Menu
▾
▴
#320 RT doesn't support duplicate Check Value References
XCCDF allows multiple <check-export> elements to reference the same <Value> element. The RT does not allow the analogous situation of multiple <CheckValueRef> elements (in <CheckContent> in <ComplianceCheck>) to reference the same <CheckValue> element.
The UniqueCheckValueRefId uniqueness constraint in the schema needs to be eliminated and the Profile_CheckValue table and DAO code needs to be eliminated or amended.
Note: importing USGCB-Windows-7-x86_xccdf.xml will illustrate the problem as it has two sets non-unique <check-export> elements that reference the same <Value> element.
Added schematron check for non unique check-value value-ids. This check is used to abort the import so that the RT won't crash when validating. The user is presented with an error message saying, "The file contains non-unique check-export value-ids and cannot be imported."
This code should be removed when the schema is changed to support non unique CheckValueRefs.
In revision 910.
Is this still a high priority item? This effectively prevents the USGCB content from being used with the RT, which I imagine is a significant use case.
Fortunately I only had to "fix" 3 instances of the above issue in the USGCB so that the content would get loaded and saved into the RT (stand-alone mode for now, haven't tested on my agency's mysql DB yet).
@vunguyen8: If you look at the USGCB content in depth you'll see that it's totally broken. The instances where they have multiple check exports referencing single values are copy/paste errors. But that's not all, the check exports don't always adhere to scoping constraints and would fail to be processed correctly by an XCCDF engine (as long as the XCCDF engine follows the spec).
I have submitted bugs to the USGCB team and they are going to take care of it. Once they fix the content, it should be able to be imported into the RT.
We are looking into adding this feature into the RT regardless, but as of now, the USGCB content is broken and doesn't follow the rules of XCCDF.
Thanks Bryan for the timely response and clarification. I had suspicions that there were more serious issues with the USGCB and possibility with some other benchmarks on the national checklist program and DISA website.
I hate to beat up on the NIST SCAP Content Validation tool, but shouldn't it catch some of these issues? In theory, if the USGCB has this many issues, then other benchmarks available on the national checklist program could as well. Makes it difficult to point to any particular complex XCCDF document as a "golden example."