update trivy, and unsupport image scanning feature (#971)
* update trivy, fanal. unsupport image scanning * Update models/library.go Co-authored-by: Teppei Fukuda <teppei@elab.ic.i.u-tokyo.ac.jp> * add -no-progress flag to report/tui cmd * Display trivy vuln info to tui/report * add detection method to vulninfo detected by trivy * fix(uuid): change uuid lib to go-uuid #929 (#969) * update trivy, fanal. unsupport image scanning * Update models/library.go Co-authored-by: Teppei Fukuda <teppei@elab.ic.i.u-tokyo.ac.jp> * add -no-progress flag to report/tui cmd * Display trivy vuln info to tui/report * add detection method to vulninfo detected by trivy * unique ref links in TUI * download trivy DB only when lock file is specified in config.toml Co-authored-by: Teppei Fukuda <teppei@elab.ic.i.u-tokyo.ac.jp>
This commit is contained in:
Kota Kanbe
@@ -416,12 +416,6 @@ func (l *base) convertToModel() models.ScanResult {
|
||||
Type: ctype,
|
||||
}
|
||||
|
||||
image := models.Image{
|
||||
Name: l.ServerInfo.Image.Name,
|
||||
Tag: l.ServerInfo.Image.Tag,
|
||||
Digest: l.ServerInfo.Image.Digest,
|
||||
}
|
||||
|
||||
errs, warns := []string{}, []string{}
|
||||
for _, e := range l.errs {
|
||||
errs = append(errs, fmt.Sprintf("%+v", e))
|
||||
@@ -445,7 +439,6 @@ func (l *base) convertToModel() models.ScanResult {
|
||||
Family: l.Distro.Family,
|
||||
Release: l.Distro.Release,
|
||||
Container: container,
|
||||
Image: image,
|
||||
Platform: l.Platform,
|
||||
IPv4Addrs: l.ServerInfo.IPv4Addrs,
|
||||
IPv6Addrs: l.ServerInfo.IPv6Addrs,
|
||||
|
||||
@@ -1,224 +0,0 @@
|
||||
package scan
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aquasecurity/fanal/analyzer"
|
||||
"github.com/aquasecurity/fanal/cache"
|
||||
"github.com/aquasecurity/fanal/extractor/docker"
|
||||
"github.com/aquasecurity/fanal/utils"
|
||||
"golang.org/x/xerrors"
|
||||
|
||||
fanalos "github.com/aquasecurity/fanal/analyzer/os"
|
||||
godeptypes "github.com/aquasecurity/go-dep-parser/pkg/types"
|
||||
"github.com/future-architect/vuls/config"
|
||||
"github.com/future-architect/vuls/models"
|
||||
"github.com/future-architect/vuls/util"
|
||||
|
||||
// Register library analyzers
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/bundler"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/cargo"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/composer"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/npm"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/pipenv"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/poetry"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/library/yarn"
|
||||
|
||||
// Register os analyzers
|
||||
_ "github.com/aquasecurity/fanal/analyzer/os/alpine"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/os/amazonlinux"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/os/debianbase"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/os/redhatbase"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/os/suse"
|
||||
|
||||
// Register package analyzers
|
||||
_ "github.com/aquasecurity/fanal/analyzer/pkg/apk"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/pkg/dpkg"
|
||||
_ "github.com/aquasecurity/fanal/analyzer/pkg/rpmcmd"
|
||||
)
|
||||
|
||||
// inherit OsTypeInterface
|
||||
type image struct {
|
||||
base
|
||||
}
|
||||
|
||||
// newDummyOS is constructor
|
||||
func newDummyOS(c config.ServerInfo) *image {
|
||||
d := &image{
|
||||
base: base{
|
||||
osPackages: osPackages{
|
||||
Packages: models.Packages{},
|
||||
VulnInfos: models.VulnInfos{},
|
||||
},
|
||||
},
|
||||
}
|
||||
d.log = util.NewCustomLogger(c)
|
||||
d.setServerInfo(c)
|
||||
return d
|
||||
}
|
||||
|
||||
func detectContainerImage(c config.ServerInfo) (itsMe bool, containerImage osTypeInterface, err error) {
|
||||
if err = config.IsValidImage(c.Image); err != nil {
|
||||
return false, nil, nil
|
||||
}
|
||||
|
||||
os, pkgs, libs, err := scanImage(c)
|
||||
if err != nil {
|
||||
// use Alpine for setErrs
|
||||
return false, newDummyOS(c), err
|
||||
}
|
||||
switch os.Family {
|
||||
case fanalos.OpenSUSELeap, fanalos.OpenSUSETumbleweed, fanalos.OpenSUSE:
|
||||
return false, newDummyOS(c), xerrors.Errorf("Unsupported OS : %s", os.Family)
|
||||
}
|
||||
|
||||
libScanners, err := convertLibWithScanner(libs)
|
||||
if err != nil {
|
||||
return false, newDummyOS(c), err
|
||||
}
|
||||
|
||||
osName := os.Name
|
||||
switch os.Family {
|
||||
case fanalos.Amazon:
|
||||
osName = "1"
|
||||
if strings.HasPrefix(os.Family, "2") {
|
||||
osName = "2"
|
||||
}
|
||||
}
|
||||
p := newContainerImage(c, pkgs, libScanners)
|
||||
p.setDistro(os.Family, osName)
|
||||
return true, p, nil
|
||||
}
|
||||
|
||||
func convertLibWithScanner(libs map[analyzer.FilePath][]godeptypes.Library) ([]models.LibraryScanner, error) {
|
||||
scanners := []models.LibraryScanner{}
|
||||
for path, pkgs := range libs {
|
||||
scanners = append(scanners, models.LibraryScanner{Path: string(path), Libs: pkgs})
|
||||
}
|
||||
return scanners, nil
|
||||
}
|
||||
|
||||
// scanImage returns os, packages on image layers
|
||||
func scanImage(c config.ServerInfo) (os *analyzer.OS, pkgs []analyzer.Package, libs map[analyzer.FilePath][]godeptypes.Library, err error) {
|
||||
|
||||
ctx := context.Background()
|
||||
domain := c.Image.GetFullName()
|
||||
util.Log.Info("Start fetch container... ", domain)
|
||||
|
||||
fanalCache := cache.Initialize(utils.CacheDir())
|
||||
// Configure dockerOption
|
||||
dockerOption := c.Image.DockerOption
|
||||
if dockerOption.Timeout == 0 {
|
||||
dockerOption.Timeout = 60 * time.Second
|
||||
}
|
||||
ext, err := docker.NewDockerExtractor(dockerOption, fanalCache)
|
||||
if err != nil {
|
||||
return nil, nil, nil, xerrors.Errorf("Failed initialize docker extractor%w", err)
|
||||
}
|
||||
ac := analyzer.Config{Extractor: ext}
|
||||
files, err := ac.Analyze(ctx, domain, dockerOption)
|
||||
|
||||
if err != nil {
|
||||
return nil, nil, nil, xerrors.Errorf("Failed scan files %q, %w", domain, err)
|
||||
}
|
||||
|
||||
containerOs, err := analyzer.GetOS(files)
|
||||
if err != nil {
|
||||
return nil, nil, nil, xerrors.Errorf("Failed scan os %q, %w", domain, err)
|
||||
}
|
||||
|
||||
pkgs, err = analyzer.GetPackages(files)
|
||||
if err != nil {
|
||||
return nil, nil, nil, xerrors.Errorf("Failed scan pkgs %q, %w", domain, err)
|
||||
}
|
||||
libs, err = analyzer.GetLibraries(files)
|
||||
if err != nil {
|
||||
return nil, nil, nil, xerrors.Errorf("Failed scan libs %q, %w", domain, err)
|
||||
}
|
||||
return &containerOs, pkgs, libs, nil
|
||||
}
|
||||
|
||||
func convertFanalToVulsPkg(pkgs []analyzer.Package) (map[string]models.Package, map[string]models.SrcPackage) {
|
||||
modelPkgs := map[string]models.Package{}
|
||||
modelSrcPkgs := map[string]models.SrcPackage{}
|
||||
for _, pkg := range pkgs {
|
||||
version := pkg.Version
|
||||
if pkg.Epoch != 0 {
|
||||
version = fmt.Sprintf("%d:%s", pkg.Epoch, pkg.Version)
|
||||
}
|
||||
modelPkgs[pkg.Name] = models.Package{
|
||||
Name: pkg.Name,
|
||||
Release: pkg.Release,
|
||||
Version: version,
|
||||
Arch: pkg.Arch,
|
||||
}
|
||||
|
||||
// add SrcPacks
|
||||
if pkg.Name != pkg.SrcName {
|
||||
if pack, ok := modelSrcPkgs[pkg.SrcName]; ok {
|
||||
pack.AddBinaryName(pkg.Name)
|
||||
modelSrcPkgs[pkg.SrcName] = pack
|
||||
} else {
|
||||
modelSrcPkgs[pkg.SrcName] = models.SrcPackage{
|
||||
Name: pkg.SrcName,
|
||||
Version: pkg.SrcVersion,
|
||||
Arch: pkg.Arch,
|
||||
BinaryNames: []string{pkg.Name},
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return modelPkgs, modelSrcPkgs
|
||||
}
|
||||
|
||||
func newContainerImage(c config.ServerInfo, pkgs []analyzer.Package, libs []models.LibraryScanner) *image {
|
||||
modelPkgs, modelSrcPkgs := convertFanalToVulsPkg(pkgs)
|
||||
d := &image{
|
||||
base: base{
|
||||
osPackages: osPackages{
|
||||
Packages: modelPkgs,
|
||||
SrcPackages: modelSrcPkgs,
|
||||
VulnInfos: models.VulnInfos{},
|
||||
},
|
||||
LibraryScanners: libs,
|
||||
},
|
||||
}
|
||||
d.log = util.NewCustomLogger(c)
|
||||
d.setServerInfo(c)
|
||||
return d
|
||||
}
|
||||
|
||||
func (o *image) checkScanMode() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) checkIfSudoNoPasswd() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) checkDeps() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) preCure() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) postScan() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) scanPackages() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (o *image) parseInstalledPackages(string) (models.Packages, models.SrcPackages, error) {
|
||||
return nil, nil, nil
|
||||
}
|
||||
|
||||
func (o *image) detectPlatform() {
|
||||
o.setPlatform(models.Platform{Name: "image"})
|
||||
}
|
||||
26
scan/library.go
Normal file
26
scan/library.go
Normal file
@@ -0,0 +1,26 @@
|
||||
package scan
|
||||
|
||||
import (
|
||||
"github.com/aquasecurity/fanal/types"
|
||||
"github.com/future-architect/vuls/models"
|
||||
|
||||
trivyTypes "github.com/aquasecurity/trivy/pkg/types"
|
||||
)
|
||||
|
||||
func convertLibWithScanner(apps []types.Application) ([]models.LibraryScanner, error) {
|
||||
scanners := []models.LibraryScanner{}
|
||||
for _, app := range apps {
|
||||
libs := []trivyTypes.Library{}
|
||||
for _, lib := range app.Libraries {
|
||||
libs = append(libs, trivyTypes.Library{
|
||||
Name: lib.Library.Name,
|
||||
Version: lib.Library.Version,
|
||||
})
|
||||
}
|
||||
scanners = append(scanners, models.LibraryScanner{
|
||||
Path: app.FilePath,
|
||||
Libs: libs,
|
||||
})
|
||||
}
|
||||
return scanners, nil
|
||||
}
|
||||
@@ -109,18 +109,6 @@ func detectOS(c config.ServerInfo) (osType osTypeInterface) {
|
||||
return
|
||||
}
|
||||
|
||||
itsMe, osType, fatalErr = detectContainerImage(c)
|
||||
if fatalErr != nil {
|
||||
osType.setErrs(
|
||||
[]error{xerrors.Errorf("Failed to detect OS: %w", fatalErr)},
|
||||
)
|
||||
return
|
||||
}
|
||||
if itsMe {
|
||||
util.Log.Debugf("Container")
|
||||
return
|
||||
}
|
||||
|
||||
itsMe, osType, fatalErr = detectDebianWithRetry(c)
|
||||
if fatalErr != nil {
|
||||
osType.setErrs([]error{
|
||||
@@ -179,28 +167,9 @@ func PrintSSHableServerNames() bool {
|
||||
return true
|
||||
}
|
||||
|
||||
func needScans() (needBaseServer, scanContainer, scanImage bool) {
|
||||
scanContainer = true
|
||||
scanImage = true
|
||||
if !config.Conf.ContainersOnly && !config.Conf.ImagesOnly {
|
||||
needBaseServer = true
|
||||
}
|
||||
|
||||
if config.Conf.ImagesOnly && !config.Conf.ContainersOnly {
|
||||
scanContainer = false
|
||||
}
|
||||
|
||||
if config.Conf.ContainersOnly && !config.Conf.ImagesOnly {
|
||||
scanImage = false
|
||||
}
|
||||
return needBaseServer, scanContainer, scanImage
|
||||
}
|
||||
|
||||
// InitServers detect the kind of OS distribution of target servers
|
||||
func InitServers(timeoutSec int) error {
|
||||
needBaseServers, scanContainer, scanImage := needScans()
|
||||
|
||||
// use global servers, errServers when scan containers and images
|
||||
// use global servers, errServers when scan containers
|
||||
servers, errServers = detectServerOSes(timeoutSec)
|
||||
if len(servers) == 0 {
|
||||
return xerrors.New("No scannable base servers")
|
||||
@@ -208,23 +177,16 @@ func InitServers(timeoutSec int) error {
|
||||
|
||||
// scan additional servers
|
||||
var actives, inactives []osTypeInterface
|
||||
if scanImage {
|
||||
oks, errs := detectImageOSes(timeoutSec)
|
||||
actives = append(actives, oks...)
|
||||
inactives = append(inactives, errs...)
|
||||
}
|
||||
if scanContainer {
|
||||
oks, errs := detectContainerOSes(timeoutSec)
|
||||
actives = append(actives, oks...)
|
||||
inactives = append(inactives, errs...)
|
||||
}
|
||||
oks, errs := detectContainerOSes(timeoutSec)
|
||||
actives = append(actives, oks...)
|
||||
inactives = append(inactives, errs...)
|
||||
|
||||
if needBaseServers {
|
||||
servers = append(servers, actives...)
|
||||
errServers = append(errServers, inactives...)
|
||||
} else {
|
||||
if config.Conf.ContainersOnly {
|
||||
servers = actives
|
||||
errServers = inactives
|
||||
} else {
|
||||
servers = append(servers, actives...)
|
||||
errServers = append(errServers, inactives...)
|
||||
}
|
||||
|
||||
if len(servers) == 0 {
|
||||
@@ -434,81 +396,6 @@ func detectContainerOSesOnServer(containerHost osTypeInterface) (oses []osTypeIn
|
||||
return oses
|
||||
}
|
||||
|
||||
func detectImageOSes(timeoutSec int) (actives, inactives []osTypeInterface) {
|
||||
util.Log.Info("Detecting OS of static containers... ")
|
||||
osTypesChan := make(chan []osTypeInterface, len(servers))
|
||||
defer close(osTypesChan)
|
||||
for _, s := range servers {
|
||||
go func(s osTypeInterface) {
|
||||
defer func() {
|
||||
if p := recover(); p != nil {
|
||||
util.Log.Debugf("Panic: %s on %s",
|
||||
p, s.getServerInfo().GetServerName())
|
||||
}
|
||||
}()
|
||||
osTypesChan <- detectImageOSesOnServer(s)
|
||||
}(s)
|
||||
}
|
||||
|
||||
timeout := time.After(time.Duration(timeoutSec) * time.Second)
|
||||
for i := 0; i < len(servers); i++ {
|
||||
select {
|
||||
case res := <-osTypesChan:
|
||||
for _, osi := range res {
|
||||
sinfo := osi.getServerInfo()
|
||||
if 0 < len(osi.getErrs()) {
|
||||
inactives = append(inactives, osi)
|
||||
util.Log.Errorf("Failed: %s err: %+v", sinfo.ServerName, osi.getErrs())
|
||||
continue
|
||||
}
|
||||
actives = append(actives, osi)
|
||||
util.Log.Infof("Detected: %s@%s: %s",
|
||||
sinfo.Image.Name, sinfo.ServerName, osi.getDistro())
|
||||
}
|
||||
case <-timeout:
|
||||
msg := "Timed out while detecting static containers"
|
||||
util.Log.Error(msg)
|
||||
for servername, sInfo := range config.Conf.Servers {
|
||||
found := false
|
||||
for _, o := range append(actives, inactives...) {
|
||||
if servername == o.getServerInfo().ServerName {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
u := &unknown{}
|
||||
u.setServerInfo(sInfo)
|
||||
u.setErrs([]error{
|
||||
xerrors.New("Timed out"),
|
||||
})
|
||||
inactives = append(inactives)
|
||||
util.Log.Errorf("Timed out: %s", servername)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func detectImageOSesOnServer(containerHost osTypeInterface) (oses []osTypeInterface) {
|
||||
containerHostInfo := containerHost.getServerInfo()
|
||||
if len(containerHostInfo.Images) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
for idx, img := range containerHostInfo.Images {
|
||||
copied := containerHostInfo
|
||||
// change servername for original
|
||||
copied.ServerName = fmt.Sprintf("%s@%s", idx, containerHostInfo.ServerName)
|
||||
copied.Image = img
|
||||
copied.Type = ""
|
||||
os := detectOS(copied)
|
||||
oses = append(oses, os)
|
||||
}
|
||||
return oses
|
||||
}
|
||||
|
||||
// CheckScanModes checks scan mode
|
||||
func CheckScanModes() error {
|
||||
for _, s := range servers {
|
||||
|
||||
Reference in New Issue
Block a user