From 8775c2c359c9360df3ad9ae27d6dd4f1e8c7f3ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 13 May 2024 17:08:23 +0100 Subject: [PATCH 01/24] fix: remove CVE-2023-4822 and include enterprise packages --- .../vuln_packages.json | 72 +++++++++++-------- 1 file changed, 44 insertions(+), 28 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json index 3aa8cc9777..eb63d4b624 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json @@ -31,8 +31,7 @@ "CVE-2022-31097", "CVE-2022-23552", "CVE-2022-23498", - "CVE-2023-3128", - "CVE-2023-4822" + "CVE-2023-3128" ], "urls": { "ubuntu": { @@ -63,8 +62,7 @@ "CVE-2022-31097", "CVE-2022-23552", "CVE-2022-23498", - "CVE-2023-3128", - "CVE-2023-4822" + "CVE-2023-3128" ], "urls": { "centos": { @@ -94,8 +92,7 @@ "CVE-2022-31107", "CVE-2022-31097", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "ubuntu": { @@ -125,8 +122,7 @@ "CVE-2022-31107", "CVE-2022-31097", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "centos": { @@ -152,8 +148,7 @@ "CVE-2022-31130", "CVE-2022-31123", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "ubuntu": { @@ -179,8 +174,7 @@ "CVE-2022-31130", "CVE-2022-31123", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "centos": { @@ -206,8 +200,7 @@ "CVE-2022-39307", "CVE-2022-39306", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "ubuntu": { @@ -233,8 +226,7 @@ "CVE-2022-39307", "CVE-2022-39306", "CVE-2022-23552", - "CVE-2022-23498", - "CVE-2023-4822" + "CVE-2022-23498" ], "urls": { "centos": { @@ -292,29 +284,53 @@ }, "uninstall_name": "grafana*" }, - "grafana-10.0.0": { - "package_name": "grafana", + "grafana-enterprise-10.0.0": { + "package_name": "grafana-enterprise", "package_version": "10.0.0", - "CVE": ["CVE-2023-4822", "CVE-2023-4399", "CVE-2023-4822"], + "CVE": ["CVE-2023-4822"], "urls": { "ubuntu": { - "amd64": "https://dl.grafana.com/oss/release/grafana_10.0.0_amd64.deb", - "arm64v8": "https://dl.grafana.com/oss/release/grafana_10.0.0_arm64.deb" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_amd64.deb", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_arm64.deb" } }, - "uninstall_name": "grafana*" + "uninstall_name": "grafana-enterprise*" }, - "grafana-10.0.0-1": { - "package_name": "grafana", + "grafana-enterprise-10.0.0-1": { + "package_name": "grafana-enterprise", "package_version": "10.0.0-1", - "CVE": ["CVE-2023-4822", "CVE-2023-4399", "CVE-2023-4822"], + "CVE": ["CVE-2023-4822"], "urls": { "centos": { - "amd64": "https://dl.grafana.com/oss/release/grafana-10.0.0-1.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/oss/release/grafana-10.0.0-1.aarch64.rpm" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.aarch64.rpm" } }, - "uninstall_name": "grafana*" + "uninstall_name": "grafana-enterprise*" + }, + "grafana-enterprise-10.4.2": { + "package_name": "grafana-enterprise", + "package_version": "10.4.2", + "CVE": ["CVE-2023-4822"], + "urls": { + "ubuntu": { + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.4.2_amd64.deb", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.4.2_arm64.deb" + } + }, + "uninstall_name": "grafana-enterprise*" + }, + "grafana-enterprise-10.4.2-1": { + "package_name": "grafana-enterprise", + "package_version": "10.4.2-1", + "CVE": [], + "urls": { + "centos": { + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.4.2-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.4.2-1.aarch64.rpm" + } + }, + "uninstall_name": "grafana-enterprise*" }, "vlc-3.0.6": { "package_name": "VLC media player", From f0a3e960897e7d1bdb95c44648df8cc91a80279d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 13 May 2024 17:08:53 +0100 Subject: [PATCH 02/24] fix: change vulntononvuln test case packages --- .../cases/test_vulnerability.yaml | 40 +++++++++++++------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml index d41fa851ff..379838bf8d 100644 --- a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml +++ b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml @@ -224,6 +224,15 @@ macos: amd64: http-proxy-0.7.2 arm64v8: http-proxy-0.7.2 + teardown: + operation: remove_package + package: + centos: + amd64: grafana-9.4.17-1 + arm64v8: grafana-9.4.17-1 + ubuntu: + amd64: grafana-9.4.17 + arm64v8: grafana-9.4.17 - case: 'Upgrade: Non vulnerable to vulnerable package' id: upgrade_package_nonvulnerable_to_vulnerable @@ -235,16 +244,23 @@ macos: amd64: luxon-2.5.2 arm64v8: luxon-2.5.2 + centos: + amd64: grafana-enterprise-10.0.0-1 + arm64v8: grafana-enterprise-10.0.0-1 + ubuntu: + amd64: grafana-enterprise-10.0.0 + arm64v8: grafana-enterprise-10.0.0 + body: operation: update_package package: from: centos: - amd64: grafana-9.5.13-1 - arm64v8: grafana-9.5.13-1 + amd64: grafana-enterprise-10.0.0-1 + arm64v8: grafana-enterprise-10.0.0-1 ubuntu: - amd64: grafana-9.5.13 - arm64v8: grafana-9.5.13 + amd64: grafana-enterprise-10.0.0 + arm64v8: grafana-enterprise-10.0.0 windows: amd64: node-v18.20.2 macos: @@ -252,11 +268,11 @@ arm64v8: luxon-2.5.2 to: centos: - amd64: grafana-10.0.0-1 - arm64v8: grafana-10.0.0-1 + amd64: grafana-enterprise-10.4.2-1 + arm64v8: grafana-enterprise-10.4.2-1 ubuntu: - amd64: grafana-10.0.0 - arm64v8: grafana-10.0.0 + amd64: grafana-enterprise-10.4.2-1 + arm64v8: grafana-enterprise-10.4.2-1 windows: amd64: node-v20.5.1 macos: @@ -266,11 +282,11 @@ operation: remove_package package: centos: - amd64: grafana-10.0.0-1 - arm64v8: grafana-10.0.0-1 + amd64: grafana-enterprise-10.4.2-1 + arm64v8: grafana-enterprise-10.4.2-1 ubuntu: - amd64: grafana-10.0.0 - arm64v8: grafana-10.0.0 + amd64: grafana-enterprise-10.4.2-1 + arm64v8: grafana-enterprise-10.4.2-1 windows: amd64: node-v20.5.1 macos: From 1495118da106198e9f872826556f12130178b099 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 13 May 2024 17:09:47 +0100 Subject: [PATCH 03/24] fix: give support for teardown for certain OS --- .../end_to_end/test_vulnerability_detector/conftest.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index a242eaef7c..3fdd746978 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -309,8 +309,6 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: result = launch_parallel_operations(preconditions, host_manager, target_to_ignore) logging.info(f"Preconditions finished. Results: {result}") - logging.info(f"Result of preconditions: {result}") - test_timestamp = datetime.datetime.now(datetime.timezone.utc) test_timestamp = test_timestamp.strftime("%Y-%m-%dT%H:%M:%S") @@ -343,7 +341,13 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: logging.info("Running teardown") if teardown: - result = launch_parallel_operations(teardown, host_manager) + + if 'target_os' in preconditions: + agents_to_check = filter_hosts_by_os(host_manager, preconditions['target_os']) + target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) + + result = launch_parallel_operations(preconditions, host_manager, target_to_ignore) + logging.info(f"Teardown Results: {result}") @pytest.fixture(scope='session', autouse=True) From 335a9c9dcec15a07b6a82eb8a4371b4c053b65b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 13 May 2024 17:28:50 +0100 Subject: [PATCH 04/24] fix: wrong grafana enterprise version for E2E test case --- .../vuln_packages.json | 39 +++++++++--------- .../cases/test_vulnerability.yaml | 41 +++++++++---------- 2 files changed, 40 insertions(+), 40 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json index eb63d4b624..520450f594 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json @@ -284,54 +284,55 @@ }, "uninstall_name": "grafana*" }, - "grafana-enterprise-10.0.0": { + "grafana-enterprise-9.5.18": { "package_name": "grafana-enterprise", - "package_version": "10.0.0", - "CVE": ["CVE-2023-4822"], + "package_version": "9.5.18", + "CVE": [], "urls": { "ubuntu": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_amd64.deb", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_arm64.deb" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_9.5.18_amd64.deb", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_9.5.18_arm64.deb" } }, "uninstall_name": "grafana-enterprise*" }, - "grafana-enterprise-10.0.0-1": { + "grafana-enterprise-9.5.18-1": { "package_name": "grafana-enterprise", - "package_version": "10.0.0-1", - "CVE": ["CVE-2023-4822"], + "package_version": "9.5.18-1", + "CVE": [], "urls": { "centos": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.aarch64.rpm" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-9.5.18-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-9.5.18-1.aarch64.rpm" } }, "uninstall_name": "grafana-enterprise*" }, - "grafana-enterprise-10.4.2": { + "grafana-enterprise-10.0.0": { "package_name": "grafana-enterprise", - "package_version": "10.4.2", + "package_version": "10.0.0", "CVE": ["CVE-2023-4822"], "urls": { "ubuntu": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.4.2_amd64.deb", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.4.2_arm64.deb" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_amd64.deb", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_arm64.deb" } }, "uninstall_name": "grafana-enterprise*" }, - "grafana-enterprise-10.4.2-1": { + "grafana-enterprise-10.0.0-1": { "package_name": "grafana-enterprise", - "package_version": "10.4.2-1", - "CVE": [], + "package_version": "10.0.0-1", + "CVE": ["CVE-2023-4822"], "urls": { "centos": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.4.2-1.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.4.2-1.aarch64.rpm" + "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.aarch64.rpm" } }, "uninstall_name": "grafana-enterprise*" }, + "vlc-3.0.6": { "package_name": "VLC media player", "package_version": "3.0.6", diff --git a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml index 379838bf8d..e6399462e5 100644 --- a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml +++ b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml @@ -228,11 +228,11 @@ operation: remove_package package: centos: - amd64: grafana-9.4.17-1 - arm64v8: grafana-9.4.17-1 + amd64: grafana-9.5.13-1 + arm64v8: grafana-9.5.13-1 ubuntu: - amd64: grafana-9.4.17 - arm64v8: grafana-9.4.17 + amd64: grafana-9.5.13 + arm64v8: grafana-9.5.13 - case: 'Upgrade: Non vulnerable to vulnerable package' id: upgrade_package_nonvulnerable_to_vulnerable @@ -245,22 +245,21 @@ amd64: luxon-2.5.2 arm64v8: luxon-2.5.2 centos: - amd64: grafana-enterprise-10.0.0-1 - arm64v8: grafana-enterprise-10.0.0-1 + amd64: grafana-enterprise-9.5.18-1 + arm64v8: grafana-enterprise-9.5.18-1 ubuntu: - amd64: grafana-enterprise-10.0.0 - arm64v8: grafana-enterprise-10.0.0 - + amd64: grafana-enterprise-9.5.18 + arm64v8: grafana-enterprise-9.5.18 body: operation: update_package package: from: centos: - amd64: grafana-enterprise-10.0.0-1 - arm64v8: grafana-enterprise-10.0.0-1 + amd64: grafana-enterprise-9.5.18-1 + arm64v8: grafana-enterprise-9.5.18-1 ubuntu: - amd64: grafana-enterprise-10.0.0 - arm64v8: grafana-enterprise-10.0.0 + amd64: grafana-enterprise-9.5.18 + arm64v8: grafana-enterprise-9.5.18 windows: amd64: node-v18.20.2 macos: @@ -268,11 +267,11 @@ arm64v8: luxon-2.5.2 to: centos: - amd64: grafana-enterprise-10.4.2-1 - arm64v8: grafana-enterprise-10.4.2-1 + amd64: grafana-enterprise-10.0.0-1 + arm64v8: grafana-enterprise-10.0.0-1 ubuntu: - amd64: grafana-enterprise-10.4.2-1 - arm64v8: grafana-enterprise-10.4.2-1 + amd64: grafana-enterprise-10.0.0 + arm64v8: grafana-enterprise-10.0.0 windows: amd64: node-v20.5.1 macos: @@ -282,11 +281,11 @@ operation: remove_package package: centos: - amd64: grafana-enterprise-10.4.2-1 - arm64v8: grafana-enterprise-10.4.2-1 + amd64: grafana-enterprise-10.0.0-1 + arm64v8: grafana-enterprise-10.0.0-1 ubuntu: - amd64: grafana-enterprise-10.4.2-1 - arm64v8: grafana-enterprise-10.4.2-1 + amd64: grafana-enterprise-10.0.0 + arm64v8: grafana-enterprise-10.0.0 windows: amd64: node-v20.5.1 macos: From 43dbac54d83e4c62b1234f53739bdc11a54a71f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 09:05:54 +0100 Subject: [PATCH 05/24] docs: include 5369 changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c0723f5f2..c88a8807f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -61,6 +61,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Remove false positive from E2E Vulnerability Detection tests ([#5369](https://github.com/wazuh/wazuh-qa/pull/5369)) \- (Framework) - Fix E2E Vulnerability Detection Windows package installation error ([#5363](https://github.com/wazuh/wazuh-qa/pull/5363)) \- (Framework) - Fix shutdown messages system test ([#5298](https://github.com/wazuh/wazuh-qa/pull/5298)) \- (Framework + Tests) - Fix upgrade macOS package cases for vulnerability scanner E2E ([#5334](https://github.com/wazuh/wazuh-qa/pull/5334)) \- (Tests) From c1db0f43eacbf1cd205b2bba7ef0e1c8afaf332e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 19:03:34 +0100 Subject: [PATCH 06/24] fix: replace grafana enterprise with grafana for E2E tests --- .../vuln_packages.json | 73 +++++++++---------- .../cases/test_vulnerability.yaml | 54 ++++++++------ 2 files changed, 66 insertions(+), 61 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json index 520450f594..1df4efa72a 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json @@ -132,6 +132,30 @@ }, "uninstall_name": "grafana*" }, + "grafana-8.5.27": { + "package_name": "grafana", + "package_version": "8.5.27", + "CVE": [], + "urls": { + "centos": { + "amd64": "https://dl.grafana.com/oss/release/grafana-8.5.27.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/oss/release/grafana-8.5.27.aarch64.rpm" + } + }, + "uninstall_name": "grafana*" + }, + "grafana-8.5.27-1": { + "package_name": "grafana", + "package_version": "8.5.27-1", + "CVE": [], + "urls": { + "centos": { + "amd64": "https://dl.grafana.com/oss/release/grafana-8.5.27-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/oss/release/grafana-8.5.27-1.aarch64.rpm" + } + }, + "uninstall_name": "grafana*" + }, "grafana-9.1.1": { "package_name": "grafana", "package_version": "9.1.1", @@ -284,55 +308,30 @@ }, "uninstall_name": "grafana*" }, - "grafana-enterprise-9.5.18": { - "package_name": "grafana-enterprise", - "package_version": "9.5.18", + "grafana-9.5.17": { + "package_name": "grafana", + "package_version": "9.5.17", "CVE": [], "urls": { "ubuntu": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_9.5.18_amd64.deb", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_9.5.18_arm64.deb" + "amd64": "https://dl.grafana.com/oss/release/grafana_9.5.17_amd64.deb", + "arm64v8": "https://dl.grafana.com/oss/release/grafana_9.5.17_arm64.deb" } }, - "uninstall_name": "grafana-enterprise*" + "uninstall_name": "grafana*" }, - "grafana-enterprise-9.5.18-1": { - "package_name": "grafana-enterprise", - "package_version": "9.5.18-1", + "grafana-9.5.17-1": { + "package_name": "grafana", + "package_version": "9.5.17-1", "CVE": [], "urls": { "centos": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-9.5.18-1.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-9.5.18-1.aarch64.rpm" + "amd64": "https://dl.grafana.com/oss/release/grafana-9.5.17-1.x86_64.rpm", + "arm64v8": "https://dl.grafana.com/oss/release/grafana-9.5.17-1.aarch64.rpm" } }, - "uninstall_name": "grafana-enterprise*" - }, - "grafana-enterprise-10.0.0": { - "package_name": "grafana-enterprise", - "package_version": "10.0.0", - "CVE": ["CVE-2023-4822"], - "urls": { - "ubuntu": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_amd64.deb", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise_10.0.0_arm64.deb" - } - }, - "uninstall_name": "grafana-enterprise*" - }, - "grafana-enterprise-10.0.0-1": { - "package_name": "grafana-enterprise", - "package_version": "10.0.0-1", - "CVE": ["CVE-2023-4822"], - "urls": { - "centos": { - "amd64": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/enterprise/release/grafana-enterprise-10.0.0-1.aarch64.rpm" - } - }, - "uninstall_name": "grafana-enterprise*" + "uninstall_name": "grafana*" }, - "vlc-3.0.6": { "package_name": "VLC media player", "package_version": "3.0.6", diff --git a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml index e6399462e5..2a636b4ce5 100644 --- a/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml +++ b/tests/end_to_end/test_vulnerability_detector/cases/test_vulnerability.yaml @@ -44,6 +44,7 @@ Upgrade of a vulnerable package which maintain vulnerability preconditions: operation: install_package + target_os: ['centos', 'ubuntu', 'windows', 'macos'] package: centos: amd64: grafana-8.5.5-1 @@ -89,6 +90,7 @@ description: | Upgrade of a vulnerable package which include a new vulnerability preconditions: + target_os: ['macos'] operation: install_package package: macos: @@ -128,6 +130,7 @@ Upgrade of a vulnerable package which maintain vulnerabilities and include new ones preconditions: + target_os: ["macos"] operation: install_package package: macos: @@ -225,6 +228,7 @@ amd64: http-proxy-0.7.2 arm64v8: http-proxy-0.7.2 teardown: + target_os: ['centos', 'ubuntu'] operation: remove_package package: centos: @@ -239,27 +243,28 @@ description: | Upgrade to non vulnerable package to vulnerable preconditions: + target_os: ['centos', 'ubuntu', 'macos'] operation: install_package package: macos: amd64: luxon-2.5.2 arm64v8: luxon-2.5.2 centos: - amd64: grafana-enterprise-9.5.18-1 - arm64v8: grafana-enterprise-9.5.18-1 + amd64: grafana-8.5.27-1 + arm64v8: grafana-8.5.27-1 ubuntu: - amd64: grafana-enterprise-9.5.18 - arm64v8: grafana-enterprise-9.5.18 + amd64: grafana-8.5.27 + arm64v8: grafana-8.5.27 body: operation: update_package package: from: centos: - amd64: grafana-enterprise-9.5.18-1 - arm64v8: grafana-enterprise-9.5.18-1 + amd64: grafana-8.5.27-1 + arm64v8: grafana-8.5.27-1 ubuntu: - amd64: grafana-enterprise-9.5.18 - arm64v8: grafana-enterprise-9.5.18 + amd64: grafana-8.5.27 + arm64v8: grafana-8.5.27 windows: amd64: node-v18.20.2 macos: @@ -267,11 +272,11 @@ arm64v8: luxon-2.5.2 to: centos: - amd64: grafana-enterprise-10.0.0-1 - arm64v8: grafana-enterprise-10.0.0-1 + amd64: grafana-9.1.1-1 + arm64v8: grafana-9.1.1-1 ubuntu: - amd64: grafana-enterprise-10.0.0 - arm64v8: grafana-enterprise-10.0.0 + amd64: grafana-9.1.1 + arm64v8: grafana-9.1.1 windows: amd64: node-v20.5.1 macos: @@ -279,13 +284,14 @@ arm64v8: luxon-3.0.0 teardown: operation: remove_package + target_os: ['centos', 'ubuntu', 'macos', 'windows'] package: centos: - amd64: grafana-enterprise-10.0.0-1 - arm64v8: grafana-enterprise-10.0.0-1 + amd64: grafana-9.1.1-1 + arm64v8: grafana-9.1.1-1 ubuntu: - amd64: grafana-enterprise-10.0.0 - arm64v8: grafana-enterprise-10.0.0 + amd64: grafana-9.1.1 + arm64v8: grafana-9.1.1 windows: amd64: node-v20.5.1 macos: @@ -300,11 +306,11 @@ operation: install_package package: centos: - amd64: grafana-9.5.13-1 - arm64v8: grafana-9.5.13-1 + amd64: grafana-9.5.17-1 + arm64v8: grafana-9.5.17-1 ubuntu: - amd64: grafana-9.5.13 - arm64v8: grafana-9.5.13 + amd64: grafana-9.5.17 + arm64v8: grafana-9.5.17 windows: amd64: node-v18.20.0 macos: @@ -319,11 +325,11 @@ operation: remove_package package: centos: - amd64: grafana-9.5.13-1 - arm64v8: grafana-9.5.13-1 + amd64: grafana-9.5.17-1 + arm64v8: grafana-9.5.17-1 ubuntu: - amd64: grafana-9.5.13 - arm64v8: grafana-9.5.13 + amd64: grafana-9.5.17 + arm64v8: grafana-9.5.17 windows: amd64: node-v18.20.0 macos: From f743c5cdc2ac62726804938e84e2cc94f06a2ec1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 19:03:56 +0100 Subject: [PATCH 07/24] fix: teardown fixture --- tests/end_to_end/test_vulnerability_detector/conftest.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index 3fdd746978..53a093e4e0 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -341,13 +341,14 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: logging.info("Running teardown") if teardown: - - if 'target_os' in preconditions: + if 'target_os' in teardown: agents_to_check = filter_hosts_by_os(host_manager, preconditions['target_os']) target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) - result = launch_parallel_operations(preconditions, host_manager, target_to_ignore) - logging.info(f"Teardown Results: {result}") + logging.critical(f"Running teardown for agent: {agents_to_check}") + + result = launch_parallel_operations(teardown, host_manager, target_to_ignore) + logging.critical(f"Teardown Results: {result}") @pytest.fixture(scope='session', autouse=True) From c708a8d7b1e1d5da3a6f6b2f757be718b7be4f05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 19:08:27 +0100 Subject: [PATCH 08/24] fix: wrong debian packages for grafana --- .../vulnerability_detector_packages/vuln_packages.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json index 1df4efa72a..c9436359ab 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json @@ -137,9 +137,9 @@ "package_version": "8.5.27", "CVE": [], "urls": { - "centos": { - "amd64": "https://dl.grafana.com/oss/release/grafana-8.5.27.x86_64.rpm", - "arm64v8": "https://dl.grafana.com/oss/release/grafana-8.5.27.aarch64.rpm" + "ubuntu": { + "amd64": "https://dl.grafana.com/oss/release/grafana_8.5.27_amd64.deb", + "arm64v8": "https://dl.grafana.com/oss/release/grafana_8.5.27_arm64.deb" } }, "uninstall_name": "grafana*" From 11dc48f1b10d5218e2a50fc3e1bbac8b1e3d3e2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 20:18:08 +0100 Subject: [PATCH 09/24] feat: comment macos agent for testing --- .../environments/e2e_vulnerability_detector.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/provisioning/environments/e2e_vulnerability_detector.yaml b/provisioning/environments/e2e_vulnerability_detector.yaml index f0fe3aff01..a2cf1b9089 100644 --- a/provisioning/environments/e2e_vulnerability_detector.yaml +++ b/provisioning/environments/e2e_vulnerability_detector.yaml @@ -35,8 +35,8 @@ agent5: manager: manager2 architecture: arm64v8 -agent6: - roles: [agent] - os: macos_1400 - manager: manager1 - architecture: arm64v8 +# agent6: +# roles: [agent] +# os: macos_1400 +# manager: manager1 +# architecture: arm64v8 From fd26cf0c7edcf256c64928f35d3e921c08d1d363 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 14 May 2024 20:18:41 +0100 Subject: [PATCH 10/24] feat: uncomment macos agent e2e env --- .../environments/e2e_vulnerability_detector.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/provisioning/environments/e2e_vulnerability_detector.yaml b/provisioning/environments/e2e_vulnerability_detector.yaml index a2cf1b9089..f0fe3aff01 100644 --- a/provisioning/environments/e2e_vulnerability_detector.yaml +++ b/provisioning/environments/e2e_vulnerability_detector.yaml @@ -35,8 +35,8 @@ agent5: manager: manager2 architecture: arm64v8 -# agent6: -# roles: [agent] -# os: macos_1400 -# manager: manager1 -# architecture: arm64v8 +agent6: + roles: [agent] + os: macos_1400 + manager: manager1 + architecture: arm64v8 From dc954ed9af35dede3c264c3a82e5d988afded50c Mon Sep 17 00:00:00 2001 From: Julia Date: Wed, 15 May 2024 11:55:49 +0200 Subject: [PATCH 11/24] refactor: bump version --- CHANGELOG.md | 6 +++++- version.json | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b6aae55ca..236f357f4c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,11 @@ All notable changes to this project will be documented in this file. -## [4.7.4] - TBD +## [4.7.5] - TBD + +## [4.7.4] - 29/04/2024 + +- No changes ## [4.7.3] - 04/03/2024 diff --git a/version.json b/version.json index b3c2b7b62d..ac328ae6e8 100644 --- a/version.json +++ b/version.json @@ -1,4 +1,4 @@ { - "version": "4.7.4", - "revision": "40717" + "version": "4.7.5", + "revision": "40718" } From 628f65d2a043d389684d5f3d56efcef5983e9a21 Mon Sep 17 00:00:00 2001 From: Julia Date: Wed, 15 May 2024 11:57:41 +0200 Subject: [PATCH 12/24] refactor: add version to qa_docs --- deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml index 1ad1cb96dd..73d4ef8f53 100644 --- a/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml +++ b/deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml @@ -200,6 +200,7 @@ predefined_values: - 4.7.2 - 4.7.3 - 4.7.4 + - 4.7.5 tags: - active_response - agentd From d91cafb7de0dd273133158aacc2f6bf939313f65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Thu, 16 May 2024 16:43:15 +0100 Subject: [PATCH 13/24] fix: undefined target_to_ignore in teardown --- tests/end_to_end/test_vulnerability_detector/conftest.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index 53a093e4e0..5252702b77 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -341,6 +341,7 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: logging.info("Running teardown") if teardown: + target_to_ignore = [] if 'target_os' in teardown: agents_to_check = filter_hosts_by_os(host_manager, preconditions['target_os']) target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) From e628b904acdfcf1cf17e48181ec08585d6a56142 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Fri, 17 May 2024 18:33:51 +0100 Subject: [PATCH 14/24] fix: rename VD index --- .../wazuh_testing/end_to_end/indexer_api.py | 2 +- .../tools/performance/statistic.py | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py b/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py index 5bdf3c153a..0a02c936ed 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py @@ -18,7 +18,7 @@ from wazuh_testing.tools.system import HostManager -WAZUH_STATES_VULNERABILITIES_INDEXNAME = 'wazuh-states-vulnerabilities' +WAZUH_STATES_VULNERABILITIES_INDEXNAME = 'wazuh-states-vulnerabilities-wazuh' def create_vulnerability_states_indexer_filter(target_agent: str = None, diff --git a/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py b/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py index 79376a5edc..ca04a7c1d2 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py +++ b/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py @@ -155,7 +155,7 @@ def _parse_api_data(self): API_URL = f"https://{self.ip}:{self.port}" DAEMONS_ENDPOINT= f"/manager/daemons/stats?daemons_list={self.daemon}&wait_for_complete=true" - VULNS_ENDOPOINT= f"/wazuh-states-vulnerabilities/_count" + VULNS_ENDOPOINT= f"/wazuh-states-vulnerabilities-wazuh/_count" ALERTS_ENDPOINT= f"/wazuh-alerts-4.x-*/_count" TOKEN_ENDPOINT="/security/user/authenticate" @@ -164,7 +164,7 @@ def _parse_api_data(self): max_retries = 3 token_response = None daemon_response = None - data = None + data = None if(self.target == "vulnerabilities"): for _ in range(max_retries): @@ -244,14 +244,14 @@ def _write_csv(self, data, target, csv_file): csv_header = headers.agentd_header header = not isfile(csv_file) - + with open(csv_file, 'a+') as log: if header: log.write(f'{",".join(csv_header)}\n') timestamp = datetime.fromtimestamp(time()).strftime('%Y-%m-%d %H:%M:%S') - + if self.use_state_file == False: if target not in ["vulnerabilities", "alerts"]: format = r"%Y-%m-%dT%H:%M:%S+%f:00" @@ -259,7 +259,7 @@ def _write_csv(self, data, target, csv_file): datetime_uptime = datetime.strptime(data['uptime'], format) interval = (datetime_timestamp - datetime_uptime).total_seconds() - if target == "analysis": + if target == "analysis": metrics = data['metrics'] decoded = metrics['events']['received_breakdown']['decoded_breakdown'] decoded_modules = decoded['modules_breakdown'] @@ -425,11 +425,11 @@ def _write_csv(self, data, target, csv_file): ag_bd['tables']['syscheck']['fim_file'], # 17 ag_bd['tables']['syscheck']['fim_registry'], # 18 ag_bd['tables']['syscheck']['fim_registry_key'], # 19 - ag_bd['tables']['syscheck']['fim_registry_value'], # 20 + ag_bd['tables']['syscheck']['fim_registry_value'], # 20 ag_bd['tables']['syscollector']['syscollector_hotfixes'], # 21 - ag_bd['tables']['syscollector']['syscollector_hwinfo'], # 22 + ag_bd['tables']['syscollector']['syscollector_hwinfo'], # 22 ag_bd['tables']['syscollector']['syscollector_network_address'], # 23 - ag_bd['tables']['syscollector']['syscollector_network_iface'], # 24 + ag_bd['tables']['syscollector']['syscollector_network_iface'], # 24 ag_bd['tables']['syscollector']['syscollector_network_protocol'], # 25 ag_bd['tables']['syscollector']['syscollector_osinfo'], # 26 ag_bd['tables']['syscollector']['syscollector_packages'], # 27 @@ -438,7 +438,7 @@ def _write_csv(self, data, target, csv_file): vulnerability_data, # 30 received_breakdown['global'], # 31 glob_bd['db']['backup'], # 32 - glob_bd['db']['sql'], # 33 + glob_bd['db']['sql'], # 33 glob_bd['db']['vacuum'], # 34 glob_bd['db']['get_fragmentation'], # 35 glob_bd['tables']['agent']['delete-agent'], # 36 From 3e65c418fbd58834642946256a21928d294cd043 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 20 May 2024 08:45:23 +0100 Subject: [PATCH 15/24] fix: teardown target_os refference --- tests/end_to_end/test_vulnerability_detector/conftest.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index 5252702b77..0e2cf2acf0 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -343,7 +343,7 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: if teardown: target_to_ignore = [] if 'target_os' in teardown: - agents_to_check = filter_hosts_by_os(host_manager, preconditions['target_os']) + agents_to_check = filter_hosts_by_os(host_manager, teardown['target_os']) target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) logging.critical(f"Running teardown for agent: {agents_to_check}") From cb5745750a2e84b660d5f718b9cc9c3bd6f7e059 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 20 May 2024 10:33:33 +0100 Subject: [PATCH 16/24] fix: agents_to_check initialization --- tests/end_to_end/test_vulnerability_detector/conftest.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index 0e2cf2acf0..ac896d6676 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -342,6 +342,8 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: if teardown: target_to_ignore = [] + agents_to_check = host_manager.get_group_hosts("agent") + if 'target_os' in teardown: agents_to_check = filter_hosts_by_os(host_manager, teardown['target_os']) target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) From 721be5263b5f621c8d257385ac364972a5fe50e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 20 May 2024 10:58:54 +0100 Subject: [PATCH 17/24] feat: allow custom cluster name index --- .../wazuh_testing/end_to_end/indexer_api.py | 37 ++++++++++++++++++- .../end_to_end/vulnerability_detector.py | 7 ++-- .../wazuh_testing/tools/system.py | 4 ++ .../test_vulnerability_detector/conftest.py | 6 ++- 4 files changed, 47 insertions(+), 7 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py b/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py index 0a02c936ed..1ca658f186 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/indexer_api.py @@ -5,7 +5,19 @@ This module provides functions to interact with the Wazuh Indexer API. Functions: - - get_indexer_values: Retrieves values from the Indexer API. + - get_wazuh_states_vulnerabilities_indexname(cluster_name: str) -> str: + Generate the Wazuh states vulnerabilities index name for a given cluster. + - create_vulnerability_states_indexer_filter(target_agent: str = None, + greater_than_timestamp: str = None) -> dict + Create a filter for the Indexer API for the vulnerability state index. + - create_alerts_filter(target_agent: str = None, greater_than_timestamp: str = None) -> dict + Create a filter for the Indexer API for the alerts index. + - get_indexer_values(host_manager: HostManager, credentials: dict = {'user': 'admin', 'password': 'changeme'}, + index: str = 'wazuh-alerts*', filter: dict = None, size: int = 10000) -> Dict + Get values from the Wazuh Indexer API. + - delete_index(host_manager: HostManager, credentials: dict = {'user': 'admin', 'password': 'changeme'}, + index: str = 'wazuh-alerts*') + Delete index from the Wazuh Indexer API. Copyright (C) 2015, Wazuh Inc. Created by Wazuh, Inc. . @@ -18,7 +30,28 @@ from wazuh_testing.tools.system import HostManager -WAZUH_STATES_VULNERABILITIES_INDEXNAME = 'wazuh-states-vulnerabilities-wazuh' +WAZUH_STATES_VULNERABILITIES_INDEXNAME_TEMPLATE = 'wazuh-states-vulnerabilities-{cluster_name}' + + +def get_wazuh_states_vulnerabilities_indexname(cluster_name: str = 'wazuh') -> str: + """ + Generate the Wazuh states vulnerabilities index name for a given cluster. + + This function takes a cluster name as input and returns the corresponding + Wazuh states vulnerabilities index name by inserting the cluster name into + a predefined template. + + Args: + cluster_name (str): The name of the cluster to be included in the index name. + + Returns: + str: The formatted Wazuh states vulnerabilities index name. + + Example: + >>> get_wazuh_states_vulnerabilities_indexname('cluster1') + 'wazuh-states-vulnerabilities-cluster1' + """ + return WAZUH_STATES_VULNERABILITIES_INDEXNAME_TEMPLATE.format(cluster_name=cluster_name) def create_vulnerability_states_indexer_filter(target_agent: str = None, diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector.py b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector.py index c1f94fba45..871b07ffeb 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector.py +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector.py @@ -23,7 +23,7 @@ from wazuh_testing.tools.system import HostManager from wazuh_testing.end_to_end.indexer_api import get_indexer_values, create_vulnerability_states_indexer_filter, \ - create_alerts_filter, WAZUH_STATES_VULNERABILITIES_INDEXNAME + create_alerts_filter, get_wazuh_states_vulnerabilities_indexname from wazuh_testing.end_to_end.regex import REGEX_PATTERNS from collections import namedtuple @@ -275,7 +275,7 @@ def parse_vulnerability_from_state(state): def get_vulnerabilities_from_states_by_agent(host_manager: HostManager, agents: List[str], - greater_than_timestamp: str = None) -> dict: + greater_than_timestamp: str = None, cluster_name='wazuh') -> dict: """Get vulnerabilities from the vulnerability state index by agent. Args: @@ -302,11 +302,12 @@ def get_vulnerabilities_from_states_by_agent(host_manager: HostManager, agents: for agent in agents: agent_all_vulnerabilities = [] try: + index = get_wazuh_states_vulnerabilities_indexname(cluster_name) states_filter = create_vulnerability_states_indexer_filter(target_agent=agent, greater_than_timestamp=greater_than_timestamp) agent_all_vulnerabilities = get_indexer_values(host_manager, filter=states_filter, - index=WAZUH_STATES_VULNERABILITIES_INDEXNAME, + index=index, credentials={'user': indexer_user, 'password': indexer_password} )['hits']['hits'] diff --git a/deps/wazuh_testing/wazuh_testing/tools/system.py b/deps/wazuh_testing/wazuh_testing/tools/system.py index 8066c04a91..5d5c9261fd 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/system.py +++ b/deps/wazuh_testing/wazuh_testing/tools/system.py @@ -884,6 +884,10 @@ def get_api_credentials(self): return user, password + def get_cluster_name(self) -> str: + cluster_name = self.get_host_variables('all').get('cluster_name', 'wazuh') + return cluster_name + def get_indexer_credentials(self): default_user = 'admin' default_password = 'changeme' diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index a242eaef7c..75365f3366 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -52,7 +52,7 @@ def test_example(host_manager): restore_configuration, save_indexer_credentials_into_keystore) from wazuh_testing.end_to_end.indexer_api import ( - WAZUH_STATES_VULNERABILITIES_INDEXNAME, delete_index) + get_wazuh_states_vulnerabilities_indexname, delete_index) from wazuh_testing.end_to_end.logs import (get_hosts_alerts, get_hosts_logs, truncate_remote_host_group_files) from wazuh_testing.end_to_end.remote_operations_handler import ( @@ -162,7 +162,9 @@ def delete_states_vulnerability_index(host_manager: HostManager): """ yield logging.error("Delete vulnerability index") - delete_index(host_manager, index=WAZUH_STATES_VULNERABILITIES_INDEXNAME) + + cluster_name = host_manager.get_cluster_name() + delete_index(host_manager, index=get_wazuh_states_vulnerabilities_indexname(cluster_name)) def collect_e2e_environment_data(logs_path, host_manager) -> None: From b9d6f2b891c67ac89a89bfc07561d7ba70513edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Mon, 20 May 2024 11:29:28 +0100 Subject: [PATCH 18/24] fix: include CVE-2023-3128 in grafana 8.5.6 --- .../vulnerability_detector_packages/vuln_packages.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json index c9436359ab..ba155f72f7 100644 --- a/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json +++ b/deps/wazuh_testing/wazuh_testing/end_to_end/vulnerability_detector_packages/vuln_packages.json @@ -92,7 +92,8 @@ "CVE-2022-31107", "CVE-2022-31097", "CVE-2022-23552", - "CVE-2022-23498" + "CVE-2022-23498", + "CVE-2023-3128" ], "urls": { "ubuntu": { @@ -122,7 +123,8 @@ "CVE-2022-31107", "CVE-2022-31097", "CVE-2022-23552", - "CVE-2022-23498" + "CVE-2022-23498", + "CVE-2023-3128" ], "urls": { "centos": { From 6c204bdb756781276169f7f564d1237523ff591e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 21 May 2024 10:51:50 +0100 Subject: [PATCH 19/24] docs: include 5402 changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce14b30b0a..6262f7e563 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Update vulnerability state index name ([#5402](https://github.com/wazuh/wazuh-qa/pull/5402)) \- (Framework) - Include new package information from wdb ([#5350](https://github.com/wazuh/wazuh-qa/pull/5350)) \- (Tests) - Disable debug evidences for Vulnerability Detector E2E tests by default ([#5331](https://github.com/wazuh/wazuh-qa/pull/5331)) \- (Tests) - Include CVE-2023-4822 vulnerability to grafana packages ([#5332](https://github.com/wazuh/wazuh-qa/pull/5332)) \- (Framework) From fd21715840c68512dde177e7d993dbbec0f23b07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 21 May 2024 11:12:28 +0100 Subject: [PATCH 20/24] fix: get_cluster_name method --- deps/wazuh_testing/wazuh_testing/tools/system.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/deps/wazuh_testing/wazuh_testing/tools/system.py b/deps/wazuh_testing/wazuh_testing/tools/system.py index 5d5c9261fd..ce3015badf 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/system.py +++ b/deps/wazuh_testing/wazuh_testing/tools/system.py @@ -885,7 +885,13 @@ def get_api_credentials(self): return user, password def get_cluster_name(self) -> str: - cluster_name = self.get_host_variables('all').get('cluster_name', 'wazuh') + manager_list = self.get_group_hosts('manager') + if not manager_list: + raise ValueError("No manager defined in the environment") + + first_manager_vars = self.inventory_manager.get_host(manager_list[0]) + cluster_name = first_manager_vars.vars.get('cluster_name', 'wazuh') + return cluster_name def get_indexer_credentials(self): From ae4509c62227d2f0467ce0dc1365054cc6e9ff4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Tue, 21 May 2024 18:15:54 +0100 Subject: [PATCH 21/24] fix: include timeout to teardown --- tests/end_to_end/test_vulnerability_detector/conftest.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/end_to_end/test_vulnerability_detector/conftest.py b/tests/end_to_end/test_vulnerability_detector/conftest.py index ac896d6676..701f932655 100644 --- a/tests/end_to_end/test_vulnerability_detector/conftest.py +++ b/tests/end_to_end/test_vulnerability_detector/conftest.py @@ -307,7 +307,7 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: target_to_ignore = list(set(host_manager.get_group_hosts('agent')) - set(agents_to_check)) result = launch_parallel_operations(preconditions, host_manager, target_to_ignore) - logging.info(f"Preconditions finished. Results: {result}") + logging.critical(f"Preconditions finished. Results: {result}") test_timestamp = datetime.datetime.now(datetime.timezone.utc) test_timestamp = test_timestamp.strftime("%Y-%m-%dT%H:%M:%S") @@ -353,6 +353,10 @@ def setup(preconditions, teardown, host_manager) -> Generator[Dict, None, None]: result = launch_parallel_operations(teardown, host_manager, target_to_ignore) logging.critical(f"Teardown Results: {result}") + timeout_syscollector_scan = VD_E2E_TIMEOUT_SYSCOLLECTOR_SCAN + timeout_vulnerabilities_detected = len(agents_to_check) * PACKAGE_VULNERABILITY_SCAN_TIME + time.sleep(timeout_syscollector_scan + timeout_vulnerabilities_detected) + @pytest.fixture(scope='session', autouse=True) def handle_logs(): From c1e99250e5403cfc15f030f979020a236792b471 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Wed, 22 May 2024 09:15:24 +0100 Subject: [PATCH 22/24] refac: split cluster name from endpoint --- .../wazuh_testing/wazuh_testing/tools/performance/statistic.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py b/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py index ca04a7c1d2..8cb2a416d2 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py +++ b/deps/wazuh_testing/wazuh_testing/tools/performance/statistic.py @@ -154,8 +154,9 @@ def _parse_api_data(self): """Read the data generated by Wazuh API.""" API_URL = f"https://{self.ip}:{self.port}" + CLUSTER_NAME = 'wazuh' DAEMONS_ENDPOINT= f"/manager/daemons/stats?daemons_list={self.daemon}&wait_for_complete=true" - VULNS_ENDOPOINT= f"/wazuh-states-vulnerabilities-wazuh/_count" + VULNS_ENDOPOINT= f"/wazuh-states-vulnerabilities-{CLUSTER_NAME}/_count" ALERTS_ENDPOINT= f"/wazuh-alerts-4.x-*/_count" TOKEN_ENDPOINT="/security/user/authenticate" From 8f6455bd024eccaa091ff225916f01e66eb9a441 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Rebollo=20P=C3=A9rez?= Date: Wed, 22 May 2024 09:18:25 +0100 Subject: [PATCH 23/24] fix: value error exception message --- deps/wazuh_testing/wazuh_testing/tools/system.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deps/wazuh_testing/wazuh_testing/tools/system.py b/deps/wazuh_testing/wazuh_testing/tools/system.py index ce3015badf..d935c801b0 100644 --- a/deps/wazuh_testing/wazuh_testing/tools/system.py +++ b/deps/wazuh_testing/wazuh_testing/tools/system.py @@ -884,10 +884,10 @@ def get_api_credentials(self): return user, password - def get_cluster_name(self) -> str: + def get_cluster_name(self): manager_list = self.get_group_hosts('manager') if not manager_list: - raise ValueError("No manager defined in the environment") + raise ValueError("No manager is defined in the environment") first_manager_vars = self.inventory_manager.get_host(manager_list[0]) cluster_name = first_manager_vars.vars.get('cluster_name', 'wazuh') From 95773c599011581fd796c53363e963c5e339f663 Mon Sep 17 00:00:00 2001 From: jnasselle Date: Wed, 22 May 2024 12:38:57 -0300 Subject: [PATCH 24/24] feat: bump version to 40719 --- version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/version.json b/version.json index ac328ae6e8..f073b2e2ed 100644 --- a/version.json +++ b/version.json @@ -1,4 +1,4 @@ { "version": "4.7.5", - "revision": "40718" + "revision": "40719" }