Skip to content

Commit c919f6d

Browse files
marleystipich2marleystipich2
authored
RHICOMPL-2833: Parse selected groups and selected rules separately in Profile (#37)
1 parent 413441e commit c919f6d

File tree

4 files changed

+90
-8
lines changed

4 files changed

+90
-8
lines changed

‎lib/openscap_parser/profile.rb‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
require 'openscap_parser/regex_handler'
2+
13
module OpenscapParser
24
class Profile < XmlNode
35
def id
@@ -20,7 +22,27 @@ def description
2022
end
2123

2224
def selected_rule_ids
23-
@selected_rule_ids ||= @parsed_xml.xpath("select[@selected='true']/@idref") &&
25+
# Look for selected rule ids where the idref contains '_rule_' that is not preceded by 'group'
26+
@selected_rule_ids ||= @parsed_xml.xpath("select[@selected='true']
27+
[regex(@idref, '^((?!_group_).)*?(_rule_).*$')]
28+
/@idref", RegexHandler) &&
29+
@parsed_xml.xpath("select[@selected='true']
30+
[regex(@idref, '^((?!_group_).)*?(_rule_).*$')]
31+
/@idref", RegexHandler).map(&:text)
32+
end
33+
34+
def selected_group_ids
35+
# Look for selected group ids where the idref contains '_group_' that is not preceded by 'rule'
36+
@selected_group_ids ||= @parsed_xml.xpath("select[@selected='true']
37+
[regex(@idref, '^((?!_rule_).)*?(_group_).*$')]
38+
/@idref", RegexHandler) &&
39+
@parsed_xml.xpath("select[@selected='true']
40+
[regex(@idref, '^((?!_rule_).)*?(_group_).*$')]
41+
/@idref", RegexHandler).map(&:text)
42+
end
43+
44+
def selected_entity_ids
45+
@selected_entity_ids ||= @parsed_xml.xpath("select[@selected='true']/@idref") &&
2446
@parsed_xml.xpath("select[@selected='true']/@idref").map(&:text)
2547
end
2648

‎lib/openscap_parser/regex_handler.rb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# frozen_string_literal: true
2+
3+
module OpenscapParser
4+
class RegexHandler < XmlNode
5+
def self.regex node_set, regex
6+
node_set.find_all { |node| node.to_s =~ /#{regex}/ }
7+
end
8+
end
9+
end

‎test/fixtures/files/xccdf_report_with_conflicts_and_requires.xml‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -298,9 +298,13 @@ CIS' terms and conditions, specifically Restrictions(8), note
298298
there is no representation or claim that the C2S profile will
299299
ensure a system is in compliance or consistency with the CIS
300300
baseline.</description>
301+
<select idref="xccdf_org.ssgproject.contentgroup_rule_account_disable_post_pw_expiration" selected="true"/>
302+
<select idref="xccdf_org.ssgproject_groups.content_rule_account_disable_post_pw_expiration" selected="true"/>
303+
<select idref="xccdf_org.ssgproject.groups_rule_account_disable_post_pw_expiration" selected="true"/>
301304
<select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
302305
<select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
303306
<select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
307+
<select idref="xccdf_org.ssgproject.content_rule_group_rule_accounts_minimum_age_login_defs" selected="true"/>
304308
<select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
305309
<select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
306310
<select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
@@ -528,15 +532,20 @@ baseline.</description>
528532
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
529533
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
530534
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
531-
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
535+
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_group_ipv6_conf_all_accept_redirects" selected="true"/>
532536
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" selected="true"/>
533537
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
534-
<select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
538+
<select idref="xccdf_org.ssgproject.content_rule_group_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
539+
<select idref="xccdf_org.ssgproject.rules_group_crypto" selected="true"/>
540+
<select idref="xccdf_org.ssgproject_rules.content_group_crypto" selected="true"/>
541+
<select idref="xccdf_org.ssgproject.contentrule_group_crypto" selected="true"/>
542+
<select idref="xccdf_org.ssgproject.content_group_rule_crypto" selected="true"/>
543+
<select idref="xccdf_org.ssgproject.content_group_rule_group_crypto" selected="true"/>
535544
<select idref="xccdf_org.ssgproject.content_group_rpm_verification" selected="false"/>
536545
<select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
537546
<select idref="xccdf_org.ssgproject.content_group_crypto" selected="false"/>
538547
<select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
539-
<select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
548+
<select idref="xccdf_org.ssgproject.content_group_endpoint_rule_security_software" selected="true"/>
540549
<select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
541550
<select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
542551
<select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
@@ -643,10 +652,10 @@ baseline.</description>
643652
<select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
644653
<select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
645654
<select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
646-
<select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
647-
<select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
648-
<select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
649-
<select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
655+
<select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="true"/>
656+
<select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="true"/>
657+
<select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="true"/>
658+
<select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="true"/>
650659
<select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
651660
<select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
652661
<select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>

‎test/openscap_parser/test_result_file_test.rb‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,43 +29,85 @@ def setup
2929
end
3030

3131
context 'profiles' do
32+
test 'profile_id' do
33+
assert_match(/^xccdf_org.ssgproject.content_profile_C2S/,
34+
@test_result_file2.benchmark.profiles.first.id)
35+
end
36+
37+
test 'profile_selected_rule_ids' do
38+
assert_equal(238, @test_result_file2.benchmark.profiles.first.selected_rule_ids.length)
39+
refute_includes(@test_result_file2.benchmark.profiles.first.selected_rule_ids, "xccdf_org.ssgproject.rules_group_crypto")
40+
refute_includes(@test_result_file2.benchmark.profiles.first.selected_rule_ids, "xccdf_org.ssgproject.content_group_rule_crypto")
41+
refute_includes(@test_result_file2.benchmark.profiles.first.selected_rule_ids, "xccdf_org.ssgproject.contentrule_group_crypto")
42+
refute_includes(@test_result_file2.benchmark.profiles.first.selected_rule_ids, "xccdf_org.ssgproject.content_group_rule_group_crypto")
43+
end
44+
45+
test 'profile_selected_group_ids' do
46+
assert_equal(["xccdf_org.ssgproject.rules_group_crypto",
47+
"xccdf_org.ssgproject_rules.content_group_crypto",
48+
"xccdf_org.ssgproject.contentrule_group_crypto",
49+
"xccdf_org.ssgproject.content_group_rule_crypto",
50+
"xccdf_org.ssgproject.content_group_rule_group_crypto",
51+
"xccdf_org.ssgproject.content_group_endpoint_rule_security_software",
52+
"xccdf_org.ssgproject.content_group_nfs_configuring_all_machines",
53+
"xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both",
54+
"xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports",
55+
"xccdf_org.ssgproject.content_group_mounting_remote_filesystems"],
56+
@test_result_file2.benchmark.profiles.first.selected_group_ids)
57+
end
58+
59+
test 'profile_selected_entity_ids' do
60+
all_selected_ids = @test_result_file2.benchmark.profiles.first.selected_rule_ids +
61+
@test_result_file2.benchmark.profiles.first.selected_group_ids
62+
assert_equal(248, @test_result_file2.benchmark.profiles.first.selected_entity_ids.length)
63+
assert_equal(all_selected_ids.sort, @test_result_file2.benchmark.profiles.first.selected_entity_ids.sort)
64+
end
3265
end
3366

3467
context 'groups' do
3568
test 'group_id' do
3669
assert_match(/^xccdf_org.ssgproject.content_group_system/,
3770
@test_result_file2.benchmark.groups.first.id)
3871
end
72+
3973
test 'group_no_conflicts' do
4074
assert_equal([], @test_result_file2.benchmark.groups.first.conflicts)
4175
end
76+
4277
test 'group_with_conflicts' do
4378
assert_equal(["xccdf_org.ssgproject.content_rule_selinux_state",
4479
"xccdf_org.ssgproject.content_group_mcafee_security_software"],
4580
@test_result_file2.benchmark.groups[1].conflicts)
4681
end
82+
4783
test 'group_no_requires' do
4884
assert_equal([], @test_result_file2.benchmark.groups[1].requires)
4985
end
86+
5087
test 'group_with_requires' do
5188
assert_equal(['A', 'B', 'C'], @test_result_file2.benchmark.groups.first.requires)
5289
end
90+
5391
test 'group_description' do
5492
assert_match(/^Contains rules that check correct system settings./,
5593
@test_result_file2.benchmark.groups.first.description)
5694
end
95+
5796
test 'group_parent_id_benchmark' do
5897
assert_match(/^xccdf_org.ssgproject.content_benchmark_RHEL-7/,
5998
@test_result_file2.benchmark.groups.first.parent_id)
6099
end
100+
61101
test 'group_parent_id_group' do
62102
assert_match(/^xccdf_org.ssgproject.content_group_system/,
63103
@test_result_file2.benchmark.groups[1].parent_id)
64104
end
105+
65106
test 'group_parent_type_with_benchmark_parent' do
66107
assert_match(/^Benchmark/,
67108
@test_result_file2.benchmark.groups.first.parent_type)
68109
end
110+
69111
test 'group_parent_type_with_group_parent' do
70112
assert_match(/^Group/,
71113
@test_result_file2.benchmark.groups[1].parent_type)

0 commit comments

Comments
 (0)