Hi,
while playing around with SLAD we uncovered that
Nessus and thus OpenVAS is broken in regard to
updated .inc files.
Updated .inc files are apparently not considered
when the respective .desc files have been created
for the NASL files that include the .inc file.
In the special case of SLAD, the file "slad.inc" is
part of the Feed or openvas-plugins. It is created
during a SLAD installation and then copied to the
the directory with the other SLAD NASL scripts,
especially slad_run.nasl which includes slad.inc.
Funny enough, the compilation of slad_run.nasl
naturally fails but a 'valid' .desc entry is created.
And a newly installed slad.inc will not get slad_run.nasl
to work except when you manually remove the .desc entry.
This shows the broken error handling because although
internally a error is detected about a missing .inc, it is not
reacted upon.
After all I am in doubt that the .desc stuff is a clever concept
at all. So far I discovered more problems than benefits. Is there
any benefit at all?
However, the small cure could be one of the following
* Don't create a .desc entry when compilation reports errors
(does only help for the specific case of SLAD, not for updated .inc's)
* libopenvas/store.c (store_load_plugin): do the mtime check
for included files as well.
Any suggestions or preferences how to proceed on this?
Best
Jan
--
Dr. Jan-Oliver Wagner Intevation GmbH, Osnabrück
Amtsgericht Osnabrück, HR B 18998 http://www.intevation.de/
Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
_______________________________________________
Openvas-devel mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-devel
