Skip to content

Commit 850a018

Browse files
author
Ondrej Prazak
committed
Parse profiles from data stream files
New features: - ability to parse profiles from data stream files Important changes: - strip namespaces from the xml file before parsing
1 parent 5eb333b commit 850a018

11 files changed

Lines changed: 251473 additions & 7 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@
66
/pkg/
77
/spec/reports/
88
/tmp/
9+
Gemfile.lock

‎lib/openscap_parser.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
require 'openscap_parser/rules'
66
require 'openscap_parser/version'
77
require 'openscap_parser/xml_report'
8+
require 'openscap_parser/ds'
89

910
require 'date'
1011

‎lib/openscap_parser/ds.rb‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# frozen_string_literal: true
2+
require 'openscap_parser/xml_file'
3+
4+
module OpenscapParser
5+
class Ds
6+
include OpenscapParser::XmlFile
7+
8+
def initialize(report)
9+
report_xml report
10+
end
11+
12+
def profiles
13+
@profiles ||= profile_nodes
14+
end
15+
16+
private
17+
18+
def profile_nodes
19+
@report_xml.xpath(".//Profile").map do |node|
20+
id = node.attribute('id')&.value
21+
title = node.at_xpath('./title')&.text
22+
description = node.at_xpath('./description')&.text
23+
{ :id => id, :title => title, :description => description }
24+
end
25+
end
26+
end
27+
end

‎lib/openscap_parser/profile.rb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module OpenscapParser
2+
class Profile
3+
attr_acessor :id, :title, :description
4+
5+
def to_h
6+
{ :id => id, :title => title, :description => description }
7+
end
8+
end
9+
end

‎lib/openscap_parser/profiles.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def profiles
1515
private
1616

1717
def profile_node
18-
@report_xml.at_xpath(".//xmlns:Profile\
18+
@report_xml.at_xpath(".//Profile\
1919
[contains('#{test_result_node['id']}', @id)]")
2020
end
2121

‎lib/openscap_parser/rules.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ module Rules
66
def self.included(base)
77
base.class_eval do
88
def rule_ids
9-
test_result_node.xpath('.//xmlns:rule-result/@idref').map(&:value)
9+
test_result_node.xpath('.//rule-result/@idref').map(&:value)
1010
end
1111

1212
def rule_objects

‎lib/openscap_parser/xml_file.rb‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# frozen_string_literal: true
2+
require 'nokogiri'
3+
4+
module OpenscapParser
5+
module XmlFile
6+
def report_xml(report_contents = '')
7+
@report_xml ||= ::Nokogiri::XML.parse(report_contents)
8+
@report_xml.remove_namespaces!
9+
end
10+
end
11+
end

‎lib/openscap_parser/xml_report.rb‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,22 @@
11
# frozen_string_literal: true
22
require 'nokogiri'
3+
require 'openscap_parser/xml_file'
34

45
module OpenscapParser
56
# Methods related with parsing directly the XML from the Report
67
# as opposed to using the OpenSCAP APIs
78
module XMLReport
89
def self.included(base)
910
base.class_eval do
11+
include OpenscapParser::XmlFile
12+
1013
def host
1114
@report_xml.search('target').text
1215
end
1316

1417
def description
1518
@report_xml.search('description').first.text
1619
end
17-
18-
def report_xml(report_contents = '')
19-
@report_xml ||= ::Nokogiri::XML.parse(report_contents)
20-
@report_xml.remove_namespaces! if @report_xml.namespaces.keys.include? 'xmlns:arf'
21-
end
2220
end
2321
end
2422
end

‎test/ds_test.rb‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# frozen_string_literal: true
2+
require 'test_helper'
3+
4+
class DsTest < MiniTest::Test
5+
context 'scap content' do
6+
should 'be able to parse profiles' do
7+
parser = create_parser('ssg-rhel7-ds.xml')
8+
profile_titles = [
9+
"United States Government Configuration Baseline",
10+
"Standard System Security Profile for Red Hat Enterprise Linux 7",
11+
"Criminal Justice Information Services (CJIS) Security Policy",
12+
"C2S for Red Hat Enterprise Linux 7",
13+
"Health Insurance Portability and Accountability Act (HIPAA)",
14+
"Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)",
15+
"DISA STIG for Red Hat Enterprise Linux 7",
16+
"OSPP - Protection Profile for General Purpose Operating Systems v. 4.2",
17+
"PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7",
18+
"Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)",
19+
"PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7"
20+
]
21+
assert_equal(profile_titles, parser.profiles.map { |profile| profile[:title] })
22+
end
23+
end
24+
25+
context 'tailoring file' do
26+
should 'be able to parse profiles' do
27+
parser = create_parser('ssg-rhel7-ds-tailoring.xml')
28+
profile_titles = [
29+
"Standard System Security Profile [CUSTOMIZED]",
30+
"Common Profile for General-Purpose Systems [CUSTOMIZED]"
31+
]
32+
assert_equal(profile_titles, parser.profiles.map { |profile| profile[:title] })
33+
end
34+
end
35+
36+
def create_parser(file)
37+
scap_content = file_fixture(file).read
38+
::OpenscapParser::Ds.new(scap_content)
39+
end
40+
end

‎test/fixtures/files/ssg-rhel7-ds-tailoring.xml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
3+
<xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml"/>
4+
<xccdf:version time="2018-04-18T09:09:42">1</xccdf:version>
5+
<xccdf:Profile id="xccdf_org.ssgproject.content_profile_standard_customized" extends="xccdf_org.ssgproject.content_profile_standard">
6+
<xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Standard System Security Profile [CUSTOMIZED]</xccdf:title>
7+
<xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile contains rules to ensure standard security baseline
8+
of Red Hat Enterprise Linux 7 system. Regardless of your system's workload
9+
all of these checks should pass.</xccdf:description>
10+
<xccdf:select idref="xccdf_org.ssgproject.content_group_gnome" selected="true"/>
11+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" selected="true"/>
12+
<xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="true"/>
13+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
14+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
15+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="true"/>
16+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="true"/>
17+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" selected="true"/>
18+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="true"/>
19+
<xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_screen_locking" selected="true"/>
20+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
21+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
22+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
23+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
24+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
25+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="true"/>
26+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_user_locks" selected="true"/>
27+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
28+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" selected="true"/>
29+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
30+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
31+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
32+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
33+
</xccdf:Profile>
34+
<xccdf:Profile id="xccdf_org.ssgproject.content_profile_common_customized" extends="xccdf_org.ssgproject.content_profile_common">
35+
<xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Common Profile for General-Purpose Systems [CUSTOMIZED]</xccdf:title>
36+
<xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile contains items common to general-purpose desktop and server installations.</xccdf:description>
37+
<xccdf:select idref="xccdf_org.ssgproject.content_group_proxy" selected="true"/>
38+
<xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="true"/>
39+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_service_squid_disabled" selected="true"/>
40+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_squid_removed" selected="true"/>
41+
<xccdf:select idref="xccdf_org.ssgproject.content_group_snmp" selected="true"/>
42+
<xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="true"/>
43+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" selected="true"/>
44+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" selected="true"/>
45+
<xccdf:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="true"/>
46+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" selected="true"/>
47+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_snmpd_not_default_password" selected="true"/>
48+
<xccdf:select idref="xccdf_org.ssgproject.content_group_routing" selected="true"/>
49+
<xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="true"/>
50+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_service_zebra_disabled" selected="true"/>
51+
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_quagga_removed" selected="true"/>
52+
</xccdf:Profile>
53+
</xccdf:Tailoring>

0 commit comments

Comments
 (0)