greenbone / gsa

Greenbone Security Assistant - The web frontend for the Greenbone Community Edition

Greenbone Security Assistant

The Greenbone Security Assistant is the web interface developed for the Greenbone Enterprise appliances written in React.

• Releases
• Installation
• Developing
• Translations
  • Format
  • Updating
  • Support a new Language
• Settings
  • Config File
  • Config Variables
    • vendorVersion
    • vendorLabel
    • guestUsername and guestPassword
    • disableLoginForm
    • enableEPSS
    • enableStoreDebugLog
    • logLevel
    • timeout
    • apiServer
    • apiProtocol
    • manualUrl
    • manualLanguageMapping
    • protocolDocUrl
    • reloadInterval
    • reloadIntervalActive
    • reloadIntervalInactive
    • reportResultsThreshold
• Support
• Maintainer
• Contributing
• License

Releases

All release files are signed with the Greenbone Community Feed integrity key. This gpg key can be downloaded at https://www.greenbone.net/GBCommunitySigningKey.asc and the fingerprint is 8AE4 BE42 9B60 A59B 311C 2E73 9823 FAA6 0ED1 E580.

Installation

Prerequisites for GSA:

• node.js >= 18.0

To install nodejs the following commands can be used

export VERSION=18
export KEYRING=/usr/share/keyrings/nodesource.gpg

curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | sudo tee "$KEYRING" >/dev/null
gpg --no-default-keyring --keyring "$KEYRING" --list-keys

echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/node_$VERSION.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list
echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/node_$VERSION.x nodistro main" | sudo tee -a /etc/apt/sources.list.d/nodesource.list

sudo apt update && sudo apt install nodejs

Change into the gsa source directory and delete the possible existing build output directory.

cd path/to/gsa
rm -rf build

Install the JavaScript dependencies and start the build process. The build process creates a build directory with a production build of GSA. The build/img directory will contain images like logos and banners. The build/static directory will contain generated JavaScript and CSS files and additionally in the build/static/media directory SVG files for all icons will be found.

npm install
npm run build

All content of the production build can be shipped with every web server. For providing GSA via our gsad web server, the files need to be copied into the share/gvm/gsad/web/ subdirectory of your chosen CMAKE_INSTALL_PREFIX directory when building gsad. Normally this is set to /usr or /usr/local.

mkdir -p $INSTALL_PREFIX/share/gvm/gsad/web/
cp -r build/* $INSTALL_PREFIX/share/gvm/gsad/web/

If you are not familiar or comfortable building from source code, we recommend that you use the Greenbone Enterprise TRIAL, a prepared virtual machine with a readily available setup. Information regarding the virtual machine is available at https://www.greenbone.net/en/testnow.

Developing

Using GSA requires to re-build the JavaScript bundle. This process is very time-consuming and therefore may be avoided during development. It is possible to run GSA in a special web development server. The development server can be started with:

cd path/to/gsa && npm run start

Afterwards the development web server is set up and a new browser window is opened at the URL http://127.0.0.1:8080, containing the GSA web application. When a JavaScript file of GSA in the src folder is changed, the browser window will reload automatically.

Besides the development server gsad needs to be running with CORS enabled.

gsad --http-cors="http://127.0.0.1:8080"

To be able to communicate with gsad, the web application needs to know the server URL. This can be accomplished by editing the path/to/gsa/public/config.js file. The following lines can be used for a local gsad running with HTTP on port 9392:

  config = {
    apiProtocol: 'http',
    apiServer: '127.0.0.1:9392',
  };

For HTTPS only the protocol property must be 'https' accordingly.

After changing the config.js file, the browser window should be reloaded manually.

Translations

For translations and internationalization i18next is used.

With our configuration of i18next the translations are stored in language specific JSON files. The existing translations can be found at the public/locales/ directory.

Format

The translations are stored in the JSON files as key-value pairs with the key being the English string and the value the translation of the specific language. Not translated strings have an empty string “” as the value.

Example with German translations:

{
  "Create a new Tag": "Einen neuen Tag erstellen",
  "Create a new Target": "Ein neues Ziel erstellen",
  "Create a new Task": ""
}

Updating

To change or extend translations new values can be added to the specific JSON file, committed to git and finally uploaded through a pull request to GitHub.

But sometimes the UI changes and new English descriptions are added or existing ones have been rephrased. In this case the new keys must be extracted from the source code and added to the JSON files. This can be done by running

npm run i18n-extract

New translation strings are added with an empty string “” as default value. Therefore searching for empty strings will find the to be translated values. Keys with a _plural suffix can be ignored. They are just added for technical reasons and are unused.

If not all strings are translated at once the remaining empty strings would cause missing text in web UI. Therefore, the JSON files must be cleaned up before adding the changes to git and creating a pull request. To clean up the JSON files the following command can be used

npm run clean-up-translations

Support a new Language

The currently supported languages are listed at src/gmp/locale/languages.js. If a new language should be available in the web UI, it needs an entry in this object. Additionally the corresponding language codes must be added to the babel config and cleanup script.

Settings

The behavior of GSA can be changed via settings. All of the settings can be adjusted via a config file. Some of the settings can be changed during runtime too. Some of them are persistent during reload, some are reset during reload.

This sections lists all settings and explains their behavior.

Config File

The config file is a normal JavaScript file (with a .js suffix). It is named config.js and will be loaded from the /usr/share/gvm/gsad/web/ (or /usr/local/share/gvm/gsad/web/) directory when using gsad for providing GSA e.g. in production environments.

During development when using the on-the-fly-transpiling JavaScript development server (via npm run start) the file is loaded from the public/ directory.

The config.js file must contain a global config object with settings as properties e.g.

config = {
  // javascript files in contrast to JSON files allow comments
  foo: 'bar',
}

It is evaluated in the GmpSettings object implemented in the gmpsettings.js file. The GmpSettings object is instantiated once for the GSA application

Config Variables

Name	Type	Default	Changeable during runtime	Persistent after reload
apiProtocol	String ('http' or 'https')	global.location.protocol	-	x
apiServer	String	global.location.host	-	x
enableGreenboneSensor	Boolean	false	-	x
disableLoginForm	Boolean	false	-	x
enableEPSS	Boolean	false	x	x
enableStoreDebugLog	Boolean	false	x	x
guestUsername	String	undefined	-	x
guestPassword	String	undefined	-	x
locale	String	undefined	x	x
logLevel	String	'warn'	x	x
manualUrl	String	https://docs.greenbone.net/GSM-Manual/gos-22.04/	-	x
manualLanguageMapping	Object	undefined	-	x
protocolDocUrl	String	https://docs.greenbone.net/API/GMP/gmp-22.4.html	-	x
reloadInterval	Integer	15 * 1000; // fifteen seconds	x	-
reloadIntervalActive	Integer	3 * 1000; // three seconds	x	-
reloadIntervalInactive	Integer	60 * 1000; // one minute	x	-
reportResultsThreshold	Integer	25000	x	-
timeout	Integer	300000; // 5 minutes	x	-
vendorVersion	String	undefined	-	x
vendorLabel	String	undefined	-	x

vendorVersion

Allows to adjust the shown product version string at the Login and About pages.

vendorLabel

Allows to adjust the product info image at the Login page. It must be a relative path e.g. foo.png. The path will be mapped to $INSTALL_PREFIX/share/gvm/gsad/web/img/ on production (with gsad) and gsa/public/img for the development server.

guestUsername and guestPassword

Both settings allow to login with a single click. This user has to be set up carefully. E.g. if this user is created with admin privileges it will have these permissions after login. Thus be careful when creating a guest user. If guestUsername is contained in the config.js file the Login as Guest button will be shown.

disableLoginForm

This setting allows to deactivate the username password form at the Login page. It can be used to deactivate login for normal users.

enableEPSS

Enables the display of EPSS scores and percentiles in CVEs and NVTs.

The data required for this is not available in the feed yet, so this is disabled by default.

enableStoreDebugLog

Changes to this settings are persistent during browser reload. If the value has been changed in the browser console e.g. via gmp.settings.enableStoreDebugLog = true the browser window needs to be reloaded to apply this setting. The setting can be true, false or undefined.

If either enableStoreDebugLog is true or it is undefined and logLevel is debug the changes of the redux store are shown. The store contains all data visible to the user.

logLevel

The value of logLevel is persistent during browser reload. If the value has been changed e.g. by running gmp.settings.logLevel = 'debug' in the browser console the browser window needs to be reloaded to apply this setting. Also this setting must be reset via gmp.settings.logLevel = undefined to not display the debug logs anymore and to use the default setting again. If logLevel is set to 'debug' and enableStoreDebugLog is not false the store debug logs are shown too.

timeout

This setting specifies as timeout after a data request to our API provided by gsad will fail. Default is 5 minutes (300000 ms).

apiServer

Defaults to window.location.host. It contains the domain/IP address of the gsad server including the port e.g. '192.168.10.123:9392'.

apiProtocol

Defaults to window.location.protocol and must be either 'http' or 'https'.

manualUrl

URL to the manual. On a Greenbone Enterprise Appliance the manuals are served locally and the value is the relative URL '/manual'. The URL is used for all links from help icons pointing to a page at the user manual.

manualLanguageMapping

Because we could possibly have a different number of translated manuals then available locales, a setting for mapping a locale to a corresponding translated manual is provided. If a current locale isn't mapped it always falls back to the English (en) locale.

protocolDocUrl

This setting contains the URL to the public Greenbone Management Protocol (GMP) documentation. It is https://docs.greenbone.net/API/GMP/gmp-22.4.html and only used at the About page.

reloadInterval

The standard interval for reloading data. The default is 15 seconds (15000 ms).

reloadIntervalActive

This interval is used for reloading data on pages with an active process. This is currently the case for a task list page, task details page, report list page and report details page containing at least one actively scanning task. The default is 3 seconds (3000 ms).

reloadIntervalInactive

This interval is used instead of reloadInterval or reloadIntervalActive for reloading data when GSA is not the active browser window or tab. The default is 60 seconds (60000 ms).

reportResultsThreshold

If the number of filtered results of a shown report extends this threshold only the report without details is loaded and an information panel is show at the Hosts, Ports, Applications, Operating Systems, CVEs, Close CVEs and TLS Certificates tabs to prompt the user for lowering the number of results by additional filtering. This setting can be used to improve the responsiveness of the report details page.

Support

For any question on the usage of gsa please use the Greenbone Community Portal. If you found a problem with the software, please create an issue on GitHub. If you are a Greenbone customer you may alternatively or additionally forward your issue to the Greenbone Support Portal.

Maintainer

This project is maintained by Greenbone AG.

Contributing

Your contributions are highly appreciated. Please create a pull request on GitHub. Bigger changes need to be discussed with the development team via the issues section at github first.

License

Copyright (C) 2009-2023 Greenbone AG

Licensed under the AGPL-3.0 GNU Affero General Public License v3.0 or later.

gsa's Issues

Rename StrippedTable to StripedTable

Fix typo for the StripedTable.

NG: Formatting is not preserved in "Log Method" case

This is a follow-up of #390 and the PR #397 solving it:

There is another edge/corner case where a NVT is using the script_tag(name:"vuldetect", value:"" tag but is only sending a log_message() (0.0 severity).

Once this is happening instead of the static and already correctly formatted Vulnerability Detection Method a Log Method (static as well) without the formatting is shown like seen below:

Merge withIconSize and withIconCss HOCs

It doesn't make sense to use one of these two HOCs independently. Therefore they should be merged into only one HOC. It should also be considered to implement a component using the render props pattern as a base for the new HOC.

Move NvtPreferences to web/nvts/

Move NvtPreferences from web/scanconfigs/ to web/nvts/

Replace Select Dropdown component

Our current select component (select2) is based on the jquery select2 library. The component has several downsides (besides being based on jquery). Most important it's layout always calculates its width on the size of the content.

We should the replace the component by a new react version. A good starting point would be downshift

https://blog.kentcdodds.com/introducing-downshift-for-react-b1de3fca0817
https://github.com/paypal/downshift

Please keep in mind we use select to as multi select (tag like selection) and dropdown. So actually there are two components to be implemented.

Replace dialogcontainer component

ng contains some old concept of DialogContainers. These container components have been implemented to not having to implement save and create handler several time. But as time goes by this DialogContainer concept has been made obsolete.

Currently there are still

./src/web/components/dialog/container.js
./src/web/pages/targets/dialogcontainer.js
./src/web/pages/tasks/dialogcontainer.js
./src/web/pages/alerts/dialogcontainer.js

They should be replaced with a SaveDialog component in combination with a EntityComponent (e.g. TaskComponent).

Merge SECINFO_FILTER_FILTER constants

At the moment we are using several constants such as NVTS_FILTER_FILTER, CVES_FILTER_FILTER and so on in the filter model.
All of the SecInfo filter types are 'type=info' so it makes sense to merge those constants and use SECINFO_FILTER_FILTER only.
For this, the constants in the model have to be changed and their usage in different displays and possibly other components has to be adjusted.

Update Model id behavior

Set model instance ids to undefined if they contain an empty string. Currently they are set to the value passed from the response 1:1 see https://github.com/greenbone/gsa/blob/master/ng/src/gmp/parser.js#L124

Implementing this may cause regressions because some code may expect that an id is always defined.

NG: Delta reports are missing "diff view/different lines" for changed (~) items

A delta view with a current trunk doesn't show the "Result 1", "Result 2" and "Different Lines" like seen on the screenshots below (from GSA 7.0.x). On NG only the newest result is shown in the delta view of a changed item.

[7.0.3] Build fails with po file error

The 7.0.3 build fails with:

[ 68%] Generating gsad-ru.json
cd /builddir/build/BUILD/gsa-7.0.3/src/po && /usr/bin/msgfmt /builddir/build/BUILD/gsa-7.0.3/src/po/gsad_xsl-de.po -o /builddir/build/BUILD/gsa-7.0.3/src/po/de/gsad_xsl.mo
cd /builddir/build/BUILD/gsa-7.0.3/src/po && /usr/bin/python /builddir/build/BUILD/gsa-7.0.3/tools/po2json /builddir/build/BUILD/gsa-7.0.3/src/po/gsad_js-ru.po /builddir/build/BUILD/gsa-7.0.3/src/po/gsad-ru.json
Traceback (most recent call last):
File "/builddir/build/BUILD/gsa-7.0.3/tools/po2json", line 66, in
main()
File "/builddir/build/BUILD/gsa-7.0.3/tools/po2json", line 62, in main
convert(sys.argv[1], sys.argv[2])
File "/builddir/build/BUILD/gsa-7.0.3/tools/po2json", line 45, in convert
po_f = polib.pofile(in_name)
File "/usr/lib/python2.7/site-packages/polib.py", line 138, in pofile
return _pofile_or_mofile(pofile, 'pofile', **kwargs)
File "/usr/lib/python2.7/site-packages/polib.py", line 86, in _pofile_or_mofile
instance = parser.parse()
File "/usr/lib/python2.7/site-packages/polib.py", line 1306, in parse
self.process(keywords[tokens[0]])
File "/usr/lib/python2.7/site-packages/polib.py", line 1450, in process
self.current_line)
IOError: Syntax error in po file (line 430)

libexslt is not listed as dependency

Important dependency is not listed in the INSTALL.md

Expected behavior

apt-get install libxslt1-dev

root@greenbone-ubuntu-1604:/tmp/kitchen/cache/assistant/build# cmake -DCMAKE_INSTALL_PREFIX=/opt/greenbone ..
-- Configuring greenbone-security-assistant...
-- Checking for module 'libexslt'
--   Found libexslt, version 0.8.17
-- Checking for module 'libopenvas_omp>=9.0.0'
--   Found libopenvas_omp, version 9.0.2
-- Checking for module 'libopenvas_base>=9.0.0'
--   Found libopenvas_base, version 9.0.2
-- Checking for module 'libopenvas_misc>=9.0.0'
--   Found libopenvas_misc, version 9.0.2
-- Checking for module 'libxslt'
--   Found libxslt, version 1.1.28
-- Checking for module 'gnutls>=3.2.15'
--   Found gnutls, version 3.4.10
-- Looking for libgcrypt...
-- Looking for libgcrypt... /usr/lib/x86_64-linux-gnu/libgcrypt.so
-- Found Git: /usr/bin/git (found version "2.7.4") 
-- Install prefix: /opt/greenbone
-- Looking for pthread.h
-- Looking for pthread.h - found
-- Looking for pthread_create
-- Looking for pthread_create - not found
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE  
-- Static asset serving is builtin, use with care.
-- Internal XSL transformations, with libxslt.
-- Could NOT find Gettext (missing:  GETTEXT_MSGMERGE_EXECUTABLE GETTEXT_MSGFMT_EXECUTABLE) 
-- Found PythonInterp: /usr/bin/python (found version "2.7.12") 
-- Could NOT find PY_polib (missing:  PY_POLIB) 
CMake Warning at src/po/CMakeLists.txt:164 (message):
  Could not build translation files: gettext not found.


-- Found Doxygen: /usr/bin/doxygen (found version "1.8.11") 
-- Looking for xmltoman...
-- Looking for xmltoman... /usr/bin/xmltoman
-- Looking for xmlmantohtml... /usr/bin/xmlmantohtml
-- Configuring done
-- Generating done
-- Build files have been written to: /tmp/kitchen/cache/assistant/build

Current behavior

root@greenbone-ubuntu-1604:/tmp/kitchen/cache/assistant/build# cmake -DCMAKE_INSTALL_PREFIX=/opt/greenbone ..
-- Configuring greenbone-security-assistant...
-- Checking for module 'libexslt'
--   No package 'libexslt' found
CMake Error at /usr/share/cmake-3.5/Modules/FindPkgConfig.cmake:367 (message):
  A required package was not found
Call Stack (most recent call first):
  /usr/share/cmake-3.5/Modules/FindPkgConfig.cmake:532 (_pkg_check_modules_internal)
  CMakeLists.txt:82 (pkg_check_modules)


-- Configuring incomplete, errors occurred!
See also "/tmp/kitchen/cache/assistant/build/CMakeFiles/CMakeOutput.log".

Steps to reproduce

1. Install gvm-libs
2. download gsa source
3. export PKG_CONFIG_PATH and cmake -DCMAKE_INSTALL_PREFIX

GVM versions

gsa: (gsad --version) 7.0.3

gvm-libs: 9.0.2

Environment

Operating system: UBUNTU 16.04 x86_64

Installation method / source: source installation

Logfiles

Edit Filter in Report view no longer works

Expected behavior

The edit filter button should pop up the filter editing modal to allow for easy filter editing.

Current behavior

The button throws a javascript exection :
Uncaught TypeError: this.filter_dialog.show is not a function
at t.value (detailspage.js:350)
at t.value (icon.js:52)
at Object.a (react-dom.production.min.js:15)
at Object.invokeGuardedCallback (react-dom.production.min.js:16)
at Object.invokeGuardedCallbackAndCatchFirstError (react-dom.production.min.js:16)
at u (react-dom.production.min.js:20)
at p (react-dom.production.min.js:22)
at m (react-dom.production.min.js:22)
at d (react-dom.production.min.js:21)
at v (react-dom.production.min.js:24)

Steps to reproduce

1. Navigate to any report in GSA
2. Click on the "Edit Filter" (wrench) button
3. Check the javascript console

GVM versions

gsa: GIT revision b54fb58-master

gvm: GIT revision 578d030c-master

openvas-scanner: GIT revision e2e20fd-master

Environment

Operating system: Debian Linux x64

Installation method / source: Git source

gsad must return http 404

Return http 404 if an entity couldn't be found for a specific id. Currently an unknown id will cause an error in ng.

Fix layout of action icons

Several action icons (in lists and page toolbars) don't have a margin between them currently. They should be put into an IconDivider.

New slider component

The old version (gsa 7.0) has a slider component based on jquery. This component hasn't been used by intention in ng. We should implement/find a suitable slider component base on react for ng.

Hint: if I remember correctly the slider component is used for setting the min qod in the powerfilter dialogs.

Migrate to other CSS-in-JS library

It seems glamorous will be deprecated paypal/glamorous#419
So we need to investigate howto migrate to another CSS-in-JS solution like https://emotion.sh/

Error in make for gsa-7.0.3

When I try to build the gsa-7.0.3, I get the following error:

Scanning dependencies of target gettext-json
[ 80%] Generating gsad-zh_CN.json
[ 82%] Generating gsad-ar.json
[ 85%] Generating gsad-de.json
[ 88%] Generating gsad-fr.json
Traceback (most recent call last):
File "/home/openvas/src/gsa-7.0.3/tools/po2json", line 66, in
main()
File "/home/openvas/src/gsa-7.0.3/tools/po2json", line 62, in main
convert(sys.argv[1], sys.argv[2])
File "/home/openvas/src/gsa-7.0.3/tools/po2json", line 45, in convert
po_f = polib.pofile(in_name)
File "/usr/lib/python2.7/dist-packages/polib.py", line 138, in pofile
return _pofile_or_mofile(pofile, 'pofile', **kwargs)
File "/usr/lib/python2.7/dist-packages/polib.py", line 86, in _pofile_or_mofile
instance = parser.parse()
File "/usr/lib/python2.7/dist-packages/polib.py", line 1320, in parse
self.process(keywords[tokens[0]])
File "/usr/lib/python2.7/dist-packages/polib.py", line 1464, in process
self.current_line)
IOError: Syntax error in po file (line 430)
src/po/CMakeFiles/gettext-json.dir/build.make:74: recipe for target 'src/po/gsad-fr.json' failed
make[2]: *** [src/po/gsad-fr.json] Error 1
CMakeFiles/Makefile2:1020: recipe for target 'src/po/CMakeFiles/gettext-json.dir/all' failed
make[1]: *** [src/po/CMakeFiles/gettext-json.dir/all] Error 2
Makefile:149: recipe for target 'all' failed
make: *** [all] Error 2

Set defaults for gmp APIs

Currently in the gmp apis it's not clear which parameters are mandatory any optional. Therefore we should set sane defaults as much as possible.

E.g. gmp.xyz.save({abc = 'mydefault'})

Show busy indicatior during dialog saving

If a dialog needs some time to save the data no indicator is shown that the dialog is still busy in the background. Even the save button is not disabled. Therefore a use might click several times on the save button and create several objects at the backend.

Fix rendering of ovaldef and cve list tables

Currently for being able to render divided rows all rows of these lists are put into an tbody element, because before React 16 it wasn't possible to return several elements from a components render method.

This has the side effect that the details are added as a tr child of the table without a tbody in between. Therefore react issues a warning when opening the details.

By using https://reactjs.org/docs/react-component.html#fragments it should be fixed to only have one tbody for all rows.

Implement anchor usage (#) for links

Anchors such as help/users.html#peruserldapauthentication are not supported.

The # gets parsed to %23 and is not located at the end of the URL. Changes might need to be done to the HelpIcon component, but it's more likely that gmp.buildUrl() needs adjustments.

New Datepicker component

The current datepicker uses jquery-ui datepicker and should be replaced by a plain react version.

make base path configurable instead of hardcoded /

I want to use gsad behind an Apache reverse proxy, in a subdirectory of the root of a domain. This mostly works with this Apache configuration:

<Location /openvas>
        ProxyPass http://localhost:9392
	ProxyPassReverse http://localhost:9392
        ProxyHTMLEnable On
        ProxyHTMLURLMap /       /openvas/
	ProxyAddHeaders On
</Location>

However even then there are some places where ProxyHTMLURLMap fails to rewrite the path of some image resources (maybe in Javascript?). It would be useful if there were a way to define a base path in gsad itself, and that it would automatically make all resources available in that path instead of in the root directory.

[7.0.2] Linking against libmicrohttpd 0.9.59 will result in warnings during start up

When using the last version of libmicrohttpd, the following warning will shown on start up:

gsad: Warning: MHD_USE_THREAD_PER_CONNECTION must be used only with MHD_USE_INTERNAL_POLLING_THREAD. Flag MHD_USE_INTERNAL_POLLING_THREAD was added. Consider setting MHD_USE_INTERNAL_POLLING_THREAD explicitly.

Allow to change initialData of SaveDialog after opening

Currently the initialData of the new SaveDialog is only set when the SaveDialog class is created (the state is state to contain the props in the constructor). This may lead to issues when not all initalData is loaded yet and the user want's to open the dialog.

Therefore it should be allowed to change the initialData.

signed tarball for gsa 7.0.3

Hello,
There is no signed tarball for gsa 7.0.3. Could you please add it? Thanks!

OSP setting options in user settings

The two settings "Default OSP Scan Config" and "Default OSP Scanner" don't have any options from which to select. Missing data in the setup don't allow me to figure out which data needs to be send and how. Therefore, they are not yet included in the user settings.
This concerns pages/usersettings/dialog.js ll. 296 and 309.

Update timezone settings while logged in

The currently set timezone will not update after it is changed in usersettings. Only after logging out and then in again, the new timezone is actually set and displayed.

Adding a user tag to SecInfos causes internal error

When adding a tag to a secinfo entity (e.g. NVTs, CPEs, CVEs...) via the details page tab, an "internal error" 500 is thrown. A faulty resourceType might be the cause for this.

Access to WEB-console GSA via hostname

Hello. In version 7.0.3, access to GSA through the hostname was lost. The web interface is accessible only by IP address. Error: "The request contained an unknown or invalid host header. If you are trying to access GSA through your host name or proxy server, make sure that the GSA is configured this way." This is a bug or feature ?

Expected behavior

Access to WEB-console GSA via hostname.

Current behavior

Access to WEB-console GSA via IP address.

Steps to reproduce

1. Open URL https://scan01.local:4444
2. Error.
3. Open URL https://10.0.0.10:4444
4. No error.

OpenVAS / GVM versions

gsa: (7.0.3)

gvm: (7.0.3 / -)

openvas-scanner: (5.1.2)

gvm-libs: -

openvas-smb: -

Environment

Operating system: Ubuntu 16.04 LTS

Installation method / source: (packages)

Logfiles

gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: - fe80::215:5dff:fe96:fa5c%eth0
gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: - 127.0.0.1
gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: - 10.0.0.10
gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: - localhost
gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: - ::1
gsad main:  DEBUG:2018-04-09 13h46.14 utc:35837: GSAD started successfully and is listening on port 4444
gsad main:  DEBUG:2018-04-10 06h36.22 utc:35829: ============= url: /?r=1
gsad main:  DEBUG:2018-04-10 06h36.22 utc:35829: validate_host_header: header: 'scan01.local:4444' -> host: 'scan01.local'
gsad main:  DEBUG:2018-04-10 06h36.22 utc:35829: connectiontype=2

[gsa-7.0] error during the make process

During the make process I got the following error

Traceback (most recent call last):
File "/openvas/update/gsa/tools/po2json", line 66, in
main()
File "/openvas/update/gsa/tools/po2json", line 62, in main
convert(sys.argv[1], sys.argv[2])
File "/openvas/update/gsa/tools/po2json", line 45, in convert
po_f = polib.pofile(in_name)
File "/usr/local/lib/python2.7/dist-packages/polib.py", line 138, in pofile
return _pofile_or_mofile(pofile, 'pofile', **kwargs)
File "/usr/local/lib/python2.7/dist-packages/polib.py", line 86, in _pofile_or_mofile
instance = parser.parse()
File "/usr/local/lib/python2.7/dist-packages/polib.py", line 1320, in parse
self.process(keywords[tokens[0]])
File "/usr/local/lib/python2.7/dist-packages/polib.py", line 1464, in process
self.current_line)
IOError: Syntax error in po file (line 430)
src/po/CMakeFiles/gettext-json.dir/build.make:74: recipe for target 'src/po/gsad-fr.json' failed
make[2]: *** [src/po/gsad-fr.json] Error 1
CMakeFiles/Makefile2:1020: recipe for target 'src/po/CMakeFiles/gettext-json.dir/all' failed
make[1]: *** [src/po/CMakeFiles/gettext-json.dir/all] Error 2
Makefile:149: recipe for target 'all' failed
make: *** [all] Error 2

How to fix it.

In the https://github.com/greenbone/gsa/blob/gsa-7.0/src/po/gsad_js-fr.po line 430 you need to have msgstr instead of msgid

( Ubuntu 16.04.4 LTS, build from source)

[7.0.2] Unable to import an role

An role can exported as an xml file, but there is no import function in the roles menu.

Review unused functions

Code analysis with cppcheck shows four functions in GSA which are
defined, but never used:

• gsad/src/gsad_cmd.c: cmd_response_data_set_redirect ()
• gsad/src/xslt_i18n.c: get_ext_gettext_enabled ()
• gsad/src/gsad_http_handler.c: handle_login_page ()
• gsad/src/gsad_http.c: is_export ()

It should check whether this is indeed dead code or code waiting to be
used.

Remove parse_xyz, YES_VALUE, NO_VALUE from gmp/utils.js

All parsing related code should be in gmp/parser.js now. Currently parse_yesno, YES_VALUE and NO_VALUE are already imported and exported at gmp/parser.js but many code still uses gmp/utils.js to import them. Therefore the imports should be rewritten to use gmp/parser.js instead.

Clicking on an ExternalLink should show dialog first

As it is in gsa-7.0 clicking on an ExternalLink should show a disclaimer dialog if the user really would like to open the external page first.

Rename token to sessionToken

The current gmp api uses the term token for the session token because the http "protocol" to gsad uses this variable. I fear the term token might be to generic in future and it may be better to use sessionToken instead.

The term token is used in gmp/gmp.js and gmp/http.js

Replace all css files with glamorous

We are using the CSS-in-JS solution glamorous which is much nicer to encapsulate styles in components. But there are still some components that use css files directly from the before glamorous era.

src/web/components/dashboard/css/dashboard.css
src/web/components/folding/css/folding.css
src/web/components/menu/css/menu.css
src/web/components/form/css/select2.css
src/web/components/form/css/form.css
src/web/components/form/css/button.css
src/web/components/form/css/datepicker.css
src/web/components/form/css/checkboxradio.css
src/web/components/form/css/spinner.css
src/web/components/form/css/formgroup.css
src/web/pages/users/css/row.css
src/web/wizard/css/wizard.css
src/web/css/app.css
src/web/css/gsa-base.css
src/web/css/gsa-style.css
src/web/css/gsa-login.css
src/web/entities/css/component.css
src/web/entities/css/footer.css

These files should be replaced by using glamorous instead as possible.

Get rid of autobind

In the early beginnings of I have implemented a autobind function to bind handler functions for react component automatically based on their name prefix. This violates the explicit is better the implicit rule and therefore autobind isn't used very much (if at all now). Therefore autobind should be removed completely from the ng code. It lives in gmp/utils.js at the moment.

Use LRU strategy for http caching

Currently our http cache stores all requests as long as the user reloads the page. This might be to much data at the end because our responses are really big. Therefore we should use a LRU strategy instead.

Allow resizing of dialogs

It should be possible to resize all dialogs via mouse or at least to allow resizing by setting a prop. The resizing is already possible at the old version of the dialogs in gsa-7.0 with the jquery-ui dialog component.

Rethink responses for plural commands

Currently all plural commands (commands to return lists like gmp.tasks.get()) return CollectionLists
directly. The collection list had the intention to provide the list counts at first and got extended to also provide meta information about the http response. Afterwards getting meta info got also necessary for single commands (for a specific entity like gmp.taks.get({id})). As a result single commands return a Response class instead of the entity model directly.

To have a more consistent API it may be better to also return Response objects for plural commands. The API would change from

gmp.tasks.get().then(collectionlist => {
  const data = collectionslist;
  const {meta, counts} = data;
});

to

gmp.tasks.get().then(response => {
  const {meta, data: collectionlist} = response;
  const {counts} = collectionlist;
});

which is more aligned to the single command API

gmp.task.get({id: 1}).then(response => {
  const {meta, data: task} = response;
});

Override/Note details are missing result link

Currently it is not possible to link from an Override or Note to the result details because the result name is missing in both data responses.

Not sure if that is a problem in gsad or gvmd yet.

Remove unnecessary download functions from gsad

in gsad_gmp.c the download_ssl_cert, download_ca_pub and download_key_pub are posting user data back to the browser without ever checking if the data is valid. This is a no-go and can/has been replaced with js code. Therefore theses functions should be removed from gsad.

Invalid Request

Hi,
I am not accessing my gsa. I get error it say "The request contained an unknown or invalid Host header. If you are trying to access GSA via its hostname or a proxy, make sure GSA is set up to allow it."

I connected from my browser with https://172.17.6.150:4000 to openvas.

help me please.

Rewrite dialogs to use SaveDialog

The current dialogs are implemented using the withDialog HOC. The API to use these dialogs is based on react refs and the show() methods. refs are a bit problematic because they might already be removed when a promise of the dialog is fulfilled and this can cause serious bugs.

Therefore all dialogs using withDialog should be replaced with a version using the new SaveDialog component.

Broken "Hosts by Modification Time" Graph

Expected behavior

I should be able to edit the Openvas Dashboard and see the "Hosts by Modification Time"-Graph

Current behavior

The "Hosts by Modification Time"-Graph is loading forever and breaks the option to edit the dashboard.

Steps to reproduce

It happened after a restore of openvas from a backup. (whole VM snapshot backup)

GVM versions

gsa: 7.0.2

gvm: 7.0.2

openvas-scanner: 5.1.1

gvm-libs: no idea

openvas-smb: no idea

Environment

Operating system: CentOS7 with Atomicorps Sources

Installation method / source: (packages, source installation)

Packages via Atomicorp Openvas RPMs

Logfiles

No idea which logs you want..

Screencast

Here is a Screencast of the issue. You might need Chromium/Chrome to play the video: https://paste.xinu.at/WIHv/

Remove page prop from DetailsLInk

The page prop has become obsolete. It was used for checking user capabilities if the entity type was not equal to the page name. This problem has been improved at the Capabilities class directly.

Get rid of form Text component

The component was intended to add a marging after a text. Adding margins has been improved by the introduction of the Divider components. Therefore gsa/src/html/classic/ng/src/web/components/form/text.js is completely useless now.

Make checkboxes resize

When the font size in the browser is changed (e.g. via Ctrl++ or Ctrl+-) the checkboxes within dialogs do not change size. So depending on the direction of change of font size they either look very big or very tiny.
This is a minor issue, though, as it gets really visible only with very huge or very tiny fonts.

NG: Difference in NVT text format between /ng/results and /ng/nvts

Running the current trunk there is a difference in the formatting of the text on the two mentioned pages (havn't checked any others so far). The screenshots below are from results of the NVT with the OID 1.3.6.1.4.1.25623.1.0.902909: