From: Matt Keeler <mkeeler(a)tresys.com>
fix name errors
finish implementing the sub element support
---
src/secstate/util.py | 40 +++++++++++++++++++++++++++++++---------
1 files changed, 31 insertions(+), 9 deletions(-)
diff --git a/src/secstate/util.py b/src/secstate/util.py
index 8e16326..355dda1 100644
--- a/src/secstate/util.py
+++ b/src/secstate/util.py
@@ -58,14 +58,13 @@ def iterator_to_generator_and_list(iterator_type):
return gen,lst
-xccdf_generator_list_types = ['xccdf_item', 'xccdf_notice',
'xccdf_status', 'xccdf_reference',
- 'xccdf_identity', 'xccdf_model',
'xccdf_result', 'xccdf_profile',
- 'xccdf_select', 'xccdf_value',
'xccdf_value_binding', 'xccdf_setvalue', 'xccdf_refine_value',
- 'xccdf_refine_rule', 'xccdf_ident',
'xccdf_check', 'xccdf_profile_note',
- 'xccdf_fixtext', 'xccdf_check_content_ref',
'xccdf_check_import',
- 'xccdf_fix', 'xccdf_check_export',
'xccdf_warning', 'xccdf_instance',
- 'xccdf_message', 'xccdf_override',
'xccdf_rule_result', 'xccdf_score',
- 'xccdf_target_fact', 'xccdf_plain_text',
'xccdf_model']
+xccdf_generator_list_types = ['xccdf_check', 'xccdf_check_content_ref',
'xccdf_check_export', 'xccdf_check_import',
+ 'xccdf_fix', 'xccdf_fixtext',
'xccdf_ident', 'xccdf_identity', 'xccdf_instance',
+ 'xccdf_item', 'xccdf_message',
'xccdf_model', 'xccdf_notice', 'xccdf_override',
+ 'xccdf_plain_text', 'xccdf_profile',
'xccdf_profile_note', 'xccdf_reference',
+ 'xccdf_refine_rule', 'xccdf_refine_value',
'xccdf_result', 'xccdf_rule_result',
+ 'xccdf_score', 'xccdf_select',
'xccdf_setvalue', 'xccdf_status', 'xccdf_target_fact',
+ 'xccdf_value', 'xccdf_value_binding',
'xccdf_value_instance', 'xccdf_warning']
for type in xccdf_generator_list_types:
gen_func, list_func = iterator_to_generator_and_list('%s_iterator' % type)
@@ -550,7 +549,7 @@ def parse_puppet_fixes(benchmark, ignore_ids=[]):
for fix in fixes:
if oscap.xccdf_fix_get_system(fix) == 'urn:xccdf:fix:script:puppet':
- content = oscap.xccdf_fix_get_content(fix)
+ content = dereference_sub_elements(fix, benchmark)
for line in content.split('\n'):
mtch = line_reg.match(line)
@@ -599,3 +598,26 @@ def dict_to_external(puppet_dict):
return '\n'.join(content)
+
+def dereference_sub_elements(fix, benchmark):
+ sub_element_re = r'<sub\s+.*idref="(.*?)"\s*/\s*>'
+ replacement_re = r'<sub\s+.*idref="%s"\s*/\s*>'
+
+ content = oscap.xccdf_fix_get_content(fix)
+ ids = [m.group(1) for m in re.finditer(sub_element_re, content)]
+ for id in ids:
+ #lookup the actual value the id points too
+ value_obj = oscap.xccdf_item_to_value(oscap.xccdf_benchmark_get_item(benchmark,
id))
+ value_instance =
oscap.xccdf_value_instance_iterator_next(oscap.xccdf_value_get_instances(value_obj))
+
+ type = oscap.xccdf_value_instance_get_type(value_instance)
+ if type == oscap.XCCDF_TYPE_NUMBER:
+ value = str(oscap.xccdf_value_instance_get_value_number(value_instance))
+ elif type == oscap.XCCDF_TYPE_STRING:
+ value = oscap.xccdf_value_instance_get_value_string(value_instance)
+ elif type == oscap.XCCDF_TYPE_BOOLEAN:
+ value =
str(oscap.xccdf_value_instance_get_value_boolean(value_instance)).lower()
+
+ content = re.sub(replacement_re % id, re.escape(value), content)
+ return content
+
\ No newline at end of file
--
1.6.5.2