Commit graph

35 commits

Author SHA1 Message Date
Juan Fernandez
966bfbf85e
Feature 6487: Deprecate cpe_id from software_cve table (#6562)
Part 2/3 of the removal of the cpe_id column from the software_cve table in favor of using the newly added software_id coumn.
2022-08-04 09:24:44 -04:00
Juan Fernandez
af80406b59
Bug 6777: Make the regexp used for detecting the oval platform major, min versions more permissive (#6800)
When getting the major/minor version for OVAL processing, handle the LTS post-fix for Ubuntu platforms
2022-07-21 12:55:07 -04:00
Juan Fernandez
5b90d11c85
Bug 6508: Don't show non-CVE entries (#6686)
Only include vulnerabilities (CVEs) in Fleet UI and API
2022-07-18 09:23:32 -04:00
Juan Fernandez
79bf51b03c
Feature 6242: Use oval to detect vulnerabilities on Fedora hosts (#6330)
* Feature 6242: Scan Fedora hosts using OVAL definitions
2022-06-24 11:02:51 -04:00
Juan Fernandez
9d01ba33c6
Feature 6096: Scan RHEL/CentOS hosts using OVAL definitions (#6241)
Extended the OVAL parser/analyzer so that we can scan RHEL based systems.
2022-06-23 16:44:45 -04:00
Eng Zer Jun
abe33f1d8d
test: use T.TempDir to create temporary test directory (#6080)
This commit replaces `ioutil.TempDir` with `t.TempDir` in tests. The
directory created by `t.TempDir` is automatically removed when the test
and all its subtests complete.

Prior to this commit, temporary directory created using `ioutil.TempDir`
needs to be removed manually by calling `os.RemoveAll`, which is omitted
in some tests. The error handling boilerplate e.g.
	defer func() {
		if err := os.RemoveAll(dir); err != nil {
			t.Fatal(err)
		}
	}
is also tedious, but `t.TempDir` handles this for us nicely.

Reference: https://pkg.go.dev/testing#T.TempDir
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-06-13 10:20:38 -03:00
Lucas Manuel Rodriguez
4cfeaa1580
Do not use golangci action for better reproducibility (use make lint-go) (#6175)
* Do not use golangci action for better reproducibility

* Add fix to trigger build

* Fix all reported issues

* fix more lint errors

* Add missing import

* Remove unused method

* Remove change not necessary
2022-06-10 18:52:24 -03:00
Lucas Manuel Rodriguez
3dd89bc0a1
Fix flaky test TestVulnerabilityDataStream (#6162) 2022-06-09 10:36:37 -03:00
Michal Nicpon
bac168e3fd
fix mem usage cve sync (#6131) 2022-06-08 13:15:44 -06:00
Juan Fernandez
337734fce1
Bug: Issue while parsing dpkg objects with inline names (#6146)
* Bug: Issue while parsing dpkg objects with inline names

Dpkg objects can also define their names inline, not only using variable references.
2022-06-08 14:29:58 -04:00
Juan Fernandez
ef73039559
Improve vulnerability detection for Ubuntu (#6102)
Feature: Improve our capability to detect vulnerable software on Ubuntu hosts

To improve the capability of detecting vulnerable software on Ubuntu, we are now using OVAL definitions to detect vulnerable software on Ubuntu hosts. If data sync is enabled (disable_data_sync=false) OVAL definitions are automatically kept up to date (they are 'refreshed' once per day) - there's also the option to manually download the OVAL definitions using the 'fleetctl vulnerability-data-stream' command. Downloaded definitions are then parsed into an intermediary format and then used to identify vulnerable software on Ubuntu hosts. Finally, any 'recent' detected vulnerabilities are sent to any third-party integrations.
2022-06-07 21:09:47 -04:00
Michal Nicpon
1044182b7b
fix epss probability (#6083) 2022-06-03 11:37:47 -06:00
Michal Nicpon
30a864c8d2
Sync CVE scores periodically (#5838) 2022-06-01 10:06:57 -06:00
Michal Nicpon
983f9e59b3
Include CVE scores when listing software (#5673) 2022-05-20 10:58:40 -06:00
Lucas Manuel Rodriguez
114b678e26
test: Add retry to the correct part that has sync enabled (#5688) 2022-05-11 10:11:51 -03:00
Lucas Manuel Rodriguez
fda79a8770
Run network test serially to prevent timeouts on Github CI (#5557)
* Run network test serially to prevent timeouts on Github CI

* Revert lint changes

* Add simple file lock

* Revert test change

* Clarify error check
2022-05-10 11:52:33 -03:00
Martin Angers
36702ede8d
Make recent vulnerabilities max age configurable. (#5081) 2022-04-12 14:48:15 -04:00
Tomas Touceda
f2aba83a73
Extend vulnerability age to 30 (#4901) 2022-04-06 11:42:02 -03:00
Michal Nicpon
779623934c
Fix update invite email conflict (#4751) 2022-03-28 09:38:57 -06:00
Martin Angers
80079e4fd7
Fix race in mock datastore for recent_vulns test (#4230) 2022-02-16 09:23:27 -05:00
Lucas Manuel Rodriguez
be72dc356c
Add CentOS parsing+post-processing to reduce false positives in vulnerability processing (#4037)
* Add CentOS parsing and post-processing in fleet

* Add tests and amend SyncCPEDatabase

* Add test for centosPostProcessing

* Changes from PR comments

* Amend software test

* Fix sync test

* Add index to source and vendor

* Use os.MkdirTemp

* Rearrange migrations

* Regenerate test schema

* Add support for testing migrations (#4112)

* Add support for testing migrations

* Rename migration in tests

* Changes suggested in PR

* Go mod tidy
2022-02-14 15:13:44 -03:00
Tomas Touceda
c45115a915
Properly handle path in CVE URL prefix (#4174) 2022-02-11 14:10:13 -03:00
Martin Angers
6e2ba62744
Trigger webhooks for recently published vulnerabilities (#3941) 2022-02-02 16:34:37 -05:00
Tomas Touceda
b90e2e2e3d
Issue 3901 match target sw (#3982)
* Allow to search with target_sw with a period

* Remove tests for a different thign

* Add a test for programs as a source as well

* Use MATCH again and add proper tests
2022-02-02 17:17:41 -03:00
Martin Angers
c997f853e5
Make creation of http.Client uniform across the codebase (#3097) 2021-11-24 15:56:54 -05:00
Martin Angers
69a4985cac
Use new error handling approach in other packages (#2954) 2021-11-22 09:13:26 -05:00
Tomas Touceda
fcb5d5b392
Make vulnerability processing less RAM hungry (#2739)
* Make preview work when run from scratch (no orbit running)

* Make vulnerability processing less RAM hungry

* Add changes file

* Only get the cpe list once

* Remove cache

* Try killing osquery as well as orbit and clear their db dir

Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2021-10-29 11:27:12 -03:00
Martin Angers
86dce785ae
Improve performance of the Go test suite (#2060)
Closes #1805
2021-09-20 14:09:38 -04:00
Tomas Touceda
429af72b69
Issue 1963 vulnerabilities no sync (#1976)
* wip

* Add tests for skip sync

* Add changes file

* Fix lint
2021-09-14 10:58:35 -03:00
Martin Angers
4f4185372d
Add support for context in datastore/mysql layer (#1962)
This is just to pass down the context to the datastore layer, it doesn't
use it just yet - this will be in a follow-up PR.
2021-09-14 08:11:07 -04:00
Tomas Touceda
70f728fe84
Make vulnerability processing more configurable (#1718)
* Make vulnerability processing more configurable

* Simplify leader selection
2021-08-18 17:25:14 -03:00
Tomas Touceda
c781058617
Fix build, add missing tests for cpe translations (#1631)
* Fix build, add missing tests for cpe translations

Also dont fail alltogether if there's one issue translating CPEs, log it and continue

* Make it once every hour again

* Use MATCH but escape strings
2021-08-11 14:52:09 -03:00
Tomas Touceda
f8b7a83cc6
Process stored CPEs and store found CVEs (#1533)
* WIP

* WIP

* Make path optional and fix tests

* Add first generate

* Move to nvd package

* remove replace

* Re-add replace

* It's path, not file name

* Change how db path is set and use etag

* Fix typos

* Make db generation faster

* Remove quotes

* Doesn't like comments

* Samitize etag and save to file

* Refactor some things and improve writing of etagenv

* Compress file and truncate amount of items for faster testing

* Remove quotes

* Try to improve performance

* Ignore truncate error if not exists

* Minor cleanup and make sqlite have cpe prefix

* Simplify code and test sync

* Add VCR for sync test

* Check for nvdRelease nil

* Add test for the actual translation

* Address review comments

* Rename generate command because we'll have a cve one too

* Move to its own dir

* Add first cve db generation

* WIP but with final strategy, preparring to merge main

* Fix merge conflicts

* WIP

* wip

* Insert CVEs to the db

* Remove unused code

* Use wg instead of counting

* Call cancelFunc to avoid ctx leak

* Fix logs for better readability

* Point code to fleetdm instead of my repo
2021-08-04 18:01:39 -03:00
Zach Wasserman
416038a689
Update usage of os.IsNotExist (#1539)
Per [godoc](https://pkg.go.dev/os#IsNotExist), this is the preferred method.
2021-08-03 13:02:15 -07:00
Tomas Touceda
46b0b7765b
Issue 1435 software to cpe (#1488)
* WIP

* WIP

* Make path optional and fix tests

* Add first generate

* Move to nvd package

* remove replace

* Re-add replace

* It's path, not file name

* Change how db path is set and use etag

* Fix typos

* Make db generation faster

* Remove quotes

* Doesn't like comments

* Samitize etag and save to file

* Refactor some things and improve writing of etagenv

* Compress file and truncate amount of items for faster testing

* Remove quotes

* Try to improve performance

* Ignore truncate error if not exists

* Minor cleanup and make sqlite have cpe prefix

* Simplify code and test sync

* Add VCR for sync test

* Check for nvdRelease nil

* Add test for the actual translation

* Address review comments

* Rename generate command because we'll have a cve one too

* Move to its own dir

* Address review comments
2021-07-29 13:10:34 -03:00