From be789bcab8efd80fea876db73c9ce334755f4eb4 Mon Sep 17 00:00:00 2001 From: Olivier Mehani Date: Tue, 25 Apr 2017 11:04:48 +1000 Subject: [PATCH 1/3] [system/debsecan] Count unique CVEs Signed-off-by: Olivier Mehani --- plugins/debian/debsecan | 148 +------------------------------ plugins/debian/debsecan_ | 183 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 184 insertions(+), 147 deletions(-) mode change 100755 => 120000 plugins/debian/debsecan create mode 100755 plugins/debian/debsecan_ diff --git a/plugins/debian/debsecan b/plugins/debian/debsecan deleted file mode 100755 index 66bb0b4e..00000000 --- a/plugins/debian/debsecan +++ /dev/null @@ -1,147 +0,0 @@ -#!/bin/sh - -: << =cut - -=head1 NAME - -debsecan - Plugin to monitor the number of CVE vulnerabilities present on a Debian -system (using debsecan). Might work on other distib, who knows... - -=head1 CONFIGURATION - - [debsecan] - env.suite jessie - env.fixed_warn 1 - env.fixed_critical 1000 - env.remote_warn 1 - env.remote_critical 10 - -=head1 AUTHORS - -* Nicolas BOUTHORS http://nbi.fr/, Inspiration of the moment 10/10/2007 -* Olivier Mehani , 2016 - -=head1 LICENSE - -Public Domain - -=head1 MAGIC MARKERS - -%# family=auto -%# capabilities=autoconf - -=cut - -# Auto enable if we have debsecan only -if [ "$1" = "autoconf" ] ; then - if [ -x /usr/bin/debsecan ]; then - echo yes - else - echo 'no (/usr/bin/debsecan not found)' - fi - exit 0 -fi - -# Fail if we don't have debsecan -if [ ! -x /usr/bin/debsecan ]; then - echo 'error: /usr/bin/debsecan not found' >&2 - exit 1 -fi - -# Determine suite from filename... -SUITE=$(echo "$0" | sed 's/.*_//') -if [ "${SUITE}" = "${0}" ]; then - # ...or fall back onto configuration in environment - SUITE=${suite:-sid} -fi -FIXEDWARN=${fixed_warning:-1} -FIXEDCRIT=${fixed_critical:-1000} -REMOTEWARN=${remote_warning:-1} -REMOTECRIT=${remote_critical:-10} - -if [ "$1" = "config" ] ; then - cat < /dev/null) -REMOTE=$(echo "$ALL" | grep 'remotely') -NONREMOTE=$(echo "$ALL" | grep -v 'remotely') - -HIGH=$(echo "${NONREMOTE}" | grep 'high urgency') -MEDIUM=$(echo "${NONREMOTE}" | grep 'medium urgency') -LOW=$(echo "${NONREMOTE}" | grep 'low urgency') -OTHER=$(echo "${NONREMOTE}" | grep -v 'urgency') -FIXED=$(echo "${ALL}" | grep '(fixed') - -remote_count=$(echo "${REMOTE}" | wc -l) -high_count=$(echo "${HIGH}" | wc -l) -medium_count=$(echo "${MEDIUM}" | wc -l) -low_count=$(echo "${LOW}" | wc -l) -other_count=$(echo "${OTHER}" | wc -l) -fixed_count=$(echo "${FIXED}" | wc -l) - -CVECOUNTRE="s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/" - -# shellcheck disable=SC2005 disable=SC2046 -# The nested $(echo ...)s are needed to yet the newlines -cat < http://nbi.fr/, Inspiration of the moment 10/10/2007 +* Olivier Mehani , 2016 + +=head1 LICENSE + +Public Domain + +=head1 MAGIC MARKERS + +%# family=auto +%# capabilities=autoconf + +=cut + +# Auto enable if we have debsecan only +if [ "$1" = "autoconf" ] ; then + if [ -x /usr/bin/debsecan ]; then + echo yes + else + echo 'no (/usr/bin/debsecan not found)' + fi + exit 0 +fi + +# Fail if we don't have debsecan +if [ ! -x /usr/bin/debsecan ]; then + echo 'error: /usr/bin/debsecan not found' >&2 + exit 1 +fi + +SUITE=${suite:-sid} +FIXEDWARN=${fixed_warning:-1} +FIXEDCRIT=${fixed_critical:-1000} +REMOTEWARN=${remote_warning:-1} +REMOTECRIT=${remote_critical:-10} + +MODE=$(echo "$0" | sed 's/.*_//') +case "${MODE}" in + 'cve') + TITLE_ADD="unique " + CUT_FIELD=1 + ;; + 'pkg' | *) + TITLE_ADD="package " + CUT_FIELD=2 + ;; +esac + +if [ "$1" = "config" ] ; then + cat < /dev/null) +REMOTE=$(echo "$ALL" | grep 'remotely') +NONREMOTE=$(echo "$ALL" | grep -v 'remotely') + +HIGH=$(echo "${NONREMOTE}" | grep 'high urgency') +MEDIUM=$(echo "${NONREMOTE}" | grep 'medium urgency') +LOW=$(echo "${NONREMOTE}" | grep 'low urgency') +OTHER=$(echo "${NONREMOTE}" | grep -v 'urgency') +FIXED=$(echo "${ALL}" | grep '(fixed') + +case "${MODE}" in + 'cve') + remote_count=$(echo "${REMOTE}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + high_count=$(echo "${HIGH}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + medium_count=$(echo "${MEDIUM}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + low_count=$(echo "${LOW}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + other_count=$(echo "${OTHER}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + fixed_count=$(echo "${FIXED}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + ;; + 'pkg' | *) + remote_count=$(echo "${REMOTE}" | wc -l) + high_count=$(echo "${HIGH}" | wc -l) + medium_count=$(echo "${MEDIUM}" | wc -l) + low_count=$(echo "${LOW}" | wc -l) + other_count=$(echo "${OTHER}" | wc -l) + fixed_count=$(echo "${FIXED}" | wc -l) + ;; +esac + +# Reformat the output of the cut|sort|uniq... to a more human-friendly "item (count)" format +CVECOUNTRE="s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/" + +# shellcheck disable=SC2005 disable=SC2046 +# The nested $(echo ...)s are needed to yet the newlines +cat < Date: Wed, 26 Apr 2017 21:42:47 +1000 Subject: [PATCH 2/3] [debian/debsecan_] Code cleanup Signed-off-by: Olivier Mehani --- plugins/debian/debsecan_ | 50 ++++++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/plugins/debian/debsecan_ b/plugins/debian/debsecan_ index 6b1f69e5..b563116b 100755 --- a/plugins/debian/debsecan_ +++ b/plugins/debian/debsecan_ @@ -74,17 +74,17 @@ MODE=$(echo "$0" | sed 's/.*_//') case "${MODE}" in 'cve') TITLE_ADD="unique " - CUT_FIELD=1 + FIELD=1 ;; 'pkg' | *) TITLE_ADD="package " - CUT_FIELD=2 + FIELD=2 ;; esac if [ "$1" = "config" ] ; then cat < /dev/null) -REMOTE=$(echo "$ALL" | grep 'remotely') -NONREMOTE=$(echo "$ALL" | grep -v 'remotely') +REMOTE=$(echo "$ALL" | grep -w 'remotely') +NONREMOTE=$(echo "$ALL" | grep -wv 'remotely') -HIGH=$(echo "${NONREMOTE}" | grep 'high urgency') -MEDIUM=$(echo "${NONREMOTE}" | grep 'medium urgency') -LOW=$(echo "${NONREMOTE}" | grep 'low urgency') -OTHER=$(echo "${NONREMOTE}" | grep -v 'urgency') -FIXED=$(echo "${ALL}" | grep '(fixed') +HIGH=$(echo "${NONREMOTE}" | grep -w 'high urgency') +MEDIUM=$(echo "${NONREMOTE}" | grep -w 'medium urgency') +LOW=$(echo "${NONREMOTE}" | grep -w 'low urgency') +OTHER=$(echo "${NONREMOTE}" | grep -wv 'urgency') +FIXED=$(echo "${ALL}" | grep -w '(fixed') + +# Arguments: Field offset to aggregate by +count_entries() { + CUT_FIELD=${1} + cut -f "${CUT_FIELD}" -d " "| sort | uniq -c +} case "${MODE}" in 'cve') - remote_count=$(echo "${REMOTE}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) - high_count=$(echo "${HIGH}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) - medium_count=$(echo "${MEDIUM}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) - low_count=$(echo "${LOW}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) - other_count=$(echo "${OTHER}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) - fixed_count=$(echo "${FIXED}" | cut -f "${CUT_FIELD}" -d " "| sort | uniq | wc -l) + remote_count=$(echo "${REMOTE}" | count_entries ${FIELD} | wc -l) + high_count=$(echo "${HIGH}" | count_entries ${FIELD} | wc -l) + medium_count=$(echo "${MEDIUM}" | count_entries ${FIELD} | wc -l) + low_count=$(echo "${LOW}" | count_entries ${FIELD} | wc -l) + other_count=$(echo "${OTHER}" | count_entries ${FIELD} | wc -l) + fixed_count=$(echo "${FIXED}" | count_entries ${FIELD} | wc -l) ;; 'pkg' | *) remote_count=$(echo "${REMOTE}" | wc -l) @@ -169,15 +175,15 @@ CVECOUNTRE="s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/" # The nested $(echo ...)s are needed to yet the newlines cat < Date: Thu, 27 Apr 2017 12:17:13 +1000 Subject: [PATCH 3/3] [debian/debsecan_] Quote stragglers Signed-off-by: Olivier Mehani --- plugins/debian/debsecan_ | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/plugins/debian/debsecan_ b/plugins/debian/debsecan_ index b563116b..a3a381b4 100755 --- a/plugins/debian/debsecan_ +++ b/plugins/debian/debsecan_ @@ -145,18 +145,18 @@ FIXED=$(echo "${ALL}" | grep -w '(fixed') # Arguments: Field offset to aggregate by count_entries() { - CUT_FIELD=${1} + CUT_FIELD="${1}" cut -f "${CUT_FIELD}" -d " "| sort | uniq -c } case "${MODE}" in 'cve') - remote_count=$(echo "${REMOTE}" | count_entries ${FIELD} | wc -l) - high_count=$(echo "${HIGH}" | count_entries ${FIELD} | wc -l) - medium_count=$(echo "${MEDIUM}" | count_entries ${FIELD} | wc -l) - low_count=$(echo "${LOW}" | count_entries ${FIELD} | wc -l) - other_count=$(echo "${OTHER}" | count_entries ${FIELD} | wc -l) - fixed_count=$(echo "${FIXED}" | count_entries ${FIELD} | wc -l) + remote_count=$(echo "${REMOTE}" | count_entries "${FIELD}" | wc -l) + high_count=$(echo "${HIGH}" | count_entries "${FIELD}" | wc -l) + medium_count=$(echo "${MEDIUM}" | count_entries "${FIELD}" | wc -l) + low_count=$(echo "${LOW}" | count_entries "${FIELD}" | wc -l) + other_count=$(echo "${OTHER}" | count_entries "${FIELD}" | wc -l) + fixed_count=$(echo "${FIXED}" | count_entries "${FIELD}" | wc -l) ;; 'pkg' | *) remote_count=$(echo "${REMOTE}" | wc -l) @@ -175,15 +175,15 @@ CVECOUNTRE="s/^ *\([0-9]\+\) \+\([^ ]\+\)/\2 (\1)/" # The nested $(echo ...)s are needed to yet the newlines cat <