[PATCH 5/8] typechange
Shawn Wells
shawn at redhat.com
Sat Oct 26 03:28:28 UTC 2013
-------------- next part --------------
>From a9d31f98f19a8a750ddfe0df7fb33121b96cb7dd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:21:47 -0400
Subject: [PATCH 5/8] typechange: checks/idtranslate.py
---
RHEL6/input/checks/idtranslate.py | 139 ++++++++++++++++++++++++++++++++++++-
1 files changed, 138 insertions(+), 1 deletions(-)
mode change 120000 => 100755 RHEL6/input/checks/idtranslate.py
diff --git a/RHEL6/input/checks/idtranslate.py b/RHEL6/input/checks/idtranslate.py
deleted file mode 120000
index fd33b1e..0000000
--- a/RHEL6/input/checks/idtranslate.py
+++ /dev/null
@@ -1 +0,0 @@
-../../transforms/idtranslate.py
\ No newline at end of file
diff --git a/RHEL6/input/checks/idtranslate.py b/RHEL6/input/checks/idtranslate.py
new file mode 100755
index 0000000..77f078a
--- /dev/null
+++ b/RHEL6/input/checks/idtranslate.py
@@ -0,0 +1,138 @@
+import ConfigParser, sys
+import lxml.etree as ET
+
+# This class is designed to handle the mapping of meaningful, human-readable
+# names to IDs in the formats required by the SCAP checking systems, such as
+# OVAL and OCIL.
+
+oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
+oval_cs = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
+
+ocil_ns = "http://scap.nist.gov/schema/ocil/2.0"
+ocil_cs = "http://scap.nist.gov/schema/ocil/2"
+
+ovaltag_to_abbrev = {
+ 'definition' : 'def',
+ 'criteria' : 'crit',
+ 'test' : 'tst',
+ 'object' : 'obj',
+ 'state' : 'ste',
+ 'variable' : 'var',
+}
+
+ociltag_to_abbrev = {
+ 'questionnaire' : 'questionnaire',
+ 'action' : 'testaction',
+ 'question' : 'question',
+ 'artifact' : 'artifact',
+ 'variable' : 'variable',
+}
+
+ovalrefattr_to_tag = {
+ "definition_ref" : "definition",
+ "test_ref" : "test",
+ "object_ref" : "object",
+ "state_ref" : "state",
+ "var_ref" : "variable",
+}
+
+ocilrefattr_to_tag = {
+ "question_ref" : "question",
+}
+
+ocilrefchild_to_tag = {
+ "test_action_ref" : "action",
+}
+
+def split_namespace(tag):
+ # returns a tuple of (namespace,name) removing any fragment id from namespace
+ if tag[:1] == "{":
+ namespace, name = tag[1:].split("}", 1)
+ return namespace.split("#")[0], name
+ else:
+ return (None,tag)
+
+def namespace_to_prefix(tag):
+ namespace, name = split_namespace(tag)
+ if namespace == ocil_ns:
+ return "ocil"
+ if namespace == oval_ns:
+ return "oval"
+ sys.exit("Error: unknown checksystem referenced in tag : %s" % tag)
+
+def tagname_to_abbrev(tag):
+ namespace, tag = split_namespace(tag)
+ if tag == "extend_definition":
+ return tag
+ # grab the last part of the tag name to determine its type
+ tag = tag.rsplit("_", 1)[-1]
+ if namespace == ocil_ns:
+ return ociltag_to_abbrev[tag]
+ if namespace == oval_ns:
+ return ovaltag_to_abbrev[tag]
+ sys.exit("Error: unknown checksystem referenced in tag : %s" % tag)
+
+class idtranslator:
+ def __init__(self, fname, content_id):
+ self.fname = fname
+ self.content_id = content_id
+ self.config = ConfigParser.ConfigParser()
+ f = self.config.read(fname)
+ if len(f) == 0:
+ self.__setup()
+
+ def __get_next_id(self):
+ i = self.config.getint("general", "next_id")
+ n = "%d" % (i + 1)
+ self.config.set("general", "next_id", n)
+ return i
+
+ def save(self):
+ fd = open(self.fname, "wb")
+ self.config.write(fd)
+
+ def __setup(self):
+ self.config.add_section("general")
+ self.config.set("general", "next_id", "100")
+ self.config.add_section("assigned")
+
+ def assign_id(self, tagname, name):
+ i = None
+ try:
+ i = self.config.getint("assigned", name)
+ except:
+ i = self.__get_next_id()
+ self.config.set("assigned", name, str(i))
+
+ str_id = "%s:%s:%s:%d" % (namespace_to_prefix(tagname), self.content_id, tagname_to_abbrev(tagname), i)
+ return str_id
+
+ def translate(self, tree, store_defname=False):
+ for element in tree.getiterator():
+ idname = element.get("id")
+ if idname:
+ # store the old name if requested (for OVAL definitions)
+ if store_defname and element.tag == "{" + oval_ns + "}definition":
+ metadata = element.find("{" + oval_ns + "}metadata")
+ if metadata is None:
+ metadata = ET.SubElement(element, "metadata")
+ defnam = ET.SubElement(metadata, "reference", ref_id=idname, source=self.content_id)
+ # set the element to the new identifier
+ element.set("id", self.assign_id(element.tag, idname))
+ #continue
+ if element.tag == "{" + oval_ns + "}filter":
+ element.text = self.assign_id("{" + oval_ns + "}state", element.text)
+ continue
+ for attr in element.keys():
+ if attr in ovalrefattr_to_tag.keys():
+ element.set(attr,self.assign_id( "{" + oval_ns + "}" + ovalrefattr_to_tag[attr], element.get(attr)))
+ if attr in ocilrefattr_to_tag.keys():
+ element.set(attr, self.assign_id("{" + ocil_ns + "}" + ocilrefattr_to_tag[attr], element.get(attr)))
+ if element.tag == "{" + ocil_ns + "}test_action_ref":
+ element.text = self.assign_id("{" + ocil_ns + "}action", element.text)
+
+ self.save()
+ # note: the ini file is not tracked by git, see .gitignore
+ return tree
+
+
--
1.7.1
More information about the scap-security-guide
mailing list