From 35ae94cd84b7b99845f0d2306924946e66da6d50 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>

Date: Tue, 15 Jun 2021 10:09:44 +0200

Subject: [PATCH 01/10] Allow providing pre-downloaded components

OpenSCAP can download remote SCAP source data stream components from the

internet if the --fetch-remote-resources option is set. When this

command line option isn't set, it is possible to download the remote

component separately, save it as file to the filesystem which name is

equal to the name of the remote component and OpenSCAP would use this

local file instead of just skipping the checks. It currently works by

accident, it wasn't intended to work this way or at least I haven't

heard it before, but somobody found out that it works and documented it

as a KSC: https://access.redhat.com/solutions/5185891. However, it

produces warning messages if the approach used in the KSC is used.

This patch promotes the workaround to a feature. And it changes the

logic so that it won't print the warnings.

The main difference is that it won't work automatically, but only

on user's demand by providing --use-local-file which is the new

command line option introduced by this commit.

Fixes: rhbz#1970527

---

 src/DS/ds_sds_session.c                       | 14 ++-

 src/DS/ds_sds_session_priv.h                  |  1 +

 src/DS/public/ds_sds_session.h                | 15 ++-

 src/DS/sds.c                                  | 22 +++++

 src/OVAL/oval_session.c                       | 11 ++-

 src/OVAL/public/oval_session.h                | 15 ++-

 src/XCCDF/public/xccdf_session.h              | 15 ++-

 src/XCCDF/xccdf_session.c                     | 36 ++++---

 tests/DS/CMakeLists.txt                       |  1 +

 .../remote.oval.xml                           | 58 +++++++++++

 .../remote_content_1.3.ds.xml                 | 96 +++++++++++++++++++

 .../DS/test_ds_use_local_remote_resources.sh  | 57 +++++++++++

 utils/oscap-ds.c                              |  6 +-

 utils/oscap-info.c                            |  4 +-

 utils/oscap-oval.c                            |  6 +-

 utils/oscap-tool.h                            |  1 +

 utils/oscap-xccdf.c                           | 14 ++-

 utils/oscap.8                                 | 26 +++++

 18 files changed, 369 insertions(+), 29 deletions(-)

 create mode 100644 tests/DS/ds_use_local_remote_resources/remote.oval.xml

 create mode 100644 tests/DS/ds_use_local_remote_resources/remote_content_1.3.ds.xml

 create mode 100755 tests/DS/test_ds_use_local_remote_resources.sh

diff --git a/src/DS/ds_sds_session.c b/src/DS/ds_sds_session.c

index 8c0072bae0..9d9a9c8b52 100644

--- a/src/DS/ds_sds_session.c

+++ b/src/DS/ds_sds_session.c

@@ -55,6 +55,7 @@ struct ds_sds_session {

 	struct oscap_htable *component_uris;    ///< maps component refs to component URIs

 	bool fetch_remote_resources;            ///< Allows loading of external components;

 	download_progress_calllback_t progress;	///< Callback to report progress of download.

+	bool use_local_file;                    ///< Use a locally downloaded copy of a remote resource if it exists

 };

 /**

@@ -337,12 +338,23 @@ int ds_sds_session_register_component_with_dependencies(struct ds_sds_session *s

 	return res;

 }

-void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback)

+void ds_sds_session_configure_remote_resources(struct ds_sds_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback)

 {

 	session->fetch_remote_resources = allowed;

+	session->use_local_file = use_local_file;

 	session->progress = (callback != NULL) ? callback : download_progress_empty_calllback;

 }

+void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback)

+{

+	ds_sds_session_configure_remote_resources(session, allowed, false, callback);

+}

+

+bool ds_sds_session_can_use_local_file(struct ds_sds_session *session)

+{

+	return session->use_local_file;

+}

+

 int ds_sds_session_dump_component_files(struct ds_sds_session *session)

 {

 	return ds_dump_component_sources(session->component_sources, ds_sds_session_get_target_dir(session));

diff --git a/src/DS/ds_sds_session_priv.h b/src/DS/ds_sds_session_priv.h

index f58231dc48..018cd053ec 100644

--- a/src/DS/ds_sds_session_priv.h

+++ b/src/DS/ds_sds_session_priv.h

@@ -40,6 +40,7 @@ struct oscap_htable *ds_sds_session_get_component_sources(struct ds_sds_session

 struct oscap_htable *ds_sds_session_get_component_uris(struct ds_sds_session *session);

 const char *ds_sds_session_get_readable_origin(const struct ds_sds_session *session);

 bool ds_sds_session_fetch_remote_resources(struct ds_sds_session *session);

+bool ds_sds_session_can_use_local_file(struct ds_sds_session *session);

 download_progress_calllback_t ds_sds_session_remote_resources_progress(struct ds_sds_session *session);

 void download_progress_empty_calllback(bool warning, const char * format, ...);

diff --git a/src/DS/public/ds_sds_session.h b/src/DS/public/ds_sds_session.h

index 20a85146cc..695a0df215 100644

--- a/src/DS/public/ds_sds_session.h

+++ b/src/DS/public/ds_sds_session.h

@@ -200,7 +200,20 @@ OSCAP_API void ds_sds_session_reset(struct ds_sds_session *session);

  * @param callback used to notify user about download proceeds. This might be safely set

  * to NULL -- ignoring user notification.

  */

-OSCAP_API void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback);

+OSCAP_API OSCAP_DEPRECATED(void ds_sds_session_set_remote_resources(struct ds_sds_session *session, bool allowed, download_progress_calllback_t callback));

+

+/**

+ * Set property of remote content.

+ * @memberof ds_sds_session

+ * @param session The source data stream session

+ * @param allowed Whether is download of remote resources allowed in this

+ * session (defaults to false)

+ * @param use_local_file Allows to use a locally downloaded copy of the remote

+ * resource if it exists (defaults to false)

+ * @param callback used to notify user about download proceeds. This might be

+ * safely set to NULL -- ignoring user notification.

+ */

+OSCAP_API void ds_sds_session_configure_remote_resources(struct ds_sds_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback);

 /**

  * Returns HTML representation of selected checklist in form of OpenSCAP guide.

diff --git a/src/DS/sds.c b/src/DS/sds.c

index 0f19a81982..b1737aa57f 100644

--- a/src/DS/sds.c

+++ b/src/DS/sds.c

@@ -413,6 +413,28 @@ static int ds_sds_dump_component_by_href(struct ds_sds_session *session, char* x

 		}

 		if (!ds_sds_session_fetch_remote_resources(session)) {

+			/*

+			 * If fetching remote resources isn't allowed by the user let's take

+			 * a look whether there exists a file whose file name is equal to

+			 * @name attribute of the uri element within the catalog of the

+			 * previously processed component-ref which pointed us to the

+			 * currently processed component-ref. Note that the @name attribute

+			 * value has been passed as relative_filepath in the recursive call

+			 * of ds_sds_dump_component_ref_as. If such file exists, we will

+			 * assume that it's a local copy of the remote component located at

+			 * the URL defined in @xlink:href. This way people can provide the

+			 * previously downloaded component which might be useful on systems

+			 * with limited internet access. This behavior is allowed only when

+			 * --use-local-file is used on the command line.

+			 * See: https://bugzilla.redhat.com/show_bug.cgi?id=1970527

+			 * See: https://access.redhat.com/solutions/5185891

+			 */

+			struct stat sb;

+			if (ds_sds_session_can_use_local_file(session) && stat(relative_filepath, &sb) == 0) {

+				dI("Using local file '%s' instead of '%s'", relative_filepath, xlink_href);

+				return ds_sds_dump_file_component(relative_filepath, *component_id, session, target_filename_dirname, relative_filepath);

+			}

+

 			static bool fetch_remote_resources_suggested = false;

 			if (!fetch_remote_resources_suggested) {

diff --git a/src/OVAL/oval_session.c b/src/OVAL/oval_session.c

index ebc7e55f71..5adda43f66 100644

--- a/src/OVAL/oval_session.c

+++ b/src/OVAL/oval_session.c

@@ -84,6 +84,7 @@ struct oval_session {

 	bool full_validation;

 	bool fetch_remote_resources;

 	download_progress_calllback_t progress;

+	bool use_local_file;

 };

 struct oval_session *oval_session_new(const char *filename)

@@ -223,7 +224,7 @@ static int oval_session_load_definitions(struct oval_session *session)

 		if ((session->sds_session = ds_sds_session_new_from_source(session->source)) == NULL) {

 			return 1;

 		}

-		ds_sds_session_set_remote_resources(session->sds_session,session->fetch_remote_resources ,session->progress);

+		ds_sds_session_configure_remote_resources(session->sds_session, session->fetch_remote_resources, session->use_local_file, session->progress);

 		ds_sds_session_set_datastream_id(session->sds_session, session->datastream_id);

 		if (ds_sds_session_register_component_with_dependencies(session->sds_session,

 					"checks", session->component_id, "oval.xml") != 0) {

@@ -451,12 +452,18 @@ void oval_session_set_export_system_characteristics(struct oval_session *session

 	session->export_sys_chars = export;

 }

-void oval_session_set_remote_resources(struct oval_session *session, bool allowed, download_progress_calllback_t callback)

+void oval_session_configure_remote_resources(struct oval_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback)

 {

 	session->fetch_remote_resources = allowed;

+	session->use_local_file = use_local_file;

 	session->progress = callback;

 }

+void oval_session_set_remote_resources(struct oval_session *session, bool allowed, download_progress_calllback_t callback)

+{

+	oval_session_configure_remote_resources(session, allowed, false, callback);

+}

+

 void oval_session_free(struct oval_session *session)

 {

 	if (session == NULL)

diff --git a/src/OVAL/public/oval_session.h b/src/OVAL/public/oval_session.h

index ed97cb7768..d485676747 100644

--- a/src/OVAL/public/oval_session.h

+++ b/src/OVAL/public/oval_session.h

@@ -239,7 +239,20 @@ OSCAP_API void oval_session_set_export_system_characteristics(struct oval_sessio

  * @param callback used to notify user about download proceeds. This might be safely set

  * to NULL -- ignoring user notification.

  */

-OSCAP_API void oval_session_set_remote_resources(struct oval_session *session, bool allowed, download_progress_calllback_t callback);

+OSCAP_API OSCAP_DEPRECATED(void oval_session_set_remote_resources(struct oval_session *session, bool allowed, download_progress_calllback_t callback));

+

+/**

+ * Set property of remote content.

+ * @memberof oval_session

+ * @param session an \ref oval_session

+ * @param allowed Whether is download of remote resources allowed in this

+ * session (defaults to false)

+ * @param use_local_file Allows to use a locally downloaded copy of the remote

+ * resource if it exists (defaults to false)

+ * @param callback used to notify user about download proceeds. This might be

+ * safely set to NULL -- ignoring user notification.

+ */

+OSCAP_API void oval_session_configure_remote_resources(struct oval_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback);

 /**

  * Destructor of an \ref oval_session.

diff --git a/src/XCCDF/public/xccdf_session.h b/src/XCCDF/public/xccdf_session.h

index 70cfc677f3..2eb7128019 100644

--- a/src/XCCDF/public/xccdf_session.h

+++ b/src/XCCDF/public/xccdf_session.h

@@ -232,7 +232,20 @@ OSCAP_API void xccdf_session_set_user_tailoring_cid(struct xccdf_session *sessio

  * @param callback used to notify user about download proceeds. This might be safely set

  * to NULL -- ignoring user notification.

  */

-OSCAP_API void xccdf_session_set_remote_resources(struct xccdf_session *session, bool allowed, download_progress_calllback_t callback);

+OSCAP_API OSCAP_DEPRECATED(void xccdf_session_set_remote_resources(struct xccdf_session *session, bool allowed, download_progress_calllback_t callback));

+

+/**

+ * Set properties of remote content.

+ * @memberof xccdf_session

+ * @param session XCCDF Session

+ * @param allowed Whether is download od remote resources allowed in this

+ * session (defaults to false)

+ * @param use_local_file Allows to use a locally downloaded copy of the remote

+ * resource if it exists (defaults to false)

+ * @param callback used to notify user about download proceeds. This might be

+ * safely set to NULL -- ignoring user notification.

+ */

+OSCAP_API void xccdf_session_configure_remote_resources(struct xccdf_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback);

 /**

  * Disable or allow loading of depending content (OVAL, SCE, CPE)

diff --git a/src/XCCDF/xccdf_session.c b/src/XCCDF/xccdf_session.c

index 9d8f42c445..85fcc90d23 100644

--- a/src/XCCDF/xccdf_session.c

+++ b/src/XCCDF/xccdf_session.c

@@ -87,6 +87,7 @@ struct xccdf_session {

 	} ds;

 	struct {

 		bool fetch_remote_resources;		///< Allows download of remote resources (not applicable when user sets custom oval files)

+		bool use_local_file; ///< Use a locally downloaded copy of a remote resource if it exists

 		download_progress_calllback_t progress;	///< Callback to report progress of download.

 		struct oval_content_resource **custom_resources;///< OVAL files required by user

 		struct oval_content_resource **resources;///< OVAL files referenced from XCCDF

@@ -626,7 +627,8 @@ static struct ds_sds_session *xccdf_session_get_ds_sds_session(struct xccdf_sess

 	return session->ds.session;

 }

-void xccdf_session_set_remote_resources(struct xccdf_session *session, bool allowed, download_progress_calllback_t callback)

+

+void xccdf_session_configure_remote_resources(struct xccdf_session *session, bool allowed, bool use_local_file, download_progress_calllback_t callback)

 {

 	if (callback == NULL) {

 		// With empty cb we don't have to check for NULL

@@ -635,15 +637,21 @@ void xccdf_session_set_remote_resources(struct xccdf_session *session, bool allo

 	}

 	session->oval.fetch_remote_resources = allowed;

+	session->oval.use_local_file = use_local_file;

 	session->oval.progress = callback;

 	if (xccdf_session_is_sds(session)) {

 		// We have to propagate this option to allow loading

 		// of external datastream components

-		ds_sds_session_set_remote_resources(xccdf_session_get_ds_sds_session(session), allowed, callback);

+		ds_sds_session_configure_remote_resources(xccdf_session_get_ds_sds_session(session), allowed, use_local_file, callback);

 	}

 }

+void xccdf_session_set_remote_resources(struct xccdf_session *session, bool allowed, download_progress_calllback_t callback)

+{

+	xccdf_session_configure_remote_resources(session, allowed, false, callback);

+}

+

 void xccdf_session_set_loading_flags(struct xccdf_session *session, xccdf_session_loading_flags_t flags)

 {

 	session->loading_flags = flags;

@@ -993,6 +1001,7 @@ static int _xccdf_session_get_oval_from_model(struct xccdf_session *session)

 	while (oscap_file_entry_iterator_has_more(files_it)) {

 		struct oscap_file_entry *file_entry;

 		struct stat sb;

+		bool source_owned = false;

 		file_entry = (struct oscap_file_entry *) oscap_file_entry_iterator_next(files_it);

@@ -1002,9 +1011,6 @@ static int _xccdf_session_get_oval_from_model(struct xccdf_session *session)

 		const char *file_path = oscap_file_entry_get_file(file_entry);

 		struct oscap_source *source = NULL;

-		if (xccdf_session_get_ds_sds_session(session) != NULL) {

-			source = ds_sds_session_get_component_by_href(xccdf_session_get_ds_sds_session(session), file_path);

-		}

 		tmp_path = malloc(PATH_MAX * sizeof(char));

 		if (file_path[0] == '/') { // it's a simple absolute path

@@ -1017,16 +1023,20 @@ static int _xccdf_session_get_oval_from_model(struct xccdf_session *session)

 			snprintf(tmp_path, PATH_MAX, "%s/%s", dir_path, file_path);

 		}

-		if (source != NULL || stat(tmp_path, &sb) == 0) {

-			resources[idx] = malloc(sizeof(struct oval_content_resource));

-			resources[idx]->href = oscap_strdup(oscap_file_entry_get_file(file_entry));

-			if (source == NULL) {

+		if (xccdf_session_get_ds_sds_session(session) != NULL) {

+			source = ds_sds_session_get_component_by_href(xccdf_session_get_ds_sds_session(session), file_path);

+			source_owned = false;

+		} else {

+			if (stat(tmp_path, &sb) == 0) {

 				source = oscap_source_new_from_file(tmp_path);

-				resources[idx]->source_owned = true;

-			}

-			else {

-				resources[idx]->source_owned = false;

+				source_owned = true;

 			}

+		}

+

+		if (source != NULL) {

+			resources[idx] = malloc(sizeof(struct oval_content_resource));

+			resources[idx]->href = oscap_strdup(oscap_file_entry_get_file(file_entry));

+			resources[idx]->source_owned = source_owned;

 			resources[idx]->source = source;

 			idx++;

 			void *new_resources = realloc(resources, (idx + 1) * sizeof(struct oval_content_resource *));

diff --git a/tests/DS/CMakeLists.txt b/tests/DS/CMakeLists.txt

index f239586f8b..aac089cab5 100644

--- a/tests/DS/CMakeLists.txt

+++ b/tests/DS/CMakeLists.txt

@@ -4,6 +4,7 @@ add_oscap_test("test_sds_compose_split.sh")

 add_oscap_test("test_sds_eval.sh")

 add_oscap_test("test_sds_fix_from_results.sh")

 add_oscap_test("test_sds_fix_from_source.sh")

+add_oscap_test("test_ds_use_local_remote_resources.sh")

 add_subdirectory("ds_sds_index")

 add_subdirectory("schematron")

diff --git a/tests/DS/ds_use_local_remote_resources/remote.oval.xml b/tests/DS/ds_use_local_remote_resources/remote.oval.xml

new file mode 100644

index 0000000000..ed864a462d

--- /dev/null

+++ b/tests/DS/ds_use_local_remote_resources/remote.oval.xml

@@ -0,0 +1,58 @@

+

+<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">

+  <generator>

+    <oval:schema_version>5.10</oval:schema_version>

+    <oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>

+  </generator>

+

+  <definitions>

+    <definition class="compliance" version="1" id="oval:x:def:1">

+      <metadata>

+        <title>This definition will pass</title>

+        <description>x</description>

+        <affected family="unix">

+          <platform>x</platform>

+        </affected>

+      </metadata>

+      <criteria comment="x" operator="OR">

+        <criterion test_ref="oval:x:tst:1" comment="always pass"/>

+        <criterion test_ref="oval:x:tst:2" comment="always fail"/>

+      </criteria>

+    </definition>

+    <definition class="compliance" version="1" id="oval:x:def:2">

+      <metadata>

+        <title>This definition will fail</title>

+        <description>x</description>

+        <affected family="unix">

+          <platform>x</platform>

+        </affected>

+      </metadata>

+      <criteria comment="x" operator="AND">

+        <criterion test_ref="oval:x:tst:1" comment="always pass"/>

+        <criterion test_ref="oval:x:tst:2" comment="always fail"/>

+      </criteria>

+    </definition>

+  </definitions>

+

+  <tests>

+    <variable_test id="oval:x:tst:1" check="all" comment="always pass" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">

+      <object object_ref="oval:x:obj:1"/>

+    </variable_test>

+

+    <variable_test id="oval:x:tst:2" check="all" check_existence="none_exist" comment="always fail" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">

+      <object object_ref="oval:x:obj:1"/>

+    </variable_test>

+  </tests>

+

+  <objects>

+    <variable_object id="oval:x:obj:1" version="1" comment="x" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">

+      <var_ref>oval:x:var:1</var_ref>

+    </variable_object>

+  </objects>

+

+  <variables>

+    <constant_variable id="oval:x:var:1" version="1" comment="x" datatype="string">

+      <value>x</value>

+    </constant_variable>

+  </variables>

+</oval_definitions>

diff --git a/tests/DS/ds_use_local_remote_resources/remote_content_1.3.ds.xml b/tests/DS/ds_use_local_remote_resources/remote_content_1.3.ds.xml

new file mode 100644

index 0000000000..ab1a0f1458

--- /dev/null

+++ b/tests/DS/ds_use_local_remote_resources/remote_content_1.3.ds.xml

@@ -0,0 +1,96 @@

+

+<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_test_single_rule.xccdf.xml" schematron-version="1.3">

+<ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_test_single_rule.xccdf.xml" scap-version="1.3" use-case="OTHER">

+  <ds:checklists>

+    <ds:component-ref id="scap_org.open-scap_cref_test_single_rule.xccdf.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.xccdf.xml">

+      <cat:catalog>

+        <cat:uri name="test_single_rule.oval.xml" uri="#scap_org.open-scap_cref_test_single_rule.oval.xml"/>

+        <cat:uri name="remote.oval.xml" uri="#scap_org.open-scap_cref_remote.oval.xml"/>

+      </cat:catalog>

+    </ds:component-ref>

+  </ds:checklists>

+  <ds:checks>

+    <ds:component-ref id="scap_org.open-scap_cref_test_single_rule.oval.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.oval.xml"/>

+    <ds:component-ref id="scap_org.open-scap_cref_remote.oval.xml" xlink:href="https://www.example.com/security/data/oval/remote.oval.xml"/>

+  </ds:checks>

+</ds:data-stream>

+

+<ds:component id="scap_org.open-scap_comp_test_single_rule.oval.xml" timestamp="2017-06-09T07:07:38">

+<oval_definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd    http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd">

+  <generator>

+    <oval:schema_version>5.11</oval:schema_version>

+    <oval:timestamp>2009-01-12T10:41:00-05:00</oval:timestamp>

+  </generator>

+

+  <definitions>

+    <definition class="compliance" id="oval:test-pass:def:1" version="1">

+      <metadata>

+        <title>PASS</title>

+	<description>pass</description>

+      </metadata>

+      <criteria>

+        <criterion comment="PASS test" test_ref="oval:x:tst:1"/>

+      </criteria>

+    </definition>

+  </definitions>

+

+    <tests>

+    <variable_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:tst:1" check="all" comment="always pass" version="1">

+      <object object_ref="oval:x:obj:1"/>

+    </variable_test>

+    </tests>

+

+    <objects>

+    <variable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:obj:1" version="1" comment="x">

+      <var_ref>oval:x:var:1</var_ref>

+    </variable_object>

+    </objects>

+

+    <variables>

+      <constant_variable id="oval:x:var:1" version="1" comment="x" datatype="int">

+        <value>100</value>

+      </constant_variable>

+    </variables>

+

+</oval_definitions>

+</ds:component>

+

+<ds:component id="scap_org.open-scap_comp_test_single_rule.xccdf.xml" timestamp="2017-06-09T09:15:45">

+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_com.example.www_benchmark_dummy" xml:lang="en-US">

+  <status>accepted</status>

+  <version>1.0</version>

+

+  <Profile id="xccdf_com.example.www_profile_test_remote_res">

+    <title>xccdf_test_profile</title>

+    <description>This profile is for testing.</description>

+    <select idref="xccdf_com.example.www_rule_test-pass" selected="true"/>

+    <select idref="xccdf_com.example.www_rule_test-remote_res" selected="true"/>

+  </Profile>

+

+  <Value id="xccdf_com.example.www_value_val1" type="number" operator="equals" interactive="0">

+    <title>test value</title>

+    <description>foo</description>

+    <value selector="bar_1">50</value>

+    <value selector="bar_2">100</value>

+  </Value>

+  <Rule selected="true" id="xccdf_com.example.www_rule_test-pass">

+    <title>This rule always pass</title>

+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">

+      <check-content-ref href="test_single_rule.oval.xml" name="oval:test-pass:def:1"/>

+    </check>

+  </Rule>

+  <Rule selected="true" id="xccdf_com.example.www_rule_test-remote_res">

+    <title>This rule checks remote resource</title>

+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" multi-check="true">

+      <check-content-ref href="remote.oval.xml"/>

+    </check>

+  </Rule>

+  <Rule selected="true" id="xccdf_com.example.www_rule_test-pass2">

+    <title>This rule always pass</title>

+    <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">

+      <check-content-ref href="test_single_rule.oval.xml" name="oval:test-pass:def:1"/>

+    </check>

+  </Rule>

+</Benchmark>

+</ds:component>

+</ds:data-stream-collection>

diff --git a/tests/DS/test_ds_use_local_remote_resources.sh b/tests/DS/test_ds_use_local_remote_resources.sh

new file mode 100755

index 0000000000..706f38c2bc

--- /dev/null

+++ b/tests/DS/test_ds_use_local_remote_resources.sh

@@ -0,0 +1,57 @@

+#!/usr/bin/env bash

+

+# Author:

+#   Jan Černý <jcerny@redhat.com>

+

+set -e -o pipefail

+set -x

+

+. $builddir/tests/test_common.sh

+	

+PROFILE="xccdf_com.example.www_profile_test_remote_res"

+result=$(mktemp)

+stderr=$(mktemp)

+tmpdir=$(mktemp -d)

+cp "${srcdir}/ds_use_local_remote_resources/remote_content_1.3.ds.xml" "$tmpdir"

+cp "${srcdir}/ds_use_local_remote_resources/remote.oval.xml" "$tmpdir"

+pushd "$tmpdir"

+

+$OSCAP xccdf eval --use-local-file --profile "$PROFILE" --results "$result" "remote_content_1.3.ds.xml" 2>"$stderr" || ret=$?

+[ "$ret" = 2 ]

+

+grep -q "WARNING: Datastream component 'scap_org.open-scap_cref_remote.oval.xml' points out to the remote 'https://www.example.com/security/data/oval/remote.oval.xml'. Use '--fetch-remote-resources' option to download it." "$stderr" && false

+grep -q "WARNING: Skipping 'https://www.example.com/security/data/oval/remote.oval.xml' file which is referenced from datastream" "$stderr" && false

+

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass"]/result[text()="pass"]'

+# the remote_res rule is a multicheck with 2 oval definitions so it's twice here

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-remote_res"]/result[text()="pass"]'

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-remote_res"]/result[text()="fail"]'

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass2"]/result[text()="pass"]'

+

+popd

+rm -f "$result" "$stderr"

+rm -rf "$tmpdir"

+

+

+# test the same without --use-local-file to make sure the $tmpdir/remote.oval.xml isn't loaded by oscap

+

+result=$(mktemp)

+stderr=$(mktemp)

+tmpdir=$(mktemp -d)

+cp "${srcdir}/ds_use_local_remote_resources/remote_content_1.3.ds.xml" "$tmpdir"

+cp "${srcdir}/ds_use_local_remote_resources/remote.oval.xml" "$tmpdir"

+pushd "$tmpdir"

+

+$OSCAP xccdf eval --profile "$PROFILE" --results "$result" "remote_content_1.3.ds.xml" 2>"$stderr" || ret=$?

+[ "$ret" = 2 ]

+

+grep -q "WARNING: Datastream component 'scap_org.open-scap_cref_remote.oval.xml' points out to the remote 'https://www.example.com/security/data/oval/remote.oval.xml'. Use '--fetch-remote-resources' option to download it." "$stderr"

+grep -q "WARNING: Skipping 'https://www.example.com/security/data/oval/remote.oval.xml' file which is referenced from datastream" "$stderr"

+

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass"]/result[text()="pass"]'

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-remote_res"]/result[text()="notchecked"]'

+assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass2"]/result[text()="pass"]'

+

+popd

+rm -f "$result" "$stderr"

+rm -rf "$tmpdir"

\ No newline at end of file

diff --git a/utils/oscap-ds.c b/utils/oscap-ds.c

index 772c9c3283..6a42724597 100644

--- a/utils/oscap-ds.c

+++ b/utils/oscap-ds.c

@@ -82,7 +82,8 @@ static struct oscap_module DS_SDS_SPLIT_MODULE = {

 		"   --xccdf-id <id>               - ID of XCCDF in the data stream that should be evaluated.\n"

 		"   --skip-valid                  - Skips validating of given XCCDF.\n"

 		"   --skip-validation\n"

-		"   --fetch-remote-resources      - Download remote content referenced by data stream.\n",

+		"   --fetch-remote-resources      - Download remote content referenced by data stream.\n"

+		"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n",

 	.opt_parser = getopt_ds,

 	.func = app_ds_sds_split

 };

@@ -186,6 +187,7 @@ bool getopt_ds(int argc, char **argv, struct oscap_action *action) {

 		{"xccdf-id",		required_argument, NULL, DS_OPT_XCCDF_ID},

 		{"report-id",		required_argument, NULL, DS_OPT_REPORT_ID},

 		{"fetch-remote-resources", no_argument, &action->remote_resources, 1},

+		{"use-local-file", no_argument, &action->use_local_file, 1},

 	// end

 		{0, 0, 0, 0}

 	};

@@ -308,7 +310,7 @@ int app_ds_sds_split(const struct oscap_action *action) {

 	}

 	ds_sds_session_set_datastream_id(session, f_datastream_id);

-	ds_sds_session_set_remote_resources(session, action->remote_resources, download_reporting_callback);

+	ds_sds_session_configure_remote_resources(session, action->remote_resources, action->use_local_file, download_reporting_callback);

 	ds_sds_session_set_target_dir(session, action->ds_action->target);

 	if (ds_sds_session_register_component_with_dependencies(session, "checklists", f_component_id, NULL) != 0) {

 		goto cleanup;

diff --git a/utils/oscap-info.c b/utils/oscap-info.c

index 46721eba05..01db5153b3 100644

--- a/utils/oscap-info.c

+++ b/utils/oscap-info.c

@@ -63,6 +63,7 @@ struct oscap_module OSCAP_INFO_MODULE = {

     .usage = "some-file.xml",

 	.help = "Options:\n"

 		"   --fetch-remote-resources      - Download remote content referenced by data stream.\n"

+		"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n"

 		"   --profile <id>                - Show info of the profile with the given ID.\n"

 		"   --profiles                    - Show profiles from the input file in the <id>:<title> format, one line per profile.\n",

     .opt_parser = getopt_info,

@@ -531,7 +532,7 @@ static int app_info_sds(struct oscap_source *source, const struct oscap_action *

 		return OSCAP_ERROR;

 	}

-	ds_sds_session_set_remote_resources(session, action->remote_resources, download_reporting_callback);

+	ds_sds_session_configure_remote_resources(session, action->remote_resources, action->use_local_file, download_reporting_callback);

 	/* get collection */

 	struct ds_sds_index *sds = ds_sds_session_get_sds_idx(session);

@@ -762,6 +763,7 @@ bool getopt_info(int argc, char **argv, struct oscap_action *action)

 	/* Command-options */

 	const struct option long_options[] = {

 		{"fetch-remote-resources", no_argument, &action->remote_resources, 1},

+		{"use-local-file", no_argument, &action->use_local_file, 1},

 		{"profile", required_argument, 0, 'p'},

 		{"profiles", no_argument, 0, 'n'},

 		// end

diff --git a/utils/oscap-oval.c b/utils/oscap-oval.c

index 39bcb92edb..582a5695e3 100644

--- a/utils/oscap-oval.c

+++ b/utils/oscap-oval.c

@@ -115,7 +115,8 @@ static struct oscap_module OVAL_EVAL = {

 	"   --oval-id <id>                - ID of the OVAL component ref in the data stream to use.\n"

 	"                                   (only applicable for source data streams)\n"

 	"   --fetch-remote-resources      - Download remote content referenced by OVAL Definitions.\n"

-	"                                   (only applicable for source data streams)\n",

+	"                                   (only applicable for source data streams)\n"

+	"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n",

     .opt_parser = getopt_oval_eval,

     .func = app_evaluate_oval

 };

@@ -344,7 +345,7 @@ int app_evaluate_oval(const struct oscap_action *action)

 	/* set OVAL Variables */

 	oval_session_set_variables(session, action->f_variables);

-	oval_session_set_remote_resources(session, action->remote_resources, download_reporting_callback);

+	oval_session_configure_remote_resources(session, action->remote_resources, action->use_local_file, download_reporting_callback);

 	/* load all necesary OVAL Definitions and bind OVAL Variables if provided */

 	if ((oval_session_load(session)) != 0)

 		goto cleanup;

@@ -520,6 +521,7 @@ bool getopt_oval_eval(int argc, char **argv, struct oscap_action *action)

 		{ "skip-valid",	no_argument, &action->validate, 0 },

 		{ "skip-validation",	no_argument, &action->validate, 0 },

 		{ "fetch-remote-resources", no_argument, &action->remote_resources, 1},

+		{ "use-local-file", no_argument, &action->use_local_file, 1},

 		{ 0, 0, 0, 0 }

 	};

diff --git a/utils/oscap-tool.h b/utils/oscap-tool.h

index 18cce0fbce..a3b8781b27 100644

--- a/utils/oscap-tool.h

+++ b/utils/oscap-tool.h

@@ -174,6 +174,7 @@ struct oscap_action {

         int list_dynamic;

 	char *verbosity_level;

 	char *fix_type;

+	int use_local_file;

 };

 int app_xslt(const char *infile, const char *xsltfile, const char *outfile, const char **params);

diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c

index 801e54fa35..ef2768bdef 100644

--- a/utils/oscap-xccdf.c

+++ b/utils/oscap-xccdf.c

@@ -129,6 +129,7 @@ static struct oscap_module XCCDF_EXPORT_OVAL_VARIABLES = {

 		"   --skip-valid                  - Skip validation.\n"

 		"   --skip-validation\n"

 		"   --fetch-remote-resources      - Download remote content referenced by XCCDF.\n"

+		"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n"

 		"   --datastream-id <id>          - ID of the data stream in the collection to use.\n"

 		"                                   (only applicable for source data streams)\n"

 		"   --xccdf-id <id>               - ID of component-ref with XCCDF in the data stream that should be evaluated.\n"

@@ -171,6 +172,7 @@ static struct oscap_module XCCDF_EVAL = {

 		"                                   (only applicable for source data streams)\n"

 		"   --enforce-signature           - Process only signed data streams.\n"

 		"   --fetch-remote-resources      - Download remote content referenced by XCCDF.\n"

+		"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n"

 		"   --progress                    - Switch to sparse output suitable for progress reporting.\n"

 		"                                   Format is \"$rule_id:$result\\n\".\n"

 		"   --datastream-id <id>          - ID of the data stream in the collection to use.\n"

@@ -199,6 +201,7 @@ static struct oscap_module XCCDF_REMEDIATE = {

 		"   --cpe <name>                  - Use given CPE dictionary or language (autodetected)\n"

 		"                                   for applicability checks.\n"

 		"   --fetch-remote-resources      - Download remote content referenced by XCCDF.\n"

+		"   --use-local-file              - Use a locally downloaded copy of the remote resource if it exists.\n"

 		"   --results <file>              - Write XCCDF Results into file.\n"

 		"   --results-arf <file>          - Write ARF (result data stream) into file.\n"

 		"   --stig-viewer <file>          - Writes XCCDF results into FILE in a format readable by DISA STIG Viewer\n"

@@ -573,7 +576,7 @@ int app_evaluate_xccdf(const struct oscap_action *action)

 	if (action->tailoring_file != NULL)

 		xccdf_session_set_user_tailoring_file(session, action->tailoring_file);

 	xccdf_session_set_user_tailoring_cid(session, action->tailoring_id);

-	xccdf_session_set_remote_resources(session, action->remote_resources, download_reporting_callback);