|
| 1 | +package csaf |
| 2 | + |
| 3 | +import ( |
| 4 | + "archive/tar" |
| 5 | + "bytes" |
| 6 | + "compress/bzip2" |
| 7 | + "compress/gzip" |
| 8 | + "encoding/json" |
| 9 | + "errors" |
| 10 | + "fmt" |
| 11 | + "io" |
| 12 | + "log" |
| 13 | + "path/filepath" |
| 14 | + "regexp" |
| 15 | + "strings" |
| 16 | + "unicode/utf8" |
| 17 | + |
| 18 | + csaflib "github.com/csaf-poc/csaf_distribution/v3/csaf" |
| 19 | + "github.com/spf13/afero" |
| 20 | + "golang.org/x/xerrors" |
| 21 | + |
| 22 | + "github.com/aquasecurity/vuln-list-update/utils" |
| 23 | +) |
| 24 | + |
| 25 | +const ( |
| 26 | + csafArchiveURL = "https://ftp.suse.com/pub/projects/security/csaf.tar.bz2" |
| 27 | + csafDir = "csaf" |
| 28 | + suseDir = "suse" |
| 29 | + retries = 5 |
| 30 | +) |
| 31 | + |
| 32 | +var fileRegexp = regexp.MustCompile(`^(suse-su|opensuse-su)-`) |
| 33 | + |
| 34 | +type Config struct { |
| 35 | + VulnListDir string |
| 36 | + URL string |
| 37 | + AppFs afero.Fs |
| 38 | +} |
| 39 | + |
| 40 | +// archiveEntry is a single JSON document from the SUSE CSAF tar archive. |
| 41 | +type archiveEntry struct { |
| 42 | + Filename string |
| 43 | + Data []byte |
| 44 | +} |
| 45 | + |
| 46 | +func NewConfig() Config { |
| 47 | + return Config{ |
| 48 | + VulnListDir: utils.VulnListDir(), |
| 49 | + URL: csafArchiveURL, |
| 50 | + AppFs: afero.NewOsFs(), |
| 51 | + } |
| 52 | +} |
| 53 | + |
| 54 | +func (c Config) Update() error { |
| 55 | + log.Print("Fetching SUSE CSAF archive...") |
| 56 | + |
| 57 | + return walkArchive(c.URL, retries, fileRegexp, func(e archiveEntry) error { |
| 58 | + osName, err := osNameFromFilename(e.Filename) |
| 59 | + if err != nil { |
| 60 | + log.Printf("skip %s: %v", e.Filename, err) |
| 61 | + return nil |
| 62 | + } |
| 63 | + |
| 64 | + var adv csaflib.Advisory |
| 65 | + if err := json.Unmarshal(e.Data, &adv); err != nil { |
| 66 | + log.Printf("skip invalid CSAF json (%s): %v", e.Filename, err) |
| 67 | + return nil |
| 68 | + } |
| 69 | + |
| 70 | + if err := adv.Validate(); err != nil { |
| 71 | + log.Printf("skip invalid CSAF advisory (%s): %v", e.Filename, err) |
| 72 | + return nil |
| 73 | + } |
| 74 | + |
| 75 | + if adv.Document == nil || adv.Document.Tracking == nil || adv.Document.Tracking.ID == nil { |
| 76 | + log.Printf("skip advisory without tracking id (%s)", e.Filename) |
| 77 | + return nil |
| 78 | + } |
| 79 | + |
| 80 | + dir := filepath.Join(csafDir, suseDir, osName) |
| 81 | + if err := c.savePerYear(dir, string(*adv.Document.Tracking.ID), adv); err != nil { |
| 82 | + return xerrors.Errorf("failed to save CSAF: %w", err) |
| 83 | + } |
| 84 | + return nil |
| 85 | + }) |
| 86 | +} |
| 87 | + |
| 88 | +func osNameFromFilename(filename string) (string, error) { |
| 89 | + match := fileRegexp.FindStringSubmatch(filename) |
| 90 | + if len(match) < 2 { |
| 91 | + return "", fmt.Errorf("unexpected filename") |
| 92 | + } |
| 93 | + switch match[1] { |
| 94 | + case "suse-su": |
| 95 | + return "suse", nil |
| 96 | + case "opensuse-su": |
| 97 | + return "opensuse", nil |
| 98 | + default: |
| 99 | + return "", fmt.Errorf("unknown prefix %q", match[1]) |
| 100 | + } |
| 101 | +} |
| 102 | + |
| 103 | +func (c Config) savePerYear(dirName, advisoryID string, data any) error { |
| 104 | + s := strings.Split(advisoryID, "-") |
| 105 | + if len(s) < 4 { |
| 106 | + log.Printf("invalid advisory ID format: %s", advisoryID) |
| 107 | + return nil |
| 108 | + } |
| 109 | + |
| 110 | + year := strings.Split(s[2], ":")[0] |
| 111 | + if len(year) < 4 { |
| 112 | + log.Printf("invalid advisory ID format: %s", advisoryID) |
| 113 | + return nil |
| 114 | + } |
| 115 | + |
| 116 | + yearDir := filepath.Join(c.VulnListDir, dirName, year) |
| 117 | + fileName := fmt.Sprintf("%s.json", strings.Replace(advisoryID, ":", "-", 1)) |
| 118 | + if err := utils.WriteJSON(c.AppFs, yearDir, fileName, data); err != nil { |
| 119 | + return xerrors.Errorf("failed to write file: %w", err) |
| 120 | + } |
| 121 | + return nil |
| 122 | +} |
| 123 | + |
| 124 | +func walkArchive(url string, retries int, nameRegexp *regexp.Regexp, handler func(archiveEntry) error) error { |
| 125 | + body, err := utils.FetchURL(url, "", retries) |
| 126 | + if err != nil { |
| 127 | + return xerrors.Errorf("failed to download archive: %w", err) |
| 128 | + } |
| 129 | + |
| 130 | + decompressed, err := decompressArchive(url, body) |
| 131 | + if err != nil { |
| 132 | + return err |
| 133 | + } |
| 134 | + |
| 135 | + tr := tar.NewReader(decompressed) |
| 136 | + for { |
| 137 | + hdr, err := tr.Next() |
| 138 | + switch { |
| 139 | + case errors.Is(err, io.EOF): |
| 140 | + return nil |
| 141 | + case err != nil: |
| 142 | + return xerrors.Errorf("failed to read tar entry: %w", err) |
| 143 | + case hdr.Typeflag != tar.TypeReg: |
| 144 | + continue |
| 145 | + } |
| 146 | + |
| 147 | + filename := filepath.Base(hdr.Name) |
| 148 | + if !strings.HasSuffix(filename, ".json") { |
| 149 | + continue |
| 150 | + } |
| 151 | + if nameRegexp != nil && !nameRegexp.MatchString(filename) { |
| 152 | + continue |
| 153 | + } |
| 154 | + |
| 155 | + data, err := io.ReadAll(tr) |
| 156 | + if err != nil { |
| 157 | + return xerrors.Errorf("failed to read tar entry data: %w", err) |
| 158 | + } |
| 159 | + if len(data) == 0 { |
| 160 | + log.Printf("empty json: %s", filename) |
| 161 | + continue |
| 162 | + } |
| 163 | + if !utf8.Valid(data) { |
| 164 | + log.Printf("invalid UTF-8: %s", filename) |
| 165 | + data = []byte(strings.ToValidUTF8(string(data), "")) |
| 166 | + } |
| 167 | + |
| 168 | + if err := handler(archiveEntry{Filename: filename, Data: data}); err != nil { |
| 169 | + return err |
| 170 | + } |
| 171 | + } |
| 172 | +} |
| 173 | + |
| 174 | +func decompressArchive(url string, body []byte) (io.Reader, error) { |
| 175 | + switch { |
| 176 | + case strings.HasSuffix(url, ".tar.bz2"): |
| 177 | + return bzip2.NewReader(bytes.NewReader(body)), nil |
| 178 | + case strings.HasSuffix(url, ".tar.gz"): |
| 179 | + return gzip.NewReader(bytes.NewReader(body)) |
| 180 | + default: |
| 181 | + return nil, xerrors.Errorf("unsupported archive format: %s", url) |
| 182 | + } |
| 183 | +} |
0 commit comments