[PATCH 4/4] new script to create CPE files * the script creates a cpe-oval file from inventory definitions, links it to cpe-dictionary file
Shawn Wells
shawn at redhat.com
Sun Aug 12 18:03:37 UTC 2012
On 8/11/12 2:30 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
> RHEL6/transforms/cpe_generate.py | 109 ++++++++++++++++++++++++++++++++++++++
> 1 files changed, 109 insertions(+), 0 deletions(-)
> create mode 100755 RHEL6/transforms/cpe_generate.py
>
> diff --git a/RHEL6/transforms/cpe_generate.py b/RHEL6/transforms/cpe_generate.py
> new file mode 100755
> index 0000000..70ee115
> --- /dev/null
> +++ b/RHEL6/transforms/cpe_generate.py
> @@ -0,0 +1,109 @@
> +#!/usr/bin/python
> +
> +import sys, os, idtranslate
> +import lxml.etree as ET
> +
> +# This script requires two arguments: an OVAL file and a CPE dictionary file.
> +# It is designed to extract any inventory definitions and the tests, states,
> +# objects and variables it references and then write them into a standalone
> +# OVAL CPE file, along with a synchronized CPE dictionary file.
> +
> +oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
> +xccdf_ns = "http://checklists.nist.gov/xccdf/1.1"
> +cpe_ns = "http://cpe.mitre.org/dictionary/2.0"
> +
> +def parse_xml_file(xmlfile):
> + with open( xmlfile, 'r') as f:
> + filestring = f.read()
> + tree = ET.fromstring(filestring)
> + #print filestring
> + return tree
> +
> +
> +def extract_referred_nodes(tree_with_refs, tree_with_ids, attrname):
> + reflist = []
> + elementlist = []
> + iter = tree_with_refs.getiterator()
> + for element in iter:
> + value = element.get(attrname)
> + if value is not None:
> + reflist.append(value)
> +
> + iter = tree_with_ids.getiterator()
> + for element in iter:
> + if element.get("id") in reflist:
> + elementlist.append(element)
> + return elementlist
> +
> +
> +def collect_nodes(tree, reflist):
> + elementlist = []
> + iter = tree.getiterator()
> + for element in iter:
> + if element.get("id") in reflist:
> + elementlist.append(element)
> + return elementlist
> +
> +def main():
> + if len(sys.argv) < 2:
> + print "Provide an OVAL file that contains inventory definitions."
> + print "This script extracts these definitions and writes them to STDOUT."
> + sys.exit(1)
> +
> + ovalfile = sys.argv[1]
> + cpedictfile = sys.argv[2]
> + idname = sys.argv[3]
> +
> + # parse oval file
> + ovaltree = parse_xml_file(ovalfile)
> +
> + # extract inventory definitions
> + # making (dubious) assumption that all inventory defs are CPE
> + defs = ovaltree.find("./{%s}definitions" % oval_ns)
> + inventory_defs = defs.findall(".//{%s}definition[@class='inventory']" % oval_ns)
> + defs.clear()
> + [defs.append(inventory_def) for inventory_def in inventory_defs]
> +
> + tests = ovaltree.find("./{%s}tests" % oval_ns)
> + cpe_tests = extract_referred_nodes(defs, tests, "test_ref")
> + tests.clear()
> + [tests.append(cpe_test) for cpe_test in cpe_tests]
> +
> + states = ovaltree.find("./{%s}states" % oval_ns)
> + cpe_states = extract_referred_nodes(tests, states, "state_ref")
> + states.clear()
> + [states.append(cpe_state) for cpe_state in cpe_states]
> +
> + objects = ovaltree.find("./{%s}objects" % oval_ns)
> + cpe_objects = extract_referred_nodes(tests, objects, "object_ref")
> + objects.clear()
> + [objects.append(cpe_object) for cpe_object in cpe_objects]
> +
> + variables = ovaltree.find("./{%s}variables" % oval_ns)
> + cpe_variables = extract_referred_nodes(ovaltree, variables, "var_ref")
> + if cpe_variables:
> + variables.clear()
> + [variables.append(cpe_variable) for cpe_variable in cpe_variables]
> + else:
> + ovaltree.remove(variables)
> +
> + # turn IDs into meaningless numbers
> + translator = idtranslate.idtranslator("./output/"+idname+".ini", "oval:"+idname)
> + ovaltree = translator.translate(ovaltree)
> +
> + newovalfile = ovalfile.replace("oval", "cpe-oval-"+idname)
> + ET.ElementTree(ovaltree).write(newovalfile)
> +
> + # replace and sync IDs, href filenames in input cpe dictionary file
> + cpedicttree = parse_xml_file(cpedictfile)
> + newcpedictfile = os.path.basename(cpedictfile).replace(".xml","-"+idname+".xml")
> + for check in cpedicttree.findall(".//{%s}check" % cpe_ns):
> + check.set("href",os.path.basename(newovalfile))
> + check.text = translator.assign_id("definition", check.text)
> + ET.ElementTree(cpedicttree).write("./output/"+newcpedictfile)
> +
> + sys.exit(0)
> +
> +if __name__ == "__main__":
> + main()
> +
$ git apply /tmp/jeffoval4.patch
/tmp/jeffoval4.patch:27: trailing whitespace.
xccdf_ns = "http://checklists.nist.gov/xccdf/1.1"
/tmp/jeffoval4.patch:33: trailing whitespace.
tree = ET.fromstring(filestring)
/tmp/jeffoval4.patch:45: trailing whitespace.
reflist.append(value)
/tmp/jeffoval4.patch:73: trailing whitespace.
ovaltree = parse_xml_file(ovalfile)
/tmp/jeffoval4.patch:108: trailing whitespace.
warning: squelched 2 whitespace errors
warning: 7 lines add whitespace errors.
Cleaned up whitespace stuff, then pushed
More information about the scap-security-guide
mailing list