|
1 | 1 | package rhel
|
2 | 2 |
|
3 | 3 | import (
|
4 |
| - "context" |
5 |
| - "encoding/json" |
6 |
| - "fmt" |
7 |
| - "io" |
8 |
| - "net/http" |
9 |
| - "net/http/httptest" |
10 |
| - "os" |
11 |
| - "path/filepath" |
12 | 4 | "testing"
|
13 | 5 |
|
14 |
| - "github.com/quay/zlog" |
15 |
| - |
16 |
| - "github.com/quay/claircore" |
17 |
| - "github.com/quay/claircore/datastore/postgres" |
18 |
| - "github.com/quay/claircore/internal/matcher" |
19 |
| - "github.com/quay/claircore/libvuln/driver" |
20 |
| - "github.com/quay/claircore/libvuln/updates" |
21 |
| - "github.com/quay/claircore/pkg/ctxlock" |
22 |
| - "github.com/quay/claircore/test/integration" |
23 |
| - pgtest "github.com/quay/claircore/test/postgres" |
24 | 6 | "github.com/quay/claircore/toolkit/types/cpe"
|
25 | 7 | )
|
26 | 8 |
|
27 |
| -func TestMain(m *testing.M) { |
28 |
| - var c int |
29 |
| - defer func() { os.Exit(c) }() |
30 |
| - defer integration.DBSetup()() |
31 |
| - c = m.Run() |
32 |
| -} |
33 |
| - |
34 |
| -func serveOVAL(t *testing.T) (string, *http.Client) { |
35 |
| - srv := httptest.NewServer(http.FileServer(http.Dir("testdata"))) |
36 |
| - t.Cleanup(srv.Close) |
37 |
| - return srv.URL, srv.Client() |
38 |
| -} |
39 |
| - |
40 |
| -func TestMatcherIntegration(t *testing.T) { |
41 |
| - t.Parallel() |
42 |
| - integration.NeedDB(t) |
43 |
| - ctx := zlog.Test(context.Background(), t) |
44 |
| - pool := pgtest.TestMatcherDB(ctx, t) |
45 |
| - store := postgres.NewMatcherStore(pool) |
46 |
| - m := &Matcher{} |
47 |
| - fs, err := filepath.Glob("testdata/*.xml") |
48 |
| - if err != nil { |
49 |
| - t.Error(err) |
50 |
| - } |
51 |
| - root, c := serveOVAL(t) |
52 |
| - locks, err := ctxlock.New(ctx, pool) |
53 |
| - if err != nil { |
54 |
| - t.Error(err) |
55 |
| - return |
56 |
| - } |
57 |
| - defer locks.Close(ctx) |
58 |
| - |
59 |
| - facs := make(map[string]driver.UpdaterSetFactory, len(fs)) |
60 |
| - for _, fn := range fs { |
61 |
| - u, err := NewUpdater( |
62 |
| - fmt.Sprintf("test-updater-%s", filepath.Base(fn)), |
63 |
| - 1, |
64 |
| - root+"/"+filepath.Base(fn), |
65 |
| - false, |
66 |
| - ) |
67 |
| - if err != nil { |
68 |
| - t.Error(err) |
69 |
| - continue |
70 |
| - } |
71 |
| - u.Configure(ctx, func(v interface{}) error { return nil }, c) |
72 |
| - if err != nil { |
73 |
| - t.Error(err) |
74 |
| - continue |
75 |
| - } |
76 |
| - s := driver.NewUpdaterSet() |
77 |
| - if err := s.Add(u); err != nil { |
78 |
| - t.Error(err) |
79 |
| - continue |
80 |
| - } |
81 |
| - facs[u.Name()] = driver.StaticSet(s) |
82 |
| - } |
83 |
| - mgr, err := updates.NewManager(ctx, store, locks, c, updates.WithFactories(facs)) |
84 |
| - if err != nil { |
85 |
| - t.Error(err) |
86 |
| - } |
87 |
| - // force update |
88 |
| - if err := mgr.Run(ctx); err != nil { |
89 |
| - t.Error(err) |
90 |
| - } |
91 |
| - |
92 |
| - f, err := os.Open(filepath.Join("testdata", "rhel-report.json")) |
93 |
| - if err != nil { |
94 |
| - t.Fatalf("%v", err) |
95 |
| - } |
96 |
| - defer f.Close() |
97 |
| - var ir claircore.IndexReport |
98 |
| - if err := json.NewDecoder(f).Decode(&ir); err != nil { |
99 |
| - t.Fatalf("failed to decode IndexReport: %v", err) |
100 |
| - } |
101 |
| - vr, err := matcher.Match(ctx, &ir, []driver.Matcher{m}, store) |
102 |
| - if err != nil { |
103 |
| - t.Fatal(err) |
104 |
| - } |
105 |
| - if err := json.NewEncoder(io.Discard).Encode(&vr); err != nil { |
106 |
| - t.Fatalf("failed to marshal VR: %v", err) |
107 |
| - } |
108 |
| -} |
109 |
| - |
110 |
| -type vulnerableTestCase struct { |
111 |
| - ir *claircore.IndexRecord |
112 |
| - v *claircore.Vulnerability |
113 |
| - name string |
114 |
| - want bool |
115 |
| -} |
116 |
| - |
117 |
| -func TestVulnerable(t *testing.T) { |
118 |
| - record := &claircore.IndexRecord{ |
119 |
| - Package: &claircore.Package{ |
120 |
| - Version: "0.33.0-6.el8", |
121 |
| - }, |
122 |
| - Repository: &claircore.Repository{ |
123 |
| - CPE: cpe.MustUnbind("cpe:/o:redhat:enterprise_linux:8::baseos"), |
124 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
125 |
| - Key: "rhel-cpe-repository", |
126 |
| - }, |
127 |
| - } |
128 |
| - openshiftRecord := &claircore.IndexRecord{ |
129 |
| - Package: &claircore.Package{ |
130 |
| - Version: "0.33.0-6.el8", |
131 |
| - }, |
132 |
| - Repository: &claircore.Repository{ |
133 |
| - CPE: cpe.MustUnbind("cpe:/a:redhat:openshift:4.13::el8"), |
134 |
| - Name: "cpe:/a:redhat:openshift:4.13::el8", |
135 |
| - Key: "rhel-cpe-repository", |
136 |
| - }, |
137 |
| - } |
138 |
| - openshift5Record := &claircore.IndexRecord{ |
139 |
| - Package: &claircore.Package{ |
140 |
| - Version: "0.33.0-6.el8", |
141 |
| - }, |
142 |
| - Repository: &claircore.Repository{ |
143 |
| - CPE: cpe.MustUnbind("cpe:/a:redhat:openshift:5.1::el8"), |
144 |
| - Name: "cpe:/a:redhat:openshift:5.1::el8", |
145 |
| - Key: "rhel-cpe-repository", |
146 |
| - }, |
147 |
| - } |
148 |
| - fixedVulnPast := &claircore.Vulnerability{ |
149 |
| - Package: &claircore.Package{ |
150 |
| - Version: "", |
151 |
| - }, |
152 |
| - FixedInVersion: "0.33.0-5.el8", |
153 |
| - Repo: &claircore.Repository{ |
154 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
155 |
| - Key: "rhel-cpe-repository", |
156 |
| - }, |
157 |
| - } |
158 |
| - fixedVulnCurrent := &claircore.Vulnerability{ |
159 |
| - Package: &claircore.Package{ |
160 |
| - Version: "", |
161 |
| - }, |
162 |
| - FixedInVersion: "0.33.0-6.el8", |
163 |
| - Repo: &claircore.Repository{ |
164 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
165 |
| - Key: "rhel-cpe-repository", |
166 |
| - }, |
167 |
| - } |
168 |
| - fixedVulnFuture := &claircore.Vulnerability{ |
169 |
| - Package: &claircore.Package{ |
170 |
| - Version: "", |
171 |
| - }, |
172 |
| - FixedInVersion: "0.33.0-7.el8", |
173 |
| - Repo: &claircore.Repository{ |
174 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
175 |
| - Key: "rhel-cpe-repository", |
176 |
| - }, |
177 |
| - } |
178 |
| - unfixedVuln := &claircore.Vulnerability{ |
179 |
| - Package: &claircore.Package{ |
180 |
| - Version: "", |
181 |
| - }, |
182 |
| - FixedInVersion: "", |
183 |
| - Repo: &claircore.Repository{ |
184 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::baseos", |
185 |
| - Key: "rhel-cpe-repository", |
186 |
| - }, |
187 |
| - } |
188 |
| - unfixedVulnBadCPE := &claircore.Vulnerability{ |
189 |
| - Package: &claircore.Package{ |
190 |
| - Version: "", |
191 |
| - }, |
192 |
| - FixedInVersion: "", |
193 |
| - Repo: &claircore.Repository{ |
194 |
| - Name: "cep:o:redhat:enterprise_linux:8::baseos", |
195 |
| - Key: "rhel-cpe-repository", |
196 |
| - }, |
197 |
| - } |
198 |
| - unfixedVulnRepoIsSubset := &claircore.Vulnerability{ |
199 |
| - Package: &claircore.Package{ |
200 |
| - Version: "", |
201 |
| - }, |
202 |
| - FixedInVersion: "", |
203 |
| - Repo: &claircore.Repository{ |
204 |
| - Name: "cpe:/o:redhat:enterprise_linux:8", |
205 |
| - Key: "rhel-cpe-repository", |
206 |
| - }, |
207 |
| - } |
208 |
| - unfixedVulnRepoNotSubset := &claircore.Vulnerability{ |
209 |
| - Package: &claircore.Package{ |
210 |
| - Version: "", |
211 |
| - }, |
212 |
| - FixedInVersion: "", |
213 |
| - Repo: &claircore.Repository{ |
214 |
| - Name: "cpe:/o:redhat:enterprise_linux:8::appstream", |
215 |
| - Key: "rhel-cpe-repository", |
216 |
| - }, |
217 |
| - } |
218 |
| - unfixedVulnRepoSubstring := &claircore.Vulnerability{ |
219 |
| - Package: &claircore.Package{ |
220 |
| - Version: "", |
221 |
| - }, |
222 |
| - FixedInVersion: "", |
223 |
| - Repo: &claircore.Repository{ |
224 |
| - Name: "cpe:/a:redhat:openshift:4", |
225 |
| - Key: "rhel-cpe-repository", |
226 |
| - }, |
227 |
| - } |
228 |
| - genericWilcardRepo := &claircore.Vulnerability{ |
229 |
| - Package: &claircore.Package{ |
230 |
| - Version: "", |
231 |
| - }, |
232 |
| - FixedInVersion: "", |
233 |
| - Repo: &claircore.Repository{ |
234 |
| - Name: "cpe:/a:redhat:openshift:4.%02::el8", |
235 |
| - Key: "rhel-cpe-repository", |
236 |
| - }, |
237 |
| - } |
238 |
| - |
239 |
| - testCases := []vulnerableTestCase{ |
240 |
| - {ir: record, v: fixedVulnPast, want: false, name: "vuln fixed in past version"}, |
241 |
| - {ir: record, v: fixedVulnCurrent, want: false, name: "vuln fixed in current version"}, |
242 |
| - {ir: record, v: fixedVulnFuture, want: true, name: "outdated package"}, |
243 |
| - {ir: record, v: unfixedVuln, want: true, name: "unfixed vuln"}, |
244 |
| - {ir: record, v: unfixedVulnBadCPE, want: false, name: "unfixed vuln, invalid CPE"}, |
245 |
| - {ir: record, v: unfixedVulnRepoIsSubset, want: true, name: "unfixed vuln, Repo is a subset"}, |
246 |
| - {ir: record, v: unfixedVulnRepoNotSubset, want: false, name: "unfixed vuln, Repo not a subset"}, |
247 |
| - {ir: openshiftRecord, v: unfixedVulnRepoSubstring, want: true, name: "unfixed vuln, Repo is a substring match"}, |
248 |
| - {ir: openshiftRecord, v: genericWilcardRepo, want: true, name: "unfixed vuln, Repo is a superset (with wildcard)"}, |
249 |
| - {ir: openshift5Record, v: genericWilcardRepo, want: false, name: "unfixed vuln, Repo isn't a superset (with wildcard)"}, |
250 |
| - } |
251 |
| - |
252 |
| - m := &Matcher{} |
253 |
| - ctx := context.Background() |
254 |
| - ctx = zlog.Test(ctx, t) |
255 |
| - for _, tc := range testCases { |
256 |
| - got, err := m.Vulnerable(ctx, tc.ir, tc.v) |
257 |
| - if err != nil { |
258 |
| - t.Error(err) |
259 |
| - } |
260 |
| - if tc.want != got { |
261 |
| - t.Errorf("%q failed: want %t, got %t", tc.name, tc.want, got) |
262 |
| - } |
263 |
| - } |
264 |
| -} |
265 |
| - |
266 | 9 | func TestIsCPEStringSubsetMatch(t *testing.T) {
|
267 | 10 | t.Parallel()
|
268 | 11 |
|
|
0 commit comments