foreman_openscap 0.6.4 → 0.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7e87dce0b8251a238c5e9893119aa4a98db7a3a0
-  data.tar.gz: ed41c816b9194e86b8c6a7a4fc627e0a205a9680
+  metadata.gz: af14c957ab312cad9a1af665492c7684fbd4483f
+  data.tar.gz: 7085d5dd248a19fa3c746cc37756630bba065429
 SHA512:
-  metadata.gz: eeea587bb391f44a7f1d1a645c9060850e9a408df25f141d671f7ab48c8fb3e0d298ab02ee795f17661e56d1cea8f2085052dc2faefedf256ef112c4a0346d42
-  data.tar.gz: 37deb96efe064794ae14ba33876509598baaf5a3c73a32604134f074492144ee4656010da49c21770dee01c1d26511fb54847574b6d5e70d73ff063497d79acf
+  metadata.gz: bae574807e8c53cffa7e3cf1273aacf1c01c102c89cd2a5b9128042b394fb05ad60cfe6a55f7fdfcb6ef5e1c5ef621e9c8f048ab51e7047676c4cffbb362ffcc
+  data.tar.gz: db89e1a4e868dca5482d468985cac76eba3935b9bdebc9f1e16c3eac1f30dfa4e02c59373113950d559c1cbe0d5a332f8ac0dcf55f45426573931993d6c145d3

data/app/controllers/api/v2/compliance/arf_reports_controller.rb

@@ -7,11 +7,12 @@ module Api
       class ArfReportsController < V2::BaseController
         include Api::Version2
         include Foreman::Controller::SmartProxyAuth
+        include ForemanOpenscap::ArfReportsControllerCommonExtensions
 
         add_smart_proxy_filters :create, :features => 'Openscap'
 
-        before_filter :find_resource, :only => %w(show destroy download)
-        skip_after_filter :log_response_body, :only => %w(download)
+        before_filter :find_resource, :only => %w(show destroy download download_html)
+        skip_after_filter :log_response_body, :only => %w(download download_html)
 
         def resource_name
           '::ForemanOpenscap::ArfReport'
@@ -58,9 +59,19 @@ module Api
 
         def download
           response = @arf_report.to_bzip
-          send_data response, :filename => "#{@arf_report.id}_arf_report.bz2"
+          send_data response, :filename => "#{format_filename}.xml.bz2"
         rescue => e
-          render_error 'standard_error', :status => :internal_error, :locals => { :exception => e }
+          handle_download_error e
+        end
+
+        api :GET, "/compliance/arf_reports/:id/download_html/", N_("Download ARF report in HTML")
+        param :id, :identifier, :required => true
+
+        def download_html
+          response = @arf_report.to_html
+          send_data response, :filename => "#{format_filename}.html"
+        rescue => e
+          handle_download_error e
         end
 
         private
@@ -70,9 +81,13 @@ module Api
           instance_variable_set("@arf_report", resource_scope.find(params[:id]))
         end
 
+        def handle_download_error(error)
+          render_error 'standard_error', :status => :internal_error, :locals => { :exception => error }
+        end
+
         def action_permission
           case params[:action]
-          when 'download'
+          when 'download', 'download_html'
             :view
           else
             super

data/app/controllers/arf_reports_controller.rb

@@ -1,7 +1,8 @@
 class ArfReportsController < ApplicationController
   include Foreman::Controller::AutoCompleteSearch
+  include ForemanOpenscap::ArfReportsControllerCommonExtensions
 
-  before_filter :find_arf_report, :only => [:show, :show_html, :destroy, :parse_html, :parse_bzip]
+  before_filter :find_arf_report, :only => [:show, :show_html, :destroy, :parse_html, :parse_bzip, :download_html]
   before_filter :find_multiple, :only => [:delete_multiple, :submit_delete_multiple]
 
   def model_of_controller
@@ -31,13 +32,24 @@ class ArfReportsController < ApplicationController
   def parse_bzip
     begin
       response = @arf_report.to_bzip
-      send_data response, :filename => "#{@arf_report.id}_arf_report.bz2", :type => 'application/octet-stream', :disposition => 'attachement'
+      send_data response, :filename => "#{format_filename}.xml.bz2", :type => 'application/octet-stream', :disposition => 'attachement'
     rescue => e
       process_error(:error_msg => (_("Failed to downloaded ARF report as bzip: %s") % (e.message)),
                     :error_redirect => arf_report_path(@arf_report.id))
     end
   end
 
+  def download_html
+    begin
+      response = @arf_report.to_html
+      send_data response, :filename => "#{format_filename}.html",
+                          :type => 'text/html', :disposition => 'attachement'
+    rescue => e
+      process_error(:error_msg => _("Failed to downloaded ARF report in HTML: %s") % e.message,
+                    :error_redirect => arf_report_path(@arf_report.id))
+    end
+  end
+
   def destroy
     if @arf_report.destroy
       process_success(:success_msg => (_("Successfully deleted ARF report.")), :success_redirect => arf_reports_path)
@@ -87,7 +99,7 @@ class ArfReportsController < ApplicationController
 
   def action_permission
     case params[:action]
-    when 'show_html', 'parse_html', 'parse_bzip'
+    when 'show_html', 'parse_html', 'parse_bzip', 'download_html'
       :view
     when 'delete_multiple', 'submit_delete_multiple'
       :destroy

data/app/controllers/concerns/foreman_openscap/arf_reports_controller_common_extensions.rb

@@ -0,0 +1,8 @@
+module ForemanOpenscap
+  module ArfReportsControllerCommonExtensions
+    extend ActiveSupport::Concern
+    def format_filename
+      "#{@arf_report.asset.name}-#{@arf_report.reported_at.to_formatted_s(:number)}"
+    end
+  end
+end

data/app/models/concerns/foreman_openscap/compliance_status_scoped_search.rb

@@ -68,19 +68,19 @@ module ForemanOpenscap
     end
 
     included do
-      scoped_search :in => :policy, :on => :name, :complete_value => true, :rename => :compliance_policy,
+      scoped_search :relation => :policy, :on => :name, :complete_value => true, :rename => :compliance_policy,
         :only_explicit => true, :ext_method => :search_by_policy_name
 
       scoped_search :on => :id, :rename => :last_for, :complete_value => { :host => 0, :policy => 1 },
         :only_explicit => true, :ext_method => :search_by_last_for
 
-      scoped_search :in => :policy, :on => :name, :complete_value => true, :rename => :comply_with,
+      scoped_search :relation => :policy, :on => :name, :complete_value => true, :rename => :comply_with,
         :only_explicit => true, :operators => ['= '], :ext_method => :search_by_comply_with
 
-      scoped_search :in => :policy, :on => :name, :complete_value => true, :rename => :not_comply_with,
+      scoped_search :relation => :policy, :on => :name, :complete_value => true, :rename => :not_comply_with,
         :only_explicit => true, :operators => ['= '], :ext_method => :search_by_not_comply_with
 
-      scoped_search :in => :policy, :on => :name, :complete_value => true, :rename => :inconclusive_with,
+      scoped_search :relation => :policy, :on => :name, :complete_value => true, :rename => :inconclusive_with,
         :only_explicit => true, :operators => ['= '], :ext_method => :search_by_inconclusive_with
 
       compliance_status_scoped_search 'passed', :on => :status, :rename => :compliance_passed

data/app/models/concerns/foreman_openscap/host_extensions.rb

@@ -10,13 +10,13 @@ module ForemanOpenscap
       has_many :arf_reports, :class_name => '::ForemanOpenscap::ArfReport', :foreign_key => :host_id
       has_one :compliance_status_object, :class_name => '::ForemanOpenscap::ComplianceStatus', :foreign_key => 'host_id'
 
-      scoped_search :in => :policies, :on => :name, :complete_value => true, :rename => :compliance_policy,
-                    :only_explicit => true, :operators => ['= ', '!= '], :ext_method => :search_by_policy_name
+      scoped_search :relation => :policies, :on => :name, :complete_value => true, :rename => :compliance_policy,
+                    :only_explicit => true, :operators => ['= '], :ext_method => :search_by_policy_name
 
-      scoped_search :in => :policies, :on => :name, :complete_value => true, :rename => :compliance_report_missing_for,
+      scoped_search :relation => :policies, :on => :name, :complete_value => true, :rename => :compliance_report_missing_for,
                     :only_explicit => true, :operators => ['= ', '!= '], :ext_method => :search_by_missing_arf
 
-      scoped_search :in => :compliance_status_object, :on => :status, :rename => :compliance_status,
+      scoped_search :relation => :compliance_status_object, :on => :status, :rename => :compliance_status,
                     :complete_value => {:compliant => ::ForemanOpenscap::ComplianceStatus::COMPLIANT,
                                         :incompliant => ::ForemanOpenscap::ComplianceStatus::INCOMPLIANT,
                                         :inconclusive => ::ForemanOpenscap::ComplianceStatus::INCONCLUSIVE}
@@ -63,7 +63,9 @@ module ForemanOpenscap
     end
 
     def policies_enc
-      combined_policies.map(&:to_enc).to_json
+      check = ForemanOpenscap::OpenscapProxyAssignedVersionCheck.new(self).run
+      method = check.pass? ? :to_enc : :to_enc_legacy
+      combined_policies.map(&method).to_json
     end
 
     def combined_policies
@@ -102,23 +104,20 @@ module ForemanOpenscap
     module ClassMethods
       def search_by_policy_name(key, operator, policy_name)
         cond = sanitize_sql_for_conditions(["foreman_openscap_policies.name #{operator} ?", value_to_sql(operator, policy_name)])
-        { :conditions => Host::Managed.arel_table[:id].in(
-          Host::Managed.select(Host::Managed.arel_table[:id]).joins(:policies).where(cond).ast
-        ).to_sql }
+        { :conditions => Host::Managed.arel_table[:id].in(Host::Managed.select(Host::Managed.arel_table[:id]).joins(:policies).where(cond).pluck(:id)).to_sql }
       end
 
       def search_by_missing_arf(key, operator, policy_name)
         cond = sanitize_sql_for_conditions(["foreman_openscap_policies.name #{operator} ?", value_to_sql(operator, policy_name)])
-        { :conditions => Host::Managed.arel_table[:id].in(
-          Host::Managed.select(Host::Managed.arel_table[:id])
-            .joins(:policies)
-            .where(cond)
-            .where("foreman_openscap_assets.id NOT IN (
+        { :conditions => Host::Managed.arel_table[:id].in(Host::Managed.select(Host::Managed.arel_table[:id]).
+            joins(:policies).
+            where(cond).
+            where("foreman_openscap_assets.id NOT IN (
                      SELECT DISTINCT foreman_openscap_arf_reports.asset_id
                      FROM foreman_openscap_arf_reports
                      WHERE foreman_openscap_arf_reports.asset_id = foreman_openscap_assets.id
-                         AND foreman_openscap_arf_reports.policy_id = foreman_openscap_policies.id)
-                   ").ast).to_sql
+                         AND foreman_openscap_arf_reports.policy_id = foreman_openscap_policies.id)").
+            pluck(:id)).to_sql
         }
       end
     end

data/app/models/foreman_openscap/arf_report.rb

@@ -164,11 +164,15 @@ module ForemanOpenscap
     end
 
     def destroy
-      begin
-        openscap_proxy_api.destroy_report(self, ForemanOpenscap::Helper::find_name_or_uuid_by_host(host))
-      rescue Foreman::Exception => e
-        logger.error "Failed to delete report with id #{id} from proxy, cause: #{e.message}"
-        logger.debug e.backtrace.join("\n\t")
+      if host
+        begin
+          openscap_proxy_api.destroy_report(self, ForemanOpenscap::Helper::find_name_or_uuid_by_host(host))
+        rescue Foreman::Exception => e
+          logger.error "Failed to delete report with id #{id} from proxy, cause: #{e.message}"
+          logger.debug e.backtrace.join("\n\t")
+        end
+      else
+        logger.error "Failed to delete report with id #{id} from proxy, no host associated with report"
       end
       super
     end

data/app/models/foreman_openscap/policy.rb

@@ -171,11 +171,15 @@ module ForemanOpenscap
         'profile_id'    => profile_for_scan,
         'content_path'  => "/var/lib/openscap/content/#{self.scap_content.digest}.xml",
         'tailoring_path' => tailoring_file ? "/var/lib/openscap/tailoring/#{self.tailoring_file.digest}.xml" : '',
-        'download_path' => "/compliance/policies/#{self.id}/content", # default to proxy path
-        'tailoring_download_path' => "/compliance/policies/#{self.id}/tailoring"
+        'download_path' => "/compliance/policies/#{self.id}/content/#{scap_content.digest}",
+        'tailoring_download_path' => tailoring_file ? "/compliance/policies/#{self.id}/tailoring/#{tailoring_file.digest}" : ''
       }.merge(period_enc)
     end
 
+    def to_enc_legacy
+      to_enc.tap { |hash| hash['download_path'] = "/compliance/policies/#{self.id}/content" }
+    end
+
     def should_validate?(step_name)
       if new_record? && wizard_initiated?
         step_index > step_to_i(step_name)

data/app/services/foreman_openscap/openscap_proxy_assigned_version_check.rb

@@ -0,0 +1,14 @@
+module ForemanOpenscap
+  class OpenscapProxyAssignedVersionCheck < OpenscapProxyVersionCheck
+    def initialize(host)
+      @host = host
+      super()
+    end
+
+    private
+
+    def get_openscap_proxies
+      @host.openscap_proxy ? [@host.openscap_proxy] : []
+    end
+  end
+end

data/app/services/foreman_openscap/openscap_proxy_version_check.rb

@@ -9,7 +9,7 @@ module ForemanOpenscap
 
     def run
       @versions = openscap_proxy_versions.select do |key, value|
-        Gem::Version.new(value) <= Gem::Version.new("0.6.1")
+        Gem::Version.new(value) < Gem::Version.new("0.6.1")
       end
       self
     end

data/app/views/arf_reports/show.html.erb

@@ -12,5 +12,6 @@
   display_delete_if_authorized(hash_for_arf_report_path(:id => @arf_report), :class=> "btn btn-danger"),
   link_to(_("Host details"), @arf_report.host, :class => "btn btn-default"),
   link_to(_("View full report"), show_html_arf_report_path(:id => @arf_report.id), :class => "btn btn-default"),
-  link_to(_("Download XML in bzip"), parse_bzip_arf_report_path(:id => @arf_report.id), :class => "btn btn-default", :data => { :no_turbolink => true })
+  link_to(_("Download XML in bzip"), parse_bzip_arf_report_path(:id => @arf_report.id), :class => "btn btn-default", :data => { :no_turbolink => true }),
+  link_to(_("Download HTML"), download_html_arf_report_path(:id => @arf_report.id), :class => "btn btn-default", :data => { :no_turbolink => true })
 %>

data/app/views/job_templates/run_openscap_scans.erb

@@ -0,0 +1,21 @@
+<%#
+name: Run OpenSCAP scans
+job_category: OpenSCAP
+description_format: Run scan for all OpenSCAP policies on host
+feature: foreman_openscap_run_scans
+provider_type: SSH
+snippet: false
+template_inputs:
+- name: policies
+  required: false
+  input_type: puppet_parameter
+  puppet_class_name: foreman_scap_client
+  puppet_parameter_name: policies
+  advanced: false
+provider_type: SSH
+kind: job_template
+%>
+
+<% input('policies').map { |policy_config| policy_config['id'] }.each do |id| -%>
+/usr/bin/foreman_scap_client <%= id %>
+<% end -%>

data/config/routes.rb

@@ -7,6 +7,7 @@ Rails.application.routes.draw do
         get 'show_html'
         get 'parse_html'
         get 'parse_bzip'
+        get 'download_html'
       end
       collection do
         get 'auto_complete_search'
@@ -80,6 +81,7 @@ Rails.application.routes.draw do
         resources :arf_reports, :only => [:index, :show, :destroy] do
           member do
             get 'download'
+            get 'download_html'
           end
         end
         post 'arf_reports/:cname/:policy_id/:date', \

data/db/seeds.d/75-job_templates.rb

@@ -0,0 +1,10 @@
+if ForemanOpenscap.with_remote_execution?
+  User.as_anonymous_admin do
+    JobTemplate.without_auditing do
+      Dir[File.join("#{ForemanOpenscap::Engine.root}/app/views/job_templates/**/*.erb")].each do |template|
+        sync = !Rails.env.test? && Setting[:remote_execution_sync_templates]
+        JobTemplate.import!(File.read(template), :default => true, :locked => true, :update => sync)
+      end
+    end
+  end
+end

data/lib/foreman_openscap/engine.rb

@@ -9,6 +9,7 @@ module ForemanOpenscap
     config.autoload_paths += Dir["#{config.root}/app/models"]
     config.autoload_paths += Dir["#{config.root}/app/overrides"]
     config.autoload_paths += Dir["#{config.root}/app/lib"]
+    config.autoload_paths += Dir["#{config.root}/app/services"]
     config.autoload_paths += Dir["#{config.root}/lib"]
     config.autoload_paths += Dir["#{config.root}/test/"]
 
@@ -51,8 +52,8 @@ module ForemanOpenscap
         # Add permissions
         security_block :foreman_openscap do
           permission :view_arf_reports, {:arf_reports => [:index, :show, :parse_html, :show_html,
-                                                          :parse_bzip, :auto_complete_search],
-                                         'api/v2/compliance/arf_reports' => [:index, :show, :download],
+                                                          :parse_bzip, :auto_complete_search, :download_html],
+                                         'api/v2/compliance/arf_reports' => [:index, :show, :download, :download_html],
                                          :compliance_hosts => [:show]},
                      :resource_type => 'ForemanOpenscap::ArfReport'
           permission :destroy_arf_reports, {:arf_reports => [:destroy, :delete_multiple, :submit_delete_multiple],
@@ -154,6 +155,20 @@ module ForemanOpenscap
         parameter_filter Hostgroup, :openscap_proxy_id, :openscap_proxy
         parameter_filter Log, :result
 
+        if ForemanOpenscap.with_remote_execution?
+          RemoteExecutionFeature.register(:foreman_openscap_run_scans, N_("Run OpenSCAP scan"),
+                                          :description => N_("Run OpenSCAP scan"),
+                                          :host_action_button => true,
+                                          :provided_inputs => "policies")
+        end
+
+        add_controller_action_scope(::Api::V2::HostsController, :index) do |base_scope|
+          base_scope.includes(:policies)
+        end
+
+        add_controller_action_scope(::HostsController, :index) do |base_scope|
+          base_scope.includes(:policies)
+        end
       end
     end
 
@@ -194,4 +209,8 @@ module ForemanOpenscap
   def self.use_relative_model_naming?
     true
   end
+
+  def self.with_remote_execution?
+    RemoteExecutionFeature rescue false
+  end
 end

data/lib/foreman_openscap/version.rb

@@ -1,3 +1,3 @@
 module ForemanOpenscap
-  VERSION = "0.6.4"
+  VERSION = "0.6.5"
 end