Merge branch 'main' into ipv6

jjnicola · web-flow · commit 80b35704eb07 · 2025-10-29T10:37:16.000-03:00
diff --git a/.github/workflows/build-rs.yaml b/.github/workflows/build-rs.yaml
@@ -38,14 +38,14 @@ jobs:
           cp "./${DIST}/install/usr/local/bin/openvasd"      "${ASSETS_SUBDIR}/openvasd"
           cp "./${DIST}/install/usr/local/bin/scannerctl"    "${ASSETS_SUBDIR}/scannerctl"
           cp "./${DIST}/install/usr/local/bin/feed-verifier" "${ASSETS_SUBDIR}/feed-verifier"
-      - name: verify
-        shell: bash
-        run: |
-          # I think it is not good that we rely on dynamic libs
-          apt update && apt install -y \
-              libsnmp-dev
-          ${ASSETS_SUBDIR}/openvasd -h
-          ${ASSETS_SUBDIR}/scannerctl -h
+      # - name: verify
+      #   shell: bash
+      #   run: |
+      #     # I think it is not good that we rely on dynamic libs
+      #     apt update && apt install -y \
+      #         libsnmp-dev
+      #     ${ASSETS_SUBDIR}/openvasd -h
+      #     ${ASSETS_SUBDIR}/scannerctl -h
       - name: archive
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
@@ -19,8 +19,8 @@ jobs:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-rust
       - run: cargo fmt --check
-      - run: cargo clippy --all-targets -- -D warnings
-      - run: cargo clippy --all-targets --features experimental -- -D warnings
+      - run: cargo clippy --all-targets -- -D warnings --no-deps
+      - run: cargo clippy --all-targets --features experimental -- -D warnings --no-deps
   Rust-Typos:
     runs-on: ubuntu-latest
     defaults:
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -8,7 +8,7 @@ message ("-- Configuring the Scanner...")
 
 # VERSION: Always include major, minor and patch level.
 project (openvas
-  VERSION 23.29.0
+  VERSION 23.30.1
   LANGUAGES C)
 
 if (POLICY CMP0005)
diff --git a/charts/openvasd/Chart.yaml b/charts/openvasd/Chart.yaml
@@ -21,4 +21,4 @@ version: 0.1.0
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "23.29.0"
+appVersion: "23.30.1"
diff --git a/doc/manual/nasl/built-in-functions/glue-functions/index.md b/doc/manual/nasl/built-in-functions/glue-functions/index.md
@@ -8,7 +8,11 @@ This part contains functions that are dependent on openVAS.
 
 - **[get_preference](get_preference.md)** - get a preference
 - **[get_script_oid](get_script_oid.md)** - get the OID of the current script
+- **[notus_error](notus_error.md)** - Get the last notus error as string
+- **[notus](notus.md)** - Starts a notus scan with given data
+- **[safe_checks](safe_checks.md)** - takes no argument and returns the boolean value of the “safe checks” option.
 - **[script_get_preference_file_content](script_get_preference_file_content.md)** - get the file contents of a plugins preference that is of type "file"
 - **[script_get_preference_file_location](script_get_preference_file_location.md)** - get the location of a plugin preference of type "file"
 - **[script_get_preference](script_get_preference.md)** - get the value of a plugin preference
+- **[update_table_driven_lsc_data](update_table_driven_lsc_data.md)** - Set information, so that openvas can start a table driven lsc
 - **[vendor_version](vendor_version.md)** - get vendor version
diff --git a/doc/manual/nasl/built-in-functions/host-functions/index.md b/doc/manual/nasl/built-in-functions/host-functions/index.md
@@ -7,6 +7,7 @@ Host functions are used to get, resolve, compare and add hosts to the vhosts lis
 ## TABLE OF CONTENT
 
 - **[add_host_name](add_host_name.md)** - add a host name to the vhost list
+- **[get_host_name](get_host_name.md)** - get the currently scanned host
 - **[get_host_names](get_host_names.md)** - get a list with found hostnames
 - **[get_host_name_source](get_host_name_source.md)** - get the hostname source
 - **[resolve_host_name](resolve_host_name.md)** - get an IP address corresponding to the host name
diff --git a/doc/manual/nasl/built-in-functions/krb5/index.md b/doc/manual/nasl/built-in-functions/krb5/index.md
@@ -0,0 +1,18 @@
+# Krb5 functions
+
+## General
+
+Functions related to krb5 (Kerberos).
+
+## Table of contents
+
+- **[krb5_error_code_to_string](krb5_error_code_to_string.md)** - Returns a string representation of either the given code or the cached code.
+- **[krb5_find_kdc](krb5_find_kdc.md)** - Find the KDC for a given realm.
+- **[krb5_gss_init](krb5_gss_init.md)** - initialize the krb5 GSS-API library.
+- **[krb5_gss_prepare_context](krb5_gss_prepare_context.md)** - Creates the initial ticket request for the krb5 GSS-API library and prepares the context for further use.
+- **[krb5_gss_session_key](krb5_gss_session_key.md)** - Returns the session key or NULL if none was found.
+- **[krb5_gss_update_context](krb5_gss_update_context.md)** - Updates the context with the provided data and caches the output for the application.
+- **[krb5_gss_update_context_needs_more](krb5_gss_update_context_needs_more.md)** - Returns true when the previous `krb5_gss_update_context` requires further information/calls.
+- **[krb5_gss_update_context_out](krb5_gss_update_context_out.md)** - Returns the data for the application to send to the service.
+- **[krb5_is_failure](krb5_is_failure.md)** - Returns 1 if the last stored krb5 or given result code is a failure, 0 otherwise.
+- **[krb5_is_success](krb5_is_success.md)** - Returns 1 if the last stored krb5 or given result code is a success, 0 otherwise.
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_error_code_to_string.md b/doc/manual/nasl/built-in-functions/krb5/krb5_error_code_to_string.md
@@ -8,14 +8,12 @@
 
 *str* **krb5_error_code_to_string**(int);
 
-
 ## DESCRIPTION
 
 Returns a string representation of either the given code or the cached code.
 
 The cached code reflects the error code of the last krb5 function call.
 
-
 ## RETURN VALUE
 
 Returns a human readable version of the result code.
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_find_kdc.md b/doc/manual/nasl/built-in-functions/krb5/krb5_find_kdc.md
@@ -2,7 +2,7 @@
 
 ## NAME
 
-**krb5_find_kdc** - Find the KDC for a given realm 
+**krb5_find_kdc** - Find the KDC for a given realm.
 
 ## SYNOPSIS
 
@@ -14,7 +14,6 @@
 
 This function opens the krb5.conf file (located either by environment variable KRB5_CONFIG or /etc/ktrb5.conf) and looks for an kdc entry for the given realm.
 
-
 ## RETURN VALUE
 
 The found KDC or *NULL* if the KDC could not be found.
@@ -29,5 +28,3 @@ Returns *NULL* if the realm is not found or the krb5.conf file could not be open
 kdc = insstr(realm: 'EXAMPLE.COM');
 display(kdc);
 ```
-
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_init.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_init.md
@@ -2,7 +2,7 @@
 
 ## NAME
 
-**krb5_gss_init** - initialize the krb5 GSS-API library
+**krb5_gss_init** - initialize the krb5 GSS-API library.
 
 ## SYNOPSIS
 
@@ -20,7 +20,6 @@ When there is an already initialized context it will be destroyed and a new one
 
 Returns 0 on success otherwise it is an failure.
 
-
 ## EXAMPLES
 
 ```c#
@@ -29,5 +28,3 @@ if (krb5_is_failure(result)) {
 	exit(42);
 }
 ```
-
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_prepare_context.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_prepare_context.md
@@ -23,12 +23,10 @@ When krb5_gss_prepare_context is called it creates the initial ticket request fo
 
 It can be used directly without calling krb5_gss_init first.
 
-
 ## RETURN VALUE
 
 Returns 0 on success otherwise it is an failure.
 
-
 ## EXAMPLES
 
 ```c#
@@ -43,4 +41,3 @@ if (krb5_is_failure(result)) {
 	exit(42);
 }
 ```
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_session_key.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_session_key.md
@@ -8,12 +8,10 @@
 
 *str* **krb5_gss_update_context_session_key**();
 
-
 ## DESCRIPTION
 
 Returns the session key found within the context when the last `krb5_gss_update_context` was called. If no session key was found, NULL is returned.
 
-
 ## RETURN VALUE
 
 Returns the session key or NULL if none was found.
@@ -38,4 +36,3 @@ if (krb5_update_context_needs_more()) {
    session_key = krb5_gss_session_key();
 }
 ```
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context.md
@@ -25,7 +25,6 @@ To verify if the process requires further step the caller must call `krb5_gss_up
 
 Returns 0 on success otherwise it is an failure.
 
-
 ## EXAMPLES
 
 ```nasl
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_needs_more.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_needs_more.md
@@ -16,7 +16,6 @@ This method is used to verify if the previous `krb5_gss_update_context` requires
 
 ## RETURN VALUE
 
-
 Returns 1 if the previous `krb5_gss_update_context` requires further information/calls, 0 otherwise.
 
 ## EXAMPLES
@@ -40,4 +39,3 @@ if (krb5_gss_update_context_needs_more()) {
 	exit(0);	
 }
 ```
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_out.md b/doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_out.md
@@ -8,7 +8,6 @@
 
 *str* **krb5_gss_update_context_out**();
 
-
 ## DESCRIPTION
 
 This function is used to get the data that the application should send to the service.
@@ -43,4 +42,3 @@ if ((out = krb5_gss_update_context_out())) {
 	send(socket:soc, data:out);
 }
 ```
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_is_failure.md b/doc/manual/nasl/built-in-functions/krb5/krb5_is_failure.md
@@ -16,17 +16,13 @@ Checks if given result code or cached result code is a failure. If no result cod
 
 The cached result code reflects the error code of the last krb5 function call.
 
-
 ## RETURN VALUE
 
 Returns 1 if the result code is a failure, 0 otherwise.
 
-
 ## EXAMPLES
 
 ```c#
 failure = krb5_is_failure();
 display(failure);
 ```
-
-
diff --git a/doc/manual/nasl/built-in-functions/krb5/krb5_is_success.md b/doc/manual/nasl/built-in-functions/krb5/krb5_is_success.md
@@ -16,17 +16,13 @@ Checks if given result code or cached result code is a success. If no result cod
 
 The cached result code reflects the error code of the last krb5 function call.
 
-
 ## RETURN VALUE
 
 Returns 1 if the result code is a success, 0 otherwise.
 
-
 ## EXAMPLES
 
 ```c#
 success = krb5_is_success();
 display(success);
 ```
-
-
diff --git a/doc/manual/nasl/built-in-functions/misc/index.md b/doc/manual/nasl/built-in-functions/misc/index.md
@@ -21,9 +21,7 @@ Here you can find general purpose functions.
 - **[make_list](make_list.md)** - takes any number of unnamed arguments and returns an array made from them.
 - **[max_index](max_index.md)** - returns the length of an array.
 - **[mktime](mktime.md)** - takes seven named arguments sec, min, hour, mday, mon, year, isdst and returns the Unix time.
-- **[open_sock_kdc](open_sock_kdc.md)** - open a kdc socket
 - **[rand](rand.md)** - returns a pseudo random number.
-- **[safe_checks](safe_checks.md)** - takes no argument and returns the boolean value of the “safe checks” option.
 - **[sleep](sleep.md)** - takes an integer and sleeps the amount of seconds
 - **[sort](sort.md)** - sorts the value of a dict/array. WARNING: drops the keys of a dict and returns an array.
 - **[typeof](typeof.md)** - returns the type of given unnamed argument.
diff --git a/doc/manual/nasl/built-in-functions/network-functions/index.md b/doc/manual/nasl/built-in-functions/network-functions/index.md
@@ -11,7 +11,6 @@ In case of error, all those functions returns a value that can be interpreted as
 - **[ftp_get_pasv_port](ftp_get_pasv_port.md)** - sends the “PASV” command on the open socket, parses the returned data and returns the chosen “passive” port
 - **[ftp_log_in](ftp_log_in.md)** - performs a FTP identification / authentication on an open socket
 - **[get_host_ip](get_host_ip.md)** - get the IP of the currently scanned host
-- **[get_host_name](get_host_name.md)** - get_host_names the given socket
 - **[get_host_open_port](get_host_open_port.md)** - get an open TCP port on the target host
 - **[get_mtu](get_mtu.md)** - get the maximum transition unit for the scanned host
 - **[get_port_state](get_port_state.md)** - get a port state
@@ -25,6 +24,7 @@ In case of error, all those functions returns a value that can be interpreted as
 - **[leave_multicast_group](leave_multicast_group.md)** - leaves a multicast group.
 - **[open_priv_sock_tcp](open_priv_sock_tcp.md)** - opens a “privileged” TCP socket to the target host.
 - **[open_priv_sock_udp](open_priv_sock_udp.md)** - opens a “privileged” UDP socket to the target host.
+- **[open_sock_kdc](open_sock_kdc.md)** - open a kdc socket
 - **[open_sock_tcp](open_sock_tcp.md)** - opens a TCP socket to the target host.
 - **[open_sock_udp](open_sock_udp.md)** - opens a UDP socket to the target host.
 - **[recv_line](recv_line.md)** - receives data from a TCP or UDP socket.
diff --git a/doc/manual/nasl/built-in-functions/report-functions/index.md b/doc/manual/nasl/built-in-functions/report-functions/index.md
@@ -10,3 +10,4 @@ Those functions are used for reporting (send data back to daemon).
 - **[log_message](log_message.md)** - Reports a miscellaneous information.
 - **[scanner_status](scanner_status.md)** - this function currently does nothing, kept for backwards compatibility
 - **[security_message](security_message.md)** - Reports a severe flaw.
+- **[security_notus](security_notus.md)** - Reports a severe flaw based on a notus result.
diff --git a/doc/manual/nasl/built-in-functions/report-functions/security_notus.md b/doc/manual/nasl/built-in-functions/report-functions/security_notus.md
@@ -1,4 +1,4 @@
-# security_lsc
+# security_notus
 
 ## NAME
 
@@ -8,7 +8,7 @@
 
 *void* **security_notus**(result: *json*);
 
-**security_notus** The security_lsc take following arguments:
+**security_notus** The security_notus take following arguments:
 - *result* This is a notus result given as a json like structure. The structure should have the following format:
 ```json
 {
diff --git a/doc/manual/nasl/built-in-functions/ssh-functions/index.md b/doc/manual/nasl/built-in-functions/ssh-functions/index.md
@@ -7,7 +7,7 @@ Used for SSH connections and interactions
 ## TABLE OF CONTENT
 
 - **[sftp_enabled_check](sftp_enabled_check.md)** - checks if SFTP is enabled on the target system
-- **[ssh_connect](ssh_connect.md)** - connect ot the target via TCP and setup an SSH connection
+- **[ssh_connect](ssh_connect.md)** - connect to the target via TCP and setup an SSH connection
 - **[ssh_disconnect](ssh_disconnect.md)** - disconnect an open SSH connection
 - **[ssh_get_auth_methods](ssh_get_auth_methods.md)** - get list of supported authentication schemes
 - **[ssh_get_host_key](ssh_get_host_key.md)** - get the host key
diff --git a/doc/manual/nasl/built-in-functions/ssh-functions/ssh_connect.md b/doc/manual/nasl/built-in-functions/ssh-functions/ssh_connect.md
@@ -2,7 +2,7 @@
 
 ## NAME
 
-**ssh_connect** - connect ot the target via TCP and setup an SSH connection
+**ssh_connect** - connect to the target via TCP and setup an SSH connection
 
 ## SYNOPSIS
 
@@ -55,4 +55,4 @@ No space left in SSH session table, internal error
 
 ## SEE ALSO
 
-**[ssh_disconnect(3)](ssh_disconnect.md)**
+**[ssh_disconnect(3)](ssh_disconnect.md)**
diff --git a/doc/manual/nasl/built-in-functions/wmi-functions/index.md b/doc/manual/nasl/built-in-functions/wmi-functions/index.md
@@ -8,7 +8,9 @@ The API offers three groups of functions:
 2. WMI_RSOP_FUNCTIONS (RSoP = Resultant Set of Policy): run RSoP queries
 3. WMI_REGISTRY_FUNCTIONS: read and write values from/to the registry
 
-In order to be able to use the WMI functions, **[openvas-smb](https://github.com/greenbone/openvas-smb)** has to be installed before.
+These functions are only available when
+**[openvas-smb](https://github.com/greenbone/openvas-smb)** is
+installed.
 
 ## TABLE OF CONTENT
 
diff --git a/rust/src/container_image_scanner/detection.rs b/rust/src/container_image_scanner/detection.rs
@@ -158,6 +158,23 @@ ID_LIKE=debian"#;
         assert_eq!(os.version_id, "24.04");
     }
 
+    #[tokio::test]
+    async fn test_eulerosv2() {
+        let content = r#"
+        Name="EulerOS"
+        VERSION="2.0 (SP12)"
+        ID="euleros"
+        VERSION_ID="2.0"
+        PRETTY_NAME="EulerOS 2.0 (SP12)"
+        ANSI_COLOR="0;31"
+        "#;
+        let detector = OperatingSystemDetector::from(content);
+        let os = detector.detect_operating_system().await.unwrap();
+        assert_eq!(os.name, "euleros");
+        assert_eq!(os.version_id, "2.0");
+        assert_eq!(os.version, "2.0 (SP12)");
+    }
+
     #[tokio::test]
     async fn test_os_detection_debian() {
         let content = r#"PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
diff --git a/rust/src/container_image_scanner/notus/mod.rs b/rust/src/container_image_scanner/notus/mod.rs
@@ -25,7 +25,9 @@ fn generate_key(architecture: &str, os: &OperatingSystem) -> String {
     let nos = os.name.to_lowercase();
 
     match (architecture, &nos as &str) {
-        (_, "openeuler") => format!("openeuler_{}", normalize_euler_version()),
+        // TODO: figure out if there is some kind of rule behind the _sp versioning scheme or if
+        // that is really per OS.
+        (_, "openeuler") | (_, "euleros") => format!("{}_{}", &nos, normalize_euler_version()),
         (_, name) => format!("{}_{}", name, os.version_id),
     }
 }
@@ -134,6 +136,18 @@ mod key_generation_tests {
         let result = super::generate_key("", &os);
         assert_eq!("openeuler_24.03_lts_sp1".to_owned(), result);
     }
+
+    #[test]
+    fn euleros() {
+        let os = OperatingSystem {
+            name: "euleros".to_owned(),
+            version: "2.0 (SP12)".to_owned(),
+            version_id: "2.0".to_owned(),
+        };
+
+        let result = super::generate_key("", &os);
+        assert_eq!("euleros_2.0_sp12".to_owned(), result);
+    }
 }
 
 #[cfg(test)]
diff --git a/rust/src/nasl/builtin/cryptographic/mod.rs b/rust/src/nasl/builtin/cryptographic/mod.rs
diff --git a/rust/src/openvasd/crypt.rs b/rust/src/openvasd/crypt.rs
diff --git a/rust/src/openvasd/scans/mod.rs b/rust/src/openvasd/scans/mod.rs
