Skip to content

Commit 769cda4

Browse files
new tests on xccdf_policy
1 parent 2b9eb2d commit 769cda4

File tree

4 files changed

+204
-0
lines changed

4 files changed

+204
-0
lines changed

tests/bindings/python/import_handler.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"instead of the tested environment.\n"
2222
"Loaded module path = {0}".format(oscap.__file__))
2323
else:
24+
print("openscap_api loaded from "+oscap.__file__)
2425
pass # import is loaded from the right env
2526

2627

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!-- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sect-defining_compliance_policy -->
3+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2"
4+
id="xccdf_com.example.www_benchmark_test">
5+
<status>incomplete</status>
6+
<version>0.1</version>
7+
<Profile id="xccdf_com.example.www_profile_1">
8+
<title>Profile title is compulsory</title>
9+
<select idref="xccdf_com.example.www_group_1"
10+
selected="true"/>
11+
<select idref="xccdf_com.example.www_rule_1"
12+
selected="true"/>
13+
<refine-value idref="xccdf_com.example.www_value_1"
14+
selector="telnet_service"/>
15+
</Profile>
16+
<Group id="xccdf_com.example.www_group_1">
17+
<Value id="xccdf_com.example.www_value_1">
18+
<title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Which package is installed ? (telnet-server/dhcpd/tftpd) </title>
19+
<value selector="telnet_service">telnet-server</value>
20+
<value selector="dhcp_service">dhcpd</value>
21+
<value selector="ftp_service">tftpd</value>
22+
</Value>
23+
<Rule id="xccdf_com.example.www_rule_1">
24+
<title>The telnet-server Package Shall Not Be Installed </title>
25+
<rationale>
26+
Removing the telnet-server package decreases the risk
27+
of the telnet service’s accidental (or intentional) activation
28+
</rationale>
29+
<fix platform="cpe:/o:redhat:enterprise_linux:6"
30+
reboot="false"
31+
disruption="low"
32+
system="urn:xccdf:fix:script:sh">
33+
yum -y remove
34+
<sub idref="xccdf_com.example.www_value_1"/>
35+
</fix>
36+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
37+
<check-export value-id="xccdf_com.example.www_value_1"
38+
export-name="oval:com.example.www:var:1"/>
39+
<check-content-ref href="examplary.oval.xml"
40+
name="oval:com.example.www:def:1"/>
41+
</check>
42+
<check system="http://open-scap.org/page/SCE">
43+
<check-import import-name="stdout"/>
44+
<check-content-ref href="telnet_server.sh"/>
45+
</check>
46+
</Rule>
47+
</Group>
48+
</Benchmark>

tests/bindings/python/xccdf_policy.py

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
#!/usr/bin/env python
2+
3+
# Author:
4+
# Dominique Blaze <[email protected]>
5+
#
6+
7+
import os
8+
from import_handler import oscap, result2str, get_path
9+
10+
''' Story
11+
12+
1) ======= import benchmark with xccdf.init (and not import_benchmark) ====
13+
14+
Benchmark id should be xccdf_com.example.www_benchmark_test
15+
Profile should contains : xccdf_com.example.www_profile_1
16+
17+
18+
2) ===== Testing XCCDF_POLICY ========
19+
20+
When using this profile, get_tailoring_items() should returns this.
21+
But instead of testing exactly this result (which will probably be improved
22+
we only test expected required features, for instance it's better to check
23+
if a feature is included (in order the test pass if more features are added later
24+
25+
[{'choices': {},
26+
'descs': {None: ''},
27+
'id': 'xccdf_com.example.www_value_1',
28+
'lang': None,
29+
'langs': {None, 'en-US'},
30+
'match': '^.*$',
31+
'options': {'dhcp_service': 'dhcpd',
32+
'ftp_service': 'tftpd',
33+
'telnet_service': 'telnet-server'},
34+
'selected': ('telnet_service', 'telnet-server'),
35+
'titles': {None: '',
36+
'en-US': 'Which package is installed ? '
37+
'(telnet-server/dhcpd/tftpd) '},
38+
'type': 2}]
39+
40+
3) ====== Testing values ========
41+
42+
43+
Expected items in list returned by get_all_values():
44+
first value id should be : xccdf_com.example.www_value_1 -----
45+
with title (en-us) = Which package is installed ? (telnet-server/dhcpd/tftpd)
46+
47+
4) ======== Refining some values and ensure it's working ======
48+
49+
TODO : export the tailored file, re-import it, check the modifications
50+
and ensure that the initial file isn't modified.
51+
52+
'''
53+
54+
# ====================== Part 1 ============================
55+
56+
print("opening " + get_path("samples/redhat_bench_example/benchmark_example_redhat.xml") + " ...")
57+
benchmark_components = oscap.xccdf.init(get_path("samples/redhat_bench_example/"
58+
"benchmark_example_redhat.xml"))
59+
60+
pm = benchmark_components['policy_model']
61+
benchmark = pm.get_benchmark()
62+
expected_benchmark_id = "xccdf_com.example.www_benchmark_test"
63+
if benchmark.get_id() != expected_benchmark_id:
64+
raise Exception("Benchmark id should be {0} but is currently {0}"
65+
.format(expected_benchmark_id, benchmark.get_id()))
66+
67+
print("Browsing profiles ...")
68+
profiles = set()
69+
for p in pm.get_benchmark().get_profiles():
70+
print("\t" + p.get_id())
71+
profiles.add(p.get_id())
72+
73+
if 'xccdf_com.example.www_profile_1' not in profiles:
74+
raise Exception("Profile xccdf_com.example.www_profile_1 should be present in get_profiles"
75+
"but haven't be found. Current profiles : {0}".format(', '.join(profiles)))
76+
77+
profile = pm.get_benchmark().get_profile_by_id("xccdf_com.example.www_profile_1")
78+
print("selected profile : " + profile.get_id())
79+
80+
profile_not_defined = pm.get_benchmark().get_profile_by_id("xccdf_com.example.profile_not_exists")
81+
if profile_not_defined is not None:
82+
raise Exception("get_profile_by_id('xccdf_com.example.profile_not_exists') should returns "
83+
"None but returned value is {0}".format(profile_not_defined))
84+
85+
# ====================== Part 2 ============================
86+
87+
policy = oscap.xccdf.policy_new(pm, profile)
88+
89+
if "'xccdf_policy'" not in policy.__repr__():
90+
raise Exception("Variable policy should be a swig object of type 'xccdf_policy'. "
91+
"Current object representation : {0}".format(policy.__repr__()))
92+
93+
94+
# ====================== Part 3 ============================
95+
96+
97+
tailor_items = policy.get_tailor_items()
98+
99+
expected_val1_id = 'xccdf_com.example.www_value_1'
100+
expected_val1_options = {'dhcp_service': 'dhcpd',
101+
'ftp_service': 'tftpd',
102+
'telnet_service': 'telnet-server'}
103+
104+
expected_val1_selected = ('telnet_service', 'telnet-server')
105+
106+
val1 = tailor_items[0]
107+
print("First tailored value raw_content: {0}".format(val1))
108+
109+
if val1['id'] != expected_val1_id:
110+
raise Exception("Id of first tailored value should be {0} but is {1}"
111+
.format(expected_val1_id, val1["id"]))
112+
113+
if val1['options'] != expected_val1_options:
114+
raise Exception("Options of tailored value {0} should be {1} but is {2}"
115+
.format(val1['id'], expected_val1_options, val1["options"]))
116+
117+
118+
if val1['selected'] != expected_val1_selected:
119+
raise Exception("Selected option of tailored value {0} should be {1} but is {2}"
120+
.format(val1['id'], expected_val1_selected, val1["selected"]))
121+
122+
if 'en-US' not in val1['langs']:
123+
raise Exception("Available langs of tailored value {0} should contains en-US but is {1}"
124+
.format(val1['id'], ', '.join(val1["langs"])))
125+
126+
if val1['match'] != '^.*$':
127+
raise Exception("Match propety of tailored value {0} should be '^.*$' but is {1}"
128+
.format(val1['id'], val1["match"]))
129+
130+
if int(val1['type']) != 2:
131+
raise Exception("Type of tailored value {0} should be '2' but is {1}"
132+
.format(val1['type'], val1["type"]))
133+
134+
print("All retrievied values seems OK (id, options, selected option, lang, match, type)")
135+
136+
# ====================== Part 4 ============================
137+
138+
139+
''' Should replace the selected option with ('ftp_service', 'tftpd') '''
140+
new_tailored_value = {'id': expected_val1_id,
141+
'value': 'tftpd'
142+
}
143+
144+
new_expected_selected_value = ()
145+
146+
policy.set_tailor_items([new_tailored_value])
147+
val1bis = policy.get_tailor_items()
148+
149+
if val1bis[0]['selected'] != ('ftp_service', 'tftpd'):
150+
raise Exception("After setting of the default value {0}, its selected option "
151+
"should be ('ftp_service', 'tftpd') but is currently {1}"
152+
.format(expected_val1_id, val1bis['selected']))
153+
154+
print("Default value refining (set_tailoring_item) seems to work fine.")

tests/bindings/test_python.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ if [ -z ${CUSTOM_OSCAP+x} ] ; then
3535
test_run "python_benchmark_import_results" run_pyfile benchmark_import_results.py
3636
test_run "python_oval_eval" run_pyfile oval_eval.py
3737
test_run "python_introspection_features" run_pyfile introspection_features.py
38+
test_run "python_xccdf_policy" run_pyfile xccdf_policy.py
3839
fi
3940

4041
test_exit

0 commit comments

Comments
 (0)