Red Hat Enterprise Linux : Custom Repository Mapping

#TRUSTED 1aa9ae8bb25306374ae96eae49024a0be88cf7bb161500c7960fd2f664bd11a616442a86e56edb180e2b0197ea9b07e4a22051d60be358a0d817cd9d6f511efe28ef1642b06d16d7704f1be16d3849963cd5a7919d8d000665875546650cac11373c1683393764ebd2bb80e7a632c168c1f1f94a35158711a0c12ac6af3ffb77ce7e84036f9eae688a07a72701bebee7abbacd0d4058615aac942a9d36f07ec98282c0f002bdb0a7a0fc1a4a87b32b6b5a671d5078d156caca73743d378b999b16ac2380f82b464dd20e664e6a68d6a265b50c7d87dccd715824a4f9b9159ec3b9a83e46eb3482a39291d7ecc759a6024c8115b40e0e31c233f00f906de299e09a69500703842c108ce17d85aaec351d53b06fc6b8ef5b372850bd636d4a47103592b1f8134f88c73f9e3a9ff95e79a50fe0a57f30ee03ba9f9bc0b0ed9623a97bb4fbe54ee0cc7f735a37449fd7d7a2a1cd0dbca9966066ab0805332dd559d5df2c1bb2de648103a0c9569c35079f255dad6a9db636356ffce74696f5e055acd293bce62ab3a159ae7c2d946f1509fcc05979678952ac2ab8d56f35ae6224bcbaf31b75ec930e96cda8d5f03cd2efe4a4cc45cacb33cd7a286c3ddf487a6c792fa95412845b0616b1a7dd0655eef207c92f100ea330f6659bbbf82c3f907430e596bbb530ac9844bf17390df99940529185ff8511d9c53f493c51fcb005c0f3
#TRUST-RSA-SHA256 3e78ff4822804146956867870ff614234129ba0be1912b661f147b903688bc4068d1add4e64e914bd1cffacec1f16326d28c2d7ecb0526753d6bf3ff0f54d7b8ff90ef489cced04aa51ec14d8e35343e191ffcd5d52deab03205b451c5e2a1e47f55f304aff8b7e1fb41edcff988d9715ecbfce28ad9e1ec19f85030b1e107a8ca0b715d44b1710ab5ada654b9bcb4f47e1f68c6dee74fbe11e3a1f5d4c69ac61ea9b6733107f74d1ea90f692ee2539fa05b9a291a97e5d42deefbe3299ca68764503cddcc82b6e39d9f5f53740cbb376ae8074ce658fa826118343e3eb152858f2c97f9e06ef1a59ccde9408c6837355a8f744b198c21b1638c619f67211943978db48fe17d1ec00321976182d8b5e06d248a8f569b3bb16e461882a63e10837912a15af6cb0b30e2ed50a802b6a8925a0fd39ce28f06c36a6a8cf30f6db244449d17d2ae099150dff7816875b9a97932b1349e427d90860b47ee361993404b3c7a973698d928345d0301a915eb7349c68d52833a7c06f748c82f252cbf06d85c8a939254bb72ef9f259c59af60fde86876b7a88e13508b478537368a07f47ead5cc872107fcae974c2a481182f0a438a5c9a7435bcd734d6ee153249842b04d897489b189c4f1fb32937d0fbe3878d46535ffc7e6bf63d61711b6e8e0d3324c2a10255e8cc00e7dce65cbc05347615e5df5b49adca039c2c953eee80ffc96f
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include("compat.inc");

if (description)
{
  script_id(233963);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/16");

  script_name(english:"Red Hat Enterprise Linux : Custom Repository Mapping");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote host is using one or more custom repositories to access official Red Hat repositories."
  );
  script_set_attribute(
    attribute:"description",
    value:
"By leveraging the user-generated custom repository mapping file, the scan has identified one or more custom repositories
used to access official Red Hat repositories to install packages. These repositories will be used in conjunction with Red
Hat OS package level assessment security advisories to determine whether or not relevant repositories are installed before
checking package versions for vulnerable ranges."
  );
  # https://www.redhat.com/en/blog/how-accurately-match-oval-security-data-installed-rpms
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5c79239a");
  # https://community.tenable.com/s/article/How-Red-Hat-Local-Security-Checks-operate
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9221764");
  script_set_attribute(attribute:"see_also", value:"https://www.redhat.com/security/data/metrics/repository-to-cpe.json");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_type", value:"local");

  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/14");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/relative-url-list");

  exit(0);
}

include('json2.inc');

##
# This function retrieves user-defined repository mapping file
# and prepares it for use by RHEL local checks
#
# @remark
# Locates the imported repository mapping file and prepares it for use.
#
# @return [array] Custom repo mapping to compare against enumerated repo urls
##
function get_rhel_custom_repo_mapping()
{
  var data, user_pref, data_ret, map;

  data = NULL;
  user_pref = 'Global variable settings[file]:custom_rhel_repo_mapping';
  dbg::detailed_log(lvl:2, msg:"Confirming if custom repo mapping preference is enabled...");
  if (get_preference(user_pref))
  {
    dbg::detailed_log(lvl:2, msg:"Custom repo mapping preference enabled, locating mapping file...");
    data = get_preference_file_content(user_pref);
    if (!isnull(data))
      dbg::detailed_log(lvl:2,
        msg:'Mapping file found! ',
        msg_details:{
          'raw map':{'lvl':2, 'value':data}
      });
    else if (isnull(data) && strlen(data) < 1)
    {
      dbg::detailed_log(lvl:2, msg:"Custom repo mapping preference is enabled but returned an empty file.");
      return FALSE;
    }
  }

  if (!isnull(data))
  {
    dbg::detailed_log(lvl:2, msg:"Mapping file prepared for policy...");
    return data;
  }
  return FALSE;
}

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var pref = get_kb_item("FLATLINE/repo_map");
if (empty_or_null(pref))
  pref = get_preference('Global variable settings[file]:custom_rhel_repo_mapping');
if (!pref) audit(AUDIT_MISSING_PREFERENCES, "Red Hat custom repository mappping file");

# Gather import file and retrieve lists of enabled and validated repo URLs
var relative_urls  = get_kb_item_or_exit('Host/RedHat/relative-url-list');
var import_file    = get_kb_item("FLATLINE/repo_mapping");
if (empty_or_null(import_file))
  import_file = get_rhel_custom_repo_mapping();

# Parse import file and prepare for anaylsis
if(!empty_or_null(import_file) && strlen(import_file) > 0)
{
  dbg::detailed_log(lvl:2, msg:'Mapping file imported successfully.');
  var mapping = json_read(import_file);
}
else
  exit(1, 'Custom mapping option is enabled but failed to import the mapping file successfully.');

if (!empty_or_null(mapping))
{
  mapping = mapping[0]['CustomRepoMapping'];
  dbg::detailed_log(lvl:2, msg:'Mapping file ready: ', msg_details:{'map':{'lvl':2, 'value':mapping}});
}
else
  exit(1, 'Custom mapping file was imported but failed to be parsed successfully.');

var url, key;
var correlated = 0;
var mapped = [];
var prepped_urls = deserialize(relative_urls);
dbg::detailed_log(lvl:2, msg:'Relative URLs ready: ', msg_details:{'urls':{'lvl':2, 'value':prepped_urls}});

# Correlate custom repo URLs to their official counterparts
for (key in mapping)
{
  foreach url (prepped_urls)
  {
    dbg::detailed_log(lvl:2, msg:'Evaluating: ' + url + ' and ' + key + '\n');
    var base = preg_replace(string:url, pattern:'\\?.*$', replace:'');
    if (tolower(base) == tolower(key))
    {
      append_element(value:mapping[key]['official_url'], var:mapped);
      mapping[key]['correlated'] = TRUE;
      dbg::detailed_log(
        lvl:2,
        msg:'Repo match found!',
        msg_details:{
          "Official URL" : {"lvl":2, "value":mapping[key]['official_url']},
          "Internal URL" : {"lvl":2, "value":url}});
      correlated++;
    }
  }
}

# Add validated official repo URLs to Host/RedHat/valid-repo-relative-urls
if (!empty_or_null(mapped))
{
  var serialized_validated = NULL;
  serialized_validated = serialize(mapped);
  dbg::detailed_log(lvl:1, msg:'Generating list of correlated URLs:' + serialized_validated + '\n');
  if (!empty_or_null(serialized_validated))
    replace_kb_item(name:'Host/RedHat/valid-repo-relative-urls', value:serialized_validated);
}
else exit(0, 'No official Red Hat repositories were found to be enabled via custom mirrors.');

# Prepare reporting elements
var stub;
if (!empty_or_null(serialized_validated))
{
  if (correlated == 1)
    stub = 'repository has ';
  else
    stub = 'repositories have ';
}

var successful_repo_correlation = 
  'Using the internal repository mapping file imported into the scan policy, the following\n' +
  'Red Hat ' + stub + 'been determined to be enabled on the host via internal mirrors:\n\n';

var unsuccessful_repo_correlation = 
  'The following custom URLs were imported but were not identified as enabled, therefore\n' +
  'their official Red Hat repository counterpart will not be considered for this host:\n\n';

var report = '';
var mapped_chunk = '';
var unmapped_chunk = '';
var INVALID_MAP = FALSE;

var report_rhel_urls     = '  RHEL Repo Relative URL         : ';
var report_rhel_label    = '  RHEL Repo Label                : ';
var report_custom_url    = '  Internal Repo Relative URL     : ';

foreach (key in keys(mapping))
{
  if (mapping[key]['correlated'] == TRUE)
  {
    mapped_chunk += report_rhel_urls    + mapping[key]['official_url'] + '\n';
    mapped_chunk += report_rhel_label   + mapping[key]['official_label'] + '\n';
    mapped_chunk += report_custom_url   + key + '\n\n';
  }
  else
  {
    unmapped_chunk += report_rhel_urls    + mapping[key]['official_url'] + '\n';
    unmapped_chunk += report_rhel_label   + mapping[key]['official_label'] + '\n';
    unmapped_chunk += report_custom_url   + key + '\n\n';
    INVALID_MAP = TRUE;
  }
}

# Compile final report
if (!empty_or_null(mapped) && max_index(mapped) > 0)
{
  report += successful_repo_correlation + mapped_chunk;
  if (INVALID_MAP)
    report += unsuccessful_repo_correlation  + unmapped_chunk;

# Report
  if (!empty_or_null(report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : report
    );
  }
}