Merge pull request #88 from Ostorlab/fix/add_service_version_when_pro…

…duct_is_available Emit product version when fingerprinting.
Ostorlab · Feb 28, 2024 · 34d06b9 · 34d06b9
2 parents 3674fc4 + 7c51484
commit 34d06b9
Show file tree

Hide file tree

Showing 4 changed files with 58 additions and 2 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -5,7 +5,7 @@ RUN apt-get update && apt-get install -y software-properties-common  \
     && add-apt-repository ppa:deadsnakes/ppa \
     && apt-get remove -y python*
 
-RUN apt-get install -y build-essential \
+RUN apt-get update && apt-get install -y build-essential \
     python3.11 \
     python3.11-dev \
     python3-pip \

diff --git a/agent/generators.py b/agent/generators.py
@@ -47,6 +47,7 @@ def get_services(
                 data["state"] = port.get("state", {}).get("@state", "closed")
                 data["service"] = port.get("service", {}).get("@name", "")
                 data["product"] = port.get("service", {}).get("@product", "")
+                data["product_version"] = port.get("service", {}).get("@version", "")
                 data["banner"] = get_script_by_name(name="banner", port=port)
                 yield data
     except KeyError as e:

diff --git a/agent/nmap_agent.py b/agent/nmap_agent.py
@@ -382,6 +382,7 @@ def _emit_fingerprints(
                             "port": data.get("port"),
                             "protocol": data.get("protocol"),
                             "library_name": data.get("product"),
+                            "library_version": data.get("product_version"),
                             "detail": data.get("product"),
                         }
                         self.emit(selector, fingerprint_data)
@@ -406,7 +407,7 @@ def _emit_fingerprints(
                                 "port": data.get("port"),
                                 "schema": data.get("service"),
                                 "library_name": data.get("product"),
-                                "library_version": None,
+                                "library_version": data.get("product_version"),
                                 "library_type": "BACKEND_COMPONENT",
                                 "detail": f"Nmap Detected {data.get('name')} on {domain_name}",
                             }

diff --git a/tests/nmap_agent_test.py b/tests/nmap_agent_test.py
@@ -687,3 +687,57 @@ def testAgentNmap_whenInvalidDomainName_doesNotCrash(
     nmap_test_agent.process(invalid_domain_msg)
 
     assert len(agent_mock) == 0
+
+
+def testAgent_whenServiceWithProductAndVersion_fingerprintMessageShouldHaveLibraryNameAndVersion(
+    nmap_test_agent: nmap_agent.NmapAgent,
+    agent_mock: List[message.Message],
+    ipv4_msg: message.Message,
+    agent_persist_mock: Dict[Union[str, bytes], Union[str, bytes]],
+    mocker: plugin.MockerFixture,
+) -> None:
+    """Ensure the agents emits the detected library name with its version."""
+    del agent_persist_mock
+    product_fake_output = {
+        "nmaprun": {
+            "host": {
+                "address": {"@addr": "127.0.0.1", "@addrtype": "ipv4"},
+                "ports": {
+                    "port": {
+                        "@portid": "22",
+                        "@protocol": "tcp",
+                        "state": {
+                            "@state": "open",
+                            "@reason": "syn-ack",
+                            "@reason_ttl": "0",
+                        },
+                        "service": {
+                            "@name": "ssh",
+                            "@product": "OpenSSH",
+                            "@version": "7.4",
+                            "cpe": "cpe:/a:openbsd:openssh:7.4",
+                        },
+                    }
+                },
+            }
+        }
+    }
+
+    mocker.patch(
+        "agent.nmap_wrapper.NmapWrapper.scan_hosts",
+        return_value=(product_fake_output, ""),
+    )
+
+    nmap_test_agent.process(ipv4_msg)
+
+    assert len(agent_mock) == 3
+    assert agent_mock[0].selector == "v3.asset.ip.v4.port.service"
+    assert agent_mock[1].selector == "v3.report.vulnerability"
+    fingerprint_msg = agent_mock[2]
+    assert fingerprint_msg.selector == "v3.fingerprint.ip.v4.service.library"
+    assert fingerprint_msg.data["host"] == "127.0.0.1"
+    assert fingerprint_msg.data["mask"] == "32"
+    assert fingerprint_msg.data["service"] == "ssh"
+    assert fingerprint_msg.data["port"] == 22
+    assert fingerprint_msg.data["library_name"] == "OpenSSH"
+    assert fingerprint_msg.data["library_version"] == "7.4"