[PATCH] changed major transforms to handle CCIs as references instead of idents

Willy Santos wsantos at redhat.com
Fri Apr 27 18:04:35 UTC 2012


ACK

Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos at redhat.com


On 04/27/2012 11:57 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
>   rhel6/src/transforms/constants.xslt       |    4 +-
>   rhel6/src/transforms/shorthand2xccdf.xslt |   75 +++++++++++++++++++----------
>   rhel6/src/transforms/table-srgmap.xslt    |   22 +++++++--
>   3 files changed, 68 insertions(+), 33 deletions(-)
>
> diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
> index 6c0fe4a..a3b26b7 100644
> --- a/rhel6/src/transforms/constants.xslt
> +++ b/rhel6/src/transforms/constants.xslt
> @@ -5,14 +5,12 @@
>
>   <!-- abbreviated as idents in the XCCDF-->
>   <xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
> -<xsl:variable name="cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
>
>   <!-- abbreviated as references in the XCCDF-->
>   <xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf</xsl:variable>
>   <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
>   <xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
> -
> -
> +<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
>
>   <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
>   </xsl:stylesheet>
> diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt
> index 9127dd8..8cc2b96 100644
> --- a/rhel6/src/transforms/shorthand2xccdf.xslt
> +++ b/rhel6/src/transforms/shorthand2xccdf.xslt
> @@ -2,7 +2,7 @@
>   <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
>   xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
>   xmlns:xhtml="http://www.w3.org/1999/xhtml"
> -exclude-result-prefixes="xccdf">
> +exclude-result-prefixes="xccdf xhtml">
>
>   <xsl:include href="constants.xslt"/>
>
> @@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
>       </xsl:copy>
>     </xsl:template>
>
> -<!-- expand reference to CCE ID -->
> +<!-- expand reference to ident types -->
>     <xsl:template match="Rule/ident">
>       <xsl:for-each select="@*">
>         <ident>
> @@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
>                 </xsl:otherwise>
>               </xsl:choose>
>             </xsl:when>
> -
> -<!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings -->
> -<xsl:when test="name() = 'cci'">
> -<xsl:attribute name="system">
> -<xsl:value-of select="$cciuri" />
> -<!--<xsl:text>http://iase.disa.mil/cci/index.html</xsl:text>  -->
> -</xsl:attribute>
> -<xsl:choose>
> -<xsl:when test="starts-with(translate(., 'ci', 'CI'), 'CCI')">
> -<xsl:value-of select="." />
> -</xsl:when>
> -<xsl:otherwise>
> -<xsl:value-of select="concat('CCI-', .)" />
> -</xsl:otherwise>
> -</xsl:choose>
> -</xsl:when>
>             <xsl:otherwise>
>               <xsl:value-of select="." />
>             </xsl:otherwise>
> @@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
>       </xsl:for-each>
>     </xsl:template>
>
> -<!-- expand ref attributes to appropriate XCCDF reference bodies -->
> +<!-- expand ref attributes to reference tags, one item per reference -->
>     <xsl:template match="Rule/ref">
>       <xsl:for-each select="@*">
> +<xsl:call-template name="ref-info">
> +<xsl:with-param name="refsource" select="name()" />
> +<xsl:with-param name="refitems" select="." />
> +</xsl:call-template>
> +</xsl:for-each>
> +</xsl:template>
> +
> +<!-- expands individual reference source -->
> +<xsl:template name="ref-info">
> +<xsl:param name="refsource"/>
> +<xsl:param name="refitems"/>
> +<xsl:variable name="delim" select="','" />
> +<xsl:choose>
> +<xsl:when test="$delim and contains($refitems, $delim)">
> +<!-- output the reference -->
> +<xsl:call-template name="ref-output">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitem" select="substring-before($refitems, $delim)" />
> +</xsl:call-template>
> +<!-- recurse for additional refs -->
> +<xsl:call-template name="ref-info">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitems" select="substring-after($refitems, $delim)" />
> +</xsl:call-template>
> +</xsl:when>
> +
> +<xsl:otherwise>
> +<xsl:call-template name="ref-output">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitem" select="$refitems" />
> +</xsl:call-template>
> +</xsl:otherwise>
> +</xsl:choose>
> +</xsl:template>
> +
> +<!-- output individual reference -->
> +<xsl:template name="ref-output">
> +<xsl:param name="refsource"/>
> +<xsl:param name="refitem"/>
>         <reference>
>           <xsl:attribute name="href">
>           <!-- populate the href attribute with a global reference-->
> -<xsl:if test="name() = 'nist'">
> +<xsl:if test="$refsource = 'nist'">
>               <xsl:value-of select="$nist800-53uri" />
>             </xsl:if>
> -<xsl:if test="name() = 'cnss'">
> +<xsl:if test="$refsource = 'cnss'">
>               <xsl:value-of select="$cnss1253uri" />
>             </xsl:if>
> -<xsl:if test="name() = 'dcid'">
> +<xsl:if test="$refsource = 'dcid'">
>               <xsl:value-of select="$dcid63uri" />
>             </xsl:if>
> +<xsl:if test="$refsource = 'disa'">
> +<xsl:value-of select="$disa-cciuri" />
> +</xsl:if>
>           </xsl:attribute>
> -<!-- the actual string specified -->
> -<xsl:value-of select="." />
> +<xsl:value-of select="$refitem" />
>         </reference>
> -</xsl:for-each>
>     </xsl:template>
>
> -
>     <!-- expand reference to OVAL ID -->
>     <xsl:template match="Rule/oval">
>       <check>
> diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt
> index a502d24..b7f68a7 100644
> --- a/rhel6/src/transforms/table-srgmap.xslt
> +++ b/rhel6/src/transforms/table-srgmap.xslt
> @@ -2,7 +2,7 @@
>   <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
>
>   <!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG),
> -     and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents).
> +     and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as references).
>        The output shows how a body of XCCDF meets SRG requirements. -->
>
>   <xsl:include href="constants.xslt"/>
> @@ -77,14 +77,17 @@
>   		<td>  <xsl:value-of select="$srg_id"/>  </td>
>   		<td>  <xsl:value-of select="$srg_cci"/>  </td>
>   		<td>  <xsl:value-of select="$srg_title"/>  </td>
> -		<td>  <xsl:value-of select="$srg_desc"/>  </td>
> +		<td>  <xsl:call-template name="extract-vulndiscussion"><xsl:with-param name="desc" select="$srg_desc"/></xsl:call-template>  </td>
>   		<td>
>         		<!-- iterate over the Rules in the (externally-provided) XCCDF document -->
>   			<xsl:for-each select="$rules">
>   				<xsl:variable name="rule" select="."/>
> +				<xsl:if test="cdf:reference[@href=$disa-cciuri]">
>   				<table>
> -				<xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
> -			  		<xsl:if test="self::node()[text()=$srg_cci]">
> +				<xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
> +				<xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
> +				<xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)"  />
> +			  		<xsl:if test="$cci_expanded=$srg_cci">
>   						<tr>
>   						<td>  <xsl:value-of select="$rule/cdf:title"/>  </td>
>   						<td>  <xsl:apply-templates select="$rule/cdf:description"/>  </td>
> @@ -92,11 +95,22 @@
>   			  		</xsl:if>
>   				</xsl:for-each>
>   				</table>
> +				</xsl:if>
>   			</xsl:for-each>
>   			</td>
>   		</tr>
>   	</xsl:template>
>
> +
> +	<!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags -->
> +	<!-- this should be removed as soon as SRGs include only a description instead of odd tags -->
> +	<xsl:template name="extract-vulndiscussion">
> +		<xsl:param name="desc"/>
> +		<xsl:variable name="desc_info" select="substring-before($desc, '&lt;/VulnDiscussion&gt;')"/>
> +		<xsl:value-of select="substring-after($desc_info, '&lt;VulnDiscussion&gt;')"/>
> +	</xsl:template>
> +
> +
>   	<!-- get rid of XHTML namespace since we're outputting to HTML -->
>   	<xsl:template match="xhtml:*">
>   		<xsl:element name="{local-name()}">


More information about the scap-security-guide mailing list