smart_proxy_openscap 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57a129c56c494eaf735088a59fedaaeddd7a0af1c8e4aed8424e76c94415e515
-  data.tar.gz: 9e9b31ccd266403eae40237a47ab8852b1799ea520684a4facbc2229595e4566
+  metadata.gz: b4d1a52c4299cb9828c2cb492622a4cc13f9cd3d234fc6a9940dc9768840761b
+  data.tar.gz: bfa0d9e1444579127bec7bf5f32fe37d73577c99ab803dfd07b59c0ed6f1e15a
 SHA512:
-  metadata.gz: dc046f2f2ff1d9f78a0bffbadb1c671b731e5ac0457eff5620d01dde5cf0a299cc0b0ba475abc02e70e64ad919edf721610a9c010aade74ff54ab0ff574241dd
-  data.tar.gz: 20c7e65b5452fb3f1b5107e90522b7403c4ed00c2564969f85858a0ddaab14cc57aa41bd31de4e968dbee52e8756ec30c2f1c01ad19248b15d69f76db6df20c8
+  metadata.gz: 49c8ece151fb60cdf31a3c396b22df455d3f653648640f5e6d05505c67c386128bf09970bd9d08b82e94710d493c3ba8dd003d47d584e05819204cd32987ffc3
+  data.tar.gz: 18acfdafceecc4845da3fce3703f7e670d0c991ddda0d6cb542c00ccb6d399cd4090b63cf44dbeb2fef5aa99cfa0fb7710a2a54cf5b6d4b1678f98b70d01678b

data/lib/smart_proxy_openscap/fetch_scap_file.rb

@@ -0,0 +1,45 @@
+require 'smart_proxy_openscap/fetch_file'
+
+module Proxy::OpenSCAP
+  class FetchScapFile < FetchFile
+    def initialize(type)
+      raise "Expected one of the following symbols: #{allowed_types.join(', ')}, got: #{type}" unless allowed_types.include? type
+      @type = type
+    end
+
+    def fetch(policy_id, digest, content_dir)
+      store_dir = File.join(Proxy::OpenSCAP.fullpath(content_dir), policy_id.to_s)
+      scap_file = File.join(store_dir, file_name(policy_id, digest))
+
+      file_download_path = download_path.sub(':policy_id', policy_id)
+      create_store_dir store_dir
+      file = policy_content_file scap_file
+      clean_store_folder store_dir unless file
+      file ||= save_or_serve_scap_file scap_file, file_download_path
+    end
+
+    def download_path
+      case @type
+      when :scap_content
+        "api/v2/compliance/policies/:policy_id/content"
+      when :tailoring_file
+        "api/v2/compliance/policies/:policy_id/tailoring"
+      when :oval_content
+        "api/v2/compliance/oval_policies/:policy_id/oval_content"
+      end
+    end
+
+    def file_name(policy_id, digest)
+      case @type
+      when :scap_content, :tailoring_file
+        "#{policy_id}_#{digest}.xml"
+      when :oval_content
+        "#{digest}.oval.xml.bz2"
+      end
+    end
+
+    def allowed_types
+      [:scap_content, :tailoring_file, :oval_content]
+    end
+  end
+end

data/lib/smart_proxy_openscap/foreman_arf_forwarder.rb

@@ -0,0 +1,15 @@
+require 'smart_proxy_openscap/foreman_forwarder'
+
+module Proxy::OpenSCAP
+  class ForemanArfForwarder < ForemanForwarder
+    private
+
+    def parse_report(cname, policy_id, date, report_data)
+      Proxy::OpenSCAP::ArfParser.new(cname, policy_id, date).as_json(report_data)
+    end
+
+    def report_upload_path(cname, policy_id, date)
+      upload_path "arf_reports", cname, policy_id, date
+    end
+  end
+end

data/lib/smart_proxy_openscap/foreman_forwarder.rb

@@ -4,26 +4,29 @@ module Proxy::OpenSCAP
   class ForemanForwarder < Proxy::HttpRequest::ForemanRequest
     include ::Proxy::Log
 
-    def post_arf_report(cname, policy_id, date, data, timeout)
-      begin
-        foreman_api_path = upload_path(cname, policy_id, date)
-        json = Proxy::OpenSCAP::ArfParser.new(cname, policy_id, date).as_json(data)
-        response = send_request(foreman_api_path, json, timeout)
-        # Raise an HTTP error if the response is not 2xx (success).
-        response.value
-        JSON.parse(response.body)
-      rescue Net::HTTPServerException => e
-        logger.debug "Received response: #{response.code} #{response.msg}"
-        logger.debug response.body
-        raise ReportUploadError, e.message if response.code.to_i == 422
-        raise e
-      end
+    def post_report(cname, policy_id, date, data, timeout)
+      foreman_api_path = report_upload_path(cname, policy_id, date)
+
+      json = parse_report(cname, policy_id, date, data)
+      response = send_request(foreman_api_path, json, timeout)
+      # Raise an HTTP error if the response is not 2xx (success).
+      response.value
+      JSON.parse(response.body)
+    rescue Net::HTTPServerException => e
+      logger.debug "Received response: #{response.code} #{response.msg}"
+      logger.debug response.body
+      raise ReportUploadError, e.message if response.code.to_i == 422
+      raise e
     end
 
     private
 
-    def upload_path(cname, policy_id, date)
-      "/api/v2/compliance/arf_reports/#{cname}/#{policy_id}/#{date}"
+    def upload_path(resource, cname, policy_id, date)
+      "/api/v2/compliance/#{resource}/#{cname}/#{policy_id}/#{date}"
+    end
+
+    def parse_report(cname, policy_id, date, data)
+      raise NotImplementedError
     end
 
     def send_request(path, body, timeout)

data/lib/smart_proxy_openscap/foreman_oval_forwarder.rb

@@ -0,0 +1,19 @@
+require 'smart_proxy_openscap/foreman_forwarder'
+
+module Proxy::OpenSCAP
+  class ForemanOvalForwarder < ForemanForwarder
+    private
+
+    def parse_report(cname, policy_id, date, report_data)
+      {
+        :oval_results => OvalReportParser.new.parse_cves(report_data),
+        :oval_policy_id => policy_id,
+        :cname => cname
+      }.to_json
+    end
+
+    def report_upload_path(cname, policy_id, date)
+      upload_path "oval_reports", cname, policy_id, date
+    end
+  end
+end

data/lib/smart_proxy_openscap/openscap_api.rb

@@ -33,35 +33,37 @@ module Proxy::OpenSCAP
       do_authorize_with_trusted_hosts
     end
 
-    post "/arf/:policy" do
-      # first let's verify client's certificate
+    before '(/arf/*|/oval_reports/*)' do
       begin
-        cn = Proxy::OpenSCAP::common_name request
+        @cn = Proxy::OpenSCAP::common_name request
       rescue Proxy::Error::Unauthorized => e
         log_halt 403, "Client authentication failed: #{e.message}"
       end
-      date = Time.now.to_i
+      @reported_at = Time.now.to_i
+    end
+
+    post "/arf/:policy" do
       policy = params[:policy]
 
       begin
-        post_to_foreman = ForemanForwarder.new.post_arf_report(cn, policy, date, request.body.string, Proxy::OpenSCAP::Plugin.settings.timeout)
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, cn, post_to_foreman['id'], date).store_archive(request.body.string)
+        post_to_foreman = ForemanArfForwarder.new.post_report(@cn, policy, @reported_at, request.body.string, Proxy::OpenSCAP::Plugin.settings.timeout)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, @cn, post_to_foreman['id'], @reported_at).store_archive(request.body.string)
         post_to_foreman.to_json
       rescue Proxy::OpenSCAP::StoreReportError => e
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.failed_dir, cn, post_to_foreman['id'], date).store_failed(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.failed_dir, @cn, post_to_foreman['id'], @reported_at).store_failed(request.body.string)
         logger.error "Failed to save Report in reports directory (#{Proxy::OpenSCAP::Plugin.settings.reportsdir}). Failed with: #{e.message}.
                       Saving file in #{Proxy::OpenSCAP::Plugin.settings.failed_dir}. Please copy manually to #{Proxy::OpenSCAP::Plugin.settings.reportsdir}"
         { :result => 'Storage failure on proxy, see proxy logs for details' }.to_json
       rescue Nokogiri::XML::SyntaxError => e
         error = "Failed to parse Arf Report, moving to #{Proxy::OpenSCAP::Plugin.settings.corrupted_dir}"
         logger.error error
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.corrupted_dir, cn, policy, date).store_corrupted(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.corrupted_dir, @cn, policy, @reported_at).store_corrupted(request.body.string)
         { :result => (error << ' on proxy') }.to_json
       rescue *HTTP_ERRORS => e
         ### If the upload to foreman fails then store it in the spooldir
         msg = "Failed to upload to Foreman, saving in spool. Failed with: #{e.message}"
         logger.error msg
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.spooldir, cn, policy, date).store_spool(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.spooldir, @cn, policy, @reported_at).store_spool(request.body.string)
         { :result => msg }.to_json
       rescue Proxy::OpenSCAP::StoreSpoolError => e
         log_halt 500, e.message
@@ -70,10 +72,26 @@ module Proxy::OpenSCAP
       end
     end
 
+    post "/oval_reports/:oval_policy_id" do
+      ForemanOvalForwarder.new.post_report(@cn, params[:oval_policy_id], @reported_at, request.body.string, Plugin.settings.timeout)
+
+      { :reported_at => Time.at(@reported_at) }.to_json
+    rescue *HTTP_ERRORS => e
+      msg = "Failed to upload to Foreman, failed with: #{e.message}"
+      logger.error e
+      { :result => msg }.to_json
+    rescue Nokogiri::XML::SyntaxError => e
+      logger.error e
+      { :result => 'Failed to parse OVAL report, see proxy logs for details' }.to_json
+    rescue Proxy::OpenSCAP::ReportUploadError, Proxy::OpenSCAP::ReportDecompressError => e
+      { :result => e.message }.to_json
+    end
+
+
     get "/arf/:id/:cname/:date/:digest/xml" do
       content_type 'application/x-bzip2'
       begin
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, params[:cname], params[:id], params[:date]).get_arf_xml(params[:digest])
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, params[:cname], params[:id], params[:date]).get_arf_xml(params[:digest])
       rescue FileNotFound => e
         log_halt 500, "Could not find requested file, #{e.message}"
       end
@@ -81,7 +99,7 @@ module Proxy::OpenSCAP
 
     delete "/arf/:id/:cname/:date/:digest" do
       begin
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, params[:cname], params[:id], params[:date]).delete_arf_file
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, params[:cname], params[:id], params[:date]).delete_arf_file
       rescue FileNotFound => e
         logger.debug "Could not find requested file, #{e.message} - Assuming deleted"
       end
@@ -100,32 +118,34 @@ module Proxy::OpenSCAP
     get "/policies/:policy_id/content/:digest" do
       content_type 'application/xml'
       begin
-        Proxy::OpenSCAP::FetchScapContent.new.get_policy_content(params[:policy_id], params[:digest])
+        Proxy::OpenSCAP::FetchScapFile.new(:scap_content)
+          .fetch(params[:policy_id], params[:digest], Proxy::OpenSCAP::Plugin.settings.contentdir)
       rescue *HTTP_ERRORS => e
-        log_halt e.response.code.to_i, "File not found on Foreman. Wrong policy id?"
+        log_halt e.response.code.to_i, file_not_found_msg
       rescue StandardError => e
         log_halt 500, "Error occurred: #{e.message}"
       end
     end
 
-    get "/policies/:policy_id/content" do
+    get "/policies/:policy_id/tailoring/:digest" do
       content_type 'application/xml'
-      logger.warn 'DEPRECATION WARNING: /policies/:policy_id/content/:digest should be used, please update foreman_openscap'
       begin
-        Proxy::OpenSCAP::FetchScapContent.new.get_policy_content(params[:policy_id], 'scap_content')
+        Proxy::OpenSCAP::FetchScapFile.new(:tailoring_file)
+          .fetch(params[:policy_id], params[:digest], Proxy::OpenSCAP::Plugin.settings.tailoring_dir)
       rescue *HTTP_ERRORS => e
-        log_halt e.response.code.to_i, "File not found on Foreman. Wrong policy id?"
+        log_halt e.response.code.to_i, file_not_found_msg
       rescue StandardError => e
         log_halt 500, "Error occurred: #{e.message}"
       end
     end
 
-    get "/policies/:policy_id/tailoring/:digest" do
-      content_type 'application/xml'
+    get "/oval_policies/:oval_policy_id/oval_content/:digest" do
+      content_type 'application/x-bzip2'
       begin
-        Proxy::OpenSCAP::FetchTailoringFile.new.get_tailoring_file(params[:policy_id], params[:digest])
-      rescue *HTTP_ERRORS => e
-        log_halt e.response.code.to_i, "File not found on Foreman. Wrong policy id?"
+        Proxy::OpenSCAP::FetchScapFile.new(:oval_content)
+          .fetch(params[:oval_policy_id], params[:digest], Proxy::OpenSCAP::Plugin.settings.oval_content_dir)
+      rescue *HTTP => e
+        log_halt e.response.code.to_i, file_not_found_msg
       rescue StandardError => e
         log_halt 500, "Error occurred: #{e.message}"
       end
@@ -173,7 +193,7 @@ module Proxy::OpenSCAP
 
     get "/spool_errors" do
       begin
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.corrupted_dir, nil, nil, nil).spool_errors.to_json
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.corrupted_dir, nil, nil, nil).spool_errors.to_json
       rescue StandardError => e
         log_halt 500, "Error occurred: #{e.message}"
       end
@@ -190,5 +210,9 @@ module Proxy::OpenSCAP
         log_halt 500, "Error occurred: #{e.message}"
       end
     end
+
+    def file_not_found_msg
+      "File not found on Foreman. Wrong policy id?"
+    end
   end
 end

data/lib/smart_proxy_openscap/openscap_html_generator.rb

@@ -30,7 +30,7 @@ module Proxy
 
       def file_path_in_storage
         path_to_dir = Proxy::OpenSCAP::Plugin.settings.reportsdir
-        storage = Proxy::OpenSCAP::StorageFS.new(path_to_dir, @cname, @id, @date)
+        storage = Proxy::OpenSCAP::StorageFs.new(path_to_dir, @cname, @id, @date)
         storage.get_path(@digest)
       end
     end

data/lib/smart_proxy_openscap/openscap_import_api.rb

@@ -14,15 +14,15 @@ module Proxy::OpenSCAP
 
       post_to_foreman = ForemanForwarder.new.post_arf_report(cn, policy, date, request.body.string, Proxy::OpenSCAP::Plugin.settings.timeout)
       begin
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, cn, post_to_foreman['id'], date).store_archive(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.reportsdir, cn, post_to_foreman['id'], date).store_archive(request.body.string)
       rescue Proxy::OpenSCAP::StoreReportError => e
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.failed_dir, cn, post_to_foreman['id'], date).store_failed(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.failed_dir, cn, post_to_foreman['id'], date).store_failed(request.body.string)
         logger.error "Failed to save Report in reports directory (#{Proxy::OpenSCAP::Plugin.settings.reportsdir}). Failed with: #{e.message}.
                         Saving file in #{Proxy::OpenSCAP::Plugin.settings.failed_dir}. Please copy manually to #{Proxy::OpenSCAP::Plugin.settings.reportsdir}"
       rescue *HTTP_ERRORS => e
         ### If the upload to foreman fails then store it in the spooldir
         logger.error "Failed to upload to Foreman, saving in spool. Failed with: #{e.message}"
-        Proxy::OpenSCAP::StorageFS.new(Proxy::OpenSCAP::Plugin.settings.spooldir, cn, policy, date).store_spool(request.body.string)
+        Proxy::OpenSCAP::StorageFs.new(Proxy::OpenSCAP::Plugin.settings.spooldir, cn, policy, date).store_spool(request.body.string)
       rescue Proxy::OpenSCAP::StoreSpoolError => e
         log_halt 500, e.message
       end

data/lib/smart_proxy_openscap/openscap_lib.rb

@@ -16,16 +16,18 @@ require 'proxy/error'
 require 'yaml'
 require 'ostruct'
 require 'proxy/request'
-require 'smart_proxy_openscap/fetch_scap_content'
-require 'smart_proxy_openscap/foreman_forwarder'
+require 'smart_proxy_openscap/foreman_arf_forwarder'
+require 'smart_proxy_openscap/foreman_oval_forwarder'
 require 'smart_proxy_openscap/content_parser'
 require 'smart_proxy_openscap/openscap_exception'
 require 'smart_proxy_openscap/arf_parser'
 require 'smart_proxy_openscap/spool_forwarder'
 require 'smart_proxy_openscap/openscap_html_generator'
-require 'smart_proxy_openscap/fetch_tailoring_file'
 require 'smart_proxy_openscap/policy_parser'
 require 'smart_proxy_openscap/profiles_parser'
+require 'smart_proxy_openscap/oval_report_storage_fs'
+require 'smart_proxy_openscap/oval_report_parser'
+require 'smart_proxy_openscap/fetch_scap_file'
 
 module Proxy::OpenSCAP
   extend ::Proxy::Log

data/lib/smart_proxy_openscap/openscap_plugin.rb

@@ -22,6 +22,7 @@ module Proxy::OpenSCAP
                      :contentdir => File.join(APP_ROOT, 'openscap/content'),
                      :reportsdir => File.join(APP_ROOT, 'openscap/reports'),
                      :failed_dir => File.join(APP_ROOT, 'openscap/failed'),
-                     :tailoring_dir => File.join(APP_ROOT, 'openscap/tailoring')
+                     :tailoring_dir => File.join(APP_ROOT, 'openscap/tailoring'),
+                     :oval_content_dir => File.join(APP_ROOT, 'openscap/oval_content')
   end
 end

data/lib/smart_proxy_openscap/oval_report_parser.rb

@@ -0,0 +1,54 @@
+require 'smart_proxy_openscap/openscap_exception'
+require 'openscap_parser/oval_report'
+
+module Proxy::OpenSCAP
+  class OvalReportParser
+    include Proxy::Log
+
+    def parse_cves(report_data)
+      report = oval_report report_data
+      results = report.definition_results.reduce({}) do |memo, result|
+        memo.tap { |acc| acc[result.definition_id] = parse_cve_res result }
+      end
+
+      report.definitions.map do |definition|
+        results[definition.id].merge(parse_cve_def definition)
+      end
+    end
+
+    private
+
+    def parse_cve_def(definition)
+      refs = definition.references.reduce([]) do |memo, ref|
+        memo.tap { |acc| acc << { :ref_id => ref.ref_id, :ref_url => ref.ref_url } }
+      end
+
+      { :references => refs, :definition_id => definition.id }
+    end
+
+    def parse_cve_res(result)
+      { :result => result.result }
+    end
+
+    def oval_report(report_data)
+      decompressed = decompress report_data
+      ::OpenscapParser::OvalReport.new(decompressed)
+    end
+
+    def decompress(report_data)
+      begin
+        file = Tempfile.new
+        file.write report_data
+        file.rewind
+        decompressed = `bunzip2 -dc #{file.path}`
+      rescue => e
+        logger.error e
+        raise Proxy::OpenSCAP::ReportDecompressError, "Failed to decompress received report bzip, cause: #{e.message}"
+      ensure
+        file.close
+        file.unlink
+      end
+      decompressed
+    end
+  end
+end

data/lib/smart_proxy_openscap/oval_report_storage_fs.rb

@@ -0,0 +1,26 @@
+require 'smart_proxy_openscap/storage_fs_common'
+require 'smart_proxy_openscap/openscap_exception'
+
+module Proxy::OpenSCAP
+  class OvalReportStorageFs
+    include StorageFsCommon
+
+    def initialize(path_to_dir, oval_policy_id, cname, reported_at)
+      @namespace = 'oval'
+      @reported_at = reported_at
+      @path = "#{path_to_dir}/#{@namespace}/#{oval_policy_id}/#{cname}/"
+    end
+
+    def store_report(report_data)
+      store(report_data, StoreReportError)
+    end
+
+    private
+
+    def store_file(path_to_store, report_data)
+      target_path = "#{path_to_store}#{@reported_at}"
+      File.open(target_path, 'w') { |f| f.write(report_data) }
+      target_path
+    end
+  end
+end

data/lib/smart_proxy_openscap/spool_forwarder.rb

@@ -52,13 +52,13 @@ module Proxy::OpenSCAP
 
     def forward_arf_file(cname, policy_id, date, arf_file_path)
       data = File.open(arf_file_path, 'rb') { |io| io.read }
-      post_to_foreman = ForemanForwarder.new.post_arf_report(cname, policy_id, date, data, @loaded_settings.timeout)
-      Proxy::OpenSCAP::StorageFS.new(@loaded_settings.reportsdir, cname, post_to_foreman['id'], date).store_archive(data)
+      post_to_foreman = ForemanArfForwarder.new.post_report(cname, policy_id, date, data, @loaded_settings.timeout)
+      Proxy::OpenSCAP::StorageFs.new(@loaded_settings.reportsdir, cname, post_to_foreman['id'], date).store_archive(data)
       File.delete arf_file_path
     rescue Nokogiri::XML::SyntaxError, Proxy::OpenSCAP::ReportDecompressError => e
       logger.error "Failed to parse Arf Report at #{arf_file_path}, moving to #{@loaded_settings.corrupted_dir}"
 
-      Proxy::OpenSCAP::StorageFS.new(@loaded_settings.corrupted_dir, cname, policy_id, date).
+      Proxy::OpenSCAP::StorageFs.new(@loaded_settings.corrupted_dir, cname, policy_id, date).
         move_corrupted(arf_file_path.split('/').last, @loaded_settings.spooldir)
     rescue Proxy::OpenSCAP::ReportUploadError => e
       logger.error "Failed to upload Arf Report at #{arf_file_path}, cause: #{e.message}, the report will be deleted."

data/lib/smart_proxy_openscap/storage.rb

@@ -2,8 +2,6 @@ require 'smart_proxy_openscap/openscap_exception'
 
 module Proxy::OpenSCAP
   class Storage
-    include ::Proxy::Log
-
     def initialize(path_to_dir, cname, id, date)
       @namespace = 'arf'
       @cname = cname

data/lib/smart_proxy_openscap/storage_fs.rb

@@ -1,8 +1,11 @@
 require 'pathname'
 require 'smart_proxy_openscap/storage'
+require 'smart_proxy_openscap/storage_fs_common'
 
 module Proxy::OpenSCAP
-  class StorageFS < Storage
+  class StorageFs < Storage
+    include StorageFsCommon
+
     def store_archive(data)
       store(data, StoreReportError)
     end
@@ -57,9 +60,9 @@ module Proxy::OpenSCAP
 
     private
 
-    def store_arf(spool_arf_dir, data)
+    def store_file(path_to_store, data)
       filename = Digest::SHA256.hexdigest data
-      target_path = spool_arf_dir + filename
+      target_path = path_to_store + filename
       File.open(target_path,'w') { |f| f.write(data) }
       target_path
     end
@@ -91,7 +94,7 @@ module Proxy::OpenSCAP
       end
 
       begin
-        target_path = store_arf(@path, data)
+        target_path = store_file(@path, data)
       rescue StandardError => e
         raise error_type, "Could not store file: #{e.message}"
       end

data/lib/smart_proxy_openscap/storage_fs_common.rb

@@ -0,0 +1,42 @@
+module Proxy::OpenSCAP
+  module StorageFsCommon
+    include ::Proxy::Log
+
+    private
+
+    def create_directory
+      begin
+        FileUtils.mkdir_p @path
+      rescue StandardError => e
+        logger.error "Could not create '#{@path}' directory: #{e.message}"
+        raise e
+      end
+      @path
+    end
+
+    def move(source, error_type)
+      begin
+        create_directory
+        FileUtils.mv source, @path
+      rescue StandardError => e
+        raise error_type, "Could not move file: #{e.message}"
+      end
+    end
+
+    def store(data, error_type)
+      begin
+        create_directory
+      rescue StandardError => e
+        raise error_type, "Could not fulfill request: #{e.message}"
+      end
+
+      begin
+        target_path = store_file(@path, data)
+      rescue StandardError => e
+        raise error_type, "Could not store file: #{e.message}"
+      end
+
+      logger.debug "File #{target_path} stored in reports dir."
+    end
+  end
+end

data/lib/smart_proxy_openscap/version.rb

@@ -10,6 +10,6 @@
 
 module Proxy
   module OpenSCAP
-    VERSION = '0.8.1'
+    VERSION = '0.9.0'
   end
 end

data/settings.d/openscap.yml.example

@@ -31,3 +31,6 @@
 # Affects sending reports to Foreman (directly and from spool) and fetching scap content or tailoring file
 # for distribution to clients
 #:timeout: 60
+
+# Directory where OpenSCAP OVAL content bzipped XML are stored
+#:oval_content_dir: /var/lib/openscap/oval_content

data/smart_proxy_openscap.gemspec

@@ -21,6 +21,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency('mocha')
   s.add_development_dependency('webmock')
   s.add_dependency 'openscap', '~> 0.4.7'
-
-  s.add_dependency 'openscap_parser', '~> 1.0.1'
+  s.add_dependency 'openscap_parser', '~> 1.0.2'
 end

data/test/fetch_oval_content_api_test.rb

@@ -0,0 +1,38 @@
+require 'test_helper'
+require 'smart_proxy_openscap'
+require 'smart_proxy_openscap/openscap_api'
+
+ENV['RACK_ENV'] = 'test'
+
+class FetchOvalContentApiTest < Test::Unit::TestCase
+  include Rack::Test::Methods
+
+  def setup
+    @foreman_url = 'https://foreman.example.com'
+    @fixture_path = "/test/data/rhel-7-including-unpatched.oval.xml.bz2"
+    @fixture_full_path = File.join(Dir.getwd, @fixture_path)
+    Proxy::SETTINGS.stubs(:foreman_url).returns(@foreman_url)
+    @results_path = ("#{Dir.getwd}/test/test_run_files")
+    FileUtils.mkdir_p(@results_path)
+    Proxy::OpenSCAP::Plugin.settings.stubs(:oval_content_dir).returns(@results_path)
+    @oval_content = File.new(@fixture_full_path).read
+    @digest = Digest::SHA256.hexdigest @oval_content
+    @policy_id = 1
+  end
+
+  def teardown
+    FileUtils.rm_rf(Dir.glob("#{@results_path}/*"))
+  end
+
+  def app
+    ::Proxy::OpenSCAP::Api.new
+  end
+
+  def test_get_oval_content_from_file
+    FileUtils.mkdir("#{@results_path}/#{@policy_id}")
+    FileUtils.cp(@fixture_full_path, "#{@results_path}/#{@policy_id}/#{@digest}.oval.xml.bz2")
+    get "/oval_policies/#{@policy_id}/oval_content/#{@digest}"
+    assert_equal("application/x-bzip2", last_response.header["Content-Type"], "Response header should be application/x-bzip2")
+    assert(last_response.successful?, "Response should be success")
+  end
+end

data/test/fetch_scap_api_test.rb

@@ -54,7 +54,7 @@ class FetchScapApiTest < Test::Unit::TestCase
   end
 
   def test_get_scap_content_permissions
-    Proxy::OpenSCAP::FetchScapContent.any_instance.stubs(:get_policy_content).raises(Errno::EACCES)
+    Proxy::OpenSCAP::FetchScapFile.any_instance.stubs(:fetch).raises(Errno::EACCES)
     stub_request(:get, "#{@foreman_url}/api/v2/compliance/policies/#{@policy_id}/content").to_return(:body => @scap_content)
     get "/policies/#{@policy_id}/content/#{@digest}"
     assert_equal(500, last_response.status, "No permissions should raise error 500")

data/test/oval_report_parser_test.rb

@@ -0,0 +1,14 @@
+require 'test_helper'
+require 'smart_proxy_openscap'
+require 'smart_proxy_openscap/oval_report_parser'
+
+class OvalReportParserTest < Test::Unit::TestCase
+
+  def test_oval_report_parsing
+    oval_report = File.open("#{Dir.getwd}/test/data/oval-results.xml.bz2").read
+    res = Proxy::OpenSCAP::OvalReportParser.new.parse_cves oval_report
+    refute res.empty?
+    assert res.first[:result]
+    refute res.first[:references].empty?
+  end
+end

data/test/post_oval_report_api_test.rb

@@ -0,0 +1,30 @@
+require 'test_helper'
+require 'smart_proxy_openscap'
+require 'smart_proxy_openscap/openscap_api'
+
+ENV['RACK_ENV'] = 'test'
+
+class PostOvalReportApiTest < Test::Unit::TestCase
+  include Rack::Test::Methods
+
+  setup do
+    @foreman_url = 'https://foreman.example.com'
+    Proxy::SETTINGS.stubs(:foreman_url).returns(@foreman_url)
+    @oval_report = File.open("#{Dir.getwd}/test/data/oval-results.xml.bz2").read
+    @cname = 'node.example.org'
+    @date = Time.now.to_i
+    @policy_id = 1
+    Proxy::OpenSCAP.stubs(:common_name).returns(@cname)
+  end
+
+  def app
+    ::Proxy::OpenSCAP::Api.new
+  end
+
+  def test_post_oval_report_to_foreman
+    stub_request(:post, "#{@foreman_url}/api/v2/compliance/oval_reports/#{@cname}/#{@policy_id}/#{@date}")
+      .to_return(:status => 200, :body => '{ "result": "ok" }')
+    post "/oval_reports/#{@policy_id}", @oval_report, 'CONTENT_TYPE' => 'text/xml', 'CONTENT_ENCODING' => 'x-bzip2'
+    assert(last_response.successful?, "Should be a success")
+  end
+end

data/test/post_report_api_test.rb

@@ -58,7 +58,7 @@ class OpenSCAPApiTest < Test::Unit::TestCase
   def test_fail_save_file_should_raise_error
     @policy_id = 2
     stub_request(:post, "#{@foreman_url}/api/v2/compliance/arf_reports/#{@cname}/#{@policy_id}/#{@date}").to_return(:status => 500, :body => "{\"result\":\"server error\"}")
-    Proxy::OpenSCAP::StorageFS.any_instance.stubs(:create_directory).raises(StandardError)
+    Proxy::OpenSCAP::StorageFs.any_instance.stubs(:create_directory).raises(StandardError)
     post "/arf/#{@policy_id}", @arf_report, 'CONTENT_TYPE' => 'text/xml', 'CONTENT_ENCODING' => 'x-bzip2'
     assert(last_response.server_error?, "Should return 500")
     refute(File.file?("#{@results_path}/spool/arf/#{@cname}/#{@policy_id}/#{@date}/#{@filename}"), "File should be saved in spool directory")
@@ -67,7 +67,7 @@ class OpenSCAPApiTest < Test::Unit::TestCase
   def test_success_post_fail_save_should_save_spool
     stub_request(:post, "#{@foreman_url}/api/v2/compliance/arf_reports/#{@cname}/#{@policy_id}/#{@date}")
       .to_return(:status => 200, :body => "{\"result\":\"OK\",\"id\":\"#{@arf_id}\"}")
-    Proxy::OpenSCAP::StorageFS.any_instance.stubs(:store_archive).raises(Proxy::OpenSCAP::StoreReportError)
+    Proxy::OpenSCAP::StorageFs.any_instance.stubs(:store_archive).raises(Proxy::OpenSCAP::StoreReportError)
     post "/arf/#{@policy_id}", @arf_report, 'CONTENT_TYPE' => 'text/xml', 'CONTENT_ENCODING' => 'x-bzip2'
     refute(File.file?("#{@results_path}/spool/arf/#{@cname}/#{@policy_id}/#{@date}/#{@filename}"), "File should not be  in spool directory")
     refute(File.file?("#{@results_path}/reports/arf/#{@cname}/#{@arf_id}/#{@date}/#{@filename}"), "File should not be in Reports directory")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_openscap
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Šimon Lukašík
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-22 00:00:00.000000000 Z
+date: 2021-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -88,14 +88,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.1
+        version: 1.0.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.1
+        version: 1.0.2
 description: |-
   A plug-in to the Foreman's smart-proxy which receives
     bzip2ed ARF files and forwards them to the Foreman.
@@ -124,9 +124,10 @@ files:
 - lib/smart_proxy_openscap/arf_parser.rb
 - lib/smart_proxy_openscap/content_parser.rb
 - lib/smart_proxy_openscap/fetch_file.rb
-- lib/smart_proxy_openscap/fetch_scap_content.rb
-- lib/smart_proxy_openscap/fetch_tailoring_file.rb
+- lib/smart_proxy_openscap/fetch_scap_file.rb
+- lib/smart_proxy_openscap/foreman_arf_forwarder.rb
 - lib/smart_proxy_openscap/foreman_forwarder.rb
+- lib/smart_proxy_openscap/foreman_oval_forwarder.rb
 - lib/smart_proxy_openscap/http_config.ru
 - lib/smart_proxy_openscap/openscap_api.rb
 - lib/smart_proxy_openscap/openscap_exception.rb
@@ -134,6 +135,8 @@ files:
 - lib/smart_proxy_openscap/openscap_import_api.rb
 - lib/smart_proxy_openscap/openscap_lib.rb
 - lib/smart_proxy_openscap/openscap_plugin.rb
+- lib/smart_proxy_openscap/oval_report_parser.rb
+- lib/smart_proxy_openscap/oval_report_storage_fs.rb
 - lib/smart_proxy_openscap/policy_guide.rb
 - lib/smart_proxy_openscap/policy_parser.rb
 - lib/smart_proxy_openscap/profiles_parser.rb
@@ -141,11 +144,14 @@ files:
 - lib/smart_proxy_openscap/spool_forwarder.rb
 - lib/smart_proxy_openscap/storage.rb
 - lib/smart_proxy_openscap/storage_fs.rb
+- lib/smart_proxy_openscap/storage_fs_common.rb
 - lib/smart_proxy_openscap/version.rb
 - settings.d/openscap.yml.example
 - smart_proxy_openscap.gemspec
 - test/data/arf_report
 - test/data/corrupted_arf_report
+- test/data/oval-results.xml.bz2
+- test/data/rhel-7-including-unpatched.oval.xml.bz2
 - test/data/spool/cleanup_spool/arf/2c101b95-033f-4b15-b490-f50bf9090dae/1/1484313035/fa2f68ffb944c917332a284dc63ec7f8fa76990cb815ddcad3318b5d9457f8a1
 - test/data/spool/cleanup_spool/arf/e20b9695-f655-401a-9dda-8cca7a47a8c0/1/1484309984/fa2f68ffb944c917332a284dc63ec7f8fa76990cb815ddcad3318b5d9457f8a1
 - test/data/spool/corrupted_spool/arf/e20b9695-f655-401a-9dda-8cca7a47a8c0/1/1484309984/a4dfba5db27b21795e6fa401b8dce7a70faeb25b7963891f07f6f4baaf052afb
@@ -154,9 +160,12 @@ files:
 - test/data/spool/valid_spool/arf/e20b9695-f655-401a-9dda-8cca7a47a8c0/1/1484313035/fa2f68ffb944c917332a284dc63ec7f8fa76990cb815ddcad3318b5d9457f8a1
 - test/data/ssg-rhel7-ds.xml
 - test/data/tailoring.xml
+- test/fetch_oval_content_api_test.rb
 - test/fetch_scap_api_test.rb
 - test/fetch_tailoring_api_test.rb
 - test/get_report_xml_html_test.rb
+- test/oval_report_parser_test.rb
+- test/post_oval_report_api_test.rb
 - test/post_report_api_test.rb
 - test/scap_content_parser_api_test.rb
 - test/script_class_test.rb

data/lib/smart_proxy_openscap/fetch_scap_content.rb

@@ -1,17 +0,0 @@
-require 'smart_proxy_openscap/fetch_file'
-
-module Proxy::OpenSCAP
-  class FetchScapContent < FetchFile
-    def get_policy_content(policy_id, digest)
-      policy_store_dir = File.join(Proxy::OpenSCAP.fullpath(Proxy::OpenSCAP::Plugin.settings.contentdir), policy_id.to_s)
-      policy_scap_file = File.join(policy_store_dir, "#{policy_id}_#{digest}.xml")
-      file_download_path = "api/v2/compliance/policies/#{policy_id}/content"
-
-      create_store_dir policy_store_dir
-
-      scap_file = policy_content_file(policy_scap_file)
-      clean_store_folder(policy_store_dir) unless scap_file
-      scap_file ||= save_or_serve_scap_file(policy_scap_file, file_download_path)
-    end
-  end
-end

data/lib/smart_proxy_openscap/fetch_tailoring_file.rb

@@ -1,17 +0,0 @@
-require 'smart_proxy_openscap/fetch_file'
-
-module Proxy::OpenSCAP
-  class FetchTailoringFile < FetchFile
-    def get_tailoring_file(policy_id, digest)
-      store_dir = File.join(Proxy::OpenSCAP.fullpath(Proxy::OpenSCAP::Plugin.settings.tailoring_dir), policy_id.to_s)
-      policy_tailoring_file = File.join(store_dir, "#{policy_id}_#{digest}.xml")
-      file_download_path = "api/v2/compliance/policies/#{policy_id}/tailoring"
-
-      create_store_dir store_dir
-
-      scap_file = policy_content_file(policy_tailoring_file)
-      clean_store_folder(store_dir) unless scap_file
-      scap_file ||= save_or_serve_scap_file(policy_tailoring_file, file_download_path)
-    end
-  end
-end