[PATCH] changed major transforms to handle CCIs as references instead of idents

Jeffrey Blank blank at eclipse.ncsc.mil
Fri Apr 27 15:57:13 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 rhel6/src/transforms/constants.xslt       |    4 +-
 rhel6/src/transforms/shorthand2xccdf.xslt |   75 +++++++++++++++++++----------
 rhel6/src/transforms/table-srgmap.xslt    |   22 +++++++--
 3 files changed, 68 insertions(+), 33 deletions(-)

diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
index 6c0fe4a..a3b26b7 100644
--- a/rhel6/src/transforms/constants.xslt
+++ b/rhel6/src/transforms/constants.xslt
@@ -5,14 +5,12 @@
 
 <!-- abbreviated as idents in the XCCDF-->
 <xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
-<xsl:variable name="cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
 
 <!-- abbreviated as references in the XCCDF-->
 <xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf</xsl:variable>
 <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
 <xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
-
-
+<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
 
 <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
 </xsl:stylesheet>
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt
index 9127dd8..8cc2b96 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -2,7 +2,7 @@
 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
 xmlns:xhtml="http://www.w3.org/1999/xhtml"
-exclude-result-prefixes="xccdf">
+exclude-result-prefixes="xccdf xhtml">
 
 <xsl:include href="constants.xslt"/>
 
@@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
     </xsl:copy>
   </xsl:template> 
 
-  <!-- expand reference to CCE ID -->
+  <!-- expand reference to ident types -->
   <xsl:template match="Rule/ident">
     <xsl:for-each select="@*">
       <ident>
@@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
               </xsl:otherwise>
             </xsl:choose>
           </xsl:when>
-
-          <!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings -->
-          <xsl:when test="name() = 'cci'">
-            <xsl:attribute name="system">
-              <xsl:value-of select="$cciuri" />
-              <!-- <xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> -->
-            </xsl:attribute>
-            <xsl:choose>
-              <xsl:when test="starts-with(translate(., 'ci', 'CI'), 'CCI')">
-                <xsl:value-of select="." />
-              </xsl:when>
-              <xsl:otherwise>
-                <xsl:value-of select="concat('CCI-', .)" />
-              </xsl:otherwise>
-            </xsl:choose>
-          </xsl:when>
           <xsl:otherwise>
             <xsl:value-of select="." />
           </xsl:otherwise>
@@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
     </xsl:for-each>
   </xsl:template>
 
-  <!-- expand ref attributes to appropriate XCCDF reference bodies -->
+  <!-- expand ref attributes to reference tags, one item per reference -->
   <xsl:template match="Rule/ref"> 
     <xsl:for-each select="@*">
+       <xsl:call-template name="ref-info" >
+          <xsl:with-param name="refsource" select="name()" />
+          <xsl:with-param name="refitems" select="." />
+       </xsl:call-template>
+    </xsl:for-each>
+  </xsl:template>
+
+  <!-- expands individual reference source -->
+  <xsl:template name="ref-info">
+      <xsl:param name="refsource"/>
+      <xsl:param name="refitems"/>
+      <xsl:variable name="delim" select="','" />
+       <xsl:choose>
+           <xsl:when test="$delim and contains($refitems, $delim)">
+             <!-- output the reference -->
+             <xsl:call-template name="ref-output" >
+               <xsl:with-param name="refsource" select="$refsource" />
+               <xsl:with-param name="refitem" select="substring-before($refitems, $delim)" />
+             </xsl:call-template>
+             <!-- recurse for additional refs -->
+             <xsl:call-template name="ref-info">
+               <xsl:with-param name="refsource" select="$refsource" />
+               <xsl:with-param name="refitems" select="substring-after($refitems, $delim)" />
+             </xsl:call-template>
+           </xsl:when>
+
+           <xsl:otherwise>
+             <xsl:call-template name="ref-output" >
+               <xsl:with-param name="refsource" select="$refsource" />
+               <xsl:with-param name="refitem" select="$refitems" />
+             </xsl:call-template>
+           </xsl:otherwise>
+       </xsl:choose>
+  </xsl:template>
+
+  <!-- output individual reference -->
+  <xsl:template name="ref-output">
+      <xsl:param name="refsource"/>
+      <xsl:param name="refitem"/>
       <reference>
         <xsl:attribute name="href">
         <!-- populate the href attribute with a global reference-->
-          <xsl:if test="name() = 'nist'">
+          <xsl:if test="$refsource = 'nist'">
             <xsl:value-of select="$nist800-53uri" />
           </xsl:if>
-          <xsl:if test="name() = 'cnss'">
+          <xsl:if test="$refsource = 'cnss'">
             <xsl:value-of select="$cnss1253uri" />
           </xsl:if>
-          <xsl:if test="name() = 'dcid'">
+          <xsl:if test="$refsource = 'dcid'">
             <xsl:value-of select="$dcid63uri" />
           </xsl:if>
+          <xsl:if test="$refsource = 'disa'">
+            <xsl:value-of select="$disa-cciuri" />
+          </xsl:if>
         </xsl:attribute>
-      <!-- the actual string specified -->
-        <xsl:value-of select="." />  
+        <xsl:value-of select="$refitem" />
       </reference>
-    </xsl:for-each>
   </xsl:template>
 
-
   <!-- expand reference to OVAL ID -->
   <xsl:template match="Rule/oval">
     <check>
diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt
index a502d24..b7f68a7 100644
--- a/rhel6/src/transforms/table-srgmap.xslt
+++ b/rhel6/src/transforms/table-srgmap.xslt
@@ -2,7 +2,7 @@
 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
 
 <!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG), 
-     and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents). 
+     and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as references). 
      The output shows how a body of XCCDF meets SRG requirements. -->
 
 <xsl:include href="constants.xslt"/>
@@ -77,14 +77,17 @@
 		  <td> <xsl:value-of select="$srg_id"/> </td> 
 		  <td> <xsl:value-of select="$srg_cci"/> </td> 
 		  <td> <xsl:value-of select="$srg_title"/> </td>
-		  <td> <xsl:value-of select="$srg_desc"/> </td>
+		  <td> <xsl:call-template name="extract-vulndiscussion"><xsl:with-param name="desc" select="$srg_desc"/></xsl:call-template> </td>
 		  <td>
       		<!-- iterate over the Rules in the (externally-provided) XCCDF document -->
 			<xsl:for-each select="$rules">
 				<xsl:variable name="rule" select="."/>
+				<xsl:if test="cdf:reference[@href=$disa-cciuri]" > 
 				<table>
-				<xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']"> 
-			  		<xsl:if test="self::node()[text()=$srg_cci]" >
+				<xsl:for-each select="cdf:reference[@href=$disa-cciuri]"> 
+				    <xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+				    <xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)"  />
+			  		<xsl:if test="$cci_expanded=$srg_cci" >
 						<tr>
 						<td> <xsl:value-of select="$rule/cdf:title"/> </td>
 						<td> <xsl:apply-templates select="$rule/cdf:description"/> </td>
@@ -92,11 +95,22 @@
 			  		</xsl:if>
 				</xsl:for-each>
 				</table>
+				</xsl:if>
 			</xsl:for-each>
 			</td>
 		  </tr>
 	</xsl:template>
 
+
+	<!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags -->
+	<!-- this should be removed as soon as SRGs include only a description instead of odd tags -->
+	<xsl:template name="extract-vulndiscussion">
+		<xsl:param name="desc"/>
+		<xsl:variable name="desc_info" select="substring-before($desc, '&lt;/VulnDiscussion&gt;')"/>
+		<xsl:value-of select="substring-after($desc_info, '&lt;VulnDiscussion&gt;')"/>
+	</xsl:template>
+
+
 	<!-- get rid of XHTML namespace since we're outputting to HTML -->
 	<xsl:template match="xhtml:*">
 		<xsl:element name="{local-name()}">
-- 
1.7.1



More information about the scap-security-guide mailing list