Skip to content

Commit 8f435c9

Browse files
bminnixitdependsnetworksjeffkala
authored
Made changes to the URL creation using cpeName instead of virtualMatchString, fixed nxos, added aruba and paloalto, update get_nist_urls() to use NIST_LIB_MAPPER_REVERSE_DICT
Co-authored-by: Ken Celenza <ken@celenza.org> Co-authored-by: Jeff Kala <48843785+jeffkala@users.noreply.github.com>
1 parent 16cc8b8 commit 8f435c9

5 files changed

Lines changed: 74 additions & 60 deletions

File tree

‎docs/user/lib_mapper/nist.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
| NIST | | NORMALIZED |
22
| ---------- | -- | ------ |
3-
| adaptive_security_appliance_software | → | cisco_asa |
4-
| arubaos | → | aruba_os |
5-
| eos | → | arista_eos |
6-
| ios | → | cisco_ios |
7-
| ios_xe | → | cisco_xe |
8-
| ios_xr | → | cisco_xr |
9-
| junos | → | juniper_junos |
10-
| nx-os | → | cisco_nxos |
11-
| pan-os | → | paloalto_panos |
3+
| arista:eos | → | arista_eos |
4+
| arubanetworks:arubaos | → | aruba_os |
5+
| cisco:adaptive_security_appliance_software | → | cisco_asa |
6+
| cisco:ios | → | cisco_ios |
7+
| cisco:ios_xe | → | cisco_xe |
8+
| cisco:ios_xr | → | cisco_xr |
9+
| cisco:nx-os | → | cisco_nxos |
10+
| juniper:junos | → | juniper_junos |
11+
| paloaltonetworks:pan-os | → | paloalto_panos |

‎docs/user/lib_mapper/nist_reverse.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
| NORMALIZED | | NIST |
22
| ---------- | -- | ------ |
3-
| arista_eos | → | eos |
4-
| aruba_os | → | arubaos |
5-
| cisco_asa | → | adaptive_security_appliance_software |
6-
| cisco_ios | → | ios |
7-
| cisco_nxos | → | nx-os |
8-
| cisco_xe | → | ios_xe |
9-
| cisco_xr | → | ios_xr |
10-
| juniper_junos | → | junos |
11-
| paloalto_panos | → | pan-os |
3+
| arista_eos | → | arista:eos |
4+
| aruba_os | → | arubanetworks:arubaos |
5+
| cisco_asa | → | cisco:adaptive_security_appliance_software |
6+
| cisco_ios | → | cisco:ios |
7+
| cisco_nxos | → | cisco:nx-os |
8+
| cisco_xe | → | cisco:ios_xe |
9+
| cisco_xr | → | cisco:ios_xr |
10+
| juniper_junos | → | juniper:junos |
11+
| paloalto_panos | → | paloaltonetworks:pan-os |

‎netutils/lib_mapper.py‎

Lines changed: 20 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -450,16 +450,16 @@
450450
}
451451

452452
# NIST | Normalized
453-
NIST_LIB_MAPPER = {
454-
"adaptive_security_appliance_software": "cisco_asa",
455-
"arubaos": "aruba_os",
456-
"eos": "arista_eos",
457-
"ios": "cisco_ios",
458-
"ios_xe": "cisco_xe",
459-
"ios_xr": "cisco_xr",
460-
"nx-os": "cisco_nxos",
461-
"junos": "juniper_junos",
462-
"pan-os": "paloalto_panos",
453+
NIST_LIB_MAPPER: t.Dict[str, str] = {
454+
"arista:eos": "arista_eos",
455+
"arubanetworks:arubaos": "aruba_os",
456+
"cisco:adaptive_security_appliance_software": "cisco_asa",
457+
"cisco:ios": "cisco_ios",
458+
"cisco:nx-os": "cisco_nxos",
459+
"cisco:ios_xe": "cisco_xe",
460+
"cisco:ios_xr": "cisco_xr",
461+
"juniper:junos": "juniper_junos",
462+
"paloaltonetworks:pan-os": "paloalto_panos",
463463
}
464464

465465
# Normalized | NAPALM
@@ -619,29 +619,16 @@
619619
}
620620

621621
# Normalized | NIST
622-
NIST_LIB_MAPPER_REVERSE = {
623-
"arista_eos": "eos",
624-
"aruba_os": "arubaos",
625-
"cisco_asa": "adaptive_security_appliance_software",
626-
"cisco_ios": "ios",
627-
"cisco_nxos": "nx-os",
628-
"cisco_xe": "ios_xe",
629-
"cisco_xr": "ios_xr",
630-
"juniper_junos": "junos",
631-
"paloalto_panos": "pan-os",
632-
}
633-
634-
# Normalized | NIST reverse dictionary parser for NIST URL generation.
635-
NIST_TO_VENDOR = {
636-
"arista_eos": {"vendor": "arista", "os_name": "eos"},
637-
"aruba_os": {"vendor": "arubanetworks", "os_name": "arubaos"},
638-
"cisco_asa": {"vendor": "cisco", "os_name": "adaptive_security_appliance_software"},
639-
"cisco_ios": {"vendor": "cisco", "os_name": "ios"},
640-
"cisco_nxos": {"vendor": "cisco", "os_name": "nx-os"},
641-
"cisco_xe": {"vendor": "cisco", "os_name": "ios_xe"},
642-
"cisco_xr": {"vendor": "cisco", "os_name": "ios_xr"},
643-
"juniper_junos": {"vendor": "juniper", "os_name": "junos"},
644-
"paloalto_panos": {"vendor": "paloaltonetworks", "os_name": "pan-os"},
622+
NIST_LIB_MAPPER_REVERSE: t.Dict[str, str] = {
623+
"arista_eos": "arista:eos",
624+
"aruba_os": "arubanetworks:arubaos",
625+
"cisco_asa": "cisco:adaptive_security_appliance_software",
626+
"cisco_ios": "cisco:ios",
627+
"cisco_nxos": "cisco:nx-os",
628+
"cisco_xe": "cisco:ios_xe",
629+
"cisco_xr": "cisco:ios_xr",
630+
"juniper_junos": "juniper:junos",
631+
"paloalto_panos": "paloaltonetworks:pan-os",
645632
}
646633

647634
# Deep copy the reverse, where there is no actual translation happening with special

‎netutils/nist.py‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
import re
66
import typing as t
77

8-
from netutils.lib_mapper import NIST_TO_VENDOR
8+
from netutils.lib_mapper import NIST_LIB_MAPPER_REVERSE
99
from netutils.os_version import version_metadata
1010

1111
# Setting up the dataclass values for specific parsers
@@ -247,6 +247,12 @@ def get_nist_vendor_platform_urls(vendor: str, platform: str, version: str) -> t
247247
248248
Returns:
249249
t.List[str]: NIST URLs to search for possible CVE matches
250+
251+
Examples:
252+
>>> from netutils.nist import get_nist_vendor_platform_urls
253+
>>> get_nist_vendor_platform_urls('cisco', 'ios', '15.3')
254+
['https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:cisco:ios:15.3:*']
255+
>>>
250256
"""
251257
platform_data = _os_platform_object_builder(vendor, platform, version).__dict__
252258

@@ -264,10 +270,19 @@ def get_nist_urls(network_driver: str, version: str) -> t.List[str]:
264270
265271
Returns:
266272
t.List[str]: NIST URLs to search for possible CVE matches
273+
274+
Examples:
275+
>>> from netutils.nist import get_nist_urls
276+
>>> get_nist_urls('cisco_ios', '15.3')
277+
['https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:cisco:ios:15.3:*']
278+
>>>
267279
"""
268280
# DICTIONARY FOR VENDOR/PLATFORM TO NETWORK_DRIVER; UPDATE AS NEEDED
269-
network_driver_mappings = NIST_TO_VENDOR
270-
271-
vendor_os = network_driver_mappings[network_driver]
272-
273-
return get_nist_vendor_platform_urls(vendor_os["vendor"], vendor_os["os_name"], version)
281+
vendor_os: str = NIST_LIB_MAPPER_REVERSE.get(network_driver, "")
282+
if not vendor_os:
283+
raise ValueError(
284+
f"The network driver `{network_driver}` has no associated mapping, the supported drivers are {list(NIST_LIB_MAPPER_REVERSE.keys())}."
285+
)
286+
vendor, os_name = vendor_os.split(":")
287+
288+
return get_nist_vendor_platform_urls(vendor, os_name, version)

‎tests/unit/test_nist.py‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
import pytest
44

5-
from netutils.nist import get_nist_urls
5+
from netutils import nist
66

77
platform_nist_urls = [
88
{
@@ -33,6 +33,18 @@
3333

3434
# Testing the composition of the nist url(s) created for a platform
3535
@pytest.mark.parametrize("data", platform_nist_urls)
36-
def test_platform_nist(data):
37-
platform_obj = get_nist_urls(data["sent"]["network_driver"], data["sent"]["version"])
36+
def test_get_nist_urls(data):
37+
platform_obj = nist.get_nist_urls(data["sent"]["network_driver"], data["sent"]["version"])
3838
assert platform_obj == data["received"]
39+
40+
41+
def test_get_nist_urls_failed():
42+
with pytest.raises(
43+
ValueError, match=r"The network driver `fakeos` has no associated mapping, the supported drivers are*"
44+
):
45+
nist.get_nist_urls("fakeos", "15.5")
46+
47+
48+
def test_get_nist_vendor_platform_urls():
49+
platform_obj = nist.get_nist_vendor_platform_urls("cisco", "ios", "15.5")
50+
assert platform_obj == ["https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:cisco:ios:15.5:*"]

0 commit comments

Comments
 (0)