|
1 | 1 | package rhel |
2 | 2 |
|
3 | 3 | import ( |
4 | | - "context" |
5 | | - "encoding/json" |
6 | | - "fmt" |
7 | | - "io" |
8 | | - "net/http" |
9 | | - "net/http/httptest" |
10 | | - "os" |
11 | | - "path/filepath" |
12 | 4 | "testing" |
13 | 5 |
|
14 | | - "github.com/quay/zlog" |
15 | | - |
16 | | - "github.com/quay/claircore" |
17 | | - "github.com/quay/claircore/datastore/postgres" |
18 | | - "github.com/quay/claircore/internal/matcher" |
19 | | - "github.com/quay/claircore/libvuln/driver" |
20 | | - "github.com/quay/claircore/libvuln/updates" |
21 | | - "github.com/quay/claircore/pkg/ctxlock" |
22 | | - "github.com/quay/claircore/test/integration" |
23 | | - pgtest "github.com/quay/claircore/test/postgres" |
24 | 6 | "github.com/quay/claircore/toolkit/types/cpe" |
25 | 7 | ) |
26 | 8 |
|
27 | | -func TestMain(m *testing.M) { |
28 | | - var c int |
29 | | - defer func() { os.Exit(c) }() |
30 | | - defer integration.DBSetup()() |
31 | | - c = m.Run() |
32 | | -} |
33 | | - |
34 | | -func serveOVAL(t *testing.T) (string, *http.Client) { |
35 | | - srv := httptest.NewServer(http.FileServer(http.Dir("testdata"))) |
36 | | - t.Cleanup(srv.Close) |
37 | | - return srv.URL, srv.Client() |
38 | | -} |
39 | | - |
40 | | -func TestMatcherIntegration(t *testing.T) { |
41 | | - t.Parallel() |
42 | | - integration.NeedDB(t) |
43 | | - ctx := zlog.Test(context.Background(), t) |
44 | | - pool := pgtest.TestMatcherDB(ctx, t) |
45 | | - store := postgres.NewMatcherStore(pool) |
46 | | - m := &Matcher{} |
47 | | - fs, err := filepath.Glob("testdata/*.xml") |
48 | | - if err != nil { |
49 | | - t.Error(err) |
50 | | - } |
51 | | - root, c := serveOVAL(t) |
52 | | - locks, err := ctxlock.New(ctx, pool) |
53 | | - if err != nil { |
54 | | - t.Error(err) |
55 | | - return |
56 | | - } |
57 | | - defer locks.Close(ctx) |
58 | | - |
59 | | - facs := make(map[string]driver.UpdaterSetFactory, len(fs)) |
60 | | - for _, fn := range fs { |
61 | | - u, err := NewUpdater( |
62 | | - fmt.Sprintf("test-updater-%s", filepath.Base(fn)), |
63 | | - 1, |
64 | | - root+"/"+filepath.Base(fn), |
65 | | - false, |
66 | | - ) |
67 | | - if err != nil { |
68 | | - t.Error(err) |
69 | | - continue |
70 | | - } |
71 | | - u.Configure(ctx, func(v interface{}) error { return nil }, c) |
72 | | - if err != nil { |
73 | | - t.Error(err) |
74 | | - continue |
75 | | - } |
76 | | - s := driver.NewUpdaterSet() |
77 | | - if err := s.Add(u); err != nil { |
78 | | - t.Error(err) |
79 | | - continue |
80 | | - } |
81 | | - facs[u.Name()] = driver.StaticSet(s) |
82 | | - } |
83 | | - mgr, err := updates.NewManager(ctx, store, locks, c, updates.WithFactories(facs)) |
84 | | - if err != nil { |
85 | | - t.Error(err) |
86 | | - } |
87 | | - // force update |
88 | | - if err := mgr.Run(ctx); err != nil { |
89 | | - t.Error(err) |
90 | | - } |
91 | | - |
92 | | - f, err := os.Open(filepath.Join("testdata", "rhel-report.json")) |
93 | | - if err != nil { |
94 | | - t.Fatalf("%v", err) |
95 | | - } |
96 | | - defer f.Close() |
97 | | - var ir claircore.IndexReport |
98 | | - if err := json.NewDecoder(f).Decode(&ir); err != nil { |
99 | | - t.Fatalf("failed to decode IndexReport: %v", err) |
100 | | - } |
101 | | - vr, err := matcher.Match(ctx, &ir, []driver.Matcher{m}, store) |
102 | | - if err != nil { |
103 | | - t.Fatal(err) |
104 | | - } |
105 | | - if err := json.NewEncoder(io.Discard).Encode(&vr); err != nil { |
106 | | - t.Fatalf("failed to marshal VR: %v", err) |
107 | | - } |
108 | | -} |
109 | | - |
110 | | -type vulnerableTestCase struct { |
111 | | - ir *claircore.IndexRecord |
112 | | - v *claircore.Vulnerability |
113 | | - name string |
114 | | - want bool |
115 | | -} |
116 | | - |
117 | | -func TestVulnerable(t *testing.T) { |
118 | | - record := &claircore.IndexRecord{ |
119 | | - Package: &claircore.Package{ |
120 | | - Version: "0.33.0-6.el8", |
121 | | - }, |
122 | | - Repository: &claircore.Repository{ |
123 | | - CPE: cpe.MustUnbind("cpe:/o:redhat:enterprise_linux:8::baseos"), |
124 | | - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
125 | | - Key: "rhel-cpe-repository", |
126 | | - }, |
127 | | - } |
128 | | - openshiftRecord := &claircore.IndexRecord{ |
129 | | - Package: &claircore.Package{ |
130 | | - Version: "0.33.0-6.el8", |
131 | | - }, |
132 | | - Repository: &claircore.Repository{ |
133 | | - CPE: cpe.MustUnbind("cpe:/a:redhat:openshift:4.13::el8"), |
134 | | - Name: "cpe:/a:redhat:openshift:4.13::el8", |
135 | | - Key: "rhel-cpe-repository", |
136 | | - }, |
137 | | - } |
138 | | - openshift5Record := &claircore.IndexRecord{ |
139 | | - Package: &claircore.Package{ |
140 | | - Version: "0.33.0-6.el8", |
141 | | - }, |
142 | | - Repository: &claircore.Repository{ |
143 | | - CPE: cpe.MustUnbind("cpe:/a:redhat:openshift:5.1::el8"), |
144 | | - Name: "cpe:/a:redhat:openshift:5.1::el8", |
145 | | - Key: "rhel-cpe-repository", |
146 | | - }, |
147 | | - } |
148 | | - fixedVulnPast := &claircore.Vulnerability{ |
149 | | - Package: &claircore.Package{ |
150 | | - Version: "", |
151 | | - }, |
152 | | - FixedInVersion: "0.33.0-5.el8", |
153 | | - Repo: &claircore.Repository{ |
154 | | - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
155 | | - Key: "rhel-cpe-repository", |
156 | | - }, |
157 | | - } |
158 | | - fixedVulnCurrent := &claircore.Vulnerability{ |
159 | | - Package: &claircore.Package{ |
160 | | - Version: "", |
161 | | - }, |
162 | | - FixedInVersion: "0.33.0-6.el8", |
163 | | - Repo: &claircore.Repository{ |
164 | | - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
165 | | - Key: "rhel-cpe-repository", |
166 | | - }, |
167 | | - } |
168 | | - fixedVulnFuture := &claircore.Vulnerability{ |
169 | | - Package: &claircore.Package{ |
170 | | - Version: "", |
171 | | - }, |
172 | | - FixedInVersion: "0.33.0-7.el8", |
173 | | - Repo: &claircore.Repository{ |
174 | | - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
175 | | - Key: "rhel-cpe-repository", |
176 | | - }, |
177 | | - } |
178 | | - unfixedVuln := &claircore.Vulnerability{ |
179 | | - Package: &claircore.Package{ |
180 | | - Version: "", |
181 | | - }, |
182 | | - FixedInVersion: "", |
183 | | - Repo: &claircore.Repository{ |
184 | | - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
185 | | - Key: "rhel-cpe-repository", |
186 | | - }, |
187 | | - } |
188 | | - unfixedVulnBadCPE := &claircore.Vulnerability{ |
189 | | - Package: &claircore.Package{ |
190 | | - Version: "", |
191 | | - }, |
192 | | - FixedInVersion: "", |
193 | | - Repo: &claircore.Repository{ |
194 | | - Name: "cep:o:redhat:enterprise_linux:8::baseos", |
195 | | - Key: "rhel-cpe-repository", |
196 | | - }, |
197 | | - } |
198 | | - unfixedVulnRepoIsSubset := &claircore.Vulnerability{ |
199 | | - Package: &claircore.Package{ |
200 | | - Version: "", |
201 | | - }, |
202 | | - FixedInVersion: "", |
203 | | - Repo: &claircore.Repository{ |
204 | | - Name: "cpe:/o:redhat:enterprise_linux:8", |
205 | | - Key: "rhel-cpe-repository", |
206 | | - }, |
207 | | - } |
208 | | - unfixedVulnRepoNotSubset := &claircore.Vulnerability{ |
209 | | - Package: &claircore.Package{ |
210 | | - Version: "", |
211 | | - }, |
212 | | - FixedInVersion: "", |
213 | | - Repo: &claircore.Repository{ |
214 | | - Name: "cpe:/o:redhat:enterprise_linux:8::appstream", |
215 | | - Key: "rhel-cpe-repository", |
216 | | - }, |
217 | | - } |
218 | | - unfixedVulnRepoSubstring := &claircore.Vulnerability{ |
219 | | - Package: &claircore.Package{ |
220 | | - Version: "", |
221 | | - }, |
222 | | - FixedInVersion: "", |
223 | | - Repo: &claircore.Repository{ |
224 | | - Name: "cpe:/a:redhat:openshift:4", |
225 | | - Key: "rhel-cpe-repository", |
226 | | - }, |
227 | | - } |
228 | | - genericWilcardRepo := &claircore.Vulnerability{ |
229 | | - Package: &claircore.Package{ |
230 | | - Version: "", |
231 | | - }, |
232 | | - FixedInVersion: "", |
233 | | - Repo: &claircore.Repository{ |
234 | | - Name: "cpe:/a:redhat:openshift:4.%02::el8", |
235 | | - Key: "rhel-cpe-repository", |
236 | | - }, |
237 | | - } |
238 | | - |
239 | | - testCases := []vulnerableTestCase{ |
240 | | - {ir: record, v: fixedVulnPast, want: false, name: "vuln fixed in past version"}, |
241 | | - {ir: record, v: fixedVulnCurrent, want: false, name: "vuln fixed in current version"}, |
242 | | - {ir: record, v: fixedVulnFuture, want: true, name: "outdated package"}, |
243 | | - {ir: record, v: unfixedVuln, want: true, name: "unfixed vuln"}, |
244 | | - {ir: record, v: unfixedVulnBadCPE, want: false, name: "unfixed vuln, invalid CPE"}, |
245 | | - {ir: record, v: unfixedVulnRepoIsSubset, want: true, name: "unfixed vuln, Repo is a subset"}, |
246 | | - {ir: record, v: unfixedVulnRepoNotSubset, want: false, name: "unfixed vuln, Repo not a subset"}, |
247 | | - {ir: openshiftRecord, v: unfixedVulnRepoSubstring, want: true, name: "unfixed vuln, Repo is a substring match"}, |
248 | | - {ir: openshiftRecord, v: genericWilcardRepo, want: true, name: "unfixed vuln, Repo is a superset (with wildcard)"}, |
249 | | - {ir: openshift5Record, v: genericWilcardRepo, want: false, name: "unfixed vuln, Repo isn't a superset (with wildcard)"}, |
250 | | - } |
251 | | - |
252 | | - m := &Matcher{} |
253 | | - ctx := context.Background() |
254 | | - ctx = zlog.Test(ctx, t) |
255 | | - for _, tc := range testCases { |
256 | | - got, err := m.Vulnerable(ctx, tc.ir, tc.v) |
257 | | - if err != nil { |
258 | | - t.Error(err) |
259 | | - } |
260 | | - if tc.want != got { |
261 | | - t.Errorf("%q failed: want %t, got %t", tc.name, tc.want, got) |
262 | | - } |
263 | | - } |
264 | | -} |
265 | | - |
266 | 9 | func TestIsCPEStringSubsetMatch(t *testing.T) { |
267 | 10 | t.Parallel() |
268 | 11 |
|
|
0 commit comments