Extended signatures for BFI

[rohit]

Has anyone working on creating extended signatures to look for version information in file contents? Here is the scenario i had.

There is a file on the server MYFILE.txt which contains “MYAPP_version=1.3”. I created an extended signature using below xml

<MultipleInstance>
	<Iterator export="true" name="INSTALL_PATH">
		<FindFilePathEx name="MYFILE.txt"/>
	</Iterator>
	<Instance>
		<Variable export="false" name="file_read">
			<ReadFile path="$(INSTALL_PATH)MYFILE.txt"/>
		</Variable>
		<Variable name="IS_INSTALLED">
			<Contains inputString="$(file_read)" position="contains" searchedString="MYAPP_version=1.3"/>
		</Variable>
		<Condition withVariable="IS_INSTALLED">
			<Action do="SKIP" onValue="false"/>
		</Condition>
	</Instance>
</MultipleInstance>

After creating this entry, I ran an import for distributing the catalog to endpoint and then ran a Software scan. However nothing is being discovered against the signature.
Is there something I am missing?

[fermt]

@michalpaluch @Andrzej.Pietrzak Do you have any thoughts?

[michalpaluch]

check catalog.xml file on endpoint, if it contains your signature
next check <EP_ID>_citlog.xml file which contains CIT error/warn log for sigantures, see if your signature was correctly evaluated

[rohit]

I can see the signature in catalog.xml file on endpoint and the citlog.xml file does not how any errors for that signature guid. Does it have something to do with the .txt file used in the signature? _cit.xml.bz2 does not contain any matches.

[fermt]

Also I tried running the command wscansw and I didn’t get any match.
I have used content provided by IBM in the BFI Catalog as template and it doesn’t work at all. What are we missing? Is there any documentation besides the User’s guide that we can review?

[michalpaluch]

I just tested this signature and it works just fine. Here is what I did.

1. created my small test_catalog.xml, note I removed the condition just to be able to see it in output even if it fails (you can see content here: https://justpaste.it/3k1a7)
2. defined paths for CIT (if you do not do that you will see in error.txt Expression [FindFilePathEx] could not be resolved.)
   LIBPATH="/opt/tivoli/cit/bin:$LIBPATH"
   export LIBPATH
   SHLIB_PATH="/opt/tivoli/cit/bin:$SHLIB_PATH"
   export SHLIB_PATH
   LD_LIBRARY_PATH="/opt/tivoli/cit/bin:$LD_LIBRARY_PATH"
   export LD_LIBRARY_PATH
3. ran:
   ./wscansw -i test_catalog.xml -e error.txt -o out.txt -l MAX -c /var/opt/BESClient/LMT/CIT/sw_config.xml
   If there is no MYFILE.txt on file system, you will see in max logs:
   Signature [e6c4375b9bc14eb40a7f36f887443115] skipped because no instances are available.

However, if there is MYFILE.txt but content doesnt match, the out.txt contains:
https://justpaste.it/6ij62

If content matches:
https://justpaste.it/4p2rm

[fermt]

Yeah, that works…

I’ll try now creating the signature in BFI and run a new scan to see how it goes…

[rohit]

Yeah this is working for me too now. I was getting below error when i tried this on Windows

18/10/24 09:43:14 I [Plugin ] ReadFile::getScalarResult(Plug [85892] File: C:\Program Files\MYAPP\MYFILE.txt opened successfully (native mode)
18/10/24 09:43:14 I [Plugin ] ReadFile::getScalarResult::_fo [85892] ----------------------------------> ENTRY
18/10/24 09:43:14 I [Plugin ] ReadFile::getScalarResult::_fo [85892] <---------------------------------- EXIT
18/10/24 09:43:14 I [Plugin ] ReadFile::getScalarResult(Plug [85892] <-------------------------------- EXIT
18/10/24 09:43:14 I [XSE ] ExpressionShell::~ExpressionSh [85892] --------------------------------> ENTRY
18/10/24 09:43:14 I [XSE ] ExpressionShell::~ExpressionSh [85892] <-------------------------------- EXIT
18/10/24 09:43:14 I [XSE ] ProcessorUtility::evaluateVari [85892] Adding variable file_read value: ÿþM
18/10/24 09:43:14 I [XSE ] ProcessorUtility::evaluateVari [85892] <------------------------------ EXIT

MYFILE.txt contains the line “MYAPP_version=1.3” but i think the scanner was not able to read it because of the encoding. Once i fixed the encoding, signature matched.

[rohit]

I am still trying to comprehend what the issue was with the original signature i used. The only difference i see is

<Condition withVariable="IS_INSTALLED">
			<Action do="SKIP" onValue="false"/>
		</Condition>

Was this creating the issue?

[michalpaluch]

Nope, you should add it to the production siignature. I removed it only for test puropse, but in fact BFI expects only matched GUIDs in the output file, hence the condition.

[Wandy]

HI
I’m struck-ling with something similar to this:

I’m try to find a specific string in at file:

<MultipleInstance>
  <Iterator name="file_list" export="false">
    <FindFilePathEx name="tq.ini" />
  </Iterator>
  <Instance>
    <Variable name="file_read" export="false">
      <ReadFile path="$(file_list)tq.ini" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <VectorToScalar>
          <Vector filter="Data">
          <ValueOf value="$(file_read)" />
          </Vector>
        </VectorToScalar>
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP" />
    </Condition>
  </Instance>
</MultipleInstance>

and I try to test it with this:
/wscansw -i extended_signature_test_tq.xml -o output.xml -e warning.xml

the only output I get in both files is:

<?xml version="1.0" encoding="UTF-8"?>

the file is placed in:
/opt/teamquest/manager/etc/

and it contains this:
[Database]
Data Directory=/opt/teamquest/data

[michalpaluch]

Try:

<MultipleInstance>
<Iterator export=“true” name=“INSTALL_PATH”>
<FindFilePathEx name=“tq.ini”/>
</Iterator>
<Instance>
<Variable export=“false” name=“file_read”>
<ReadFile path="$(INSTALL_PATH)tq.ini"/>
</Variable>
<Variable name=“IS_INSTALLED”>
<Contains inputString="$(file_read)" position=“contains” searchedString=“Data Directory=/opt/teamquest/data”/>
</Variable>
</Instance>
</MultipleInstance>

[Wandy]

Hi
thanks for the quick answer, but it give the same result, I have also tried with wildcards in the search string, but it’s the same.

[michalpaluch]

Can you try with debug logs, look at my example in above post form october, it will give us idea what is wrong

[Wandy]

Hi

Here is the output ran with the MAX switch.

max.out.bes (37.2 KB)

[Wandy]

Hi
the last uploaded file was NOT done with your input file, but this onmax_2.out.bes (36.6 KB)
e is and it comes with some errors.