gobinsec

package
v0.10.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 10, 2022 License: GPL-3.0 Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	MinimumBinaryDependencyFields = 3
	MinimumBinaryLines            = 3
)
View Source 
const (
	FileCacheDefaultFile       = "~/.gobinsec-cache.yml"
	FileCacheDefaultExpiration = 24 * time.Hour
)
View Source 
const (
	MemcachedDefaultTimeout    = 1 * time.Second
	MemcachedDefaultExpiration = 24 * time.Hour
)
View Source 
const (
	MemcachierDefaultTimeout    = 1 * time.Second
	MemcachierDefaultExpiration = 24 * time.Hour
)
View Source 
const (
	URL                  = "https://services.nvd.nist.gov/rest/json/cves/1.0/?keyword="
	StatusCodeLimit      = 300
	RateMinuteWithoutKey = 10
	RateMinuteWithKey    = 100
)
View Source 
const DateVersionTimeFormat = "2006-01-02"

DateVersionTimeFormat is the time format for date versions

View Source 
const PseudoVersionMinimumLength = 32
View Source 
const PseudoVersionTimeFormat = "20060102"

PseudoVersionTimeFormat is the time format for pseudo versions

Variables

View Source 
var (
	ColorRed   = color.New(color.FgRed).Add(color.Bold)
	ColorGreen = color.New(color.FgGreen).Add(color.Bold)
)
View Source 
var NumGoroutines = 4 * runtime.NumCPU()

NumGoroutines to load vulnerabilities

Functions

func BuildCache 

func BuildCache() error

BuildCache and open it

func ExecCommand 

func ExecCommand(name string, args ...string) (stdout, stderr string, err error)

ExecCommand runs command with given args and returns stdout, stderr and an error if any

func ExpandHome 

func ExpandHome(file string) string

ExpandHome expand ~ in file path with home directory

func FileExists 

func FileExists(file string) bool

FileExists tells if given file exists

func GetVersionTime 

func GetVersionTime(version interface{}) (*time.Time, error)

GetVersionTime extracts time from pseudo or date version

func LoadConfig 

func LoadConfig(path string, strict, wait, verbose, cache bool) error

LoadConfig loads configuration from given file and overwrite with command line options

func LoadVulnerabilities 

func LoadVulnerabilities(dependencies chan *Dependency, wg *sync.WaitGroup)

LoadVulnerabilities takes dependencies from channel and loads dependencies for it

func NewCache 

func NewCache() error

NewCache builds a cache instance depending on configuration and environment

func ParseDuration 

func ParseDuration(value string, def time.Duration) (time.Duration, error)

ParseDuration with default value

func WaitBeforeCall 

func WaitBeforeCall()

WaitBeforeCall waits in order not to exceed NVD call rate limit

Types

type Binary 

type Binary struct {
	Path         string        // path to binary file
	Dependencies []*Dependency // list of dependencies
	Vulnerable   bool          // tells if binary is vulnerable
}

Binary represents a binary with its dependencies

func NewBinary 

func NewBinary(path string) (*Binary, error)

NewBinary returns a binary

func (*Binary) GetDependencies 

func (b *Binary) GetDependencies() error

GetDependencies gets dependencies analyzing binary with buildinfo

func (*Binary) Report 

func (b *Binary) Report()

Report prints a report on terminal nolint:gocyclo // this is life

type CVE 

type CVE struct {
	Metadata   Metadata  `json:"CVE_data_meta"`
	References Reference `json:"references"`
}

type Cache 

type Cache interface {
	Name() string
	Get(d *Dependency) ([]byte, error)
	Set(d *Dependency, v []byte) error
	Open() error
	Close() error
}

Cache is the interface for caching 

var CacheInstance Cache

func NewFileCache 

func NewFileCache(config *FileConfig) (Cache, error)

NewFileCache builds a cache using file

func NewMemcachedCache 

func NewMemcachedCache(config *MemcachedConfig) (Cache, error)

NewMemcachedCache builds a memcached cache

func NewMemcachierCache 

func NewMemcachierCache(config *MemcachierConfig) (Cache, error)

NewMemcachierCache builds a Memcachier cache

type CacheLogger 

type CacheLogger struct {
	Cache Cache
}

CacheLogger logs cache calls on embedded cache

func NewCacheLogger 

func NewCacheLogger(cache Cache) *CacheLogger

NewCacheLogger returns a cache logger embedding a cache

func (*CacheLogger) Close 

func (c *CacheLogger) Close() error

Close does nothing

func (*CacheLogger) Get 

func (c *CacheLogger) Get(d *Dependency) ([]byte, error)

Get calls embedded cache and logs result

func (*CacheLogger) Name 

func (c *CacheLogger) Name() string

Name return embedded cache name

func (*CacheLogger) Open 

func (c *CacheLogger) Open() error

Open prints an information message on terminal

func (*CacheLogger) Set 

func (c *CacheLogger) Set(d *Dependency, v []byte) error

Set calls embedded cache and logs call

type Config 

type Config struct {
	APIKey     string            `yaml:"api-key"`
	Memcached  *MemcachedConfig  `yaml:"memcached"`
	Memcachier *MemcachierConfig `yaml:"memcachier"`
	File       *FileConfig       `yaml:"file"`
	Ignore     []string          `yaml:"ignore"`
	Strict     bool              `yaml:"strict"`
	Verbose    bool              `yaml:"verbose"`
	Cache      bool              `yaml:"cache"`
	Wait       bool              `yaml:"wait"`
}

Config is the configuration from YAML config file and command line options

func (*Config) IgnoreVulnerability 

func (c *Config) IgnoreVulnerability(id string) bool

IgnoreVulnerability tells if we should ignore given vulnerability

type Configurations 

type Configurations struct {
	Nodes []Node `json:"nodes"`
}

type DateVersion 

type DateVersion struct {
	Text string
	Date time.Time
}

DateVersion for dependencies that don't have a version

func NewDateVersion 

func NewDateVersion(text string) (*DateVersion, error)

NewDateVersion builds a date version from string

func (*DateVersion) Compare 

func (version *DateVersion) Compare(o interface{}) (int, error)

Compare two date versions by time

func (*DateVersion) String 

func (version *DateVersion) String() string

String returns a string representation for date version

type Dependency 

type Dependency struct {
	Name            string
	Version         Version
	Vulnerabilities []Vulnerability
	Vulnerable      bool
}

Dependency is a dependency with vulnerabilities

func NewDependency 

func NewDependency(name, version string) (*Dependency, error)

NewDependency builds a new dependency and loads its vulnerabilities

func (*Dependency) Key 

func (d *Dependency) Key() string

Key returns a key as a string for caching

func (*Dependency) LoadVulnerabilities 

func (d *Dependency) LoadVulnerabilities() error

Vulnerabilities return list of vulnerabilities for given dependency

type DependencyCache 

type DependencyCache struct {
	Date            string
	Vulnerabilities string
}

DependencyCache is an entry of dependency cache

type FileCache 

type FileCache struct {
	File       string
	Expiration time.Duration
	Cache      map[string]DependencyCache
}

FileCache is the cache instance

func (*FileCache) CleanCache 

func (fc *FileCache) CleanCache()

CleanCache removes obsolete cache entries

func (*FileCache) Close 

func (fc *FileCache) Close() error

Close saves cache in file

func (*FileCache) Get 

func (fc *FileCache) Get(d *Dependency) ([]byte, error)

Get returns NVD response for given dependency

func (*FileCache) Name 

func (fc *FileCache) Name() string

Name returns the name of this cache

func (*FileCache) Open 

func (fc *FileCache) Open() error

Open and load file cache if exists

func (*FileCache) Set 

func (fc *FileCache) Set(d *Dependency, v []byte) error

Set put NVD response for given dependency in cache

type FileConfig 

type FileConfig struct {
	File       string        `yaml:"name"`
	Expiration time.Duration `yaml:"expiration"`
}

FileConfig is the configuration for file cache

func NewFileConfig 

func NewFileConfig(config *FileConfig) (*FileConfig, error)

NewFileConfig builds configuration for file cache

type Item 

type Item struct {
	CVE            CVE            `json:"cve"`
	Configurations Configurations `json:"configurations"`
}

type Match 

type Match struct {
	Vulnerable            bool   `json:"vulnerable"`
	VersionStartExcluding string `json:"versionStartExcluding"`
	VersionStartIncluding string `json:"versionStartIncluding"`
	VersionEndExcluding   string `json:"versionEndExcluding"`
	VersionEndIncluding   string `json:"versionEndIncluding"`
}

type MemcachedClient 

type MemcachedClient struct {
	Client     *memcache.Client
	Expiration time.Duration
}

MemcachedClient is the Cache using memcached

func (*MemcachedClient) Close 

func (mc *MemcachedClient) Close() error

Clean does nothing

func (*MemcachedClient) Get 

func (mc *MemcachedClient) Get(d *Dependency) ([]byte, error)

Get returns NVD response for given dependency

func (*MemcachedClient) Name 

func (mc *MemcachedClient) Name() string

Name returns the name of this cache

func (*MemcachedClient) Open 

func (mc *MemcachedClient) Open() error

Ping calls memcached

func (*MemcachedClient) Set 

func (mc *MemcachedClient) Set(d *Dependency, v []byte) error

Set put NVD response for given dependency in cache

type MemcachedConfig 

type MemcachedConfig struct {
	Address    string        `yaml:"address"`
	Timeout    time.Duration `yaml:"timeout"`
	Expiration time.Duration `yaml:"expiration"`
}

MemcachedConfig is the configuration for memcached

func NewMemcachedConfig 

func NewMemcachedConfig(config *MemcachedConfig) (*MemcachedConfig, error)

NewMemcachedConfig returns configuration

type MemcachierClient 

type MemcachierClient struct {
	Client     *memcache.Client
	Expiration time.Duration
}

MemcachierClient is the Cache using Memcachier

func (*MemcachierClient) Close 

func (mc *MemcachierClient) Close() error

Clean does nothing

func (*MemcachierClient) Get 

func (mc *MemcachierClient) Get(d *Dependency) ([]byte, error)

Get returns NVD response for given dependency

func (*MemcachierClient) Name 

func (mc *MemcachierClient) Name() string

Name returns the name of this cache

func (*MemcachierClient) Open 

func (mc *MemcachierClient) Open() error

Ping calls Memcachier

func (*MemcachierClient) Set 

func (mc *MemcachierClient) Set(d *Dependency, v []byte) error

Set put NVD response for given dependency in cache

type MemcachierConfig 

type MemcachierConfig struct {
	Address    string        `yaml:"address"`
	Username   string        `yaml:"username"`
	Password   string        `yaml:"password"`
	Timeout    time.Duration `yaml:"timeout"`
	Expiration time.Duration `yaml:"expiration"`
}

MemcachierConfig is the configuration for Memcachier

func NewMemcachierConfig 

func NewMemcachierConfig(config *MemcachierConfig) (*MemcachierConfig, error)

NewMemcachierConfig returns configuration

type Metadata 

type Metadata struct {
	ID string `json:"ID"`
}

type Node 

type Node struct {
	Operator string  `json:"operator"`
	Match    []Match `json:"cpe_match"`
}

type PseudoVersion 

type PseudoVersion struct {
	Text string
	Date time.Time
}

PseudoVersion for dependencies that don't have a version. Its string representation is something like "v0.0.0-20191109021931-daa7c04131f5" with time and commit ID

func NewPseudoVersion 

func NewPseudoVersion(text string) (*PseudoVersion, error)

NewPseudoVersion builds a pseudo version from string

func (*PseudoVersion) Compare 

func (version *PseudoVersion) Compare(o interface{}) (int, error)

Compare two pseudo versions by time

func (*PseudoVersion) String 

func (version *PseudoVersion) String() string

String returns a string representation for pseudo version

type Reference 

type Reference struct {
	ReferenceData []ReferenceData `json:"reference_data"`
}

type ReferenceData 

type ReferenceData struct {
	URL string `json:"url"`
}

type Response 

type Response struct {
	ResultsPerPage int    `json:"resultsPerPage"`
	StartIndex     int    `json:"startIndex"`
	TotalResults   int    `json:"totalResults"`
	Result         Result `json:"result"`
}

type Result 

type Result struct {
	Items []Item `json:"CVE_Items"`
}

type SemanticVersion 

type SemanticVersion struct {
	Text   string
	Fields [3]int
}

SemanticVersion is type to represent a semantic version

func NewSemanticVersion 

func NewSemanticVersion(text string) (*SemanticVersion, error)

NewSemanticVersion builds a version from string

func (*SemanticVersion) Compare 

func (version *SemanticVersion) Compare(other interface{}) (int, error)

Compare two semantic versions s and o: - if s < o : returns -1 - if s > o : returns +1 - if s = o : returns 0

func (*SemanticVersion) String 

func (version *SemanticVersion) String() string

String returns string representation of version

type UnknownVersion 

type UnknownVersion string

func NewUnknownVersion 

func NewUnknownVersion(version string) *UnknownVersion

func (*UnknownVersion) Compare 

func (version *UnknownVersion) Compare(other interface{}) (int, error)

func (*UnknownVersion) String 

func (version *UnknownVersion) String() string

type Version 

type Version interface {
	String() string
	Compare(o interface{}) (int, error)
}

Version is definition of a version

func NewVersion 

func NewVersion(version string) Version

NewVersion from string

type Vulnerability 

type Vulnerability struct {
	ID         string               // CVE ID
	References []string             // Reference URL
	Matchs     []VulnerabilityMatch // version matching
	Exposed    bool                 // tells if this vulnerability is exposed
	Ignored    bool                 // tells id this vulnerability is ignored
}

Vulnerability for a vulnerability

func NewVulnerability 

func NewVulnerability(item Item) (*Vulnerability, error)

NewVulnerability builds a vulnerability from NVD call result

func (*Vulnerability) IsExposed 

func (v *Vulnerability) IsExposed(version Version) bool

IsExposed tells if given version matchs vulnerability

type VulnerabilityMatch 

type VulnerabilityMatch struct {
	VersionStartExcluding Version
	VersionStartIncluding Version
	VersionEndExcluding   Version
	VersionEndIncluding   Version
}

VulnerabilityMatch are version constraints for vulnerability

func NewVulnerabilityMatch 

func NewVulnerabilityMatch(m Match) (*VulnerabilityMatch, error)

NewVulnerabilityMatch return a version match

func (*VulnerabilityMatch) Equal 

func (m *VulnerabilityMatch) Equal(o VulnerabilityMatch) bool

Equal tells if matchs equal

func (*VulnerabilityMatch) InList 

func (m *VulnerabilityMatch) InList(matchs []VulnerabilityMatch) bool

InList tells if match in given list

func (*VulnerabilityMatch) Match 

func (m *VulnerabilityMatch) Match(v Version) bool

Match tells if given version matches (so that it is affected by vulnerability) nolint:gocyclo // this is life

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.