Add vt info to results

CHANGELOG.md

@@ -22,6 +22,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   Reintroduction after Rebase with
   [#788](https://github.com/greenbone/openvas/pull/788)
 - Add message type validation for proto_post_wrapped. [#805](https://github.com/greenbone/openvas/pull/805)
+- Add nvti info to openvas results. [#809](https://github.com/greenbone/openvas/pull/809)
 
 ### Changed
 - function script_bugtraq_id getting skipped, linter warns. [#724](https://github.com/greenbone/openvas/pull/724)

misc/CMakeLists.txt

@@ -85,7 +85,7 @@ include_directories (${GLIB_INCLUDE_DIRS} ${GLIB_JSON_INCLUDE_DIRS}
 # Library
 
 set (FILES bpf_share.c ftp_funcs.c vendorversion.c network.c plugutils.c pcap.c
-     strutils.c)
+     nvt_qod.c strutils.c)
 
 
 # On windows we are always PIC and stack-protector is replaces by DEP

misc/nvt_qod.c

@@ -0,0 +1,80 @@
+/* Portions Copyright (C) 2009-2021 Greenbone Networks GmbH
+ * Based on work Copyright (C) 1998 - 2007 Tenable Network Security, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/**
+ * @file 
+ * @brief Converts a qod_type string into a QoD value.
+ *
+ */
+
+#include "nvt_qod.h"
+#include <glib.h>
+
+#undef G_LOG_DOMAIN
+/**
+ * @brief GLib logging domain.
+ */
+#define G_LOG_DOMAIN "lib  misc"
+
+static const struct {
+  qod_val val;
+  const char *type;
+} qod_types[] = {
+                 {EXPLOIT, "exploit"},
+                 {REMOTE_VUL, "remote_vul"},
+                 {REMOTE_APP, "remote_app"},
+                 {PACKAGE, "package"},
+                 {REGISTRY, "registry"},
+                 {REMOTE_ACTIVE, "remote_active"},
+                 {REMOTE_BANNER, "remote_banner"},
+                 {EXECUTABLE_VERSION, "executable_version"},
+                 {REMOTE_ANALYSIS, "remote_analysis"},
+                 {REMOTE_PROBE, "remote_probe"},
+                 {REMOTE_BANNER_UNRELIABLE, "remote_banner_unreliable"},
+                 {EXECUTABLE_VERSION_UNRELIABLE, "executable_version_unreliable"},
+                 {GENERAL_NOTE, "general_note"},
+                 {DEFAULT, "default"}
+};
+
+/**
+ * @brief Converts a qod_type string into it value
+ *
+ * @param[in] qod_type String containing the qod type
+ *
+ * @return The value corresponding to the given qod type. Defaults to 70 if
+ * the given type does not exist. -1 if a  null pointer was given.
+ */
+int
+qod_type2val (const char *qod_type)
+{
+  unsigned int i;
+
+  g_message ("GGGGG %s",qod_type);
+
+  if (!qod_type)
+    return -1;
+
+  for (i = 0; i < sizeof (qod_types) / sizeof (qod_types[i]); i++)
+    {
+      if (!g_strcmp0(qod_types[i].type, qod_type))
+        return qod_types[i].val;
+    }
+  return DEFAULT;
+}

misc/nvt_qod.h

@@ -0,0 +1,52 @@
+/* Portions Copyright (C) 2009-2021 Greenbone Networks GmbH
+ * Based on work Copyright (C) 1998 - 2007 Tenable Network Security, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/**
+ * @file nvt_qod_types.h
+ * @brief QOD_TYPES definitions.
+ *
+ * This file contains defines for the QoD types of NVTs.
+ */
+
+#ifndef _NVT_QOD_H
+#define _NVT_QOD_H
+
+typedef enum
+{
+        EXPLOIT = 100,
+        REMOTE_VUL = 99,
+        REMOTE_APP = 98,
+        PACKAGE = 97,
+        REGISTRY = 97,
+        REMOTE_ACTIVE = 95,
+        REMOTE_BANNER = 80,
+        EXECUTABLE_VERSION = 80,
+        REMOTE_ANALYSIS = 70,
+        REMOTE_PROBE = 50,
+        REMOTE_BANNER_UNRELIABLE = 30,
+        EXECUTABLE_VERSION_UNRELIABLE = 30,
+        GENERAL_NOTE = 1,
+        DEFAULT = 70,
+} qod_val;
+
+int
+qod_type2val (const char *);
+
+#endif /* _NVT_QOD_H */

misc/plugutils.c

@@ -26,8 +26,10 @@
 #include "plugutils.h"
 
 #include "network.h" // for OPENVAS_ENCAPS_IP
+#include "nvt_qod.h" // for qod_str2val
 
 #include <errno.h>               // for errno
+#include <gvm/base/cvss.h>       // for get_cvss_score_from_base_metrics
 #include <gvm/base/hosts.h>      // for g_vhost_t
 #include <gvm/base/networking.h> // for port_protocol_t
 #include <gvm/base/prefs.h>      // for prefs_get_bool
@@ -405,6 +407,104 @@ make_table_driven_lsc_info_json_str (const char *scan_id, const char *ip_str,
   return json_str;
 }
 
+/**
+ * @brief Get the nvti's severity vector and return the score as string.
+ *
+ * @param[in] nvti     The nvti where to get the severity vector from.
+ *
+ * @return string representing a float value, with max 1 decimal. Eg. -1, 3.2.
+ * NULL otherwise. Must be free()'d by the caller.
+ */
+static gchar *
+get_severity_score_from_vt (nvti_t *nvti)
+{
+  gchar *vector;
+  gchar *score_str;
+  double score;
+
+  vector = nvti_severity_vector_from_tag (nvti);
+  if (!vector)
+    return NULL;
+
+  score = get_cvss_score_from_base_metrics (vector);
+  g_free (vector);
+
+  score_str = g_strdup_printf ("%.1f", score);
+
+  return score_str;
+}
+
+/**
+ * @brief Get the nvti's QoD and return the value as
+ * string.
+ *
+ * @param[in] nvti The nvti where to get the QoD from.
+ *
+ * @return string representing an integer value, NULL on error.
+ *  Must be free()'d by the caller.
+ */
+static gchar *
+get_qod_from_vt (nvti_t *nvti)
+{
+  int qod;
+  gchar *qod_str, *qod_type;
+
+  qod_str = NULL;
+  qod_type = nvti_get_tag (nvti, "qod_type");
+  if (qod_type)
+    {
+      qod = qod_type2val (qod_type);
+      qod_str = g_strdup_printf ("%i", qod);
+      g_free (qod_type);
+      return qod_str;
+    }
+
+  qod_str = nvti_get_tag (nvti, "qod");
+  return qod_str;
+}
+
+/**
+ * @brief Build a json representation of the part related to nvti information
+ * of a result.
+ *
+ * OpenVAS result contains also the nvti name, QoD and score, which need to be
+ * taken from redis and the score must be calculated from the vector
+ *
+ * @param[in]  oid     The oid of the NVT.
+ * @param[out] builder Json builder to add data to.
+ *
+ */
+static void
+add_nvti_info_into_json_builder (const char *oid, JsonBuilder *builder)
+{
+  nvti_t *nvti;
+  gchar *score_str;
+  gchar *qod;
+
+  nvti = nvticache_get_nvt (oid);
+
+  if (!nvti)
+    {
+      g_warning ("%s: Plugin '%s' missing from nvticache.", __func__, oid);
+      return;
+    }
+
+  json_builder_set_member_name (builder, "name");
+  builder = json_builder_add_string_value (builder, nvti_name (nvti));
+
+  qod = get_qod_from_vt (nvti);
+  json_builder_set_member_name (builder, "qod");
+  builder = json_builder_add_string_value (builder, qod);
+  g_free (qod);
+
+  score_str = get_severity_score_from_vt (nvti);
+  json_builder_set_member_name (builder, "severity");
+  builder = json_builder_add_string_value (builder, score_str);
+  g_free (score_str);
+
+  nvti_free (nvti);
+}
+
 /**
  * @brief Build a json representation of a result.
  *
@@ -458,6 +558,9 @@ make_result_json_str (const gchar *scan_id, const gchar *type,
   json_builder_set_member_name (builder, "OID");
   json_builder_add_string_value (builder, oid);
 
+  if (oid != NULL && oid[0] != '\0')
+    add_nvti_info_into_json_builder (oid, builder);
+
   json_builder_set_member_name (builder, "value");
   json_builder_add_string_value (builder, action_str);