Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
rhel6/src/transforms/constants.xslt | 4 +-
rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++----------
rhel6/src/transforms/table-srgmap.xslt | 22 +++++++--
3 files changed, 68 insertions(+), 33 deletions(-)
diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
index 6c0fe4a..a3b26b7 100644
--- a/rhel6/src/transforms/constants.xslt
+++ b/rhel6/src/transforms/constants.xslt
@@ -5,14 +5,12 @@
<!-- abbreviated as idents in the XCCDF-->
<xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
-<xsl:variable
name="cciuri">http://iase.disa.mil/cci/index.html</xsl:va...
<!-- abbreviated as references in the XCCDF-->
<xsl:variable
name="nist800-53uri">http://csrc.nist.gov/publications/nistp...
<xsl:variable
name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253...
<xsl:variable
name="dcid63uri">not_officially_available</xsl:variable>
-
-
+<xsl:variable
name="disa-cciuri">http://iase.disa.mil/cci/index.html</x...
<xsl:variable
name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definiti...
</xsl:stylesheet>
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt
b/rhel6/src/transforms/shorthand2xccdf.xslt
index 9127dd8..8cc2b96 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
-exclude-result-prefixes="xccdf">
+exclude-result-prefixes="xccdf xhtml">
<xsl:include href="constants.xslt"/>
@@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
</xsl:copy>
</xsl:template>
- <!-- expand reference to CCE ID -->
+ <!-- expand reference to ident types -->
<xsl:template match="Rule/ident">
<xsl:for-each select="@*">
<ident>
@@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
</xsl:otherwise>
</xsl:choose>
</xsl:when>
-
- <!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS
settings -->
- <xsl:when test="name() = 'cci'">
- <xsl:attribute name="system">
- <xsl:value-of select="$cciuri" />
- <!--
<
xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> -->
- </xsl:attribute>
- <xsl:choose>
- <xsl:when test="starts-with(translate(., 'ci',
'CI'), 'CCI')">
- <xsl:value-of select="." />
- </xsl:when>
- <xsl:otherwise>
- <xsl:value-of select="concat('CCI-', .)" />
- </xsl:otherwise>
- </xsl:choose>
- </xsl:when>
<xsl:otherwise>
<xsl:value-of select="." />
</xsl:otherwise>
@@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
</xsl:for-each>
</xsl:template>
- <!-- expand ref attributes to appropriate XCCDF reference bodies -->
+ <!-- expand ref attributes to reference tags, one item per reference -->
<xsl:template match="Rule/ref">
<xsl:for-each select="@*">
+ <xsl:call-template name="ref-info" >
+ <xsl:with-param name="refsource" select="name()" />
+ <xsl:with-param name="refitems" select="." />
+ </xsl:call-template>
+ </xsl:for-each>
+ </xsl:template>
+
+ <!-- expands individual reference source -->
+ <xsl:template name="ref-info">
+ <xsl:param name="refsource"/>
+ <xsl:param name="refitems"/>
+ <xsl:variable name="delim" select="','" />
+ <xsl:choose>
+ <xsl:when test="$delim and contains($refitems, $delim)">
+ <!-- output the reference -->
+ <xsl:call-template name="ref-output" >
+ <xsl:with-param name="refsource"
select="$refsource" />
+ <xsl:with-param name="refitem"
select="substring-before($refitems, $delim)" />
+ </xsl:call-template>
+ <!-- recurse for additional refs -->
+ <xsl:call-template name="ref-info">
+ <xsl:with-param name="refsource"
select="$refsource" />
+ <xsl:with-param name="refitems"
select="substring-after($refitems, $delim)" />
+ </xsl:call-template>
+ </xsl:when>
+
+ <xsl:otherwise>
+ <xsl:call-template name="ref-output" >
+ <xsl:with-param name="refsource"
select="$refsource" />
+ <xsl:with-param name="refitem" select="$refitems"
/>
+ </xsl:call-template>
+ </xsl:otherwise>
+ </xsl:choose>
+ </xsl:template>
+
+ <!-- output individual reference -->
+ <xsl:template name="ref-output">
+ <xsl:param name="refsource"/>
+ <xsl:param name="refitem"/>
<reference>
<xsl:attribute name="href">
<!-- populate the href attribute with a global reference-->
- <xsl:if test="name() = 'nist'">
+ <xsl:if test="$refsource = 'nist'">
<xsl:value-of select="$nist800-53uri" />
</xsl:if>
- <xsl:if test="name() = 'cnss'">
+ <xsl:if test="$refsource = 'cnss'">
<xsl:value-of select="$cnss1253uri" />
</xsl:if>
- <xsl:if test="name() = 'dcid'">
+ <xsl:if test="$refsource = 'dcid'">
<xsl:value-of select="$dcid63uri" />
</xsl:if>
+ <xsl:if test="$refsource = 'disa'">
+ <xsl:value-of select="$disa-cciuri" />
+ </xsl:if>
</xsl:attribute>
- <!-- the actual string specified -->
- <xsl:value-of select="." />
+ <xsl:value-of select="$refitem" />
</reference>
- </xsl:for-each>
</xsl:template>
-
<!-- expand reference to OVAL ID -->
<xsl:template match="Rule/oval">
<check>
diff --git a/rhel6/src/transforms/table-srgmap.xslt
b/rhel6/src/transforms/table-srgmap.xslt
index a502d24..b7f68a7 100644
--- a/rhel6/src/transforms/table-srgmap.xslt
+++ b/rhel6/src/transforms/table-srgmap.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml">
<!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF
content (e.g. draft STIG),
- and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs
as idents).
+ and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs
as references).
The output shows how a body of XCCDF meets SRG requirements. -->
<xsl:include href="constants.xslt"/>
@@ -77,14 +77,17 @@
<td> <xsl:value-of select="$srg_id"/> </td>
<td> <xsl:value-of select="$srg_cci"/> </td>
<td> <xsl:value-of select="$srg_title"/> </td>
- <td> <xsl:value-of select="$srg_desc"/> </td>
+ <td> <xsl:call-template
name="extract-vulndiscussion"><xsl:with-param name="desc"
select="$srg_desc"/></xsl:call-template> </td>
<td>
<!-- iterate over the Rules in the (externally-provided) XCCDF document
-->
<xsl:for-each select="$rules">
<xsl:variable name="rule" select="."/>
+ <xsl:if test="cdf:reference[@href=$disa-cciuri]" >
<table>
- <xsl:for-each
select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
- <xsl:if test="self::node()[text()=$srg_cci]" >
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <xsl:variable name="cci_formatted"
select='format-number(self::node()[text()], "000000")' />
+ <xsl:variable name="cci_expanded"
select="concat('CCI-', $cci_formatted)" />
+ <xsl:if test="$cci_expanded=$srg_cci" >
<tr>
<td> <xsl:value-of select="$rule/cdf:title"/> </td>
<td> <xsl:apply-templates select="$rule/cdf:description"/>
</td>
@@ -92,11 +95,22 @@
</xsl:if>
</xsl:for-each>
</table>
+ </xsl:if>
</xsl:for-each>
</td>
</tr>
</xsl:template>
+
+ <!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags
-->
+ <!-- this should be removed as soon as SRGs include only a description instead of odd
tags -->
+ <xsl:template name="extract-vulndiscussion">
+ <xsl:param name="desc"/>
+ <xsl:variable name="desc_info" select="substring-before($desc,
'</VulnDiscussion>')"/>
+ <xsl:value-of select="substring-after($desc_info,
'<VulnDiscussion>')"/>
+ </xsl:template>
+
+
<!-- get rid of XHTML namespace since we're outputting to HTML -->
<xsl:template match="xhtml:*">
<xsl:element name="{local-name()}">
--
1.7.1