R2.html

configuration = {'metadata': {'description': 'Canonical provider', 'download_timeout': 120, 'name': 'BIONIC', 'provider_name': 'Ubuntu...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Canonical provider', 'download_timeout': 120, 'name': 'BIONIC', 'provider_name': 'Ubuntu Bionic', ...}
set_wazuh_configuration_vdt = None, truncate_monitored_files = None
clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
try:
# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
> timeout=metadata['download_timeout'])

test_vulnerability_detector/test_feeds/test_download_feeds.py:135:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

log_monitor = None, provider_name = 'Ubuntu Bionic', timeout = 120

def check_provider_database_update_finish_log(log_monitor=None, provider_name='', timeout=vd.T_20):
"""Check the provider database update finish event in ossec.log

Args:
log_monitor (FileMonitor): Log monitor.
provider_name (str): Provider name of the downloaded feed.
timeout (int): Timeout of the event.
"""
check_vuln_detector_event(file_monitor=log_monitor, timeout=timeout,
callback=f"The update of the '{provider_name}' feed finished",
> error_message=f"Could not find {provider_name} feed finished log")

/usr/local/lib/python3.6/site-packages/wazuh_testing/modules/vulnerability_detector/event_monitor.py:146:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

file_monitor = <wazuh_testing.tools.monitoring.FileMonitor object at 0x7f343aa7f710>
callback = "The update of the 'Ubuntu Bionic' feed finished"
error_message = 'Could not find Ubuntu Bionic feed finished log', update_position = True
timeout = 120, prefix = '.*wazuh-modulesd:vulnerability-detector.*', accum_results = 1
file_to_monitor = '/var/ossec/logs/ossec.log'

def check_vuln_detector_event(file_monitor=None, callback='', error_message=None, update_position=True,
timeout=vd.T_60, prefix=vd.VULNERABILITY_DETECTOR_PREFIX, accum_results=1,
file_to_monitor=LOG_FILE_PATH):
"""Check if a vulnerability event occurs

Args:
file_monitor (FileMonitor): FileMonitor object to monitor the file content.
callback (str): log regex to check in Wazuh log
error_message (str): error message to show in case of expected event does not occur
update_position (boolean): filter configuration parameter to search in Wazuh log
timeout (str): timeout to check the event in Wazuh log
prefix (str): log pattern regex
accum_results (int): Accumulation of matches.
"""
file_monitor = FileMonitor(file_to_monitor) if file_monitor is None else file_monitor
error_message = f"Could not find this event in {file_to_monitor}: {callback}" if error_message is None else \
error_message

file_monitor.start(timeout=timeout, update_position=update_position, accum_results=accum_results,
> callback=make_vuln_callback(callback, prefix), error_message=error_message)

/usr/local/lib/python3.6/site-packages/wazuh_testing/modules/vulnerability_detector/event_monitor.py:55:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <wazuh_testing.tools.monitoring.FileMonitor object at 0x7f343aa7f710>
timeout = 120
callback = <function make_vuln_callback.<locals>.<lambda> at 0x7f343eb3a8c8>
accum_results = 1, update_position = True, timeout_extra = 0
error_message = 'Could not find Ubuntu Bionic feed finished log', encoding = None

def start(self, timeout=-1, callback=_callback_default, accum_results=1, update_position=True, timeout_extra=0,
error_message='', encoding=None):
"""Start the file monitoring until the stop method is called."""
try:
tailer = self.tailer if update_position else copy(self.tailer)

if encoding is not None:
tailer.encoding = encoding
tailer.start()

monitor = QueueMonitor(tailer.queue, time_step=self._time_step)
self._result = monitor.start(timeout=timeout, callback=callback, accum_results=accum_results,
update_position=True, timeout_extra=timeout_extra,
> error_message=error_message).result()

/usr/local/lib/python3.6/site-packages/wazuh_testing/tools/monitoring.py:203:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <wazuh_testing.tools.monitoring.QueueMonitor object at 0x7f343aa7ac50>
timeout = 120
callback = <function make_vuln_callback.<locals>.<lambda> at 0x7f343eb3a8c8>
accum_results = 1, update_position = True, timeout_extra = 0
error_message = 'Could not find Ubuntu Bionic feed finished log'

def start(self, timeout=-1, callback=_callback_default, accum_results=1, update_position=True, timeout_extra=0,
error_message=''):
"""Start the queue monitoring until the stop method is called."""
if not self._continue:
self._continue = True
self._abort = False
result = None

while self._continue:
if self._abort:
self.stop()
if error_message:
logger.error(error_message)
logger.error(f"Results accumulated: "
f"{len(result) if isinstance(result, list) else 0}")
logger.error(f"Results expected: {accum_results}")
> raise TimeoutError(error_message)
E TimeoutError: Could not find Ubuntu Bionic feed finished log

/usr/local/lib/python3.6/site-packages/wazuh_testing/tools/monitoring.py:469: TimeoutError

During handling of the above exception, another exception occurred:

configuration = {'metadata': {'description': 'Canonical provider', 'download_timeout': 120, 'name': 'BIONIC', 'provider_name': 'Ubuntu...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Canonical provider', 'download_timeout': 120, 'name': 'BIONIC', 'provider_name': 'Ubuntu Bionic', ...}
set_wazuh_configuration_vdt = None, truncate_monitored_files = None
clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
try:
# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
timeout=metadata['download_timeout'])

if 'provider_json_name' in metadata:
evm.check_provider_database_update_start_log(metadata['provider_json_name'])
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_json_name'],
timeout=metadata['download_timeout'])

# Check that the timestamp of the feed metadata does not exceed the established threshold limit.
if metadata['update_treshold_weeks'] != 'None':
assert vd.feed_is_recently_updated(provider_name=metadata['provider_name'],
provider_os=metadata['provider_os'],
threshold_weeks=metadata['update_treshold_weeks']), '' \
f"The {metadata['provider_os']} feed has not been recently updated"
except TimeoutError as e:
if metadata['provider_os'] == 'BIONIC':
> pytest.xfail(reason='Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556')
E _pytest.outcomes.XFailed: Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556

test_vulnerability_detector/test_feeds/test_download_feeds.py:150: XFailed
-----------------------------Captured stderr setup------------------------------
2022/05/24 01:40:02 wazuh-modulesd[60134] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2022/05/24 01:40:02 wazuh-modulesd[60134] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2022/05/24 01:40:02 wazuh-modulesd[60134] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2022/05/24 01:40:02 wazuh-modulesd[60134] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2022/05/24 01:40:02 wazuh-modulesd[60134] wmodules-vuln-detector.c:655 at wm_vuldet_read_provider(): DEBUG: Added canonical (bionic) feed. Interval: 3600s | Path: 'none' | Url: 'none' | Timeout: 300s
------------------------------Captured stderr call------------------------------
2022-05-24 01:42:04,130 - wazuh_testing - ERROR - Could not find Ubuntu Bionic feed finished log 2022-05-24 01:42:04,131 - wazuh_testing - ERROR - Results accumulated: 0 2022-05-24 01:42:04,131 - wazuh_testing - ERROR - Results expected: 1
-------------------------------Captured log call--------------------------------
ERROR wazuh_testing:monitoring.py:465 Could not find Ubuntu Bionic feed finished log ERROR wazuh_testing:monitoring.py:466 Results accumulated: 0 ERROR wazuh_testing:monitoring.py:468 Results expected: 1

configuration = {'sections': [{'elements': [{'enabled': {'value': 'yes'}}, {'run_on_start': {'value': 'yes'}}, {'provider': {'attribut...check'}, {'attributes': [{'name': 'syscollector'}], 'elements': [{'disabled': {'value': 'yes'}}], 'section': 'wodle'}]}
metadata = {'custom_feed_url': 'https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/dummy_files/dummy.mp3', 'description': 'Ch...and parsing of JPG file as invalid feed in the NVD', 'name': 'NVD - MP3', 'provider_feed_names': ['nvd provider'], ...}
set_wazuh_configuration_vdt = None, truncate_monitored_files = None
clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_import_invalid_feed_type(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check the vulnerability detector behavior when importing unexpected file types as feeds.

test_phases:
- Set a custom Wazuh configuration, with custom URL feeds which refer to files of unexpected type.
- Check the error when updating the provider data.
- Check the error when updating the CVE database.
- Check that no junk data has been inserted into the database.
- Check that wazuh-modulesd is running (it has not crashed after parsing unexpected file types).

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Configuration loaded from `configuration_template`.
- metadata:
type: dict
brief: Test case metadata.
- set_wazuh_configuration_vdt:
type: fixture
brief: Set wazuh configuration.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all CVE tables.
- restart_modulesd_function:
type: fixture
brief: Restart wazuh-modulesd daemon before starting a test, and stop it after finishing.

assertions:
- Check the error when updating the provider database.
- Check the error when updating the CVE database.
- Check that no junk data has been inserted into the database.
- Check that wazuh-modulesd is running (it has not crashed after parsing unexpected file types).

input_description:
- The `configuration_import_invalid_feed_type.yaml` file provides the module configuration for this test.
- The `cases_import_invalid_feed_type` file provides the test cases.

expected_output:
- r"Failed when updating '{provider_feed_name}' database"
- r"ERROR: .* CVE database could not be updated."
'''
if metadata['target'] == 'nvd':
> pytest.xfail(reason='no error reported when importing invalid NVD feed. '
'https://github.com/wazuh/wazuh/issues/5210')
E _pytest.outcomes.XFailed: no error reported when importing invalid NVD feed. https://github.com/wazuh/wazuh/issues/5210

test_vulnerability_detector/test_feeds/test_import_invalid_feed_type.py:138: XFailed
-----------------------------Captured stderr setup------------------------------
2022/05/24 02:09:40 wazuh-modulesd[65269] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2022/05/24 02:09:40 wazuh-modulesd[65269] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2022/05/24 02:09:40 wazuh-modulesd[65269] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2022/05/24 02:09:40 wazuh-modulesd[65269] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2022/05/24 02:09:40 wazuh-modulesd[65269] wmodules-vuln-detector.c:713 at wm_vuldet_read_provider(): DEBUG: Added nvd feed. Interval: 86400s | Multi path: 'none' | Multi url: 'https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/dummy_files/dummy.mp3' | Update since: 2010 | Timeout: 300s