Skip to content

Commit 1fe2754

Browse files
evgenyzevgenyz
authored
Merge pull request #1901 from dodys/dpkg-version-compare
oval_cmp_evr_string: Make epoch comparison less strict for dpkg
2 parents bd49a1f + 17d0697 commit 1fe2754

9 files changed

+260
-12
lines changed

‎src/OVAL/results/oval_cmp_evr_string.c

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -408,12 +408,10 @@ oval_result_t oval_debian_evr_string_cmp(const char *state, const char *sys, ova
408408
parseEVR(a_copy, &a_epoch, &a_version, &a_release);
409409
parseEVR(b_copy, &b_epoch, &b_version, &b_release);
410410

411-
if (!a_epoch || !b_epoch) {
412-
oscap_seterr(OSCAP_EFAMILY_OVAL, "Invalid epoch.");
413-
free(a_copy);
414-
free(b_copy);
415-
return OVAL_RESULT_ERROR;
416-
}
411+
if (!a_epoch)
412+
a_epoch = "0";
413+
if (!b_epoch)
414+
b_epoch = "0";
417415

418416
aux = strtol(a_epoch, NULL, 10);
419417
if (aux < INT_MIN || aux > INT_MAX) {
@@ -453,7 +451,7 @@ oval_result_t oval_debian_evr_string_cmp(const char *state, const char *sys, ova
453451
case OVAL_OPERATION_LESS_THAN_OR_EQUAL:
454452
return ((result <= 0) ? OVAL_RESULT_TRUE : OVAL_RESULT_FALSE);
455453
default:
456-
oscap_seterr(OSCAP_EFAMILY_OVAL, "Invalid type of operation in rpm version comparison: %d.", operation);
454+
oscap_seterr(OSCAP_EFAMILY_OVAL, "Invalid type of operation in dpkg version comparison: %d.", operation);
457455
}
458456

459457
return OVAL_RESULT_ERROR;

‎tests/API/OVAL/unittests/CMakeLists.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ add_oscap_test("test_cim_datetime.sh")
44
add_oscap_test("test_circular_extend_def.sh")
55
add_oscap_test("test_comment.sh")
66
add_oscap_test("test_count_function.sh")
7+
add_oscap_test("test_debian_evr_string_comparison.sh")
8+
add_oscap_test("test_debian_evr_string_missing_epoch.sh")
79
add_oscap_test("test_deprecated_def.sh")
810
add_oscap_test("test_directives.sh")
911
add_oscap_test("test_empty_filename.sh")

‎tests/API/OVAL/unittests/test_debian_evr_string_comparison.oval.xml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<oval_definitions
2+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
3+
xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
4+
xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
5+
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
6+
xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
7+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd">
8+
<generator>
9+
<oval:product_name>Canonical USN OVAL Generator</oval:product_name>
10+
<oval:product_version>1</oval:product_version>
11+
<oval:schema_version>5.11.1</oval:schema_version>
12+
<oval:timestamp>2022-12-19T14:35:51</oval:timestamp>
13+
</generator>
14+
<definitions>
15+
<definition id="oval:com.ubuntu.jammy:def:54471000000" version="1" class="patch">
16+
<metadata>
17+
<title>logrotate vulnerability</title>
18+
<description>none</description>
19+
</metadata>
20+
<criteria operator="OR">
21+
<criterion test_ref="oval:com.ubuntu.jammy:tst:544710000000" comment="logrotate is earlier than 0:3.18.0-2ubuntu1.1" />
22+
</criteria>
23+
</definition>
24+
</definitions>
25+
<tests>
26+
<linux:dpkginfo_test id="oval:com.ubuntu.jammy:tst:544710000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="logrotate is earlier than 0:3.18.0-2ubuntu1.1">
27+
<linux:object object_ref="oval:com.ubuntu.jammy:obj:544710000000"/>
28+
<linux:state state_ref="oval:com.ubuntu.jammy:ste:544710000000"/>
29+
</linux:dpkginfo_test>
30+
</tests>
31+
<objects>
32+
<linux:dpkginfo_object id="oval:com.ubuntu.jammy:obj:544710000000" version="1" comment="logrotate object">
33+
<linux:name var_ref="oval:com.ubuntu.jammy:var:544710000000" var_check="at least one" />
34+
</linux:dpkginfo_object>
35+
</objects>
36+
<states>
37+
<linux:dpkginfo_state id="oval:com.ubuntu.jammy:ste:544710000000" version="1" comment="logrotate version">
38+
<linux:evr datatype="debian_evr_string" operation="less than">0:3.18.0-2ubuntu1.1</linux:evr>
39+
</linux:dpkginfo_state>
40+
</states>
41+
<variables>
42+
<constant_variable id="oval:com.ubuntu.jammy:var:544710000000" version="1" datatype="string" comment="logrotate">
43+
<value>logrotate</value>
44+
</constant_variable>
45+
</variables>
46+
</oval_definitions>

‎tests/API/OVAL/unittests/test_debian_evr_string_comparison.sh

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/env bash
2+
. $builddir/tests/test_common.sh
3+
4+
set -e -o pipefail
5+
6+
name=$(basename $0 .sh)
7+
result=$(mktemp ${name}.out.XXXXXX)
8+
echo "result file: $result"
9+
stderr=$(mktemp ${name}.err.XXXXXX)
10+
echo "stderr file: $stderr"
11+
12+
echo "Analysing syschar content."
13+
$OSCAP oval analyse --results $result $srcdir/$name.oval.xml $srcdir/$name.syschar.xml 2> $stderr
14+
[ -f $stderr ]; [ ! -s $stderr ]; rm $stderr
15+
[ -f $result ]
16+
17+
assert_exists 1 '/oval_results'
18+
assert_exists 1 '/oval_results/generator'
19+
assert_exists 1 '/oval_results/generator/oval:product_name'
20+
assert_exists 1 '/oval_results/generator/oval:product_name[text()="cpe:/a:open-scap:oscap"]'
21+
assert_exists 1 '/oval_results/generator/oval:schema_version'
22+
assert_exists 1 '/oval_results/generator/oval:schema_version[text()="5.11.1"]'
23+
assert_exists 1 '/oval_results/generator/oval:timestamp'
24+
assert_exists 1 '/oval_results/directives'
25+
assert_exists 1 '/oval_results/oval_definitions'
26+
assert_exists 1 '/oval_results/results'
27+
assert_exists 1 '/oval_results/results/system'
28+
assert_exists 1 '/oval_results/results/system/definitions'
29+
assert_exists 1 '/oval_results/results/system/definitions/definition'
30+
assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'
31+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria'
32+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria/criterion'
33+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria/criterion[@result="false"]'
34+
assert_exists 1 '/oval_results/results/system/tests'
35+
assert_exists 1 '/oval_results/results/system/tests/test'
36+
assert_exists 1 '/oval_results/results/system/tests/test[@result="false"]'
37+
assert_exists 1 '/oval_results/results/system/tests/test/tested_item'
38+
assert_exists 1 '/oval_results/results/system/tests/test/tested_item[@result="false"]'
39+
40+
rm $result

‎tests/API/OVAL/unittests/test_debian_evr_string_comparison.syschar.xml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<oval_system_characteristics xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
3+
<generator>
4+
<oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
5+
<oval:product_version>1</oval:product_version>
6+
<oval:schema_version>5.11.1</oval:schema_version>
7+
<oval:timestamp>2022-12-19T16:39:11</oval:timestamp>
8+
</generator>
9+
<system_info>
10+
<os_name>Linux</os_name>
11+
<os_version>#59-Ubuntu SMP Mon Oct 17 18:53:30 UTC 2022</os_version>
12+
<architecture>x86_64</architecture>
13+
<primary_host_name>you.know.it</primary_host_name>
14+
<interfaces>
15+
<interface>
16+
<interface_name>lo</interface_name>
17+
<ip_address>127.0.0.1</ip_address>
18+
<mac_address>00:00:00:00:00:00</mac_address>
19+
</interface>
20+
</interfaces>
21+
</system_info>
22+
<collected_objects>
23+
<object id="oval:com.ubuntu.jammy:obj:544710000000" version="1" flag="complete">
24+
<variable_value variable_id="oval:com.ubuntu.jammy:var:544710000000">logrotate</variable_value>
25+
<reference item_ref="101854166"/>
26+
</object>
27+
</collected_objects>
28+
<system_data>
29+
<lin-sys:dpkginfo_item id="101854166" status="exists">
30+
<lin-sys:name>logrotate</lin-sys:name>
31+
<lin-sys:arch>amd64</lin-sys:arch>
32+
<lin-sys:epoch>0</lin-sys:epoch>
33+
<lin-sys:release>2ubuntu1.1</lin-sys:release>
34+
<lin-sys:version>3.18.0</lin-sys:version>
35+
<lin-sys:evr datatype="debian_evr_string">0:3.18.0-2ubuntu1.1</lin-sys:evr>
36+
</lin-sys:dpkginfo_item>
37+
</system_data>
38+
</oval_system_characteristics>

‎tests/API/OVAL/unittests/test_debian_evr_string_missing_epoch.oval.xml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<oval_definitions
2+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
3+
xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
4+
xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
5+
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
6+
xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
7+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd">
8+
<generator>
9+
<oval:product_name>Canonical USN OVAL Generator</oval:product_name>
10+
<oval:product_version>1</oval:product_version>
11+
<oval:schema_version>5.11.1</oval:schema_version>
12+
<oval:timestamp>2022-12-19T14:35:51</oval:timestamp>
13+
</generator>
14+
<definitions>
15+
<definition id="oval:com.ubuntu.jammy:def:54471000000" version="1" class="patch">
16+
<metadata>
17+
<title>logrotate vulnerability</title>
18+
<description>none</description>
19+
</metadata>
20+
<criteria operator="OR">
21+
<criterion test_ref="oval:com.ubuntu.jammy:tst:544710000000" comment="logrotate is earlier than 3.19.0-1ubuntu1.1" />
22+
</criteria>
23+
</definition>
24+
</definitions>
25+
<tests>
26+
<linux:dpkginfo_test id="oval:com.ubuntu.jammy:tst:544710000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="logrotate is earlier than 3.19.0-1ubuntu1.1">
27+
<linux:object object_ref="oval:com.ubuntu.jammy:obj:544710000000"/>
28+
<linux:state state_ref="oval:com.ubuntu.jammy:ste:544710000000"/>
29+
</linux:dpkginfo_test>
30+
</tests>
31+
<objects>
32+
<linux:dpkginfo_object id="oval:com.ubuntu.jammy:obj:544710000000" version="1" comment="logrotate object">
33+
<linux:name var_ref="oval:com.ubuntu.jammy:var:544710000000" var_check="at least one" />
34+
</linux:dpkginfo_object>
35+
</objects>
36+
<states>
37+
<linux:dpkginfo_state id="oval:com.ubuntu.jammy:ste:544710000000" version="1" comment="logrotate version">
38+
<linux:evr datatype="debian_evr_string" operation="less than">3.19.0-1ubuntu1.1</linux:evr>
39+
</linux:dpkginfo_state>
40+
</states>
41+
<variables>
42+
<constant_variable id="oval:com.ubuntu.jammy:var:544710000000" version="1" datatype="string" comment="logrotate">
43+
<value>logrotate</value>
44+
</constant_variable>
45+
</variables>
46+
</oval_definitions>

‎tests/API/OVAL/unittests/test_debian_evr_string_missing_epoch.sh

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/env bash
2+
. $builddir/tests/test_common.sh
3+
4+
set -e -o pipefail
5+
6+
name=$(basename $0 .sh)
7+
result=$(mktemp ${name}.out.XXXXXX)
8+
echo "result file: $result"
9+
stderr=$(mktemp ${name}.err.XXXXXX)
10+
echo "stderr file: $stderr"
11+
12+
echo "Analysing syschar content."
13+
$OSCAP oval analyse --results $result $srcdir/$name.oval.xml $srcdir/$name.syschar.xml 2> $stderr
14+
[ -f $stderr ]; [ ! -s $stderr ]; rm $stderr
15+
[ -f $result ]
16+
17+
assert_exists 1 '/oval_results'
18+
assert_exists 1 '/oval_results/generator'
19+
assert_exists 1 '/oval_results/generator/oval:product_name'
20+
assert_exists 1 '/oval_results/generator/oval:product_name[text()="cpe:/a:open-scap:oscap"]'
21+
assert_exists 1 '/oval_results/generator/oval:schema_version'
22+
assert_exists 1 '/oval_results/generator/oval:schema_version[text()="5.11.1"]'
23+
assert_exists 1 '/oval_results/generator/oval:timestamp'
24+
assert_exists 1 '/oval_results/directives'
25+
assert_exists 1 '/oval_results/oval_definitions'
26+
assert_exists 1 '/oval_results/results'
27+
assert_exists 1 '/oval_results/results/system'
28+
assert_exists 1 '/oval_results/results/system/definitions'
29+
assert_exists 1 '/oval_results/results/system/definitions/definition'
30+
assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'
31+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria'
32+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria/criterion'
33+
assert_exists 1 '/oval_results/results/system/definitions/definition/criteria/criterion[@result="false"]'
34+
assert_exists 1 '/oval_results/results/system/tests'
35+
assert_exists 1 '/oval_results/results/system/tests/test'
36+
assert_exists 1 '/oval_results/results/system/tests/test[@result="false"]'
37+
assert_exists 1 '/oval_results/results/system/tests/test/tested_item'
38+
assert_exists 1 '/oval_results/results/system/tests/test/tested_item[@result="false"]'
39+
40+
rm $result

‎tests/API/OVAL/unittests/test_debian_evr_string_missing_epoch.syschar.xml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<oval_system_characteristics xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
3+
<generator>
4+
<oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
5+
<oval:product_version>1</oval:product_version>
6+
<oval:schema_version>5.11.1</oval:schema_version>
7+
<oval:timestamp>2022-12-19T16:39:11</oval:timestamp>
8+
</generator>
9+
<system_info>
10+
<os_name>Linux</os_name>
11+
<os_version>#59-Ubuntu SMP Mon Oct 17 18:53:30 UTC 2022</os_version>
12+
<architecture>x86_64</architecture>
13+
<primary_host_name>you.know.it</primary_host_name>
14+
<interfaces>
15+
<interface>
16+
<interface_name>lo</interface_name>
17+
<ip_address>127.0.0.1</ip_address>
18+
<mac_address>00:00:00:00:00:00</mac_address>
19+
</interface>
20+
</interfaces>
21+
</system_info>
22+
<collected_objects>
23+
<object id="oval:com.ubuntu.jammy:obj:544710000000" version="1" flag="complete">
24+
<variable_value variable_id="oval:com.ubuntu.jammy:var:544710000000">logrotate</variable_value>
25+
<reference item_ref="101854166"/>
26+
</object>
27+
</collected_objects>
28+
<system_data>
29+
<lin-sys:dpkginfo_item id="101854166" status="exists">
30+
<lin-sys:name>logrotate</lin-sys:name>
31+
<lin-sys:arch>amd64</lin-sys:arch>
32+
<lin-sys:epoch>0</lin-sys:epoch>
33+
<lin-sys:release>1ubuntu1.1</lin-sys:release>
34+
<lin-sys:version>3.19.0</lin-sys:version>
35+
<lin-sys:evr datatype="debian_evr_string">0:3.19.0-1ubuntu1.1</lin-sys:evr>
36+
</lin-sys:dpkginfo_item>
37+
</system_data>
38+
</oval_system_characteristics>

‎tests/mitre/linux-def_dpkginfo_test.xml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,23 +53,23 @@
5353
<epoch operation="pattern match">.*</epoch>
5454
<release operation="pattern match">.*</release>
5555
<version operation="pattern match">.*</version>
56-
<evr datatype="evr_string" operation="greater than">0:0-0</evr>
57-
</dpkginfo_state>
56+
<evr datatype="debian_evr_string" operation="greater than">0:0-0</evr>
57+
</dpkginfo_state>
5858
<dpkginfo_state id="oval:org.mitre.oval.test:ste:499" version="2" comment="This state represents dpkginfo_items that have a name not equal to 'libapt-pkg-dev', and an arch, epoch, release, version, evr, and signature_keyid that match the regular expression '.*'." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
5959
<name operation="not equal">libapt-pkg-dev</name>
6060
<arch operation="pattern match">.*</arch>
6161
<epoch operation="pattern match">.*</epoch>
6262
<release operation="pattern match">.*</release>
6363
<version operation="pattern match">.*</version>
64-
<evr datatype="evr_string" operation="greater than">0:0-0</evr>
64+
<evr datatype="debian_evr_string" operation="greater than">0:0-0</evr>
6565
</dpkginfo_state>
6666
<dpkginfo_state id="oval:org.mitre.oval.test:ste:718" version="2" comment="This state represents dpkginfo_items that have a name that matches the regular expression '^libapt.pkg.dev$', and an arch, epoch, release, version, evr, and signature_keyid that match the regular expression '.*'." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
6767
<name operation="pattern match">^libapt.pkg.dev$</name>
6868
<arch operation="pattern match">.*</arch>
6969
<epoch operation="pattern match">.*</epoch>
7070
<release operation="pattern match">.*</release>
7171
<version operation="pattern match">.*</version>
72-
<evr datatype="evr_string" operation="greater than">0:0-0</evr>
72+
<evr datatype="debian_evr_string" operation="greater than">0:0-0</evr>
7373
</dpkginfo_state>
7474
</states>
75-
</oval_definitions>
75+
</oval_definitions>

0 commit comments

Comments
 (0)