|
|
@ -18,10 +18,8 @@ package alpine
|
|
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
import (
|
|
|
|
"io"
|
|
|
|
"io"
|
|
|
|
"io/ioutil"
|
|
|
|
|
|
|
|
"os"
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
"path/filepath"
|
|
|
|
"strings"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
"gopkg.in/yaml.v2"
|
|
|
|
"gopkg.in/yaml.v2"
|
|
|
@ -30,10 +28,13 @@ import (
|
|
|
|
"github.com/coreos/clair/ext/versionfmt"
|
|
|
|
"github.com/coreos/clair/ext/versionfmt"
|
|
|
|
"github.com/coreos/clair/ext/versionfmt/dpkg"
|
|
|
|
"github.com/coreos/clair/ext/versionfmt/dpkg"
|
|
|
|
"github.com/coreos/clair/ext/vulnsrc"
|
|
|
|
"github.com/coreos/clair/ext/vulnsrc"
|
|
|
|
|
|
|
|
"github.com/coreos/clair/pkg/fsutil"
|
|
|
|
"github.com/coreos/clair/pkg/gitutil"
|
|
|
|
"github.com/coreos/clair/pkg/gitutil"
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
const (
|
|
|
|
const (
|
|
|
|
|
|
|
|
// This Alpine vulnerability database affects origin packages, which has
|
|
|
|
|
|
|
|
// `origin` field of itself.
|
|
|
|
secdbGitURL = "https://github.com/alpinelinux/alpine-secdb"
|
|
|
|
secdbGitURL = "https://github.com/alpinelinux/alpine-secdb"
|
|
|
|
updaterFlag = "alpine-secdbUpdater"
|
|
|
|
updaterFlag = "alpine-secdbUpdater"
|
|
|
|
nvdURLPrefix = "https://cve.mitre.org/cgi-bin/cvename.cgi?name="
|
|
|
|
nvdURLPrefix = "https://cve.mitre.org/cgi-bin/cvename.cgi?name="
|
|
|
@ -51,61 +52,44 @@ type updater struct {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
func (u *updater) Update(db database.Datastore) (resp vulnsrc.UpdateResponse, err error) {
|
|
|
|
func (u *updater) Update(db database.Datastore) (resp vulnsrc.UpdateResponse, err error) {
|
|
|
|
log.WithField("package", "Alpine").Info("Start fetching vulnerabilities")
|
|
|
|
log.WithField("package", "Alpine").Info("start fetching vulnerabilities")
|
|
|
|
|
|
|
|
|
|
|
|
// Pull the master branch.
|
|
|
|
// Pull the master branch.
|
|
|
|
var commit string
|
|
|
|
var (
|
|
|
|
u.repositoryLocalPath, commit, err = gitutil.CloneOrPull(secdbGitURL, u.repositoryLocalPath, updaterFlag)
|
|
|
|
commit string
|
|
|
|
if err != nil {
|
|
|
|
existingCommit string
|
|
|
|
return
|
|
|
|
foundCommit bool
|
|
|
|
}
|
|
|
|
namespaces []string
|
|
|
|
|
|
|
|
vulns []database.VulnerabilityWithAffected
|
|
|
|
// Open a database transaction.
|
|
|
|
)
|
|
|
|
tx, err := db.Begin()
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
defer tx.Rollback()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// Ask the database for the latest commit we successfully applied.
|
|
|
|
if u.repositoryLocalPath, commit, err = gitutil.CloneOrPull(secdbGitURL, u.repositoryLocalPath, updaterFlag); err != nil {
|
|
|
|
var dbCommit string
|
|
|
|
|
|
|
|
var ok bool
|
|
|
|
|
|
|
|
dbCommit, ok, err = tx.FindKeyValue(updaterFlag)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !ok {
|
|
|
|
|
|
|
|
dbCommit = ""
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// Set the updaterFlag to equal the commit processed.
|
|
|
|
// Set the updaterFlag to equal the commit processed.
|
|
|
|
resp.FlagName = updaterFlag
|
|
|
|
resp.FlagName = updaterFlag
|
|
|
|
resp.FlagValue = commit
|
|
|
|
resp.FlagValue = commit
|
|
|
|
|
|
|
|
if existingCommit, foundCommit, err = database.FindKeyValueAndRollback(db, updaterFlag); err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Short-circuit if there have been no updates.
|
|
|
|
// Short-circuit if there have been no updates.
|
|
|
|
if commit == dbCommit {
|
|
|
|
if foundCommit && commit == existingCommit {
|
|
|
|
log.WithField("package", "alpine").Debug("no update")
|
|
|
|
log.WithField("package", "alpine").Debug("no update, skip")
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Get the list of namespaces from the repository.
|
|
|
|
// Get the list of namespaces from the repository.
|
|
|
|
var namespaces []string
|
|
|
|
if namespaces, err = fsutil.Readdir(u.repositoryLocalPath, fsutil.DirectoriesOnly); err != nil {
|
|
|
|
namespaces, err = ls(u.repositoryLocalPath, directoriesOnly)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Append any changed vulnerabilities to the response.
|
|
|
|
// Append any changed vulnerabilities to the response.
|
|
|
|
for _, namespace := range namespaces {
|
|
|
|
for _, namespace := range namespaces {
|
|
|
|
var vulns []database.VulnerabilityWithAffected
|
|
|
|
if vulns, err = parseVulnsFromNamespace(u.repositoryLocalPath, namespace); err != nil {
|
|
|
|
var note string
|
|
|
|
|
|
|
|
vulns, note, err = parseVulnsFromNamespace(u.repositoryLocalPath, namespace)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if note != "" {
|
|
|
|
|
|
|
|
resp.Notes = append(resp.Notes, note)
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
resp.Vulnerabilities = append(resp.Vulnerabilities, vulns...)
|
|
|
|
resp.Vulnerabilities = append(resp.Vulnerabilities, vulns...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -118,74 +102,26 @@ func (u *updater) Clean() {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
type lsFilter int
|
|
|
|
func parseVulnsFromNamespace(repositoryPath, namespace string) (vulns []database.VulnerabilityWithAffected, err error) {
|
|
|
|
|
|
|
|
|
|
|
|
const (
|
|
|
|
|
|
|
|
filesOnly lsFilter = iota
|
|
|
|
|
|
|
|
directoriesOnly
|
|
|
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func ls(path string, filter lsFilter) ([]string, error) {
|
|
|
|
|
|
|
|
dir, err := os.Open(path)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return nil, err
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
defer dir.Close()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
finfos, err := dir.Readdir(0)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return nil, err
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
var files []string
|
|
|
|
|
|
|
|
for _, info := range finfos {
|
|
|
|
|
|
|
|
if filter == directoriesOnly && !info.IsDir() {
|
|
|
|
|
|
|
|
continue
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if filter == filesOnly && info.IsDir() {
|
|
|
|
|
|
|
|
continue
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if strings.HasPrefix(info.Name(), ".") {
|
|
|
|
|
|
|
|
continue
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
files = append(files, info.Name())
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return files, nil
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func parseVulnsFromNamespace(repositoryPath, namespace string) (vulns []database.VulnerabilityWithAffected, note string, err error) {
|
|
|
|
|
|
|
|
nsDir := filepath.Join(repositoryPath, namespace)
|
|
|
|
nsDir := filepath.Join(repositoryPath, namespace)
|
|
|
|
var dbFilenames []string
|
|
|
|
var dbFilenames []string
|
|
|
|
dbFilenames, err = ls(nsDir, filesOnly)
|
|
|
|
if dbFilenames, err = fsutil.Readdir(nsDir, fsutil.FilesOnly); err != nil {
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
for _, filename := range dbFilenames {
|
|
|
|
for _, filename := range dbFilenames {
|
|
|
|
var file io.ReadCloser
|
|
|
|
var db *secDB
|
|
|
|
file, err = os.Open(filepath.Join(nsDir, filename))
|
|
|
|
if db, err = newSecDB(filepath.Join(nsDir, filename)); err != nil {
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
var fileVulns []database.VulnerabilityWithAffected
|
|
|
|
vulns = append(vulns, db.Vulnerabilities()...)
|
|
|
|
fileVulns, err = parseYAML(file)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
vulns = append(vulns, fileVulns...)
|
|
|
|
|
|
|
|
file.Close()
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
type secDBFile struct {
|
|
|
|
type secDB struct {
|
|
|
|
Distro string `yaml:"distroversion"`
|
|
|
|
Distro string `yaml:"distroversion"`
|
|
|
|
Packages []struct {
|
|
|
|
Packages []struct {
|
|
|
|
Pkg struct {
|
|
|
|
Pkg struct {
|
|
|
@ -195,42 +131,54 @@ type secDBFile struct {
|
|
|
|
} `yaml:"packages"`
|
|
|
|
} `yaml:"packages"`
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
func parseYAML(r io.Reader) (vulns []database.VulnerabilityWithAffected, err error) {
|
|
|
|
func newSecDB(filePath string) (file *secDB, err error) {
|
|
|
|
var rBytes []byte
|
|
|
|
var f io.ReadCloser
|
|
|
|
rBytes, err = ioutil.ReadAll(r)
|
|
|
|
f, err = os.Open(filePath)
|
|
|
|
if err != nil {
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
var file secDBFile
|
|
|
|
defer f.Close()
|
|
|
|
err = yaml.Unmarshal(rBytes, &file)
|
|
|
|
file = &secDB{}
|
|
|
|
if err != nil {
|
|
|
|
err = yaml.NewDecoder(f).Decode(file)
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
for _, pack := range file.Packages {
|
|
|
|
func (file *secDB) Vulnerabilities() (vulns []database.VulnerabilityWithAffected) {
|
|
|
|
pkg := pack.Pkg
|
|
|
|
if file == nil {
|
|
|
|
for version, vulnStrs := range pkg.Fixes {
|
|
|
|
return
|
|
|
|
err := versionfmt.Valid(dpkg.ParserName, version)
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
log.WithError(err).WithField("version", version).Warning("could not parse package version. skipping")
|
|
|
|
namespace := database.Namespace{Name: "alpine:" + file.Distro, VersionFormat: dpkg.ParserName}
|
|
|
|
|
|
|
|
for _, pkg := range file.Packages {
|
|
|
|
|
|
|
|
for version, cveNames := range pkg.Pkg.Fixes {
|
|
|
|
|
|
|
|
if err := versionfmt.Valid(dpkg.ParserName, version); err != nil {
|
|
|
|
|
|
|
|
log.WithError(err).WithFields(log.Fields{
|
|
|
|
|
|
|
|
"version": version,
|
|
|
|
|
|
|
|
"package name": pkg.Pkg.Name,
|
|
|
|
|
|
|
|
}).Warning("could not parse package version, skipping")
|
|
|
|
continue
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
for _, vulnStr := range vulnStrs {
|
|
|
|
for _, cve := range cveNames {
|
|
|
|
var vuln database.VulnerabilityWithAffected
|
|
|
|
vuln := database.VulnerabilityWithAffected{
|
|
|
|
vuln.Severity = database.UnknownSeverity
|
|
|
|
Vulnerability: database.Vulnerability{
|
|
|
|
vuln.Name = vulnStr
|
|
|
|
Name: cve,
|
|
|
|
vuln.Link = nvdURLPrefix + vulnStr
|
|
|
|
Link: nvdURLPrefix + cve,
|
|
|
|
|
|
|
|
Severity: database.UnknownSeverity,
|
|
|
|
|
|
|
|
Namespace: namespace,
|
|
|
|
|
|
|
|
},
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
var fixedInVersion string
|
|
|
|
var fixedInVersion string
|
|
|
|
if version != versionfmt.MaxVersion {
|
|
|
|
if version != versionfmt.MaxVersion {
|
|
|
|
fixedInVersion = version
|
|
|
|
fixedInVersion = version
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
vuln.Affected = []database.AffectedFeature{
|
|
|
|
vuln.Affected = []database.AffectedFeature{
|
|
|
|
{
|
|
|
|
{
|
|
|
|
AffectedType: affectedType,
|
|
|
|
AffectedType: affectedType,
|
|
|
|
FeatureName: pkg.Name,
|
|
|
|
FeatureName: pkg.Pkg.Name,
|
|
|
|
AffectedVersion: version,
|
|
|
|
AffectedVersion: version,
|
|
|
|
FixedInVersion: fixedInVersion,
|
|
|
|
FixedInVersion: fixedInVersion,
|
|
|
|
Namespace: database.Namespace{
|
|
|
|
Namespace: database.Namespace{
|
|
|
|