Skip to content

Commit e28aad9

Browse files
mpreislermpreisler
authored
Merge pull request #1055 from cipherboy/wpe
Warn about non-registered check systems
2 parents e726259 + ac48456 commit e28aad9

File tree

6 files changed

+139
-3
lines changed

6 files changed

+139
-3
lines changed

‎src/XCCDF_POLICY/xccdf_policy.c

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#endif
2929

3030
#include <stdlib.h>
31+
#include <stdio.h>
3132
#include <string.h>
3233
#include <libgen.h>
3334

@@ -572,11 +573,32 @@ _xccdf_policy_rule_get_applicable_check(struct xccdf_policy *policy, struct xccd
572573
// If the refined selector does not match, checks without selector shall be used.
573574
candidate_it = xccdf_rule_get_checks_filtered(rule, NULL);
574575
}
576+
577+
bool print_general_warning = false;
578+
bool print_oval_warning = false;
579+
char *warning_check_system;
575580
// Check Processing Algorithm -- Check.System
576581
while (xccdf_check_iterator_has_more(candidate_it)) {
577582
struct xccdf_check *check = xccdf_check_iterator_next(candidate_it);
578-
if (_xccdf_policy_is_engine_registered(policy, (char *) xccdf_check_get_system(check)))
583+
if (_xccdf_policy_is_engine_registered(policy, (char *) xccdf_check_get_system(check))) {
579584
result = check;
585+
} else if (strcmp("http://oval.mitre.org/XMLSchema/oval-definitions-5", check->system) == 0) {
586+
print_oval_warning = true;
587+
} else {
588+
print_general_warning = true;
589+
warning_check_system = check->system;
590+
}
591+
}
592+
593+
// Only print a warning if we didn't select a check but could've otherwise.
594+
if (print_oval_warning) {
595+
printf("WARNING: Skipping rule that uses OVAL but is possibly malformed; "
596+
"an incorrect content reference prevents this check from being evaluated.\n");
597+
} else if (print_general_warning && result == NULL) {
598+
printf("WARNING: Skipping rule that requires an unregistered check system "
599+
"or incorrect content reference to evaluate. "
600+
"Please consider providing a valid SCAP/OVAL instead of %s\n",
601+
warning_check_system);
580602
}
581603
xccdf_check_iterator_free(candidate_it);
582604
}

‎tests/API/XCCDF/parser/Makefile.am

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,11 @@ TESTS_ENVIRONMENT = \
2222
OSCAP_FULL_VALIDATION=1 \
2323
$(top_builddir)/run
2424

25-
TESTS = test_api_xccdf.sh
25+
TESTS = test_api_xccdf.sh test_extensions.sh
2626
check_PROGRAMS = test_api_xccdf
2727

2828
test_api_xccdf_SOURCES = test_api_xccdf.c
2929

30-
EXTRA_DIST = test_api_xccdf.sh xccdf11.xml xccdf12.xml xccdf11-results.xml
30+
EXTRA_DIST = test_api_xccdf.sh test_extensions.sh xccdf11.xml xccdf12.xml xccdf11-results.xml \
31+
test_known_extensions.xml test_malformed_extensions.xml test_proprietary_extensions.xml
3132

‎tests/API/XCCDF/parser/test_extensions.sh

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2018 Red Hat Inc., Durham, North Carolina.
4+
# All Rights Reserved.
5+
#
6+
# OpenScap XCCDF Module Test Suite.
7+
#
8+
# Authors:
9+
# Peter Vrabec <[email protected]>
10+
# Alexander Scheel <[email protected]>
11+
12+
. $builddir/tests/test_common.sh
13+
14+
# Test cases.
15+
16+
function test_known_extension {
17+
local INPUT=$1
18+
19+
output=$(bash $builddir/run $builddir/utils/oscap xccdf eval $srcdir/$INPUT 2>&1)
20+
has_warning=$(echo "$output" | grep -i "Skipping rule")
21+
22+
return $([ "x$has_warning" == "x" ])
23+
}
24+
25+
26+
27+
function test_malformed_extension {
28+
local INPUT=$1
29+
30+
output=$(bash $builddir/run $builddir/utils/oscap xccdf eval $srcdir/$INPUT 2>&1)
31+
has_warning=$(echo "$output" | grep -i "Skipping rule that uses OVAL")
32+
33+
return $([ "x$has_warning" != "x" ])
34+
}
35+
36+
37+
function test_unknown_extension {
38+
local INPUT=$1
39+
40+
output=$(bash $builddir/run $builddir/utils/oscap xccdf eval $srcdir/$INPUT 2>&1)
41+
has_warning=$(echo "$output" | grep -i "Skipping rule that requires")
42+
43+
return $([ "x$has_warning" != "x" ])
44+
}
45+
46+
# Testing.
47+
48+
test_init "test_xccdf_check_extensions.log"
49+
50+
if [ -z ${CUSTOM_OSCAP+x} ] ; then
51+
test_run "known check extension" test_known_extension test_known_extensions.xml
52+
test_run "malformed check extension" test_malformed_extension test_malformed_extensions.xml
53+
test_run "unknown check extension" test_unknown_extension test_proprietary_extensions.xml
54+
fi
55+
56+
test_exit

‎tests/API/XCCDF/parser/test_known_extensions.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="0" xml:lang="en-US">
3+
<status date="2011-12-08">draft</status>
4+
<title xml:lang="en-US">Sample XCCDF using open extensions</title>
5+
<description xml:lang="en-US">Open extensions will appear the XCCDF report</description>
6+
<version>0.1</version>
7+
<model system="urn:xccdf:scoring:default"/>
8+
<model system="urn:xccdf:scoring:flat"/>
9+
<Group id="bash-passer" hidden="false">
10+
<title xml:lang="en-US">Check with a hint of OVAL</title>
11+
<description xml:lang="en-US">Be Sure To Drink Your OVALtine.</description>
12+
<Rule id="rule-1000" selected="true" weight="10.000000">
13+
<title xml:lang="en-US">TEST (open)</title>
14+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
15+
<check-content-ref href="../tailoring/simple-oval.xml" name="oval:x:def:1"/>
16+
</check>
17+
</Rule>
18+
</Group>
19+
</Benchmark>

‎tests/API/XCCDF/parser/test_malformed_extensions.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="0" xml:lang="en-US">
3+
<status date="2011-12-08">draft</status>
4+
<title xml:lang="en-US">Sample XCCDF using open extensions</title>
5+
<description xml:lang="en-US">Open extensions will appear the XCCDF report</description>
6+
<version>0.1</version>
7+
<model system="urn:xccdf:scoring:default"/>
8+
<model system="urn:xccdf:scoring:flat"/>
9+
<Group id="bash-passer" hidden="false">
10+
<title xml:lang="en-US">Check with a hint of OVAL</title>
11+
<description xml:lang="en-US">Be Sure To Drink Your OVALtine.</description>
12+
<Rule id="rule-1000" selected="true" weight="10.000000">
13+
<title xml:lang="en-US">TEST (open)</title>
14+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
15+
<check-content-ref href="../some/arbitrary/path/which/will/never/really/exist/on/real/systems.xml" name="oval:x:def:1"/>
16+
</check>
17+
</Rule>
18+
</Group>
19+
</Benchmark>

‎tests/API/XCCDF/parser/test_proprietary_extensions.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="0" xml:lang="en-US">
3+
<status date="2011-12-08">draft</status>
4+
<title xml:lang="en-US">Sample XCCDF using proprietary extensions</title>
5+
<description xml:lang="en-US">Proprietary extensions WILL NOT appear the XCCDF report</description>
6+
<version>0.1</version>
7+
<model system="urn:xccdf:scoring:default"/>
8+
<model system="urn:xccdf:scoring:flat"/>
9+
<Group id="bash-passer" hidden="false">
10+
<title xml:lang="en-US">Check with a hint of Mint</title>
11+
<description xml:lang="en-US">Mint tea consumed during the making of this test</description>
12+
<Rule id="rule-1000" selected="true" weight="10.000000">
13+
<title xml:lang="en-US">TEST (proprietary)</title>
14+
<check system="https://www.bigelowtea.com/Teas/Flavors/Mint">
15+
<check-content-ref href="mint.tea"/>
16+
</check>
17+
</Rule>
18+
</Group>
19+
</Benchmark>

0 commit comments

Comments
 (0)