<div dir="ltr">Ah, good to know. Thanks!</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 15, 2019 at 7:51 AM William Munyan <<a href="mailto:William.Munyan@cisecurity.org">William.Munyan@cisecurity.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>
<div>
<div style="direction:ltr">Those extensions are only in the CIS benchmark content and not part of the OVAL repository. I plan on taking a look at the specific content mentioned in the thread to see what I can see.</div>
<div><br>
</div>
<div style="direction:ltr">Cheers</div>
<div style="direction:ltr">Bill M (CIS)</div>
<div style="direction:ltr"></div>
</div>
<div><br>
</div>
<div class="gmail-m_8560077989867658009ms-outlook-ios-signature">Get <a href="https://aka.ms/o0ukef" target="_blank">Outlook for iOS</a></div>
</div>
<br>
<br>
<br>
<div class="gmail_quote">On Thu, Aug 15, 2019 at 7:49 AM -0400, "Trevor Vaughan" <span dir="ltr">
<<a href="mailto:tvaughan@onyxpoint.com" target="_blank">tvaughan@onyxpoint.com</a>></span> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="3D"ltr""><br>
<br>
<br>
<div dir="ltr">As far as I know, the CIS materials have non-standard extensions that only their scanner supports.</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Aug 14, 2019 at 11:47 PM Tim <<a href="mailto:tim@variosecure.net" target="_blank">tim@variosecure.net</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Another issue has come up while attempting to scan a Fedora-based system <br>
using the quasi-official OVAL collection at CIS:<br>
<br>
<a href="https://oval.cisecurity.org/repository/download/5.11.2/all/oval.xml.zip" rel="noreferrer" target="_blank">https://oval.cisecurity.org/repository/download/5.11.2/all/oval.xml.zip</a><br>
<br>
After extracting the XML and using a command such as:<br>
<br>
oscap oval eval --report report.html --results results.xml <br>
--fetch-remote-resources oval.xml<br>
<br>
the oscap utility spends about an hour and a half parsing the 213MB of <br>
data, then says in the end that the definitions are invalid and so <br>
refuses to do the scan.<br>
<br>
When I use --fetch-remote-resources, the following message is repeated <br>
158 times. Alas the code apparently does not contemplate OVAL files with <br>
more than 65535 lines, so the line numbers are all the same (the actual <br>
number of lines is about 3 million):<br>
<br>
File 'oval.xml' line 65535: Element <br>
'{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Dversion_string" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}version_string</a>':
<br>
This element is not expected. Expected is one of ( <br>
{<a href="http://www.w3.org/2000/09/xmldsig#%7DSignature" rel="noreferrer" target="_blank">http://www.w3.org/2000/09/xmldsig#}Signature</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-common-5%7Dnotes" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-common-5}notes</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5%7Dnotes" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5}notes</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Dplatform" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}platform</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Drp" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}rp</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Dpkg" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}pkg</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Dmajor_release" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}major_release</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Drelease" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}release</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Drebuild" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}rebuild</a>,
<br>
{<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe%7Dios_release" rel="noreferrer" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#iosxe}ios_release</a> ).<br>
<br>
If I omit --fetch-remote-resources, there are a few different errors, <br>
but I guess those don't matter so much?<br>
<br>
So... what to do? Adding --skip-valid to the command doesn't seem like a <br>
solution. If I do that the scan fails almost immediately with:<br>
<br>
W: oscap: Unknown OVAL family subtype: interim_fix<br>
OpenSCAP Error: Unknown test type oval:org.cisecurity:tst:6710. <br>
[/builddir/build/BUILD/openscap-1.3.1/src/OVAL/oval_test.c:395]<br>
Failed to import the OVAL Definitions from 'oval.xml'. <br>
[/builddir/build/BUILD/openscap-1.3.1/src/OVAL/oval_session.c:248]<br>
<br>
Are there some additional definitions that need to be pulled in somehow?<br>
<br>
Thanks!<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Open-scap-list mailing list<br>
<a href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/open-scap-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="gmail-m_8560077989867658009gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>Trevor Vaughan<br>
Vice President, Onyx Point, Inc<br>
</div>
<div>(410) 541-6699 x788<br>
</div>
<div><br>
-- This account not approved for unencrypted proprietary information --</div>
</div>
</div>
</div>
</div>
<br>
..... <br>
</div>
</blockquote>
</div>
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender
immediately and permanently delete the message and any attachments.
<br><br>. . . . .</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br></div><div>(410) 541-6699 x788<br></div><div><br>-- This account not approved for unencrypted proprietary information --</div></div></div></div></div>