On 03/12/2013 06:15 AM, Simon Lukasik
wrote:
oscap already supports remote URI if the URI is used within
check-content-ref/@href. You can enable this functionality by
--fetch-remote-resources command-line option.
I had hoped that XCCDF documents (and thus relative or absolute
references therein to associated documents) could be identified by
URI with at least support for http and https schemes.
This would allow, for example, placing SCAP content in a version
control repository (exposed secondarily via HTTP) or web service
from which definitive copies could be obtained at a time chosen by
the requestor, obviating the need for a separate, less timely
distribution scheme (I'm intending to do this, by the way).
Such a means of distribution does not preclude methods such as XML
Catalog to provide locally cached copies of the content. I am of
course aware that such a scheme could be implemented independently
of Open SCAP.
I was not aware that remote resources are not fetched by default.
NIST FDCC and USGCB content assume the opposite, and customarily
provide more frequently updated documents such as patch checks as
HTTP references.
However, I am afraid to allow remote URI even on the command-line. Some
of the risks are discussed at https://fedorahosted.org/openscap/ticket/213 .
I do not subscribe to the theory that remote fetches are a potential
risk. I will be happy to defend this carefree attitude vigorously
and at length.
Even if one warrants that remote fetches offer some risks, these
could be obviated by providing a mode of operation for those who
fear them, as has already been done for href attributes, and an
obverse mode for those who embrace them.
I will also (at the risk of citing a document for which I have grave
misgivings) mention that NIST SP
800-126r2 ยง3.10 provides a method by which document integrity
can be assured. Please do not read any other part of that
publication. Prefer the prior
version for now.
Both XCCDF and OVAL have allowed XML digital signatures for many
years. NIST
IR 7802 discusses such use in detail. I have not seen anyone
actually doing this.
XCCDF has always defined href and similar attributes as XML Schema
anyURI, though I am unaware of any normative reference specifying
minimal scheme support. Thus far I have only seen http used. If
libcurl is being used, would it not offer both multiple scheme
support as well as TLS certificate validation?