fortifyclient uploadFPR An internal error has occurred

When you try to upload a .fpr file to Fortify 360 server and you get the below mentioned error. Then, this blog provides one of the route cause info and fix.

fortifyclient -url http://some-fortify-server:8282/f360 -authtoken xxxxxxx-xxxx-xxxx-xxxx-xx1231324 uploadFPR -file myproject.fpr -project myproject -version 3.1


An internal error has occurred.
(org.springframework.oxm.jaxb.JaxbUnmarshallingFailureException: JAXB unmarshalling exception: null; nested exception is javax.xml.bind.UnmarshalException
 - with linked exception:

One of the reason this error occurs is "If the date/time on the machine where you run fortifyclient is ahead or too behind"

Solution: Set current date/time on the client machine.

Read More

Fortify scan automation steps for analyzing c/c++ code (Makefiles)

I wrote in my previous blog about installing and configuring Fortify client. This blog presents standard steps to automate fortify scan for c/c++ code which are compiled using Makefiles.

Step 1: Compile your source code by instrumenting Fortify
      Normally we compile source code using  compilers like cc, gcc, cl.exe or devenv. To instrument fortify append sourceanalyzer (fortify tool) to your compilation command at the beginning.
     For ex: sourceanalyzer -b testing-fortify cc test.c

     This command will compile test.c and generates NST file, which is understood by Fortify tool.
      Note: .nst files can be located at $HOME/.fortify 

     In most cases we don't compile individual files like it shown above. We will be using Makefiles to manage compilation. In that case we need to inform Make to call sourceanalyzer at the time compilation.
    If our Makefiles (usually top level makefiles) have defined the CC variable, then we can modify it as given below
    ifdef FORTIFY
        CC="sourceanalyzer -b MyProject $CC"
    endif

    With this definition, your Make command will be able to compile all your source files using sourceanalyzer.

Step 2: Scan NST files to generate fpr file
    Fortify generates a fpr file using the NST files generated in step 1. Once all your files are compiled in step 1, you need to run this step only once to generate one combined FPR file. This FPR file will be understood by other fortify tools used for reporting.

   sourceanalyzer -b MyProject -scan -f MyProject.fpr

  This will generate a FPR file named myproject.fpr which will be used in next steps.

Step 3: Upload the FPR file to Fortify 360 server
   Fortify 360 server is web based tool, which displays fortify scan result. The input to this tool is the FPR file which we generated in Step 2.
   We can upload the FPR file to Fortify 360 server using the command given below

    fortifyclient -url http://my-fortify-360-server:8282/f360 -authtoken afknafowqnewksdgjsgddkg  uploadFPR -file MyProject.fpr -project MyProject  -version 1.0

  where for
      -authtoken : You need to generate authentication token for login to Fortify 360 server. Refer my previous blog to know how to generate it
      -project: You need to create your project name in your Fortify 360 server, prior to this step.
      -version: You need to create your project version in your Fortify 360 server, prior to this step.

Step 4: Generating PDF report using the FPR file
   You can generate a PDF or XML report out of FPR file, which can be sent through mail for developers.
   Here is the command to do it
    ReportGenerator -format pdf -f MyProject.pdf -source MyProject.fpr

    Refer my previous blog for detailed information about this step.

 This completes the automation steps for Fortify scan on c/c++ code.


Note: You can use an application called auditworkbench to analyze fortify scan report. Even input for auditworkbench is FPR file.

Some more useful commands
 - Use sourceanalyzer -b MyProject -show-files to know what all files are associated with the tag MyProject
 - Use sourceanalyzer -b MyProject -show-build-warnings to show errors and warnings
 - Use sourceanalyzer -b MyProject -show-loc to show Lines of code. 

Read More

Installing and configuring Fortify on Linux and Windows machines

Installing Fortify on Linux (RHEL 5 32 bit)

• Download Fortify archive Fortify-360-2.6.5-Analyzers_and_Apps-Linux-x86.tar.gz and extract it to a directory like /usr/local/fortify
• Get License file fortify.license and place it under root directory (/usr/local/fortify)
• Run utility scapostinstall under bin directory (/usr/local/fortify/bin) to perform some necessary post install activities.

        ./scapostinstall

           [1] Migration...
           [2] Settings...
           [s] Display all settings
           [q] Exit
           Please select the desired action (1,2,s,q):

          Give valid entries for  Rulepack Update and 360 Server Settings

          Select 2 and proceed for changing settings. In Rulepack Update, give http address of your fortify 360 server for  Update Server URL: field. In 360 Server Settings, give again http address of your fortify 360 server for Server URL: field and set Get Rulepack Updates from 360 Server: true

• Now update rules pack using tool rulepackupdate available at bin directory (/usr/local/fortify/bin) 
• Generate Upload access token using utility fortifyclient under bin directory. The upload access token enable account and password information to be concealed during uploading of FPRs to Fortify 360 Server          

          fortifyclient -url [360_server_URL] token -gettoken AnalysisUploadToken -user [AccountName]
 
          fortifyclient prompts for a password, type the password for [AccountName]. fortifyclient displays a token of the general form cb79c492-0a78-44e3-b26c-65c14df52e86. Copy the token returned by fortifyclient into a text file.

Updating rules in future

• In case in future if you want to update rule packs, here is the process
• You may get rules pack in a zip file of the form Se289787b-abd8-4ad6-a77d-f11d89e8ac60.zip 

          Then run the command
         /usr/local/fortify//bin/rulepackupdate -import Se289787b-abd8-4ad6-a77d-f11d89e8ac60.zip

• or if your F360 server is up to date with rules, then run the command

           /usr/local/fortify//bin/rulepackupdate -url  [360_server_URL]

Read More

Fortify report templates using ReportGenerator

Fortify Static Code Analysis Tool allows us to create scan reports using command line utility ReportGenerator.

By default ReportGenerator creates report using the template OWASP2007.xml

Here is an example of generating PDF scan report using command line utility

ReportGenerator -format pdf -f outputFile.pdf -source dev-rkm-KMS-aggregate.fpr

We can create report either in pdf or rtf or xml.

Some times we get an error like

Xlib: connection to "localhost:10.0" refused by server
Xlib: PuTTY X11 proxy: wrong authentication protocol attempted

It means ReportGenerator will open Xwindows and your server doesn't have any Xserver running. You can try to run some simple X applications like xcalc or xterm on your machine and make sure Xserver is running fine.

But there is also an option -template, using which we can generate reports of various formats.This option is not well documented. When you say "ReportGenerator -help", it just says

-template       The Fortify Report template used to define the report.

But what are the various available template names, which they are not giving information.

Anyways still we can find out available templates in the directory fortify-install-dir/Core/config/reports

Available templates are

1) DefaultReportDefinition.xml  

2) DeveloperWorkbook.xml 

3) OWASP2004.xml  

4) OWASP2007.xml  

5) ScanReport.xml

Here is an example of using template option

ReportGenerator -format pdf -f outputFile.pdf -source dev-rkm-KMS-aggregate.fpr -template "ScanReport.xml"

Read More