%#!/usr/bin/env escript %%! %-*-Mode:erlang;coding:utf-8;tab-width:4;c-basic-offset:4;indent-tabs-mode:()-*- % ex: set ft=erlang fenc=utf-8 sts=4 ts=4 sw=4 et: %%%------------------------------------------------------------------------ %%% @doc %%% ==Primitive Erlang Security Tool (PEST)== %%% @end %%% %%% BSD LICENSE %%% %%% Copyright (c) 2016, Michael Truog %%% All rights reserved. %%% %%% Redistribution and use in source and binary forms, with or without %%% modification, are permitted provided that the following conditions are met: %%% %%% * Redistributions of source code must retain the above copyright %%% notice, this list of conditions and the following disclaimer. %%% * Redistributions in binary form must reproduce the above copyright %%% notice, this list of conditions and the following disclaimer in %%% the documentation and/or other materials provided with the %%% distribution. %%% * All advertising materials mentioning features or use of this %%% software must display the following acknowledgment: %%% This product includes software developed by Michael Truog %%% * The name of the author may not be used to endorse or promote %%% products derived from this software without specific prior %%% written permission %%% %%% THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND %%% CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, %%% INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES %%% OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE %%% DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR %%% CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, %%% SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, %%% BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR %%% SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS %%% INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, %%% WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING %%% NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE %%% OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH %%% DAMAGE. %%% %%% @version 0.2.0 {@date} {@time} %%%------------------------------------------------------------------------ -module(pest). -vsn("0.2.0"). -mode(compile). -export([checks/0, analyze/1, analyze/2, main/1]). -type severity() :: 0..100. % 0 == low, 100 == high -type problem() :: {Module :: module(), Function :: function_name(), Arity :: arity()} | module(). -type message() :: nonempty_string(). -type checks() :: nonempty_list({severity(), nonempty_list(problem()), message()}). -type file_path() :: string(). -type line() :: erl_anno:line(). -type options() :: list(consistency_checks | {checks, checks()} | {severity_min, severity()}). -type warning() :: {severity(), message(), #{problem() := nonempty_list(line())}}. -type warnings() :: nonempty_list(warning()). -export_type([checks/0, file_path/0, options/0, warning/0, warnings/0]). -record(state, { severity_min = 50 :: severity(), consistency_checks = false :: boolean(), input_beam_only = false :: boolean(), input_source_only = false :: boolean(), recursive = false :: boolean(), file_paths = [] :: list(file_path()) }). -record(warnings, { checks_lookup :: #{problem() := {severity(), message()}} | #{}, instances = #{} :: #{problem() := nonempty_list(line())} | #{} }). % erl_parse tree nodes represented as records -type function_name() :: atom(). -record('remote', { anno :: erl_anno:anno(), module :: erl_parse:abstract_expr(), function_name :: erl_parse:abstract_expr() }). -record('call', { anno :: erl_anno:anno(), function :: erl_parse:abstract_expr() | #'remote'{}, args :: list(erl_parse:abstract_expr()) }). %%------------------------------------------------------------------------- %% @doc %% ===Security checks.=== %% @end %%------------------------------------------------------------------------- -spec checks() -> checks(). %%------------------------------------------------------------------------- %% Clearly describe all the security problems that might be present in %% Erlang source code with an associated severity and short message %% %% Severity Guide (default severity_min == 50): %% 100..86 undefined behavior that can be exploited %% 85..75 OS execution that can be exploited %% 25..15 Erlang VM dependencies can be exploited %% 14..0 Erlang VM may be killed due to memory consumption checks() -> [{90, [{erlang, load_nif, 2}], "NIFs may cause undefined behavior"}, {90, [{erl_ddll, load, 2}, {erl_ddll, load_driver, 2}, {erl_ddll, reload, 2}, {erl_ddll, reload_driver, 2}, {erl_ddll, try_load, 3}], "Port Drivers may cause undefined behavior"}, {80, [{os, cmd, 1}], "OS shell usage may require input validation"}, {80, [{erlang, open_port, 2}], "OS process creation may require input validation"}, {15, [{crypto, block_encrypt, 3}, {crypto, block_decrypt, 3}, {crypto, block_encrypt, 4}, {crypto, block_decrypt, 4}, {crypto, compute_key, 4}, {crypto, generate_key, 2}, {crypto, generate_key, 3}, {crypto, next_iv, 2}, {crypto, next_iv, 3}, {crypto, private_decrypt, 4}, {crypto, private_encrypt, 4}, {crypto, public_decrypt, 4}, {crypto, public_encrypt, 4}, {crypto, sign, 4}, {crypto, stream_init, 2}, {crypto, stream_init, 3}, {crypto, stream_encrypt, 2}, {crypto, stream_decrypt, 2}, {crypto, ec_curve, 1}, {crypto, verify, 5}] ++ % application modules: public_key (with "-m public_key") ['OTP-PUB-KEY','PKCS-FRAME',pubkey_cert,pubkey_cert_records,pubkey_crl, pubkey_pbe,pubkey_pem,pubkey_ssh,public_key] ++ % application modules: ssl (with "-m ssl") [dtls,dtls_connection,dtls_connection_sup,dtls_handshake,dtls_record,dtls_v1, inet6_tls_dist,inet_tls_dist,ssl,ssl_alert,ssl_app,ssl_certificate, ssl_cipher,ssl_config,ssl_connection,ssl_crl,ssl_crl_cache,ssl_crl_cache_api, ssl_crl_hash_dir,ssl_dist_sup,ssl_handshake,ssl_listen_tracker_sup, ssl_manager,ssl_pkix_db,ssl_record,ssl_session,ssl_session_cache, ssl_session_cache_api,ssl_socket,ssl_srp_primes,ssl_sup,ssl_tls_dist_proxy, ssl_v2,ssl_v3,tls,tls_connection,tls_connection_sup,tls_handshake,tls_record, tls_v1] ++ % application modules: ssh (with "-m ssh") [ssh,ssh_acceptor,ssh_acceptor_sup,ssh_app,ssh_auth,ssh_bits,ssh_channel, ssh_channel_sup,ssh_cli,ssh_client_key_api,ssh_connection, ssh_connection_handler,ssh_connection_sup,ssh_daemon_channel,ssh_dbg, ssh_file,ssh_info,ssh_io,ssh_message,ssh_no_io,ssh_server_key_api,ssh_sftp, ssh_sftpd,ssh_sftpd_file,ssh_sftpd_file_api,ssh_shell,ssh_subsystem_sup, ssh_sup,ssh_system_sup,ssh_transport,ssh_xfer,sshc_sup,sshd_sup] ++ % application modules: snmp (with "-m snmp") [snmp,snmp_app,snmp_app_sup,snmp_community_mib,snmp_conf,snmp_config, snmp_framework_mib,snmp_generic,snmp_generic_mnesia,snmp_index,snmp_log, snmp_mini_mib,snmp_misc,snmp_note_store,snmp_notification_mib,snmp_pdus, snmp_shadow_table,snmp_standard_mib,snmp_target_mib,snmp_user_based_sm_mib, snmp_usm,snmp_verbosity,snmp_view_based_acm_mib,snmpa,snmpa_acm,snmpa_agent, snmpa_agent_sup,snmpa_app,snmpa_authentication_service,snmpa_conf, snmpa_discovery_handler,snmpa_discovery_handler_default,snmpa_error, snmpa_error_io,snmpa_error_logger,snmpa_error_report,snmpa_local_db, snmpa_mib,snmpa_mib_data,snmpa_mib_data_tttn,snmpa_mib_lib,snmpa_mib_storage, snmpa_mib_storage_dets,snmpa_mib_storage_ets,snmpa_mib_storage_mnesia, snmpa_misc_sup,snmpa_mpd,snmpa_net_if,snmpa_net_if_filter, snmpa_network_interface,snmpa_network_interface_filter, snmpa_notification_delivery_info_receiver,snmpa_notification_filter, snmpa_set,snmpa_set_lib,snmpa_set_mechanism,snmpa_supervisor,snmpa_svbl, snmpa_symbolic_store,snmpa_target_cache,snmpa_trap,snmpa_usm,snmpa_vacm, snmpc,snmpc_lib,snmpc_mib_gram,snmpc_mib_to_hrl,snmpc_misc,snmpc_tok,snmpm, snmpm_conf,snmpm_config,snmpm_misc_sup,snmpm_mpd,snmpm_net_if, snmpm_net_if_filter,snmpm_net_if_mt,snmpm_network_interface, snmpm_network_interface_filter,snmpm_server,snmpm_server_sup, snmpm_supervisor,snmpm_user,snmpm_user_default,snmpm_user_old,snmpm_usm] ++ % encrypt_debug_info option usage [{compile, file, 2}, {compile, forms, 2}, {compile, noenv_file, 2}, {compile, noenv_forms, 2}], "Keep OpenSSL updated for crypto module use (run with \"-V crypto\")"}, {10, [{erlang, list_to_atom, 1}, {erlang, binary_to_atom, 2}, {erlang, binary_to_term, 1}, {file, consult, 1}, {file, eval, 1}, {file, eval, 2}, {file, path_consult, 2}, {file, path_eval, 2}, {file, path_script, 2}, {file, path_script, 3}, {file, script, 1}, {file, script, 2}] ++ % application modules: xmerl (with "-m xmerl") [xmerl,xmerl_b64Bin,xmerl_b64Bin_scan,xmerl_eventp,xmerl_html,xmerl_lib, xmerl_otpsgml,xmerl_regexp,xmerl_sax_old_dom,xmerl_sax_parser, xmerl_sax_parser_latin1,xmerl_sax_parser_list,xmerl_sax_parser_utf16be, xmerl_sax_parser_utf16le,xmerl_sax_parser_utf8,xmerl_sax_simple_dom, xmerl_scan,xmerl_sgml,xmerl_simple,xmerl_text,xmerl_ucs,xmerl_uri, xmerl_validate,xmerl_xlate,xmerl_xml,xmerl_xpath,xmerl_xpath_lib, xmerl_xpath_parse,xmerl_xpath_pred,xmerl_xpath_scan,xmerl_xs,xmerl_xsd, xmerl_xsd_type], "Dynamic creation of atoms can exhaust atom memory"}]. %%------------------------------------------------------------------------- %%------------------------------------------------------------------------- %% @doc %% ===Analyze a file.=== %% @end %%------------------------------------------------------------------------- -spec analyze(FilePath :: file_path()) -> ok | {warning, warnings()} | {error, any()}. analyze(FilePath) -> analyze(FilePath, []). %%------------------------------------------------------------------------- %% @doc %% ===Analyze a file with options.=== %% @end %%------------------------------------------------------------------------- -spec analyze(FilePath :: file_path(), Options :: options()) -> ok | {warning, warnings()} | {error, any()}. analyze(FilePath, Options) -> Checks = proplists:get_value(checks, Options, checks()), case proplists:get_value(consistency_checks, Options, false) of true -> ok = consistency_checks(Checks); false -> ok end, SeverityMin = proplists:get_value(severity_min, Options, 50), case abstract_forms(FilePath) of {ok, _} when not (is_integer(SeverityMin) andalso (SeverityMin >= 0) andalso (SeverityMin =< 100)) -> {error, severity_min}; {ok, Forms} -> ChecksLookup = checks_lookup(Checks, SeverityMin), Warnings0 = #warnings{checks_lookup = ChecksLookup}, WarningsN = erl_syntax_lib:fold(fun(TreeNode, Warnings1) -> case TreeNode of #'call'{function = #'remote'{anno = Anno, module = {atom, _, M}, function_name = {atom, _, F}}, args = Args} -> Line = erl_anno:line(Anno), analyze_checks(Warnings1, Line, {M, F, length(Args)}); _ -> Warnings1 end end, Warnings0, erl_syntax:form_list(Forms)), case warnings_format(WarningsN) of [] -> ok; [_ | _] = Output -> {warning, Output} end; {error, _} = Error -> Error end. %%------------------------------------------------------------------------- %% @doc %% ===Escript Main Function.=== %% @end %%------------------------------------------------------------------------- -spec main(Arguments :: list(string())) -> no_return(). main(Arguments) -> State = main_arguments(Arguments), #state{severity_min = SeverityMin, consistency_checks = ConsistencyChecks, file_paths = FilePaths} = State, if ConsistencyChecks =:= true -> ok = consistency_checks(checks()); ConsistencyChecks =:= false -> ok end, Options = [{severity_min, SeverityMin}], WarningsN = lists:foldl(fun(FilePath, Warnings0) -> case analyze(FilePath, Options) of ok -> Warnings0; {warning, FileWarnings} -> main_warnings_merge(FileWarnings, Warnings0, FilePath); {error, Reason} -> erlang:error({FilePath, Reason}) end end, #{}, FilePaths), main_warnings_display(WarningsN), if WarningsN =:= #{} -> exit_code(0); true -> exit_code(1) end. %%%------------------------------------------------------------------------ %%% Private functions %%%------------------------------------------------------------------------ main_arguments(Arguments) -> main_arguments(Arguments, [], [], #state{}). main_arguments(["-b" | Arguments], FilePaths, Directories, #state{input_source_only = false} = State) -> main_arguments(Arguments, FilePaths, Directories, State#state{input_beam_only = true, recursive = true}); main_arguments(["-c" | Arguments], FilePaths, Directories, State) -> main_arguments(Arguments, FilePaths, Directories, State#state{consistency_checks = true}); main_arguments(["-e" | Arguments], FilePaths, Directories, #state{input_beam_only = false} = State) -> main_arguments(Arguments, FilePaths, Directories, State#state{input_source_only = true, recursive = true}); main_arguments(["-h" | _], _, _, _) -> io:format(help(), [filename:basename(?FILE)]), exit_code(0); main_arguments(["-m", ApplicationName | _], _, _, _) -> Application = erlang:list_to_atom(ApplicationName), case application:load(Application) of ok -> {ok, Modules} = application:get_key(Application, modules), io:format("~p~n", [lists:sort(Modules)]), exit_code(0); {error, Reason} -> erlang:error({invalid_application, Reason}) end; main_arguments(["-r" | Arguments], FilePaths, Directories, State) -> main_arguments(Arguments, FilePaths, Directories, State#state{recursive = true}); main_arguments(["-s", SeverityMin | Arguments], FilePaths, Directories, State) -> SeverityMinValue = try erlang:list_to_integer(SeverityMin) catch error:badarg -> erlang:error(invalid_severity_min) end, if SeverityMinValue < 0; SeverityMinValue > 100 -> erlang:error(invalid_severity_min); true -> ok end, main_arguments(Arguments, FilePaths, Directories, State#state{severity_min = SeverityMinValue}); main_arguments(["-U", Component | _], _, _, _) -> Update = case Component of "crypto" -> update_crypto_data(); _ -> erlang:error({invalid_component, Component}) end, case Update of ok -> ok; {error, Reason} -> erlang:error({update_failed, Reason}) end, exit_code(0); main_arguments(["-v" | Arguments], FilePaths, Directories, State) -> main_arguments(Arguments, FilePaths, Directories, State#state{severity_min = 0}); main_arguments(["-V" | Arguments], _, _, _) -> Component = case Arguments of [] -> "pest"; ["-" ++ _ | _] -> "pest"; [ComponentName | _] -> ComponentName end, case Component of "pest" -> version_info_pest(); "crypto" -> version_info_crypto(); _ -> erlang:error({invalid_component, Component}) end, exit_code(0); main_arguments(["-" ++ InvalidParameter | _], _, _, _) -> erlang:error({invalid_parameter, InvalidParameter}); main_arguments([Path | Arguments], FilePaths, Directories, State) -> case filelib:is_dir(Path) of true -> main_arguments(Arguments, FilePaths, [Path | Directories], State); false -> main_arguments(Arguments, [Path | FilePaths], Directories, State) end; main_arguments([], FilePaths, Directories, #state{input_beam_only = BeamOnly, input_source_only = SourceOnly, recursive = Recursive} = State) -> FilePathsFoundN = if Recursive =:= false, Directories /= [] -> erlang:error(not_recursive); Recursive =:= true -> RegExp = if BeamOnly =:= true -> ".*\\.beam$"; SourceOnly =:= true -> ".*\\.erl$"; true -> ".*" end, lists:foldl(fun(Directory, FilePathsFound0) -> FilePathsFound0 ++ lists:reverse(filelib:fold_files(Directory, RegExp, true, fun(FilePathFound, FilePathsFound1) -> [FilePathFound | FilePathsFound1] end, FilePathsFound0)) end, [], lists:reverse(Directories)); true -> [] end, State#state{file_paths = lists:reverse(FilePaths) ++ FilePathsFoundN}. main_warnings_merge([], Warnings, _) -> Warnings; main_warnings_merge([{Severity, Message, Problems} | FileWarnings], Warnings, FilePath) -> Key = {Severity, Message}, NewWarnings = maps:put(Key, maps:put(FilePath, Problems, maps:get(Key, Warnings, #{})), Warnings), main_warnings_merge(FileWarnings, NewWarnings, FilePath). main_warnings_display(Warnings) -> OutputN = lists:reverse(maps:fold(fun(Key, FileProblems, Output0) -> FileOutput1 = maps:fold(fun(FilePath, Problems, FileOutput0) -> ProblemsOutput1 = maps:fold(fun(Problem, Lines, ProblemsOutput0) -> ProblemName = case Problem of {M, F, A} -> lists:flatten(io_lib:format("~w:~w/~w", [M, F, A])); M -> lists:flatten(io_lib:format("~w:_/_", [M])) end, lists:ukeymerge(1, ProblemsOutput0, [{ProblemName, Lines}]) end, [], Problems), lists:ukeymerge(1, FileOutput0, [{FilePath, ProblemsOutput1}]) end, [], FileProblems), lists:ukeymerge(1, Output0, [{Key, FileOutput1}]) end, [], Warnings)), lists:foreach(fun({{Severity, Message}, FileOutputN}) -> io:format("~3.. w: ~s~n", [Severity, Message]), lists:foreach(fun({FilePath, ProblemsOutputN}) -> FileName = filename:basename(FilePath), lists:foreach(fun({ProblemName, Lines}) -> FileLines = case Lines of [Line] -> Line; [_ | _] -> Lines end, io:format("~-5s~s:~w (~s)~n", ["", FileName, FileLines, ProblemName]) end, ProblemsOutputN) end, FileOutputN) end, OutputN). checks_lookup(Checks, SeverityMin) -> checks_lookup(Checks, #{}, SeverityMin). checks_lookup([], Lookup, _) -> Lookup; checks_lookup([{Severity, Problems, Message} | Checks], Lookup0, SeverityMin) when Severity >= SeverityMin -> LookupN = lists:foldl(fun(Problem, Lookup1) -> Lookup1#{Problem => {Severity, Message}} end, Lookup0, Problems), checks_lookup(Checks, LookupN, SeverityMin); checks_lookup([_ | Checks], Lookup, SeverityMin) -> checks_lookup(Checks, Lookup, SeverityMin). analyze_checks(#warnings{checks_lookup = ChecksLookup, instances = Instances} = Warnings, Line, Call) -> {Module, _, _} = Call, ProblemFunction = maps:is_key(Call, ChecksLookup), ProblemModule = maps:is_key(Module, ChecksLookup), Store = fun(Problem) -> Lines = maps:get(Problem, Instances, []), NewInstances = maps:put(Problem, [Line | Lines], Instances), Warnings#warnings{instances = NewInstances} end, if ProblemFunction =:= true -> Store(Call); ProblemModule =:= true -> Store(Module); true -> Warnings end. -spec warnings_format(Warnings :: #warnings{}) -> list(warning()). warnings_format(#warnings{checks_lookup = ChecksLookup, instances = Instances}) -> OutputN = maps:fold(fun(Problem, Lines, Output0) -> Key = maps:get(Problem, ChecksLookup), maps:put(Key, maps:put(Problem, lists:reverse(Lines), maps:get(Key, Output0, #{})), Output0) end, #{}, Instances), lists:reverse(maps:fold(fun({Severity, Message}, Problems, L) -> lists:umerge(L, [{Severity, Message, Problems}]) end, [], OutputN)). -spec consistency_checks(Checks :: any()) -> ok. consistency_checks([_ | _] = Checks) -> % internal consistency checks to make sure all the checks are valid Set0 = sets:new(), _ = lists:foldl(fun({Rank, Problems, Message}, Set1) -> if is_integer(Rank), Rank >= 0, Rank =< 100 -> ok; true -> erlang:error({invalid_severity, Rank}) end, Set2 = if is_list(Problems) -> lists:foldl(fun(Problem, Set3) -> ProblemOk = case Problem of {M, F, A} -> function_exists(M, F, A); M -> function_exists(M, module_info, 0) end, if ProblemOk =:= true -> ok; ProblemOk =:= false -> erlang:error({invalid_problem, Problem}) end, case sets:is_element(Problem, Set3) of true -> erlang:error({duplicate_problem, Problem}); false -> sets:add_element(Problem, Set3) end end, Set1, Problems); true -> erlang:error({invalid_problems, Problems}) end, if is_list(Message), is_integer(hd(Message)) -> ok; true -> erlang:error({invalid_message, Message}) end, Set2 end, Set0, Checks), ok; consistency_checks(Checks) -> erlang:error({invalid_checks, Checks}). -spec abstract_forms(FilePath :: file_path()) -> {ok, Forms :: list(erl_parse:abstract_form())} | {error, any()}. abstract_forms(FilePath) -> case filename:extension(FilePath) of ".beam" -> case beam_lib:chunks(FilePath, [abstract_code]) of {ok, {_, [{abstract_code, {_, Forms}}]}} -> {ok, Forms}; {ok, {_, [{abstract_code, no_abstract_code}]}} -> {error, no_abstract_code}; {error, beam_lib, ChunkReason} -> {error, erlang:delete_element(2, ChunkReason)} end; _ -> % can parse escript files case epp:parse_file(FilePath, []) of {ok, _} = Success -> Success; {error, _} = Error -> Error end end. function_exists(M, F, A) -> Loaded = code:is_loaded(M) =/= false, if Loaded =:= true -> ok; Loaded =:= false -> code:ensure_loaded(M) end, Exists = erlang:function_exported(M, F, A), if Loaded =:= true -> ok; Loaded =:= false -> code:purge(M) end, Exists. exit_code(ExitCode) when is_integer(ExitCode) -> erlang:halt(ExitCode, [{flush, true}]). pest_data_file() -> filename:join([filename:dirname(?FILE), "priv", "pest.dat"]). pest_data_find(Key) -> FilePath = pest_data_file(), case file:consult(FilePath) of {ok, [Data]} -> case lists:keyfind(Key, 1, Data) of {Key, Value} -> {ok, Value}; false -> error end; {error, enoent} -> error end. pest_data_store(Key, Value) -> FilePath = pest_data_file(), DataNew = case file:consult(FilePath) of {ok, [DataOld]} -> lists:keystore(Key, 1, DataOld, {Key, Value}); {error, enoent} -> [{Key, Value}] end, file:write_file(FilePath, io_lib:format("~p.", [DataNew]), [raw]). update_crypto_data() -> % webscraper for OpenSSL Vulnerabilities URL = "https://www.openssl.org/news/vulnerabilities.html", Timeout = 20000, % milliseconds error_logger:tty(false), ok = ssl:start(), ok = inets:start(), Result = case httpc:request(get, {URL, []}, [{autoredirect, false}, {timeout, Timeout}], [{body_format, string}]) of {ok, {{_, 200, "OK"}, _Headers, Body}} -> {ok, Vulnerabilities} = update_crypto_openssl_data_parse(Body, []), pest_data_store(crypto, [{openssl, Vulnerabilities}]); {ok, RequestFailed} -> {error, RequestFailed}; {error, _} = Error -> Error end, ok = inets:stop(), ok = ssl:stop(), error_logger:tty(true), Result. update_crypto_openssl_data_parse("CVE-" ++ _ = L0, D) -> {CVE, LN} = lists:splitwith(fun(C0) -> (C0 >= $A andalso C0 =< $Z) orelse (C0 >= $0 andalso C0 =< $9) orelse (C0 == $-) end, L0), update_crypto_openssl_data_parse_cve(LN, moderate, CVE, D); update_crypto_openssl_data_parse([], D) -> {ok, D}; update_crypto_openssl_data_parse([_ | L], D) -> update_crypto_openssl_data_parse(L, D). update_crypto_openssl_data_parse_cve("[Critical severity]" ++ L, _, CVE, D) -> update_crypto_openssl_data_parse_cve(L, critical, CVE, D); update_crypto_openssl_data_parse_cve("[High severity]" ++ L, _, CVE, D) -> update_crypto_openssl_data_parse_cve(L, high, CVE, D); update_crypto_openssl_data_parse_cve("[Moderate severity]" ++ L, _, CVE, D) -> update_crypto_openssl_data_parse_cve(L, moderate, CVE, D); update_crypto_openssl_data_parse_cve("[Low severity]" ++ L, _, CVE, D) -> update_crypto_openssl_data_parse_cve(L, low, CVE, D); update_crypto_openssl_data_parse_cve("Fixed in OpenSSL " ++ L0, Level, CVE, D) -> Version = fun(V) -> (V >= $0 andalso V =< $9) orelse (V == $.) orelse (V >= $a andalso V =< $z) end, {_, L1} = lists:splitwith(fun(C0) -> not Version(C0) end, L0), {Fix, LN} = lists:splitwith(fun(C1) -> Version(C1) end, L1), update_crypto_openssl_data_parse_cve_fix(LN, Fix, Level, CVE, D); update_crypto_openssl_data_parse_cve(">CVE-" ++ _ = L, _, _, D) -> update_crypto_openssl_data_parse(L, D); update_crypto_openssl_data_parse_cve([], _, _, D) -> {ok, D}; update_crypto_openssl_data_parse_cve([_ | L], Level, CVE, D) -> update_crypto_openssl_data_parse_cve(L, Level, CVE, D). update_crypto_openssl_data_parse_cve_fix("(Affected " ++ L0, Fix, Level, CVE, D) -> {Affected, LN} = lists:splitwith(fun(C0) -> C0 /= $) end, L0), AffectedList = string:tokens(Affected, ", "), Entry = {CVE, Level, Fix, AffectedList}, update_crypto_openssl_data_parse_cve(LN, Level, CVE, [Entry | D]); update_crypto_openssl_data_parse_cve_fix(">CVE-" ++ _ = L, _, _, _, D) -> update_crypto_openssl_data_parse(L, D); update_crypto_openssl_data_parse_cve_fix([], _, _, _, D) -> {ok, D}; update_crypto_openssl_data_parse_cve_fix([_ | L], Fix, Level, CVE, D) -> update_crypto_openssl_data_parse_cve_fix(L, Fix, Level, CVE, D). version_info_openssl(VersionRuntime) -> [<<"OpenSSL">>, VersionMajor, VersionMinor, VersionPatch | _] = binary:split(VersionRuntime, [<<" ">>, <<".">>], [global]), Version = erlang:binary_to_list(<>), {PatchNumber, PatchString} = lists:splitwith(fun(C) -> (C >= $0) andalso (C =< $9) end, erlang:binary_to_list(VersionPatch)), LibrarySource = if PatchString == "" -> "package manager fork?"; true -> "openssl mainline!" end, Fork = {erlang:binary_to_list(VersionMajor), erlang:binary_to_list(VersionMinor), PatchNumber}, Vulnerabilities = case pest_data_find(crypto) of {ok, [{openssl, VulnerabilitiesData}]} -> VulnerabilitiesData; error -> [] end, SecurityProblemsList = [ if % based on % https://en.wikipedia.org/wiki/OpenSSL#Major_version_releases Fork =< {"1", "0", "0"} -> "OLD OpenSSL!"; true -> "" end | lists:map(fun({CVE, Level, _Fix, Affected}) -> case lists:member(Version, Affected) of true -> CVE ++ "(" ++ string:to_upper(erlang:atom_to_list(Level)) ++ ")"; false -> "" end end, Vulnerabilities) ], SecurityProblems = lists:filter(fun(S) -> S /= "" end, SecurityProblemsList), {length(SecurityProblems), length(SecurityProblemsList), LibrarySource, SecurityProblems}. version_info_crypto() -> {ok, _} = application:ensure_all_started(crypto), lists:foreach(fun(CryptoComponent) -> case CryptoComponent of {<<"OpenSSL">>, VersionHeader, VersionRuntime} -> {SecurityProblemsFound, SecurityProblemsKnown, LibrarySource, SecurityProblems} = version_info_openssl(VersionRuntime), io:format("OpenSSL version information:~n" " crypto compile-time " "openssl/opensslv.h version ~w~n" " crypto run-time version ~s~n" " ~w/~w problems found (~s)~n" " ~p~n", [VersionHeader, VersionRuntime, SecurityProblemsFound, SecurityProblemsKnown, LibrarySource, SecurityProblems]); Other -> io:format("~p (crypto dependency unknown)~n", [Other]) end end, crypto:info_lib()). version_info_pest() -> Version = case ?MODULE:module_info(attributes) of [] -> "UNKNOWN!"; Attributes -> VersionListN = lists:foldr(fun(Attribute, VersionList0) -> case Attribute of {vsn, VSN} -> VSN ++ VersionList0; _ -> VersionList0 end end, [], Attributes), io_lib:format("~p", [VersionListN]) end, {ok, Data} = file:read_file(?FILE), FileHash = erlang:phash2(Data), io:format("~s version ~s (~w)~n", [filename:basename(?FILE), Version, FileHash]). help() -> "Usage ~s [OPTION] [FILES] [DIRECTORIES] -b Only process beam files recursively -c Perform internal consistency checks -e Only process source files recursively -h List available command line flags -m APPLICATION Display a list of modules in an Erlang/OTP application -r Recursively search directories -s SEVERITY Set the minimum severity to use when reporting problems (default is 50) -U COMPONENT Update local data related to a component (valid components are: crypto) -v Verbose output (set the minimum severity to 0) -V [COMPONENT] Print version information (valid components are: pest, crypto) ".