Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal to add schema for Palo Alto #124

Merged
merged 2 commits into from
Jul 19, 2021
Merged

Proposal to add schema for Palo Alto #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ac5c2a
Proposal to add schema for Palo Alto
May 26, 2021
35905be
Renamed 'paloalto' to 'panos'
Jul 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
171 changes: 171 additions & 0 deletions oval-schemas/panos-definitions-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,171 @@
<?xml version="1.0" encoding="UTF-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5"
xmlns:panos-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"
xmlns:sch="http://purl.oclc.org/dsdl/schematron"
targetNamespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"
elementFormDefault="qualified" version="5.11">
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-definitions-5" schemaLocation="oval-definitions-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>
The following is a description of the elements, types, and attributes that compose the Palo Alto (PAN-OS)-specific
tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension
of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a
set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and
should provide the information necessary to understand what each element and attribute represents. This document
is intended for developers and assumes some familiarity with XML. A high level description of the interaction
between the different tests and their relationship to the Core Definition Schema is not outlined here.
</xsd:documentation>
<xsd:documentation>
This schema was originally developed by William Munyan at cisecurity.org. The OVAL Schema is maintained by the
OVAL Community. For more information, including how to get involved in the project and how to submit change
requests, please visit the OVAL website at http://oval.cisecurity.org.
</xsd:documentation>
<xsd:appinfo>
<schema>Palo Alto (PAN-OS) Definitions</schema>
<version>5.11.2:2.0</version>
<date>03/30/2021 09:00:00 AM</date>
<terms_of_use>
For the portion subject to the copyright in the United States: Copyright (c) 2016 United States Government.
All rights reserved. Copyright (c) 2016, Center for Internet Security. All rights reserved. The contents of
this file are subject to the terms of the OVAL License located at https://oval.cisecurity.org/terms. See the
OVAL License for the specific language governing permissions and limitations for use of this schema. When
distributing copies of the OVAL Schema, this license header must be included.
</terms_of_use>
<sch:ns prefix="oval-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5"/>
<sch:ns prefix="panos-def" uri="http://oval.mitre.org/XMLSchema/oval-definitions-5#panos"/>
<sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>
</xsd:appinfo>
</xsd:annotation>

<!-- ============================================================================ -->
<!-- ================================ CONFIG TEST ============================= -->
<!-- ============================================================================ -->
<xsd:element name="config_test" substitutionGroup="oval-def:test">
<xsd:annotation>
<xsd:documentation>
The config_test is used to check the properties of the XML output from a PAN-OS XML API request to export the
current running configuration. This is a request to the API at "https://[PAN-OS-DEVICE]/api/?type=export&amp;category=configuration".
The response to this request is an XML payload rooted with a "response" element and including device-specific information.
It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType
description for more information. The required object element references a config_object and the optional state
element specifies the data to check.
</xsd:documentation>
<xsd:appinfo>
<oval:element_mapping>
<oval:test>config_test</oval:test>
<oval:object>config_object</oval:object>
<oval:state>config_state</oval:state>
<oval:item target_namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos">config_item</oval:item>
</oval:element_mapping>
</xsd:appinfo>
<xsd:appinfo>
<sch:pattern id="panos-def_configtst">
<sch:rule context="panos-def:config_test/panos-def:object">
<sch:assert test="@object_ref=ancestor::oval-def:oval_definitions/oval-def:objects/panos-def:config_object/@id"><sch:value-of select="../@id"/> - the object child element of a config_test must reference a config_object</sch:assert>
</sch:rule>
<sch:rule context="panos-def:config_test/panos-def:state">
<sch:assert test="@state_ref=ancestor::oval-def:oval_definitions/oval-def:states/panos-def:config_state/@id"><sch:value-of select="../@id"/> - the state child element of a config_test must reference a config_state</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:TestType">
<xsd:sequence>
<xsd:element name="object" type="oval-def:ObjectRefType"/>
<xsd:element name="state" type="oval-def:StateRefType" minOccurs="0" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="config_object" substitutionGroup="oval-def:object">
<xsd:annotation>
<xsd:documentation>
The config_object element is used by a config_test to define the object to be evaluated. Each object extends the
standard ObjectType as defined in the oval-definitions-schema and one should refer to the ObjectType description
for more information. The common set element allows complex objects to be created using filters and set logic.
Again, please refer to the description of the set element in the oval-definitions-schema.
</xsd:documentation>
<xsd:documentation>
A config_object consists of an xpath entity that contains an XPATH 1.0 query to perform on the PAN-OS API response
XML data. The response data is assumed to consist of a &lt;response&gt; entity, with arbitrary (i.e., vendor-specific)
child nodes.
</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="panos-def_paloalto_object_verify_filter_state">
<sch:rule context="panos-def:paloalto_object//oval-def:filter">
<sch:let name="parent_object" value="ancestor::panos-def:config_object"/>
<sch:let name="parent_object_id" value="$parent_object/@id"/>
<sch:let name="state_ref" value="."/>
<sch:let name="reffed_state" value="ancestor::oval-def:oval_definitions/oval-def:states/*[@id=$state_ref]"/>
<sch:let name="state_name" value="local-name($reffed_state)"/>
<sch:let name="state_namespace" value="namespace-uri($reffed_state)"/>
<sch:assert test="(($state_namespace='http://oval.mitre.org/XMLSchema/oval-definitions-5#panos') and ($state_name='config_state'))">State referenced in filter for <sch:value-of select="name($parent_object)"/> '<sch:value-of select="$parent_object_id"/>' is of the wrong type. </sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:ObjectType">
<xsd:sequence>
<xsd:choice>
<xsd:element ref="oval-def:set"/>
<xsd:sequence>
<xsd:element name="xpath" type="oval-def:EntityObjectStringType">
<xsd:annotation>
<xsd:documentation>
Specifies an Xpath expression describing the text node(s) or attribute(s) to look at. Any valid
XPath 1.0 statement is usable with one exception, at most one field may be identified in the XPath.
This is because the value_of element in the data section is only designed to work against a single
field. The only valid operator for xpath is equals since there is an infinite number of possible
XPaths and determinining all those that do not equal a given XPath would be impossible.
</xsd:documentation>
<xsd:appinfo>
<sch:pattern id="panos-def_xmlobjxpath">
<sch:rule context="panos-def:config_object/panos-def:xpath">
<sch:assert test="not(@operation) or @operation='equals'"><sch:value-of select="../@id"/> - operation attribute for the xpath entity of a config_object should be 'equals', note that this overrules the general operation attribute validation (i.e. follow this one)</sch:assert>
</sch:rule>
</sch:pattern>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element ref="oval-def:filter" minOccurs="0" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:choice>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="config_state" substitutionGroup="oval-def:state">
<xsd:annotation>
<xsd:documentation>
The config_state element defines the different information that can be used to evaluate the result of a specific
config XPath evaluation. This includes the XPath used and the value of this XPath.
</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-def:StateType">
<xsd:sequence>
<xsd:element name="xpath" type="oval-def:EntityStateStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies an XPath expression describing the text node(s) or attribute(s) to look at.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value_of" type="oval-def:EntityStateAnySimpleType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The value_of element checks the value(s) of the text node(s) or attribute(s) found.</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
</xsd:schema>
66 changes: 66 additions & 0 deletions oval-schemas/panos-system-characteristics-schema.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
<?xml version="1.0" encoding="UTF-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:oval-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5"
xmlns:panos-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos"
xmlns:sch="http://purl.oclc.org/dsdl/schematron"
targetNamespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos"
elementFormDefault="qualified" version="5.11">
<xsd:import namespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" schemaLocation="oval-system-characteristics-schema.xsd"/>
<xsd:annotation>
<xsd:documentation>
This document outlines the items of the OVAL System Characteristics XML schema that are composed of Palo Alto-specific
tests. Each item is an extention of a basic System Characteristics item defined in the core System Characteristics XML
schema.
</xsd:documentation>
<xsd:documentation>
This schema was originally developed by William Munyan at cisecurity.org. The OVAL Schema is maintained by the OVAL
Community. For more information, including how to get involved in the project and how to submit change requests, please
visit the OVAL website at http://oval.cisecurity.org.
</xsd:documentation>
<xsd:appinfo>
<schema>Palo Alto (PAN-OS) Definitions</schema>
<version>5.11.2:2.0</version>
<date>03/30/2021 09:00:00 AM</date>
<terms_of_use>
For the portion subject to the copyright in the United States: Copyright (c) 2016 United States Government.
All rights reserved. Copyright (c) 2016, Center for Internet Security. All rights reserved. The contents of
this file are subject to the terms of the OVAL License located at https://oval.cisecurity.org/terms. See the
OVAL License for the specific language governing permissions and limitations for use of this schema. When
distributing copies of the OVAL Schema, this license header must be included.
</terms_of_use>
<sch:ns prefix="oval-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5"/>
<sch:ns prefix="panos-sc" uri="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#panos"/>
<sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>
</xsd:appinfo>
</xsd:annotation>

<!-- =============================================================================== -->
<!-- =============================== CONFIG ITEM ================================= -->
<!-- =============================================================================== -->
<xsd:element name="config_item" substitutionGroup="oval-sc:item">
<xsd:annotation>
<xsd:documentation>This item stores results from checking the contents of an XML configuration.</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval-sc:ItemType">
<xsd:sequence>
<xsd:element name="xpath" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies an XPath expression describing the text node(s) or attribute(s) which were collected.</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="value_of" type="oval-sc:EntityItemAnySimpleType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>
The value_of element checks the value(s) of the text node(s) or attribute(s) found. How this
is used is entirely controlled by operator attributes.
</xsd:documentation>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
</xsd:schema>