Merge branch 'main' into get-notes-with-get-next

.docker/prod.Dockerfile

@@ -2,16 +2,22 @@ ARG VERSION=edge
 ARG GVM_LIBS_VERSION=oldstable
 ARG DEBIAN_FRONTEND=noninteractive
 ARG IMAGE_REGISTRY=ghcr.io
+# when set it will added to the cmake command
+# As an example:
+# FEATURE_TOGGLES="-DOPENVASD=1"
+# enables openvasd feature toggle.
+ARG FEATURE_TOGGLE=""
 
 FROM ${IMAGE_REGISTRY}/greenbone/gvmd-build:${VERSION} as builder
+ARG FEATURE_TOGGLE
 
 COPY . /source
 WORKDIR /source
 
 RUN mkdir /build && \
     mkdir /install && \
     cd /build && \
-    cmake -DCMAKE_BUILD_TYPE=Release /source && \
+    cmake -DCMAKE_BUILD_TYPE=Release $FEATURE_TOGGLE /source && \
     make DESTDIR=/install install
 
 FROM greenbone/gvm-libs:${GVM_LIBS_VERSION}

.github/workflows/container.yml

@@ -14,6 +14,11 @@ jobs:
   images:
     name: Production Images
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        build:
+          - default
+          - openvasd
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -41,8 +46,9 @@ jobs:
             type=ref,event=pr
 
             # when a new git tag is created set stable and a latest tags
-            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
-            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' && matrix.build == 'default'}}
+            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' && matrix.build == 'default'}}
+            type=raw,value=edge-openvasd,enable=${{ steps.latest.outputs.is-latest-tag == 'false' && matrix.build == 'openvasd' }}
       - name: Set container build options
         id: container-opts
         run: |
@@ -53,6 +59,11 @@ jobs:
             echo "version=edge" >> $GITHUB_OUTPUT
             echo "gvm-libs-version=oldstable-edge" >> $GITHUB_OUTPUT
           fi
+          if [[ "${{ matrix.build }}" = 'openvasd' ]]; then
+            echo 'ft=-DOPENVASD=1' >> $GITHUB_OUTPUT
+          else
+            echo 'ft=-DOPENVASD=0' >> $GITHUB_OUTPUT
+          fi
       - name: Login to Docker Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
@@ -71,6 +82,7 @@ jobs:
           build-args: |
             VERSION=${{ steps.container-opts.outputs.version }}
             GVM_LIBS_VERSION=${{ steps.container-opts.outputs.gvm-libs-version }}
+            FEATURE_TOGGLE=${{ steps.container-opts.outputs.ft }}
             IMAGE_REGISTRY=${{ vars.IMAGE_REGISTRY }}
           file: .docker/prod.Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/push.yml

@@ -0,0 +1,55 @@
+name: Build and Push to Greenbone Registry
+
+on:
+  push:
+    branches: [ main ]
+    tags: ["v*"]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  building:
+    runs-on: self-hosted-generic
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - uses: greenbone/actions/is-latest-tag@v3
+        id: latest
+
+      - name: Set container build options
+        id: container-opts
+        run: |
+          if [[ "${{ github.ref_type }}" = 'tag' ]]; then
+            echo "version=stable" >> $GITHUB_OUTPUT
+            echo "gvm-libs-version=oldstable" >> $GITHUB_OUTPUT
+          else
+            echo "version=edge" >> $GITHUB_OUTPUT
+            echo "gvm-libs-version=oldstable-edge" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and Push Container
+        id: build-and-push
+        uses: greenbone/actions/container-build-push-generic@v3
+        with:
+          build-docker-file: .docker/prod.Dockerfile
+          build-args: |
+            VERSION=${{ steps.container-opts.outputs.version }}
+            GVM_LIBS_VERSION=${{ steps.container-opts.outputs.gvm-libs-version }}
+            IMAGE_REGISTRY=${{ vars.IMAGE_REGISTRY }}
+          image-url: community/gvmd
+          image-labels: |
+            org.opencontainers.image.vendor=Greenbone
+            org.opencontainers.image.base.name=greenbone/gvm-libs
+          image-tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=edge
+            type=ref,event=pr
+            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+          registry: ${{ secrets.GREENBONE_REGISTRY }}
+          registry-username: ${{ secrets.GREENBONE_REGISTRY_USER }}
+          registry-password: ${{ secrets.GREENBONE_REGISTRY_TOKEN }}

CMakeLists.txt

@@ -101,7 +101,7 @@ include (CPack)
 
 ## Variables
 
-set (GVMD_DATABASE_VERSION 255)
+set (GVMD_DATABASE_VERSION 256)
 
 set (GVMD_SCAP_DATABASE_VERSION 21)
 
@@ -235,6 +235,11 @@ if (NOT GVM_DEFAULT_DROP_USER)
   set (GVM_DEFAULT_DROP_USER "")
 endif (NOT GVM_DEFAULT_DROP_USER)
 
+
+if (NOT OPENVASD)
+  set (OPENVASD 0)
+endif (NOT OPENVASD)
+
 message ("-- Install prefix: ${CMAKE_INSTALL_PREFIX}")
 
 ## Version
@@ -275,7 +280,7 @@ set (HARDENING_FLAGS            "-Wformat -Wformat-security -D_FORTIFY_SOURCE=2
 set (LINKER_HARDENING_FLAGS     "-Wl,-z,relro -Wl,-z,now")
 
 # To find unused functions, add: -flto -fwhole-program -ffunction-sections -Wl,--gc-sections -Wl,--print-gc-sections
-set (CMAKE_C_FLAGS              "${CMAKE_C_FLAGS} -Wall -D_BSD_SOURCE -D_ISOC99_SOURCE -D_SVID_SOURCE -D_DEFAULT_SOURCE -D_FILE_OFFSET_BITS=64")
+set (CMAKE_C_FLAGS              "${CMAKE_C_FLAGS} -Wall -D_BSD_SOURCE -D_ISOC99_SOURCE -D_SVID_SOURCE -D_DEFAULT_SOURCE -D_FILE_OFFSET_BITS=64 -DOPENVASD=${OPENVASD}")
 
 set (CMAKE_C_FLAGS_DEBUG        "${CMAKE_C_FLAGS_DEBUG} -Werror -Wshadow ${COVERAGE_FLAGS} ${DEBUG_FUNCTION_NAMES_FLAGS}")
 set (CMAKE_C_FLAGS_RELEASE      "${CMAKE_C_FLAGS_RELEASE} ${HARDENING_FLAGS} ${COVERAGE_FLAGS}")

src/gmp.c

@@ -12282,7 +12282,7 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
   SEND_GET_START("credential");
   while (1)
     {
-      const char *private_key, *public_key, *login, *type, *cert;
+      const char *login, *type, *cert;
       gchar *formats_xml;
 
       ret = get_next (&credentials, &get_credentials_data->get,
@@ -12296,8 +12296,6 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
         }
 
       SEND_GET_COMMON (credential, &get_credentials_data->get, &credentials);
-      private_key = credential_iterator_private_key (&credentials);
-      public_key = credential_iterator_public_key (&credentials);
       login = credential_iterator_login (&credentials);
       type = credential_iterator_type (&credentials);
       cert = credential_iterator_certificate (&credentials);
@@ -12376,6 +12374,10 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
 
           case CREDENTIAL_FORMAT_KEY:
             {
+              const char *public_key;
+
+              public_key = credential_iterator_public_key (&credentials);
+
               if (public_key && strcmp (public_key, ""))
                 {
                   SENDF_TO_CLIENT_OR_FAIL
@@ -12384,8 +12386,9 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
               else
                 {
                   char *pub;
-                  const char *pass;
+                  const char *pass, *private_key;
 
+                  private_key = credential_iterator_private_key (&credentials);
                   pass = credential_iterator_password (&credentials);
                   pub = gvm_ssh_public_from_private (private_key, pass);
                   SENDF_TO_CLIENT_OR_FAIL
@@ -18610,9 +18613,13 @@ handle_get_tasks (gmp_parser_t *gmp_parser, GError **error)
             auto_delete ? auto_delete : "0",
             auto_delete_data ? auto_delete_data : "0");
 
+          g_free (assets_apply_overrides);
+          g_free (assets_min_qod);
           g_free (in_assets);
           g_free (max_checks);
           g_free (max_hosts);
+          g_free (auto_delete);
+          g_free (auto_delete_data);
         }
 
       count++;

src/gvmd.c

@@ -2300,6 +2300,9 @@ gvmd (int argc, char** argv, char *env[])
           else
             printf ("Sentry support disabled\n");
         }
+#if OPENVASD == 1
+      printf ("OpenVASD is enabled\n");
+#endif
       printf ("Copyright (C) 2009-2021 Greenbone AG\n");
       printf ("License: AGPL-3.0-or-later\n");
       printf
@@ -2484,6 +2487,7 @@ gvmd (int argc, char** argv, char *env[])
   /**
    * LDAP debugging
    */
+
   if (ldap_debug)
     {
       if (ldap_enable_debug () == 0)

src/lsc_crypt.c

@@ -581,6 +581,7 @@ lsc_crypt_release (lsc_crypt_ctx_t ctx)
   lsc_crypt_flush (ctx);
   if (ctx->encctx) /* Check required for gpgme < 1.3.1 */
     gpgme_release (ctx->encctx);
+  g_free (ctx->enckey_uid);
   g_free (ctx);
 }
 

src/manage.c

@@ -5085,6 +5085,8 @@ manage_sync (sigset_t *sigmask_current,
           wait_for_pid (scap_pid, "SCAP sync");
           wait_for_pid (cert_pid, "CERT sync");
 
+          update_scap_extra ();
+
           lockfile_unlock (&lockfile);
         }
     }
@@ -5977,6 +5979,54 @@ get_nvt_xml (iterator_t *nvts, int details, int pref_count,
           free (default_timeout);
         }
 
+      if (nvt_iterator_epss_cve (nvts))
+        {
+          buffer_xml_append_printf 
+             (buffer,
+              "<epss>"
+              "<max_severity>"
+              "<score>%0.5f</score>"
+              "<percentile>%0.5f</percentile>"
+              "<cve id=\"%s\">",
+              nvt_iterator_epss_score (nvts),
+              nvt_iterator_epss_percentile (nvts),
+              nvt_iterator_epss_cve (nvts));
+
+          if (nvt_iterator_has_epss_severity (nvts))
+            {
+              buffer_xml_append_printf 
+                 (buffer,
+                  "<severity>%0.1f</severity>",
+                  nvt_iterator_epss_severity (nvts));
+            }
+
+          buffer_xml_append_printf
+             (buffer,
+              "</cve>"
+              "</max_severity>"
+              "<max_epss>"
+              "<score>%0.5f</score>"
+              "<percentile>%0.5f</percentile>"
+              "<cve id=\"%s\">",
+              nvt_iterator_max_epss_score (nvts),
+              nvt_iterator_max_epss_percentile (nvts),
+              nvt_iterator_max_epss_cve (nvts));
+
+          if (nvt_iterator_has_max_epss_severity (nvts))
+            {
+              buffer_xml_append_printf 
+                 (buffer,
+                  "<severity>%0.1f</severity>",
+                  nvt_iterator_max_epss_severity (nvts));
+            }
+
+          buffer_xml_append_printf
+             (buffer,
+              "</cve>"
+              "</max_epss>"
+              "</epss>");
+        }
+
       xml_string_append (buffer, close_tag ? "</nvt>" : "");
       msg = g_string_free (buffer, FALSE);
     }

src/manage.h

@@ -1982,6 +1982,36 @@ nvt_iterator_solution_type (iterator_t*);
 const char*
 nvt_iterator_solution_method (iterator_t*);
 
+double
+nvt_iterator_epss_score (iterator_t*);
+
+double
+nvt_iterator_epss_percentile (iterator_t*);
+
+const char*
+nvt_iterator_epss_cve (iterator_t*);
+
+double
+nvt_iterator_epss_severity (iterator_t*);
+
+gboolean
+nvt_iterator_has_epss_severity (iterator_t*);
+
+double
+nvt_iterator_max_epss_score (iterator_t*);
+
+double
+nvt_iterator_max_epss_percentile (iterator_t*);
+
+const char*
+nvt_iterator_max_epss_cve (iterator_t*);
+
+double
+nvt_iterator_max_epss_severity (iterator_t*);
+
+gboolean
+nvt_iterator_has_max_epss_severity (iterator_t*);
+
 char*
 nvt_default_timeout (const char *);
 

src/manage_acl.c

@@ -1078,6 +1078,7 @@ acl_where_owned_user (const char *user_id, const char *user_sql,
   if (permissions == NULL || permissions->len == 0)
     {
       /* Treat filters with no permissions keyword as "any". */
+      g_string_free (permission_or, TRUE);
       permission_or = g_string_new ("t ()");
       index = 1;
     }

src/manage_configs.c

@@ -620,7 +620,11 @@ should_sync_configs ()
         && strlen (config_path) >= (36 /* UUID */ + strlen (".xml"))
         && g_str_has_suffix (config_path, ".xml")
         && should_sync_config_from_path (config_path, FALSE, &config))
-      return TRUE;
+      {
+        g_dir_close (dir);
+        return TRUE;
+      }
 
+  g_dir_close (dir);
   return FALSE;
 }