|
1
|
2 |
|
from __future__ import absolute_import |
|
2
|
2 |
|
from __future__ import print_function |
|
3
|
|
|
|
|
4
|
2 |
|
import os |
|
5
|
|
|
|
|
6
|
2 |
|
from .constants import XCCDF11_NS |
|
7
|
2 |
|
from .oval import parse_affected |
|
8
|
2 |
|
from .utils import read_file_list |
|
9
|
|
|
|
|
10
|
|
|
|
|
11
|
2 |
|
def get_content_ref_if_exists_and_not_remote(check): |
|
12
|
|
|
""" |
|
13
|
|
|
Given an OVAL check element, examine the ``xccdf_ns:check-content-ref`` |
|
14
|
|
|
|
|
15
|
|
|
If it exists and it isn't remote, pass it as the return value. |
|
16
|
|
|
Otherwise, return None. |
|
17
|
|
|
|
|
18
|
|
|
..see-also:: is_content_href_remote |
|
19
|
|
|
""" |
|
20
|
|
|
checkcontentref = check.find("./{%s}check-content-ref" % XCCDF11_NS) |
|
21
|
|
|
if checkcontentref is None: |
|
22
|
|
|
return None |
|
23
|
|
|
if is_content_href_remote(checkcontentref): |
|
24
|
|
|
return None |
|
25
|
|
|
return checkcontentref |
|
26
|
|
|
|
|
27
|
|
|
|
|
28
|
2 |
|
def is_content_href_remote(check_content_ref): |
|
29
|
|
|
""" |
|
30
|
|
|
Given an OVAL check-content-ref element, examine the 'href' attribute. |
|
31
|
|
|
|
|
32
|
|
|
If it starts with 'http://' or 'https://', return True, otherwise |
|
33
|
|
|
return False. |
|
34
|
|
|
|
|
35
|
|
|
Raises RuntimeError if the ``href`` element doesn't exist. |
|
36
|
|
|
""" |
|
37
|
|
|
hrefattr = check_content_ref.get("href") |
|
38
|
|
|
if hrefattr is None: |
|
39
|
|
|
# @href attribute of <check-content-ref> is required by XCCDF standard |
|
40
|
|
|
msg = "Invalid OVAL <check-content-ref> detected - missing the " \ |
|
41
|
|
|
"'href' attribute!" |
|
42
|
|
|
raise RuntimeError(msg) |
|
43
|
|
|
|
|
44
|
|
|
return hrefattr.startswith("http://") or hrefattr.startswith("https://") |
|
45
|
|
|
|
|
46
|
|
|
|
|
47
|
2 |
|
def get_oval_path(rule_obj, oval_id): |
|
48
|
|
|
""" |
|
49
|
|
|
For the given oval_id or product, return the full path to the check in the |
|
50
|
|
|
given rule. |
|
51
|
|
|
""" |
|
52
|
2 |
|
if not oval_id.endswith(".xml"): |
|
53
|
2 |
|
oval_id += ".xml" |
|
54
|
|
|
|
|
55
|
2 |
|
if 'dir' not in rule_obj or 'id' not in rule_obj: |
|
56
|
2 |
|
raise ValueError("Malformed rule_obj") |
|
57
|
|
|
|
|
58
|
2 |
|
if 'ovals' not in rule_obj or oval_id not in rule_obj['ovals']: |
|
59
|
2 |
|
raise ValueError("Unknown oval_id:%s for rule_id" % oval_id) |
|
60
|
|
|
|
|
61
|
2 |
|
return os.path.join(rule_obj['dir'], 'oval', oval_id) |
|
62
|
|
|
|
|
63
|
|
|
|
|
64
|
2 |
|
def get_oval_contents(rule_obj, oval_id): |
|
65
|
|
|
""" |
|
66
|
|
|
Returns the tuple (path, contents) of the check described by the given |
|
67
|
|
|
oval_id or product. |
|
68
|
|
|
""" |
|
69
|
|
|
|
|
70
|
|
|
oval_path = get_oval_path(rule_obj, oval_id) |
|
71
|
|
|
oval_contents = read_file_list(oval_path) |
|
72
|
|
|
|
|
73
|
|
|
return oval_path, oval_contents |
|
74
|
|
|
|
|
75
|
|
|
|
|
76
|
2 |
|
def set_applicable_platforms(oval_contents, new_platforms): |
|
77
|
|
|
""" |
|
78
|
|
|
Returns a modified contents which updates the platforms to the new |
|
79
|
|
|
platforms. |
|
80
|
|
|
""" |
|
81
|
|
|
|
|
82
|
|
|
start_affected, end_affected, indent = parse_affected(oval_contents) |
|
83
|
|
|
|
|
84
|
|
|
platforms = sorted(new_platforms) |
|
85
|
|
|
new_platforms_xml = map(lambda x: indent + "<platform>%s</platform>" % x, platforms) |
|
86
|
|
|
new_platforms_xml = list(new_platforms_xml) |
|
87
|
|
|
|
|
88
|
|
|
new_contents = oval_contents[0:start_affected+1] |
|
89
|
|
|
new_contents.extend(new_platforms_xml) |
|
90
|
|
|
new_contents.extend(oval_contents[end_affected:]) |
|
91
|
|
|
|
|
92
|
|
|
return new_contents |
|
93
|
|
|
|
ComplianceAsCode /
content
