".into(),
|
||||
cpus: "0.5".into(),
|
||||
max_lifetime_secs: 180,
|
||||
..PlcRuntimeConfig::default()
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
|
||||
let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
|
||||
assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
|
||||
assert_eq!(parse_epoch(&a), Some(1_700_000_000));
|
||||
// Docker names: only [A-Za-z0-9_.-].
|
||||
assert!(a
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
|
||||
// A different random suffix yields a different name for the same target.
|
||||
let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
|
||||
assert_ne!(a, b);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_epoch_rejects_foreign_names() {
|
||||
assert_eq!(parse_epoch("some-other-container"), None);
|
||||
assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
|
||||
let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
|
||||
// No host port publishing.
|
||||
assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
|
||||
// Detached.
|
||||
assert!(args.contains(&"-d".to_string()));
|
||||
// Joined to the agent's own network.
|
||||
let net = args.iter().position(|a| a == "--network").expect("network");
|
||||
assert_eq!(args[net + 1], "certifai");
|
||||
// Resource caps.
|
||||
let mem = args.iter().position(|a| a == "--memory").expect("memory");
|
||||
assert_eq!(args[mem + 1], "512m");
|
||||
let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
|
||||
assert_eq!(args[cpu + 1], "0.5");
|
||||
assert!(args.iter().any(|a| a == "--pids-limit"));
|
||||
// Hardening.
|
||||
let so = args
|
||||
.iter()
|
||||
.position(|a| a == "--security-opt")
|
||||
.expect("secopt");
|
||||
assert_eq!(args[so + 1], "no-new-privileges");
|
||||
// Ownership + target labels for reaping / attribution.
|
||||
assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
|
||||
assert!(args.contains(&"certifai.target=target-123".to_string()));
|
||||
// Image is last.
|
||||
assert_eq!(
|
||||
args.last().map(String::as_str),
|
||||
Some("registry.example.com/openplc:latest")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rm_args_force_remove() {
|
||||
assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn reap_list_filters_by_owner_label() {
|
||||
let args = reap_list_args();
|
||||
assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
|
||||
assert!(args.contains(&"{{.Names}}".to_string()));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user