Open SCAP Library
cvrf_priv.h
1 /*
2  * Copyright 2017 Red Hat Inc., Durham, North Carolina.
3  * All Rights Reserved.
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2.1 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the Free Software
17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18  *
19  * Authors:
20  * Katarina Jankov <kj226@cornell.edu>
21  *
22  */
23 #ifndef CVRF_PRIV_H_
24 #define CVRF_PRIV_H_
25 
26 #include <libxml/xmlreader.h>
27 #include <libxml/tree.h>
28 #include <libxml/xpath.h>
29 #include <libxml/parser.h>
30 #include <libxml/xpathInternals.h>
31 
32 #include "../common/list.h"
33 #include "../common/elements.h"
34 #include "cvrf.h"
35 
36 
37 // namespaces
38 #define CVRF_NS BAD_CAST "http://www.icasi.org/CVRF/schema/cvrf/1.1"
39 #define PROD_NS BAD_CAST "http://www.icasi.org/CVRF/schema/prod/1.1"
40 #define VULN_NS BAD_CAST "http://www.icasi.org/CVRF/schema/vuln/1.1"
41 
42 /*-----------------------------------------------------------------------------------------*\
43 | CVRF Enum Definitions |
44 \*-----------------------------------------------------------------------------------------*/
45 
46 /************************************************************************************************
47  * Type attribute of a DocumentPublisher element and Party attribute of an Involvement element
48  * (these must match in the same document)
49  */
50 typedef enum {
51  CVRF_DOC_PUBLISHER_UNKNOWN = 0,
52  CVRF_DOC_PUBLISHER_VENDOR,
53  CVRF_DOC_PUBLISHER_DISCOVERER,
54  CVRF_DOC_PUBLISHER_COORDINATOR,
55  CVRF_DOC_PUBLISHER_USER,
56  CVRF_DOC_PUBLISHER_OTHER,
57 } cvrf_doc_publisher_type_t;
58 
65 cvrf_doc_publisher_type_t cvrf_doc_publisher_get_type(struct cvrf_doc_publisher *publisher);
66 
73 cvrf_doc_publisher_type_t cvrf_involvement_get_party(struct cvrf_involvement *involve);
74 
80 cvrf_doc_publisher_type_t cvrf_doc_publisher_type_parse(xmlTextReaderPtr reader);
81 
88 cvrf_doc_publisher_type_t cvrf_involvement_party_parse(xmlTextReaderPtr reader);
89 
95 const char *cvrf_doc_publisher_type_get_text(cvrf_doc_publisher_type_t type);
96 
97 /************************************************************************************************
98  * Type represented as a child node of the DocumentTracking element
99  * Refers to stage of completeness of the document and likelihood of it changing
100  */
101 typedef enum {
102  CVRF_DOC_STATUS_UNKNOWN = 0,
103  CVRF_DOC_STATUS_DRAFT,
104  CVRF_DOC_STATUS_INTERIM,
105  CVRF_DOC_STATUS_FINAL,
106 } cvrf_doc_status_type_t;
107 
114 cvrf_doc_status_type_t cvrf_doc_tracking_get_status(struct cvrf_doc_tracking *tracking);
115 
121 cvrf_doc_status_type_t cvrf_doc_status_type_parse(xmlTextReaderPtr reader);
122 
128 const char *cvrf_doc_status_type_get_text(cvrf_doc_status_type_t type);
129 
130 /************************************************************************************************
131  * Type attribute of the Note element
132  * Category of information provided by a Note element
133  */
134 typedef enum {
135  CVRF_NOTE_UNKNOWN = 0,
136  CVRF_NOTE_GENERAL,
137  CVRF_NOTE_DETAILS,
138  CVRF_NOTE_DESCRIPTION,
139  CVRF_NOTE_SUMMARY,
140  CVRF_NOTE_FAQ,
141  CVRF_NOTE_LEGAL_DISCLAIMER,
142  CVRF_NOTE_OTHER,
143 } cvrf_note_type_t;
144 
151 cvrf_note_type_t cvrf_note_get_note_type(const struct cvrf_note *note);
152 
158 cvrf_note_type_t cvrf_note_type_parse(xmlTextReaderPtr reader);
159 
165 const char *cvrf_note_type_get_text(cvrf_note_type_t type);
166 
167 /************************************************************************************************
168  * Type attribute of the Reference element
169  * Indicates whether the reference refers to a document or to an external source
170  */
171 typedef enum {
172  CVRF_REFERENCE_UNKNOWN = 0,
173  CVRF_REFERENCE_EXTERNAL,
174  CVRF_REFERENCE_SELF,
175 } cvrf_reference_type_t;
176 
183 cvrf_reference_type_t cvrf_reference_get_reference_type(struct cvrf_reference *reference);
184 
190 cvrf_reference_type_t cvrf_reference_type_parse(xmlTextReaderPtr reader);
191 
197 const char *cvrf_reference_type_get_text(cvrf_reference_type_t type);
198 
199 /************************************************************************************************
200  * Type attribute of the Branch element
201  * Category and context for the information provided in the Name attribute
202  */
203 typedef enum {
204  CVRF_BRANCH_UNKNOWN = 0,
205  CVRF_BRANCH_VENDOR,
206  CVRF_BRANCH_PRODUCT_FAMILY,
207  CVRF_BRANCH_PRODUCT_NAME,
208  CVRF_BRANCH_PRODUCT_VERSION,
209  CVRF_BRANCH_PATCH_LEVEL,
210  CVRF_BRANCH_SERVICE_PACK,
211  CVRF_BRANCH_ARCHITECTURE,
212  CVRF_BRANCH_LANGUAGE,
213  CVRF_BRANCH_LEGACY,
214  CVRF_BRANCH_SPECIFICATION,
215 } cvrf_branch_type_t;
216 
223 cvrf_branch_type_t cvrf_branch_get_branch_type(struct cvrf_branch *branch);
224 
230 cvrf_branch_type_t cvrf_branch_type_parse(xmlTextReaderPtr reader);
231 
237 const char *cvrf_branch_type_get_text(cvrf_branch_type_t type);
238 
239 /************************************************************************************************
240  * RelationType attribute of the Relationship element
241  * Defines how the products named in the ProductReference and RelatesToProductReference attributes
242  * are related
243  * EX:
244  * <Relationship ProductReference="A" RelationType="?" RelatesToProductReference="B">
245  */
246 typedef enum {
247  CVRF_RELATIONSHIP_UNKNOWN = 0,
248  CVRF_RELATIONSHIP_DEFAULT_COMPONENT,
249  CVRF_RELATIONSHIP_OPTIONAL_COMPONENT,
250  CVRF_RELATIONSHIP_EXTERNAL_COMPONENT,
251  CVRF_RELATIONSHIP_INSTALLED_ON,
252  CVRF_RELATIONSHIP_INSTALLED_WITH,
253 } cvrf_relationship_type_t;
254 
261 cvrf_relationship_type_t cvrf_relationship_get_relation_type(struct cvrf_relationship *relation);
262 
268 cvrf_relationship_type_t cvrf_relationship_type_parse(xmlTextReaderPtr reader);
269 
275 const char *cvrf_relationship_type_get_text(cvrf_relationship_type_t type);
276 
277 /************************************************************************************************
278  * Status attribute of the Involvement element
279  * Indicates level of involvement of the Party referenced in the Involvement's Party attribute
280  */
281 typedef enum {
282  CVRF_INVOLVEMENT_UNKNOWN = 0,
283  CVRF_INVOLVEMENT_OPEN,
284  CVRF_INVOLVEMENT_DISPUTED,
285  CVRF_INVOLVEMENT_IN_PROGRESS,
286  CVRF_INVOLVEMENT_COMPLETED,
287  CVRF_INVOLVEMENT_CONTACT_ATTEMPTED,
288  CVRF_INVOLVEMENT_NOT_CONTACTED,
289 } cvrf_involvement_status_type_t;
290 
297 cvrf_involvement_status_type_t cvrf_involvement_get_status_type(struct cvrf_involvement *involve);
298 
304 cvrf_involvement_status_type_t cvrf_involvement_status_type_parse(xmlTextReaderPtr reader);
305 
311 const char *cvrf_involvement_status_type_get_text(cvrf_involvement_status_type_t type);
312 
313 
314 /************************************************************************************************
315  * Type attribute of the Status element
316  * Indicates the status of products with regards to a Vulnerability: whether this Vulnerability
317  * is known to affect the product, whether a fix exists for the version in the release, etc.
318  */
319 typedef enum {
320  CVRF_PRODUCT_STATUS_UNKNOWN = 0,
321  CVRF_PRODUCT_STATUS_FIRST_AFFECTED,
322  CVRF_PRODUCT_STATUS_KNOWN_AFFECTED,
323  CVRF_PRODUCT_STATUS_KNOWN_NOT_AFFECTED,
324  CVRF_PRODUCT_STATUS_FIRST_FIXED,
325  CVRF_PRODUCT_STATUS_FIXED,
326  CVRF_PRODUCT_STATUS_RECOMMENDED,
327  CVRF_PRODUCT_STATUS_LAST_AFFECTED,
328 } cvrf_product_status_type_t;
329 
330 
337 cvrf_product_status_type_t cvrf_product_status_get_type(struct cvrf_product_status *stat);
338 
344 cvrf_product_status_type_t cvrf_product_status_type_parse(xmlTextReaderPtr reader);
345 
351 const char *cvrf_product_status_type_get_text(cvrf_product_status_type_t product_status_type);
352 
353 /************************************************************************************************
354  * Type attribute of the Threat element
355  * Category of information the Threat provides about the Vulnerability; gives context about
356  * impact and damage done by the Vulnerability
357  */
358 typedef enum {
359  CVRF_THREAT_UNKNOWN = 0,
360  CVRF_THREAT_IMPACT,
361  CVRF_THREAT_EXPLOIT_STATUS,
362  CVRF_THREAT_TARGET_SET,
363 } cvrf_threat_type_t;
364 
371 cvrf_threat_type_t cvrf_threat_get_threat_type(struct cvrf_threat *threat);
372 
378 cvrf_threat_type_t cvrf_threat_type_parse(xmlTextReaderPtr reader);
379 
385 const char *cvrf_threat_type_get_text(cvrf_threat_type_t threat_type);
386 
387 /************************************************************************************************
388  * Type attribute of the Remediation element
389  * Category of and status about ways to avoid, mitigate, or resolve a Vulnerability
390  */
391 typedef enum {
392  CVRF_REMEDIATION_UNKNOWN = 0,
393  CVRF_REMEDIATION_WORKAROUND,
394  CVRF_REMEDIATION_MITIGATION,
395  CVRF_REMEDIATION_VENDOR_FIX,
396  CVRF_REMEDIATION_NONE_AVAILABLE,
397  CVRF_REMEDIATION_WILL_NOT_FIX,
398 } cvrf_remediation_type_t;
399 
406 cvrf_remediation_type_t cvrf_remediation_get_type(struct cvrf_remediation *remed);
407 
413 cvrf_remediation_type_t cvrf_remediation_type_parse(xmlTextReaderPtr reader);
414 
420 const char *cvrf_remediation_type_get_text(cvrf_remediation_type_t remediation_type);
421 
422 
423 /************************************************************************************************
424  * @struct cvrf_item_spec
425  * Maps a cvrf_item_type_t enum to its text representation within a CVRF XML file,
426  * as well as the parent container (if one exists)
427  */
428 struct cvrf_item_spec;
429 
430 typedef enum {
431  CVRF_ITEM_UNKNOWN = 0,
432  CVRF_DOCUMENT_PUBLISHER,
433  CVRF_DOCUMENT_TRACKING,
434  CVRF_REVISION,
435  CVRF_DOCUMENT_NOTE,
436  CVRF_DOCUMENT_REFERENCE,
437  CVRF_ACKNOWLEDGMENT,
438  CVRF_PRODUCT_TREE,
439  CVRF_BRANCH,
440  CVRF_GROUP,
441  CVRF_RELATIONSHIP,
442  CVRF_PRODUCT_NAME,
443  CVRF_VULNERABILITY,
444  CVRF_VULNERABILITY_CWE,
445  CVRF_NOTE,
446  CVRF_INVOLVEMENT,
447  CVRF_SCORE_SET,
448  CVRF_PRODUCT_STATUS,
449  CVRF_THREAT,
450  CVRF_REMEDIATION,
451  CVRF_REFERENCE,
452 } cvrf_item_type_t;
453 
459 const char *cvrf_item_type_get_text(cvrf_item_type_t type);
460 
466 cvrf_item_type_t cvrf_item_type_from_text(const char *item);
467 
472 bool cvrf_is_valid_item_type(const char *item);
473 
479 const char *cvrf_item_type_get_container(cvrf_item_type_t type);
480 
487 bool cvrf_item_type_has_container(cvrf_item_type_t type);
488 
489 
490 /*-----------------------------------------------------------------------------------------*\
491 | CVRF Parsing & Serialization Functions |
492 \*-----------------------------------------------------------------------------------------*/
493 
499 struct cvrf_remediation *cvrf_remediation_parse(xmlTextReaderPtr reader);
500 
506 struct cvrf_score_set *cvrf_score_set_parse(xmlTextReaderPtr reader);
507 
513 struct cvrf_threat *cvrf_threat_parse(xmlTextReaderPtr reader);
514 
520 struct cvrf_product_status *cvrf_product_status_parse(xmlTextReaderPtr reader);
521 
527 struct cvrf_involvement *cvrf_involvement_parse(xmlTextReaderPtr reader);
528 
534 struct cvrf_vulnerability_cwe *cvrf_vulnerability_cwe_parse(xmlTextReaderPtr reader);
535 
541 struct cvrf_vulnerability *cvrf_vulnerability_parse(xmlTextReaderPtr reader);
542 
548 struct cvrf_product_name *cvrf_product_name_parse(xmlTextReaderPtr reader);
549 
555 struct cvrf_group *cvrf_group_parse(xmlTextReaderPtr reader);
556 
562 struct cvrf_relationship *cvrf_relationship_parse(xmlTextReaderPtr reader);
563 
569 struct cvrf_branch *cvrf_branch_parse(xmlTextReaderPtr reader);
570 
576 struct cvrf_product_tree *cvrf_product_tree_parse(xmlTextReaderPtr reader);
577 
583 struct cvrf_acknowledgment *cvrf_acknowledgment_parse(xmlTextReaderPtr reader);
584 
590 struct cvrf_reference *cvrf_reference_parse(xmlTextReaderPtr reader);
591 
597 struct cvrf_note *cvrf_note_parse(xmlTextReaderPtr reader);
598 
604 struct cvrf_revision *cvrf_revision_parse(xmlTextReaderPtr reader);
605 
611 struct cvrf_doc_tracking *cvrf_doc_tracking_parse(xmlTextReaderPtr reader);
612 
618 struct cvrf_doc_publisher *cvrf_doc_publisher_parse(xmlTextReaderPtr reader);
619 
626 struct cvrf_document *cvrf_document_parse(xmlTextReaderPtr reader);
627 
633 struct cvrf_model *cvrf_model_parse(xmlTextReaderPtr reader);
634 
640 struct cvrf_index *cvrf_index_parse_xml(struct oscap_source *index_source);
641 
642 
650 void cvrf_element_add_container(struct oscap_list *list, cvrf_item_type_t cvrf_type, xmlNode *parent);
651 
659 void cvrf_element_add_stringlist(struct oscap_stringlist *list, const char *tag_name, xmlNode *parent);
660 
668 void cvrf_element_add_attribute(const char *attr_name, const char *attr_value, xmlNode *element);
669 
677 void cvrf_element_add_child(const char *elm_name, const char *elm_value, xmlNode *parent);
678 
685 xmlNode *cvrf_element_to_dom(const char *elm_name, const char *elm_value);
686 
693 xmlNode *cvrf_remediation_to_dom(const struct cvrf_remediation *remed);
694 
701 xmlNode *cvrf_threat_to_dom(const struct cvrf_threat *threat);
702 
709 xmlNode *cvrf_score_set_to_dom(const struct cvrf_score_set *score_set);
710 
717 xmlNode *cvrf_product_status_to_dom(const struct cvrf_product_status *stat);
718 
725 xmlNode *cvrf_involvement_to_dom(const struct cvrf_involvement *involve);
726 
733 xmlNode *cvrf_vulnerability_cwe_to_dom(const struct cvrf_vulnerability_cwe *vuln_cwe);
734 
741 xmlNode *cvrf_vulnerability_to_dom(const struct cvrf_vulnerability *vuln);
742 
749 xmlNode *cvrf_product_name_to_dom(struct cvrf_product_name *full_name);
750 
757 xmlNode *cvrf_group_to_dom(const struct cvrf_group *group);
758 
765 xmlNode *cvrf_relationship_to_dom(const struct cvrf_relationship *relation);
766 
773 xmlNode *cvrf_branch_to_dom(struct cvrf_branch *branch);
774 
781 xmlNode *cvrf_product_tree_to_dom(struct cvrf_product_tree *tree);
782 
789 xmlNode *cvrf_acknowledgment_to_dom(struct cvrf_acknowledgment *ack);
790 
797 xmlNode *cvrf_reference_to_dom(struct cvrf_reference *ref);
798 
806 xmlNode *cvrf_note_to_dom(struct cvrf_note *note);
807 
814 xmlNode *cvrf_revision_to_dom(struct cvrf_revision *revision);
815 
822 xmlNode *cvrf_doc_tracking_to_dom(struct cvrf_doc_tracking *tracking);
823 
830 xmlNode *cvrf_doc_publisher_to_dom(struct cvrf_doc_publisher *publisher);
831 
839 xmlNode *cvrf_document_to_dom(struct cvrf_document *document);
840 
849 xmlNode *cvrf_model_to_dom(struct cvrf_model *model, xmlDocPtr doc, xmlNode *parent, void *user_args);
850 
858 xmlNode *cvrf_index_to_dom(struct cvrf_index *index, xmlDocPtr doc, xmlNode *parent, void *user_args);
859 
860 bool cvrf_product_vulnerability_fixed(struct cvrf_vulnerability *vuln, const char *product);
861 
862 
863 #endif /* _CVRF_PRIV_H_ */
Definition: cvrf_priv.c:362
xmlNode * cvrf_doc_publisher_to_dom(struct cvrf_doc_publisher *publisher)
Parent: CVRF Model root node.
Definition: cvrf_priv.c:2236
xmlNode * cvrf_threat_to_dom(const struct cvrf_threat *threat)
Parent: Threats container in a CVRF Vulnerability element.
Definition: cvrf_priv.c:1717
cvrf_branch_type_t cvrf_branch_get_branch_type(struct cvrf_branch *branch)
Definition: cvrf_priv.c:698
xmlNode * cvrf_vulnerability_cwe_to_dom(const struct cvrf_vulnerability_cwe *vuln_cwe)
Parent: Vulnerability element.
Definition: cvrf_priv.c:1790
cvrf_product_status_type_t cvrf_product_status_get_type(struct cvrf_product_status *stat)
Definition: cvrf_priv.c:283
Interface to Common Vulnerability Reporting Framework.
A collection of strings.
Definition: oscap_text.h:60
xmlNode * cvrf_group_to_dom(const struct cvrf_group *group)
Parent: CVRF ProductGroups container.
Definition: cvrf_priv.c:1913
Definition: cvrf_priv.c:1238
Definition: cvrf_enumeration.c:241
xmlNode * cvrf_remediation_to_dom(const struct cvrf_remediation *remed)
Parent: Remediations container in a CVRF Vulnerability element.
Definition: cvrf_priv.c:1635
Definition: cvrf_priv.c:556
Definition: cvrf_priv.c:316
cvrf_remediation_type_t cvrf_remediation_get_type(struct cvrf_remediation *remed)
Definition: cvrf_priv.c:78
Definition: cvrf_priv.c:636
Definition: cvrf_priv.c:133
Definition: cvrf_priv.c:399
xmlNode * cvrf_product_tree_to_dom(struct cvrf_product_tree *tree)
Parent: CVRF Model root node.
Definition: cvrf_priv.c:2017
xmlNode * cvrf_document_to_dom(struct cvrf_document *document)
Creates a list of xmlNode siblings of all document elements, all of which will be added as a child li...
Definition: cvrf_priv.c:2274
xmlNode * cvrf_product_status_to_dom(const struct cvrf_product_status *stat)
Parent: ProductStatuses container in a CVRF Vulnerability element.
Definition: cvrf_priv.c:1748
Definition: cvrf_priv.c:685
xmlNode * cvrf_branch_to_dom(struct cvrf_branch *branch)
Parent: CVRF ProductTree element or another Branch element.
Definition: cvrf_priv.c:1970
cvrf_doc_publisher_type_t cvrf_involvement_get_party(struct cvrf_involvement *involve)
Definition: cvrf_priv.c:327
Definition: cvrf_priv.c:1312
cvrf_reference_type_t cvrf_reference_get_reference_type(struct cvrf_reference *reference)
Definition: cvrf_priv.c:1126
Definition: cvrf_priv.c:592
Definition: cvrf_priv.c:1118
xmlNode * cvrf_product_name_to_dom(struct cvrf_product_name *full_name)
Parent: CVRF ProductTree, Branch, Relationship, or Group element.
Definition: cvrf_priv.c:1883
Definition: cvrf_priv.c:841
Definition: cvrf_priv.c:1068
Definition: list.h:53
xmlNode * cvrf_doc_tracking_to_dom(struct cvrf_doc_tracking *tracking)
Parent: CVRF Model root node.
Definition: cvrf_priv.c:2198
Definition: cvrf_priv.c:64
Definition: oscap_source.c:66
xmlNode * cvrf_involvement_to_dom(const struct cvrf_involvement *involve)
Parent: Involvements container in a CVRF Vulnerability element.
Definition: cvrf_priv.c:1771
Definition: cvrf_priv.c:949
xmlNode * cvrf_note_to_dom(struct cvrf_note *note)
Parent: Notes or DocumentNotes container (of root node or Vulnerability node, respectively) ...
Definition: cvrf_priv.c:2109
xmlNode * cvrf_score_set_to_dom(const struct cvrf_score_set *score_set)
Parent: CVSSScoreSets container in a CVRF Vulnerability element.
Definition: cvrf_priv.c:1678
cvrf_relationship_type_t cvrf_relationship_get_relation_type(struct cvrf_relationship *relation)
Definition: cvrf_priv.c:646
xmlNode * cvrf_reference_to_dom(struct cvrf_reference *ref)
Parent: References or DocumentReferences container.
Definition: cvrf_priv.c:2081
xmlNode * cvrf_vulnerability_to_dom(const struct cvrf_vulnerability *vuln)
Parent: CVRF Model root node.
Definition: cvrf_priv.c:1848
cvrf_involvement_status_type_t cvrf_involvement_get_status_type(struct cvrf_involvement *involve)
Definition: cvrf_priv.c:323
Definition: cvrf_priv.c:753
Definition: cvrf_priv.c:896
Definition: cvrf_priv.c:990
Definition: cvrf_priv.c:1162
xmlNode * cvrf_acknowledgment_to_dom(struct cvrf_acknowledgment *ack)
Parent: Acknowledgements container.
Definition: cvrf_priv.c:2051
cvrf_doc_publisher_type_t cvrf_doc_publisher_get_type(struct cvrf_doc_publisher *publisher)
Definition: cvrf_priv.c:1078
Definition: cvrf_priv.c:275
oscap_source_type_t type
Internal type of the oscap_source.
Definition: oscap_source.c:69
xmlNode * cvrf_relationship_to_dom(const struct cvrf_relationship *relation)
Parent: CVRF ProductTree element.
Definition: cvrf_priv.c:1935
cvrf_doc_status_type_t cvrf_doc_tracking_get_status(struct cvrf_doc_tracking *tracking)
Definition: cvrf_priv.c:1011
cvrf_threat_type_t cvrf_threat_get_threat_type(struct cvrf_threat *threat)
Definition: cvrf_priv.c:226
xmlNode * cvrf_revision_to_dom(struct cvrf_revision *revision)
Parent: RevisionHistory container in CVRF DocumentTracking element.
Definition: cvrf_priv.c:2140
cvrf_note_type_t cvrf_note_get_note_type(const struct cvrf_note *note)
Definition: cvrf_priv.c:908
Definition: cvrf_priv.c:216