[PATCH] changed major transforms to handle CCIs as references instead of idents
Jeffrey Blank
blank at eclipse.ncsc.mil
Fri Apr 27 15:57:13 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
rhel6/src/transforms/constants.xslt | 4 +-
rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++----------
rhel6/src/transforms/table-srgmap.xslt | 22 +++++++--
3 files changed, 68 insertions(+), 33 deletions(-)
diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
index 6c0fe4a..a3b26b7 100644
--- a/rhel6/src/transforms/constants.xslt
+++ b/rhel6/src/transforms/constants.xslt
@@ -5,14 +5,12 @@
<!-- abbreviated as idents in the XCCDF-->
<xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
-<xsl:variable name="cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
<!-- abbreviated as references in the XCCDF-->
<xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf</xsl:variable>
<xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
<xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
-
-
+<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
<xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
</xsl:stylesheet>
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt
index 9127dd8..8cc2b96 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
xmlns:xhtml="http://www.w3.org/1999/xhtml"
-exclude-result-prefixes="xccdf">
+exclude-result-prefixes="xccdf xhtml">
<xsl:include href="constants.xslt"/>
@@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
</xsl:copy>
</xsl:template>
- <!-- expand reference to CCE ID -->
+ <!-- expand reference to ident types -->
<xsl:template match="Rule/ident">
<xsl:for-each select="@*">
<ident>
@@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
</xsl:otherwise>
</xsl:choose>
</xsl:when>
-
- <!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings -->
- <xsl:when test="name() = 'cci'">
- <xsl:attribute name="system">
- <xsl:value-of select="$cciuri" />
- <!-- <xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> -->
- </xsl:attribute>
- <xsl:choose>
- <xsl:when test="starts-with(translate(., 'ci', 'CI'), 'CCI')">
- <xsl:value-of select="." />
- </xsl:when>
- <xsl:otherwise>
- <xsl:value-of select="concat('CCI-', .)" />
- </xsl:otherwise>
- </xsl:choose>
- </xsl:when>
<xsl:otherwise>
<xsl:value-of select="." />
</xsl:otherwise>
@@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
</xsl:for-each>
</xsl:template>
- <!-- expand ref attributes to appropriate XCCDF reference bodies -->
+ <!-- expand ref attributes to reference tags, one item per reference -->
<xsl:template match="Rule/ref">
<xsl:for-each select="@*">
+ <xsl:call-template name="ref-info" >
+ <xsl:with-param name="refsource" select="name()" />
+ <xsl:with-param name="refitems" select="." />
+ </xsl:call-template>
+ </xsl:for-each>
+ </xsl:template>
+
+ <!-- expands individual reference source -->
+ <xsl:template name="ref-info">
+ <xsl:param name="refsource"/>
+ <xsl:param name="refitems"/>
+ <xsl:variable name="delim" select="','" />
+ <xsl:choose>
+ <xsl:when test="$delim and contains($refitems, $delim)">
+ <!-- output the reference -->
+ <xsl:call-template name="ref-output" >
+ <xsl:with-param name="refsource" select="$refsource" />
+ <xsl:with-param name="refitem" select="substring-before($refitems, $delim)" />
+ </xsl:call-template>
+ <!-- recurse for additional refs -->
+ <xsl:call-template name="ref-info">
+ <xsl:with-param name="refsource" select="$refsource" />
+ <xsl:with-param name="refitems" select="substring-after($refitems, $delim)" />
+ </xsl:call-template>
+ </xsl:when>
+
+ <xsl:otherwise>
+ <xsl:call-template name="ref-output" >
+ <xsl:with-param name="refsource" select="$refsource" />
+ <xsl:with-param name="refitem" select="$refitems" />
+ </xsl:call-template>
+ </xsl:otherwise>
+ </xsl:choose>
+ </xsl:template>
+
+ <!-- output individual reference -->
+ <xsl:template name="ref-output">
+ <xsl:param name="refsource"/>
+ <xsl:param name="refitem"/>
<reference>
<xsl:attribute name="href">
<!-- populate the href attribute with a global reference-->
- <xsl:if test="name() = 'nist'">
+ <xsl:if test="$refsource = 'nist'">
<xsl:value-of select="$nist800-53uri" />
</xsl:if>
- <xsl:if test="name() = 'cnss'">
+ <xsl:if test="$refsource = 'cnss'">
<xsl:value-of select="$cnss1253uri" />
</xsl:if>
- <xsl:if test="name() = 'dcid'">
+ <xsl:if test="$refsource = 'dcid'">
<xsl:value-of select="$dcid63uri" />
</xsl:if>
+ <xsl:if test="$refsource = 'disa'">
+ <xsl:value-of select="$disa-cciuri" />
+ </xsl:if>
</xsl:attribute>
- <!-- the actual string specified -->
- <xsl:value-of select="." />
+ <xsl:value-of select="$refitem" />
</reference>
- </xsl:for-each>
</xsl:template>
-
<!-- expand reference to OVAL ID -->
<xsl:template match="Rule/oval">
<check>
diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt
index a502d24..b7f68a7 100644
--- a/rhel6/src/transforms/table-srgmap.xslt
+++ b/rhel6/src/transforms/table-srgmap.xslt
@@ -2,7 +2,7 @@
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
<!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG),
- and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents).
+ and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as references).
The output shows how a body of XCCDF meets SRG requirements. -->
<xsl:include href="constants.xslt"/>
@@ -77,14 +77,17 @@
<td> <xsl:value-of select="$srg_id"/> </td>
<td> <xsl:value-of select="$srg_cci"/> </td>
<td> <xsl:value-of select="$srg_title"/> </td>
- <td> <xsl:value-of select="$srg_desc"/> </td>
+ <td> <xsl:call-template name="extract-vulndiscussion"><xsl:with-param name="desc" select="$srg_desc"/></xsl:call-template> </td>
<td>
<!-- iterate over the Rules in the (externally-provided) XCCDF document -->
<xsl:for-each select="$rules">
<xsl:variable name="rule" select="."/>
+ <xsl:if test="cdf:reference[@href=$disa-cciuri]" >
<table>
- <xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
- <xsl:if test="self::node()[text()=$srg_cci]" >
+ <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
+ <xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
+ <xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)" />
+ <xsl:if test="$cci_expanded=$srg_cci" >
<tr>
<td> <xsl:value-of select="$rule/cdf:title"/> </td>
<td> <xsl:apply-templates select="$rule/cdf:description"/> </td>
@@ -92,11 +95,22 @@
</xsl:if>
</xsl:for-each>
</table>
+ </xsl:if>
</xsl:for-each>
</td>
</tr>
</xsl:template>
+
+ <!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags -->
+ <!-- this should be removed as soon as SRGs include only a description instead of odd tags -->
+ <xsl:template name="extract-vulndiscussion">
+ <xsl:param name="desc"/>
+ <xsl:variable name="desc_info" select="substring-before($desc, '</VulnDiscussion>')"/>
+ <xsl:value-of select="substring-after($desc_info, '<VulnDiscussion>')"/>
+ </xsl:template>
+
+
<!-- get rid of XHTML namespace since we're outputting to HTML -->
<xsl:template match="xhtml:*">
<xsl:element name="{local-name()}">
--
1.7.1
More information about the scap-security-guide
mailing list