Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(detector): standardize db.NewDB to db.CloseDB #1380

Merged
merged 8 commits into from
Feb 19, 2022

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Feb 4, 2022

What did you implement:

db.Close(), which was the cause of this issue(#1281), was handled differently in OVAL, gost, exploitdb, metasploitdb, and kevuln.
This time, we will refactor it so that all of them use the same method to get the client and close the DB.
Also, the method to determine whether it is a DB or HTTP is based on whether the driver, which is the minimum data, is nil or not. In addition, I decided to have only the URL to the dictionary (baseURL) so that it does not need to be as large as the config.

Fixes #1121
Duplicate PR #1272

In addition to refactoring the client around, I incorporated the following issue and PR content.
When there is no config.toml (configPath is ""), read environment variables and enable reporting.

Type of change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

$ OVALDB_SQLITE3_PATH="/usr/share/vuls-data/oval.sqlite3" GOSTDB_SQLITE3_PATH="/usr/share/vuls-data/gost.sqlite3" CVEDB_SQLITE3_PATH="/usr/share/vuls-data/cve.sqlite3" EXPLOITDB_SQLITE3_PATH="/usr/share/vuls-data/go-exploitdb.sqlite3" METASPLOITDB_SQLITE3_PATH="/usr/share/vuls-data/go-msfdb.sqlite3" KEVULN_SQLITE3_PATH="/usr/share/vuls-data/go-kev.sqlite3" go run cmd/vuls/main.go report -config "" -refresh-cve
[Feb  7 01:28:43]  INFO [localhost] vuls-`make build` or `make install` will show the version-
[Feb  7 01:28:43]  INFO [localhost] Validating config...
[Feb  7 01:28:43]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/usr/share/vuls-data/cve.sqlite3
[Feb  7 01:28:43]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/usr/share/vuls-data/oval.sqlite3
[Feb  7 01:28:43]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/usr/share/vuls-data/gost.sqlite3
[Feb  7 01:28:43]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/usr/share/vuls-data/go-exploitdb.sqlite3
[Feb  7 01:28:43]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/usr/share/vuls-data/go-msfdb.sqlite3
[Feb  7 01:28:43]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/usr/share/vuls-data/go-kev.sqlite3
[Feb  7 01:28:43]  INFO [localhost] Loaded: /home/mainek00n/github/github.com/MaineK00n/vuls/results/2022-02-07T01:10:16+09:00
[Feb  7 01:28:43]  INFO [localhost] OVAL debian 11.2 found. defs: 23046
[Feb  7 01:28:43]  INFO [localhost] OVAL debian 11.2 is fresh. lastModified: 2022-02-07T01:08:55+09:00
[Feb  7 01:28:44]  INFO [localhost] vuls-target: 0 CVEs are detected with OVAL
[Feb  7 01:28:45]  INFO [localhost] vuls-target: 203 CVEs are detected with gost
[Feb  7 01:28:45]  INFO [localhost] vuls-target: 0 CVEs are detected with CPE
[Feb  7 01:28:45]  INFO [localhost] vuls-target: 3 PoC are detected
[Feb  7 01:28:45]  INFO [localhost] vuls-target: 0 exploits are detected
[Feb  7 01:28:45]  INFO [localhost] vuls-target: total 203 CVEs detected
[Feb  7 01:28:45]  INFO [localhost] vuls-target: 0 CVEs filtered by --confidence-over=80
vuls-target (debian11.2)
========================
Total: 203 (Critical:15 High:64 Medium:89 Low:16 ?:19)
0/203 Fixed, 34 poc, 0 exploits, cisa: 0, uscert: 0, jpcert: 3 alerts
319 installed

$ OVALDB_SQLITE3_PATH="/usr/share/vuls-data/oval.sqlite3" GOSTDB_SQLITE3_PATH="/usr/share/vuls-data/gost.sqlite3" CVEDB_SQLITE3_PATH="/usr/share/vuls-data/cve.sqlite3" EXPLOITDB_SQLITE3_PATH="/usr/share/vuls-data/go-exploitdb.sqlite3" METASPLOITDB_SQLITE3_PATH="/usr/share/vuls-data/go-msfdb.sqlite3" KEVULN_SQLITE3_PATH="/usr/share/vuls-data/go-kev.sqlite3" go run cmd/vuls/main.go server -config ""
[Feb  7 01:23:26]  INFO [localhost] vuls-`make build` or `make install` will show the version-
[Feb  7 01:23:26]  INFO [localhost] Validating config...
[Feb  7 01:23:26]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/usr/share/vuls-data/cve.sqlite3
[Feb  7 01:23:26]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/usr/share/vuls-data/oval.sqlite3
[Feb  7 01:23:26]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/usr/share/vuls-data/gost.sqlite3
[Feb  7 01:23:26]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/usr/share/vuls-data/go-exploitdb.sqlite3
[Feb  7 01:23:26]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/usr/share/vuls-data/go-msfdb.sqlite3
[Feb  7 01:23:26]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/usr/share/vuls-data/go-kev.sqlite3
[Feb  7 01:23:26]  INFO [localhost] Listening on localhost:5515
[Feb  7 01:23:48]  INFO [localhost] OVAL debian 11.2 found. defs: 23046
[Feb  7 01:23:48]  INFO [localhost] OVAL debian 11.2 is fresh. lastModified: 2022-02-07T01:08:55+09:00
[Feb  7 01:23:49]  INFO [localhost] vuls-target: 0 CVEs are detected with OVAL
[Feb  7 01:23:50]  INFO [localhost] vuls-target: 203 CVEs are detected with gost
[Feb  7 01:23:50]  INFO [localhost] Fill CVE detailed with gost
[Feb  7 01:23:50]  INFO [localhost] Fill CVE detailed with CVE-DB
[Feb  7 01:23:50]  INFO [localhost] vuls-target: 3 PoC detected
[Feb  7 01:23:50]  INFO [localhost] vuls-target: 0 exploits are detected

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Feb 4, 2022
@MaineK00n MaineK00n force-pushed the MaineK00n/refactor-client branch 3 times, most recently from 8683981 to 1e2f542 Compare February 6, 2022 16:28
@MaineK00n MaineK00n marked this pull request as ready for review February 6, 2022 16:31
@MaineK00n MaineK00n force-pushed the MaineK00n/refactor-client branch 4 times, most recently from 00a592b to fb9c853 Compare February 15, 2022 20:46
@kotakanbe kotakanbe self-requested a review February 17, 2022 23:57
Copy link
Member

@kotakanbe kotakanbe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is one point that could be a nil pointer, so please fix it.

@MaineK00n MaineK00n force-pushed the MaineK00n/refactor-client branch from fb9c853 to 34e7a89 Compare February 18, 2022 03:52
@MaineK00n MaineK00n requested a review from kotakanbe February 18, 2022 03:53
@kotakanbe
Copy link
Member

Confirmed that make diff was successful.

@kotakanbe kotakanbe merged commit 7d8a24e into master Feb 19, 2022
@kotakanbe kotakanbe deleted the MaineK00n/refactor-client branch February 19, 2022 00:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Release v0.15.0 ???
2 participants