From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH v3 5/8] support/scripts: Add a per configuration CVE checker
Date: Fri, 28 Aug 2020 11:45:55 +0200 [thread overview]
Message-ID: <20200828114555.18c19e9c@windsurf.home> (raw)
In-Reply-To: <20200724154356.2607639-6-gregory.clement@bootlin.com>
Hello,
On Fri, 24 Jul 2020 17:43:53 +0200
Gregory CLEMENT <gregory.clement@bootlin.com> wrote:
> This scripts takes as entry on stdin a JSON description of the package
> used for a given configuration. This description is the one generated
> by "make show-info".
>
> The script generates the list of all the package used and if they are
> affected by a CVE. The output is either a JSON or an HTML file similar
> to the one generated by pkg-stats.
>
> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Thanks, I have applied to next, but after doing a number of changes,
see below.
> +import argparse
> +import datetime
> +import os
> +import json
> +import sys
> +
> +sys.path.append('utils/')
This was not needed.
> +
> +import cve as cvecheck
> +
> +class Package:
> + def __init__(self, name, version, ignored_cves):
> + self.name = name
> + self.version = version
> + self.cves = list()
> + self.ignored_cves = ignored_cves
> +
> +def check_package_cves(nvd_path, packages):
> + if not os.path.isdir(nvd_path):
> + os.makedirs(nvd_path)
> +
> + for cve in cvecheck.CVE.read_nvd_dir(nvd_path):
> + for pkg_name in cve.pkg_names:
> + pkg = packages.get(pkg_name, '')
> + if pkg and cve.affects(pkg.name, pkg.version, pkg.ignored_cves):
This was not correct as cve.affects() no longer returns a boolean. Due
to this, all existing CVEs were reported in the generated HTML/JSON as
affecting the package.
> + pkg.cves.append(cve.identifier)
> +
> +html_header = """
> +<head>
> +<script src=\"https://www.kryogenix.org/code/browser/sorttable/sorttable.js\"></script>
> +<style type=\"text/css\">
> +table {
> + width: 100%;
> +}
> +td {
> + border: 1px solid black;
> +}
> +td.centered {
> + text-align: center;
> +}
> +td.wrong {
> + background: #ff9a69;
> +}
> +td.correct {
> + background: #d2ffc4;
> +}
> +td.nopatches {
> + background: #d2ffc4;
> +}
> +td.somepatches {
> + background: #ffd870;
> +}
> +td.lotsofpatches {
> + background: #ff9a69;
> +}
> +
> +td.good_url {
> + background: #d2ffc4;
> +}
> +td.missing_url {
> + background: #ffd870;
> +}
> +td.invalid_url {
> + background: #ff9a69;
> +}
> +
> +td.version-good {
> + background: #d2ffc4;
> +}
> +td.version-needs-update {
> + background: #ff9a69;
> +}
> +td.version-unknown {
> + background: #ffd870;
> +}
> +td.version-error {
> + background: #ccc;
> +}
Lots of these CSS classes were not useful, so I dropped them.
> +
> +</style>
> +<title>CVE status for Buildroot packages</title>
Changed "Buildroot packages" for "Buildroot configuration". Indeed,
compared to pkg-stats which operates on all packages (it's a tool for
Buildroot maintenance), cve-checker is really about a given Buildroot
configuration.
> +def infra_str(infra_list):
This function was not used anywhere, so I dropped it.
> +def boolean_str(b):
This function was not used anywhere, so I dropped it.
> +def dump_json(packages, date, output):
> + # Format packages as a dictionnary instead of a list
> + # Exclude local field that does not contains real date
> + excluded_fields = ['url_worker', 'name']
> + pkgs = {
> + pkg.name: {
> + k: v
> + for k, v in pkg.__dict__.items()
> + if k not in excluded_fields
> + } for pkg in packages
I simplified that a bit, as we don't want all fields in the JSON I
believe, just the version and list of CVEs. For example, the list of
ignored CVEs is not really relevant.
> +
> +def parse_args():
> + parser = argparse.ArgumentParser()
> + output = parser.add_argument_group('output', 'Output file(s)')
> + output.add_argument('--html', dest='html', type=resolvepath,
> + help='HTML output file')
> + output.add_argument('--json', dest='json', type=resolvepath,
> + help='JSON output file')
> + packages = parser.add_mutually_exclusive_group()
This line was not used.
> + parser.add_argument('--nvd-path', dest='nvd_path',
> + help='Path to the local NVD database',type=resolvepath,
> + default='./nvd_dl')
The default value doesn't exist for pkg-stats, I'm not sure it makes
sense to have a default value. I've however added a required=True
because this script doesn't do anything useful if we don't have access
to the NVD data.
> +def __main__():
> + packages = list()
> + exclude_pacakges = ["linux", "gcc"]
I'm not sure why those two packages were excluded, so I've dropped
that, at least for now. We can of course improve things later on.
> + content = json.load(sys.stdin)
> + for item in content:
> + if item in exclude_pacakges:
> + continue
> + pkg = content[item]
> + p = Package(item, pkg.get('version', ''), pkg.get('ignore_cves', ''))
> + packages.append(p)
> +
> + args = parse_args()
> + date = datetime.datetime.utcnow()
> +
> + if args.nvd_path:
I've dropped this "if", since args.nvd_path is a required option.
As said above: applied to next with all those changes. Thanks!
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
next prev parent reply other threads:[~2020-08-28 9:45 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-24 15:43 [Buildroot] [PATCH v3 0/8] Improving CVE reporting Gregory CLEMENT
2020-07-24 15:43 ` [Buildroot] [PATCH v3 1/8] support/scripts: Turn CVE check into a module Gregory CLEMENT
2020-08-28 7:18 ` Thomas Petazzoni
2020-07-24 15:43 ` [Buildroot] [PATCH v3 2/8] support/scripts/cve.py: Switch to JSON 1.1 Gregory CLEMENT
2020-08-28 7:34 ` Thomas Petazzoni
2020-07-24 15:43 ` [Buildroot] [PATCH v3 3/8] package/pkg-utils: show-info: report the list of the CVEs ignored Gregory CLEMENT
2020-08-28 8:51 ` Thomas Petazzoni
2020-07-24 15:43 ` [Buildroot] [PATCH v3 4/8] support/script: Make CVE class independent of the Pacakage class Gregory CLEMENT
2020-08-28 9:03 ` Thomas Petazzoni
2020-07-24 15:43 ` [Buildroot] [PATCH v3 5/8] support/scripts: Add a per configuration CVE checker Gregory CLEMENT
2020-07-29 18:03 ` Matthew Weber
2020-08-28 9:45 ` Thomas Petazzoni [this message]
2020-07-24 15:43 ` [Buildroot] [PATCH v3 6/8] support/script/pkg-stats: Manage the CVEs that need to be check Gregory CLEMENT
2020-07-24 15:43 ` [Buildroot] [PATCH v3 7/8] support/script/cve-checker: " Gregory CLEMENT
2020-07-24 15:43 ` [Buildroot] [PATCH v3 8/8] package/pkg-utils/cve.py: Manage case when package version doesn't exist Gregory CLEMENT
2020-07-28 7:52 ` [Buildroot] [PATCH v3 0/8] Improving CVE reporting Thomas Petazzoni
2020-07-28 22:07 ` Titouan Christophe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200828114555.18c19e9c@windsurf.home \
--to=thomas.petazzoni@bootlin.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox