GSOC23 - A - Adapt the CVE auditing functionality to depend on OVAL data #7335
Commits on Aug 2, 2023
-
-
Create OVAL objects, states and tests managers
- It's an optimization to enable faster lookups of OVAL resources
-
Create a facade class that offers mock implementations for Uyuni APIs
- This class is temporary and will be removed when the integration with Uyuni is complete.
-
-
Add OVAL Criteria and Criterion types
- Also, implemented the composite design pattern to enable the evaluation of the criteria tree
-
-
- This is a temporary implementation based on JAXB API which consumes a lot of memory. I plan to rewrite it with StAX for better performance.
-
-
-
-
-
-
-
-
-
-
-
-
Create OVALVulnerablePackage and OVALPlatformVulnerablePackage entiti…
…es and their corresponding tables
-
-
-
-
-
-
-
-
Reference one cve per OVAL definition
- Right now we're only processing vulnerability definitions which reference one cve per definition, so it's redundant to have a list of cves when it's going to always have one element.
-
-
-
-
-
-
-
-
Add source column to the oval definition table
- This column represents the source from which we fetched the definition
-
-
-
-
-
-
-
-
-
Store platform cpe instead of plain name
- CPE is easier to parse
-
-
-
-
-
-
Modify the vulnerable packages extractor to use database entities ins…
…tead of oval types
-
-
-
-
-
-
-
-
Add a query to fetch all packages installed on a system mapped to a m…
…ore lightweight DTO
-
Go back to fetching all packages
- It's more efficient in terms of speed. And memory footprint shouldn't be a problem since we're using a lightweight DTO
-
-
Fallback to using channels if OVAL data is not available or synced fo…
…r the given system
-
-
Move the OVAL algorithm implementation to CVEAuditManagerOVAL
- The idea here is decouple CVEAuditManager from the rest of the app by replacing all calls to CVEAuditManager to CVEAuditManagerOVAL, and make the CVEAuditManagerOVAL#listSystemsByPatchStatus method fallback to CVEAuditManager#listSystemsByPatchStatus when the system cannot be audited with OVAL (OVAL not synced or not supported by the system's OS). This way, in the future, when all distributions become supported for performing OVAL-based CVE auditing, we can just delete CVEAuditManager and its test class. - CVEAuditManager contains also methods for managing the CVE channels. For now, we can create the same methods in CVEAuditManagerOVAL and redirect them to their equivalent in CVEAuditManager. But in the future, when we don't need CVEAuditManager anymore, we can move them entirely to CVEAuditManagerOVAL or put them in their own class. - The upside is that we can keep the tests for CVEAuditManager, which tests the channels-based algorithm, and we make the transition later when we don't need the channels algorithm anymore, easier. The downside is a lot of potential duplication in CVEAuditManagerOVAL tests given that need to maintain both channels and OVAL-based implementations.
-
Decouple CVEAuditManager completely from the rest of the code
- Now, it's only used by CVEAuditManagerOVAL and CVEAuditManagerTest
-
-
-
- Test fails with exception 'could not initialize proxy - no Session' otherwise
-
-
-
Remove custom caching of OVALPlatform objects
- Since the hashmap used for caching was defined as a static field, it created collision between testcases
-
-
-
-
Remove uninstalled vulnerable packages
- Because they are irrelevant and their presence could lead to false evaluations
-
-
-
-
-
-
-
-
-
-
-
-
-
