Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the interconnection-component-has-local-protocol constraint #1089

Open
wants to merge 1 commit into
base: canary
Choose a base branch
from
Open

Add the interconnection-component-has-local-protocol constraint #1089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions features/fedramp_extensions.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ Examples:
| information-type-has-integrity-impact |
| information-type-system |
| inter-boundary-component-has-information-type |
| interconnection-component-has-local-protocol |
| interconnection-direction |
| interconnection-security |
| inventory-item-allows-authenticated-scan |
Expand Down Expand Up @@ -382,6 +383,8 @@ Examples:
| information-type-system-PASS.yaml |
| inter-boundary-component-has-information-type-FAIL.yaml |
| inter-boundary-component-has-information-type-PASS.yaml |
| interconnection-component-has-local-protocol-FAIL.yaml |
| interconnection-component-has-local-protocol-PASS.yaml |
| interconnection-direction-FAIL.yaml |
| interconnection-direction-PASS.yaml |
| interconnection-security-FAIL.yaml |
Expand Down
44 changes: 44 additions & 0 deletions src/content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2305,6 +2305,50 @@ approved.</p>
</protocol>
</component>

<component uuid="11111111-2222-4000-8000-009000200002" type="interconnection">
<title>Authorized Connection Information System Name</title>
<description>
<p>Describe the purpose of the external system/service; specifically, provide reasons for connectivity (e.g., system monitoring, system alerting, download updates, etc.)</p>
</description>
<prop name="nature-of-agreement" value="contract" ns="http://fedramp.gov/ns/oscal"/>
<prop name="authentication-method" value="yes" ns="http://fedramp.gov/ns/oscal">
<remarks>
<p>If 'yes', describe the authentication method in the remarks.</p>
<p>If 'no', explain why no authentication is used in the remarks.</p>
<p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
</remarks>
</prop>
<prop name="information-type" class="incoming" value="C.3.5.1" ns="http://fedramp.gov/ns/oscal"/>
<prop name="information-type" class="incoming" value="C.3.5.8" ns="http://fedramp.gov/ns/oscal"/>
<prop name="ipv4-address" class="local" value="10.1.1.1"/>
<prop name="ipv6-address" class="local" value="::ffff:10.1.1.1"/>
<prop name="ipv4-address" class="remote" value="10.2.2.2"/>
<prop name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
<prop name="fqdn" class="local" value="www.example.com"/>
<prop name="uri" class="local" value="https://sample.com#content"/>
<prop name="fqdn" class="remote" value="www.example.com"/>
<prop name="uri" class="remote" value="https://sample.com#content"/>
<prop name="connection-security" value="tls-1.3" ns="http://fedramp.gov/ns/oscal"/>
<link rel="uri" href="https://www.example.com#content"/>
<status state="operational"/>
<responsible-role role-id="provider">
<party-uuid>44444444-2222-4000-8000-004000000001</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-remote">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-local">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="administrator">
<prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="http://fedramp.gov/ns/oscal"/>
<party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
</responsible-role>
</component>


<!-- Appendix M - Inventory -->
<inventory-item uuid="11111111-2222-4000-8000-011000000001">
<description>
Expand Down
48 changes: 48 additions & 0 deletions ...idations/constraints/content/ssp-interconnection-component-has-local-protocol-INVALID.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
<?xml version="1.0" encoding="UTF-8"?>
<?xml-model href="https://github.com/usnistgov/OSCAL/releases/download/v1.1.3/oscal_ssp_schema.xsd" schematypens="http://www.w3.org/2001/XMLSchema" title="OSCAL complete schema"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="df903c4c-6bb5-4b78-8a71-c5baa06a9f2e">
<system-implementation>
<component uuid="11111111-2222-4000-8000-009000200002" type="interconnection">
<title>Authorized Connection Information System Name</title>
<description>
<p>Describe the purpose of the external system/service; specifically, provide reasons for connectivity (e.g., system monitoring, system alerting, download updates, etc.)</p>
</description>
<prop name="nature-of-agreement" value="contract" ns="http://fedramp.gov/ns/oscal"/>
<prop name="authentication-method" value="yes" ns="http://fedramp.gov/ns/oscal">
<remarks>
<p>If 'yes', describe the authentication method in the remarks.</p>
<p>If 'no', explain why no authentication is used in the remarks.</p>
<p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
</remarks>
</prop>
<prop name="information-type" class="incoming" value="C.3.5.1" ns="http://fedramp.gov/ns/oscal"/>
<prop name="information-type" class="incoming" value="C.3.5.8" ns="http://fedramp.gov/ns/oscal"/>
<!--prop name="ipv4-address" class="local" value="10.1.1.1"/>
<prop name="ipv6-address" class="local" value="::ffff:10.1.1.1"/-->
<prop name="ipv4-address" class="remote" value="10.2.2.2"/>
<prop name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
<!--prop name="fqdn" class="local" value="www.example.com"/>
<prop name="uri" class="local" value="https://sample.com#content"/-->
<prop name="fqdn" class="remote" value="www.example.com"/>
<prop name="uri" class="remote" value="https://sample.com#content"/>
<prop name="connection-security" value="tls-1.3" ns="http://fedramp.gov/ns/oscal"/>
<!--link rel="uri" href="https://www.example.com#content"/-->
<status state="operational"/>
<responsible-role role-id="provider">
<party-uuid>44444444-2222-4000-8000-004000000001</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-remote">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-local">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="administrator">
<prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="http://fedramp.gov/ns/oscal"/>
<party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
</responsible-role>
</component>
Comment on lines +5 to +46
Copy link
Contributor

@Gabeblis Gabeblis Jan 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NON-BLOCKING: The constraint looks good, this is just to make the invalid test content a little more clear as to what is being tested.

Suggested change
<component uuid="11111111-2222-4000-8000-009000200002" type="interconnection">
<title>Authorized Connection Information System Name</title>
<description>
<p>Describe the purpose of the external system/service; specifically, provide reasons for connectivity (e.g., system monitoring, system alerting, download updates, etc.)</p>
</description>
<prop name="nature-of-agreement" value="contract" ns="http://fedramp.gov/ns/oscal"/>
<prop name="authentication-method" value="yes" ns="http://fedramp.gov/ns/oscal">
<remarks>
<p>If 'yes', describe the authentication method in the remarks.</p>
<p>If 'no', explain why no authentication is used in the remarks.</p>
<p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
</remarks>
</prop>
<prop name="information-type" class="incoming" value="C.3.5.1" ns="http://fedramp.gov/ns/oscal"/>
<prop name="information-type" class="incoming" value="C.3.5.8" ns="http://fedramp.gov/ns/oscal"/>
<!--prop name="ipv4-address" class="local" value="10.1.1.1"/>
<prop name="ipv6-address" class="local" value="::ffff:10.1.1.1"/-->
<prop name="ipv4-address" class="remote" value="10.2.2.2"/>
<prop name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
<!--prop name="fqdn" class="local" value="www.example.com"/>
<prop name="uri" class="local" value="https://sample.com#content"/-->
<prop name="fqdn" class="remote" value="www.example.com"/>
<prop name="uri" class="remote" value="https://sample.com#content"/>
<prop name="connection-security" value="tls-1.3" ns="http://fedramp.gov/ns/oscal"/>
<!--link rel="uri" href="https://www.example.com#content"/-->
<status state="operational"/>
<responsible-role role-id="provider">
<party-uuid>44444444-2222-4000-8000-004000000001</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-remote">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="isa-poc-local">
<party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
</responsible-role>
<responsible-role role-id="administrator">
<prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="http://fedramp.gov/ns/oscal"/>
<party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
<party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
</responsible-role>
</component>
<component uuid="11111111-2222-4000-8000-009000200002" type="interconnection">
<!-- Missing at least one ipv4-address, ipv6-address, or URI. -->
<!--<prop name="ipv4-address" class="local" value="10.1.1.1"/>-->
<!--<prop name="ipv6-address" class="local" value="::ffff:10.1.1.1"/>-->
<!--<link rel="uri" href="https://www.example.com#content"/>-->
</component>

</system-implementation>
</system-security-plan>
5 changes: 5 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,11 @@
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-information-and-information-types"/>
<message>An inter-boundary communication component {@uuid} ({path(.)}) MUST have at least one information-type property.</message>
</expect>
<expect id="interconnection-component-has-local-protocol" target="component[@type='interconnection']" test="count(prop[@class='local' and @name=('ipv4-address','ipv6-address','fqdn','uri')] | link[@rel='uri']) &gt;= 1" level="ERROR">
<formal-name>Interconnection Component Has Local Protocols</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/"/>
<message>In a FedRAMP SSP, an interconnection component MUST have at least one local IPv4 Address, IPv6 Address, URI, or FQDN.</message>
</expect>
Comment on lines +619 to +623
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<expect id="interconnection-component-has-local-protocol" target="component[@type='interconnection']" test="count(prop[@class='local' and @name=('ipv4-address','ipv6-address','fqdn','uri')] | link[@rel='uri']) &gt;= 1" level="ERROR">
<formal-name>Interconnection Component Has Local Protocols</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/"/>
<message>In a FedRAMP SSP, an interconnection component MUST have at least one local IPv4 Address, IPv6 Address, URI, or FQDN.</message>
</expect>
<expect id="interconnection-component-has-local-protocol" target="component[@type='interconnection']" test="count(prop[@class='local' and @name=('ipv4-address','ipv6-address')] | link[@rel='uri']) &gt;= 1" level="ERROR">
<formal-name>Interconnection Component Has Local Protocols</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/"/>
<message>In a FedRAMP SSP, an interconnection component MUST have at least one local IPv4 Address, IPv6 Address, or URI.</message>
</expect>

<expect id="inventory-item-and-component-has-public" target="(inventory-item | component[@type='service' and prop[@name='implementation-point' and @value='internal']])" test="count(prop[@name='public']) = 1" level="ERROR">
<formal-name>Inventory Item and Component Has Public</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
Expand Down
8 changes: 8 additions & 0 deletions ...validations/constraints/unit-tests/interconnection-component-has-local-protocol-FAIL.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Driver for the invalid interconnection-component-has-local-protocol constraint unit test.
test-case:
name: The invalid interconnection-component-has-local-protocol constraint unit test.
description: Test that the FedRAMP SSP interconnection component does not have local IPv4 Address, IPv6 Address, URI, or FQDN.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
description: Test that the FedRAMP SSP interconnection component does not have local IPv4 Address, IPv6 Address, URI, or FQDN.
description: Test that the FedRAMP SSP interconnection component does not have local IPv4 Address, IPv6 Address, or URI.

content: ../content/ssp-interconnection-component-has-local-protocol-INVALID.xml
expectations:
- constraint-id: interconnection-component-has-local-protocol
result: fail
8 changes: 8 additions & 0 deletions ...validations/constraints/unit-tests/interconnection-component-has-local-protocol-PASS.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Driver for the valid interconnection-component-has-local-protocol constraint unit test.
test-case:
name: The valid interconnection-component-has-local-protocol constraint unit test.
description: Test that the FedRAMP SSP interconnection component has at least one local IPv4 Address, IPv6 Address, URI, or FQDN.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
description: Test that the FedRAMP SSP interconnection component has at least one local IPv4 Address, IPv6 Address, URI, or FQDN.
description: Test that the FedRAMP SSP interconnection component has at least one local IPv4 Address, IPv6 Address, or URI.

content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
expectations:
- constraint-id: interconnection-component-has-local-protocol
result: pass
Loading