cvefeed

Documentation

Overview

Package cvefeed provides an API to NVD CVE feeds parsing and matching.

Index

• func Match(inventory []*wfn.Attributes, rules []LogicalTest, requireVersion bool) ([]*wfn.Attributes, bool)
• type CVEItem
  • func ParseJSON(in io.Reader) ([]CVEItem, error)
  • func ParseXML(in io.Reader) ([]CVEItem, error)
• type Cache
  • func NewCache(dict Dictionary) *Cache
  • func (c *Cache) Get(cpes []*wfn.Attributes) []MatchResult
  • func (c *Cache) SetMaxSize(size int64) *Cache
  • func (c *Cache) SetRequireVersion(requireVersion bool) *Cache
• type Dictionary
  • func LoadFeed(loadFunc func(string) ([]CVEItem, error), paths ...string) (Dictionary, error)
  • func LoadJSONDictionary(paths ...string) (Dictionary, error)
  • func LoadXMLDictionary(paths ...string) (Dictionary, error)
  • func (d *Dictionary) Override(d2 Dictionary)
• type Index
  • func NewIndex(d Dictionary) Index
• type LogicalTest
• type MatchResult

Functions

func Match

func Match(inventory []*wfn.Attributes, rules []LogicalTest, requireVersion bool) ([]*wfn.Attributes, bool)

Match matches list of software in inventory to a number of rules; returns the CPE names that matched and the boolean result of the match. If requireVersion is true, the function ignores rules with no Version attribute.

Types

type CVEItem

type CVEItem = nvdcommon.CVEItem

CVEItem is an interface that provides access to CVE data from vulnerability feed

type CVEItem interface {
	CVE() string
	Configuration() []LogicalTest
}

func ParseJSON

func ParseJSON(in io.Reader) ([]CVEItem, error)

ParseJSON loads CVE feed from JSON

func ParseXML

func ParseXML(in io.Reader) ([]CVEItem, error)

ParseXML loads CVE feed from XML

type Cache

type Cache struct {
	Dict           Dictionary
	Idx            Index
	RequireVersion bool  // ignore matching specifications that have Version == ANY
	MaxSize        int64 // maximum size of the cache, 0 -- unlimited, -1 -- no caching
	// contains filtered or unexported fields
}

Cache caches CVEs for known CPEs

func NewCache

func NewCache(dict Dictionary) *Cache

NewCache creates new Cache instance with dictionary dict.

func (*Cache) Get

func (c *Cache) Get(cpes []*wfn.Attributes) []MatchResult

Get returns slice of CVEs for CPE names from cpes parameter; if CVEs aren't cached (and the feature is enabled) it finds them in cveDict and caches the results

func (*Cache) SetMaxSize

func (c *Cache) SetMaxSize(size int64) *Cache

SetMaxSize sets maximum size of the cache to some pre-defined value, size of 0 disables eviction (makes the cache grow indefinitely), negative size disables caching. Returns a pointer to the instance of Cache, for easy chaining.

func (*Cache) SetRequireVersion

func (c *Cache) SetRequireVersion(requireVersion bool) *Cache

SetRequireVersion sets if the instance of cache fails matching the dictionary records without Version attribute of CPE name. Returns a pointer to the instance of Cache, for easy chaining.

type Dictionary

type Dictionary map[string]CVEItem

Dictionary is a slice of entries

func LoadFeed

func LoadFeed(loadFunc func(string) ([]CVEItem, error), paths ...string) (Dictionary, error)

LoadFeed calls loadFunc for each file in paths and returns the combined outputs in a Dictionary.

func LoadJSONDictionary

func LoadJSONDictionary(paths ...string) (Dictionary, error)

LoadJSONDictionary parses dictionary from multiple NVD vulenrability feed JSON files

func LoadXMLDictionary

func LoadXMLDictionary(paths ...string) (Dictionary, error)

LoadXMLDictionary parses dictionary from multiple NVD vulenrability feed XML files

func (*Dictionary) Override

func (d *Dictionary) Override(d2 Dictionary)

Override amends entries in Dictionary with configurations from Dictionary d2; CVE will be matched if it matches the original config of d and does not match the config of d2.

type Index

type Index map[string][]CVEItem

Index maps the CPEs to the entries in the NVD feed they mentioned in

func NewIndex

func NewIndex(d Dictionary) Index

NewIndex creates new Index from a slice of CVE entries

type LogicalTest

type LogicalTest = nvdcommon.LogicalTest

LogicalTest describes logical test performed during matching

type LogicalTest interface {
	LogicalOperator() string // "and", "or", "eq"
	NegateIfNeeded(bool) bool
	InnerTests() []LogicalTest
	MatchPlatform(platform *wfn.Attributes, requireVersion bool) bool
	CPEs() []*wfn.Attributes
}

type MatchResult

type MatchResult struct {
	CVE  CVEItem
	CPEs []*wfn.Attributes
}

MatchResult stores CVE and a slice of CPEs that matched it