Skip to content

Commit

Permalink
Add 'inventory-item-has-software-version' constraint and tests
Browse files Browse the repository at this point in the history
  • Loading branch information
Gabeblis committed Dec 30, 2024
1 parent 0e2ce18 commit d26001e
Show file tree
Hide file tree
Showing 6 changed files with 40 additions and 0 deletions.
3 changes: 3 additions & 0 deletions features/fedramp_extensions.feature
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ Examples:
| interconnection-security |
| inventory-item-allows-authenticated-scan |
| inventory-item-and-component-has-public |
| inventory-item-has-software-version |
| inventory-item-has-vendor-name |
| inventory-item-public |
| inventory-item-virtual |
Expand Down Expand Up @@ -365,6 +366,8 @@ Examples:
| inventory-item-allows-authenticated-scan-PASS.yaml |
| inventory-item-and-component-has-public-FAIL.yaml |
| inventory-item-and-component-has-public-PASS.yaml |
| inventory-item-has-software-version-FAIL.yaml |
| inventory-item-has-software-version-PASS.yaml |
| inventory-item-has-vendor-name-FAIL.yaml |
| inventory-item-has-vendor-name-PASS.yaml |
| inventory-item-public-FAIL.yaml |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2250,6 +2250,7 @@ approved.</p>
<p>Legacy Example (No implemented-component).</p>
</description>
<!--<prop name="asset-id" value="unique-asset-ID-01"/>-->
<prop name="software-version" value="software-version"/>
<prop name="ipv4-address" value="10.1.1.1"/>
<prop name="ipv6-address" value="2001:db8:3333:4444:5555:6666:7777:8888"/>
<prop name="virtual" value="no"/>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="11111111-2222-4000-8000-000000000000">
<system-implementation>
<component uuid="11111111-2222-4000-8000-009000000007" type="software">
<!-- <prop name="software-version" value="software-version"/> Missing software-version in linked component-->
</component>
<inventory-item uuid="11111111-2222-4000-8000-011000000001">
<prop name="asset-type" value="operating-system"/>
<!-- <prop name="software-version" value="software-version"/> Missing software-version in inventory-item.-->
<implemented-component component-uuid="11111111-2222-4000-8000-009000000007">
</implemented-component>
</inventory-item>
</system-implementation>
</system-security-plan>
5 changes: 5 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
Original file line number Diff line number Diff line change
Expand Up @@ -646,6 +646,11 @@
<metapath target="/system-security-plan/system-implementation/inventory-item"/>
<constraints>
<let var ="component-uuid" expression="implemented-component/@component-uuid"/>
<expect id="inventory-item-has-software-version" target=".[prop[@name='asset-type' and @value=('operating-system', 'container', 'image')] or ../component[uuid=$component-uuid and type='software']]" test="count(prop[@name=('software-version', 'os-version')]) >= 1 or count(../component[@uuid=$component-uuid]/prop[@name=('software-version', 'os-version')]) >= 1" level="ERROR">
<formal-name>Inventory Item Has Software Version</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
<message>In a FedRAMP SSP, each inventory item MUST include the software version in the inventory item itself or within the linked component.</message>
</expect>
<expect id="inventory-item-has-vendor-name" target="." test="count(prop[@name='vendor-name' and @ns='http://fedramp.gov/ns/oscal']) >= 1 or count(../component[@uuid=$component-uuid]/prop[@name='vendor-name' and @ns='http://fedramp.gov/ns/oscal']) >= 1" level="ERROR">
<formal-name>Inventory Item Has Vendor Name</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for inventory-item-has-software-version
description: >-
This test case validates the behavior of constraint
inventory-item-has-software-version
content: ../content/ssp-inventory-item-has-software-version-INVALID.xml
expectations:
- constraint-id: inventory-item-has-software-version
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for inventory-item-has-software-version
description: >-
This test case validates the behavior of constraint
inventory-item-has-software-version
content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
expectations:
- constraint-id: inventory-item-has-software-version
result: pass

0 comments on commit d26001e

Please sign in to comment.