/
db.go
173 lines (140 loc) · 4.1 KB
/
db.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
package vulndb
import (
"log"
"time"
bolt "go.etcd.io/bbolt"
"golang.org/x/xerrors"
"k8s.io/utils/clock"
"github.com/khulnasoft-lab/vul-db/pkg/db"
"github.com/khulnasoft-lab/vul-db/pkg/metadata"
"github.com/khulnasoft-lab/vul-db/pkg/types"
"github.com/khulnasoft-lab/vul-db/pkg/vulnsrc"
"github.com/khulnasoft-lab/vul-db/pkg/vulnsrc/vulnerability"
)
type VulnDB interface {
Build(targets []string) error
}
type VulDB struct {
dbc db.Config
metadata metadata.Client
vulnClient vulnerability.Vulnerability
vulnSrcs map[types.SourceID]vulnsrc.VulnSrc
cacheDir string
updateInterval time.Duration
clock clock.Clock
}
type Option func(*VulDB)
func WithClock(clock clock.Clock) Option {
return func(core *VulDB) {
core.clock = clock
}
}
func WithVulnSrcs(srcs map[types.SourceID]vulnsrc.VulnSrc) Option {
return func(core *VulDB) {
core.vulnSrcs = srcs
}
}
func New(cacheDir string, updateInterval time.Duration, opts ...Option) *VulDB {
// Initialize map
vulnSrcs := map[types.SourceID]vulnsrc.VulnSrc{}
for _, v := range vulnsrc.All {
vulnSrcs[v.Name()] = v
}
dbc := db.Config{}
tdb := &VulDB{
dbc: dbc,
metadata: metadata.NewClient(cacheDir),
vulnClient: vulnerability.New(dbc),
vulnSrcs: vulnSrcs,
cacheDir: cacheDir,
updateInterval: updateInterval,
clock: clock.RealClock{},
}
for _, opt := range opts {
opt(tdb)
}
return tdb
}
func (t VulDB) Insert(targets []string) error {
log.Println("Updating vulnerability database...")
for _, target := range targets {
src, ok := t.vulnSrc(target)
if !ok {
return xerrors.Errorf("%s is not supported", target)
}
log.Printf("Updating %s data...\n", target)
if err := src.Update(t.cacheDir); err != nil {
return xerrors.Errorf("%s update error: %w", target, err)
}
}
md := metadata.Metadata{
Version: db.SchemaVersion,
NextUpdate: t.clock.Now().UTC().Add(t.updateInterval),
UpdatedAt: t.clock.Now().UTC(),
}
if err := t.metadata.Update(md); err != nil {
return xerrors.Errorf("metadata update error: %w", err)
}
return nil
}
func (t VulDB) Build(targets []string) error {
// Insert all security advisories
if err := t.Insert(targets); err != nil {
return xerrors.Errorf("insert error: %w", err)
}
// Remove unnecessary details
if err := t.optimize(); err != nil {
return xerrors.Errorf("optimize error: %w", err)
}
// Remove unnecessary buckets
if err := t.cleanup(); err != nil {
return xerrors.Errorf("cleanup error: %w", err)
}
return nil
}
func (t VulDB) vulnSrc(target string) (vulnsrc.VulnSrc, bool) {
for _, src := range t.vulnSrcs {
if target == string(src.Name()) {
return src, true
}
}
return nil, false
}
func (t VulDB) optimize() error {
// NVD also contains many vulnerabilities that are not related to OS packages or language-specific packages.
// Vul DB will not store them so that it could reduce the database size.
// This bucket has only vulnerability IDs provided by vendors. They must be stored.
err := t.dbc.ForEachVulnerabilityID(func(tx *bolt.Tx, cveID string) error {
details := t.vulnClient.GetDetails(cveID)
if t.vulnClient.IsRejected(details) {
return nil
}
if err := t.dbc.SaveAdvisoryDetails(tx, cveID); err != nil {
return xerrors.Errorf("failed to save advisories: %w", err)
}
if len(details) == 0 {
return nil
}
vuln := t.vulnClient.Normalize(details)
if err := t.dbc.PutVulnerability(tx, cveID, vuln); err != nil {
return xerrors.Errorf("failed to put vulnerability: %w", err)
}
return nil
})
if err != nil {
return xerrors.Errorf("failed to iterate severity: %w", err)
}
return nil
}
func (t VulDB) cleanup() error {
if err := t.dbc.DeleteVulnerabilityIDBucket(); err != nil {
return xerrors.Errorf("failed to delete severity bucket: %w", err)
}
if err := t.dbc.DeleteVulnerabilityDetailBucket(); err != nil {
return xerrors.Errorf("failed to delete vulnerability detail bucket: %w", err)
}
if err := t.dbc.DeleteAdvisoryDetailBucket(); err != nil {
return xerrors.Errorf("failed to delete advisory detail bucket: %w", err)
}
return nil
}