Code quality analysis of OpenVAS modules with trends

The OpenVAS developer team is very much concerned with source code quality. This page summarizes analysis of the quality as a base for planning improvements strategies. Note, that simple counter heuristics are only one element of a quality strategy.

Applied tools:

• flawfinder 1.26 by David Wheeler.
• RATS 2.0:
  rats . | grep "High:" | wc -l
rats . | grep "Medium:" | wc -l
• gcc -Wall (gcc 4.1.2, Intel P4): $ make 2>&1 | grep "warning:" | wc -l

Furthermore, some information (e.g. code/comment ratio) can be found on the ohloh page of OpenVAS.

Note: You should make yourself familiar with the applied tools especially before interpreting the absolute numbers. The trends of the numbers give a first impression, but for deeper understanding you should read more about the applied methods as well.

openvas-libraries

openvas-libnasl

openvas-server

openvas-plugins

OpenVAS-Client

How the numbers have been assembled

The actual commands (currently except for RATS) to assemble all the numbers are collected in a shell script "code-analysis.sh" which you can find here.

For comparison: Nessus

This is the analysis of the latest Free Software release of Nessus (Server: 2.2.10, Client: 1.0.2).

Naturally, we do not have any such numbers for the proprietary successors.