From 423557d80c075b099d151bd6bcb3adf7b3deacf2 Mon Sep 17 00:00:00 2001 From: Juan Jose Nicola Date: Thu, 18 Oct 2018 09:33:03 -0400 Subject: [PATCH 1/2] Improve the vt selection element in . Rename element in start_scan from vts to vt_selection. Rename vt to vt_single. Rename vt_param to vt_value. Remove the type attribute. Update documentation. --- doc/OSP.xml | 49 ++++++++++++++++++++------------------------ ospd/ospd.py | 57 ++++++++++++++++++++++++++-------------------------- 2 files changed, 51 insertions(+), 55 deletions(-) diff --git a/doc/OSP.xml b/doc/OSP.xml index ba4e0e90..88064c89 100644 --- a/doc/OSP.xml +++ b/doc/OSP.xml @@ -196,14 +196,14 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. - vts + vt_selection Contanins elements that represent Vulnerability Test or a collection of Vulnerability Test to be excecute and their parameters. - vt - vtgroup + vt_single + vt_group - vt + vt_single Elements that represent Vulnerability Test. @@ -212,19 +212,14 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. vt_id 1 - vt_param + vt_value - vt_param + vt_value Vulnerability Test parameter. - name - string - 1 - - - type + id string 1 @@ -233,7 +228,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. - vtgroup + vt_group Collection of Vulnerability Test @@ -246,16 +241,16 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. VT with parameters and VT group - - - 200 - yes - - - - - - + + + 200 + yes + + + + + + @@ -854,7 +849,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. integer scanner_params - vts + vt_selection targets @@ -862,7 +857,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. Contains elements that represent scanner specific parameters - vts + vt_selection Contanins elements that represent Vulnerability Test or a collection of Vulnerability Test to be excecute and their parameters @@ -912,9 +907,9 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ... - + .... - + ... diff --git a/ospd/ospd.py b/ospd/ospd.py index aa514e07..2e695617 100644 --- a/ospd/ospd.py +++ b/ospd/ospd.py @@ -398,44 +398,43 @@ def process_vts_params(self, scanner_vts): id attribute. Optinal parameters can be included as vt child. Example form: - - - - value - - - - + + + + value + + + + @return: Dictionary containing the vts attribute and subelements, like the VT's id and VT's parameters. Example form: - {'v1', - 'vt2': {param1: {'type': type', 'value': value}}, - 'vtgroups': ['family = debian', 'family = general']} + {'vt1': {}, + 'vt2': {'value_id': 'value'}, + 'vt_groups': ['family=debian', 'family=general']} """ - vts = {} + vt_selection = {} filters = list() for vt in scanner_vts: - if vt.tag == 'vt': + if vt.tag == 'vt_single': vt_id = vt.attrib.get('id') - vts[vt_id] = {} - for param in vt: - if not param.attrib.get('name'): - raise OSPDError('Invalid VT parameter. No parameter name', + vt_selection[vt_id] = {} + for vt_value in vt: + if not vt_value.attrib.get('id'): + raise OSPDError('Invalid VT preference. No attribute id', 'start_scan') - ptype = param.attrib.get('type', 'entry') - pvalue = param.text if param.text else '' - pname = param.attrib.get('name') - vts[vt_id][pname] = {'type': ptype, 'value': pvalue} - if vt.tag == 'vtgroup': + vt_value_id = vt_value.attrib.get('id') + vt_value_value = vt_value.text if vt_value.text else '' + vt_selection[vt_id][vt_value_id] = vt_value_value + if vt.tag == 'vt_group': vts_filter = vt.attrib.get('filter', None) if vts_filter is None: raise OSPDError('Invalid VT group. No filter given.', 'start_scan') filters.append(vts_filter) - vts['vtgroups'] = filters - return vts + vt_selection['vt_groups'] = filters + return vt_selection @staticmethod def process_credentials_elements(cred_tree): @@ -580,13 +579,13 @@ def handle_start_scan_command(self, scan_et): params = self._preprocess_scan_params(scanner_params) # VTS is an optional element. If present should not be empty. - vts = {} - scanner_vts = scan_et.find('vts') + vt_selection = {} + scanner_vts = scan_et.find('vt_selection') if scanner_vts is not None: if not scanner_vts: raise OSPDError('VTs list is empty', 'start_scan') else: - vts = self.process_vts_params(scanner_vts) + vt_selection = self.process_vts_params(scanner_vts) # Dry run case. if 'dry_run' in params and int(params['dry_run']): @@ -596,7 +595,9 @@ def handle_start_scan_command(self, scan_et): scan_func = self.start_scan scan_params = self.process_scan_params(params) - scan_id = self.create_scan(scan_id, scan_targets, target_str, scan_params, vts) + scan_id = self.create_scan(scan_id, scan_targets, + target_str, scan_params, + vt_selection) scan_process = multiprocessing.Process(target=scan_func, args=(scan_id, scan_targets, From 86197b9fad00cf20c1fae255764f7f6b10b8e3d1 Mon Sep 17 00:00:00 2001 From: Juan Jose Nicola Date: Fri, 19 Oct 2018 07:31:45 -0400 Subject: [PATCH 2/2] Fix unit tests for vt_selection changes. --- tests/testScanAndResult.py | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/tests/testScanAndResult.py b/tests/testScanAndResult.py index ede1b842..65a5b7d2 100644 --- a/tests/testScanAndResult.py +++ b/tests/testScanAndResult.py @@ -252,7 +252,7 @@ def testScanWithVTs(self): daemon = DummyWrapper([]) cmd = secET.fromstring('' + - '') + '') print(ET.tostring(cmd)) self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) @@ -260,12 +260,12 @@ def testScanWithVTs(self): response = secET.fromstring( daemon.handle_command('' + - '' + - '')) + '' + + '')) print(ET.tostring(response)) scan_id = response.findtext('id') time.sleep(0.01) - self.assertEqual(daemon.get_scan_vts(scan_id), {'1.2.3.4': {}, 'vtgroups': []}) + self.assertEqual(daemon.get_scan_vts(scan_id), {'1.2.3.4': {}, 'vt_groups': []}) self.assertNotEqual(daemon.get_scan_vts(scan_id), {'1.2.3.6': {}}) # With out VTS @@ -281,12 +281,12 @@ def testScanWithVTs(self): def testScanWithVTs_and_param(self): daemon = DummyWrapper([]) - # Raise because no vt_param name attribute + # Raise because no vt_param id attribute cmd = secET.fromstring('' + - '' + - '200' + - '') + '' + + '200' + + '') print(ET.tostring(cmd)) self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) @@ -294,21 +294,21 @@ def testScanWithVTs_and_param(self): response = secET.fromstring( daemon.handle_command('' + - '' + - '200' + - '')) + '' + + '200' + + '')) print(ET.tostring(response)) scan_id = response.findtext('id') time.sleep(0.01) self.assertEqual(daemon.get_scan_vts(scan_id), - {'1234': {'ABC': {'type': 'entry', 'value': '200'}}, 'vtgroups': []}) + {'1234': {'ABC': '200'}, 'vt_groups': []}) # Raise because no vtgroup filter attribute cmd = secET.fromstring('' + - '' + - '') + '' + + '') print(ET.tostring(cmd)) self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) @@ -316,14 +316,14 @@ def testScanWithVTs_and_param(self): response = secET.fromstring( daemon.handle_command('' + - '' + - '' + - '')) + '' + + '' + + '')) print(ET.tostring(response)) scan_id = response.findtext('id') time.sleep(0.01) self.assertEqual(daemon.get_scan_vts(scan_id), - {'vtgroups': ['a']}) + {'vt_groups': ['a']}) def testBillonLaughs(self):