Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consider Adding PaloAlto Networks PAN-OS and Cisco NX-OS Schema to minimize Validation Errors #2160

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Consider Adding PaloAlto Networks PAN-OS and Cisco NX-OS Schema to minimize Validation Errors #2160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions schemas/oval/5.11.2/oval-common-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -607,6 +607,16 @@ at_least_one_exists || 0 | 0+ | 1+ | 0+ || Error
<xsd:annotation>
<xsd:documentation>The windows value describes the Microsoft Windows operating system.</xsd:documentation>
</xsd:annotation>
</xsd:enumeration>
<xsd:enumeration value="nxos">
<xsd:annotation>
<xsd:documentation>The NX-OS value describes the Cisco NX-OS operating system.</xsd:documentation>
</xsd:annotation>
</xsd:enumeration>
<xsd:enumeration value="panos">
<xsd:annotation>
<xsd:documentation>The PAN-OS value describes the Palo Alto Networks PAN-OS operating system.</xsd:documentation>
</xsd:annotation>
</xsd:enumeration>
</xsd:restriction>
</xsd:simpleType>
Expand Down
2 changes: 2 additions & 0 deletions schemas/oval/5.11.2/oval-definitions-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" schemaLocation="solaris-definitions-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" schemaLocation="unix-definitions-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" schemaLocation="windows-definitions-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos" schemaLocation="panos-definitions-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#nxos" schemaLocation="x-nxos-definitions-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>The following is a description of the elements, types, and attributes that compose the core schema for encoding Open Vulnerability and Assessment Language (OVAL) Definitions. Some of the objects defined here are extended and enhanced by individual component schemas, which are described in separate documents. Each of the elements, types, and attributes that make up the Core Definition Schema are described in detail and should provide the information necessary to understand what each represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between these objects is not outlined here.</xsd:documentation>
<xsd:documentation>The OVAL Schema is maintained by OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.cisecurity.org.</xsd:documentation>
Expand Down
1 change: 1 addition & 0 deletions schemas/oval/5.11.2/oval-system-characteristics-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#solaris" schemaLocation="solaris-system-characteristics-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" schemaLocation="unix-system-characteristics-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" schemaLocation="windows-system-characteristics-schema.xsd"/>
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos" schemaLocation="panos-system-characteristics-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>The following is a description of the elements, types, and attributes that compose the core schema for encoding Open Vulnerability and Assessment Language (OVAL) System Characteristics. The Core System Characteristics Schema defines all operating system independent objects. These objects are extended and enhanced by individual family schemas, which are described in separate documents. Each of the elements, types, and attributes that make up the Core System Characteristics Schema are described in detail and should provide the information necessary to understand what each object represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between these objects is not outlined here.</xsd:documentation>
<xsd:documentation>The OVAL Schema is maintained by the OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.cisecurity.org.</xsd:documentation>
Expand Down
171 changes: 171 additions & 0 deletions schemas/oval/5.11.2/panos-definitions-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,171 @@
<?xml version="1.0" encoding="UTF-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5"
xmlns:panos-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"
xmlns:sch="http://purl.oclc.org/dsdl/schematron"
targetNamespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"
elementFormDefault="qualified" version="5.11">
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5" schemaLocation="oval-definitions-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>
The following is a description of the elements, types, and attributes that compose the Palo Alto (PAN-OS)-specific
tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension
of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a
set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and
should provide the information necessary to understand what each element and attribute represents. This document
is intended for developers and assumes some familiarity with XML. A high level description of the interaction
between the different tests and their relationship to the Core Definition Schema is not outlined here.
</xsd:documentation>
<xsd:documentation>
This schema was originally developed by William Munyan at cisecurity.org. The OVAL Schema is maintained by the
OVAL Community. For more information, including how to get involved in the project and how to submit change
requests, please visit the OVAL website at http://oval.cisecurity.org.
</xsd:documentation>
<xsd:appinfo>
<schema>Palo Alto (PAN-OS) Definitions</schema>
<version>5.11.2:2.0</version>
<date>03/30/2021 09:00:00 AM</date>
<terms_of_use>
For the portion subject to the copyright in the United States: Copyright (c) 2016 United States Government.
All rights reserved. Copyright (c) 2016, Center for Internet Security. All rights reserved. The contents of
this file are subject to the terms of the OVAL License located at https://oval.cisecurity.org/terms. See the
OVAL License for the specific language governing permissions and limitations for use of this schema. When
distributing copies of the OVAL Schema, this license header must be included.
</terms_of_use>
<sch:ns prefix="oval-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5"/>
<sch:ns prefix="panos-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"/>
<sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>
</xsd:appinfo>
</xsd:annotation>

<!-- ============================================================================ -->
<!-- ================================ CONFIG TEST ============================= -->
<!-- ============================================================================ -->
<xsd:element name="config_test" substitutionGroup="oval-def:test">
<xsd:annotation>
<xsd:documentation>
The config_test is used to check the properties of the XML output from a PAN-OS XML API request to export the
current running configuration. This is a request to the API at "https://[PAN-OS-DEVICE]/api/?type=export&amp;category=configuration".
The response to this request is an XML payload rooted with a "response" element and including device-specific information.
It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType
description for more information. The required object element references a config_object and the optional state
element specifies the data to check.
</xsd:documentation>
<xsd:appinfo>
<oval:element_mapping>
<oval:test>config_test</oval:test>
<oval:object>config_object</oval:object>
<oval:state>config_state</oval:state>
<oval:item target_namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos">config_item</oval:item>
</oval:element_mapping>
</xsd:appinfo>
<xsd:appinfo>
<sch:pattern id="panos-def_configtst">
<sch:rule context="panos-def:config_test/panos-def:object">
<sch:assert test="@object_ref=ancestor::oval-def:oval_definitions/oval-def:objects/panos-def:config_object/@id"><sch:value-of select="../@id"/> - the object child element of a config_test must reference a config_object</sch:assert>
</sch:rule>
<sch:rule context="panos-def:config_test/panos-def:state">
<sch:assert test="@state_ref=ancestor::oval-def:oval_definitions/oval-def:states/panos-def:config_state/@id"><sch:value-of select="../@id"/> - the state child element of a config_test must reference a config_state</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:TestType">
<xsd:sequence>
<xsd:element name="object" type="oval-def:ObjectRefType"/>
<xsd:element name="state" type="oval-def:StateRefType" minOccurs="0" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="config_object" substitutionGroup="oval-def:object">
<xsd:annotation>
<xsd:documentation>
The config_object element is used by a config_test to define the object to be evaluated. Each object extends the
standard ObjectType as defined in the oval-definitions-schema and one should refer to the ObjectType description
for more information. The common set element allows complex objects to be created using filters and set logic.
Again, please refer to the description of the set element in the oval-definitions-schema.
</xsd:documentation>
<xsd:documentation>
A config_object consists of an xpath entity that contains an XPATH 1.0 query to perform on the PAN-OS API response
XML data. The response data is assumed to consist of a &lt;response&gt; entity, with arbitrary (i.e., vendor-specific)
child nodes.
</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="panos-def_paloalto_object_verify_filter_state">
<sch:rule context="panos-def:paloalto_object//oval-def:filter">
<sch:let name="parent_object" value="ancestor::panos-def:config_object"/>
<sch:let name="parent_object_id" value="$parent_object/@id"/>
<sch:let name="state_ref" value="."/>
<sch:let name="reffed_state" value="ancestor::oval-def:oval_definitions/oval-def:states/*[@id=$state_ref]"/>
<sch:let name="state_name" value="local-name($reffed_state)"/>
<sch:let name="state_namespace" value="namespace-uri($reffed_state)"/>
<sch:assert test="(($state_namespace='http://oval.mitre.org/XMLSchema/oval-definitions-5#panos') and ($state_name='config_state'))">State referenced in filter for <sch:value-of select="name($parent_object)"/> '<sch:value-of select="$parent_object_id"/>' is of the wrong type. </sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:ObjectType">
<xsd:sequence>
<xsd:choice>
<xsd:element ref="oval-def:set"/>
<xsd:sequence>
<xsd:element name="xpath" type="oval-def:EntityObjectStringType">
<xsd:annotation>
<xsd:documentation>
Specifies an Xpath expression describing the text node(s) or attribute(s) to look at. Any valid
XPath 1.0 statement is usable with one exception, at most one field may be identified in the XPath.
This is because the value_of element in the data section is only designed to work against a single
field. The only valid operator for xpath is equals since there is an infinite number of possible
XPaths and determinining all those that do not equal a given XPath would be impossible.
</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="panos-def_xmlobjxpath">
<sch:rule context="panos-def:config_object/panos-def:xpath">
<sch:assert test="not(@operation) or @operation='equals'"><sch:value-of select="../@id"/> - operation attribute for the xpath entity of a config_object should be 'equals', note that this overrules the general operation attribute validation (i.e. follow this one)</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element ref="oval-def:filter" minOccurs="0" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:choice>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="config_state" substitutionGroup="oval-def:state">
<xsd:annotation>
<xsd:documentation>
The config_state element defines the different information that can be used to evaluate the result of a specific
config XPath evaluation. This includes the XPath used and the value of this XPath.
</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:StateType">
<xsd:sequence>
<xsd:element name="xpath" type="oval-def:EntityStateStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies an XPath expression describing the text node(s) or attribute(s) to look at.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value_of" type="oval-def:EntityStateAnySimpleType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The value_of element checks the value(s) of the text node(s) or attribute(s) found.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
</xsd:schema>
Loading