mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 00:18:27 +00:00
bd2b2bcd3b
https://github.com/fleetdm/fleet/issues/21300 - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality
79 lines
2.6 KiB
Go
79 lines
2.6 KiB
Go
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/vulnerabilities/goval_dictionary"
|
|
"github.com/fleetdm/fleet/v4/server/vulnerabilities/nvd"
|
|
"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
|
|
"github.com/go-kit/log"
|
|
"github.com/go-kit/log/level"
|
|
)
|
|
|
|
func main() {
|
|
dbDir := flag.String("db_dir", "/tmp/vulndbs", "Path to the vulnerability database")
|
|
debug := flag.Bool("debug", false, "Sets debug mode")
|
|
flag.Parse()
|
|
|
|
logger := log.NewJSONLogger(os.Stdout)
|
|
if *debug {
|
|
logger = level.NewFilter(logger, level.AllowDebug())
|
|
} else {
|
|
logger = level.NewFilter(logger, level.AllowInfo())
|
|
}
|
|
|
|
vulnPath := *dbDir
|
|
checkNVDVulnerabilities(vulnPath, logger)
|
|
checkGovalDictionaryVulnerabilities(vulnPath)
|
|
}
|
|
|
|
func checkNVDVulnerabilities(vulnPath string, logger log.Logger) {
|
|
metaMap := make(map[string]fleet.CVEMeta)
|
|
if err := nvd.CVEMetaFromNVDFeedFiles(metaMap, vulnPath, logger); err != nil {
|
|
panic(err)
|
|
}
|
|
}
|
|
|
|
func checkGovalDictionaryVulnerabilities(vulnPath string) {
|
|
for _, p := range oval.SupportedGovalPlatforms {
|
|
platform := platformFromString(p)
|
|
|
|
destFilename := platform.ToGovalDictionaryFilename()
|
|
filename := platform.ToGovalDatabaseFilename()
|
|
|
|
// Renaming these files from amzn_%d.sqlite3 to fleet_goval_dictionary_amzn_%d.sqlite3
|
|
// In the vulnerabilities repository the `goval-dictionary fetch` downloads these files with the shorter name
|
|
// However, the goval_dictionary/sync.go#Refresh method download these files, extracts them, and uses the longer name
|
|
// See in specific the `downloadDatabase` function where it sets the `dstPath` to use `platform.ToGovalDictionaryFilename`
|
|
// LoadDb then expect the path to include the `ToGovalDictionaryFilename`
|
|
err := os.Rename(fmt.Sprintf("%s/%s", vulnPath, filename), fmt.Sprintf("%s/%s", vulnPath, destFilename))
|
|
if err != nil {
|
|
panic(fmt.Sprintf("failed to move file from %s/%s to %s/%s: %v", vulnPath, filename, vulnPath, destFilename, err))
|
|
}
|
|
|
|
db, err := goval_dictionary.LoadDb(platform, vulnPath)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
err = db.Verfiy()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
err = os.Rename(fmt.Sprintf("%s/%s", vulnPath, destFilename), fmt.Sprintf("%s/%s", vulnPath, filename))
|
|
if err != nil {
|
|
panic(fmt.Sprintf("failed to move file from %s/%s to %s/%s: %v", vulnPath, destFilename, vulnPath, filename, err))
|
|
}
|
|
}
|
|
}
|
|
|
|
func platformFromString(platform string) oval.Platform {
|
|
parts := strings.Split(platform, "_")
|
|
host, version := parts[0], fmt.Sprintf("Amazon Linux %s.0", parts[1]) // this is due to how oval.Platform#getMajorMinorVer works
|
|
return oval.NewPlatform(host, version)
|
|
}
|