Google Cloud. IT Tests: Fixing and rework for 4.3.0-RC2

.gitignore

@@ -59,6 +59,5 @@ deps/wazuh_testing/wazuh_testing.egg-info/
 # SearchUI package-lock
 deps/wazuh_testing/wazuh_testing/qa_docs/Search-UI/package-lock.json
 
-
 # GCP tests configuration file
 tests/integration/test_gcloud/data/configuration.yaml

deps/wazuh_testing/wazuh_testing/gcloud.py

@@ -27,19 +27,19 @@ def validate_gcp_event(event):
 
 
 def callback_detect_start_gcp(line):
- if 'wm_gcp_main(): INFO: Module started.' in line:
+ if 'wm_gcp_pubsub_main(): INFO: Module started.' in line:
  return line
  return None
 
 
 def callback_detect_start_fetching_logs(line):
- if 'wm_gcp_main(): DEBUG: Starting fetching of logs.' in line:
+ if 'wm_gcp_pubsub_main(): DEBUG: Starting fetching of logs.' in line:
  return line
  return None
 
 
 def callback_detect_start_gcp_sleep(line):
- match = re.match(r'.*wm_gcp_main\(\): DEBUG: Sleeping until: (\S+ \S+)', line)
+ match = re.match(r'.*wm_gcp_pubsub_main\(\): DEBUG: Sleeping until: (\S+ \S+)', line)
 
  if match:
  return match.group(1)
@@ -56,7 +56,7 @@ def detect_gcp_start(file_monitor):
 
 
 def callback_received_messages_number(line):
- match = re.match(r'.*wm_gcp_run\(\): INFO: - INFO - Received and acknowledged (\d+) messages', line)
+ match = re.match(r'.*wm_gcp_pubsub_run\(\): INFO: - INFO - Received and acknowledged (\d+) messages', line)
  if match:
  return match.group(1)
  return None
@@ -95,8 +95,8 @@ def callback_detect_schedule_validate_parameters_err(line):
 
 
 def callback_detect_gcp_read_err(line):
- match_err = re.match(r'.*wm_gcp_read\(\): ERROR:.*', line)
- match_warn = re.match(r'.*wm_gcp_read\(\): WARNING: File \'\S+\' not found.*', line)
+ match_err = re.match(r'.*wm_gcp_pubsub_read\(\): ERROR:.*', line)
+ match_warn = re.match(r'.*wm_gcp_pubsub_read\(\): WARNING: File \'\S+\' not found.*', line)
 
  if match_err:
  return line
@@ -107,7 +107,7 @@ def callback_detect_gcp_read_err(line):
 
 def callback_detect_gcp_wmodule_err(line):
  match_err = re.match(r'.*read_main_elements\(\): ERROR: \(\d+\): Invalid element in the configuration.*', line)
- match_deb = re.match(r'.*Read_GCP\(\): DEBUG: Empty configuration for module \'gcp-pubsub\'', line)
+ match_deb = re.match(r'.*Read_GCP_pubsub\(\): DEBUG: Empty configuration for module \'gcp-pubsub\'', line)
 
  if match_err:
  return line

deps/wazuh_testing/wazuh_testing/qa_docs/schema.yaml

@@ -186,6 +186,8 @@ predefined_values:
  - brute_force_attack
  - cache
  - cluster
+ - config
+ - config
  - cors
  - cpe
  - dos_attack
@@ -214,49 +216,59 @@ predefined_values:
  - fim_multiple_dirs
  - fim_nodiff
  - fim_prefilter_cmd
- - fim_report_changes
  - fim_process_priority
  - fim_recursion_level
- - fim_restrict
- - fim_scan
- - fim_skip
- - fim_stats_integrity_sync
- - fim_tags
- - fim_timezone_changes
- - fim_wildcards_complex
- - fim_windows_audit_interval
  - fim_registry_ambiguous_confs
  - fim_registry_basic_usage
  - fim_registry_checks
- - fim_registry_ignore
- - fim_registry_nodiff
  - fim_registry_file_limit
+ - fim_registry_ignore
  - fim_registry_multiple_registries
+ - fim_registry_nodiff
  - fim_registry_recursion_level
  - fim_registry_restrict
+ - fim_report_changes
+ - fim_restrict
+ - fim_scan
+ - fim_skip
+ - fim_stats_integrity_sync
  - fim_synchronization
+ - fim_tags
+ - fim_timezone_changes
+ - fim_wildcards_complex
+ - fim_windows_audit_interval
  - gcloud
  - github
  - integrity
+ - interval
+ - invalid
  - keys
  - key_polling
+ - limits
  - logcollector
+ - logging
+ - logs
  - logs
  - logtest
  - man_in_the_middle
  - master
+ - maximum
  - mitre
  - msu
  - nvd
  - office365
+ - on start
  - oval
+ - pull
  - rbac
  - realtime
+ - remote
  - remoted
  - rids
  - rootcheck
  - rules
  - scan
+ - schedule
  - scheduled
  - settings
  - simulator
@@ -268,6 +280,7 @@ predefined_values:
  - vulnerability_detector
  - wazuh_db
  - wdb_socket
+ - week_day
  - who_data
  - worker
  - wpk

tests/integration/test_gcloud/conftest.py

@@ -9,7 +9,7 @@
 from wazuh_testing.tools import WAZUH_PATH
 from wazuh_testing.tools.file import write_file, remove_file
 from wazuh_testing.gcloud import detect_gcp_start, publish_sync
-
+import wazuh_testing.tools.configuration as conf
 
 @pytest.fixture(scope='session', autouse=True)
 def handle_credentials_file():
@@ -49,3 +49,11 @@ def wait_for_gcp_start(get_configuration, request):
  # Wait for module gpc-pubsub starts
  file_monitor = getattr(request.module, 'wazuh_log_monitor')
  detect_gcp_start(file_monitor)
+
+@pytest.fixture(scope="session", autouse=True)
+def configure_internal_options():
+ local_internal_options = {'wazuh_modules.debug': 2, 'analysisd.debug': 2, 'monitord.rotate_log': 0, 'monitord.day_wait': 0, 'monitord.keep_log_days': 0,'monitord.size_rotate': 0}
+ conf.set_local_internal_options_dict(local_internal_options)
+ yield
+ local_internal_options = {'wazuh_modules.debug': 0, 'analysisd.debug': 0, "monitord.rotate_log": 1, "monitord.day_wait": 10, "monitord.keep_log_days": 31,'monitord.size_rotate': 512}
+ conf.set_local_internal_options_dict(local_internal_options)

tests/integration/test_gcloud/test_configuration/test_invalid.py

@@ -54,7 +54,8 @@
  - https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/gcp-pubsub.html
 
 tags:
- - gcloud_configuration
+ - invalid
+ - config
 '''
 import os
 import sys
@@ -79,10 +80,11 @@
 wazuh_log_monitor = FileMonitor(LOG_FILE_PATH)
 test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data')
 configurations_path = os.path.join(test_data_path, 'invalid_conf.yaml')
-force_restart_after_restoring = True
+force_restart_after_restoring = False
 
 # configurations
 
+daemons_handler_configuration = {'daemons': ['wazuh-modulesd'], 'ignore_errors' : True}
 monitoring_modes = ['scheduled']
 conf_params = {'PROJECT_ID': global_parameters.gcp_project_id,
  'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name,
@@ -99,11 +101,10 @@ def get_configuration(request):
  """Get configurations from the module."""
  return request.param
 
-
 # tests
 
 @pytest.mark.skipif(sys.platform == "win32", reason="Windows does not have support for Google Cloud integration.")
-def test_invalid(get_configuration, configure_environment, reset_ossec_log):
+def test_invalid(get_configuration, configure_environment, reset_ossec_log, daemons_handler):
  '''
  description: Check if the 'gcp-pubsub' module detects invalid configurations. For this purpose, the test
  will configure 'gcp-pubsub' using invalid configuration settings with different attributes.
@@ -121,6 +122,9 @@ def test_invalid(get_configuration, configure_environment, reset_ossec_log):
  - reset_ossec_log:
  type: fixture
  brief: Reset the 'ossec.log' file and start a new monitor.
+ - daemons_handler:
+ type: fixture
+ brief: Handler of Wazuh daemons.
 
  assertions:
  - Verify that the 'gcp-pubsub' module generates error events when invalid configurations are used.
@@ -138,33 +142,25 @@ def test_invalid(get_configuration, configure_environment, reset_ossec_log):
  tags:
  - invalid_settings
  '''
- # Configuration error -> ValueError raised
- with pytest.raises(ValueError):
- control_service('restart')
-
  tags_to_apply = get_configuration['tags'][0]
 
  if tags_to_apply == 'invalid_gcp_wmodule':
  wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
  callback=callback_detect_gcp_wmodule_err,
- accum_results=1,
  error_message='Did not receive expected '
  'Invalid element in the configuration').result()
  elif tags_to_apply == 'invalid_day_wday':
  wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
  callback=callback_detect_schedule_validate_parameters_err,
- accum_results=1,
  error_message='Did not receive expected '
  'sched_scan_validate_parameters(): ERROR').result()
  elif tags_to_apply == 'invalid_schedule':
  wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
  callback=callback_detect_schedule_read_err,
- accum_results=1,
  error_message='Did not receive expected '
  'sched_scan_validate_parameters(): ERROR').result()
  else:
  wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
  callback=callback_detect_gcp_read_err,
- accum_results=1,
  error_message='Did not receive expected '
  'wm_gcp_read(): ERROR:').result()

tests/integration/test_gcloud/test_configuration/test_remote_configuration.py

@@ -54,7 +54,8 @@
  - https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/gcp-pubsub.html
 
 tags:
- - gcloud_configuration
+ - config
+ - remote
 '''
 import os
 import pytest
@@ -90,6 +91,7 @@
 
 # configurations
 
+daemons_handler_configuration = {'daemons': ['wazuh-modulesd'], 'ignore_errors' : True}
 monitoring_modes = ['scheduled']
 conf_params = {'PROJECT_ID': global_parameters.gcp_project_id,
  'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name,
@@ -100,7 +102,7 @@
 p, m = generate_params(extra_params=conf_params,
  modes=monitoring_modes)
 configurations = load_wazuh_configurations(configurations_path, __name__, params=p, metadata=m)
-force_restart_after_restoring = True
+force_restart_after_restoring = False
 
 
 # fixtures
@@ -147,8 +149,7 @@ def get_remote_configuration(component_name, config):
 
 
 @pytest.mark.skipif(sys.platform == "win32", reason="Windows does not have support for Google Cloud integration.")
-def test_remote_configuration(get_configuration, configure_environment,
- restart_wazuh, wait_for_gcp_start):
+def test_remote_configuration(get_configuration, configure_environment, reset_ossec_log, daemons_handler, wait_for_gcp_start):
  '''
  description: Check if the remote configuration matches the local configuration of the 'gcp-pubsub' module.
  For this purpose, the test will use different settings and get the remote configuration applied.

tests/integration/test_gcloud/test_configuration/test_schedule.py

@@ -54,7 +54,8 @@
  - https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/gcp-pubsub.html#interval
 
 tags:
- - gcloud_configuration
+ - config
+ - schedule
 '''
 import os
 import sys
@@ -66,6 +67,7 @@
 from wazuh_testing.tools import LOG_FILE_PATH
 from wazuh_testing.tools.configuration import load_wazuh_configurations
 from wazuh_testing.tools.monitoring import FileMonitor
+from wazuh_testing.tools.file import truncate_file
 
 # Marks
 
@@ -77,10 +79,11 @@
 wazuh_log_monitor = FileMonitor(LOG_FILE_PATH)
 test_data_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data')
 configurations_path = os.path.join(test_data_path, 'schedule_conf.yaml')
-force_restart_after_restoring = True
+force_restart_after_restoring = False
 
 # configurations
 
+daemons_handler_configuration = {'daemons': ['wazuh-modulesd']}
 monitoring_modes = ['scheduled']
 conf_params = {'PROJECT_ID': global_parameters.gcp_project_id,
  'SUBSCRIPTION_NAME': global_parameters.gcp_subscription_name,
@@ -102,7 +105,7 @@ def get_configuration(request):
 # tests
 
 @pytest.mark.skipif(sys.platform == "win32", reason="Windows does not have support for Google Cloud integration.")
-def test_schedule(get_configuration, configure_environment, restart_wazuh):
+def test_schedule(get_configuration, configure_environment, reset_ossec_log, daemons_handler):
  '''
  description: Check if the 'gcp-pubsub' module is executed in the periods specified in the 'interval' tag.
  For this purpose, the test will use different values for the 'interval' tag (a positive number
@@ -137,44 +140,22 @@ def test_schedule(get_configuration, configure_environment, restart_wazuh):
  tags:
  - scheduled
  '''
+
  str_interval = get_configuration['sections'][0]['elements'][3]['interval']['value']
  time_interval = int(''.join(filter(str.isdigit, str_interval)))
  tags_to_apply = get_configuration['tags'][0]
-
- if tags_to_apply == 'schedule_day':
- if 'M' not in str_interval:
- wazuh_log_monitor.start(timeout=global_parameters.default_timeout + time_interval,
- callback=callback_detect_schedule_validate_parameters_warn,
- accum_results=2,
- error_message='Did not receive expected '
- 'at _sched_scan_validate_parameters(): WARNING:').result()
- else:
- with pytest.raises(TimeoutError):
- event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
- callback=callback_detect_schedule_validate_parameters_warn).result()
- raise AttributeError(f'Unexpected event {event}')
-
- elif tags_to_apply == 'schedule_wday':
- if 'w' not in str_interval:
- wazuh_log_monitor.start(timeout=global_parameters.default_timeout + time_interval,
- callback=callback_detect_schedule_validate_parameters_warn,
- accum_results=2,
- error_message='Did not receive expected '
- 'at _sched_scan_validate_parameters(): WARNING:').result()
- else:
- with pytest.raises(TimeoutError):
- event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
- callback=callback_detect_schedule_validate_parameters_warn).result()
- raise AttributeError(f'Unexpected event {event}')
+
+ # Warning log must appear in log (cause interval is not compatible with <day/month/week>)
+ if (tags_to_apply == 'schedule_day' and 'M' not in str_interval) or \
+ (tags_to_apply == 'schedule_wday' and 'w' not in str_interval) or \
+ (tags_to_apply == 'schedule_time' and ('d' not in str_interval and 'w' not in str_interval)):
+ wazuh_log_monitor.start(timeout=global_parameters.default_timeout + time_interval,
+ callback=callback_detect_schedule_validate_parameters_warn,
+ error_message='Did not receive expected '
+ 'at _sched_scan_validate_parameters(): WARNING:').result()
+ # Warning is not suppose to appear
  else:
- if 'd' not in str_interval and 'w' not in str_interval:
- wazuh_log_monitor.start(timeout=global_parameters.default_timeout + time_interval,
- callback=callback_detect_schedule_validate_parameters_warn,
- accum_results=2,
- error_message='Did not receive expected '
- 'at _sched_scan_validate_parameters(): WARNING:').result()
- else:
- with pytest.raises(TimeoutError):
- event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
- callback=callback_detect_schedule_validate_parameters_warn).result()
- raise AttributeError(f'Unexpected event {event}')
+ with pytest.raises(TimeoutError):
+ event = wazuh_log_monitor.start(timeout=global_parameters.default_timeout,
+ callback=callback_detect_schedule_validate_parameters_warn).result()
+ raise AttributeError(f'Unexpected event {event}')