vulns

type Advisory struct {
	ID string `gorm:"primaryKey;type:varchar(128)" json:"id"`
	// Source is the feed that owns the record. Existing rows predate NVD
	// support and are OSV records.
	Source     string  `gorm:"type:varchar(8);default:osv;index" json:"source"`
	Summary    string  `gorm:"type:text" json:"summary"`
	Details    string  `gorm:"type:text" json:"details"`
	CVSSVector string  `gorm:"type:varchar(255)" json:"cvss_vector"`
	CVSSScore  float64 `json:"cvss_score"`
	Severity   string  `gorm:"type:varchar(16);index" json:"severity"`
	// CVSSFrom is the aliased NVD CVE an OSV record without its own CVSS
	// borrowed its score from. Empty when the score is the record's own.
	CVSSFrom  string    `gorm:"type:varchar(32);default:''" json:"cvss_from"`
	KEV       bool      `gorm:"index" json:"kev"`
	RefURLs   string    `gorm:"type:text" json:"-"` // JSON array of URLs
	Published time.Time `json:"published"`
	Modified  time.Time `json:"modified"`
}

type AdvisoryDetail struct {
	Advisory   Advisory  `json:"advisory"`
	Aliases    []string  `json:"aliases"`
	References []string  `json:"references"`
	Findings   []Finding `json:"findings"`
}

type Affected struct {
	ID         uint   `gorm:"primarykey"`
	AdvisoryID string `gorm:"type:varchar(128);index"`
	Ecosystem  string `gorm:"type:varchar(64);index:idx_vuln_affected_pkg"`
	Package    string `gorm:"type:varchar(255);index:idx_vuln_affected_pkg"`
	Ranges     string `gorm:"type:text"` // JSON []Range
	Versions   string `gorm:"type:text"` // JSON []string
}

type Alias struct {
	AdvisoryID string `gorm:"primaryKey;type:varchar(128)"`
	Alias      string `gorm:"primaryKey;type:varchar(128);index"`
}

type CPEProduct struct {
	Vendor  string `gorm:"primaryKey;type:varchar(128)"`
	Product string `gorm:"primaryKey;type:varchar(128);index"`
}

type Config struct {
	OSVURL       string
	KEVURL       string
	Ecosystems   []string // OSV directories; empty = what the fleet reports
	SyncInterval time.Duration
	Retention    time.Duration
	MaxDownload  int64
	HTTPClient   *http.Client
	// NVD CPE matching (--vuln-nvd-*). The key is a secret: it travels only
	// as a request header.
	NVDEnabled bool
	NVDURL     string
	NVDAPIKey  string
}

type CountRow struct {
	Name  string `json:"name"`
	Total int64  `json:"total"`
}

type Escalation struct {
	ID           uint   `gorm:"primarykey"`
	FindingID    uint   `gorm:"index"`
	PrevSeverity string `gorm:"type:varchar(16)"`
	PrevKEV      bool
	CreatedAt    time.Time `gorm:"index"`
}

type Event struct {
	Introduced   string `json:"introduced,omitempty"`
	Fixed        string `json:"fixed,omitempty"`
	LastAffected string `json:"last_affected,omitempty"`
	Limit        string `json:"limit,omitempty"`
}

type FeedStatus struct {
	Sources         []SyncState `json:"sources"`
	LastSyncAt      *time.Time  `json:"last_sync_at"`
	SyncRequestedAt *time.Time  `json:"sync_requested_at"`
	LastSyncFailed  bool        `json:"last_sync_failed"`
	Loaded          bool        `json:"loaded"`
	Stale           bool        `json:"stale"`
}

type Finding struct {
	ID               uint       `gorm:"primarykey" json:"id"`
	NodeUUID         string     `gorm:"type:varchar(64);uniqueIndex:idx_vuln_finding" json:"node_uuid"`
	EnvironmentID    uint       `gorm:"index" json:"environment_id"`
	AdvisoryID       string     `gorm:"type:varchar(128);uniqueIndex:idx_vuln_finding;index" json:"advisory_id"`
	Ecosystem        string     `gorm:"type:varchar(64);uniqueIndex:idx_vuln_finding" json:"ecosystem"`
	Package          string     `gorm:"type:varchar(255);uniqueIndex:idx_vuln_finding" json:"package"`
	InstalledVersion string     `gorm:"type:varchar(255)" json:"installed_version"`
	FixedVersion     string     `gorm:"type:varchar(255)" json:"fixed_version"`
	Confidence       string     `gorm:"type:varchar(16);index" json:"confidence"`
	Severity         string     `gorm:"type:varchar(16);index" json:"severity"`
	KEV              bool       `json:"kev"`
	FirstSeen        time.Time  `json:"first_seen"`
	LastSeen         time.Time  `json:"last_seen"`
	ResolvedAt       *time.Time `gorm:"index" json:"resolved_at"`
	// PeakSeverity and EverKEV are the highest state the finding reached:
	// escalations are measured against them, so falling and coming back is
	// not news. ReopenedAt is the last reopen: escalations recorded before
	// it are not news either.
	PeakSeverity string     `gorm:"type:varchar(16);default:''" json:"-"`
	EverKEV      bool       `gorm:"default:false" json:"-"`
	ReopenedAt   *time.Time `json:"-"`
}

type FindingFilter struct {
	EnvironmentID uint
	NodeUUID      string
	Severity      string
	Confidence    string
	KEV           bool
	State         string
	Package       string
	Advisory      string
	Page          int
	PageSize      int
}

type Inventory struct {
	DB *gorm.DB
	// contains filtered or unexported fields
}

type KEV struct {
	CVEID string `gorm:"primaryKey;type:varchar(32)"`
}

type Matcher struct {
	DB *gorm.DB

	// CPE turns on name matching against NVD data (--vuln-nvd-enabled).
	CPE bool
	// contains filtered or unexported fields
}

type NVDSource struct {
	// contains filtered or unexported fields
}

type NewFinding struct {
	ID               uint
	NodeUUID         string
	Hostname         string
	EnvironmentID    uint
	AdvisoryID       string
	Package          string
	InstalledVersion string
	FixedVersion     string
	Severity         string
	KEV              bool
	Escalated        bool
	PrevSeverity     string
	PrevKEV          bool
	// FindingID is the escalated finding (ID is the escalation's own).
	FindingID uint
}

type NodeReport struct {
	Findings    []Finding  `json:"findings"`
	NotAssessed int        `json:"not_assessed"`
	InventoryAt *time.Time `json:"inventory_at"`
	MatchedAt   *time.Time `json:"matched_at"`
	Loaded      bool       `json:"loaded"`
	Stale       bool       `json:"stale"`
}

type NodeSoftware struct {
	ID            uint      `gorm:"primarykey" json:"-"`
	NodeUUID      string    `gorm:"type:varchar(64);index:idx_vuln_sw_node" json:"node_uuid"`
	EnvironmentID uint      `gorm:"index" json:"environment_id"`
	Category      string    `gorm:"type:varchar(32);index:idx_vuln_sw_node" json:"category"`
	Name          string    `gorm:"type:varchar(255)" json:"name"`
	SourceName    string    `gorm:"type:varchar(255)" json:"source_name"`
	Version       string    `gorm:"type:varchar(255)" json:"version"`
	Arch          string    `gorm:"type:varchar(32)" json:"arch"`
	Vendor        string    `gorm:"type:varchar(255)" json:"vendor"`
	LastSeen      time.Time `json:"last_seen"`
}

type NodeState struct {
	NodeUUID      string     `gorm:"primaryKey;type:varchar(64)" json:"node_uuid"`
	EnvironmentID uint       `gorm:"index" json:"environment_id"`
	OSPlatform    string     `gorm:"type:varchar(64)" json:"os_platform"`
	OSVersion     string     `gorm:"type:varchar(128)" json:"os_version"`
	OSMajor       string     `gorm:"type:varchar(16)" json:"os_major"`
	InventoryAt   time.Time  `gorm:"index" json:"inventory_at"`
	MatchedAt     *time.Time `gorm:"index" json:"matched_at"`
	NotAssessed   int        `json:"not_assessed"`
	// Assessed counts packages matched against an exact ecosystem feed
	// (OSV). It is what a clean result means for scoring; CPE matches never
	// count.
	Assessed int `json:"assessed"`
}

type OSVSource struct {
	// contains filtered or unexported fields
}

type Range struct {
	Type   string  `json:"type"`
	Events []Event `json:"events"`
}

type Reader struct {
	DB         *gorm.DB
	StaleAfter time.Duration
	// contains filtered or unexported fields
}

type Summary struct {
	Loaded     bool                        `json:"loaded"`
	Stale      bool                        `json:"stale"`
	BySeverity map[string]map[string]int64 `json:"by_severity"`
	KEV        int64                       `json:"kev"`
	// Possible counts open possible (NVD CPE) findings. KEV, AffectedNodes
	// and the top lists count confirmed findings only.
	Possible int64 `json:"possible"`
	// KEVPossible counts open possible findings that are known-exploited.
	KEVPossible   int64      `json:"kev_possible"`
	AffectedNodes int64      `json:"affected_nodes"`
	NotAssessed   int64      `json:"not_assessed"`
	TopAdvisories []CountRow `json:"top_advisories"`
	TopPackages   []CountRow `json:"top_packages"`
}

type SyncResult struct{ Written, Skipped int }

type SyncState struct {
	Source      string     `gorm:"primaryKey;type:varchar(128)" json:"source"`
	Cursor      time.Time  `json:"cursor"`
	LastSuccess *time.Time `json:"last_success"`
	LastWritten int        `json:"last_written"`
	LastSkipped int        `json:"last_skipped"`
	LastError   string     `gorm:"type:text" json:"last_error"`
	LastErrorAt *time.Time `json:"last_error_at"`
	// ResumeIndex and ResumeStart let a full NVD sync that failed part-way
	// continue from its next page; ResumeStart is when that sync began.
	ResumeIndex int        `json:"-"`
	ResumeStart *time.Time `json:"-"`
}

type Worker struct {
	// contains filtered or unexported fields
}

type WorkerState struct {
	Name            string     `gorm:"primaryKey;type:varchar(32)" json:"-"`
	Owner           string     `gorm:"type:varchar(128)" json:"-"`
	LeaseUntil      time.Time  `json:"-"`
	SyncRequestedAt *time.Time `json:"sync_requested_at"`
	LastSyncAt      *time.Time `json:"last_sync_at"`
	LastSyncFailed  bool       `json:"last_sync_failed"`
	LastHousekeepAt *time.Time `json:"-"`
	// NVDActiveAt is the last tick of a replica with --vuln-nvd-enabled.
	// Replicas with NVD off keep NVD data while it is recent.
	NVDActiveAt *time.Time `json:"-"`
	// NVDActiveBy is the host that stamped NVDActiveAt: a host's own stamp,
	// from before it restarted with NVD off, does not delay the drop.
	NVDActiveBy string `gorm:"type:varchar(255)" json:"-"`
}