class ForemanScapClient::Client
Attributes
config[R]
policy_id[R]
tailored[R]
Public Instance Methods
run(policy_id)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 17 def run(policy_id) @policy_id = policy_id load_config ensure_scan_file ensure_tailoring_file Dir.mktmpdir do |dir| @tmp_dir = dir scan bzip upload end end
Private Instance Methods
bzip()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 131 def bzip puts 'DEBUG: running: ' + bzip_command result = %x`#{bzip_command}` if !$?.success? puts 'bzip failed' puts results exit(2) end end
bzip_command()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 127 def bzip_command "/usr/bin/env bzip2 #{results_path}" end
download_uri(download_path)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 221 def download_uri(download_path) foreman_proxy_uri + "#{download_path}" end
ensure_file(dir, download_path, type_humanized)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 193 def ensure_file(dir, download_path, type_humanized) return if File.exist?(config[policy_id][dir]) puts "File #{config[policy_id][dir]} is missing. Downloading it from proxy." begin FileUtils.mkdir_p(File.dirname(config[policy_id][dir])) uri = URI.parse(download_uri(config[policy_id][download_path])) puts "Download #{type_humanized} xml from: #{uri}" request = generate_https_object(uri).get(uri.path) request.value ds_content_xml = request.body open(config[policy_id][dir], 'wb') do |file| file << ds_content_xml end rescue StandardError => e puts "#{type_humanized} is missing and download failed with error: #{e.message}" exit(5) end end
ensure_policy_exist()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 186 def ensure_policy_exist if config[@policy_id].nil? puts "Policy id #{@policy_id} not found." exit(1) end end
ensure_scan_file()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 212 def ensure_scan_file ensure_file :content_path, :download_path, "SCAP content" end
ensure_tailoring_file()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 216 def ensure_tailoring_file return unless tailored ensure_file :tailoring_path, :tailoring_download_path, "Tailoring file" end
foreman_proxy_uri()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 164 def foreman_proxy_uri foreman_proxy_fqdn = config[:server] foreman_proxy_port = config[:port] "https://#{foreman_proxy_fqdn}:#{foreman_proxy_port}" end
foreman_upload_result(response)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 225 def foreman_upload_result(response) begin print_upload_result JSON.parse(response.body) rescue StandardError => e # rescue and print nothing if older proxy version does not respond with json we expect end end
generate_https_object(uri)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 170 def generate_https_object(uri) https = Net::HTTP.new(uri.host, uri.port) https.use_ssl = true https.verify_mode = OpenSSL::SSL::VERIFY_PEER https.ca_file = config[:ca_file] begin https.cert = OpenSSL::X509::Certificate.new File.read(config[:host_certificate]) https.key = OpenSSL::PKey::RSA.new File.read(config[:host_private_key]) rescue StandardError => e puts 'Unable to load certs' puts e.message exit(3) end https end
http_proxy_uri()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 94 def http_proxy_uri return nil unless config[:http_proxy_server] && config[:http_proxy_port] http_proxy_server = config[:http_proxy_server] http_proxy_port = config[:http_proxy_port] "http://#{http_proxy_server}:#{http_proxy_port}" end
legacy_run_scan()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 70 def legacy_run_scan warn_proxy_not_supported result = %x`#{scan_command}` if $?.success? || $?.exitstatus == 2 @report = results_path else puts 'Scan failed' puts result exit(2) end end
load_config()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 36 def load_config @config ||= YAML.load_file(CONFIG_FILE) ensure_policy_exist @tailored = @config[policy_id][:tailoring_path] && !@config[policy_id][:tailoring_path].empty? rescue => e puts 'Config file could not be loaded' puts e.message exit(1) end
print_upload_result(parsed)
click to toggle source
# File lib/foreman_scap_client/client.rb, line 233 def print_upload_result(parsed) if parsed['id'] puts "Report uploaded, report id: #{parsed['id']}" else puts "Report not uploaded from proxy to Foreman server, cause: #{parsed['result']}" end end
results_bzip_path()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 105 def results_bzip_path "#{results_path}.bz2" end
results_path()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 101 def results_path "#{@tmp_dir}/results.xml" end
run_scan()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 57 def run_scan stdout_str, error_str, result = Open3.capture3(scan_command_env_vars, scan_command) if result.success? || result.exitstatus == 2 puts error_str.split("\n").select { |item| item.start_with?('WARNING:') || item.start_with?('Downloading') }.join("\n") @report = results_path else puts 'Scan failed' puts stdout_str puts error_str exit(2) end end
scan()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 46 def scan puts "DEBUG: running: " + scan_command puts "with ENV vars: #{scan_command_env_vars}" unless scan_command_env_vars.empty? if RUBY_VERSION.start_with? '1.8' legacy_run_scan else run_scan end end
scan_command()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 109 def scan_command if config[@policy_id] && config[@policy_id][:profile] && !config[@policy_id][:profile].empty? profile = "--profile #{config[@policy_id][:profile]}" else profile = '' end fetch_remote_resources = if config[:fetch_remote_resources] '--fetch-remote-resources' else '' end "oscap xccdf eval #{fetch_remote_resources} #{profile} #{tailoring_subcommand} --results-arf #{results_path} #{config[@policy_id][:content_path]}" end
scan_command_env_vars()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 83 def scan_command_env_vars if http_proxy_uri { 'HTTP_PROXY' => http_proxy_uri, 'HTTPS_PROXY' => http_proxy_uri } else {} end end
tailoring_subcommand()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 123 def tailoring_subcommand tailored ? "--tailoring-file #{config[policy_id][:tailoring_path]}" : "" end
upload()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 141 def upload uri = URI.parse(upload_uri) puts "Uploading results to #{uri}" https = generate_https_object(uri) request = Net::HTTP::Post.new uri.path request.body = File.read(results_bzip_path) request['Content-Type'] = 'text/xml' request['Content-Encoding'] = 'x-bzip2' begin res = https.request(request) value = res.value foreman_upload_result res rescue StandardError => e puts res.body if res puts "Upload failed: #{e.message}" exit(4) end end
upload_uri()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 160 def upload_uri foreman_proxy_uri + "/compliance/arf/#{@policy_id}" end
warn_proxy_not_supported()
click to toggle source
# File lib/foreman_scap_client/client.rb, line 32 def warn_proxy_not_supported puts 'Configuration for HTTP(S) proxy found but not supported for ruby 1.8' if http_proxy_uri end