1
|
|
|
# -*- coding: utf-8 -*- |
2
|
|
|
# Copyright (C) 2014-2021 Greenbone Networks GmbH |
3
|
|
|
# |
4
|
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later |
5
|
|
|
# |
6
|
|
|
# This program is free software: you can redistribute it and/or modify |
7
|
|
|
# it under the terms of the GNU Affero General Public License as |
8
|
|
|
# published by the Free Software Foundation, either version 3 of the |
9
|
|
|
# License, or (at your option) any later version. |
10
|
|
|
# |
11
|
|
|
# This program is distributed in the hope that it will be useful, |
12
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
13
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14
|
|
|
# GNU Affero General Public License for more details. |
15
|
|
|
# |
16
|
|
|
# You should have received a copy of the GNU Affero General Public License |
17
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. |
18
|
|
|
|
19
|
|
|
|
20
|
|
|
# pylint: disable=too-many-lines |
21
|
|
|
|
22
|
|
|
""" Setup for the OSP OpenVAS Server. """ |
23
|
|
|
|
24
|
|
|
import logging |
25
|
|
|
import time |
26
|
|
|
import copy |
27
|
|
|
|
28
|
|
|
from typing import Optional, Dict, List, Tuple, Iterator |
29
|
|
|
from datetime import datetime |
30
|
|
|
|
31
|
|
|
from pathlib import Path |
32
|
|
|
from os import geteuid, environ |
33
|
|
|
from lxml.etree import tostring, SubElement, Element |
34
|
|
|
|
35
|
|
|
import psutil |
36
|
|
|
|
37
|
|
|
from ospd.ospd import OSPDaemon |
38
|
|
|
from ospd.scan import ScanProgress, ScanStatus |
39
|
|
|
from ospd.server import BaseServer |
40
|
|
|
from ospd.main import main as daemon_main |
41
|
|
|
from ospd.vtfilter import VtsFilter |
42
|
|
|
from ospd.resultlist import ResultList |
43
|
|
|
|
44
|
|
|
from ospd_openvas import __version__ |
45
|
|
|
from ospd_openvas.errors import OspdOpenvasError |
46
|
|
|
|
47
|
|
|
from ospd_openvas.dryrun import DryRun |
48
|
|
|
from ospd_openvas.nvticache import NVTICache |
49
|
|
|
from ospd_openvas.db import MainDB, BaseDB |
50
|
|
|
from ospd_openvas.lock import LockFile |
51
|
|
|
from ospd_openvas.preferencehandler import PreferenceHandler |
52
|
|
|
from ospd_openvas.openvas import Openvas |
53
|
|
|
from ospd_openvas.vthelper import VtHelper |
54
|
|
|
|
55
|
|
|
SENTRY_DSN_OSPD_OPENVAS = environ.get("SENTRY_DSN_OSPD_OPENVAS") |
56
|
|
|
if SENTRY_DSN_OSPD_OPENVAS: |
57
|
|
|
import sentry_sdk |
58
|
|
|
|
59
|
|
|
sentry_sdk.init( # pylint: disable=abstract-class-instantiated |
60
|
|
|
SENTRY_DSN_OSPD_OPENVAS, |
61
|
|
|
traces_sample_rate=1.0, |
62
|
|
|
server_name=environ.get('SENTRY_SERVER_NAME'), |
63
|
|
|
environment=environ.get('SENTRY_ENVIRONMENT'), |
64
|
|
|
) |
65
|
|
|
|
66
|
|
|
logger = logging.getLogger(__name__) |
67
|
|
|
|
68
|
|
|
|
69
|
|
|
OSPD_DESC = """ |
70
|
|
|
This scanner runs OpenVAS to scan the target hosts. |
71
|
|
|
|
72
|
|
|
OpenVAS (Open Vulnerability Assessment Scanner) is a powerful scanner |
73
|
|
|
for vulnerabilities in IT infrastrucutres. The capabilities include |
74
|
|
|
unauthenticated scanning as well as authenticated scanning for |
75
|
|
|
various types of systems and services. |
76
|
|
|
|
77
|
|
|
For more details about OpenVAS see: |
78
|
|
|
http://www.openvas.org/ |
79
|
|
|
|
80
|
|
|
The current version of ospd-openvas is a simple frame, which sends |
81
|
|
|
the server parameters to the Greenbone Vulnerability Manager daemon (GVMd) and |
82
|
|
|
checks the existence of OpenVAS binary. But it can not run scans yet. |
83
|
|
|
""" |
84
|
|
|
|
85
|
|
|
OSPD_PARAMS = { |
86
|
|
|
'auto_enable_dependencies': { |
87
|
|
|
'type': 'boolean', |
88
|
|
|
'name': 'auto_enable_dependencies', |
89
|
|
|
'default': 1, |
90
|
|
|
'mandatory': 1, |
91
|
|
|
'visible_for_client': True, |
92
|
|
|
'description': 'Automatically enable the plugins that are depended on', |
93
|
|
|
}, |
94
|
|
|
'cgi_path': { |
95
|
|
|
'type': 'string', |
96
|
|
|
'name': 'cgi_path', |
97
|
|
|
'default': '/cgi-bin:/scripts', |
98
|
|
|
'mandatory': 1, |
99
|
|
|
'visible_for_client': True, |
100
|
|
|
'description': 'Look for default CGIs in /cgi-bin and /scripts', |
101
|
|
|
}, |
102
|
|
|
'checks_read_timeout': { |
103
|
|
|
'type': 'integer', |
104
|
|
|
'name': 'checks_read_timeout', |
105
|
|
|
'default': 5, |
106
|
|
|
'mandatory': 1, |
107
|
|
|
'visible_for_client': True, |
108
|
|
|
'description': ( |
109
|
|
|
'Number of seconds that the security checks will ' |
110
|
|
|
+ 'wait for when doing a recv()' |
111
|
|
|
), |
112
|
|
|
}, |
113
|
|
|
'non_simult_ports': { |
114
|
|
|
'type': 'string', |
115
|
|
|
'name': 'non_simult_ports', |
116
|
|
|
'default': '139, 445, 3389, Services/irc', |
117
|
|
|
'mandatory': 1, |
118
|
|
|
'visible_for_client': True, |
119
|
|
|
'description': ( |
120
|
|
|
'Prevent to make two connections on the same given ' |
121
|
|
|
+ 'ports at the same time.' |
122
|
|
|
), |
123
|
|
|
}, |
124
|
|
|
'open_sock_max_attempts': { |
125
|
|
|
'type': 'integer', |
126
|
|
|
'name': 'open_sock_max_attempts', |
127
|
|
|
'default': 5, |
128
|
|
|
'mandatory': 0, |
129
|
|
|
'visible_for_client': True, |
130
|
|
|
'description': ( |
131
|
|
|
'Number of unsuccessful retries to open the socket ' |
132
|
|
|
+ 'before to set the port as closed.' |
133
|
|
|
), |
134
|
|
|
}, |
135
|
|
|
'timeout_retry': { |
136
|
|
|
'type': 'integer', |
137
|
|
|
'name': 'timeout_retry', |
138
|
|
|
'default': 5, |
139
|
|
|
'mandatory': 0, |
140
|
|
|
'visible_for_client': True, |
141
|
|
|
'description': ( |
142
|
|
|
'Number of retries when a socket connection attempt ' + 'timesout.' |
143
|
|
|
), |
144
|
|
|
}, |
145
|
|
|
'optimize_test': { |
146
|
|
|
'type': 'boolean', |
147
|
|
|
'name': 'optimize_test', |
148
|
|
|
'default': 1, |
149
|
|
|
'mandatory': 0, |
150
|
|
|
'visible_for_client': True, |
151
|
|
|
'description': ( |
152
|
|
|
'By default, optimize_test is enabled which means openvas does ' |
153
|
|
|
+ 'trust the remote host banners and is only launching plugins ' |
154
|
|
|
+ 'against the services they have been designed to check. ' |
155
|
|
|
+ 'For example it will check a web server claiming to be IIS only ' |
156
|
|
|
+ 'for IIS related flaws but will skip plugins testing for Apache ' |
157
|
|
|
+ 'flaws, and so on. This default behavior is used to optimize ' |
158
|
|
|
+ 'the scanning performance and to avoid false positives. ' |
159
|
|
|
+ 'If you are not sure that the banners of the remote host ' |
160
|
|
|
+ 'have been tampered with, you can disable this option.' |
161
|
|
|
), |
162
|
|
|
}, |
163
|
|
|
'plugins_timeout': { |
164
|
|
|
'type': 'integer', |
165
|
|
|
'name': 'plugins_timeout', |
166
|
|
|
'default': 5, |
167
|
|
|
'mandatory': 0, |
168
|
|
|
'visible_for_client': True, |
169
|
|
|
'description': 'This is the maximum lifetime, in seconds of a plugin.', |
170
|
|
|
}, |
171
|
|
|
'report_host_details': { |
172
|
|
|
'type': 'boolean', |
173
|
|
|
'name': 'report_host_details', |
174
|
|
|
'default': 1, |
175
|
|
|
'mandatory': 1, |
176
|
|
|
'visible_for_client': True, |
177
|
|
|
'description': '', |
178
|
|
|
}, |
179
|
|
|
'safe_checks': { |
180
|
|
|
'type': 'boolean', |
181
|
|
|
'name': 'safe_checks', |
182
|
|
|
'default': 1, |
183
|
|
|
'mandatory': 1, |
184
|
|
|
'visible_for_client': True, |
185
|
|
|
'description': ( |
186
|
|
|
'Disable the plugins with potential to crash ' |
187
|
|
|
+ 'the remote services' |
188
|
|
|
), |
189
|
|
|
}, |
190
|
|
|
'scanner_plugins_timeout': { |
191
|
|
|
'type': 'integer', |
192
|
|
|
'name': 'scanner_plugins_timeout', |
193
|
|
|
'default': 36000, |
194
|
|
|
'mandatory': 1, |
195
|
|
|
'visible_for_client': True, |
196
|
|
|
'description': 'Like plugins_timeout, but for ACT_SCANNER plugins.', |
197
|
|
|
}, |
198
|
|
|
'time_between_request': { |
199
|
|
|
'type': 'integer', |
200
|
|
|
'name': 'time_between_request', |
201
|
|
|
'default': 0, |
202
|
|
|
'mandatory': 0, |
203
|
|
|
'visible_for_client': True, |
204
|
|
|
'description': ( |
205
|
|
|
'Allow to set a wait time between two actions ' |
206
|
|
|
+ '(open, send, close).' |
207
|
|
|
), |
208
|
|
|
}, |
209
|
|
|
'unscanned_closed': { |
210
|
|
|
'type': 'boolean', |
211
|
|
|
'name': 'unscanned_closed', |
212
|
|
|
'default': 1, |
213
|
|
|
'mandatory': 1, |
214
|
|
|
'visible_for_client': True, |
215
|
|
|
'description': '', |
216
|
|
|
}, |
217
|
|
|
'unscanned_closed_udp': { |
218
|
|
|
'type': 'boolean', |
219
|
|
|
'name': 'unscanned_closed_udp', |
220
|
|
|
'default': 1, |
221
|
|
|
'mandatory': 1, |
222
|
|
|
'visible_for_client': True, |
223
|
|
|
'description': '', |
224
|
|
|
}, |
225
|
|
|
'expand_vhosts': { |
226
|
|
|
'type': 'boolean', |
227
|
|
|
'name': 'expand_vhosts', |
228
|
|
|
'default': 1, |
229
|
|
|
'mandatory': 0, |
230
|
|
|
'visible_for_client': True, |
231
|
|
|
'description': 'Whether to expand the target hosts ' |
232
|
|
|
+ 'list of vhosts with values gathered from sources ' |
233
|
|
|
+ 'such as reverse-lookup queries and VT checks ' |
234
|
|
|
+ 'for SSL/TLS certificates.', |
235
|
|
|
}, |
236
|
|
|
'test_empty_vhost': { |
237
|
|
|
'type': 'boolean', |
238
|
|
|
'name': 'test_empty_vhost', |
239
|
|
|
'default': 0, |
240
|
|
|
'mandatory': 0, |
241
|
|
|
'visible_for_client': True, |
242
|
|
|
'description': 'If set to yes, the scanner will ' |
243
|
|
|
+ 'also test the target by using empty vhost value ' |
244
|
|
|
+ 'in addition to the targets associated vhost values.', |
245
|
|
|
}, |
246
|
|
|
'max_hosts': { |
247
|
|
|
'type': 'integer', |
248
|
|
|
'name': 'max_hosts', |
249
|
|
|
'default': 30, |
250
|
|
|
'mandatory': 0, |
251
|
|
|
'visible_for_client': False, |
252
|
|
|
'description': ( |
253
|
|
|
'The maximum number of hosts to test at the same time which ' |
254
|
|
|
+ 'should be given to the client (which can override it). ' |
255
|
|
|
+ 'This value must be computed given your bandwidth, ' |
256
|
|
|
+ 'the number of hosts you want to test, your amount of ' |
257
|
|
|
+ 'memory and the performance of your processor(s).' |
258
|
|
|
), |
259
|
|
|
}, |
260
|
|
|
'max_checks': { |
261
|
|
|
'type': 'integer', |
262
|
|
|
'name': 'max_checks', |
263
|
|
|
'default': 10, |
264
|
|
|
'mandatory': 0, |
265
|
|
|
'visible_for_client': False, |
266
|
|
|
'description': ( |
267
|
|
|
'The number of plugins that will run against each host being ' |
268
|
|
|
+ 'tested. Note that the total number of process will be max ' |
269
|
|
|
+ 'checks x max_hosts so you need to find a balance between ' |
270
|
|
|
+ 'these two options. Note that launching too many plugins at ' |
271
|
|
|
+ 'the same time may disable the remote host, either temporarily ' |
272
|
|
|
+ '(ie: inetd closes its ports) or definitely (the remote host ' |
273
|
|
|
+ 'crash because it is asked to do too many things at the ' |
274
|
|
|
+ 'same time), so be careful.' |
275
|
|
|
), |
276
|
|
|
}, |
277
|
|
|
'port_range': { |
278
|
|
|
'type': 'string', |
279
|
|
|
'name': 'port_range', |
280
|
|
|
'default': '', |
281
|
|
|
'mandatory': 0, |
282
|
|
|
'visible_for_client': False, |
283
|
|
|
'description': ( |
284
|
|
|
'This is the default range of ports that the scanner plugins will ' |
285
|
|
|
+ 'probe. The syntax of this option is flexible, it can be a ' |
286
|
|
|
+ 'single range ("1-1500"), several ports ("21,23,80"), several ' |
287
|
|
|
+ 'ranges of ports ("1-1500,32000-33000"). Note that you can ' |
288
|
|
|
+ 'specify UDP and TCP ports by prefixing each range by T or U. ' |
289
|
|
|
+ 'For instance, the following range will make openvas scan UDP ' |
290
|
|
|
+ 'ports 1 to 1024 and TCP ports 1 to 65535 : ' |
291
|
|
|
+ '"T:1-65535,U:1-1024".' |
292
|
|
|
), |
293
|
|
|
}, |
294
|
|
|
'test_alive_hosts_only': { |
295
|
|
|
'type': 'boolean', |
296
|
|
|
'name': 'test_alive_hosts_only', |
297
|
|
|
'default': 0, |
298
|
|
|
'mandatory': 0, |
299
|
|
|
'visible_for_client': False, |
300
|
|
|
'description': ( |
301
|
|
|
'If this option is set, openvas will scan the target list for ' |
302
|
|
|
+ 'alive hosts in a separate process while only testing those ' |
303
|
|
|
+ 'hosts which are identified as alive. This boosts the scan ' |
304
|
|
|
+ 'speed of target ranges with a high amount of dead hosts ' |
305
|
|
|
+ 'significantly.' |
306
|
|
|
), |
307
|
|
|
}, |
308
|
|
|
'hosts_allow': { |
309
|
|
|
'type': 'string', |
310
|
|
|
'name': 'hosts_allow', |
311
|
|
|
'default': '', |
312
|
|
|
'mandatory': 0, |
313
|
|
|
'visible_for_client': False, |
314
|
|
|
'description': ( |
315
|
|
|
'Comma-separated list of the only targets that are authorized ' |
316
|
|
|
+ 'to be scanned. Supports the same syntax as the list targets. ' |
317
|
|
|
+ 'Both target hostnames and the address to which they resolve ' |
318
|
|
|
+ 'are checked. Hostnames in hosts_allow list are not resolved ' |
319
|
|
|
+ 'however.' |
320
|
|
|
), |
321
|
|
|
}, |
322
|
|
|
'hosts_deny': { |
323
|
|
|
'type': 'string', |
324
|
|
|
'name': 'hosts_deny', |
325
|
|
|
'default': '', |
326
|
|
|
'mandatory': 0, |
327
|
|
|
'visible_for_client': False, |
328
|
|
|
'description': ( |
329
|
|
|
'Comma-separated list of targets that are not authorized to ' |
330
|
|
|
+ 'be scanned. Supports the same syntax as the list targets. ' |
331
|
|
|
+ 'Both target hostnames and the address to which they resolve ' |
332
|
|
|
+ 'are checked. Hostnames in hosts_deny list are not ' |
333
|
|
|
+ 'resolved however.' |
334
|
|
|
), |
335
|
|
|
}, |
336
|
|
|
'results_per_host': { |
337
|
|
|
'type': 'integer', |
338
|
|
|
'name': 'results_per_host', |
339
|
|
|
'default': 10, |
340
|
|
|
'mandatory': 0, |
341
|
|
|
'visible_for_client': True, |
342
|
|
|
'description': ( |
343
|
|
|
'Amount of fake results generated per each host in the target ' |
344
|
|
|
+ 'list for a dry run scan.' |
345
|
|
|
), |
346
|
|
|
}, |
347
|
|
|
} |
348
|
|
|
|
349
|
|
|
VT_BASE_OID = "1.3.6.1.4.1.25623." |
350
|
|
|
|
351
|
|
|
|
352
|
|
|
def safe_int(value: str) -> Optional[int]: |
353
|
|
|
"""Convert a string into an integer and return None in case of errors |
354
|
|
|
during conversion |
355
|
|
|
""" |
356
|
|
|
try: |
357
|
|
|
return int(value) |
358
|
|
|
except (ValueError, TypeError): |
359
|
|
|
return None |
360
|
|
|
|
361
|
|
|
|
362
|
|
|
class OpenVasVtsFilter(VtsFilter): |
363
|
|
|
|
364
|
|
|
"""Methods to overwrite the ones in the original class.""" |
365
|
|
|
|
366
|
|
|
def __init__(self, nvticache: NVTICache) -> None: |
367
|
|
|
super().__init__() |
368
|
|
|
|
369
|
|
|
self.nvti = nvticache |
370
|
|
|
|
371
|
|
|
def format_vt_modification_time(self, value: str) -> str: |
372
|
|
|
"""Convert the string seconds since epoch into a 19 character |
373
|
|
|
string representing YearMonthDayHourMinuteSecond, |
374
|
|
|
e.g. 20190319122532. This always refers to UTC. |
375
|
|
|
""" |
376
|
|
|
|
377
|
|
|
return datetime.utcfromtimestamp(int(value)).strftime("%Y%m%d%H%M%S") |
378
|
|
|
|
379
|
|
|
def get_filtered_vts_list(self, vts, vt_filter: str) -> Optional[List[str]]: |
380
|
|
|
"""Gets a collection of vulnerability test from the redis cache, |
381
|
|
|
which match the filter. |
382
|
|
|
|
383
|
|
|
Arguments: |
384
|
|
|
vt_filter: Filter to apply to the vts collection. |
385
|
|
|
vts: The complete vts collection. |
386
|
|
|
|
387
|
|
|
Returns: |
388
|
|
|
List with filtered vulnerability tests. The list can be empty. |
389
|
|
|
None in case of filter parse failure. |
390
|
|
|
""" |
391
|
|
|
filters = self.parse_filters(vt_filter) |
392
|
|
|
if not filters: |
393
|
|
|
return None |
394
|
|
|
|
395
|
|
|
if not self.nvti: |
396
|
|
|
return None |
397
|
|
|
|
398
|
|
|
vt_oid_list = [vtlist[1] for vtlist in self.nvti.get_oids()] |
399
|
|
|
vt_oid_list_temp = copy.copy(vt_oid_list) |
400
|
|
|
vthelper = VtHelper(self.nvti) |
401
|
|
|
|
402
|
|
|
for element, oper, filter_val in filters: |
403
|
|
|
for vt_oid in vt_oid_list_temp: |
404
|
|
|
if vt_oid not in vt_oid_list: |
405
|
|
|
continue |
406
|
|
|
|
407
|
|
|
vt = vthelper.get_single_vt(vt_oid) |
408
|
|
|
if vt is None or not vt.get(element): |
409
|
|
|
vt_oid_list.remove(vt_oid) |
410
|
|
|
continue |
411
|
|
|
|
412
|
|
|
elem_val = vt.get(element) |
413
|
|
|
val = self.format_filter_value(element, elem_val) |
414
|
|
|
|
415
|
|
|
if self.filter_operator[oper](val, filter_val): |
416
|
|
|
continue |
417
|
|
|
else: |
418
|
|
|
vt_oid_list.remove(vt_oid) |
419
|
|
|
|
420
|
|
|
return vt_oid_list |
421
|
|
|
|
422
|
|
|
|
423
|
|
|
class OSPDopenvas(OSPDaemon): |
424
|
|
|
|
425
|
|
|
"""Class for ospd-openvas daemon.""" |
426
|
|
|
|
427
|
|
|
def __init__( |
428
|
|
|
self, *, niceness=None, lock_file_dir='/var/lib/openvas', **kwargs |
429
|
|
|
): |
430
|
|
|
"""Initializes the ospd-openvas daemon's internal data.""" |
431
|
|
|
self.main_db = MainDB() |
432
|
|
|
self.nvti = NVTICache(self.main_db) |
433
|
|
|
|
434
|
|
|
super().__init__( |
435
|
|
|
customvtfilter=OpenVasVtsFilter(self.nvti), |
436
|
|
|
storage=dict, |
437
|
|
|
file_storage_dir=lock_file_dir, |
438
|
|
|
**kwargs, |
439
|
|
|
) |
440
|
|
|
|
441
|
|
|
self.server_version = __version__ |
442
|
|
|
|
443
|
|
|
self._niceness = str(niceness) |
444
|
|
|
|
445
|
|
|
self.feed_lock = LockFile(Path(lock_file_dir) / 'feed-update.lock') |
446
|
|
|
self.daemon_info['name'] = 'OSPd OpenVAS' |
447
|
|
|
self.scanner_info['name'] = 'openvas' |
448
|
|
|
self.scanner_info['version'] = '' # achieved during self.init() |
449
|
|
|
self.scanner_info['description'] = OSPD_DESC |
450
|
|
|
|
451
|
|
|
for name, param in OSPD_PARAMS.items(): |
452
|
|
|
self.set_scanner_param(name, param) |
453
|
|
|
|
454
|
|
|
self._sudo_available = None |
455
|
|
|
self._is_running_as_root = None |
456
|
|
|
|
457
|
|
|
self.scan_only_params = dict() |
458
|
|
|
|
459
|
|
|
def init(self, server: BaseServer) -> None: |
460
|
|
|
|
461
|
|
|
self.scan_collection.init() |
462
|
|
|
|
463
|
|
|
server.start(self.handle_client_stream) |
464
|
|
|
|
465
|
|
|
self.scanner_info['version'] = Openvas.get_version() |
466
|
|
|
|
467
|
|
|
self.set_params_from_openvas_settings() |
468
|
|
|
|
469
|
|
|
with self.feed_lock.wait_for_lock(): |
470
|
|
|
Openvas.load_vts_into_redis() |
471
|
|
|
current_feed = self.nvti.get_feed_version() |
472
|
|
|
self.set_vts_version(vts_version=current_feed) |
473
|
|
|
|
474
|
|
|
logger.debug("Calculating vts integrity check hash...") |
475
|
|
|
vthelper = VtHelper(self.nvti) |
476
|
|
|
self.vts.sha256_hash = vthelper.calculate_vts_collection_hash() |
477
|
|
|
|
478
|
|
|
self.initialized = True |
479
|
|
|
|
480
|
|
|
def set_params_from_openvas_settings(self): |
481
|
|
|
"""Set OSPD_PARAMS with the params taken from the openvas executable.""" |
482
|
|
|
param_list = Openvas.get_settings() |
483
|
|
|
|
484
|
|
|
for elem in param_list: # pylint: disable=consider-using-dict-items |
485
|
|
|
if elem not in OSPD_PARAMS: |
|
|
|
|
486
|
|
|
self.scan_only_params[elem] = param_list[elem] |
487
|
|
|
else: |
488
|
|
|
OSPD_PARAMS[elem]['default'] = param_list[elem] |
489
|
|
|
|
490
|
|
|
def feed_is_outdated(self, current_feed: str) -> Optional[bool]: |
491
|
|
|
"""Compare the current feed with the one in the disk. |
492
|
|
|
|
493
|
|
|
Return: |
494
|
|
|
False if there is no new feed. |
495
|
|
|
True if the feed version in disk is newer than the feed in |
496
|
|
|
redis cache. |
497
|
|
|
None if there is no feed on the disk. |
498
|
|
|
""" |
499
|
|
|
plugins_folder = self.scan_only_params.get('plugins_folder') |
500
|
|
|
if not plugins_folder: |
501
|
|
|
raise OspdOpenvasError("Error: Path to plugins folder not found.") |
502
|
|
|
|
503
|
|
|
feed_info_file = Path(plugins_folder) / 'plugin_feed_info.inc' |
504
|
|
|
if not feed_info_file.exists(): |
505
|
|
|
self.set_params_from_openvas_settings() |
506
|
|
|
logger.debug('Plugins feed file %s not found.', feed_info_file) |
507
|
|
|
return None |
508
|
|
|
|
509
|
|
|
current_feed = safe_int(current_feed) |
510
|
|
|
if current_feed is None: |
511
|
|
|
logger.debug( |
512
|
|
|
"Wrong PLUGIN_SET format in plugins feed file %s. Format has to" |
513
|
|
|
" be yyyymmddhhmm. For example 'PLUGIN_SET = \"201910251033\"'", |
514
|
|
|
feed_info_file, |
515
|
|
|
) |
516
|
|
|
|
517
|
|
|
feed_date = None |
518
|
|
|
with feed_info_file.open() as fcontent: |
519
|
|
|
for line in fcontent: |
520
|
|
|
if "PLUGIN_SET" in line: |
521
|
|
|
feed_date = line.split('=', 1)[1] |
522
|
|
|
feed_date = feed_date.strip() |
523
|
|
|
feed_date = feed_date.replace(';', '') |
524
|
|
|
feed_date = feed_date.replace('"', '') |
525
|
|
|
feed_date = safe_int(feed_date) |
526
|
|
|
break |
527
|
|
|
|
528
|
|
|
logger.debug("Current feed version: %s", current_feed) |
529
|
|
|
logger.debug("Plugin feed version: %s", feed_date) |
530
|
|
|
|
531
|
|
|
return ( |
532
|
|
|
(not feed_date) or (not current_feed) or (current_feed < feed_date) |
533
|
|
|
) |
534
|
|
|
|
535
|
|
|
def check_feed(self): |
536
|
|
|
"""Check if there is a feed update. |
537
|
|
|
|
538
|
|
|
Wait until all the running scans finished. Set a flag to announce there |
539
|
|
|
is a pending feed update, which avoids to start a new scan. |
540
|
|
|
""" |
541
|
|
|
if not self.vts.is_cache_available: |
542
|
|
|
return |
543
|
|
|
|
544
|
|
|
current_feed = self.nvti.get_feed_version() |
545
|
|
|
is_outdated = self.feed_is_outdated(current_feed) |
546
|
|
|
|
547
|
|
|
# Check if the nvticache in redis is outdated |
548
|
|
|
if not current_feed or is_outdated: |
549
|
|
|
with self.feed_lock as fl: |
550
|
|
|
if fl.has_lock(): |
551
|
|
|
self.initialized = False |
552
|
|
|
Openvas.load_vts_into_redis() |
553
|
|
|
current_feed = self.nvti.get_feed_version() |
554
|
|
|
self.set_vts_version(vts_version=current_feed) |
555
|
|
|
|
556
|
|
|
vthelper = VtHelper(self.nvti) |
557
|
|
|
self.vts.sha256_hash = ( |
558
|
|
|
vthelper.calculate_vts_collection_hash() |
559
|
|
|
) |
560
|
|
|
self.initialized = True |
561
|
|
|
else: |
562
|
|
|
logger.debug( |
563
|
|
|
"The feed was not upload or it is outdated, " |
564
|
|
|
"but other process is locking the update. " |
565
|
|
|
"Trying again later..." |
566
|
|
|
) |
567
|
|
|
return |
568
|
|
|
|
569
|
|
|
def scheduler(self): |
570
|
|
|
"""This method is called periodically to run tasks.""" |
571
|
|
|
self.check_feed() |
572
|
|
|
|
573
|
|
|
def get_vt_iterator( |
574
|
|
|
self, vt_selection: List[str] = None, details: bool = True |
575
|
|
|
) -> Iterator[Tuple[str, Dict]]: |
576
|
|
|
vthelper = VtHelper(self.nvti) |
577
|
|
|
return vthelper.get_vt_iterator(vt_selection, details) |
578
|
|
|
|
579
|
|
|
@staticmethod |
580
|
|
|
def get_custom_vt_as_xml_str(vt_id: str, custom: Dict) -> str: |
581
|
|
|
"""Return an xml element with custom metadata formatted as string. |
582
|
|
|
Arguments: |
583
|
|
|
vt_id: VT OID. Only used for logging in error case. |
584
|
|
|
custom: Dictionary with the custom metadata. |
585
|
|
|
Return: |
586
|
|
|
Xml element as string. |
587
|
|
|
""" |
588
|
|
|
|
589
|
|
|
_custom = Element('custom') |
590
|
|
|
for key, val in custom.items(): |
591
|
|
|
xml_key = SubElement(_custom, key) |
592
|
|
|
try: |
593
|
|
|
xml_key.text = val |
594
|
|
|
except ValueError as e: |
595
|
|
|
logger.warning( |
596
|
|
|
"Not possible to parse custom tag for VT %s: %s", vt_id, e |
597
|
|
|
) |
598
|
|
|
return tostring(_custom).decode('utf-8') |
599
|
|
|
|
600
|
|
|
@staticmethod |
601
|
|
|
def get_severities_vt_as_xml_str(vt_id: str, severities: Dict) -> str: |
602
|
|
|
"""Return an xml element with severities as string. |
603
|
|
|
Arguments: |
604
|
|
|
vt_id: VT OID. Only used for logging in error case. |
605
|
|
|
severities: Dictionary with the severities. |
606
|
|
|
Return: |
607
|
|
|
Xml element as string. |
608
|
|
|
""" |
609
|
|
|
_severities = Element('severities') |
610
|
|
|
_severity = SubElement(_severities, 'severity') |
611
|
|
|
if 'severity_base_vector' in severities: |
612
|
|
|
try: |
613
|
|
|
_value = SubElement(_severity, 'value') |
614
|
|
|
_value.text = severities.get('severity_base_vector') |
615
|
|
|
except ValueError as e: |
616
|
|
|
logger.warning( |
617
|
|
|
"Not possible to parse severity tag for vt %s: %s", vt_id, e |
618
|
|
|
) |
619
|
|
|
if 'severity_origin' in severities: |
620
|
|
|
_origin = SubElement(_severity, 'origin') |
621
|
|
|
_origin.text = severities.get('severity_origin') |
622
|
|
|
if 'severity_date' in severities: |
623
|
|
|
_date = SubElement(_severity, 'date') |
624
|
|
|
_date.text = severities.get('severity_date') |
625
|
|
|
if 'severity_type' in severities: |
626
|
|
|
_severity.set('type', severities.get('severity_type')) |
627
|
|
|
|
628
|
|
|
return tostring(_severities).decode('utf-8') |
629
|
|
|
|
630
|
|
|
@staticmethod |
631
|
|
|
def get_params_vt_as_xml_str(vt_id: str, vt_params: Dict) -> str: |
632
|
|
|
"""Return an xml element with params formatted as string. |
633
|
|
|
Arguments: |
634
|
|
|
vt_id: VT OID. Only used for logging in error case. |
635
|
|
|
vt_params: Dictionary with the VT parameters. |
636
|
|
|
Return: |
637
|
|
|
Xml element as string. |
638
|
|
|
""" |
639
|
|
|
vt_params_xml = Element('params') |
640
|
|
|
for _pref_id, prefs in vt_params.items(): |
641
|
|
|
vt_param = Element('param') |
642
|
|
|
vt_param.set('type', prefs['type']) |
643
|
|
|
vt_param.set('id', _pref_id) |
644
|
|
|
xml_name = SubElement(vt_param, 'name') |
645
|
|
|
try: |
646
|
|
|
xml_name.text = prefs['name'] |
647
|
|
|
except ValueError as e: |
648
|
|
|
logger.warning( |
649
|
|
|
"Not possible to parse parameter for VT %s: %s", vt_id, e |
650
|
|
|
) |
651
|
|
|
if prefs['default']: |
652
|
|
|
xml_def = SubElement(vt_param, 'default') |
653
|
|
|
try: |
654
|
|
|
xml_def.text = prefs['default'] |
655
|
|
|
except ValueError as e: |
656
|
|
|
logger.warning( |
657
|
|
|
"Not possible to parse default parameter for VT %s: %s", |
658
|
|
|
vt_id, |
659
|
|
|
e, |
660
|
|
|
) |
661
|
|
|
vt_params_xml.append(vt_param) |
662
|
|
|
|
663
|
|
|
return tostring(vt_params_xml).decode('utf-8') |
664
|
|
|
|
665
|
|
|
@staticmethod |
666
|
|
|
def get_refs_vt_as_xml_str(vt_id: str, vt_refs: Dict) -> str: |
667
|
|
|
"""Return an xml element with references formatted as string. |
668
|
|
|
Arguments: |
669
|
|
|
vt_id: VT OID. Only used for logging in error case. |
670
|
|
|
vt_refs: Dictionary with the VT references. |
671
|
|
|
Return: |
672
|
|
|
Xml element as string. |
673
|
|
|
""" |
674
|
|
|
vt_refs_xml = Element('refs') |
675
|
|
|
for ref_type, ref_values in vt_refs.items(): |
676
|
|
|
for value in ref_values: |
677
|
|
|
vt_ref = Element('ref') |
678
|
|
|
if ref_type == "xref" and value: |
679
|
|
|
for xref in value.split(', '): |
680
|
|
|
try: |
681
|
|
|
_type, _id = xref.split(':', 1) |
682
|
|
|
except ValueError as e: |
683
|
|
|
logger.error( |
684
|
|
|
'Not possible to parse xref "%s" for VT %s: %s', |
685
|
|
|
xref, |
686
|
|
|
vt_id, |
687
|
|
|
e, |
688
|
|
|
) |
689
|
|
|
continue |
690
|
|
|
vt_ref.set('type', _type.lower()) |
691
|
|
|
vt_ref.set('id', _id) |
692
|
|
|
elif value: |
693
|
|
|
vt_ref.set('type', ref_type.lower()) |
694
|
|
|
vt_ref.set('id', value) |
695
|
|
|
else: |
696
|
|
|
continue |
697
|
|
|
vt_refs_xml.append(vt_ref) |
698
|
|
|
|
699
|
|
|
return tostring(vt_refs_xml).decode('utf-8') |
700
|
|
|
|
701
|
|
|
@staticmethod |
702
|
|
|
def get_dependencies_vt_as_xml_str( |
703
|
|
|
vt_id: str, vt_dependencies: List |
704
|
|
|
) -> str: |
705
|
|
|
"""Return an xml element with dependencies as string. |
706
|
|
|
Arguments: |
707
|
|
|
vt_id: VT OID. Only used for logging in error case. |
708
|
|
|
vt_dependencies: List with the VT dependencies. |
709
|
|
|
Return: |
710
|
|
|
Xml element as string. |
711
|
|
|
""" |
712
|
|
|
vt_deps_xml = Element('dependencies') |
713
|
|
|
for dep in vt_dependencies: |
714
|
|
|
_vt_dep = Element('dependency') |
715
|
|
|
if VT_BASE_OID in dep: |
716
|
|
|
_vt_dep.set('vt_id', dep) |
717
|
|
|
else: |
718
|
|
|
logger.error( |
719
|
|
|
'Not possible to add dependency %s for VT %s', dep, vt_id |
720
|
|
|
) |
721
|
|
|
continue |
722
|
|
|
vt_deps_xml.append(_vt_dep) |
723
|
|
|
|
724
|
|
|
return tostring(vt_deps_xml).decode('utf-8') |
725
|
|
|
|
726
|
|
|
@staticmethod |
727
|
|
|
def get_creation_time_vt_as_xml_str( |
728
|
|
|
vt_id: str, vt_creation_time: str |
729
|
|
|
) -> str: |
730
|
|
|
"""Return creation time as string. |
731
|
|
|
Arguments: |
732
|
|
|
vt_id: VT OID. Only used for logging in error case. |
733
|
|
|
vt_creation_time: String with the VT creation time. |
734
|
|
|
Return: |
735
|
|
|
Xml element as string. |
736
|
|
|
""" |
737
|
|
|
_time = Element('creation_time') |
738
|
|
|
try: |
739
|
|
|
_time.text = vt_creation_time |
740
|
|
|
except ValueError as e: |
741
|
|
|
logger.warning( |
742
|
|
|
"Not possible to parse creation time for VT %s: %s", vt_id, e |
743
|
|
|
) |
744
|
|
|
return tostring(_time).decode('utf-8') |
745
|
|
|
|
746
|
|
|
@staticmethod |
747
|
|
|
def get_modification_time_vt_as_xml_str( |
748
|
|
|
vt_id: str, vt_modification_time: str |
749
|
|
|
) -> str: |
750
|
|
|
"""Return modification time as string. |
751
|
|
|
Arguments: |
752
|
|
|
vt_id: VT OID. Only used for logging in error case. |
753
|
|
|
vt_modification_time: String with the VT modification time. |
754
|
|
|
Return: |
755
|
|
|
Xml element as string. |
756
|
|
|
""" |
757
|
|
|
_time = Element('modification_time') |
758
|
|
|
try: |
759
|
|
|
_time.text = vt_modification_time |
760
|
|
|
except ValueError as e: |
761
|
|
|
logger.warning( |
762
|
|
|
"Not possible to parse modification time for VT %s: %s", |
763
|
|
|
vt_id, |
764
|
|
|
e, |
765
|
|
|
) |
766
|
|
|
return tostring(_time).decode('utf-8') |
767
|
|
|
|
768
|
|
|
@staticmethod |
769
|
|
|
def get_summary_vt_as_xml_str(vt_id: str, summary: str) -> str: |
770
|
|
|
"""Return summary as string. |
771
|
|
|
Arguments: |
772
|
|
|
vt_id: VT OID. Only used for logging in error case. |
773
|
|
|
summary: String with a VT summary. |
774
|
|
|
Return: |
775
|
|
|
Xml element as string. |
776
|
|
|
""" |
777
|
|
|
_summary = Element('summary') |
778
|
|
|
try: |
779
|
|
|
_summary.text = summary |
780
|
|
|
except ValueError as e: |
781
|
|
|
logger.warning( |
782
|
|
|
"Not possible to parse summary tag for VT %s: %s", vt_id, e |
783
|
|
|
) |
784
|
|
|
return tostring(_summary).decode('utf-8') |
785
|
|
|
|
786
|
|
|
@staticmethod |
787
|
|
|
def get_impact_vt_as_xml_str(vt_id: str, impact) -> str: |
788
|
|
|
"""Return impact as string. |
789
|
|
|
|
790
|
|
|
Arguments: |
791
|
|
|
vt_id (str): VT OID. Only used for logging in error case. |
792
|
|
|
impact (str): String which explain the vulneravility impact. |
793
|
|
|
Return: |
794
|
|
|
string: xml element as string. |
795
|
|
|
""" |
796
|
|
|
_impact = Element('impact') |
797
|
|
|
try: |
798
|
|
|
_impact.text = impact |
799
|
|
|
except ValueError as e: |
800
|
|
|
logger.warning( |
801
|
|
|
"Not possible to parse impact tag for VT %s: %s", vt_id, e |
802
|
|
|
) |
803
|
|
|
return tostring(_impact).decode('utf-8') |
804
|
|
|
|
805
|
|
|
@staticmethod |
806
|
|
|
def get_affected_vt_as_xml_str(vt_id: str, affected: str) -> str: |
807
|
|
|
"""Return affected as string. |
808
|
|
|
Arguments: |
809
|
|
|
vt_id: VT OID. Only used for logging in error case. |
810
|
|
|
affected: String which explain what is affected. |
811
|
|
|
Return: |
812
|
|
|
Xml element as string. |
813
|
|
|
""" |
814
|
|
|
_affected = Element('affected') |
815
|
|
|
try: |
816
|
|
|
_affected.text = affected |
817
|
|
|
except ValueError as e: |
818
|
|
|
logger.warning( |
819
|
|
|
"Not possible to parse affected tag for VT %s: %s", vt_id, e |
820
|
|
|
) |
821
|
|
|
return tostring(_affected).decode('utf-8') |
822
|
|
|
|
823
|
|
|
@staticmethod |
824
|
|
|
def get_insight_vt_as_xml_str(vt_id: str, insight: str) -> str: |
825
|
|
|
"""Return insight as string. |
826
|
|
|
Arguments: |
827
|
|
|
vt_id: VT OID. Only used for logging in error case. |
828
|
|
|
insight: String giving an insight of the vulnerability. |
829
|
|
|
Return: |
830
|
|
|
Xml element as string. |
831
|
|
|
""" |
832
|
|
|
_insight = Element('insight') |
833
|
|
|
try: |
834
|
|
|
_insight.text = insight |
835
|
|
|
except ValueError as e: |
836
|
|
|
logger.warning( |
837
|
|
|
"Not possible to parse insight tag for VT %s: %s", vt_id, e |
838
|
|
|
) |
839
|
|
|
return tostring(_insight).decode('utf-8') |
840
|
|
|
|
841
|
|
|
@staticmethod |
842
|
|
|
def get_solution_vt_as_xml_str( |
843
|
|
|
vt_id: str, |
844
|
|
|
solution: str, |
845
|
|
|
solution_type: Optional[str] = None, |
846
|
|
|
solution_method: Optional[str] = None, |
847
|
|
|
) -> str: |
848
|
|
|
"""Return solution as string. |
849
|
|
|
Arguments: |
850
|
|
|
vt_id: VT OID. Only used for logging in error case. |
851
|
|
|
solution: String giving a possible solution. |
852
|
|
|
solution_type: A solution type |
853
|
|
|
solution_method: A solution method |
854
|
|
|
Return: |
855
|
|
|
Xml element as string. |
856
|
|
|
""" |
857
|
|
|
_solution = Element('solution') |
858
|
|
|
try: |
859
|
|
|
_solution.text = solution |
860
|
|
|
except ValueError as e: |
861
|
|
|
logger.warning( |
862
|
|
|
"Not possible to parse solution tag for VT %s: %s", vt_id, e |
863
|
|
|
) |
864
|
|
|
if solution_type: |
865
|
|
|
_solution.set('type', solution_type) |
866
|
|
|
if solution_method: |
867
|
|
|
_solution.set('method', solution_method) |
868
|
|
|
return tostring(_solution).decode('utf-8') |
869
|
|
|
|
870
|
|
|
@staticmethod |
871
|
|
|
def get_detection_vt_as_xml_str( |
872
|
|
|
vt_id: str, |
873
|
|
|
detection: Optional[str] = None, |
874
|
|
|
qod_type: Optional[str] = None, |
875
|
|
|
qod: Optional[str] = None, |
876
|
|
|
) -> str: |
877
|
|
|
"""Return detection as string. |
878
|
|
|
Arguments: |
879
|
|
|
vt_id: VT OID. Only used for logging in error case. |
880
|
|
|
detection: String which explain how the vulnerability |
881
|
|
|
was detected. |
882
|
|
|
qod_type: qod type. |
883
|
|
|
qod: qod value. |
884
|
|
|
Return: |
885
|
|
|
Xml element as string. |
886
|
|
|
""" |
887
|
|
|
_detection = Element('detection') |
888
|
|
|
if detection: |
889
|
|
|
try: |
890
|
|
|
_detection.text = detection |
891
|
|
|
except ValueError as e: |
892
|
|
|
logger.warning( |
893
|
|
|
"Not possible to parse detection tag for VT %s: %s", |
894
|
|
|
vt_id, |
895
|
|
|
e, |
896
|
|
|
) |
897
|
|
|
if qod_type: |
898
|
|
|
_detection.set('qod_type', qod_type) |
899
|
|
|
elif qod: |
900
|
|
|
_detection.set('qod', qod) |
901
|
|
|
|
902
|
|
|
return tostring(_detection).decode('utf-8') |
903
|
|
|
|
904
|
|
|
@property |
905
|
|
|
def is_running_as_root(self) -> bool: |
906
|
|
|
"""Check if it is running as root user.""" |
907
|
|
|
if self._is_running_as_root is not None: |
908
|
|
|
return self._is_running_as_root |
909
|
|
|
|
910
|
|
|
self._is_running_as_root = False |
911
|
|
|
if geteuid() == 0: |
912
|
|
|
self._is_running_as_root = True |
913
|
|
|
|
914
|
|
|
return self._is_running_as_root |
915
|
|
|
|
916
|
|
|
@property |
917
|
|
|
def sudo_available(self) -> bool: |
918
|
|
|
"""Checks that sudo is available""" |
919
|
|
|
if self._sudo_available is not None: |
920
|
|
|
return self._sudo_available |
921
|
|
|
|
922
|
|
|
if self.is_running_as_root: |
923
|
|
|
self._sudo_available = False |
924
|
|
|
return self._sudo_available |
925
|
|
|
|
926
|
|
|
self._sudo_available = Openvas.check_sudo() |
927
|
|
|
|
928
|
|
|
return self._sudo_available |
929
|
|
|
|
930
|
|
|
def check(self) -> bool: |
931
|
|
|
"""Checks that openvas command line tool is found and |
932
|
|
|
is executable.""" |
933
|
|
|
has_openvas = Openvas.check() |
934
|
|
|
if not has_openvas: |
935
|
|
|
logger.error( |
936
|
|
|
'openvas executable not available. Please install openvas' |
937
|
|
|
' into your PATH.' |
938
|
|
|
) |
939
|
|
|
return has_openvas |
940
|
|
|
|
941
|
|
|
def report_openvas_scan_status(self, kbdb: BaseDB, scan_id: str): |
942
|
|
|
"""Get all status entries from redis kb. |
943
|
|
|
|
944
|
|
|
Arguments: |
945
|
|
|
kbdb: KB context where to get the status from. |
946
|
|
|
scan_id: Scan ID to identify the current scan. |
947
|
|
|
""" |
948
|
|
|
all_status = kbdb.get_scan_status() |
949
|
|
|
all_hosts = dict() |
950
|
|
|
finished_hosts = list() |
951
|
|
|
for res in all_status: |
952
|
|
|
try: |
953
|
|
|
current_host, launched, total = res.split('/') |
954
|
|
|
except ValueError: |
955
|
|
|
continue |
956
|
|
|
|
957
|
|
|
try: |
958
|
|
|
if float(total) == 0: |
959
|
|
|
continue |
960
|
|
|
elif float(total) == ScanProgress.DEAD_HOST: |
961
|
|
|
host_prog = ScanProgress.DEAD_HOST |
962
|
|
|
else: |
963
|
|
|
host_prog = int((float(launched) / float(total)) * 100) |
964
|
|
|
except TypeError: |
965
|
|
|
continue |
966
|
|
|
|
967
|
|
|
all_hosts[current_host] = host_prog |
968
|
|
|
|
969
|
|
|
if ( |
970
|
|
|
host_prog == ScanProgress.DEAD_HOST |
971
|
|
|
or host_prog == ScanProgress.FINISHED |
972
|
|
|
): |
973
|
|
|
finished_hosts.append(current_host) |
974
|
|
|
|
975
|
|
|
logger.debug( |
976
|
|
|
'%s: Host %s has progress: %d', scan_id, current_host, host_prog |
977
|
|
|
) |
978
|
|
|
|
979
|
|
|
self.set_scan_progress_batch(scan_id, host_progress=all_hosts) |
980
|
|
|
|
981
|
|
|
self.sort_host_finished(scan_id, finished_hosts) |
982
|
|
|
|
983
|
|
|
def report_openvas_results(self, db: BaseDB, scan_id: str) -> bool: |
984
|
|
|
"""Get all result entries from redis kb.""" |
985
|
|
|
|
986
|
|
|
vthelper = VtHelper(self.nvti) |
987
|
|
|
|
988
|
|
|
# Result messages come in the next form, with optional uri field |
989
|
|
|
# type ||| host ip ||| hostname ||| port ||| OID ||| value [|||uri] |
990
|
|
|
all_results = db.get_result() |
991
|
|
|
res_list = ResultList() |
992
|
|
|
total_dead = 0 |
993
|
|
|
for res in all_results: |
994
|
|
|
if not res: |
995
|
|
|
continue |
996
|
|
|
|
997
|
|
|
msg = res.split('|||') |
998
|
|
|
roid = msg[4].strip() |
999
|
|
|
rqod = '' |
1000
|
|
|
rname = '' |
1001
|
|
|
current_host = msg[1].strip() if msg[1] else '' |
1002
|
|
|
rhostname = msg[2].strip() if msg[2] else '' |
1003
|
|
|
host_is_dead = "Host dead" in msg[5] or msg[0] == "DEADHOST" |
1004
|
|
|
host_deny = "Host access denied" in msg[5] |
1005
|
|
|
start_end_msg = msg[0] == "HOST_START" or msg[0] == "HOST_END" |
1006
|
|
|
host_count = msg[0] == "HOSTS_COUNT" |
1007
|
|
|
vt_aux = None |
1008
|
|
|
|
1009
|
|
|
# URI is optional and msg list length must be checked |
1010
|
|
|
ruri = '' |
1011
|
|
|
if len(msg) > 6: |
1012
|
|
|
ruri = msg[6] |
1013
|
|
|
|
1014
|
|
|
if ( |
1015
|
|
|
roid |
1016
|
|
|
and not host_is_dead |
1017
|
|
|
and not host_deny |
1018
|
|
|
and not start_end_msg |
1019
|
|
|
and not host_count |
1020
|
|
|
): |
1021
|
|
|
vt_aux = vthelper.get_single_vt(roid) |
1022
|
|
|
|
1023
|
|
|
if ( |
1024
|
|
|
not vt_aux |
1025
|
|
|
and not host_is_dead |
1026
|
|
|
and not host_deny |
1027
|
|
|
and not start_end_msg |
1028
|
|
|
and not host_count |
1029
|
|
|
): |
1030
|
|
|
logger.warning('Invalid VT oid %s for a result', roid) |
1031
|
|
|
|
1032
|
|
|
if vt_aux: |
1033
|
|
|
if vt_aux.get('qod_type'): |
1034
|
|
|
qod_t = vt_aux.get('qod_type') |
1035
|
|
|
rqod = self.nvti.QOD_TYPES[qod_t] |
1036
|
|
|
elif vt_aux.get('qod'): |
1037
|
|
|
rqod = vt_aux.get('qod') |
1038
|
|
|
|
1039
|
|
|
rname = vt_aux.get('name') |
1040
|
|
|
|
1041
|
|
|
if msg[0] == 'ERRMSG': |
1042
|
|
|
res_list.add_scan_error_to_list( |
1043
|
|
|
host=current_host, |
1044
|
|
|
hostname=rhostname, |
1045
|
|
|
name=rname, |
1046
|
|
|
value=msg[5], |
1047
|
|
|
port=msg[3], |
1048
|
|
|
test_id=roid, |
1049
|
|
|
uri=ruri, |
1050
|
|
|
) |
1051
|
|
|
|
1052
|
|
|
elif msg[0] == 'HOST_START' or msg[0] == 'HOST_END': |
1053
|
|
|
res_list.add_scan_log_to_list( |
1054
|
|
|
host=current_host, |
1055
|
|
|
name=msg[0], |
1056
|
|
|
value=msg[5], |
1057
|
|
|
) |
1058
|
|
|
|
1059
|
|
|
elif msg[0] == 'LOG': |
1060
|
|
|
res_list.add_scan_log_to_list( |
1061
|
|
|
host=current_host, |
1062
|
|
|
hostname=rhostname, |
1063
|
|
|
name=rname, |
1064
|
|
|
value=msg[5], |
1065
|
|
|
port=msg[3], |
1066
|
|
|
qod=rqod, |
1067
|
|
|
test_id=roid, |
1068
|
|
|
uri=ruri, |
1069
|
|
|
) |
1070
|
|
|
|
1071
|
|
|
elif msg[0] == 'HOST_DETAIL': |
1072
|
|
|
res_list.add_scan_host_detail_to_list( |
1073
|
|
|
host=current_host, |
1074
|
|
|
hostname=rhostname, |
1075
|
|
|
name=rname, |
1076
|
|
|
value=msg[5], |
1077
|
|
|
uri=ruri, |
1078
|
|
|
) |
1079
|
|
|
|
1080
|
|
|
elif msg[0] == 'ALARM': |
1081
|
|
|
rseverity = vthelper.get_severity_score(vt_aux) |
1082
|
|
|
res_list.add_scan_alarm_to_list( |
1083
|
|
|
host=current_host, |
1084
|
|
|
hostname=rhostname, |
1085
|
|
|
name=rname, |
1086
|
|
|
value=msg[5], |
1087
|
|
|
port=msg[3], |
1088
|
|
|
test_id=roid, |
1089
|
|
|
severity=rseverity, |
1090
|
|
|
qod=rqod, |
1091
|
|
|
uri=ruri, |
1092
|
|
|
) |
1093
|
|
|
|
1094
|
|
|
# To process non-scanned dead hosts when |
1095
|
|
|
# test_alive_host_only in openvas is enable |
1096
|
|
|
elif msg[0] == 'DEADHOST': |
1097
|
|
|
try: |
1098
|
|
|
total_dead = int(msg[5]) |
1099
|
|
|
except TypeError: |
1100
|
|
|
logger.debug('Error processing dead host count') |
1101
|
|
|
|
1102
|
|
|
# To update total host count |
1103
|
|
|
if msg[0] == 'HOSTS_COUNT': |
1104
|
|
|
try: |
1105
|
|
|
count_total = int(msg[5]) |
1106
|
|
|
logger.debug( |
1107
|
|
|
'%s: Set total hosts counted by OpenVAS: %d', |
1108
|
|
|
scan_id, |
1109
|
|
|
count_total, |
1110
|
|
|
) |
1111
|
|
|
self.set_scan_total_hosts(scan_id, count_total) |
1112
|
|
|
except TypeError: |
1113
|
|
|
logger.debug('Error processing total host count') |
1114
|
|
|
|
1115
|
|
|
# Insert result batch into the scan collection table. |
1116
|
|
|
if len(res_list): |
1117
|
|
|
self.scan_collection.add_result_list(scan_id, res_list) |
1118
|
|
|
logger.debug( |
1119
|
|
|
'%s: Inserting %d results into scan collection table', |
1120
|
|
|
scan_id, |
1121
|
|
|
len(res_list), |
1122
|
|
|
) |
1123
|
|
|
if total_dead: |
1124
|
|
|
logger.debug( |
1125
|
|
|
'%s: Set dead hosts counted by OpenVAS: %d', |
1126
|
|
|
scan_id, |
1127
|
|
|
total_dead, |
1128
|
|
|
) |
1129
|
|
|
self.scan_collection.set_amount_dead_hosts( |
1130
|
|
|
scan_id, total_dead=total_dead |
1131
|
|
|
) |
1132
|
|
|
|
1133
|
|
|
return len(res_list) > 0 |
1134
|
|
|
|
1135
|
|
|
@staticmethod |
1136
|
|
|
def is_openvas_process_alive(openvas_process: psutil.Popen) -> bool: |
1137
|
|
|
|
1138
|
|
|
if openvas_process.status() == psutil.STATUS_ZOMBIE: |
1139
|
|
|
logger.debug("Process is a Zombie, waiting for it to clean up") |
1140
|
|
|
openvas_process.wait() |
1141
|
|
|
return openvas_process.is_running() |
1142
|
|
|
|
1143
|
|
|
def stop_scan_cleanup( |
1144
|
|
|
self, |
1145
|
|
|
kbdb: BaseDB, |
1146
|
|
|
scan_id: str, |
1147
|
|
|
ovas_process: psutil.Popen, # pylint: disable=arguments-differ |
1148
|
|
|
): |
1149
|
|
|
"""Set a key in redis to indicate the wrapper is stopped. |
1150
|
|
|
It is done through redis because it is a new multiprocess |
1151
|
|
|
instance and it is not possible to reach the variables |
1152
|
|
|
of the grandchild process. |
1153
|
|
|
Indirectly sends SIGUSR1 to the running openvas scan process |
1154
|
|
|
via an invocation of openvas with the --scan-stop option to |
1155
|
|
|
stop it.""" |
1156
|
|
|
|
1157
|
|
|
if kbdb: |
1158
|
|
|
# Set stop flag in redis |
1159
|
|
|
kbdb.stop_scan(scan_id) |
1160
|
|
|
|
1161
|
|
|
# Check if openvas is running |
1162
|
|
|
if ovas_process.is_running(): |
1163
|
|
|
# Cleaning in case of Zombie Process |
1164
|
|
|
if ovas_process.status() == psutil.STATUS_ZOMBIE: |
1165
|
|
|
logger.debug( |
1166
|
|
|
'%s: Process with PID %s is a Zombie process.' |
1167
|
|
|
' Cleaning up...', |
1168
|
|
|
scan_id, |
1169
|
|
|
ovas_process.pid, |
1170
|
|
|
) |
1171
|
|
|
ovas_process.wait() |
1172
|
|
|
# Stop openvas process and wait until it stopped |
1173
|
|
|
else: |
1174
|
|
|
can_stop_scan = Openvas.stop_scan( |
1175
|
|
|
scan_id, |
1176
|
|
|
not self.is_running_as_root and self.sudo_available, |
1177
|
|
|
) |
1178
|
|
|
if not can_stop_scan: |
1179
|
|
|
logger.debug( |
1180
|
|
|
'Not possible to stop scan process: %s.', |
1181
|
|
|
ovas_process, |
1182
|
|
|
) |
1183
|
|
|
return |
1184
|
|
|
|
1185
|
|
|
logger.debug('Stopping process: %s', ovas_process) |
1186
|
|
|
|
1187
|
|
|
while ovas_process.is_running(): |
1188
|
|
|
if ovas_process.status() == psutil.STATUS_ZOMBIE: |
1189
|
|
|
ovas_process.wait() |
1190
|
|
|
else: |
1191
|
|
|
time.sleep(0.1) |
1192
|
|
|
else: |
1193
|
|
|
logger.debug( |
1194
|
|
|
"%s: Process with PID %s already stopped", |
1195
|
|
|
scan_id, |
1196
|
|
|
ovas_process.pid, |
1197
|
|
|
) |
1198
|
|
|
|
1199
|
|
|
# Clean redis db |
1200
|
|
|
for scan_db in kbdb.get_scan_databases(): |
1201
|
|
|
self.main_db.release_database(scan_db) |
1202
|
|
|
|
1203
|
|
|
def exec_scan(self, scan_id: str): |
1204
|
|
|
"""Starts the OpenVAS scanner for scan_id scan.""" |
1205
|
|
|
params = self.scan_collection.get_options(scan_id) |
1206
|
|
|
if params.get("dry_run"): |
1207
|
|
|
dryrun = DryRun(self) |
1208
|
|
|
dryrun.exec_dry_run_scan(scan_id, self.nvti, OSPD_PARAMS) |
1209
|
|
|
return |
1210
|
|
|
|
1211
|
|
|
do_not_launch = False |
1212
|
|
|
kbdb = self.main_db.get_new_kb_database() |
1213
|
|
|
scan_prefs = PreferenceHandler( |
1214
|
|
|
scan_id, kbdb, self.scan_collection, self.nvti |
1215
|
|
|
) |
1216
|
|
|
kbdb.add_scan_id(scan_id) |
1217
|
|
|
scan_prefs.prepare_target_for_openvas() |
1218
|
|
|
|
1219
|
|
|
if not scan_prefs.prepare_ports_for_openvas(): |
1220
|
|
|
self.add_scan_error( |
1221
|
|
|
scan_id, name='', host='', value='Invalid port list.' |
1222
|
|
|
) |
1223
|
|
|
do_not_launch = True |
1224
|
|
|
|
1225
|
|
|
# Set credentials |
1226
|
|
|
if not scan_prefs.prepare_credentials_for_openvas(): |
1227
|
|
|
error = ( |
1228
|
|
|
'All authentifications contain errors.' |
1229
|
|
|
+ 'Starting unauthenticated scan instead.' |
1230
|
|
|
) |
1231
|
|
|
self.add_scan_error( |
1232
|
|
|
scan_id, |
1233
|
|
|
name='', |
1234
|
|
|
host='', |
1235
|
|
|
value=error, |
1236
|
|
|
) |
1237
|
|
|
logger.error(error) |
1238
|
|
|
errors = scan_prefs.get_error_messages() |
1239
|
|
|
for e in errors: |
1240
|
|
|
error = 'Malformed credential. ' + e |
1241
|
|
|
self.add_scan_error( |
1242
|
|
|
scan_id, |
1243
|
|
|
name='', |
1244
|
|
|
host='', |
1245
|
|
|
value=error, |
1246
|
|
|
) |
1247
|
|
|
logger.error(error) |
1248
|
|
|
|
1249
|
|
|
if not scan_prefs.prepare_plugins_for_openvas(): |
1250
|
|
|
self.add_scan_error( |
1251
|
|
|
scan_id, name='', host='', value='No VTS to run.' |
1252
|
|
|
) |
1253
|
|
|
do_not_launch = True |
1254
|
|
|
|
1255
|
|
|
scan_prefs.prepare_main_kbindex_for_openvas() |
1256
|
|
|
scan_prefs.prepare_host_options_for_openvas() |
1257
|
|
|
scan_prefs.prepare_scan_params_for_openvas(OSPD_PARAMS) |
1258
|
|
|
scan_prefs.prepare_reverse_lookup_opt_for_openvas() |
1259
|
|
|
scan_prefs.prepare_alive_test_option_for_openvas() |
1260
|
|
|
|
1261
|
|
|
# VT preferences are stored after all preferences have been processed, |
1262
|
|
|
# since alive tests preferences have to be able to overwrite default |
1263
|
|
|
# preferences of ping_host.nasl for the classic method. |
1264
|
|
|
scan_prefs.prepare_nvt_preferences() |
1265
|
|
|
scan_prefs.prepare_boreas_alive_test() |
1266
|
|
|
|
1267
|
|
|
# Release memory used for scan preferences. |
1268
|
|
|
del scan_prefs |
1269
|
|
|
|
1270
|
|
|
if do_not_launch or kbdb.scan_is_stopped(scan_id): |
1271
|
|
|
self.main_db.release_database(kbdb) |
1272
|
|
|
return |
1273
|
|
|
|
1274
|
|
|
openvas_process = Openvas.start_scan( |
1275
|
|
|
scan_id, |
1276
|
|
|
not self.is_running_as_root and self.sudo_available, |
1277
|
|
|
self._niceness, |
1278
|
|
|
) |
1279
|
|
|
|
1280
|
|
|
if openvas_process is None: |
1281
|
|
|
self.main_db.release_database(kbdb) |
1282
|
|
|
return |
1283
|
|
|
|
1284
|
|
|
kbdb.add_scan_process_id(openvas_process.pid) |
1285
|
|
|
logger.debug('pid = %s', openvas_process.pid) |
1286
|
|
|
|
1287
|
|
|
# Wait until the scanner starts and loads all the preferences. |
1288
|
|
|
while kbdb.get_status(scan_id) == 'new': |
1289
|
|
|
res = openvas_process.poll() |
1290
|
|
|
if res and res < 0: |
1291
|
|
|
self.stop_scan_cleanup(kbdb, scan_id, openvas_process) |
1292
|
|
|
logger.error( |
1293
|
|
|
'It was not possible run the task %s, since openvas ended ' |
1294
|
|
|
'unexpectedly with errors during launching.', |
1295
|
|
|
scan_id, |
1296
|
|
|
) |
1297
|
|
|
return |
1298
|
|
|
|
1299
|
|
|
time.sleep(1) |
1300
|
|
|
|
1301
|
|
|
got_results = False |
1302
|
|
|
while True: |
1303
|
|
|
|
1304
|
|
|
openvas_process_is_alive = self.is_openvas_process_alive( |
1305
|
|
|
openvas_process |
1306
|
|
|
) |
1307
|
|
|
target_is_finished = kbdb.target_is_finished(scan_id) |
1308
|
|
|
scan_stopped = self.get_scan_status(scan_id) == ScanStatus.STOPPED |
1309
|
|
|
|
1310
|
|
|
# Report new Results and update status |
1311
|
|
|
got_results = self.report_openvas_results(kbdb, scan_id) |
1312
|
|
|
self.report_openvas_scan_status(kbdb, scan_id) |
1313
|
|
|
|
1314
|
|
|
# Check if the client stopped the whole scan |
1315
|
|
|
if scan_stopped: |
1316
|
|
|
logger.debug('%s: Scan stopped by the client', scan_id) |
1317
|
|
|
|
1318
|
|
|
self.stop_scan_cleanup(kbdb, scan_id, openvas_process) |
1319
|
|
|
|
1320
|
|
|
# clean main_db, but wait for scanner to finish. |
1321
|
|
|
while not kbdb.target_is_finished(scan_id): |
1322
|
|
|
logger.debug('%s: Waiting for openvas to finish', scan_id) |
1323
|
|
|
time.sleep(1) |
1324
|
|
|
self.main_db.release_database(kbdb) |
1325
|
|
|
return |
1326
|
|
|
|
1327
|
|
|
# Scan end. No kb in use for this scan id |
1328
|
|
|
if target_is_finished: |
1329
|
|
|
logger.debug('%s: Target is finished', scan_id) |
1330
|
|
|
break |
1331
|
|
|
|
1332
|
|
|
if not openvas_process_is_alive: |
1333
|
|
|
logger.error( |
1334
|
|
|
'Task %s was unexpectedly stopped or killed.', |
1335
|
|
|
scan_id, |
1336
|
|
|
) |
1337
|
|
|
self.add_scan_error( |
1338
|
|
|
scan_id, |
1339
|
|
|
name='', |
1340
|
|
|
host='', |
1341
|
|
|
value='Task was unexpectedly stopped or killed.', |
1342
|
|
|
) |
1343
|
|
|
|
1344
|
|
|
# check for scanner error messages before leaving. |
1345
|
|
|
self.report_openvas_results(kbdb, scan_id) |
1346
|
|
|
|
1347
|
|
|
kbdb.stop_scan(scan_id) |
1348
|
|
|
|
1349
|
|
|
for scan_db in kbdb.get_scan_databases(): |
1350
|
|
|
self.main_db.release_database(scan_db) |
1351
|
|
|
self.main_db.release_database(kbdb) |
1352
|
|
|
return |
1353
|
|
|
|
1354
|
|
|
# Wait a second before trying to get result from redis if there |
1355
|
|
|
# was no results before. |
1356
|
|
|
# Otherwise, wait 50 msec to give access other process to redis. |
1357
|
|
|
if not got_results: |
1358
|
|
|
time.sleep(1) |
1359
|
|
|
else: |
1360
|
|
|
time.sleep(0.05) |
1361
|
|
|
got_results = False |
1362
|
|
|
|
1363
|
|
|
# Delete keys from KB related to this scan task. |
1364
|
|
|
logger.debug('%s: End Target. Release main database', scan_id) |
1365
|
|
|
self.main_db.release_database(kbdb) |
1366
|
|
|
|
1367
|
|
|
|
1368
|
|
|
def main(): |
1369
|
|
|
"""OSP openvas main function.""" |
1370
|
|
|
daemon_main('OSPD - openvas', OSPDopenvas) |
1371
|
|
|
|
1372
|
|
|
|
1373
|
|
|
if __name__ == '__main__': |
1374
|
|
|
main() |
1375
|
|
|
|