Skip to content

Commit 5e67135

Browse files
jan-cernyjan-cerny
authored
Merge pull request #1189 from jan-cerny/add_windows_cpes
Add Windows CPEs
2 parents f1aff91 + ebeb608 commit 5e67135

File tree

5 files changed

+224
-2
lines changed

5 files changed

+224
-2
lines changed

‎cpe/openscap-cpe-dict.xml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,4 +202,32 @@
202202
<title xml:lang="en-us">Wind River Linux 8</title>
203203
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.wrlinux:def:8</check>
204204
</cpe-item>
205+
<cpe-item name="cpe:/o:microsoft:windows_7">
206+
<title xml:lang="en-us">Microsoft Windows 7</title>
207+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:7</check>
208+
</cpe-item>
209+
<cpe-item name="cpe:/o:microsoft:windows_8">
210+
<title xml:lang="en-us">Microsoft Windows 8</title>
211+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:8</check>
212+
</cpe-item>
213+
<cpe-item name="cpe:/o:microsoft:windows_8.1">
214+
<title xml:lang="en-us">Microsoft Windows 8.1</title>
215+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:81</check>
216+
</cpe-item>
217+
<cpe-item name="cpe:/o:microsoft:windows_10">
218+
<title xml:lang="en-us">Microsoft Windows 10</title>
219+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:10</check>
220+
</cpe-item>
221+
<cpe-item name="cpe:/o:microsoft:windows_server_2008">
222+
<title xml:lang="en-us">Microsoft Windows Server 2008</title>
223+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:2008</check>
224+
</cpe-item>
225+
<cpe-item name="cpe:/o:microsoft:windows_server_2012">
226+
<title xml:lang="en-us">Microsoft Windows Server 2012</title>
227+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:2012</check>
228+
</cpe-item>
229+
<cpe-item name="cpe:/o:microsoft:windows_server_2016">
230+
<title xml:lang="en-us">Microsoft Windows Server 2016</title>
231+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:2016</check>
232+
</cpe-item>
205233
</cpe-list>

‎cpe/openscap-cpe-oval.xml

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,97 @@
611611
<criterion comment="Wind River Linux version is 8." test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" />
612612
</criteria>
613613
</definition>
614+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:7" version="1">
615+
<metadata>
616+
<title>Microsoft Windows 7</title>
617+
<affected family="windows">
618+
<platform>Microsoft Windows 7</platform>
619+
</affected>
620+
<reference ref_id="cpe:/o:microsoft:windows_7" source="CPE"/>
621+
<description>The operating system installed on the system is Microsoft Windows 7</description>
622+
</metadata>
623+
<criteria operator="OR">
624+
<criterion comment="Microsoft Windows 7 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:7" />
625+
</criteria>
626+
</definition>
627+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:8" version="1">
628+
<metadata>
629+
<title>Microsoft Windows 8</title>
630+
<affected family="windows">
631+
<platform>Microsoft Windows 8</platform>
632+
</affected>
633+
<reference ref_id="cpe:/o:microsoft:windows_8" source="CPE"/>
634+
<description>The operating system installed on the system is Microsoft Windows 8</description>
635+
</metadata>
636+
<criteria operator="OR">
637+
<criterion comment="Microsoft Windows 8 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:8" />
638+
</criteria>
639+
</definition>
640+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:81" version="1">
641+
<metadata>
642+
<title>Microsoft Windows 8.1</title>
643+
<affected family="windows">
644+
<platform>Microsoft Windows 8.1</platform>
645+
</affected>
646+
<reference ref_id="cpe:/o:microsoft:windows_8.1" source="CPE"/>
647+
<description>The operating system installed on the system is Microsoft Windows 8.1</description>
648+
</metadata>
649+
<criteria operator="OR">
650+
<criterion comment="Microsoft Windows 8.1 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:81" />
651+
</criteria>
652+
</definition>
653+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:10" version="1">
654+
<metadata>
655+
<title>Microsoft Windows 10</title>
656+
<affected family="windows">
657+
<platform>Microsoft Windows 10</platform>
658+
</affected>
659+
<reference ref_id="cpe:/o:microsoft:windows_10" source="CPE"/>
660+
<description>The operating system installed on the system is Microsoft Windows 10</description>
661+
</metadata>
662+
<criteria operator="OR">
663+
<criterion comment="Microsoft Windows 10 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:10" />
664+
</criteria>
665+
</definition>
666+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:2008" version="1">
667+
<metadata>
668+
<title>Microsoft Windows Server 2008</title>
669+
<affected family="windows">
670+
<platform>Microsoft Windows Server 2008</platform>
671+
</affected>
672+
<reference ref_id="cpe:/o:microsoft:windows_server_2008" source="CPE"/>
673+
<description>The operating system installed on the system is Microsoft Windows Server 2008</description>
674+
</metadata>
675+
<criteria operator="OR">
676+
<criterion comment="Microsoft Windows Server 2008 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:2008" />
677+
</criteria>
678+
</definition>
679+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:2012" version="1">
680+
<metadata>
681+
<title>Microsoft Windows Server 2012</title>
682+
<affected family="windows">
683+
<platform>Microsoft Windows Server 2012</platform>
684+
</affected>
685+
<reference ref_id="cpe:/o:microsoft:windows_server_2012" source="CPE"/>
686+
<description>The operating system installed on the system is Microsoft Windows Server 2012</description>
687+
</metadata>
688+
<criteria operator="OR">
689+
<criterion comment="Microsoft Windows Server 2012 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:2012" />
690+
</criteria>
691+
</definition>
692+
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:2016" version="1">
693+
<metadata>
694+
<title>Microsoft Windows Server 2016</title>
695+
<affected family="windows">
696+
<platform>Microsoft Windows Server 2016</platform>
697+
</affected>
698+
<reference ref_id="cpe:/o:microsoft:windows_server_2016" source="CPE"/>
699+
<description>The operating system installed on the system is Microsoft Windows Server 2016</description>
700+
</metadata>
701+
<criteria operator="OR">
702+
<criterion comment="Microsoft Windows Server 2016 is installed" test_ref="oval:org.open-scap.cpe.windows:tst:2016" />
703+
</criteria>
704+
</definition>
614705
</definitions>
615706
<tests>
616707
<rpmverifyfile_test check_existence="at_least_one_exists" id="oval:org.open-scap.cpe.rhel:tst:2" version="1" check="at least one" comment="/etc/redhat-release is provided by redhat-release package"
@@ -867,6 +958,34 @@
867958
<object object_ref="oval:org.open-scap.cpe.rhevh:obj:2" />
868959
<state state_ref="oval:org.open-scap.cpe.rhevh:ste:2" />
869960
</textfilecontent54_test>
961+
<registry_test id="oval:org.open-scap.cpe.windows:tst:7" version="1" comment="Windows 7 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
962+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
963+
<state state_ref="oval:org.open-scap.cpe.windows:ste:7"/>
964+
</registry_test>
965+
<registry_test id="oval:org.open-scap.cpe.windows:tst:8" version="1" comment="Windows 8 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
966+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
967+
<state state_ref="oval:org.open-scap.cpe.windows:ste:8"/>
968+
</registry_test>
969+
<registry_test id="oval:org.open-scap.cpe.windows:tst:81" version="1" comment="Windows 8.1 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
970+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
971+
<state state_ref="oval:org.open-scap.cpe.windows:ste:81"/>
972+
</registry_test>
973+
<registry_test id="oval:org.open-scap.cpe.windows:tst:10" version="1" comment="Windows 10 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
974+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
975+
<state state_ref="oval:org.open-scap.cpe.windows:ste:10"/>
976+
</registry_test>
977+
<registry_test id="oval:org.open-scap.cpe.windows:tst:2008" version="1" comment="Windows Server 2008 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
978+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
979+
<state state_ref="oval:org.open-scap.cpe.windows:ste:2008"/>
980+
</registry_test>
981+
<registry_test id="oval:org.open-scap.cpe.windows:tst:2012" version="1" comment="Windows Server 2012 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
982+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
983+
<state state_ref="oval:org.open-scap.cpe.windows:ste:2012"/>
984+
</registry_test>
985+
<registry_test id="oval:org.open-scap.cpe.windows:tst:2016" version="1" comment="Windows Server 2016 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
986+
<object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
987+
<state state_ref="oval:org.open-scap.cpe.windows:ste:2016"/>
988+
</registry_test>
870989
</tests>
871990
<objects>
872991
<family_object id="oval:org.open-scap.cpe.unix:obj:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"/>
@@ -920,6 +1039,11 @@
9201039
<rpminfo_object id="oval:org.open-scap.cpe.oraclelinux-release:obj:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
9211040
<name>oraclelinux-release</name>
9221041
</rpminfo_object>
1042+
<registry_object id="oval:org.open-scap.cpe.windows:obj:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" >
1043+
<hive>HKEY_LOCAL_MACHINE</hive>
1044+
<key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
1045+
<name>ProductName</name>
1046+
</registry_object>
9231047
</objects>
9241048
<states>
9251049
<family_state id="oval:org.open-scap.cpe.unix:ste:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
@@ -1079,5 +1203,26 @@
10791203
<textfilecontent54_state id="oval:org.open-scap.cpe.rhevh:ste:2" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
10801204
<subexpression operation="pattern match">7</subexpression>
10811205
</textfilecontent54_state>
1206+
<registry_state id="oval:org.open-scap.cpe.windows:ste:7" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1207+
<value operation="pattern match">^Windows 7.*$</value>
1208+
</registry_state>
1209+
<registry_state id="oval:org.open-scap.cpe.windows:ste:8" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1210+
<value operation="pattern match">^Windows 8.*$</value>
1211+
</registry_state>
1212+
<registry_state id="oval:org.open-scap.cpe.windows:ste:81" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1213+
<value operation="pattern match">^Windows 8\.1.*$</value>
1214+
</registry_state>
1215+
<registry_state id="oval:org.open-scap.cpe.windows:ste:10" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1216+
<value operation="pattern match">^Windows 10.*$</value>
1217+
</registry_state>
1218+
<registry_state id="oval:org.open-scap.cpe.windows:ste:2008" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1219+
<value operation="pattern match">^.*2008.*$</value>
1220+
</registry_state>
1221+
<registry_state id="oval:org.open-scap.cpe.windows:ste:2012" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1222+
<value operation="pattern match">^.*2012.*$</value>
1223+
</registry_state>
1224+
<registry_state id="oval:org.open-scap.cpe.windows:ste:2016" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
1225+
<value operation="pattern match">^.*2016.*$</value>
1226+
</registry_state>
10821227
</states>
10831228
</oval_definitions>

‎src/XCCDF/benchmark.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ bool xccdf_benchmark_parse(struct xccdf_item * benchmark, xmlTextReaderPtr reade
160160
oscap_list_add(benchmark->sub.benchmark.rear_matter, oscap_text_new_parse(XCCDF_TEXT_HTMLSUB, reader));
161161
break;
162162
case XCCDFE_PLATFORM:
163-
oscap_list_add(benchmark->item.platforms, xccdf_attribute_copy(reader, XCCDFA_IDREF));
163+
xccdf_item_add_applicable_platform(benchmark, reader);
164164
break;
165165
case XCCDFE_MODEL:
166166
parsed_model = xccdf_model_new_xml(reader);

‎src/XCCDF/item.c

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#include <string.h>
3131
#include <time.h>
3232
#include <math.h>
33+
#include <pcre.h>
3334

3435
#include <libxml/tree.h>
3536
#include <libxml/xpath.h>
@@ -40,6 +41,12 @@
4041
#include "helpers.h"
4142
#include "xccdf_impl.h"
4243
#include "common/util.h"
44+
#include "oscap_helpers.h"
45+
46+
/* According to `man 3 pcreapi`, the number passed in ovecsize should always
47+
* be a multiple of three.
48+
*/
49+
#define OVECTOR_LEN 30
4350

4451
const struct oscap_string_map XCCDF_OPERATOR_MAP[] = {
4552
{XCCDF_OPERATOR_EQUALS, "equals"},
@@ -742,6 +749,46 @@ bool xccdf_item_process_attributes(struct xccdf_item *item, xmlTextReaderPtr rea
742749
return item->item.id != NULL;
743750
}
744751

752+
void xccdf_item_add_applicable_platform(struct xccdf_item *item, xmlTextReaderPtr reader)
753+
{
754+
char *platform_idref = xccdf_attribute_copy(reader, XCCDFA_IDREF);
755+
756+
/* Official Windows 7 CPE according to National Vulnerability Database
757+
* CPE Dictionary as of 2018-08-29 is 'cpe:/o:microsoft:windows_7'.
758+
* However, content exported from Microsoft Security Compliance Manager
759+
* as of version 4.0.0.1 in CAB archive using 'Export in SCAP 1.0' is
760+
* 'cpe:/o:microsoft:windows7'. If this pattern is matched, we will add
761+
* an underscore to workaround the situation that this XCCDF benchmark is
762+
* not applicable.
763+
*/
764+
const char *pcreerror = NULL;
765+
int erroffset = 0;
766+
pcre *regex = pcre_compile("^(cpe:/o:microsoft:windows)(7.*)", 0, &pcreerror, &erroffset, NULL);
767+
int ovector[OVECTOR_LEN];
768+
int rc = pcre_exec(regex, NULL, platform_idref, strlen(platform_idref), 0, 0, ovector, OVECTOR_LEN);
769+
/* 1 pattern + 2 groups = 3 */
770+
if (rc == 3) {
771+
const int first_group_start = ovector[2];
772+
const int first_group_end = ovector[3];
773+
size_t first_group_len = first_group_end - first_group_start;
774+
char *first_group = malloc(first_group_len + 1); // + 1 for '\0'
775+
strncpy(first_group, platform_idref + first_group_start, first_group_len);
776+
first_group[first_group_len] = '\0';
777+
const int second_group_start = ovector[4];
778+
const int second_group_end = ovector[5];
779+
size_t second_group_len = second_group_end - second_group_start;
780+
char *second_group = malloc(second_group_len + 1); // + 1 for '\0'
781+
strncpy(second_group, platform_idref + second_group_start, second_group_len);
782+
second_group[second_group_len] = '\0';
783+
char *alternate_platform_idref = oscap_sprintf("%s_%s", first_group, second_group);
784+
free(first_group);
785+
free(second_group);
786+
oscap_list_add(item->item.platforms, alternate_platform_idref);
787+
}
788+
789+
oscap_list_add(item->item.platforms, platform_idref);
790+
}
791+
745792
bool xccdf_item_process_element(struct xccdf_item * item, xmlTextReaderPtr reader)
746793
{
747794
xccdf_element_t el = xccdf_element_get(reader);
@@ -790,7 +837,7 @@ bool xccdf_item_process_element(struct xccdf_item * item, xmlTextReaderPtr reade
790837
oscap_list_add(item->item.rationale, oscap_text_new_parse(XCCDF_TEXT_HTMLSUB, reader));
791838
return true;
792839
case XCCDFE_PLATFORM:
793-
oscap_list_add(item->item.platforms, xccdf_attribute_copy(reader, XCCDFA_IDREF));
840+
xccdf_item_add_applicable_platform(item, reader);
794841
return true;
795842
case XCCDFE_QUESTION:
796843
oscap_list_add(item->item.question, oscap_text_new_parse(XCCDF_TEXT_PLAIN, reader));

‎src/XCCDF/item.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -520,6 +520,8 @@ void xccdf_reparent_item(struct xccdf_item * item, struct xccdf_item * parent);
520520

521521
void xccdf_texts_to_dom(struct oscap_text_iterator *texts, xmlNode *parent, const char *elname);
522522

523+
void xccdf_item_add_applicable_platform(struct xccdf_item *item, xmlTextReaderPtr reader);
524+
523525
#include "unused.h"
524526

525527

0 commit comments

Comments
 (0)