2017-01-15 15:52:13 +00:00
|
|
|
// Copyright 2017 clair authors
|
2016-01-19 20:16:45 +00:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
2015-12-28 20:03:29 +00:00
|
|
|
package database
|
|
|
|
|
2016-01-22 20:59:46 +00:00
|
|
|
import (
|
2016-02-01 23:41:40 +00:00
|
|
|
"database/sql/driver"
|
|
|
|
"encoding/json"
|
2016-01-22 20:59:46 +00:00
|
|
|
"time"
|
2018-09-07 20:12:19 +00:00
|
|
|
|
|
|
|
"github.com/coreos/clair/pkg/pagination"
|
2016-01-22 20:59:46 +00:00
|
|
|
)
|
2015-12-28 20:03:29 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// Ancestry is a manifest that keeps all layers in an image in order.
|
|
|
|
type Ancestry struct {
|
2018-10-08 14:42:17 +00:00
|
|
|
// Name is a globally unique value for a set of layers. This is often the
|
|
|
|
// sha256 digest of an OCI/Docker manifest.
|
2017-07-26 23:20:19 +00:00
|
|
|
Name string
|
2018-10-08 14:42:17 +00:00
|
|
|
// By contains the processors that are used when computing the
|
2018-09-05 15:34:49 +00:00
|
|
|
// content of this ancestry.
|
2018-10-08 14:42:17 +00:00
|
|
|
By []Detector
|
2017-07-26 23:20:19 +00:00
|
|
|
// Layers should be ordered and i_th layer is the parent of i+1_th layer in
|
|
|
|
// the slice.
|
2018-09-05 15:34:49 +00:00
|
|
|
Layers []AncestryLayer
|
|
|
|
}
|
|
|
|
|
2018-10-08 14:42:17 +00:00
|
|
|
// Valid checks if the ancestry is compliant to spec.
|
|
|
|
func (a *Ancestry) Valid() bool {
|
|
|
|
if a == nil {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if a.Name == "" {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, d := range a.By {
|
|
|
|
if !d.Valid() {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, l := range a.Layers {
|
|
|
|
if !l.Valid() {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2018-09-05 15:34:49 +00:00
|
|
|
// AncestryLayer is a layer with all detected namespaced features.
|
|
|
|
type AncestryLayer struct {
|
2018-10-08 14:42:17 +00:00
|
|
|
// Hash is the sha-256 tarsum on the layer's blob content.
|
|
|
|
Hash string
|
|
|
|
// Features are the features introduced by this layer when it was
|
2018-09-07 15:31:35 +00:00
|
|
|
// processed.
|
2018-10-08 14:42:17 +00:00
|
|
|
Features []AncestryFeature
|
2017-07-26 23:20:19 +00:00
|
|
|
}
|
|
|
|
|
2018-10-08 14:42:17 +00:00
|
|
|
// Valid checks if the Ancestry Layer is compliant to the spec.
|
|
|
|
func (l *AncestryLayer) Valid() bool {
|
|
|
|
if l == nil {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if l.Hash == "" {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetFeatures returns the Ancestry's features.
|
|
|
|
func (l *AncestryLayer) GetFeatures() []NamespacedFeature {
|
|
|
|
nsf := make([]NamespacedFeature, 0, len(l.Features))
|
|
|
|
for _, f := range l.Features {
|
|
|
|
nsf = append(nsf, f.NamespacedFeature)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nsf
|
2017-07-26 23:20:19 +00:00
|
|
|
}
|
2015-12-28 20:03:29 +00:00
|
|
|
|
2018-10-08 14:42:17 +00:00
|
|
|
// AncestryFeature is a namespaced feature with the detectors used to
|
|
|
|
// find this feature.
|
|
|
|
type AncestryFeature struct {
|
|
|
|
NamespacedFeature
|
|
|
|
|
|
|
|
// FeatureBy is the detector that detected the feature.
|
|
|
|
FeatureBy Detector
|
|
|
|
// NamespaceBy is the detector that detected the namespace.
|
|
|
|
NamespaceBy Detector
|
|
|
|
}
|
|
|
|
|
|
|
|
// Layer is a layer with all the detected features and namespaces.
|
2018-09-11 20:09:08 +00:00
|
|
|
type Layer struct {
|
2018-10-08 14:42:17 +00:00
|
|
|
// Hash is the sha-256 tarsum on the layer's blob content.
|
|
|
|
Hash string
|
|
|
|
// By contains a list of detectors scanned this Layer.
|
|
|
|
By []Detector
|
|
|
|
Namespaces []LayerNamespace
|
|
|
|
Features []LayerFeature
|
|
|
|
}
|
|
|
|
|
|
|
|
func (l *Layer) GetFeatures() []Feature {
|
|
|
|
features := make([]Feature, 0, len(l.Features))
|
|
|
|
for _, f := range l.Features {
|
|
|
|
features = append(features, f.Feature)
|
|
|
|
}
|
|
|
|
|
|
|
|
return features
|
|
|
|
}
|
|
|
|
|
|
|
|
func (l *Layer) GetNamespaces() []Namespace {
|
|
|
|
namespaces := make([]Namespace, 0, len(l.Namespaces))
|
|
|
|
for _, ns := range l.Namespaces {
|
|
|
|
namespaces = append(namespaces, ns.Namespace)
|
|
|
|
}
|
|
|
|
|
|
|
|
return namespaces
|
|
|
|
}
|
|
|
|
|
|
|
|
// LayerNamespace is a namespace with detection information.
|
|
|
|
type LayerNamespace struct {
|
|
|
|
Namespace
|
|
|
|
|
|
|
|
// By is the detector found the namespace.
|
|
|
|
By Detector
|
|
|
|
}
|
|
|
|
|
|
|
|
// LayerFeature is a feature with detection information.
|
|
|
|
type LayerFeature struct {
|
|
|
|
Feature
|
2017-07-26 23:20:19 +00:00
|
|
|
|
2018-10-08 14:42:17 +00:00
|
|
|
// By is the detector found the feature.
|
|
|
|
By Detector
|
2015-12-28 20:03:29 +00:00
|
|
|
}
|
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// Namespace is the contextual information around features.
|
|
|
|
//
|
|
|
|
// e.g. Debian:7, NodeJS.
|
2015-12-28 20:03:29 +00:00
|
|
|
type Namespace struct {
|
2016-12-28 01:45:11 +00:00
|
|
|
Name string
|
|
|
|
VersionFormat string
|
2015-12-28 20:03:29 +00:00
|
|
|
}
|
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// Feature represents a package detected in a layer but the namespace is not
|
|
|
|
// determined.
|
|
|
|
//
|
|
|
|
// e.g. Name: OpenSSL, Version: 1.0, VersionFormat: dpkg.
|
2018-02-02 05:53:40 +00:00
|
|
|
// dpkg is the version format of the installer package manager, which in this
|
|
|
|
// case could be dpkg or apk.
|
2015-12-28 20:03:29 +00:00
|
|
|
type Feature struct {
|
2017-07-26 23:20:19 +00:00
|
|
|
Name string
|
|
|
|
Version string
|
|
|
|
VersionFormat string
|
2018-10-09 21:33:43 +00:00
|
|
|
|
|
|
|
// Parent feature indicates that the vulnerability affects parent feature
|
|
|
|
// will also affect this feature.
|
|
|
|
//
|
|
|
|
// e.g. A source package is the parent feature of a binary package.
|
|
|
|
Parent *Feature
|
2017-07-26 23:20:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// NamespacedFeature is a feature with determined namespace and can be affected
|
|
|
|
// by vulnerabilities.
|
|
|
|
//
|
|
|
|
// e.g. OpenSSL 1.0 dpkg Debian:7.
|
|
|
|
type NamespacedFeature struct {
|
|
|
|
Feature
|
2015-12-28 20:03:29 +00:00
|
|
|
|
|
|
|
Namespace Namespace
|
|
|
|
}
|
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// AffectedNamespacedFeature is a namespaced feature affected by the
|
|
|
|
// vulnerabilities with fixed-in versions for this feature.
|
|
|
|
type AffectedNamespacedFeature struct {
|
|
|
|
NamespacedFeature
|
|
|
|
|
|
|
|
AffectedBy []VulnerabilityWithFixedIn
|
|
|
|
}
|
2015-12-28 20:03:29 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// VulnerabilityWithFixedIn is used for AffectedNamespacedFeature to retrieve
|
|
|
|
// the affecting vulnerabilities and the fixed-in versions for the feature.
|
|
|
|
type VulnerabilityWithFixedIn struct {
|
|
|
|
Vulnerability
|
2016-02-18 16:04:16 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
FixedInVersion string
|
2015-12-28 20:03:29 +00:00
|
|
|
}
|
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// AffectedFeature is used to determine whether a namespaced feature is affected
|
|
|
|
// by a Vulnerability. Namespace and Feature Name is unique. Affected Feature is
|
|
|
|
// bound to vulnerability.
|
|
|
|
type AffectedFeature struct {
|
|
|
|
Namespace Namespace
|
|
|
|
FeatureName string
|
|
|
|
// FixedInVersion is known next feature version that's not affected by the
|
|
|
|
// vulnerability. Empty FixedInVersion means the unaffected version is
|
|
|
|
// unknown.
|
|
|
|
FixedInVersion string
|
|
|
|
// AffectedVersion contains the version range to determine whether or not a
|
|
|
|
// feature is affected.
|
|
|
|
AffectedVersion string
|
|
|
|
}
|
|
|
|
|
|
|
|
// VulnerabilityID is an identifier for every vulnerability. Every vulnerability
|
|
|
|
// has unique namespace and name.
|
|
|
|
type VulnerabilityID struct {
|
|
|
|
Name string
|
|
|
|
Namespace string
|
|
|
|
}
|
2015-12-28 20:03:29 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// Vulnerability represents CVE or similar vulnerability reports.
|
|
|
|
type Vulnerability struct {
|
2016-02-04 16:34:01 +00:00
|
|
|
Name string
|
|
|
|
Namespace Namespace
|
|
|
|
|
2015-12-28 20:03:29 +00:00
|
|
|
Description string
|
|
|
|
Link string
|
2017-01-19 18:42:37 +00:00
|
|
|
Severity Severity
|
2016-01-12 15:40:46 +00:00
|
|
|
|
2016-02-01 23:41:40 +00:00
|
|
|
Metadata MetadataMap
|
2017-07-26 23:20:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// VulnerabilityWithAffected is an vulnerability with all known affected
|
|
|
|
// features.
|
|
|
|
type VulnerabilityWithAffected struct {
|
|
|
|
Vulnerability
|
|
|
|
|
|
|
|
Affected []AffectedFeature
|
|
|
|
}
|
|
|
|
|
|
|
|
// PagedVulnerableAncestries is a vulnerability with a page of affected
|
|
|
|
// ancestries each with a special index attached for streaming purpose. The
|
|
|
|
// current page number and next page number are for navigate.
|
|
|
|
type PagedVulnerableAncestries struct {
|
|
|
|
Vulnerability
|
|
|
|
|
|
|
|
// Affected is a map of special indexes to Ancestries, which the pair
|
|
|
|
// should be unique in a stream. Every indexes in the map should be larger
|
|
|
|
// than previous page.
|
|
|
|
Affected map[int]string
|
|
|
|
|
|
|
|
Limit int
|
2018-09-07 20:12:19 +00:00
|
|
|
Current pagination.Token
|
|
|
|
Next pagination.Token
|
2016-02-01 23:41:40 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// End signals the end of the pages.
|
|
|
|
End bool
|
|
|
|
}
|
|
|
|
|
|
|
|
// NotificationHook is a message sent to another service to inform of a change
|
|
|
|
// to a Vulnerability or the Ancestries affected by a Vulnerability. It contains
|
|
|
|
// the name of a notification that should be read and marked as read via the
|
|
|
|
// API.
|
|
|
|
type NotificationHook struct {
|
|
|
|
Name string
|
2015-12-28 20:03:29 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
Created time.Time
|
|
|
|
Notified time.Time
|
|
|
|
Deleted time.Time
|
2015-12-28 20:03:29 +00:00
|
|
|
}
|
2016-01-21 23:09:23 +00:00
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// VulnerabilityNotification is a notification for vulnerability changes.
|
|
|
|
type VulnerabilityNotification struct {
|
|
|
|
NotificationHook
|
|
|
|
|
|
|
|
Old *Vulnerability
|
|
|
|
New *Vulnerability
|
|
|
|
}
|
|
|
|
|
|
|
|
// VulnerabilityNotificationWithVulnerable is a notification for vulnerability
|
|
|
|
// changes with vulnerable ancestries.
|
|
|
|
type VulnerabilityNotificationWithVulnerable struct {
|
|
|
|
NotificationHook
|
|
|
|
|
|
|
|
Old *PagedVulnerableAncestries
|
|
|
|
New *PagedVulnerableAncestries
|
|
|
|
}
|
|
|
|
|
2018-09-05 15:34:49 +00:00
|
|
|
// MetadataMap is for storing the metadata returned by vulnerability database.
|
2016-02-01 23:41:40 +00:00
|
|
|
type MetadataMap map[string]interface{}
|
|
|
|
|
2017-07-26 23:20:19 +00:00
|
|
|
// NullableAffectedNamespacedFeature is an affectednamespacedfeature with
|
|
|
|
// whether it's found in datastore.
|
|
|
|
type NullableAffectedNamespacedFeature struct {
|
|
|
|
AffectedNamespacedFeature
|
|
|
|
|
|
|
|
Valid bool
|
|
|
|
}
|
|
|
|
|
|
|
|
// NullableVulnerability is a vulnerability with whether the vulnerability is
|
|
|
|
// found in datastore.
|
|
|
|
type NullableVulnerability struct {
|
|
|
|
VulnerabilityWithAffected
|
|
|
|
|
|
|
|
Valid bool
|
|
|
|
}
|
|
|
|
|
2016-02-01 23:41:40 +00:00
|
|
|
func (mm *MetadataMap) Scan(value interface{}) error {
|
2017-05-06 21:01:41 +00:00
|
|
|
if value == nil {
|
2016-02-01 23:41:40 +00:00
|
|
|
return nil
|
|
|
|
}
|
2017-05-06 21:01:41 +00:00
|
|
|
|
|
|
|
// github.com/lib/pq decodes TEXT/VARCHAR fields into strings.
|
|
|
|
val, ok := value.(string)
|
|
|
|
if !ok {
|
|
|
|
panic("got type other than []byte from database")
|
|
|
|
}
|
|
|
|
return json.Unmarshal([]byte(val), mm)
|
2016-02-01 23:41:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (mm *MetadataMap) Value() (driver.Value, error) {
|
|
|
|
json, err := json.Marshal(*mm)
|
|
|
|
return string(json), err
|
|
|
|
}
|