[PATCH] changed major transforms to handle CCIs as references instead of idents
Willy Santos
wsantos at redhat.com
Fri Apr 27 18:04:35 UTC 2012
ACK
Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos at redhat.com
On 04/27/2012 11:57 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank<blank at eclipse.ncsc.mil>
> ---
> rhel6/src/transforms/constants.xslt | 4 +-
> rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++----------
> rhel6/src/transforms/table-srgmap.xslt | 22 +++++++--
> 3 files changed, 68 insertions(+), 33 deletions(-)
>
> diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt
> index 6c0fe4a..a3b26b7 100644
> --- a/rhel6/src/transforms/constants.xslt
> +++ b/rhel6/src/transforms/constants.xslt
> @@ -5,14 +5,12 @@
>
> <!-- abbreviated as idents in the XCCDF-->
> <xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable>
> -<xsl:variable name="cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
>
> <!-- abbreviated as references in the XCCDF-->
> <xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf</xsl:variable>
> <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable>
> <xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
> -
> -
> +<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
>
> <xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable>
> </xsl:stylesheet>
> diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt
> index 9127dd8..8cc2b96 100644
> --- a/rhel6/src/transforms/shorthand2xccdf.xslt
> +++ b/rhel6/src/transforms/shorthand2xccdf.xslt
> @@ -2,7 +2,7 @@
> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
> xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1"
> xmlns:xhtml="http://www.w3.org/1999/xhtml"
> -exclude-result-prefixes="xccdf">
> +exclude-result-prefixes="xccdf xhtml">
>
> <xsl:include href="constants.xslt"/>
>
> @@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf">
> </xsl:copy>
> </xsl:template>
>
> -<!-- expand reference to CCE ID -->
> +<!-- expand reference to ident types -->
> <xsl:template match="Rule/ident">
> <xsl:for-each select="@*">
> <ident>
> @@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf">
> </xsl:otherwise>
> </xsl:choose>
> </xsl:when>
> -
> -<!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings -->
> -<xsl:when test="name() = 'cci'">
> -<xsl:attribute name="system">
> -<xsl:value-of select="$cciuri" />
> -<!--<xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> -->
> -</xsl:attribute>
> -<xsl:choose>
> -<xsl:when test="starts-with(translate(., 'ci', 'CI'), 'CCI')">
> -<xsl:value-of select="." />
> -</xsl:when>
> -<xsl:otherwise>
> -<xsl:value-of select="concat('CCI-', .)" />
> -</xsl:otherwise>
> -</xsl:choose>
> -</xsl:when>
> <xsl:otherwise>
> <xsl:value-of select="." />
> </xsl:otherwise>
> @@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf">
> </xsl:for-each>
> </xsl:template>
>
> -<!-- expand ref attributes to appropriate XCCDF reference bodies -->
> +<!-- expand ref attributes to reference tags, one item per reference -->
> <xsl:template match="Rule/ref">
> <xsl:for-each select="@*">
> +<xsl:call-template name="ref-info">
> +<xsl:with-param name="refsource" select="name()" />
> +<xsl:with-param name="refitems" select="." />
> +</xsl:call-template>
> +</xsl:for-each>
> +</xsl:template>
> +
> +<!-- expands individual reference source -->
> +<xsl:template name="ref-info">
> +<xsl:param name="refsource"/>
> +<xsl:param name="refitems"/>
> +<xsl:variable name="delim" select="','" />
> +<xsl:choose>
> +<xsl:when test="$delim and contains($refitems, $delim)">
> +<!-- output the reference -->
> +<xsl:call-template name="ref-output">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitem" select="substring-before($refitems, $delim)" />
> +</xsl:call-template>
> +<!-- recurse for additional refs -->
> +<xsl:call-template name="ref-info">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitems" select="substring-after($refitems, $delim)" />
> +</xsl:call-template>
> +</xsl:when>
> +
> +<xsl:otherwise>
> +<xsl:call-template name="ref-output">
> +<xsl:with-param name="refsource" select="$refsource" />
> +<xsl:with-param name="refitem" select="$refitems" />
> +</xsl:call-template>
> +</xsl:otherwise>
> +</xsl:choose>
> +</xsl:template>
> +
> +<!-- output individual reference -->
> +<xsl:template name="ref-output">
> +<xsl:param name="refsource"/>
> +<xsl:param name="refitem"/>
> <reference>
> <xsl:attribute name="href">
> <!-- populate the href attribute with a global reference-->
> -<xsl:if test="name() = 'nist'">
> +<xsl:if test="$refsource = 'nist'">
> <xsl:value-of select="$nist800-53uri" />
> </xsl:if>
> -<xsl:if test="name() = 'cnss'">
> +<xsl:if test="$refsource = 'cnss'">
> <xsl:value-of select="$cnss1253uri" />
> </xsl:if>
> -<xsl:if test="name() = 'dcid'">
> +<xsl:if test="$refsource = 'dcid'">
> <xsl:value-of select="$dcid63uri" />
> </xsl:if>
> +<xsl:if test="$refsource = 'disa'">
> +<xsl:value-of select="$disa-cciuri" />
> +</xsl:if>
> </xsl:attribute>
> -<!-- the actual string specified -->
> -<xsl:value-of select="." />
> +<xsl:value-of select="$refitem" />
> </reference>
> -</xsl:for-each>
> </xsl:template>
>
> -
> <!-- expand reference to OVAL ID -->
> <xsl:template match="Rule/oval">
> <check>
> diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt
> index a502d24..b7f68a7 100644
> --- a/rhel6/src/transforms/table-srgmap.xslt
> +++ b/rhel6/src/transforms/table-srgmap.xslt
> @@ -2,7 +2,7 @@
> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
>
> <!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG),
> - and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents).
> + and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as references).
> The output shows how a body of XCCDF meets SRG requirements. -->
>
> <xsl:include href="constants.xslt"/>
> @@ -77,14 +77,17 @@
> <td> <xsl:value-of select="$srg_id"/> </td>
> <td> <xsl:value-of select="$srg_cci"/> </td>
> <td> <xsl:value-of select="$srg_title"/> </td>
> - <td> <xsl:value-of select="$srg_desc"/> </td>
> + <td> <xsl:call-template name="extract-vulndiscussion"><xsl:with-param name="desc" select="$srg_desc"/></xsl:call-template> </td>
> <td>
> <!-- iterate over the Rules in the (externally-provided) XCCDF document -->
> <xsl:for-each select="$rules">
> <xsl:variable name="rule" select="."/>
> + <xsl:if test="cdf:reference[@href=$disa-cciuri]">
> <table>
> - <xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']">
> - <xsl:if test="self::node()[text()=$srg_cci]">
> + <xsl:for-each select="cdf:reference[@href=$disa-cciuri]">
> + <xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' />
> + <xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)" />
> + <xsl:if test="$cci_expanded=$srg_cci">
> <tr>
> <td> <xsl:value-of select="$rule/cdf:title"/> </td>
> <td> <xsl:apply-templates select="$rule/cdf:description"/> </td>
> @@ -92,11 +95,22 @@
> </xsl:if>
> </xsl:for-each>
> </table>
> + </xsl:if>
> </xsl:for-each>
> </td>
> </tr>
> </xsl:template>
>
> +
> + <!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags -->
> + <!-- this should be removed as soon as SRGs include only a description instead of odd tags -->
> + <xsl:template name="extract-vulndiscussion">
> + <xsl:param name="desc"/>
> + <xsl:variable name="desc_info" select="substring-before($desc, '</VulnDiscussion>')"/>
> + <xsl:value-of select="substring-after($desc_info, '<VulnDiscussion>')"/>
> + </xsl:template>
> +
> +
> <!-- get rid of XHTML namespace since we're outputting to HTML -->
> <xsl:template match="xhtml:*">
> <xsl:element name="{local-name()}">
More information about the scap-security-guide
mailing list