cvefeed

Documentation

Overview

Package cvefeed defines types and methods necessary to parse NVD vulnerability feed and match an inventory of CPE names against it.

Copyright (c) Facebook, Inc. and its affiliates.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

• func Match(inventory []*wfn.Attributes, rules []LogicalTest, requireVersion bool) ([]*wfn.Attributes, bool)
• type CVEItem
  • func ParseJSON(in io.Reader) ([]CVEItem, error)
  • func ParseXML(in io.Reader) ([]CVEItem, error)
• type Cache
  • func NewCache(dict Dictionary) *Cache
  • func (c *Cache) Get(cpes []*wfn.Attributes) []MatchResult
  • func (c *Cache) SetMaxSize(size int) *Cache
  • func (c *Cache) SetRequireVersion(requireVersion bool) *Cache
• type Dictionary
  • func LoadJSONDictionary(paths ...string) (Dictionary, error)
  • func LoadXMLDictionary(paths ...string) (Dictionary, error)
• type Index
  • func NewIndex(d Dictionary) Index
• type LogicalTest
• type MatchResult

Functions

func Match

func Match(inventory []*wfn.Attributes, rules []LogicalTest, requireVersion bool) ([]*wfn.Attributes, bool)

Match matches list of software in inventory to a number of rules; returns the CPE names that matched and the boolean result of the match. If requireVersion is true, the function ignores rules with no Version attribute.

Types

type CVEItem

type CVEItem = iface.CVEItem

CVEItem is an interface that provides access to CVE data from vulnerability feed

type CVEItem interface {
	CVE() string
	Configuration() []LogicalTest
}

func ParseJSON

func ParseJSON(in io.Reader) ([]CVEItem, error)

ParseJSON loads CVE feed from JSON

func ParseXML

func ParseXML(in io.Reader) ([]CVEItem, error)

ParseXML loads CVE feed from XML

type Cache

type Cache struct {
	Dict           Dictionary
	Idx            Index
	RequireVersion bool // ignore matching specifications that have Version == ANY
	MaxSize        int  // maximum size of the cache, 0 -- unlimited, -1 -- no caching
	// contains filtered or unexported fields
}

Cache caches CVEs for known CPEs

func NewCache

func NewCache(dict Dictionary) *Cache

NewCache creates new Cache instance with dictionary dict.

func (*Cache) Get

func (c *Cache) Get(cpes []*wfn.Attributes) []MatchResult

Get returns slice of CVEs for CPE names from cpes parameter; if CVEs aren't cached (and the feature is enabled) it finds them in cveDict and caches the results

func (*Cache) SetMaxSize

func (c *Cache) SetMaxSize(size int) *Cache

SetMaxSize sets maximum size of the cache to some pre-defined value, size of 0 disables eviction (makes the cache grow indefinitely), negative size disables caching. Returns a pointer to the instance of Cache, for easy chaining.

func (*Cache) SetRequireVersion

func (c *Cache) SetRequireVersion(requireVersion bool) *Cache

SetRequireVersion sets if the instance of cache fails matching the dictionary records without Version attribute of CPE name. Returns a pointer to the instance of Cache, for easy chaining.

type Dictionary

type Dictionary = []CVEItem

Dictionary is a slice of entries

func LoadJSONDictionary

func LoadJSONDictionary(paths ...string) (Dictionary, error)

LoadJSONDictionary parses dictionary from multiple NVD vulenrability feed JSON files

func LoadXMLDictionary

func LoadXMLDictionary(paths ...string) (Dictionary, error)

LoadXMLDictionary parses dictionary from multiple NVD vulenrability feed XML files

type Index

type Index map[string][]CVEItem

Index maps the CPEs to the entries in the NVD feed they mentioned in

func NewIndex

func NewIndex(d Dictionary) Index

NewIndex creates new Index from a slice of CVE entries

type LogicalTest

type LogicalTest = iface.LogicalTest

LogicalTest describes logical test performed during matching

type LogicalTest interface {
	LogicalOperator() string // "and", "or", "eq"
	NegateIfNeeded(bool) bool
	InnerTests() []LogicalTest
	MatchPlatform(platform *wfn.Attributes, requireVersion bool) bool
	CPEs() []*wfn.Attributes
}

type MatchResult

type MatchResult struct {
	CVE  string
	CPEs []*wfn.Attributes
}

MatchResult stores CVE and a slice of CPEs that matched it