ACK
Willy Santos, RHCE Consultant Red Hat Consulting Cell: +1 (301) 254-7077 Email: wsantos@redhat.com
On 04/27/2012 11:57 AM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blankblank@eclipse.ncsc.mil
rhel6/src/transforms/constants.xslt | 4 +- rhel6/src/transforms/shorthand2xccdf.xslt | 75 +++++++++++++++++++---------- rhel6/src/transforms/table-srgmap.xslt | 22 +++++++-- 3 files changed, 68 insertions(+), 33 deletions(-)
diff --git a/rhel6/src/transforms/constants.xslt b/rhel6/src/transforms/constants.xslt index 6c0fe4a..a3b26b7 100644 --- a/rhel6/src/transforms/constants.xslt +++ b/rhel6/src/transforms/constants.xslt @@ -5,14 +5,12 @@
<!-- abbreviated as idents in the XCCDF-->
<xsl:variable name="cceuri">http://cce.mitre.org</xsl:variable> -<xsl:variable name="cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
<!-- abbreviated as references in the XCCDF-->
<xsl:variable name="nist800-53uri">http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.p...</xsl:variable> <xsl:variable name="cnss1253uri">http://www.cnss.gov/Assets/pdf/CNSSI-1253.pdf</xsl:variable> <xsl:variable name="dcid63uri">not_officially_available</xsl:variable>
+<xsl:variable name="disa-cciuri">http://iase.disa.mil/cci/index.html</xsl:variable>
<xsl:variable name="ovaluri">http://oval.mitre.org/XMLSchema/oval-definitions-5</xsl:variable> </xsl:stylesheet> diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt index 9127dd8..8cc2b96 100644 --- a/rhel6/src/transforms/shorthand2xccdf.xslt +++ b/rhel6/src/transforms/shorthand2xccdf.xslt @@ -2,7 +2,7 @@ <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" -exclude-result-prefixes="xccdf"> +exclude-result-prefixes="xccdf xhtml">
<xsl:include href="constants.xslt"/>
@@ -39,7 +39,7 @@ exclude-result-prefixes="xccdf"> </xsl:copy> </xsl:template>
-<!-- expand reference to CCE ID --> +<!-- expand reference to ident types --> <xsl:template match="Rule/ident"> <xsl:for-each select="@*"> <ident> @@ -57,22 +57,6 @@ exclude-result-prefixes="xccdf"> </xsl:otherwise> </xsl:choose> </xsl:when>
-<!-- NOTE: use DISA's OS SRG to see these tied to more-concrete OS settings --> -<xsl:when test="name() = 'cci'"> -<xsl:attribute name="system"> -<xsl:value-of select="$cciuri" /> -<!--<xsl:text>http://iase.disa.mil/cci/index.html</xsl:text> --> -</xsl:attribute> -xsl:choose -<xsl:when test="starts-with(translate(., 'ci', 'CI'), 'CCI')"> -<xsl:value-of select="." /> -</xsl:when> -xsl:otherwise -<xsl:value-of select="concat('CCI-', .)" /> -</xsl:otherwise> -</xsl:choose> -</xsl:when> xsl:otherwise <xsl:value-of select="." /> </xsl:otherwise> @@ -81,29 +65,68 @@ exclude-result-prefixes="xccdf"> </xsl:for-each> </xsl:template>
-<!-- expand ref attributes to appropriate XCCDF reference bodies --> +<!-- expand ref attributes to reference tags, one item per reference --> <xsl:template match="Rule/ref"> <xsl:for-each select="@*"> +<xsl:call-template name="ref-info"> +<xsl:with-param name="refsource" select="name()" /> +<xsl:with-param name="refitems" select="." /> +</xsl:call-template> +</xsl:for-each> +</xsl:template>
+<!-- expands individual reference source --> +<xsl:template name="ref-info"> +<xsl:param name="refsource"/> +<xsl:param name="refitems"/> +<xsl:variable name="delim" select="','" /> +xsl:choose +<xsl:when test="$delim and contains($refitems, $delim)"> +<!-- output the reference --> +<xsl:call-template name="ref-output"> +<xsl:with-param name="refsource" select="$refsource" /> +<xsl:with-param name="refitem" select="substring-before($refitems, $delim)" /> +</xsl:call-template> +<!-- recurse for additional refs --> +<xsl:call-template name="ref-info"> +<xsl:with-param name="refsource" select="$refsource" /> +<xsl:with-param name="refitems" select="substring-after($refitems, $delim)" /> +</xsl:call-template> +</xsl:when>
+xsl:otherwise +<xsl:call-template name="ref-output"> +<xsl:with-param name="refsource" select="$refsource" /> +<xsl:with-param name="refitem" select="$refitems" /> +</xsl:call-template> +</xsl:otherwise> +</xsl:choose> +</xsl:template>
+<!-- output individual reference --> +<xsl:template name="ref-output"> +<xsl:param name="refsource"/> +<xsl:param name="refitem"/> <reference> <xsl:attribute name="href"> <!-- populate the href attribute with a global reference--> -<xsl:if test="name() = 'nist'"> +<xsl:if test="$refsource = 'nist'"> <xsl:value-of select="$nist800-53uri" /> </xsl:if> -<xsl:if test="name() = 'cnss'"> +<xsl:if test="$refsource = 'cnss'"> <xsl:value-of select="$cnss1253uri" /> </xsl:if> -<xsl:if test="name() = 'dcid'"> +<xsl:if test="$refsource = 'dcid'"> <xsl:value-of select="$dcid63uri" /> </xsl:if> +<xsl:if test="$refsource = 'disa'"> +<xsl:value-of select="$disa-cciuri" /> +</xsl:if> </xsl:attribute> -<!-- the actual string specified --> -<xsl:value-of select="." /> +<xsl:value-of select="$refitem" /> </reference> -</xsl:for-each> </xsl:template>
<!-- expand reference to OVAL ID -->
<xsl:template match="Rule/oval"> <check>diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt index a502d24..b7f68a7 100644 --- a/rhel6/src/transforms/table-srgmap.xslt +++ b/rhel6/src/transforms/table-srgmap.xslt @@ -2,7 +2,7 @@ <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml%22%3E
<!-- this style sheet is designed to take as input the OS SRG and a body of XCCDF content (e.g. draft STIG), - and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as idents). + and to map the requirements from the SRG to Rules in the XCCDF (which include CCIs as references). The output shows how a body of XCCDF meets SRG requirements. -->
<xsl:include href="constants.xslt"/> @@ -77,14 +77,17 @@ <td> <xsl:value-of select="$srg_id"/> </td> <td> <xsl:value-of select="$srg_cci"/> </td> <td> <xsl:value-of select="$srg_title"/> </td>
<td> <xsl:value-of select="$srg_desc"/> </td>
<td> <xsl:call-template name="extract-vulndiscussion"><xsl:with-param name="desc" select="$srg_desc"/></xsl:call-template> </td><td> <!-- iterate over the Rules in the (externally-provided) XCCDF document --> <xsl:for-each select="$rules"> <xsl:variable name="rule" select="."/>
<xsl:if test="cdf:reference[@href=$disa-cciuri]"> <table>
<xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']"><xsl:if test="self::node()[text()=$srg_cci]">
<xsl:for-each select="cdf:reference[@href=$disa-cciuri]"><xsl:variable name="cci_formatted" select='format-number(self::node()[text()], "000000")' /><xsl:variable name="cci_expanded" select="concat('CCI-', $cci_formatted)" /><xsl:if test="$cci_expanded=$srg_cci"> <tr> <td> <xsl:value-of select="$rule/cdf:title"/> </td> <td> <xsl:apply-templates select="$rule/cdf:description"/> </td>@@ -92,11 +95,22 @@ </xsl:if> </xsl:for-each> </table>
</xsl:if> </xsl:for-each> </td></tr> </xsl:template>
<!-- return only the text between the "VulnDiscussion" (non-XCCDF) tags -->
<!-- this should be removed as soon as SRGs include only a description instead of odd tags -->
<xsl:template name="extract-vulndiscussion">
<xsl:param name="desc"/><xsl:variable name="desc_info" select="substring-before($desc, '</VulnDiscussion>')"/><xsl:value-of select="substring-after($desc_info, '<VulnDiscussion>')"/></xsl:template>
<!-- get rid of XHTML namespace since we're outputting to HTML -->
<xsl:template match="xhtml:*"> <xsl:element name="{local-name()}">