Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate test_providers documentation to qa-docs #2377

Merged
merged 6 commits into from
Jan 7, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,7 @@ predefined_values:
- office365
- on start
- oval
- providers
- pull
- rbac
- realtime
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,61 @@
# Copyright (C) 2015-2021, Wazuh Inc.
# Created by Wazuh, Inc. <[email protected]>.
# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2
'''
copyright: Copyright (C) 2015-2021, Wazuh Inc.

Created by Wazuh, Inc. <[email protected]>.

This program is free software; you can redistribute it and/or modify it under the terms of GPLv2

type: integration

brief: Wazuh is able to detect vulnerabilities in the applications installed in agents using the Vulnerability Detector
module. This software audit is performed through the integration of vulnerability feeds indexed by Redhat,
Canonical, Debian, Amazon Linux and NVD Database.

tier: 1

modules:
- vulnerability_detector

components:
- manager

daemons:
- wazuh-modulesd
- wazuh-db
- wazuh-analysisd

os_platform:
- linux

os_version:
- Arch Linux
- Amazon Linux 2
- Amazon Linux 1
- CentOS 8
- CentOS 7
- CentOS 6
- Ubuntu Focal
- Ubuntu Bionic
- Ubuntu Xenial
- Ubuntu Trusty
- Debian Buster
- Debian Stretch
- Debian Jessie
- Debian Wheezy
- Red Hat 8
- Red Hat 7
- Red Hat 6

references:
- https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html
- https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/vuln-detector.html#provider

tags:
- settings
- vulnerability
- vulnerability_detector
- providers
'''
import os

import pytest
Expand Down Expand Up @@ -72,16 +126,40 @@ def get_configuration(request):

@pytest.mark.skip(reason="It will be blocked by #1602, when it was solve we can enable again this test")
def test_enabled(get_configuration, configure_environment, restart_modulesd):
"""Check if modulesd downloads the feeds from different providers when enabled is set to yes.
'''
description: Check if modulesd downloads the feeds from different providers when enabled is set to yes. To do this,
it identifies the log which, if activated, indicates the update of the feeds. If the feeds are not
active in the configuration, check that the above-mentioned log does not occur.

wazuh_min_version: 4.2.0

parameters:
- get_configuration:
type: fixture
brief: Get configurations from the module.
- configure_environment:
type: fixture
brief: Configure a custom environment for testing.
- restart_modulesd:
type: fixture
brief: Reset the logs file and start a new monitor.

assertions:
- Verify that when the `enabled` tag of the provider option is set to `yes`, provider database starts updating.
- Verify that when the `enabled` tag of the provider option is set to `no`, checks that provider database does
not start updating.

For this purpose, it identifies the log which, if activated, indicates the update of the feeds.
If the feeds are not active in the configuration, check that the above-mentioned log does not occur.
input_description:
- Test cases are found in the test module and include parameters for the `enabled` tag of the provider option
(`yes` and `no`). The `wazuh_providers_enabled.yaml` file provides the configuration of this module for this
test.

Args:
get_configuration (fixture): Get configurations from the module.
configure_environment (fixture): Configure a custom environment for testing.
restart_modulesd (fixture): Reset the logs file and start a new monitor.
"""
expected_output:
- 'Starting.+database update'
- r'Unexpected event .* database updating'
- r'Starting .* database update'
- r'Could not find .* update starting log'
'''
provider_name = get_configuration['metadata']['provider_name']
if get_configuration['metadata']['enabled'] == 'no':
with pytest.raises(TimeoutError):
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,61 @@
# Copyright (C) 2015-2021, Wazuh Inc.
# Created by Wazuh, Inc. <[email protected]>.
# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2

'''
copyright: Copyright (C) 2015-2021, Wazuh Inc.

Created by Wazuh, Inc. <[email protected]>.

This program is free software; you can redistribute it and/or modify it under the terms of GPLv2

type: integration

brief: Wazuh is able to detect vulnerabilities in the applications installed in agents using the Vulnerability Detector
module. This software audit is performed through the integration of vulnerability feeds indexed by Redhat,
Canonical, Debian, Amazon Linux and NVD Database.

tier: 0

modules:
- vulnerability_detector

components:
- manager

daemons:
- wazuh-modulesd
- wazuh-db
- wazuh-analysisd

os_platform:
- linux

os_version:
- Arch Linux
- Amazon Linux 2
- Amazon Linux 1
- CentOS 8
- CentOS 7
- CentOS 6
- Ubuntu Focal
- Ubuntu Bionic
- Ubuntu Xenial
- Ubuntu Trusty
- Debian Buster
- Debian Stretch
- Debian Jessie
- Debian Wheezy
- Red Hat 8
- Red Hat 7
- Red Hat 6

references:
- https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html
- https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/vuln-detector.html#provider

tags:
- settings
- vulnerability
- vulnerability_detector
- providers
'''
import os

import pytest
Expand Down Expand Up @@ -62,22 +116,49 @@ def get_configuration(request):


def test_multiple_providers(clean_vuln_tables, get_configuration, configure_environment, restart_modulesd):
r"""This test verifies the path/url and multipath/url options work properly according to the configuration
and check there are no conflicts when downloading or reading the feeds.


From now on, Redhat and Debian providers use two feeds to fetch vulnerabilities and CVEs' metadata.
\<os path=...\> option indicates the local path where the OVAL feed is whereas \<path\> indicates the local path where
the another feed is. The same goes for \<os url=...\> and \<url\> options.
This test verifies the path/url and multipath/url options work properly according to the configuration
and check there are no conflicts when downloading or reading the feeds.

Args:
clean_vuln_tables: Clean the tables involved with vulnerability detector packages and feeds.
get_configuration (fixture): Get configurations from the module.
configure_environment (fixture): Configure a custom environment for testing.
restart_modulesd (fixture): Reset the logs file and start a new monitor.
"""
'''
description: Check if the path/url and multipath/url options work properly according to the configuration
and check there are no conflicts when downloading or reading the feeds. To do this, it checks that the
OVAL feed has been correctly assigned in the log file. In the case of the RedHat provider, it verifies
the correct assignment of the global information feeds. Finally, when the feed assignment is correct,
it checks that the updates for both types of feeds start.
From now on, Redhat and Debian providers use two feeds to fetch vulnerabilities and CVEs' metadata.
<os path=...> option indicates the local path where the OVAL feed is whereas <path> indicates the
local path where the another feed is. The same goes for <os url=...> and <url> options.

wazuh_min_version: 4.2.0

parameters:
- clean_vuln_tables:
type: fixture
brief: Clean vulnerabilities tables.
- get_configuration:
type: fixture
brief: Get configurations from the module.
- configure_environment:
type: fixture
brief: Configure a custom environment for testing.
- restart_modulesd:
type: fixture
brief: Reset the logs file and start a new monitor.

assertions:
- Verify that the OVAL feed has been correctly assigned in the log file.
- In the case of the RedHat provider, verify the correct assignment of the global information feeds.
- When the feed assignment is correct, verify that the updates for both types of feeds start.

input_description:
- Test cases are found in the test module and include parameters for the `os url/path` tag of the provider
option. The `wazuh_providers_multiple_providers.yaml` file provides the configuration of this module for this
test. `custom_redhat_json_feed.json`, `custom_redhat_oval_feed.xml`, `custom_debian_json_feed.json`, and
`custom_debian_oval_feed.xml` provide the specific feeds to be downloaded or read.

expected_output:
- r'(Path|Url): (.*'|'none').*'
- r'Multi (path|url): .*'
- r'(Fetching feed from|Downloading) .*'
- r'((Fetching .* from|Downloading) .*|.*Trying to download).*'
'''
provider = get_configuration['metadata']['provider']

if provider == 'redhat':
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,61 @@
# Copyright (C) 2015-2021, Wazuh Inc.
# Created by Wazuh, Inc. <[email protected]>.
# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2

'''
copyright: Copyright (C) 2015-2021, Wazuh Inc.

Created by Wazuh, Inc. <[email protected]>.

This program is free software; you can redistribute it and/or modify it under the terms of GPLv2

type: integration

brief: Wazuh is able to detect vulnerabilities in the applications installed in agents using the Vulnerability Detector
module. This software audit is performed through the integration of vulnerability feeds indexed by Redhat,
Canonical, Debian, Amazon Linux and NVD Database.

tier: 1

modules:
- vulnerability_detector

components:
- manager

daemons:
- wazuh-modulesd
- wazuh-db
- wazuh-analysisd

os_platform:
- linux

os_version:
- Arch Linux
- Amazon Linux 2
- Amazon Linux 1
- CentOS 8
- CentOS 7
- CentOS 6
- Ubuntu Focal
- Ubuntu Bionic
- Ubuntu Xenial
- Ubuntu Trusty
- Debian Buster
- Debian Stretch
- Debian Jessie
- Debian Wheezy
- Red Hat 8
- Red Hat 7
- Red Hat 6

references:
- https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html
- https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/vuln-detector.html#provider

tags:
- settings
- vulnerability
- vulnerability_detector
- providers
'''
import os

import pytest
Expand Down Expand Up @@ -56,17 +110,36 @@ def get_configuration(request):

@pytest.mark.skip(reason="It will be blocked by #1602, when it was solve we can enable again this test")
def test_providers_no_os(clean_vuln_tables, get_configuration, configure_environment):
"""Check if modulesd downloads the feeds without specifing the os version.

For this purpose, on the one hand, it checks if errors occur when the <os> tag
is omitted in the configuration in providers that should have it and, on the other hand,
if the update of the feeds starts normally in providers that do not require this tag.

Args:
clean_vuln_tables: Clean the tables involved with vulnerability detector packages and feeds.
get_configuration (fixture): Get configurations from the module.
configure_environment (fixture): Configure a custom environment for testing.
"""
'''
description: Check if modulesd downloads the feeds without specifing the os version. To do this, it checks if errors
occur when the <os> tag is omitted in the configuration in providers that should have it and, on the
other hand, if the update of the feeds starts normally in providers that do not require this tag.

wazuh_min_version: 4.2.0

parameters:
- clean_vuln_tables:
type: fixture
brief: Clean the tables involved with vulnerability detector packages and feeds.
- get_configuration:
type: fixture
brief: Get configurations from the module.
- configure_environment:
type: fixture
brief: Configure a custom environment for testing.

assertions:
- Verify that the provider os data update starts when `os` has not a determined value.
- Verify that an error message appears when using `error` tag in providers.

input_description:
- Test cases are found in the test module and include parameters for the `os` tag of the provider option and
`error` tag. The `wazuh_providers_os.yaml` file provides the configuration of this module for this test.

expected_output:
- r'.*: Configuration error at.*'
- r'Starting .* database update'
'''
check_apply_test({'test_providers_no_os'}, get_configuration['tags'])
provider_name = get_configuration['metadata']['provider_name']

Expand Down
Loading