Exemple #1
0
def get_active_configuration(agent_id, component, configuration):
    """
    Reads agent loaded configuration in memory
    """
    if not component or not configuration:
        raise WazuhException(1307)

    components = {
        "agent", "agentless", "analysis", "auth", "com", "csyslog",
        "integrator", "logcollector", "mail", "monitor", "request", "syscheck",
        "wmodules"
    }

    # checks if the component is correct
    if component not in components:
        raise WazuhException(1101,
                             f'Valid components: {", ".join(components)}')

    sockets_path = os_path.join(common.ossec_path, "queue/ossec/")

    if agent_id == '000':
        dest_socket = os_path.join(sockets_path, component)
        command = f"getconfig {configuration}"
    else:
        dest_socket = os_path.join(sockets_path, "request")
        command = f"{str(agent_id).zfill(3)} {component} getconfig {configuration}"

    # Socket connection
    try:
        s = OssecSocket(dest_socket)
    except Exception as e:
        raise WazuhException(1117, str(e))

    # Send message
    s.send(command.encode())

    # Receive response
    try:
        # Receive data length
        rec_msg_ok, rec_msg = s.receive().decode().split(" ", 1)
    except ValueError:
        raise WazuhException(1118, "Data could not be received")

    s.close()

    if rec_msg_ok.startswith('ok'):
        msg = json.loads(rec_msg)
        return msg
    else:
        raise WazuhException(
            1117 if "No such file or directory" in rec_msg
            or "Cannot send request" in rec_msg else 1116,
            rec_msg.replace("err ", ""))
Exemple #2
0
def test_OssecSocket_send_ko(mock_conn, msg, effect, send_effect, expected_exception):
    """Tests OssecSocket.send function exceptions works"""

    queue = OssecSocket('test_path')

    if effect == 'return_value':
        with patch('wazuh.ossec_socket.socket.socket.send', return_value=send_effect):
            with pytest.raises(WazuhException, match=f'.* {expected_exception} .*'):
                queue.send(msg)
    else:
        with patch('wazuh.ossec_socket.socket.socket.send', side_effect=send_effect):
            with pytest.raises(WazuhException, match=f'.* {expected_exception} .*'):
                queue.send(msg)

    mock_conn.assert_called_once_with('test_path')
Exemple #3
0
def test_OssecSocket_send(mock_send, mock_conn):
    """Tests OssecSocket.send function works"""

    queue = OssecSocket('test_path')

    response = queue.send(b"\x00\x01")

    assert isinstance(response, MagicMock)
    mock_conn.assert_called_once_with('test_path')