1
|
|
|
import pytest |
2
|
|
|
from lxml import etree |
3
|
|
|
|
4
|
|
|
from openscap_report.scap_results_parser import SCAPResultsParser |
5
|
|
|
from openscap_report.scap_results_parser.parsers import FullTextParser |
6
|
|
|
|
7
|
|
|
from ..constants import (PATH_TO_ARF, |
8
|
|
|
PATH_TO_ARF_REPRODUCING_DANGLING_REFERENCE_TO) |
9
|
|
|
|
10
|
|
|
REF_VALUES = { |
11
|
|
|
"id-1234": "text1", |
12
|
|
|
"1234": 'echo "nwm"' |
13
|
|
|
} |
14
|
|
|
FULL_TEXT_PARSER = FullTextParser(REF_VALUES) |
15
|
|
|
|
16
|
|
|
|
17
|
|
|
@pytest.mark.unit_test |
18
|
|
|
@pytest.mark.parametrize("tag, return_data", [ |
19
|
|
|
(etree.Element("sub", idref="id-1234"), "text1"), |
20
|
|
|
(etree.Element("sub", idref="1234"), 'echo "nwm"'), |
21
|
|
|
( |
22
|
|
|
etree.Element("sub", idref="hello-ID"), |
23
|
|
|
"!!! Error !!! - Sub tag reference does not exist: hello-ID" |
24
|
|
|
), |
25
|
|
|
]) |
26
|
|
|
def test_replace_sub_tag(tag, return_data): |
27
|
|
|
assert FULL_TEXT_PARSER.replace_sub_tag(tag) == return_data |
28
|
|
|
|
29
|
|
|
|
30
|
|
|
def get_report(src): |
31
|
|
|
with open(src, "r") as report_file: |
|
|
|
|
32
|
|
|
return SCAPResultsParser(report_file.read().encode()).parse_report() |
33
|
|
|
|
34
|
|
|
|
35
|
|
|
BASIC_REPORT = get_report(PATH_TO_ARF) |
36
|
|
|
REPORT_REPRODUCING_DANGLING_REFERENCE_TO = get_report( |
37
|
|
|
PATH_TO_ARF_REPRODUCING_DANGLING_REFERENCE_TO |
38
|
|
|
) |
39
|
|
|
|
40
|
|
|
|
41
|
|
|
@pytest.mark.integration_test |
42
|
|
|
@pytest.mark.parametrize("report, rule_id, expected_data", [ |
43
|
|
|
( |
44
|
|
|
REPORT_REPRODUCING_DANGLING_REFERENCE_TO, |
45
|
|
|
"xccdf_org.ssgproject.content_rule_grub2_l1tf_argument", |
46
|
|
|
( |
47
|
|
|
"L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged\n" |
48
|
|
|
"speculative access to data which is available in the Level 1 Data Cache when\n" |
49
|
|
|
"the page table entry isn't present.\n\nSelect the appropriate mitigation by" |
50
|
|
|
" adding the argument\n" |
51
|
|
|
"<code>l1tf=!!! Error !!! - Sub tag reference does not exist: dangling reference to !" |
52
|
|
|
"</code> to the default\nGRUB 2 command line for the Linux operating system.\n" |
53
|
|
|
"Configure the default Grub2 kernel command line to contain " |
54
|
|
|
"l1tf=xccdf_value(var_l1tf_options) as follows:\n" |
55
|
|
|
"<pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) " |
56
|
|
|
"l1tf=xccdf_value(var_l1tf_options)"</pre>\n\nSince Linux Kernel 4.19 " |
57
|
|
|
"you can check the L1TF vulnerability state with the\n" |
58
|
|
|
"following command:\n<code>cat /sys/devices/system/cpu/vulnerabilities/l1tf</code>" |
59
|
|
|
) |
60
|
|
|
), |
61
|
|
|
( |
62
|
|
|
BASIC_REPORT, |
63
|
|
|
"xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias", |
64
|
|
|
( |
65
|
|
|
"Make sure that mails delivered to root user are forwarded to a monitored\n" |
66
|
|
|
"email address. Make sure that the address\[email protected] is" |
67
|
|
|
" a valid email address\nreachable from the system in question. Use the following" |
68
|
|
|
" command to\nconfigure the alias:\n<pre>$ sudo echo "root: " |
69
|
|
|
"[email protected]" >> /etc/aliases\n$ sudo newaliases</pre>" |
70
|
|
|
) |
71
|
|
|
), |
72
|
|
|
( |
73
|
|
|
REPORT_REPRODUCING_DANGLING_REFERENCE_TO, |
74
|
|
|
"xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias", |
75
|
|
|
( |
76
|
|
|
"Make sure that mails delivered to root user are forwarded to a monitored\n" |
77
|
|
|
"email address. Make sure that the address\[email protected] is" |
78
|
|
|
" a valid email address\nreachable from the system in question. Use the following" |
79
|
|
|
" command to\nconfigure the alias:\n<pre>$ sudo echo "root: " |
80
|
|
|
"[email protected]" >> /etc/aliases\n$ sudo newaliases</pre>" |
81
|
|
|
) |
82
|
|
|
), |
83
|
|
|
]) |
84
|
|
|
def test_parsing_of_text(report, rule_id, expected_data): |
85
|
|
|
print(repr(report.rules[rule_id].description)) |
86
|
|
|
assert report.rules[rule_id].description == expected_data |
87
|
|
|
|