|
1
|
2 |
|
from __future__ import absolute_import |
|
2
|
2 |
|
from __future__ import print_function |
|
3
|
|
|
|
|
4
|
2 |
|
import os |
|
5
|
2 |
|
import re |
|
6
|
|
|
|
|
7
|
2 |
|
from .constants import XCCDF11_NS |
|
8
|
2 |
|
from .oval import parse_affected |
|
9
|
2 |
|
from .utils import read_file_list |
|
10
|
|
|
|
|
11
|
|
|
|
|
12
|
2 |
|
def get_content_ref_if_exists_and_not_remote(check): |
|
13
|
|
|
""" |
|
14
|
|
|
Given an OVAL check element, examine the ``xccdf_ns:check-content-ref`` |
|
15
|
|
|
|
|
16
|
|
|
If it exists and it isn't remote, pass it as the return value. |
|
17
|
|
|
Otherwise, return None. |
|
18
|
|
|
|
|
19
|
|
|
..see-also:: is_content_href_remote |
|
20
|
|
|
""" |
|
21
|
|
|
checkcontentref = check.find("./{%s}check-content-ref" % XCCDF11_NS) |
|
22
|
|
|
if checkcontentref is None: |
|
23
|
|
|
return None |
|
24
|
|
|
if is_content_href_remote(checkcontentref): |
|
25
|
|
|
return None |
|
26
|
|
|
return checkcontentref |
|
27
|
|
|
|
|
28
|
|
|
|
|
29
|
2 |
|
def is_content_href_remote(check_content_ref): |
|
30
|
|
|
""" |
|
31
|
|
|
Given an OVAL check-content-ref element, examine the 'href' attribute. |
|
32
|
|
|
|
|
33
|
|
|
If it starts with 'http://' or 'https://', return True, otherwise |
|
34
|
|
|
return False. |
|
35
|
|
|
|
|
36
|
|
|
Raises RuntimeError if the ``href`` element doesn't exist. |
|
37
|
|
|
""" |
|
38
|
|
|
hrefattr = check_content_ref.get("href") |
|
39
|
|
|
if hrefattr is None: |
|
40
|
|
|
# @href attribute of <check-content-ref> is required by XCCDF standard |
|
41
|
|
|
msg = "Invalid OVAL <check-content-ref> detected - missing the " \ |
|
42
|
|
|
"'href' attribute!" |
|
43
|
|
|
raise RuntimeError(msg) |
|
44
|
|
|
|
|
45
|
|
|
return hrefattr.startswith("http://") or hrefattr.startswith("https://") |
|
46
|
|
|
|
|
47
|
|
|
|
|
48
|
2 |
|
def is_cce_format_valid(cceid): |
|
49
|
|
|
""" |
|
50
|
|
|
IF CCE ID IS IN VALID FORM (either 'CCE-XXXX-X' or 'CCE-XXXXX-X' |
|
51
|
|
|
where each X is a digit, and the final X is a check-digit) |
|
52
|
|
|
based on Requirement A17: |
|
53
|
|
|
|
|
54
|
|
|
http://people.redhat.com/swells/nist-scap-validation/scap-val-requirements-1.2.html |
|
55
|
|
|
""" |
|
56
|
2 |
|
match = re.match(r'^CCE-\d{4,5}-\d$', cceid) |
|
57
|
2 |
|
return match is not None |
|
58
|
|
|
|
|
59
|
|
|
|
|
60
|
2 |
|
def is_cce_value_valid(cceid): |
|
61
|
|
|
# For context, see: |
|
62
|
|
|
# https://github.com/ComplianceAsCode/content/issues/3044#issuecomment-420844095 |
|
63
|
|
|
|
|
64
|
|
|
# concat(substr ... , substr ...) -- just remove non-digit characters. |
|
65
|
|
|
# Since we've already validated format, this hack suffices: |
|
66
|
2 |
|
cce = re.sub(r'(CCE|-)', '', cceid) |
|
67
|
|
|
|
|
68
|
|
|
# The below is an implementation of Luhn's algorithm as this is what the |
|
69
|
|
|
# XPath code does. |
|
70
|
|
|
|
|
71
|
|
|
# First, map string numbers to integers. List cast is necessary to be able |
|
72
|
|
|
# to index it. |
|
73
|
2 |
|
digits = list(map(int, cce)) |
|
74
|
|
|
|
|
75
|
|
|
# Even indices are doubled. Coerce to list for list addition. However, |
|
76
|
|
|
# XPath uses 1-indexing so "evens" and "odds" are swapped from Python. |
|
77
|
|
|
# We handle both the idiv and the mod here as well; note that we only |
|
78
|
|
|
# hvae to do this for evens: no single digit is above 10, so the idiv |
|
79
|
|
|
# always returns 0 and the mod always returns the original number. |
|
80
|
2 |
|
evens = list(map(lambda i: (i*2)//10 + (i*2) % 10, digits[-2::-2])) |
|
81
|
2 |
|
odds = digits[-1::-2] |
|
82
|
|
|
|
|
83
|
|
|
# The checksum value is now the sum of the evens and the odds. |
|
84
|
2 |
|
value = sum(evens + odds) % 10 |
|
85
|
|
|
|
|
86
|
|
|
# Valid CCE <=> value == 0 |
|
87
|
2 |
|
return value == 0 |
|
88
|
|
|
|
|
89
|
|
|
|
|
90
|
2 |
|
def get_oval_path(rule_obj, oval_id): |
|
91
|
|
|
""" |
|
92
|
|
|
For the given oval_id or product, return the full path to the check in the |
|
93
|
|
|
given rule. |
|
94
|
|
|
""" |
|
95
|
2 |
|
if not oval_id.endswith(".xml"): |
|
96
|
2 |
|
oval_id += ".xml" |
|
97
|
|
|
|
|
98
|
2 |
|
if 'dir' not in rule_obj or 'id' not in rule_obj: |
|
99
|
2 |
|
raise ValueError("Malformed rule_obj") |
|
100
|
|
|
|
|
101
|
2 |
|
if 'ovals' not in rule_obj or oval_id not in rule_obj['ovals']: |
|
102
|
2 |
|
raise ValueError("Unknown oval_id:%s for rule_id" % oval_id) |
|
103
|
|
|
|
|
104
|
2 |
|
return os.path.join(rule_obj['dir'], 'oval', oval_id) |
|
105
|
|
|
|
|
106
|
|
|
|
|
107
|
2 |
|
def get_oval_contents(rule_obj, oval_id): |
|
108
|
|
|
""" |
|
109
|
|
|
Returns the tuple (path, contents) of the check described by the given |
|
110
|
|
|
oval_id or product. |
|
111
|
|
|
""" |
|
112
|
|
|
|
|
113
|
|
|
oval_path = get_oval_path(rule_obj, oval_id) |
|
114
|
|
|
oval_contents = read_file_list(oval_path) |
|
115
|
|
|
|
|
116
|
|
|
return oval_path, oval_contents |
|
117
|
|
|
|
|
118
|
|
|
|
|
119
|
2 |
|
def set_applicable_platforms(oval_contents, new_platforms): |
|
120
|
|
|
""" |
|
121
|
|
|
Returns a modified contents which updates the platforms to the new |
|
122
|
|
|
platforms. |
|
123
|
|
|
""" |
|
124
|
|
|
|
|
125
|
|
|
start_affected, end_affected, indent = parse_affected(oval_contents) |
|
126
|
|
|
|
|
127
|
|
|
platforms = sorted(new_platforms) |
|
128
|
|
|
new_platforms_xml = map(lambda x: indent + "<platform>%s</platform>" % x, platforms) |
|
129
|
|
|
new_platforms_xml = list(new_platforms_xml) |
|
130
|
|
|
|
|
131
|
|
|
new_contents = oval_contents[0:start_affected+1] |
|
132
|
|
|
new_contents.extend(new_platforms_xml) |
|
133
|
|
|
new_contents.extend(oval_contents[end_affected:]) |
|
134
|
|
|
|
|
135
|
|
|
return new_contents |
|
136
|
|
|
|
ComplianceAsCode /
content
