Skip to content

Commit 5d70f88

Browse files
jan-cernyjan-cerny
committed
Support XCCDF Tailoring files in oscap info --list-rules and --list-vars
Refactor _print_rules_for_profile and _print_vars_for_profile to accept a pre-configured xccdf_policy_model instead of a raw benchmark. This enables callers to set tailoring on the policy model before printing, so that profile inheritance and overrides are properly resolved. Add support for two tailoring scenarios: - Standalone XCCDF Tailoring files: resolve the referenced benchmark from the tailoring file's benchmark href, load it, create a policy model with tailoring set, then print the resolved profile's rules or variables. - Source data streams with tailoring components: find the XCCDF benchmark component in the stream, re-import the tailoring with benchmark context, then print via the policy model.
1 parent d071475 commit 5d70f88

6 files changed

Lines changed: 386 additions & 24 deletions

File tree

‎tests/API/XCCDF/unittests/test_list_rules.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,28 @@ grep -q "\-\-list-rules option requires \-\-profile" $stderr
2727
:> $stdout
2828
:> $stderr
2929

30+
# Test 3: --list-rules with standalone XCCDF tailoring file
31+
tailoring="$srcdir/test_tailoring_file.xml"
32+
tp="xccdf_com.example.www_profile_P1_tailored"
33+
$OSCAP info --profile $tp --list-rules $tailoring > $stdout 2> $stderr
34+
[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
35+
grep -q "xccdf_com.example.www_rule_R1" $stdout
36+
grep -q "xccdf_com.example.www_rule_R2" $stdout
37+
# R3 and R4 are deselected by tailoring
38+
! grep -q "xccdf_com.example.www_rule_R3" $stdout
39+
! grep -q "xccdf_com.example.www_rule_R4" $stdout
40+
[ "$(wc -l < $stdout)" -eq 2 ]
41+
:> $stdout
42+
43+
# Test 4: --list-rules with SDS containing tailoring
44+
ds_tailoring="$srcdir/test_reference_ds_with_tailoring.xml"
45+
$OSCAP info --profile $tp --list-rules $ds_tailoring > $stdout 2> $stderr
46+
[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
47+
grep -q "xccdf_com.example.www_rule_R1" $stdout
48+
grep -q "xccdf_com.example.www_rule_R2" $stdout
49+
! grep -q "xccdf_com.example.www_rule_R3" $stdout
50+
! grep -q "xccdf_com.example.www_rule_R4" $stdout
51+
[ "$(wc -l < $stdout)" -eq 2 ]
52+
:> $stdout
53+
3054
rm -f $stdout $stderr

‎tests/API/XCCDF/unittests/test_list_vars.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,24 @@ grep -q "The \-\-list-rules and \-\-list-vars options can't be used at the same
3131
:> $stdout
3232
:> $stderr
3333

34+
# Test 4: --list-vars with standalone XCCDF tailoring file
35+
tailoring="$srcdir/test_tailoring_file.xml"
36+
tp="xccdf_com.example.www_profile_P1_tailored"
37+
$OSCAP info --profile $tp --list-vars $tailoring > $stdout 2> $stderr
38+
[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
39+
# V1 is overridden to 99 by tailoring, V2 is inherited from base profile
40+
grep -q "xccdf_com.example.www_value_V1 99" $stdout
41+
grep -q "xccdf_com.example.www_value_V2 custom_val" $stdout
42+
[ "$(wc -l < $stdout)" -eq 2 ]
43+
:> $stdout
44+
45+
# Test 5: --list-vars with SDS containing tailoring
46+
ds_tailoring="$srcdir/test_reference_ds_with_tailoring.xml"
47+
$OSCAP info --profile $tp --list-vars $ds_tailoring > $stdout 2> $stderr
48+
[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
49+
grep -q "xccdf_com.example.www_value_V1 99" $stdout
50+
grep -q "xccdf_com.example.www_value_V2 custom_val" $stdout
51+
[ "$(wc -l < $stdout)" -eq 2 ]
52+
:> $stdout
53+
3454
rm -f $stdout $stderr

‎tests/API/XCCDF/unittests/test_reference_ds_with_tailoring.xml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="scap_org.open-scap_collection_from_xccdf_test_single_rule.xccdf.xml" schematron-version="1.3" xsi:schemaLocation="http://scap.nist.gov/schema/scap/source/1.2 https://scap.nist.gov/schema/scap/1.3/scap-source-data-stream_1.3.xsd">
3+
<ds:data-stream id="scap_org.open-scap_datastream_simple" scap-version="1.3" use-case="OTHER">
4+
<ds:checklists>
5+
<ds:component-ref id="scap_org.open-scap_cref_test_single_rule.xccdf.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.xccdf.xml">
6+
<cat:catalog>
7+
<cat:uri name="test_single_rule.oval.xml" uri="#scap_org.open-scap_cref_test_single_rule.oval.xml"/>
8+
</cat:catalog>
9+
</ds:component-ref>
10+
<ds:component-ref id="scap_org.open-scap_cref_tailoring.xml" xlink:href="#scap_org.open-scap_comp_tailoring.xml"/>
11+
</ds:checklists>
12+
<ds:checks>
13+
<ds:component-ref id="scap_org.open-scap_cref_test_single_rule.oval.xml" xlink:href="#scap_org.open-scap_comp_test_single_rule.oval.xml"/>
14+
</ds:checks>
15+
</ds:data-stream>
16+
<ds:component id="scap_org.open-scap_comp_test_single_rule.oval.xml" timestamp="2021-02-01T08:07:06+01:00">
17+
<oval_definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd">
18+
<generator>
19+
<oval:schema_version>5.11.2</oval:schema_version>
20+
<oval:timestamp>2021-02-01T08:07:06+01:00</oval:timestamp>
21+
</generator>
22+
<definitions>
23+
<definition class="compliance" id="oval:x:def:1" version="1">
24+
<metadata>
25+
<title>PASS</title>
26+
<description>pass</description>
27+
</metadata>
28+
<criteria>
29+
<criterion comment="PASS test" test_ref="oval:x:tst:1"/>
30+
</criteria>
31+
</definition>
32+
</definitions>
33+
<tests>
34+
<variable_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:tst:1" check="all" comment="always pass" version="1">
35+
<object object_ref="oval:x:obj:1"/>
36+
</variable_test>
37+
</tests>
38+
<objects>
39+
<variable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:obj:1" version="1" comment="x">
40+
<var_ref>oval:x:var:1</var_ref>
41+
</variable_object>
42+
</objects>
43+
<variables>
44+
<constant_variable id="oval:x:var:1" version="1" comment="x" datatype="int">
45+
<value>100</value>
46+
</constant_variable>
47+
</variables>
48+
</oval_definitions>
49+
</ds:component>
50+
<ds:component id="scap_org.open-scap_comp_test_single_rule.xccdf.xml" timestamp="2021-02-01T08:07:06+01:00">
51+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_com.example.www_benchmark_dummy" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="false" xml:lang="en-US">
52+
<status date="2021-01-21">accepted</status>
53+
<title>Test Benchmark</title>
54+
<description>Description</description>
55+
<reference href="https://www.animals.com">animals</reference>
56+
<reference href="https://www.fruit.com">fruit</reference>
57+
<version>1.0</version>
58+
<metadata>
59+
<dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">OpenSCAP</dc:contributor>
60+
<dc:publisher xmlns:dc="http://purl.org/dc/elements/1.1/">OpenSCAP</dc:publisher>
61+
<dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">OpenSCAP</dc:creator>
62+
<dc:source xmlns:dc="http://purl.org/dc/elements/1.1/">http://scap.nist.gov</dc:source>
63+
</metadata>
64+
<Profile id="xccdf_com.example.www_profile_P1">
65+
<title>xccdf_test_profile</title>
66+
<description>This profile is for testing.</description>
67+
<select idref="xccdf_com.example.www_rule_R1" selected="true"/>
68+
<select idref="xccdf_com.example.www_rule_R2" selected="true"/>
69+
<select idref="xccdf_com.example.www_rule_R3" selected="true"/>
70+
<select idref="xccdf_com.example.www_rule_R4" selected="true"/>
71+
<set-value idref="xccdf_com.example.www_value_V1">42</set-value>
72+
<refine-value idref="xccdf_com.example.www_value_V2" selector="custom"/>
73+
</Profile>
74+
<Value id="xccdf_com.example.www_value_V1" type="number">
75+
<title>Value V1</title>
76+
<value>10</value>
77+
<value selector="twenty">20</value>
78+
</Value>
79+
<Value id="xccdf_com.example.www_value_V2" type="string">
80+
<title>Value V2</title>
81+
<value>default_val</value>
82+
<value selector="custom">custom_val</value>
83+
</Value>
84+
<Rule selected="true" id="xccdf_com.example.www_rule_R1">
85+
<title>Rule R1</title>
86+
<description>Description</description>
87+
<reference href="https://www.animals.com">3.14</reference>
88+
<reference href="https://www.fruit.com">42.42</reference>
89+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
90+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
91+
</check>
92+
</Rule>
93+
<Rule selected="true" id="xccdf_com.example.www_rule_R2">
94+
<title>Rule R2</title>
95+
<description>Description</description>
96+
<reference href="https://www.animals.com">17.71.777</reference>
97+
<reference href="https://www.fruit.com">88888888</reference>
98+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
99+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
100+
</check>
101+
</Rule>
102+
<Rule selected="true" id="xccdf_com.example.www_rule_R3">
103+
<title>Rule R3</title>
104+
<description>Description</description>
105+
<reference href="https://www.animals.com">17.71.777</reference>
106+
<reference href="https://www.fruit.com">666</reference>
107+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
108+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
109+
</check>
110+
</Rule>
111+
<Rule selected="true" id="xccdf_com.example.www_rule_R4">
112+
<title>Rule R4</title>
113+
<description>Description</description>
114+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
115+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
116+
</check>
117+
</Rule>
118+
</Benchmark>
119+
</ds:component>
120+
<ds:component id="scap_org.open-scap_comp_tailoring.xml" timestamp="2021-02-01T08:07:06+01:00">
121+
<Tailoring xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_com.example.www_tailoring_test">
122+
<benchmark href="#scap_org.open-scap_comp_test_single_rule.xccdf.xml"/>
123+
<version>1.0</version>
124+
<Profile id="xccdf_com.example.www_profile_P1_tailored" extends="xccdf_com.example.www_profile_P1">
125+
<title>Tailored P1</title>
126+
<select idref="xccdf_com.example.www_rule_R3" selected="false"/>
127+
<select idref="xccdf_com.example.www_rule_R4" selected="false"/>
128+
<set-value idref="xccdf_com.example.www_value_V1">99</set-value>
129+
</Profile>
130+
</Tailoring>
131+
</ds:component>
132+
</ds:data-stream-collection>

‎tests/API/XCCDF/unittests/test_tailoring_benchmark.xml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_com.example.www_benchmark_dummy" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="false" xml:lang="en-US">
3+
<status date="2021-01-21">accepted</status>
4+
<title>Test Benchmark</title>
5+
<description>Description</description>
6+
<version>1.0</version>
7+
<Profile id="xccdf_com.example.www_profile_P1">
8+
<title>xccdf_test_profile</title>
9+
<description>This profile is for testing.</description>
10+
<select idref="xccdf_com.example.www_rule_R1" selected="true"/>
11+
<select idref="xccdf_com.example.www_rule_R2" selected="true"/>
12+
<select idref="xccdf_com.example.www_rule_R3" selected="true"/>
13+
<select idref="xccdf_com.example.www_rule_R4" selected="true"/>
14+
<set-value idref="xccdf_com.example.www_value_V1">42</set-value>
15+
<refine-value idref="xccdf_com.example.www_value_V2" selector="custom"/>
16+
</Profile>
17+
<Value id="xccdf_com.example.www_value_V1" type="number">
18+
<title>Value V1</title>
19+
<value>10</value>
20+
<value selector="twenty">20</value>
21+
</Value>
22+
<Value id="xccdf_com.example.www_value_V2" type="string">
23+
<title>Value V2</title>
24+
<value>default_val</value>
25+
<value selector="custom">custom_val</value>
26+
</Value>
27+
<Rule selected="true" id="xccdf_com.example.www_rule_R1">
28+
<title>Rule R1</title>
29+
<description>Description</description>
30+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
31+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
32+
</check>
33+
</Rule>
34+
<Rule selected="true" id="xccdf_com.example.www_rule_R2">
35+
<title>Rule R2</title>
36+
<description>Description</description>
37+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
38+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
39+
</check>
40+
</Rule>
41+
<Rule selected="true" id="xccdf_com.example.www_rule_R3">
42+
<title>Rule R3</title>
43+
<description>Description</description>
44+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
45+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
46+
</check>
47+
</Rule>
48+
<Rule selected="true" id="xccdf_com.example.www_rule_R4">
49+
<title>Rule R4</title>
50+
<description>Description</description>
51+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
52+
<check-content-ref href="test_single_rule.oval.xml" name="oval:x:def:1"/>
53+
</check>
54+
</Rule>
55+
</Benchmark>

‎tests/API/XCCDF/unittests/test_tailoring_file.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Tailoring xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_com.example.www_tailoring_test">
3+
<benchmark href="test_tailoring_benchmark.xml"/>
4+
<version>1.0</version>
5+
<Profile id="xccdf_com.example.www_profile_P1_tailored" extends="xccdf_com.example.www_profile_P1">
6+
<title>Tailored P1</title>
7+
<select idref="xccdf_com.example.www_rule_R3" selected="false"/>
8+
<select idref="xccdf_com.example.www_rule_R4" selected="false"/>
9+
<set-value idref="xccdf_com.example.www_value_V1">99</set-value>
10+
</Profile>
11+
</Tailoring>

0 commit comments

Comments
 (0)