Skip to content

Commit 52f958d

Browse files
san-zrlsan-zrl
authored
Fix: enrich asset collections (#344)
* Fix: enrich asset collections Signed-off-by: san-zrl <san@zurich.ibm.com> * improved protocol encodings: fixed empty ref for TLS dependecies; added cryptoRefArray to protocols; added IPSec protocol object Signed-off-by: san-zrl <san@zurich.ibm.com> * replaced deprecated code Signed-off-by: san-zrl <san@zurich.ibm.com> * added IKE protocol type to mapper API Signed-off-by: san-zrl <san@zurich.ibm.com> --------- Signed-off-by: san-zrl <san@zurich.ibm.com>
1 parent b31122c commit 52f958d

File tree

8 files changed

+166
-5
lines changed

8 files changed

+166
-5
lines changed

‎enricher/src/main/java/com/ibm/enricher/Enricher.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
package com.ibm.enricher;
2121

2222
import com.ibm.enricher.algorithm.AESEnricher;
23+
import com.ibm.enricher.algorithm.AbstractAssetCollectionEnricher;
2324
import com.ibm.enricher.algorithm.DESEnricher;
2425
import com.ibm.enricher.algorithm.DHEnricher;
2526
import com.ibm.enricher.algorithm.DSAEnricher;
@@ -94,7 +95,8 @@ private static INode enrichTree(@Nonnull INode node) {
9495
new SignatureEnricher(),
9596
new TagOrDigestEnricher(),
9697
new KEMEnricher(),
97-
new SecretKeyEnricher());
98+
new SecretKeyEnricher(),
99+
new AbstractAssetCollectionEnricher());
98100

99101
/**
100102
* Enriches the given node with additional information.

‎enricher/src/main/java/com/ibm/enricher/algorithm/AbstractAssetCollectionEnricher.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* Sonar Cryptography Plugin
3+
* Copyright (C) 2024 PQCA
4+
*
5+
* Licensed to the Apache Software Foundation (ASF) under one or more
6+
* contributor license agreements. See the NOTICE file distributed with
7+
* this work for additional information regarding copyright ownership.
8+
* The ASF licenses this file to you under the Apache License, Version 2.0
9+
* (the "License"); you may not use this file except in compliance with
10+
* the License. You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package com.ibm.enricher.algorithm;
21+
22+
import com.ibm.enricher.Enricher;
23+
import com.ibm.enricher.IEnricher;
24+
import com.ibm.mapper.model.INode;
25+
import com.ibm.mapper.model.collections.AbstractAssetCollection;
26+
import java.util.ArrayList;
27+
import javax.annotation.Nonnull;
28+
29+
public class AbstractAssetCollectionEnricher implements IEnricher {
30+
31+
@Nonnull
32+
@Override
33+
public INode enrich(@Nonnull INode node) {
34+
if (node instanceof AbstractAssetCollection<? extends INode> aac) {
35+
Enricher.enrich(new ArrayList<INode>(aac.getCollection()));
36+
}
37+
return node;
38+
}
39+
}

‎mapper/src/main/java/com/ibm/mapper/model/protocol/IKE.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Sonar Cryptography Plugin
3+
* Copyright (C) 2024 PQCA
4+
*
5+
* Licensed to the Apache Software Foundation (ASF) under one or more
6+
* contributor license agreements. See the NOTICE file distributed with
7+
* this work for additional information regarding copyright ownership.
8+
* The ASF licenses this file to you under the Apache License, Version 2.0
9+
* (the "License"); you may not use this file except in compliance with
10+
* the License. You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package com.ibm.mapper.model.protocol;
21+
22+
import com.ibm.mapper.model.Protocol;
23+
import com.ibm.mapper.model.Version;
24+
import com.ibm.mapper.utils.DetectionLocation;
25+
import javax.annotation.Nonnull;
26+
27+
public final class IKE extends Protocol {
28+
29+
public IKE(@Nonnull DetectionLocation detectionLocation) {
30+
super(new Protocol("IKE", detectionLocation), IKE.class);
31+
}
32+
33+
public IKE(@Nonnull Version version) {
34+
super(new Protocol("IKE" + version.asString(), version.getDetectionContext()), IKE.class);
35+
this.put(version);
36+
}
37+
}

‎mapper/src/main/java/com/ibm/mapper/model/protocol/IPSec.java‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/*
2+
* Sonar Cryptography Plugin
3+
* Copyright (C) 2024 PQCA
4+
*
5+
* Licensed to the Apache Software Foundation (ASF) under one or more
6+
* contributor license agreements. See the NOTICE file distributed with
7+
* this work for additional information regarding copyright ownership.
8+
* The ASF licenses this file to you under the Apache License, Version 2.0
9+
* (the "License"); you may not use this file except in compliance with
10+
* the License. You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package com.ibm.mapper.model.protocol;
21+
22+
import com.ibm.mapper.model.Protocol;
23+
import com.ibm.mapper.utils.DetectionLocation;
24+
import javax.annotation.Nonnull;
25+
26+
public final class IPSec extends Protocol {
27+
28+
public IPSec(@Nonnull DetectionLocation detectionLocation) {
29+
super(new Protocol("IPSec", detectionLocation), IPSec.class);
30+
}
31+
}

‎output/src/main/java/com/ibm/output/cyclondx/CBOMOutputFile.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@
8787
import org.cyclonedx.model.Metadata;
8888
import org.cyclonedx.model.OrganizationalEntity;
8989
import org.cyclonedx.model.Service;
90+
import org.cyclonedx.model.component.crypto.CryptoRef;
9091
import org.cyclonedx.model.component.evidence.Occurrence;
9192
import org.cyclonedx.model.metadata.ToolInformation;
9293
import org.slf4j.Logger;
@@ -201,6 +202,14 @@ private void createProtocolComponent(@Nullable String parentBomRef, @Nonnull Pro
201202
return;
202203
}
203204
addComponentAndDependencies(protocol, optionalId.get(), parentBomRef, node);
205+
206+
Dependency protocolDependency = dependencies.get(protocol.getBomRef());
207+
if (protocolDependency != null) {
208+
CryptoRef cryptoRef = new CryptoRef();
209+
cryptoRef.setRef(
210+
protocolDependency.getDependencies().stream().map(Dependency::getRef).toList());
211+
protocol.getCryptoProperties().getProtocolProperties().setCryptoRefArray(cryptoRef);
212+
}
204213
}
205214

206215
private void createCipherSuiteComponent(

‎output/src/main/java/com/ibm/output/cyclondx/builder/ProtocolComponentBuilder.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@
2525
import com.ibm.mapper.model.Identifier;
2626
import com.ibm.mapper.model.Protocol;
2727
import com.ibm.mapper.model.collections.CipherSuiteCollection;
28+
import com.ibm.mapper.model.protocol.IKE;
29+
import com.ibm.mapper.model.protocol.IPSec;
2830
import com.ibm.mapper.model.protocol.TLS;
2931
import java.util.ArrayList;
3032
import java.util.List;
@@ -49,6 +51,7 @@ public class ProtocolComponentBuilder implements IProtocolComponentBuilder {
4951
protected ProtocolComponentBuilder(
5052
@Nonnull BiFunction<String, Algorithm, String> algorithmComponentBuilder) {
5153
this.component = new Component();
54+
this.component.setBomRef(UUID.randomUUID().toString());
5255
this.cryptoProperties = new CryptoProperties();
5356
this.protocolProperties = new ProtocolProperties();
5457
this.algorithmComponentBuilder = algorithmComponentBuilder;
@@ -95,6 +98,10 @@ public IProtocolComponentBuilder type(@Nullable Protocol type) {
9598

9699
if (type instanceof TLS) {
97100
protocolProperties.setType(ProtocolType.TLS);
101+
} else if (type instanceof IPSec) {
102+
protocolProperties.setType(ProtocolType.IPSEC);
103+
} else if (type instanceof IKE) {
104+
protocolProperties.setType(ProtocolType.IKE);
98105
} else {
99106
protocolProperties.setType(ProtocolType.OTHER);
100107
}
@@ -140,7 +147,7 @@ public IProtocolComponentBuilder cipherSuites(@Nullable INode node) {
140147
if (asset instanceof Algorithm algorithm) {
141148
final String ref =
142149
this.algorithmComponentBuilder.apply(
143-
"", algorithm);
150+
component.getBomRef(), algorithm);
144151
algorithmRefs.add(ref);
145152
}
146153
}
@@ -189,7 +196,6 @@ public Component build() {
189196

190197
this.component.setType(Component.Type.CRYPTOGRAPHIC_ASSET);
191198
this.component.setCryptoProperties(this.cryptoProperties);
192-
this.component.setBomRef(UUID.randomUUID().toString());
193199

194200
return this.component;
195201
}

‎output/src/test/java/com/ibm/output/cyclonedx/ProtocolTest.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,13 @@
2929
import com.ibm.mapper.model.algorithms.AES;
3030
import com.ibm.mapper.model.algorithms.DH;
3131
import com.ibm.mapper.model.algorithms.DSA;
32+
import com.ibm.mapper.model.algorithms.RSA;
3233
import com.ibm.mapper.model.algorithms.SHA2;
3334
import com.ibm.mapper.model.collections.AssetCollection;
3435
import com.ibm.mapper.model.collections.CipherSuiteCollection;
3536
import com.ibm.mapper.model.collections.IdentifierCollection;
3637
import com.ibm.mapper.model.mode.CBC;
38+
import com.ibm.mapper.model.protocol.IPSec;
3739
import com.ibm.mapper.model.protocol.TLS;
3840
import java.util.List;
3941
import org.cyclonedx.model.Component;
@@ -223,6 +225,8 @@ void protocolWithCipherSuite() {
223225
assertThat(protocolProperties.getVersion()).isEqualTo("1.3");
224226
assertThat(protocolProperties.getCipherSuites()).isNotNull();
225227
assertThat(protocolProperties.getCipherSuites()).hasSize(1);
228+
assertThat(protocolProperties.getCryptoRefArray()).isNotNull();
229+
assertThat(protocolProperties.getCryptoRefArray().getRef()).hasSize(3);
226230

227231
final org.cyclonedx.model.component.crypto.CipherSuite cipherSuite =
228232
protocolProperties.getCipherSuites().get(0);
@@ -235,4 +239,37 @@ void protocolWithCipherSuite() {
235239
}
236240
});
237241
}
242+
243+
@Test
244+
void protocolOther() {
245+
this.assertsNode(
246+
() -> {
247+
final IPSec ipsec = new IPSec(detectionLocation);
248+
ipsec.put(new AES(128, new CBC(detectionLocation), detectionLocation));
249+
ipsec.put(new RSA(detectionLocation));
250+
return ipsec;
251+
},
252+
bom -> {
253+
assertThat(bom.getComponents()).hasSize(3);
254+
assertThat(bom.getComponents().stream().map(Component::getName))
255+
.contains("AES128-CBC", "RSA", "IPSec");
256+
257+
for (Component component : bom.getComponents()) {
258+
asserts(component.getEvidence());
259+
assertThat(component.getCryptoProperties()).isNotNull();
260+
final CryptoProperties cryptoProperties = component.getCryptoProperties();
261+
if (cryptoProperties.getAssetType().equals(AssetType.PROTOCOL)) {
262+
assertThat(component.getName()).isEqualTo("IPSec");
263+
assertThat(cryptoProperties.getProtocolProperties()).isNotNull();
264+
final ProtocolProperties protocolProperties =
265+
cryptoProperties.getProtocolProperties();
266+
assertThat(protocolProperties.getType()).isEqualTo(ProtocolType.IPSEC);
267+
assertThat(protocolProperties.getVersion()).isNull();
268+
assertThat(protocolProperties.getCipherSuites()).isNull();
269+
assertThat(protocolProperties.getCryptoRefArray()).isNotNull();
270+
assertThat(protocolProperties.getCryptoRefArray().getRef()).hasSize(2);
271+
}
272+
}
273+
});
274+
}
238275
}

‎sonar-cryptography-plugin/src/main/java/com/ibm/plugin/Configuration.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
import java.util.List;
2323
import javax.annotation.Nonnull;
2424
import org.sonar.api.config.PropertyDefinition;
25-
import org.sonar.api.resources.Qualifiers;
25+
import org.sonar.api.config.PropertyDefinition.ConfigScope;
2626

2727
public final class Configuration {
2828

@@ -31,7 +31,7 @@ private Configuration() {}
3131
public static @Nonnull List<PropertyDefinition> getPropertyDefinitions() {
3232
return List.of(
3333
PropertyDefinition.builder(Constants.CBOM_OUTPUT_NAME)
34-
.onQualifiers(Qualifiers.PROJECT)
34+
.onConfigScopes(ConfigScope.PROJECT)
3535
.subCategory(Constants.SUB_CATEGORY_GENERAL)
3636
.name("CBOM filename")
3737
.description("Filename for the generated CBOM")

0 commit comments

Comments
 (0)