stackrox · Maddosaurus · Oct 28, 2022 · Oct 4, 2022 · Oct 4, 2022 · Oct 5, 2022
diff --git a/compliance/collection/main.go b/compliance/collection/main.go
@@ -10,11 +10,13 @@ import (
 	"github.com/cenkalti/backoff/v3"
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/compliance/collection/auditlog"
+	"github.com/stackrox/rox/compliance/collection/nodescanv2"
 	"github.com/stackrox/rox/generated/internalapi/sensor"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/clientconn"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/k8sutil"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/mtls"
@@ -80,7 +82,7 @@ func runRecv(ctx context.Context, client sensor.ComplianceService_CommunicateCli
 				}
 			}
 		default:
-			utils.Should(errors.Errorf("Unhandled msg type: %T", t))
+			_ = utils.Should(errors.Errorf("Unhandled msg type: %T", t))
 		}
 	}
 }
@@ -105,7 +107,26 @@ func startAuditLogCollection(ctx context.Context, client sensor.ComplianceServic
 	return auditReader
 }
 
-func manageStream(ctx context.Context, cli sensor.ComplianceServiceClient, sig *concurrency.Signal) {
+// manageSendingToSensor sends everything from sensorC channel to sensor
+func manageSendingToSensor(ctx context.Context, cli sensor.ComplianceServiceClient, sensorC <-chan *sensor.MsgFromCompliance) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case sc := <-sensorC:
+			client, _, err := initializeStream(ctx, cli)
+			if err != nil && ctx.Err() == nil {
+				// error even after retries
+				log.Fatalf("unable to establish send stream to sensor: %v", err)
+			}
+			if err := client.Send(sc); err != nil {
+				log.Errorf("failed sending nodeScanV2 to sensor: %v", err)
+			}
 s.receiver.Start(stream, s.Stop, s.sender.Stop) 
 s.sender.Start(stream, s.Stop, s.receiver.Stop) 
 s.receiver.Start(stream, s.Stop, s.sender.Stop) 
 s.sender.Start(stream, s.Stop, s.receiver.Stop) 
+		}
+	}
+}
+
+func manageReceiveStream(ctx context.Context, cli sensor.ComplianceServiceClient, sig *concurrency.Signal) {
 	for {
 		select {
 		case <-ctx.Done():
@@ -127,6 +148,49 @@ func manageStream(ctx context.Context, cli sensor.ComplianceServiceClient, sig *
 	}
 }
 
+func manageNodeScanLoop(ctx context.Context, rescanInterval time.Duration, scanner nodescanv2.NodeScanner) <-chan *sensor.MsgFromCompliance {
+	sensorC := make(chan *sensor.MsgFromCompliance)
+	nodeName := getNode()
+	go func() {
+		defer close(sensorC)
+		t := time.NewTicker(rescanInterval)
+
+		// first scan should happen on start
+		msg, err := scanNode(nodeName, scanner)
+		if err != nil {
+			log.Errorf("error running scanNode: %v", err)
+		} else {
+			sensorC <- msg
+		}
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				msg, err := scanNode(nodeName, scanner)
+				if err != nil {
+					log.Errorf("error running scanNode: %v", err)
+				} else {
+					sensorC <- msg
+				}
+			}
+		}
+	}()
+	return sensorC
+}
+
+func scanNode(nodeName string, scanner nodescanv2.NodeScanner) (*sensor.MsgFromCompliance, error) {
+	result, err := scanner.Scan(nodeName)
+	if err != nil {
+		return nil, err
+	}
+	return &sensor.MsgFromCompliance{
+		Node: nodeName,
+		Msg:  &sensor.MsgFromCompliance_NodeScanV2{NodeScanV2: result},
+	}, nil
+}
+
 func initialClientAndConfig(ctx context.Context, cli sensor.ComplianceServiceClient) (sensor.ComplianceService_CommunicateClient, *sensor.MsgToCompliance_ScrapeConfig, error) {
 	client, err := cli.Communicate(ctx)
 	if err != nil {
@@ -201,7 +265,29 @@ func main() {
 	ctx = metadata.AppendToOutgoingContext(ctx, "rox-compliance-nodename", getNode())
 
 	stoppedSig := concurrency.NewSignal()
-	go manageStream(ctx, cli, &stoppedSig)
+
+	go manageReceiveStream(ctx, cli, &stoppedSig)
+
+	if features.RHCOSNodeScanning.Enabled() {
+		log.Infof("Node Rescan interval: %v", env.GetNodeRescanInterval())
+		sensorC := make(chan *sensor.MsgFromCompliance)
+		defer close(sensorC)
+		go manageSendingToSensor(ctx, cli, sensorC)
+
+		// TODO(ROX-12971): Replace with real scanner
+		scanner := nodescanv2.FakeNodeScanner{}
+		nodeScansC := manageNodeScanLoop(ctx, env.GetNodeRescanInterval(), &scanner)
+		// multiplex producers (nodeScansC) into the output channel (sensorC)
+		go func() {
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case sensorC <- <-nodeScansC:
+				}
+			}
+		}()
+	}
 
 	signalsC := make(chan os.Signal, 1)
 	signal.Notify(signalsC, syscall.SIGINT, syscall.SIGTERM)

diff --git a/compliance/collection/nodescanv2/fake_nodescan.go b/compliance/collection/nodescanv2/fake_nodescan.go
@@ -0,0 +1,51 @@
+package nodescanv2
+
+import (
+	timestamp "github.com/gogo/protobuf/types"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/logging"
+	scannerV1 "github.com/stackrox/scanner/generated/scanner/api/v1"
+)
+
+var (
+	log = logging.LoggerForModule()
+)
+
+// FakeNodeScanner can be used to send fake messages that would be emitted by NodeScanV2
+type FakeNodeScanner struct {
+}
+
+// Scan returns a fake message in the same format a real NodeScanV2 would produce
+func (f *FakeNodeScanner) Scan(nodeName string) (*storage.NodeScanV2, error) {
+	log.Infof("Generating fake scan result message...")
+	msg := &storage.NodeScanV2{
+		NodeId:   "",
+		NodeName: nodeName,
+		ScanTime: timestamp.TimestampNow(),
+		Components: &scannerV1.Components{
+			Namespace: "Testme OS",
+			RhelComponents: []*scannerV1.RHELComponent{
+				{
+					Name:      "vim-minimal",
+					Namespace: "rhel:8",
+					Version:   "2:7.4.629-6.el8.x86_64",
+					Arch:      "x86_64",
+					Module:    "FakeMod",
+					Cpes:      []string{"cpe:/a:redhat:enterprise_linux:8::baseos"},
+					AddedBy:   "FakeLayer",
+				},
+				{
+					Name:      "libsolv",
+					Namespace: "rhel:8",
+					Version:   "0.7.7-1.el8.x86_64",
+					Arch:      "x86_64",
+					Module:    "FakeMod",
+					AddedBy:   "FakeLayer",
+				},
+			},
+			LanguageComponents: nil,
+		},
+		Notes: nil,
+	}
+	return msg, nil
+}
diff --git a/compliance/collection/nodescanv2/nodescan.go b/compliance/collection/nodescanv2/nodescan.go
@@ -0,0 +1,20 @@
+package nodescanv2
+
+import (
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/generated/storage"
+)
+
+// NodeScanner defines an interface for V2 NodeScanning
+type NodeScanner interface {
+	Scan(nodeName string) (*storage.NodeScanV2, error)
+}
+
+// NodeScan is the V2 NodeScanning implementation
+type NodeScan struct {
+}
+
+// Scan scans the current node and returns the results as storage.NodeScanV2 object
+func (n *NodeScan) Scan(nodeName string) (*storage.NodeScanV2, error) {
+	return nil, errors.New("Not implemented")
+}
diff --git a/compliance/collection/nodescanv2/nodescan_test.go b/compliance/collection/nodescanv2/nodescan_test.go
@@ -0,0 +1,23 @@
+package nodescanv2
+
+import (
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stretchr/testify/suite"
+)
+
+func TestNodeScan(t *testing.T) {
+	suite.Run(t, &NodeScanSuite{})
+}
+
+type NodeScanSuite struct {
+	suite.Suite
+}
+
+func (n *NodeScanSuite) TestMessageFormat() {
+	fns, err := (&FakeNodeScanner{}).Scan("someNode")
+	n.Nil(err)
+	n.NotNil(fns)
+	n.IsType(&storage.NodeScanV2{}, fns)
+}
diff --git a/pkg/env/node_scan.go b/pkg/env/node_scan.go
@@ -0,0 +1,18 @@
+package env
+
+import "time"
+
+var (
+	nodeRescanIntervalDefault = 4 * time.Hour
+	// nodeRescanInterval will set the duration for when to scan nodes for vulnerabilities (NodeScanV2)
+	nodeRescanInterval = registerDurationSetting("ROX_NODE_RESCAN_INTERVAL", nodeRescanIntervalDefault)
+)
+
+// GetNodeRescanInterval returns NodeRescanInterval if positive, otherwise returns the default
+func GetNodeRescanInterval() time.Duration {
+	if nodeRescanInterval.DurationSetting() <= 0 {
+		log.Warnf("Negative or zero duration found. Setting to %s.", nodeRescanIntervalDefault.String())
+		return nodeRescanIntervalDefault
+	}
+	return nodeRescanInterval.DurationSetting()
+}
@@ -59,7 +59,7 @@ message MsgToCompliance {
     }
 }
 
-// A Sensor service that allows Compliance to report node scrapes results and audit events.
+// A Sensor service that allows Compliance to report node scrapes results, audit events, and node scans v2.
 service ComplianceService {
     rpc Communicate (stream MsgFromCompliance) returns (stream MsgToCompliance);
 }
@@ -142,6 +142,8 @@ func (s *serviceImpl) Communicate(server sensor.ComplianceService_CommunicateSer
 		case *sensor.MsgFromCompliance_AuditEvents:
 			s.auditEvents <- t.AuditEvents
 			s.auditLogCollectionManager.AuditMessagesChan() <- msg
+		case *sensor.MsgFromCompliance_NodeScanV2:
+			log.Infof("NodeScanV2 message received: %v", msg)
 		}
 	}
 }