ACK
Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos(a)redhat.com
On 04/27/2012 11:57 AM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank<blank(a)eclipse.ncsc.mil>
---
rhel6/src/transforms/constants.xslt | 4 +-
rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++----------
rhel6/src/transforms/table-srgmap.xslt | 22 +++++++--
3 files changed, 68 insertions(+), 33 deletions(-)
diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
index 6c0fe4a..a3b26b7 100644
--- a/rhel6/src/transforms/constants.xslt
+++ b/rhel6/src/transforms/constants.xslt
@@ -5,14 +5,12 @@
<!-- abbreviated as idents in the XCCDF-->
<xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
-<xsl:variable
name="cciuri">http://iase.disa.mil/cci/index.html</xsl:va...
<!-- abbreviated as references in the XCCDF-->
<xsl:variable
name="nist800-53uri">http://csrc.nist.gov/publications/nistp...
<xsl:variable
name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253...
<xsl:variable
name="dcid63uri">not_officially_available</xsl:variable>
-
-
+<xsl:variable
name="disa-cciuri">http://iase.disa.mil/cci/index.html</x...
<xsl:variable
name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definiti...
</xsl:stylesheet>
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt
b/rhel6/src/transforms/shorthand2xccdf.xslt
index 9127dd8..8cc2b96 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
-exclude-result-prefixes="xccdf">
+exclude-result-prefixes="xccdf xhtml">
<xsl:include href="constants.xslt"/>
@@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
</xsl:copy>
</xsl:template>
-<!-- expand reference to CCE ID -->
+<!-- expand reference to ident types -->
<xsl:template match="Rule/ident">
<xsl:for-each select="@*">
<ident>
@@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
</xsl:otherwise>
</xsl:choose>
</xsl:when>
-
-<!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings
-->
-<xsl:when test="name() = 'cci'">
-<xsl:attribute name="system">
-<xsl:value-of select="$cciuri" />
-<!--<xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> -->
-</xsl:attribute>
-<xsl:choose>
-<xsl:when test="starts-with(translate(., 'ci', 'CI'),
'CCI')">
-<xsl:value-of select="." />
-</xsl:when>
-<xsl:otherwise>
-<xsl:value-of select="concat('CCI-', .)" />
-</xsl:otherwise>
-</xsl:choose>
-</xsl:when>
<xsl:otherwise>
<xsl:value-of select="." />
</xsl:otherwise>
@@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
</xsl:for-each>
</xsl:template>
-<!-- expand ref attributes to appropriate XCCDF reference bodies -->
+<!-- expand ref attributes to reference tags, one item per reference -->
<xsl:template match="Rule/ref">
<xsl:for-each select="@*">
+<xsl:call-template name="ref-info">
+<xsl:with-param name="refsource" select="name()" />
+<xsl:with-param name="refitems" select="." />
+</xsl:call-template>
+</xsl:for-each>
+</xsl:template>
+
+<!-- expands individual reference source -->
+<xsl:template name="ref-info">
+<xsl:param name="refsource"/>
+<xsl:param name="refitems"/>
+<xsl:variable name="delim" select="','" />
+<xsl:choose>
+<xsl:when test="$delim and contains($refitems, $delim)">
+<!-- output the reference -->
+<xsl:call-template name="ref-output">
+<xsl:with-param name="refsource" select="$refsource" />
+<xsl:with-param name="refitem" select="substring-before($refitems,
$delim)" />
+</xsl:call-template>
+<!-- recurse for additional refs -->
+<xsl:call-template name="ref-info">
+<xsl:with-param name="refsource" select="$refsource" />
+<xsl:with-param name="refitems" select="substring-after($refitems,
$delim)" />
+</xsl:call-template>
+</xsl:when>
+
+<xsl:otherwise>
+<xsl:call-template name="ref-output">
+<xsl:with-param name="refsource" select="$refsource" />
+<xsl:with-param name="refitem" select="$refitems" />
+</xsl:call-template>
+</xsl:otherwise>
+</xsl:choose>
+</xsl:template>
+
+<!-- output individual reference -->
+<xsl:template name="ref-output">
+<xsl:param name="refsource"/>
+<xsl:param name="refitem"/>
<reference>
<xsl:attribute name="href">
<!-- populate the href attribute with a global reference-->
-<xsl:if test="name() = 'nist'">
+<xsl:if test="$refsource = 'nist'">
<xsl:value-of select="$nist800-53uri" />
</xsl:if>
-<xsl:if test="name() = 'cnss'">
+<xsl:if test="$refsource = 'cnss'">
<xsl:value-of select="$cnss1253uri" />
</xsl:if>
-<xsl:if test="name() = 'dcid'">
+<xsl:if test="$refsource = 'dcid'">
<xsl:value-of select="$dcid63uri" />
</xsl:if>
+<xsl:if test="$refsource = 'disa'">
+<xsl:value-of select="$disa-cciuri" />
+</xsl:if>
</xsl:attribute>
-<!-- the actual string specified -->
-<xsl:value-of select="." />
+<xsl:value-of select="$refitem" />
</reference>
-</xsl:for-each>
</xsl:template>
-
<!-- expand reference to OVAL ID -->
<xsl:template match="Rule/oval">
<check>
diff --git a/rhel6/src/transforms/table-srgmap.xslt
b/rhel6/src/transforms/table-srgmap.xslt
index a502d24..b7f68a7 100644
--- a/rhel6/src/transforms/table-srgmap.xslt
+++ b/rhel6/src/transforms/table-srgmap.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml">
<!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF
content (e.g. draft STIG),
- and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs
as idents).
+ and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs
as references).
The output shows how a body of XCCDF meets SRG requirements. -->
<xsl:include href="constants.xslt"/>
@@ -77,14 +77,17 @@
<td> <xsl:value-of select="$srg_id"/> </td>
<td> <xsl:value-of select="$srg_cci"/> </td>
<td> <xsl:value-of select="$srg_title"/> </td>
- <td> <xsl:value-of select="$srg_desc"/> </td>
+ <td> <xsl:call-template
name="extract-vulndiscussion"><xsl:with-param name="desc"
select="$srg_desc"/></xsl:call-template> </td>
<td>
<!-- iterate over the Rules in the (externally-provided) XCCDF document
-->
<xsl:for-each select="$rules">
<xsl:variable name="rule" select="."/>
+ <xsl:if test="cdf:reference[@href=$disa-cciuri]">
<table>
- <xsl:for-each
select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
- <xsl:if test="self::node()[text()=$srg_cci]">
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <xsl:variable name="cci_formatted"
select='format-number(self::node()[text()], "000000")' />
+ <xsl:variable name="cci_expanded" select="concat('CCI-',
$cci_formatted)" />
+ <xsl:if test="$cci_expanded=$srg_cci">
<tr>
<td> <xsl:value-of select="$rule/cdf:title"/>
</td>
<td> <xsl:apply-templates select="$rule/cdf:description"/>
</td>
@@ -92,11 +95,22 @@
</xsl:if>
</xsl:for-each>
</table>
+ </xsl:if>
</xsl:for-each>
</td>
</tr>
</xsl:template>
+
+ <!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags
-->
+ <!-- this should be removed as soon as SRGs include only a description instead of
odd tags -->
+ <xsl:template name="extract-vulndiscussion">
+ <xsl:param name="desc"/>
+ <xsl:variable name="desc_info" select="substring-before($desc,
'</VulnDiscussion>')"/>
+ <xsl:value-of select="substring-after($desc_info,
'<VulnDiscussion>')"/>
+ </xsl:template>
+
+
<!-- get rid of XHTML namespace since we're outputting to HTML -->
<xsl:template match="xhtml:*">
<xsl:element name="{local-name()}">