fkie-cad / FACT_core

Firmware Analysis and Comparison Tool
https://fkie-cad.github.io/FACT_core
GNU General Public License v3.0
1.23k stars 224 forks source link

Support Search By Tags #665

Closed frakman1 closed 3 years ago

frakman1 commented 3 years ago

I've added several user tags to my firmware. I want to be able to quickly search by them.

For example complete,test, openwrt: image

But the Basic Search page does not have a field to search by these tags:

image

So I tried the Advanced search page. I don't really understand MongoDB Query langage or Yara but looking at the example, I thought I could do a simple:

{"tags": "complete"} as a query and have it return the firmware with those tags like I have in the screenshot. But nothing came up.:

image

image

1- What am I doing wrong in the search query? 2- Please implement a simple search-by-user-tag functionality in the Basic Search page.

jstucke commented 3 years ago

The tags have the following structure in the database:

    "tags" : {
        "tag text" : "tag color"
    },

Therefore, the query has to be a bit different:

{
  "tags.<tag_name>": {
    "$exists": true
  }
}

If you want to make more complex queries, if helps to take a look at the structure of the documents in the database. You could use e.g. "Robo 3T" or simply the mongodb CLI interface.

frakman1 commented 3 years ago

That worked, thanks. Would love to see it implemented under Basic Search page, but until then, I can use this.

frakman1 commented 3 years ago

On a related topic, are you able to connect to the docker's MongoDB using a graphical UI? I tried publishing port 27018 and using "Mongo Compass" on both the host and on a remote PC on the same network but I kept getting either connection refused or authentication errors. I confirmed that I could connect from within the docker container using the mongo CLI. I used the credentials in main.cfg and selected "admin" database for Authentication:

# Authentication
db_admin_user = fact_admin
db_admin_pw = 6fJEb5LkV2hRtWq0
db_readonly_user = fact_readonly
db_readonly_pw = RFaoFSr8b6BMSbzt

Using: mongodb://fact_admin:6fJEb5LkV2hRtWq0@192.168.86.145:27018/admin returns: connect ECONNREFUSED 192.168.86.145:27018

I confirmed that I can't even telnet that port from the host or remote PC (connection refused) meaning that the docker container wasn't really publishing that port.

On the other hand, I can connect/telnet to port 5000 (webUI) with no issue.

I publish both ports using -p 0.0.0.0:5000:5000 -p 0.0.0.0:27018:27018

The 0.0.0.0 was necessary otherwise I got binding errors.

I got similar results with adminer.

I have never used MogoDB (or MongoDB within docker) before so I might be missing some basic docker networking configuration.

jstucke commented 2 years ago

One important thing to note: in FACT mongoDB is by default configured to bind to localhost. When running it in a docker container, it is necessary to set this to 0.0.0.0 in mongo.conf to be able to reach it from outside the container. It is configured like this in the mongo config that comes with FACT docker but this config is only used when starting it with --config-path or manually mounting it in the container. An alternative could be to change it in the container:

frakman1 commented 2 years ago

I suspected the 127.0.0.1 vs 0.0.0.0 issue. I'll try that

frakman1 commented 2 years ago

That worked. Thank you so much!

Using MongoDB Compass, I can now view the database. It doesn't mean much to me yet but at least I can access it in case I need to change something manually one day.

image

image