peridot/apollo/workflow/autocreate_advisory.go
2022-10-30 02:59:43 +01:00

232 lines
7.6 KiB
Go

// Copyright (c) All respective contributors to the Peridot Project. All rights reserved.
// Copyright (c) 2021-2022 Rocky Enterprise Software Foundation, Inc. All rights reserved.
// Copyright (c) 2021-2022 Ctrl IQ, Inc. All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice,
// this list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
// this list of conditions and the following disclaimer in the documentation
// and/or other materials provided with the distribution.
//
// 3. Neither the name of the copyright holder nor the names of its contributors
// may be used to endorse or promote products derived from this software without
// specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
package workflow
import (
"database/sql"
"fmt"
"github.com/sirupsen/logrus"
"go.temporal.io/sdk/workflow"
apollodb "peridot.resf.org/apollo/db"
"peridot.resf.org/apollo/rpmutils"
"strconv"
"strings"
"time"
)
func (c *Controller) AutoCreateAdvisoryActivity() error {
cves, err := c.db.GetAllCVEsFixedDownstream()
if err != nil {
c.log.Errorf("Could not get cves fixed downstream: %v", err)
return fmt.Errorf("could not get cves fixed downstream")
}
rebootSuggestedPackages, err := c.db.GetAllRebootSuggestedPackages()
if err != nil {
c.log.Errorf("Could not get reboot suggested packages: %v", err)
return fmt.Errorf("could not get reboot suggested packages")
}
for _, cve := range cves {
beginTx, err := c.db.Begin()
if err != nil {
logrus.Errorf("could not begin tx: %v", err)
continue
}
tx := c.db.UseTransaction(beginTx)
affectedProducts, err := tx.GetAllAffectedProductsByCVE(cve.ID)
if err != nil {
logrus.Errorf("Could not get affected products for %s: %v", cve.ID, err)
_ = beginTx.Rollback()
continue
}
var existingAdvisory *apollodb.Advisory
didSkip := false
for _, affectedProduct := range affectedProducts {
if !affectedProduct.Advisory.Valid {
continue
}
product, err := c.db.GetProductByID(affectedProduct.ProductID)
if err != nil {
c.log.Errorf("could not get product by id %d: %v", affectedProduct.ProductID, err)
return fmt.Errorf("could not get product by id %d", affectedProduct.ProductID)
}
advisorySplit := strings.Split(affectedProduct.Advisory.String, "-")
numYearSplit := strings.Split(advisorySplit[1], ":")
year, err := strconv.Atoi(numYearSplit[0])
if err != nil {
logrus.Errorf("invalid year %s", numYearSplit[0])
continue
}
num, err := strconv.Atoi(numYearSplit[1])
if err != nil {
logrus.Errorf("invalid num %s", numYearSplit[1])
continue
}
existingAdvisory, err = tx.GetAdvisoryByCodeAndYearAndNum(product.ShortCode, year, num)
if err != nil {
if err == sql.ErrNoRows {
errata, err := c.errata.GetErrata(affectedProduct.Advisory.String)
if err != nil {
logrus.Errorf("could not get errata from Red Hat: %v", err)
didSkip = true
break
}
for i, _ := range errata.Topic {
errata.Topic[i] = strings.Replace(errata.Topic[i], "Red Hat Enterprise Linux", product.RedHatProductPrefix.String, -1)
errata.Topic[i] = strings.Replace(errata.Topic[i], "Red Hat", c.vendor, -1)
}
for i, _ := range errata.Description {
errata.Description[i] = strings.Replace(errata.Description[i], "Red Hat Enterprise Linux", product.RedHatProductPrefix.String, -1)
errata.Description[i] = strings.Replace(errata.Description[i], "Red Hat", c.vendor, -1)
}
var packageName string
if !rpmutils.Module().MatchString(affectedProduct.Package) {
packageName = affectedProduct.Package
}
newAdvisory := &apollodb.Advisory{
Year: year,
Num: num,
Synopsis: errata.Synopsis,
Topic: strings.Join(errata.Topic, "\n"),
Severity: int(errata.Severity),
Type: int(errata.Type),
Description: strings.Join(errata.Description, "\n"),
RedHatIssuedAt: sql.NullTime{Valid: true, Time: errata.IssuedAt},
ShortCodeCode: product.ShortCode,
PublishedAt: sql.NullTime{},
}
if packageName != "" {
match, err := c.checkForRebootSuggestedPackage(rebootSuggestedPackages, packageName)
if err != nil {
c.log.Errorf("could not check for reboot suggested package: %v", err)
return fmt.Errorf("could not check for reboot suggested package")
}
if match {
newAdvisory.RebootSuggested = true
}
}
newAdvisory, err = tx.CreateAdvisory(newAdvisory)
if err != nil {
logrus.Errorf("Could not create new advisory: %v", err)
didSkip = true
break
}
existingAdvisory = newAdvisory
for _, fix := range errata.Fixes {
sourceLink := fmt.Sprintf("https://bugzilla.redhat.com/show_bug.cgi?id=%s", fix.BugzillaID)
id, err := tx.CreateFix(fix.BugzillaID, "Red Hat", sourceLink, fix.Description)
if err != nil {
logrus.Errorf("Could not create fix for BZ#%s", fix.BugzillaID)
didSkip = true
break
}
err = tx.AddAdvisoryFix(existingAdvisory.ID, id)
if err != nil {
logrus.Errorf("Could not add fix BZ#%s to advisory %d", fix.BugzillaID, existingAdvisory.ID)
didSkip = true
break
}
}
if didSkip {
break
}
for _, reference := range errata.References {
// Skip redhat.com references
if strings.Contains(reference, "redhat.com") {
continue
}
err := tx.CreateAdvisoryReference(existingAdvisory.ID, reference)
if err != nil {
logrus.Errorf("Could not reference %s", reference)
didSkip = true
break
}
}
if didSkip {
break
}
} else {
logrus.Errorf("Could not reach database to retrieve advisory: %v", err)
didSkip = true
break
}
}
if didSkip {
break
}
err = tx.AddAdvisoryCVE(existingAdvisory.ID, cve.ID)
if err != nil {
logrus.Errorf("Could not add %s to advisory %d", cve.ID, existingAdvisory.ID)
didSkip = true
break
}
}
if didSkip {
_ = beginTx.Rollback()
continue
}
err = beginTx.Commit()
if err != nil {
logrus.Errorf("Could not commit database transaction: %v", err)
continue
}
logrus.Infof("Created/updated advisory %s-%d:%d for %s", existingAdvisory.ShortCodeCode, existingAdvisory.Year, existingAdvisory.Num, cve.ID)
}
return nil
}
func (c *Controller) AutoCreateAdvisoryWorkflow(ctx workflow.Context) error {
activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
ScheduleToStartTimeout: 5 * time.Minute,
StartToCloseTimeout: time.Hour,
})
return workflow.ExecuteActivity(activityCtx, c.AutoCreateAdvisoryActivity).Get(ctx, nil)
}