|
 |
0950b5 |
From 4bfc0f1d9cfe21ec672fc806f5421272f1c0b41f Mon Sep 17 00:00:00 2001
|
|
|
0950b5 |
From: Wesley Ceraso Prudencio <wcerasop@redhat.com>
|
|
|
0950b5 |
Date: Wed, 1 Nov 2017 14:17:24 +0100
|
|
|
0950b5 |
Subject: [PATCH] Enables the STIG Rule ID to be output
|
|
|
0950b5 |
|
|
|
0950b5 |
Signed-off-by: Wesley Ceraso Prudencio <wcerasop@redhat.com>
|
|
|
0950b5 |
---
|
|
|
0950b5 |
cmake/SSGCommon.cmake | 5 ++++
|
|
|
0950b5 |
shared/utils/add_stig_references.py | 57 +++++++++++++++++++++++++++++++++++++
|
|
|
0950b5 |
2 files changed, 62 insertions(+)
|
|
|
0950b5 |
create mode 100755 shared/utils/add_stig_references.py
|
|
|
0950b5 |
|
|
|
0950b5 |
diff --git a/cmake/SSGCommon.cmake b/cmake/SSGCommon.cmake
|
|
|
0950b5 |
index 8ac826ef6..786e07532 100644
|
|
|
0950b5 |
--- a/cmake/SSGCommon.cmake
|
|
|
0950b5 |
+++ b/cmake/SSGCommon.cmake
|
|
|
0950b5 |
@@ -130,10 +130,15 @@ macro(ssg_build_shorthand_xml PRODUCT)
|
|
|
0950b5 |
endmacro()
|
|
|
0950b5 |
|
|
|
0950b5 |
macro(ssg_build_xccdf_unlinked PRODUCT)
|
|
|
0950b5 |
+ file(GLOB STIG_REFERENCE_FILE_LIST "${SSG_SHARED_REFS}/disa-stig-${PRODUCT}-*-xccdf-manual.xml")
|
|
|
0950b5 |
+ list(APPEND STIG_REFERENCE_FILE_LIST "not-found")
|
|
|
0950b5 |
+ list(GET STIG_REFERENCE_FILE_LIST 0 STIG_REFERENCE_FILE)
|
|
|
0950b5 |
+
|
|
|
0950b5 |
add_custom_command(
|
|
|
0950b5 |
OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/xccdf-unlinked-resolved.xml"
|
|
|
0950b5 |
COMMAND "${XSLTPROC_EXECUTABLE}" --stringparam ssg_version "${SSG_VERSION}" --output "${CMAKE_CURRENT_BINARY_DIR}/xccdf-unlinked-resolved.xml" "${CMAKE_CURRENT_SOURCE_DIR}/transforms/shorthand2xccdf.xslt" "${CMAKE_CURRENT_BINARY_DIR}/shorthand.xml"
|
|
|
0950b5 |
COMMAND "${OPENSCAP_OSCAP_EXECUTABLE}" xccdf resolve -o "${CMAKE_CURRENT_BINARY_DIR}/xccdf-unlinked-resolved.xml" "${CMAKE_CURRENT_BINARY_DIR}/xccdf-unlinked-resolved.xml"
|
|
|
0950b5 |
+ COMMAND "${SSG_SHARED_UTILS}/add_stig_references.py" --disa-stig "${STIG_REFERENCE_FILE}" --unlinked-xccdf "${CMAKE_CURRENT_BINARY_DIR}/xccdf-unlinked-resolved.xml"
|
|
|
0950b5 |
DEPENDS generate-internal-${PRODUCT}-shorthand.xml
|
|
|
0950b5 |
DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/shorthand.xml"
|
|
|
0950b5 |
DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/transforms/shorthand2xccdf.xslt"
|
|
|
0950b5 |
diff --git a/shared/utils/add_stig_references.py b/shared/utils/add_stig_references.py
|
|
|
0950b5 |
new file mode 100755
|
|
|
0950b5 |
index 000000000..0ab208793
|
|
|
0950b5 |
--- /dev/null
|
|
|
0950b5 |
+++ b/shared/utils/add_stig_references.py
|
|
|
0950b5 |
@@ -0,0 +1,57 @@
|
|
|
0950b5 |
+#!/usr/bin/env python2
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+try:
|
|
|
0950b5 |
+ from xml.etree import cElementTree as etree
|
|
|
0950b5 |
+except ImportError:
|
|
|
0950b5 |
+ import cElementTree as etree
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+import re
|
|
|
0950b5 |
+import sys
|
|
|
0950b5 |
+import argparse
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+parser = argparse.ArgumentParser(
|
|
|
0950b5 |
+ description='Add STIG references to XCCDF files.')
|
|
|
0950b5 |
+parser.add_argument(
|
|
|
0950b5 |
+ "--disa-stig", help="DISA STIG Reference XCCDF file",dest="reference")
|
|
|
0950b5 |
+parser.add_argument(
|
|
|
0950b5 |
+ "--unlinked-xccdf", help="unlinked SSG XCCDF file", dest="destination")
|
|
|
0950b5 |
+args = parser.parse_args()
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+reference = args.reference
|
|
|
0950b5 |
+destination = args.destination
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+xccdf_namespace = "http://checklists.nist.gov/xccdf/1.1"
|
|
|
0950b5 |
+stig_href = 'http://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx'
|
|
|
0950b5 |
+stig_references_beginning = 'http://iase.disa.mil/stigs/'
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+try:
|
|
|
0950b5 |
+ reference_root = etree.parse(reference)
|
|
|
0950b5 |
+except IOError as exception:
|
|
|
0950b5 |
+ print 'INFO: DISA STIG Reference file not found for this platform'
|
|
|
0950b5 |
+ sys.exit(0)
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+reference_rules = reference_root.findall('.//{%s}Rule' % xccdf_namespace)
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+dictionary = {}
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+for rule in reference_rules:
|
|
|
0950b5 |
+ version = rule.find('.//{%s}version' % xccdf_namespace)
|
|
|
0950b5 |
+ if version is not None and version.text:
|
|
|
0950b5 |
+ dictionary[version.text] = rule.get('id')
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+target_root = etree.parse(destination)
|
|
|
0950b5 |
+target_rules = target_root.findall('.//{%s}Rule' % xccdf_namespace)
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+for rule in target_rules:
|
|
|
0950b5 |
+ refs = rule.findall('.//{%s}reference' % xccdf_namespace)
|
|
|
0950b5 |
+ for ref in refs:
|
|
|
0950b5 |
+ if (ref.get('href').startswith(stig_references_beginning) and
|
|
|
0950b5 |
+ ref.text in dictionary):
|
|
|
0950b5 |
+ index = rule.getchildren().index(ref)
|
|
|
0950b5 |
+ new_ref = etree.Element(
|
|
|
0950b5 |
+ '{%s}reference' % xccdf_namespace, {'href': stig_href})
|
|
|
0950b5 |
+ new_ref.text = dictionary[ref.text]
|
|
|
0950b5 |
+ new_ref.tail = ref.tail
|
|
|
0950b5 |
+ rule.insert(index + 1, new_ref)
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+target_root.write(destination)
|