-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(#3420): add test to check vulnerable packages with triaged null
- Loading branch information
1 parent
fdbf43e
commit 7fabec9
Showing
7 changed files
with
309 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
81 changes: 81 additions & 0 deletions
81
..._results/data/configuration_template/configuration_scan_vulnerabilities_triaged_null.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| - sections: | ||
| - section: vulnerability-detector | ||
| elements: | ||
| - enabled: | ||
| value: 'yes' | ||
| - run_on_start: | ||
| value: 'yes' | ||
| - interval: | ||
| value: SCAN_INTERVAL | ||
| - provider: | ||
| attributes: | ||
| - name: redhat | ||
| elements: | ||
| - enabled: | ||
| value: 'yes' | ||
| - os: | ||
| attributes: | ||
| - path: CUSTOM_REDHAT_OVAL_FEED | ||
| value: OS | ||
| - path: | ||
| value: CUSTOM_REDHAT_JSON_FEED | ||
| - provider: | ||
| attributes: | ||
| - name: canonical | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
| - provider: | ||
| attributes: | ||
| - name: debian | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
| - provider: | ||
| attributes: | ||
| - name: msu | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
| - provider: | ||
| attributes: | ||
| - name: alas | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
| - provider: | ||
| attributes: | ||
| - name: arch | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
| - provider: | ||
| attributes: | ||
| - name: nvd | ||
| elements: | ||
| - enabled: | ||
| value: 'yes' | ||
| - path: | ||
| value: CUSTOM_NVD_JSON_FEED | ||
|
|
||
| - section: sca | ||
| elements: | ||
| - enabled: | ||
| value: 'no' | ||
|
|
||
| - section: rootcheck | ||
| elements: | ||
| - disabled: | ||
| value: 'no' | ||
|
|
||
| - section: syscheck | ||
| elements: | ||
| - disabled: | ||
| value: 'no' | ||
|
|
||
| - section: wodle | ||
| attributes: | ||
| - name: syscollector | ||
| elements: | ||
| - disabled: | ||
| value: 'yes' |
8 changes: 8 additions & 0 deletions
8
...y_detector/test_scan_results/data/test_cases/cases_scan_vulnerabilities_triaged_null.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| - name: RHEL | ||
| description: Check that after partial scan is launched triaged status changes from NULL to 1 | ||
| configuration_parameters: | ||
| OS: '8' | ||
| SCAN_INTERVAL: '5' | ||
| metadata: | ||
| system: RHEL8 | ||
| triaged: '' |
177 changes: 177 additions & 0 deletions
177
...n/test_vulnerability_detector/test_scan_results/test_scan_vulnerabilities_triaged_null.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,177 @@ | ||
| ''' | ||
| copyright: Copyright (C) 2015-2021, Wazuh Inc. | ||
| Created by Wazuh, Inc. <[email protected]>. | ||
| This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 | ||
| type: integration | ||
| brief: Wazuh is able to detect vulnerabilities in the applications installed in agents using the Vulnerability Detector | ||
| module. This software audit is performed through the integration of vulnerability feeds indexed by Redhat, | ||
| Canonical, Debian, Amazon Linux and NVD Database. | ||
| components: | ||
| - vulnerability_detector | ||
| suite: scan_results | ||
| targets: | ||
| - manager | ||
| daemons: | ||
| - wazuh-modulesd | ||
| - wazuh-db | ||
| - wazuh-analysisd | ||
| os_platform: | ||
| - linux | ||
| os_version: | ||
| - Arch Linux | ||
| - Amazon Linux 2 | ||
| - Amazon Linux 1 | ||
| - CentOS 8 | ||
| - CentOS 7 | ||
| - Debian Buster | ||
| - Red Hat 8 | ||
| - Ubuntu Focal | ||
| - Ubuntu Bionic | ||
| - SUSE Enterprise Desktop 11 | ||
| - SUSE Enterprise Desktop 12 | ||
| - SUSE Enterprise Desktop 15 | ||
| - SUSE Enterprise Server 11 | ||
| - SUSE Enterprise Server 12 | ||
| - SUSE Enterprise Server 15 | ||
| references: | ||
| - https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html | ||
| tags: | ||
| - vulnerability | ||
| - vulnerability_detector | ||
| - scan_results | ||
| ''' | ||
| import os | ||
| import pytest | ||
|
|
||
| from wazuh_testing.tools.configuration import load_configuration_template, get_test_cases_data | ||
| from wazuh_testing.tools.configuration import update_configuration_template | ||
| from wazuh_testing.db_interface import agent_db | ||
| from wazuh_testing.modules.vulnerability_detector import event_monitor as evm | ||
| from wazuh_testing.modules import vulnerability_detector as vd | ||
|
|
||
| pytestmark = [pytest.mark.server] | ||
|
|
||
| # Reference paths | ||
| TEST_DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data') | ||
| CONFIGURATIONS_PATH = os.path.join(TEST_DATA_PATH, 'configuration_template') | ||
| TEST_CASES_PATH = os.path.join(TEST_DATA_PATH, 'test_cases') | ||
| TEST_FEEDS_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), '..', 'data', 'feeds') | ||
| TEST_PACKAGES_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), '..', 'data', 'vulnerable_packages') | ||
|
|
||
| # Configuration and cases data | ||
| configurations_path = os.path.join(CONFIGURATIONS_PATH, 'configuration_scan_vulnerabilities_triaged_null.yaml') | ||
| t1_cases_path = os.path.join(TEST_CASES_PATH, 'cases_scan_vulnerabilities_triaged_null.yaml') | ||
|
|
||
| # Custom paths | ||
| custom_nvd_json_feed_path = os.path.join(TEST_FEEDS_PATH, 'nvd', vd.CUSTOM_NVD_FEED) | ||
| custom_redhat_oval_feed_path = os.path.join(TEST_FEEDS_PATH, 'redhat', vd.CUSTOM_REDHAT_OVAL_FEED) | ||
| custom_redhat_json_feed_path = os.path.join(TEST_FEEDS_PATH, 'redhat', vd.CUSTOM_REDHAT_JSON_FEED) | ||
|
|
||
| # Scan vulnerabilities with null triaged triaged field configurations (t1) | ||
| t1_configuration_parameters, t1_configuration_metadata, t1_case_ids = get_test_cases_data(t1_cases_path) | ||
| t1_configurations = load_configuration_template(configurations_path, t1_configuration_parameters, | ||
| t1_configuration_metadata) | ||
| t1_systems = [metadata['system'] for metadata in t1_configuration_metadata] | ||
|
|
||
| # Set offline custom feeds configuration | ||
| t1_configurations = update_configuration_template( | ||
| t1_configurations, ['CUSTOM_REDHAT_OVAL_FEED', 'CUSTOM_REDHAT_JSON_FEED', 'CUSTOM_NVD_JSON_FEED'], | ||
| [custom_redhat_oval_feed_path, custom_redhat_json_feed_path, custom_nvd_json_feed_path]) | ||
|
|
||
|
|
||
| @pytest.mark.tier(level=1) | ||
| @pytest.mark.parametrize('configuration, metadata, agent_system', | ||
| zip(t1_configurations, t1_configuration_metadata, t1_systems), ids=t1_case_ids) | ||
| def test_scan_triaged_null_vulnerabilities(configuration, metadata, agent_system, set_wazuh_configuration_vdt, | ||
| truncate_monitored_files, clean_cve_tables_func, prepare_full_scan, | ||
| restart_modulesd_function): | ||
| ''' | ||
| description: Check if a vulnerable package with triaged NULL, is detected with the partial scan. | ||
| test_phases: | ||
| - setup: | ||
| - Set a custom Wazuh configuration. | ||
| - Mock an agent. | ||
| - Clean CVE table. | ||
| - Force a full scan. | ||
| - Restart wazuh-modulesd. | ||
| - test: | ||
| - Insert a vulnerable package with triaged NULL. | ||
| - Check that after partial scan triaged changes to 1. | ||
| - teardown: | ||
| - Restart initial wazuh configuration. | ||
| - Clean CVE table. | ||
| wazuh_min_version: 4.4.0 | ||
| tier: 1 | ||
| parameters: | ||
| - configuration: | ||
| type: dict | ||
| brief: Configuration loaded from `configuration_template`. | ||
| - metadata: | ||
| type: dict | ||
| brief: Test case metadata. | ||
| - agent_system: | ||
| type: str | ||
| brief: System to set to the mocked agent. | ||
| - set_wazuh_configuration_vdt: | ||
| type: fixture | ||
| brief: Set wazuh configuration. | ||
| - truncate_monitored_files: | ||
| type: fixture | ||
| brief: Truncate all the log files and json alerts files before and after the test execution. | ||
| - clean_cve_tables_func: | ||
| type: fixture | ||
| brief: Clean all CVE tables. | ||
| - prepare_full_scan: | ||
| type: fixture | ||
| brief: Setup the initial test state. | ||
| - restart_modulesd_function: | ||
| type: fixture | ||
| brief: Restart wazuh-modulesd daemon before starting a test, and stop it after finishing. | ||
| assertions: | ||
| - Verify that the log a partial scan will be run on agent appears in ossec.log. | ||
| - Verify that the triaged field of sys_programs table has changed to 1. | ||
| input_description: | ||
| - The `configuration_scan_vulnerabilities_triaged_null.yaml` file provides the module configuration for this | ||
| test. | ||
| - The `cases_scan_vulnerabilities_triaged_null.yaml` file provides the test cases. | ||
| expected_output: | ||
| - f"A partial scan will be run on agent '{agent_id}'" | ||
| ''' | ||
| agent_id = prepare_full_scan | ||
| package_name = vd.VULNERABLE_PACKAGES[1]['name'] | ||
|
|
||
| # Insert mocked vulnerables packages. | ||
| agent_db.insert_package(name=package_name, version=vd.VULNERABLE_PACKAGES[1]['version'], | ||
| source=vd.VULNERABLE_PACKAGES[1]['name'], agent_id=agent_id, | ||
| vendor='Red Hat, Inc.', triaged=metadata['triaged']) | ||
|
|
||
| assert agent_db.get_triaged_value_from_inventory(package_name, agent_id=agent_id) == metadata['triaged'], \ | ||
| 'The triaged value of sys_programs table should be '' before the partial scan' | ||
|
|
||
| # Update packages sync status. | ||
| agent_db.update_sync_info(agent_id=agent_id, component="syscollector-packages") | ||
|
|
||
| # Check for the next partial scan | ||
| evm.check_partial_scan_start_log(agent_id=agent_id, timeout=vd.T_15) | ||
|
|
||
| assert agent_db.get_triaged_value_from_inventory(package_name, agent_id=agent_id) == 1, \ | ||
| 'The triaged value of sys_programs table should be 1 after a partial scan of a vulnerable package.' |