[PATCH 5/8] typechange

Shawn Wells shawn at redhat.com
Sat Oct 26 03:28:28 UTC 2013


-------------- next part --------------
>From a9d31f98f19a8a750ddfe0df7fb33121b96cb7dd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:21:47 -0400
Subject: [PATCH 5/8] typechange: checks/idtranslate.py

---
 RHEL6/input/checks/idtranslate.py |  139 ++++++++++++++++++++++++++++++++++++-
 1 files changed, 138 insertions(+), 1 deletions(-)
 mode change 120000 => 100755 RHEL6/input/checks/idtranslate.py

diff --git a/RHEL6/input/checks/idtranslate.py b/RHEL6/input/checks/idtranslate.py
deleted file mode 120000
index fd33b1e..0000000
--- a/RHEL6/input/checks/idtranslate.py
+++ /dev/null
@@ -1 +0,0 @@
-../../transforms/idtranslate.py
\ No newline at end of file
diff --git a/RHEL6/input/checks/idtranslate.py b/RHEL6/input/checks/idtranslate.py
new file mode 100755
index 0000000..77f078a
--- /dev/null
+++ b/RHEL6/input/checks/idtranslate.py
@@ -0,0 +1,138 @@
+import ConfigParser, sys
+import lxml.etree as ET 
+
+# This class is designed to handle the mapping of meaningful, human-readable
+# names to IDs in the formats required by the SCAP checking systems, such as
+# OVAL and OCIL.  
+
+oval_ns = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
+oval_cs = "http://oval.mitre.org/XMLSchema/oval-definitions-5"
+
+ocil_ns = "http://scap.nist.gov/schema/ocil/2.0"
+ocil_cs = "http://scap.nist.gov/schema/ocil/2"
+
+ovaltag_to_abbrev = {
+	'definition' : 'def',
+	'criteria' : 'crit',
+	'test' : 'tst',
+	'object' : 'obj',
+	'state' : 'ste',
+	'variable' : 'var',
+}
+
+ociltag_to_abbrev = {
+	'questionnaire' : 'questionnaire',
+	'action' : 'testaction',
+	'question' : 'question',
+	'artifact' : 'artifact',
+	'variable' : 'variable',
+}
+
+ovalrefattr_to_tag = {
+	"definition_ref" : "definition",
+	"test_ref" : "test",
+	"object_ref" : "object",
+	"state_ref" : "state",
+	"var_ref" : "variable",
+}
+
+ocilrefattr_to_tag = {
+	"question_ref" : "question",
+}
+
+ocilrefchild_to_tag = {
+	"test_action_ref" : "action",
+}
+
+def split_namespace(tag):
+	# returns a tuple of (namespace,name) removing any fragment id from namespace
+	if tag[:1] == "{":
+		namespace, name = tag[1:].split("}", 1)
+		return namespace.split("#")[0], name
+	else:
+		return (None,tag)
+
+def namespace_to_prefix(tag):
+	namespace, name = split_namespace(tag)
+	if namespace == ocil_ns:
+		return "ocil"
+	if namespace == oval_ns:
+		return "oval"
+	sys.exit("Error: unknown checksystem referenced in tag : %s" % tag)
+
+def tagname_to_abbrev(tag):
+	namespace, tag = split_namespace(tag)
+	if tag == "extend_definition":
+		return tag
+	# grab the last part of the tag name to determine its type
+	tag = tag.rsplit("_", 1)[-1]
+	if namespace == ocil_ns:
+		return ociltag_to_abbrev[tag]
+	if namespace == oval_ns:
+		return ovaltag_to_abbrev[tag]
+	sys.exit("Error: unknown checksystem referenced in tag : %s" % tag)
+
+class idtranslator:
+	def __init__(self, fname, content_id):
+		self.fname = fname 
+		self.content_id = content_id
+		self.config = ConfigParser.ConfigParser()
+		f = self.config.read(fname)
+		if len(f) == 0:
+			self.__setup()
+
+	def __get_next_id(self):
+		i = self.config.getint("general", "next_id")
+		n = "%d" % (i + 1)
+		self.config.set("general", "next_id", n)
+		return i
+
+	def save(self):
+		fd = open(self.fname, "wb")
+		self.config.write(fd)
+
+	def __setup(self):
+		self.config.add_section("general")
+		self.config.set("general", "next_id", "100")
+		self.config.add_section("assigned")
+
+	def assign_id(self, tagname, name):
+		i = None
+		try:
+			i = self.config.getint("assigned", name)
+		except:
+			i = self.__get_next_id()
+			self.config.set("assigned", name, str(i))
+
+		str_id = "%s:%s:%s:%d" % (namespace_to_prefix(tagname), self.content_id, tagname_to_abbrev(tagname), i)
+		return str_id
+
+	def translate(self, tree, store_defname=False):
+		for element in tree.getiterator():
+			idname = element.get("id")
+			if idname:
+				# store the old name if requested (for OVAL definitions)
+				if store_defname and element.tag == "{" + oval_ns + "}definition":
+					metadata = element.find("{" + oval_ns + "}metadata")
+					if metadata is None:
+						metadata = ET.SubElement(element, "metadata")
+					defnam = ET.SubElement(metadata, "reference", ref_id=idname, source=self.content_id) 
+				# set the element to the new identifier 
+				element.set("id", self.assign_id(element.tag, idname))
+				#continue
+			if element.tag == "{" + oval_ns + "}filter":
+				element.text = self.assign_id("{" + oval_ns + "}state", element.text)
+				continue
+			for attr in element.keys():
+				if attr in ovalrefattr_to_tag.keys():
+					element.set(attr,self.assign_id( "{" + oval_ns + "}" + ovalrefattr_to_tag[attr], element.get(attr)))
+				if attr in ocilrefattr_to_tag.keys():
+					element.set(attr, self.assign_id("{" + ocil_ns + "}" + ocilrefattr_to_tag[attr], element.get(attr)))
+			if element.tag == "{" + ocil_ns + "}test_action_ref":
+					element.text = self.assign_id("{" + ocil_ns + "}action", element.text)
+
+		self.save()
+		# note: the ini file is not tracked by git, see .gitignore
+		return tree
+
+
-- 
1.7.1



More information about the scap-security-guide mailing list