backend/server/action_extra_data/scap.py
| 52 ++++--
client/rhel/spacewalk-oscap/xccdf-resume.xslt
| 13 +
java/code/src/com/redhat/rhn/common/db/datasource/xml/scap_queries.xml
| 21 +-
java/code/src/com/redhat/rhn/frontend/dto/XccdfIdentDto.java
| 85 ++++++++++
java/code/src/com/redhat/rhn/frontend/dto/XccdfRuleResultDto.java
| 74 +++++---
java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
| 11 -
java/code/src/com/redhat/rhn/manager/audit/ScapManager.java
| 14 +
java/code/webapp/WEB-INF/pages/systems/details/audit/xccdfdetails.jsp
| 16 +
reporting/reports/data/scap-scan-results
| 36 +++-
schema/spacewalk/common/tables/rhnXccdfIdent.sql
| 2
schema/spacewalk/common/tables/rhnXccdfRuleIdentMap.sql
| 32 +++
schema/spacewalk/common/tables/rhnXccdfRuleresult.sql
| 11 -
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.oracle
| 2
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.postgresql
| 3
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.oracle
| 12 +
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.postgresql
| 12 +
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.oracle
| 18 ++
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.postgresql
| 15 +
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/019-rhnXccdfRuleIdentMap_data.sql
| 7
schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/020-rhnXccdfRuleresult.sql
| 2
20 files changed, 363 insertions(+), 75 deletions(-)
New commits:
commit df34cbbea65848d0e5f63e54ceeee7310bc1e0e8
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Thu Mar 29 11:27:07 2012 +0200
Rework reporting to correspond with 0-n rule/ident mapping
diff --git a/reporting/reports/data/scap-scan-results
b/reporting/reports/data/scap-scan-results
old mode 100644
new mode 100755
index ce2f824..8adbee1
--- a/reporting/reports/data/scap-scan-results
+++ b/reporting/reports/data/scap-scan-results
@@ -10,6 +10,8 @@ description:
columns:
testresult_id:i Testresult identifier
+ ruleresult_id:i Ruleresult identifier
+ idref Ruleresult text identifier
system Naming scheme for the identifier
ident Identifier of the xccdf rule
result Result of the check
@@ -18,16 +20,34 @@ multival_columns:
sql:
- select testresult_id, system, ident, result from (
- select rhnxccdftestresult.id as testresult_id,
+ select testresult_id, ruleresult_id, idref, system, ident, result from (
+ select rhnxccdfruleresult.testresult_id as testresult_id,
+ rhnxccdfruleresult.id as ruleresult_id,
+ (select xi.identifier
+ from rhnxccdfruleidentmap rim, rhnxccdfident xi, rhnxccdfidentsystem xis
+ where rim.rresult_id = rhnxccdfruleresult.id
+ and rim.ident_id = xi.id
+ and xi.identsystem_id = xis.id
+ and xis.system = '#IDREF#'
+ ) as idref,
rhnxccdfidentsystem.system as system,
rhnxccdfident.identifier as ident,
rhnxccdfruleresulttype.label as result
- from rhnxccdftestresult, rhnxccdfruleresult, rhnxccdfruleresulttype, rhnxccdfident,
rhnxccdfidentsystem
- where rhnxccdftestresult.id = rhnxccdfruleresult.testresult_id
- and rhnxccdfruleresult.result_id = rhnxccdfruleresulttype.id
- and rhnxccdfruleresult.ident_id = rhnxccdfident.id
- and rhnxccdfident.identsystem_id = rhnxccdfidentsystem.id
+ from rhnxccdfruleresult
+ left outer join rhnxccdfruleresulttype
+ on rhnxccdfruleresult.result_id = rhnxccdfruleresulttype.id
+ left outer join rhnxccdfruleidentmap
+ on rhnxccdfruleresult.id = rhnxccdfruleidentmap.rresult_id
+ and (select count(*)
+ from rhnxccdfident xi, rhnxccdfidentsystem xis
+ where rhnxccdfruleidentmap.ident_id = xi.id
+ and xi.identsystem_id = xis.id
+ and xis.system = '#IDREF#'
+ ) = 0
+ left outer join rhnxccdfident
+ on rhnxccdfruleidentmap.ident_id = rhnxccdfident.id
+ left outer join rhnxccdfidentsystem
+ on rhnxccdfident.identsystem_id = rhnxccdfidentsystem.id
) X
-- where placeholder
- order by testresult_id, system, ident
+ order by testresult_id, ruleresult_id, system, ident
commit eba763151c4882e048b3edfe918594505bb167ea
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Mon Mar 26 12:41:46 2012 +0200
Rework web interface to correspond with 0-n rule/ident mapping
A single rule-result is now presented with
* idref (unique identifier within XCCDF document
* list of idents (CCE, CVE, ...)
* the result of the eval
Results submitted with older clients has idref set to Unknown.
diff --git a/java/code/src/com/redhat/rhn/common/db/datasource/xml/scap_queries.xml
b/java/code/src/com/redhat/rhn/common/db/datasource/xml/scap_queries.xml
index c30a097..deb69b8 100644
--- a/java/code/src/com/redhat/rhn/common/db/datasource/xml/scap_queries.xml
+++ b/java/code/src/com/redhat/rhn/common/db/datasource/xml/scap_queries.xml
@@ -34,17 +34,26 @@
<mode name="show_ruleresults"
class="com.redhat.rhn.frontend.dto.XccdfRuleResultDto">
<query params="xid">
- SELECT xis.system, xi.identifier, rrt.label
+ SELECT rr.id, rrt.label
FROM rhnXccdfRuleresult rr,
- rhnXccdfRuleresultType rrt,
- rhnXccdfIdent xi,
- rhnXccdfIdentSystem xis
+ rhnXccdfRuleresultType rrt
WHERE rr.testresult_id = :xid
- AND rr.ident_id = xi.id
AND rr.result_id = rrt.id
- AND xi.identsystem_id = xis.id
ORDER BY rrt.id
</query>
</mode>
+<mode name="idents_per_ruleresult"
class="com.redhat.rhn.frontend.dto.XccdfIdentDto">
+ <query params="rr_id">
+ SELECT xi.id, xi.identifier, xis.system
+ FROM rhnXccdfRuleIdentMap rim,
+ rhnXccdfIdent xi,
+ rhnXccdfIdentSystem xis
+ WHERE rim.rresult_id = :rr_id
+ AND rim.ident_id = xi.id
+ AND xi.identsystem_id = xis.id
+ ORDER BY xis.system
+ </query>
+</mode>
+
</datasource_modes>
diff --git a/java/code/src/com/redhat/rhn/frontend/dto/XccdfIdentDto.java
b/java/code/src/com/redhat/rhn/frontend/dto/XccdfIdentDto.java
new file mode 100644
index 0000000..f036830
--- /dev/null
+++ b/java/code/src/com/redhat/rhn/frontend/dto/XccdfIdentDto.java
@@ -0,0 +1,85 @@
+/**
+ * Copyright (c) 2012 Red Hat, Inc.
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ *
http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * Red Hat trademarks are not licensed under GPLv2. No permission is
+ * granted to use or replicate Red Hat trademarks that are incorporated
+ * in this software or its documentation.
+ */
+package com.redhat.rhn.frontend.dto;
+
+/**
+ * Simple DTO for transfering data from the DB to the UI through datasource.
+ * @version $Rev$
+ */
+public class XccdfIdentDto {
+
+ private Long id;
+ private String identifier;
+ private String system;
+
+ /**
+ * Returns id of xccdf:ident
+ * @return the id
+ */
+ public Long getId() {
+ return this.id;
+ }
+
+ /**
+ * Sets the id of xccdf:ident
+ * @param idIn to set
+ */
+ public void setId(Long idIn) {
+ this.id = idIn;
+ }
+
+ /**
+ * Returns the identifier of xccdf:ident
+ * @return the identifier
+ */
+ public String getIdentifier() {
+ return identifier;
+ }
+
+ /**
+ * Sets the identifier of xccdf:ident
+ * @param identifierIn to set
+ */
+ public void setIdentifier(String identifierIn) {
+ identifier = identifierIn;
+ }
+
+ /**
+ * Returns the naming system of xccdf:ident
+ * @return the system
+ */
+ public String getSystem() {
+ return system;
+ }
+
+ /**
+ * Sets the naming system of xccdf:ident
+ * @param systemIn to set
+ */
+ public void setSystem(String systemIn) {
+ system = systemIn;
+ }
+
+ /**
+ * Does this ident represent idref attribute?
+ * Note: Each rule-result element in the XCCDF document
+ * has 'idref' attribute which uniquely identifies
+ * the xccdf:Rule and xccdf:rule-result elements.
+ * @return true if this ident represent idref attribute
+ */
+ public boolean isDocumentIdref() {
+ return "#IDREF#".equals(this.system);
+ }
+}
diff --git a/java/code/src/com/redhat/rhn/frontend/dto/XccdfRuleResultDto.java
b/java/code/src/com/redhat/rhn/frontend/dto/XccdfRuleResultDto.java
index 7d07f6c..2e842d0 100644
--- a/java/code/src/com/redhat/rhn/frontend/dto/XccdfRuleResultDto.java
+++ b/java/code/src/com/redhat/rhn/frontend/dto/XccdfRuleResultDto.java
@@ -14,46 +14,34 @@
*/
package com.redhat.rhn.frontend.dto;
+import java.util.List;
+
+import com.redhat.rhn.manager.audit.ScapManager;
+
/**
* Simple DTO for transfering data from the DB to the UI through datasource.
* @version $Rev$
*/
public class XccdfRuleResultDto {
- private String system;
- private String identifier;
+ private Long id;
private String label;
+ private List<XccdfIdentDto> idents;
/**
- * Returns the xccdf:rule-result system
- * @return the system
- */
- public String getSystem() {
- return this.system;
- }
-
- /**
- * Sets the xccdf:rule-result system
- * @param systemIn to set
- */
- public void setSystem(String systemIn) {
- this.system = systemIn;
- }
-
- /**
- * Returns the xccdf:ident
- * @return the ident
+ * Returns id of xccdf:rule-result
+ * @return the id
*/
- public String getIdentifier() {
- return this.identifier;
+ public Long getId() {
+ return this.id;
}
/**
- * Sets the xccdf:ident
- * @param identifierIn to set
+ * Sets the id of xccdf:rule-result
+ * @param idIn to set
*/
- public void setIdentifier(String identifierIn) {
- this.identifier = identifierIn;
+ public void setId(Long idIn) {
+ this.id = idIn;
}
/**
@@ -71,4 +59,38 @@ public class XccdfRuleResultDto {
public void setLabel(String labelIn) {
label = labelIn;
}
+
+ /**
+ * Get idref attribute of xccdf:rule-result
+ * @return idref attribute
+ */
+ public String getDocumentIdref() {
+ for (XccdfIdentDto i : getIdents()) {
+ if (i.isDocumentIdref()) {
+ return i.getIdentifier();
+ }
+ }
+ return new String();
+ }
+
+ /**
+ * Return summary of xccdf:idents in xccdf:rule-result
+ * @return comma separated list of xccdf:ident identifiers
+ */
+ public String getIdentsString() {
+ String result = new String();
+ for (XccdfIdentDto i : getIdents()) {
+ if (!i.isDocumentIdref()) {
+ result += (result.isEmpty() ? "" : ", ") +
i.getIdentifier();
+ }
+ }
+ return result;
+ }
+
+ private List<XccdfIdentDto> getIdents() {
+ if (idents == null) {
+ idents = ScapManager.identsPerRuleResult(this.id);
+ }
+ return idents;
+ }
}
diff --git a/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
b/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
index 822b046..4e1e624 100644
--- a/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
+++ b/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
@@ -11886,15 +11886,18 @@ the <strong>Red Hat Enterprise Linux System
Administration Guide.</stro
<trans-unit id="system.audit.xccdfdetails.jsp.xccdfrules">
<source>XCCDF Rule Results</source>
</trans-unit>
- <trans-unit id="system.audit.xccdfdetails.jsp.scheme">
- <source>Naming System URI</source>
- </trans-unit>
- <trans-unit id="system.audit.xccdfdetails.jsp.ident">
+ <trans-unit id="system.audit.xccdfdetails.jsp.idref">
<source>XCCDF Rule Identifier</source>
</trans-unit>
+ <trans-unit id="system.audit.xccdfdetails.jsp.idents">
+ <source>XCCDF Ident Tags</source>
+ </trans-unit>
<trans-unit id="system.audit.xccdfdetails.jsp.result">
<source>Result</source>
</trans-unit>
+ <trans-unit id="system.audit.xccdfdetails.jsp.unknown">
+ <source>Unknown</source>
+ </trans-unit>
</group>
<!-- Action common -->
diff --git a/java/code/src/com/redhat/rhn/manager/audit/ScapManager.java
b/java/code/src/com/redhat/rhn/manager/audit/ScapManager.java
index 69f75f1..8f03779 100644
--- a/java/code/src/com/redhat/rhn/manager/audit/ScapManager.java
+++ b/java/code/src/com/redhat/rhn/manager/audit/ScapManager.java
@@ -24,6 +24,7 @@ import com.redhat.rhn.common.db.datasource.ModeFactory;
import com.redhat.rhn.common.db.datasource.SelectMode;
import com.redhat.rhn.domain.server.Server;
import com.redhat.rhn.domain.user.User;
+import com.redhat.rhn.frontend.dto.XccdfIdentDto;
import com.redhat.rhn.manager.BaseManager;
/**
@@ -75,6 +76,19 @@ public class ScapManager extends BaseManager {
return m.execute(params);
}
+ /**
+ * Show xccdf:ident results for given rule-result
+ * @param ruleResultId of XccdfRuleResultDto
+ * @return the list of idents
+ */
+ public static List<XccdfIdentDto> identsPerRuleResult(Long ruleResultId) {
+ SelectMode m = ModeFactory.getMode("scap_queries",
+ "idents_per_ruleresult");
+ HashMap params = new HashMap();
+ params.put("rr_id", ruleResultId);
+ return (List<XccdfIdentDto>) m.execute(params);
+ }
+
private static List<Map<String, Object>> transposeView(DataResult
testResultsRaw) {
List<Map<String, Object>> resultView = new
ArrayList<Map<String, Object>>();
Map<String, Object> currResult = null;
diff --git a/java/code/webapp/WEB-INF/pages/systems/details/audit/xccdfdetails.jsp
b/java/code/webapp/WEB-INF/pages/systems/details/audit/xccdfdetails.jsp
index 645aab2..87a4b10 100644
--- a/java/code/webapp/WEB-INF/pages/systems/details/audit/xccdfdetails.jsp
+++ b/java/code/webapp/WEB-INF/pages/systems/details/audit/xccdfdetails.jsp
@@ -56,11 +56,19 @@
<rl:decorator name="PageSizeDecorator"/>
<rhn:csrf/>
- <rl:column headerkey="system.audit.xccdfdetails.jsp.scheme"
sortattr="system" sortable="true">
- <c:out value="${current.system}"/>
+ <rl:column headerkey="system.audit.xccdfdetails.jsp.idref"
sortattr="documentIdref" sortable="true">
+ <c:choose>
+ <c:when test="${empty current.documentIdref}">
+ <bean:message key="system.audit.xccdfdetails.jsp.unknown"/>
+ </c:when>
+ <c:otherwise>
+ <c:out value="${current.documentIdref}"/>
+ </c:otherwise>
+ </c:choose>
+
</rl:column>
- <rl:column headerkey="system.audit.xccdfdetails.jsp.ident"
sortattr="identifier" sortable="true">
- <c:out value="${current.identifier}"/>
+ <rl:column headerkey="system.audit.xccdfdetails.jsp.idents"
sortattr="identsString" sortable="true">
+ <c:out value="${current.identsString}"/>
</rl:column>
<rl:column headerkey="system.audit.xccdfdetails.jsp.result"
sortattr="label" sortable="true" filterattr="label">
<c:out value="${current.label}"/>
commit 555874ff83f3f7622dd153cadfb2b63d4b87811a
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Mon Mar 26 12:19:32 2012 +0200
Store also @idref of xccdf:rule-result element
The rule-result is uniquely identified within a single XCCDF
document by the idref attribute.
diff --git a/backend/server/action_extra_data/scap.py
b/backend/server/action_extra_data/scap.py
index 721cba5..e21cc10 100644
--- a/backend/server/action_extra_data/scap.py
+++ b/backend/server/action_extra_data/scap.py
@@ -72,6 +72,10 @@ def _process_ruleresults(testresult_id, tr):
for result in tr.childNodes:
for rr in result.childNodes:
rr_id = _create_rresult(testresult_id, result.nodeName)
+
+ inserts['rr_id'].append(rr_id)
+ inserts['system'].append('#IDREF#')
+ inserts['ident'].append(rr.getAttribute('id'))
for ident in rr.childNodes:
inserts['rr_id'].append(rr_id)
inserts['system'].append(ident.getAttribute('system'))
diff --git a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
index 7173559..0c458d9 100644
--- a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
+++ b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
@@ -87,6 +87,9 @@ Authors:
<xsl:template match="cdf:rule-result">
<rr>
+ <xsl:attribute name="id">
+ <xsl:value-of select="normalize-space(@idref)"/>
+ </xsl:attribute>
<xsl:apply-templates select="cdf:ident"/>
</rr>
</xsl:template>
commit 8d5aae8704377725004424d03583435628a45654
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Fri Mar 23 14:15:51 2012 +0100
Schema upgrade for the new rule/ident mapping.
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.oracle
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.oracle
new file mode 100644
index 0000000..07d28eb
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.oracle
@@ -0,0 +1,12 @@
+
+ALTER TABLE rhnXccdfRuleresult ADD id NUMBER;
+
+CREATE SEQUENCE rhn_xccdf_rresult_id_seq;
+
+UPDATE rhnXccdfRuleresult SET id = rhn_xccdf_rresult_id_seq.nextval;
+
+ALTER TABLE rhnXccdfRuleresult MODIFY id NUMBER NOT NULL;
+
+ALTER TABLE rhnXccdfRuleresult
+ ADD CONSTRAINT rhn_xccdf_rresult_id_pk PRIMARY KEY (id)
+ USING INDEX TABLESPACE [[8m_tbs]];
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.postgresql
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.postgresql
new file mode 100644
index 0000000..837224a
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/017-rhnXccdfRuleresult.sql.postgresql
@@ -0,0 +1,12 @@
+-- oracle equivalent source sha1 67a0e927a201e784309501fcfd29f633d6d50bea
+
+ALTER TABLE rhnXccdfRuleresult ADD id NUMERIC;
+
+CREATE SEQUENCE rhn_xccdf_rresult_id_seq;
+
+UPDATE rhnXccdfRuleresult SET id = nextval('rhn_xccdf_rresult_id_seq');
+
+ALTER TABLE rhnXccdfRuleresult ALTER COLUMN id SET NOT NULL;
+
+ALTER TABLE rhnXccdfRuleresult
+ ADD CONSTRAINT rhn_xccdf_rresult_id_pk PRIMARY KEY (id);
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.oracle
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.oracle
new file mode 100644
index 0000000..7c2a1b8
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.oracle
@@ -0,0 +1,18 @@
+
+CREATE TABLE rhnXccdfRuleIdentMap
+(
+ rresult_id NUMBER NOT NULL
+ CONSTRAINT rhn_xccdf_rim_rresult_fk
+ REFERENCES rhnXccdfRuleresult (id)
+ ON DELETE CASCADE,
+ ident_id NUMBER NOT NULL
+ CONSTRAINT rhn_xccdf_rim_ident_fk
+ REFERENCES rhnXccdfIdent (id)
+)
+ENABLE ROW MOVEMENT
+;
+
+CREATE UNIQUE INDEX rhn_xccdf_rim_ri_uq
+ ON rhnXccdfRuleIdentMap (rresult_id, ident_id)
+ TABLESPACE [[8m_tbs]]
+ NOLOGGING;
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.postgresql
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.postgresql
new file mode 100644
index 0000000..6cd3367
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/018-rhnXccdfRuleIdentMap.sql.postgresql
@@ -0,0 +1,15 @@
+-- oracle equivalent source sha1 086e3135accd03bd79f2656d7e657af6d6b1b81f
+
+CREATE TABLE rhnXccdfRuleIdentMap
+(
+ rresult_id NUMERIC NOT NULL
+ CONSTRAINT rhn_xccdf_rim_rresult_fk
+ REFERENCES rhnXccdfRuleresult (id)
+ ON DELETE CASCADE,
+ ident_id NUMERIC NOT NULL
+ CONSTRAINT rhn_xccdf_rim_ident_fk
+ REFERENCES rhnXccdfIdent (id)
+);
+
+CREATE UNIQUE INDEX rhn_xccdf_rim_ri_uq
+ ON rhnXccdfRuleIdentMap (rresult_id, ident_id);
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/019-rhnXccdfRuleIdentMap_data.sql
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/019-rhnXccdfRuleIdentMap_data.sql
new file mode 100644
index 0000000..ec84be3
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/019-rhnXccdfRuleIdentMap_data.sql
@@ -0,0 +1,7 @@
+
+INSERT INTO rhnXccdfRuleIdentMap
+ (rresult_id, ident_id)
+ SELECT xrr.id, xrr.ident_id
+ FROM rhnXccdfRuleresult xrr;
+
+COMMIT;
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/020-rhnXccdfRuleresult.sql
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/020-rhnXccdfRuleresult.sql
new file mode 100644
index 0000000..be41731
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/020-rhnXccdfRuleresult.sql
@@ -0,0 +1,2 @@
+
+ALTER TABLE rhnXccdfRuleresult DROP COLUMN ident_id;
commit f0fee58bb1e896e7fb854ef93fb2672edc5332eb
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Fri Mar 23 14:15:07 2012 +0100
We want to store all idents per rule-result
Previous assumption was that there was 1-1 mapping between
rule-result and ident elements. Alas, there is 0-n idents
per single rule-result. Moreover, the same idents might be
assidned to more rule-results within a single document.
diff --git a/backend/server/action_extra_data/scap.py
b/backend/server/action_extra_data/scap.py
index 950af08..721cba5 100644
--- a/backend/server/action_extra_data/scap.py
+++ b/backend/server/action_extra_data/scap.py
@@ -68,17 +68,25 @@ def _process_testresult(tr, server_id, action_id, benchmark, profile,
errors):
_process_ruleresults(h.fetchone()[0], tr)
def _process_ruleresults(testresult_id, tr):
- inserts = {'tr_id': [], 'system': [], 'ident': [],
'type': []}
- for rule_result in tr.childNodes:
- for ident in rule_result.childNodes:
- inserts['tr_id'].append(testresult_id)
- inserts['system'].append(ident.getAttribute('system'))
- inserts['ident'].append(_get_text(ident))
- inserts['type'].append(rule_result.nodeName)
- _store_ruleresults(inserts)
-
-def _store_ruleresults(data):
- h = rhnSQL.prepare(_query_insert_ruleresult)
+ inserts = {'rr_id': [], 'system': [], 'ident': []}
+ for result in tr.childNodes:
+ for rr in result.childNodes:
+ rr_id = _create_rresult(testresult_id, result.nodeName)
+ for ident in rr.childNodes:
+ inserts['rr_id'].append(rr_id)
+ inserts['system'].append(ident.getAttribute('system'))
+ inserts['ident'].append(_get_text(ident))
+ _store_idents(inserts)
+
+def _create_rresult(testresult_id, result_label):
+ rr_id = rhnSQL.Sequence("rhn_xccdf_rresult_id_seq")()
+ h = rhnSQL.prepare(_query_insert_rresult)
+ h.execute(rr_id=rr_id, testresult_id=testresult_id,
+ result_label=result_label)
+ return rr_id
+
+def _store_idents(data):
+ h = rhnSQL.prepare(_query_insert_identmap)
rowcount = h.execute_bulk(data)
log_debug(5, "Inserted xccdf_ruleresults rows:", rowcount)
@@ -133,13 +141,21 @@ select id from rhnXccdfTestresult
)
""")
-_query_insert_ruleresult = rhnSQL.Statement("""
-insert into rhnXccdfRuleresult (testresult_id, ident_id, result_id)
+_query_insert_rresult = """
+insert into rhnXccdfRuleresult (id, testresult_id, result_id)
values (
- :tr_id,
- lookup_xccdf_ident(:system, :ident),
+ :rr_id,
+ :testresult_id,
(select rt.id
from rhnXccdfRuleresultType rt
- where rt.label = :type)
+ where rt.label = :result_label)
+ )
+"""
+
+_query_insert_identmap = rhnSQL.Statement("""
+insert into rhnXccdfRuleIdentMap (rresult_id, ident_id)
+values (
+ :rr_id,
+ lookup_xccdf_ident(:system, :ident)
)
""")
diff --git a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
index 8ddd927..7173559 100644
--- a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
+++ b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
@@ -86,7 +86,9 @@ Authors:
</xsl:template>
<xsl:template match="cdf:rule-result">
- <xsl:apply-templates select="cdf:ident"/>
+ <rr>
+ <xsl:apply-templates select="cdf:ident"/>
+ </rr>
</xsl:template>
<xsl:template match="cdf:ident">
diff --git a/schema/spacewalk/common/tables/rhnXccdfRuleIdentMap.sql
b/schema/spacewalk/common/tables/rhnXccdfRuleIdentMap.sql
new file mode 100644
index 0000000..912cd14
--- /dev/null
+++ b/schema/spacewalk/common/tables/rhnXccdfRuleIdentMap.sql
@@ -0,0 +1,32 @@
+--
+-- Copyright (c) 2012 Red Hat, Inc.
+--
+-- This software is licensed to you under the GNU General Public License,
+-- version 2 (GPLv2). There is NO WARRANTY for this software, express or
+-- implied, including the implied warranties of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+-- along with this software; if not, see
+--
http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+--
+-- Red Hat trademarks are not licensed under GPLv2. No permission is
+-- granted to use or replicate Red Hat trademarks that are incorporated
+-- in this software or its documentation.
+--
+
+CREATE TABLE rhnXccdfRuleIdentMap
+(
+ rresult_id NUMBER NOT NULL
+ CONSTRAINT rhn_xccdf_rim_rresult_fk
+ REFERENCES rhnXccdfRuleresult (id)
+ ON DELETE CASCADE,
+ ident_id NUMBER NOT NULL
+ CONSTRAINT rhn_xccdf_rim_ident_fk
+ REFERENCES rhnXccdfIdent (id)
+)
+ENABLE ROW MOVEMENT
+;
+
+CREATE UNIQUE INDEX rhn_xccdf_rim_ri_uq
+ ON rhnXccdfRuleIdentMap (rresult_id, ident_id)
+ TABLESPACE [[8m_tbs]]
+ NOLOGGING;
diff --git a/schema/spacewalk/common/tables/rhnXccdfRuleresult.sql
b/schema/spacewalk/common/tables/rhnXccdfRuleresult.sql
index 8233f90..8a97a28 100644
--- a/schema/spacewalk/common/tables/rhnXccdfRuleresult.sql
+++ b/schema/spacewalk/common/tables/rhnXccdfRuleresult.sql
@@ -15,13 +15,13 @@
CREATE TABLE rhnXccdfRuleresult
(
+ id NUMBER NOT NULL
+ CONSTRAINT rhn_xccdf_rresult_id_pk PRIMARY KEY
+ USING INDEX TABLESPACE [[8m_tbs]],
testresult_id NUMBER NOT NULL
CONSTRAINT rhn_xccdf_rresult_tresult_fk
REFERENCES rhnXccdfTestresult (id)
ON DELETE CASCADE,
- ident_id NUMBER NOT NULL
- CONSTRAINT rhn_xccdf_rresult_ident_fk
- REFERENCES rhnXccdfIdent (id),
result_id NUMBER NOT NULL
CONSTRAINT rhn_xccdf_rresult_result_fk
REFERENCES rhnXccdfRuleresultType (id)
@@ -29,7 +29,4 @@ CREATE TABLE rhnXccdfRuleresult
ENABLE ROW MOVEMENT
;
-CREATE UNIQUE INDEX rhn_xccdf_rresult_tri_uq
- ON rhnXccdfRuleresult (testresult_id, ident_id)
- TABLESPACE [[8m_tbs]]
- NOLOGGING;
+CREATE SEQUENCE rhn_xccdf_rresult_id_seq;
commit 252aec1f69ff6bc41fb6c3016227443c3c30b774
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Thu Mar 22 16:48:47 2012 +0100
Extend xccdf:ident length
diff --git a/schema/spacewalk/common/tables/rhnXccdfIdent.sql
b/schema/spacewalk/common/tables/rhnXccdfIdent.sql
index bafb588..3cbc2a5 100644
--- a/schema/spacewalk/common/tables/rhnXccdfIdent.sql
+++ b/schema/spacewalk/common/tables/rhnXccdfIdent.sql
@@ -21,7 +21,7 @@ CREATE TABLE rhnXccdfIdent
identsystem_id NUMBER NOT NULL
CONSTRAINT rhn_xccdf_ident_system_fk
REFERENCES rhnXccdfIdentsystem (id),
- identifier VARCHAR (20) NOT NULL
+ identifier VARCHAR (100) NOT NULL
)
ENABLE ROW MOVEMENT
;
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.oracle
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.oracle
new file mode 100644
index 0000000..3ab29a2
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.oracle
@@ -0,0 +1,2 @@
+
+ALTER TABLE rhnXccdfIdent MODIFY identifier VARCHAR2(100);
diff --git
a/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.postgresql
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.postgresql
new file mode 100644
index 0000000..e9958cc
--- /dev/null
+++
b/schema/spacewalk/upgrade/spacewalk-schema-1.7-to-spacewalk-schema-1.8/016-rhnXccdfIdent.sql.postgresql
@@ -0,0 +1,3 @@
+-- oracle equivalent source sha1 cc5737c136de9cb3648c3ab699622a119ea64062
+
+ALTER TABLE rhnXccdfIdent ALTER COLUMN identifier TYPE VARCHAR(100);
commit fcc7d45d8631c318c3ce5320e062a05cb1d6815c
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Wed Mar 21 11:01:02 2012 +0100
Only one Profile element is useful
While XCCDF document may contain multiple Prolfile elements,
the oscap scan is always performed only against one of them.
diff --git a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
index 663d535..8ddd927 100644
--- a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
+++ b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
@@ -32,7 +32,9 @@ Authors:
<xsl:attribute name="version">
<xsl:value-of select="normalize-space(cdf:version/text())"/>
</xsl:attribute>
- <xsl:apply-templates select="cdf:Profile"/>
+
+ <xsl:variable name="profileId"
select="cdf:TestResult[1]/cdf:profile/@idref"/>
+ <xsl:apply-templates select="cdf:Profile[@id = $profileId]"/>
<xsl:apply-templates select="cdf:TestResult[1]"/>
</xsl:template>
commit 88f2122f1566dce5e8e1db0bfb052297bda6e155
Author: Simon Lukasik <slukasik(a)redhat.com>
Date: Wed Mar 21 10:56:21 2012 +0100
Make sure only one TestResult element is used
Even though XCCDF 1.2 allows 0-n TestResult elements
in the document, oscap tool always produce a single one.
diff --git a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
index 9af59cd..663d535 100644
--- a/client/rhel/spacewalk-oscap/xccdf-resume.xslt
+++ b/client/rhel/spacewalk-oscap/xccdf-resume.xslt
@@ -33,7 +33,7 @@ Authors:
<xsl:value-of select="normalize-space(cdf:version/text())"/>
</xsl:attribute>
<xsl:apply-templates select="cdf:Profile"/>
- <xsl:apply-templates select="cdf:TestResult"/>
+ <xsl:apply-templates select="cdf:TestResult[1]"/>
</xsl:template>
<xsl:template match="cdf:Profile">