Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,14 @@ Version-controlled specifications for API Details are located in the `docs/api`

This repository is currently under development. Documentation and examples are being added as they are created.

| Task | Status |
| ---------------------------------------------------------------------------------------- | ------ |
| Example CRS Azure Kubernetes Service (AKS) Terraform | ✅ |
| Competition API Spec v1.4.0 | ✅ |
| CRS API Spec v1.4.0 | ✅ |
| Telemetry Spec v1.0 | ✅ |
| <[Challenge Generation script](https://github.com/aixcc-finals/generate-challenge-task)> | ✅ |
| End-to-end example webservice that implements specs | ✅ |
| Task | Version | Status |
| ------------------------------------------------------------------ | ------- | ------ |
| Example CRS Azure Kubernetes Service (AKS) Terraform | N/A | ✅ |
| Competition API Spec | v1.4.0 | ✅ |
| CRS API Spec | v1.4.0 | ✅ |
| Telemetry Spec | v1.0 | ✅ |
| <[Challenge Generation script](generate-challenge-task/README.md)> | N/A | ✅ |
| End-to-end example webservice that implements specs | N/A | ✅ |

## Contributing

Expand Down
2 changes: 0 additions & 2 deletions docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,6 @@ Welcome to the documentation page for the AIxCC Final Competition.
- [Improving the structure of OTEL data](telemetry/telemetry_best_practices.md#improving-the-structure-of-otel-data)
- [Verifying telemetry](telemetry/telemetry_best_practices.md#verifying-telemetry)
- [Source File Language Determination](source_language_determination)
- [Tailnet-accessible hosted Competitor Test Server](tailscale-hosted-competitor-test-server/hosted_competitor_test_server.md#tailnet-accessible-hosted-competitor-test-server)
- [Tailscale Management Tools](tailscale-hosted-competitor-test-server/tailscale_management_tools.md#tailscale-management-tools)
- [Round Information](round_info/README.md#round-information)

- [Exhibition Round 1](round_info/exhibition-round-1.md#exhibition-round-1)
Expand Down
104 changes: 4 additions & 100 deletions docs/api/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,102 +71,6 @@ CRS->>API: Create Bundle "accepted"
CRS->>API: Modify Bundle
```

### Request Integration Test Task

After deploying your CRS, you now have the ability to task your CRS with a simple “[integration test](https://github.com/aixcc-finals/integration-test/tree/challenges/integration-test-delta-01)” challenge (delta scan) to
make sure your CRS and Telemetry are working as expected prior to the opening of the Round.

This endpoint is available from now until 5 minutes prior to the opening of a Round. It is accessible from the internet and from inside the tailnet. `duration_secs` is an optional parameter, and defaults to 4 hours.
Provide your Competition API credentials to kick off the task. This will send a task to the Round's expected CRS hostname (e.g. `team-moniker-exhibition2` for exhibition2) on the tailnet.

```mermaid
sequenceDiagram
accTitle: Smoke Test Workflow

User->>API: /v1/request/delta
API->>CRS: Hardcoded integration-test task
CRS->>API: POV/Patch/Bundle/Sarif Submission
```

Here is an example curl you may use to trigger the integration testing task.

```bash
curl -u 11111111-1111-1111-1111-111111111111:pY8rLk7FvQ2hZm9GwUx3Ej5BnTcV4So0 -X 'POST' 'https://api.aixcc.tech/v1/request/delta/' -H 'Content-Type: application/json' -d '{"duration_secs": 3600 }'
```

### Request Arbitrary Exhibition 3 Task

We have updated the production Competition API /v1/request/ endpoint to include all exhibition3 challenges. Exercising this endpoint should look the same as exercising the /v1/request/delta/ endpoint, but
instead of putting delta in the URL path, you can input the challenge name.

For example:

```bash
curl -u <team-id>:<secret> -X 'POST' 'https://api.aixcc.tech/v1/request/ex3-tk-full-01/' --json '{"duration_secs":43200}'
```

You may, of course, still use /v1/request/delta/, and you will get the same integration test challenge as you would have before Exhibition 3. In order to get a list of the challenges that are available, you may use
the /v1/request/list/ endpoint:

```bash
curl -u <team-id>:<secret> -X 'GET' 'https://api.aixcc.tech/v1/request/list/'
```

Some teams have noted that the hosted competitor test servers were having issues scaling to respond to the number of submissions. Unfortunately, this is a limit. The official competition API, however, is built to
handle hundreds of POVs at the same time. So if you are running into any issues with the competitor test server, we highly recommend you use this new endpoint. We will still also still be updating the competitor test
servers as we have been before when updates are made to evaluation scripts.

Use the following URL/hostname configurations in order to use this new requesting feature:

**CRS API URL**: `https://<team-moniker>-final.tail7e9b4c.ts.net`

**Competition API URL**: `https://api.tail7e9b4c.ts.net`

Here's a reference for which challenge names correspond to which repos:

- **Apache Commons Compress**
- ex3-cc-delta-02
- ex3-cc-delta-03
- ex3-cc-full-01
- **FreeRDP**
- ex3-fp-delta-01
- ex3-fp-full-01
- **Integration Test** (There should be no significant differences between "ex3-integration-test-delta-01" and "delta")
- ex3-integration-test-delta-01
- ex3-integration-test-unharnessed-delta-01
- delta
- **libpng**
- ex3-lp-delta-01
- **libxml2**
- ex3-lx-delta-01
- ex3-lx-delta-02
- **sqlite3**
- ex3-sq-delta-01
- ex3-sq-delta-02
- ex3-sq-delta-03
- ex3-sq-full-01
- **Apache Tika**
- ex3-tk-full-01
- ex3-tk-delta-02
- ex3-tk-delta-03
- ex3-tk-delta-04
- ex3-tk-delta-05
- **Apache Zookeeper**
- ex3-zk-delta-01
- ex3-zk-delta-02
- ex3-zk-full-01
- **Curl**
- ex3-cu-full-01
- ex3-cu-delta-01
- **libexif**
- ex3-ex-delta-01
- **libpostal**
- ex3-libpostal-full-01
- **s2n-tls**
- ex3-s2n_tls-full-01
- **IPF**
- ex3-ipf-full-01

## CRS API Task Statuses

The CRS API has a status endpoint which provides a summary of tasks by status, among other things. The statuses which tasks go through are documented in the state diagram below.
Expand Down Expand Up @@ -200,15 +104,15 @@ To run the generator using docker or podman:

```bash
docker run --rm -v $PWD:/local openapitools/openapi-generator-cli generate \
-i /local/competition-swagger-v0.1.json \
-i /local/competition-swagger.json \
-g lang \
-o /local/out
```

- `-v $PWD:/local` mounts the current working directory into the `/local` directory in the container. A different host path could be provided for `$PWD`. All paths used in the following steps would be relative to the new
path instead of `$PWD`.
- All arguments after `openapitools/openapi-generator-cli` are passed to the generator CLI inside the container
- `-i /local/competition-swagger-v0.1.json` is the path relative to the current working directory of the swagger file. On the host, `competition-swagger-v-0.1.json` is located in `$PWD`. If you want to change the file or
- `-i /local/competition-swagger-v0.1.json` is the path relative to the current working directory of the swagger file. On the host, `competition-swagger.json` is located in `$PWD`. If you want to change the file or
path it must be a descendant of `$PWD`.
- `-g lang` is used to specify the generator to run. If you pass an invalid value it will list all of the options.
- `-o /local/out` is the path relative to the current working directory to output the generated code.
Expand Down Expand Up @@ -247,7 +151,7 @@ If you do not wish to integrate the UI directly into the CRS system it is still
python -m http.server
```

- Change the path to the swagger file at the top of your page to the desired file. For example, `/competition-swagger-v0.1.json` if you placed a swagger spec called `competition-swagger-v0.1.json` at
`swagger-ui/dist/competition-swagger-v0.1.json`.
- Change the path to the swagger file at the top of your page to the desired file. For example, `/competition-swagger.json` if you placed a swagger spec called `competition-swagger.json` at
`swagger-ui/dist/competition-swagger.json`.
- This will only allow viewing the documentation. Experimenting with the API endpoints requires a running API server serving the spec file. If the spec is served from the API server and it supports CORS, it is possible
to specify the full URL to the spec in the box. This will allow you to experiment with the API using the `Try it Out` button.

This file was deleted.

This file was deleted.

2 changes: 1 addition & 1 deletion example-crs-architecture/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@ The deployment of the AKS cluster and its resources are performed by the `Makefi
## Deploy

- Log into your Azure tenant with `az login --tenant aixcc.tech`
- Clone this repository if needed: `git clone git@github.com:aixcc-finals/example-crs-architecture.git /<local_dir>`
- Clone this repository if needed: `git clone git@github.com:AIxCyberChallenge/example-crs-architecture.git /<local_dir>`
- Make required changes to `backend.tf`
- Make any wanted changes to `main.tf`, `outputs.tf`, `providers.tf`, and `variables.tf`
- Update `./env` with accurate values for each variable
Expand Down
10 changes: 5 additions & 5 deletions example-crs-webservice/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ In other words, competitors are expected to develop a web server for receiving t
| Competition | <----> | CRS API Web Server |
```

The [example-crs-architecture](https://github.com/aixcc-finals/example-crs-architecture/tree/main/docs/api) repository provides the swagger specification files which may be used to autogenerate code for both the http server stub as well as the http client for sending submissions to the scoreboard.
The [example-crs-architecture](https://github.com/AIxCyberChallenge/example-crs-architecture/tree/main/docs/api) repository provides the swagger specification files which may be used to autogenerate code for both the http server stub as well as the http client for sending submissions to the scoreboard.

- `competition-swagger-*.json` - description of the competition HTTP API
- `crs-swagger-*.json` - description of the CRS HTTP API
Expand All @@ -45,7 +45,7 @@ Instead of installing the dependencies on your local machine, you may also use t

The `example-competition-api` provides a mock implementation of the competition API which will validate input formats and provide example outputs.

The complete instructions for running the `example-competition-server` are available under [example-competition-server/](https://github.com/aixcc-finals/example-crs-architecture/tree/main/example-competition-server).
The complete instructions for running the `example-competition-server` are available under [example-competition-server/](https://github.com/AIxCyberChallenge/example-crs-architecture/tree/main/example-competition-server).

All endpoints use HTTP Basic authentication. Use `11111111-1111-1111-1111-111111111111` and `secret` as the credentials.

Expand Down Expand Up @@ -78,7 +78,7 @@ $ uvicorn server:app --reload --port 1324 --log-config=../../log-conf.yaml --env

The web server will be accessible at `http://localhost:1324` by default.

The [generate-challenge-task](https://github.com/aixcc-finals/generate-challenge-task) script may be used to construct an HTTP request that the task server expects.
The [generate-challenge-task](https://github.com/AIxCyberChallenge/example-crs-architecture/tree/main/generate-challenge-task) script may be used to construct an HTTP request that the task server expects.

Alternatively, the `example-competition-server` may be used to generate and send tasks to the task server.

Expand All @@ -105,7 +105,7 @@ Detailed instructions for autogeneration of the code as well as manually added c

**Competition API Client**

The client code for interacting with the competition scoreboard was autogenerated using `openapi-generator` following the provided instructions in the example-crs-architecture [Readme](https://github.com/aixcc-finals/example-crs-architecture/blob/main/docs/api/README.md#openapi-generator).
The client code for interacting with the competition scoreboard was autogenerated using `openapi-generator` following the provided instructions in the example-crs-architecture [Readme](https://github.com/AIxCyberChallenge/example-crs-architecture/blob/main/docs/api/README.md#openapi-generator).

From the `example-crs-architecture`, repository run the following command using the `competition-swagger-*.json` specification file to autogenerate the Competition API client code:

Expand Down Expand Up @@ -156,7 +156,7 @@ The `Enum` classes must also contain `str` and all `UUID` types can be changed t

CRS HTTP endpoints are required to have Basic Authentication. The autogenerated server code has been modified to include an initial implementation of this based on the fastapi [documentation](https://fastapi.tiangolo.com/advanced/security/http-basic-auth/).

To ensure the task server implementation is correct, the [generate-challenge-task](https://github.com/aixcc-finals/generate-challenge-task) script may be used to construct an HTTP request that a task server expects.
To ensure the task server implementation is correct, the [generate-challenge-task](https://github.com/AIxCyberChallenge/example-crs-architecture/tree/main/generate-challenge-task) script may be used to construct an HTTP request that a task server expects.

#### Troubleshooting

Expand Down
11 changes: 11 additions & 0 deletions generate-challenge-task/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Devenv
.devenv*
devenv.local.nix

# direnv
.direnv

# pre-commit
.pre-commit-config.yaml

.env
Loading