<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 02/29/2016 08:50 AM, Burton, Ross
wrote:<br>
</div>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">On 24 February 2016 at 15:27, <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:mariano.lopez@linux.intel.com" target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:mariano.lopez@linux.intel.com">mariano.lopez@linux.intel.com</a></a>></span>
wrote:<br>
<div class="gmail_extra">
<div class="gmail_quote"><br>
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">+do_cve_check[depends]
= "cve-check-tool-native:do_populate_cve_db"<br>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>And cve-check-tool-native:do_populate_sysroot.</div>
</div>
</div>
</div>
</blockquote>
<br>
cve-check-tool-native:do_populate_cve_db depends on
cve-check-tool-native:do_populate_sysroot, so adding it there would
be redundant.<br>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">+def
get_patches_cves(d):<br>
+ """<br>
+ Get patches that solve CVEs using the "CVE: " tag.<br>
+ """<br>
+<br>
+ import re<br>
+<br>
+ pn = d.getVar("PN", True)<br>
+ cve_match = re.compile("CVE:( CVE\-\d+\-\d+)+")<br>
</blockquote>
<div><br>
</div>
<div>How does this work as the backslashes are escaping the
- and d and d? Use r"" strings.</div>
</div>
</div>
</div>
</blockquote>
<br>
The backslashes just escape the "-", the "d" is the same as with the
raw string. I don't really see the need to use r"" here.<br>
<br>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">+
patched_cves = set()<br>
+ for url in src_patches(d):<br>
+ patch_file = bb.fetch.decodeurl(url)[2]<br>
+ with open(patch_file, "r") as f:<br>
+ patch_text = f.read()<br>
+<br>
+ # Search for the "CVE: " line<br>
+ match = cve_match.search(patch_text)<br>
+ if match:<br>
+ # Get only the CVEs without the "CVE: " tag<br>
+ cves =
patch_text[match.start()+5:match.end()]<br>
+ for cve in cves.split():<br>
+ patched_cves.add(cve)<br>
<br>
</blockquote>
<div><br>
</div>
<div>Breaks for patches such as this in glibc:</div>
<div><br>
</div>
<div>meta/recipes-core/glibc/glibc/CVE-2015-9761_1.patch:CVE:
CVE-2015-9761 patch #1</div>
<div><br>
</div>
<div>I'd probably look for a line that starts with "CVE:"
and the use re.findall to find all strings matching
r"CVE-\d{4}-\d+"</div>
</div>
</div>
</div>
</blockquote>
<br>
What do you mean by break? It does catch the CVE just fine, to test
it just revert the glibc 2.23 update. I find cleaner to match the
string in a single operation instead of searching for the tag line
by line and then match the CVEs.<br>
<br>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">+def
get_cve_info(d, cves):<br>
+ """<br>
+ Get CVE information from the database used by
cve-check-tool.<br>
+ """<br>
+<br>
+ try:<br>
+ import sqlite3<br>
+ except ImportError:<br>
+ from pysqlite2 import dbapi2 as sqlite3<br>
</blockquote>
<div><br>
</div>
<div>Isn't the output from cve-check-tool good enough?
Would it be nicer to extend the log instead of assuming
that the database format won't ever change?</div>
</div>
</div>
</div>
</blockquote>
<br>
The output from cve-check-tool is only the CVE number, if that is
good enough, the query to the database can be removed.<br>
<br>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">+def
cve_write_data(d, patched, unpatched, cve_data):<br>
+ """<br>
+ Write CVE information in WORKDIR; and to
CVE_CHECK_DIR, and<br>
+ CVE manifest if enabled.<br>
+ """<br>
+<br>
+ from bb.utils import mkdirhier<br>
+<br>
+ cve_file = d.getVar("CVE_CHECK_LOCAL_FILE", True)<br>
+ nvd_link = "<a moz-do-not-send="true"
href="https://web.nvd.nist.gov/view/vuln/detail?vulnId="
rel="noreferrer" target="_blank">https://web.nvd.nist.gov/view/vuln/detail?vulnId=</a>"<br>
+ write_string = ""<br>
+ mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR", True))<br>
+<br>
+ for cve in sorted(cve_data):<br>
+ write_string += "PACKAGE NAME: %s\n" %
d.getVar("PN", True)<br>
+ write_string += "PACKAGE VERSION: %s\n" %
d.getVar("PV", True)<br>
+ write_string += "CVE: %s\n" % cve<br>
+ if cve in patched:<br>
+ write_string += "CVE STATUS: Patched\n"<br>
+ else:<br>
+ write_string += "CVE STATUS: Unpatched\n"<br>
+ bb.warn("Found unpatched CVE, for more
information check %s" % cve_file)<br>
+ write_string += "CVE SUMMARY: %s\n" %
cve_data[cve]["summary"]<br>
+ write_string += "CVSS v2 BASE SCORE: %s\n" %
cve_data[cve]["score"]<br>
+ write_string += "VECTOR: %s\n" %
cve_data[cve]["vector"]<br>
+ write_string += "MORE INFORMATION: %s%s\n\n" %
(nvd_link, cve)<br>
+<br>
+ with open(cve_file, "w") as f:<br>
+ f.write(write_string)<br>
</blockquote>
<div><br>
</div>
<div>Just write to the file instead of to a temporary
string.</div>
</div>
</div>
</div>
</blockquote>
<br>
The temporary string is used for other two files, one could be
copied, but the other appends the string content.<br>
<br>
<blockquote
cite="mid:CAJTo0LbFnPEtokmGTK6-UzdGSEfNUz+vaHB=WhHQBQCs1HLbJw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<div>Ross</div>
</div>
</div>
</div>
</blockquote>
<br>
<div class="moz-signature">I have implemented the rest of the
comments, just need your input before sending a new version.<br>
<br>
Mariano<br>
</div>
</body>
</html>