Author: neilm
Date: 2005-09-01 17:50:06 +0000 (Thu, 01 Sep 2005)
New Revision: 1763
Modified:
bin/checklist
Log:
Now it actually dows work with DTSAs.
Modified: bin/checklist
==================================================================---
bin/checklist 2005-09-01 17:15:43 UTC (rev 1762)
+++ bin/checklist 2005-09-01 17:50:06 UTC (rev 1763)
@@ -15,21 +15,28 @@
"html" => \$html,
"debug" => \$debug,
"suite=s" => \$suite,
+ "sta=s" => \$sta,
"output=s", \$output)
|| ! @ARGV) {
- die "usage: $0 [--suite suite] [--html] [--output=file] [--debug]
advisorylist dtsalist...\n";
+ die "usage: $0 [--suite suite] [--sta sta-mirror] [--html]
[--output=file] [--debug] list ...\n";
}
+my $sta =
"http://secure-testing.debian.net/debian-security-updates/dists/testing/security-updates/main/source/Sources.gz";
+
+system("wget -q -O /tmp/Sources.sta.gz $sta");
+
if (defined $output) {
- open (OUT, ">$output.tmp.$$") || die "output.tmp.$$:
$!";
+ open (OUT, ">$output.tmp.$$") || die "output.tmp.$$:
$!"; # Set the output to a file
}
else {
- open (OUT, ">&STDOUT");
+ open (OUT, ">&STDOUT"); # Set the output to stdout
}
-if ($html) {
+if ($html) { # It''s HTML, so we need a header
print OUT "<html><title>$suite security
issues</title>\n";
- if ($suite ne ''testing'' && $suite ne
''unstable'') {
+
+ # This is being run against something it''s not meant to be, so print
a warning
+ if ($suite ne ''testing'' && $suite ne
''unstable'') {
print OUT <<"EOF";
<p>
<em>Warning:</em> This page is the result of running the testing
security
@@ -45,11 +52,13 @@
my %data;
+my %advlist;
my %needkernel=qw/2.4.27 0 2.6.11 0/;
my $list_unknown=1; #set to 1 to display kernel images with unknown source
version
my $sources=$ENV{SOURCES_FILE};
my $need_rebuild=0;
+# Set some colours for the urgency types
my @urgencies=("high", "medium", "low",
"unknown");
my %colormap=(
high => "#FF0000",
@@ -58,8 +67,9 @@
unknown => "#FFFF00"
);
-my $unprop = my $unprop_all = my $unfixed = my $todos = 0;
+my $unprop = my $unprop_all = my $unfixed = my $todos = my $fixedsta = 0;
+# Add an item into the data array.
sub record {
my ($package, $condition, $item, $urgency)=@_;
@@ -72,9 +82,10 @@
push @{$data{$package}{$condition}}, {item => $item, urgency =>
$urgency};
}
-die ("No DTSA list specified") if (! length @ARGV[1]);
-my $dtsalist = @ARGV[1];
-foreach my $list (@ARGV[0]) {
+foreach my $list (@ARGV) {
+ # Each of the @ARGVs we''ve got passed need parsing. So lets do that
+
+ # If it''s a directory, set the file to list, cause we need that.
if (-d $list) {
$list="$list/list";
}
@@ -83,15 +94,18 @@
while (<IN>) {
print STDERR "line: $_" if $debug;
chomp;
- if (/^\[/) {
+ if (/\s+TODO/) { # It''s a todo item. Add it to the count, and ignore
it
+ $todos++;
+ }
+ elsif (/^\[/) { # Checking adv. number for a line starting with [ : Set $id
to it
($id)=m/((?:DSA|DTSA|CAN|CVE)-[^\s]+) /;
}
- elsif (/^((?:DSA|DTSA|CAN|CVE)-[^\s]+)/) {
+ elsif (/^((?:DSA|DTSA|CAN|CVE)-[^\s]+)/) { # Check for a line with an
advisory at the start : Set $id to it
$id=$1;
}
- elsif (/^\s+[!-]\s+(\S+)\s+(.*?)\s*$/) {
- my $package=$1;
- my $rest=$2;
+ elsif (/^\s+[!-]\s+(\S+)\s+(.*?)\s*$/) { # Deal with the rest of the lines
+ my $package=$1; # We know which package it is.
+ my $rest=$2;
my $version;
my $notes;
if ($rest=~/([^\(\s]+)\s+\((.*)\)/) {
@@ -106,8 +120,13 @@
$version=$rest;
$notes="";
}
+
+ # by now, we also have the version that''s affected by the security
problem.
+ # This is stored in $version
+
my @notes=split(/\s*;\s+/, $notes);
+ # Fetch the urgency, if we can.
my $urgency="unknown";
foreach my $u (@urgencies) {
if (grep { $_ eq $u } @notes) {
@@ -116,7 +135,8 @@
last;
}
}
-
+
+ # It''s a kernel. Add it to the list of kernels that need to be
looked at.
if ($package=~/kernel-source-([0-9.]+)/) {
my $kernversion=$1;
if (exists $needkernel{$kernversion} &&
@@ -126,6 +146,7 @@
}
}
+ # Fire up madison.
my @maddy;
for (1..5) {
@maddy=`madison -s ''$suite''
''$package''`;
@@ -149,41 +170,47 @@
if (grep { $_ eq ''unfixed'' || $_ eq
''pending'' } @notes) {
record($package, ''(''.join("; ",
@notes).'')'', $id, $urgency);
$unfixed++;
+ # It''s not been fixed!
}
else {
foreach my $maddy (@maddy) {
my @fields = split(/\s*\|\s*/, $maddy);
- my $havver=$fields[1];
+ my $havver=$fields[1]; # It''s this version in the archive
I''m checking.
my $arches=$fields[3];
- my $dtsacmp=1;
$version=~s/\s+//; # strip whitespace
$arches=~s/\s+$//;
- my $cmp=system("dpkg --compare-versions ''$havver''
''>='' ''$version''");
-
- my $dtsaver = `grep "\\- $package" $dtsalist|awk
''{print \$3}''`;
- chomp $dtsaver;
- if (length($dtsaver)) {
- my $hdcmp=system("dpkg --compare-versions
''$havver'' ''>=''
''$dtsaver''");
- if ($hdcmp != 0 && $vdcmp == 0) {
- record($package, "have $dtsaver in secure-testing archive, but
$havver is in main archive",$id, $urgency);
+ my $starchive = "";
+
+ # Is the version in the archive greater than the version that''s
vulnerable?
+ my $cmp=system("dpkg --compare-versions ''$havver''
''>='' ''$version''");
+ if ($cmp != 0){ # No, so the archive is vulnerable.
+
+ # Does the version exist in the secure-testing archive?
+ my $staversion = `zcat /tmp/Sources.sta.gz |grep-dctrl -F Package -e
^$package\$ -s Version -`;
+ chomp $staversion;
+ $staversion=~s/Version: //;
+ $staversion=~s/\s+//;
+ if (length ($staversion)) {
+ # Yes, but what version is in s-t?
+ my $stacmp = system("dpkg --compare-versions
''$staversion'' ''>=''
''$version''");
+ if ($stacmp == 0){
+ # Well, the version in the s-t archive fixes the issue
+ # but it''s still vulnerable in the main archive
+ $starchive = " (fixed in $staversion in the secure-testing
archive)";
+ $fixedsta++;
+ }
}
- $dtsacmp = 0;
- }
-
- if ($cmp != 0 && $dtsacmp !=0) {
+
if ($html && $suite eq ''testing'') {
$havver=''<a
href="http://bjorn.haxx.se/debian/testing.pl?package=''.uri_escape($package).''">''.$havver.''</a>'';
}
- record($package, "$version needed, have $havver".(@maddy > 1
? " [$arches]" : ""), $id, $urgency);
+ record($package, "$version needed, have $havver".(@maddy > 1
? " [$arches]" : "").$starchive, $id, $urgency);
$unprop++;
$unprop_all++ unless @maddy > 1;
}
}
}
}
- elsif (/\s+TODO/) {
- $todos++;
- }
}
}
@@ -265,8 +292,13 @@
if ($html) {
print OUT "</ul>\n";
print OUT "<hr>\n";
+ print OUT "Key: ";
+ foreach $keyline (@urgencies) {
+ print OUT "<span style=\"border: 1px dashed;
background:".$colormap{$keyline}."\"> $keyline </span>
";
+ }
+ print OUT "<br>";
print OUT "Total holes unfixed: $unfixed<br>\n";
- print OUT "Total holes fixed in unstable but not $suite:
$unprop_all";
+ print OUT "Total holes fixed in unstable but not $suite: $unprop_all
($fixedsta fixed in secure-testing archive)";
if ($unprop_all != $unprop) {
print OUT " (+".($unprop - $unprop_all)." on some
arches)";
}