From 6f3fc1e54bc7df115c669c77043aec0cf6bdc1be Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 25 Jun 2014 21:36:08 -0400 Subject: [PATCH 001/297] Fixed typo in from_dict() in MalwareConfigurationDetails --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 7670d9c..ebceb0b 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -598,7 +598,7 @@ def from_dict(mal_conf_dict): mal_conf_ = MalwareConfigurationDetails() mal_conf_.storage = MalwareConfigurationStorageDetails.from_dict(mal_conf_dict.get('storage')) mal_conf_.obfuscation = MalwareConfigurationStorageDetails.from_dict(mal_conf_dict.get('obfuscation')) - if mal_dev_dict['configuration_parameter']: + if mal_conf_dict.get('configuration_parameter'): mal_conf_.configuration_parameter = [MalwareConfigurationParameter.from_dict(x) for x in mal_conf_dict.get('configuration_parameter')] return mal_conf_ From 926a3c43baf8e6ff166446ed866254fe4a6c3f5f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 1 Jul 2014 12:43:00 -0400 Subject: [PATCH 002/297] Fixed typo where __init__() was defined as init() --- maec/bundle/bundle_reference.py | 2 +- maec/package/malware_subject_reference.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index 39ea59f..d06a7ad 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -12,7 +12,7 @@ class BundleReference(maec.Entity): _namespace = maec.bundle._namespace - def init(self, bundle_idref = None): + def __init__(self, bundle_idref = None): super(BundleReference, self).__init__() self.bundle_idref = bundle_idref diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 6788bac..04c4534 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -12,7 +12,7 @@ class MalwareSubjectReference(maec.Entity): _namespace = maec.package._namespace - def init(self, malware_subject_idref = None): + def __init__(self, malware_subject_idref = None): super(MalwareSubjectReference, self).__init__() self.malware_subject_idref = malware_subject_idref From efaa560ab8e514c63ba422934c0faa3584604d59 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 3 Jul 2014 11:37:32 -0400 Subject: [PATCH 003/297] Initial commit --- maec/utils/merge.py | 180 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 180 insertions(+) create mode 100644 maec/utils/merge.py diff --git a/maec/utils/merge.py b/maec/utils/merge.py new file mode 100644 index 0000000..568ff7b --- /dev/null +++ b/maec/utils/merge.py @@ -0,0 +1,180 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. +# Methods for merging MAEC documents + +import sys +import itertools +import maec +from copy import deepcopy +from cybox.core import Object +from maec.package.package import Package +from maec.bundle.bundle import Bundle +from maec.package.malware_subject import MalwareSubject, MalwareConfigurationDetails,\ + FindingsBundleList, MetaAnalysis, Analyses,\ + MinorVariants, MalwareSubjectRelationshipList + +def dict_merge(target, *args): + '''Merge multiple dictionaries into one''' + if len(args) > 1: + for obj in args: + dict_merge(target, obj) + return target + + # Recursively merge dicts and set non-dict values + obj = args[0] + if not isinstance(obj, dict): + return obj + for k, v in obj.iteritems(): + if k in target and isinstance(target[k], dict): + dict_merge(target[k], v) + elif k in target and isinstance(target[k], list): + target[k] = (target[k] + v) + else: + target[k] = deepcopy(v) + return target + +def merge_documents(input_list, output_file): + '''Merge a list of input MAEC documents and write them to an output file''' + parsed_documents = [] + # Parse the documents and get their API representation + for input_file in input_list: + api_representation = maec.parse_xml_instance(input_file)['api'] + parsed_documents.append(api_representation) + # Do a sanity check on the input list of documents + for document in parsed_documents: + if isinstance(document, Package): + continue + else: + print 'Error: unsupported document type. Currently only MAEC Packages are supported' + + # Merge the MAEC packages + merge_packages(parsed_documents, output_file) + +def merge_packages(package_list, output_file): + '''Merge a list of input MAEC Packages and write them to an output Package file''' + malware_subjects = [] + # Build the list of Malware Subjects + for package in package_list: + for malware_subject in package.malware_subjects: + malware_subjects.append(malware_subject) + # Merge the Malware Subjects + merged_subjects = merge_malware_subjects(malware_subjects) + # Create a new Package with the merged Malware Subjects + +def bin_malware_subjects(malware_subject_list, default_hash_type='md5'): + '''Bin a list of Malware Subjects by hash + Default = MD5 + ''' + binned_subjects = {} + for malware_subject in malware_subject_list: + mal_inst_obj = malware_subject.malware_instance_object_attributes + if mal_inst_obj: + obj_properties = mal_inst_obj.properties + if obj_properties and obj_properties.hashes: + hashes_list = obj_properties.hashes.to_list() + for hash_dict in hashes_list: + if 'type' in hash_dict and 'simple_hash_value' in hash_dict: + hash_type = '' + hash_value = '' + # Get the hash type + if isinstance(hash_dict['type'], str): + hash_type = str(hash_dict['type']).lower() + elif isinstance(hash_dict['type'], dict): + hash_type = str(hash_dict['type']['value']).lower() + # Get the hash value + if isinstance(hash_dict['simple_hash_value'], str): + hash_value = str(hash_dict['simple_hash_value']).lower() + elif isinstance(hash_dict['simple_hash_value'], dict): + hash_value = str(hash_dict['simple_hash_value']['value']).lower() + + # Check the hash type and bin accordingly + if hash_type == default_hash_type: + if hash_value in binned_subjects: + binned_subjects[hash_value].append(malware_subject) + else: + binned_subjects[hash_value] = [malware_subject] + return binned_subjects + +def merge_entities(entity_list): + '''Merge a list of MAEC/CybOX entities''' + dict_list = [x.to_dict() for x in entity_list] + output_dict = dict_merge({}, *dict_list) + return output_dict + +def deduplicate_vocabulary_list(entity_list): # TODO: Move this to the deduplicator module? + '''Deduplicate a simple list of MAEC/CybOX vocabulary entries''' + temp = [] + output_list = [] + for entity in entity_list: + if entity.value and entity.value not in temp: + temp.append(entity.value) + output_list.append(entity) + return output_list + +def merge_findings_bundles(findings_bundles_list): + '''Merge two or more Malware Subject Findings Bundles''' + # Merge the meta-analysis + merged_meta_analysis = None + meta_analysis_list = [x.meta_analysis for x in findings_bundles_list if x.meta_analysis] + if meta_analysis_list: + merged_meta_analysis = MetaAnalysis.from_dict(merge_entities(meta_analysis_list)) + # Merge the list of bundles + merged_bundles = list(itertools.chain(*[x.bundles for x in findings_bundles_list if x.bundles])) + # Merge the list of external bundle references + merged_bundle_external_references = list(itertools.chain(*[x.bundle_external_references for x in findings_bundles_list if x.bundle_external_references])) + + # Construct the merged Findings Bundle List entity + merged_findings_bundle_list = FindingsBundleList() + if merged_meta_analysis: + merged_findings_bundle_list.meta_analysis = merged_meta_analysis + if merged_bundles: + merged_findings_bundle_list.bundles = merged_bundles + if merged_bundle_external_references: + merged_findings_bundle_list.bundle_external_references = merged_bundle_external_references + + return merged_findings_bundle_list + +def merge_malware_subjects(malware_subject_list): + '''Merge a list of input Malware Subjects''' + output_subjects = [] + # Bin the Malware Subjects by hash + binned_subjects = bin_malware_subjects(malware_subject_list) + # Merge the Malware Subjects that were binned + for binned_list in binned_subjects.values(): + # Make sure we're dealing with at least two subjects + if len(binned_list) > 1: + # Merge the Malware_Instance_Object_Attributes # TODO: Determine what to do with the ID? + # TODO: Deduplicate hashes? + mal_inst_obj_list = [x.malware_instance_object_attributes for x in binned_list] + print merge_entities(mal_inst_obj_list) + merged_inst_obj = Object.from_dict(merge_entities(mal_inst_obj_list)) + # Merge and deduplicate the labels + merged_labels = list(itertools.chain(*[x.label for x in binned_list if x.label])) + deduplicated_labels = deduplicate_vocabulary_list(merged_labels) + # Merge the configuration details + config_details_list = [x.configuration_details for x in binned_list if x.configuration_details] + merged_config_details = None + if config_details_list: + merged_config_details = MalwareConfigurationDetails.from_dict(merge_entities(config_details_list)) + # Merge the minor variants + merged_minor_variants = list(itertools.chain(*[x.minor_variants for x in binned_list if x.minor_variants])) + # Merge the field data # TODO: Add support. Not implemented in the APIs. + # Merge the analyses + merged_analyses = list(itertools.chain(*[x.analyses for x in binned_list if x.analyses])) + # Merge the findings bundles + merged_findings_bundles = merge_findings_bundles([x.findings_bundles for x in binned_list if x.findings_bundles]) + # Merge the relationships # TODO: Determine what to do about the Malware Subject IDs + merged_relationships = list(itertools.chain(*[x.relationships for x in binned_list if x.relationships])) + # Merge the compatible platforms + merged_compatible_platforms = list(itertools.chain(*[x.compatible_platform for x in binned_list if x.compatible_platform])) + + # Build the merged Malware Subject + merged_malware_subject = MalwareSubject() + merged_malware_subject.malware_instance_object_attributes = merged_inst_obj + if deduplicated_labels: merged_malware_subject.label = deduplicated_labels + if merged_config_details: merged_malware_subject.configuration_details = merged_config_details + if merged_minor_variants: merged_malware_subject.minor_variants = MinorVariants(merged_minor_variants) + if merged_analyses: merged_malware_subject.analyses = Analyses(merged_analyses) + if merged_findings_bundles: merged_malware_subject.findings_bundles = merged_findings_bundles + if merged_relationships: merged_malware_subject.relationships = MalwareSubjectRelationshipList(merged_relationships) + if merged_compatible_platforms: merged_malware_subject.compatible_platform = merged_compatible_platforms From 1ef8e12dd4fb9100d482800d56f48e37b2eaf884 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 7 Jul 2014 11:13:33 -0400 Subject: [PATCH 004/297] Generates merged Malware Subjects and creates output Package. Release candidate --- maec/utils/merge.py | 131 +++++++++++++++++++++++++++++++------------- 1 file changed, 93 insertions(+), 38 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 568ff7b..3b3cc30 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -7,11 +7,14 @@ import maec from copy import deepcopy from cybox.core import Object +from cybox.common import HashList +from cybox.utils import Namespace from maec.package.package import Package from maec.bundle.bundle import Bundle from maec.package.malware_subject import MalwareSubject, MalwareConfigurationDetails,\ FindingsBundleList, MetaAnalysis, Analyses,\ - MinorVariants, MalwareSubjectRelationshipList + MinorVariants, MalwareSubjectRelationshipList,\ + MalwareSubjectList def dict_merge(target, *args): '''Merge multiple dictionaries into one''' @@ -53,6 +56,9 @@ def merge_documents(input_list, output_file): def merge_packages(package_list, output_file): '''Merge a list of input MAEC Packages and write them to an output Package file''' malware_subjects = [] + # Instantiate the ID generator class (for automatic ID generation) + NS = Namespace("https://github.com/MAECProject/python-maec", "merged") + maec.utils.set_id_namespace(NS) # Build the list of Malware Subjects for package in package_list: for malware_subject in package.malware_subjects: @@ -60,6 +66,10 @@ def merge_packages(package_list, output_file): # Merge the Malware Subjects merged_subjects = merge_malware_subjects(malware_subjects) # Create a new Package with the merged Malware Subjects + merged_package = Package() + merged_package.malware_subjects = MalwareSubjectList(merged_subjects) + # Write the Package to the output file + merged_package.to_xml_file(output_file, {"https://github.com/MAECProject/python-maec":"merged"}) def bin_malware_subjects(malware_subject_list, default_hash_type='md5'): '''Bin a list of Malware Subjects by hash @@ -101,13 +111,17 @@ def merge_entities(entity_list): output_dict = dict_merge({}, *dict_list) return output_dict -def deduplicate_vocabulary_list(entity_list): # TODO: Move this to the deduplicator module? +def deduplicate_vocabulary_list(entity_list, value_name = "value"): # TODO: Move this to the deduplicator module? '''Deduplicate a simple list of MAEC/CybOX vocabulary entries''' temp = [] output_list = [] for entity in entity_list: - if entity.value and entity.value not in temp: - temp.append(entity.value) + entity_value = getattr(entity, value_name) + entity_lower = str(entity_value).lower() + if entity_value and entity_lower not in temp: + temp.append(entity_lower) + output_list.append(entity) + elif not entity_value: output_list.append(entity) return output_list @@ -134,8 +148,68 @@ def merge_findings_bundles(findings_bundles_list): return merged_findings_bundle_list +def create_mappings(mapping_dict, original_malware_subject_list, merged_malware_subject): + '''Map the IDs of a list of existing Malware Subjects to the new merged Malware Subject''' + for malware_subject in original_malware_subject_list: + mapping_dict[malware_subject.id] = merged_malware_subject.id + +def merge_binned_malware_subjects(merged_malware_subject, binned_list, id_mappings_dict): + '''Merge a list of input binned (related) Malware Subjects''' + # Merge the Malware_Instance_Object_Attributes + mal_inst_obj_list = [x.malware_instance_object_attributes for x in binned_list] + merged_inst_obj = Object.from_dict(merge_entities(mal_inst_obj_list)) + # Give the merged Object a new ID + merged_inst_obj.id_ = maec.utils.idgen.create_id('object') + # Deduplicate the hash values, if they exist + if merged_inst_obj.properties and merged_inst_obj.properties.hashes: + hashes = merged_inst_obj.properties.hashes + hashes = HashList(deduplicate_vocabulary_list(hashes, value_name = 'simple_hash_value')) + hashes = HashList(deduplicate_vocabulary_list(hashes, value_name = 'fuzzy_hash_value')) + merged_inst_obj.properties.hashes = hashes + # Merge and deduplicate the labels + merged_labels = list(itertools.chain(*[x.label for x in binned_list if x.label])) + deduplicated_labels = deduplicate_vocabulary_list(merged_labels) + # Merge the configuration details + config_details_list = [x.configuration_details for x in binned_list if x.configuration_details] + merged_config_details = None + if config_details_list: + merged_config_details = MalwareConfigurationDetails.from_dict(merge_entities(config_details_list)) + # Merge the minor variants + merged_minor_variants = list(itertools.chain(*[x.minor_variants for x in binned_list if x.minor_variants])) + # Merge the field data # TODO: Add support. Not implemented in the APIs. + # Merge the analyses + merged_analyses = list(itertools.chain(*[x.analyses for x in binned_list if x.analyses])) + # Merge the findings bundles + merged_findings_bundles = merge_findings_bundles([x.findings_bundles for x in binned_list if x.findings_bundles]) + # Merge the relationships + merged_relationships = list(itertools.chain(*[x.relationships for x in binned_list if x.relationships])) + # Merge the compatible platforms + merged_compatible_platforms = list(itertools.chain(*[x.compatible_platform for x in binned_list if x.compatible_platform])) + + # Build the merged Malware Subject + merged_malware_subject.malware_instance_object_attributes = merged_inst_obj + if deduplicated_labels: merged_malware_subject.label = deduplicated_labels + if merged_config_details: merged_malware_subject.configuration_details = merged_config_details + if merged_minor_variants: merged_malware_subject.minor_variants = MinorVariants(merged_minor_variants) + if merged_analyses: merged_malware_subject.analyses = Analyses(merged_analyses) + if merged_findings_bundles: merged_malware_subject.findings_bundles = merged_findings_bundles + if merged_relationships: merged_malware_subject.relationships = MalwareSubjectRelationshipList(merged_relationships) + if merged_compatible_platforms: merged_malware_subject.compatible_platform = merged_compatible_platforms + +def update_relationships(malware_subject_list, id_mappings): + '''Update any existing Malware Subject relationships to account for merged Malware Subjects''' + for malware_subject in malware_subject_list: + if malware_subject.relationships: + relationships = malware_subject.relationships + for relationship in relationships: + malware_subject_references = relationship.malware_subject_references + for malware_subject_reference in malware_subject_references: + if malware_subject_reference.malware_subject_idref in id_mappings.keys(): + malware_subject_reference.malware_subject_idref = id_mappings[malware_subject_reference.malware_subject_idref] + def merge_malware_subjects(malware_subject_list): '''Merge a list of input Malware Subjects''' + id_mappings = {} output_subjects = [] # Bin the Malware Subjects by hash binned_subjects = bin_malware_subjects(malware_subject_list) @@ -143,38 +217,19 @@ def merge_malware_subjects(malware_subject_list): for binned_list in binned_subjects.values(): # Make sure we're dealing with at least two subjects if len(binned_list) > 1: - # Merge the Malware_Instance_Object_Attributes # TODO: Determine what to do with the ID? - # TODO: Deduplicate hashes? - mal_inst_obj_list = [x.malware_instance_object_attributes for x in binned_list] - print merge_entities(mal_inst_obj_list) - merged_inst_obj = Object.from_dict(merge_entities(mal_inst_obj_list)) - # Merge and deduplicate the labels - merged_labels = list(itertools.chain(*[x.label for x in binned_list if x.label])) - deduplicated_labels = deduplicate_vocabulary_list(merged_labels) - # Merge the configuration details - config_details_list = [x.configuration_details for x in binned_list if x.configuration_details] - merged_config_details = None - if config_details_list: - merged_config_details = MalwareConfigurationDetails.from_dict(merge_entities(config_details_list)) - # Merge the minor variants - merged_minor_variants = list(itertools.chain(*[x.minor_variants for x in binned_list if x.minor_variants])) - # Merge the field data # TODO: Add support. Not implemented in the APIs. - # Merge the analyses - merged_analyses = list(itertools.chain(*[x.analyses for x in binned_list if x.analyses])) - # Merge the findings bundles - merged_findings_bundles = merge_findings_bundles([x.findings_bundles for x in binned_list if x.findings_bundles]) - # Merge the relationships # TODO: Determine what to do about the Malware Subject IDs - merged_relationships = list(itertools.chain(*[x.relationships for x in binned_list if x.relationships])) - # Merge the compatible platforms - merged_compatible_platforms = list(itertools.chain(*[x.compatible_platform for x in binned_list if x.compatible_platform])) - - # Build the merged Malware Subject + # Instantiate the merged Malware Subject merged_malware_subject = MalwareSubject() - merged_malware_subject.malware_instance_object_attributes = merged_inst_obj - if deduplicated_labels: merged_malware_subject.label = deduplicated_labels - if merged_config_details: merged_malware_subject.configuration_details = merged_config_details - if merged_minor_variants: merged_malware_subject.minor_variants = MinorVariants(merged_minor_variants) - if merged_analyses: merged_malware_subject.analyses = Analyses(merged_analyses) - if merged_findings_bundles: merged_malware_subject.findings_bundles = merged_findings_bundles - if merged_relationships: merged_malware_subject.relationships = MalwareSubjectRelationshipList(merged_relationships) - if merged_compatible_platforms: merged_malware_subject.compatible_platform = merged_compatible_platforms + # Add the ID mappings from the old (merged) subject to the new one + create_mappings(id_mappings, binned_list, merged_malware_subject) + # Perform the merging + merge_binned_malware_subjects(merged_malware_subject, binned_list, id_mappings) + # Add the merged Malware Subject to the output list + output_subjects.append(merged_malware_subject) + # Add the Malware Subjects that weren't merged + for malware_subject in malware_subject_list: + if malware_subject.id not in id_mappings.keys(): + output_subjects.append(malware_subject) + # Update the relationships for the Malware Subjects to account for the merges + update_relationships(output_subjects, id_mappings) + # Return the list of original and merged Malware Subjects + return output_subjects \ No newline at end of file From dd539b1214f5cf1f445cd5989ce3f93e4fb3b2a8 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 7 Jul 2014 13:16:56 -0400 Subject: [PATCH 005/297] Initial commit of merge_packages script --- scripts/merge_packages.py | 59 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 scripts/merge_packages.py diff --git a/scripts/merge_packages.py b/scripts/merge_packages.py new file mode 100644 index 0000000..60190aa --- /dev/null +++ b/scripts/merge_packages.py @@ -0,0 +1,59 @@ +# merge_packages script +# v0.10 BETA +# Merges two or more MAEC Package documents (.xml files) +# Attempts to merge related Malware Subjects +import sys +import os +import maec +from maec.utils.merge import merge_documents + +USAGE_TEXT = """ +MAEC Package Merge Script v0.10 BETA + *Merges two or more MAEC Package XML documents + *Attempts to merge related (e.g., same MD5 hash) Malware Subjects + +Usage: python merge_packages.py -o -l OR -d +""" + +def main(): + infilenames = [] + list_mode = False + directoryname = '' + outfilename = '' + + #Get the command-line arguments + args = sys.argv[1:] + + if len(args) < 3: + print USAGE_TEXT + sys.exit(1) + + for i in range(0,len(args)): + if args[i] == '-o': + outfilename = args[i+1] + elif args[i] == '-l': + list_mode = True + elif args[i] == '-d': + directoryname = args[i+1] + + if outfilename == '': + print USAGE_TEXT + sys.exit(1) + + sys.stdout.write("Merging...") + # Get the list of input files and perform the merge operation + if list_mode: + files = args[3:] + merge_documents(files, outfilename) + elif directoryname != '': + file_list = [] + for filename in os.listdir(directoryname): + if '.xml' not in filename: + pass + else: + file_list.append(os.path.join(directoryname, filename)) + merge_documents(file_list, outfilename) + sys.stdout.write("Done.") + +if __name__ == "__main__": + main() From abecd98bb39acf42db9e5b9c38c5b5f194883e06 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 10:12:40 -0400 Subject: [PATCH 006/297] Added normalize_objects() method for normalizing Objects using the CybOX utils/normalize module --- maec/bundle/bundle.py | 52 +++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index e75678c..99f024a 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -4,12 +4,13 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 06/19/2014 +#Last updated 07/8/2014 import datetime from cybox.core import Object +from cybox.utils.normalize import normalize_object_properties import maec import maec.bindings.maec_bundle as bundle_binding @@ -234,6 +235,33 @@ def add_candidate_indicator(self, candidate_indicator, candidate_indicator_colle elif candidate_indicator_collection_name == None: self.candidate_indicators.append(candidate_indicator) + def deduplicate(self): + BundleDeduplicator.deduplicate(self) + + def get_action_objects(self, action_name_list): + """Get all Objects corresponding to one or more types of Actions, specified via a list of Action names""" + action_objects = {} + all_actions = self.get_all_actions(bin=True) + for action_name in action_name_list: + if action_name in all_actions: + associated_objects = [] + associated_object_lists = [[y for y in x.associated_objects if x.associated_objects] for x in all_actions[action_name]] + for associated_object_list in associated_object_lists: + associated_objects += associated_object_list + action_objects[action_name] = associated_objects + return action_objects + + def get_object_history(self): + """Build and return the Object history for the Bundle""" + return ObjectHistory.build(self) + + def normalize_objects(self): + """Normalize all Objects in the Bundle, using the CybOX normalize module""" + all_objects = self.get_all_objects(include_actions = True) + for object in all_objects: + if object.properties: + normalize_object_properties(object.properties) + def to_obj(self): bundle_obj = bundle_binding.BundleType(id=self.id) #Set the bundle schema version @@ -327,27 +355,7 @@ def from_dict(bundle_dict): @classmethod def compare(cls, bundle_list, match_on = None, case_sensitive = True): - return BundleComparator.compare(bundle_list, match_on, case_sensitive); - - def deduplicate(self): - BundleDeduplicator.deduplicate(self) - - def get_action_objects(self, action_name_list): - """Get all Objects corresponding to one or more types of Actions, specified via a list of Action names""" - action_objects = {} - all_actions = self.get_all_actions(bin=True) - for action_name in action_name_list: - if action_name in all_actions: - associated_objects = [] - associated_object_lists = [[y for y in x.associated_objects if x.associated_objects] for x in all_actions[action_name]] - for associated_object_list in associated_object_lists: - associated_objects += associated_object_list - action_objects[action_name] = associated_objects - return action_objects - - def get_object_history(self): - """Build and return the Object history for the Bundle""" - return ObjectHistory.build(self) + return BundleComparator.compare(bundle_list, match_on, case_sensitive) class ObjectHistory(object): @classmethod From 90325e69806846ceb15bfd28358548983818ff59 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 10:13:38 -0400 Subject: [PATCH 007/297] Added normalize_bundles method for normalizing all Bundles (only Objects for now) in a Malware Subject --- maec/package/malware_subject.py | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index ebceb0b..1170163 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -4,7 +4,7 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 06/24/2014 +#Last updated 07/8/2014 from cybox.common import VocabString, PlatformSpecification, ToolInformationList from cybox.objects.file_object import File @@ -62,6 +62,17 @@ def get_all_bundles(self): def add_findings_bundle(self, bundle): self.findings_bundles.add_bundle(bundle) + def deduplicate_bundles(self): + """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" + for findings_bundle in self.findings_bundles.bundles: + findings_bundle.deduplicate() + + def normalize_bundles(self): + """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.normalize_objects() + def to_obj(self): malware_subject_obj = package_binding.MalwareSubjectType(id = self.id) if self.malware_instance_object_attributes is not None: malware_subject_obj.set_Malware_Instance_Object_Attributes(self.malware_instance_object_attributes.to_obj()) @@ -138,11 +149,6 @@ def from_obj(malware_subject_obj): malware_subject_.compatible_platform = [PlatformSpecification.from_obj(x) for x in malware_subject_obj.get_Compatible_Platform()] return malware_subject_ - def deduplicate_bundles(self): - """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" - for findings_bundle in self.findings_bundles.bundles: - findings_bundle.deduplicate() - class MinorVariants(maec.EntityList): _contained_type = Object _binding_class = package_binding.MinorVariantListType From 256e4fb2ff6a84560d34d741db3471eb8ddfcd4e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 11:06:29 -0400 Subject: [PATCH 008/297] Added dereference_objects() method for dereferencing all Objects in a Bundle --- maec/bundle/bundle.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 99f024a..6510335 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -262,6 +262,16 @@ def normalize_objects(self): if object.properties: normalize_object_properties(object.properties) + def dereference_objects(self): + """Dereference any Objects in the Bundle by replacing them with the entities they reference""" + all_objects = self.get_all_objects(include_actions=True) + for object in all_objects: + if object.idref and not object.id_: + real_object = self.get_object_by_id(object.idref) + object.idref = None + object.id_ = real_object.id_ + object.properties = real_object.properties + def to_obj(self): bundle_obj = bundle_binding.BundleType(id=self.id) #Set the bundle schema version From 77fbe935f88370b0022c4cddd4fac226e9d763ee Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 11:09:44 -0400 Subject: [PATCH 009/297] Added Associated_Objects existence check to get_object_by_id() --- maec/bundle/bundle.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 6510335..f048dc6 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -183,7 +183,8 @@ def get_object_by_id(self, id): if action.id_ == id: return action - for associated_obj in action.associated_objects: + if action.associated_objects: + for associated_obj in action.associated_objects: if associated_obj.id_ == id: return associated_obj @@ -192,9 +193,10 @@ def get_object_by_id(self, id): if action.id_ == id: return action - for associated_obj in action.associated_objects: - if associated_obj.id_ == id: - return associated_obj + if action.associated_objects: + for associated_obj in action.associated_objects: + if associated_obj.id_ == id: + return associated_obj for obj in self.objects: if obj.id_ == id: From 677281c125080a96c7849a66031b33bca070f104 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:29:20 -0400 Subject: [PATCH 010/297] Added dereference_bundles method for dereferencing Objects in MAEC Bundles --- maec/package/malware_subject.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 1170163..6e7d1c4 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -67,6 +67,12 @@ def deduplicate_bundles(self): for findings_bundle in self.findings_bundles.bundles: findings_bundle.deduplicate() + def deference_bundles(self): + """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.dereference_objects() + def normalize_bundles(self): """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" all_bundles = self.get_all_bundles() From 1904d9482e51ad72c1d46838b54e6e1625ff1ddd Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:35:05 -0400 Subject: [PATCH 011/297] Fixed typo in dereference_bundles method --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 6e7d1c4..1492158 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -67,7 +67,7 @@ def deduplicate_bundles(self): for findings_bundle in self.findings_bundles.bundles: findings_bundle.deduplicate() - def deference_bundles(self): + def dereference_bundles(self): """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" all_bundles = self.get_all_bundles() for bundle in all_bundles: From 7d4b0a1f682b57f0e8b9850300c14fe3bb79d058 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:40:27 -0400 Subject: [PATCH 012/297] Updated get_all_objects() to include Malware_Instance_Object_Attributes if included --- maec/bundle/bundle.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index f048dc6..69c4dee 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -166,6 +166,10 @@ def get_all_objects(self, include_actions = False): for related_obj in associated_object.related_objects: all_objects.append(related_obj) + # Add the Object corresponding to the Malware Instance Object Attributes, if specified + if self.malware_instance_object_attributes: + all_objects.append(self.malware_instance_object_attributes) + return all_objects def get_all_multiple_referenced_objects(self): From 583e14428a54da076aa827ba4b7e056de34b78af Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:49:03 -0400 Subject: [PATCH 013/297] Updated dereference_objects() to allow for passing in of extra objects --- maec/bundle/bundle.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 69c4dee..82702c4 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -268,9 +268,11 @@ def normalize_objects(self): if object.properties: normalize_object_properties(object.properties) - def dereference_objects(self): + def dereference_objects(self, extra_objects = []): """Dereference any Objects in the Bundle by replacing them with the entities they reference""" all_objects = self.get_all_objects(include_actions=True) + # Add any extra objects that were passed, e.g. from a Malware Subject + all_objects = all_objects + extra_objects for object in all_objects: if object.idref and not object.id_: real_object = self.get_object_by_id(object.idref) From 3f92620a55bdc2bc7ddd41857892577ed7115b71 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:49:39 -0400 Subject: [PATCH 014/297] Updated dereference_bundles() to pass in Malware_Instance_Object_Attributes --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 1492158..8002f16 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -71,7 +71,7 @@ def dereference_bundles(self): """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" all_bundles = self.get_all_bundles() for bundle in all_bundles: - bundle.dereference_objects() + bundle.dereference_objects([self.malware_instance_object_attributes]) def normalize_bundles(self): """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" From 1a9061d8a6d6ad9c65ccd61848167c2281f88036 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 13:51:55 -0400 Subject: [PATCH 015/297] Updated get_object_by_id() to accept extra_objects as optional parameter --- maec/bundle/bundle.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 82702c4..2b24bea 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -182,7 +182,7 @@ def get_all_non_reference_objects(self): return [x for x in self.get_all_objects(True) if x.id_ and not x.idref] # finds actions and objects by id - def get_object_by_id(self, id): + def get_object_by_id(self, id, extra_objects = []): for action in self.actions: if action.id_ == id: return action @@ -211,6 +211,11 @@ def get_object_by_id(self, id): if obj.id_ == id: return obj + # Test the extra_objects Array + for obj in extra_objects: + if obj.id_ == id: + return obj + #Add a new Named Behavior Collection def add_named_behavior_collection(self, collection_name): if collection_name is not None: @@ -275,7 +280,7 @@ def dereference_objects(self, extra_objects = []): all_objects = all_objects + extra_objects for object in all_objects: if object.idref and not object.id_: - real_object = self.get_object_by_id(object.idref) + real_object = self.get_object_by_id(object.idref, extra_objects) object.idref = None object.id_ = real_object.id_ object.properties = real_object.properties From 4fabe231ec7a26e6e193b5cdb8361218359d0528 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 8 Jul 2014 14:52:37 -0400 Subject: [PATCH 016/297] Added ability to ignore case to get_object_values() --- maec/utils/deduplicator.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 8695805..72e5c5a 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -125,30 +125,33 @@ def map_objects(cls, all_objects): # Returns the value contained in a TypedField or its nested members, if applicable @classmethod - def get_typedfield_values(cls, val, name, values): + def get_typedfield_values(cls, val, name, values, ignoreCase = False): # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): - values.add(name + ":" + str(val)) + if ignoreCase: + values.add(name + ":" + str(val)) + else: + values.add(name + ":" + str(val).lower()) # If it's a list, then we need to iterate through each of its members elif isinstance(val, collections.MutableSequence): for list_item in val: for list_item_property in list_item._get_vars(): - cls.get_typedfield_values(getattr(list_item, str(list_item_property)), name + "/" + str(list_item_property), values) + cls.get_typedfield_values(getattr(list_item, str(list_item_property)), name + "/" + str(list_item_property), values, ignoreCase) # If it's a cybox.Entity, then we need to iterate through its properties elif isinstance(val, cybox.Entity): for item_property in val._get_vars(): - cls.get_typedfield_values(getattr(val, str(item_property)), name + "/" + str(item_property), values) + cls.get_typedfield_values(getattr(val, str(item_property)), name + "/" + str(item_property), values, ignoreCase) # Get the values specified for an object's properties as a set @classmethod - def get_object_values(cls, obj): + def get_object_values(cls, obj, ignoreCase = False): values = set() for typed_field in obj.properties._get_vars(): # Make sure the typed field is comparable if typed_field.comparable: val = getattr(obj.properties, str(typed_field)) if val is not None: - cls.get_typedfield_values(val, str(typed_field), values) + cls.get_typedfield_values(val, str(typed_field), values, ignoreCase) return values # Find a matching object, if it exists From 341e80d139ed006dd36ea8aa9106ee04acd81fd7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 11 Jul 2014 13:48:32 -0400 Subject: [PATCH 017/297] Updated dereference_objects() and get_object_by_id() to ignore actions if special parameter is included --- maec/bundle/bundle.py | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 2b24bea..cc5bf17 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -182,25 +182,26 @@ def get_all_non_reference_objects(self): return [x for x in self.get_all_objects(True) if x.id_ and not x.idref] # finds actions and objects by id - def get_object_by_id(self, id, extra_objects = []): - for action in self.actions: - if action.id_ == id: - return action - - if action.associated_objects: - for associated_obj in action.associated_objects: - if associated_obj.id_ == id: - return associated_obj - - for collection in self.collections.action_collections: - for action in collection.action_list: + def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): + if not ignore_actions: + for action in self.actions: if action.id_ == id: return action - + if action.associated_objects: for associated_obj in action.associated_objects: if associated_obj.id_ == id: return associated_obj + + for collection in self.collections.action_collections: + for action in collection.action_list: + if action.id_ == id: + return action + + if action.associated_objects: + for associated_obj in action.associated_objects: + if associated_obj.id_ == id: + return associated_obj for obj in self.objects: if obj.id_ == id: @@ -280,7 +281,7 @@ def dereference_objects(self, extra_objects = []): all_objects = all_objects + extra_objects for object in all_objects: if object.idref and not object.id_: - real_object = self.get_object_by_id(object.idref, extra_objects) + real_object = self.get_object_by_id(object.idref, extra_objects, ignore_actions = True) object.idref = None object.id_ = real_object.id_ object.properties = real_object.properties From 70b9526ea8ba18192bae9c38ce399809bccc80c9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 1 Aug 2014 15:35:45 -0400 Subject: [PATCH 018/297] Fixed typo in name of constructor for GroupingRelationship --- maec/package/grouping_relationship.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index cc2fda8..c5a30a5 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -14,7 +14,7 @@ class GroupingRelationship(maec.Entity): _namespace = maec.package._namespace - def init(self): + def __init__(self): super(GroupingRelationship, self).__init__() self.type = None self.malware_family_name = None From 55762a0c87d783d28df2a3f405c5eecb5d24afb1 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 1 Aug 2014 15:42:35 -0400 Subject: [PATCH 019/297] Updated to_obj() on MalwareSubject to output findings_bundles only when they have data --- maec/package/malware_subject.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 8002f16..9f92c05 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -87,7 +87,8 @@ def to_obj(self): if self.development_environment: malware_subject_obj.set_Development_Environment(self.development_environment.to_obj()) if self.field_data is not None: malware_subject_obj.set_Field_Data(self.field_data.to_obj()) if self.analyses: malware_subject_obj.set_Analyses(self.analyses.to_obj()) - if self.findings_bundles : malware_subject_obj.set_Findings_Bundles(self.findings_bundles.to_obj()) + if self.findings_bundles and (self.findings_bundles.bundle_external_references or self.findings_bundles.bundles): + malware_subject_obj.set_Findings_Bundles(self.findings_bundles.to_obj()) if self.relationships: malware_subject_obj.set_Relationships(self.relationships.to_obj()) if self.label: for labl in self.label: From 6d75c18f43bf67a583d325a7db60787bec3108fb Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 7 Aug 2014 14:59:01 -0500 Subject: [PATCH 020/297] Add badges to README.rst --- README.rst | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 8c05c09..801006e 100644 --- a/README.rst +++ b/README.rst @@ -3,7 +3,19 @@ python-maec A Python library for parsing, manipulating, and generating MAEC content. -For more information about MAEC, see http://maec.mitre.org. +:Source: https://github.com/MAECProject/python-maec +:Documentation: http://maec.readthedocs.org +:Information: http://maec.mitre.org + +|version badge| |downloads badge| + +..TODO: add Travis Badge + +.. |version badge| image:: https://pypip.in/v/maec/badge.png + :target: https://pypi.python.org/pypi/maec/ +.. |downloads badge| image:: https://pypip.in/d/maec/badge.png + :target: https://pypi.python.org/pypi/maec/ + Overview -------- From aa0752a959ae22910f1fc230bc0bcb4990e9c365 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 7 Aug 2014 15:00:00 -0500 Subject: [PATCH 021/297] Oops --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 801006e..aa2219d 100644 --- a/README.rst +++ b/README.rst @@ -9,7 +9,7 @@ A Python library for parsing, manipulating, and generating MAEC content. |version badge| |downloads badge| -..TODO: add Travis Badge +.. TODO: add Travis Badge .. |version badge| image:: https://pypip.in/v/maec/badge.png :target: https://pypi.python.org/pypi/maec/ From e147b074427742569be2441c3e97082384267d62 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 14 Aug 2014 16:15:40 -0400 Subject: [PATCH 022/297] Cleaned up Entity class; removed methods that were complete duplicates of those in the CybOX.Entity class --- maec/__init__.py | 218 ----------------------------------------------- 1 file changed, 218 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 8b34fd2..44213b8 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -37,207 +37,6 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" - # By default (unless a particular subclass states otherwise), try to "cast" - # invalid objects to the correct class using the constructor. Entity - # subclasses should either provide a "sane" constructor or set this to - # False. - _try_cast = True - - def __init__(self): - self._fields = {} - - @classmethod - def _get_vars(cls): - var_list = [] - for (name, obj) in inspect.getmembers(cls, inspect.isdatadescriptor): - if isinstance(obj, TypedField): - var_list.append(obj) - - return var_list - - def __eq__(self, other): - # This fixes some strange behavior where an object isn't equal to - # itself - if other is self: - return True - - # I'm not sure about this, if we want to compare exact classes or if - # various subclasses will also do (I think not), but for now I'm going - # to assume they must be equal. - GTB - if self.__class__ != other.__class__: - return False - - var_list = self.__class__._get_vars() - - # If there are no TypedFields, assume this class hasn't been - # "TypedField"-ified, so we don't want these to inadvertently return - # equal. - if not var_list: - return False - - for f in var_list: - if not f.comparable: - continue - if getattr(self, f.attr_name) != getattr(other, f.attr_name): - return False - - return True - - def __ne__(self, other): - return not self == other - - def to_obj(self): - """Default implementation of a to_obj function. - - Subclasses can override this function.""" - - entity_obj = self._binding_class() - - for field in self.__class__._get_vars(): - val = getattr(self, field.attr_name) - - if field.multiple: - if val: - val = [x.to_obj() for x in val] - else: - val = [] - elif isinstance(val, Entity): - val = val.to_obj() - - setattr(entity_obj, field.name, val) - - self._finalize_obj(entity_obj) - - return entity_obj - - def _finalize_obj(self, entity_obj): - """Subclasses can define additional items in the binding object. - - `entity_obj` should be modified in place. - """ - pass - - def to_dict(self): - """Default implementation of a to_dict function. - - Subclasses can override this function.""" - - entity_dict = {} - - for field in self.__class__._get_vars(): - val = getattr(self, field.attr_name) - - - if field.multiple: - if val: - val = [x.to_dict() for x in val] - else: - val = [] - elif isinstance(val, Entity): - val = val.to_dict() - - # Only add non-None objects or non-empty lists - if val is not None and val != []: - entity_dict[field.key_name] = val - - self._finalize_dict(entity_dict) - - return entity_dict - - def _finalize_dict(self, entity_dict): - """Subclasses can define additional items in the dictionary. - - `entity_dict` should be modified in place. - """ - pass - - @classmethod - def from_obj(cls, cls_obj=None): - if not cls_obj: - return None - - entity = cls() - - for field in cls._get_vars(): - val = getattr(cls_obj, field.name) - if field.type_: - if field.multiple and val is not None: - val = [field.type_.from_obj(x) for x in val] - else: - val = field.type_.from_obj(val) - setattr(entity, field.attr_name, val) - - return entity - - @classmethod - def from_dict(cls, cls_dict=None): - if cls_dict is None: - return None - - entity = cls() - - # Shortcut if an actual dict is not provided: - if not isinstance(cls_dict, dict): - value = cls_dict - # Call the class's constructor - try: - return cls(value) - except TypeError: - raise TypeError("Could not instantiate a %s from a %s: %s" % - (cls, type(value), value)) - - for field in cls._get_vars(): - val = cls_dict.get(field.key_name) - if field.type_: - if issubclass(field.type_, EntityList): - val = field.type_.from_list(val) - elif field.multiple: - if val is not None: - val = [field.type_.from_dict(x) for x in val] - else: - val = [] - else: - val = field.type_.from_dict(val) - - else: - if field.multiple and not val: - val = [] - setattr(entity, field.attr_name, val) - - return entity - - def to_xml(self, include_namespaces=True, namespace_dict=None, - pretty=True): - """Export an object as an XML String. - - :param include_namespaces: whether to include xmlns and - xsi:schemaLocation attributes on the root element. Set to true by - default. - :type include_namespaces: bool - :param namespace_dict: mapping of additional XML namespaces to prefixes - :type namespace_dict: dict - :param pretty: produce readable (``True``) or compact (``False``) - output. Default is ``True`` - :type pretty: bool - """ - namespace_def = "" - - if include_namespaces: - # Update the namespace dictionary with namespaces found upon import - if namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict.update(self.__input_namespaces__) - elif not namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict = self.__input_namespaces__ - namespace_def = self._get_namespace_def(namespace_dict) - - if not pretty: - namespace_def = namespace_def.replace('\n\t', ' ') - - s = StringIO() - self.to_obj().export(s, 0, namespacedef_=namespace_def, - pretty_print=pretty) - return s.getvalue() - def to_xml_file(self, filename, namespace_dict=None): """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" # Update the namespace dictionary with namespaces found upon import @@ -249,11 +48,6 @@ def to_xml_file(self, filename, namespace_dict=None): out_file.write("\n") self.to_obj().export(out_file, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() - - def to_json(self): - """Export an object as a JSON string. - """ - return json.dumps(self.to_dict()) def _get_namespace_def(self, additional_ns_dict=None): # copy necessary namespaces @@ -311,18 +105,6 @@ def _get_children(self): if isinstance(item, Entity) or isinstance(item, cyboxEntity): yield item - @classmethod - def istypeof(cls, obj): - """Check if `cls` is the type of `obj` - - In the normal case, as implemented here, a simple isinstance check is - used. However, there are more complex checks possible. For instance, - EmailAddress.istypeof(obj) checks if obj is an Address object with - a category of Address.CAT_EMAIL - """ - return isinstance(obj, cls) - - class EntityList(collections.MutableSequence, Entity): _contained_type = object From 3b8eb00116c06b07d8044b73a49f8866d0f635fc Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 14 Aug 2014 16:28:05 -0400 Subject: [PATCH 023/297] Converted BundleReference to TypedField implementation --- maec/bundle/bundle_reference.py | 32 +++++--------------------------- 1 file changed, 5 insertions(+), 27 deletions(-) diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index d06a7ad..77c17a7 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -4,41 +4,19 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 02/18/2014 +#Last updated 08/14/2014 import maec import maec.bindings.maec_bundle as bundle_binding class BundleReference(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.BundleReferenceType + + bundle_idref = maec.TypedField("bundle_idref") def __init__(self, bundle_idref = None): super(BundleReference, self).__init__() self.bundle_idref = bundle_idref - - def to_obj(self): - bundle_reference_obj = bundle_binding.BundleReferenceType() - if self.bundle_idref is not None : bundle_reference_obj.set_bundle_idref(self.bundle_idref) - return bundle_reference_obj - - def to_dict(self): - bundle_reference_dict = {} - if self.bundle_idref is not None : bundle_reference_dict['bundle_idref'] = self.bundle_idref - return bundle_reference_dict - - @staticmethod - def from_dict(bundle_reference_dict): - if not bundle_reference_dict: - return None - bundle_reference_ = BundleReference() - bundle_reference_.bundle_idref = bundle_reference_dict.get('bundle_idref') - return bundle_reference_ - - @staticmethod - def from_obj(bundle_reference_obj): - if not bundle_reference_obj: - return None - bundle_reference_ = BundleReference() - bundle_reference_.bundle_idref = bundle_reference_obj.get_bundle_idref() - return bundle_reference_ \ No newline at end of file From 47f54afff45dd8a07ad5fad31106ef43b8c559d7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 19 Aug 2014 16:12:09 -0400 Subject: [PATCH 024/297] Initial commit of distance-related classes --- maec/analytics/__init__.py | 0 maec/analytics/distance.py | 589 ++++++++++++++++++++++++++++++ maec/analytics/static_features.py | 78 ++++ 3 files changed, 667 insertions(+) create mode 100644 maec/analytics/__init__.py create mode 100644 maec/analytics/distance.py create mode 100644 maec/analytics/static_features.py diff --git a/maec/analytics/__init__.py b/maec/analytics/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py new file mode 100644 index 0000000..c956671 --- /dev/null +++ b/maec/analytics/distance.py @@ -0,0 +1,589 @@ +# MAEC Distance Measure-related Classes - BETA +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved + +# See LICENSE.txt for complete terms +import sys +try: + import numpy +except ImportError: + sys.stdout.write("Error: unable to import required numpy module.\nSee https://pypi.python.org/pypi/numpy.") +import os +import subprocess +import maec +import itertools +import math +from maec.package.package import Package +from maec.package.malware_subject import MalwareSubject +from maec.utils.deduplicator import BundleDeduplicator +from maec.utils.merge import merge_malware_subjects +from maec.analytics.static_features import static_features_dict + +class DynamicFeatureVector(object): + '''Generate a feature vector for a Malware Subject based on its dynamic features''' + def __init__(self, malware_subject, deduplicator): + self.deduplicator = deduplicator + self.dynamic_features = [] + self.unique_dynamic_features = [] + # List of ignored object attributes + self.ignored_object_properties = ['address', + 'hashes/simple_hash_value', + 'id_', + 'type_', + 'pid', + 'size_in_bytes'] + # List of ignored actions - not useful/difficult to correlate on + self.ignored_actions = ['map view of section', + 'create section', + 'create thread', + 'open section'] + # Extract the features and build the vector + self.extract_features(malware_subject) + # Calculate the unique features + self.get_unique_features() + + def create_action_vector(self, action): + '''Create a vector from a single Action''' + action_vector = set() + # Add the Action Name to the set + if action.name: + action_vector.add("act:" + action.name.value) + # Add the Object values to the set + if action.associated_objects: + for associated_object in action.associated_objects: + if associated_object.properties: + object_vector = self.deduplicator.get_object_values(associated_object) + updated_vector = set() + for entry in object_vector: + updated_vector.add(entry.replace(',', ';').rstrip('\n')) + action_vector.update(updated_vector) + return action_vector + + def create_dynamic_vectors(self, malware_subject): + '''Create a vector of unique action/object pairs for an input Malware Subject''' + action_vectors = [] + # Extract the Bundles from the Malware Subject + bundles = malware_subject.get_all_bundles() + for bundle in bundles: + # Create the vector for each Action + all_actions = bundle.get_all_actions() + for action in all_actions: + action_vector = self.create_action_vector(action) + if action_vector: + action_vectors.append(action_vector) + return action_vectors + + def extract_features(self, malware_subject): + '''Extract the dynamic features from the Malware Subject''' + # Extract the Dynamic (Action) features + self.dynamic_features = self.create_dynamic_vectors(malware_subject) + # Prune the Dynamic features + self.prune_dynamic_features() + + def prune_dynamic_features(self, min_length = 2): + '''Prune the dynamic features based on ignored Object properties/Actions''' + pruned_dynamic_features = [] + for dynamic_vector in self.dynamic_features: + ignore_vector = False + pruned_vector = set() + # Do the minimum length check (to prune Actions with no Objects) + if len(dynamic_vector) < min_length: + continue + # Prune any vectors with ignored actions or object properites + for entity in dynamic_vector: + split_entity = str(entity).split(':') + if split_entity[0] == 'act': + action_name = split_entity[1] + if action_name in self.ignored_actions: + ignore_vector = True + break + else: + pruned_vector.add(entity) + elif split_entity[0] in self.ignored_object_properties: + continue + else: + pruned_vector.add(entity) + if ignore_vector: + continue + else: + pruned_dynamic_features.append(pruned_vector) + # Update the existing dynamic feature with the pruned versions + self.dynamic_features = pruned_dynamic_features + + def get_unique_features(self): + '''Calculates the unique set of dynamic features for the Malware Subject''' + self.unique_dynamic_features = [x for x in self.dynamic_features if self.dynamic_features.count(x) == 1] + +class StaticFeatureVector(object): + '''Generate a feature vector for a Malware Subject based on its static features''' + def __init__(self, malware_subject, deduplicator): + self.deduplicator = deduplicator + self.static_features = {} + self.unique_static_features = {} + # Extract the features and build the vector + self.extract_features(malware_subject) + # Calculate the unique features + self.get_unique_features() + + def create_object_vector(self, object, static_feature_dict, callback_function = None): + '''Create a vector from a single Object''' + object_vector = self.deduplicator.get_object_values(object) + for entity_string in object_vector: + split_string = entity_string.split(':') + feature_path = str(split_string[0]) + feature_value = str(split_string[1]).lower() + # Test if this is a feature that we want to keep + if feature_path in static_features_dict.keys(): + feature_dict = static_features_dict[feature_path] + feature_name = feature_dict['feature_name'] + # Set the key in the object feature dictionary + if feature_name in static_feature_dict: + # Test if multiple values are allowed for this feature + if 'options' in feature_dict and 'allow_multiple' in feature_dict['options']: + if isinstance(static_feature_dict[feature_name], list): + static_feature_dict[feature_name].append(feature_value) + else: + static_feature_dict[feature_name] = [static_feature_dict[feature_name], feature_value] + # If they're not allowed, use a callback function to determine what to do + # E.g., if two different tools report the same value differently, this can be used to resolve that + # Callback function parameters : feature name, existing feature value, new feature value + elif callback_function: + existing_value = static_feature_dict[feature_name] + static_feature_dict[feature_name] = callback_function(feature_name, existing_value, feature_value) + + else: + static_feature_dict[feature_name] = feature_value + + def create_static_vectors(self, malware_subject): + '''Create a vector of static features for an input Malware Subject''' + static_feature_dict = {} + # Extract any feature from the Malware Instance Object Attributes of the Malware Subject + if malware_subject.malware_instance_object_attributes and malware_subject.malware_instance_object_attributes.properties: + # Add the properties of the Object to the feature dict + self.create_object_vector(malware_subject.malware_instance_object_attributes, static_feature_dict) + # Extract any feature from the Bundles in the Malware Subject + bundles = malware_subject.get_all_bundles() + for bundle in bundles: + # Test the Bundle's content_type to make sure we're dealing with static analysis tool output + if bundle.content_type and bundle.content_type == 'static analysis tool output': + # Extract the Objects from the Bundle + for obj in bundle.get_all_objects(): + if obj.properties: + # Add the properties of the Object to the feature dict + self.create_object_vector(obj, static_feature_dict) + if static_feature_dict: + return static_feature_dict + + def extract_features(self, malware_subject): + '''Extract the static features from the Malware Subject''' + # Extract the Static features + self.static_features = self.create_static_vectors(malware_subject) + + def get_unique_features(self): + '''Calculates the unique set of static features for the Malware Subject''' + self.unique_static_features = {} + for feature_name, feature_value in self.static_features.items(): + # Prune any list-type values + if isinstance(feature_value, list): + pruned_value_list = [] + for value in feature_value: + if value not in pruned_value_list: + pruned_value_list.append(value) + self.unique_static_features[feature_name] = pruned_value_list + else: + self.unique_static_features[feature_name] = feature_value + +class Distance(object): + '''Calculates distance between two or more MAEC entities. + Currently supports only Packages or Malware Subjects.''' + def __init__(self, maec_entity_list): + self.maec_entity_list = maec_entity_list + self.deduplicator = BundleDeduplicator() + self.feature_vectors = {} + self.superset_dynamic_vectors = [] + self.superset_static_vectors = {} + # A list of normalized/merged Malware Subjects + self.normalized_subjects = [] + # Dictionary of distances + # Key = Malware Subject ID + # Value = dictionary of distances + # key = Malware Subject ID + # value = distance + self.distances = {} + # Dictionary of static features to use in the distance calculation + # Also, defines how they should be post-processed/compared + # NOTE: The default features here are merely a suggestion + # Options: + # datatype = Required. The datatype of the values for the feature. + # Possible values: hex, hex list, int, int list, float, float list, string. + # normalize = Optional. Normalize/scale the data. + # True by default. + # scale_log = Optional. Use logarithmic scaling for the list of numeric features. + # True by default. + # bin = Optional. For numerical features, use bins for the distance measure. + # number of bins = Optional. Valid only if bin = true. The number of bins to use in binning. + # use_raw_value = Optional. Use the raw value for the field, without any post-processing. + # All other options are ignored when this setting is used. + self.compared_static_features = {'imported_files' : {'datatype' : 'string'}, + 'section_entropies' : {'datatype' : 'float list', 'scale log' : False}, + 'section_virtual_sizes' : {'datatype' : 'hex list','scale log' : False}, + 'address_of_entry_point' : {'datatype' : 'hex', 'scale log' : False, 'bin' : True}, + 'size_in_bytes' : {'datatype' : 'int', 'bin' : True}, + 'size_of_initialized_data' : {'datatype' : 'hex', 'scale log' : False, 'bin' : True, 'number of bins' : 5}, + 'size_of_image' : {'datatype' : 'hex', 'bin' : True}} + + def bin_list(self, numeric_value, numeric_list, n=10): + '''Bin a numeric value into a bucket, based on a parent list of values. + N = number of buckets to use (default = 10).''' + bin_vector = numpy.array([0] * n) + # Sanity checking for lists with a single value + if len(numeric_list) == 1: + bin_vector = numpy.array([0] * n) + bin_vector[n-1] = 1 + return bin_vector + max_list = max(numeric_list) + min_list = min(numeric_list) + bucket_size = (max_list-min_list)/n + bin_value = int(math.floor((numeric_value - min_list)/bucket_size)) + if bin_value == n: + bin_value -= 1 + bin_vector[bin_value] = 1 + return bin_vector + + def add_log(self, number, log_list): + '''Added a log'd (log-ized??) number to a list''' + if number != 0: + log_list.append(float(math.log(number))) + else: + log_list.append(float(number)) + + def normalize_numeric(self, numeric_value, numeric_list, normalize = True, scale_log = True): + '''Scale a numeric value, based on a parent list of values. + Return the scaled/normalized form.''' + # Sanity check for zeros + if numeric_value == 0: + return float(0) + if normalize: + if scale_log: + log_list = [] + for number in numeric_list: + self.add_log(number, log_list) + return math.log(float(numeric_value))/max(log_list) + else: + return float(numeric_value)/max(numeric_list) + else: + return numeric_value + + def normalize_numeric_list(self, value_list, numeric_list, normalize = True, scale_log = True): + '''Scale a list of numeric values, based on a parent list of numeric value lists. + Return the scaled/normalized form.''' + # Find the maximum length of all of the lists + max_len = max(len(p) for p in numeric_list) + if normalize: + # Find the maximum value in all of the lists + max_val = max(max(p) for p in numeric_list) + if scale_log: + log_list = [] + for vector_entry in value_list: + self.add_log(vector_entry, log_list) + # Scale the list + scaled_list = [float(x)/math.log(max_val) for x in log_list] + scaled_vector = numpy.array(scaled_list) + # Resize the vector + scaled_vector.resize(max_len, refcheck = False) + return scaled_vector + else: + # Scale the list + scaled_list = [float(x)/max_val for x in value_list] + scaled_vector = numpy.array(scaled_list) + # Resize the vector + scaled_vector.resize(max_len, refcheck = False) + return scaled_vector + else: + # Resize the vector + return value_list.resize(max_len, refcheck = False) + + def build_string_vector(self, string_list, superset_string_list, ignore_case = True): + '''Build a vector from an input list of strings and superset list of strings.''' + # Flatten the superset list + flattened_string_list = self.flatten_vector(superset_string_list) + # List of ignored/skipped strings + ignored_strings = ['none'] + # List of unique strings + unique_strings = [] + # First, build up the unique strings + for string in flattened_string_list: + normalized_string = string + # Ignore case if specified + if ignore_case: + normalized_string = string.lower() + if normalized_string not in ignored_strings and normalized_string not in unique_strings: + unique_strings.append(normalized_string) + # Next, build the actual strings vector + string_vector = numpy.array([0] * len(unique_strings)) + normalized_string_list = string_list + # Ignore case if specified + if ignore_case: + normalized_string_list = [str(x).lower() for x in string_list] + for i in range(0, len(unique_strings)): + if unique_strings[i] in normalized_string_list: + string_vector[i] = 1 + else: + string_vector[i] = 0 + return string_vector + + def preprocess_entities(self, dereference = True): + '''Pre-process the MAEC entities''' + malware_subjects = [] + # Dereference and normalize the Malware Subjects in the Package + for entity in self.maec_entity_list: + # Test if we're dealing with a package or Malware Subject + if isinstance(entity, Package): + action_vectors = [] + for malware_subject in entity.malware_subjects: + # Dereference the Bundles in the Malware Subject + if dereference: + malware_subject.dereference_bundles() + # Normalize the Bundles in the Malware Subject + malware_subject.normalize_bundles() + # Add the Malware Subject to the list + malware_subjects.append(malware_subject) + elif isinstance(entity, MalwareSubject): + # Dereference the Bundles in the Malware Subject + if dereference: + entity.dereference_bundles() + # Normalize the Bundles in the Malware Subject + entity.normalize_bundles() + # Add the Malware Subject to the list + malware_subjects.append(malware_subject) + # Merge the Malware Subjects by hash (if possible) + return merge_malware_subjects(malware_subjects) + + def generate_feature_vectors(self, merged_subjects): + '''Generate a feature vector for the binned Malware Subjects''' + for malware_subject in merged_subjects: + feature_vector_dict = {'dynamic' : DynamicFeatureVector(malware_subject, self.deduplicator), + 'static' : StaticFeatureVector(malware_subject, self.deduplicator)} + self.feature_vectors[malware_subject.id] = feature_vector_dict + + def flatten_vector(self, vector_entry_list): + '''Generate a single, flattened vector from an input list of vectors or values.''' + component_list = [] + for vector_entry in vector_entry_list: + if isinstance(vector_entry, numpy.ndarray) or isinstance(vector_entry, list): + for component in vector_entry: + component_list.append(component) + else: + component_list.append(vector_entry) + return component_list + + def normalize_vectors(self, vector_1, vector_2): + '''Normalize two input vectors so that they have similar composition.''' + for i in range(0, len(vector_1)): + if type(vector_1[i]) != type(vector_2[i]): + if isinstance(vector_1[i], numpy.ndarray) and not isinstance(vector_2[i], numpy.ndarray): + vector_2[i] = numpy.array([0] * len(vector_1[i])) + elif not isinstance(vector_1[i], numpy.ndarray) and isinstance(vector_2[i], numpy.ndarray): + vector_1[i] = numpy.array([0] * len(vector_2[i])) + + def create_static_result_vector(self, static_vector): + '''Construct the static result (matching) vector for a corresponding feature vector''' + results_vector = [] + for feature_name in self.compared_static_features: + # Test if we wish to use the feature in the comparison + if feature_name in static_vector.unique_static_features: + # Get the value of the feature + feature_value = static_vector.unique_static_features[feature_name] + # Get the options dictionary for the feature + feature_options_dict = self.compared_static_features[feature_name] + feature_items = self.superset_static_vectors[feature_name] + # Check if the raw value setting is specified + if 'use_raw_value' in feature_options_dict: + results_vector.append(feature_value) + continue + # Determine if numeric values should be logarithmically scaled - true by default + scale_log = True + if 'scale log' in feature_options_dict: + scale_log = feature_options_dict['scale log'] + # Determine if numeric values should be normalized - true by default + normalize = True + if 'normalize' in feature_options_dict: + normalize = feature_options_dict['normalize'] + # Normalize the items for the feature based on the specified datatype + # Use this to construct the results vector + # Normalize on hex values + normalized_value = None + if feature_options_dict['datatype'] == 'hex': + converted_types = [int(x,0) for x in feature_items] + normalized_value = self.normalize_numeric(int(feature_value,0), converted_types, normalize, scale_log) + # Normalize on lists of hex values + if feature_options_dict['datatype'] == 'hex list': + converted_types = [numpy.array([int(x, 0) for x in y]) for y in feature_items] + normalized_value = self.normalize_numeric_list(numpy.array([int(x,0) for x in feature_value]), converted_types, normalize, scale_log) + # Normalize on int values + elif feature_options_dict['datatype'] == 'int': + converted_types = [int(x) for x in feature_items] + normalized_value = self.normalize_numeric(int(feature_value), converted_types, normalize, scale_log) + # Normalize on lists of int values + elif feature_options_dict['datatype'] == 'int list': + converted_types = [numpy.array([int(x) for x in y]) for y in feature_items] + normalized_value = self.normalize_numeric_list(numpy.array([int(x) for x in feature_value]), converted_types, normalize, scale_log) + # Normalize on float values + elif feature_options_dict['datatype'] == 'float': + converted_types = [float(x) for x in feature_items] + normalized_value = self.normalize_numeric(float(feature_value), converted_types, normalize, scale_log) + # Normalize on lists of float values + elif feature_options_dict['datatype'] == 'float list': + converted_types = [numpy.array([float(x) for x in y]) for y in feature_items] + normalized_value = self.normalize_numeric_list(numpy.array([float(x) for x in feature_value]), converted_types, normalize, scale_log) + # Normalize on string values + elif feature_options_dict['datatype'] == 'string': + string_vector = self.build_string_vector(feature_value, feature_items) + results_vector.append(string_vector) + # Bin any values, if specified in the options dictionary + if 'bin' in feature_options_dict and feature_options_dict['bin']: + normalized_items = [self.normalize_numeric(x, converted_types, scale_log) for x in converted_types] + if 'number of bins' in feature_options_dict: + bin = self.bin_list(normalized_value, normalized_items, feature_options_dict['number of bins']) + else: + bin = self.bin_list(normalized_value, normalized_items) + results_vector.append(bin) + elif normalized_value is not None: + results_vector.append(normalized_value) + else: + results_vector.append(0) + return results_vector + + def create_dynamic_result_vector(self, dynamic_vector): + '''Construct the dynamic result (matching) vector for a corresponding feature vector''' + # First, construct the results vector for the dynamic vectors + results_vector = numpy.array([0] * len(self.superset_dynamic_vectors)) + i = 0 + for vector in self.superset_dynamic_vectors: + if vector in dynamic_vector.unique_dynamic_features: + results_vector[i] = 1 + i+= 1 + return results_vector + + def create_superset_vectors(self): + '''Calculate vector supersets from the feature vectors''' + for feature_vector_dict in self.feature_vectors.values(): + dynamic_vector = feature_vector_dict['dynamic'] + static_vector = feature_vector_dict['static'] + # Build the superset of dynamic vectors + for vector in dynamic_vector.unique_dynamic_features: + if vector not in self.superset_dynamic_vectors: + self.superset_dynamic_vectors.append(vector) + # Build the superset of static vectors + for feature_name, feature_value in static_vector.unique_static_features.items(): + if feature_name not in self.superset_static_vectors: + self.superset_static_vectors[feature_name] = [feature_value] + else: + self.superset_static_vectors[feature_name].append(feature_value) + + def euclidean_distance(self, vector_1, vector_2): + '''Calculate the Euclidean distance between two input vectors''' + distance = 0.0 + for i in range(0, len(vector_1)): + if isinstance(vector_1[i], float): + distance += math.pow(vector_1[i] - vector_2[i], 2) + elif isinstance(vector_1[i], numpy.ndarray): + for vi in range(0, len(vector_1[i])): + distance += math.pow(vector_1[i][vi] - vector_2[i][vi], 2) + elif isinstance(vector_1[i], int): + if vector_1[i] != vector_2[i]: + distance += 1.0 + elif isinstance(vector_1[i], str): + if vector_1[i] != vector_2[i]: + distance += 1.0 + return math.sqrt(distance) + + def populate_hashes_mapping(self, malware_subject_list): + '''Populate and return the Malware Subject -> Hashes mapping from an input list of Malware Subjects.''' + hashes_mapping = {} + for malware_subject in malware_subject_list: + mal_inst_obj = malware_subject.malware_instance_object_attributes + if mal_inst_obj.properties and mal_inst_obj.properties.hashes: + hashes_dict = {} + for hash in mal_inst_obj.properties.hashes: + type = None + value = None + if hash.type_: + type = hash.type_.value + if hash.simple_hash_value: + value = hash.simple_hash_value.value + elif hash.fuzzy_hash_value: + value = hash.fuzzy_hash_value.value + if type and value: + hashes_dict[str(type).lower()] = str(value).lower() + hashes_mapping[malware_subject.id] = hashes_dict + return hashes_mapping + + def calculate(self, options_dict = None): + '''Calculate the distances between the input Malware Subject list''' + # Pre-process and merge the entities + self.normalized_subjects = self.preprocess_entities() + # Generate the feature vectors for the entities + self.generate_feature_vectors(self.normalized_subjects) + # Build up the supersets of unique vectors + self.create_superset_vectors() + # Construct the result vectors + for feature_vector_dict in self.feature_vectors.values(): + # Construct the dynamic result vector + feature_vector_dict['dynamic_result'] = self.create_dynamic_result_vector(feature_vector_dict['dynamic']) + # Construct the static result vector + feature_vector_dict['static_result'] = self.create_static_result_vector(feature_vector_dict['static']) + + # Do the distance calculation + # Determine the different combinations of Malware Subjects + combinations = itertools.combinations(self.feature_vectors, r=2) + for combination in combinations: + dynamic_vectors = (self.feature_vectors[combination[0]]['dynamic_result'], + self.feature_vectors[combination[1]]['dynamic_result']) + static_vectors = (self.feature_vectors[combination[0]]['static_result'], + self.feature_vectors[combination[1]]['static_result']) + # Normalize the static vectors (to make them equal length) + self.normalize_vectors(static_vectors[0], static_vectors[1]) + # Generate the combined vectors + combined_vectors = (numpy.array(list(dynamic_vectors[0]) + self.flatten_vector(static_vectors[0])), + numpy.array(list(dynamic_vectors[1]) + self.flatten_vector(static_vectors[1]))) + distance = self.euclidean_distance(combined_vectors[0], combined_vectors[1]) + # Add the result to the distances dictionary + for i in range(0,2): + opposite = 1 - i + if combination[i] not in self.distances: + self.distances[combination[i]] = {combination[opposite] : distance} + else: + self.distances[combination[i]][combination[opposite]] = distance + + def print_distances(self, default_label = 'md5', delimiter = ','): + '''Print the distances between the Malware Subjects in delimited matrix format. + Try to use the MD5s of the Malware Subjects as the default label. + Uses commas as the default delimiter, for CSV-like output.''' + hashes_mapping = self.populate_hashes_mapping(self.normalized_subjects) + distance_strings = [] + # Generate the header string and individual distance strings + header_string = '' + delimiter + for malware_subject in self.normalized_subjects: + distance_string = '' + hashes = hashes_mapping[malware_subject.id] + if default_label in hashes: + distance_string += (hashes[default_label] + delimiter) + header_string += (hashes[default_label] + delimiter) + else: + distance_string += (malware_subject.id + delimiter) + header_string += (malware_subject.id + delimiter) + for other_malware_subject in self.normalized_subjects: + if malware_subject.id == other_malware_subject.id: + distance_string += ('0.0' + delimiter) + else: + distance_string += (str(self.distances[malware_subject.id][other_malware_subject.id]) + + delimiter) + distance_strings.append(distance_string.rstrip(delimiter)) + + # Print the header and distance strings + print header_string.rstrip(delimiter) + for distance_string in distance_strings: + print distance_string + + diff --git a/maec/analytics/static_features.py b/maec/analytics/static_features.py new file mode 100644 index 0000000..f045b85 --- /dev/null +++ b/maec/analytics/static_features.py @@ -0,0 +1,78 @@ +# MAEC Static Features List +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved + +static_features_dict = {'file_name' : {'feature_name' : 'file_name'}, + 'file_path' : {'feature_name' : 'file_path'}, + 'size_in_bytes' : {'feature_name' : 'size_in_bytes'}, + 'file_format' : {'feature_name' : 'file_format'}, + 'peak_entropy' : {'feature_name' : 'peak_entropy'}, + 'headers/dos_header/e_cblp' : {'feature_name' : 'e_cblp'}, + 'headers/dos_header/e_cp' : {'feature_name' : 'e_cp'}, + 'headers/dos_header/e_crlc' : {'feature_name' : 'e_crlc'}, + 'headers/dos_header/e_cparhdr' : {'feature_name' : 'e_cparhdr'}, + 'headers/dos_header/e_minalloc' : {'feature_name' : 'e_minalloc'}, + 'headers/dos_header/e_maxalloc' : {'feature_name' : 'e_maxalloc'}, + 'headers/dos_header/e_ss' : {'feature_name' : 'e_ss'}, + 'headers/dos_header/e_sp' : {'feature_name' : 'e_sp'}, + 'headers/dos_header/e_csum' : {'feature_name' : 'e_csum'}, + 'headers/dos_header/e_ip' : {'feature_name' : 'e_ip'}, + 'headers/dos_header/e_cs' : {'feature_name' : 'e_cs'}, + 'headers/dos_header/e_lfarlc' : {'feature_name' : 'e_lfarlc'}, + 'headers/dos_header/e_ovro' : {'feature_name' : 'e_ovro'}, + 'headers/dos_header/e_oemid' : {'feature_name' : 'e_oemid'}, + 'headers/dos_header/e_oeminfo' : {'feature_name' : 'e_oeminfo'}, + 'headers/dos_header/e_lfanew' : {'feature_name' : 'e_lfanew'}, + 'headers/file_header/machine' : {'feature_name' : 'machine'}, + 'headers/file_header/number_of_sections' : {'feature_name' : 'number_of_sections'}, + 'headers/file_header/time_date_stamp' : {'feature_name' : 'time_date_stamp'}, + 'headers/file_header/pointer_to_symbol_table' : {'feature_name' : 'pointer_to_symbol_table'}, + 'headers/file_header/number_of_symbols' : {'feature_name' : 'number_of_symbols'}, + 'headers/file_header/size_of_optional_header' : {'feature_name' : 'size_of_optional_header'}, + 'headers/optional_header/major_linker_version' : {'feature_name' : 'major_linker_version'}, + 'headers/optional_header/minor_linker_version' : {'feature_name' : 'minor_linker_version'}, + 'headers/optional_header/size_of_code' : {'feature_name' : 'size_of_code'}, + 'headers/optional_header/size_of_initialized_data' : {'feature_name' : 'size_of_initialized_data'}, + 'headers/optional_header/address_of_entry_point' : {'feature_name' : 'address_of_entry_point'}, + 'headers/optional_header/base_of_code' : {'feature_name' : 'base_of_code'}, + 'headers/optional_header/base_of_data' : {'feature_name' : 'base_of_data'}, + 'headers/optional_header/image_base' : {'feature_name' : 'image_base'}, + 'headers/optional_header/section_alignment' : {'feature_name' : 'section_alignment'}, + 'headers/optional_header/file_alignment' : {'feature_name' : 'file_alignment'}, + 'headers/optional_header/major_os_version' : {'feature_name' : 'major_os_version'}, + 'headers/optional_header/minor_os_version' : {'feature_name' : 'minor_os_version'}, + 'headers/optional_header/major_image_version' : {'feature_name' : 'major_image_version'}, + 'headers/optional_header/minor_image_version' : {'feature_name' : 'minor_image_version'}, + 'headers/optional_header/major_subsystem_version' : {'feature_name' : 'major_subsystem_version'}, + 'headers/optional_header/minor_subsystem_version' : {'feature_name' : 'minor_subsystem_version'}, + 'headers/optional_header/win32_version_value' : {'feature_name' : 'win32_version_value'}, + 'headers/optional_header/size_of_image' : {'feature_name' : 'size_of_image'}, + 'headers/optional_header/size_of_headers' : {'feature_name' : 'size_of_headers'}, + 'headers/optional_header/checksum' : {'feature_name' : 'checksum'}, + 'headers/optional_header/subsystem' : {'feature_name' : 'subsystem'}, + 'headers/optional_header/size_of_stack_reserve' : {'feature_name' : 'size_of_stack_reserve'}, + 'headers/optional_header/size_of_stack_commit' : {'feature_name' : 'size_of_stack_commit'}, + 'headers/optional_header/size_of_heap_reserve' : {'feature_name' : 'size_of_heap_reserve'}, + 'headers/optional_header/size_of_heap_commit' : {'feature_name' : 'size_of_heap_commit'}, + 'headers/optional_header/loader_flags' : {'feature_name' : 'loader_flags'}, + 'headers/optional_header/number_of_rva_and_sizes' : {'feature_name' : 'number_of_rva_and_sizes'}, + 'imports/file_name' : {'feature_name' : 'imported_files', + 'options' : ['allow_multiple']}, + 'imports/imported_functions/function_name' : {'feature_name' : 'imported_functions', + 'options' : ['allow_multiple']}, + 'resources/type' : {'feature_name' : 'resource_types', + 'options' : ['allow_multiple']}, + 'resources/name' : {'feature_name' : 'resource_names', + 'options' : ['allow_multiple']}, + 'resources/size' : {'feature_name' : 'resource_sizes', + 'options' : ['allow_multiple']}, + 'resources/language' : {'feature_name' : 'resource_languages', + 'options' : ['allow_multiple']}, + 'sections/section_header/name' : {'feature_name' : 'section_names', + 'options' : ['allow_multiple']}, + 'sections/section_header/virtual_size' : {'feature_name' : 'section_virtual_sizes', + 'options' : ['allow_multiple']}, + 'sections/section_header/virtual_address' : {'feature_name' : 'section_virtual_addresses', + 'options' : ['allow_multiple']}, + 'sections/entropy/value' : {'feature_name' : 'section_entropies', + 'options' : ['allow_multiple']}} \ No newline at end of file From afd20eee97a30b61ba41fbac361727b70924d6ce Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 20 Aug 2014 09:25:38 -0400 Subject: [PATCH 025/297] Moved all ignored_ dictionaries into Distance class and added options_dict for specifying basic options --- maec/analytics/distance.py | 105 ++++++++++++++++++++++--------------- 1 file changed, 64 insertions(+), 41 deletions(-) diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py index c956671..c4f76b1 100644 --- a/maec/analytics/distance.py +++ b/maec/analytics/distance.py @@ -21,22 +21,12 @@ class DynamicFeatureVector(object): '''Generate a feature vector for a Malware Subject based on its dynamic features''' - def __init__(self, malware_subject, deduplicator): + def __init__(self, malware_subject, deduplicator, ignored_object_properties, ignored_actions): self.deduplicator = deduplicator self.dynamic_features = [] self.unique_dynamic_features = [] - # List of ignored object attributes - self.ignored_object_properties = ['address', - 'hashes/simple_hash_value', - 'id_', - 'type_', - 'pid', - 'size_in_bytes'] - # List of ignored actions - not useful/difficult to correlate on - self.ignored_actions = ['map view of section', - 'create section', - 'create thread', - 'open section'] + self.ignored_object_properties = ignored_object_properties + self.ignored_actions = ignored_actions # Extract the features and build the vector self.extract_features(malware_subject) # Calculate the unique features @@ -198,6 +188,12 @@ class Distance(object): Currently supports only Packages or Malware Subjects.''' def __init__(self, maec_entity_list): self.maec_entity_list = maec_entity_list + # Options dictionary + # currently available options: + # use_dynamic_features : True/False. Use dynamic features (Actions) in the distance calculation. + # use_static_features : True/False. Use static features (File/PE attributes) in the distance calculation. + self.options_dict = {'use_dynamic_features' : True, + 'use_static_features' : True} self.deduplicator = BundleDeduplicator() self.feature_vectors = {} self.superset_dynamic_vectors = [] @@ -212,7 +208,7 @@ def __init__(self, maec_entity_list): self.distances = {} # Dictionary of static features to use in the distance calculation # Also, defines how they should be post-processed/compared - # NOTE: The default features here are merely a suggestion + # NOTE: The default features here are merely a suggestion! # Options: # datatype = Required. The datatype of the values for the feature. # Possible values: hex, hex list, int, int list, float, float list, string. @@ -231,6 +227,18 @@ def __init__(self, maec_entity_list): 'size_in_bytes' : {'datatype' : 'int', 'bin' : True}, 'size_of_initialized_data' : {'datatype' : 'hex', 'scale log' : False, 'bin' : True, 'number of bins' : 5}, 'size_of_image' : {'datatype' : 'hex', 'bin' : True}} + # List of ignored object attributes, for use in dynamic vector creation + self.ignored_object_properties = ['address', + 'hashes/simple_hash_value', + 'id_', + 'type_', + 'pid', + 'size_in_bytes'] + # List of ignored actions (not useful/difficult to correlate on), for use in dynamic vector creation + self.ignored_actions = ['map view of section', + 'create section', + 'create thread', + 'open section'] def bin_list(self, numeric_value, numeric_list, n=10): '''Bin a numeric value into a bucket, based on a parent list of values. @@ -362,7 +370,7 @@ def preprocess_entities(self, dereference = True): def generate_feature_vectors(self, merged_subjects): '''Generate a feature vector for the binned Malware Subjects''' for malware_subject in merged_subjects: - feature_vector_dict = {'dynamic' : DynamicFeatureVector(malware_subject, self.deduplicator), + feature_vector_dict = {'dynamic' : DynamicFeatureVector(malware_subject, self.deduplicator, self.ignored_object_properties, self.ignored_actions), 'static' : StaticFeatureVector(malware_subject, self.deduplicator)} self.feature_vectors[malware_subject.id] = feature_vector_dict @@ -519,35 +527,31 @@ def populate_hashes_mapping(self, malware_subject_list): hashes_mapping[malware_subject.id] = hashes_dict return hashes_mapping - def calculate(self, options_dict = None): - '''Calculate the distances between the input Malware Subject list''' - # Pre-process and merge the entities - self.normalized_subjects = self.preprocess_entities() - # Generate the feature vectors for the entities - self.generate_feature_vectors(self.normalized_subjects) - # Build up the supersets of unique vectors - self.create_superset_vectors() - # Construct the result vectors - for feature_vector_dict in self.feature_vectors.values(): - # Construct the dynamic result vector - feature_vector_dict['dynamic_result'] = self.create_dynamic_result_vector(feature_vector_dict['dynamic']) - # Construct the static result vector - feature_vector_dict['static_result'] = self.create_static_result_vector(feature_vector_dict['static']) - - # Do the distance calculation + def perform_calculation(self): + '''Perform the actual distance calculation. + Store the results in the distances dictionary.''' # Determine the different combinations of Malware Subjects combinations = itertools.combinations(self.feature_vectors, r=2) for combination in combinations: - dynamic_vectors = (self.feature_vectors[combination[0]]['dynamic_result'], - self.feature_vectors[combination[1]]['dynamic_result']) - static_vectors = (self.feature_vectors[combination[0]]['static_result'], - self.feature_vectors[combination[1]]['static_result']) - # Normalize the static vectors (to make them equal length) - self.normalize_vectors(static_vectors[0], static_vectors[1]) - # Generate the combined vectors - combined_vectors = (numpy.array(list(dynamic_vectors[0]) + self.flatten_vector(static_vectors[0])), - numpy.array(list(dynamic_vectors[1]) + self.flatten_vector(static_vectors[1]))) - distance = self.euclidean_distance(combined_vectors[0], combined_vectors[1]) + if self.options_dict['use_dynamic_features']: + dynamic_vectors = (self.feature_vectors[combination[0]]['dynamic_result'], + self.feature_vectors[combination[1]]['dynamic_result']) + if self.options_dict['use_static_features']: + static_vectors = (self.feature_vectors[combination[0]]['static_result'], + self.feature_vectors[combination[1]]['static_result']) + # Normalize the static vectors (to make them equal length) + self.normalize_vectors(static_vectors[0], static_vectors[1]) + # Generate the combined vectors if necessary and calculate the distance + if self.options_dict['use_dynamic_features'] and self.options_dict['use_static_features']: + result_vectors = (numpy.array(list(dynamic_vectors[0]) + self.flatten_vector(static_vectors[0])), + numpy.array(list(dynamic_vectors[1]) + self.flatten_vector(static_vectors[1]))) + elif self.options_dict['use_dynamic_features'] and not self.options_dict['use_static_features']: + result_vectors = (numpy.array(list(dynamic_vectors[0])), + numpy.array(list(dynamic_vectors[1]))) + elif not self.options_dict['use_dynamic_features'] and self.options_dict['use_static_features']: + result_vectors = (self.flatten_vector(static_vectors[0]), + self.flatten_vector(static_vectors[1])) + distance = self.euclidean_distance(result_vectors[0], result_vectors[1]) # Add the result to the distances dictionary for i in range(0,2): opposite = 1 - i @@ -556,6 +560,25 @@ def calculate(self, options_dict = None): else: self.distances[combination[i]][combination[opposite]] = distance + def calculate(self): + '''Calculate the distances between the input Malware Subjects.''' + # Pre-process and merge the entities + self.normalized_subjects = self.preprocess_entities() + # Generate the feature vectors for the entities + self.generate_feature_vectors(self.normalized_subjects) + # Build up the supersets of unique vectors + self.create_superset_vectors() + # Construct the result vectors + for feature_vector_dict in self.feature_vectors.values(): + if self.options_dict['use_dynamic_features']: + # Construct the dynamic result vector + feature_vector_dict['dynamic_result'] = self.create_dynamic_result_vector(feature_vector_dict['dynamic']) + if self.options_dict['use_static_features']: + # Construct the static result vector + feature_vector_dict['static_result'] = self.create_static_result_vector(feature_vector_dict['static']) + # Perform the actual distance calculation + self.perform_calculation() + def print_distances(self, default_label = 'md5', delimiter = ','): '''Print the distances between the Malware Subjects in delimited matrix format. Try to use the MD5s of the Malware Subjects as the default label. From 0aadbcc185a24098d60b7139b9e1cf034451aadb Mon Sep 17 00:00:00 2001 From: apsillers Date: Wed, 20 Aug 2014 15:38:13 -0400 Subject: [PATCH 026/297] Update Package classes to TypeField implementation --- maec/package/action_equivalence.py | 59 +- maec/package/analysis.py | 746 ++++++------------ maec/package/grouping_relationship.py | 355 +++------ maec/package/malware_subject.py | 898 +++++++--------------- maec/package/malware_subject_reference.py | 66 +- maec/package/object_equivalence.py | 88 +-- maec/package/package.py | 181 ++--- 7 files changed, 761 insertions(+), 1632 deletions(-) diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index 4604584..ebc9686 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -1,31 +1,30 @@ -#MAEC Action Equivalence Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -import maec -import maec.bindings.maec_package as package_binding -from cybox.core import ActionReference - - -class ActionEquivalence(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ActionEquivalenceType - _namespace = maec.package._namespace - - id = maec.TypedField('id') - action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) - - def __init__(self): - super(ActionEquivalence, self).__init__() - self.id = maec.utils.idgen.create_id(prefix="action_equivalence") - - -class ActionEquivalenceList(maec.EntityList): - _contained_type = ActionEquivalence - _binding_class = package_binding.ActionEquivalenceListType - _binding_var = "Action_Equivalence" +#MAEC Action Equivalence Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +from cybox.core import ActionReference + +class ActionEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ActionEquivalenceType + _namespace = maec.package._namespace + + id = maec.TypedField('id') + action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) + + def __init__(self): + super(ActionEquivalence, self).__init__() + self.id = maec.utils.idgen.create_id(prefix="action_equivalence") + self.action_reference = None + +class ActionEquivalenceList(maec.EntityList): + _contained_type = ActionEquivalence + _binding_class = package_binding.ActionEquivalenceListType + _binding_var = "Action_Equivalence" _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 8f8573e..98b3856 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -1,515 +1,231 @@ -#MAEC Analysis Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -from cybox.common import (PlatformSpecification, Personnel, StructuredText, - ToolInformation) -from cybox.objects.system_object import System - -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.bundle_reference import BundleReference - - -class Analysis(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): - super(Analysis, self).__init__() - if id: - self.id = id - else: - self.id = maec.utils.idgen.create_id(prefix="analysis") - self.method = method - self.type = type - self.ordinal_position = None - self.start_datetime = None - self.complete_datetime = None - self.lastupdate_datetime = None - self.source = None - self.analysts = None - self.summary = None - self.comments = None - self.findings_bundle_reference = findings_bundle_reference - self.tools = ToolList() - self.dynamic_analysis_metadata = None - self.analysis_environment = None - self.report = None - - #"Public" methods - def set_findings_bundle(self, bundle_id): - self.findings_bundle_reference = [BundleReference.from_dict({'bundle_idref' : bundle_id})] - - def add_tool(self, tool): - self.tools.append(tool) - - #Return a bindings object - def to_obj(self): - analysis_obj = package_binding.AnalysisType() - if self.id is not None : analysis_obj.set_id(self.id) - if self.method is not None: analysis_obj.set_method(self.method) - if self.type is not None: analysis_obj.set_type(self.type) - if self.ordinal_position is not None : analysis_obj.set_ordinal_position(self.ordinal_position) - if self.complete_datetime is not None: analysis_obj.set_complete_datetime(self.complete_datetime) - if self.start_datetime is not None : analysis_obj.set_start_datetime(self.start_datetime) - if self.lastupdate_datetime is not None : analysis_obj.set_lastupdate_datetime(self.lastupdate_datetime) - if self.source is not None : analysis_obj.set_Source(self.source.to_obj()) - if self.analysts is not None : analysis_obj.set_Analysts(self.analysts.to_obj()) - if self.summary is not None : analysis_obj.set_Summary(self.summary.to_obj()) - if self.comments is not None : analysis_obj.set_Comments(self.comments.to_obj()) - if self.findings_bundle_reference is not None : - for findings_bundle_ref in self.findings_bundle_reference: - analysis_obj.add_Findings_Bundle_Reference(findings_bundle_ref.to_obj()) - if self.tools: analysis_obj.set_Tools(self.tools.to_obj()) - if self.dynamic_analysis_metadata is not None : analysis_obj.set_Dynamic_Analysis_Metadata(self.dynamic_analysis_metadata.to_obj()) - if self.analysis_environment is not None : analysis_obj.set_Analysis_Environment(self.analysis_environment.to_obj()) - if self.report is not None : analysis_obj.set_Report(self.report.to_obj()) - return analysis_obj - - def to_dict(self): - analysis_dict = {} - if self.id is not None: analysis_dict['id'] = self.id - if self.method is not None: analysis_dict['method'] = self.method - if self.type is not None: analysis_dict['type'] = self.type - if self.ordinal_position is not None : analysis_dict['ordinal_position'] = self.ordinal_position - if self.complete_datetime is not None: analysis_dict['complete_datetime'] = self.complete_datetime - if self.start_datetime is not None : analysis_dict['start_datetime'] = self.start_datetime - if self.lastupdate_datetime is not None : analysis_dict['lastupdate_datetime'] = self.lastupdate_datetime - if self.source is not None : analysis_dict['source'] = self.source.to_dict() - if self.analysts is not None : analysis_dict['analysts'] = self.analysts.to_list() - if self.summary is not None : analysis_dict['summary'] = self.summary.to_dict() - if self.comments is not None : analysis_dict['comments'] = self.comments.to_list() - if self.findings_bundle_reference is not None : - analysis_dict['findings_bundle_reference'] = [x.to_dict() for x in self.findings_bundle_reference] - if self.tools: analysis_dict['tools'] = self.tools.to_list() - if self.dynamic_analysis_metadata is not None : analysis_dict['dynamic_analysis_metadata'] = self.dynamic_analysis_metadata.to_dict() - if self.analysis_environment is not None : analysis_dict['analysis_environment'] = self.analysis_environment.to_dict() - if self.report is not None : analysis_dict['report'] = self.report.to_dict() - return analysis_dict - - #Create and return the Analysis from the input dictionary - @staticmethod - def from_obj(analysis_obj): - if not analysis_obj: - return None - analysis_ = Analysis(None) - analysis_.id = analysis_obj.get_id() - analysis_.method = analysis_obj.get_method() - analysis_.type = analysis_obj.get_type() - analysis_.ordinal_position = analysis_obj.get_ordinal_position() - analysis_.complete_datetime = analysis_obj.get_complete_datetime() - analysis_.start_datetime = analysis_obj.get_start_datetime() - analysis_.lastupdate_datetime = analysis_obj.get_lastupdate_datetime() - analysis_.source = Source.from_obj(analysis_obj.get_Source()) - analysis_.analysts = Personnel.from_obj(analysis_obj.get_Analysts()) - analysis_.summary = StructuredText.from_obj(analysis_obj.get_Summary()) - analysis_.comments = CommentList.from_obj(analysis_obj.get_Comments()) - if analysis_obj.get_Findings_Bundle_Reference(): - analysis_.findings_bundle_reference = [BundleReference.from_obj(x) for x in analysis_obj.get_Findings_Bundle_Reference()] - analysis_.tools = ToolList.from_obj(analysis_obj.get_Tools()) - analysis_.dynamic_analysis_metadata = DynamicAnalysisMetadata.from_obj(analysis_obj.get_Dynamic_Analysis_Metadata()) - analysis_.analysis_environment = AnalysisEnvironment.from_obj(analysis_obj.get_Analysis_Environment()) - analysis_.report = StructuredText.from_obj(analysis_obj.get_Report()) - return analysis_ - - #Create and return the Analysis from the input dictionary - @staticmethod - def from_dict(analysis_dict): - if not analysis_dict: - return None - analysis_ = Analysis(None) - analysis_.id = analysis_dict.get('id') - analysis_.method = analysis_dict.get('method') - analysis_.type = analysis_dict.get('type') - analysis_.ordinal_position = analysis_dict.get('ordinal_position') - analysis_.complete_datetime = analysis_dict.get('complete_datetime') - analysis_.start_datetime = analysis_dict.get('start_datetime') - analysis_.lastupdate_datetime = analysis_dict.get('lastupdate_datetime') - analysis_.source = Source.from_dict(analysis_dict.get('source')) - analysis_.analysts = Personnel.from_list(analysis_dict.get('analysts')) - analysis_.summary = StructuredText.from_dict(analysis_dict.get('summary')) - analysis_.comments = CommentList.from_list(analysis_dict.get('comments')) - if analysis_dict.get('findings_bundle_reference'): - analysis_.findings_bundle_reference = [BundleReference.from_dict(x) for x in analysis_dict.get('findings_bundle_reference')] - analysis_.tools = ToolList.from_list(analysis_dict.get('tools', [])) - analysis_.dynamic_analysis_metadata = DynamicAnalysisMetadata.from_dict(analysis_dict.get('dynamic_analysis_metadata')) - analysis_.analysis_environment = AnalysisEnvironment.from_dict(analysis_dict.get('analysis_environment')) - analysis_.report = StructuredText.from_dict(analysis_dict.get('report')) - return analysis_ - -class Comment(StructuredText): - _namespace = maec.package._namespace - - def __init__(self): - super(Comment, self).__init__() - self.author = None - self.timestamp = None - self.observation_name = None - - def is_plain(self): - """Whether this can be represented as a string rather than a dictionary - """ - return (super(Comment, self).is_plain() and - self.author is None and - self.timestamp is None and - self.observation_name is None) - - def to_obj(self): - comment_obj = super(Comment, self).to_obj(package_binding.CommentType()) - if self.author is not None : comment_obj.set_author(self.author) - if self.timestamp is not None : comment_obj.set_timestamp(self.timestamp) - if self.observation_name is not None : comment_obj.set_observation_name(self.observation_name) - return comment_obj - - def to_dict(self): - comment_dict = super(Comment, self).to_dict() - if self.author is not None : comment_dict['author'] = self.author - if self.timestamp is not None : comment_dict['timestamp'] = self.timestamp - if self.observation_name is not None : comment_dict['observation_name'] = self.observation_name - return comment_dict - - @staticmethod - def from_dict(comment_dict): - if not comment_dict: - return None - comment_ = StructuredText.from_dict(comment_dict, Comment()) - comment_.author = comment_dict.get('author') - comment_.timestamp = comment_dict.get('timestamp') - comment_.observation_name = comment_dict.get('observation_name') - return comment_ - - @staticmethod - def from_obj(comment_obj): - if not comment_obj: - return None - comment_ = StructuredText.from_obj(comment_obj, Comment()) - comment_.author = comment_obj.get_author() - comment_.timestamp = comment_obj.get_timestamp() - comment_.observation_name = comment_obj.get_observation_name() - return comment_ - -class CommentList(maec.EntityList): - _contained_type = Comment - _binding_class = package_binding.CommentListType - _binding_var = "Comment" - _namespace = maec.package._namespace - -class DynamicAnalysisMetadata(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(DynamicAnalysisMetadata, self).__init__() - self.command_line = None - self.analysis_duration = None - self.exit_code = None - - def to_obj(self): - dynamic_analysis_metadata_obj = package_binding.DynamicAnalysisMetadataType() - if self.command_line is not None : dynamic_analysis_metadata_obj.set_Command_Line(self.command_line) - if self.analysis_duration is not None : dynamic_analysis_metadata_obj.set_Analysis_Duration(self.analysis_duration) - if self.exit_code is not None : dynamic_analysis_metadata_obj.set_Exit_Code(self.exit_code) - return dynamic_analysis_metadata_obj - - def to_dict(self): - dynamic_analysis_metadata_dict = {} - if self.command_line is not None : dynamic_analysis_metadata_dict['command_line'] = self.command_line - if self.analysis_duration is not None : dynamic_analysis_metadata_dict['analysis_duration'] = self.analysis_duration - if self.exit_code is not None : dynamic_analysis_metadata_dict['exit_code'] = self.exit_code - return dynamic_analysis_metadata_dict - - @staticmethod - def from_dict(dynamic_analysis_metadata_dict): - if not dynamic_analysis_metadata_dict: - return None - dynamic_analysis_metadata_ = DynamicAnalysisMetadata() - dynamic_analysis_metadata_.command_line = dynamic_analysis_metadata_dict.get('command_line') - dynamic_analysis_metadata_.analysis_duration = dynamic_analysis_metadata_dict.get('analysis_duration') - dynamic_analysis_metadata_.exit_code = dynamic_analysis_metadata_dict.get('exit_code') - return dynamic_analysis_metadata_ - - @staticmethod - def from_obj(dynamic_analysis_metadata_obj): - if not dynamic_analysis_metadata_obj: - return None - dynamic_analysis_metadata_ = DynamicAnalysisMetadata() - dynamic_analysis_metadata_.command_line = dynamic_analysis_metadata_obj.get_Command_Line() - dynamic_analysis_metadata_.analysis_duration = dynamic_analysis_metadata_obj.get_Analysis_Duration() - dynamic_analysis_metadata_.exit_code = dynamic_analysis_metadata_obj.get_Exit_Code() - return dynamic_analysis_metadata_ - -class AnalysisEnvironment(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(AnalysisEnvironment, self).__init__() - self.hypervisor_host_system = None - self.analysis_systems = None - self.network_infrastructure = None - - def to_obj(self): - analysis_environment_obj = package_binding.AnalysisEnvironmentType() - if self.hypervisor_host_system is not None : analysis_environment_obj.set_Hypervisor_Host_System(self.hypervisor_host_system.to_obj()) - if self.analysis_systems is not None : analysis_environment_obj.set_Analysis_Systems(self.analysis_systems.to_obj()) - if self.network_infrastructure is not None : analysis_environment_obj.set_Network_Infrastructure(self.network_infrastructure.to_obj()) - return analysis_environment_obj - - def to_dict(self): - analysis_environment_dict = {} - if self.hypervisor_host_system is not None : analysis_environment_dict['hypervisor_host_system'] = self.hypervisor_host_system.to_dict() - if self.analysis_systems is not None : analysis_environment_dict['analysis_systems'] = self.analysis_systems.to_list() - if self.network_infrastructure is not None : analysis_environment_dict['network_infrastructure'] = self.network_infrastructure.to_dict() - return analysis_environment_obj - - @staticmethod - def from_dict(analysis_environment_dict): - if not analysis_environment_dict: - return None - analysis_environment_ = AnalysisEnvironment() - analysis_environment_.hypervisor_host_system = HypervisorHostSystem.from_dict(analysis_environment_dict.get('hypervisor_host_system')) - analysis_environment_.analysis_systems = AnalysisSystemList.from_list(analysis_environment_dict.get('analysis_systems')) - analysis_environment_.network_infrastructure = NetworkInfrastructure.from_dict(analysis_environment_dict.get('network_infrastructure')) - return analysis_environment_ - - @staticmethod - def from_obj(analysis_environment_obj): - if not analysis_environment_obj: - return None - analysis_environment_ = AnalysisEnvironment() - analysis_environment_.hypervisor_host_system = HypervisorHostSystem.from_obj(analysis_environment_obj.get_Hypervisor_Host_System()) - analysis_environment_.analysis_systems = AnalysisSystemList.from_obj(analysis_environment_obj.get_Analysis_Systems()) - analysis_environment_.network_infrastructure = NetworkInfrastructure.from_obj(analysis_environment_obj.get_Network_Infrastructure()) - return analysis_environment_ - -class HypervisorHostSystem(System): - _namespace = maec.package._namespace - - def __init__(self): - super(HypervisorHostSystem, self).__init__() - self.vm_hypervisor = None - - def to_obj(self): - hypervisor_host_system_obj = super(HypervisorHostSystem, self).to_obj(package_binding.HypervisorHostSystemType()) - if self.vm_hypervisor is not None : hypervisor_host_system_obj.set_VM_Hypervisor(self.vm_hypervisor.to_obj()) - return hypervisor_host_system_obj - - def to_dict(self): - hypervisor_host_system_dict = super(HypervisorHostSystem, self).to_dict() - if self.vm_hypervisor is not None : hypervisor_host_system_dict['vm_hypervisor'] = self.vm_hypervisor.to_dict() - return hypervisor_host_system_dict - - @staticmethod - def from_dict(hypervisor_host_system_dict): - if not hypervisor_host_system_dict: - return None - hypervisor_host_system_ = System.from_dict(hypervisor_host_system_dict, HypervisorHostSystem()) - hypervisor_host_system_.vm_hypervisor = PlatformSpecification.from_dict(hypervisor_host_system_dict.get('vm_hypervisor')) - return hypervisor_host_system_ - - @staticmethod - def from_obj(hypervisor_host_system_obj): - if not hypervisor_host_system_obj: - return None - hypervisor_host_system_ = System.from_obj(hypervisor_host_system_obj, HypervisorHostSystem()) - hypervisor_host_system_.vm_hypervisor = PlatformSpecification.from_obj(hypervisor_host_system_obj.get_VM_Hypervisor()) - return hypervisor_host_system_ - -class AnalysisSystem(System): - _namespace = maec.package._namespace - - def __init__(self): - super(AnalysisSystem, self).__init__() - self.installed_programs = InstalledPrograms() - - def to_obj(self): - analysis_system_obj = super(AnalysisSystem, self).to_obj(package_binding.AnalysisSystemType()) - if len(self.installed_programs) > 0 : analysis_system_obj.set_Installed_Programs(self.installed_programs.to_obj()) - return analysis_system_obj - - def to_dict(self): - analysis_system_dict = super(AnalysisSystem, self).to_dict() - if len(self.installed_programs) > 0 : analysis_system_dict['installed_programs'] = self.installed_programs.to_list() - return analysis_system_dict - - @staticmethod - def from_dict(analysis_system_dict): - if not analysis_system_dict: - return None - analysis_system_ = System.from_dict(AnalysisSystem, AnalysisSystem()) - analysis_system_.installed_programs = InstalledPrograms.from_list(analysis_system_dict.get('installed_programs')) - return analysis_system_ - - @staticmethod - def from_obj(analysis_system_obj): - if not analysis_system_obj: - return None - analysis_system_ = System.from_obj(AnalysisSystem, AnalysisSystem()) - if analysis_system_obj.get_Installed_Programs() is not None : - analysis_system_.installed_programs = InstalledPrograms.from_obj(analysis_system_obj.get_Installed_Programs()) - return analysis_system_ - - -class InstalledPrograms(maec.EntityList): - _contained_type = PlatformSpecification - _binding_class = package_binding.InstalledProgramsType - _binding_var = "Program" - _namespace = maec.package._namespace - -class AnalysisSystemList(maec.EntityList): - _contained_type = AnalysisSystem - _binding_class = package_binding.AnalysisSystemListType - _binding_var = "Analysis_System" - _namespace = maec.package._namespace - -class NetworkInfrastructure(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(NetworkInfrastructure, self).__init__() - self.captured_protocols = CapturedProtocolList() - - def to_obj(self): - network_infrastructure_obj = package_binding.NetworkInfrastructureType() - if len(self.captured_protocols) > 0: network_infrastructure_obj.set_Captured_Protocols(self.captured_protocols.to_obj()) - return network_infrastructure_obj - - def to_dict(self): - network_infrastructure_dict = {} - if len(self.captured_protocols) > 0: network_infrastructure_dict['captured_protocols'] = self.captured_protocols.to_list() - return network_infrastructure_dict - - @staticmethod - def from_dict(network_infrastructure_dict): - if not network_infrastructure_dict: - return None - network_infrastructure_ = NetworkInfrastructure() - network_infrastructure_.captured_protocols = CapturedProtocolList.from_list(network_infrastructure_dict.get('captured_protocols')) - return network_infrastructure_ - - @staticmethod - def from_obj(network_infrastructure_obj): - if not network_infrastructure_obj: - return None - network_infrastructure_ = NetworkInfrastructure() - if network_infrastructure_obj.get_Captured_Protocols() is not None : - network_infrastructure_.captured_protocols = CapturedProtocolList.from_obj(network_infrastructure_obj.get_Captured_Protocols()) - return network_infrastructure_ - -class CapturedProtocol(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(CapturedProtocol, self).__init__() - self.layer7_protocol = None - self.layer4_protocol = None - self.port_number = None - self.interaction_level = None - - def to_obj(self): - captured_protocol_obj = package_binding.CapturedProtocolType() - if self.layer7_protocol is not None : captured_protocol_obj.set_layer7_protocol(self.layer7_protocol) - if self.layer4_protocol is not None : captured_protocol_obj.set_layer4_protocol(self.layer4_protocol) - if self.port_number is not None : captured_protocol_obj.set_port_number(self.port_number) - if self.interaction_level is not None : captured_protocol_obj.set_interaction_level(self.interaction_level) - return captured_protocol_obj - - def to_dict(self): - captured_protocol_dict = {} - if self.layer7_protocol is not None : captured_protocol_dict['layer7_protocol'] = self.layer7_protocol - if self.layer4_protocol is not None : captured_protocol_dict['layer4_protocol'] = self.layer4_protocol - if self.port_number is not None : captured_protocol_dict['port_number'] = self.port_number - if self.interaction_level is not None : captured_protocol_dict['interaction_level'] = self.interaction_level - return captured_protocol_dict - - @staticmethod - def from_dict(captured_protocol_dict): - if not captured_protocol_dict: - return None - captured_protocol_ = CapturedProtocol() - captured_protocol_.layer7_protocol = captured_protocol_dict.get('layer7_protocol') - captured_protocol_.layer4_protocol = captured_protocol_dict.get('layer4_protocol') - captured_protocol_.port_number = captured_protocol_dict.get('port_number') - captured_protocol_.interaction_level = captured_protocol_dict.get('interaction_level') - return captured_protocol_ - - @staticmethod - def from_obj(captured_protocol_obj): - if not captured_protocol_obj: - return None - captured_protocol_ = CapturedProtocol() - captured_protocol_.layer7_protocol = captured_protocol_obj.get_layer7_protocol() - captured_protocol_.layer4_protocol = captured_protocol_dict.get_layer4_protocol() - captured_protocol_.port_number = captured_protocol_dict.get_port_number() - captured_protocol_.interaction_level = captured_protocol_dict.get_interaction_level() - return captured_protocol_ - -class CapturedProtocolList(maec.EntityList): - _contained_type = CapturedProtocol - _binding_class = package_binding.CapturedProtocolListType - _binding_var = "Protocol" - _namespace = maec.package._namespace - -class ToolList(maec.EntityList): - _contained_type = ToolInformation - _binding_class = package_binding.ToolListType - _binding_var = "Tool" - _namespace = maec.package._namespace - -class Source(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(Source, self).__init__() - self.name = None - self.method = None - self.reference = None - self.organization = None - self.url = None - - def to_obj(self): - source_obj = package_binding.SourceType() - if self.name is not None : source_obj.set_Name(self.name) - if self.method is not None : source_obj.set_Method(self.method) - if self.reference is not None : source_obj.set_Reference(self.reference) - if self.organization is not None : source_obj.set_Organization(self.organization) - if self.url is not None : source_obj.set_URL(self.url) - return source_obj - - def to_dict(self): - source_dict = {} - if self.name is not None : source_dict['name'] = self.name - if self.method is not None : source_dict['method'] = self.method - if self.reference is not None : source_dict['reference'] = self.reference - if self.organization is not None : source_dict['organization'] = self.organization - if self.url is not None : source_dict['url'] = self.url - return source_dict - - @staticmethod - def from_dict(source_dict): - if not source_dict: - return None - source_ = Source() - source_.name = source_dict.get('name') - source_.method = source_dict.get('method') - source_.reference = source_dict.get('reference') - source_.organization = source_dict.get('organization') - source_.url = source_dict.get('url') - return source_ - - @staticmethod - def from_obj(source_obj): - if not source_obj: - return None - source_ = Source() - source_.name = source_obj.get_Name() - source_.method = source_obj.get_Method() - source_.reference = source_obj.get_Reference() - source_.organization = source_obj.get_Organization() - source_.url = source_obj.get_URL() - return source_ - - - +#MAEC Analysis Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +from cybox.common import (PlatformSpecification, Personnel, StructuredText, + ToolInformation) +from cybox.objects.system_object import System + +import cybox.TypedField +import maec +import maec.bindings.maec_package as package_binding +from maec.bundle.bundle_reference import BundleReference + +class Source(maec.Entity): + _binding = package_binding + _binding_class = package_binding.SourceType + _namespace = maec.package._namespace + + name = cybox.TypedField("name") + method = cybox.TypedField("method") + reference = cybox.TypedField("reference") + organization = cybox.TypedField("organization") + url = cybox.TypedField("url") + + def __init__(self): + super(Source, self).__init__() + self.name = None + self.method = None + self.reference = None + self.organization = None + self.url = None + +class Comment(StructuredText): + _binding = package_binding + _binding_class = package_binding.CommentType + _namespace = maec.package._namespace + + author = cybox.TypedField("author") + timestamp = cybox.TypedField("timestamp") + observation_name = cybox.TypedField("observation_name") + + def __init__(self): + super(Comment, self).__init__() + self.author = None + self.timestamp = None + self.observation_name = None + + def is_plain(self): + """Whether this can be represented as a string rather than a dictionary + """ + return (super(Comment, self).is_plain() and + self.author is None and + self.timestamp is None and + self.observation_name is None) + +class CommentList(maec.EntityList): + _contained_type = Comment + _binding_class = package_binding.CommentListType + _binding_var = "Comment" + _namespace = maec.package._namespace + +class ToolList(maec.EntityList): + _contained_type = ToolInformation + _binding_class = package_binding.ToolListType + _binding_var = "Tool" + _namespace = maec.package._namespace + +class DynamicAnalysisMetadata(maec.Entity): + _binding = package_binding + _binding_class = package_binding.DynamicAnalysisMetadataType + _namespace = maec.package._namespace + + command_line = cybox.TypedField("command_line") + analysis_duration = cybox.TypedField("analysis_duration") + exit_code = cybox.TypedField("exit_code") + #raised_exception = cybox.TypedField("raised_exception", MalwareException) + + def __init__(self): + super(DynamicAnalysisMetadata, self).__init__() + self.command_line = None + self.analysis_duration = None + self.exit_code = None + +class HypervisorHostSystem(System): + _binding = package_binding + _binding_class = package_binding.HypervisorHostSystemType + _namespace = maec.package._namespace + + vm_hypervisor = cybox.TypedField("vm_hypervisor", PlatformSpecification) + + def __init__(self): + super(HypervisorHostSystem, self).__init__() + self.vm_hypervisor = None + +class InstalledPrograms(maec.EntityList): + _contained_type = PlatformSpecification + _binding_class = package_binding.InstalledProgramsType + _binding_var = "Program" + _namespace = maec.package._namespace + +class AnalysisSystem(System): + _binding = package_binding + _binding_class = package_binding.AnalysisSystemType + _namespace = maec.package._namespace + + installed_programs = cybox.TypedField("installed_programs", InstalledPrograms) + + def __init__(self): + super(AnalysisSystem, self).__init__() + self.installed_programs = InstalledPrograms() + +class AnalysisSystemList(maec.EntityList): + _contained_type = AnalysisSystem + _binding_class = package_binding.AnalysisSystemListType + _binding_var = "Analysis_System" + _namespace = maec.package._namespace + +class CapturedProtocol(maec.Entity): + _binding = package_binding + _binding_class = package_binding.CapturedProtocolType + _namespace = maec.package._namespace + + layer7_protocol = cybox.TypedField("layer7_protocol") + layer4_protocol = cybox.TypedField("layer4_protocol") + port_number = cybox.TypedField("port_number") + interaction_level = cybox.TypedField("interaction_level") + + def __init__(self): + super(CapturedProtocol, self).__init__() + self.layer7_protocol = None + self.layer4_protocol = None + self.port_number = None + self.interaction_level = None + +class CapturedProtocolList(maec.EntityList): + _contained_type = CapturedProtocol + _binding_class = package_binding.CapturedProtocolListType + _binding_var = "Protocol" + _namespace = maec.package._namespace + +class NetworkInfrastructure(maec.Entity): + _binding = package_binding + _binding_class = package_binding.NetworkInfrastructureType + _namespace = maec.package._namespace + + captured_protocols = cybox.TypedField("captured_protocols", CapturedProtocolList) + + def __init__(self): + super(NetworkInfrastructure, self).__init__() + self.captured_protocols = CapturedProtocolList() + +class AnalysisEnvironment(maec.Entity): + _binding = package_binding + _binding_class = package_binding.AnalysisEnvironmentType + _namespace = maec.package._namespace + + hypervisor_host_system = cybox.TypedField("hypervisor_host_system", HypervisorHostSystem) + analysis_systems = cybox.TypedField("analysis_systems", AnalysisSystemList) + network_infrastructure = cybox.TypedField("network_infrastructure", NetworkInfrastructure) + + def __init__(self): + super(AnalysisEnvironment, self).__init__() + self.hypervisor_host_system = None + self.analysis_systems = None + self.network_infrastructure = None + +class Analysis(maec.Entity): + _binding = package_binding + _binding_class = package_binding.AnalysisType + _namespace = maec.package._namespace + + id = cybox.TypedField("id") + method = cybox.TypedField("method") + type = cybox.TypedField("type") + ordinal_position = cybox.TypedField("ordinal_position") + start_datetime = cybox.TypedField("start_datetime") + complete_datetime = cybox.TypedField("complete_datetime") + lastupdate_datetime = cybox.TypedField("lastupdate_datetime") + source = cybox.TypedField("source", Source) + analysts = cybox.TypedField("analysts", Personnel) + summary = cybox.TypedField("summary", StructuredText) + comments = cybox.TypedField("comments", CommentList) + findings_bundle_reference = cybox.TypedField("findings_bundle_reference", BundleReference, multiple = True) + tools = cybox.TypedField("tools", ToolList) + dynamic_analysis_metadata = cybox.TypedField("dynamic_analysis_metadata", DynamicAnalysisMetadata) + analysis_environment = cybox.TypedField("analysis_environment", AnalysisEnvironment) + report = cybox.TypedField("report", StructuredText) + + def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): + super(Analysis, self).__init__() + if id: + self.id = id + else: + self.id = maec.utils.idgen.create_id(prefix="analysis") + self.method = method + self.type = type + self.ordinal_position = None + self.start_datetime = None + self.complete_datetime = None + self.lastupdate_datetime = None + self.source = None + self.analysts = None + self.summary = None + self.comments = None + self.findings_bundle_reference = findings_bundle_reference + self.tools = ToolList() + self.dynamic_analysis_metadata = None + self.analysis_environment = None + self.report = None + + #"Public" methods + # set the findings_bundle_reference values; accepts a list of bundle ID values + def set_findings_bundle(self, bundle_id): + self.findings_bundle_reference = [BundleReference.from_dict({'bundle_idref' : bundle_id})] + + # add a tool to this Anaysis's ToolList + def add_tool(self, tool): + self.tools.append(tool) + + + + + + + + + diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index c5a30a5..9cd608b 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -1,251 +1,104 @@ -#MAEC Grouping Relationship Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -import maec -import maec.bindings.maec_package as package_binding -from maec.package.malware_subject_reference import MalwareSubjectReference -from cybox.common import VocabString - -class GroupingRelationship(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(GroupingRelationship, self).__init__() - self.type = None - self.malware_family_name = None - self.malware_toolkit_name = None - self.clustering_metadata = None - - def to_obj(self): - grouping_relationship_obj = package_binding.GroupingRelationshipType() - if self.type is not None : grouping_relationship_obj.set_Type(self.type.to_obj()) - if self.malware_family_name is not None : grouping_relationship_obj.set_Malware_Family_Name(self.malware_family_name) - if self.malware_toolkit_name is not None : grouping_relationship_obj.set_Malware_Toolkit_Name(self.malware_toolkit_name) - if self.clustering_metadata is not None : grouping_relationship_obj.set_Clustering_Metadata(self.clustering_metadata.to_obj()) - return grouping_relationship_obj - - def to_dict(self): - grouping_relationship_dict = {} - if self.type is not None : grouping_relationship_dict['type'] = self.type.to_dict() - if self.malware_family_name is not None : grouping_relationship_dict['malware_family_name'] = self.malware_family_name - if self.malware_toolkit_name is not None : grouping_relationship_dict['malware_toolkit_name'] = self.malware_family_name - if self.clustering_metadata is not None : grouping_relationship_dict['clustering_metadata'] = self.clustering_metadata.to_dict() - return grouping_relationship_dict - - @staticmethod - def from_dict(grouping_relationship_dict): - if not grouping_relationship_dict: - return None - grouping_relationship_ = GroupingRelationship() - grouping_relationship_.type = VocabString.from_dict(grouping_relationship_dict.get('type')) - grouping_relationship_.malware_family_name = grouping_relationship_dict.get('malware_family_name') - grouping_relationship_.malware_toolkit_name = grouping_relationship_dict.get('malware_toolkit_name') - grouping_relationship_.clustering_metadata = ClusteringMetadata.from_dict(grouping_relationship_dict.get('clustering_metadata')) - return grouping_relationship_ - - @staticmethod - def from_obj(grouping_relationship_obj): - if not grouping_relationship_obj: - return None - grouping_relationship_ = GroupingRelationship() - grouping_relationship_.type = VocabString.from_obj(grouping_relationship_obj.get_Type()) - grouping_relationship_.malware_family_name = grouping_relationship_obj.get_Malware_Family_Name() - grouping_relationship_.malware_toolkit_name = grouping_relationship_obj.get_Malware_Toolkit_Name() - grouping_relationship_.clustering_metadata = ClusteringMetadata.from_obj(grouping_relationship_obj.get_Clustering_Metadata()) - return grouping_relationship_ - -class GroupingRelationshipList(maec.EntityList): - _contained_type = GroupingRelationship - _binding_class = package_binding.GroupingRelationshipListType - _binding_var = "Grouping_Relationship" - _namespace = maec.package._namespace - -class ClusteringMetadata(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(ClusteringMetadata, self).__init__() - self.algorithm_name = None - self.algorithm_version = None - self.algorithm_parameters = None - self.cluster_size = None - self.cluster_description = None - self.cluster_composition = None - - def to_obj(self): - clustering_metadata_obj = package_binding.ClusteringMetadataType() - if self.algorithm_name is not None : clustering_metadata_obj.set_Algorithm_Name(self.algorithm_name) - if self.algorithm_version is not None : clustering_metadata_obj.set_Algorithm_Version(self.algorithm_version) - if self.algorithm_parameters is not None : clustering_metadata_obj.set_Algorithm_Parameters(self.algorithm_parameters.to_obj()) - if self.cluster_size is not None : clustering_metadata_obj.set_Cluster_Size(self.cluster_size) - if self.cluster_description is not None : clustering_metadata_obj.set_Cluster_Description(self.cluster_description) - if self.cluster_composition is not None : clustering_metadata_obj.set_Cluster_Composition(self.cluster_composition.to_obj()) - return clustering_metadata_obj - - def to_dict(self): - clustering_metadata_dict = {} - if self.algorithm_name is not None : clustering_metadata_dict['algorithm_name'] = self.algorithm_name - if self.algorithm_version is not None : clustering_metadata_dict['algorithm_version'] = self.algorithm_version - if self.algorithm_parameters is not None : clustering_metadata_dict['algorithm_parameters'] = self.algorithm_parameters.to_dict() - if self.cluster_size is not None : clustering_metadata_dict['cluster_size'] = self.cluster_size - if self.cluster_description is not None : clustering_metadata_dict['cluster_description'] = self.cluster_description - if self.cluster_composition is not None : clustering_metadata_dict['cluster_composition'] = self.cluster_composition.to_dict() - return clustering_metadata_dict - - @staticmethod - def from_dict(clustering_metadata_dict): - if not clustering_metadata_dict: - return None - clustering_metadata_ = ClusteringMetadata() - clustering_metadata_.algorithm_name = clustering_metadata_dict.get('algorithm_name') - clustering_metadata_.algorithm_version = clustering_metadata_dict.get('algorithm_version') - clustering_metadata_.algorithm_parameters = ClusteringAlgorithmParameters.from_dict(clustering_metadata_dict.get('algorithm_parameters')) - clustering_metadata_.cluster_size = clustering_metadata_dict.get('cluster_size') - clustering_metadata_.cluster_description = clustering_metadata_dict.get('cluster_description') - clustering_metadata_.cluster_composition = ClusterComposition.from_dict(clustering_metadata_dict.get('cluster_composition')) - return clustering_metadata_ - - @staticmethod - def from_obj(clustering_metadata_obj): - if not clustering_metadata_obj: - return None - clustering_metadata_ = ClusteringMetadata() - clustering_metadata_.algorithm_name = clustering_metadata_obj.get_Algorithm_Name() - clustering_metadata_.algorithm_version = clustering_metadata_obj.get_Algorithm_Version() - clustering_metadata_.algorithm_parameters = ClusteringAlgorithmParameters.from_obj(clustering_metadata_obj.get_Algorithm_Parameters()) - clustering_metadata_.cluster_size = clustering_metadata_obj.get_Cluster_Size() - clustering_metadata_.cluster_description = clustering_metadata_obj.get_Cluster_Description() - clustering_metadata_.cluster_composition = ClusterComposition.from_obj(clustering_metadata_obj.get_Cluster_Composition()) - return clustering_metadata_ - - -class ClusteringAlgorithmParameters(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(ClusteringAlgorithmParameters, self).__init__() - self.distance_threshold = None - self.number_of_iterations = None - - def to_obj(self): - clustering_algorithm_parameters_obj = package_binding.ClusteringAlgorithmParametersType() - if self.distance_threshold is not None : clustering_algorithm_parameters_obj.set_Distance_Threshold(self.distance_threshold) - if self.number_of_iterations is not None : clustering_algorithm_parameters_obj.set_Number_of_Iterations(self.number_of_iterations) - return clustering_algorithm_parameters_obj - - def to_dict(self): - clustering_algorithm_parameters_dict = {} - if self.distance_threshold is not None : clustering_algorithm_parameters_dict['distance_threshold'] = self.distance_threshold - if self.number_of_iterations is not None : clustering_algorithm_parameters_dict['number_of_iterations'] = self.number_of_iterations - return clustering_algorithm_parameters_dict - - @staticmethod - def from_dict(clustering_algorithm_parameters_dict): - if not clustering_algorithm_parameters_dict: - return None - clustering_algorithm_parameters_ = ClusteringAlgorithmParameters() - clustering_algorithm_parameters_.distance_threshold = clustering_algorithm_parameters_dict.get('distance_threshold') - clustering_algorithm_parameters_.number_of_iterations = clustering_algorithm_parameters_dict.get('number_of_iterations') - return clustering_algorithm_parameters_ - - @staticmethod - def from_obj(clustering_algorithm_parameters_obj): - if not clustering_algorithm_parameters_obj: - return None - clustering_algorithm_parameters_ = ClusteringAlgorithmParameters() - clustering_algorithm_parameters_.distance_threshold = clustering_algorithm_parameters_obj.get_Distance_Threshold() - clustering_algorithm_parameters_.number_of_iterations = clustering_algorithm_parameters_obj.get_Number_of_Iterations() - return clustering_algorithm_parameters_ - -class ClusterComposition(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(ClusterComposition, self).__init__() - self.score_type = None - self.edge_node_pairs = [] - - def to_obj(self): - cluster_composition_obj = package_binding.ClusterCompositionType() - if self.score_type is not None : cluster_composition_obj.set_score_type(self.score_type) - if len(self.edge_node_pairs) > 0: - for edge_node_pair in self.edge_node_pairs: cluster_composition_obj.add_Edge_Node_Pair(edge_node_pair.to_obj()) - return cluster_composition_obj - - def to_dict(self): - cluster_composition_dict = {} - if self.score_type is not None : cluster_composition_dict['score_type'] = self.score_type - if len(self.edge_node_pairs) > 0: - cluster_composition_dict['edge_node_pairs'] = [x.to_dict() for x in self.edge_node_pairs] - return cluster_composition_dict - - @staticmethod - def from_dict(cluster_composition_dict): - if not cluster_composition_dict: - return None - cluster_composition_ = ClusterComposition() - cluster_composition_.score_type = cluster_composition_dict.get('score_type') - cluster_composition_.edge_node_pairs = [ClusterEdgeNodePair.from_dict(x) for x in cluster_composition_dict.get('edge_node_pairs',[])] - return cluster_composition_ - - @staticmethod - def from_obj(cluster_composition_obj): - if not cluster_composition_obj: - return None - cluster_composition_ = ClusterComposition() - cluster_composition_.score_type = cluster_composition_obj.get_score_type() - cluster_composition_.edge_node_pairs = [ClusterEdgeNodePair.from_obj(x) for x in cluster_composition_obj.get_Edge_Node_Pair()] - return cluster_composition_ - -class ClusterEdgeNodePair(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(ClusterEdgeNodePair, self).__init__() - self.similarity_index = None - self.similarity_distance = None - self.malware_subject_node_a = None - self.malware_subject_node_b = None - - def to_obj(self): - cluster_edge_node_pair_obj = package_binding.ClusterEdgeNodePairType() - if self.similarity_index is not None : cluster_edge_node_pair_obj.set_similarity_index(self.similarity_index) - if self.similarity_distance is not None : cluster_edge_node_pair_obj.set_similarity_distance(self.similarity_distance) - if self.malware_subject_node_a is not None : cluster_edge_node_pair_obj.set_Malware_Subject_Node_A(self.malware_subject_node_a.to_obj()) - if self.malware_subject_node_b is not None : cluster_edge_node_pair_obj.set_Malware_Subject_Node_B(self.malware_subject_node_b.to_obj()) - return cluster_edge_node_pair_obj - - def to_dict(self): - cluster_edge_node_pair_dict = {} - if self.similarity_index is not None : cluster_edge_node_pair_dict['similarity_index'] = self.similarity_index - if self.similarity_distance is not None : cluster_edge_node_pair_dict['similarity_distance'] = self.similarity_distance - if self.malware_subject_node_a is not None : cluster_edge_node_pair_dict['malware_subject_node_a'] = self.malware_subject_node_a.to_dict() - if self.malware_subject_node_b is not None : cluster_edge_node_pair_dict['malware_subject_node_b'] = self.malware_subject_node_b.to_dict() - return cluster_edge_node_pair_dict - - @staticmethod - def from_dict(cluster_edge_node_pair_dict): - if not cluster_edge_node_pair_dict: - return None - cluster_edge_node_pair_ = ClusterEdgeNodePair() - cluster_edge_node_pair_.similarity_index = cluster_edge_node_pair_dict.get('similarity_index') - cluster_edge_node_pair_.similarity_distance = cluster_edge_node_pair_dict.get('similarity_distance') - cluster_edge_node_pair_.malware_subject_node_a = MalwareSubjectReference.from_dict(cluster_edge_node_pair_dict.get('malware_subject_node_a')) - cluster_edge_node_pair_.malware_subject_node_b = MalwareSubjectReference.from_dict(cluster_edge_node_pair_dict.get('malware_subject_node_b')) - return cluster_edge_node_pair_ - - @staticmethod - def from_obj(cluster_edge_node_pair_obj): - if not cluster_edge_node_pair_obj: - return None - cluster_edge_node_pair_ = ClusterEdgeNodePair() - cluster_edge_node_pair_.similarity_index = cluster_edge_node_pair_obj.get_similarity_index() - cluster_edge_node_pair_.similarity_distance = cluster_edge_node_pair_obj.get_similarity_distance() - cluster_edge_node_pair_.malware_subject_node_a = MalwareSubjectReference.from_obj(cluster_edge_node_pair_obj.get_Malware_Subject_Node_A()) - cluster_edge_node_pair_.malware_subject_node_b = MalwareSubjectReference.from_obj(cluster_edge_node_pair_obj.get_Malware_Subject_Node_B()) - return cluster_edge_node_pair_ +#MAEC Grouping Relationship Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import cybox +import maec +import maec.bindings.maec_package as package_binding +from maec.package.malware_subject_reference import MalwareSubjectReference +from cybox.common import VocabString + +class ClusterEdgeNodePair(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterEdgeNodePairType + _namespace = maec.package._namespace + + similarity_index = cybox.TypedField("similarity_index") + similarity_distance = cybox.TypedField("similarity_distance") + malware_subject_node_a = cybox.TypedField("malware_subject_node_a", MalwareSubjectReference) + malware_subject_node_b = cybox.TypedField("malware_subject_node_b", MalwareSubjectReference) + + def __init__(self): + super(ClusterEdgeNodePair, self).__init__() + self.similarity_index = None + self.similarity_distance = None + self.malware_subject_node_a = None + self.malware_subject_node_b = None + +class ClusterComposition(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterCompositionType + _namespace = maec.package._namespace + + score_type = cybox.TypedField("score_type") + edge_node_pair = cybox.TypedField("edge_node_pair", ClusterEdgeNodePair, multiple=True) + + def __init__(self): + super(ClusterComposition, self).__init__() + self.score_type = None + self.edge_node_pair = [] + +class ClusteringAlgorithmParameters(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringAlgorithmParametersType + _namespace = maec.package._namespace + + distance_threashold = cybox.TypedField("distance_threashold") + number_of_iterations = cybox.TypedField("number_of_iterations") + + def __init__(self): + super(ClusteringAlgorithmParameters, self).__init__() + self.distance_threshold = None + self.number_of_iterations = None + +class ClusteringMetadata(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringMetadataType + _namespace = maec.package._namespace + + algorithm_name = cybox.TypedField("algorithm_name") + algorithm_version = cybox.TypedField("algorithm_version") + algorithm_parameters = cybox.TypedField("algorithm_parameters", ClusteringAlgorithmParameters) + cluster_size = cybox.TypedField("cluster_size") + cluster_description = cybox.TypedField("cluster_description") + cluster_composition = cybox.TypedField("cluster_composition", ClusterComposition) + + def __init__(self): + super(ClusteringMetadata, self).__init__() + self.algorithm_name = None + self.algorithm_version = None + self.algorithm_parameters = None + self.cluster_size = None + self.cluster_description = None + self.cluster_composition = None + +class GroupingRelationship(maec.Entity): + _binding = package_binding + _binding_class = package_binding.GroupingRelationshipType + _namespace = maec.package._namespace + + type = cybox.TypedField("type") + malware_family_name = cybox.TypedField("malware_family_name") + malware_toolkit_name = cybox.TypedField("malware_toolkit_name") + clustering_metadata = cybox.TypedField("clustering_metadata", ClusteringMetadata) + + def __init__(self): + super(GroupingRelationship, self).__init__() + self.type = None + self.malware_family_name = None + self.malware_toolkit_name = None + self.clustering_metadata = None + +class GroupingRelationshipList(maec.EntityList): + _contained_type = GroupingRelationship + _binding_class = package_binding.GroupingRelationshipListType + _binding_var = "Grouping_Relationship" + _namespace = maec.package._namespace + + + + diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 9f92c05..4c04619 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -1,627 +1,271 @@ -#MAEC Malware Subject Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 07/8/2014 - -from cybox.common import VocabString, PlatformSpecification, ToolInformationList -from cybox.objects.file_object import File -from cybox.objects.uri_object import URI -from cybox.core import Object - -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.bundle import Bundle -from maec.package.action_equivalence import ActionEquivalenceList -from maec.package.analysis import Analysis -from maec.package.malware_subject_reference import MalwareSubjectReference -from maec.package.object_equivalence import ObjectEquivalenceList - - -class MalwareSubject(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self, id = None, malware_instance_object_attributes = None): - super(MalwareSubject, self).__init__() - if id: - self.id = id - else: - self.id = maec.utils.idgen.create_id(prefix="malware_subject") - #Set the Malware Instance Object Attributes (a CybOX object) if they are not none - self.malware_instance_object_attributes = malware_instance_object_attributes - self.label = [] - self.configuration_details = None - self.minor_variants = MinorVariants() - self.development_environment = None - self.field_data = None - #Instantiate the lists - self.analyses = Analyses() - self.findings_bundles = FindingsBundleList() - self.relationships = MalwareSubjectRelationshipList() - self.compatible_platform = [] - - #Public methods - #Set the Malware_Instance_Object_Attributes with a CybOX object - def set_malware_instance_object_attributes(self, malware_instance_object_attributes): - self.malware_instance_object_attributes = malware_instance_object_attributes - - #Add an Analysis to the Analyses - def add_analysis(self, analysis): - self.analyses.append(analysis) - - def get_analyses(self): - return self.analyses - - #Get all Bundles in the Subject - def get_all_bundles(self): - return self.findings_bundles.bundles - - #Add a MAEC Bundle to the Findings Bundles - def add_findings_bundle(self, bundle): - self.findings_bundles.add_bundle(bundle) - - def deduplicate_bundles(self): - """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" - for findings_bundle in self.findings_bundles.bundles: - findings_bundle.deduplicate() - - def dereference_bundles(self): - """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" - all_bundles = self.get_all_bundles() - for bundle in all_bundles: - bundle.dereference_objects([self.malware_instance_object_attributes]) - - def normalize_bundles(self): - """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" - all_bundles = self.get_all_bundles() - for bundle in all_bundles: - bundle.normalize_objects() - - def to_obj(self): - malware_subject_obj = package_binding.MalwareSubjectType(id = self.id) - if self.malware_instance_object_attributes is not None: malware_subject_obj.set_Malware_Instance_Object_Attributes(self.malware_instance_object_attributes.to_obj()) - if self.minor_variants: malware_subject_obj.set_Minor_Variants(self.minor_variants.to_obj()) - if self.configuration_details: malware_subject_obj.set_Configuration_Details(self.configuration_details.to_obj()) - if self.development_environment: malware_subject_obj.set_Development_Environment(self.development_environment.to_obj()) - if self.field_data is not None: malware_subject_obj.set_Field_Data(self.field_data.to_obj()) - if self.analyses: malware_subject_obj.set_Analyses(self.analyses.to_obj()) - if self.findings_bundles and (self.findings_bundles.bundle_external_references or self.findings_bundles.bundles): - malware_subject_obj.set_Findings_Bundles(self.findings_bundles.to_obj()) - if self.relationships: malware_subject_obj.set_Relationships(self.relationships.to_obj()) - if self.label: - for labl in self.label: - malware_subject_obj.add_Label(labl.to_obj()) - if self.compatible_platform: - for platform in self.compatible_platform: - malware_subject_obj.add_Compatible_Platform(platform.to_obj()) - return malware_subject_obj - - def to_dict(self): - malware_subject_dict = {} - if self.id is not None : malware_subject_dict['id'] = self.id - if self.malware_instance_object_attributes is not None: malware_subject_dict['malware_instance_object_attributes'] = self.malware_instance_object_attributes.to_dict() - if self.minor_variants : malware_subject_dict['minor_variants'] = self.minor_variants.to_list() - if self.configuration_details : malware_subject_dict['configuration_details'] = self.configuration_details.to_dict() - if self.development_environment : malware_subject_dict['development_environment'] = self.development_environment.to_dict() - if self.field_data is not None: malware_subject_dict['field_data'] = self.field_data.to_dict() - if self.analyses : malware_subject_dict['analyses'] = self.analyses.to_list() - if self.findings_bundles : malware_subject_dict['findings_bundles'] = self.findings_bundles.to_dict() - if self.relationships : malware_subject_dict['relationships'] = self.relationships.to_list() - if self.label: - malware_subject_dict['label'] = [x.to_dict() for x in self.label] - if self.compatible_platform: - malware_subject_dict['compatible_platform'] = [x.to_dict() for x in self.compatible_platform] - return malware_subject_dict - - #Build the Malware Subject from the input dictionary - @staticmethod - def from_dict(malware_subject_dict): - if not malware_subject_dict: - return None - malware_subject_ = MalwareSubject(None) - malware_subject_.id = malware_subject_dict.get('id') - malware_subject_.malware_instance_object_attributes = Object.from_dict(malware_subject_dict.get('malware_instance_object_attributes')) - malware_subject_.minor_variants = MinorVariants.from_list(malware_subject_dict.get('minor_variants')) - malware_subject_.configuration_details = MalwareConfigurationDetails.from_dict(malware_subject_dict.get('configuration_details')) - malware_subject_.development_environment = MalwareDevelopmentEnvironment.from_dict(malware_subject_dict.get('development_environment')) - malware_subject_.field_data = None #TODO: add support - malware_subject_.analyses = Analyses.from_list(malware_subject_dict.get('analyses')) - malware_subject_.findings_bundles = FindingsBundleList.from_dict(malware_subject_dict.get('findings_bundles')) - malware_subject_.relationships = MalwareSubjectRelationshipList.from_list(malware_subject_dict.get('id')) - if malware_subject_dict.get('label'): - malware_subject_.label = [VocabString.from_dict(x) for x in malware_subject_dict.get('label')] - if malware_subject_dict.get('compatible_platform'): - malware_subject_.compatible_platform = [PlatformSpecification.from_dict(x) for x in malware_subject_dict.get('compatible_platform')] - return malware_subject_ - - @staticmethod - def from_obj(malware_subject_obj): - if not malware_subject_obj: - return None - malware_subject_ = MalwareSubject(None) - malware_subject_.id = malware_subject_obj.get_id() - malware_subject_.malware_instance_object_attributes = Object.from_obj(malware_subject_obj.get_Malware_Instance_Object_Attributes()) - malware_subject_.minor_variants = MinorVariants.from_obj(malware_subject_obj.get_Minor_Variants()) - malware_subject_.configuration_details = MalwareConfigurationDetails.from_obj(malware_subject_obj.get_Configuration_Details()) - malware_subject_.development_environment = MalwareDevelopmentEnvironment.from_obj(malware_subject_obj.get_Development_Environment()) - malware_subject_.field_data = None #TODO: add support - malware_subject_.analyses = Analyses.from_obj(malware_subject_obj.get_Analyses()) - malware_subject_.findings_bundles = FindingsBundleList.from_obj(malware_subject_obj.get_Findings_Bundles()) - malware_subject_.relationships = MalwareSubjectRelationshipList.from_obj(malware_subject_obj.get_Relationships()) - if malware_subject_obj.get_Label(): - malware_subject_.label = [VocabString.from_obj(x) for x in malware_subject_obj.get_Label()] - if malware_subject_obj.get_Compatible_Platform(): - malware_subject_.compatible_platform = [PlatformSpecification.from_obj(x) for x in malware_subject_obj.get_Compatible_Platform()] - return malware_subject_ - -class MinorVariants(maec.EntityList): - _contained_type = Object - _binding_class = package_binding.MinorVariantListType - _binding_var = "Minor_Variant" - _namespace = maec.package._namespace - -class Analyses(maec.EntityList): - _contained_type = Analysis - _binding_class = package_binding.AnalysisListType - _binding_var = "Analysis" - _namespace = maec.package._namespace - -class MalwareSubjectRelationship(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareSubjectRelationship, self).__init__() - self.type = None - self.malware_subject_references = [] - - def to_obj(self): - malware_subject_relationship_obj = package_binding.MalwareSubjectRelationshipType() - if self.type is not None : malware_subject_relationship_obj.set_Type(self.type.to_obj()) - if len(self.malware_subject_references) > 0: - for malware_subject_reference in self.malware_subject_references: - malware_subject_relationship_obj.add_Malware_Subject_Reference(malware_subject_reference.to_obj()) - return malware_subject_relationship_obj - - def to_dict(self): - malware_subject_relationship_dict = {} - if self.type is not None : malware_subject_relationship_dict['type'] = self.type.to_dict() - if len(self.malware_subject_references) > 0: - malware_subject_refs = [] - for malware_subject_reference in self.malware_subject_references: - malware_subject_refs.append(malware_subject_reference.to_dict()) - malware_subject_relationship_dict['malware_subject_references'] = malware_subject_refs - return malware_subject_relationship_dict - - @staticmethod - def from_dict(malware_subject_relationship_dict): - if not malware_subject_relationship_dict: - return None - malware_subject_relationship_ = MalwareSubjectRelationship() - malware_subject_relationship_.type = VocabString.from_dict(malware_subject_relationship_dict.get('type')) - malware_subject_relationship_.malware_subject_references = [MalwareSubjectReference.from_dict(x) for x in malware_subject_relationship_dict.get('malware_subject_references', [])] - return malware_subject_relationship_ - - @staticmethod - def from_obj(malware_subject_relationship_obj): - if not malware_subject_relationship_obj: - return None - malware_subject_relationship_ = MalwareSubjectRelationship() - malware_subject_relationship_.type = VocabString.from_obj(malware_subject_relationship_obj.get_Type()) - malware_subject_relationship_.malware_subject_references = [MalwareSubjectReference.from_obj(x) for x in malware_subject_relationship_obj.get_Malware_Subject_Reference()] - return malware_subject_relationship_ - -class MalwareSubjectRelationshipList(maec.EntityList): - _contained_type = MalwareSubjectRelationship - _binding_class = package_binding.MalwareSubjectRelationshipListType - _binding_var = "Relationship" - _namespace = maec.package._namespace - -class FindingsBundleList(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(FindingsBundleList, self).__init__() - self.meta_analysis = None - self.bundles = [] - self.bundle_external_references = [] - - def add_bundle(self, bundle): - self.bundles.append(bundle) - - def add_bundle_external_reference(self, bundle_external_reference): - self.bundle_external_references.append(bundle_external_reference) - - def to_obj(self): - findings_bundle_list_obj = package_binding.FindingsBundleListType() - if self.meta_analysis is not None : findings_bundle_list_obj.set_Meta_Analysis(self.meta_analysis.to_obj()) - if len(self.bundles) > 0: - for bundle in self.bundles: findings_bundle_list_obj.add_Bundle(bundle.to_obj()) - if len(self.bundle_external_references) > 0: - for bundle_external_reference in self.bundle_external_references: findings_bundle_list_obj.add_Bundle_External_Reference(bundle_external_reference) - return findings_bundle_list_obj - - def to_dict(self): - findings_bundle_list_dict = {} - if self.meta_analysis is not None : findings_bundle_list_dict['meta_analysis'] = self.meta_analysis.to_dict() - if len(self.bundles) > 0: - bundle_list = [] - for bundle in self.bundles: bundle_list.append(bundle.to_dict()) - findings_bundle_list_dict['bundles'] = bundle_list - if len(self.bundle_external_references) > 0: - bundle_external_refs_list = [] - for bundle_external_reference in self.bundle_external_references: bundle_external_refs_list.append(bundle_external_reference) - findings_bundle_list_dict['bundle_external_references'] = bundle_external_refs_list - return findings_bundle_list_dict - - @staticmethod - def from_dict(findings_bundle_list_dict): - if not findings_bundle_list_dict: - return None - findings_bundle_list_ = FindingsBundleList() - findings_bundle_list_.meta_analysis = MetaAnalysis.from_dict(findings_bundle_list_dict.get('meta_analysis')) - findings_bundle_list_.bundles = [Bundle.from_dict(x) for x in findings_bundle_list_dict.get('bundles', [])] - findings_bundle_list_.bundle_external_references = [x for x in findings_bundle_list_dict.get('bundle_external_references', [])] - return findings_bundle_list_ - - @staticmethod - def from_obj(findings_bundle_list_obj): - if not findings_bundle_list_obj: - return None - findings_bundle_list_ = FindingsBundleList() - findings_bundle_list_.meta_analysis = MetaAnalysis.from_obj(findings_bundle_list_obj.get_Meta_Analysis()) - findings_bundle_list_.bundles = [Bundle.from_obj(x) for x in findings_bundle_list_obj.get_Bundle()] - findings_bundle_list_.bundle_external_references = [x for x in findings_bundle_list_obj.get_Bundle_External_Reference()] - return findings_bundle_list_ - -class MetaAnalysis(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MetaAnalysis, self).__init__() - self.action_equivalences = None - self.object_equivalences = None - - def to_obj(self): - meta_analysis_obj = package_binding.MetaAnalysisType() - if self.action_equivalences is not None : meta_analysis_obj.set_Action_Equivalences(self.action_equivalences.to_obj()) - if self.object_equivalences is not None : meta_analysis_obj.set_Object_Equivalences(self.object_equivalences.to_obj()) - return meta_analysis_obj - - def to_dict(self): - meta_analysis_dict = {} - if self.action_equivalences is not None : meta_analysis_dict['action_equivalences'] = self.action_equivalences.to_list() - if self.object_equivalences is not None : meta_analysis_dict['object_equivalences'] = self.object_equivalences.to_list() - return meta_analysis_dict - - @staticmethod - def from_dict(meta_analysis_dict): - if not meta_analysis_dict: - return None - meta_analysis_ = MetaAnalysis() - meta_analysis_.action_equivalences = ActionEquivalenceList.from_list(meta_analysis_dict.get('action_equivalences')) - meta_analysis_.object_equivalences = ObjectEquivalenceList.from_list(meta_analysis_dict.get('object_equivalences')) - return meta_analysis_ - - @staticmethod - def from_obj(meta_analysis_obj): - if not meta_analysis_obj: - return None - meta_analysis_ = MetaAnalysis() - meta_analysis_.action_equivalences = ActionEquivalenceList.from_obj(meta_analysis_obj.get_Action_Equivalences()) - meta_analysis_.object_equivalences = ObjectEquivalenceList.from_obj(meta_analysis_obj.get_Object_Equivalences()) - return meta_analysis_ - -class MalwareSubjectList(maec.EntityList): - _contained_type = MalwareSubject - _binding_class = package_binding.MalwareSubjectListType - _binding_var = "Malware_Subject" - _namespace = maec.package._namespace - -class MalwareDevelopmentEnvironment(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareDevelopmentEnvironment, self).__init__() - self.tools = None - self.debugging_file = None - - def to_obj(self): - mal_dev_obj = package_binding.MalwareDevelopmentEnvironmentType() - if self.tools is not None : mal_dev_obj.set_Tools(self.tools.to_obj()) - if self.debugging_file is not None: - mal_dev_obj.set_Debugging_File([x.to_obj() for x in self.debugging_file]) - return mal_dev_obj - - def to_dict(self): - mal_dev_dict = {} - if self.tools is not None : mal_dev_dict['tools'] = self.tools.to_list() - if self.debugging_file is not None: - mal_dev_dict['debugging_file'] = [x.to_dict() for x in self.debugging_file] - return mal_dev_dict - - @staticmethod - def from_dict(mal_dev_dict): - if not mal_dev_dict: - return None - mal_dev_env_ = MalwareDevelopmentEnvironment() - mal_dev_env_.tools = ToolInformationList.from_list(mal_dev_dict['tools']) - if mal_dev_dict.get('debugging_file'): - mal_dev_env_.debugging_file = [File.from_dict(x) for x in mal_dev_dict['debugging_file']] - return mal_dev_env_ - - @staticmethod - def from_obj(mal_dev_obj): - if not mal_dev_obj: - return None - mal_dev_env_ = MalwareDevelopmentEnvironment() - mal_dev_env_.tools = ToolInformationList.from_obj(mal_dev_obj.get_Tools()) - if mal_dev_obj.get_Debugging_File(): - mal_dev_env_.debugging_file = [File.from_obj(x) for x in mal_dev_obj.get_Debugging_File()] - return mal_dev_env_ - -class MalwareConfigurationParameter(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareConfigurationParameter, self).__init__() - self.name = None - self.value = None - - def to_obj(self): - mal_conf_param_obj = package_binding.MalwareConfigurationParameterType() - if self.name is not None : mal_conf_param_obj.set_Name(self.name.to_obj()) - if self.value is not None : mal_conf_param_obj.set_Value(self.value) - return mal_conf_param_obj - - def to_dict(self): - mal_conf_param_dict = {} - if self.name is not None : mal_conf_param_dict['name'] = self.name.to_dict() - if self.value is not None : mal_conf_param_dict['value'] = self.value - return mal_conf_param_dict - - @staticmethod - def from_dict(mal_conf_param_dict): - if not mal_conf_param_dict: - return None - mal_conf_param_ = MalwareConfigurationParameter() - mal_conf_param_.name = VocabString.from_dict(mal_conf_param_dict['name']) - if mal_conf_param_dict.get('value'): mal_conf_param_.value = mal_conf_param_dict['value'] - return mal_conf_param_ - - @staticmethod - def from_obj(mal_conf_param_obj): - if not mal_conf_param_obj: - return None - mal_conf_param_ = MalwareConfigurationParameter() - mal_conf_param_.name = VocabString.from_obj(mal_conf_param_obj.get_Name()) - if mal_conf_param_obj.get_Value(): mal_conf_param_.value = mal_conf_param_obj.get_Value() - return mal_conf_param_ - -class MalwareBinaryConfigurationStorageDetails(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareBinaryConfigurationStorageDetails, self).__init__() - self.file_offset = None - self.section_name = None - self.section_offset = None - - def to_obj(self): - mal_binary_conf_storage_obj = package_binding.MalwareBinaryConfigurationStorageDetailsType() - if self.file_offset is not None : mal_binary_conf_storage_obj.set_File_Offset(self.file_offset) - if self.section_name is not None : mal_binary_conf_storage_obj.set_Section_Name(self.section_name) - if self.section_offset is not None : mal_binary_conf_storage_obj.set_Section_Offset(self.section_offset) - return mal_binary_conf_storage_obj - - def to_dict(self): - mal_binary_conf_storage_dict = {} - if self.file_offset is not None : mal_binary_conf_storage_dict['file_offset'] = self.file_offset - if self.section_name is not None : mal_binary_conf_storage_dict['section_name'] = self.section_name - if self.section_offset is not None : mal_binary_conf_storage_dict['section_offset'] = self.section_offset - return mal_binary_conf_storage_dict - - @staticmethod - def from_dict(mal_binary_conf_storage_dict): - if not mal_binary_conf_storage_dict: - return None - mal_binary_conf_storage_ = MalwareBinaryConfigurationStorageDetails() - if mal_conf_storage_dict['file_offset']: mal_binary_conf_storage_.file_offset = mal_conf_storage_dict['file_offset'] - if mal_conf_storage_dict['section_name']: mal_binary_conf_storage_.section_name = mal_conf_storage_dict['section_name'] - if mal_conf_storage_dict['section_offset']: mal_binary_conf_storage_.section_offset = mal_conf_storage_dict['section_offset'] - return mal_binary_conf_storage_ - - @staticmethod - def from_obj(mal_binary_conf_storage_obj): - if not mal_binary_conf_storage_obj: - return None - mal_binary_conf_storage_ = MalwareBinaryConfigurationStorageDetails() - mal_binary_conf_storage_.file_offset = mal_binary_conf_storage_obj.get_File_Offset() - mal_binary_conf_storage_.section_name = mal_binary_conf_storage_obj.get_Section_Name() - mal_binary_conf_storage_.section_offset = mal_binary_conf_storage_obj.get_Section_Offset() - return mal_binary_conf_storage_ - -class MalwareConfigurationStorageDetails(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareConfigurationStorageDetails, self).__init__() - self.malware_binary = None - self.file = None - self.url = [] - - def to_obj(self): - mal_conf_storage_obj = package_binding.MalwareConfigurationStorageDetailsType() - if self.malware_binary is not None : mal_conf_storage_obj.set_Malware_Binary(self.malware_binary.to_obj()) - if self.file is not None : mal_conf_storage_obj.set_File(self.file.to_obj()) - if self.url is not None: - mal_conf_storage_obj.set_URL([x.to_obj() for x in self.url]) - return mal_conf_storage_obj - - def to_dict(self): - mal_conf_storage_dict = {} - if self.malware_binary is not None : mal_conf_storage_dict['malware_binary'] = self.malware_binary.to_dict() - if self.file is not None : mal_conf_storage_dict['file'] = self.file.to_dict() - if self.url is not None: - mal_conf_storage_dict['url'] = [x.to_dict() for x in self.url] - return mal_conf_storage_dict - - @staticmethod - def from_dict(mal_conf_storage_dict): - if not mal_conf_storage_dict: - return None - mal_conf_storage_ = MalwareConfigurationStorageDetails() - mal_conf_storage_.malware_binary = MalwareBinaryConfigurationStorageDetails.from_dict(mal_conf_storage_dict['malware_binary']) - mal_conf_storage_.file = File.from_dict(mal_conf_storage_dict['file']) - if mal_conf_storage_dict['url']: - mal_conf_storage_.url = [URI.from_dict(x) for x in mal_conf_storage_dict['configuration_parameter']] - return mal_conf_storage_ - - @staticmethod - def from_obj(mal_conf_storage_obj): - if not mal_conf_storage_obj: - return None - mal_conf_storage_ = MalwareConfigurationStorageDetails() - mal_conf_storage_.malware_binary = MalwareBinaryConfigurationStorageDetails.from_obj(mal_conf_storage_obj.get_Malware_Binary()) - mal_conf_storage_.file = File.from_obj(mal_conf_storage_obj.get_File()) - if mal_conf_storage_obj.get_URL(): - mal_conf_storage_.url = [URI.from_obj(x) for x in mal_conf_obj.get_URL()] - return mal_conf_storage_ - -class MalwareConfigurationObfuscationAlgorithm(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareConfigurationObfuscationAlgorithm, self).__init__() - self.ordinal_position = None - self.key = None - self.algorithm_name = None - - def to_obj(self): - mal_binary_obfusc_alg_obj = package_binding.MalwareConfigurationObfuscationAlgorithmType() - if self.ordinal_position is not None : mal_binary_obfusc_alg_obj.set_ordinal_position(self.ordinal_position) - if self.key is not None : mal_binary_obfusc_alg_obj.set_Key(self.key) - if self.algorithm_name is not None : mal_binary_obfusc_alg_obj.set_Algorithm_Name(self.algorithm_name.to_obj()) - return mal_binary_obfusc_alg_obj - - def to_dict(self): - mal_binary_obfusc_alg_dict = {} - if self.ordinal_position is not None : mal_binary_obfusc_alg_dict['ordinal_position'] = self.ordinal_position - if self.key is not None : mal_binary_obfusc_alg_dict['key'] = self.key - if self.algorithm_name is not None : mal_binary_obfusc_alg_dict['algorithm_name'] = self.algorithm_name.to_dict() - return mal_binary_obfusc_alg_dict - - @staticmethod - def from_dict(mal_binary_obfusc_alg_dict): - if not mal_binary_obfusc_alg_dict: - return None - mal_binary_obfusc_alg_ = MalwareConfigurationObfuscationAlgorithm() - if mal_binary_obfusc_alg_dict['ordinal_position']: mal_binary_obfusc_alg_.ordinal_position = mal_binary_obfusc_alg_dict['ordinal_position'] - if mal_binary_obfusc_alg_dict['key']: mal_binary_obfusc_alg_.key = mal_binary_obfusc_alg_dict['key'] - mal_binary_obfusc_alg_.algorithm_name = VocabString.from_dict(mal_binary_obfusc_alg_dict['algorithm_name']) - return mal_binary_obfusc_alg_ - - @staticmethod - def from_obj(mal_binary_obfusc_alg_obj): - if not mal_binary_obfusc_alg_obj: - return None - mal_binary_obfusc_alg_ = MalwareConfigurationObfuscationAlgorithm() - mal_binary_obfusc_alg_.ordinal_position = mal_binary_obfusc_alg_obj.get_ordinal_position() - mal_binary_obfusc_alg_.key = mal_binary_obfusc_alg_obj.get_Key() - mal_binary_obfusc_alg_.algorithm_name = VocabString.from_obj(mal_binary_obfusc_alg_obj.get_Algorithm_name()) - return mal_binary_obfusc_alg_ - -class MalwareConfigurationObfuscationDetails(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareConfigurationObfuscationDetails, self).__init__() - self.is_encoded = None - self.is_encrypted = None - self.algorithm_details = [] - - def to_obj(self): - mal_conf_obfusc_obj = package_binding.MalwareConfigurationObfuscationDetailsType() - if self.is_encoded is not None : mal_conf_obfusc_obj.set_is_encoded(self.is_encoded) - if self.is_encrypted is not None : mal_conf_obfusc_obj.set_is_encrypted(self.is_encrypted) - if self.algorithm_details is not None: - mal_conf_obfusc_obj.set_Algorithm_Details([x.to_obj() for x in self.algorithm_details]) - return mal_conf_obfusc_obj - - def to_dict(self): - mal_conf_obfusc_dict = {} - if self.is_encoded is not None : mal_conf_obfusc_dict['is_encoded'] = self.is_encoded - if self.is_encrypted is not None : mal_conf_obfusc_dict['is_encrypted'] = self.is_encrypted - if self.algorithm_details is not None: - mal_conf_obfusc_dict['algorithm_details'] = [x.to_dict() for x in self.algorithm_details] - return mal_conf_obfusc_dict - - @staticmethod - def from_dict(mal_conf_obfusc_dict): - if not mal_conf_obfusc_dict: - return None - mal_conf_obfusc_ = MalwareConfigurationObfuscationDetails() - if mal_conf_obfusc_dict['is_encoded']: mal_conf_obfusc_.is_encoded = mal_conf_obfusc_dict['is_encoded'] - if mal_conf_obfusc_dict['is_encrypted']: mal_conf_obfusc_.is_encrypted = mal_conf_obfusc_dict['is_encrypted'] - if mal_conf_obfusc_dict['algorithm_details']: - mal_conf_obfusc_.algorithm_details = [MalwareConfigurationObfuscationAlgorithm.from_dict(x) for x in mal_conf_obfusc_dict['algorithm_details']] - return mal_conf_obfusc_ - - @staticmethod - def from_obj(mal_conf_obfusc_obj): - if not mal_conf_obfusc_obj: - return None - mal_conf_obfusc_ = MalwareConfigurationObfuscationDetails() - mal_conf_obfusc_.is_encoded = mal_conf_obfusc_obj.get_is_encoded() - mal_conf_obfusc_.is_encrypted = mal_conf_obfusc_obj.get_is_encrypted() - if mal_conf_obfusc_obj.get_Algorithm_Details(): - mal_conf_obfusc_.algorithm_details = [MalwareConfigurationObfuscationAlgorithm.from_obj(x) for x in mal_conf_obfusc_obj.get_Algorithm_Details()] - return mal_conf_obfusc_ - -class MalwareConfigurationDetails(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self): - super(MalwareConfigurationDetails, self).__init__() - self.storage = None - self.obfuscation = None - self.configuration_parameter = [] - - def to_obj(self): - mal_conf_obj = package_binding.MalwareConfigurationDetailsType() - if self.storage is not None : mal_conf_obj.set_Storage(self.storage.to_obj()) - if self.obfuscation is not None : mal_conf_obj.set_Obfuscation(self.obfuscation.to_obj()) - if self.configuration_parameter is not None: - mal_conf_obj.set_Configuration_Parameter([x.to_obj() for x in self.configuration_parameter]) - return mal_conf_obj - - def to_dict(self): - mal_conf_dict = {} - if self.storage is not None : mal_conf_dict['storage'] = self.storage.to_dict() - if self.obfuscation is not None : mal_conf_dict['obfuscation'] = self.obfuscation.to_dict() - if self.configuration_parameter is not None: - mal_conf_dict['configuration_parameter'] = [x.to_dict() for x in self.configuration_parameter] - return mal_conf_dict - - @staticmethod - def from_dict(mal_conf_dict): - if not mal_conf_dict: - return None - mal_conf_ = MalwareConfigurationDetails() - mal_conf_.storage = MalwareConfigurationStorageDetails.from_dict(mal_conf_dict.get('storage')) - mal_conf_.obfuscation = MalwareConfigurationStorageDetails.from_dict(mal_conf_dict.get('obfuscation')) - if mal_conf_dict.get('configuration_parameter'): - mal_conf_.configuration_parameter = [MalwareConfigurationParameter.from_dict(x) for x in mal_conf_dict.get('configuration_parameter')] - return mal_conf_ - - @staticmethod - def from_obj(mal_conf_obj): - if not mal_conf_obj: - return None - mal_conf_ = MalwareConfigurationDetails() - mal_conf_.storage = MalwareConfigurationStorageDetails.from_obj(mal_conf_obj.get_Storage()) - mal_conf_.obfuscation = MalwareConfigurationStorageDetails.from_obj(mal_conf_obj.get_Obfuscation()) - if mal_conf_obj.get_Configuration_Parameter(): - mal_conf_.configuration_parameter = [MalwareConfigurationParameter.from_obj(x) for x in mal_conf_obj.get_Configuration_Parameter()] - return mal_conf_ +#MAEC Malware Subject Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation +from cybox.objects.file_object import File +from cybox.objects.uri_object import URI +from cybox.core import Object +import cybox.TypedField + +import maec +import maec.bindings.maec_package as package_binding +from maec.bundle.bundle import Bundle +from maec.package.action_equivalence import ActionEquivalenceList +from maec.package.analysis import Analysis +from maec.package.malware_subject_reference import MalwareSubjectReference +from maec.package.object_equivalence import ObjectEquivalenceList + +class MinorVariants(maec.EntityList): + _contained_type = Object + _binding_class = package_binding.MinorVariantListType + _binding_var = "Minor_Variant" + _namespace = maec.package._namespace + +class Analyses(maec.EntityList): + _contained_type = Analysis + _binding_class = package_binding.AnalysisListType + _binding_var = "Analysis" + _namespace = maec.package._namespace + +class MalwareSubjectRelationship(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectRelationshipType + _namespace = maec.package._namespace + + malware_subject_reference = cybox.TypedField("maleware_subject_reference", MalwareSubjectReference, multiple = True) + type = cybox.TypedField("type", VocabString) + + def __init__(self): + super(MalwareSubjectRelationship, self).__init__() + self.type = None + self.malware_subject_reference = [] + + +class MalwareSubjectRelationshipList(maec.EntityList): + _contained_type = MalwareSubjectRelationship + _binding_class = package_binding.MalwareSubjectRelationshipListType + _binding_var = "Relationship" + _namespace = maec.package._namespace + +class MetaAnalysis(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MetaAnalysisType + _namespace = maec.package._namespace + + action_equivalences = cybox.TypedField("action_equivalences", ActionEquivalenceList) + object_equivalences = cybox.TypedField("object_equivalences", ObjectEquivalenceList) + + def __init__(self): + super(MetaAnalysis, self).__init__() + self.action_equivalences = None + self.object_equivalences = None + +class FindingsBundleList(maec.Entity): + _binding = package_binding + _binding_class = package_binding.FindingsBundleListType + _namespace = maec.package._namespace + + meta_analysis = cybox.TypedField("meta_analysis", MetaAnalysis) + bundle = cybox.TypedField("bundle", Bundle) + bundle_external_reference = cybox.TypedField("bundle_external_reference", multiple = True) + + def __init__(self): + super(FindingsBundleList, self).__init__() + self.meta_analysis = None + self.bundle = [] + self.bundle_external_reference = [] + + def add_bundle(self, bundle): + self.bundle.append(bundle) + + def add_bundle_external_reference(self, bundle_external_reference): + self.bundle_external_reference.append(bundle_external_reference) + +class MalwareDevelopmentEnvironment(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareDevelopmentEnvironmentType + _namespace = maec.package._namespace + + tools = cybox.TypedField("tools", ToolInformation) + debugging_file = cybox.TypedField("debugging_file", File, multiple = True) + + def __init__(self): + super(MalwareDevelopmentEnvironment, self).__init__() + self.tools = None + self.debugging_file = None + + +class MalwareConfigurationParameter(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationParameterType + _namespace = maec.package._namespace + + name = cybox.TypedField("name", VocabString) + value = cybox.TypedField("value") + + def __init__(self): + super(MalwareConfigurationParameter, self).__init__() + self.name = None + self.value = None + + +class MalwareBinaryConfigurationStorageDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType + _namespace = maec.package._namespace + + file_offset = cybox.TypedField("file_offset") + section_name = cybox.TypedField("section_name") + section_offset = cybox.TypedField("section_offset") + + def __init__(self): + super(MalwareBinaryConfigurationStorageDetails, self).__init__() + self.file_offset = None + self.section_name = None + self.section_offset = None + +class MalwareConfigurationStorageDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationStorageDetailsType + _namespace = maec.package._namespace + + malware_binary = cybox.TypedField("malware_binary", MalwareBinaryConfigurationStorageDetails) + file = cybox.TypedField("file", File) + url = cybox.TypedField("url", URI, multiple = True) + + def __init__(self): + super(MalwareConfigurationStorageDetails, self).__init__() + self.malware_binary = None + self.file = None + self.url = [] + +class MalwareConfigurationObfuscationAlgorithm(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType + _namespace = maec.package._namespace + + ordinal_position = cybox.TypedField("ordinal_position") + key = cybox.TypedField("key") + algorithm_name = cybox.TypedField("algorithm_name", VocabString) + + def __init__(self): + super(MalwareConfigurationObfuscationAlgorithm, self).__init__() + self.ordinal_position = None + self.key = None + self.algorithm_name = None + + +class MalwareConfigurationObfuscationDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType + _namespace = maec.package._namespace + + is_encoded = cybox.TypedField("is_encoded") + is_encrypted = cybox.TypedField("is_encrypted") + algorithm_details = cybox.TypedField("algorithm_details", MalwareConfigurationObfuscationAlgorithm, multiple = True) + + def __init__(self): + super(MalwareConfigurationObfuscationDetails, self).__init__() + self.is_encoded = None + self.is_encrypted = None + self.algorithm_details = [] + + +class MalwareConfigurationDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationDetailsType + _namespace = maec.package._namespace + + storage = cybox.TypedField("storage", MalwareConfigurationStorageDetails) + obfuscation = cybox.TypedField("obfuscation", MalwareConfigurationObfuscationDetails) + configuration_parameter = cybox.TypedField("configuration_parameter", MalwareConfigurationParameter, multiple = True) + + def __init__(self): + super(MalwareConfigurationDetails, self).__init__() + self.storage = None + self.obfuscation = None + self.configuration_parameter = [] + +class MalwareSubject(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectType + _namespace = maec.package._namespace + + id = cybox.TypedField("id") + malware_instance_object_attributes = cybox.TypedField("malware_instance_object_attributes", Object) + label = cybox.TypedField("label", VocabString) + configuration_details = cybox.TypedField("configuration_details", MalwareConfigurationDetails) + minor_variants = cybox.TypedField("minor_variants", MinorVariants) + development_environment = cybox.TypedField("development_environment", MalwareDevelopmentEnvironment) + #field_data = cybox.TypedField("field_data") # TODO: support metadata:fieldDataEntry + analyses = cybox.TypedField("analyses", Analyses) + findings_bundles = cybox.TypedField("findings_bundles", FindingsBundleList) + relationships = cybox.TypedField("relationships", MalwareSubjectRelationshipList) + compatible_platform = cybox.TypedField("compatible_platform", PlatformSpecification) + + def __init__(self, id = None, malware_instance_object_attributes = None): + super(MalwareSubject, self).__init__() + if id: + self.id = id + else: + self.id = maec.utils.idgen.create_id(prefix="malware_subject") + #Set the Malware Instance Object Attributes (a CybOX object) if they are not none + self.malware_instance_object_attributes = malware_instance_object_attributes + self.label = [] + self.configuration_details = None + self.minor_variants = MinorVariants() + self.development_environment = None + self.field_data = None + #Instantiate the lists + self.analyses = Analyses() + self.findings_bundles = FindingsBundleList() + self.relationships = MalwareSubjectRelationshipList() + self.compatible_platform = [] + + #Public methods + #Set the Malware_Instance_Object_Attributes with a CybOX object + def set_malware_instance_object_attributes(self, malware_instance_object_attributes): + self.malware_instance_object_attributes = malware_instance_object_attributes + + #Add an Analysis to the Analyses + def add_analysis(self, analysis): + self.analyses.append(analysis) + + def get_analyses(self): + return self.analyses + + #Get all Bundles in the Subject + def get_all_bundles(self): + return self.findings_bundles.bundles + + #Add a MAEC Bundle to the Findings Bundles + def add_findings_bundle(self, bundle): + self.findings_bundles.add_bundle(bundle) + + def deduplicate_bundles(self): + """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" + for findings_bundle in self.findings_bundles.bundles: + findings_bundle.deduplicate() + + def dereference_bundles(self): + """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.dereference_objects([self.malware_instance_object_attributes]) + + def normalize_bundles(self): + """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.normalize_objects() + +class MalwareSubjectList(maec.EntityList): + _contained_type = MalwareSubject + _binding_class = package_binding.MalwareSubjectListType + _binding_var = "Malware_Subject" + _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 04c4534..1912e8a 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -1,44 +1,24 @@ -#MAEC Malware Subject Reference Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -import maec -import maec.bindings.maec_package as package_binding - -class MalwareSubjectReference(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self, malware_subject_idref = None): - super(MalwareSubjectReference, self).__init__() - self.malware_subject_idref = malware_subject_idref - - def to_obj(self): - malware_subject_reference_obj = package_binding.MalwareSubjectReferenceType() - if self.malware_subject_idref is not None : malware_subject_reference_obj.set_malware_subject_idref(self.malware_subject_idref) - return malware_subject_reference_obj - - def to_dict(self): - malware_subject_reference_dict = {} - if self.malware_subject_idref is not None : malware_subject_reference_dict['malware_subject_idref'] = self.malware_subject_idref - return malware_subject_reference_dict - - @staticmethod - def from_dict(malware_subject_reference_dict): - if not malware_subject_reference_dict: - return None - malware_subject_reference_ = MalwareSubjectReference() - malware_subject_reference_.malware_subject_idref = malware_subject_reference_dict.get('malware_subject_idref') - return malware_subject_reference_ - - @staticmethod - def from_obj(malware_subject_reference_obj): - if not malware_subject_reference_obj: - return None - malware_subject_reference_ = MalwareSubjectReference() - malware_subject_reference_.malware_subject_idref = malware_subject_reference_obj.get_malware_subject_idref() - return malware_subject_reference_ +#MAEC Malware Subject Reference Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +import cybox + +class MalwareSubjectReference(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectReferenceType + _namespace = maec.package._namespace + + malware_subject_idref = cybox.TypedField("malware_subject_idref") + + def __init__(self, malware_subject_idref = None): + super(MalwareSubjectReference, self).__init__() + self.malware_subject_idref = malware_subject_idref + \ No newline at end of file diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 2ee461f..c9cbcd0 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -1,59 +1,31 @@ -#MAEC Action Equivalence Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.object_reference import ObjectReference - -class ObjectEquivalence(maec.Entity): - _namespace = maec.package._namespace - - def init(self, id = None): - super(ObjectEquivalence, self).__init__() - self.id = id - self.object_references = [] - - def to_obj(self): - object_equivalence_obj = package_binding.ObjectEquivalenceType() - if self.id is not None : object_equivalence_obj.set_id(self.id) - if len(self.object_references) > 0: - for object_reference in self.object_references: object_equivalence_obj.add_object_Reference(object_reference.to_obj()) - return object_equivalence_obj - - def to_dict(self): - object_equivalence_dict = {} - if self.id is not None : object_equivalence_dict['id'] = self.id - if len(self.object_references) > 0: - object_reference_list = [] - for object_reference in self.object_references: object_reference_list.append(object_reference.to_dict()) - object_equivalence_dict['object_references'] = object_reference_list - return object_equivalence_dict - - @staticmethod - def from_dict(object_equivalence_dict): - if not object_equivalence_dict: - return None - object_equivalence_ = ObjectEquivalence() - object_equivalence_.id = object_equivalence_dict.get('id') - object_equivalence_.object_references = [ObjectReference.from_dict(x) for x in object_equivalence_dict.get('object_references', [])] - return object_equivalence_ - - @staticmethod - def from_obj(object_equivalence_obj): - if not object_equivalence_obj: - return None - object_equivalence_ = ObjectEquivalence() - object_equivalence_.id = object_equivalence_obj.get_id() - object_equivalence_.object_references = [ObjectReference.from_obj(x) for x in object_equivalence_obj.get_object_Reference()] - return object_equivalence_ - -class ObjectEquivalenceList(maec.EntityList): - _contained_type = ObjectEquivalence - _binding_class = package_binding.ObjectEquivalenceListType - _binding_var = "Object_Equivalence" +#MAEC Action Equivalence Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import cybox.TypedField +import maec.bindings.maec_package as package_binding +from maec.bundle.object_reference import ObjectReference + +class ObjectEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ObjectEquivalenceType + _namespace = maec.package._namespace + + id = cybox.TypedField("id") + object_reference = cybox.TypedField("object_reference", ObjectReference, multiple = True) + + def init(self, id = None): + super(ObjectEquivalence, self).__init__() + self.id = id + self.object_reference = [] + +class ObjectEquivalenceList(maec.EntityList): + _contained_type = ObjectEquivalence + _binding_class = package_binding.ObjectEquivalenceListType + _binding_var = "Object_Equivalence" _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/package.py b/maec/package/package.py index b56a94b..87f607a 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -1,108 +1,73 @@ -#MAEC Package Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 - -import maec -import datetime -import maec.bindings.maec_package as package_binding -from maec.package.malware_subject import MalwareSubjectList -from maec.package.grouping_relationship import GroupingRelationshipList - -class Package(maec.Entity): - _namespace = maec.package._namespace - - def __init__(self, id = None, schema_version = "2.1", timestamp = None): - super(Package, self).__init__() - if id: - self.id = id - else: - self.id = maec.utils.idgen.create_id(prefix="package") - self.schema_version = schema_version - self.timestamp = timestamp - self.malware_subjects = MalwareSubjectList() - self.grouping_relationships = GroupingRelationshipList() - - #Public methods - #Add a malware subject - def add_malware_subject(self, malware_subject): - self.malware_subjects.append(malware_subject) - - #Add a grouping relationship - def add_grouping_relationship(self, grouping_relationship): - self.grouping_relationships.append(grouping_relationship) - - def to_obj(self): - package_obj = package_binding.PackageType(id=self.id) - if self.schema_version is not None: package_obj.set_schema_version(self.schema_version) - if self.timestamp is not None: package_obj.set_timestamp(self.timestamp.isoformat()) - if len(self.malware_subjects) > 0: package_obj.set_Malware_Subjects(self.malware_subjects.to_obj()) - if len(self.grouping_relationships) > 0: package_obj.set_Grouping_Relationships(self.grouping_relationships.to_obj()) - return package_obj - - def to_dict(self): - package_dict = {} - if self.id is not None : package_dict['id'] = self.id - if self.schema_version is not None: package_dict['schema_version'] = self.schema_version - if self.timestamp is not None: package_dict['timestamp'] = self.timestamp.isoformat() - if len(self.malware_subjects) > 0: package_dict['malware_subjects'] = self.malware_subjects.to_list() - if len(self.grouping_relationships) > 0: package_dict['grouping_relationships'] = self.grouping_relationships.to_list() - return package_dict - - #Build the Package from the input dictionary - @staticmethod - def from_dict(package_dict): - if not package_dict: - return None - package_ = Package(None) - package_.id = package_dict.get('id') - package_.schema_version = package_dict.get('schema_version') - if package_dict.get('timestamp'): - package_.timestamp = datetime.datetime.strptime(package_dict.get('timestamp'), "%Y-%m-%dT%H:%M:%S.%f") - package_.malware_subjects = MalwareSubjectList.from_list(package_dict.get('malware_subjects', [])) - package_.grouping_relationships = GroupingRelationshipList.from_list(package_dict.get('grouping_relationships', [])) - return package_ - - @staticmethod - def from_obj(package_obj): - if not package_obj: - return None - package_ = Package(None) - package_.id = package_obj.get_id() - package_.schema_version = package_obj.get_schema_version() - package_.timestamp = package_obj.get_timestamp() - if package_obj.get_Malware_Subjects() is not None : package_.malware_subjects = MalwareSubjectList.from_obj(package_obj.get_Malware_Subjects()) - if package_obj.get_Grouping_Relationships() is not None : package_.grouping_relationships = GroupingRelationshipList.from_obj(package_obj.get_Grouping_Relationships()) - return package_ - - @staticmethod - def from_xml(xml_file): - ''' - Returns a tuple of (api_object, binding_object). - Parameters: - xml_file - either a filename or a stream object - ''' - - if isinstance(xml_file, basestring): - f = open(xml_file, "rb") - else: - f = xml_file - - doc = package_binding.parsexml_(f) - maec_package_obj = package_binding.PackageType().factory() - maec_package_obj.build(doc.getroot()) - maec_package = Package.from_obj(maec_package_obj) - - return (maec_package, maec_package_obj) - - - def deduplicate_malware_subjects(self): - """DeDuplicate all Malware_Subjects in the Package. For now, only handles Objects in Findings Bundles""" - for malware_subject in self.malware_subjects: - malware_subject.deduplicate_bundles() - - - +#MAEC Package Class + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +from maec.package.malware_subject import MalwareSubjectList +from maec.package.grouping_relationship import GroupingRelationshipList +from cybox.common import DateTime + +class Package(maec.Entity): + _binding = package_binding + _binding_class = package_binding.PackageType + _namespace = maec.package._namespace + + id = maec.TypedField('id') + timestamp = maec.TypedField('timestamp') + malware_subjects = maec.TypedField('malware_subjects', MalwareSubjectList) + grouping_relationships = maec.TypedField('grouping_relationships', GroupingRelationshipList) + + def __init__(self, id = None, schema_version = "2.1", timestamp = None): + super(Package, self).__init__() + if id: + self.id = id + else: + self.id = maec.utils.idgen.create_id(prefix="package") + self.schema_version = schema_version + self.timestamp = timestamp + self.malware_subjects = MalwareSubjectList() + self.grouping_relationships = GroupingRelationshipList() + + #Public methods + #Add a malware subject to this Package + def add_malware_subject(self, malware_subject): + self.malware_subjects.append(malware_subject) + + #Add a grouping relationship + def add_grouping_relationship(self, grouping_relationship): + self.grouping_relationships.append(grouping_relationship) + + # Create new Package from the XML document at the specified path + @staticmethod + def from_xml(xml_file): + ''' + Returns a tuple of (api_object, binding_object). + Parameters: + xml_file - either a filename or a stream object + ''' + + if isinstance(xml_file, basestring): + f = open(xml_file, "rb") + else: + f = xml_file + + doc = package_binding.parsexml_(f) + maec_package_obj = package_binding.PackageType().factory() + maec_package_obj.build(doc.getroot()) + maec_package = Package.from_obj(maec_package_obj) + + return (maec_package, maec_package_obj) + + # Transform duplicate objects within this Package into references pointing to a single canonical object + def deduplicate_malware_subjects(self): + """DeDuplicate all Malware_Subjects in the Package. For now, only handles Objects in Findings Bundles""" + for malware_subject in self.malware_subjects: + malware_subject.deduplicate_bundles() + + + From 803edba9bcf6d45c6be1284a53f4d5a50c29f955 Mon Sep 17 00:00:00 2001 From: apsillers Date: Wed, 20 Aug 2014 15:54:16 -0400 Subject: [PATCH 027/297] Rollback to Ivan's changes that I clobbered --- maec/__init__.py | 218 -------------------------------- maec/bundle/bundle_reference.py | 32 +---- 2 files changed, 5 insertions(+), 245 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 8b34fd2..44213b8 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -37,207 +37,6 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" - # By default (unless a particular subclass states otherwise), try to "cast" - # invalid objects to the correct class using the constructor. Entity - # subclasses should either provide a "sane" constructor or set this to - # False. - _try_cast = True - - def __init__(self): - self._fields = {} - - @classmethod - def _get_vars(cls): - var_list = [] - for (name, obj) in inspect.getmembers(cls, inspect.isdatadescriptor): - if isinstance(obj, TypedField): - var_list.append(obj) - - return var_list - - def __eq__(self, other): - # This fixes some strange behavior where an object isn't equal to - # itself - if other is self: - return True - - # I'm not sure about this, if we want to compare exact classes or if - # various subclasses will also do (I think not), but for now I'm going - # to assume they must be equal. - GTB - if self.__class__ != other.__class__: - return False - - var_list = self.__class__._get_vars() - - # If there are no TypedFields, assume this class hasn't been - # "TypedField"-ified, so we don't want these to inadvertently return - # equal. - if not var_list: - return False - - for f in var_list: - if not f.comparable: - continue - if getattr(self, f.attr_name) != getattr(other, f.attr_name): - return False - - return True - - def __ne__(self, other): - return not self == other - - def to_obj(self): - """Default implementation of a to_obj function. - - Subclasses can override this function.""" - - entity_obj = self._binding_class() - - for field in self.__class__._get_vars(): - val = getattr(self, field.attr_name) - - if field.multiple: - if val: - val = [x.to_obj() for x in val] - else: - val = [] - elif isinstance(val, Entity): - val = val.to_obj() - - setattr(entity_obj, field.name, val) - - self._finalize_obj(entity_obj) - - return entity_obj - - def _finalize_obj(self, entity_obj): - """Subclasses can define additional items in the binding object. - - `entity_obj` should be modified in place. - """ - pass - - def to_dict(self): - """Default implementation of a to_dict function. - - Subclasses can override this function.""" - - entity_dict = {} - - for field in self.__class__._get_vars(): - val = getattr(self, field.attr_name) - - - if field.multiple: - if val: - val = [x.to_dict() for x in val] - else: - val = [] - elif isinstance(val, Entity): - val = val.to_dict() - - # Only add non-None objects or non-empty lists - if val is not None and val != []: - entity_dict[field.key_name] = val - - self._finalize_dict(entity_dict) - - return entity_dict - - def _finalize_dict(self, entity_dict): - """Subclasses can define additional items in the dictionary. - - `entity_dict` should be modified in place. - """ - pass - - @classmethod - def from_obj(cls, cls_obj=None): - if not cls_obj: - return None - - entity = cls() - - for field in cls._get_vars(): - val = getattr(cls_obj, field.name) - if field.type_: - if field.multiple and val is not None: - val = [field.type_.from_obj(x) for x in val] - else: - val = field.type_.from_obj(val) - setattr(entity, field.attr_name, val) - - return entity - - @classmethod - def from_dict(cls, cls_dict=None): - if cls_dict is None: - return None - - entity = cls() - - # Shortcut if an actual dict is not provided: - if not isinstance(cls_dict, dict): - value = cls_dict - # Call the class's constructor - try: - return cls(value) - except TypeError: - raise TypeError("Could not instantiate a %s from a %s: %s" % - (cls, type(value), value)) - - for field in cls._get_vars(): - val = cls_dict.get(field.key_name) - if field.type_: - if issubclass(field.type_, EntityList): - val = field.type_.from_list(val) - elif field.multiple: - if val is not None: - val = [field.type_.from_dict(x) for x in val] - else: - val = [] - else: - val = field.type_.from_dict(val) - - else: - if field.multiple and not val: - val = [] - setattr(entity, field.attr_name, val) - - return entity - - def to_xml(self, include_namespaces=True, namespace_dict=None, - pretty=True): - """Export an object as an XML String. - - :param include_namespaces: whether to include xmlns and - xsi:schemaLocation attributes on the root element. Set to true by - default. - :type include_namespaces: bool - :param namespace_dict: mapping of additional XML namespaces to prefixes - :type namespace_dict: dict - :param pretty: produce readable (``True``) or compact (``False``) - output. Default is ``True`` - :type pretty: bool - """ - namespace_def = "" - - if include_namespaces: - # Update the namespace dictionary with namespaces found upon import - if namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict.update(self.__input_namespaces__) - elif not namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict = self.__input_namespaces__ - namespace_def = self._get_namespace_def(namespace_dict) - - if not pretty: - namespace_def = namespace_def.replace('\n\t', ' ') - - s = StringIO() - self.to_obj().export(s, 0, namespacedef_=namespace_def, - pretty_print=pretty) - return s.getvalue() - def to_xml_file(self, filename, namespace_dict=None): """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" # Update the namespace dictionary with namespaces found upon import @@ -249,11 +48,6 @@ def to_xml_file(self, filename, namespace_dict=None): out_file.write("\n") self.to_obj().export(out_file, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() - - def to_json(self): - """Export an object as a JSON string. - """ - return json.dumps(self.to_dict()) def _get_namespace_def(self, additional_ns_dict=None): # copy necessary namespaces @@ -311,18 +105,6 @@ def _get_children(self): if isinstance(item, Entity) or isinstance(item, cyboxEntity): yield item - @classmethod - def istypeof(cls, obj): - """Check if `cls` is the type of `obj` - - In the normal case, as implemented here, a simple isinstance check is - used. However, there are more complex checks possible. For instance, - EmailAddress.istypeof(obj) checks if obj is an Address object with - a category of Address.CAT_EMAIL - """ - return isinstance(obj, cls) - - class EntityList(collections.MutableSequence, Entity): _contained_type = object diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index d06a7ad..77c17a7 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -4,41 +4,19 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 02/18/2014 +#Last updated 08/14/2014 import maec import maec.bindings.maec_bundle as bundle_binding class BundleReference(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.BundleReferenceType + + bundle_idref = maec.TypedField("bundle_idref") def __init__(self, bundle_idref = None): super(BundleReference, self).__init__() self.bundle_idref = bundle_idref - - def to_obj(self): - bundle_reference_obj = bundle_binding.BundleReferenceType() - if self.bundle_idref is not None : bundle_reference_obj.set_bundle_idref(self.bundle_idref) - return bundle_reference_obj - - def to_dict(self): - bundle_reference_dict = {} - if self.bundle_idref is not None : bundle_reference_dict['bundle_idref'] = self.bundle_idref - return bundle_reference_dict - - @staticmethod - def from_dict(bundle_reference_dict): - if not bundle_reference_dict: - return None - bundle_reference_ = BundleReference() - bundle_reference_.bundle_idref = bundle_reference_dict.get('bundle_idref') - return bundle_reference_ - - @staticmethod - def from_obj(bundle_reference_obj): - if not bundle_reference_obj: - return None - bundle_reference_ = BundleReference() - bundle_reference_.bundle_idref = bundle_reference_obj.get_bundle_idref() - return bundle_reference_ \ No newline at end of file From bee38f6a465829f522750bb77281574085335551 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 11:27:31 -0400 Subject: [PATCH 028/297] Added validity check for real_object inside of dereference_objects in Bundle() --- maec/bundle/bundle.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index cc5bf17..a48068f 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -4,7 +4,7 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 07/8/2014 +#Last updated 08/21/2014 import datetime @@ -282,9 +282,10 @@ def dereference_objects(self, extra_objects = []): for object in all_objects: if object.idref and not object.id_: real_object = self.get_object_by_id(object.idref, extra_objects, ignore_actions = True) - object.idref = None - object.id_ = real_object.id_ - object.properties = real_object.properties + if real_object: + object.idref = None + object.id_ = real_object.id_ + object.properties = real_object.properties def to_obj(self): bundle_obj = bundle_binding.BundleType(id=self.id) From 3dd9227373566ebca6b850500608a4d82525f9dc Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 13:14:53 -0400 Subject: [PATCH 029/297] Updated print_distances() to output to a file --- maec/analytics/distance.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py index c4f76b1..c7a2a04 100644 --- a/maec/analytics/distance.py +++ b/maec/analytics/distance.py @@ -579,8 +579,10 @@ def calculate(self): # Perform the actual distance calculation self.perform_calculation() - def print_distances(self, default_label = 'md5', delimiter = ','): - '''Print the distances between the Malware Subjects in delimited matrix format. + def print_distances(self, file_object, default_label = 'md5', delimiter = ','): + '''Print the distances between the Malware Subjects in delimited matrix format + to a File-like object. + Try to use the MD5s of the Malware Subjects as the default label. Uses commas as the default delimiter, for CSV-like output.''' hashes_mapping = self.populate_hashes_mapping(self.normalized_subjects) @@ -605,8 +607,9 @@ def print_distances(self, default_label = 'md5', delimiter = ','): distance_strings.append(distance_string.rstrip(delimiter)) # Print the header and distance strings - print header_string.rstrip(delimiter) + file_object.write(header_string.rstrip(delimiter) + "\n") for distance_string in distance_strings: - print distance_string + file_object.write(distance_string + "\n") + file_object.flush() From 7be18fe384721feb64e31f5b3e3fcd112c80df57 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 14:10:11 -0400 Subject: [PATCH 030/297] Initial commit of distance calculation script --- scripts/calculate_distance.py | 55 +++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 scripts/calculate_distance.py diff --git a/scripts/calculate_distance.py b/scripts/calculate_distance.py new file mode 100644 index 0000000..594d234 --- /dev/null +++ b/scripts/calculate_distance.py @@ -0,0 +1,55 @@ +# calculate_distance script +# Calculates and prints the distance between two or more MAEC Malware Subjects + +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import os +import maec +import argparse +from maec.analytics.distance import Distance +from maec.package.package import Package + +def main(): + # Setup the argument parser + parser = argparse.ArgumentParser(description="MAEC Distance Calculation script") + group = parser.add_mutually_exclusive_group() + group.add_argument("-l", "-list", nargs="+", help="a space separated list of MAEC Package files to calculate the distances for") + group.add_argument("-d", "-directory", help="the path to a directory of MAEC Package files to calculate the distances for") + parser.add_argument("--only_static", "--only_static", help="use only static features in the distance calculation", action="store_true") + parser.add_argument("--only_dynamic", "--only_dynamic", help="use only dynamic features (Actions) in the distance calculation", action="store_true") + parser.add_argument("output", help="the name of the CSV file to which the calculated distances will be written") + args = parser.parse_args() + package_list = [] + + # Parse the input files + if args.l: + for file in args.l: + api_obj = maec.parse_xml_instance(file)['api'] + if isinstance(api_obj, Package): + package_list.append(api_obj) + elif args.d: + for filename in os.listdir(args.d): + if '.xml' not in filename: + pass + else: + api_obj = maec.parse_xml_instance(os.path.join(args.d, filename))['api'] + if isinstance(api_obj, Package): + package_list.append(api_obj) + + # Perform the distance calculation + dist = Distance(package_list) + # Set the particular features that will be used + if args.only_static: + dist.options_dict['use_dynamic_features'] = False + if args.only_dynamic: + dist.options_dict['use_static_features'] = False + dist.calculate() + # Write the results to the specified CSV file + out_file = open(args.output, mode='w') + dist.print_distances(out_file) + out_file.close() + + +if __name__ == "__main__": + main() \ No newline at end of file From f78a8661ee0333d129d93af8a7e5512b166e5f12 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 14:39:43 -0400 Subject: [PATCH 031/297] Added missing cybox import --- maec/package/analysis.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 98b3856..d152104 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -6,11 +6,11 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 +import cybox from cybox.common import (PlatformSpecification, Personnel, StructuredText, ToolInformation) from cybox.objects.system_object import System -import cybox.TypedField import maec import maec.bindings.maec_package as package_binding from maec.bundle.bundle_reference import BundleReference From f3e39316d62934cc4e75d0af58fa8c27b964722f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 14:42:16 -0400 Subject: [PATCH 032/297] Added missing cybox import --- maec/package/malware_subject.py | 2 +- maec/package/object_equivalence.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 4c04619..52d4f54 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -6,11 +6,11 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 +import cybox from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation from cybox.objects.file_object import File from cybox.objects.uri_object import URI from cybox.core import Object -import cybox.TypedField import maec import maec.bindings.maec_package as package_binding diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index c9cbcd0..0ccbfac 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -6,8 +6,8 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 +import cybox import maec -import cybox.TypedField import maec.bindings.maec_package as package_binding from maec.bundle.object_reference import ObjectReference From d4f2b623b21d8bcabb5c4873378f9b3b07f78d38 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 14:45:12 -0400 Subject: [PATCH 033/297] Removed extraneous definitions in __init__ --- maec/package/malware_subject.py | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 52d4f54..2ffe735 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -198,7 +198,7 @@ class MalwareSubject(maec.Entity): id = cybox.TypedField("id") malware_instance_object_attributes = cybox.TypedField("malware_instance_object_attributes", Object) - label = cybox.TypedField("label", VocabString) + label = cybox.TypedField("label", VocabString, multiple=True) configuration_details = cybox.TypedField("configuration_details", MalwareConfigurationDetails) minor_variants = cybox.TypedField("minor_variants", MinorVariants) development_environment = cybox.TypedField("development_environment", MalwareDevelopmentEnvironment) @@ -206,7 +206,7 @@ class MalwareSubject(maec.Entity): analyses = cybox.TypedField("analyses", Analyses) findings_bundles = cybox.TypedField("findings_bundles", FindingsBundleList) relationships = cybox.TypedField("relationships", MalwareSubjectRelationshipList) - compatible_platform = cybox.TypedField("compatible_platform", PlatformSpecification) + compatible_platform = cybox.TypedField("compatible_platform", PlatformSpecification, multiple=True) def __init__(self, id = None, malware_instance_object_attributes = None): super(MalwareSubject, self).__init__() @@ -216,16 +216,6 @@ def __init__(self, id = None, malware_instance_object_attributes = None): self.id = maec.utils.idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes - self.label = [] - self.configuration_details = None - self.minor_variants = MinorVariants() - self.development_environment = None - self.field_data = None - #Instantiate the lists - self.analyses = Analyses() - self.findings_bundles = FindingsBundleList() - self.relationships = MalwareSubjectRelationshipList() - self.compatible_platform = [] #Public methods #Set the Malware_Instance_Object_Attributes with a CybOX object From 93b87cdcb7d05ac6ace602a50f065fac45eda98a Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 14:49:32 -0400 Subject: [PATCH 034/297] Fixed a few type definition issues --- maec/package/malware_subject.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 2ffe735..0f8a622 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -71,14 +71,12 @@ class FindingsBundleList(maec.Entity): _namespace = maec.package._namespace meta_analysis = cybox.TypedField("meta_analysis", MetaAnalysis) - bundle = cybox.TypedField("bundle", Bundle) + bundle = cybox.TypedField("bundle", Bundle, multiple = True) bundle_external_reference = cybox.TypedField("bundle_external_reference", multiple = True) def __init__(self): super(FindingsBundleList, self).__init__() self.meta_analysis = None - self.bundle = [] - self.bundle_external_reference = [] def add_bundle(self, bundle): self.bundle.append(bundle) @@ -216,6 +214,8 @@ def __init__(self, id = None, malware_instance_object_attributes = None): self.id = maec.utils.idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes + self.analyses = Analyses() + self.findings_bundles = FindingsBundleList() #Public methods #Set the Malware_Instance_Object_Attributes with a CybOX object From 8411012321dd6820209df0eeb16b9ace01eb93c7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 15:42:15 -0400 Subject: [PATCH 035/297] Changed id to id_ to avoid colliding with python keywords --- maec/package/malware_subject.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 0f8a622..7a3b1a3 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -194,8 +194,8 @@ class MalwareSubject(maec.Entity): _binding_class = package_binding.MalwareSubjectType _namespace = maec.package._namespace - id = cybox.TypedField("id") - malware_instance_object_attributes = cybox.TypedField("malware_instance_object_attributes", Object) + id_ = cybox.TypedField("id") + malware_instance_object_attributes = cybox.TypedField("Malware_Instance_Object_Attributes", Object) label = cybox.TypedField("label", VocabString, multiple=True) configuration_details = cybox.TypedField("configuration_details", MalwareConfigurationDetails) minor_variants = cybox.TypedField("minor_variants", MinorVariants) @@ -209,9 +209,9 @@ class MalwareSubject(maec.Entity): def __init__(self, id = None, malware_instance_object_attributes = None): super(MalwareSubject, self).__init__() if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="malware_subject") + self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes self.analyses = Analyses() From 85debd42c701396905d22020934e722430158ed5 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 15:42:40 -0400 Subject: [PATCH 036/297] Changed id to id_ to avoid colliding with python keywords; also, updated some typedfield names to exactly mirror the element names in the XML schema --- maec/package/package.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/maec/package/package.py b/maec/package/package.py index 87f607a..9a4c615 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -17,21 +17,20 @@ class Package(maec.Entity): _binding_class = package_binding.PackageType _namespace = maec.package._namespace - id = maec.TypedField('id') + id_ = maec.TypedField('id') timestamp = maec.TypedField('timestamp') - malware_subjects = maec.TypedField('malware_subjects', MalwareSubjectList) - grouping_relationships = maec.TypedField('grouping_relationships', GroupingRelationshipList) + malware_subjects = maec.TypedField('Malware_Subjects', MalwareSubjectList) + grouping_relationships = maec.TypedField('Grouping_Relationships', GroupingRelationshipList) def __init__(self, id = None, schema_version = "2.1", timestamp = None): super(Package, self).__init__() if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="package") + self.id_ = maec.utils.idgen.create_id(prefix="package") self.schema_version = schema_version self.timestamp = timestamp self.malware_subjects = MalwareSubjectList() - self.grouping_relationships = GroupingRelationshipList() #Public methods #Add a malware subject to this Package @@ -40,6 +39,8 @@ def add_malware_subject(self, malware_subject): #Add a grouping relationship def add_grouping_relationship(self, grouping_relationship): + if not self.grouping_relationships: + self.grouping_relationships = GroupingRelationshipList() self.grouping_relationships.append(grouping_relationship) # Create new Package from the XML document at the specified path From d402a17fbede53a446a24d44760808f8dfd7b5cd Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 21 Aug 2014 16:25:37 -0400 Subject: [PATCH 037/297] Updated .id usage on Malware Subjects to .id_ to account for new updates --- maec/analytics/distance.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py index c7a2a04..e34ee9b 100644 --- a/maec/analytics/distance.py +++ b/maec/analytics/distance.py @@ -372,7 +372,7 @@ def generate_feature_vectors(self, merged_subjects): for malware_subject in merged_subjects: feature_vector_dict = {'dynamic' : DynamicFeatureVector(malware_subject, self.deduplicator, self.ignored_object_properties, self.ignored_actions), 'static' : StaticFeatureVector(malware_subject, self.deduplicator)} - self.feature_vectors[malware_subject.id] = feature_vector_dict + self.feature_vectors[malware_subject.id_] = feature_vector_dict def flatten_vector(self, vector_entry_list): '''Generate a single, flattened vector from an input list of vectors or values.''' @@ -524,7 +524,7 @@ def populate_hashes_mapping(self, malware_subject_list): value = hash.fuzzy_hash_value.value if type and value: hashes_dict[str(type).lower()] = str(value).lower() - hashes_mapping[malware_subject.id] = hashes_dict + hashes_mapping[malware_subject.id_] = hashes_dict return hashes_mapping def perform_calculation(self): @@ -591,18 +591,18 @@ def print_distances(self, file_object, default_label = 'md5', delimiter = ','): header_string = '' + delimiter for malware_subject in self.normalized_subjects: distance_string = '' - hashes = hashes_mapping[malware_subject.id] + hashes = hashes_mapping[malware_subject.id_] if default_label in hashes: distance_string += (hashes[default_label] + delimiter) header_string += (hashes[default_label] + delimiter) else: - distance_string += (malware_subject.id + delimiter) - header_string += (malware_subject.id + delimiter) + distance_string += (malware_subject.id_ + delimiter) + header_string += (malware_subject.id_ + delimiter) for other_malware_subject in self.normalized_subjects: - if malware_subject.id == other_malware_subject.id: + if malware_subject.id_ == other_malware_subject.id_: distance_string += ('0.0' + delimiter) else: - distance_string += (str(self.distances[malware_subject.id][other_malware_subject.id]) + distance_string += (str(self.distances[malware_subject.id_][other_malware_subject.id_]) + delimiter) distance_strings.append(distance_string.rstrip(delimiter)) From c7815c0e9efecc19001497d4cb1359f735aeffb7 Mon Sep 17 00:00:00 2001 From: apsillers Date: Thu, 21 Aug 2014 16:35:15 -0400 Subject: [PATCH 038/297] TypedField updates for Package classes --- examples/package_parsing_example.py | 2 +- maec/package/action_equivalence.py | 5 +- maec/package/analysis.py | 111 ++++++++-------------- maec/package/grouping_relationship.py | 54 ++++------- maec/package/malware_subject.py | 99 ++++++++----------- maec/package/malware_subject_reference.py | 4 +- maec/package/object_equivalence.py | 7 +- maec/package/package.py | 1 + 8 files changed, 105 insertions(+), 178 deletions(-) diff --git a/examples/package_parsing_example.py b/examples/package_parsing_example.py index ba7c57e..36cf9cf 100644 --- a/examples/package_parsing_example.py +++ b/examples/package_parsing_example.py @@ -13,4 +13,4 @@ # For this example, iterate through the Malware Subjects # in the input Package, and print the ID of each for malware_subject in maec_package.malware_subjects: - print malware_subject.id \ No newline at end of file + print malware_subject.id_ \ No newline at end of file diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index ebc9686..d94d187 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -15,13 +15,12 @@ class ActionEquivalence(maec.Entity): _binding_class = package_binding.ActionEquivalenceType _namespace = maec.package._namespace - id = maec.TypedField('id') + id_ = maec.TypedField('id') action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) def __init__(self): super(ActionEquivalence, self).__init__() - self.id = maec.utils.idgen.create_id(prefix="action_equivalence") - self.action_reference = None + self.id_ = maec.utils.idgen.create_id(prefix="action_equivalence") class ActionEquivalenceList(maec.EntityList): _contained_type = ActionEquivalence diff --git a/maec/package/analysis.py b/maec/package/analysis.py index d152104..67a6522 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -20,34 +20,26 @@ class Source(maec.Entity): _binding_class = package_binding.SourceType _namespace = maec.package._namespace - name = cybox.TypedField("name") - method = cybox.TypedField("method") - reference = cybox.TypedField("reference") - organization = cybox.TypedField("organization") - url = cybox.TypedField("url") + name = maec.TypedField("Name") + method = maec.TypedField("Method") + reference = maec.TypedField("Reference") + organization = maec.TypedField("Organization") + url = maec.TypedField("URL") def __init__(self): super(Source, self).__init__() - self.name = None - self.method = None - self.reference = None - self.organization = None - self.url = None class Comment(StructuredText): _binding = package_binding _binding_class = package_binding.CommentType _namespace = maec.package._namespace - author = cybox.TypedField("author") - timestamp = cybox.TypedField("timestamp") - observation_name = cybox.TypedField("observation_name") + author = maec.TypedField("author") + timestamp = maec.TypedField("timestamp") + observation_name = maec.TypedField("observation_name") def __init__(self): super(Comment, self).__init__() - self.author = None - self.timestamp = None - self.observation_name = None def is_plain(self): """Whether this can be represented as a string rather than a dictionary @@ -74,27 +66,23 @@ class DynamicAnalysisMetadata(maec.Entity): _binding_class = package_binding.DynamicAnalysisMetadataType _namespace = maec.package._namespace - command_line = cybox.TypedField("command_line") - analysis_duration = cybox.TypedField("analysis_duration") - exit_code = cybox.TypedField("exit_code") - #raised_exception = cybox.TypedField("raised_exception", MalwareException) + command_line = maec.TypedField("Command_Line") + analysis_duration = maec.TypedField("Analysis_Duration") + exit_code = maec.TypedField("Exit_Code") + #raised_exception = maec.TypedField("Raised_Exception", MalwareException) def __init__(self): super(DynamicAnalysisMetadata, self).__init__() - self.command_line = None - self.analysis_duration = None - self.exit_code = None class HypervisorHostSystem(System): _binding = package_binding _binding_class = package_binding.HypervisorHostSystemType _namespace = maec.package._namespace - vm_hypervisor = cybox.TypedField("vm_hypervisor", PlatformSpecification) + vm_hypervisor = maec.TypedField("VM_Hypervisor", PlatformSpecification) def __init__(self): super(HypervisorHostSystem, self).__init__() - self.vm_hypervisor = None class InstalledPrograms(maec.EntityList): _contained_type = PlatformSpecification @@ -107,7 +95,7 @@ class AnalysisSystem(System): _binding_class = package_binding.AnalysisSystemType _namespace = maec.package._namespace - installed_programs = cybox.TypedField("installed_programs", InstalledPrograms) + installed_programs = maec.TypedField("Installed_Programs", InstalledPrograms) def __init__(self): super(AnalysisSystem, self).__init__() @@ -124,17 +112,13 @@ class CapturedProtocol(maec.Entity): _binding_class = package_binding.CapturedProtocolType _namespace = maec.package._namespace - layer7_protocol = cybox.TypedField("layer7_protocol") - layer4_protocol = cybox.TypedField("layer4_protocol") - port_number = cybox.TypedField("port_number") - interaction_level = cybox.TypedField("interaction_level") + layer7_protocol = maec.TypedField("layer7_protocol") + layer4_protocol = maec.TypedField("layer4_protocol") + port_number = maec.TypedField("port_number") + interaction_level = maec.TypedField("interaction_level") def __init__(self): super(CapturedProtocol, self).__init__() - self.layer7_protocol = None - self.layer4_protocol = None - self.port_number = None - self.interaction_level = None class CapturedProtocolList(maec.EntityList): _contained_type = CapturedProtocol @@ -147,7 +131,7 @@ class NetworkInfrastructure(maec.Entity): _binding_class = package_binding.NetworkInfrastructureType _namespace = maec.package._namespace - captured_protocols = cybox.TypedField("captured_protocols", CapturedProtocolList) + captured_protocols = maec.TypedField("Captured_Protocols", CapturedProtocolList) def __init__(self): super(NetworkInfrastructure, self).__init__() @@ -158,59 +142,46 @@ class AnalysisEnvironment(maec.Entity): _binding_class = package_binding.AnalysisEnvironmentType _namespace = maec.package._namespace - hypervisor_host_system = cybox.TypedField("hypervisor_host_system", HypervisorHostSystem) - analysis_systems = cybox.TypedField("analysis_systems", AnalysisSystemList) - network_infrastructure = cybox.TypedField("network_infrastructure", NetworkInfrastructure) + hypervisor_host_system = maec.TypedField("Hypervisor_Host_System", HypervisorHostSystem) + analysis_systems = maec.TypedField("Analysis_Systems", AnalysisSystemList) + network_infrastructure = maec.TypedField("Network_Infrastructure", NetworkInfrastructure) def __init__(self): super(AnalysisEnvironment, self).__init__() - self.hypervisor_host_system = None - self.analysis_systems = None - self.network_infrastructure = None class Analysis(maec.Entity): _binding = package_binding _binding_class = package_binding.AnalysisType _namespace = maec.package._namespace - id = cybox.TypedField("id") - method = cybox.TypedField("method") - type = cybox.TypedField("type") - ordinal_position = cybox.TypedField("ordinal_position") - start_datetime = cybox.TypedField("start_datetime") - complete_datetime = cybox.TypedField("complete_datetime") - lastupdate_datetime = cybox.TypedField("lastupdate_datetime") - source = cybox.TypedField("source", Source) - analysts = cybox.TypedField("analysts", Personnel) - summary = cybox.TypedField("summary", StructuredText) - comments = cybox.TypedField("comments", CommentList) - findings_bundle_reference = cybox.TypedField("findings_bundle_reference", BundleReference, multiple = True) - tools = cybox.TypedField("tools", ToolList) - dynamic_analysis_metadata = cybox.TypedField("dynamic_analysis_metadata", DynamicAnalysisMetadata) - analysis_environment = cybox.TypedField("analysis_environment", AnalysisEnvironment) - report = cybox.TypedField("report", StructuredText) + id_ = maec.TypedField("id") + method = maec.TypedField("method") + type = maec.TypedField("type") + ordinal_position = maec.TypedField("ordinal_position") + start_datetime = maec.TypedField("start_datetime") + complete_datetime = maec.TypedField("complete_datetime") + lastupdate_datetime = maec.TypedField("lastupdate_datetime") + source = maec.TypedField("Source", Source) + analysts = maec.TypedField("Analysts", Personnel) + summary = maec.TypedField("Summary", StructuredText) + comments = maec.TypedField("Comments", CommentList) + findings_bundle_reference = maec.TypedField("Findings_Bundle_Reference", BundleReference, multiple = True) + tools = maec.TypedField("Tools", ToolList) + dynamic_analysis_metadata = maec.TypedField("Dynamic_Analysis_Metadata", DynamicAnalysisMetadata) + analysis_environment = maec.TypedField("Analysis_Environment", AnalysisEnvironment) + report = maec.TypedField("Report", StructuredText) def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): super(Analysis, self).__init__() if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="analysis") + self.id_ = maec.utils.idgen.create_id(prefix="analysis") self.method = method self.type = type - self.ordinal_position = None - self.start_datetime = None - self.complete_datetime = None - self.lastupdate_datetime = None - self.source = None - self.analysts = None - self.summary = None - self.comments = None self.findings_bundle_reference = findings_bundle_reference self.tools = ToolList() - self.dynamic_analysis_metadata = None - self.analysis_environment = None - self.report = None + #"Public" methods # set the findings_bundle_reference values; accepts a list of bundle ID values diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 9cd608b..613eb87 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -17,81 +17,63 @@ class ClusterEdgeNodePair(maec.Entity): _binding_class = package_binding.ClusterEdgeNodePairType _namespace = maec.package._namespace - similarity_index = cybox.TypedField("similarity_index") - similarity_distance = cybox.TypedField("similarity_distance") - malware_subject_node_a = cybox.TypedField("malware_subject_node_a", MalwareSubjectReference) - malware_subject_node_b = cybox.TypedField("malware_subject_node_b", MalwareSubjectReference) + similarity_index = maec.TypedField("similarity_index") + similarity_distance = maec.TypedField("similarity_distance") + malware_subject_node_a = maec.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) + malware_subject_node_b = maec.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) def __init__(self): super(ClusterEdgeNodePair, self).__init__() - self.similarity_index = None - self.similarity_distance = None - self.malware_subject_node_a = None - self.malware_subject_node_b = None class ClusterComposition(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusterCompositionType _namespace = maec.package._namespace - score_type = cybox.TypedField("score_type") - edge_node_pair = cybox.TypedField("edge_node_pair", ClusterEdgeNodePair, multiple=True) + score_type = maec.TypedField("score_type") + edge_node_pair = maec.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) def __init__(self): super(ClusterComposition, self).__init__() - self.score_type = None - self.edge_node_pair = [] class ClusteringAlgorithmParameters(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusteringAlgorithmParametersType _namespace = maec.package._namespace - distance_threashold = cybox.TypedField("distance_threashold") - number_of_iterations = cybox.TypedField("number_of_iterations") + distance_threashold = maec.TypedField("Distance_Threashold") + number_of_iterations = maec.TypedField("Number_of_Iterations") def __init__(self): super(ClusteringAlgorithmParameters, self).__init__() - self.distance_threshold = None - self.number_of_iterations = None class ClusteringMetadata(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusteringMetadataType _namespace = maec.package._namespace - algorithm_name = cybox.TypedField("algorithm_name") - algorithm_version = cybox.TypedField("algorithm_version") - algorithm_parameters = cybox.TypedField("algorithm_parameters", ClusteringAlgorithmParameters) - cluster_size = cybox.TypedField("cluster_size") - cluster_description = cybox.TypedField("cluster_description") - cluster_composition = cybox.TypedField("cluster_composition", ClusterComposition) + algorithm_name = maec.TypedField("Algorithm_Name") + algorithm_version = maec.TypedField("Algorithm_Version") + algorithm_parameters = maec.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) + cluster_size = maec.TypedField("Cluster_Size") + cluster_description = maec.TypedField("Cluster_Description") + cluster_composition = maec.TypedField("Cluster_Composition", ClusterComposition) def __init__(self): super(ClusteringMetadata, self).__init__() - self.algorithm_name = None - self.algorithm_version = None - self.algorithm_parameters = None - self.cluster_size = None - self.cluster_description = None - self.cluster_composition = None class GroupingRelationship(maec.Entity): _binding = package_binding _binding_class = package_binding.GroupingRelationshipType _namespace = maec.package._namespace - type = cybox.TypedField("type") - malware_family_name = cybox.TypedField("malware_family_name") - malware_toolkit_name = cybox.TypedField("malware_toolkit_name") - clustering_metadata = cybox.TypedField("clustering_metadata", ClusteringMetadata) + type = maec.TypedField("Type") + malware_family_name = maec.TypedField("Malware_Family_Name") + malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") + clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) def __init__(self): super(GroupingRelationship, self).__init__() - self.type = None - self.malware_family_name = None - self.malware_toolkit_name = None - self.clustering_metadata = None class GroupingRelationshipList(maec.EntityList): _contained_type = GroupingRelationship diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 7a3b1a3..01eb8dc 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -37,13 +37,11 @@ class MalwareSubjectRelationship(maec.Entity): _binding_class = package_binding.MalwareSubjectRelationshipType _namespace = maec.package._namespace - malware_subject_reference = cybox.TypedField("maleware_subject_reference", MalwareSubjectReference, multiple = True) - type = cybox.TypedField("type", VocabString) + malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) + type = maec.TypedField("type", VocabString) def __init__(self): super(MalwareSubjectRelationship, self).__init__() - self.type = None - self.malware_subject_reference = [] class MalwareSubjectRelationshipList(maec.EntityList): @@ -57,26 +55,23 @@ class MetaAnalysis(maec.Entity): _binding_class = package_binding.MetaAnalysisType _namespace = maec.package._namespace - action_equivalences = cybox.TypedField("action_equivalences", ActionEquivalenceList) - object_equivalences = cybox.TypedField("object_equivalences", ObjectEquivalenceList) + action_equivalences = maec.TypedField("Action_Equivalences", ActionEquivalenceList) + object_equivalences = maec.TypedField("Object_Equivalences", ObjectEquivalenceList) def __init__(self): super(MetaAnalysis, self).__init__() - self.action_equivalences = None - self.object_equivalences = None class FindingsBundleList(maec.Entity): _binding = package_binding _binding_class = package_binding.FindingsBundleListType _namespace = maec.package._namespace - meta_analysis = cybox.TypedField("meta_analysis", MetaAnalysis) - bundle = cybox.TypedField("bundle", Bundle, multiple = True) - bundle_external_reference = cybox.TypedField("bundle_external_reference", multiple = True) + meta_analysis = maec.TypedField("Meta_Analysis", MetaAnalysis) + bundle = maec.TypedField("Bundle", Bundle, multiple = True) + bundle_external_reference = maec.TypedField("Bundle_External_Reference", multiple = True) def __init__(self): super(FindingsBundleList, self).__init__() - self.meta_analysis = None def add_bundle(self, bundle): self.bundle.append(bundle) @@ -89,13 +84,11 @@ class MalwareDevelopmentEnvironment(maec.Entity): _binding_class = package_binding.MalwareDevelopmentEnvironmentType _namespace = maec.package._namespace - tools = cybox.TypedField("tools", ToolInformation) - debugging_file = cybox.TypedField("debugging_file", File, multiple = True) + tools = maec.TypedField("Tools", ToolInformation) + debugging_file = maec.TypedField("Debugging_File", File, multiple = True) def __init__(self): super(MalwareDevelopmentEnvironment, self).__init__() - self.tools = None - self.debugging_file = None class MalwareConfigurationParameter(maec.Entity): @@ -103,13 +96,11 @@ class MalwareConfigurationParameter(maec.Entity): _binding_class = package_binding.MalwareConfigurationParameterType _namespace = maec.package._namespace - name = cybox.TypedField("name", VocabString) - value = cybox.TypedField("value") + name = maec.TypedField("Name", VocabString) + value = maec.TypedField("Value") def __init__(self): super(MalwareConfigurationParameter, self).__init__() - self.name = None - self.value = None class MalwareBinaryConfigurationStorageDetails(maec.Entity): @@ -117,45 +108,36 @@ class MalwareBinaryConfigurationStorageDetails(maec.Entity): _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType _namespace = maec.package._namespace - file_offset = cybox.TypedField("file_offset") - section_name = cybox.TypedField("section_name") - section_offset = cybox.TypedField("section_offset") + file_offset = maec.TypedField("File_Offset") + section_name = maec.TypedField("Section_Name") + section_offset = maec.TypedField("Section_Offset") def __init__(self): super(MalwareBinaryConfigurationStorageDetails, self).__init__() - self.file_offset = None - self.section_name = None - self.section_offset = None class MalwareConfigurationStorageDetails(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationStorageDetailsType _namespace = maec.package._namespace - malware_binary = cybox.TypedField("malware_binary", MalwareBinaryConfigurationStorageDetails) - file = cybox.TypedField("file", File) - url = cybox.TypedField("url", URI, multiple = True) + malware_binary = maec.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) + file = maec.TypedField("File", File) + url = maec.TypedField("URL", URI, multiple = True) def __init__(self): super(MalwareConfigurationStorageDetails, self).__init__() - self.malware_binary = None - self.file = None - self.url = [] class MalwareConfigurationObfuscationAlgorithm(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType _namespace = maec.package._namespace - ordinal_position = cybox.TypedField("ordinal_position") - key = cybox.TypedField("key") - algorithm_name = cybox.TypedField("algorithm_name", VocabString) + ordinal_position = maec.TypedField("ordinal_position") + key = maec.TypedField("Key") + algorithm_name = maec.TypedField("Algorithm_Name", VocabString) def __init__(self): super(MalwareConfigurationObfuscationAlgorithm, self).__init__() - self.ordinal_position = None - self.key = None - self.algorithm_name = None class MalwareConfigurationObfuscationDetails(maec.Entity): @@ -163,14 +145,12 @@ class MalwareConfigurationObfuscationDetails(maec.Entity): _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType _namespace = maec.package._namespace - is_encoded = cybox.TypedField("is_encoded") - is_encrypted = cybox.TypedField("is_encrypted") - algorithm_details = cybox.TypedField("algorithm_details", MalwareConfigurationObfuscationAlgorithm, multiple = True) + is_encoded = maec.TypedField("is_encoded") + is_encrypted = maec.TypedField("is_encrypted") + algorithm_details = maec.TypedField("Algorithm_Details", MalwareConfigurationObfuscationAlgorithm, multiple = True) def __init__(self): super(MalwareConfigurationObfuscationDetails, self).__init__() - self.is_encoded = None - self.is_encrypted = None self.algorithm_details = [] @@ -179,32 +159,29 @@ class MalwareConfigurationDetails(maec.Entity): _binding_class = package_binding.MalwareConfigurationDetailsType _namespace = maec.package._namespace - storage = cybox.TypedField("storage", MalwareConfigurationStorageDetails) - obfuscation = cybox.TypedField("obfuscation", MalwareConfigurationObfuscationDetails) - configuration_parameter = cybox.TypedField("configuration_parameter", MalwareConfigurationParameter, multiple = True) + storage = maec.TypedField("Storage", MalwareConfigurationStorageDetails) + obfuscation = maec.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) + configuration_parameter = maec.TypedField("Configuration_Parameter", MalwareConfigurationParameter, multiple = True) def __init__(self): super(MalwareConfigurationDetails, self).__init__() - self.storage = None - self.obfuscation = None - self.configuration_parameter = [] class MalwareSubject(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareSubjectType _namespace = maec.package._namespace - id_ = cybox.TypedField("id") - malware_instance_object_attributes = cybox.TypedField("Malware_Instance_Object_Attributes", Object) - label = cybox.TypedField("label", VocabString, multiple=True) - configuration_details = cybox.TypedField("configuration_details", MalwareConfigurationDetails) - minor_variants = cybox.TypedField("minor_variants", MinorVariants) - development_environment = cybox.TypedField("development_environment", MalwareDevelopmentEnvironment) - #field_data = cybox.TypedField("field_data") # TODO: support metadata:fieldDataEntry - analyses = cybox.TypedField("analyses", Analyses) - findings_bundles = cybox.TypedField("findings_bundles", FindingsBundleList) - relationships = cybox.TypedField("relationships", MalwareSubjectRelationshipList) - compatible_platform = cybox.TypedField("compatible_platform", PlatformSpecification, multiple=True) + id_ = maec.TypedField("id") + malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) + label = maec.TypedField("Label", VocabString, multiple=True) + configuration_details = maec.TypedField("Configuration_Details", MalwareConfigurationDetails) + minor_variants = maec.TypedField("Minor_Variants", MinorVariants) + development_environment = maec.TypedField("Development_Environment", MalwareDevelopmentEnvironment) + #field_data = maec.TypedField("field_data") # TODO: support metadata:fieldDataEntry + analyses = maec.TypedField("Analyses", Analyses) + findings_bundles = maec.TypedField("Findings_Bundles", FindingsBundleList) + relationships = maec.TypedField("Relationships", MalwareSubjectRelationshipList) + compatible_platform = maec.TypedField("Compatible_Platform", PlatformSpecification, multiple=True) def __init__(self, id = None, malware_instance_object_attributes = None): super(MalwareSubject, self).__init__() @@ -243,7 +220,7 @@ def deduplicate_bundles(self): findings_bundle.deduplicate() def dereference_bundles(self): - """Deference all Findings Bundles in the Malware Subject. For now, only handles Objects""" + """Dereference all Findings Bundles in the Malware Subject. For now, only handles Objects""" all_bundles = self.get_all_bundles() for bundle in all_bundles: bundle.dereference_objects([self.malware_instance_object_attributes]) diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 1912e8a..d6483d1 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -15,10 +15,8 @@ class MalwareSubjectReference(maec.Entity): _binding_class = package_binding.MalwareSubjectReferenceType _namespace = maec.package._namespace - malware_subject_idref = cybox.TypedField("malware_subject_idref") + malware_subject_idref = maec.TypedField("malware_subject_idref") def __init__(self, malware_subject_idref = None): super(MalwareSubjectReference, self).__init__() self.malware_subject_idref = malware_subject_idref - - \ No newline at end of file diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 0ccbfac..42a8d17 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -16,13 +16,12 @@ class ObjectEquivalence(maec.Entity): _binding_class = package_binding.ObjectEquivalenceType _namespace = maec.package._namespace - id = cybox.TypedField("id") - object_reference = cybox.TypedField("object_reference", ObjectReference, multiple = True) + id_ = maec.TypedField("id") + object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) def init(self, id = None): super(ObjectEquivalence, self).__init__() - self.id = id - self.object_reference = [] + self.id_ = id class ObjectEquivalenceList(maec.EntityList): _contained_type = ObjectEquivalence diff --git a/maec/package/package.py b/maec/package/package.py index 9a4c615..1981105 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -19,6 +19,7 @@ class Package(maec.Entity): id_ = maec.TypedField('id') timestamp = maec.TypedField('timestamp') + schema_version = maec.TypedField('schema_version') malware_subjects = maec.TypedField('Malware_Subjects', MalwareSubjectList) grouping_relationships = maec.TypedField('Grouping_Relationships', GroupingRelationshipList) From 33887b8c1af003f258078c585053fb886e65ca4e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 08:39:55 -0400 Subject: [PATCH 039/297] Fixed issue with Analyses always being exported to xml --- maec/package/malware_subject.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 01eb8dc..7bfd6e6 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -191,7 +191,6 @@ def __init__(self, id = None, malware_instance_object_attributes = None): self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes - self.analyses = Analyses() self.findings_bundles = FindingsBundleList() #Public methods @@ -201,6 +200,8 @@ def set_malware_instance_object_attributes(self, malware_instance_object_attribu #Add an Analysis to the Analyses def add_analysis(self, analysis): + if not self.analyses: + self.analyses = Analyses() self.analyses.append(analysis) def get_analyses(self): From aedc5bb6de2270bf5c0387b91ed3795bec7545a0 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 08:57:42 -0400 Subject: [PATCH 040/297] Updated add_ methods in FindingsBundleList to function properly with latest changes --- maec/package/malware_subject.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 7bfd6e6..69f6eb6 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -74,9 +74,13 @@ def __init__(self): super(FindingsBundleList, self).__init__() def add_bundle(self, bundle): + if not self.bundle: + self.bundle = [] self.bundle.append(bundle) def add_bundle_external_reference(self, bundle_external_reference): + if not self.bundle_external_reference: + self.bundle_external_reference = [] self.bundle_external_reference.append(bundle_external_reference) class MalwareDevelopmentEnvironment(maec.Entity): From 59f5386d76aabf4a4cac9d1688b1c8d780c9dba6 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:15:47 -0400 Subject: [PATCH 041/297] Changed type to type_ in Analysis and updated add_tool method --- maec/package/analysis.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 67a6522..1021ced 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -156,7 +156,7 @@ class Analysis(maec.Entity): id_ = maec.TypedField("id") method = maec.TypedField("method") - type = maec.TypedField("type") + type_ = maec.TypedField("type") ordinal_position = maec.TypedField("ordinal_position") start_datetime = maec.TypedField("start_datetime") complete_datetime = maec.TypedField("complete_datetime") @@ -180,8 +180,6 @@ def __init__(self, id = None, method = None, type = None, findings_bundle_refere self.method = method self.type = type self.findings_bundle_reference = findings_bundle_reference - self.tools = ToolList() - #"Public" methods # set the findings_bundle_reference values; accepts a list of bundle ID values @@ -190,6 +188,8 @@ def set_findings_bundle(self, bundle_id): # add a tool to this Anaysis's ToolList def add_tool(self, tool): + if not self.tools: + self.tools = ToolList() self.tools.append(tool) From d7df5ed7c22cc18266470ad9afd00c1242867ef4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:18:58 -0400 Subject: [PATCH 042/297] In GroupingRelationship, renamed type to type_ --- maec/package/grouping_relationship.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 613eb87..45bd052 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -67,7 +67,7 @@ class GroupingRelationship(maec.Entity): _binding_class = package_binding.GroupingRelationshipType _namespace = maec.package._namespace - type = maec.TypedField("Type") + type_ = maec.TypedField("Type", VocabString) malware_family_name = maec.TypedField("Malware_Family_Name") malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) From a4911358781c71c8ec81ec931bd9a088d30ed8e9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:23:48 -0400 Subject: [PATCH 043/297] Upated MalwareSubject to not always export Findings_Bundles if none exist --- maec/package/malware_subject.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 69f6eb6..0db4853 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -195,7 +195,6 @@ def __init__(self, id = None, malware_instance_object_attributes = None): self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes - self.findings_bundles = FindingsBundleList() #Public methods #Set the Malware_Instance_Object_Attributes with a CybOX object @@ -217,6 +216,8 @@ def get_all_bundles(self): #Add a MAEC Bundle to the Findings Bundles def add_findings_bundle(self, bundle): + if not self.findings_bundles: + self.findings_bundles = FindingsBundleList() self.findings_bundles.add_bundle(bundle) def deduplicate_bundles(self): From 49ee9e28beab1f5c470a728c447ec677172b2cde Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:39:32 -0400 Subject: [PATCH 044/297] Updated deduplicate_bundles to use get_all_bundles, like other _bundles methods --- maec/package/malware_subject.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 0db4853..c32bb13 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -222,8 +222,9 @@ def add_findings_bundle(self, bundle): def deduplicate_bundles(self): """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" - for findings_bundle in self.findings_bundles.bundles: - findings_bundle.deduplicate() + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.deduplicate() def dereference_bundles(self): """Dereference all Findings Bundles in the Malware Subject. For now, only handles Objects""" From a38eb3079b7cc5fbf75605ebad86adf4f8842958 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:44:44 -0400 Subject: [PATCH 045/297] Updated MalwareSubject id usage to account for latest changes --- maec/utils/merge.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 3b3cc30..e0ab9c0 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -151,7 +151,7 @@ def merge_findings_bundles(findings_bundles_list): def create_mappings(mapping_dict, original_malware_subject_list, merged_malware_subject): '''Map the IDs of a list of existing Malware Subjects to the new merged Malware Subject''' for malware_subject in original_malware_subject_list: - mapping_dict[malware_subject.id] = merged_malware_subject.id + mapping_dict[malware_subject.id_] = merged_malware_subject.id_ def merge_binned_malware_subjects(merged_malware_subject, binned_list, id_mappings_dict): '''Merge a list of input binned (related) Malware Subjects''' @@ -227,7 +227,7 @@ def merge_malware_subjects(malware_subject_list): output_subjects.append(merged_malware_subject) # Add the Malware Subjects that weren't merged for malware_subject in malware_subject_list: - if malware_subject.id not in id_mappings.keys(): + if malware_subject.id_ not in id_mappings.keys(): output_subjects.append(malware_subject) # Update the relationships for the Malware Subjects to account for the merges update_relationships(output_subjects, id_mappings) From 2cb61aa3f0ddce9c03f5df975e4467706fbe0603 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 09:46:34 -0400 Subject: [PATCH 046/297] Updated usage of type_ in Analysis.__init__ --- maec/package/analysis.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 1021ced..4d1bdc3 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -178,7 +178,7 @@ def __init__(self, id = None, method = None, type = None, findings_bundle_refere else: self.id_ = maec.utils.idgen.create_id(prefix="analysis") self.method = method - self.type = type + self.type_ = type self.findings_bundle_reference = findings_bundle_reference #"Public" methods From d9c6f4f2cfd941f9f2f1a3c15a4c15791a9474c9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 10:04:00 -0400 Subject: [PATCH 047/297] Updated type_ to type in AnalysisType to work properly with TypedFields --- maec/bindings/maec_package.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index f77c38f..a74aeee 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -1149,7 +1149,7 @@ def __init__(self, start_datetime=None, complete_datetime=None, method=None, ord self.method = _cast(None, method) self.ordinal_position = _cast(int, ordinal_position) self.lastupdate_datetime = _cast(None, lastupdate_datetime) - self.type_ = _cast(None, type_) + self.type = _cast(None, type) self.id = _cast(None, id) self.Source = Source self.Analysts = Analysts @@ -1250,9 +1250,9 @@ def exportAttributes(self, outfile, level, already_processed, namespace_='maecPa if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: already_processed.add('lastupdate_datetime') outfile.write(' lastupdate_datetime="%s"' % self.lastupdate_datetime) - if self.type_ is not None and 'type_' not in already_processed: - already_processed.add('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) + if self.type is not None and 'type' not in already_processed: + already_processed.add('type') + outfile.write(' type=%s' % (quote_attrib(self.type), )) if self.id is not None and 'id' not in already_processed: already_processed.add('id') outfile.write(' id=%s' % (quote_attrib(self.id), )) @@ -1306,10 +1306,10 @@ def exportLiteralAttributes(self, outfile, level, already_processed, name_): already_processed.add('lastupdate_datetime') showIndent(outfile, level) outfile.write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) - if self.type_ is not None and 'type_' not in already_processed: - already_processed.add('type_') + if self.type is not None and 'type' not in already_processed: + already_processed.add('type') showIndent(outfile, level) - outfile.write('type_ = %s,\n' % (self.type_,)) + outfile.write('type = %s,\n' % (self.type,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') showIndent(outfile, level) @@ -1395,7 +1395,7 @@ def buildAttributes(self, node, attrs, already_processed): value = find_attr_value_('type', node) if value is not None and 'type' not in already_processed: already_processed.add('type') - self.type_ = value + self.type = value value = find_attr_value_('id', node) if value is not None and 'id' not in already_processed: already_processed.add('id') From 106e9f80b66db212a82d74c62754ffe57cf5e3ae Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 10:05:41 -0400 Subject: [PATCH 048/297] Updated Package/Bundle calls in parse_xml to work on classes and not instances --- maec/utils/parser.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/utils/parser.py b/maec/utils/parser.py index 6505b9a..72678bb 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -108,10 +108,10 @@ def parse_xml(self, xml_file, check_version=True): binding_obj = self.parse_xml_to_obj(xml_file, check_version) if self.is_package: from maec.package.package import Package # resolve circular dependencies - api_obj = Package().from_obj(binding_obj) + api_obj = Package.from_obj(binding_obj) elif self.is_bundle: from maec.bundle.bundle import Bundle # resolve circular dependencies - api_obj = Bundle().from_obj(binding_obj) + api_obj = Bundle.from_obj(binding_obj) self._apply_input_namespaces(tree, api_obj) return api_obj \ No newline at end of file From 835f651862693f441f365be641d32244dc9e2999 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 10:15:10 -0400 Subject: [PATCH 049/297] Few more changes of type_ to type in AnalysisType --- maec/bindings/maec_package.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index a74aeee..fea3c7a 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -1143,7 +1143,7 @@ class AnalysisType(GeneratedsSuper): the analysis was last updated.""" subclass = None superclass = None - def __init__(self, start_datetime=None, complete_datetime=None, method=None, ordinal_position=None, lastupdate_datetime=None, type_=None, id=None, Source=None, Analysts=None, Summary=None, Comments=None, Findings_Bundle_Reference=None, Tools=None, Dynamic_Analysis_Metadata=None, Analysis_Environment=None, Report=None): + def __init__(self, start_datetime=None, complete_datetime=None, method=None, ordinal_position=None, lastupdate_datetime=None, type=None, id=None, Source=None, Analysts=None, Summary=None, Comments=None, Findings_Bundle_Reference=None, Tools=None, Dynamic_Analysis_Metadata=None, Analysis_Environment=None, Report=None): self.start_datetime = _cast(None, start_datetime) self.complete_datetime = _cast(None, complete_datetime) self.method = _cast(None, method) @@ -1199,8 +1199,8 @@ def get_ordinal_position(self): return self.ordinal_position def set_ordinal_position(self, ordinal_position): self.ordinal_position = ordinal_position def get_lastupdate_datetime(self): return self.lastupdate_datetime def set_lastupdate_datetime(self, lastupdate_datetime): self.lastupdate_datetime = lastupdate_datetime - def get_type(self): return self.type_ - def set_type(self, type_): self.type_ = type_ + def get_type(self): return self.type + def set_type(self, type): self.type = type def get_id(self): return self.id def set_id(self, id): self.id = id def hasContent_(self): From 5ea01bdeb09ea4e917d973b976bad8c758ead618 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 15:16:57 -0400 Subject: [PATCH 050/297] Fixed findings_bundles.bundle access in get_all_bundles --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index c32bb13..eeda25d 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -212,7 +212,7 @@ def get_analyses(self): #Get all Bundles in the Subject def get_all_bundles(self): - return self.findings_bundles.bundles + return self.findings_bundles.bundle #Add a MAEC Bundle to the Findings Bundles def add_findings_bundle(self, bundle): From c51d32c74243c221958cdd9ac1fee20ef24bddb5 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 22 Aug 2014 15:57:24 -0400 Subject: [PATCH 051/297] Added numpy dependency disclaimer --- scripts/calculate_distance.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/calculate_distance.py b/scripts/calculate_distance.py index 594d234..2e95f22 100644 --- a/scripts/calculate_distance.py +++ b/scripts/calculate_distance.py @@ -1,5 +1,7 @@ # calculate_distance script # Calculates and prints the distance between two or more MAEC Malware Subjects +# NOTE: This code imports and uses the maec.analytics.distance module, which uses the external numpy library. +# Numpy can be found here: https://pypi.python.org/pypi/numpy # Copyright (c) 2014, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. From 71b2d951c5ab9733690ade0d71661a13bca6aad7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 25 Aug 2014 16:02:06 -0400 Subject: [PATCH 052/297] Updated for TypedField implementation --- maec/bundle/bundle.py | 1010 ++++++++++++++++------------------------- 1 file changed, 385 insertions(+), 625 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index a48068f..0828c3f 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -4,7 +4,7 @@ #All rights reserved #Compatible with MAEC v4.1 -#Last updated 08/21/2014 +#Last updated 08/25/2014 import datetime @@ -25,388 +25,6 @@ from maec.utils.deduplicator import BundleDeduplicator -class Bundle(maec.Entity): - _namespace = maec.bundle._namespace - - def __init__(self, id = None, defined_subject = "False", schema_version = "4.1", content_type = None, malware_instance_object = None): - super(Bundle, self).__init__() - if id: - self.id = id - else: - self.id = maec.utils.idgen.create_id(prefix="bundle") - self.schema_version = schema_version - self.defined_subject = defined_subject - self.content_type = content_type - self.timestamp = None - self.malware_instance_object_attributes = malware_instance_object - #Add all of the top-level containers - self.av_classifications = AVClassifications() - self.actions = ActionList() - self.process_tree = None - self.behaviors = BehaviorList() - self.capabilities = CapabilityList() - self.objects = ObjectList() - self.candidate_indicators = CandidateIndicatorList() - self.collections = Collections() - - #Set the Malware Instance Object Attributes - def set_malware_instance_object_atttributes(self, malware_instance_object): - self.malware_instance_object_attributes = malware_instance_object - - #Add an AV classification - def add_av_classification(self, av_classification): - self.av_classifications.append(av_classification) - - #Add a Capability - def add_capability(self, capability): - capabilities = None - if self.capabilities: - capabilities = self.capabilities - else: - capabilities = CapabilityList() - capabilities.capability.append(capability) - - #Set the Process Tree, in the top-level element - def set_process_tree(self, process_tree): - self.process_tree = process_tree - - #Add a new Named Action Collection - def add_named_action_collection(self, collection_name, collection_id = None): - if not self.collections: - self.collections = Collections() - if collection_name is not None: - self.collections.action_collections.append(ActionCollection(collection_name, collection_id)) - - #Add an Action to an existing named collection; if it does not exist, add it to the top-level element - def add_action(self, action, action_collection_name = None): - if action_collection_name is not None: - #The collection has already been defined - if self.collections.action_collections.has_collection(action_collection_name): - action_collection = self.collections.action_collections.get_named_collection(action_collection_name) - action_collection.add_action(action) - elif action_collection_name == None: - self.actions.append(action) - - #Add a new Named Object Collection - def add_named_object_collection(self, collection_name, collection_id = None): - if not self.collections: - self.collections = Collections() - if collection_name is not None: - self.collections.object_collections.append(ObjectCollection(collection_name, collection_id)) - - # return a list of all abjects from self.actions and all action collections - def get_all_actions(self, bin = False): - all_actions = [] - - for action in self.actions: - all_actions.append(action) - - if self.collections and self.collections.action_collections: - for collection in self.collections.action_collections: - for action in collection.action_list: - all_actions.append(action) - - if bin: - binned_actions = {} - for action in all_actions: - if action.name and action.name.value not in binned_actions: - binned_actions[action.name.value] = [action] - elif action.name and action.name.value in binned_actions: - binned_actions[action.name.value].append(action) - return binned_actions - else: - return all_actions - - def get_all_actions_on_object(self, object): - """Return a list of all of the Actions that operate on a particular Object""" - object_actions = [] - if object.id_: - for action in self.get_all_actions(): - associated_objects = action.associated_objects - if associated_objects: - for associated_object in associated_objects: - if associated_object.idref and associated_object.idref == object.id_: - object_actions.append(action) - elif associated_object.id_ and associated_object.id_ == object.id_: - object_actions.append(action) - return object_actions - - #Add an Object to an existing named collection; if it does not exist, add it to the top-level element - def add_object(self, object, object_collection_name = None): - if object_collection_name is not None: - #The collection has already been defined - if self.collections.object_collections.has_collection(object_collection_name): - object_collection = self.collections.object_collections.get_named_collection(object_collection_name) - object_collection.add_object(object) - elif object_collection_name == None: - self.objects.append(object) - - # return a list of all objects from self.objects and all object collections - def get_all_objects(self, include_actions = False): - all_objects = [] - for obj in self.objects: - all_objects.append(obj) - for related_obj in obj.related_objects: - all_objects.append(related_obj) - - if self.collections: - for collection in self.collections.object_collections: - for obj in collection.object_list: - all_objects.append(obj) - for related_obj in obj.related_objects: - all_objects.append(related_obj) - - # Include Objects in Actions, if include_actions flag is specified - if include_actions: - for action in self.get_all_actions(): - associated_objects = action.associated_objects - if associated_objects: - for associated_object in associated_objects: - all_objects.append(associated_object) - for related_obj in associated_object.related_objects: - all_objects.append(related_obj) - - # Add the Object corresponding to the Malware Instance Object Attributes, if specified - if self.malware_instance_object_attributes: - all_objects.append(self.malware_instance_object_attributes) - - return all_objects - - def get_all_multiple_referenced_objects(self): - """Return a list of all Objects in the Bundle that are referenced more than once.""" - idref_list = [x.idref for x in self.get_all_objects() if x.idref] - return [self.get_object_by_id(x) for x in idref_list if self.get_object_by_id(x)] - - def get_all_non_reference_objects(self): - """Return a list of all Objects in the Bundle that are not references (i.e. all of the actual Objects in the Bundle).""" - return [x for x in self.get_all_objects(True) if x.id_ and not x.idref] - - # finds actions and objects by id - def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): - if not ignore_actions: - for action in self.actions: - if action.id_ == id: - return action - - if action.associated_objects: - for associated_obj in action.associated_objects: - if associated_obj.id_ == id: - return associated_obj - - for collection in self.collections.action_collections: - for action in collection.action_list: - if action.id_ == id: - return action - - if action.associated_objects: - for associated_obj in action.associated_objects: - if associated_obj.id_ == id: - return associated_obj - - for obj in self.objects: - if obj.id_ == id: - return obj - - for collection in self.collections.object_collections: - for obj in collection.object_list: - if obj.id_ == id: - return obj - - # Test the extra_objects Array - for obj in extra_objects: - if obj.id_ == id: - return obj - - #Add a new Named Behavior Collection - def add_named_behavior_collection(self, collection_name): - if collection_name is not None: - self.collections.behavior_collections.append(BehaviorCollection(collection_name, collection_id)) - - #Add a Behavior to an existing named collection; if it does not exist, add it to the top-level element - def add_behavior(self, behavior, behavior_collection_name = None): - if behavior_collection_name is not None: - #The collection has already been defined - if self.collections.behavior_collections.has_collection(behavior_collection_name): - behavior_collection = self.collections.behavior_collections.get_named_collection(behavior_collection_name) - behavior_collection.add_Behavior(behavior) - elif behavior_collection_name == None: - self.behaviors.append(behavior) - - #Add a new Named Behavior Collection - def add_named_candidate_indicator_collection(self, collection_name, collection_id): - if collection_name is not None and collection_id is not None: - self.collections.candidate_indicator_collections.append(CandidateIndicatorCollection(collection_name, collection_id)) - - #Add a Candidate Indicator to an existing named collection; if it does not exist, add it to the top-level element - def add_candidate_indicator(self, candidate_indicator, candidate_indicator_collection_name = None): - if candidate_indicator_collection_name is not None: - #The collection has already been defined - if self.collections.candidate_indicator_collections.has_collection(candidate_indicator_collection_name): - candidate_indicator_collection = self.collections.candidate_indicator_collections.get_named_collection(candidate_indicator_collection_name) - candidate_indicator_collection.add_candidate_indicator(candidate_indicator) - elif candidate_indicator_collection_name == None: - self.candidate_indicators.append(candidate_indicator) - - def deduplicate(self): - BundleDeduplicator.deduplicate(self) - - def get_action_objects(self, action_name_list): - """Get all Objects corresponding to one or more types of Actions, specified via a list of Action names""" - action_objects = {} - all_actions = self.get_all_actions(bin=True) - for action_name in action_name_list: - if action_name in all_actions: - associated_objects = [] - associated_object_lists = [[y for y in x.associated_objects if x.associated_objects] for x in all_actions[action_name]] - for associated_object_list in associated_object_lists: - associated_objects += associated_object_list - action_objects[action_name] = associated_objects - return action_objects - - def get_object_history(self): - """Build and return the Object history for the Bundle""" - return ObjectHistory.build(self) - - def normalize_objects(self): - """Normalize all Objects in the Bundle, using the CybOX normalize module""" - all_objects = self.get_all_objects(include_actions = True) - for object in all_objects: - if object.properties: - normalize_object_properties(object.properties) - - def dereference_objects(self, extra_objects = []): - """Dereference any Objects in the Bundle by replacing them with the entities they reference""" - all_objects = self.get_all_objects(include_actions=True) - # Add any extra objects that were passed, e.g. from a Malware Subject - all_objects = all_objects + extra_objects - for object in all_objects: - if object.idref and not object.id_: - real_object = self.get_object_by_id(object.idref, extra_objects, ignore_actions = True) - if real_object: - object.idref = None - object.id_ = real_object.id_ - object.properties = real_object.properties - - def to_obj(self): - bundle_obj = bundle_binding.BundleType(id=self.id) - #Set the bundle schema version - bundle_obj.set_schema_version(self.schema_version) - #Set whether this Bundle has a defined_subject - bundle_obj.set_defined_subject(self.defined_subject) - #Set the bundle timestamp - if self.timestamp is not None : bundle_obj.set_timestamp(self.timestamp.isoformat()) - #Set the content_type if it is not none - if self.content_type is not None: bundle_obj.set_content_type(self.content_type) - #Set the Malware Instance Object Attributes (a CybOX object) if they are not none - if self.malware_instance_object_attributes is not None: bundle_obj.set_Malware_Instance_Object_Attributes(self.malware_instance_object_attributes.to_obj()) - #Add the AV Classifications - if self.av_classifications: bundle_obj.set_AV_Classifications(self.av_classifications.to_obj()) - #Add the Behaviors - if self.behaviors: bundle_obj.set_Behaviors(self.behaviors.to_obj()) - #Add the Capabilities - if self.capabilities and (self.capabilities.capability or self.capabilities.capability_reference): bundle_obj.set_Capabilities(self.capabilities.to_obj()) - #Add the Actions - if self.actions: bundle_obj.set_Actions(self.actions.to_obj()) - #Add the Objects - if self.objects: bundle_obj.set_Objects(self.objects.to_obj()) - #Add the Process Tree - if self.process_tree is not None: bundle_obj.set_Process_Tree(self.process_tree.to_obj()) - #Add the Candidate Indicators - if self.candidate_indicators: bundle_obj.set_Candidate_Indicators(self.candidate_indicators.to_obj()) - #Add the collections - if self.collections is not None and self.collections.has_content(): bundle_obj.set_Collections(self.collections.to_obj()) - return bundle_obj - - def to_dict(self): - bundle_dict = {} - if self.id is not None : bundle_dict['id'] = self.id - if self.schema_version is not None : bundle_dict['schema_version'] = self.schema_version - if self.defined_subject is not None : bundle_dict['defined_subject'] = self.defined_subject - if self.content_type is not None : bundle_dict['content_type'] = self.content_type - if self.timestamp is not None : bundle_dict['timestamp'] = self.timestamp.isoformat() - if self.malware_instance_object_attributes is not None : bundle_dict['malware_instance_object_attributes'] = self.malware_instance_object_attributes.to_dict() - if self.av_classifications : bundle_dict['av_classifications'] = self.av_classifications.to_list() - if self.process_tree is not None : bundle_dict['process_tree'] = self.process_tree.to_dict() - if self.behaviors : bundle_dict['behaviors'] = self.behaviors.to_list() - if self.capabilities : bundle_dict['capabilities'] = self.capabilities.to_dict() - if self.actions : bundle_dict['actions'] = self.actions.to_list() - if self.objects : bundle_dict['objects'] = self.objects.to_list() - if self.candidate_indicators : bundle_dict['candidate_indicators'] = self.candidate_indicators.to_list() - if self.collections is not None and self.collections.has_content(): bundle_dict['collections'] = self.collections.to_dict() - return bundle_dict - - @staticmethod - def from_obj(bundle_obj): - if not bundle_obj: - return None - bundle_ = Bundle(None, None) - bundle_.id = bundle_obj.get_id() - bundle_.schema_version = bundle_obj.get_schema_version() - bundle_.defined_subject = bundle_obj.get_defined_subject() - bundle_.content_type = bundle_obj.get_content_type() - bundle_.timestamp = bundle_obj.get_timestamp() - bundle_.malware_instance_object_attributes = Object.from_obj(bundle_obj.get_Malware_Instance_Object_Attributes()) - if bundle_obj.get_AV_Classifications() is not None: bundle_.av_classifications = AVClassifications.from_obj(bundle_obj.get_AV_Classifications()) - bundle_.process_tree = ProcessTree.from_obj(bundle_obj.get_Process_Tree()) - if bundle_obj.get_Behaviors() is not None : bundle_.behaviors = BehaviorList.from_obj(bundle_obj.get_Behaviors()) - if bundle_obj.get_Capabilities() is not None : bundle_.capabilities = CapabilityList.from_obj(bundle_obj.get_Capabilities()) - if bundle_obj.get_Actions() is not None : bundle_.actions = ActionList.from_obj(bundle_obj.get_Actions()) - if bundle_obj.get_Objects() is not None : bundle_.objects = ObjectList.from_obj(bundle_obj.get_Objects()) - if bundle_obj.get_Candidate_Indicators() is not None : bundle_.candidate_indicators = CandidateIndicatorList.from_obj(bundle_obj.get_Candidate_Indicators()) - bundle_.collections = Collections.from_obj(bundle_obj.get_Collections()) - return bundle_ - - @staticmethod - def from_dict(bundle_dict): - if not bundle_dict: - return None - bundle_ = Bundle(None, None) - bundle_.id = bundle_dict.get('id') - bundle_.schema_version = bundle_dict.get('schema_version') - bundle_.defined_subject = bundle_dict.get('defined_subject') - bundle_.content_type = bundle_dict.get('content_type') - if bundle_dict.get('timestamp'): - bundle_.timestamp = datetime.datetime.strptime(bundle_dict.get('timestamp'), "%Y-%m-%dT%H:%M:%S.%f") - bundle_.malware_instance_object_attributes = Object.from_dict(bundle_dict.get('malware_instance_object_attributes')) - bundle_.av_classifications = AVClassifications.from_list(bundle_dict.get('av_classifications')) - bundle_.process_tree = ProcessTree.from_dict(bundle_dict.get('process_tree')) - bundle_.behaviors = BehaviorList.from_list(bundle_dict.get('behaviors', [])) - bundle_.capabilities = CapabilityList.from_dict(bundle_dict.get('capabilities')) - bundle_.actions = ActionList.from_list(bundle_dict.get('actions', [])) - bundle_.objects = ObjectList.from_list(bundle_dict.get('objects', [])) - bundle_.candidate_indicators = CandidateIndicatorList.from_list(bundle_dict.get('candidate_indicators', [])) - bundle_.collections = Collections.from_dict(bundle_dict.get('collections')) - return bundle_ - - @classmethod - def compare(cls, bundle_list, match_on = None, case_sensitive = True): - return BundleComparator.compare(bundle_list, match_on, case_sensitive) - -class ObjectHistory(object): - @classmethod - def build(cls, bundle): - """Build the Object History for a Bundle""" - cls.entries = [] # A list of the Objects in the Object History - # Get the Objects that are not references - objects = bundle.get_all_non_reference_objects() - for object in objects: - object_history_entry = ObjectHistoryEntry(object) - # Find and set all Actions that operate on the Object - if bundle.get_all_actions_on_object(object): - object_history_entry.actions = bundle.get_all_actions_on_object(object) - # Add the history entry to the list - cls.entries.append(object_history_entry) - -class ObjectHistoryEntry(object): - def __init__(self, object = None): - self.object = object - self.actions = [] # A list of the Actions that operate on the Object - self.behaviors = [] # A list of Behaviors that make use of the Object (through Actions?) - - def get_action_names(self): - """Return a list of the Actions that operated on the Object, via their names""" - return [x.name.value for x in self.actions if x.name] - class BehaviorList(maec.EntityList): _contained_type = Behavior _binding_class = bundle_binding.BehaviorListType @@ -426,238 +44,99 @@ class ObjectList(maec.EntityList): _namespace = maec.bundle._namespace class BaseCollection(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BaseCollectionType _namespace = maec.bundle._namespace + name = maec.TypedField("name") + affinity_type = maec.TypedField("Affinity_Type") + affinity_degree = maec.TypedField("Affinity_Degree") + description = maec.TypedField("Description") + def __init__(self, name = None): super(BaseCollection, self).__init__() self.name = name - self.affinity_type = None - self.affinity_degree = None - self.description = None - - def to_obj(self, derived_collection_obj = None): - if derived_collection_obj == None: - collection_obj = bundle_binding.BaseCollectionType() - else: - collection_obj = derived_collection_obj - if self.name is not None: collection_obj.set_name(self.name) - if self.affinity_type is not None: collection_obj.set_Affinity_Type(self.affinity_type) - if self.affinity_degree is not None: collection_obj.set_Affinity_Degree(self.affinity_degree) - if self.description is not None: collection_obj.set_Description(self.description) - return collection_obj - - def to_dict(self): - base_collection_dict = {} - if self.name is not None : base_collection_dict['name'] = self.name - if self.affinity_type is not None : base_collection_dict['affinity_type'] = self.affinity_type - if self.affinity_degree is not None : base_collection_dict['affinity_degree'] = self.affinity_degree - if self.description is not None : base_collection_dict['description'] = self.description - return base_collection_dict - - @staticmethod - def from_obj(collection_obj, derived_collection_cls = None): - if not collection_obj: - return None - if derived_collection_cls == None: - collection_obj_ = BaseCollection() - else: - collection_obj_ = derived_collection_cls - collection_obj_.name = collection_obj.get_name() - collection_obj_.affinity_type = collection_obj.get_Affinity_Type() - collection_obj_.affinity_degree = collection_obj.get_Affinity_Degree() - collection_obj_.description = collection_obj.get_Description() - return collection_obj_ - - @staticmethod - def from_dict(collection_dict, derived_collection_cls = None): - if not collection_dict: - return None - if derived_collection_cls == None: - collection_obj_ = BaseCollection() - else: - collection_obj_ = derived_collection_cls - collection_obj_.name = collection_dict.get('name') - collection_obj_.affinity_type = collection_dict.get('affinity_type') - collection_obj_.affinity_degree = collection_dict.get('affinity_degree') - collection_obj_.description = collection_dict.get('description') - return collection_obj_ class ActionCollection(BaseCollection): - superclass = BaseCollection + _binding = bundle_binding + _binding_class = bundle_binding.ActionCollectionType + _namespace = maec.bundle._namespace + + id_ = maec.TypedField("id") + action_list = maec.TypedField("Action_List", ActionList) def __init__(self, name = None, id = None): super(ActionCollection, self).__init__(name) if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="action_collection") + self.id_ = maec.utils.idgen.create_id(prefix="action_collection") self.action_list = ActionList() def add_action(self, action): + """Add an input Action to the Collection.""" self.action_list.append(action) - def to_obj(self): - action_collection_obj = super(ActionCollection, self).to_obj(bundle_binding.ActionCollectionType()) - if self.id is not None : action_collection_obj.set_id(self.id) - if len(self.action_list) > 0: action_collection_obj.set_Action_List(self.action_list.to_obj()) - return action_collection_obj - - def to_dict(self): - action_collection_dict = super(ActionCollection, self).to_dict() - if self.id is not None : action_collection_dict['id'] = self.id - if len(self.action_list) > 0: action_collection_dict['action_list'] = self.action_list.to_list() - return action_collection_dict - - @staticmethod - def from_obj(action_collection_obj): - if not action_collection_obj: - return None - action_collection_ = BaseCollection.from_obj(action_collection_obj, ActionCollection()) - action_collection_.id = action_collection_obj.get_id() - action_collection_.action_list = ActionList.from_obj(action_collection_obj.get_Action_List()) - return action_collection_ - - @staticmethod - def from_dict(action_collection_dict): - if not action_collection_dict: - return action_collection_dict - action_collection_ = BaseCollection.from_dict(action_collection_dict, ActionCollection()) - action_collection_.id = action_collection_dict.get('id') - action_collection_.action_list = ActionList.from_list(action_collection_dict.get('action_list')) - return action_collection_ - class BehaviorCollection(BaseCollection): - superclass = BaseCollection + _binding = bundle_binding + _binding_class = bundle_binding.BehaviorCollectionType + _namespace = maec.bundle._namespace + + id_ = maec.TypedField("id") + behavior_list = maec.TypedField("Behavior_List", BehaviorList) def __init__(self, name = None, id = None): super(BehaviorCollection, self).__init__(name) if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="behavior_collection") + self.id_ = maec.utils.idgen.create_id(prefix="behavior_collection") self.behavior_list = BehaviorList() def add_behavior(self, behavior): + """Add an input Behavior to the Collection.""" self.behavior_list.append(behavior) - def to_obj(self): - behavior_collection_obj = super(BehaviorCollection, self).to_obj(bundle_binding.BehaviorCollectionType()) - if self.id is not None : behavior_collection_obj.set_id(self.id) - if len(self.behavior_list) > 0: behavior_collection_obj.set_Behavior_List(self.behavior_list.to_obj()) - return behavior_collection_obj - - def to_dict(self): - behavior_collection_dict = super(BehaviorCollection, self).to_dict() - if self.id is not None : behavior_collection_dict['id'] = self.id - if len(self.behavior_list) > 0: behavior_collection_dict['behavior_list'] = self.behavior_list.to_list() - return behavior_collection_dict - - @staticmethod - def from_obj(behavior_collection_obj): - if not behavior_collection_obj: - return None - behavior_collection_ = BaseCollection.from_obj(behavior_collection_obj, BehaviorCollection()) - behavior_collection_.id = behavior_collection_obj.get_id() - behavior_collection_.behavior_list = BehaviorList.from_obj(behavior_collection_obj.get_Behavior_List()) - return behavior_collection_ - - @staticmethod - def from_dict(behavior_collection_dict): - if not behavior_collection_dict: - return None - behavior_collection_ = BaseCollection.from_dict(behavior_collection_dict, BehaviorCollection()) - behavior_collection_.id = behavior_collection_dict.get('id') - behavior_collection_.behavior_list = BehaviorList.from_list(behavior_collection_dict.get('behavior_list')) - return behavior_collection_ - class ObjectCollection(BaseCollection): - superclass = BaseCollection + _binding = bundle_binding + _binding_class = bundle_binding.ObjectCollectionType + _namespace = maec.bundle._namespace + + id_ = maec.TypedField("id") + object_list = maec.TypedField("Object_List", ObjectList) def __init__(self, name = None, id = None): super(ObjectCollection, self).__init__(name) if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="object_collection") + self.id_ = maec.utils.idgen.create_id(prefix="object_collection") self.object_list = ObjectList() def add_object(self, object): + """Add an input Object to the Collection.""" self.object_list.append(object) - def to_obj(self): - object_collection_obj = super(ObjectCollection, self).to_obj(bundle_binding.ObjectCollectionType()) - if self.id is not None : object_collection_obj.set_id(self.id) - if len(self.object_list) > 0 : object_collection_obj.set_Object_List(self.object_list.to_obj()) - return object_collection_obj - - def to_dict(self): - object_collection_dict = {} - if self.id is not None : object_collection_dict['id'] = self.id - if len(self.object_list) > 0 : object_collection_dict['object_list'] = self.object_list.to_list() - return object_collection_dict - - @staticmethod - def from_obj(object_collection_obj): - if not object_collection_obj: - return None - object_collection_ = BaseCollection.from_obj(object_collection_obj, ObjectCollection()) - object_collection_.id = object_collection_obj.get_id() - object_collection_.object_list = ObjectList.from_obj(object_collection_obj.get_Object_List()) - return object_collection_ - - @staticmethod - def from_dict(object_collection_dict): - if not object_collection_dict: - return None - object_collection_ = BaseCollection.from_dict(object_collection_dict, ObjectCollection()) - object_collection_.id = object_collection_dict.get('id') - object_collection_.object_list = ObjectList.from_list(object_collection_dict.get('object_list')) - return object_collection_ - class CandidateIndicatorCollection(BaseCollection): - superclass = BaseCollection + _binding = bundle_binding + _binding_class = bundle_binding.CandidateIndicatorCollectionType + _namespace = maec.bundle._namespace + + id_ = maec.TypedField("id") + candidate_indicator_list = maec.TypedField("Candidate_Indicator_List", CandidateIndicatorList) def __init__(self, name = None, id = None): super(CandidateIndicatorCollection, self).__init__(name) if id: - self.id = id + self.id_ = id else: - self.id = maec.utils.idgen.create_id(prefix="candidate_indicator_collection") + self.id_ = maec.utils.idgen.create_id(prefix="candidate_indicator_collection") self.candidate_indicator_list = CandidateIndicatorList() def add_candidate_indicator(self, candidate_indicator): + """Add an input Candidate Indicator to the Collection.""" self.candidate_indicator_list.append(candidate_indicator) - def to_obj(self): - candidate_indicator_collection_obj = super(CandidateIndicatorCollection, self).to_obj(bundle_binding.CandidateIndicatorCollectionType()) - if self.id is not None : candidate_indicator_collection_obj.set_id(self.id) - if len(self.candidate_indicator_list) > 0 is not None: candidate_indicator_collection_obj.set_Candidate_Indicator_List(self.candidate_indicator_list.to_obj()) - return candidate_indicator_collection_obj - - def to_dict(self): - candidate_indicator_collection_dict = {} - if self.id is not None : candidate_indicator_collection_dict['id'] = self.id - if len(self.candidate_indicator_list) > 0 is not None: candidate_indicator_collection_dict['candidate_indicator_list'] = self.candidate_indicator_list.to_list() - return candidate_indicator_collection_dict - - @staticmethod - def from_obj(candidate_indicator_collection_obj): - if not candidate_indicator_collection_obj: - return None - candidate_indicator_collection_ = BaseCollection.from_obj(candidate_indicator_collection_obj, CandidateIndicatorCollection()) - candidate_indicator_collection_.id = candidate_indicator_collection_obj.get_id() - candidate_indicator_collection_.candidate_indicator_list = CandidateIndicatorList.from_obj(candidate_indicator_collection_obj.get_Candidate_Indicator_List()) - return candidate_indicator_collection_ - - @staticmethod - def from_dict(candidate_indicator_collection_dict): - if not candidate_indicator_collection_dict: - return None - candidate_indicator_collection_ = BaseCollection.from_dict(candidate_indicator_collection_dict, CandidateIndicatorCollection()) - candidate_indicator_collection_.id = candidate_indicator_collection_dict.get('id') - candidate_indicator_collection_.candidate_indicator_list = CandidateIndicatorList.from_list(candidate_indicator_collection_dict.get('candidate_indicator_list')) - return candidate_indicator_collection_ - class BehaviorCollectionList(maec.EntityList): _contained_type = BehaviorCollection _binding_class = bundle_binding.BehaviorCollectionListType @@ -675,15 +154,15 @@ def to_obj(self): if behavior_collection_list_obj.hasContent_(): return behavior_collection_list_obj - #Checks for the existence of a named collection in the list def has_collection(self, collection_name): + """Checks for the existence of a specific named Collection in the list, based on the its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return True return False - #Get a specific named collection in the list def get_named_collection(self, collection_name): + """Return a specific named Collection from the list, based on its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return collection @@ -706,15 +185,15 @@ def to_obj(self): if action_collection_list_obj.hasContent_(): return action_collection_list_obj - #Checks for the existence of a named collection in the list def has_collection(self, collection_name): + """Checks for the existence of a specific named Collection in the list, based on the its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return True return False - #Get a specific named collection in the list def get_named_collection(self, collection_name): + """Return a specific named Collection from the list, based on its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return collection @@ -737,15 +216,15 @@ def to_obj(self): if object_collection_list_obj.hasContent_(): return object_collection_list_obj - #Checks for the existence of a named collection in the list def has_collection(self, collection_name): + """Checks for the existence of a specific named Collection in the list, based on the its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return True return False - #Get a specific named collection in the list def get_named_collection(self, collection_name): + """Return a specific named Collection from the list, based on its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return collection @@ -768,87 +247,368 @@ def to_obj(self): if candidate_indicator_collection_list_obj.hasContent_(): return candidate_indicator_collection_list_obj - #Checks for the existence of a named collection in the list def has_collection(self, collection_name): + """Checks for the existence of a specific named Collection in the list, based on the its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return True return False - #Get a specific named collection in the list def get_named_collection(self, collection_name): + """Return a specific named Collection from the list, based on its name.""" for collection in self: if collection.name is not None and collection.name == collection_name: return collection return None class Collections(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CollectionsType _namespace = maec.bundle._namespace + behavior_collections = maec.TypedField("Behavior_Collections", BehaviorCollectionList) + action_collections = maec.TypedField("Action_Collections", ActionCollectionList) + object_collections = maec.TypedField("Object_Collections", ObjectCollectionList) + candidate_indicator_collections = maec.TypedField("Candidate_Indicator_Collections", CandidateIndicatorCollectionList) + def __init__(self): super(Collections, self).__init__() - self.behavior_collections = BehaviorCollectionList() - self.action_collections = ActionCollectionList() - self.object_collections = ObjectCollectionList() - self.candidate_indicator_collections = CandidateIndicatorCollectionList() - #Checks if the collections instance has any of its lists populated + def add_named_action_collection(self, action_collection_name, collection_id = None): + """Add a new named Action Collection to the Collections instance.""" + if not self.action_collections: + self.action_collections = ActionCollectionList() + self.action_collections.append(ActionCollection(action_collection_name, collection_id)) + + def add_named_object_collection(self, object_collection_name, collection_id = None): + """Add a new named Object Collection to the Collections instance.""" + if not self.object_collections: + self.object_collections = ObjectCollectionList() + self.object_collections.append(ObjectCollection(object_collection_name, collection_id)) + + def add_named_behavior_collection(self, behavior_collection_name, collection_id = None): + """Add a new named Behavior Collection to the Collections instance.""" + if not self.behavior_collections: + self.behavior_collections = BehaviorCollectionList() + self.behavior_collections.append(BehaviorCollection(behavior_collection_name, collection_id)) + + def add_named_candidate_indicator_collection(self, candidate_indicator_collection_name, collection_id = None): + """Add a new named Candidate Indicator Collection to the Collections instance.""" + if not self.candidate_indicator_collections: + self.candidate_indicator_collections = CandidateIndicatorCollectionList() + self.candidate_indicator_collections.append(CandidateIndicatorCollection(candidate_indicator_collection_name, collection_id)) + def has_content(self): - if len(self.behavior_collections) > 0: + """Returns true if any Collections instance inside of the Collection has len > 0.""" + if self.behavior_collections and len(self.behavior_collections) > 0: return True - elif len(self.action_collections) > 0: + elif self.action_collections and len(self.action_collections) > 0: return True - elif len(self.object_collections) > 0: + elif self.object_collections and len(self.object_collections) > 0: return True - elif len(self.candidate_indicator_collections) > 0: + elif self.candidate_indicator_collections and len(self.candidate_indicator_collections) > 0: return True return False - def to_obj(self): - collections_obj = bundle_binding.CollectionsType() - if self.behavior_collections: collections_obj.set_Behavior_Collections(self.behavior_collections.to_obj()) - if self.action_collections: collections_obj.set_Action_Collections(self.action_collections.to_obj()) - if self.object_collections: collections_obj.set_Object_Collections(self.object_collections.to_obj()) - if self.candidate_indicator_collections: collections_obj.set_Candidate_Indicator_Collections(self.candidate_indicator_collections.to_obj()) - return collections_obj - - def to_dict(self): - collections_dict = {} - if self.behavior_collections: collections_dict['behavior_collections'] = self.behavior_collections.to_list() - if self.action_collections: collections_dict['action_collections'] = self.action_collections.to_list() - if self.object_collections: collections_dict['object_collections'] = self.object_collections.to_list() - if self.candidate_indicator_collections: collections_dict['candidate_indicator_collections'] = self.candidate_indicator_collections.to_list() - return collections_dict - - @staticmethod - def from_dict(collections_dict): - if not collections_dict: - return None - collections_ = Collections() - collections_.behavior_collections = BehaviorCollectionList.from_list(collections_dict.get('behavior_collections', [])) - collections_.action_collections = ActionCollectionList.from_list(collections_dict.get('action_collections', [])) - collections_.object_collections = ObjectCollectionList.from_list(collections_dict.get('object_collections', [])) - collections_.candidate_indicator_collections = CandidateIndicatorCollectionList.from_list(collections_dict.get('candidate_indicator_collections', [])) - return collections_ - - @staticmethod - def from_obj(collections_obj): - if not collections_obj: - return None - collections_ = Collections() - if collections_obj.get_Behavior_Collections() is not None: - collections_.behavior_collections = BehaviorCollectionList.from_obj(collections_obj.get_Behavior_Collections()) - if collections_obj.get_Action_Collections() is not None: - collections_.action_collections = ActionCollectionList.from_obj(collections_obj.get_Action_Collections()) - if collections_obj.get_Object_Collections() is not None: - collections_.object_collections = ObjectCollectionList.from_obj(collections_obj.get_Object_Collections()) - if collections_obj.get_Candidate_Indicator_Collections() is not None: - collections_.candidate_indicator_collections = CandidateIndicatorCollectionList.from_obj(collections_obj.get_Candidate_Indicator_Collections()) - return collections_ - class BehaviorReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorReferenceType _namespace = maec.bundle._namespace - behavior_idref = maec.TypedField('behavior_idref') \ No newline at end of file + behavior_idref = maec.TypedField('behavior_idref') + +class Bundle(maec.Entity): + _binding = bundle_binding + _namespace = maec.bundle._namespace + _binding_class = bundle_binding.BundleType + + id_ = maec.TypedField("id") + schema_version = maec.TypedField("schema_version") + defined_subject = maec.TypedField("defined_subject") + content_type = maec.TypedField("content_type") + timestamp = maec.TypedField("timestamp") + malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) + av_classifications = maec.TypedField("AV_Classifications", AVClassifications) + actions = maec.TypedField("Actions", ActionList) + process_tree = maec.TypedField("Process_Tree", ProcessTree) + behaviors = maec.TypedField("Behaviors", BehaviorList) + capabilities = maec.TypedField("Capabilities", CapabilityList) + objects = maec.TypedField("Objects", ObjectList) + candidate_indicators = maec.TypedField("Candidate_Indicators", CandidateIndicatorList) + collections = maec.TypedField("Collections", Collections) + + def __init__(self, id = None, defined_subject = "False", schema_version = "4.1", content_type = None, malware_instance_object = None): + super(Bundle, self).__init__() + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="bundle") + self.schema_version = schema_version + self.defined_subject = defined_subject + self.content_type = content_type + self.timestamp = None + self.malware_instance_object_attributes = malware_instance_object + + def set_malware_instance_object_atttributes(self, malware_instance_object): + """Set the top-level Malware Instance Object Attributes entity in the Bundle.""" + self.malware_instance_object_attributes = malware_instance_object + + def add_av_classification(self, av_classification): + """Add an AV Classification to the top-level AV_Classifications entity in the Bundle.""" + if not self.av_classifications: + self.av_classifications = AVClassifications() + self.av_classifications.append(av_classification) + + def add_capability(self, capability): + """Add a Capability to the top-level Capabilities entity in the Bundle.""" + if not self.capabilities: + self.capabilities = CapabilityList() + self.capabilities.capability.append(capability) + + def set_process_tree(self, process_tree): + """Set the Process Tree, in the top-level element.""" + self.process_tree = process_tree + + def add_named_action_collection(self, collection_name, collection_id = None): + """Add a new named Action Collection to the top-level Collections entity in the Bundle.""" + if not self.collections: + self.collections = Collections() + if collection_name is not None: + self.collections.add_named_action_collection(collection_name, collection_id) + + def add_action(self, action, action_collection_name = None): + """Add an Action to an existing named Action Collection in the Collections entity. + If it does not exist, add it to the top-level Actions entity.""" + if action_collection_name is not None and self.collections: + #The collection has already been defined + if self.collections.action_collections.has_collection(action_collection_name): + action_collection = self.collections.action_collections.get_named_collection(action_collection_name) + action_collection.add_action(action) + elif action_collection_name == None: + if not self.actions: + self.actions = ActionList() + self.actions.append(action) + + def add_named_object_collection(self, collection_name, collection_id = None): + """Add a new named Object Collection to the Collections entity in the Bundle.""" + if not self.collections: + self.collections = Collections() + if collection_name is not None: + self.collections.add_named_object_collection(collection_name, collection_id) + + def get_all_actions(self, bin = False): + """Return a list of all Actions in the Bundle.""" + all_actions = [] + + if self.actions: + for action in self.actions: + all_actions.append(action) + + if self.collections and self.collections.action_collections: + for collection in self.collections.action_collections: + for action in collection.action_list: + all_actions.append(action) + + if bin: + binned_actions = {} + for action in all_actions: + if action.name and action.name.value not in binned_actions: + binned_actions[action.name.value] = [action] + elif action.name and action.name.value in binned_actions: + binned_actions[action.name.value].append(action) + return binned_actions + else: + return all_actions + + def get_all_actions_on_object(self, object): + """Return a list of all of the Actions in the Bundle that operate on a particular input Object.""" + object_actions = [] + if object.id_: + for action in self.get_all_actions(): + associated_objects = action.associated_objects + if associated_objects: + for associated_object in associated_objects: + if associated_object.idref and associated_object.idref == object.id_: + object_actions.append(action) + elif associated_object.id_ and associated_object.id_ == object.id_: + object_actions.append(action) + return object_actions + + def add_object(self, object, object_collection_name = None): + """Add an Object to an existing named Object Collection in the Collections entity. + If it does not exist, add it to the top-level Object entity.""" + if object_collection_name is not None and self.collections: + #The collection has already been defined + if self.collections.object_collections.has_collection(object_collection_name): + object_collection = self.collections.object_collections.get_named_collection(object_collection_name) + object_collection.add_object(object) + elif object_collection_name == None: + self.objects.append(object) + + def get_all_objects(self, include_actions = False): + """Return a list of all Objects in the Bundle.""" + all_objects = [] + + if self.objects: + for obj in self.objects: + all_objects.append(obj) + for related_obj in obj.related_objects: + all_objects.append(related_obj) + + if self.collections and self.collections.object_collections: + for collection in self.collections.object_collections: + for obj in collection.object_list: + all_objects.append(obj) + for related_obj in obj.related_objects: + all_objects.append(related_obj) + + # Include Objects in Actions, if include_actions flag is specified + if include_actions: + for action in self.get_all_actions(): + associated_objects = action.associated_objects + if associated_objects: + for associated_object in associated_objects: + all_objects.append(associated_object) + for related_obj in associated_object.related_objects: + all_objects.append(related_obj) + + # Add the Object corresponding to the Malware Instance Object Attributes, if specified + if self.malware_instance_object_attributes: + all_objects.append(self.malware_instance_object_attributes) + + return all_objects + + def get_all_multiple_referenced_objects(self): + """Return a list of all Objects in the Bundle that are referenced more than once.""" + idref_list = [x.idref for x in self.get_all_objects() if x.idref] + return [self.get_object_by_id(x) for x in idref_list if self.get_object_by_id(x)] + + def get_all_non_reference_objects(self): + """Return a list of all Objects in the Bundle that are not references (i.e. all of the actual Objects in the Bundle).""" + return [x for x in self.get_all_objects(True) if x.id_ and not x.idref] + + def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): + """Find and return the Entity (Action, Object, etc.) with the specified ID.""" + if not ignore_actions: + if self.actions: + for action in self.actions: + if action.id_ == id: + return action + + if action.associated_objects: + for associated_obj in action.associated_objects: + if associated_obj.id_ == id: + return associated_obj + if self.collections: + for collection in self.collections.action_collections: + for action in collection.action_list: + if action.id_ == id: + return action + + if action.associated_objects: + for associated_obj in action.associated_objects: + if associated_obj.id_ == id: + return associated_obj + if self.objects: + for obj in self.objects: + if obj.id_ == id: + return obj + + if self.collections: + for collection in self.collections.object_collections: + for obj in collection.object_list: + if obj.id_ == id: + return obj + + # Test the extra_objects Array + for obj in extra_objects: + if obj.id_ == id: + return obj + + def add_named_behavior_collection(self, collection_name, collection_id = None): + """Add a new named Behavior Collection to the Collections entity in the Bundle.""" + if not self.collections: + self.collections = Collections() + if collection_name is not None: + self.collections.add_named_behavior_collection(collection_name, collection_id) + + def add_behavior(self, behavior, behavior_collection_name = None): + """Add a Behavior to an existing named Behavior Collection in the Collections entity. + If it does not exist, add it to the top-level Behaviors entity.""" + if behavior_collection_name is not None and self.collections: + #The collection has already been defined + if self.collections.behavior_collections.has_collection(behavior_collection_name): + behavior_collection = self.collections.behavior_collections.get_named_collection(behavior_collection_name) + behavior_collection.add_Behavior(behavior) + elif behavior_collection_name == None: + if not self.behaviors: + self.behaviors = BehaviorList() + self.behaviors.append(behavior) + + def add_named_candidate_indicator_collection(self, collection_name, collection_id = None): + """Add a new named Candidate Indicator Collection to the Collections entity in the Bundle.""" + if not self.collections(): + self.collections = Collections() + if collection_name is not None and collection_id is not None: + self.collections.add_named_candidate_indicator_collection(collection_name, collection_id) + + def add_candidate_indicator(self, candidate_indicator, candidate_indicator_collection_name = None): + """Add a Candidate Indicator to an existing named Candidate Indicator Collection in the Collections entity. + If it does not exist, add it to the top-level Candidate Indicators entity.""" + if candidate_indicator_collection_name is not None and self.collections: + #The collection has already been defined + if self.collections.candidate_indicator_collections.has_collection(candidate_indicator_collection_name): + candidate_indicator_collection = self.collections.candidate_indicator_collections.get_named_collection(candidate_indicator_collection_name) + candidate_indicator_collection.add_candidate_indicator(candidate_indicator) + elif candidate_indicator_collection_name == None: + if not self.candidate_indicators: + self.candidate_indicators = CandidateIndicatorList() + self.candidate_indicators.append(candidate_indicator) + + def deduplicate(self): + """Deduplicate all Objects in the Bundle. + Add duplicate Objects to new "Deduplicated Objects" Object Collection, + and replace duplicate entries with references to corresponding Object.""" + BundleDeduplicator.deduplicate(self) + + def get_action_objects(self, action_name_list): + """Get all Objects corresponding to one or more types of Actions, specified via a list of Action names.""" + action_objects = {} + all_actions = self.get_all_actions(bin=True) + for action_name in action_name_list: + if action_name in all_actions: + associated_objects = [] + associated_object_lists = [[y for y in x.associated_objects if x.associated_objects] for x in all_actions[action_name]] + for associated_object_list in associated_object_lists: + associated_objects += associated_object_list + action_objects[action_name] = associated_objects + return action_objects + + def get_object_history(self): + """Build and return the Object history for the Bundle.""" + return ObjectHistory.build(self) + + def normalize_objects(self): + """Normalize all Objects in the Bundle, using the CybOX normalize module.""" + all_objects = self.get_all_objects(include_actions = True) + for object in all_objects: + if object.properties: + normalize_object_properties(object.properties) + + def dereference_objects(self, extra_objects = []): + """Dereference any Objects in the Bundle by replacing them with the entities they reference.""" + all_objects = self.get_all_objects(include_actions=True) + # Add any extra objects that were passed, e.g. from a Malware Subject + all_objects = all_objects + extra_objects + for object in all_objects: + if object.idref and not object.id_: + real_object = self.get_object_by_id(object.idref, extra_objects, ignore_actions = True) + if real_object: + object.idref = None + object.id_ = real_object.id_ + object.properties = real_object.properties + + @classmethod + def compare(cls, bundle_list, match_on = None, case_sensitive = True): + """Compare the Bundle to a list of other Bundles, returning a BundleComparator object.""" + return BundleComparator.compare(bundle_list, match_on, case_sensitive) \ No newline at end of file From 47d0a7a44c0967e673a7acdb389591a45ff1e34e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 25 Aug 2014 16:02:20 -0400 Subject: [PATCH 053/297] Initial commit; split off from bundle.py --- maec/bundle/object_history.py | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 maec/bundle/object_history.py diff --git a/maec/bundle/object_history.py b/maec/bundle/object_history.py new file mode 100644 index 0000000..0b8f472 --- /dev/null +++ b/maec/bundle/object_history.py @@ -0,0 +1,32 @@ +#MAEC Object History Classes + +#Copyright (c) 2014, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/25/2014 + +class ObjectHistory(object): + @classmethod + def build(cls, bundle): + """Build the Object History for a Bundle""" + cls.entries = [] # A list of the Objects in the Object History + # Get the Objects that are not references + objects = bundle.get_all_non_reference_objects() + for object in objects: + object_history_entry = ObjectHistoryEntry(object) + # Find and set all Actions that operate on the Object + if bundle.get_all_actions_on_object(object): + object_history_entry.actions = bundle.get_all_actions_on_object(object) + # Add the history entry to the list + cls.entries.append(object_history_entry) + +class ObjectHistoryEntry(object): + def __init__(self, object = None): + self.object = object + self.actions = [] # A list of the Actions that operate on the Object + self.behaviors = [] # A list of Behaviors that make use of the Object (through Actions?) + + def get_action_names(self): + """Return a list of the Actions that operated on the Object, via their names""" + return [x.name.value for x in self.actions if x.name] From 9a28eefee2c618831c6006ebc1f8b100290733dc Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 25 Aug 2014 16:02:50 -0400 Subject: [PATCH 054/297] Updated for Bundle module changes --- maec/utils/comparator.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/maec/utils/comparator.py b/maec/utils/comparator.py index 330e8f7..1ffa8b0 100644 --- a/maec/utils/comparator.py +++ b/maec/utils/comparator.py @@ -13,7 +13,7 @@ def get_unique(self, bundle_list=None): bundle_list = self.bundle_list for b in self.bundle_list: - unique_objs[b.id] = [] + unique_objs[b.id_] = [] for obj_hash in self.lookup_table: sources = BundleComparator.get_sources(self.lookup_table, obj_hash) @@ -87,10 +87,10 @@ def compare(cls, bundle_list, match_on = None, case_sensitive = True): for bundle in bundle_list: for action in bundle.get_all_actions(): - cls.process_action(action, lookup_table, bundle.id) + cls.process_action(action, lookup_table, bundle.id_) for obj in bundle.get_all_objects(): - cls.process_object(obj, lookup_table, bundle.id) + cls.process_object(obj, lookup_table, bundle.id_) return ComparisonResult(bundle_list, lookup_table) From b6ca23fdafb87355fdab71439869a104da75dcba Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 25 Aug 2014 16:03:33 -0400 Subject: [PATCH 055/297] Added ObjectHistory import --- maec/bundle/bundle.py | 1 + 1 file changed, 1 insertion(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 0828c3f..6f0c20c 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -21,6 +21,7 @@ from maec.bundle.action_reference_list import ActionReferenceList from maec.bundle.process_tree import ProcessTree from maec.bundle.capability import CapabilityList +from maec.bundle.object_history import ObjectHistory from maec.utils.comparator import BundleComparator from maec.utils.deduplicator import BundleDeduplicator From fcc1cb3bd72ce9c5ce84fc3b0ecaa0d5cbb0cdc8 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 26 Aug 2014 09:11:48 -0400 Subject: [PATCH 056/297] Updated Capability-related classes to use TypedField implementation --- maec/bundle/capability.py | 430 ++++++-------------------------------- 1 file changed, 67 insertions(+), 363 deletions(-) diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index 481691f..5910e4e 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -1,11 +1,10 @@ -#MAEC Capability Class +# MAEC Capability Classes -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 8/26/2014 import maec import maec.bindings.maec_bundle as bundle_binding @@ -14,270 +13,91 @@ class CapabilityObjectiveReference(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityObjectiveReferenceType + + objective_idref = maec.TypedField("objective_idref") def __init__(self): super(CapabilityObjectiveReference, self).__init__() - self.objective_idref = None - - def to_obj(self): - capability_objective_reference_obj = bundle_binding.CapabilityObjectiveReferenceType() - if self.objective_idref is not None: capability_objective_reference_obj.set_objective_idref(self.objective_idref) - return capability_objective_reference_obj - - def to_dict(self): - capability_objective_reference_dict = {} - if self.objective_idref is not None: capability_objective_reference_dict['objective_idref'] = self.objective_idref - return capability_objective_reference_dict - - @staticmethod - def from_obj(capability_objective_reference_obj): - if not capability_objective_reference_obj: - return None - capability_objective_reference_ = CapabilityObjectiveReference() - capability_objective_reference_.objective_idref = capability_objective_reference_obj.get_objective_idref() - return capability_objective_reference_ - - @staticmethod - def from_dict(capability_objective_reference_dict): - if not capability_objective_reference_dict: - return None - capability_objective_reference_ = CapabilityObjectiveReference() - capability_objective_reference_.objective_idref = capability_objective_reference_dict['objective_idref'] - return capability_objective_reference_ - + class CapabilityReference(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityReferenceType + + capability_idref = maec.TypedField("capability_idref") def __init__(self): super(CapabilityReference, self).__init__() - self.capability_idref = None - - def to_obj(self): - capability_reference_obj = bundle_binding.CapabilityReferenceType() - if self.capability_idref is not None: capability_reference_obj.set_capability_idref(self.capability_idref) - return capability_reference_obj - - def to_dict(self): - capability_reference_dict = {} - if self.capability_idref is not None: capability_reference_dict['capability_idref'] = self.capability_idref - return capability_reference_dict - - @staticmethod - def from_obj(capability_reference_obj): - if not capability_reference_obj: - return None - capability_reference_ = CapabilityReference() - capability_reference_.capability_idref = capability_reference_obj.get_capability_idref() - return capability_reference_ - - @staticmethod - def from_dict(capability_reference_dict): - if not capability_reference_dict: - return None - capability_reference_ = CapabilityReference() - capability_reference_.capability_idref = capability_reference_dict['capability_idref'] - return capability_reference_ class CapabilityObjectiveRelationship(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityObjectiveRelationshipType + + relationship_type = maec.TypedField("Relationship_Type", VocabString) + objective_reference = maec.TypedField("Objective_Reference", CapabilityObjectiveReference, multiple = True) def __init__(self): super(CapabilityObjectiveRelationship, self).__init__() - self.relationship_type = None self.objective_reference = [] - def to_obj(self): - capability_obj_rel_obj = bundle_binding.CapabilityObjectiveRelationshipType() - if self.relationship_type is not None: capability_obj_rel_obj.set_Relationship_Type(self.relationship_type.to_obj()) - if self.objective_reference is not None: - for objective_ref in self.objective_reference: - capability_obj_rel_obj.add_Objective_Reference(objective_ref.to_obj()) - return capability_obj_rel_obj - - def to_dict(self): - capability_obj_rel_dict = {} - if self.relationship_type is not None: capability_obj_rel_dict['relationship_type'] = self.relationship_type.to_dict() - if self.objective_reference is not None: - capability_obj_rel_dict['objective_reference'] = [x.to_dict() for x in self.objective_reference] - return capability_obj_rel_dict - - @staticmethod - def from_obj(capability_obj_rel_obj): - if not capability_obj_rel_obj: - return None - capability_obj_rel_ = CapabilityObjectiveRelationship() - capability_obj_rel_.relationship_type = VocabString.from_obj(capability_obj_rel_obj.get_Relationship_Type()) - if capability_obj_rel_obj.get_Objective_Reference(): - capability_obj_rel_.objective_reference = [CapabilityObjectiveReference.from_obj(x) for x in capability_obj_rel_obj.get_Objective_Reference()] - return capability_obj_rel_ - - @staticmethod - def from_dict(capability_obj_rel_dict): - if not capability_obj_rel_dict: - return None - capability_obj_rel_ = CapabilityRelationship() - capability_obj_rel_.relationship_type = VocabString.from_dict(capability_obj_rel_dict['relationship_type']) - if capability_obj_rel_dict['objective_reference']: - capability_obj_rel_.objective_reference = [CapabilityObjectiveReference.from_dict(x) for x in capability_obj_rel_dict['objective_reference']] - return capability_obj_rel_ - class CapabilityRelationship(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityRelationshipType + + relationship_type = maec.TypedField("Relationship_Type", VocabString) + capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple = True) def __init__(self): super(CapabilityRelationship, self).__init__() - self.relationship_type = None self.capability_reference = [] - def to_obj(self): - capability_rel_obj = bundle_binding.CapabilityRelationshipType() - if self.relationship_type is not None: capability_rel_obj.set_Relationship_Type(self.relationship_type.to_obj()) - if self.capability_reference is not None: - for capability_ref in self.capability_reference: - capability_rel_obj.add_Capability_Reference(capability_ref.to_obj()) - return capability_rel_obj - - def to_dict(self): - capability_rel_dict = {} - if self.relationship_type is not None: capability_rel_dict['relationship_type'] = self.relationship_type.to_dict() - if self.capability_reference is not None: - capability_rel_dict['capability_reference'] = [x.to_dict() for x in self.capability_reference] - return capability_rel_dict - - @staticmethod - def from_obj(capability_rel_obj): - if not capability_rel_obj: - return None - capability_rel_ = CapabilityRelationship() - capability_rel_.relationship_type = VocabString.from_obj(capability_rel_obj.get_Relationship_Type()) - if capability_rel_obj.get_Capability_Reference(): - capability_rel_.capability_reference = [CapabilityReference.from_obj(x) for x in capability_rel_obj.get_Capability_Reference()] - return capability_rel_ - - @staticmethod - def from_dict(capability_rel_dict): - if not capability_rel_dict: - return None - capability_rel_ = CapabilityRelationship() - capability_rel_.relationship_type = VocabString.from_dict(capability_rel_dict['relationship_type']) - if capability_rel_dict['capability_reference']: - capability_rel_.capability_reference = [CapabilityReference.from_dict(x) for x in capability_rel_dict['capability_reference']] - return capability_rel_ - -class CapabilityObjective(maec.Entity): - _namespace = maec.bundle._namespace - - def __init__(self): - super(CapabilityObjective, self).__init__() - self.id_ = maec.utils.idgen.create_id(prefix="capability_objective") - self.name = None - self.description = None - self.property = [] - self.behavior_reference = [] - self.relationship = [] - - def to_obj(self): - capability_objective_obj = bundle_binding.CapabilityObjectiveType() - if self.id_ is not None: capability_objective_obj.set_id(self.id_) - if self.name is not None: capability_objective_obj.set_Name(self.name.to_obj()) - if self.description is not None: capability_objective_obj.set_Description(self.description.to_obj()) - if self.property: - for prop in self.property: - capability_objective_obj.add_Property(prop.to_obj()) - if self.behavior_reference: - for behavior_ref in self.behavior_reference: - capability_objective_obj.add_Behavior_Reference(behavior_ref.to_obj()) - if self.relationship: - for rel in self.relationship: - capability_objective_obj.add_Relationship(rel.to_obj()) - return capability_objective_obj - - def to_dict(self): - capability_objective_dict = {} - if self.id_ is not None: capability_objective_dict['id'] = self.id_ - if self.name is not None: capability_objective_dict['name'] = self.name.to_dict() - if self.description is not None: capability_objective_dict['description'] = self.description - if self.property: - capability_objective_dict['property'] = [x.to_dict() for x in self.property] - if self.behavior_reference: - capability_objective_dict['behavior_reference'] = [x.to_dict() for x in self.behavior_reference] - if self.relationship: - capability_objective_dict['relationship'] = [x.to_dict() for x in self.relationship] - - return capability_objective_dict - - @staticmethod - def from_obj(capability_objective_obj): - if not capability_objective_obj: - return None - capability_objective_ = CapabilityObjective() - if capability_objective_obj.get_id(): capability_objective_.id_ = capability_objective_obj.get_id() - capability_objective_.name = VocabString.from_obj(capability_objective_obj.get_Name()) - capability_objective_.description = capability_objective_obj.get_Description() - if capability_objective_obj.get_Property(): - capability_objective_.property = [CapabilityProperty.from_obj(x) for x in capability_objective_obj.get_Property()] - if capability_objective_obj.get_Behavior_Reference(): - capability_objective_.behavior_reference = [BehaviorReference.from_obj(x) for x in capability_objective_obj.get_Behavior_Reference()] - if capability_objective_obj.get_Relationship(): - capability_objective_.relationship = [CapabilityObjectiveRelationship.from_obj(x) for x in capability_objective_obj.get_Relationship()] - return capability_objective_ - - @staticmethod - def from_dict(capability_objective_dict): - if not capability_objective_dict: - return None - capability_objective_ = CapabilityObjective() - if capability_objective_dict.get('id'): capability_objective_.id_ = capability_objective_dict.get('id') - capability_objective_.name = VocabString.from_dict(capability_objective_dict.get('name')) - capability_objective_.description = capability_objective_dict.get('description') - if capability_objective_dict.get('property'): - capability_objective_.property = [CapabilityProperty.from_dict(x) for x in capability_objective_dict.get('property')] - if capability_objective_dict.get('behavior_reference'): - capability_objective_.behavior_reference = [BehaviorReference.from_dict(x) for x in capability_objective_dict.get('behavior_reference')] - if capability_objective_dict.get('relationship'): - capability_objective_.relationship = [CapabilityObjectiveRelationship.from_dict(x) for x in capability_objective_dict.get('relationship')] - return capability_objective_ - class CapabilityProperty(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityPropertyType + + name = maec.TypedField("Name", VocabString) + value = maec.TypedField("Value", String) def __init__(self): super(CapabilityProperty, self).__init__() - self.name = None - self.value = None - - def to_obj(self): - capability_property_obj = bundle_binding.CapabilityPropertyType() - if self.name is not None: capability_property_obj.set_Name(self.name.to_obj()) - if self.value is not None: capability_property_obj.set_Value(self.value.to_obj()) - return capability_property_obj - def to_dict(self): - capability_property_dict = {} - if self.name is not None: capability_property_dict['name'] = self.name.to_dict() - if self.value is not None: capability_property_dict['value'] = self.value.to_dict() - return capability_property_dict +class CapabilityObjective(maec.Entity): + _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityObjectiveType - @staticmethod - def from_obj(capability_property_obj): - if not capability_property_obj: - return None - capability_property_ = CapabilityProperty() - capability_property_.name = VocabString.from_obj(capability_property_obj.get_Name()) - capability_property_.value = String.from_obj(capability_property_obj.get_Value()) - return capability_property_ + id_ = maec.TypedField("id") + name = maec.TypedField("Name", VocabString) + description = maec.TypedField("Description") + property = maec.TypedField("Property", CapabilityProperty, multiple = True) + behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) + relationship = maec.TypedField("Relationship", CapabilityObjectiveRelationship, multiple = True) - @staticmethod - def from_dict(capability_property_dict): - if not capability_property_dict: - return None - capability_property_ = CapabilityProperty() - capability_property_.name = VocabString.from_dict(capability_property_dict['name']) - capability_property_.value = String.from_dict(capability_property_dict['value']) - return capability_property_ + def __init__(self, id = None): + super(CapabilityObjective, self).__init__() + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="capability_objective") class Capability(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityType + + id_ = maec.TypedField("id") + name = maec.TypedField("name") + description = maec.TypedField("Description") + property = maec.TypedField("Property", CapabilityProperty, multiple = True) + strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple = True) + tactical_objective = maec.TypedField("Tactical_Objective", CapabilityObjective, multiple = True) + behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) + relationship = maec.TypedField("Relationship", CapabilityRelationship, multiple = True) def __init__(self, id = None, name = None): super(Capability, self).__init__() @@ -286,144 +106,28 @@ def __init__(self, id = None, name = None): else: self.id_ = maec.utils.idgen.create_id(prefix="capability") self.name = name - self.description = None - self.property = [] - self.strategic_objective = [] - self.tactical_objective = [] - self.behavior_reference = [] - self.relationship = [] def add_tactical_objective(self, tactical_objective): + """Add a Tactical Objective to the Capability.""" + if not self.tactical_objective: + self.tactical_objective = [] self.tactical_objective.append(tactical_objective) def add_strategic_objective(self, strategic_objective): + """Add a Strategic Objective to the Capability.""" + if not self.strategic_objective: + self.strategic_objective = [] self.strategic_objective.append(strategic_objective) - - def to_obj(self): - capability_obj = bundle_binding.CapabilityType() - if self.id_ is not None: capability_obj.set_id(self.id_) - if self.name is not None: capability_obj.set_name(self.name) - if self.description is not None: capability_obj.set_Description(self.description) - if self.property: - for prop in self.property: - capability_obj.add_Property(prop.to_obj()) - if self.strategic_objective: - for strategic_obj in self.strategic_objective: - capability_obj.add_Strategic_Objective(strategic_obj.to_obj()) - if self.tactical_objective: - for tactical_obj in self.tactical_objective: - capability_obj.add_Tactical_Objective(tactical_obj.to_obj()) - if self.behavior_reference: - for behavior_ref in self.behavior_reference: - capability_obj.add_Behavior_Reference(behavior_ref.to_obj()) - if self.relationship: - for rel in self.relationship: - capability_obj.add_Relationship(rel.to_obj()) - - return capability_obj - - def to_dict(self): - capability_dict = {} - if self.id_ is not None: capability_dict['id'] = self.id_ - if self.name is not None: capability_dict['name'] = self.name - if self.description is not None: capability_dict['description'] = self.description - if self.property: - capability_dict['property'] = [x.to_dict() for x in self.property] - if self.strategic_objective: - capability_dict['strategic_objective'] = [x.to_dict() for x in self.strategic_objective] - if self.tactical_objective: - capability_dict['tactical_objective'] = [x.to_dict() for x in self.tactical_objective] - if self.behavior_reference: - capability_dict['behavior_reference'] = [x.to_dict() for x in self.behavior_reference] - if self.relationship: - capability_dict['relationship'] = [x.to_dict() for x in self.relationship] - - return capability_dict - - @staticmethod - def from_dict(capability_dict): - if not capability_dict: - return None - capability_ = Capability() - if capability_dict.get('id'): capability_.id_ = capability_dict.get('id') - capability_.name = capability_dict.get('name') - capability_.description = capability_dict.get('description') - if capability_dict.get('property'): - capability_.property = [CapabilityProperty.from_dict(x) for x in capability_dict.get('property')] - if capability_dict.get('strategic_objective'): - capability_.strategic_objective = [CapabilityObjective.from_dict(x) for x in capability_dict.get('strategic_objective')] - if capability_dict.get('tactical_objective'): - capability_.tactical_objective = [CapabilityObjective.from_dict(x) for x in capability_dict.get('tactical_objective')] - if capability_dict.get('behavior_reference'): - capability_.behavior_reference = [BehaviorReference.from_dict(x) for x in capability_dict.get('behavior_reference')] - if capability_dict.get('relationship'): - capability_.relationship = [CapabilityRelationship.from_dict(x) for x in capability_dict.get('relationship')] - return capability_ - - @staticmethod - def from_obj(capability_obj): - if not capability_obj: - return None - capability_ = Capability() - if capability_obj.get_id(): capability_.id_ = capability_obj.get_id() - capability_.name = capability_obj.get_name() - capability_.description = capability_obj.get_Description() - if capability_obj.get_Property(): - capability_.property = [CapabilityProperty.from_obj(x) for x in capability_obj.get_Property()] - if capability_obj.get_Strategic_Objective(): - capability_.strategic_objective = [CapabilityObjective.from_obj(x) for x in capability_obj.get_Strategic_Objective()] - if capability_obj.get_Tactical_Objective(): - capability_.tactical_objective = [CapabilityObjective.from_obj(x) for x in capability_obj.get_Tactical_Objective()] - if capability_obj.get_Behavior_Reference(): - capability_.behavior_reference = [BehaviorReference.from_obj(x) for x in capability_obj.get_Behavior_Reference()] - if capability_obj.get_Relationship(): - capability_.relationship = [CapabilityRelationship.from_obj(x) for x in capability_obj.get_Relationship()] - return capability_ class CapabilityList(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.CapabilityListType + + capability = maec.TypedField("Capability", Capability, multiple = True) + capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple = True) def __init__(self): super(CapabilityList, self).__init__() self.capability = [] self.capability_reference = [] - - def to_obj(self): - capability_list_obj = bundle_binding.CapabilityListType() - if self.capability: - for cap in self.capability: - capability_list_obj.add_Capability(cap.to_obj()) - if self.capability_reference: - for cap_ref in self.capability_reference: - capability_list_obj.add_Capability_Reference(cap_ref.to_obj()) - return capability_list_obj - - def to_dict(self): - capability_list_dict = {} - if self.capability: - capability_list_dict['capability'] = [x.to_dict() for x in self.capability] - if self.capability_reference: - capability_list_dict['capability_reference'] = [x.to_dict() for x in self.capability_reference] - return capability_list_dict - - @staticmethod - def from_obj(capability_list_obj): - if not capability_list_obj: - return None - capability_list_ = CapabilityList() - if capability_list_obj.get_Capability(): - capability_list_.capability = [Capability.from_obj(x) for x in capability_list_obj.get_Capability()] - if capability_list_obj.get_Capability_Reference(): - capability_list_.capability_reference = [CapabilityReference.from_obj(x) for x in capability_list_obj.get_Capability_Reference()] - return capability_list_ - - @staticmethod - def from_dict(capability_list_dict): - if not capability_list_dict: - return None - capability_list_ = CapabilityList() - if capability_list_dict.get('capability'): - capability_list_.capability = [Capability.from_dict(x) for x in capability_list_dict['capability']] - if capability_list_dict.get('capability_reference'): - capability_list_.capability_reference = [CapabilityReference.from_dict(x) for x in capability_list_dict['capability_reference']] - return capability_list_ \ No newline at end of file From 1572aa4ce4f7aa70779b3168ef961036f31d61a4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 27 Aug 2014 10:45:53 -0400 Subject: [PATCH 057/297] Added check for existence of Objects in get_all_objects --- maec/bundle/bundle.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 6f0c20c..a4562a1 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -444,6 +444,8 @@ def add_object(self, object, object_collection_name = None): object_collection = self.collections.object_collections.get_named_collection(object_collection_name) object_collection.add_object(object) elif object_collection_name == None: + if not self.objects: + self.objects = ObjectList() self.objects.append(object) def get_all_objects(self, include_actions = False): From 0e92fe5d6ff1d88244739b58f44cdfc032f3df2d Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 27 Aug 2014 10:46:14 -0400 Subject: [PATCH 058/297] Updated all Malware-Action classes to TypedField based implementation --- maec/bundle/malware_action.py | 204 ++++++---------------------------- 1 file changed, 34 insertions(+), 170 deletions(-) diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 4fdeea8..0a116f9 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -1,10 +1,10 @@ -#MAEC Malware Action Class +# MAEC Malware Action Classes -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 08/27/2014 import cybox from cybox.core import Action @@ -13,109 +13,17 @@ import maec import maec.bindings.maec_bundle as bundle_binding -class APICall(maec.Entity): - _namespace = maec.bundle._namespace - - def __init__(self): - super(APICall, self).__init__() - self.function_name = None - self.normalized_function_name = None - self.address = None - self.return_value = None - self.parameters = [] - - def to_obj(self): - api_call_obj = bundle_binding.APICallType() - if self.function_name is not None: api_call_obj.set_function_name(self.function_name) - if self.normalized_function_name is not None: api_call_obj.set_normalized_function_name(self.normalized_function_name) - if self.address is not None: api_call_obj.set_Address(self.address) - if self.return_value is not None: api_call_obj.set_Return_Value(self.return_value) - if len(self.parameters) > 0: - parameter_list_obj = bundle_binding.ParameterListType() - for parameter in self.parameters: - parameter_list_obj.add_Parameter(parameter.to_obj()) - api_call_obj.set_Parameters(parameter_list_obj) - return api_call_obj - - def to_dict(self): - api_call_dict = {} - if self.function_name is not None: api_call_dict['function_name'] = self.function_name - if self.normalized_function_name is not None: api_call_dict['normalized_function_name'] = self.normalized_function_name - if self.address is not None: api_call_dict['address'] = self.address - if self.return_value is not None: api_call_dict['return_value'] = self.return_value - if len(self.parameters) > 0: - parameter_list = [] - for parameter in self.parameters: - parameter_list.append(parameter.to_dict()) - api_call_dict['parameters'] = parameter_list - return api_call_dict - - @staticmethod - def from_dict(api_call_dict): - if not api_call_dict: - return None - api_call_ = APICall() - api_call_.function_name = api_call_dict.get('function_name') - api_call_.normalized_function_name = api_call_dict.get('normalized_function_name') - api_call_.address = api_call_dict.get('address') - api_call_.return_value = api_call_dict.get('return_value') - api_call_.parameters = ParameterList.from_list(api_call_dict.get('parameters', [])) - return api_call_ - - @staticmethod - def from_obj(api_call_obj): - if not api_call_obj: - return None - api_call_ = APICall() - api_call_.function_name = api_call_obj.get_function_name() - api_call_.normalized_function_name = api_call_obj.get_normalized_function_name() - api_call_.address = api_call_obj.get_Address() - api_call_.return_value = api_call_obj.get_Return_Value() - if api_call_obj.get_Parameters() is not None : api_call_.parameters = ParameterList.from_obj(api_call_obj.get_Parameters()) - return api_call_ - class Parameter(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.ParameterType + + ordinal_position = maec.TypedField("ordinal_position") + name = maec.TypedField("name") + value = maec.TypedField("value") def __init__(self): super(Parameter, self).__init__() - self.ordinal_position = None - self.name = None - self.value = None - - def to_obj(self): - parameter_obj = bundle_binding.ParameterType() - if self.ordinal_position is not None: parameter_obj.set_ordinal_position(self.ordinal_position) - if self.name is not None: parameter_obj.set_name(self.name) - if self.value is not None: parameter_obj.set_value(self.value) - return parameter_obj - - def to_dict(self): - parameter_dict = {} - if self.ordinal_position is not None: parameter_dict['ordinal_position'] = self.ordinal_position - if self.name is not None: parameter_dict['name'] = self.name - if self.value is not None: parameter_dict['value'] = self.value - return parameter_dict - - @staticmethod - def from_dict(parameter_dict): - if not parameter_dict: - return None - parameter_ = Parameter() - parameter_.ordinal_position = parameter_dict.get('ordinal_position') - parameter_.name = parameter_dict.get('name') - parameter_.value = parameter_dict.get('value') - return parameter_ - - @staticmethod - def from_obj(parameter_obj): - if not parameter_obj: - return None - parameter_ = Parameter() - parameter_.ordinal_position = parameter_obj.get_ordinal_position() - parameter_.name = parameter_obj.get_name() - parameter_.value = parameter_obj.get_value() - return parameter_ class ParameterList(maec.EntityList): _contained_type = Parameter @@ -123,76 +31,38 @@ class ParameterList(maec.EntityList): _binding_var = "Parameter" _namespace = maec.bundle._namespace +class APICall(maec.Entity): + _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.APICallType + + function_name = maec.TypedField("function_name") + normalized_function_name = maec.TypedField("normalized_function_name") + address = maec.TypedField("Address") + return_value = maec.TypedField("Return_Value") + parameters = maec.TypedField("Parameters", ParameterList) + + def __init__(self): + super(APICall, self).__init__() + class ActionImplementation(maec.Entity): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.ActionImplementationType + + id_ = maec.TypedField("id") + type_ = maec.TypedField("type_", key_name = "type") + #compatible_platforms TODO: Add support + api_call = maec.TypedField("API_Call", APICall) + code = maec.TypedField("Code", Code, multiple = True) def __init__(self): super(ActionImplementation, self).__init__() - self.id = None - self.type = None - self.compatible_platforms = [] - self.api_call = None - self.code = [] - - def to_obj(self): - implementation_obj = bundle_binding.ActionImplementationType() - if self.id is not None: implementation_obj.set_id(self.id) - if self.type is not None: implementation_obj.set_type(self.type) - if self.compatible_platforms is not None: pass - #platform_list_obj = bundle_binding.PlatformListType() #TODO: implement - #for platform in self.compatible_platforms: - # platform_list_obj.add_Platform(platform.to_obj()) - #implementation_obj.set_Compatible_Platforms(platform_list_obj) - if self.api_call is not None: implementation_obj.set_API_Call(self.api_call.to_obj()) - if self.code is not None: - for code_obj in self.code: - implementation_obj.add_Code(code_obj.to_obj()) - return implementation_obj - - def to_dict(self): - implementation_dict = {} - if self.id is not None: implementation_dict['id'] = self.id - if self.type is not None: implementation_dict['type'] = self.type - if self.compatible_platforms is not None: pass - #platform_list_obj = bundle_binding.PlatformListType() #TODO: implement - #for platform in self.compatible_platforms: - # platform_list_obj.add_Platform(platform.to_obj()) - #implementation_obj.set_Compatible_Platforms(platform_list_obj) - if self.api_call is not None: implementation_dict['api_call'] = self.api_call.to_dict() - if self.code is not None: - implementation_dict['code'] = [x.to_dict() for x in self.code] - return implementation_dict - - @staticmethod - def from_dict(implementation_dict): - if not implementation_dict: - return None - implementation_ = ActionImplementation() - implementation_.id = implementation_dict.get('id') - implementation_.type = implementation_dict.get('type') - #implementation_.compatible_platforms = implementation_dict.get('compatible_platforms') #TODO: add support - implementation_.api_call = APICall.from_dict(implementation_dict.get('api_call')) - if implementation_dict.get('code'): - implementation_.code = [Code.from_dict(x) for x in implementation_dict.get('code')] - return implementation_ - - @staticmethod - def from_obj(implementation_obj): - if not implementation_obj: - return None - implementation_ = ActionImplementation() - implementation_.id = implementation_obj.get_id() - implementation_.type = implementation_obj.get_type() - #implementation_.compatible_platforms = implementation_dict.get('compatible_platforms') #TODO: add support - implementation_.api_call = APICall.from_obj(implementation_obj.get_API_Call()) - if implementation_obj.get_Code(): - implementation_.code = [Code.from_obj(x) for x in implementation_obj.get_Code()] - return implementation_ class MalwareAction(Action): _binding = bundle_binding _binding_class = bundle_binding.MalwareActionType - _namespace = 'http://maec.mitre.org/XMLSchema/maec-bundle-4' + _namespace = maec.bundle._namespace implementation = cybox.TypedField("Implementation", ActionImplementation) @@ -200,10 +70,4 @@ def __init__(self): super(MalwareAction, self).__init__() self.id_ = maec.utils.idgen.create_id(prefix="action") - #def to_dict(self): - # action_dict = super(MalwareAction, self).to_dict() - # action_dict['implementation'] = self.implementation.to_dict() - # return action_dict - - From 8b64c158d28b418e06520981c041f3e2a01cc3eb Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 27 Aug 2014 11:20:39 -0400 Subject: [PATCH 059/297] Updated all CandidateIndicator classes to TypedField based implementation --- maec/bundle/candidate_indicator.py | 235 +++++------------------------ 1 file changed, 41 insertions(+), 194 deletions(-) diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 2cd9d52..9691918 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -1,10 +1,10 @@ -#MAEC Candidate Indicator Class +# MAEC Candidate Indicator Class -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 08/27/2014 import maec import maec.bindings.maec_bundle as bundle_binding @@ -13,210 +13,57 @@ from cybox.common import VocabString from cybox.core import ActionReference -class CandidateIndicator(maec.Entity): - _namespace = maec.bundle._namespace - - def __init__(self, id = None): - super(CandidateIndicator, self).__init__() - if id: - self.id = id - else: - self.id = maec.utils.idgen.create_id(prefix="candidate_indicator") - self.creation_datetime = None - self.lastupdate_datetime = None - self.version = None - self.importance = None - self.numeric_importance = None - self.author = None - self.description = None - self.malware_entity = None - self.composition = None - - def to_obj(self): - candidate_indicator_obj = bundle_binding.CandidateIndicatorType() - if self.id is not None : candidate_indicator_obj.set_id(self.id) - if self.creation_datetime is not None : candidate_indicator_obj.set_creation_datetime(self.creation_datetime) - if self.version is not None : candidate_indicator_obj.set_version(self.version) - if self.importance is not None : candidate_indicator_obj.set_Importance(self.importance.to_obj()) - if self.numeric_importance is not None : candidate_indicator_obj.set_Numeric_Importance(self.numeric_importance) - if self.author is not None : candidate_indicator_obj.set_Numeric_Importance(self.author) - if self.description is not None : candidate_indicator_obj.set_Description(self.description) - if self.malware_entity is not None : candidate_indicator_obj.set_Malware_Entity(self.malware_entity.to_obj()) - if self.composition is not None : candidate_indicator_obj.set_Composition(self.composition.to_obj()) - return candidate_indicator_obj - - def to_dict(self): - candidate_indicator_dict = {} - if self.id is not None : candidate_indicator_dict['id'] = self.id - if self.creation_datetime is not None : candidate_indicator_dict['creation_datetime'] = self.creation_datetime - if self.version is not None : candidate_indicator_dict['version'] = self.version - if self.importance is not None : candidate_indicator_dict['importance'] = self.importance.to_dict() - if self.numeric_importance is not None : candidate_indicator_dict['numeric_importance'] = self.numeric_importance - if self.author is not None : candidate_indicator_dict['author'] = self.author - if self.description is not None : candidate_indicator_dict['description'] = self.description - if self.malware_entity is not None : candidate_indicator_dict['malware_entity'] = self.malware_entity.to_dict() - if self.composition is not None : candidate_indicator_dict['composition'] = self.composition.to_dict() - return candidate_indicator_dict - - @staticmethod - def from_dict(candidate_indicator_dict): - if not candidate_indicator_dict: - return None - candidate_indicator_ = CandidateIndicator() - candidate_indicator_.id = candidate_indicator_dict.get('id') - candidate_indicator_.creation_datetime = candidate_indicator_dict.get('creation_datetime') - candidate_indicator_.version = candidate_indicator_dict.get('version') - candidate_indicator_.importance = VocabString.from_dict(candidate_indicator_dict.get('importance')) - candidate_indicator_.numeric_importance = candidate_indicator_dict.get('numeric_importance') - candidate_indicator_.author = candidate_indicator_dict.get('author') - candidate_indicator_.description = candidate_indicator_dict.get('description') - candidate_indicator_.malware_entity = MalwareEntity.from_dict(candidate_indicator_dict.get('malware_entity')) - candidate_indicator_.composition = CandidateIndicatorComposition.from_dict(candidate_indicator_dict.get('composition')) - return candidate_indicator_ - - @staticmethod - def from_obj(candidate_indicator_obj): - if not candidate_indicator_obj: - return None - candidate_indicator_ = CandidateIndicator() - candidate_indicator_.id = candidate_indicator_obj.get_id() - candidate_indicator_.creation_datetime = candidate_indicator_obj.get_creation_datetime() - candidate_indicator_.version = candidate_indicator_obj.get_version() - candidate_indicator_.importance = VocabString.from_obj(candidate_indicator_obj.get_Importance()) - candidate_indicator_.numeric_importance = candidate_indicator_obj.get_Numeric_Importance() - candidate_indicator_.author = candidate_indicator_obj.get_Author() - candidate_indicator_.description = candidate_indicator_obj.get_Description() - candidate_indicator_.malware_entity = MalwareEntity.from_obj(candidate_indicator_obj.get_Malware_Entity()) - candidate_indicator_.composition = CandidateIndicatorComposition.from_obj(candidate_indicator_obj.get_Composition()) - return candidate_indicator_ - class MalwareEntity(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.MalwareEntityType _namespace = maec.bundle._namespace + type_ = maec.TypedField("Type", VocabString) + name = maec.TypedField("Name") + description = maec.TypedField("Description") + def __init__(self): super(MalwareEntity, self).__init__() - self.type = None - self.name = None - self.description = None - - def to_obj(self): - malware_entity_obj = bundle_binding.MalwareEntityType() - if self.type is not None : malware_entity_obj.set_Type(self.type.to_obj()) - if self.name is not None : malware_entity_obj.set_Name(self.name) - if self.description is not None : malware_entity_obj.set_Description(self.description) - return malware_entity_obj - - def to_dict(self): - malware_entity_dict = {} - if self.type is not None : malware_entity_dict['type'] = self.type.to_dict() - if self.name is not None : malware_entity_dict['name'] = self.name - if self.description is not None : malware_entity_dict['description'] = self.description - return malware_entity_dict - - @staticmethod - def from_dict(malware_entity_dict): - if not malware_entity_dict: - return None - malware_entity_ = MalwareEntity() - malware_entity_.type = VocabString.from_dict(malware_entity_dict.get('type')) - malware_entity_.name = malware_entity_dict.get('name') - malware_entity_.description = malware_entity_dict.get('description') - return malware_entity_ - - @staticmethod - def from_obj(malware_entity_obj): - if not malware_entity_obj: - return None - malware_entity_ = MalwareEntity() - malware_entity_.type = VocabString.from_obj(malware_entity_obj.get_Type()) - malware_entity_.name = malware_entity_obj.get_Name() - malware_entity_.description = malware_entity_obj.get_Description() - return malware_entity_ class CandidateIndicatorComposition(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CandidateIndicatorCompositionType _namespace = maec.bundle._namespace + operator = maec.TypedField("operator") + behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) + action_reference = maec.TypedField("Action_Reference", ActionReference, multiple = True) + object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) + sub_composition = maec.TypedField("Sub_Composition", multiple = True) + def __init__(self): super(CandidateIndicatorComposition, self).__init__() - self.operator = None - self.behavior_references = [] - self.action_references = [] - self.object_references = [] - self.sub_compositions = [] - def to_obj(self): - candidate_indc_comp_obj = bundle_binding.CandidateIndicatorCompositionType() - if self.operator is not None : candidate_indc_comp_obj.set_operator(self.operator) - if len(self.behavior_references) > 0: - for behavior_reference in self.behavior_references: candidate_indc_comp_obj.add_Behavior_Reference(behavior_reference.to_obj()) - if len(self.action_references) > 0: - for action_reference in self.action_references: candidate_indc_comp_obj.add_Action_Reference(action_reference.to_obj()) - if len(self.object_references) > 0: - for object_reference in self.object_references: candidate_indc_comp_obj.add_Object_Reference(object_reference.to_obj()) - if len(self.sub_compositions) > 0: - for sub_composition in self.sub_compositions: candidate_indc_comp_obj.add_Sub_Composition(sub_composition.to_obj()) - return candidate_indc_comp_obj +# Allow recursive definition of CandidateIndicatorCompositions +CandidateIndicatorComposition.sub_composition.type_ = CandidateIndicatorComposition - def to_dict(self): - candidate_indc_comp_dict = {} - if self.operator is not None : candidate_indc_comp_dict['operator'] = self.operator - if len(self.behavior_references) > 0: - behavior_reference_list = [] - for behavior_reference in self.behavior_references: behavior_reference_list.append(behavior_reference.to_dict()) - candidate_indc_comp_dict['behavior_references'] = behavior_reference_list - if len(self.action_references) > 0: - action_reference_list = [] - for action_reference in self.action_references: action_reference_list.append(action_reference.to_dict()) - candidate_indc_comp_dict['action_references'] = action_reference_list - if len(self.object_references) > 0: - object_reference_list = [] - for object_reference in self.object_references: object_reference_list.append(object_reference.to_dict()) - candidate_indc_comp_dict['object_references'] = object_reference_list - if len(self.sub_compositions) > 0: - sub_composition_list = [] - for sub_composition in self.sub_compositions: sub_composition_list.append(sub_composition.to_dict()) - candidate_indc_comp_dict['sub_compositions'] = sub_composition_list - return candidate_indc_comp_dict +class CandidateIndicator(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CandidateIndicatorType + _namespace = maec.bundle._namespace - @staticmethod - def from_dict(candidate_indc_comp_dict): - if not candidate_indc_comp_dict: - return None - candidate_indicator_composition_ = CandidateIndicatorComposition() - candidate_indicator_composition_.operator = candidate_indc_comp_dict.get('operator') - if candidate_indc_comp_dict.get('behavior_references') is not None: - for behavior_reference_dict in candidate_indc_comp_dict.get('behavior_references'): - candidate_indicator_composition_.behavior_references.append(BehaviorReference.from_dict(behavior_reference_dict)) - if candidate_indc_comp_dict.get('action_references') is not None: - for action_reference_dict in candidate_indc_comp_dict.get('action_references'): - candidate_indicator_composition_.action_references.append(ActionReference.from_dict(action_reference_dict)) - if candidate_indc_comp_dict.get('object_references') is not None: - for object_reference_dict in candidate_indc_comp_dict.get('object_references'): - candidate_indicator_composition_.object_references.append(ObjectReference.from_dict(object_reference_dict)) - if candidate_indc_comp_dict.get('sub_compositions') is not None: - for sub_composition_dict in candidate_indc_comp_dict.get('sub_compositions'): - candidate_indicator_composition_.sub_compositions.append(CandidateIndicatorComposition.from_dict(sub_composition_dict)) - return candidate_indicator_composition_ + id_ = maec.TypedField("id") + creation_datetime = maec.TypedField("creation_datetime") + lastupdate_datetime = maec.TypedField("lastupdate_datetime") + version = maec.TypedField("version") + importance = maec.TypedField("Importance", VocabString) + numeric_importance = maec.TypedField("Numeric_Importance") + author = maec.TypedField("Author") + description = maec.TypedField("Description") + malware_entity = maec.TypedField("Malware_Entity", MalwareEntity) + composition = maec.TypedField("Composition", CandidateIndicatorComposition) - @staticmethod - def from_obj(candidate_indc_comp_obj): - if not candidate_indc_comp_obj: - return None - candidate_indicator_composition_ = CandidateIndicatorComposition() - candidate_indicator_composition_.operator = candidate_indc_comp_obj.get_operator() - if len(candidate_indc_comp_obj.get_Behavior_Reference()) > 0: - for behavior_reference_obj in candidate_indc_comp_obj.get_Behavior_Reference(): - candidate_indicator_composition_.behavior_references.append(BehaviorReference.from_obj(behavior_reference_obj)) - if len(candidate_indc_comp_obj.get_Action_Reference()) > 0: - for action_reference_obj in candidate_indc_comp_obj.get_Action_Reference(): - candidate_indicator_composition_.action_references.append(ActionReference.from_obj(action_reference_obj)) - if len(candidate_indc_comp_obj.get_Object_Reference()) > 0: - for object_reference_obj in candidate_indc_comp_obj.get_Object_Reference(): - candidate_indicator_composition_.object_references.append(ObjectReference.from_obj(object_reference_obj)) - if len(candidate_indc_comp_obj.get_Sub_Composition()) > 0: - for sub_composition_obj in candidate_indc_comp_obj.get_Sub_Composition(): - candidate_indicator_composition_.sub_compositions.append(CandidateIndicatorComposition.from_obj(sub_composition_obj)) - return candidate_indicator_composition_ + def __init__(self, id = None): + super(CandidateIndicator, self).__init__() + if id: + id_ = id + else: + id_ = maec.utils.idgen.create_id(prefix="candidate_indicator") class CandidateIndicatorList(maec.EntityList): _contained_type = CandidateIndicator From 95ca505863be036ce9eeacdb1e09a8531a5557ff Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 27 Aug 2014 16:29:33 -0400 Subject: [PATCH 060/297] Updated ProcessTree to TypedField implementation --- maec/bundle/process_tree.py | 191 ++++++++++++++---------------------- 1 file changed, 71 insertions(+), 120 deletions(-) diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index b7f8457..9b9d157 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -1,174 +1,125 @@ -#MAEC Bundle Class +# MAEC Process Tree classes -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 08/27/2014 +import cybox from cybox.objects.process_object import Process +from cybox.core import ActionReference import maec import maec.bindings.maec_bundle as bundle_binding from maec.bundle.action_reference_list import ActionReferenceList - -class ProcessTree(maec.Entity): - _namespace = maec.bundle._namespace - - def __init__(self, root_process = None): - super(ProcessTree, self).__init__() - self.root_process = root_process - - def set_root_process(self, root_process): - self.root_process = root_process - - def to_obj(self): - process_tree_obj = bundle_binding.ProcessTreeType() - if self.root_process is not None: - process_tree_obj.set_Root_Process(self.root_process.to_obj()) - return process_tree_obj - - def to_dict(self): - process_tree_dict = {} - if self.root_process is not None: - process_tree_dict['root_process'] = self.root_process.to_dict() - return process_tree_dict - - @staticmethod - def from_dict(process_tree_dict): - if not process_tree_dict: - return None - process_tree_ = ProcessTree() - process_tree_.root_process = ProcessTreeNode.from_dict(process_tree_dict.get('root_process')) - return process_tree_ - - @staticmethod - def from_obj(process_tree_obj): - if not process_tree_obj: - return None - process_tree_ = ProcessTree() - process_tree_.root_process = ProcessTreeNode.from_obj(process_tree_obj.get_Root_Process()) - return process_tree_ - - class ProcessTreeNode(Process): _binding = bundle_binding _binding_class = bundle_binding.ProcessTreeNodeType _XSI_NS = "maecBundle" _XSI_TYPE = "ProcessTreeNodeType" - superclass = Process + id_ = cybox.TypedField("id") + parent_action_idref = cybox.TypedField("parent_action_idref") + ordinal_position = cybox.TypedField("ordinal_position") + initiated_actions = cybox.TypedField("Initiated_Actions", ActionReferenceList) + spawned_process = cybox.TypedField("Spawned_Process", multiple = True) + injected_process = cybox.TypedField("Injected_Process", multiple = True) + def __init__(self, id = None, parent_action_idref = None): super(ProcessTreeNode, self).__init__() - self.id = maec.utils.idgen.create_id(prefix="process_tree") + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="process_tree") self.parent_action_idref = parent_action_idref - self.ordinal_position = None - self.initiated_actions = ActionReferenceList() - self.spawned_processes = [] - self.injected_processes = [] def add_spawned_process(self, process_node, process_id = None): + """Add a spawned process to the Process Tree node, either directly or to a + particular process embedded in the node based on its ID.""" if not process_id: + if not self.spawned_processes: + self.spawned_processes = [] self.spawned_processes.append(process_node) elif process_id: if str(self.pid) == process_id: + if not self.spawned_processes: + self.spawned_processes = [] self.spawned_processes.append(process_node) else: embedded_process = self.find_embedded_process(process_id) if embedded_process: + if not embedded_process.spawned_processes: + embedded_process.spawned_processes = [] embedded_process.spawned_processes.append(process_node) def add_injected_process(self, process_node, process_id = None): + """Add an injected process to the Process Tree node, either directly or to a + particular process embedded in the node based on its ID.""" if not process_id: + if not self.injected_processes: + self.injected_processes = [] self.injected_processes.append(process_node) elif process_id: if str(self.pid) == process_id: + if not self.injected_processes: + self.injected_processes = [] self.injected_processes.append(process_node) else: embedded_process = self.find_embedded_process(process_id) if embedded_process: + if not embedded_process.injected_processes: + embedded_process.injected_processes = [] embedded_process.injected_processes.append(process_node) def add_initiated_action(self, action_id): + """Add an initiated Action to the Process Tree node, based on its ID.""" + if not self.initiated_actions: + self.initiated_actions = ActionReferenceList() self.initiated_actions.append(action_id) def find_embedded_process(self, process_id): + """Find a Process embedded somewhere in the Process Tree node tree, based on its ID.""" embedded_process = None - for spawned_process in self.spawned_processes: - if str(spawned_process.pid) == str(process_id): - embedded_process = spawned_process - else: - embedded_process = spawned_process.find_embedded_process(process_id) - for injected_process in self.injected_processes: - if str(injected_process.pid) == str(process_id): - embedded_process = injected_process - else: - embedded_process = injected_process.find_embedded_process(process_id) + if self.spawned_processes: + for spawned_process in self.spawned_processes: + if str(spawned_process.pid) == str(process_id): + embedded_process = spawned_process + else: + embedded_process = spawned_process.find_embedded_process(process_id) + if self.injected_processes: + for injected_process in self.injected_processes: + if str(injected_process.pid) == str(process_id): + embedded_process = injected_process + else: + embedded_process = injected_process.find_embedded_process(process_id) return embedded_process def set_id(self, id): - self.id = id + """Set the ID of the Process Tree node.""" + self.id_ = id def set_parent_action(self, parent_action_id): + """Set the ID of the parent action of the Process Tree node.""" self.parent_action_idref = parent_action_id - def to_obj(self): - process_tree_node_obj = super(ProcessTreeNode, self).to_obj() - if self.id is not None : process_tree_node_obj.set_id(self.id) - if self.parent_action_idref is not None : process_tree_node_obj.set_parent_action_idref(self.parent_action_idref) - if self.ordinal_position is not None : process_tree_node_obj.set_ordinal_position(self.ordinal_position) - if self.initiated_actions: process_tree_node_obj.set_Initiated_Actions(self.initiated_actions.to_obj()) - if self.spawned_processes: - for spawned_process in self.spawned_processes: - process_tree_node_obj.add_Spawned_Process(spawned_process.to_obj()) - if self.injected_processes: - for injected_process in self.injected_processes: - process_tree_node_obj.add_Injected_Process(injected_process.to_obj()) - return process_tree_node_obj - - def to_dict(self): - process_tree_node_dict = super(ProcessTreeNode, self).to_dict() - if self.id is not None : process_tree_node_dict['id'] = self.id - if self.parent_action_idref is not None : process_tree_node_dict['parent_action_idref'] = self.parent_action_idref - if self.ordinal_position is not None : process_tree_node_dict['ordinal_position'] = self.ordinal_position - if self.initiated_actions: process_tree_node_dict['initiated_actions'] = self.initiated_actions.to_list() - if self.spawned_processes: - spawned_process_list = [] - for spawned_process in self.spawned_processes: - spawned_process_list.append(spawned_process.to_dict()) - process_tree_node_dict['spawned_processes'] = spawned_process_list - if self.injected_processes > 0: - injected_process_list = [] - for injected_process in self.injected_processes: - injected_process_list.append(injected_process.to_dict()) - process_tree_node_dict['injected_processes'] = injected_process_list - return process_tree_node_dict - - @classmethod - def from_dict(cls, process_tree_node_dict): - if not process_tree_node_dict: - return None - process_tree_node_ = super(ProcessTreeNode, cls).from_dict(process_tree_node_dict) - process_tree_node_.id = process_tree_node_dict.get('id') - process_tree_node_.parent_action_idref = process_tree_node_dict.get('parent_action_idref') - process_tree_node_.ordinal_position = process_tree_node_dict.get('ordinal_position') - process_tree_node_.initiated_actions = ActionReferenceList.from_list(process_tree_node_dict.get('initiated_actions', [])) - process_tree_node_.spawned_processes = [ProcessTreeNode.from_dict(x) for x in process_tree_node_dict.get('spawned_processes', [])] - process_tree_node_.injected_processes = [ProcessTreeNode.from_dict(x) for x in process_tree_node_dict.get('injected_processes', [])] - return process_tree_node_ - - @classmethod - def from_obj(cls, process_tree_node_obj): - if not process_tree_node_obj: - return None - process_tree_node_ = super(ProcessTreeNode, cls).from_obj(process_tree_node_obj) - process_tree_node_.id = process_tree_node_obj.get_id() - process_tree_node_.parent_action_idref = process_tree_node_obj.get_parent_action_idref() - process_tree_node_.ordinal_position = process_tree_node_obj.get_ordinal_position() - if process_tree_node_obj.get_Initiated_Actions() is not None: - process_tree_node_.initiated_actions = ActionReferenceList.from_obj(process_tree_node_obj.get_Initiated_Actions()) - process_tree_node_.spawned_processes = [ProcessTreeNode.from_obj(x) for x in process_tree_node_obj.get_Spawned_Process()] - process_tree_node_.injected_processes = [ProcessTreeNode.from_obj(x) for x in process_tree_node_obj.get_Injected_Process()] - return process_tree_node_ +class ProcessTree(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.ProcessTreeType + _namespace = maec.bundle._namespace + + root_process = maec.TypedField("Root_Process", ProcessTreeNode) + + def __init__(self, root_process = None): + super(ProcessTree, self).__init__() + self.root_process = root_process + + def set_root_process(self, root_process): + """Set the Root Process node of the Process Tree entity.""" + self.root_process = root_process + +# Allow recursive definition of ProcessTreeNodes +ProcessTreeNode.spawned_process.type_ = ProcessTreeNode +ProcessTreeNode.injected_process.type_ = ProcessTreeNode \ No newline at end of file From 905bf95ae50142ff337a6d3a88124c1a46c27f2d Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 28 Aug 2014 09:09:25 -0400 Subject: [PATCH 061/297] Added copyright header and updated constructor to properly set classification_name --- maec/bundle/av_classification.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index 657c99f..cd4de82 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -1,3 +1,11 @@ +# MAEC AV Classification classes + +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved + +# Compatible with MAEC v4.1 +# Last updated 08/28/2014 + import maec import maec.bindings.maec_bundle as bundle_binding from cybox.common import ToolInformation @@ -9,7 +17,7 @@ def __init__(self, classification = None, tool_name = None, tool_vendor = None): super(AVClassification, self).__init__(tool_name, tool_vendor) self.engine_version = None self.definition_version = None - self.classification_name = None + self.classification_name = classification def to_obj(self): av_classification_obj = super(AVClassification, self).to_obj(bundle_binding.AVClassificationType()) From 4719900571ba2af887a36d218539e017ba233293 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 28 Aug 2014 09:22:00 -0400 Subject: [PATCH 062/297] Updated for TypedField implementation --- maec/bundle/behavior_reference.py | 45 ++++++++----------------------- 1 file changed, 11 insertions(+), 34 deletions(-) diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index e4d4afa..910de78 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -1,44 +1,21 @@ -#MAEC Behavior Reference Class +# MAEC Behavior Reference Class -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 08/28/2014 import maec import maec.bindings.maec_bundle as bundle_binding class BehaviorReference(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehaviorReferenceType _namespace = maec.bundle._namespace - def init(self, behavior_idref = None): - super(BehaviorReference, self).__init__() - self.behavior_idref = behavior_idref - - def to_obj(self): - behavior_reference_obj = bundle_binding.BehaviorReferenceType() - if self.behavior_idref is not None : behavior_reference_obj.set_behavior_idref(self.behavior_idref) - return behavior_reference_obj - - def to_dict(self): - behavior_reference_dict = {} - if self.behavior_idref is not None : behavior_reference_dict['behavior_idref'] = self.behavior_idref - return behavior_reference_dict + behavior_idref = maec.TypedField("behavior_idref") - @staticmethod - def from_dict(behavior_reference_dict): - if not behavior_reference_dict: - return None - behavior_reference_ = BehaviorReference() - behavior_reference_.behavior_idref = behavior_reference_dict.get('behavior_idref') - return behavior_reference_ - - @staticmethod - def from_obj(behavior_reference_obj): - if not behavior_reference_obj: - return None - behavior_reference_ = BehaviorReference() - behavior_reference_.behavior_idref = behavior_reference_obj.get_behavior_idref() - return behavior_reference_ - \ No newline at end of file + def __init__(self, behavior_idref = None): + super(BehaviorReference, self).__init__() + self.behavior_idref = behavior_idref \ No newline at end of file From 642bc387cd3580a874f59d7b1ba0c5c004f2d32c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 28 Aug 2014 09:23:48 -0400 Subject: [PATCH 063/297] Updated for TypedField implementation --- maec/bundle/object_reference.py | 40 +++++++-------------------------- 1 file changed, 8 insertions(+), 32 deletions(-) diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index d1918d0..6326fd0 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -1,46 +1,22 @@ -#MAEC Object Reference Class +# MAEC Object Reference Class -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +# Compatible with MAEC v4.1 +# Last updated 08/28/2014 import maec import maec.bindings.maec_bundle as bundle_binding class ObjectReference(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.ObjectReferenceType _namespace = maec.bundle._namespace - def init(self, object_idref = None): + def __init__(self, object_idref = None): super(ObjectReference, self).__init__() self.object_idref = object_idref - - def to_obj(self): - object_reference_obj = bundle_binding.ObjectReferenceType() - if self.object_idref is not None : object_reference_obj.set_object_idref(self.object_idref) - return object_reference_obj - - def to_dict(self): - object_reference_dict = {} - if self.object_idref is not None : object_reference_dict['object_idref'] = self.object_idref - return object_reference_dict - - @staticmethod - def from_dict(object_reference_dict): - if not object_reference_dict: - return None - object_reference_ = ObjectReference() - object_reference_.object_idref = object_reference_dict.get('object_idref') - return object_reference_ - - @staticmethod - def from_obj(object_reference_obj): - if not object_reference_obj: - return None - object_reference_ = ObjectReference() - object_reference_.object_idref = object_reference_obj.get_object_idref() - return object_reference_ class ObjectReferenceList(maec.EntityList): _contained_type = ObjectReference From d97937e328d0686572e39ea0eeff74603a2dbe5e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 28 Aug 2014 10:12:36 -0400 Subject: [PATCH 064/297] Bumped up version to v4.1.0.7 --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index 44213b8..7b49dc4 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.6" +__version__ = "4.1.0.7" import collections import json From 2b52fe530e045541323d704ddfc4b6a1341d15d7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 13:21:00 -0400 Subject: [PATCH 065/297] Added _includes and work in progress prolog --- docs/_includes/wip_prolog.rst | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 docs/_includes/wip_prolog.rst diff --git a/docs/_includes/wip_prolog.rst b/docs/_includes/wip_prolog.rst new file mode 100644 index 0000000..861794d --- /dev/null +++ b/docs/_includes/wip_prolog.rst @@ -0,0 +1,8 @@ +.. warning:: + + This documentation is still a work in progress. If you have any issues or + questions, please ask on the maec-discussion mailing list or file a bug + in our `issue tracker`_. + +.. _issue tracker: https://github.com/MAECProject/python-maec/issue + From 096b03e49e5111240f704a6413d5ac211ddc1d98 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 13:21:16 -0400 Subject: [PATCH 066/297] Initial commit of API pages --- docs/api/__init__.rst | 17 +++++++++++++++++ docs/api/bundle/bundle.rst | 13 +++++++++++++ docs/api/index.rst | 30 ++++++++++++++++++++++++++++++ 3 files changed, 60 insertions(+) create mode 100644 docs/api/__init__.rst create mode 100644 docs/api/bundle/bundle.rst create mode 100644 docs/api/index.rst diff --git a/docs/api/__init__.rst b/docs/api/__init__.rst new file mode 100644 index 0000000..b240c97 --- /dev/null +++ b/docs/api/__init__.rst @@ -0,0 +1,17 @@ +.. include:: /_includes/wip_prolog.rst + +:mod:`maec` Module +================================== + +.. module:: maec + +Classes +------- + +.. autoclass:: Entity + :show-inheritance: + :members: + +.. autoclass:: EntityList + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/bundle/bundle.rst b/docs/api/bundle/bundle.rst new file mode 100644 index 0000000..f4d8af2 --- /dev/null +++ b/docs/api/bundle/bundle.rst @@ -0,0 +1,13 @@ +.. include:: /_includes/wip_prolog.rst + +:mod:`maec.bundle.bundle` Module +==================================== + +.. module:: maec.bundle.bundle + +Classes +------- + +.. autoclass:: Bundle + :show-inheritance: + :members: diff --git a/docs/api/index.rst b/docs/api/index.rst new file mode 100644 index 0000000..832953b --- /dev/null +++ b/docs/api/index.rst @@ -0,0 +1,30 @@ +.. include:: /_includes/wip_prolog.rst + +API Documentation +================= + +The *python-maec* APIs are the recommended tools for reading, writing, and manipulating STIX XML documents. + +.. note:: + + The python-maec APIs are currently under development. As such, API coverage of MAEC data constructs is incomplete; please bear with us as we work toward complete coverage. This documentation also serves to outline current API coverage. + +**STIX** -- Modules located in the base `maec`_ package + +.. _stix: https://github.com/MAECProject/python-maec/tree/master/maec + +.. toctree:: + :titlesonly: + + __init__ + +**MAEC Bundle** -- Modules located in the `maec.bundle`_ package + +.. _stix.campaign: https://github.com/STIXProject/python-maec/tree/master/stix/campaign + +.. toctree:: + :titlesonly: + :glob: + + bundle/* + \ No newline at end of file From eb8685d1f635457df66f20a98241f3eccdfadcb4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 13:49:19 -0400 Subject: [PATCH 067/297] Updated index --- docs/api/index.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/api/index.rst b/docs/api/index.rst index 832953b..cb5ef9f 100644 --- a/docs/api/index.rst +++ b/docs/api/index.rst @@ -3,7 +3,7 @@ API Documentation ================= -The *python-maec* APIs are the recommended tools for reading, writing, and manipulating STIX XML documents. +The *python-maec* APIs are the recommended tools for reading, writing, and manipulating MAEC XML documents. .. note:: @@ -11,7 +11,7 @@ The *python-maec* APIs are the recommended tools for reading, writing, and manip **STIX** -- Modules located in the base `maec`_ package -.. _stix: https://github.com/MAECProject/python-maec/tree/master/maec +.. _maec: https://github.com/MAECProject/python-maec/tree/master/maec .. toctree:: :titlesonly: @@ -20,7 +20,7 @@ The *python-maec* APIs are the recommended tools for reading, writing, and manip **MAEC Bundle** -- Modules located in the `maec.bundle`_ package -.. _stix.campaign: https://github.com/STIXProject/python-maec/tree/master/stix/campaign +.. _maec.bundle: https://github.com/MAECProject/python-maec/tree/master/bundle/bundle .. toctree:: :titlesonly: From 1837acd5b71b7672badb367e0d7d2038c320364d Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 13:51:30 -0400 Subject: [PATCH 068/297] Added API reference --- docs/index.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/index.rst b/docs/index.rst index 7ef8ccf..b310216 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -11,7 +11,13 @@ Contents: .. toctree:: :maxdepth: 2 +API Reference +============= +.. toctree:: + :maxdepth: 1 + + api/index Indices and tables ================== From caa52ce3dc94d055c697a7cd330655ddb80e7d04 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 16:07:21 -0400 Subject: [PATCH 069/297] Added proper docstrings for all methods --- maec/utils/deduplicator.py | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 72e5c5a..91b3e5e 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -9,6 +9,7 @@ class BundleDeduplicator(object): @classmethod def deduplicate(cls, bundle): + """Deduplicate the input Bundle.""" # Dictionary of all unique objects # Key = object type (xsi:type) # Value = dictionary of unique objects for that type @@ -32,10 +33,11 @@ def deduplicate(cls, bundle): # cases where you may have Objects pointing to each other cls.cleanup(bundle) - # Cleanup and remove and Objects that may be referencing the re-used Objects - # Otherwise, this can create Object->Object->Object etc. references which don't make sense + @classmethod def cleanup(cls, bundle): + """Cleanup and remove and Objects that may be referencing the re-used Objects. + Otherwise, this can create Object->Object->Object etc. references which don't make sense.""" # Cleanup the root-level Objects if bundle.objects: # List of Objects to remove @@ -56,10 +58,9 @@ def cleanup(cls, bundle): for obj in objs: collection.object_list.remove(obj) - # Replace all of the duplicate Objects with references to - # the unique object placed in the "Re-used Objects" Collection @classmethod def handle_duplicate_objects(cls, bundle, all_objects): + """Replace all of the duplicate Objects with references to the unique object placed in the "Re-used Objects" Collection.""" for duplicate_object_id, unique_object_id in cls.object_ids_mapping.items(): for object in all_objects: if object.id_ == duplicate_object_id or object.idref == duplicate_object_id: @@ -71,10 +72,10 @@ def handle_duplicate_objects(cls, bundle, all_objects): object.related_objects = None object.domain_specific_object_properties = None - # Add a new Object collection to the Bundle for storing the unique Objects - # Add the Objects to said collection @classmethod def handle_unique_objects(cls, bundle, all_objects): + """Add a new Object collection to the Bundle for storing the unique Objects. + Add the Objects to the collection. """ # First, find the ID of the last Object Collection (if applicable) counter = 1 if bundle.collections and bundle.collections.object_collections: @@ -89,9 +90,9 @@ def handle_unique_objects(cls, bundle, all_objects): # Add the unique Objects to the collection cls.add_unique_objects(bundle, all_objects) - # Add the unique Objects to the collection and perform the properties replacement @classmethod def add_unique_objects(cls, bundle, all_objects): + """Add the unique Objects to the collection and perform the properties replacement.""" added_ids = [] for unique_object_id in cls.object_ids_mapping.values(): if unique_object_id not in added_ids: @@ -114,18 +115,18 @@ def add_unique_objects(cls, bundle, all_objects): break added_ids.append(unique_object_id) - # Map the non-unique Objects to their unique (first observed) counterparts @classmethod def map_objects(cls, all_objects): + """Map the non-unique Objects to their unique (first observed) counterparts.""" # Do the object mapping for obj in all_objects: matching_object_id = cls.find_matching_object(obj) if matching_object_id: cls.object_ids_mapping[obj.id_] = matching_object_id - # Returns the value contained in a TypedField or its nested members, if applicable @classmethod def get_typedfield_values(cls, val, name, values, ignoreCase = False): + """Returns the value contained in a TypedField or its nested members, if applicable.""" # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): if ignoreCase: @@ -142,9 +143,9 @@ def get_typedfield_values(cls, val, name, values, ignoreCase = False): for item_property in val._get_vars(): cls.get_typedfield_values(getattr(val, str(item_property)), name + "/" + str(item_property), values, ignoreCase) - # Get the values specified for an object's properties as a set @classmethod def get_object_values(cls, obj, ignoreCase = False): + """Get the values specified for an Object's properties as a set.""" values = set() for typed_field in obj.properties._get_vars(): # Make sure the typed field is comparable @@ -154,9 +155,10 @@ def get_object_values(cls, obj, ignoreCase = False): cls.get_typedfield_values(val, str(typed_field), values, ignoreCase) return values - # Find a matching object, if it exists + @classmethod def find_matching_object(cls, obj): + """Find a matching object, if it exists.""" if obj and obj.properties: object_values = cls.get_object_values(obj) xsi_type = obj.properties._XSI_TYPE From 66edf033880c8b89da6df2582cd4b57ee1b7f7f4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 16:22:33 -0400 Subject: [PATCH 070/297] Fixed indentation issues with doc strings and added copyright notice --- maec/utils/deduplicator.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 91b3e5e..b84cb87 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -1,5 +1,8 @@ # MAEC Bundle Deduplicator Module -# Last updated: 12/3/2013 +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved + +# See LICENSE.txt for complete terms import collections import cybox import sets @@ -117,7 +120,7 @@ def add_unique_objects(cls, bundle, all_objects): @classmethod def map_objects(cls, all_objects): - """Map the non-unique Objects to their unique (first observed) counterparts.""" + """Map the non-unique Objects to their unique (first observed) counterparts.""" # Do the object mapping for obj in all_objects: matching_object_id = cls.find_matching_object(obj) @@ -126,7 +129,7 @@ def map_objects(cls, all_objects): @classmethod def get_typedfield_values(cls, val, name, values, ignoreCase = False): - """Returns the value contained in a TypedField or its nested members, if applicable.""" + """Returns the value contained in a TypedField or its nested members, if applicable.""" # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): if ignoreCase: @@ -145,7 +148,7 @@ def get_typedfield_values(cls, val, name, values, ignoreCase = False): @classmethod def get_object_values(cls, obj, ignoreCase = False): - """Get the values specified for an Object's properties as a set.""" + """Get the values specified for an Object's properties as a set.""" values = set() for typed_field in obj.properties._get_vars(): # Make sure the typed field is comparable @@ -158,7 +161,7 @@ def get_object_values(cls, obj, ignoreCase = False): @classmethod def find_matching_object(cls, obj): - """Find a matching object, if it exists.""" + """Find a matching object, if it exists.""" if obj and obj.properties: object_values = cls.get_object_values(obj) xsi_type = obj.properties._XSI_TYPE From b408e564606a205afe72a81825ef043c2d330b68 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 9 Sep 2014 16:31:11 -0400 Subject: [PATCH 071/297] Added lots of new pages --- docs/api/__init__.rst | 2 - docs/api/analytics/distance.rst | 19 ++++++ docs/api/bundle/action_reference_list.rst | 14 ++++ docs/api/bundle/av_classification.rst | 18 +++++ docs/api/bundle/behavior.rst | 50 ++++++++++++++ docs/api/bundle/behavior_reference.rst | 14 ++++ docs/api/bundle/bundle.rst | 58 +++++++++++++++- docs/api/bundle/bundle_reference.rst | 14 ++++ docs/api/bundle/candidate_indicator.rst | 26 +++++++ docs/api/bundle/capability.rst | 42 ++++++++++++ docs/api/bundle/malware_action.rst | 30 +++++++++ docs/api/bundle/object_history.rst | 17 +++++ docs/api/bundle/object_reference.rst | 17 +++++ docs/api/bundle/process_tree.rst | 17 +++++ docs/api/index.rst | 36 ++++++++-- docs/api/package/action_equivalence.rst | 15 +++++ docs/api/package/analysis.rst | 63 +++++++++++++++++ docs/api/package/grouping_relationship.rst | 31 +++++++++ docs/api/package/malware_subject.rst | 67 +++++++++++++++++++ .../api/package/malware_subject_reference.rst | 11 +++ docs/api/package/object_equivalence.rst | 15 +++++ docs/api/package/package.rst | 11 +++ docs/api/utils/comparator.rst | 23 +++++++ docs/api/utils/deduplicator.rst | 11 +++ docs/api/utils/idgen.rst | 11 +++ docs/api/utils/merge.rst | 30 +++++++++ docs/api/utils/nsparser.rst | 11 +++ docs/api/utils/parser.rst | 11 +++ docs/index.rst | 5 -- 29 files changed, 676 insertions(+), 13 deletions(-) create mode 100644 docs/api/analytics/distance.rst create mode 100644 docs/api/bundle/action_reference_list.rst create mode 100644 docs/api/bundle/av_classification.rst create mode 100644 docs/api/bundle/behavior.rst create mode 100644 docs/api/bundle/behavior_reference.rst create mode 100644 docs/api/bundle/bundle_reference.rst create mode 100644 docs/api/bundle/candidate_indicator.rst create mode 100644 docs/api/bundle/capability.rst create mode 100644 docs/api/bundle/malware_action.rst create mode 100644 docs/api/bundle/object_history.rst create mode 100644 docs/api/bundle/object_reference.rst create mode 100644 docs/api/bundle/process_tree.rst create mode 100644 docs/api/package/action_equivalence.rst create mode 100644 docs/api/package/analysis.rst create mode 100644 docs/api/package/grouping_relationship.rst create mode 100644 docs/api/package/malware_subject.rst create mode 100644 docs/api/package/malware_subject_reference.rst create mode 100644 docs/api/package/object_equivalence.rst create mode 100644 docs/api/package/package.rst create mode 100644 docs/api/utils/comparator.rst create mode 100644 docs/api/utils/deduplicator.rst create mode 100644 docs/api/utils/idgen.rst create mode 100644 docs/api/utils/merge.rst create mode 100644 docs/api/utils/nsparser.rst create mode 100644 docs/api/utils/parser.rst diff --git a/docs/api/__init__.rst b/docs/api/__init__.rst index b240c97..41406cf 100644 --- a/docs/api/__init__.rst +++ b/docs/api/__init__.rst @@ -1,5 +1,3 @@ -.. include:: /_includes/wip_prolog.rst - :mod:`maec` Module ================================== diff --git a/docs/api/analytics/distance.rst b/docs/api/analytics/distance.rst new file mode 100644 index 0000000..0c06394 --- /dev/null +++ b/docs/api/analytics/distance.rst @@ -0,0 +1,19 @@ +:mod:`maec.analytics.distance` Module +==================================== + +.. module:: maec.analytics.distance + +Classes +------- + +.. autoclass:: Distance + :show-inheritance: + :members: + +.. autoclass:: StaticFeatureVector + :show-inheritance: + :members: + +.. autoclass:: DynamicFeatureVector + :show-inheritance: + :members: diff --git a/docs/api/bundle/action_reference_list.rst b/docs/api/bundle/action_reference_list.rst new file mode 100644 index 0000000..772dde2 --- /dev/null +++ b/docs/api/bundle/action_reference_list.rst @@ -0,0 +1,14 @@ +:mod:`maec.bundle.action_reference_list` Module +==================================== + +.. module:: maec.bundle.action_reference_list + +Classes +------- + +.. autoclass:: ActionReferenceList + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/av_classification.rst b/docs/api/bundle/av_classification.rst new file mode 100644 index 0000000..0bfac97 --- /dev/null +++ b/docs/api/bundle/av_classification.rst @@ -0,0 +1,18 @@ +:mod:`maec.bundle.av_classification` Module +==================================== + +.. module:: maec.bundle.av_classification + +Classes +------- + +.. autoclass:: AVClassification + :show-inheritance: + :members: + +.. autoclass:: AVClassifications + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/behavior.rst b/docs/api/bundle/behavior.rst new file mode 100644 index 0000000..cbd88f7 --- /dev/null +++ b/docs/api/bundle/behavior.rst @@ -0,0 +1,50 @@ +:mod:`maec.bundle.behavior` Module +==================================== + +.. module:: maec.bundle.behavior + +Classes +------- + +.. autoclass:: Behavior + :show-inheritance: + :members: + +.. autoclass:: BehavioralActionEquivalenceReference + :show-inheritance: + :members: + +.. autoclass:: BehavioralActionReference + :show-inheritance: + :members: + +.. autoclass:: BehavioralAction + :show-inheritance: + :members: + +.. autoclass:: BehavioralActions + :show-inheritance: + :members: + +.. autoclass:: PlatformList + :show-inheritance: + :members: + +.. autoclass:: CVEVulnerability + :show-inheritance: + :members: + +.. autoclass:: Exploit + :show-inheritance: + :members: + +.. autoclass:: BehaviorPurpose + :show-inheritance: + :members: + +.. autoclass:: AssociatedCode + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/behavior_reference.rst b/docs/api/bundle/behavior_reference.rst new file mode 100644 index 0000000..276f349 --- /dev/null +++ b/docs/api/bundle/behavior_reference.rst @@ -0,0 +1,14 @@ +:mod:`maec.bundle.behavior_reference` Module +==================================== + +.. module:: maec.bundle.behavior_reference + +Classes +------- + +.. autoclass:: BehaviorReference + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/bundle.rst b/docs/api/bundle/bundle.rst index f4d8af2..76496ba 100644 --- a/docs/api/bundle/bundle.rst +++ b/docs/api/bundle/bundle.rst @@ -1,5 +1,3 @@ -.. include:: /_includes/wip_prolog.rst - :mod:`maec.bundle.bundle` Module ==================================== @@ -11,3 +9,59 @@ Classes .. autoclass:: Bundle :show-inheritance: :members: + +.. autoclass:: BundleList + :show-inheritance: + :members: + +.. autoclass:: ActionList + :show-inheritance: + :members: + +.. autoclass:: ObjectList + :show-inheritance: + :members: + +.. autoclass:: BaseCollection + :show-inheritance: + :members: + +.. autoclass:: ActionCollection + :show-inheritance: + :members: + +.. autoclass:: BehaviorCollection + :show-inheritance: + :members: + +.. autoclass:: ObjectCollection + :show-inheritance: + :members: + +.. autoclass:: CandidateIndicatorCollection + :show-inheritance: + :members: + +.. autoclass:: BehaviorCollectionList + :show-inheritance: + :members: + +.. autoclass:: ActionCollectionList + :show-inheritance: + :members: + +.. autoclass:: ObjectCollectionList + :show-inheritance: + :members: + +.. autoclass:: CandidateIndicatorCollectionList + :show-inheritance: + :members: + +.. autoclass:: Collections + :show-inheritance: + :members: + +.. autoclass:: BehaviorReference + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/bundle/bundle_reference.rst b/docs/api/bundle/bundle_reference.rst new file mode 100644 index 0000000..ce637a5 --- /dev/null +++ b/docs/api/bundle/bundle_reference.rst @@ -0,0 +1,14 @@ +:mod:`maec.bundle.bundle_reference` Module +==================================== + +.. module:: maec.bundle.bundle_reference + +Classes +------- + +.. autoclass:: BundleReference + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/candidate_indicator.rst b/docs/api/bundle/candidate_indicator.rst new file mode 100644 index 0000000..9ce2ba8 --- /dev/null +++ b/docs/api/bundle/candidate_indicator.rst @@ -0,0 +1,26 @@ +:mod:`maec.bundle.candidate_indicator` Module +==================================== + +.. module:: maec.bundle.candidate_indicator + +Classes +------- + +.. autoclass:: CandidateIndicator + :show-inheritance: + :members: + +.. autoclass:: CandidateIndicatorList + :show-inheritance: + :members: + +.. autoclass:: CandidateIndicatorComposition + :show-inheritance: + :members: + +.. autoclass:: MalwareEntity + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/capability.rst b/docs/api/bundle/capability.rst new file mode 100644 index 0000000..cf98118 --- /dev/null +++ b/docs/api/bundle/capability.rst @@ -0,0 +1,42 @@ +:mod:`maec.bundle.capability` Module +==================================== + +.. module:: maec.bundle.capability + +Classes +------- + +.. autoclass:: Capability + :show-inheritance: + :members: + +.. autoclass:: CapabilityObjective + :show-inheritance: + :members: + +.. autoclass:: CapabilityProperty + :show-inheritance: + :members: + +.. autoclass:: CapabilityRelationship + :show-inheritance: + :members: + +.. autoclass:: CapabilityObjectiveRelationship + :show-inheritance: + :members: + +.. autoclass:: CapabilityReference + :show-inheritance: + :members: + +.. autoclass:: CapabilityObjectiveReference + :show-inheritance: + :members: + +.. autoclass:: CapabilityList + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/malware_action.rst b/docs/api/bundle/malware_action.rst new file mode 100644 index 0000000..e064516 --- /dev/null +++ b/docs/api/bundle/malware_action.rst @@ -0,0 +1,30 @@ +:mod:`maec.bundle.malware_action` Module +==================================== + +.. module:: maec.bundle.malware_action + +Classes +------- + +.. autoclass:: MalwareAction + :show-inheritance: + :members: + +.. autoclass:: ActionImplementation + :show-inheritance: + :members: + +.. autoclass:: APICall + :show-inheritance: + :members: + +.. autoclass:: ParameterList + :show-inheritance: + :members: + +.. autoclass:: Parameter + :show-inheritance: + :members: + + + diff --git a/docs/api/bundle/object_history.rst b/docs/api/bundle/object_history.rst new file mode 100644 index 0000000..746eb56 --- /dev/null +++ b/docs/api/bundle/object_history.rst @@ -0,0 +1,17 @@ +:mod:`maec.bundle.object_history` Module +==================================== + +.. module:: maec.bundle.object_history + +Classes +------- + +.. autoclass:: ObjectHistory + :show-inheritance: + :members: + +.. autoclass:: ObjectHistoryEntry + :show-inheritance: + :members: + + diff --git a/docs/api/bundle/object_reference.rst b/docs/api/bundle/object_reference.rst new file mode 100644 index 0000000..2e4cf80 --- /dev/null +++ b/docs/api/bundle/object_reference.rst @@ -0,0 +1,17 @@ +:mod:`maec.bundle.object_reference` Module +==================================== + +.. module:: maec.bundle.object_reference + +Classes +------- + +.. autoclass:: ObjectReference + :show-inheritance: + :members: + +.. autoclass:: ObjectReferenceList + :show-inheritance: + :members: + + diff --git a/docs/api/bundle/process_tree.rst b/docs/api/bundle/process_tree.rst new file mode 100644 index 0000000..a67b78a --- /dev/null +++ b/docs/api/bundle/process_tree.rst @@ -0,0 +1,17 @@ +:mod:`maec.bundle.process_tree` Module +==================================== + +.. module:: maec.bundle.process_tree + +Classes +------- + +.. autoclass:: ProcessTree + :show-inheritance: + :members: + +.. autoclass:: ProcessTreeNode + :show-inheritance: + :members: + + diff --git a/docs/api/index.rst b/docs/api/index.rst index cb5ef9f..5f9b24c 100644 --- a/docs/api/index.rst +++ b/docs/api/index.rst @@ -1,5 +1,3 @@ -.. include:: /_includes/wip_prolog.rst - API Documentation ================= @@ -9,7 +7,7 @@ The *python-maec* APIs are the recommended tools for reading, writing, and manip The python-maec APIs are currently under development. As such, API coverage of MAEC data constructs is incomplete; please bear with us as we work toward complete coverage. This documentation also serves to outline current API coverage. -**STIX** -- Modules located in the base `maec`_ package +**MAEC** -- Modules located in the base `maec`_ package .. _maec: https://github.com/MAECProject/python-maec/tree/master/maec @@ -20,11 +18,41 @@ The *python-maec* APIs are the recommended tools for reading, writing, and manip **MAEC Bundle** -- Modules located in the `maec.bundle`_ package -.. _maec.bundle: https://github.com/MAECProject/python-maec/tree/master/bundle/bundle +.. _maec.bundle: https://github.com/MAECProject/python-maec/tree/master/maec/bundle .. toctree:: :titlesonly: :glob: bundle/* + +**MAEC Package** -- Modules located in the `maec.package`_ package + +.. _maec.package: https://github.com/MAECProject/python-maec/tree/master/maec/package + +.. toctree:: + :titlesonly: + :glob: + + package/* + +**MAEC Utils** -- Modules located in the `maec.utils`_ package + +.. _maec.utils: https://github.com/MAECProject/python-maec/tree/master/maec/utils + +.. toctree:: + :titlesonly: + :glob: + + utils/* + +**MAEC Analytics** -- Modules located in the `maec.analytics`_ package + +.. _maec.analytics: https://github.com/MAECProject/python-maec/tree/master/maec/analytics + +.. toctree:: + :titlesonly: + :glob: + + analytics/* \ No newline at end of file diff --git a/docs/api/package/action_equivalence.rst b/docs/api/package/action_equivalence.rst new file mode 100644 index 0000000..987e7dd --- /dev/null +++ b/docs/api/package/action_equivalence.rst @@ -0,0 +1,15 @@ +:mod:`maec.package.action_equivalence` Module +==================================== + +.. module:: maec.package.action_equivalence + +Classes +------- + +.. autoclass:: ActionEquivalence + :show-inheritance: + :members: + +.. autoclass:: ActionEquivalenceList + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/analysis.rst b/docs/api/package/analysis.rst new file mode 100644 index 0000000..d1fdd0d --- /dev/null +++ b/docs/api/package/analysis.rst @@ -0,0 +1,63 @@ +:mod:`maec.package.analysis` Module +==================================== + +.. module:: maec.package.analysis + +Classes +------- + +.. autoclass:: Analysis + :show-inheritance: + :members: + +.. autoclass:: AnalysisEnvironment + :show-inheritance: + :members: + +.. autoclass:: NetworkInfrastructure + :show-inheritance: + :members: + +.. autoclass:: CapturedProtocolList + :show-inheritance: + :members: + +.. autoclass:: CapturedProtocol + :show-inheritance: + :members: + +.. autoclass:: AnalysisSystemList + :show-inheritance: + :members: + +.. autoclass:: AnalysisSystem + :show-inheritance: + :members: + +.. autoclass:: InstalledPrograms + :show-inheritance: + :members: + +.. autoclass:: HypervisorHostSystem + :show-inheritance: + :members: + +.. autoclass:: DynamicAnalysisMetadata + :show-inheritance: + :members: + +.. autoclass:: ToolList + :show-inheritance: + :members: + +.. autoclass:: CommentList + :show-inheritance: + :members: + +.. autoclass:: Comment + :show-inheritance: + :members: + +.. autoclass:: Source + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/grouping_relationship.rst b/docs/api/package/grouping_relationship.rst new file mode 100644 index 0000000..bedfb19 --- /dev/null +++ b/docs/api/package/grouping_relationship.rst @@ -0,0 +1,31 @@ +:mod:`maec.package.grouping_relationship` Module +==================================== + +.. module:: maec.package.grouping_relationship + +Classes +------- + +.. autoclass:: GroupingRelationship + :show-inheritance: + :members: + +.. autoclass:: GroupingRelationshipList + :show-inheritance: + :members: + +.. autoclass:: ClusteringMetadata + :show-inheritance: + :members: + +.. autoclass:: ClusteringAlgorithmParameters + :show-inheritance: + :members: + +.. autoclass:: ClusterComposition + :show-inheritance: + :members: + +.. autoclass:: ClusterEdgeNodePair + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/malware_subject.rst b/docs/api/package/malware_subject.rst new file mode 100644 index 0000000..1f15ebf --- /dev/null +++ b/docs/api/package/malware_subject.rst @@ -0,0 +1,67 @@ +:mod:`maec.package.malware_subject` Module +==================================== + +.. module:: maec.package.malware_subject + +Classes +------- + +.. autoclass:: MalwareSubject + :show-inheritance: + :members: + +.. autoclass:: MalwareSubjectList + :show-inheritance: + :members: + +.. autoclass:: MalwareConfigurationDetails + :show-inheritance: + :members: + +.. autoclass:: MalwareConfigurationObfuscationDetails + :show-inheritance: + :members: + +.. autoclass:: MalwareConfigurationObfuscationAlgorithm + :show-inheritance: + :members: + +.. autoclass:: MalwareConfigurationStorageDetails + :show-inheritance: + :members: + +.. autoclass:: MalwareBinaryConfigurationStorageDetails + :show-inheritance: + :members: + +.. autoclass:: MalwareConfigurationParameter + :show-inheritance: + :members: + +.. autoclass:: MalwareDevelopmentEnvironment + :show-inheritance: + :members: + +.. autoclass:: FindingsBundleList + :show-inheritance: + :members: + +.. autoclass:: MetaAnalysis + :show-inheritance: + :members: + +.. autoclass:: MalwareSubjectRelationshipList + :show-inheritance: + :members: + +.. autoclass:: MalwareSubjectRelationship + :show-inheritance: + :members: + +.. autoclass:: Analyses + :show-inheritance: + :members: + +.. autoclass:: MinorVariants + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/malware_subject_reference.rst b/docs/api/package/malware_subject_reference.rst new file mode 100644 index 0000000..a2d3693 --- /dev/null +++ b/docs/api/package/malware_subject_reference.rst @@ -0,0 +1,11 @@ +:mod:`maec.package.malware_subject_reference` Module +==================================== + +.. module:: maec.package.malware_subject_reference + +Classes +------- + +.. autoclass:: MalwareSubjectReference + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/object_equivalence.rst b/docs/api/package/object_equivalence.rst new file mode 100644 index 0000000..91c776d --- /dev/null +++ b/docs/api/package/object_equivalence.rst @@ -0,0 +1,15 @@ +:mod:`maec.package.object_equivalence` Module +==================================== + +.. module:: maec.package.object_equivalence + +Classes +------- + +.. autoclass:: ObjectEquivalence + :show-inheritance: + :members: + +.. autoclass:: ObjectEquivalenceList + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/package/package.rst b/docs/api/package/package.rst new file mode 100644 index 0000000..0938196 --- /dev/null +++ b/docs/api/package/package.rst @@ -0,0 +1,11 @@ +:mod:`maec.package.package` Module +==================================== + +.. module:: maec.package.package + +Classes +------- + +.. autoclass:: Package + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/utils/comparator.rst b/docs/api/utils/comparator.rst new file mode 100644 index 0000000..82279aa --- /dev/null +++ b/docs/api/utils/comparator.rst @@ -0,0 +1,23 @@ +:mod:`maec.utils.comparator` Module +==================================== + +.. module:: maec.utils.comparator + +Classes +------- + +.. autoclass:: BundleComparator + :show-inheritance: + :members: + +.. autoclass:: SimilarObjectCluster + :show-inheritance: + :members: + +.. autoclass:: ObjectHash + :show-inheritance: + :members: + +.. autoclass:: ComparisonResult + :show-inheritance: + :members: \ No newline at end of file diff --git a/docs/api/utils/deduplicator.rst b/docs/api/utils/deduplicator.rst new file mode 100644 index 0000000..5aa657c --- /dev/null +++ b/docs/api/utils/deduplicator.rst @@ -0,0 +1,11 @@ +:mod:`maec.utils.deduplicator` Module +==================================== + +.. module:: maec.utils.deduplicator + +Classes +------- + +.. autoclass:: BundleDeduplicator + :show-inheritance: + :members: diff --git a/docs/api/utils/idgen.rst b/docs/api/utils/idgen.rst new file mode 100644 index 0000000..7aa07b0 --- /dev/null +++ b/docs/api/utils/idgen.rst @@ -0,0 +1,11 @@ +:mod:`maec.utils.idgen` Module +==================================== + +.. module:: maec.utils.idgen + +Classes +------- + +.. autoclass:: IDGenerator + :show-inheritance: + :members: diff --git a/docs/api/utils/merge.rst b/docs/api/utils/merge.rst new file mode 100644 index 0000000..4de3e35 --- /dev/null +++ b/docs/api/utils/merge.rst @@ -0,0 +1,30 @@ +:mod:`maec.utils.merge` Module +==================================== + +.. module:: maec.utils.merge + +Functions +--------- + +.. autofunction:: merge_documents + +.. autofunction:: merge_malware_subjects + +.. autofunction:: merge_packages + +.. autofunction:: update_relationships + +.. autofunction:: merge_binned_malware_subjects + +.. autofunction:: create_mappings + +.. autofunction:: merge_findings_bundles + +.. autofunction:: deduplicate_vocabulary_list + +.. autofunction:: merge_entities + +.. autofunction:: bin_malware_subjects + +.. autofunction:: dict_merge + diff --git a/docs/api/utils/nsparser.rst b/docs/api/utils/nsparser.rst new file mode 100644 index 0000000..e51e265 --- /dev/null +++ b/docs/api/utils/nsparser.rst @@ -0,0 +1,11 @@ +:mod:`maec.utils.nsparser` Module +==================================== + +.. module:: maec.utils.nsparser + +Classes +------- + +.. autoclass:: Metadata + :show-inheritance: + :members: diff --git a/docs/api/utils/parser.rst b/docs/api/utils/parser.rst new file mode 100644 index 0000000..dc750da --- /dev/null +++ b/docs/api/utils/parser.rst @@ -0,0 +1,11 @@ +:mod:`maec.utils.parser` Module +==================================== + +.. module:: maec.utils.parser + +Classes +------- + +.. autoclass:: EntityParser + :show-inheritance: + :members: diff --git a/docs/index.rst b/docs/index.rst index b310216..95e11e3 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -6,11 +6,6 @@ Welcome to python-maec's documentation! ======================================= -Contents: - -.. toctree:: - :maxdepth: 2 - API Reference ============= From 5ad95fd228e0bb4bd386672a378bacdc5bd6308c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 10 Sep 2014 10:09:43 -0400 Subject: [PATCH 072/297] Updated set_id_namespace and set_id_method to set equivalent python-cybox methods by default --- maec/utils/idgen.py | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/maec/utils/idgen.py b/maec/utils/idgen.py index 22a29a2..33566b4 100644 --- a/maec/utils/idgen.py +++ b/maec/utils/idgen.py @@ -2,9 +2,9 @@ # See LICENSE.txt for complete terms. import uuid -from cybox.utils import Namespace +import cybox.utils -EXAMPLE_NAMESPACE = Namespace("http://example.com", "example") +EXAMPLE_NAMESPACE = cybox.utils.Namespace("http://example.com", "example") class InvalidMethodError(ValueError): def __init__(self, method): @@ -31,7 +31,7 @@ def namespace(self): @namespace.setter def namespace(self, value): - if not isinstance(value, Namespace): + if not isinstance(value, cybox.utils.Namespace): raise ValueError("Must be a Namespace object") self._namespace = value self.reset() @@ -81,13 +81,26 @@ def _get_generator(): return __generator -def set_id_namespace(namespace): - """ Set the namespace for the module-level ID Generator""" +def set_id_namespace(namespace, set_cybox = True): + """ Set the namespace for the module-level ID Generator. + The second parameter defines whether or not to set the + namespace in python-cybox, with a default value of True.""" _get_generator().namespace = namespace - -def set_id_method(method): - """ Set the method for the module-level ID Generator""" + + # Set the corresponding CybOX method + if set_cybox: + cybox.utils.set_id_namespace(namespace) + +def set_id_method(method, set_cybox = True): + """ Set the method for the module-level ID Generator. + The second parameter defines whether or not to set the + id method in python-cybox, with a default value of True.""" _get_generator().method = method + + # Set the corresponding CybOX method + if set_cybox: + cybox.utils.set_id_method(method) + def get_id_namespace(): """Return the namespace associated with generated ids""" From 0b746f51f83d28281779b31aaea186d2d2bd08d3 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 10 Sep 2014 14:40:03 -0400 Subject: [PATCH 073/297] Many additions and changes --- docs/api/bundle/bundle.rst | 4 - docs/contributing.rst | 15 +++ docs/examples.rst | 235 +++++++++++++++++++++++++++++++++++++ docs/getting_started.rst | 72 ++++++++++++ docs/index.rst | 43 ++++++- docs/installation.rst | 124 +++++++++++++++++++ docs/overview.rst | 19 +++ 7 files changed, 506 insertions(+), 6 deletions(-) create mode 100644 docs/contributing.rst create mode 100644 docs/examples.rst create mode 100644 docs/getting_started.rst create mode 100644 docs/installation.rst create mode 100644 docs/overview.rst diff --git a/docs/api/bundle/bundle.rst b/docs/api/bundle/bundle.rst index 76496ba..9b889a6 100644 --- a/docs/api/bundle/bundle.rst +++ b/docs/api/bundle/bundle.rst @@ -9,10 +9,6 @@ Classes .. autoclass:: Bundle :show-inheritance: :members: - -.. autoclass:: BundleList - :show-inheritance: - :members: .. autoclass:: ActionList :show-inheritance: diff --git a/docs/contributing.rst b/docs/contributing.rst new file mode 100644 index 0000000..4c6da98 --- /dev/null +++ b/docs/contributing.rst @@ -0,0 +1,15 @@ +Contributing +============ + +If you notice a bug, have a suggestion for a new feature, or find that that +something just isn't behaving the way you'd expect it to, please submit an +issue to our `issue tracker`_. + +If you'd like to contribute code to our repository, you can do so by issuing a +pull request and we will work with you to try and integrate that code into our +repository. Users who want to contribute code to the python-maec repository +should be familiar with git_ and the `GitHub pull request process`_. + +.. _issue tracker: https://github.com/MAECProject/python-maec/issues +.. _git: http://git-scm.com/documentation +.. _GitHub pull request process: https://help.github.com/articles/using-pull-requests diff --git a/docs/examples.rst b/docs/examples.rst new file mode 100644 index 0000000..6248114 --- /dev/null +++ b/docs/examples.rst @@ -0,0 +1,235 @@ +.. _examples: + +Examples +======================== + +This page includes some basic examples of creating and parsing MAEC content. + +There are a couple things we do in these examples for purposes of demonstration +that shouldn't be done in production code: + +* When calling ``to_xml()``, we use ``include_namespaces=False``. This is to + make the example output easier to read, but means the resulting output + cannot be successfully parsed. The XML parser doesn't know what namespaces + to use if they aren't included. In production code, you should explicitly + set ``include_namespaces`` to ``True`` or omit it entirely (``True`` is the + default). + +* We use ``set_id_method(IDGenerator.METHOD_INT)`` to make IDs for Malware + Subjects and Actions easier to read and cross-reference within the XML + document. In production code, you should omit this statement, which causes + random UUIDs to be created instead, or create explicit IDs yourself for + Malware Subjects and Actions. + +Creating Packages +------------------- + +The most commonly used MAEC output format is the MAEC Package, which can contain +one or more Malware Subjects. Malware Subjects (discussed in more detail below) +encompass all of the data for a single malware instance, including that from +different types of analysis. + + +.. testcode:: + + from maec.package.package import Package + from maec.package.malware_subject import MalwareSubject + from maec.utils import IDGenerator, set_id_method + + set_id_method(IDGenerator.METHOD_INT) + p = Package() + ms = MalwareSubject() + p.add_malware_subject(ms) + + print p.to_xml(include_namespaces=False) + +Which outputs: + +.. testoutput:: + + + + + + + + +Creating Malware Subjects +------------------- + +The easiest way to create a Malware Subject is to construct one and then set +various properties on it. The Malware_Instance_Object_Attributes field on a +Malware Subject MUST be set in order to identify the particular malware instance +that it is characterizing. + + +.. testcode:: + + from maec.package.malware_subject import MalwareSubject + from maec.utils import IDGenerator, set_id_method + from cybox.core import Object + from cybox.objects.file_object import File + + set_id_method(IDGenerator.METHOD_INT) + ms = MalwareSubject() + ms.malware_instance_object_attributes = Object() + ms.malware_instance_object_attributes.properties = File() + ms.malware_instance_object_attributes.properties.file_name = "malware.exe" + ms.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" + print ms.to_xml(include_namespaces=False) + +Which outputs: + +.. testoutput:: + + + + + malware.exe + C:\Windows\Temp\malware.exe + + + + +Creating Bundles +-------------------- +In MAEC, the ``Bundle`` represents a container for capturing the results from a +particular malware analysis that was performed on a malware instance. While a +``Bundle`` is most commonly included as part of a Malware Subject, it can also +be used a standalone output format when only malware analysis results for a +malware instance wish to be shared. We'll cover both cases here. + +Creating Standalone Bundles +-------------------- +Standalone Bundles function very similarly to Malware Subjects. Therefore, the +easiest way to create a standalone Bundle is to construct one and then set +various properties on it. The Malware_Instance_Object_Attributes field on a +standalone Bundle MUST be set in order to identify the particular malware +instance that it is characterizing. + +.. testcode:: + + from maec.bundle.bundle import Bundle + from maec.utils import IDGenerator, set_id_method + from cybox.core import Object + from cybox.objects.file_object import File + + set_id_method(IDGenerator.METHOD_INT) + b = Bundle() + b.malware_instance_object_attributes = Object() + b.malware_instance_object_attributes.properties = File() + b.malware_instance_object_attributes.properties.file_name = "malware.exe" + b.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" + + print b.to_xml(include_namespaces=False) + +Which outputs: + +.. testoutput:: + + + + + malware.exe + C:\Windows\Temp\malware.exe + + + + +Creating and adding Bundles to a Malware Subject +-------------------- +Bundles in a Malware Subject are defined nearly identically to those of the +standalone variety, with the sole exception that they do not require their +Malware_Instance_Object_Attributes field to be set, since this would already +be defined in their parent Malware Subject. + +.. testcode:: + from maec.package.malware_subject import MalwareSubject + from maec.bundle.bundle import Bundle + from maec.utils import IDGenerator, set_id_method + from cybox.core import Object + from cybox.objects.file_object import File + + set_id_method(IDGenerator.METHOD_INT) + ms = MalwareSubject() + ms.malware_instance_object_attributes = Object() + ms.malware_instance_object_attributes.properties = File() + ms.malware_instance_object_attributes.properties.file_name = "malware.exe" + ms.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" + + b = Bundle() + ms.add_findings_bundle(b) + + print ms.to_xml(include_namespaces=False) + +Which outputs: + +.. testoutput:: + + + + + malware.exe + C:\Windows\Temp\malware.exe + + + + + +Creating and adding Actions to a Bundle +-------------------- + +MAEC uses its ``MalwareAction`` to capture the low-level dynamic entities, such +as API calls or their abstractions, performed by malware. A ``MalwareAction`` is +stored in a Bundle (either standalone or embedded in a Malware Subject, as +discussed above). As with the other MAEC entities, the easiest way to use the +``MalwareAction`` is to instantiate it and then set various properties on it as +needed. + +.. testcode:: + from maec.bundle.bundle import Bundle + from maec.bundle.malware_action import MalwareAction + from maec.utils import IDGenerator, set_id_method + from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType + from cybox.objects.file_object import File + + set_id_method(IDGenerator.METHOD_INT) + b = Bundle() + a = MalwareAction() + ao = AssociatedObject() + + ao.properties = File() + ao.properties.file_name = "badware.exe" + ao.properties.size_in_bytes = "123456" + ao.association_type = AssociationType() + ao.association_type.value = 'output' + ao.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + + a.name = 'create file' + a.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' + a.associated_objects = AssociatedObjects() + a.associated_objects.append(ao) + + b.add_action(a) + + print b.to_xml(include_namespaces = False) + +.. testoutput:: + + + + + create file + + + + badware.exe + 123456 + + output + + + + + + diff --git a/docs/getting_started.rst b/docs/getting_started.rst new file mode 100644 index 0000000..effa514 --- /dev/null +++ b/docs/getting_started.rst @@ -0,0 +1,72 @@ +Getting Started with python-maec +================================= + +.. note:: + + The python-maec library is intended for developers who want to add MAEC + support to existing programs or create new programs that handle MAEC + content. Experience with Python development is assumed. + + Other users should look at existing tools_ that support MAEC. + + Understanding XML, XML Schema, and the MAEC language is also + incredibly helpful when using python-maec in an application. + +.. _tools: https://cyboxproject.github.io/#convert + +First, you should follow the :ref:`installation` procedures. + +Your First MAEC Application +--------------------------- + +Once you have installed python-maec, you can begin writing Python applications that consume or create STIX content! + +.. note:: + + The *python-maec* library provides **bindings** and **APIs**, both of which can be used to parse and write MAEC XML files. For in-depth description of the *APIs, bindings, and the differences between the two*, please refer to :doc:`api_vs_bindings/index` + +Creating a MAEC Package +*********************** + +.. code-block:: python + + from maec.package.package import Package # Import the MAEC Package API + from maec.package.malware_subject import MalwareSubject # Import the MAEC Malware Subject API + + package = STIXPackage() # Create an instance of Package + malware_subject = MalwareSubject() # Create an instance of MalwareSubject + package.add_malware_subject(malware_subject) # Add the Malware Subject to the Package + + print(stix_package.to_xml()) # Print the XML for this MAEC Package + +Parsing MAEC XML +**************** + +.. code-block:: python + + import maec # Import the python-maec API + + fn = 'stix_content.xml' # The MAEC content filename + maec_objects = maec.parse_xml_instance(fn) # Parse using the from_xml() method + api_object = maec_objects['api'] # Get the API object from the parsed objects + +Example Scripts +--------------- + +The python-maec repository contains several `example scripts`_ that help +illustrate the capabilities of the APIs. These scripts are simple command line +utilities that can be executed by passing the name of the script to a Python +interpreter. + +.. code-block:: bash + + $ python package_generation_example.py + +.. _example scripts: https://github.com/MAECProject/python-maec/tree/master/examples + + +Writing Your Own Application +---------------------------- + +See the :ref:`examples` page for more examples of using python-maec in your +own application. diff --git a/docs/index.rst b/docs/index.rst index 95e11e3..154abcb 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -3,9 +3,48 @@ You can adapt this file completely to your liking, but it should at least contain the root `toctree` directive. -Welcome to python-maec's documentation! -======================================= +python-maec |release| Documentation +==================================== +The python-maec library provides an API for developing and consuming Malware +Attribute Enumeration and Characterizaiton (MAEC) content. Developers can +leverage the API to create applications that create, consume, translate, or +otherwise work with MAEC content. + +Versions +-------- +Each version of python-maec is designed to work with a single version of the +MAEC Language. The table below shows the latest version the library for each +version of MAEC. + +============ =================== +MAEC Version python-maec Version +============ =================== +4.1 4.1.0.7 (`PyPI`__) (`GitHub`__) +4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) +3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) +============ =================== + +__ https://pypi.python.org/pypi/maec/4.1.0.7 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.7 +__ https://pypi.python.org/pypi/maec/4.0.1.0 +__ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 +__ https://pypi.python.org/pypi/maec/3.0.0b1 +__ https://github.com/MAECProject/python-maec/tree/v3.0.0b1 + + +Contents +-------- + +.. toctree:: + :maxdepth: 2 + + getting_started + installation + overview + examples + contributing + API Reference ============= diff --git a/docs/installation.rst b/docs/installation.rst new file mode 100644 index 0000000..daf9d02 --- /dev/null +++ b/docs/installation.rst @@ -0,0 +1,124 @@ +.. _installation: + +Installation +============ + +The installation of python-maec can be accomplished through a few different workflows. + +Recommended Installation +------------------------ + +Use pypi_ and pip_: + +.. code-block:: bash + + $ pip install maec + +You might also want to consider using a virtualenv_. +Please refer to the `pip installation instructions`_ for details regarding the installation of pip. + +.. _pypi: https://pypi.python.org/pypi/MAEC/ +.. _pip: http://pip.readthedocs.org/ +.. _pip installation instructions: http://www.pip-installer.org/en/latest/installing.html +.. _virtualenv: http://virtualenv.readthedocs.org/ + + +Dependencies +------------ + +The python-maec library relies on some non-standard Python libraries for the processing of MAEC content. Revisions of python-maec may depend on particular versions of dependencies to function correctly. These versions are detailed within the distutils setup.py installation script. + +The following libraries are required to use python-maec: + +* lxml_ - A Pythonic binding for the C libraries **libxml2** and + **libxslt**. +* python-cybox_ - A library for consuming and producing CybOX content. +* python-dateutil_ - A library for parsing datetime information. + +Each of these can be installed with ``pip`` or by manually downloading packages +from PyPI. On Windows, you will probably have the most luck using `pre-compiled +binaries`_ for ``lxml``. On Ubuntu (12.04 or 14.04), you should make sure the +following packages are installed before attempting to compile ``lxml`` from +source: + +* libxml2-dev +* libxslt1-dev +* zlib1g-dev + +.. warning:: + + Users have encountered errors with versions of libxml2 (a dependency of + lxml) prior to version 2.9.1. The default version of libxml2 provided on + Ubuntu 12.04 is currently 2.7.8. Users are encouraged to upgrade libxml2 + manually if they have any issues. Ubuntu 14.04 provides libxml2 version + 2.9.1. + +.. _lxml: http://lxml.de/ +.. _python-dateutil: http://labix.org/python-dateutil +.. _python-cybox: https://github.com/CybOXProject/python-cybox +.. _pre-compiled binaries: http://www.lfd.uci.edu/~gohlke/pythonlibs/#lxml + + +Manual Installation +------------------- + +If you are unable to use pip, you can also install python-maec with setuptools_. +If you don't already have setuptools installed, please install it before +continuing. + +1. Download and install the dependencies_ above. Although setuptools will + generally install dependencies automatically, installing the dependencies + manually beforehand helps distinguish errors in dependency installation from + errors in MAEC installation. Make sure you check to ensure the + versions you install are compatible with the version of MAEC you plan + to install. + +2. Download the desired version of MAEC from PyPI_ or the GitHub releases_ + page. The steps below assume you are using the |release| release. + +3. Extract the downloaded file. This will leave you with a directory named + MAEC-|release|. + +.. parsed-literal:: + $ tar -zxf MAEC-|release|.tar.gz + $ ls + MAEC-|release| MAEC-|release|.tar.gz + +OR + +.. parsed-literal:: + $ unzip MAEC-|release|.zip + $ ls + MAEC-|release| MAEC-|release|.zip + +4. Run the installation script. + +.. parsed-literal:: + $ cd MAEC-|release| + $ python setup.py install + +5. Test the installation. + +.. parsed-literal:: + $ python + Python 2.7.6 (default, Mar 22 2014, 22:59:56) + [GCC 4.8.2] on linux2 + Type "help", "copyright", "credits" or "license" for more information. + >>> import MAEC + >>> + +If you don't see an ``ImportError``, the installation was successful. + +.. _setuptools: https://pypi.python.org/pypi/setuptools/ +.. _PyPI: https://pypi.python.org/pypi/MAEC/ +.. _releases: https://github.com/MAECProject/python-maec/releases + + +Further Information +------------------- + +If you're new to installing Python packages, you can learn more at the `Python +Packaging User Guide`_, specifically the `Installing Python Packages`_ section. + +.. _Python Packaging User Guide: http://python-packaging-user-guide.readthedocs.org/ +.. _Installing Python Packages: http://python-packaging-user-guide.readthedocs.org/en/latest/tutorial.html#installing-python-packages diff --git a/docs/overview.rst b/docs/overview.rst new file mode 100644 index 0000000..cc7d401 --- /dev/null +++ b/docs/overview.rst @@ -0,0 +1,19 @@ +Overview +======== + +This page provides a quick overview needed to understand the inner workings +of the python-maec library. If you prefer a more hands-on approach, browse the +:doc:`examples`. + +MAEC Entities +-------------- + +Each type within MAEC is represented by a class which derives from +:class:`maec.Entity`. In general, there is one Python class per MAEC type, +though in some cases classes which would have identical functionality have +been reused rather than writing duplicating classes. One example of this is +that many enumerated values are implemented using the +:class:`cybox.common.properties.String`, since values aren't checked to make +sure they are valid enumeration values. + +.. note:: Not all MAEC types have yet been implemented. From 79bf40f05b69bf728a1d6f59f8d8113d195dd440 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 10 Sep 2014 15:41:11 -0400 Subject: [PATCH 074/297] Added API vs Bindings pages --- docs/api_vs_bindings/api_snippet.rst | 34 +++++++++++++ docs/api_vs_bindings/binding_snippet.rst | 41 +++++++++++++++ docs/api_vs_bindings/index.rst | 64 ++++++++++++++++++++++++ docs/index.rst | 1 + 4 files changed, 140 insertions(+) create mode 100644 docs/api_vs_bindings/api_snippet.rst create mode 100644 docs/api_vs_bindings/binding_snippet.rst create mode 100644 docs/api_vs_bindings/index.rst diff --git a/docs/api_vs_bindings/api_snippet.rst b/docs/api_vs_bindings/api_snippet.rst new file mode 100644 index 0000000..eee8330 --- /dev/null +++ b/docs/api_vs_bindings/api_snippet.rst @@ -0,0 +1,34 @@ +.. code-block:: python + + # Import the required APIs + from maec.bundle.bundle import Bundle + from maec.bundle.malware_action import MalwareAction + from maec.utils import IDGenerator, set_id_method + from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType + from cybox.objects.file_object import File + + # Instantiate the MAEC/CybOX Entities + set_id_method(IDGenerator.METHOD_INT) + b = Bundle() + a = MalwareAction() + ao = AssociatedObject() + + # Build the Associated Object for use in the Action + ao.properties = File() + ao.properties.file_name = "badware.exe" + ao.properties.size_in_bytes = "123456" + ao.association_type = AssociationType() + ao.association_type.value = 'output' + ao.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + + # Build the Action and add the Associated Object to it + a.name = 'create file' + a.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' + a.associated_objects = AssociatedObjects() + a.associated_objects.append(ao) + + # Add the Action to the Bundle + b.add_action(a) + + # Output the Bundle to stdout + print b.to_xml(include_namespaces = False) \ No newline at end of file diff --git a/docs/api_vs_bindings/binding_snippet.rst b/docs/api_vs_bindings/binding_snippet.rst new file mode 100644 index 0000000..ac978aa --- /dev/null +++ b/docs/api_vs_bindings/binding_snippet.rst @@ -0,0 +1,41 @@ +.. code-block:: python + + import sys + # Import the required bindings + import maec.bindings.maec_bundle as bundle_binding + import cybox.bindings.cybox_core as cybox_core_binding + import cybox.bindings.cybox_common as cybox_common_binding + import cybox.bindings.file_object as file_binding + + # Instantiate the MAEC/CybOX Entities + b = bundle_binding.BundleType(id="bundle-1") + a = bundle_binding.MalwareActionType(id="action-1") + ao = cybox_core_binding.AssociatedObjectType(id="object-1") + + # Build the Associated Object for use in the Action + f = file_binding.FileObjectType() + f_name = cybox_common_binding.StringObjectPropertyType(valueOf_="badware.exe") + f.set_File_Name(f_name) + f_size = cybox_common_binding.UnsignedLongObjectPropertyType(valueOf_="123456") + f.set_Size_In_Bytes(f_size) + f.set_xsi_type = "FileObj:FileObjectType" + ao.set_Properties(f) + ao_type = cybox_common_binding.ControlledVocabularyStringType(valueOf_="output") + ao_type.set_xsi_type("maecVocabs:ActionObjectAssociationTypeVocab-1.0") + ao.set_Association_Type(ao_type) + + # Build the Action and add the Associated Object to it + a_name = cybox_common_binding.ControlledVocabularyStringType(valueOf_="create file") + a_name.set_xsi_type("maecVocabs:FileActionNameVocab-1.0") + a.set_Name(a_name) + as_objects = cybox_core_binding.AssociatedObjectsType() + as_objects.add_Associated_Object(ao) + a.set_Associated_Objects(as_objects) + + # Add the Action to the Bundle + action_list = bundle_binding.ActionListType() + action_list.add_Action(a) + b.set_Actions(action_list) + + # Output the Bundle to stdout + b.export(sys.stdout, 0) \ No newline at end of file diff --git a/docs/api_vs_bindings/index.rst b/docs/api_vs_bindings/index.rst new file mode 100644 index 0000000..b20b91f --- /dev/null +++ b/docs/api_vs_bindings/index.rst @@ -0,0 +1,64 @@ +APIs or bindings? +================= + +This page describes both the **APIs** and the **bindings** provided by the *python-maec* library. + +.. toctree:: + :hidden: + + api_snippet + binding_snippet + +Overview +-------- + +The python-maec library provides APIs and utilities that aid in the creation, consumption, and processing of Structured Threat Information eXpression (MAEC) content. The APIs that drive much of the functionality of python-maec sit on top of a binding layer that acts as a direct connection between Python and the MAEC XML. Because both the APIs and the bindings allow for the creation and development of MAEC content, developers that are new to python-maec may not understand the differences between the two. This document aims to identify the purpose and uses of the APIs and bindings. + +Bindings +-------- + +The python-maec library leverages machine generated XML-to-Python bindings for the creation and processing of MAEC content. These bindings are created using the `generateDS`_ utility and can be found under `maec.bindings`_ within the package hierarchy. + +The MAEC bindings allow for a direct, complete mapping between Python classes and MAEC XML Schema data structures. That being said, it is possible (though not advised) to use only the MAEC bindings to create MAEC documents. However, because the code is generated from XML Schema without contextual knowledge of relationships or broader organizational/developmental schemes, it is often a cumbersome and laborious task to create even the simplest of MAEC documents. + +Developers within the python-maec team felt that the binding code did not lend itself to rapid development or natural navigation of data, and so it was decided that a higher-level API should be created. + +.. _generateDS: http://www.rexx.com/~dkuhlman/generateDS.html +.. _maec.bindings: https://github.com/MAECProject/python-maec/tree/master/maec/bindings + +APIs +---- + +The python-maec APIs are classes and utilities that leverage the MAEC bindings for the creation and processing of MAEC content. The APIs are designed to behave more naturally when working with MAEC content, allowing developers to conceptualize and interact with MAEC documents as pure Python objects and not XML Schema objects. + +The APIs provide validation of inputs, multiple input and output formats, more Pythonic access of data structure internals and interaction with classes, and better interpretation of a developers intent through datatype coercion and implicit instantiation. + +.. note:: + + The python-maec APIs are under constant development. Our goal is to provide full API coverage of the MAEC data structures, but not all structures are exposed via the APIs yet. Please refer to the :doc:`../api/index` for API coverage details. + +Brevity Wins +------------ + +The two code examples show the difference in creating and printing a simple MAEC document consisting of only a MAEC Bundle with a single Malware Action using the python-maec and python-cybox bindings. Both examples will produce the same MAEC XML! + +.. container:: side-by-side + + .. container:: + + **API Example** + + .. include:: api_snippet.rst + + .. container:: + + **Binding Example** + + .. include:: binding_snippet.rst + +Feedback +-------- + +If there is a problem with the APIs or bindings, or if there is functionality missing from the APIs that forces the use of the bindings, let us know in the `python-maec issue tracker`_ + +.. _python-maec issue tracker: https://github.com/MAECProject/python-maec/issues \ No newline at end of file diff --git a/docs/index.rst b/docs/index.rst index 154abcb..9b74223 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -43,6 +43,7 @@ Contents installation overview examples + api_vs_bindings/index contributing API Reference From e7ea20573e07e871bb35d212ccb1f60d0b76c258 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 11 Sep 2014 08:42:30 -0400 Subject: [PATCH 075/297] Update LICENSE.txt --- LICENSE.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE.txt b/LICENSE.txt index 1ee58c7..ba71b84 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -1,4 +1,4 @@ -Copyright (c) 2013, The MITRE Corporation +Copyright (c) 2014, The MITRE Corporation All rights reserved. Redistribution and use in source and binary forms, with or without From f2a33943c3372f62189e74b7b5704e00eac170ad Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 11 Sep 2014 09:25:29 -0400 Subject: [PATCH 076/297] Updated python-cybox version in install_requires to >=2.1.0.7 --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 77ab86c..aec5169 100644 --- a/setup.py +++ b/setup.py @@ -35,7 +35,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.3', 'cybox>=2.1.0.0,<2.1.1.0'], + install_requires=['lxml>=2.3', 'cybox>=2.1.0.7,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", From 1e53e9e0fc05853864ee11c56a2f3335207a555f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 11 Sep 2014 10:05:04 -0400 Subject: [PATCH 077/297] Added modified from_dict to Entity to account for MAEC's own EntityList --- maec/__init__.py | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/maec/__init__.py b/maec/__init__.py index 7b49dc4..afbf6b3 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -8,6 +8,7 @@ import bindings.maec_bundle as bundle_binding import bindings.maec_package as package_binding from cybox import Entity as cyboxEntity +from cybox import EntityList as cyboxEntityList from cybox import TypedField from cybox.utils import Namespace from maec.utils import maecMETA, EntityParser @@ -105,6 +106,42 @@ def _get_children(self): if isinstance(item, Entity) or isinstance(item, cyboxEntity): yield item + @classmethod + def from_dict(cls, cls_dict=None): + if cls_dict is None: + return None + + entity = cls() + + # Shortcut if an actual dict is not provided: + if not isinstance(cls_dict, dict): + value = cls_dict + # Call the class's constructor + try: + return cls(value) + except TypeError: + raise TypeError("Could not instantiate a %s from a %s: %s" % + (cls, type(value), value)) + + for field in cls._get_vars(): + val = cls_dict.get(field.key_name) + if field.type_: + if issubclass(field.type_, EntityList) or issubclass(field.type_, cyboxEntityList): + val = field.type_.from_list(val) + elif field.multiple: + if val is not None: + val = [field.type_.from_dict(x) for x in val] + else: + val = [] + else: + val = field.type_.from_dict(val) + else: + if field.multiple and not val: + val = [] + setattr(entity, field.attr_name, val) + + return entity + class EntityList(collections.MutableSequence, Entity): _contained_type = object From fd43e57260ab23a3615685b3cbacad9212aac7f1 Mon Sep 17 00:00:00 2001 From: apsillers Date: Thu, 11 Sep 2014 10:51:33 -0400 Subject: [PATCH 078/297] Initial Package unit test --- maec/test/package/package_test.py | 57 +++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 maec/test/package/package_test.py diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py new file mode 100644 index 0000000..c80bdf8 --- /dev/null +++ b/maec/test/package/package_test.py @@ -0,0 +1,57 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.core import Object, Observables, RelatedObject, Relationship +from cybox.objects.address_object import Address +from cybox.objects.email_message_object import EmailMessage +from cybox.objects.uri_object import URI +from cybox.test import EntityTestCase, round_trip, round_trip_dict +from cybox.utils import CacheMiss, set_id_method +from maec.package.package import Package + + +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Package + + _full_dict = { + 'id': 'example:package-2794fd8f-7850-48c0-82c1-87e1a25a7a91', + 'malware_subjects': [{'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': {'file_name': 'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType'} + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': {'value': 'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} + }], + 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence'}]}, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1'}] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5'}], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType'}}}], + 'schema_version': '2.1' + } + + def test_id_autoset(self): + o = Package() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Package.from_dict(TestPackage._full_dict) + o = round_trip(o) + + self.assertEqual(TestPackage._full_dict, o.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file From 3fbbba05a7758249944e0003b0362b08245a3a2c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 12 Sep 2014 09:40:18 -0400 Subject: [PATCH 079/297] Added missing BehaviorList class --- docs/api/bundle/bundle.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/api/bundle/bundle.rst b/docs/api/bundle/bundle.rst index 9b889a6..c0b9eb2 100644 --- a/docs/api/bundle/bundle.rst +++ b/docs/api/bundle/bundle.rst @@ -14,6 +14,10 @@ Classes :show-inheritance: :members: +.. autoclass:: BehaviorList + :show-inheritance: + :members: + .. autoclass:: ObjectList :show-inheritance: :members: From 7fe23ac04d5cb2c5b8c05c352ac73787ed953680 Mon Sep 17 00:00:00 2001 From: apsillers Date: Fri, 12 Sep 2014 12:32:10 -0400 Subject: [PATCH 080/297] Update bindings to allow any type to be a top-level XML element --- maec/bindings/maec_bundle.py | 69 ++++++++++++++++++++++++++++----- maec/bindings/maec_container.py | 26 ++++++++----- maec/bindings/maec_package.py | 58 ++++++++++++++++++++++----- 3 files changed, 126 insertions(+), 27 deletions(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index a293ea5..7a32f61 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -6442,11 +6442,17 @@ def usage(): print USAGE_TEXT sys.exit(1) +def get_root_tag(node): + tag = Tag_pattern_.match(node.tag).groups()[-1] + rootClass = GDSClassesMapping.get(tag) + if rootClass is None: + rootClass = globals().get(tag) + return tag, rootClass + def parse(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Bundle' - rootClass = BundleType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -6460,8 +6466,7 @@ def parse(inFileName): def parseEtree(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Bundle' - rootClass = BundleType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -6477,8 +6482,7 @@ def parseString(inString): from StringIO import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() - rootTag = 'MAEC_Bundle' - rootClass = BundleType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -6491,8 +6495,7 @@ def parseString(inString): def parseLiteral(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Bundle' - rootClass = BundleType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -6562,4 +6565,52 @@ def main(): "ActionCollectionListType", "ObjectCollectionListType", "AVClassificationType" - ] \ No newline at end of file + ] + +GDSClassesMapping = { + "MalwareActionType": MalwareActionType, + "MAEC_Bundle": BundleType, + "BehaviorType": BehaviorType, + "BehaviorCollectionType": BehaviorCollectionType, + "ActionCollectionType": ActionCollectionType, + "APICallType": APICallType, + "ActionImplementationType": ActionImplementationType, + "CVEVulnerabilityType": CVEVulnerabilityType, + "ObjectCollectionType": ObjectCollectionType, + "BaseCollectionType": BaseCollectionType, + "BehaviorRelationshipType": BehaviorRelationshipType, + "AVClassificationsType": AVClassificationsType, + "ParameterType": ParameterType, + "ParameterListType": ParameterListType, + "AssociatedCodeType": AssociatedCodeType, + "BehaviorPurposeType": BehaviorPurposeType, + "PlatformListType": PlatformListType, + "ExploitType": ExploitType, + "BehaviorRelationshipListType": BehaviorRelationshipListType, + "BehavioralActionsType": BehavioralActionsType, + "BehaviorListType": BehaviorListType, + "ActionListType": ActionListType, + "ObjectListType": ObjectListType, + "BehaviorReferenceType": BehaviorReferenceType, + "ObjectReferenceType": ObjectReferenceType, + "BehavioralActionType": BehavioralActionType, + "BehavioralActionReferenceType": BehavioralActionReferenceType, + "BehavioralActionEquivalenceReferenceType": BehavioralActionEquivalenceReferenceType, + "BehaviorReferenceListType": BehaviorReferenceListType, + "ActionReferenceListType": ActionReferenceListType, + "ObjectReferenceListType": ObjectReferenceListType, + "CandidateIndicatorType": CandidateIndicatorType, + "CandidateIndicatorListType": CandidateIndicatorListType, + "MalwareEntityType": MalwareEntityType, + "CollectionsType": CollectionsType, + "BundleReferenceType": BundleReferenceType, + "ProcessTreeType": ProcessTreeType, + "ProcessTreeNodeType": ProcessTreeNodeType, + "CandidateIndicatorCompositionType": CandidateIndicatorCompositionType, + "CandidateIndicatorCollectionType": CandidateIndicatorCollectionType, + "CandidateIndicatorCollectionListType": CandidateIndicatorCollectionListType, + "BehaviorCollectionListType": BehaviorCollectionListType, + "ActionCollectionListType": ActionCollectionListType, + "ObjectCollectionListType": ObjectCollectionListType, + "AVClassificationType": AVClassificationType +} \ No newline at end of file diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index 988fa68..2dbfaba 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -730,11 +730,17 @@ def usage(): print USAGE_TEXT sys.exit(1) +def get_root_tag(node): + tag = Tag_pattern_.match(node.tag).groups()[-1] + rootClass = GDSClassesMapping.get(tag) + if rootClass is None: + rootClass = globals().get(tag) + return tag, rootClass + def parse(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Container' - rootClass = ContainerType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -748,8 +754,7 @@ def parse(inFileName): def parseEtree(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Container' - rootClass = ContainerType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -765,8 +770,7 @@ def parseString(inString): from StringIO import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() - rootTag = 'MAEC_Container' - rootClass = ContainerType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -779,8 +783,7 @@ def parseString(inString): def parseLiteral(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Container' - rootClass = ContainerType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -807,4 +810,9 @@ def main(): __all__ = [ "ContainerType", "PackageListType" - ] \ No newline at end of file + ] + +GDSClassesMapping = { + "ContainerType": ContainerType, + "PackageListType": PackageListType +} \ No newline at end of file diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index fea3c7a..4023139 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -5135,11 +5135,17 @@ def usage(): print USAGE_TEXT sys.exit(1) +def get_root_tag(node): + tag = Tag_pattern_.match(node.tag).groups()[-1] + rootClass = GDSClassesMapping.get(tag) + if rootClass is None: + rootClass = globals().get(tag) + return tag, rootClass + def parse(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Package' - rootClass = PackageType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -5153,8 +5159,7 @@ def parse(inFileName): def parseEtree(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Package' - rootClass = PackageType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -5170,8 +5175,7 @@ def parseString(inString): from StringIO import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() - rootTag = 'MAEC_Package' - rootClass = PackageType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -5184,8 +5188,7 @@ def parseString(inString): def parseLiteral(inFileName): doc = parsexml_(inFileName) rootNode = doc.getroot() - rootTag = 'MAEC_Package' - rootClass = PackageType + rootTag, rootClass = get_root_tag(rootNode) rootObj = rootClass.factory() rootObj.build(rootNode) # Enable Python to collect the space used by the DOM. @@ -5244,4 +5247,41 @@ def main(): "CapturedProtocolType", "ObjectEquivalenceType", "ObjectEquivalenceListType" - ] \ No newline at end of file + ] + +GDSClassesMapping = { + "AnalysisEnvironmentType": AnalysisEnvironmentType, + "SourceType": SourceType, + "CommentListType": CommentListType, + "AnalysisSystemListType": AnalysisSystemListType, + "ToolListType": ToolListType, + "CommentType": CommentType, + "AnalysisSystemType": AnalysisSystemType, + "HypervisorHostSystemType": HypervisorHostSystemType, + "DynamicAnalysisMetadataType": DynamicAnalysisMetadataType, + "AnalysisType": AnalysisType, + "AnalysisListType": AnalysisListType, + "InstalledProgramsType": InstalledProgramsType, + "MAEC_Package": PackageType, + "MalwareSubjectType": MalwareSubjectType, + "MetaAnalysisType": MetaAnalysisType, + "MalwareSubjectRelationshipType": MalwareSubjectRelationshipType, + "MalwareSubjectRelationshipListType": MalwareSubjectRelationshipListType, + "MalwareSubjectReferenceType": MalwareSubjectReferenceType, + "MalwareSubjectListType": MalwareSubjectListType, + "MinorVariantListType": MinorVariantListType, + "FindingsBundleListType": FindingsBundleListType, + "GroupingRelationshipType": GroupingRelationshipType, + "GroupingRelationshipListType": GroupingRelationshipListType, + "ClusteringMetadataType": ClusteringMetadataType, + "ClusterEdgeNodePairType": ClusterEdgeNodePairType, + "ClusterCompositionType": ClusterCompositionType, + "ClusteringAlgorithmParametersType": ClusteringAlgorithmParametersType, + "NetworkInfrastructureType": NetworkInfrastructureType, + "ActionEquivalenceType": ActionEquivalenceType, + "ActionEquivalenceListType": ActionEquivalenceListType, + "CapturedProtocolListType": CapturedProtocolListType, + "CapturedProtocolType": CapturedProtocolType, + "ObjectEquivalenceType": ObjectEquivalenceType, + "ObjectEquivalenceListType": ObjectEquivalenceListType +} \ No newline at end of file From e93323f3b373a7ac6456234eb5ba5e7e72834699 Mon Sep 17 00:00:00 2001 From: apsillers Date: Fri, 12 Sep 2014 12:46:00 -0400 Subject: [PATCH 081/297] Add Behavior unit test --- maec/test/bundle/behavior_test.py | 48 +++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 maec/test/bundle/behavior_test.py diff --git a/maec/test/bundle/behavior_test.py b/maec/test/bundle/behavior_test.py new file mode 100644 index 0000000..dbc0b1f --- /dev/null +++ b/maec/test/bundle/behavior_test.py @@ -0,0 +1,48 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip, round_trip_dict +from cybox.utils import CacheMiss, set_id_method +from maec.bundle.bundle import Behavior + + +class TestBehavior(EntityTestCase, unittest.TestCase): + klass = Behavior + + _full_dict = { + 'ordinal_position': 1, + 'status': 'Success', + 'duration': 'PT3S', + 'description': 'Malware engages in some behavior wherein...', + 'purpose': { + 'description': 'Here is why the malware does this...', + 'vulnerability_exploit': { + 'known_vulnerability': True, + 'cve': { + 'cve_id': 'CVE-2013-1337', + 'description': '.NET vulnerability' + }, + 'targeted_platforms': [{ 'description': 'Windows ME' }] + } + }, + 'action_composition': { + 'action':[{ 'behavioral_ordering': 1 }], + 'action_reference':[{ 'behavioral_ordering': 1 }], + 'action_equivalence_reference':[{ 'behavioral_ordering': 1 }] + } + } + + def test_id_autoset(self): + o = Behavior() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Behavior() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file From 76631d32ce67212c0c79e7b6dbc8ae520637d485 Mon Sep 17 00:00:00 2001 From: apsillers Date: Tue, 16 Sep 2014 15:02:16 -0400 Subject: [PATCH 082/297] Update and add unit tests --- maec/test/bundle/behavior_test.py | 4 +- maec/test/bundle/bundle_test.py | 27 ++++++++++++ maec/test/package/malware_subject_test.py | 50 +++++++++++++++++++++++ maec/test/package/package_test.py | 6 +-- 4 files changed, 81 insertions(+), 6 deletions(-) create mode 100644 maec/test/bundle/bundle_test.py create mode 100644 maec/test/package/malware_subject_test.py diff --git a/maec/test/bundle/behavior_test.py b/maec/test/bundle/behavior_test.py index dbc0b1f..389bc17 100644 --- a/maec/test/bundle/behavior_test.py +++ b/maec/test/bundle/behavior_test.py @@ -3,11 +3,9 @@ import unittest -from cybox.test import EntityTestCase, round_trip, round_trip_dict -from cybox.utils import CacheMiss, set_id_method +from cybox.test import EntityTestCase, round_trip from maec.bundle.bundle import Behavior - class TestBehavior(EntityTestCase, unittest.TestCase): klass = Behavior diff --git a/maec/test/bundle/bundle_test.py b/maec/test/bundle/bundle_test.py new file mode 100644 index 0000000..80d2840 --- /dev/null +++ b/maec/test/bundle/bundle_test.py @@ -0,0 +1,27 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.bundle import Bundle + +class TestBundle(EntityTestCase, unittest.TestCase): + klass = Bundle + + _full_dict = { + 'defined_subject':False + } + + def test_id_autoset(self): + o = Bundle() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Bundle() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py new file mode 100644 index 0000000..c6edf48 --- /dev/null +++ b/maec/test/package/malware_subject_test.py @@ -0,0 +1,50 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.package.malware_subject import MalwareSubject +from maec.bundle.bundle import Bundle + +class TestMalwareSubject(EntityTestCase, unittest.TestCase): + klass = MalwareSubject + + _full_dict = { + 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': {'file_name': 'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType'} + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': {'value': 'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} + }], + 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence'}]}, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1'}] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5'}], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType'}}} + + def test_id_autoset(self): + o = MalwareSubject() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = MalwareSubject() + o.add_findings_bundle(Bundle()) + o2 = round_trip(o) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index c80bdf8..51d759a 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -48,10 +48,10 @@ def test_id_autoset(self): self.assertNotEqual(o.id_, None) def test_round_trip(self): - o = Package.from_dict(TestPackage._full_dict) - o = round_trip(o) + o = Package() + o2 = round_trip(o) - self.assertEqual(TestPackage._full_dict, o.to_dict()) + self.assertEqual(o.to_dict(), o2.to_dict()) if __name__ == "__main__": unittest.main() \ No newline at end of file From 0cc37bbc27e9a99a77a99a76bfd6bf9e247093e7 Mon Sep 17 00:00:00 2001 From: apsillers Date: Wed, 17 Sep 2014 14:21:13 -0400 Subject: [PATCH 083/297] Modify bindings to align with Cybox binding changes --- maec/bindings/maec_bundle.py | 3274 +++++++++++++++---------------- maec/bindings/maec_container.py | 152 +- maec/bindings/maec_package.py | 2488 +++++++++++------------ maec/bindings/mmdef_1_2.py | 2472 +++++++++++------------ 4 files changed, 4193 insertions(+), 4193 deletions(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 7a32f61..10f6590 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -299,10 +299,10 @@ def gds_build_any(self, node, type_name=None): # Support/utility functions. # -def showIndent(outfile, level, pretty_print=True): +def showIndent(write, level, pretty_print=True): if pretty_print: for idx in range(level): - outfile.write(' ') + write(' ') def quote_xml(inStr): if not inStr: @@ -409,32 +409,32 @@ def getValue(self): return self.value def getName(self): return self.name - def export(self, outfile, level, name, namespace, pretty_print=True): + def export(self, write, level, name, namespace, pretty_print=True): if self.category == MixedContainer.CategoryText: # Prevent exporting empty content as empty lines. if self.value.strip(): - outfile.write(self.value) + write(self.value) elif self.category == MixedContainer.CategorySimple: - self.exportSimple(outfile, level, name) + self.exportSimple(write, level, name) else: # category == MixedContainer.CategoryComplex - self.value.export(outfile, level, namespace, name, pretty_print) - def exportSimple(self, outfile, level, name): + self.value.export(write, level, namespace, name, pretty_print) + def exportSimple(self, write, level, name): if self.content_type == MixedContainer.TypeString: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeInteger or \ self.content_type == MixedContainer.TypeBoolean: - outfile.write('<%s>%d' % + write('<%s>%d' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeFloat or \ self.content_type == MixedContainer.TypeDecimal: - outfile.write('<%s>%f' % + write('<%s>%f' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeDouble: - outfile.write('<%s>%g' % + write('<%s>%g' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeBase64: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, base64.b64encode(self.value), self.name)) def to_etree(self, element): if self.category == MixedContainer.CategoryText: @@ -469,22 +469,22 @@ def to_etree_simple(self): elif self.content_type == MixedContainer.TypeBase64: text = '%s' % base64.b64encode(self.value) return text - def exportLiteral(self, outfile, level, name): + def exportLiteral(self, write, level, name): if self.category == MixedContainer.CategoryText: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) elif self.category == MixedContainer.CategorySimple: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) else: # category == MixedContainer.CategoryComplex - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s",\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s",\n' % \ (self.category, self.content_type, self.name,)) - self.value.exportLiteral(outfile, level + 1) - showIndent(outfile, level) - outfile.write(')\n') + self.value.exportLiteral(write, level + 1) + showIndent(write, level) + write(')\n') class MemberSpec_(object): @@ -587,100 +587,100 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorType'): if self.status is not None and 'status' not in already_processed: already_processed.add('status') - outfile.write(' status=%s' % (quote_attrib(self.status), )) + write(' status=%s' % (quote_attrib(self.status), )) if self.duration is not None and 'duration' not in already_processed: already_processed.add('duration') - outfile.write(' duration=%s' % (self.gds_format_string(quote_attrib(self.duration).encode(ExternalEncoding), input_name='duration'), )) + write(' duration=%s' % (self.gds_format_string(quote_attrib(self.duration).encode(ExternalEncoding), input_name='duration'), )) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - outfile.write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) + write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Purpose is not None: - self.Purpose.export(outfile, level, 'maecBundle:', name_='Purpose', pretty_print=pretty_print) + self.Purpose.export(write, level, 'maecBundle:', name_='Purpose', pretty_print=pretty_print) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) if self.Discovery_Method is not None: - self.Discovery_Method.export(outfile, level, 'maecBundle:', name_='Discovery_Method', pretty_print=pretty_print) + self.Discovery_Method.export(write, level, 'maecBundle:', name_='Discovery_Method', pretty_print=pretty_print) if self.Action_Composition is not None: - self.Action_Composition.export(outfile, level, 'maecBundle:', name_='Action_Composition', pretty_print=pretty_print) + self.Action_Composition.export(write, level, 'maecBundle:', name_='Action_Composition', pretty_print=pretty_print) if self.Associated_Code is not None: - self.Associated_Code.export(outfile, level, 'maecBundle:', name_='Associated_Code', pretty_print=pretty_print) + self.Associated_Code.export(write, level, 'maecBundle:', name_='Associated_Code', pretty_print=pretty_print) if self.Relationships is not None: - self.Relationships.export(outfile, level, 'maecBundle:', name_='Relationships', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorType'): + self.Relationships.export(write, level, 'maecBundle:', name_='Relationships', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.status is not None and 'status' not in already_processed: already_processed.add('status') - showIndent(outfile, level) - outfile.write('status = %s,\n' % (self.status,)) + showIndent(write, level) + write('status = %s,\n' % (self.status,)) if self.duration is not None and 'duration' not in already_processed: already_processed.add('duration') - showIndent(outfile, level) - outfile.write('duration = "%s",\n' % (self.duration,)) + showIndent(write, level) + write('duration = "%s",\n' % (self.duration,)) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - showIndent(outfile, level) - outfile.write('ordinal_position = %d,\n' % (self.ordinal_position,)) + showIndent(write, level) + write('ordinal_position = %d,\n' % (self.ordinal_position,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.Purpose is not None: - outfile.write('Purpose=model_.BehaviorPurposeType(\n') - self.Purpose.exportLiteral(outfile, level, name_='Purpose') - outfile.write('),\n') + write('Purpose=model_.BehaviorPurposeType(\n') + self.Purpose.exportLiteral(write, level, name_='Purpose') + write('),\n') if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) if self.Discovery_Method is not None: - outfile.write('Discovery_Method=model_.cybox_common.MeasureSourceType(\n') - self.Discovery_Method.exportLiteral(outfile, level, name_='Discovery_Method') - outfile.write('),\n') + write('Discovery_Method=model_.cybox_common.MeasureSourceType(\n') + self.Discovery_Method.exportLiteral(write, level, name_='Discovery_Method') + write('),\n') if self.Action_Composition is not None: - outfile.write('Action_Composition=model_.BehavioralActionsType(\n') - self.Action_Composition.exportLiteral(outfile, level, name_='Action_Composition') - outfile.write('),\n') + write('Action_Composition=model_.BehavioralActionsType(\n') + self.Action_Composition.exportLiteral(write, level, name_='Action_Composition') + write('),\n') if self.Associated_Code is not None: - outfile.write('Associated_Code=model_.AssociatedCodeType(\n') - self.Associated_Code.exportLiteral(outfile, level, name_='Associated_Code') - outfile.write('),\n') + write('Associated_Code=model_.AssociatedCodeType(\n') + self.Associated_Code.exportLiteral(write, level, name_='Associated_Code') + write('),\n') if self.Relationships is not None: - outfile.write('Relationships=model_.BehaviorRelationshipListType(\n') - self.Relationships.exportLiteral(outfile, level, name_='Relationships') - outfile.write('),\n') + write('Relationships=model_.BehaviorRelationshipListType(\n') + self.Relationships.exportLiteral(write, level, name_='Relationships') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -820,125 +820,125 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='MAEC_Bundle', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='MAEC_Bundle', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MAEC_Bundle') + self.exportAttributes(write, level, already_processed, namespace_, name_='MAEC_Bundle') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='MAEC_Bundle'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='MAEC_Bundle'): if self.defined_subject is not None and 'defined_subject' not in already_processed: already_processed.add('defined_subject') - outfile.write(' defined_subject="%s"' % self.gds_format_boolean(self.defined_subject, input_name='defined_subject')) + write(' defined_subject="%s"' % self.gds_format_boolean(self.defined_subject, input_name='defined_subject')) if self.content_type is not None and 'content_type' not in already_processed: already_processed.add('content_type') - outfile.write(' content_type=%s' % (quote_attrib(self.content_type), )) + write(' content_type=%s' % (quote_attrib(self.content_type), )) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - outfile.write(' schema_version=%s' % (self.gds_format_string(quote_attrib(self.schema_version).encode(ExternalEncoding), input_name='schema_version'), )) + write(' schema_version=%s' % (self.gds_format_string(quote_attrib(self.schema_version).encode(ExternalEncoding), input_name='schema_version'), )) if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - outfile.write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='MAEC_Bundle', fromsubclass_=False, pretty_print=True): + write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='MAEC_Bundle', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Malware_Instance_Object_Attributes is not None: - self.Malware_Instance_Object_Attributes.export(outfile, level, 'maecBundle:', name_='Malware_Instance_Object_Attributes', pretty_print=pretty_print) + self.Malware_Instance_Object_Attributes.export(write, level, 'maecBundle:', name_='Malware_Instance_Object_Attributes', pretty_print=pretty_print) if self.AV_Classifications is not None: - self.AV_Classifications.export(outfile, level, 'maecBundle:', name_='AV_Classifications', pretty_print=pretty_print) + self.AV_Classifications.export(write, level, 'maecBundle:', name_='AV_Classifications', pretty_print=pretty_print) if self.Process_Tree is not None: - self.Process_Tree.export(outfile, level, 'maecBundle:', name_='Process_Tree', pretty_print=pretty_print) + self.Process_Tree.export(write, level, 'maecBundle:', name_='Process_Tree', pretty_print=pretty_print) if self.Capabilities is not None: - self.Capabilities.export(outfile, level, 'maecBundle:', name_='Capabilities', pretty_print=pretty_print) + self.Capabilities.export(write, level, 'maecBundle:', name_='Capabilities', pretty_print=pretty_print) if self.Behaviors is not None: - self.Behaviors.export(outfile, level, 'maecBundle:', name_='Behaviors', pretty_print=pretty_print) + self.Behaviors.export(write, level, 'maecBundle:', name_='Behaviors', pretty_print=pretty_print) if self.Actions is not None: - self.Actions.export(outfile, level, 'maecBundle:', name_='Actions', pretty_print=pretty_print) + self.Actions.export(write, level, 'maecBundle:', name_='Actions', pretty_print=pretty_print) if self.Objects is not None: - self.Objects.export(outfile, level, 'maecBundle:', name_='Objects', pretty_print=pretty_print) + self.Objects.export(write, level, 'maecBundle:', name_='Objects', pretty_print=pretty_print) if self.Candidate_Indicators is not None: - self.Candidate_Indicators.export(outfile, level, 'maecBundle:', name_='Candidate_Indicators', pretty_print=pretty_print) + self.Candidate_Indicators.export(write, level, 'maecBundle:', name_='Candidate_Indicators', pretty_print=pretty_print) if self.Collections is not None: - self.Collections.export(outfile, level, 'maecBundle:', name_='Collections', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MAEC_Bundle'): + self.Collections.export(write, level, 'maecBundle:', name_='Collections', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MAEC_Bundle'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.defined_subject is not None and 'defined_subject' not in already_processed: already_processed.add('defined_subject') - showIndent(outfile, level) - outfile.write('defined_subject = %s,\n' % (self.defined_subject,)) + showIndent(write, level) + write('defined_subject = %s,\n' % (self.defined_subject,)) if self.content_type is not None and 'content_type' not in already_processed: already_processed.add('content_type') - showIndent(outfile, level) - outfile.write('content_type = %s,\n' % (self.content_type,)) + showIndent(write, level) + write('content_type = %s,\n' % (self.content_type,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - showIndent(outfile, level) - outfile.write('schema_version = "%s",\n' % (self.schema_version,)) + showIndent(write, level) + write('schema_version = "%s",\n' % (self.schema_version,)) if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - showIndent(outfile, level) - outfile.write('timestamp = "%s",\n' % (self.timestamp,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('timestamp = "%s",\n' % (self.timestamp,)) + def exportLiteralChildren(self, write, level, name_): if self.Malware_Instance_Object_Attributes is not None: - outfile.write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') - self.Malware_Instance_Object_Attributes.exportLiteral(outfile, level, name_='Malware_Instance_Object_Attributes') - outfile.write('),\n') + write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') + self.Malware_Instance_Object_Attributes.exportLiteral(write, level, name_='Malware_Instance_Object_Attributes') + write('),\n') if self.AV_Classifications is not None: - outfile.write('AV_Classifications=model_.AVClassificationsType(\n') - self.AV_Classifications.exportLiteral(outfile, level, name_='AV_Classifications') - outfile.write('),\n') + write('AV_Classifications=model_.AVClassificationsType(\n') + self.AV_Classifications.exportLiteral(write, level, name_='AV_Classifications') + write('),\n') if self.Process_Tree is not None: - outfile.write('Process_Tree=model_.ProcessTreeType(\n') - self.Process_Tree.exportLiteral(outfile, level, name_='Process_Tree') - outfile.write('),\n') + write('Process_Tree=model_.ProcessTreeType(\n') + self.Process_Tree.exportLiteral(write, level, name_='Process_Tree') + write('),\n') if self.Capabilities is not None: - outfile.write('Capabilities=model_.CapabilityListType(\n') - self.Capabilities.exportLiteral(outfile, level, name_='Capabilities') - outfile.write('),\n') + write('Capabilities=model_.CapabilityListType(\n') + self.Capabilities.exportLiteral(write, level, name_='Capabilities') + write('),\n') if self.Behaviors is not None: - outfile.write('Behaviors=model_.BehaviorListType(\n') - self.Behaviors.exportLiteral(outfile, level, name_='Behaviors') - outfile.write('),\n') + write('Behaviors=model_.BehaviorListType(\n') + self.Behaviors.exportLiteral(write, level, name_='Behaviors') + write('),\n') if self.Actions is not None: - outfile.write('Actions=model_.ActionListType(\n') - self.Actions.exportLiteral(outfile, level, name_='Actions') - outfile.write('),\n') + write('Actions=model_.ActionListType(\n') + self.Actions.exportLiteral(write, level, name_='Actions') + write('),\n') if self.Objects is not None: - outfile.write('Objects=model_.ObjectListType(\n') - self.Objects.exportLiteral(outfile, level, name_='Objects') - outfile.write('),\n') + write('Objects=model_.ObjectListType(\n') + self.Objects.exportLiteral(write, level, name_='Objects') + write('),\n') if self.Candidate_Indicators is not None: - outfile.write('Candidate_Indicators=model_.CandidateIndicatorListType(\n') - self.Candidate_Indicators.exportLiteral(outfile, level, name_='Candidate_Indicators') - outfile.write('),\n') + write('Candidate_Indicators=model_.CandidateIndicatorListType(\n') + self.Candidate_Indicators.exportLiteral(write, level, name_='Candidate_Indicators') + write('),\n') if self.Collections is not None: - outfile.write('Collections=model_.CollectionsType(\n') - self.Collections.exportLiteral(outfile, level, name_='Collections') - outfile.write('),\n') + write('Collections=model_.CollectionsType(\n') + self.Collections.exportLiteral(write, level, name_='Collections') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1053,68 +1053,68 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='APICallType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='APICallType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='APICallType') + self.exportAttributes(write, level, already_processed, namespace_, name_='APICallType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='APICallType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='APICallType'): if self.normalized_function_name is not None and 'normalized_function_name' not in already_processed: already_processed.add('normalized_function_name') - outfile.write(' normalized_function_name=%s' % (self.gds_format_string(quote_attrib(self.normalized_function_name).encode(ExternalEncoding), input_name='normalized_function_name'), )) + write(' normalized_function_name=%s' % (self.gds_format_string(quote_attrib(self.normalized_function_name).encode(ExternalEncoding), input_name='normalized_function_name'), )) if self.function_name is not None and 'function_name' not in already_processed: already_processed.add('function_name') - outfile.write(' function_name=%s' % (self.gds_format_string(quote_attrib(self.function_name).encode(ExternalEncoding), input_name='function_name'), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='APICallType', fromsubclass_=False, pretty_print=True): + write(' function_name=%s' % (self.gds_format_string(quote_attrib(self.function_name).encode(ExternalEncoding), input_name='function_name'), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='APICallType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Address is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAddress>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Address).encode(ExternalEncoding), input_name='Address'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAddress>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Address).encode(ExternalEncoding), input_name='Address'), 'maecBundle:', eol_)) if self.Return_Value is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sReturn_Value>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Return_Value).encode(ExternalEncoding), input_name='Return_Value'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sReturn_Value>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Return_Value).encode(ExternalEncoding), input_name='Return_Value'), 'maecBundle:', eol_)) if self.Parameters is not None: - self.Parameters.export(outfile, level, 'maecBundle:', name_='Parameters', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='APICallType'): + self.Parameters.export(write, level, 'maecBundle:', name_='Parameters', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='APICallType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.normalized_function_name is not None and 'normalized_function_name' not in already_processed: already_processed.add('normalized_function_name') - showIndent(outfile, level) - outfile.write('normalized_function_name = "%s",\n' % (self.normalized_function_name,)) + showIndent(write, level) + write('normalized_function_name = "%s",\n' % (self.normalized_function_name,)) if self.function_name is not None and 'function_name' not in already_processed: already_processed.add('function_name') - showIndent(outfile, level) - outfile.write('function_name = "%s",\n' % (self.function_name,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('function_name = "%s",\n' % (self.function_name,)) + def exportLiteralChildren(self, write, level, name_): if self.Address is not None: - showIndent(outfile, level) - outfile.write('Address=%s,\n' % quote_python(self.Address).encode(ExternalEncoding)) + showIndent(write, level) + write('Address=%s,\n' % quote_python(self.Address).encode(ExternalEncoding)) if self.Return_Value is not None: - showIndent(outfile, level) - outfile.write('Return_Value=%s,\n' % quote_python(self.Return_Value).encode(ExternalEncoding)) + showIndent(write, level) + write('Return_Value=%s,\n' % quote_python(self.Return_Value).encode(ExternalEncoding)) if self.Parameters is not None: - outfile.write('Parameters=model_.ParameterListType(\n') - self.Parameters.exportLiteral(outfile, level, name_='Parameters') - outfile.write('),\n') + write('Parameters=model_.ParameterListType(\n') + self.Parameters.exportLiteral(write, level, name_='Parameters') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1192,75 +1192,75 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ActionImplementationType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ActionImplementationType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionImplementationType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionImplementationType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ActionImplementationType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ActionImplementationType'): if self.type_ is not None and 'type_' not in already_processed: already_processed.add('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) + write(' type=%s' % (quote_attrib(self.type_), )) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ActionImplementationType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionImplementationType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Compatible_Platforms is not None: - self.Compatible_Platforms.export(outfile, level, 'maecBundle:', name_='Compatible_Platforms', pretty_print=pretty_print) + self.Compatible_Platforms.export(write, level, 'maecBundle:', name_='Compatible_Platforms', pretty_print=pretty_print) if self.API_Call is not None: - self.API_Call.export(outfile, level, 'maecBundle:', name_='API_Call', pretty_print=pretty_print) + self.API_Call.export(write, level, 'maecBundle:', name_='API_Call', pretty_print=pretty_print) for Code_ in self.Code: - Code_.export(outfile, level, 'maecBundle:', name_='Code', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionImplementationType'): + Code_.export(write, level, 'maecBundle:', name_='Code', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionImplementationType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.add('type_') - showIndent(outfile, level) - outfile.write('type_ = %s,\n' % (self.type_,)) + showIndent(write, level) + write('type_ = %s,\n' % (self.type_,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.Compatible_Platforms is not None: - outfile.write('Compatible_Platforms=model_.PlatformListType(\n') - self.Compatible_Platforms.exportLiteral(outfile, level, name_='Compatible_Platforms') - outfile.write('),\n') + write('Compatible_Platforms=model_.PlatformListType(\n') + self.Compatible_Platforms.exportLiteral(write, level, name_='Compatible_Platforms') + write('),\n') if self.API_Call is not None: - outfile.write('API_Call=model_.APICallType(\n') - self.API_Call.exportLiteral(outfile, level, name_='API_Call') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Code=[\n') + write('API_Call=model_.APICallType(\n') + self.API_Call.exportLiteral(write, level, name_='API_Call') + write('),\n') + showIndent(write, level) + write('Code=[\n') level += 1 for Code_ in self.Code: - outfile.write('model_.code_object.CodeObjectType(\n') - Code_.exportLiteral(outfile, level, name_='code_object.CodeObjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.code_object.CodeObjectType(\n') + Code_.exportLiteral(write, level, name_='code_object.CodeObjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1320,49 +1320,49 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CVEVulnerabilityType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CVEVulnerabilityType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CVEVulnerabilityType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CVEVulnerabilityType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CVEVulnerabilityType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CVEVulnerabilityType'): if self.cve_id is not None and 'cve_id' not in already_processed: already_processed.add('cve_id') - outfile.write(' cve_id=%s' % (self.gds_format_string(quote_attrib(self.cve_id).encode(ExternalEncoding), input_name='cve_id'), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CVEVulnerabilityType', fromsubclass_=False, pretty_print=True): + write(' cve_id=%s' % (self.gds_format_string(quote_attrib(self.cve_id).encode(ExternalEncoding), input_name='cve_id'), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CVEVulnerabilityType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) - def exportLiteral(self, outfile, level, name_='CVEVulnerabilityType'): + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + def exportLiteral(self, write, level, name_='CVEVulnerabilityType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.cve_id is not None and 'cve_id' not in already_processed: already_processed.add('cve_id') - showIndent(outfile, level) - outfile.write('cve_id = "%s",\n' % (self.cve_id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('cve_id = "%s",\n' % (self.cve_id,)) + def exportLiteralChildren(self, write, level, name_): if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1417,65 +1417,65 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BaseCollectionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BaseCollectionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BaseCollectionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BaseCollectionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BaseCollectionType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BaseCollectionType'): if self.name is not None and 'name' not in already_processed: already_processed.add('name') - outfile.write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) + write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) if self.extensiontype_ is not None and 'xsi:type' not in already_processed: already_processed.add('xsi:type') - outfile.write(' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"') - outfile.write(' xsi:type="%s"' % self.extensiontype_) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BaseCollectionType', fromsubclass_=False, pretty_print=True): + write(' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"') + write(' xsi:type="%s"' % self.extensiontype_) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BaseCollectionType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Affinity_Type is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAffinity_Type>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Type).encode(ExternalEncoding), input_name='Affinity_Type'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAffinity_Type>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Type).encode(ExternalEncoding), input_name='Affinity_Type'), 'maecBundle:', eol_)) if self.Affinity_Degree is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAffinity_Degree>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Degree).encode(ExternalEncoding), input_name='Affinity_Degree'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAffinity_Degree>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Degree).encode(ExternalEncoding), input_name='Affinity_Degree'), 'maecBundle:', eol_)) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) - def exportLiteral(self, outfile, level, name_='BaseCollectionType'): + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + def exportLiteral(self, write, level, name_='BaseCollectionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.name is not None and 'name' not in already_processed: already_processed.add('name') - showIndent(outfile, level) - outfile.write('name = "%s",\n' % (self.name,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('name = "%s",\n' % (self.name,)) + def exportLiteralChildren(self, write, level, name_): if self.Affinity_Type is not None: - showIndent(outfile, level) - outfile.write('Affinity_Type=%s,\n' % quote_python(self.Affinity_Type).encode(ExternalEncoding)) + showIndent(write, level) + write('Affinity_Type=%s,\n' % quote_python(self.Affinity_Type).encode(ExternalEncoding)) if self.Affinity_Degree is not None: - showIndent(outfile, level) - outfile.write('Affinity_Degree=%s,\n' % quote_python(self.Affinity_Degree).encode(ExternalEncoding)) + showIndent(write, level) + write('Affinity_Degree=%s,\n' % quote_python(self.Affinity_Degree).encode(ExternalEncoding)) if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1538,56 +1538,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorRelationshipType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorRelationshipType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorRelationshipType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorRelationshipType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorRelationshipType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorRelationshipType'): if self.type_ is not None and 'type_' not in already_processed: already_processed.add('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorRelationshipType', fromsubclass_=False, pretty_print=True): + write(' type=%s' % (quote_attrib(self.type_), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorRelationshipType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Behavior_Reference_ in self.Behavior_Reference: - Behavior_Reference_.export(outfile, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorRelationshipType'): + Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorRelationshipType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.add('type_') - showIndent(outfile, level) - outfile.write('type_ = %s,\n' % (self.type_,)) - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Behavior_Reference=[\n') + showIndent(write, level) + write('type_ = %s,\n' % (self.type_,)) + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Behavior_Reference=[\n') level += 1 for Behavior_Reference_ in self.Behavior_Reference: - outfile.write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(outfile, level, name_='BehaviorReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorReferenceType(\n') + Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1633,51 +1633,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='AVClassificationsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='AVClassificationsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AVClassificationsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AVClassificationsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='AVClassificationsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='AVClassificationsType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='AVClassificationsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassificationsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for AV_Classification_ in self.AV_Classification: - AV_Classification_.export(outfile, level, 'maecBundle:', name_='AV_Classification', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AVClassificationsType'): + AV_Classification_.export(write, level, 'maecBundle:', name_='AV_Classification', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AVClassificationsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('AV_Classification=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('AV_Classification=[\n') level += 1 for AV_Classification_ in self.AV_Classification: - outfile.write('model_.AVClassificationType(\n') - AV_Classification_.exportLiteral(outfile, level, name_='AVClassificationType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.AVClassificationType(\n') + AV_Classification_.exportLiteral(write, level, name_='AVClassificationType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1725,53 +1725,53 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ParameterType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ParameterType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ParameterType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ParameterType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ParameterType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ParameterType'): if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - outfile.write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) + write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) if self.name is not None and 'name' not in already_processed: already_processed.add('name') - outfile.write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) + write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) if self.value is not None and 'value' not in already_processed: already_processed.add('value') - outfile.write(' value=%s' % (self.gds_format_string(quote_attrib(self.value).encode(ExternalEncoding), input_name='value'), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ParameterType', fromsubclass_=False, pretty_print=True): + write(' value=%s' % (self.gds_format_string(quote_attrib(self.value).encode(ExternalEncoding), input_name='value'), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ParameterType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='ParameterType'): + def exportLiteral(self, write, level, name_='ParameterType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - showIndent(outfile, level) - outfile.write('ordinal_position = %d,\n' % (self.ordinal_position,)) + showIndent(write, level) + write('ordinal_position = %d,\n' % (self.ordinal_position,)) if self.name is not None and 'name' not in already_processed: already_processed.add('name') - showIndent(outfile, level) - outfile.write('name = "%s",\n' % (self.name,)) + showIndent(write, level) + write('name = "%s",\n' % (self.name,)) if self.value is not None and 'value' not in already_processed: already_processed.add('value') - showIndent(outfile, level) - outfile.write('value = "%s",\n' % (self.value,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('value = "%s",\n' % (self.value,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -1827,51 +1827,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ParameterListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ParameterListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ParameterListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ParameterListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ParameterListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ParameterListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ParameterListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ParameterListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Parameter_ in self.Parameter: - Parameter_.export(outfile, level, 'maecBundle:', name_='Parameter', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ParameterListType'): + Parameter_.export(write, level, 'maecBundle:', name_='Parameter', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ParameterListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Parameter=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Parameter=[\n') level += 1 for Parameter_ in self.Parameter: - outfile.write('model_.ParameterType(\n') - Parameter_.exportLiteral(outfile, level, name_='ParameterType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ParameterType(\n') + Parameter_.exportLiteral(write, level, name_='ParameterType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1914,51 +1914,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='AssociatedCodeType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='AssociatedCodeType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AssociatedCodeType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AssociatedCodeType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='AssociatedCodeType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='AssociatedCodeType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='AssociatedCodeType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='AssociatedCodeType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Code_Snippet_ in self.Code_Snippet: - Code_Snippet_.export(outfile, level, 'maecBundle:', name_='Code_Snippet', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AssociatedCodeType'): + Code_Snippet_.export(write, level, 'maecBundle:', name_='Code_Snippet', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AssociatedCodeType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Code_Snippet=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Code_Snippet=[\n') level += 1 for Code_Snippet_ in self.Code_Snippet: - outfile.write('model_.code_object.CodeObjectType(\n') - Code_Snippet_.exportLiteral(outfile, level, name_='code_object.CodeObjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.code_object.CodeObjectType(\n') + Code_Snippet_.exportLiteral(write, level, name_='code_object.CodeObjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2000,50 +2000,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorPurposeType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorPurposeType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorPurposeType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorPurposeType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorPurposeType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorPurposeType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorPurposeType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorPurposeType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) if self.Vulnerability_Exploit is not None: - self.Vulnerability_Exploit.export(outfile, level, 'maecBundle:', name_='Vulnerability_Exploit', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorPurposeType'): + self.Vulnerability_Exploit.export(write, level, 'maecBundle:', name_='Vulnerability_Exploit', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorPurposeType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) if self.Vulnerability_Exploit is not None: - outfile.write('Vulnerability_Exploit=model_.ExploitType(\n') - self.Vulnerability_Exploit.exportLiteral(outfile, level, name_='Vulnerability_Exploit') - outfile.write('),\n') + write('Vulnerability_Exploit=model_.ExploitType(\n') + self.Vulnerability_Exploit.exportLiteral(write, level, name_='Vulnerability_Exploit') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2090,51 +2090,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='PlatformListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='PlatformListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='PlatformListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='PlatformListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='PlatformListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='PlatformListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='PlatformListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='PlatformListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Platform_ in self.Platform: - Platform_.export(outfile, level, 'maecBundle:', name_='Platform', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='PlatformListType'): + Platform_.export(write, level, 'maecBundle:', name_='Platform', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='PlatformListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Platform=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Platform=[\n') level += 1 for Platform_ in self.Platform: - outfile.write('model_.cybox_common.PlatformSpecificationType(\n') - Platform_.exportLiteral(outfile, level, name_='cybox_common.PlatformSpecificationType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_common.PlatformSpecificationType(\n') + Platform_.exportLiteral(write, level, name_='cybox_common.PlatformSpecificationType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2196,67 +2196,67 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ExploitType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ExploitType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ExploitType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ExploitType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ExploitType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ExploitType'): if self.known_vulnerability is not None and 'known_vulnerability' not in already_processed: already_processed.add('known_vulnerability') - outfile.write(' known_vulnerability="%s"' % self.gds_format_boolean(self.known_vulnerability, input_name='known_vulnerability')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ExploitType', fromsubclass_=False, pretty_print=True): + write(' known_vulnerability="%s"' % self.gds_format_boolean(self.known_vulnerability, input_name='known_vulnerability')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ExploitType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.CVE is not None: - self.CVE.export(outfile, level, 'maecBundle:', name_='CVE', pretty_print=pretty_print) + self.CVE.export(write, level, 'maecBundle:', name_='CVE', pretty_print=pretty_print) for CWE_ID_ in self.CWE_ID: - showIndent(outfile, level, pretty_print) - outfile.write('<%sCWE_ID>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(CWE_ID_).encode(ExternalEncoding), input_name='CWE_ID'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sCWE_ID>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(CWE_ID_).encode(ExternalEncoding), input_name='CWE_ID'), 'maecBundle:', eol_)) if self.Targeted_Platforms is not None: - self.Targeted_Platforms.export(outfile, level, 'maecBundle:', name_='Targeted_Platforms', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ExploitType'): + self.Targeted_Platforms.export(write, level, 'maecBundle:', name_='Targeted_Platforms', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ExploitType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.known_vulnerability is not None and 'known_vulnerability' not in already_processed: already_processed.add('known_vulnerability') - showIndent(outfile, level) - outfile.write('known_vulnerability = %s,\n' % (self.known_vulnerability,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('known_vulnerability = %s,\n' % (self.known_vulnerability,)) + def exportLiteralChildren(self, write, level, name_): if self.CVE is not None: - outfile.write('CVE=model_.CVEVulnerabilityType(\n') - self.CVE.exportLiteral(outfile, level, name_='CVE') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('CWE_ID=[\n') + write('CVE=model_.CVEVulnerabilityType(\n') + self.CVE.exportLiteral(write, level, name_='CVE') + write('),\n') + showIndent(write, level) + write('CWE_ID=[\n') level += 1 for CWE_ID_ in self.CWE_ID: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(CWE_ID_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(CWE_ID_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') if self.Targeted_Platforms is not None: - outfile.write('Targeted_Platforms=model_.PlatformListType(\n') - self.Targeted_Platforms.exportLiteral(outfile, level, name_='Targeted_Platforms') - outfile.write('),\n') + write('Targeted_Platforms=model_.PlatformListType(\n') + self.Targeted_Platforms.exportLiteral(write, level, name_='Targeted_Platforms') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2315,51 +2315,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorRelationshipListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorRelationshipListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorRelationshipListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorRelationshipListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorRelationshipListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorRelationshipListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorRelationshipListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorRelationshipListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Relationship_ in self.Relationship: - Relationship_.export(outfile, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorRelationshipListType'): + Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorRelationshipListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Relationship=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Relationship=[\n') level += 1 for Relationship_ in self.Relationship: - outfile.write('model_.BehaviorRelationshipType(\n') - Relationship_.exportLiteral(outfile, level, name_='BehaviorRelationshipType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorRelationshipType(\n') + Relationship_.exportLiteral(write, level, name_='BehaviorRelationshipType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2429,90 +2429,90 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehavioralActionsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionsType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_Collection_ in self.Action_Collection: - Action_Collection_.export(outfile, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) + Action_Collection_.export(write, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) for Action_ in self.Action: - Action_.export(outfile, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) + Action_.export(write, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) for Action_Reference_ in self.Action_Reference: - Action_Reference_.export(outfile, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) + Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) for Action_Equivalence_Reference_ in self.Action_Equivalence_Reference: - Action_Equivalence_Reference_.export(outfile, level, 'maecBundle:', name_='Action_Equivalence_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehavioralActionsType'): + Action_Equivalence_Reference_.export(write, level, 'maecBundle:', name_='Action_Equivalence_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehavioralActionsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action_Collection=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action_Collection=[\n') level += 1 for Action_Collection_ in self.Action_Collection: - outfile.write('model_.ActionCollectionType(\n') - Action_Collection_.exportLiteral(outfile, level, name_='ActionCollectionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ActionCollectionType(\n') + Action_Collection_.exportLiteral(write, level, name_='ActionCollectionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Action=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Action=[\n') level += 1 for Action_ in self.Action: - outfile.write('model_.BehavioralActionType(\n') - Action_.exportLiteral(outfile, level, name_='BehavioralActionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehavioralActionType(\n') + Action_.exportLiteral(write, level, name_='BehavioralActionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Action_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Action_Reference=[\n') level += 1 for Action_Reference_ in self.Action_Reference: - outfile.write('model_.BehavioralActionReferenceType(\n') - Action_Reference_.exportLiteral(outfile, level, name_='BehavioralActionReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehavioralActionReferenceType(\n') + Action_Reference_.exportLiteral(write, level, name_='BehavioralActionReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Action_Equivalence_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Action_Equivalence_Reference=[\n') level += 1 for Action_Equivalence_Reference_ in self.Action_Equivalence_Reference: - outfile.write('model_.BehavioralActionEquivalenceReferenceType(\n') - Action_Equivalence_Reference_.exportLiteral(outfile, level, name_='BehavioralActionEquivalenceReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehavioralActionEquivalenceReferenceType(\n') + Action_Equivalence_Reference_.exportLiteral(write, level, name_='BehavioralActionEquivalenceReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2566,51 +2566,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Behavior_ in self.Behavior: - Behavior_.export(outfile, level, 'maecBundle:', name_='Behavior', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorListType'): + Behavior_.export(write, level, 'maecBundle:', name_='Behavior', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Behavior=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Behavior=[\n') level += 1 for Behavior_ in self.Behavior: - outfile.write('model_.BehaviorType(\n') - Behavior_.exportLiteral(outfile, level, name_='BehaviorType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorType(\n') + Behavior_.exportLiteral(write, level, name_='BehaviorType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2652,51 +2652,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ActionListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ActionListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ActionListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ActionListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ActionListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_ in self.Action: - Action_.export(outfile, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionListType'): + Action_.export(write, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action=[\n') level += 1 for Action_ in self.Action: - outfile.write('model_.MalwareActionType(\n') - Action_.exportLiteral(outfile, level, name_='MalwareActionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareActionType(\n') + Action_.exportLiteral(write, level, name_='MalwareActionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2738,51 +2738,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ObjectListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ObjectListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ObjectListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ObjectListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ObjectListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Object_ in self.Object: - Object_.export(outfile, level, 'maecBundle:', name_='Object', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectListType'): + Object_.export(write, level, 'maecBundle:', name_='Object', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Object=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Object=[\n') level += 1 for Object_ in self.Object: - outfile.write('model_.cybox_core.ObjectType(\n') - Object_.exportLiteral(outfile, level, name_='cybox_core.ObjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_core.ObjectType(\n') + Object_.exportLiteral(write, level, name_='cybox_core.ObjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2823,39 +2823,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorReferenceType'): if self.behavior_idref is not None and 'behavior_idref' not in already_processed: already_processed.add('behavior_idref') - outfile.write(' behavior_idref=%s' % (quote_attrib(self.behavior_idref), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorReferenceType', fromsubclass_=False, pretty_print=True): + write(' behavior_idref=%s' % (quote_attrib(self.behavior_idref), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='BehaviorReferenceType'): + def exportLiteral(self, write, level, name_='BehaviorReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.behavior_idref is not None and 'behavior_idref' not in already_processed: already_processed.add('behavior_idref') - showIndent(outfile, level) - outfile.write('behavior_idref = %s,\n' % (self.behavior_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('behavior_idref = %s,\n' % (self.behavior_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -2897,39 +2897,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ObjectReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ObjectReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ObjectReferenceType'): if self.object_idref is not None and 'object_idref' not in already_processed: already_processed.add('object_idref') - outfile.write(' object_idref=%s' % (quote_attrib(self.object_idref), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ObjectReferenceType', fromsubclass_=False, pretty_print=True): + write(' object_idref=%s' % (quote_attrib(self.object_idref), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='ObjectReferenceType'): + def exportLiteral(self, write, level, name_='ObjectReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.object_idref is not None and 'object_idref' not in already_processed: already_processed.add('object_idref') - showIndent(outfile, level) - outfile.write('object_idref = %s,\n' % (self.object_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('object_idref = %s,\n' % (self.object_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -2982,46 +2982,46 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionEquivalenceReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionEquivalenceReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType'): if self.action_equivalence_idref is not None and 'action_equivalence_idref' not in already_processed: already_processed.add('action_equivalence_idref') - outfile.write(' action_equivalence_idref=%s' % (quote_attrib(self.action_equivalence_idref), )) + write(' action_equivalence_idref=%s' % (quote_attrib(self.action_equivalence_idref), )) if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - outfile.write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', fromsubclass_=False, pretty_print=True): + write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='BehavioralActionEquivalenceReferenceType'): + def exportLiteral(self, write, level, name_='BehavioralActionEquivalenceReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.action_equivalence_idref is not None and 'action_equivalence_idref' not in already_processed: already_processed.add('action_equivalence_idref') - showIndent(outfile, level) - outfile.write('action_equivalence_idref = %s,\n' % (self.action_equivalence_idref,)) + showIndent(write, level) + write('action_equivalence_idref = %s,\n' % (self.action_equivalence_idref,)) if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - showIndent(outfile, level) - outfile.write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -3074,51 +3074,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorReferenceListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorReferenceListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorReferenceListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorReferenceListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorReferenceListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorReferenceListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Behavior_Reference_ in self.Behavior_Reference: - Behavior_Reference_.export(outfile, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorReferenceListType'): + Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorReferenceListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Behavior_Reference=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Behavior_Reference=[\n') level += 1 for Behavior_Reference_ in self.Behavior_Reference: - outfile.write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(outfile, level, name_='BehaviorReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorReferenceType(\n') + Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3160,51 +3160,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ActionReferenceListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ActionReferenceListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionReferenceListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionReferenceListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ActionReferenceListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ActionReferenceListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ActionReferenceListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionReferenceListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_Reference_ in self.Action_Reference: - Action_Reference_.export(outfile, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionReferenceListType'): + Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionReferenceListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action_Reference=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action_Reference=[\n') level += 1 for Action_Reference_ in self.Action_Reference: - outfile.write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(outfile, level, name_='cybox_core.ActionReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_core.ActionReferenceType(\n') + Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3247,51 +3247,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ObjectReferenceListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectReferenceListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectReferenceListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ObjectReferenceListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ObjectReferenceListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ObjectReferenceListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Object_Reference_ in self.Object_Reference: - Object_Reference_.export(outfile, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectReferenceListType'): + Object_Reference_.export(write, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectReferenceListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Object_Reference=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Object_Reference=[\n') level += 1 for Object_Reference_ in self.Object_Reference: - outfile.write('model_.ObjectReferenceType(\n') - Object_Reference_.exportLiteral(outfile, level, name_='ObjectReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ObjectReferenceType(\n') + Object_Reference_.exportLiteral(write, level, name_='ObjectReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3370,100 +3370,100 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorType'): if self.version is not None and 'version' not in already_processed: already_processed.add('version') - outfile.write(' version=%s' % (self.gds_format_string(quote_attrib(self.version).encode(ExternalEncoding), input_name='version'), )) + write(' version=%s' % (self.gds_format_string(quote_attrib(self.version).encode(ExternalEncoding), input_name='version'), )) if self.creation_datetime is not None and 'creation_datetime' not in already_processed: already_processed.add('creation_datetime') - outfile.write(' creation_datetime="%s"' % self.gds_format_datetime(self.creation_datetime, input_name='creation_datetime')) + write(' creation_datetime="%s"' % self.gds_format_datetime(self.creation_datetime, input_name='creation_datetime')) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: already_processed.add('lastupdate_datetime') - outfile.write(' lastupdate_datetime="%s"' % self.gds_format_datetime(self.lastupdate_datetime, input_name='lastupdate_datetime')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorType', fromsubclass_=False, pretty_print=True): + write(' lastupdate_datetime="%s"' % self.gds_format_datetime(self.lastupdate_datetime, input_name='lastupdate_datetime')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Importance is not None: - self.Importance.export(outfile, level, 'maecBundle:', name_='Importance', pretty_print=pretty_print) + self.Importance.export(write, level, 'maecBundle:', name_='Importance', pretty_print=pretty_print) if self.Numeric_Importance is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sNumeric_Importance>%s%s' % ('maecBundle:', self.gds_format_integer(self.Numeric_Importance, input_name='Numeric_Importance'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sNumeric_Importance>%s%s' % ('maecBundle:', self.gds_format_integer(self.Numeric_Importance, input_name='Numeric_Importance'), 'maecBundle:', eol_)) if self.Author is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAuthor>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Author).encode(ExternalEncoding), input_name='Author'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAuthor>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Author).encode(ExternalEncoding), input_name='Author'), 'maecBundle:', eol_)) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) if self.Malware_Entity is not None: - self.Malware_Entity.export(outfile, level, 'maecBundle:', name_='Malware_Entity', pretty_print=pretty_print) + self.Malware_Entity.export(write, level, 'maecBundle:', name_='Malware_Entity', pretty_print=pretty_print) if self.Composition is not None: - self.Composition.export(outfile, level, 'maecBundle:', name_='Composition', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CandidateIndicatorType'): + self.Composition.export(write, level, 'maecBundle:', name_='Composition', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CandidateIndicatorType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.version is not None and 'version' not in already_processed: already_processed.add('version') - showIndent(outfile, level) - outfile.write('version = "%s",\n' % (self.version,)) + showIndent(write, level) + write('version = "%s",\n' % (self.version,)) if self.creation_datetime is not None and 'creation_datetime' not in already_processed: already_processed.add('creation_datetime') - showIndent(outfile, level) - outfile.write('creation_datetime = "%s",\n' % (self.creation_datetime,)) + showIndent(write, level) + write('creation_datetime = "%s",\n' % (self.creation_datetime,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: already_processed.add('lastupdate_datetime') - showIndent(outfile, level) - outfile.write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) + def exportLiteralChildren(self, write, level, name_): if self.Importance is not None: - outfile.write('Importance=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Importance.exportLiteral(outfile, level, name_='Importance') - outfile.write('),\n') + write('Importance=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Importance.exportLiteral(write, level, name_='Importance') + write('),\n') if self.Numeric_Importance is not None: - showIndent(outfile, level) - outfile.write('Numeric_Importance=%d,\n' % self.Numeric_Importance) + showIndent(write, level) + write('Numeric_Importance=%d,\n' % self.Numeric_Importance) if self.Author is not None: - showIndent(outfile, level) - outfile.write('Author=%s,\n' % quote_python(self.Author).encode(ExternalEncoding)) + showIndent(write, level) + write('Author=%s,\n' % quote_python(self.Author).encode(ExternalEncoding)) if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) if self.Malware_Entity is not None: - outfile.write('Malware_Entity=model_.MalwareEntityType(\n') - self.Malware_Entity.exportLiteral(outfile, level, name_='Malware_Entity') - outfile.write('),\n') + write('Malware_Entity=model_.MalwareEntityType(\n') + self.Malware_Entity.exportLiteral(write, level, name_='Malware_Entity') + write('),\n') if self.Composition is not None: - outfile.write('Composition=model_.CandidateIndicatorCompositionType(\n') - self.Composition.exportLiteral(outfile, level, name_='Composition') - outfile.write('),\n') + write('Composition=model_.CandidateIndicatorCompositionType(\n') + self.Composition.exportLiteral(write, level, name_='Composition') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3553,51 +3553,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Candidate_Indicator_ in self.Candidate_Indicator: - Candidate_Indicator_.export(outfile, level, 'maecBundle:', name_='Candidate_Indicator', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CandidateIndicatorListType'): + Candidate_Indicator_.export(write, level, 'maecBundle:', name_='Candidate_Indicator', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CandidateIndicatorListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Candidate_Indicator=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Candidate_Indicator=[\n') level += 1 for Candidate_Indicator_ in self.Candidate_Indicator: - outfile.write('model_.CandidateIndicatorType(\n') - Candidate_Indicator_.exportLiteral(outfile, level, name_='CandidateIndicatorType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CandidateIndicatorType(\n') + Candidate_Indicator_.exportLiteral(write, level, name_='CandidateIndicatorType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3645,56 +3645,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='MalwareEntityType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='MalwareEntityType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareEntityType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareEntityType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='MalwareEntityType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='MalwareEntityType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='MalwareEntityType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareEntityType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Type is not None: - self.Type.export(outfile, level, 'maecBundle:', name_='Type', pretty_print=pretty_print) + self.Type.export(write, level, 'maecBundle:', name_='Type', pretty_print=pretty_print) if self.Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sName>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sName>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecBundle:', eol_)) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) - def exportLiteral(self, outfile, level, name_='MalwareEntityType'): + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + def exportLiteral(self, write, level, name_='MalwareEntityType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Type is not None: - outfile.write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(outfile, level, name_='Type') - outfile.write('),\n') + write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Type.exportLiteral(write, level, name_='Type') + write('),\n') if self.Name is not None: - showIndent(outfile, level) - outfile.write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3752,62 +3752,62 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CollectionsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CollectionsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CollectionsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CollectionsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CollectionsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CollectionsType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CollectionsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CollectionsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Behavior_Collections is not None: - self.Behavior_Collections.export(outfile, level, 'maecBundle:', name_='Behavior_Collections', pretty_print=pretty_print) + self.Behavior_Collections.export(write, level, 'maecBundle:', name_='Behavior_Collections', pretty_print=pretty_print) if self.Action_Collections is not None: - self.Action_Collections.export(outfile, level, 'maecBundle:', name_='Action_Collections', pretty_print=pretty_print) + self.Action_Collections.export(write, level, 'maecBundle:', name_='Action_Collections', pretty_print=pretty_print) if self.Object_Collections is not None: - self.Object_Collections.export(outfile, level, 'maecBundle:', name_='Object_Collections', pretty_print=pretty_print) + self.Object_Collections.export(write, level, 'maecBundle:', name_='Object_Collections', pretty_print=pretty_print) if self.Candidate_Indicator_Collections is not None: - self.Candidate_Indicator_Collections.export(outfile, level, 'maecBundle:', name_='Candidate_Indicator_Collections', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CollectionsType'): + self.Candidate_Indicator_Collections.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collections', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CollectionsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Behavior_Collections is not None: - outfile.write('Behavior_Collections=model_.BehaviorCollectionListType(\n') - self.Behavior_Collections.exportLiteral(outfile, level, name_='Behavior_Collections') - outfile.write('),\n') + write('Behavior_Collections=model_.BehaviorCollectionListType(\n') + self.Behavior_Collections.exportLiteral(write, level, name_='Behavior_Collections') + write('),\n') if self.Action_Collections is not None: - outfile.write('Action_Collections=model_.ActionCollectionListType(\n') - self.Action_Collections.exportLiteral(outfile, level, name_='Action_Collections') - outfile.write('),\n') + write('Action_Collections=model_.ActionCollectionListType(\n') + self.Action_Collections.exportLiteral(write, level, name_='Action_Collections') + write('),\n') if self.Object_Collections is not None: - outfile.write('Object_Collections=model_.ObjectCollectionListType(\n') - self.Object_Collections.exportLiteral(outfile, level, name_='Object_Collections') - outfile.write('),\n') + write('Object_Collections=model_.ObjectCollectionListType(\n') + self.Object_Collections.exportLiteral(write, level, name_='Object_Collections') + write('),\n') if self.Candidate_Indicator_Collections is not None: - outfile.write('Candidate_Indicator_Collections=model_.CandidateIndicatorCollectionListType(\n') - self.Candidate_Indicator_Collections.exportLiteral(outfile, level, name_='Candidate_Indicator_Collections') - outfile.write('),\n') + write('Candidate_Indicator_Collections=model_.CandidateIndicatorCollectionListType(\n') + self.Candidate_Indicator_Collections.exportLiteral(write, level, name_='Candidate_Indicator_Collections') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3859,39 +3859,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BundleReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BundleReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BundleReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BundleReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BundleReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BundleReferenceType'): if self.bundle_idref is not None and 'bundle_idref' not in already_processed: already_processed.add('bundle_idref') - outfile.write(' bundle_idref=%s' % (quote_attrib(self.bundle_idref), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BundleReferenceType', fromsubclass_=False, pretty_print=True): + write(' bundle_idref=%s' % (quote_attrib(self.bundle_idref), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BundleReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='BundleReferenceType'): + def exportLiteral(self, write, level, name_='BundleReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.bundle_idref is not None and 'bundle_idref' not in already_processed: already_processed.add('bundle_idref') - showIndent(outfile, level) - outfile.write('bundle_idref = %s,\n' % (self.bundle_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('bundle_idref = %s,\n' % (self.bundle_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -3931,44 +3931,44 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ProcessTreeType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ProcessTreeType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ProcessTreeType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ProcessTreeType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ProcessTreeType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ProcessTreeType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ProcessTreeType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessTreeType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Root_Process is not None: - self.Root_Process.export(outfile, level, 'maecBundle:', name_='Root_Process', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ProcessTreeType'): + self.Root_Process.export(write, level, 'maecBundle:', name_='Root_Process', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ProcessTreeType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Root_Process is not None: - outfile.write('Root_Process=model_.ProcessTreeNodeType(\n') - self.Root_Process.exportLiteral(outfile, level, name_='Root_Process') - outfile.write('),\n') + write('Root_Process=model_.ProcessTreeNodeType(\n') + self.Root_Process.exportLiteral(write, level, name_='Root_Process') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4044,95 +4044,95 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorCompositionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorCompositionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType'): if self.operator is not None and 'operator' not in already_processed: already_processed.add('operator') - outfile.write(' operator=%s' % (quote_attrib(self.operator), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType', fromsubclass_=False, pretty_print=True): + write(' operator=%s' % (quote_attrib(self.operator), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCompositionType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Behavior_Reference_ in self.Behavior_Reference: - Behavior_Reference_.export(outfile, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) + Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) for Action_Reference_ in self.Action_Reference: - Action_Reference_.export(outfile, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) + Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) for Object_Reference_ in self.Object_Reference: - Object_Reference_.export(outfile, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) + Object_Reference_.export(write, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) for Sub_Composition_ in self.Sub_Composition: - Sub_Composition_.export(outfile, level, 'maecBundle:', name_='Sub_Composition', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CandidateIndicatorCompositionType'): + Sub_Composition_.export(write, level, 'maecBundle:', name_='Sub_Composition', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CandidateIndicatorCompositionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.operator is not None and 'operator' not in already_processed: already_processed.add('operator') - showIndent(outfile, level) - outfile.write('operator = %s,\n' % (self.operator,)) - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Behavior_Reference=[\n') + showIndent(write, level) + write('operator = %s,\n' % (self.operator,)) + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Behavior_Reference=[\n') level += 1 for Behavior_Reference_ in self.Behavior_Reference: - outfile.write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(outfile, level, name_='BehaviorReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorReferenceType(\n') + Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Action_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Action_Reference=[\n') level += 1 for Action_Reference_ in self.Action_Reference: - outfile.write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(outfile, level, name_='cybox_core.ActionReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_core.ActionReferenceType(\n') + Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Object_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Object_Reference=[\n') level += 1 for Object_Reference_ in self.Object_Reference: - outfile.write('model_.ObjectReferenceType(\n') - Object_Reference_.exportLiteral(outfile, level, name_='ObjectReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ObjectReferenceType(\n') + Object_Reference_.exportLiteral(write, level, name_='ObjectReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Sub_Composition=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Sub_Composition=[\n') level += 1 for Sub_Composition_ in self.Sub_Composition: - outfile.write('model_.CandidateIndicatorCompositionType(\n') - Sub_Composition_.exportLiteral(outfile, level, name_='CandidateIndicatorCompositionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CandidateIndicatorCompositionType(\n') + Sub_Composition_.exportLiteral(write, level, name_='CandidateIndicatorCompositionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4193,53 +4193,53 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorCollectionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorCollectionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType'): - super(CandidateIndicatorCollectionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorCollectionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType'): + super(CandidateIndicatorCollectionType, self).exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorCollectionType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType', fromsubclass_=False, pretty_print=True): - super(CandidateIndicatorCollectionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionType', fromsubclass_=False, pretty_print=True): + super(CandidateIndicatorCollectionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Candidate_Indicator_List is not None: - self.Candidate_Indicator_List.export(outfile, level, 'maecBundle:', name_='Candidate_Indicator_List', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CandidateIndicatorCollectionType'): + self.Candidate_Indicator_List.export(write, level, 'maecBundle:', name_='Candidate_Indicator_List', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CandidateIndicatorCollectionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - super(CandidateIndicatorCollectionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(CandidateIndicatorCollectionType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + super(CandidateIndicatorCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(CandidateIndicatorCollectionType, self).exportLiteralChildren(write, level, name_) if self.Candidate_Indicator_List is not None: - outfile.write('Candidate_Indicator_List=model_.CandidateIndicatorListType(\n') - self.Candidate_Indicator_List.exportLiteral(outfile, level, name_='Candidate_Indicator_List') - outfile.write('),\n') + write('Candidate_Indicator_List=model_.CandidateIndicatorListType(\n') + self.Candidate_Indicator_List.exportLiteral(write, level, name_='Candidate_Indicator_List') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4287,51 +4287,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CandidateIndicatorCollectionListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CandidateIndicatorCollectionListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CandidateIndicatorCollectionListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Candidate_Indicator_Collection_ in self.Candidate_Indicator_Collection: - Candidate_Indicator_Collection_.export(outfile, level, 'maecBundle:', name_='Candidate_Indicator_Collection', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CandidateIndicatorCollectionListType'): + Candidate_Indicator_Collection_.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collection', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CandidateIndicatorCollectionListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Candidate_Indicator_Collection=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Candidate_Indicator_Collection=[\n') level += 1 for Candidate_Indicator_Collection_ in self.Candidate_Indicator_Collection: - outfile.write('model_.CandidateIndicatorCollectionType(\n') - Candidate_Indicator_Collection_.exportLiteral(outfile, level, name_='CandidateIndicatorCollectionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CandidateIndicatorCollectionType(\n') + Candidate_Indicator_Collection_.exportLiteral(write, level, name_='CandidateIndicatorCollectionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4374,51 +4374,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorCollectionListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorCollectionListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorCollectionListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorCollectionListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorCollectionListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorCollectionListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorCollectionListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorCollectionListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Behavior_Collection_ in self.Behavior_Collection: - Behavior_Collection_.export(outfile, level, 'maecBundle:', name_='Behavior_Collection', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorCollectionListType'): + Behavior_Collection_.export(write, level, 'maecBundle:', name_='Behavior_Collection', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorCollectionListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Behavior_Collection=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Behavior_Collection=[\n') level += 1 for Behavior_Collection_ in self.Behavior_Collection: - outfile.write('model_.BehaviorCollectionType(\n') - Behavior_Collection_.exportLiteral(outfile, level, name_='BehaviorCollectionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorCollectionType(\n') + Behavior_Collection_.exportLiteral(write, level, name_='BehaviorCollectionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4460,51 +4460,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ActionCollectionListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ActionCollectionListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionCollectionListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionCollectionListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ActionCollectionListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ActionCollectionListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ActionCollectionListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCollectionListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_Collection_ in self.Action_Collection: - Action_Collection_.export(outfile, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionCollectionListType'): + Action_Collection_.export(write, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionCollectionListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action_Collection=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action_Collection=[\n') level += 1 for Action_Collection_ in self.Action_Collection: - outfile.write('model_.ActionCollectionType(\n') - Action_Collection_.exportLiteral(outfile, level, name_='ActionCollectionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ActionCollectionType(\n') + Action_Collection_.exportLiteral(write, level, name_='ActionCollectionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4546,51 +4546,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ObjectCollectionListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ObjectCollectionListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectCollectionListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectCollectionListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ObjectCollectionListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ObjectCollectionListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ObjectCollectionListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCollectionListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Object_Collection_ in self.Object_Collection: - Object_Collection_.export(outfile, level, 'maecBundle:', name_='Object_Collection', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectCollectionListType'): + Object_Collection_.export(write, level, 'maecBundle:', name_='Object_Collection', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectCollectionListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Object_Collection=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Object_Collection=[\n') level += 1 for Object_Collection_ in self.Object_Collection: - outfile.write('model_.ObjectCollectionType(\n') - Object_Collection_.exportLiteral(outfile, level, name_='ObjectCollectionType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ObjectCollectionType(\n') + Object_Collection_.exportLiteral(write, level, name_='ObjectCollectionType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4639,58 +4639,58 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='AVClassificationType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='AVClassificationType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AVClassificationType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AVClassificationType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='AVClassificationType'): - super(AVClassificationType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='AVClassificationType') - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='AVClassificationType', fromsubclass_=False, pretty_print=True): - super(AVClassificationType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='AVClassificationType'): + super(AVClassificationType, self).exportAttributes(write, level, already_processed, namespace_, name_='AVClassificationType') + def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassificationType', fromsubclass_=False, pretty_print=True): + super(AVClassificationType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Engine_Version is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sEngine_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Engine_Version).encode(ExternalEncoding), input_name='Engine_Version'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sEngine_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Engine_Version).encode(ExternalEncoding), input_name='Engine_Version'), 'maecBundle:', eol_)) if self.Definition_Version is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDefinition_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Definition_Version).encode(ExternalEncoding), input_name='Definition_Version'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDefinition_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Definition_Version).encode(ExternalEncoding), input_name='Definition_Version'), 'maecBundle:', eol_)) if self.Classification_Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sClassification_Name>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Classification_Name).encode(ExternalEncoding), input_name='Classification_Name'), 'maecBundle:', eol_)) - def exportLiteral(self, outfile, level, name_='AVClassificationType'): + showIndent(write, level, pretty_print) + write('<%sClassification_Name>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Classification_Name).encode(ExternalEncoding), input_name='Classification_Name'), 'maecBundle:', eol_)) + def exportLiteral(self, write, level, name_='AVClassificationType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): - super(AVClassificationType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(AVClassificationType, self).exportLiteralChildren(outfile, level, name_) + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): + super(AVClassificationType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(AVClassificationType, self).exportLiteralChildren(write, level, name_) if self.Engine_Version is not None: - showIndent(outfile, level) - outfile.write('Engine_Version=%s,\n' % quote_python(self.Engine_Version).encode(ExternalEncoding)) + showIndent(write, level) + write('Engine_Version=%s,\n' % quote_python(self.Engine_Version).encode(ExternalEncoding)) if self.Definition_Version is not None: - showIndent(outfile, level) - outfile.write('Definition_Version=%s,\n' % quote_python(self.Definition_Version).encode(ExternalEncoding)) + showIndent(write, level) + write('Definition_Version=%s,\n' % quote_python(self.Definition_Version).encode(ExternalEncoding)) if self.Classification_Name is not None: - showIndent(outfile, level) - outfile.write('Classification_Name=%s,\n' % quote_python(self.Classification_Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Classification_Name=%s,\n' % quote_python(self.Classification_Name).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4771,89 +4771,89 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ProcessTreeNodeType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ProcessTreeNodeType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ProcessTreeNodeType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ProcessTreeNodeType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ProcessTreeNodeType'): - super(ProcessTreeNodeType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='ProcessTreeNodeType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ProcessTreeNodeType'): + super(ProcessTreeNodeType, self).exportAttributes(write, level, already_processed, namespace_, name_='ProcessTreeNodeType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.parent_action_idref is not None and 'parent_action_idref' not in already_processed: already_processed.add('parent_action_idref') - outfile.write(' parent_action_idref=%s' % (quote_attrib(self.parent_action_idref), )) + write(' parent_action_idref=%s' % (quote_attrib(self.parent_action_idref), )) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - outfile.write(' ordinal_position=%s' % (quote_attrib(self.ordinal_position), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ProcessTreeNodeType', fromsubclass_=False, pretty_print=True): - super(ProcessTreeNodeType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' ordinal_position=%s' % (quote_attrib(self.ordinal_position), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessTreeNodeType', fromsubclass_=False, pretty_print=True): + super(ProcessTreeNodeType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Initiated_Actions is not None: - self.Initiated_Actions.export(outfile, level, 'maecBundle:', name_='Initiated_Actions', pretty_print=pretty_print) + self.Initiated_Actions.export(write, level, 'maecBundle:', name_='Initiated_Actions', pretty_print=pretty_print) for Spawned_Process_ in self.Spawned_Process: - Spawned_Process_.export(outfile, level, 'maecBundle:', name_='Spawned_Process', pretty_print=pretty_print) + Spawned_Process_.export(write, level, 'maecBundle:', name_='Spawned_Process', pretty_print=pretty_print) for Injected_Process_ in self.Injected_Process: - Injected_Process_.export(outfile, level, 'maecBundle:', name_='Injected_Process', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ProcessTreeNodeType'): + Injected_Process_.export(write, level, 'maecBundle:', name_='Injected_Process', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ProcessTreeNodeType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.parent_action_idref is not None and 'parent_action_idref' not in already_processed: already_processed.add('parent_action_idref') - showIndent(outfile, level) - outfile.write('parent_action_idref = %s,\n' % (self.parent_action_idref,)) - super(ProcessTreeNodeType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(ProcessTreeNodeType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('parent_action_idref = %s,\n' % (self.parent_action_idref,)) + super(ProcessTreeNodeType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(ProcessTreeNodeType, self).exportLiteralChildren(write, level, name_) if self.Initiated_Actions is not None: - outfile.write('Initiated_Actions=model_.ActionReferenceListType(\n') - self.Initiated_Actions.exportLiteral(outfile, level, name_='Initiated_Actions') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Spawned_Process=[\n') + write('Initiated_Actions=model_.ActionReferenceListType(\n') + self.Initiated_Actions.exportLiteral(write, level, name_='Initiated_Actions') + write('),\n') + showIndent(write, level) + write('Spawned_Process=[\n') level += 1 for Spawned_Process_ in self.Spawned_Process: - outfile.write('model_.ProcessTreeNodeType(\n') - Spawned_Process_.exportLiteral(outfile, level, name_='ProcessTreeNodeType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ProcessTreeNodeType(\n') + Spawned_Process_.exportLiteral(write, level, name_='ProcessTreeNodeType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Injected_Process=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Injected_Process=[\n') level += 1 for Injected_Process_ in self.Injected_Process: - outfile.write('model_.ProcessTreeNodeType(\n') - Injected_Process_.exportLiteral(outfile, level, name_='ProcessTreeNodeType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ProcessTreeNodeType(\n') + Injected_Process_.exportLiteral(write, level, name_='ProcessTreeNodeType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4918,43 +4918,43 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehavioralActionReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionReferenceType'): - super(BehavioralActionReferenceType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionReferenceType') + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionReferenceType'): + super(BehavioralActionReferenceType, self).exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionReferenceType') if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - outfile.write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionReferenceType', fromsubclass_=False, pretty_print=True): - super(BehavioralActionReferenceType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionReferenceType', fromsubclass_=False, pretty_print=True): + super(BehavioralActionReferenceType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) pass - def exportLiteral(self, outfile, level, name_='BehavioralActionReferenceType'): + def exportLiteral(self, write, level, name_='BehavioralActionReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - showIndent(outfile, level) - outfile.write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - super(BehavioralActionReferenceType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(BehavioralActionReferenceType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) + super(BehavioralActionReferenceType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(BehavioralActionReferenceType, self).exportLiteralChildren(write, level, name_) pass def build(self, node): already_processed = set() @@ -5009,53 +5009,53 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ObjectCollectionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ObjectCollectionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectCollectionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectCollectionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ObjectCollectionType'): - super(ObjectCollectionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectCollectionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ObjectCollectionType'): + super(ObjectCollectionType, self).exportAttributes(write, level, already_processed, namespace_, name_='ObjectCollectionType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ObjectCollectionType', fromsubclass_=False, pretty_print=True): - super(ObjectCollectionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCollectionType', fromsubclass_=False, pretty_print=True): + super(ObjectCollectionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Object_List is not None: - self.Object_List.export(outfile, level, 'maecBundle:', name_='Object_List', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectCollectionType'): + self.Object_List.export(write, level, 'maecBundle:', name_='Object_List', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectCollectionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - super(ObjectCollectionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(ObjectCollectionType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + super(ObjectCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(ObjectCollectionType, self).exportLiteralChildren(write, level, name_) if self.Object_List is not None: - outfile.write('Object_List=model_.ObjectListType(\n') - self.Object_List.exportLiteral(outfile, level, name_='Object_List') - outfile.write('),\n') + write('Object_List=model_.ObjectListType(\n') + self.Object_List.exportLiteral(write, level, name_='Object_List') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5108,53 +5108,53 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='ActionCollectionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='ActionCollectionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionCollectionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionCollectionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='ActionCollectionType'): - super(ActionCollectionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='ActionCollectionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='ActionCollectionType'): + super(ActionCollectionType, self).exportAttributes(write, level, already_processed, namespace_, name_='ActionCollectionType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='ActionCollectionType', fromsubclass_=False, pretty_print=True): - super(ActionCollectionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCollectionType', fromsubclass_=False, pretty_print=True): + super(ActionCollectionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Action_List is not None: - self.Action_List.export(outfile, level, 'maecBundle:', name_='Action_List', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionCollectionType'): + self.Action_List.export(write, level, 'maecBundle:', name_='Action_List', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionCollectionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - super(ActionCollectionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(ActionCollectionType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + super(ActionCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(ActionCollectionType, self).exportLiteralChildren(write, level, name_) if self.Action_List is not None: - outfile.write('Action_List=model_.ActionListType(\n') - self.Action_List.exportLiteral(outfile, level, name_='Action_List') - outfile.write('),\n') + write('Action_List=model_.ActionListType(\n') + self.Action_List.exportLiteral(write, level, name_='Action_List') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5208,57 +5208,57 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehaviorCollectionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehaviorCollectionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorCollectionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehaviorCollectionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehaviorCollectionType'): - super(BehaviorCollectionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='BehaviorCollectionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehaviorCollectionType'): + super(BehaviorCollectionType, self).exportAttributes(write, level, already_processed, namespace_, name_='BehaviorCollectionType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehaviorCollectionType', fromsubclass_=False, pretty_print=True): - super(BehaviorCollectionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorCollectionType', fromsubclass_=False, pretty_print=True): + super(BehaviorCollectionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Purpose is not None: - outfile.write('<%sPurpose>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Purpose).encode(ExternalEncoding), input_name='Purpose'), 'maecBundle:', eol_)) + write('<%sPurpose>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Purpose).encode(ExternalEncoding), input_name='Purpose'), 'maecBundle:', eol_)) if self.Behavior_List is not None: - self.Behavior_List.export(outfile, level, 'maecBundle:', name_='Behavior_List', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehaviorCollectionType'): + self.Behavior_List.export(write, level, 'maecBundle:', name_='Behavior_List', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehaviorCollectionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - super(BehaviorCollectionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(BehaviorCollectionType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + super(BehaviorCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(BehaviorCollectionType, self).exportLiteralChildren(write, level, name_) if self.Purpose is not None: - outfile.write('Purpose=%s,\n' % quote_python(self.Purpose).encode(ExternalEncoding)) + write('Purpose=%s,\n' % quote_python(self.Purpose).encode(ExternalEncoding)) if self.Behavior_List is not None: - outfile.write('Behavior_List=model_.BehaviorListType(\n') - self.Behavior_List.exportLiteral(outfile, level, name_='Behavior_List') - outfile.write('),\n') + write('Behavior_List=model_.BehaviorListType(\n') + self.Behavior_List.exportLiteral(write, level, name_='Behavior_List') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5320,50 +5320,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='MalwareActionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='MalwareActionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareActionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareActionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='MalwareActionType'): - super(MalwareActionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareActionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='MalwareActionType'): + super(MalwareActionType, self).exportAttributes(write, level, already_processed, namespace_, name_='MalwareActionType') if self.extensiontype_ is not None and 'xsi:type' not in already_processed: already_processed.add('xsi:type') - outfile.write(' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"') - outfile.write(' xsi:type="%s"' % self.extensiontype_) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='MalwareActionType', fromsubclass_=False, pretty_print=True): - super(MalwareActionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + write(' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"') + write(' xsi:type="%s"' % self.extensiontype_) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareActionType', fromsubclass_=False, pretty_print=True): + super(MalwareActionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Implementation is not None: - self.Implementation.export(outfile, level, 'maecBundle:', name_='Implementation', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareActionType'): + self.Implementation.export(write, level, 'maecBundle:', name_='Implementation', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareActionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): - super(MalwareActionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(MalwareActionType, self).exportLiteralChildren(outfile, level, name_) + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): + super(MalwareActionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(MalwareActionType, self).exportLiteralChildren(write, level, name_) if self.Implementation is not None: - outfile.write('Implementation=model_.ActionImplementationType(\n') - self.Implementation.exportLiteral(outfile, level, name_='Implementation') - outfile.write('),\n') + write('Implementation=model_.ActionImplementationType(\n') + self.Implementation.exportLiteral(write, level, name_='Implementation') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5411,43 +5411,43 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='BehavioralActionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionType'): - super(BehavioralActionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='BehavioralActionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BehavioralActionType'): + super(BehavioralActionType, self).exportAttributes(write, level, already_processed, namespace_, name_='BehavioralActionType') if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - outfile.write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='BehavioralActionType', fromsubclass_=False, pretty_print=True): - super(BehavioralActionType, self).exportChildren(outfile, level, 'maecBundle:', name_, True, pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='BehavioralActionType'): + write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionType', fromsubclass_=False, pretty_print=True): + super(BehavioralActionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='BehavioralActionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: already_processed.add('behavioral_ordering') - showIndent(outfile, level) - outfile.write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - super(BehavioralActionType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(BehavioralActionType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) + super(BehavioralActionType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(BehavioralActionType, self).exportLiteralChildren(write, level, name_) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5548,121 +5548,121 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityType'): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.name is not None and 'name' not in already_processed: already_processed.add('name') - outfile.write(' name=%s' % (quote_attrib(self.name), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityType', fromsubclass_=False, pretty_print=True): + write(' name=%s' % (quote_attrib(self.name), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) for Property_ in self.Property: - Property_.export(outfile, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) + Property_.export(write, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) for Strategic_Objective_ in self.Strategic_Objective: - Strategic_Objective_.export(outfile, level, 'maecBundle:', name_='Strategic_Objective', pretty_print=pretty_print) + Strategic_Objective_.export(write, level, 'maecBundle:', name_='Strategic_Objective', pretty_print=pretty_print) for Tactical_Objective_ in self.Tactical_Objective: - Tactical_Objective_.export(outfile, level, 'maecBundle:', name_='Tactical_Objective', pretty_print=pretty_print) + Tactical_Objective_.export(write, level, 'maecBundle:', name_='Tactical_Objective', pretty_print=pretty_print) for Behavior_Reference_ in self.Behavior_Reference: - Behavior_Reference_.export(outfile, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) + Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) for Relationship_ in self.Relationship: - Relationship_.export(outfile, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityType'): + Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.name is not None and 'name' not in already_processed: already_processed.add('name') - showIndent(outfile, level) - outfile.write('name = %s,\n' % (self.name,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('name = %s,\n' % (self.name,)) + def exportLiteralChildren(self, write, level, name_): if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('Property=[\n') + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Property=[\n') level += 1 for Property_ in self.Property: - outfile.write('model_.CapabilityPropertyType(\n') - Property_.exportLiteral(outfile, level, name_='CapabilityPropertyType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityPropertyType(\n') + Property_.exportLiteral(write, level, name_='CapabilityPropertyType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Strategic_Objective=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Strategic_Objective=[\n') level += 1 for Strategic_Objective_ in self.Strategic_Objective: - outfile.write('model_.CapabilityObjectiveType(\n') - Strategic_Objective_.exportLiteral(outfile, level, name_='CapabilityObjectiveType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityObjectiveType(\n') + Strategic_Objective_.exportLiteral(write, level, name_='CapabilityObjectiveType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Tactical_Objective=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Tactical_Objective=[\n') level += 1 for Tactical_Objective_ in self.Tactical_Objective: - outfile.write('model_.CapabilityObjectiveType(\n') - Tactical_Objective_.exportLiteral(outfile, level, name_='CapabilityObjectiveType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityObjectiveType(\n') + Tactical_Objective_.exportLiteral(write, level, name_='CapabilityObjectiveType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Behavior_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Behavior_Reference=[\n') level += 1 for Behavior_Reference_ in self.Behavior_Reference: - outfile.write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(outfile, level, name_='BehaviorReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorReferenceType(\n') + Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Relationship=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Relationship=[\n') level += 1 for Relationship_ in self.Relationship: - outfile.write('model_.CapabilityRelationshipType(\n') - Relationship_.exportLiteral(outfile, level, name_='CapabilityRelationshipType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityRelationshipType(\n') + Relationship_.exportLiteral(write, level, name_='CapabilityRelationshipType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5740,57 +5740,57 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityListType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Capability_ in self.Capability: - Capability_.export(outfile, level, 'maecBundle:', name_='Capability', pretty_print=pretty_print) + Capability_.export(write, level, 'maecBundle:', name_='Capability', pretty_print=pretty_print) for Capability_Reference_ in self.Capability_Reference: - Capability_Reference_.export(outfile, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityListType'): + Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Capability is not None: - outfile.write('Capability=model_.CapabilityType(\n') - self.Capability.exportLiteral(outfile, level, name_='Capability') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Capability_Reference=[\n') + write('Capability=model_.CapabilityType(\n') + self.Capability.exportLiteral(write, level, name_='Capability') + write('),\n') + showIndent(write, level) + write('Capability_Reference=[\n') level += 1 for Capability_Reference_ in self.Capability_Reference: - outfile.write('model_.CapabilityReferenceType(\n') - Capability_Reference_.exportLiteral(outfile, level, name_='CapabilityReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityReferenceType(\n') + Capability_Reference_.exportLiteral(write, level, name_='CapabilityReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5835,39 +5835,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityReferenceType'): if self.capability_idref is not None and 'capability_idref' not in already_processed: already_processed.add('capability_idref') - outfile.write(' capability_idref=%s' % (quote_attrib(self.capability_idref), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityReferenceType', fromsubclass_=False, pretty_print=True): + write(' capability_idref=%s' % (quote_attrib(self.capability_idref), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='CapabilityReferenceType'): + def exportLiteral(self, write, level, name_='CapabilityReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.capability_idref is not None and 'capability_idref' not in already_processed: already_processed.add('capability_idref') - showIndent(outfile, level) - outfile.write('capability_idref = %s,\n' % (self.capability_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('capability_idref = %s,\n' % (self.capability_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -5942,94 +5942,94 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityObjectiveType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityObjectiveType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveType'): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Name is not None: - self.Name.export(outfile, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) + self.Name.export(write, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) for Property_ in self.Property: - Property_.export(outfile, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) + Property_.export(write, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) for Behavior_Reference_ in self.Behavior_Reference: - Behavior_Reference_.export(outfile, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) + Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) for Relationship_ in self.Relationship: - Relationship_.export(outfile, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityObjectiveType'): + Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityObjectiveType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.Name is not None: - outfile.write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(outfile, level, name_='Name') - outfile.write('),\n') + write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Name.exportLiteral(write, level, name_='Name') + write('),\n') if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('Property=[\n') + showIndent(write, level) + write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Property=[\n') level += 1 for Property_ in self.Property: - outfile.write('model_.CapabilityPropertyType(\n') - Property_.exportLiteral(outfile, level, name_='CapabilityPropertyType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityPropertyType(\n') + Property_.exportLiteral(write, level, name_='CapabilityPropertyType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Behavior_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Behavior_Reference=[\n') level += 1 for Behavior_Reference_ in self.Behavior_Reference: - outfile.write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(outfile, level, name_='BehaviorReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.BehaviorReferenceType(\n') + Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Relationship=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Relationship=[\n') level += 1 for Relationship_ in self.Relationship: - outfile.write('model_.CapabilityObjectiveRelationshipType(\n') - Relationship_.exportLiteral(outfile, level, name_='CapabilityObjectiveRelationshipType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityObjectiveRelationshipType(\n') + Relationship_.exportLiteral(write, level, name_='CapabilityObjectiveRelationshipType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -6095,57 +6095,57 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityRelationshipType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityRelationshipType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityRelationshipType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityRelationshipType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityRelationshipType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityRelationshipType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityRelationshipType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityRelationshipType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Relationship_Type is not None: - self.Relationship_Type.export(outfile, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) + self.Relationship_Type.export(write, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) for Capability_Reference_ in self.Capability_Reference: - Capability_Reference_.export(outfile, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityRelationshipType'): + Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityRelationshipType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Relationship_Type is not None: - outfile.write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Relationship_Type.exportLiteral(outfile, level, name_='Relationship_Type') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Capability_Reference=[\n') + write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Relationship_Type.exportLiteral(write, level, name_='Relationship_Type') + write('),\n') + showIndent(write, level) + write('Capability_Reference=[\n') level += 1 for Capability_Reference_ in self.Capability_Reference: - outfile.write('model_.CapabilityType(\n') - Capability_Reference_.exportLiteral(outfile, level, name_='CapabilityType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityType(\n') + Capability_Reference_.exportLiteral(write, level, name_='CapabilityType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -6197,57 +6197,57 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityObjectiveRelationshipType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityObjectiveRelationshipType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveRelationshipType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Relationship_Type is not None: - self.Relationship_Type.export(outfile, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) + self.Relationship_Type.export(write, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) for Objective_Reference_ in self.Objective_Reference: - Objective_Reference_.export(outfile, level, 'maecBundle:', name_='Objective_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityObjectiveRelationshipType'): + Objective_Reference_.export(write, level, 'maecBundle:', name_='Objective_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityObjectiveRelationshipType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Relationship_Type is not None: - outfile.write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Relationship_Type.exportLiteral(outfile, level, name_='Relationship_Type') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Objective_Reference=[\n') + write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Relationship_Type.exportLiteral(write, level, name_='Relationship_Type') + write('),\n') + showIndent(write, level) + write('Objective_Reference=[\n') level += 1 for Objective_Reference_ in self.Objective_Reference: - outfile.write('model_.CapabilityObjectiveReferenceType(\n') - Objective_Reference_.exportLiteral(outfile, level, name_='CapabilityObjectiveReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapabilityObjectiveReferenceType(\n') + Objective_Reference_.exportLiteral(write, level, name_='CapabilityObjectiveReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -6293,39 +6293,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityObjectiveReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityObjectiveReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType'): if self.objective_idref is not None and 'objective_idref' not in already_processed: already_processed.add('objective_idref') - outfile.write(' objective_idref=%s' % (quote_attrib(self.objective_idref), )) - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', fromsubclass_=False, pretty_print=True): + write(' objective_idref=%s' % (quote_attrib(self.objective_idref), )) + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='CapabilityObjectiveReferenceType'): + def exportLiteral(self, write, level, name_='CapabilityObjectiveReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.objective_idref is not None and 'objective_idref' not in already_processed: already_processed.add('objective_idref') - showIndent(outfile, level) - outfile.write('objective_idref = %s,\n' % (self.objective_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('objective_idref = %s,\n' % (self.objective_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -6371,50 +6371,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecBundle:', name_='CapabilityPropertyType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecBundle:', name_='CapabilityPropertyType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapabilityPropertyType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapabilityPropertyType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecBundle:', name_='CapabilityPropertyType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CapabilityPropertyType'): pass - def exportChildren(self, outfile, level, namespace_='maecBundle:', name_='CapabilityPropertyType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityPropertyType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Name is not None: - self.Name.export(outfile, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) + self.Name.export(write, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) if self.Value is not None: - self.Value.export(outfile, level, 'maecBundle:', name_='Value', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapabilityPropertyType'): + self.Value.export(write, level, 'maecBundle:', name_='Value', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapabilityPropertyType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Name is not None: - outfile.write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(outfile, level, name_='Name') - outfile.write('),\n') + write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Name.exportLiteral(write, level, name_='Name') + write('),\n') if self.Value is not None: - outfile.write('Value=model_.cybox_common.StringObjectPropertyType(\n') - self.Value.exportLiteral(outfile, level, name_='Value') - outfile.write('),\n') + write('Value=model_.cybox_common.StringObjectPropertyType(\n') + self.Value.exportLiteral(write, level, name_='Value') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index 2dbfaba..c98e76a 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -296,10 +296,10 @@ def gds_build_any(self, node, type_name=None): # Support/utility functions. # -def showIndent(outfile, level, pretty_print=True): +def showIndent(write, level, pretty_print=True): if pretty_print: for idx in range(level): - outfile.write(' ') + write(' ') def quote_xml(inStr): if not inStr: @@ -406,32 +406,32 @@ def getValue(self): return self.value def getName(self): return self.name - def export(self, outfile, level, name, namespace, pretty_print=True): + def export(self, write, level, name, namespace, pretty_print=True): if self.category == MixedContainer.CategoryText: # Prevent exporting empty content as empty lines. if self.value.strip(): - outfile.write(self.value) + write(self.value) elif self.category == MixedContainer.CategorySimple: - self.exportSimple(outfile, level, name) + self.exportSimple(write, level, name) else: # category == MixedContainer.CategoryComplex - self.value.export(outfile, level, namespace, name, pretty_print) - def exportSimple(self, outfile, level, name): + self.value.export(write, level, namespace, name, pretty_print) + def exportSimple(self, write, level, name): if self.content_type == MixedContainer.TypeString: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeInteger or \ self.content_type == MixedContainer.TypeBoolean: - outfile.write('<%s>%d' % + write('<%s>%d' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeFloat or \ self.content_type == MixedContainer.TypeDecimal: - outfile.write('<%s>%f' % + write('<%s>%f' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeDouble: - outfile.write('<%s>%g' % + write('<%s>%g' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeBase64: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, base64.b64encode(self.value), self.name)) def to_etree(self, element): if self.category == MixedContainer.CategoryText: @@ -466,22 +466,22 @@ def to_etree_simple(self): elif self.content_type == MixedContainer.TypeBase64: text = '%s' % base64.b64encode(self.value) return text - def exportLiteral(self, outfile, level, name): + def exportLiteral(self, write, level, name): if self.category == MixedContainer.CategoryText: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) elif self.category == MixedContainer.CategorySimple: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) else: # category == MixedContainer.CategoryComplex - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s",\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s",\n' % \ (self.category, self.content_type, self.name,)) - self.value.exportLiteral(outfile, level + 1) - showIndent(outfile, level) - outfile.write(')\n') + self.value.exportLiteral(write, level + 1) + showIndent(write, level) + write(')\n') class MemberSpec_(object): @@ -550,63 +550,63 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecContainer:', name_='MAEC_Container', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecContainer:', name_='MAEC_Container', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MAEC_Container') + self.exportAttributes(write, level, already_processed, namespace_, name_='MAEC_Container') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecContainer:', name_='MAEC_Container'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecContainer:', name_='MAEC_Container'): if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - outfile.write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) + write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - outfile.write(' schema_version="%s"' % self.schema_version) - def exportChildren(self, outfile, level, namespace_='maecContainer:', name_='MAEC_Container', fromsubclass_=False, pretty_print=True): + write(' schema_version="%s"' % self.schema_version) + def exportChildren(self, write, level, namespace_='maecContainer:', name_='MAEC_Container', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Packages is not None: - self.Packages.export(outfile, level, 'maecContainer:', name_='Packages', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MAEC_Container'): + self.Packages.export(write, level, 'maecContainer:', name_='Packages', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MAEC_Container'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - showIndent(outfile, level) - outfile.write('timestamp = "%s",\n' % (self.timestamp,)) + showIndent(write, level) + write('timestamp = "%s",\n' % (self.timestamp,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - showIndent(outfile, level) - outfile.write('schema_version = %s,\n' % (self.schema_version)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('schema_version = %s,\n' % (self.schema_version)) + def exportLiteralChildren(self, write, level, name_): if self.Packages is not None: - outfile.write('Packages=model_.PackageListType(\n') - self.Packages.exportLiteral(outfile, level, name_='Packages') - outfile.write('),\n') + write('Packages=model_.PackageListType(\n') + self.Packages.exportLiteral(write, level, name_='Packages') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -662,51 +662,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecContainer:', name_='PackageListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecContainer:', name_='PackageListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='PackageListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='PackageListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecContainer:', name_='PackageListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecContainer:', name_='PackageListType'): pass - def exportChildren(self, outfile, level, namespace_='maecContainer:', name_='PackageListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecContainer:', name_='PackageListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Package_ in self.Package: - Package_.export(outfile, level, 'maecContainer:', name_='Package', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='PackageListType'): + Package_.export(write, level, 'maecContainer:', name_='Package', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='PackageListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Package=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Package=[\n') level += 1 for Package_ in self.Package: - outfile.write('model_.maec_package_schema.PackageType(\n') - Package_.exportLiteral(outfile, level, name_='maec_package_schema.PackageType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.maec_package_schema.PackageType(\n') + Package_.exportLiteral(write, level, name_='maec_package_schema.PackageType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index 4023139..0b12cf7 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -302,10 +302,10 @@ def gds_build_any(self, node, type_name=None): # Support/utility functions. # -def showIndent(outfile, level, pretty_print=True): +def showIndent(write, level, pretty_print=True): if pretty_print: for idx in range(level): - outfile.write(' ') + write(' ') def quote_xml(inStr): if not inStr: @@ -412,32 +412,32 @@ def getValue(self): return self.value def getName(self): return self.name - def export(self, outfile, level, name, namespace, pretty_print=True): + def export(self, write, level, name, namespace, pretty_print=True): if self.category == MixedContainer.CategoryText: # Prevent exporting empty content as empty lines. if self.value.strip(): - outfile.write(self.value) + write(self.value) elif self.category == MixedContainer.CategorySimple: - self.exportSimple(outfile, level, name) + self.exportSimple(write, level, name) else: # category == MixedContainer.CategoryComplex - self.value.export(outfile, level, namespace, name, pretty_print) - def exportSimple(self, outfile, level, name): + self.value.export(write, level, namespace, name, pretty_print) + def exportSimple(self, write, level, name): if self.content_type == MixedContainer.TypeString: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeInteger or \ self.content_type == MixedContainer.TypeBoolean: - outfile.write('<%s>%d' % + write('<%s>%d' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeFloat or \ self.content_type == MixedContainer.TypeDecimal: - outfile.write('<%s>%f' % + write('<%s>%f' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeDouble: - outfile.write('<%s>%g' % + write('<%s>%g' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeBase64: - outfile.write('<%s>%s' % + write('<%s>%s' % (self.name, base64.b64encode(self.value), self.name)) def to_etree(self, element): if self.category == MixedContainer.CategoryText: @@ -472,22 +472,22 @@ def to_etree_simple(self): elif self.content_type == MixedContainer.TypeBase64: text = '%s' % base64.b64encode(self.value) return text - def exportLiteral(self, outfile, level, name): + def exportLiteral(self, write, level, name): if self.category == MixedContainer.CategoryText: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) elif self.category == MixedContainer.CategorySimple: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % (self.category, self.content_type, self.name, self.value)) else: # category == MixedContainer.CategoryComplex - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s",\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s",\n' % \ (self.category, self.content_type, self.name,)) - self.value.exportLiteral(outfile, level + 1) - showIndent(outfile, level) - outfile.write(')\n') + self.value.exportLiteral(write, level + 1) + showIndent(write, level) + write(')\n') class MemberSpec_(object): @@ -550,56 +550,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='AnalysisEnvironmentType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='AnalysisEnvironmentType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisEnvironmentType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AnalysisEnvironmentType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='AnalysisEnvironmentType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='AnalysisEnvironmentType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='AnalysisEnvironmentType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='AnalysisEnvironmentType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Hypervisor_Host_System is not None: - self.Hypervisor_Host_System.export(outfile, level, 'maecPackage:', name_='Hypervisor_Host_System', pretty_print=pretty_print) + self.Hypervisor_Host_System.export(write, level, 'maecPackage:', name_='Hypervisor_Host_System', pretty_print=pretty_print) if self.Analysis_Systems is not None: - self.Analysis_Systems.export(outfile, level, 'maecPackage:', name_='Analysis_Systems', pretty_print=pretty_print) + self.Analysis_Systems.export(write, level, 'maecPackage:', name_='Analysis_Systems', pretty_print=pretty_print) if self.Network_Infrastructure is not None: - self.Network_Infrastructure.export(outfile, level, 'maecPackage:', name_='Network_Infrastructure', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AnalysisEnvironmentType'): + self.Network_Infrastructure.export(write, level, 'maecPackage:', name_='Network_Infrastructure', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AnalysisEnvironmentType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Hypervisor_Host_System is not None: - outfile.write('Hypervisor_Host_System=model_.HypervisorHostSystemType(\n') - self.Hypervisor_Host_System.exportLiteral(outfile, level, name_='Hypervisor_Host_System') - outfile.write('),\n') + write('Hypervisor_Host_System=model_.HypervisorHostSystemType(\n') + self.Hypervisor_Host_System.exportLiteral(write, level, name_='Hypervisor_Host_System') + write('),\n') if self.Analysis_Systems is not None: - outfile.write('Analysis_Systems=model_.AnalysisSystemListType(\n') - self.Analysis_Systems.exportLiteral(outfile, level, name_='Analysis_Systems') - outfile.write('),\n') + write('Analysis_Systems=model_.AnalysisSystemListType(\n') + self.Analysis_Systems.exportLiteral(write, level, name_='Analysis_Systems') + write('),\n') if self.Network_Infrastructure is not None: - outfile.write('Network_Infrastructure=model_.NetworkInfrastructureType(\n') - self.Network_Infrastructure.exportLiteral(outfile, level, name_='Network_Infrastructure') - outfile.write('),\n') + write('Network_Infrastructure=model_.NetworkInfrastructureType(\n') + self.Network_Infrastructure.exportLiteral(write, level, name_='Network_Infrastructure') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -661,68 +661,68 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='SourceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='SourceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='SourceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='SourceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='SourceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='SourceType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='SourceType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='SourceType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sName>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sName>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecPackage:', eol_)) if self.Method is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sMethod>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Method).encode(ExternalEncoding), input_name='Method'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sMethod>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Method).encode(ExternalEncoding), input_name='Method'), 'maecPackage:', eol_)) if self.Reference is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sReference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Reference).encode(ExternalEncoding), input_name='Reference'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sReference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Reference).encode(ExternalEncoding), input_name='Reference'), 'maecPackage:', eol_)) if self.Organization is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sOrganization>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Organization).encode(ExternalEncoding), input_name='Organization'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sOrganization>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Organization).encode(ExternalEncoding), input_name='Organization'), 'maecPackage:', eol_)) if self.URL is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sURL>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.URL).encode(ExternalEncoding), input_name='URL'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='SourceType'): + showIndent(write, level, pretty_print) + write('<%sURL>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.URL).encode(ExternalEncoding), input_name='URL'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='SourceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Name is not None: - showIndent(outfile, level) - outfile.write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) if self.Method is not None: - showIndent(outfile, level) - outfile.write('Method=%s,\n' % quote_python(self.Method).encode(ExternalEncoding)) + showIndent(write, level) + write('Method=%s,\n' % quote_python(self.Method).encode(ExternalEncoding)) if self.Reference is not None: - showIndent(outfile, level) - outfile.write('Reference=%s,\n' % quote_python(self.Reference).encode(ExternalEncoding)) + showIndent(write, level) + write('Reference=%s,\n' % quote_python(self.Reference).encode(ExternalEncoding)) if self.Organization is not None: - showIndent(outfile, level) - outfile.write('Organization=%s,\n' % quote_python(self.Organization).encode(ExternalEncoding)) + showIndent(write, level) + write('Organization=%s,\n' % quote_python(self.Organization).encode(ExternalEncoding)) if self.URL is not None: - showIndent(outfile, level) - outfile.write('URL=%s,\n' % quote_python(self.URL).encode(ExternalEncoding)) + showIndent(write, level) + write('URL=%s,\n' % quote_python(self.URL).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -781,51 +781,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='CommentListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='CommentListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CommentListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CommentListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='CommentListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='CommentListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='CommentListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='CommentListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Comment_ in self.Comment: - Comment_.export(outfile, level, 'maecPackage:', name_='Comment', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CommentListType'): + Comment_.export(write, level, 'maecPackage:', name_='Comment', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CommentListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Comment=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Comment=[\n') level += 1 for Comment_ in self.Comment: - outfile.write('model_.CommentType(\n') - Comment_.exportLiteral(outfile, level, name_='CommentType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CommentType(\n') + Comment_.exportLiteral(write, level, name_='CommentType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -868,51 +868,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='AnalysisSystemListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='AnalysisSystemListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisSystemListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AnalysisSystemListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='AnalysisSystemListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='AnalysisSystemListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='AnalysisSystemListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='AnalysisSystemListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Analysis_System_ in self.Analysis_System: - Analysis_System_.export(outfile, level, 'maecPackage:', name_='Analysis_System', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AnalysisSystemListType'): + Analysis_System_.export(write, level, 'maecPackage:', name_='Analysis_System', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AnalysisSystemListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Analysis_System=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Analysis_System=[\n') level += 1 for Analysis_System_ in self.Analysis_System: - outfile.write('model_.AnalysisSystemType(\n') - Analysis_System_.exportLiteral(outfile, level, name_='AnalysisSystemType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.AnalysisSystemType(\n') + Analysis_System_.exportLiteral(write, level, name_='AnalysisSystemType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -955,51 +955,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ToolListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ToolListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ToolListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ToolListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ToolListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ToolListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ToolListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ToolListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Tool_ in self.Tool: - Tool_.export(outfile, level, 'maecPackage:', name_='Tool', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ToolListType'): + Tool_.export(write, level, 'maecPackage:', name_='Tool', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ToolListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Tool=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Tool=[\n') level += 1 for Tool_ in self.Tool: - outfile.write('model_.cybox_common.ToolInformationType(\n') - Tool_.exportLiteral(outfile, level, name_='cybox_common.ToolInformationType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_common.ToolInformationType(\n') + Tool_.exportLiteral(write, level, name_='cybox_common.ToolInformationType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1045,56 +1045,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='DynamicAnalysisMetadataType') + self.exportAttributes(write, level, already_processed, namespace_, name_='DynamicAnalysisMetadataType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='DynamicAnalysisMetadataType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Command_Line is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sCommand_Line>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Command_Line).encode(ExternalEncoding), input_name='Command_Line'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sCommand_Line>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Command_Line).encode(ExternalEncoding), input_name='Command_Line'), 'maecPackage:', eol_)) if self.Analysis_Duration is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAnalysis_Duration>%s%s' % ('maecPackage:', self.gds_format_float(self.Analysis_Duration, input_name='Analysis_Duration'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAnalysis_Duration>%s%s' % ('maecPackage:', self.gds_format_float(self.Analysis_Duration, input_name='Analysis_Duration'), 'maecPackage:', eol_)) if self.Exit_Code is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sExit_Code>%s%s' % ('maecPackage:', self.gds_format_integer(self.Exit_Code, input_name='Exit_Code'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='DynamicAnalysisMetadataType'): + showIndent(write, level, pretty_print) + write('<%sExit_Code>%s%s' % ('maecPackage:', self.gds_format_integer(self.Exit_Code, input_name='Exit_Code'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='DynamicAnalysisMetadataType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Command_Line is not None: - showIndent(outfile, level) - outfile.write('Command_Line=%s,\n' % quote_python(self.Command_Line).encode(ExternalEncoding)) + showIndent(write, level) + write('Command_Line=%s,\n' % quote_python(self.Command_Line).encode(ExternalEncoding)) if self.Analysis_Duration is not None: - showIndent(outfile, level) - outfile.write('Analysis_Duration=%f,\n' % self.Analysis_Duration) + showIndent(write, level) + write('Analysis_Duration=%f,\n' % self.Analysis_Duration) if self.Exit_Code is not None: - showIndent(outfile, level) - outfile.write('Exit_Code=%d,\n' % self.Exit_Code) + showIndent(write, level) + write('Exit_Code=%d,\n' % self.Exit_Code) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1218,139 +1218,139 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='AnalysisType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='AnalysisType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AnalysisType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='AnalysisType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='AnalysisType'): if self.start_datetime is not None and 'start_datetime' not in already_processed: already_processed.add('start_datetime') - outfile.write(' start_datetime="%s"' % self.start_datetime) + write(' start_datetime="%s"' % self.start_datetime) if self.complete_datetime is not None and 'complete_datetime' not in already_processed: already_processed.add('complete_datetime') - outfile.write(' complete_datetime="%s"' % self.complete_datetime) + write(' complete_datetime="%s"' % self.complete_datetime) if self.method is not None and 'method' not in already_processed: already_processed.add('method') - outfile.write(' method=%s' % (quote_attrib(self.method), )) + write(' method=%s' % (quote_attrib(self.method), )) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - outfile.write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) + write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: already_processed.add('lastupdate_datetime') - outfile.write(' lastupdate_datetime="%s"' % self.lastupdate_datetime) + write(' lastupdate_datetime="%s"' % self.lastupdate_datetime) if self.type is not None and 'type' not in already_processed: already_processed.add('type') - outfile.write(' type=%s' % (quote_attrib(self.type), )) + write(' type=%s' % (quote_attrib(self.type), )) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='AnalysisType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='AnalysisType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Source is not None: - self.Source.export(outfile, level, 'maecPackage:', name_='Source', pretty_print=pretty_print) + self.Source.export(write, level, 'maecPackage:', name_='Source', pretty_print=pretty_print) if self.Analysts is not None: - self.Analysts.export(outfile, level, 'maecPackage:', name_='Analysts', pretty_print=pretty_print) + self.Analysts.export(write, level, 'maecPackage:', name_='Analysts', pretty_print=pretty_print) if self.Summary is not None: - self.Summary.export(outfile, level, 'maecPackage:', name_='Summary', pretty_print=pretty_print) + self.Summary.export(write, level, 'maecPackage:', name_='Summary', pretty_print=pretty_print) if self.Comments is not None: - self.Comments.export(outfile, level, 'maecPackage:', name_='Comments', pretty_print=pretty_print) + self.Comments.export(write, level, 'maecPackage:', name_='Comments', pretty_print=pretty_print) for Findings_Bundle_Reference_ in self.Findings_Bundle_Reference: - Findings_Bundle_Reference_.export(outfile, level, 'maecPackage:', name_='Findings_Bundle_Reference', pretty_print=pretty_print) + Findings_Bundle_Reference_.export(write, level, 'maecPackage:', name_='Findings_Bundle_Reference', pretty_print=pretty_print) if self.Tools is not None: - self.Tools.export(outfile, level, 'maecPackage:', name_='Tools', pretty_print=pretty_print) + self.Tools.export(write, level, 'maecPackage:', name_='Tools', pretty_print=pretty_print) if self.Dynamic_Analysis_Metadata is not None: - self.Dynamic_Analysis_Metadata.export(outfile, level, 'maecPackage:', name_='Dynamic_Analysis_Metadata', pretty_print=pretty_print) + self.Dynamic_Analysis_Metadata.export(write, level, 'maecPackage:', name_='Dynamic_Analysis_Metadata', pretty_print=pretty_print) if self.Analysis_Environment is not None: - self.Analysis_Environment.export(outfile, level, 'maecPackage:', name_='Analysis_Environment', pretty_print=pretty_print) + self.Analysis_Environment.export(write, level, 'maecPackage:', name_='Analysis_Environment', pretty_print=pretty_print) if self.Report is not None: - self.Report.export(outfile, level, 'maecPackage:', name_='Report', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AnalysisType'): + self.Report.export(write, level, 'maecPackage:', name_='Report', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AnalysisType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.start_datetime is not None and 'start_datetime' not in already_processed: already_processed.add('start_datetime') - showIndent(outfile, level) - outfile.write('start_datetime = "%s",\n' % (self.start_datetime,)) + showIndent(write, level) + write('start_datetime = "%s",\n' % (self.start_datetime,)) if self.complete_datetime is not None and 'complete_datetime' not in already_processed: already_processed.add('complete_datetime') - showIndent(outfile, level) - outfile.write('complete_datetime = "%s",\n' % (self.complete_datetime,)) + showIndent(write, level) + write('complete_datetime = "%s",\n' % (self.complete_datetime,)) if self.method is not None and 'method' not in already_processed: already_processed.add('method') - showIndent(outfile, level) - outfile.write('method = %s,\n' % (self.method,)) + showIndent(write, level) + write('method = %s,\n' % (self.method,)) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - showIndent(outfile, level) - outfile.write('ordinal_position = %d,\n' % (self.ordinal_position,)) + showIndent(write, level) + write('ordinal_position = %d,\n' % (self.ordinal_position,)) if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: already_processed.add('lastupdate_datetime') - showIndent(outfile, level) - outfile.write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) + showIndent(write, level) + write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) if self.type is not None and 'type' not in already_processed: already_processed.add('type') - showIndent(outfile, level) - outfile.write('type = %s,\n' % (self.type,)) + showIndent(write, level) + write('type = %s,\n' % (self.type,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.Source is not None: - outfile.write('Source=model_.SourceType(\n') - self.Source.exportLiteral(outfile, level, name_='Source') - outfile.write('),\n') + write('Source=model_.SourceType(\n') + self.Source.exportLiteral(write, level, name_='Source') + write('),\n') if self.Analysts is not None: - outfile.write('Analysts=model_.cybox_common.PersonnelType(\n') - self.Analysts.exportLiteral(outfile, level, name_='Analysts') - outfile.write('),\n') + write('Analysts=model_.cybox_common.PersonnelType(\n') + self.Analysts.exportLiteral(write, level, name_='Analysts') + write('),\n') if self.Summary is not None: - outfile.write('Summary=model_.cybox_common.StructuredTextType(\n') - self.Summary.exportLiteral(outfile, level, name_='Summary') - outfile.write('),\n') + write('Summary=model_.cybox_common.StructuredTextType(\n') + self.Summary.exportLiteral(write, level, name_='Summary') + write('),\n') if self.Comments is not None: - outfile.write('Comments=model_.CommentListType(\n') - self.Comments.exportLiteral(outfile, level, name_='Comments') - outfile.write('),\n') + write('Comments=model_.CommentListType(\n') + self.Comments.exportLiteral(write, level, name_='Comments') + write('),\n') if self.Findings_Bundle_Reference is not None: - outfile.write('Findings_Bundle_Reference=model_.maec_bundle_schema.BundleReferenceType(\n') - self.Findings_Bundle_Reference.exportLiteral(outfile, level, name_='Findings_Bundle_Reference') - outfile.write('),\n') + write('Findings_Bundle_Reference=model_.maec_bundle_schema.BundleReferenceType(\n') + self.Findings_Bundle_Reference.exportLiteral(write, level, name_='Findings_Bundle_Reference') + write('),\n') if self.Tools is not None: - outfile.write('Tools=model_.ToolListType(\n') - self.Tools.exportLiteral(outfile, level, name_='Tools') - outfile.write('),\n') + write('Tools=model_.ToolListType(\n') + self.Tools.exportLiteral(write, level, name_='Tools') + write('),\n') if self.Dynamic_Analysis_Metadata is not None: - outfile.write('Dynamic_Analysis_Metadata=model_.DynamicAnalysisMetadataType(\n') - self.Dynamic_Analysis_Metadata.exportLiteral(outfile, level, name_='Dynamic_Analysis_Metadata') - outfile.write('),\n') + write('Dynamic_Analysis_Metadata=model_.DynamicAnalysisMetadataType(\n') + self.Dynamic_Analysis_Metadata.exportLiteral(write, level, name_='Dynamic_Analysis_Metadata') + write('),\n') if self.Analysis_Environment is not None: - outfile.write('Analysis_Environment=model_.AnalysisEnvironmentType(\n') - self.Analysis_Environment.exportLiteral(outfile, level, name_='Analysis_Environment') - outfile.write('),\n') + write('Analysis_Environment=model_.AnalysisEnvironmentType(\n') + self.Analysis_Environment.exportLiteral(write, level, name_='Analysis_Environment') + write('),\n') if self.Report is not None: - outfile.write('Report=model_.cybox_common.StructuredTextType(\n') - self.Report.exportLiteral(outfile, level, name_='Report') - outfile.write('),\n') + write('Report=model_.cybox_common.StructuredTextType(\n') + self.Report.exportLiteral(write, level, name_='Report') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1466,51 +1466,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='AnalysisListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='AnalysisListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AnalysisListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='AnalysisListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='AnalysisListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='AnalysisListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='AnalysisListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Analysis_ in self.Analysis: - Analysis_.export(outfile, level, 'maecPackage:', name_='Analysis', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AnalysisListType'): + Analysis_.export(write, level, 'maecPackage:', name_='Analysis', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AnalysisListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Analysis=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Analysis=[\n') level += 1 for Analysis_ in self.Analysis: - outfile.write('model_.AnalysisType(\n') - Analysis_.exportLiteral(outfile, level, name_='AnalysisType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.AnalysisType(\n') + Analysis_.exportLiteral(write, level, name_='AnalysisType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1554,51 +1554,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='InstalledProgramsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='InstalledProgramsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='InstalledProgramsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='InstalledProgramsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='InstalledProgramsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='InstalledProgramsType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='InstalledProgramsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='InstalledProgramsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Program_ in self.Program: - Program_.export(outfile, level, 'maecPackage:', name_='Program', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='InstalledProgramsType'): + Program_.export(write, level, 'maecPackage:', name_='Program', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='InstalledProgramsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Program=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Program=[\n') level += 1 for Program_ in self.Program: - outfile.write('model_.cybox_common.PlatformSpecificationType(\n') - Program_.exportLiteral(outfile, level, name_='cybox_common.PlatformSpecificationType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_common.PlatformSpecificationType(\n') + Program_.exportLiteral(write, level, name_='cybox_common.PlatformSpecificationType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1661,69 +1661,69 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MAEC_Package', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MAEC_Package', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MAEC_Package') + self.exportAttributes(write, level, already_processed, namespace_, name_='MAEC_Package') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MAEC_Package'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MAEC_Package'): if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - outfile.write(' timestamp="%s"' % self.timestamp) + write(' timestamp="%s"' % self.timestamp) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) + write(' id=%s' % (quote_attrib(self.id), )) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - outfile.write(' schema_version="%s"' % self.schema_version) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MAEC_Package', fromsubclass_=False, pretty_print=True): + write(' schema_version="%s"' % self.schema_version) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MAEC_Package', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Malware_Subjects is not None: - self.Malware_Subjects.export(outfile, level, 'maecPackage:', name_='Malware_Subjects', pretty_print=pretty_print) + self.Malware_Subjects.export(write, level, 'maecPackage:', name_='Malware_Subjects', pretty_print=pretty_print) if self.Grouping_Relationships is not None: - self.Grouping_Relationships.export(outfile, level, 'maecPackage:', name_='Grouping_Relationships', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MAEC_Package'): + self.Grouping_Relationships.export(write, level, 'maecPackage:', name_='Grouping_Relationships', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MAEC_Package'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - showIndent(outfile, level) - outfile.write('timestamp = "%s",\n' % (self.timestamp,)) + showIndent(write, level) + write('timestamp = "%s",\n' % (self.timestamp,)) if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - showIndent(outfile, level) - outfile.write('schema_version = %s,\n' % (self.schema_version,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('schema_version = %s,\n' % (self.schema_version,)) + def exportLiteralChildren(self, write, level, name_): if self.Malware_Subjects is not None: - outfile.write('Malware_Subjects=model_.MalwareSubjectListType(\n') - self.Malware_Subjects.exportLiteral(outfile, level, name_='Malware_Subjects') - outfile.write('),\n') + write('Malware_Subjects=model_.MalwareSubjectListType(\n') + self.Malware_Subjects.exportLiteral(write, level, name_='Malware_Subjects') + write('),\n') if self.Grouping_Relationships is not None: - outfile.write('Grouping_Relationships=model_.GroupingRelationshipListType(\n') - self.Grouping_Relationships.exportLiteral(outfile, level, name_='Grouping_Relationships') - outfile.write('),\n') + write('Grouping_Relationships=model_.GroupingRelationshipListType(\n') + self.Grouping_Relationships.exportLiteral(write, level, name_='Grouping_Relationships') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1832,87 +1832,87 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareSubjectType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareSubjectType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectType'): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Malware_Instance_Object_Attributes is not None: - self.Malware_Instance_Object_Attributes.export(outfile, level, 'maecPackage:', name_='Malware_Instance_Object_Attributes', pretty_print=pretty_print) + self.Malware_Instance_Object_Attributes.export(write, level, 'maecPackage:', name_='Malware_Instance_Object_Attributes', pretty_print=pretty_print) for Label_ in self.Label: - Label_.export(outfile, level, 'maecPackage:', name_='Label', pretty_print=pretty_print) + Label_.export(write, level, 'maecPackage:', name_='Label', pretty_print=pretty_print) if self.Configuration_Details is not None: - self.Configuration_Details.export(outfile, level, 'maecPackage:', name_='Configuration_Details', pretty_print=pretty_print) + self.Configuration_Details.export(write, level, 'maecPackage:', name_='Configuration_Details', pretty_print=pretty_print) if self.Minor_Variants is not None: - self.Minor_Variants.export(outfile, level, 'maecPackage:', name_='Minor_Variants', pretty_print=pretty_print) + self.Minor_Variants.export(write, level, 'maecPackage:', name_='Minor_Variants', pretty_print=pretty_print) if self.Development_Environment is not None: - self.Development_Environment.export(outfile, level, 'maecPackage:', name_='Development_Environment', pretty_print=pretty_print) + self.Development_Environment.export(write, level, 'maecPackage:', name_='Development_Environment', pretty_print=pretty_print) if self.Field_Data is not None: - self.Field_Data.export(outfile, level, 'maecPackage:', name_='Field_Data', pretty_print=pretty_print) + self.Field_Data.export(write, level, 'maecPackage:', name_='Field_Data', pretty_print=pretty_print) if self.Analyses is not None: - self.Analyses.export(outfile, level, 'maecPackage:', name_='Analyses', pretty_print=pretty_print) + self.Analyses.export(write, level, 'maecPackage:', name_='Analyses', pretty_print=pretty_print) if self.Findings_Bundles is not None: - self.Findings_Bundles.export(outfile, level, 'maecPackage:', name_='Findings_Bundles', pretty_print=pretty_print) + self.Findings_Bundles.export(write, level, 'maecPackage:', name_='Findings_Bundles', pretty_print=pretty_print) if self.Relationships is not None: - self.Relationships.export(outfile, level, 'maecPackage:', name_='Relationships', pretty_print=pretty_print) + self.Relationships.export(write, level, 'maecPackage:', name_='Relationships', pretty_print=pretty_print) for Compatible_Platform_ in self.Compatible_Platform: - Compatible_Platform_.export(outfile, level, 'maecPackage:', name_='Compatible_Platform', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareSubjectType'): + Compatible_Platform_.export(write, level, 'maecPackage:', name_='Compatible_Platform', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareSubjectType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.Malware_Instance_Object_Attributes is not None: - outfile.write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') - self.Malware_Instance_Object_Attributes.exportLiteral(outfile, level, name_='Malware_Instance_Object_Attributes') - outfile.write('),\n') + write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') + self.Malware_Instance_Object_Attributes.exportLiteral(write, level, name_='Malware_Instance_Object_Attributes') + write('),\n') if self.Minor_Variants is not None: - outfile.write('Minor_Variants=model_.MinorVariantListType(\n') - self.Minor_Variants.exportLiteral(outfile, level, name_='Minor_Variants') - outfile.write('),\n') + write('Minor_Variants=model_.MinorVariantListType(\n') + self.Minor_Variants.exportLiteral(write, level, name_='Minor_Variants') + write('),\n') if self.Field_Data is not None: - outfile.write('Field_Data=model_.metadatasharing.fieldDataEntry(\n') - self.Field_Data.exportLiteral(outfile, level, name_='Field_Data') - outfile.write('),\n') + write('Field_Data=model_.metadatasharing.fieldDataEntry(\n') + self.Field_Data.exportLiteral(write, level, name_='Field_Data') + write('),\n') if self.Analyses is not None: - outfile.write('Analyses=model_.AnalysisListType(\n') - self.Analyses.exportLiteral(outfile, level, name_='Analyses') - outfile.write('),\n') + write('Analyses=model_.AnalysisListType(\n') + self.Analyses.exportLiteral(write, level, name_='Analyses') + write('),\n') if self.Findings_Bundles is not None: - outfile.write('Findings_Bundles=model_.FindingsBundleListType(\n') - self.Findings_Bundles.exportLiteral(outfile, level, name_='Findings_Bundles') - outfile.write('),\n') + write('Findings_Bundles=model_.FindingsBundleListType(\n') + self.Findings_Bundles.exportLiteral(write, level, name_='Findings_Bundles') + write('),\n') if self.Relationships is not None: - outfile.write('Relationships=model_.MalwareSubjectRelationshipListType(\n') - self.Relationships.exportLiteral(outfile, level, name_='Relationships') - outfile.write('),\n') + write('Relationships=model_.MalwareSubjectRelationshipListType(\n') + self.Relationships.exportLiteral(write, level, name_='Relationships') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1994,50 +1994,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MetaAnalysisType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MetaAnalysisType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MetaAnalysisType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MetaAnalysisType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MetaAnalysisType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MetaAnalysisType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MetaAnalysisType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MetaAnalysisType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Action_Equivalences is not None: - self.Action_Equivalences.export(outfile, level, 'maecPackage:', name_='Action_Equivalences', pretty_print=pretty_print) + self.Action_Equivalences.export(write, level, 'maecPackage:', name_='Action_Equivalences', pretty_print=pretty_print) if self.Object_Equivalences is not None: - self.Object_Equivalences.export(outfile, level, 'maecPackage:', name_='Object_Equivalences', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MetaAnalysisType'): + self.Object_Equivalences.export(write, level, 'maecPackage:', name_='Object_Equivalences', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MetaAnalysisType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Action_Equivalences is not None: - outfile.write('Action_Equivalences=model_.ActionEquivalenceListType(\n') - self.Action_Equivalences.exportLiteral(outfile, level, name_='Action_Equivalences') - outfile.write('),\n') + write('Action_Equivalences=model_.ActionEquivalenceListType(\n') + self.Action_Equivalences.exportLiteral(write, level, name_='Action_Equivalences') + write('),\n') if self.Object_Equivalences is not None: - outfile.write('Object_Equivalences=model_.ObjectEquivalenceListType(\n') - self.Object_Equivalences.exportLiteral(outfile, level, name_='Object_Equivalences') - outfile.write('),\n') + write('Object_Equivalences=model_.ObjectEquivalenceListType(\n') + self.Object_Equivalences.exportLiteral(write, level, name_='Object_Equivalences') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2089,57 +2089,57 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareSubjectRelationshipType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareSubjectRelationshipType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Type is not None: - self.Type.export(outfile, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) + self.Type.export(write, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) for Malware_Subject_Reference_ in self.Malware_Subject_Reference: - Malware_Subject_Reference_.export(outfile, level, 'maecPackage:', name_='Malware_Subject_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareSubjectRelationshipType'): + Malware_Subject_Reference_.export(write, level, 'maecPackage:', name_='Malware_Subject_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareSubjectRelationshipType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Type is not None: - outfile.write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(outfile, level, name_='Type') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Malware_Subject_Reference=[\n') + write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Type.exportLiteral(write, level, name_='Type') + write('),\n') + showIndent(write, level) + write('Malware_Subject_Reference=[\n') level += 1 for Malware_Subject_Reference_ in self.Malware_Subject_Reference: - outfile.write('model_.MalwareSubjectReferenceType(\n') - Malware_Subject_Reference_.exportLiteral(outfile, level, name_='MalwareSubjectReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareSubjectReferenceType(\n') + Malware_Subject_Reference_.exportLiteral(write, level, name_='MalwareSubjectReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2187,51 +2187,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareSubjectRelationshipListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareSubjectRelationshipListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectRelationshipListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Relationship_ in self.Relationship: - Relationship_.export(outfile, level, 'maecPackage:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareSubjectRelationshipListType'): + Relationship_.export(write, level, 'maecPackage:', name_='Relationship', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareSubjectRelationshipListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Relationship=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Relationship=[\n') level += 1 for Relationship_ in self.Relationship: - outfile.write('model_.MalwareSubjectRelationshipType(\n') - Relationship_.exportLiteral(outfile, level, name_='MalwareSubjectRelationshipType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareSubjectRelationshipType(\n') + Relationship_.exportLiteral(write, level, name_='MalwareSubjectRelationshipType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2272,39 +2272,39 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareSubjectReferenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareSubjectReferenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectReferenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectReferenceType'): if self.malware_subject_idref is not None and 'malware_subject_idref' not in already_processed: already_processed.add('malware_subject_idref') - outfile.write(' malware_subject_idref=%s' % (quote_attrib(self.malware_subject_idref), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', fromsubclass_=False, pretty_print=True): + write(' malware_subject_idref=%s' % (quote_attrib(self.malware_subject_idref), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='MalwareSubjectReferenceType'): + def exportLiteral(self, write, level, name_='MalwareSubjectReferenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.malware_subject_idref is not None and 'malware_subject_idref' not in already_processed: already_processed.add('malware_subject_idref') - showIndent(outfile, level) - outfile.write('malware_subject_idref = %s,\n' % (self.malware_subject_idref,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('malware_subject_idref = %s,\n' % (self.malware_subject_idref,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -2347,51 +2347,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareSubjectListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareSubjectListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareSubjectListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareSubjectListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Malware_Subject_ in self.Malware_Subject: - Malware_Subject_.export(outfile, level, 'maecPackage:', name_='Malware_Subject', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareSubjectListType'): + Malware_Subject_.export(write, level, 'maecPackage:', name_='Malware_Subject', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareSubjectListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Malware_Subject=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Malware_Subject=[\n') level += 1 for Malware_Subject_ in self.Malware_Subject: - outfile.write('model_.MalwareSubjectType(\n') - Malware_Subject_.exportLiteral(outfile, level, name_='MalwareSubjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareSubjectType(\n') + Malware_Subject_.exportLiteral(write, level, name_='MalwareSubjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2435,51 +2435,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MinorVariantListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MinorVariantListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MinorVariantListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MinorVariantListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MinorVariantListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MinorVariantListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MinorVariantListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MinorVariantListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Minor_Variant_ in self.Minor_Variant: - Minor_Variant_.export(outfile, level, 'maecPackage:', name_='Minor_Variant', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MinorVariantListType'): + Minor_Variant_.export(write, level, 'maecPackage:', name_='Minor_Variant', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MinorVariantListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Minor_Variant=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Minor_Variant=[\n') level += 1 for Minor_Variant_ in self.Minor_Variant: - outfile.write('model_.cybox_core.ObjectType(\n') - Minor_Variant_.exportLiteral(outfile, level, name_='cybox_core.ObjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_core.ObjectType(\n') + Minor_Variant_.exportLiteral(write, level, name_='cybox_core.ObjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2536,69 +2536,69 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='FindingsBundleListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='FindingsBundleListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='FindingsBundleListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='FindingsBundleListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='FindingsBundleListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='FindingsBundleListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='FindingsBundleListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='FindingsBundleListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Meta_Analysis is not None: - self.Meta_Analysis.export(outfile, level, 'maecPackage:', name_='Meta_Analysis', pretty_print=pretty_print) + self.Meta_Analysis.export(write, level, 'maecPackage:', name_='Meta_Analysis', pretty_print=pretty_print) for Bundle_ in self.Bundle: - Bundle_.export(outfile, level, 'maecPackage:', name_='Bundle', pretty_print=pretty_print) + Bundle_.export(write, level, 'maecPackage:', name_='Bundle', pretty_print=pretty_print) for Bundle_External_Reference_ in self.Bundle_External_Reference: - showIndent(outfile, level, pretty_print) - outfile.write('<%sBundle_External_Reference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(Bundle_External_Reference_).encode(ExternalEncoding), input_name='Bundle_External_Reference'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='FindingsBundleListType'): + showIndent(write, level, pretty_print) + write('<%sBundle_External_Reference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(Bundle_External_Reference_).encode(ExternalEncoding), input_name='Bundle_External_Reference'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='FindingsBundleListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Meta_Analysis is not None: - outfile.write('Meta_Analysis=model_.MetaAnalysisType(\n') - self.Meta_Analysis.exportLiteral(outfile, level, name_='Meta_Analysis') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Bundle=[\n') + write('Meta_Analysis=model_.MetaAnalysisType(\n') + self.Meta_Analysis.exportLiteral(write, level, name_='Meta_Analysis') + write('),\n') + showIndent(write, level) + write('Bundle=[\n') level += 1 for Bundle_ in self.Bundle: - outfile.write('model_.maec_bundle_schema.BundleType(\n') - Bundle_.exportLiteral(outfile, level, name_='maec_bundle_schema.BundleType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.maec_bundle_schema.BundleType(\n') + Bundle_.exportLiteral(write, level, name_='maec_bundle_schema.BundleType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('Bundle_External_Reference=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('Bundle_External_Reference=[\n') level += 1 for Bundle_External_Reference_ in self.Bundle_External_Reference: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(Bundle_External_Reference_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(Bundle_External_Reference_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2657,62 +2657,62 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='GroupingRelationshipType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='GroupingRelationshipType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='GroupingRelationshipType') + self.exportAttributes(write, level, already_processed, namespace_, name_='GroupingRelationshipType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='GroupingRelationshipType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='GroupingRelationshipType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='GroupingRelationshipType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='GroupingRelationshipType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Type is not None: - self.Type.export(outfile, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) + self.Type.export(write, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) if self.Malware_Family_Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sMalware_Family_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Family_Name).encode(ExternalEncoding), input_name='Malware_Family_Name'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sMalware_Family_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Family_Name).encode(ExternalEncoding), input_name='Malware_Family_Name'), 'maecPackage:', eol_)) if self.Malware_Toolkit_Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sMalware_Toolkit_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Toolkit_Name).encode(ExternalEncoding), input_name='Malware_Toolkit_Name'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sMalware_Toolkit_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Toolkit_Name).encode(ExternalEncoding), input_name='Malware_Toolkit_Name'), 'maecPackage:', eol_)) if self.Clustering_Metadata is not None: - self.Clustering_Metadata.export(outfile, level, 'maecPackage:', name_='Clustering_Metadata', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='GroupingRelationshipType'): + self.Clustering_Metadata.export(write, level, 'maecPackage:', name_='Clustering_Metadata', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='GroupingRelationshipType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Type is not None: - outfile.write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(outfile, level, name_='Type') - outfile.write('),\n') + write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Type.exportLiteral(write, level, name_='Type') + write('),\n') if self.Malware_Family_Name is not None: - showIndent(outfile, level) - outfile.write('Malware_Family_Name=%s,\n' % quote_python(self.Malware_Family_Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Malware_Family_Name=%s,\n' % quote_python(self.Malware_Family_Name).encode(ExternalEncoding)) if self.Malware_Toolkit_Name is not None: - showIndent(outfile, level) - outfile.write('Malware_Toolkit_Name=%s,\n' % quote_python(self.Malware_Toolkit_Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Malware_Toolkit_Name=%s,\n' % quote_python(self.Malware_Toolkit_Name).encode(ExternalEncoding)) if self.Clustering_Metadata is not None: - outfile.write('Clustering_Metadata=model_.ClusteringMetadataType(\n') - self.Clustering_Metadata.exportLiteral(outfile, level, name_='Clustering_Metadata') - outfile.write('),\n') + write('Clustering_Metadata=model_.ClusteringMetadataType(\n') + self.Clustering_Metadata.exportLiteral(write, level, name_='Clustering_Metadata') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2767,51 +2767,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='GroupingRelationshipListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='GroupingRelationshipListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='GroupingRelationshipListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='GroupingRelationshipListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='GroupingRelationshipListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='GroupingRelationshipListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='GroupingRelationshipListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='GroupingRelationshipListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Grouping_Relationship_ in self.Grouping_Relationship: - Grouping_Relationship_.export(outfile, level, 'maecPackage:', name_='Grouping_Relationship', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='GroupingRelationshipListType'): + Grouping_Relationship_.export(write, level, 'maecPackage:', name_='Grouping_Relationship', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='GroupingRelationshipListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Grouping_Relationship=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Grouping_Relationship=[\n') level += 1 for Grouping_Relationship_ in self.Grouping_Relationship: - outfile.write('model_.GroupingRelationshipType(\n') - Grouping_Relationship_.exportLiteral(outfile, level, name_='GroupingRelationshipType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.GroupingRelationshipType(\n') + Grouping_Relationship_.exportLiteral(write, level, name_='GroupingRelationshipType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2869,74 +2869,74 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ClusteringMetadataType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ClusteringMetadataType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ClusteringMetadataType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ClusteringMetadataType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ClusteringMetadataType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ClusteringMetadataType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ClusteringMetadataType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ClusteringMetadataType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Algorithm_Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAlgorithm_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Name).encode(ExternalEncoding), input_name='Algorithm_Name'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAlgorithm_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Name).encode(ExternalEncoding), input_name='Algorithm_Name'), 'maecPackage:', eol_)) if self.Algorithm_Version is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sAlgorithm_Version>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Version).encode(ExternalEncoding), input_name='Algorithm_Version'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sAlgorithm_Version>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Version).encode(ExternalEncoding), input_name='Algorithm_Version'), 'maecPackage:', eol_)) if self.Algorithm_Parameters is not None: - self.Algorithm_Parameters.export(outfile, level, 'maecPackage:', name_='Algorithm_Parameters', pretty_print=pretty_print) + self.Algorithm_Parameters.export(write, level, 'maecPackage:', name_='Algorithm_Parameters', pretty_print=pretty_print) if self.Cluster_Size is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sCluster_Size>%s%s' % ('maecPackage:', self.gds_format_integer(self.Cluster_Size, input_name='Cluster_Size'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sCluster_Size>%s%s' % ('maecPackage:', self.gds_format_integer(self.Cluster_Size, input_name='Cluster_Size'), 'maecPackage:', eol_)) if self.Cluster_Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sCluster_Description>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Cluster_Description).encode(ExternalEncoding), input_name='Cluster_Description'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sCluster_Description>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Cluster_Description).encode(ExternalEncoding), input_name='Cluster_Description'), 'maecPackage:', eol_)) if self.Cluster_Composition is not None: - self.Cluster_Composition.export(outfile, level, 'maecPackage:', name_='Cluster_Composition', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ClusteringMetadataType'): + self.Cluster_Composition.export(write, level, 'maecPackage:', name_='Cluster_Composition', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ClusteringMetadataType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Algorithm_Name is not None: - showIndent(outfile, level) - outfile.write('Algorithm_Name=%s,\n' % quote_python(self.Algorithm_Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Algorithm_Name=%s,\n' % quote_python(self.Algorithm_Name).encode(ExternalEncoding)) if self.Algorithm_Version is not None: - showIndent(outfile, level) - outfile.write('Algorithm_Version=%s,\n' % quote_python(self.Algorithm_Version).encode(ExternalEncoding)) + showIndent(write, level) + write('Algorithm_Version=%s,\n' % quote_python(self.Algorithm_Version).encode(ExternalEncoding)) if self.Algorithm_Parameters is not None: - outfile.write('Algorithm_Parameters=model_.ClusteringAlgorithmParametersType(\n') - self.Algorithm_Parameters.exportLiteral(outfile, level, name_='Algorithm_Parameters') - outfile.write('),\n') + write('Algorithm_Parameters=model_.ClusteringAlgorithmParametersType(\n') + self.Algorithm_Parameters.exportLiteral(write, level, name_='Algorithm_Parameters') + write('),\n') if self.Cluster_Size is not None: - showIndent(outfile, level) - outfile.write('Cluster_Size=%d,\n' % self.Cluster_Size) + showIndent(write, level) + write('Cluster_Size=%d,\n' % self.Cluster_Size) if self.Cluster_Description is not None: - showIndent(outfile, level) - outfile.write('Cluster_Description=%s,\n' % quote_python(self.Cluster_Description).encode(ExternalEncoding)) + showIndent(write, level) + write('Cluster_Description=%s,\n' % quote_python(self.Cluster_Description).encode(ExternalEncoding)) if self.Cluster_Composition is not None: - outfile.write('Cluster_Composition=model_.ClusterCompositionType(\n') - self.Cluster_Composition.exportLiteral(outfile, level, name_='Cluster_Composition') - outfile.write('),\n') + write('Cluster_Composition=model_.ClusterCompositionType(\n') + self.Cluster_Composition.exportLiteral(write, level, name_='Cluster_Composition') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3021,62 +3021,62 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ClusterEdgeNodePairType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ClusterEdgeNodePairType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ClusterEdgeNodePairType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ClusterEdgeNodePairType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ClusterEdgeNodePairType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ClusterEdgeNodePairType'): if self.similarity_distance is not None and 'similarity_distance' not in already_processed: already_processed.add('similarity_distance') - outfile.write(' similarity_distance="%s"' % self.gds_format_float(self.similarity_distance, input_name='similarity_distance')) + write(' similarity_distance="%s"' % self.gds_format_float(self.similarity_distance, input_name='similarity_distance')) if self.similarity_index is not None and 'similarity_index' not in already_processed: already_processed.add('similarity_index') - outfile.write(' similarity_index="%s"' % self.gds_format_float(self.similarity_index, input_name='similarity_index')) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ClusterEdgeNodePairType', fromsubclass_=False, pretty_print=True): + write(' similarity_index="%s"' % self.gds_format_float(self.similarity_index, input_name='similarity_index')) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ClusterEdgeNodePairType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Malware_Subject_Node_A is not None: - self.Malware_Subject_Node_A.export(outfile, level, 'maecPackage:', name_='Malware_Subject_Node_A', pretty_print=pretty_print) + self.Malware_Subject_Node_A.export(write, level, 'maecPackage:', name_='Malware_Subject_Node_A', pretty_print=pretty_print) if self.Malware_Subject_Node_B is not None: - self.Malware_Subject_Node_B.export(outfile, level, 'maecPackage:', name_='Malware_Subject_Node_B', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ClusterEdgeNodePairType'): + self.Malware_Subject_Node_B.export(write, level, 'maecPackage:', name_='Malware_Subject_Node_B', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ClusterEdgeNodePairType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.similarity_distance is not None and 'similarity_distance' not in already_processed: already_processed.add('similarity_distance') - showIndent(outfile, level) - outfile.write('similarity_distance = %f,\n' % (self.similarity_distance,)) + showIndent(write, level) + write('similarity_distance = %f,\n' % (self.similarity_distance,)) if self.similarity_index is not None and 'similarity_index' not in already_processed: already_processed.add('similarity_index') - showIndent(outfile, level) - outfile.write('similarity_index = %f,\n' % (self.similarity_index,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('similarity_index = %f,\n' % (self.similarity_index,)) + def exportLiteralChildren(self, write, level, name_): if self.Malware_Subject_Node_A is not None: - outfile.write('Malware_Subject_Node_A=model_.MalwareSubjectReferenceType(\n') - self.Malware_Subject_Node_A.exportLiteral(outfile, level, name_='Malware_Subject_Node_A') - outfile.write('),\n') + write('Malware_Subject_Node_A=model_.MalwareSubjectReferenceType(\n') + self.Malware_Subject_Node_A.exportLiteral(write, level, name_='Malware_Subject_Node_A') + write('),\n') if self.Malware_Subject_Node_B is not None: - outfile.write('Malware_Subject_Node_B=model_.MalwareSubjectReferenceType(\n') - self.Malware_Subject_Node_B.exportLiteral(outfile, level, name_='Malware_Subject_Node_B') - outfile.write('),\n') + write('Malware_Subject_Node_B=model_.MalwareSubjectReferenceType(\n') + self.Malware_Subject_Node_B.exportLiteral(write, level, name_='Malware_Subject_Node_B') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3143,56 +3143,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ClusterCompositionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ClusterCompositionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ClusterCompositionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ClusterCompositionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ClusterCompositionType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ClusterCompositionType'): if self.score_type is not None and 'score_type' not in already_processed: already_processed.add('score_type') - outfile.write(' score_type=%s' % (self.gds_format_string(quote_attrib(self.score_type).encode(ExternalEncoding), input_name='score_type'), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ClusterCompositionType', fromsubclass_=False, pretty_print=True): + write(' score_type=%s' % (self.gds_format_string(quote_attrib(self.score_type).encode(ExternalEncoding), input_name='score_type'), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ClusterCompositionType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Edge_Node_Pair_ in self.Edge_Node_Pair: - Edge_Node_Pair_.export(outfile, level, 'maecPackage:', name_='Edge_Node_Pair', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ClusterCompositionType'): + Edge_Node_Pair_.export(write, level, 'maecPackage:', name_='Edge_Node_Pair', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ClusterCompositionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.score_type is not None and 'score_type' not in already_processed: already_processed.add('score_type') - showIndent(outfile, level) - outfile.write('score_type = "%s",\n' % (self.score_type,)) - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Edge_Node_Pair=[\n') + showIndent(write, level) + write('score_type = "%s",\n' % (self.score_type,)) + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Edge_Node_Pair=[\n') level += 1 for Edge_Node_Pair_ in self.Edge_Node_Pair: - outfile.write('model_.ClusterEdgeNodePairType(\n') - Edge_Node_Pair_.exportLiteral(outfile, level, name_='ClusterEdgeNodePairType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ClusterEdgeNodePairType(\n') + Edge_Node_Pair_.exportLiteral(write, level, name_='ClusterEdgeNodePairType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3237,50 +3237,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ClusteringAlgorithmParametersType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ClusteringAlgorithmParametersType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ClusteringAlgorithmParametersType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Distance_Threshold is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDistance_Threshold>%s%s' % ('maecPackage:', self.gds_format_float(self.Distance_Threshold, input_name='Distance_Threshold'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sDistance_Threshold>%s%s' % ('maecPackage:', self.gds_format_float(self.Distance_Threshold, input_name='Distance_Threshold'), 'maecPackage:', eol_)) if self.Number_of_Iterations is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sNumber_of_Iterations>%s%s' % ('maecPackage:', self.gds_format_integer(self.Number_of_Iterations, input_name='Number_of_Iterations'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='ClusteringAlgorithmParametersType'): + showIndent(write, level, pretty_print) + write('<%sNumber_of_Iterations>%s%s' % ('maecPackage:', self.gds_format_integer(self.Number_of_Iterations, input_name='Number_of_Iterations'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='ClusteringAlgorithmParametersType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Distance_Threshold is not None: - showIndent(outfile, level) - outfile.write('Distance_Threshold=%f,\n' % self.Distance_Threshold) + showIndent(write, level) + write('Distance_Threshold=%f,\n' % self.Distance_Threshold) if self.Number_of_Iterations is not None: - showIndent(outfile, level) - outfile.write('Number_of_Iterations=%d,\n' % self.Number_of_Iterations) + showIndent(write, level) + write('Number_of_Iterations=%d,\n' % self.Number_of_Iterations) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3332,44 +3332,44 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='NetworkInfrastructureType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='NetworkInfrastructureType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='NetworkInfrastructureType') + self.exportAttributes(write, level, already_processed, namespace_, name_='NetworkInfrastructureType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='NetworkInfrastructureType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='NetworkInfrastructureType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='NetworkInfrastructureType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='NetworkInfrastructureType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Captured_Protocols is not None: - self.Captured_Protocols.export(outfile, level, 'maecPackage:', name_='Captured_Protocols', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='NetworkInfrastructureType'): + self.Captured_Protocols.export(write, level, 'maecPackage:', name_='Captured_Protocols', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='NetworkInfrastructureType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Captured_Protocols is not None: - outfile.write('Captured_Protocols=model_.CapturedProtocolListType(\n') - self.Captured_Protocols.exportLiteral(outfile, level, name_='Captured_Protocols') - outfile.write('),\n') + write('Captured_Protocols=model_.CapturedProtocolListType(\n') + self.Captured_Protocols.exportLiteral(write, level, name_='Captured_Protocols') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3421,56 +3421,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ActionEquivalenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ActionEquivalenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionEquivalenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionEquivalenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ActionEquivalenceType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ActionEquivalenceType'): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ActionEquivalenceType', fromsubclass_=False, pretty_print=True): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionEquivalenceType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_Reference_ in self.Action_Reference: - Action_Reference_.export(outfile, level, 'maecPackage:', name_='Action_Reference', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionEquivalenceType'): + Action_Reference_.export(write, level, 'maecPackage:', name_='Action_Reference', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionEquivalenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action_Reference=[\n') + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action_Reference=[\n') level += 1 for Action_Reference_ in self.Action_Reference: - outfile.write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(outfile, level, name_='cybox_core.ActionReferenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.cybox_core.ActionReferenceType(\n') + Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3516,51 +3516,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ActionEquivalenceListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ActionEquivalenceListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ActionEquivalenceListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ActionEquivalenceListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ActionEquivalenceListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ActionEquivalenceListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ActionEquivalenceListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionEquivalenceListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Action_Equivalence_ in self.Action_Equivalence: - Action_Equivalence_.export(outfile, level, 'maecPackage:', name_='Action_Equivalence', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ActionEquivalenceListType'): + Action_Equivalence_.export(write, level, 'maecPackage:', name_='Action_Equivalence', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ActionEquivalenceListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Action_Equivalence=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Action_Equivalence=[\n') level += 1 for Action_Equivalence_ in self.Action_Equivalence: - outfile.write('model_.ActionEquivalenceType(\n') - Action_Equivalence_.exportLiteral(outfile, level, name_='ActionEquivalenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ActionEquivalenceType(\n') + Action_Equivalence_.exportLiteral(write, level, name_='ActionEquivalenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3604,51 +3604,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='CapturedProtocolListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapturedProtocolListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapturedProtocolListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='CapturedProtocolListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='CapturedProtocolListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='CapturedProtocolListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Protocol_ in self.Protocol: - Protocol_.export(outfile, level, 'maecPackage:', name_='Protocol', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='CapturedProtocolListType'): + Protocol_.export(write, level, 'maecPackage:', name_='Protocol', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='CapturedProtocolListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Protocol=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Protocol=[\n') level += 1 for Protocol_ in self.Protocol: - outfile.write('model_.CapturedProtocolType(\n') - Protocol_.exportLiteral(outfile, level, name_='CapturedProtocolType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.CapturedProtocolType(\n') + Protocol_.exportLiteral(write, level, name_='CapturedProtocolType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3706,60 +3706,60 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='CapturedProtocolType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CapturedProtocolType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CapturedProtocolType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='CapturedProtocolType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='CapturedProtocolType'): if self.layer7_protocol is not None and 'layer7_protocol' not in already_processed: already_processed.add('layer7_protocol') - outfile.write(' layer7_protocol=%s' % (quote_attrib(self.layer7_protocol), )) + write(' layer7_protocol=%s' % (quote_attrib(self.layer7_protocol), )) if self.port_number is not None and 'port_number' not in already_processed: already_processed.add('port_number') - outfile.write(' port_number="%s"' % self.gds_format_integer(self.port_number, input_name='port_number')) + write(' port_number="%s"' % self.gds_format_integer(self.port_number, input_name='port_number')) if self.interaction_level is not None and 'interaction_level' not in already_processed: already_processed.add('interaction_level') - outfile.write(' interaction_level=%s' % (quote_attrib(self.interaction_level), )) + write(' interaction_level=%s' % (quote_attrib(self.interaction_level), )) if self.layer4_protocol is not None and 'layer4_protocol' not in already_processed: already_processed.add('layer4_protocol') - outfile.write(' layer4_protocol=%s' % (quote_attrib(self.layer4_protocol), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='CapturedProtocolType', fromsubclass_=False, pretty_print=True): + write(' layer4_protocol=%s' % (quote_attrib(self.layer4_protocol), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, outfile, level, name_='CapturedProtocolType'): + def exportLiteral(self, write, level, name_='CapturedProtocolType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.layer7_protocol is not None and 'layer7_protocol' not in already_processed: already_processed.add('layer7_protocol') - showIndent(outfile, level) - outfile.write('layer7_protocol = %s,\n' % (self.layer7_protocol,)) + showIndent(write, level) + write('layer7_protocol = %s,\n' % (self.layer7_protocol,)) if self.port_number is not None and 'port_number' not in already_processed: already_processed.add('port_number') - showIndent(outfile, level) - outfile.write('port_number = %d,\n' % (self.port_number,)) + showIndent(write, level) + write('port_number = %d,\n' % (self.port_number,)) if self.interaction_level is not None and 'interaction_level' not in already_processed: already_processed.add('interaction_level') - showIndent(outfile, level) - outfile.write('interaction_level = %s,\n' % (self.interaction_level,)) + showIndent(write, level) + write('interaction_level = %s,\n' % (self.interaction_level,)) if self.layer4_protocol is not None and 'layer4_protocol' not in already_processed: already_processed.add('layer4_protocol') - showIndent(outfile, level) - outfile.write('layer4_protocol = %s,\n' % (self.layer4_protocol,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('layer4_protocol = %s,\n' % (self.layer4_protocol,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): already_processed = set() @@ -3820,51 +3820,51 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ObjectEquivalenceListType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceListType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectEquivalenceListType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectEquivalenceListType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ObjectEquivalenceListType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ObjectEquivalenceListType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ObjectEquivalenceListType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceListType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Object_Equivalence_ in self.Object_Equivalence: - Object_Equivalence_.export(outfile, level, 'maecPackage:', name_='Object_Equivalence', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectEquivalenceListType'): + Object_Equivalence_.export(write, level, 'maecPackage:', name_='Object_Equivalence', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectEquivalenceListType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Object_Equivalence=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Object_Equivalence=[\n') level += 1 for Object_Equivalence_ in self.Object_Equivalence: - outfile.write('model_.ObjectEquivalenceType(\n') - Object_Equivalence_.exportLiteral(outfile, level, name_='ObjectEquivalenceType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.ObjectEquivalenceType(\n') + Object_Equivalence_.exportLiteral(write, level, name_='ObjectEquivalenceType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3907,43 +3907,43 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectEquivalenceType') + self.exportAttributes(write, level, already_processed, namespace_, name_='ObjectEquivalenceType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='ObjectEquivalenceType'): - super(ObjectEquivalenceType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='ObjectEquivalenceType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ObjectEquivalenceType'): + super(ObjectEquivalenceType, self).exportAttributes(write, level, already_processed, namespace_, name_='ObjectEquivalenceType') if self.id is not None and 'id' not in already_processed: already_processed.add('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', fromsubclass_=False, pretty_print=True): - super(ObjectEquivalenceType, self).exportChildren(outfile, level, 'maecPackage:', name_, True, pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='ObjectEquivalenceType'): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', fromsubclass_=False, pretty_print=True): + super(ObjectEquivalenceType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='ObjectEquivalenceType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.add('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - super(ObjectEquivalenceType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(ObjectEquivalenceType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + super(ObjectEquivalenceType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(ObjectEquivalenceType, self).exportLiteralChildren(write, level, name_) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3985,46 +3985,46 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='HypervisorHostSystemType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='HypervisorHostSystemType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='HypervisorHostSystemType') + self.exportAttributes(write, level, already_processed, namespace_, name_='HypervisorHostSystemType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='HypervisorHostSystemType'): - super(HypervisorHostSystemType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='HypervisorHostSystemType') - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='HypervisorHostSystemType', fromsubclass_=False, pretty_print=True): - super(HypervisorHostSystemType, self).exportChildren(outfile, level, 'maecPackage:', name_, True, pretty_print=pretty_print) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='HypervisorHostSystemType'): + super(HypervisorHostSystemType, self).exportAttributes(write, level, already_processed, namespace_, name_='HypervisorHostSystemType') + def exportChildren(self, write, level, namespace_='maecPackage:', name_='HypervisorHostSystemType', fromsubclass_=False, pretty_print=True): + super(HypervisorHostSystemType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.VM_Hypervisor is not None: - self.VM_Hypervisor.export(outfile, level, 'maecPackage:', name_='VM_Hypervisor', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='HypervisorHostSystemType'): + self.VM_Hypervisor.export(write, level, 'maecPackage:', name_='VM_Hypervisor', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='HypervisorHostSystemType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): - super(HypervisorHostSystemType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(HypervisorHostSystemType, self).exportLiteralChildren(outfile, level, name_) + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): + super(HypervisorHostSystemType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(HypervisorHostSystemType, self).exportLiteralChildren(write, level, name_) if self.VM_Hypervisor is not None: - outfile.write('VM_Hypervisor=model_.cybox_common.PlatformSpecificationType(\n') - self.VM_Hypervisor.exportLiteral(outfile, level, name_='VM_Hypervisor') - outfile.write('),\n') + write('VM_Hypervisor=model_.cybox_common.PlatformSpecificationType(\n') + self.VM_Hypervisor.exportLiteral(write, level, name_='VM_Hypervisor') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4066,46 +4066,46 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='AnalysisSystemType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='AnalysisSystemType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisSystemType') + self.exportAttributes(write, level, already_processed, namespace_, name_='AnalysisSystemType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='AnalysisSystemType'): - super(AnalysisSystemType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='AnalysisSystemType') - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='AnalysisSystemType', fromsubclass_=False, pretty_print=True): - super(AnalysisSystemType, self).exportChildren(outfile, level, 'maecPackage:', name_, True, pretty_print=pretty_print) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='AnalysisSystemType'): + super(AnalysisSystemType, self).exportAttributes(write, level, already_processed, namespace_, name_='AnalysisSystemType') + def exportChildren(self, write, level, namespace_='maecPackage:', name_='AnalysisSystemType', fromsubclass_=False, pretty_print=True): + super(AnalysisSystemType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Installed_Programs is not None: - self.Installed_Programs.export(outfile, level, 'maecPackage:', name_='Installed_Programs', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='AnalysisSystemType'): + self.Installed_Programs.export(write, level, 'maecPackage:', name_='Installed_Programs', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='AnalysisSystemType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): - super(AnalysisSystemType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(AnalysisSystemType, self).exportLiteralChildren(outfile, level, name_) + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): + super(AnalysisSystemType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(AnalysisSystemType, self).exportLiteralChildren(write, level, name_) if self.Installed_Programs is not None: - outfile.write('Installed_Programs=model_.InstalledProgramsType(\n') - self.Installed_Programs.exportLiteral(outfile, level, name_='Installed_Programs') - outfile.write('),\n') + write('Installed_Programs=model_.InstalledProgramsType(\n') + self.Installed_Programs.exportLiteral(write, level, name_='Installed_Programs') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4157,56 +4157,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='CommentType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='CommentType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CommentType') + self.exportAttributes(write, level, already_processed, namespace_, name_='CommentType') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='CommentType'): - super(CommentType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='CommentType') + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='CommentType'): + super(CommentType, self).exportAttributes(write, level, already_processed, namespace_, name_='CommentType') if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - outfile.write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) + write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) if self.author is not None and 'author' not in already_processed: already_processed.add('author') - outfile.write(' author=%s' % (self.gds_format_string(quote_attrib(self.author).encode(ExternalEncoding), input_name='author'), )) + write(' author=%s' % (self.gds_format_string(quote_attrib(self.author).encode(ExternalEncoding), input_name='author'), )) if self.observation_name is not None and 'observation_name' not in already_processed: already_processed.add('observation_name') - outfile.write(' observation_name=%s' % (self.gds_format_string(quote_attrib(self.observation_name).encode(ExternalEncoding), input_name='observation_name'), )) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='CommentType', fromsubclass_=False, pretty_print=True): - super(CommentType, self).exportChildren(outfile, level, 'maecPackage:', name_, True, pretty_print=pretty_print) + write(' observation_name=%s' % (self.gds_format_string(quote_attrib(self.observation_name).encode(ExternalEncoding), input_name='observation_name'), )) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='CommentType', fromsubclass_=False, pretty_print=True): + super(CommentType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) pass - def exportLiteral(self, outfile, level, name_='CommentType'): + def exportLiteral(self, write, level, name_='CommentType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') - showIndent(outfile, level) - outfile.write('timestamp = "%s",\n' % (self.timestamp,)) + showIndent(write, level) + write('timestamp = "%s",\n' % (self.timestamp,)) if self.author is not None and 'author' not in already_processed: already_processed.add('author') - showIndent(outfile, level) - outfile.write('author = "%s",\n' % (self.author,)) - super(CommentType, self).exportLiteralAttributes(outfile, level, already_processed, name_) - def exportLiteralChildren(self, outfile, level, name_): - super(CommentType, self).exportLiteralChildren(outfile, level, name_) + showIndent(write, level) + write('author = "%s",\n' % (self.author,)) + super(CommentType, self).exportLiteralAttributes(write, level, already_processed, name_) + def exportLiteralChildren(self, write, level, name_): + super(CommentType, self).exportLiteralChildren(write, level, name_) pass def build(self, node): already_processed = set() @@ -4274,63 +4274,63 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareExceptionType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareExceptionType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareExceptionType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareExceptionType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) - else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareExceptionType'): - super(MalwareExceptionType, self).exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareExceptionType') + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) + else: + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareExceptionType'): + super(MalwareExceptionType, self).exportAttributes(write, level, already_processed, namespace_, name_='MalwareExceptionType') if self.is_fatal is not None and 'is_fatal' not in already_processed: already_processed.add('is_fatal') - outfile.write(' is_fatal="%s"' % self.gds_format_boolean(self.is_fatal, input_name='is_fatal')) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareExceptionType', fromsubclass_=False, pretty_print=True): - super(MalwareExceptionType, self).exportChildren(outfile, level, namespace_, name_, True, pretty_print=pretty_print) + write(' is_fatal="%s"' % self.gds_format_boolean(self.is_fatal, input_name='is_fatal')) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareExceptionType', fromsubclass_=False, pretty_print=True): + super(MalwareExceptionType, self).exportChildren(write, level, namespace_, name_, True, pretty_print=pretty_print) if pretty_print: eol_ = '\n' else: eol_ = '' if self.Exception_Code is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sException_Code>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Exception_Code).encode(ExternalEncoding), input_name='Exception_Code'), namespace_, eol_)) + showIndent(write, level, pretty_print) + write('<%sException_Code>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Exception_Code).encode(ExternalEncoding), input_name='Exception_Code'), namespace_, eol_)) if self.Faulting_Address is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sFaulting_Address>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Faulting_Address).encode(ExternalEncoding), input_name='Faulting_Address'), namespace_, eol_)) + showIndent(write, level, pretty_print) + write('<%sFaulting_Address>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Faulting_Address).encode(ExternalEncoding), input_name='Faulting_Address'), namespace_, eol_)) if self.Description is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sDescription>%s%s' % (namespace_, self.gds_format_integer(self.Description, input_name='Description'), namespace_, eol_)) - def exportLiteral(self, outfile, level, name_='MalwareExceptionType'): + showIndent(write, level, pretty_print) + write('<%sDescription>%s%s' % (namespace_, self.gds_format_integer(self.Description, input_name='Description'), namespace_, eol_)) + def exportLiteral(self, write, level, name_='MalwareExceptionType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.is_fatal is not None and 'is_fatal' not in already_processed: already_processed.add('is_fatal') - showIndent(outfile, level) - outfile.write('is_fatal = %s,\n' % (self.is_fatal,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('is_fatal = %s,\n' % (self.is_fatal,)) + def exportLiteralChildren(self, write, level, name_): if self.Exception_Code is not None: - showIndent(outfile, level) - outfile.write('Exception_Code=%s,\n' % quote_python(self.Exception_Code).encode(ExternalEncoding)) + showIndent(write, level) + write('Exception_Code=%s,\n' % quote_python(self.Exception_Code).encode(ExternalEncoding)) if self.Faulting_Address is not None: - showIndent(outfile, level) - outfile.write('Faulting_Address=%s,\n' % quote_python(self.Faulting_Address).encode(ExternalEncoding)) + showIndent(write, level) + write('Faulting_Address=%s,\n' % quote_python(self.Faulting_Address).encode(ExternalEncoding)) if self.Description is not None: - showIndent(outfile, level) - outfile.write('Description=%d,\n' % self.Description) + showIndent(write, level) + write('Description=%d,\n' % self.Description) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4400,54 +4400,54 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareDevelopmentEnvironmentType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareDevelopmentEnvironmentType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareDevelopmentEnvironmentType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Tools is not None: - self.Tools.export(outfile, level, namespace_, name_='Tools', pretty_print=pretty_print) + self.Tools.export(write, level, namespace_, name_='Tools', pretty_print=pretty_print) for Debugging_File_ in self.Debugging_File: - Debugging_File_.export(outfile, level, namespace_, name_='Debugging_File', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareDevelopmentEnvironmentType'): + Debugging_File_.export(write, level, namespace_, name_='Debugging_File', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareDevelopmentEnvironmentType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Tools is not None: - showIndent(outfile, level) - outfile.write('Tools=%s,\n' % quote_python(self.Tools).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('Debugging_File=[\n') + showIndent(write, level) + write('Tools=%s,\n' % quote_python(self.Tools).encode(ExternalEncoding)) + showIndent(write, level) + write('Debugging_File=[\n') level += 1 for Debugging_File_ in self.Debugging_File: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(Debugging_File_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(Debugging_File_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4494,50 +4494,50 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationParameterType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationParameterType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareConfigurationParameterType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareConfigurationParameterType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationParameterType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationParameterType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationParameterType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationParameterType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Name is not None: - self.Name.export(outfile, level, 'maecPackage:', name_='Name', pretty_print=pretty_print) + self.Name.export(write, level, 'maecPackage:', name_='Name', pretty_print=pretty_print) if self.Value is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sValue>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Value).encode(ExternalEncoding), input_name='Value'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='MalwareConfigurationParameterType'): + showIndent(write, level, pretty_print) + write('<%sValue>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Value).encode(ExternalEncoding), input_name='Value'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='MalwareConfigurationParameterType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Name is not None: - outfile.write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(outfile, level, name_='Name') - outfile.write('),\n') + write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Name.exportLiteral(write, level, name_='Name') + write('),\n') if self.Value is not None: - showIndent(outfile, level) - outfile.write('Value=%s,\n' % quote_python(self.Value).encode(ExternalEncoding)) + showIndent(write, level) + write('Value=%s,\n' % quote_python(self.Value).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4592,63 +4592,63 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareConfigurationDetailsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareConfigurationDetailsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationDetailsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Storage is not None: - self.Storage.export(outfile, level, 'maecPackage:', name_='Storage', pretty_print=pretty_print) + self.Storage.export(write, level, 'maecPackage:', name_='Storage', pretty_print=pretty_print) if self.Obfuscation is not None: - self.Obfuscation.export(outfile, level, 'maecPackage:', name_='Obfuscation', pretty_print=pretty_print) + self.Obfuscation.export(write, level, 'maecPackage:', name_='Obfuscation', pretty_print=pretty_print) for Configuration_Parameter_ in self.Configuration_Parameter: - Configuration_Parameter_.export(outfile, level, 'maecPackage:', name_='Configuration_Parameter', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareConfigurationDetailsType'): + Configuration_Parameter_.export(write, level, 'maecPackage:', name_='Configuration_Parameter', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareConfigurationDetailsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Storage is not None: - outfile.write('Storage=model_.MalwareConfigurationStorageDetailsType(\n') - self.Storage.exportLiteral(outfile, level, name_='Storage') - outfile.write('),\n') + write('Storage=model_.MalwareConfigurationStorageDetailsType(\n') + self.Storage.exportLiteral(write, level, name_='Storage') + write('),\n') if self.Obfuscation is not None: - outfile.write('Obfuscation=model_.MalwareConfigurationObfuscationDetailsType(\n') - self.Obfuscation.exportLiteral(outfile, level, name_='Obfuscation') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('Configuration_Parameter=[\n') + write('Obfuscation=model_.MalwareConfigurationObfuscationDetailsType(\n') + self.Obfuscation.exportLiteral(write, level, name_='Obfuscation') + write('),\n') + showIndent(write, level) + write('Configuration_Parameter=[\n') level += 1 for Configuration_Parameter_ in self.Configuration_Parameter: - outfile.write('model_.MalwareConfigurationParameterType(\n') - Configuration_Parameter_.exportLiteral(outfile, level, name_='MalwareConfigurationParameterType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareConfigurationParameterType(\n') + Configuration_Parameter_.exportLiteral(write, level, name_='MalwareConfigurationParameterType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4710,63 +4710,63 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareConfigurationObfuscationDetailsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareConfigurationObfuscationDetailsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType'): if self.is_encoded is not None and 'is_encoded' not in already_processed: already_processed.add('is_encoded') - outfile.write(' is_encoded="%s"' % self.gds_format_boolean(self.is_encoded, input_name='is_encoded')) + write(' is_encoded="%s"' % self.gds_format_boolean(self.is_encoded, input_name='is_encoded')) if self.is_encrypted is not None and 'is_encrypted' not in already_processed: already_processed.add('is_encrypted') - outfile.write(' is_encrypted="%s"' % self.gds_format_boolean(self.is_encrypted, input_name='is_encrypted')) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType', fromsubclass_=False, pretty_print=True): + write(' is_encrypted="%s"' % self.gds_format_boolean(self.is_encrypted, input_name='is_encrypted')) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationDetailsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' for Algorithm_Details_ in self.Algorithm_Details: - Algorithm_Details_.export(outfile, level, 'maecPackage:', name_='Algorithm_Details', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareConfigurationObfuscationDetailsType'): + Algorithm_Details_.export(write, level, 'maecPackage:', name_='Algorithm_Details', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareConfigurationObfuscationDetailsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.is_encoded is not None and 'is_encoded' not in already_processed: already_processed.add('is_encoded') - showIndent(outfile, level) - outfile.write('is_encoded = %s,\n' % (self.is_encoded,)) + showIndent(write, level) + write('is_encoded = %s,\n' % (self.is_encoded,)) if self.is_encrypted is not None and 'is_encrypted' not in already_processed: already_processed.add('is_encrypted') - showIndent(outfile, level) - outfile.write('is_encrypted = %s,\n' % (self.is_encrypted,)) - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('Algorithm_Details=[\n') + showIndent(write, level) + write('is_encrypted = %s,\n' % (self.is_encrypted,)) + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('Algorithm_Details=[\n') level += 1 for Algorithm_Details_ in self.Algorithm_Details: - outfile.write('model_.MalwareConfigurationObfuscationAlgorithmType(\n') - Algorithm_Details_.exportLiteral(outfile, level, name_='MalwareConfigurationObfuscationAlgorithmType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.MalwareConfigurationObfuscationAlgorithmType(\n') + Algorithm_Details_.exportLiteral(write, level, name_='MalwareConfigurationObfuscationAlgorithmType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4832,55 +4832,55 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareConfigurationObfuscationAlgorithmType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareConfigurationObfuscationAlgorithmType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType'): if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - outfile.write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType', fromsubclass_=False, pretty_print=True): + write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationObfuscationAlgorithmType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Key is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sKey>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Key).encode(ExternalEncoding), input_name='Key'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sKey>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Key).encode(ExternalEncoding), input_name='Key'), 'maecPackage:', eol_)) if self.Algorithm_Name is not None: - self.Algorithm_Name.export(outfile, level, 'maecPackage:', name_='Algorithm_Name', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareConfigurationObfuscationAlgorithmType'): + self.Algorithm_Name.export(write, level, 'maecPackage:', name_='Algorithm_Name', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareConfigurationObfuscationAlgorithmType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') - showIndent(outfile, level) - outfile.write('ordinal_position = %d,\n' % (self.ordinal_position,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('ordinal_position = %d,\n' % (self.ordinal_position,)) + def exportLiteralChildren(self, write, level, name_): if self.Key is not None: - showIndent(outfile, level) - outfile.write('Key=%s,\n' % quote_python(self.Key).encode(ExternalEncoding)) + showIndent(write, level) + write('Key=%s,\n' % quote_python(self.Key).encode(ExternalEncoding)) if self.Algorithm_Name is not None: - outfile.write('Algorithm_Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Algorithm_Name.exportLiteral(outfile, level, name_='Algorithm_Name') - outfile.write('),\n') + write('Algorithm_Name=model_.cybox_common.ControlledVocabularyStringType(\n') + self.Algorithm_Name.exportLiteral(write, level, name_='Algorithm_Name') + write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4943,63 +4943,63 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareConfigurationStorageDetailsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareConfigurationStorageDetailsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareConfigurationStorageDetailsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.Malware_Binary is not None: - self.Malware_Binary.export(outfile, level, 'maecPackage:', name_='Malware_Binary', pretty_print=pretty_print) + self.Malware_Binary.export(write, level, 'maecPackage:', name_='Malware_Binary', pretty_print=pretty_print) if self.File is not None: - self.File.export(outfile, level, 'maecPackage:', name_='File', pretty_print=pretty_print) + self.File.export(write, level, 'maecPackage:', name_='File', pretty_print=pretty_print) for URL_ in self.URL: - URL_.export(outfile, level, 'maecPackage:', name_='URL', pretty_print=pretty_print) - def exportLiteral(self, outfile, level, name_='MalwareConfigurationStorageDetailsType'): + URL_.export(write, level, 'maecPackage:', name_='URL', pretty_print=pretty_print) + def exportLiteral(self, write, level, name_='MalwareConfigurationStorageDetailsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.Malware_Binary is not None: - outfile.write('Malware_Binary=model_.MalwareBinaryConfigurationStorageDetailsType(\n') - self.Malware_Binary.exportLiteral(outfile, level, name_='Malware_Binary') - outfile.write('),\n') + write('Malware_Binary=model_.MalwareBinaryConfigurationStorageDetailsType(\n') + self.Malware_Binary.exportLiteral(write, level, name_='Malware_Binary') + write('),\n') if self.File is not None: - outfile.write('File=model_.file_object.FileObjectType(\n') - self.File.exportLiteral(outfile, level, name_='File') - outfile.write('),\n') - showIndent(outfile, level) - outfile.write('URL=[\n') + write('File=model_.file_object.FileObjectType(\n') + self.File.exportLiteral(write, level, name_='File') + write('),\n') + showIndent(write, level) + write('URL=[\n') level += 1 for URL_ in self.URL: - outfile.write('model_.uri_object.URIObjectType(\n') - URL_.exportLiteral(outfile, level, name_='uri_object.URIObjectType') - showIndent(outfile, level) - outfile.write('),\n') + write('model_.uri_object.URIObjectType(\n') + URL_.exportLiteral(write, level, name_='uri_object.URIObjectType') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5054,56 +5054,56 @@ def hasContent_(self): return True else: return False - def export(self, outfile, level, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType', namespacedef_='', pretty_print=True): + def export(self, write, level, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType', namespacedef_='', pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' - showIndent(outfile, level, pretty_print) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + showIndent(write, level, pretty_print) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = set() - self.exportAttributes(outfile, level, already_processed, namespace_, name_='MalwareBinaryConfigurationStorageDetailsType') + self.exportAttributes(write, level, already_processed, namespace_, name_='MalwareBinaryConfigurationStorageDetailsType') if self.hasContent_(): - outfile.write('>%s' % (eol_, )) - self.exportChildren(outfile, level + 1, namespace_, name_, pretty_print=pretty_print) - showIndent(outfile, level, pretty_print) - outfile.write('%s' % (namespace_, name_, eol_)) + write('>%s' % (eol_, )) + self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) + showIndent(write, level, pretty_print) + write('%s' % (namespace_, name_, eol_)) else: - outfile.write('/>%s' % (eol_, )) - def exportAttributes(self, outfile, level, already_processed, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType'): + write('/>%s' % (eol_, )) + def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType'): pass - def exportChildren(self, outfile, level, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType', fromsubclass_=False, pretty_print=True): + def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareBinaryConfigurationStorageDetailsType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' else: eol_ = '' if self.File_Offset is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sFile_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.File_Offset).encode(ExternalEncoding), input_name='File_Offset'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sFile_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.File_Offset).encode(ExternalEncoding), input_name='File_Offset'), 'maecPackage:', eol_)) if self.Section_Name is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sSection_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Name).encode(ExternalEncoding), input_name='Section_Name'), 'maecPackage:', eol_)) + showIndent(write, level, pretty_print) + write('<%sSection_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Name).encode(ExternalEncoding), input_name='Section_Name'), 'maecPackage:', eol_)) if self.Section_Offset is not None: - showIndent(outfile, level, pretty_print) - outfile.write('<%sSection_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Offset).encode(ExternalEncoding), input_name='Section_Offset'), 'maecPackage:', eol_)) - def exportLiteral(self, outfile, level, name_='MalwareBinaryConfigurationStorageDetailsType'): + showIndent(write, level, pretty_print) + write('<%sSection_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Offset).encode(ExternalEncoding), input_name='Section_Offset'), 'maecPackage:', eol_)) + def exportLiteral(self, write, level, name_='MalwareBinaryConfigurationStorageDetailsType'): level += 1 already_processed = set() - self.exportLiteralAttributes(outfile, level, already_processed, name_) + self.exportLiteralAttributes(write, level, already_processed, name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.File_Offset is not None: - showIndent(outfile, level) - outfile.write('File_Offset=%s,\n' % quote_python(self.File_Offset).encode(ExternalEncoding)) + showIndent(write, level) + write('File_Offset=%s,\n' % quote_python(self.File_Offset).encode(ExternalEncoding)) if self.Section_Name is not None: - showIndent(outfile, level) - outfile.write('Section_Name=%s,\n' % quote_python(self.Section_Name).encode(ExternalEncoding)) + showIndent(write, level) + write('Section_Name=%s,\n' % quote_python(self.Section_Name).encode(ExternalEncoding)) if self.Section_Offset is not None: - showIndent(outfile, level) - outfile.write('Section_Offset=%s,\n' % quote_python(self.Section_Offset).encode(ExternalEncoding)) + showIndent(write, level) + write('Section_Offset=%s,\n' % quote_python(self.Section_Offset).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 03328bc..ca37024 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -164,9 +164,9 @@ def gds_build_any(self, node, type_name=None): # Support/utility functions. # -def showIndent(outfile, level): +def showIndent(write, level): for idx in range(level): - outfile.write(' ') + write(' ') def quote_xml(inStr): if not inStr: @@ -271,42 +271,42 @@ def getValue(self): return self.value def getName(self): return self.name - def export(self, outfile, level, name, namespace): + def export(self, write, level, name, namespace): if self.category == MixedContainer.CategoryText: # Prevent exporting empty content as empty lines. if self.value.strip(): - outfile.write(self.value) + write(self.value) elif self.category == MixedContainer.CategorySimple: - self.exportSimple(outfile, level, name) + self.exportSimple(write, level, name) else: # category == MixedContainer.CategoryComplex - self.value.export(outfile, level, namespace,name) - def exportSimple(self, outfile, level, name): + self.value.export(write, level, namespace,name) + def exportSimple(self, write, level, name): if self.content_type == MixedContainer.TypeString: - outfile.write('<%s>%s' % (self.name, self.value, self.name)) + write('<%s>%s' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeInteger or \ self.content_type == MixedContainer.TypeBoolean: - outfile.write('<%s>%d' % (self.name, self.value, self.name)) + write('<%s>%d' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeFloat or \ self.content_type == MixedContainer.TypeDecimal: - outfile.write('<%s>%f' % (self.name, self.value, self.name)) + write('<%s>%f' % (self.name, self.value, self.name)) elif self.content_type == MixedContainer.TypeDouble: - outfile.write('<%s>%g' % (self.name, self.value, self.name)) - def exportLiteral(self, outfile, level, name): + write('<%s>%g' % (self.name, self.value, self.name)) + def exportLiteral(self, write, level, name): if self.category == MixedContainer.CategoryText: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ (self.category, self.content_type, self.name, self.value)) elif self.category == MixedContainer.CategorySimple: - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ (self.category, self.content_type, self.name, self.value)) else: # category == MixedContainer.CategoryComplex - showIndent(outfile, level) - outfile.write('model_.MixedContainer(%d, %d, "%s",\n' % \ + showIndent(write, level) + write('model_.MixedContainer(%d, %d, "%s",\n' % \ (self.category, self.content_type, self.name,)) - self.value.exportLiteral(outfile, level + 1) - showIndent(outfile, level) - outfile.write(')\n') + self.value.exportLiteral(write, level + 1) + showIndent(write, level) + write(')\n') class MemberSpec_(object): @@ -457,46 +457,46 @@ def get_version(self): return self.version def set_version(self, version): self.version = version def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='malwareMetaData', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='malwareMetaData', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='malwareMetaData') + self.exportAttributes(write, level, already_processed, namespace_, name_='malwareMetaData') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='malwareMetaData'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='malwareMetaData'): if self.version is not None and 'version' not in already_processed: already_processed.append('version') - outfile.write(' version="%s"' % self.gds_format_float(self.version, input_name='version')) + write(' version="%s"' % self.gds_format_float(self.version, input_name='version')) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='malwareMetaData', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='malwareMetaData', fromsubclass_=False): if self.company is not None: - showIndent(outfile, level) - outfile.write('<%scompany>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.company).encode(ExternalEncoding), input_name='company'), namespace_)) + showIndent(write, level) + write('<%scompany>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.company).encode(ExternalEncoding), input_name='company'), namespace_)) if self.author is not None: - showIndent(outfile, level) - outfile.write('<%sauthor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.author).encode(ExternalEncoding), input_name='author'), namespace_)) + showIndent(write, level) + write('<%sauthor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.author).encode(ExternalEncoding), input_name='author'), namespace_)) if self.comment is not None: - showIndent(outfile, level) - outfile.write('<%scomment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.comment).encode(ExternalEncoding), input_name='comment'), namespace_)) + showIndent(write, level) + write('<%scomment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.comment).encode(ExternalEncoding), input_name='comment'), namespace_)) if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + showIndent(write, level) + write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) if self.objects is not None: - self.objects.export(outfile, level, namespace_, name_='objects') + self.objects.export(write, level, namespace_, name_='objects') if self.objectProperties is not None: - self.objectProperties.export(outfile, level, namespace_, name_='objectProperties') + self.objectProperties.export(write, level, namespace_, name_='objectProperties') if self.relationships is not None: - self.relationships.export(outfile, level, namespace_, name_='relationships') + self.relationships.export(write, level, namespace_, name_='relationships') if self.fieldData is not None: - self.fieldData.export(outfile, level, namespace_, name_='fieldData') + self.fieldData.export(write, level, namespace_, name_='fieldData') def hasContent_(self): if ( self.company is not None or @@ -511,57 +511,57 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='malwareMetaData'): + def exportLiteral(self, write, level, name_='malwareMetaData'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.version is not None and 'version' not in already_processed: already_processed.append('version') - showIndent(outfile, level) - outfile.write('version = %f,\n' % (self.version,)) + showIndent(write, level) + write('version = %f,\n' % (self.version,)) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.company is not None: - showIndent(outfile, level) - outfile.write('company=%s,\n' % quote_python(self.company).encode(ExternalEncoding)) + showIndent(write, level) + write('company=%s,\n' % quote_python(self.company).encode(ExternalEncoding)) if self.author is not None: - showIndent(outfile, level) - outfile.write('author=%s,\n' % quote_python(self.author).encode(ExternalEncoding)) + showIndent(write, level) + write('author=%s,\n' % quote_python(self.author).encode(ExternalEncoding)) if self.comment is not None: - showIndent(outfile, level) - outfile.write('comment=%s,\n' % quote_python(self.comment).encode(ExternalEncoding)) + showIndent(write, level) + write('comment=%s,\n' % quote_python(self.comment).encode(ExternalEncoding)) if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) + showIndent(write, level) + write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) if self.objects is not None: - showIndent(outfile, level) - outfile.write('objects=model_.objects(\n') - self.objects.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('objects=model_.objects(\n') + self.objects.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.objectProperties is not None: - showIndent(outfile, level) - outfile.write('objectProperties=model_.objectProperties(\n') - self.objectProperties.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('objectProperties=model_.objectProperties(\n') + self.objectProperties.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.relationships is not None: - showIndent(outfile, level) - outfile.write('relationships=model_.relationships(\n') - self.relationships.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('relationships=model_.relationships(\n') + self.relationships.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.fieldData is not None: - showIndent(outfile, level) - outfile.write('fieldData=model_.fieldData(\n') - self.fieldData.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('fieldData=model_.fieldData(\n') + self.fieldData.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -721,43 +721,43 @@ def get_taggant(self): return self.taggant def set_taggant(self, taggant): self.taggant = taggant def add_taggant(self, value): self.taggant.append(value) def insert_taggant(self, index, value): self.taggant[index] = value - def export(self, outfile, level, namespace_='', name_='objects', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='objects', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='objects') + self.exportAttributes(write, level, already_processed, namespace_, name_='objects') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='objects'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='objects'): pass - def exportChildren(self, outfile, level, namespace_='', name_='objects', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='objects', fromsubclass_=False): for file_ in self.file: - file_.export(outfile, level, namespace_, name_='file') + file_.export(write, level, namespace_, name_='file') for uri_ in self.uri: - uri_.export(outfile, level, namespace_, name_='uri') + uri_.export(write, level, namespace_, name_='uri') for domain_ in self.domain: - domain_.export(outfile, level, namespace_, name_='domain') + domain_.export(write, level, namespace_, name_='domain') for registry_ in self.registry: - registry_.export(outfile, level, namespace_, name_='registry') + registry_.export(write, level, namespace_, name_='registry') for ip_ in self.ip: - ip_.export(outfile, level, namespace_, name_='ip') + ip_.export(write, level, namespace_, name_='ip') for asn_ in self.asn: - asn_.export(outfile, level, namespace_, name_='asn') + asn_.export(write, level, namespace_, name_='asn') for entity_ in self.entity: - entity_.export(outfile, level, namespace_, name_='entity') + entity_.export(write, level, namespace_, name_='entity') for classification_ in self.classification: - classification_.export(outfile, level, namespace_, name_='classification') + classification_.export(write, level, namespace_, name_='classification') for softwarePackage_ in self.softwarePackage: - softwarePackage_.export(outfile, level, namespace_, name_='softwarePackage') + softwarePackage_.export(write, level, namespace_, name_='softwarePackage') for digitalSignature_ in self.digitalSignature: - digitalSignature_.export(outfile, level, namespace_, name_='digitalSignature') + digitalSignature_.export(write, level, namespace_, name_='digitalSignature') for taggant_ in self.taggant: - taggant_.export(outfile, level, namespace_, name_='taggant') + taggant_.export(write, level, namespace_, name_='taggant') def hasContent_(self): if ( self.file or @@ -775,146 +775,146 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='objects'): + def exportLiteral(self, write, level, name_='objects'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('file=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('file=[\n') level += 1 for file_ in self.file: - showIndent(outfile, level) - outfile.write('model_.fileObject(\n') - file_.exportLiteral(outfile, level, name_='fileObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.fileObject(\n') + file_.exportLiteral(write, level, name_='fileObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('uri=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('uri=[\n') level += 1 for uri_ in self.uri: - showIndent(outfile, level) - outfile.write('model_.uriObject(\n') - uri_.exportLiteral(outfile, level, name_='uriObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.uriObject(\n') + uri_.exportLiteral(write, level, name_='uriObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('domain=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('domain=[\n') level += 1 for domain_ in self.domain: - showIndent(outfile, level) - outfile.write('model_.domainObject(\n') - domain_.exportLiteral(outfile, level, name_='domainObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.domainObject(\n') + domain_.exportLiteral(write, level, name_='domainObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('registry=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('registry=[\n') level += 1 for registry_ in self.registry: - showIndent(outfile, level) - outfile.write('model_.registryObject(\n') - registry_.exportLiteral(outfile, level, name_='registryObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.registryObject(\n') + registry_.exportLiteral(write, level, name_='registryObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('ip=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('ip=[\n') level += 1 for ip_ in self.ip: - showIndent(outfile, level) - outfile.write('model_.IPObject(\n') - ip_.exportLiteral(outfile, level, name_='IPObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.IPObject(\n') + ip_.exportLiteral(write, level, name_='IPObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('asn=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('asn=[\n') level += 1 for asn_ in self.asn: - showIndent(outfile, level) - outfile.write('model_.ASNObject(\n') - asn_.exportLiteral(outfile, level, name_='ASNObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.ASNObject(\n') + asn_.exportLiteral(write, level, name_='ASNObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('entity=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('entity=[\n') level += 1 for entity_ in self.entity: - showIndent(outfile, level) - outfile.write('model_.entityObject(\n') - entity_.exportLiteral(outfile, level, name_='entityObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.entityObject(\n') + entity_.exportLiteral(write, level, name_='entityObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('classification=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('classification=[\n') level += 1 for classification_ in self.classification: - showIndent(outfile, level) - outfile.write('model_.classificationObject(\n') - classification_.exportLiteral(outfile, level, name_='classificationObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.classificationObject(\n') + classification_.exportLiteral(write, level, name_='classificationObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('softwarePackage=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('softwarePackage=[\n') level += 1 for softwarePackage_ in self.softwarePackage: - showIndent(outfile, level) - outfile.write('model_.softwarePackageObject(\n') - softwarePackage_.exportLiteral(outfile, level, name_='softwarePackageObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.softwarePackageObject(\n') + softwarePackage_.exportLiteral(write, level, name_='softwarePackageObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('digitalSignature=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('digitalSignature=[\n') level += 1 for digitalSignature_ in self.digitalSignature: - showIndent(outfile, level) - outfile.write('model_.digitalSignatureObject(\n') - digitalSignature_.exportLiteral(outfile, level, name_='digitalSignatureObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.digitalSignatureObject(\n') + digitalSignature_.exportLiteral(write, level, name_='digitalSignatureObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('taggant=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('taggant=[\n') level += 1 for taggant_ in self.taggant: - showIndent(outfile, level) - outfile.write('model_.taggantObject(\n') - taggant_.exportLiteral(outfile, level, name_='taggantObject') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.taggantObject(\n') + taggant_.exportLiteral(write, level, name_='taggantObject') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -990,23 +990,23 @@ def get_objectProperty(self): return self.objectProperty def set_objectProperty(self, objectProperty): self.objectProperty = objectProperty def add_objectProperty(self, value): self.objectProperty.append(value) def insert_objectProperty(self, index, value): self.objectProperty[index] = value - def export(self, outfile, level, namespace_='', name_='objectProperties', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='objectProperties', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='objectProperties') + self.exportAttributes(write, level, already_processed, namespace_, name_='objectProperties') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='objectProperties'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='objectProperties'): pass - def exportChildren(self, outfile, level, namespace_='', name_='objectProperties', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='objectProperties', fromsubclass_=False): for objectProperty_ in self.objectProperty: - objectProperty_.export(outfile, level, namespace_, name_='objectProperty') + objectProperty_.export(write, level, namespace_, name_='objectProperty') def hasContent_(self): if ( self.objectProperty @@ -1014,26 +1014,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='objectProperties'): + def exportLiteral(self, write, level, name_='objectProperties'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('objectProperty=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('objectProperty=[\n') level += 1 for objectProperty_ in self.objectProperty: - showIndent(outfile, level) - outfile.write('model_.objectProperty(\n') - objectProperty_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.objectProperty(\n') + objectProperty_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1068,23 +1068,23 @@ def get_relationship(self): return self.relationship def set_relationship(self, relationship): self.relationship = relationship def add_relationship(self, value): self.relationship.append(value) def insert_relationship(self, index, value): self.relationship[index] = value - def export(self, outfile, level, namespace_='', name_='relationships', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='relationships', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='relationships') + self.exportAttributes(write, level, already_processed, namespace_, name_='relationships') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='relationships'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='relationships'): pass - def exportChildren(self, outfile, level, namespace_='', name_='relationships', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='relationships', fromsubclass_=False): for relationship_ in self.relationship: - relationship_.export(outfile, level, namespace_, name_='relationship') + relationship_.export(write, level, namespace_, name_='relationship') def hasContent_(self): if ( self.relationship @@ -1092,26 +1092,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='relationships'): + def exportLiteral(self, write, level, name_='relationships'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('relationship=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('relationship=[\n') level += 1 for relationship_ in self.relationship: - showIndent(outfile, level) - outfile.write('model_.relationship(\n') - relationship_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.relationship(\n') + relationship_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1146,23 +1146,23 @@ def get_fieldDataEntry(self): return self.fieldDataEntry def set_fieldDataEntry(self, fieldDataEntry): self.fieldDataEntry = fieldDataEntry def add_fieldDataEntry(self, value): self.fieldDataEntry.append(value) def insert_fieldDataEntry(self, index, value): self.fieldDataEntry[index] = value - def export(self, outfile, level, namespace_='', name_='fieldData', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='fieldData', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='fieldData') + self.exportAttributes(write, level, already_processed, namespace_, name_='fieldData') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='fieldData'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='fieldData'): pass - def exportChildren(self, outfile, level, namespace_='', name_='fieldData', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='fieldData', fromsubclass_=False): for fieldDataEntry_ in self.fieldDataEntry: - fieldDataEntry_.export(outfile, level, namespace_, name_='fieldDataEntry') + fieldDataEntry_.export(write, level, namespace_, name_='fieldDataEntry') def hasContent_(self): if ( self.fieldDataEntry @@ -1170,26 +1170,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='fieldData'): + def exportLiteral(self, write, level, name_='fieldData'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('fieldDataEntry=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('fieldDataEntry=[\n') level += 1 for fieldDataEntry_ in self.fieldDataEntry: - showIndent(outfile, level) - outfile.write('model_.fieldDataEntry(\n') - fieldDataEntry_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.fieldDataEntry(\n') + fieldDataEntry_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1354,105 +1354,105 @@ def get_taggant(self): return self.taggant def set_taggant(self, taggant): self.taggant = taggant def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='fileObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='fileObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='fileObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='fileObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='fileObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='fileObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='', name_='fileObject', fromsubclass_=False): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='', name_='fileObject', fromsubclass_=False): if self.md5 is not None: - self.md5.export(outfile, level, namespace_, name_='md5', ) + self.md5.export(write, level, namespace_, name_='md5', ) if self.sha1 is not None: - self.sha1.export(outfile, level, namespace_, name_='sha1') + self.sha1.export(write, level, namespace_, name_='sha1') if self.sha256 is not None: - self.sha256.export(outfile, level, namespace_, name_='sha256') + self.sha256.export(write, level, namespace_, name_='sha256') if self.sha512 is not None: - self.sha512.export(outfile, level, namespace_, name_='sha512') + self.sha512.export(write, level, namespace_, name_='sha512') if self.size is not None: - showIndent(outfile, level) - outfile.write('<%ssize>%s\n' % (namespace_, self.gds_format_integer(self.size, input_name='size'), namespace_)) + showIndent(write, level) + write('<%ssize>%s\n' % (namespace_, self.gds_format_integer(self.size, input_name='size'), namespace_)) if self.crc32 is not None: - showIndent(outfile, level) - outfile.write('<%scrc32>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.crc32).encode(ExternalEncoding), input_name='crc32'), namespace_)) + showIndent(write, level) + write('<%scrc32>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.crc32).encode(ExternalEncoding), input_name='crc32'), namespace_)) for fileType_ in self.fileType: - showIndent(outfile, level) - outfile.write('<%sfileType>%s\n' % (namespace_, self.gds_format_string(quote_xml(fileType_).encode(ExternalEncoding), input_name='fileType'), namespace_)) + showIndent(write, level) + write('<%sfileType>%s\n' % (namespace_, self.gds_format_string(quote_xml(fileType_).encode(ExternalEncoding), input_name='fileType'), namespace_)) for extraHash_ in self.extraHash: - extraHash_.export(outfile, level, namespace_, name_='extraHash') + extraHash_.export(write, level, namespace_, name_='extraHash') for filename_ in self.filename: - showIndent(outfile, level) - outfile.write('<%sfilename>%s\n' % (namespace_, self.gds_format_string(quote_xml(filename_).encode(ExternalEncoding), input_name='filename'), namespace_)) + showIndent(write, level) + write('<%sfilename>%s\n' % (namespace_, self.gds_format_string(quote_xml(filename_).encode(ExternalEncoding), input_name='filename'), namespace_)) for normalizedNativePath_ in self.normalizedNativePath: - showIndent(outfile, level) - outfile.write('<%snormalizedNativePath>%s\n' % (namespace_, self.gds_format_string(quote_xml(normalizedNativePath_).encode(ExternalEncoding), input_name='normalizedNativePath'), namespace_)) + showIndent(write, level) + write('<%snormalizedNativePath>%s\n' % (namespace_, self.gds_format_string(quote_xml(normalizedNativePath_).encode(ExternalEncoding), input_name='normalizedNativePath'), namespace_)) for filenameWithinInstaller_ in self.filenameWithinInstaller: - showIndent(outfile, level) - outfile.write('<%sfilenameWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(filenameWithinInstaller_).encode(ExternalEncoding), input_name='filenameWithinInstaller'), namespace_)) + showIndent(write, level) + write('<%sfilenameWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(filenameWithinInstaller_).encode(ExternalEncoding), input_name='filenameWithinInstaller'), namespace_)) for folderWithinInstaller_ in self.folderWithinInstaller: - showIndent(outfile, level) - outfile.write('<%sfolderWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(folderWithinInstaller_).encode(ExternalEncoding), input_name='folderWithinInstaller'), namespace_)) + showIndent(write, level) + write('<%sfolderWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(folderWithinInstaller_).encode(ExternalEncoding), input_name='folderWithinInstaller'), namespace_)) if self.vendor is not None: - showIndent(outfile, level) - outfile.write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) + showIndent(write, level) + write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) for internalName_ in self.internalName: - showIndent(outfile, level) - outfile.write('<%sinternalName>%s\n' % (namespace_, self.gds_format_string(quote_xml(internalName_).encode(ExternalEncoding), input_name='internalName'), namespace_)) + showIndent(write, level) + write('<%sinternalName>%s\n' % (namespace_, self.gds_format_string(quote_xml(internalName_).encode(ExternalEncoding), input_name='internalName'), namespace_)) for language_ in self.language: - showIndent(outfile, level) - outfile.write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(language_).encode(ExternalEncoding), input_name='language'), namespace_)) + showIndent(write, level) + write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(language_).encode(ExternalEncoding), input_name='language'), namespace_)) if self.productName is not None: - showIndent(outfile, level) - outfile.write('<%sproductName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productName).encode(ExternalEncoding), input_name='productName'), namespace_)) + showIndent(write, level) + write('<%sproductName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productName).encode(ExternalEncoding), input_name='productName'), namespace_)) if self.fileVersion is not None: - showIndent(outfile, level) - outfile.write('<%sfileVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.fileVersion).encode(ExternalEncoding), input_name='fileVersion'), namespace_)) + showIndent(write, level) + write('<%sfileVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.fileVersion).encode(ExternalEncoding), input_name='fileVersion'), namespace_)) if self.productVersion is not None: - showIndent(outfile, level) - outfile.write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) + showIndent(write, level) + write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) if self.developmentEnvironment is not None: - showIndent(outfile, level) - outfile.write('<%sdevelopmentEnvironment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.developmentEnvironment).encode(ExternalEncoding), input_name='developmentEnvironment'), namespace_)) + showIndent(write, level) + write('<%sdevelopmentEnvironment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.developmentEnvironment).encode(ExternalEncoding), input_name='developmentEnvironment'), namespace_)) if self.checksum is not None: - self.checksum.export(outfile, level, namespace_, name_='checksum') + self.checksum.export(write, level, namespace_, name_='checksum') if self.architecture is not None: - showIndent(outfile, level) - outfile.write('<%sarchitecture>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.architecture).encode(ExternalEncoding), input_name='architecture'), namespace_)) + showIndent(write, level) + write('<%sarchitecture>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.architecture).encode(ExternalEncoding), input_name='architecture'), namespace_)) if self.buildTimeDateStamp is not None: - showIndent(outfile, level) - outfile.write('<%sbuildTimeDateStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.buildTimeDateStamp).encode(ExternalEncoding), input_name='buildTimeDateStamp'), namespace_)) + showIndent(write, level) + write('<%sbuildTimeDateStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.buildTimeDateStamp).encode(ExternalEncoding), input_name='buildTimeDateStamp'), namespace_)) if self.compilerVersion is not None: - showIndent(outfile, level) - outfile.write('<%scompilerVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.compilerVersion).encode(ExternalEncoding), input_name='compilerVersion'), namespace_)) + showIndent(write, level) + write('<%scompilerVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.compilerVersion).encode(ExternalEncoding), input_name='compilerVersion'), namespace_)) if self.linkerVersion is not None: - showIndent(outfile, level) - outfile.write('<%slinkerVersion>%s\n' % (namespace_, self.gds_format_float(self.linkerVersion, input_name='linkerVersion'), namespace_)) + showIndent(write, level) + write('<%slinkerVersion>%s\n' % (namespace_, self.gds_format_float(self.linkerVersion, input_name='linkerVersion'), namespace_)) if self.minOSVersionCPE is not None: - showIndent(outfile, level) - outfile.write('<%sminOSVersionCPE>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.minOSVersionCPE).encode(ExternalEncoding), input_name='minOSVersionCPE'), namespace_)) + showIndent(write, level) + write('<%sminOSVersionCPE>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.minOSVersionCPE).encode(ExternalEncoding), input_name='minOSVersionCPE'), namespace_)) if self.numberOfSections is not None: - showIndent(outfile, level) - outfile.write('<%snumberOfSections>%s\n' % (namespace_, self.gds_format_integer(self.numberOfSections, input_name='numberOfSections'), namespace_)) + showIndent(write, level) + write('<%snumberOfSections>%s\n' % (namespace_, self.gds_format_integer(self.numberOfSections, input_name='numberOfSections'), namespace_)) if self.MIMEType is not None: - showIndent(outfile, level) - outfile.write('<%sMIMEType>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.MIMEType).encode(ExternalEncoding), input_name='MIMEType'), namespace_)) + showIndent(write, level) + write('<%sMIMEType>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.MIMEType).encode(ExternalEncoding), input_name='MIMEType'), namespace_)) if self.requiredPrivilege is not None: - showIndent(outfile, level) - outfile.write('<%srequiredPrivilege>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.requiredPrivilege).encode(ExternalEncoding), input_name='requiredPrivilege'), namespace_)) + showIndent(write, level) + write('<%srequiredPrivilege>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.requiredPrivilege).encode(ExternalEncoding), input_name='requiredPrivilege'), namespace_)) if self.digitalSignature is not None: - self.digitalSignature.export(outfile, level, namespace_, name_='digitalSignature') + self.digitalSignature.export(write, level, namespace_, name_='digitalSignature') if self.taggant is not None: - self.taggant.export(outfile, level, namespace_, name_='taggant') + self.taggant.export(write, level, namespace_, name_='taggant') def hasContent_(self): if ( self.md5 is not None or @@ -1489,179 +1489,179 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='fileObject'): + def exportLiteral(self, write, level, name_='fileObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.md5 is not None: - showIndent(outfile, level) - outfile.write('md5=model_.xs_hexBinary(\n') - self.md5.exportLiteral(outfile, level, name_='md5') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('md5=model_.xs_hexBinary(\n') + self.md5.exportLiteral(write, level, name_='md5') + showIndent(write, level) + write('),\n') if self.sha1 is not None: - showIndent(outfile, level) - outfile.write('sha1=model_.xs_hexBinary(\n') - self.sha1.exportLiteral(outfile, level, name_='sha1') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('sha1=model_.xs_hexBinary(\n') + self.sha1.exportLiteral(write, level, name_='sha1') + showIndent(write, level) + write('),\n') if self.sha256 is not None: - showIndent(outfile, level) - outfile.write('sha256=model_.xs_hexBinary(\n') - self.sha256.exportLiteral(outfile, level, name_='sha256') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('sha256=model_.xs_hexBinary(\n') + self.sha256.exportLiteral(write, level, name_='sha256') + showIndent(write, level) + write('),\n') if self.sha512 is not None: - showIndent(outfile, level) - outfile.write('sha512=model_.xs_hexBinary(\n') - self.sha512.exportLiteral(outfile, level, name_='sha512') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('sha512=model_.xs_hexBinary(\n') + self.sha512.exportLiteral(write, level, name_='sha512') + showIndent(write, level) + write('),\n') if self.size is not None: - showIndent(outfile, level) - outfile.write('size=%d,\n' % self.size) + showIndent(write, level) + write('size=%d,\n' % self.size) if self.crc32 is not None: - showIndent(outfile, level) - outfile.write('crc32=%s,\n' % quote_python(self.crc32).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('fileType=[\n') + showIndent(write, level) + write('crc32=%s,\n' % quote_python(self.crc32).encode(ExternalEncoding)) + showIndent(write, level) + write('fileType=[\n') level += 1 for fileType_ in self.fileType: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(fileType_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(fileType_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('extraHash=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('extraHash=[\n') level += 1 for extraHash_ in self.extraHash: - showIndent(outfile, level) - outfile.write('model_.extraHash(\n') - extraHash_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.extraHash(\n') + extraHash_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('filename=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('filename=[\n') level += 1 for filename_ in self.filename: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(filename_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(filename_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('normalizedNativePath=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('normalizedNativePath=[\n') level += 1 for normalizedNativePath_ in self.normalizedNativePath: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(normalizedNativePath_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(normalizedNativePath_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('filenameWithinInstaller=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('filenameWithinInstaller=[\n') level += 1 for filenameWithinInstaller_ in self.filenameWithinInstaller: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(filenameWithinInstaller_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(filenameWithinInstaller_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('folderWithinInstaller=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('folderWithinInstaller=[\n') level += 1 for folderWithinInstaller_ in self.folderWithinInstaller: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(folderWithinInstaller_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(folderWithinInstaller_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') if self.vendor is not None: - showIndent(outfile, level) - outfile.write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('internalName=[\n') + showIndent(write, level) + write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) + showIndent(write, level) + write('internalName=[\n') level += 1 for internalName_ in self.internalName: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(internalName_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(internalName_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') - showIndent(outfile, level) - outfile.write('language=[\n') + showIndent(write, level) + write('],\n') + showIndent(write, level) + write('language=[\n') level += 1 for language_ in self.language: - showIndent(outfile, level) - outfile.write('%s,\n' % quote_python(language_).encode(ExternalEncoding)) + showIndent(write, level) + write('%s,\n' % quote_python(language_).encode(ExternalEncoding)) level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') if self.productName is not None: - showIndent(outfile, level) - outfile.write('productName=%s,\n' % quote_python(self.productName).encode(ExternalEncoding)) + showIndent(write, level) + write('productName=%s,\n' % quote_python(self.productName).encode(ExternalEncoding)) if self.fileVersion is not None: - showIndent(outfile, level) - outfile.write('fileVersion=%s,\n' % quote_python(self.fileVersion).encode(ExternalEncoding)) + showIndent(write, level) + write('fileVersion=%s,\n' % quote_python(self.fileVersion).encode(ExternalEncoding)) if self.productVersion is not None: - showIndent(outfile, level) - outfile.write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) + showIndent(write, level) + write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) if self.developmentEnvironment is not None: - showIndent(outfile, level) - outfile.write('developmentEnvironment=%s,\n' % quote_python(self.developmentEnvironment).encode(ExternalEncoding)) + showIndent(write, level) + write('developmentEnvironment=%s,\n' % quote_python(self.developmentEnvironment).encode(ExternalEncoding)) if self.checksum is not None: - showIndent(outfile, level) - outfile.write('checksum=model_.xs_hexBinary(\n') - self.checksum.exportLiteral(outfile, level, name_='checksum') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('checksum=model_.xs_hexBinary(\n') + self.checksum.exportLiteral(write, level, name_='checksum') + showIndent(write, level) + write('),\n') if self.architecture is not None: - showIndent(outfile, level) - outfile.write('architecture=%s,\n' % quote_python(self.architecture).encode(ExternalEncoding)) + showIndent(write, level) + write('architecture=%s,\n' % quote_python(self.architecture).encode(ExternalEncoding)) if self.buildTimeDateStamp is not None: - showIndent(outfile, level) - outfile.write('buildTimeDateStamp=%s,\n' % quote_python(self.buildTimeDateStamp).encode(ExternalEncoding)) + showIndent(write, level) + write('buildTimeDateStamp=%s,\n' % quote_python(self.buildTimeDateStamp).encode(ExternalEncoding)) if self.compilerVersion is not None: - showIndent(outfile, level) - outfile.write('compilerVersion=%s,\n' % quote_python(self.compilerVersion).encode(ExternalEncoding)) + showIndent(write, level) + write('compilerVersion=%s,\n' % quote_python(self.compilerVersion).encode(ExternalEncoding)) if self.linkerVersion is not None: - showIndent(outfile, level) - outfile.write('linkerVersion=%f,\n' % self.linkerVersion) + showIndent(write, level) + write('linkerVersion=%f,\n' % self.linkerVersion) if self.minOSVersionCPE is not None: - showIndent(outfile, level) - outfile.write('minOSVersionCPE=%s,\n' % quote_python(self.minOSVersionCPE).encode(ExternalEncoding)) + showIndent(write, level) + write('minOSVersionCPE=%s,\n' % quote_python(self.minOSVersionCPE).encode(ExternalEncoding)) if self.numberOfSections is not None: - showIndent(outfile, level) - outfile.write('numberOfSections=%d,\n' % self.numberOfSections) + showIndent(write, level) + write('numberOfSections=%d,\n' % self.numberOfSections) if self.MIMEType is not None: - showIndent(outfile, level) - outfile.write('MIMEType=%s,\n' % quote_python(self.MIMEType).encode(ExternalEncoding)) + showIndent(write, level) + write('MIMEType=%s,\n' % quote_python(self.MIMEType).encode(ExternalEncoding)) if self.requiredPrivilege is not None: - showIndent(outfile, level) - outfile.write('requiredPrivilege=%s,\n' % quote_python(self.requiredPrivilege).encode(ExternalEncoding)) + showIndent(write, level) + write('requiredPrivilege=%s,\n' % quote_python(self.requiredPrivilege).encode(ExternalEncoding)) if self.digitalSignature is not None: - showIndent(outfile, level) - outfile.write('digitalSignature=model_.digitalSignatureObject(\n') - self.digitalSignature.exportLiteral(outfile, level, name_='digitalSignature') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('digitalSignature=model_.digitalSignatureObject(\n') + self.digitalSignature.exportLiteral(write, level, name_='digitalSignature') + showIndent(write, level) + write('),\n') if self.taggant is not None: - showIndent(outfile, level) - outfile.write('taggant=model_.taggantObject(\n') - self.taggant.exportLiteral(outfile, level, name_='taggant') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('taggant=model_.taggantObject(\n') + self.taggant.exportLiteral(write, level, name_='taggant') + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1827,23 +1827,23 @@ def get_type(self): return self.type_ def set_type(self, type_): self.type_ = type_ def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='extraHash', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='extraHash', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='extraHash') + self.exportAttributes(write, level, already_processed, namespace_, name_='extraHash') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='extraHash'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='extraHash'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) - def exportChildren(self, outfile, level, namespace_='', name_='extraHash', fromsubclass_=False): + write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) + def exportChildren(self, write, level, namespace_='', name_='extraHash', fromsubclass_=False): pass def hasContent_(self): if ( @@ -1852,19 +1852,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='extraHash'): + def exportLiteral(self, write, level, name_='extraHash'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -1907,29 +1907,29 @@ def get_valueName(self): return self.valueName def set_valueName(self, valueName): self.valueName = valueName def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='registryObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='registryObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='registryObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='registryObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='registryObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='registryObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='registryObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='registryObject', fromsubclass_=False): if self.key is not None: - showIndent(outfile, level) - outfile.write('<%skey>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.key).encode(ExternalEncoding), input_name='key'), namespace_)) + showIndent(write, level) + write('<%skey>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.key).encode(ExternalEncoding), input_name='key'), namespace_)) if self.valueName is not None: - showIndent(outfile, level) - outfile.write('<%svalueName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.valueName).encode(ExternalEncoding), input_name='valueName'), namespace_)) + showIndent(write, level) + write('<%svalueName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.valueName).encode(ExternalEncoding), input_name='valueName'), namespace_)) def hasContent_(self): if ( self.key is not None or @@ -1938,23 +1938,23 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='registryObject'): + def exportLiteral(self, write, level, name_='registryObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.key is not None: - showIndent(outfile, level) - outfile.write('key=%s,\n' % quote_python(self.key).encode(ExternalEncoding)) + showIndent(write, level) + write('key=%s,\n' % quote_python(self.key).encode(ExternalEncoding)) if self.valueName is not None: - showIndent(outfile, level) - outfile.write('valueName=%s,\n' % quote_python(self.valueName).encode(ExternalEncoding)) + showIndent(write, level) + write('valueName=%s,\n' % quote_python(self.valueName).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1998,26 +1998,26 @@ def get_name(self): return self.name def set_name(self, name): self.name = name def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='entityObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='entityObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='entityObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='entityObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='entityObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='entityObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='entityObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='entityObject', fromsubclass_=False): if self.name is not None: - showIndent(outfile, level) - outfile.write('<%sname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.name).encode(ExternalEncoding), input_name='name'), namespace_)) + showIndent(write, level) + write('<%sname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.name).encode(ExternalEncoding), input_name='name'), namespace_)) def hasContent_(self): if ( self.name is not None @@ -2025,20 +2025,20 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='entityObject'): + def exportLiteral(self, write, level, name_='entityObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.name is not None: - showIndent(outfile, level) - outfile.write('name=%s,\n' % quote_python(self.name).encode(ExternalEncoding)) + showIndent(write, level) + write('name=%s,\n' % quote_python(self.name).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2103,44 +2103,44 @@ def get_ipProtocol(self): return self.ipProtocol def set_ipProtocol(self, ipProtocol): self.ipProtocol = ipProtocol def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='uriObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='uriObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='uriObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='uriObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='uriObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='uriObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='', name_='uriObject', fromsubclass_=False): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='', name_='uriObject', fromsubclass_=False): if self.uriString is not None: - showIndent(outfile, level) - outfile.write('<%suriString>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.uriString).encode(ExternalEncoding), input_name='uriString'), namespace_)) + showIndent(write, level) + write('<%suriString>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.uriString).encode(ExternalEncoding), input_name='uriString'), namespace_)) if self.protocol is not None: - showIndent(outfile, level) - outfile.write('<%sprotocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.protocol).encode(ExternalEncoding), input_name='protocol'), namespace_)) + showIndent(write, level) + write('<%sprotocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.protocol).encode(ExternalEncoding), input_name='protocol'), namespace_)) if self.hostname is not None: - showIndent(outfile, level) - outfile.write('<%shostname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.hostname).encode(ExternalEncoding), input_name='hostname'), namespace_)) + showIndent(write, level) + write('<%shostname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.hostname).encode(ExternalEncoding), input_name='hostname'), namespace_)) if self.domain is not None: - showIndent(outfile, level) - outfile.write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) + showIndent(write, level) + write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) if self.port is not None: - showIndent(outfile, level) - outfile.write('<%sport>%s\n' % (namespace_, self.gds_format_integer(self.port, input_name='port'), namespace_)) + showIndent(write, level) + write('<%sport>%s\n' % (namespace_, self.gds_format_integer(self.port, input_name='port'), namespace_)) if self.path is not None: - showIndent(outfile, level) - outfile.write('<%spath>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.path).encode(ExternalEncoding), input_name='path'), namespace_)) + showIndent(write, level) + write('<%spath>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.path).encode(ExternalEncoding), input_name='path'), namespace_)) if self.ipProtocol is not None: - showIndent(outfile, level) - outfile.write('<%sipProtocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.ipProtocol).encode(ExternalEncoding), input_name='ipProtocol'), namespace_)) + showIndent(write, level) + write('<%sipProtocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.ipProtocol).encode(ExternalEncoding), input_name='ipProtocol'), namespace_)) def hasContent_(self): if ( self.uriString is not None or @@ -2154,38 +2154,38 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='uriObject'): + def exportLiteral(self, write, level, name_='uriObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.uriString is not None: - showIndent(outfile, level) - outfile.write('uriString=%s,\n' % quote_python(self.uriString).encode(ExternalEncoding)) + showIndent(write, level) + write('uriString=%s,\n' % quote_python(self.uriString).encode(ExternalEncoding)) if self.protocol is not None: - showIndent(outfile, level) - outfile.write('protocol=%s,\n' % quote_python(self.protocol).encode(ExternalEncoding)) + showIndent(write, level) + write('protocol=%s,\n' % quote_python(self.protocol).encode(ExternalEncoding)) if self.hostname is not None: - showIndent(outfile, level) - outfile.write('hostname=%s,\n' % quote_python(self.hostname).encode(ExternalEncoding)) + showIndent(write, level) + write('hostname=%s,\n' % quote_python(self.hostname).encode(ExternalEncoding)) if self.domain is not None: - showIndent(outfile, level) - outfile.write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) + showIndent(write, level) + write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) if self.port is not None: - showIndent(outfile, level) - outfile.write('port=%d,\n' % self.port) + showIndent(write, level) + write('port=%d,\n' % self.port) if self.path is not None: - showIndent(outfile, level) - outfile.write('path=%s,\n' % quote_python(self.path).encode(ExternalEncoding)) + showIndent(write, level) + write('path=%s,\n' % quote_python(self.path).encode(ExternalEncoding)) if self.ipProtocol is not None: - showIndent(outfile, level) - outfile.write('ipProtocol=%s,\n' % quote_python(self.ipProtocol).encode(ExternalEncoding)) + showIndent(write, level) + write('ipProtocol=%s,\n' % quote_python(self.ipProtocol).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2262,27 +2262,27 @@ def set_id(self, id): self.id = id def validate_IPRange(self, value): # Validate type IPRange, a restriction on xs:string. pass - def export(self, outfile, level, namespace_='', name_='IPObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='IPObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='IPObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='IPObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='IPObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='IPObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='', name_='IPObject', fromsubclass_=False): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='', name_='IPObject', fromsubclass_=False): if self.startAddress is not None: - self.startAddress.export(outfile, level, namespace_, name_='startAddress', ) + self.startAddress.export(write, level, namespace_, name_='startAddress', ) if self.endAddress is not None: - self.endAddress.export(outfile, level, namespace_, name_='endAddress', ) + self.endAddress.export(write, level, namespace_, name_='endAddress', ) def hasContent_(self): if ( self.startAddress is not None or @@ -2291,29 +2291,29 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='IPObject'): + def exportLiteral(self, write, level, name_='IPObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.startAddress is not None: - showIndent(outfile, level) - outfile.write('startAddress=model_.IPAddress(\n') - self.startAddress.exportLiteral(outfile, level, name_='startAddress') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('startAddress=model_.IPAddress(\n') + self.startAddress.exportLiteral(write, level, name_='startAddress') + showIndent(write, level) + write('),\n') if self.endAddress is not None: - showIndent(outfile, level) - outfile.write('endAddress=model_.IPAddress(\n') - self.endAddress.exportLiteral(outfile, level, name_='endAddress') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('endAddress=model_.IPAddress(\n') + self.endAddress.exportLiteral(write, level, name_='endAddress') + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2358,23 +2358,23 @@ def validate_IPTypeEnum(self, value): pass def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='IPAddress', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='IPAddress', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='IPAddress') + self.exportAttributes(write, level, already_processed, namespace_, name_='IPAddress') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='IPAddress'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='IPAddress'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) - def exportChildren(self, outfile, level, namespace_='', name_='IPAddress', fromsubclass_=False): + write(' type=%s' % (quote_attrib(self.type_), )) + def exportChildren(self, write, level, namespace_='', name_='IPAddress', fromsubclass_=False): pass def hasContent_(self): if ( @@ -2383,19 +2383,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='IPAddress'): + def exportLiteral(self, write, level, name_='IPAddress'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -2433,26 +2433,26 @@ def get_domain(self): return self.domain def set_domain(self, domain): self.domain = domain def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='domainObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='domainObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='domainObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='domainObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='domainObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='domainObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='domainObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='domainObject', fromsubclass_=False): if self.domain is not None: - showIndent(outfile, level) - outfile.write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) + showIndent(write, level) + write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) def hasContent_(self): if ( self.domain is not None @@ -2460,20 +2460,20 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='domainObject'): + def exportLiteral(self, write, level, name_='domainObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.domain is not None: - showIndent(outfile, level) - outfile.write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) + showIndent(write, level) + write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2514,26 +2514,26 @@ def get_as_number(self): return self.as_number def set_as_number(self, as_number): self.as_number = as_number def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='ASNObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='ASNObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='ASNObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='ASNObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='ASNObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='ASNObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id="%s"' % self.gds_format_integer(self.id, input_name='id')) - def exportChildren(self, outfile, level, namespace_='', name_='ASNObject', fromsubclass_=False): + write(' id="%s"' % self.gds_format_integer(self.id, input_name='id')) + def exportChildren(self, write, level, namespace_='', name_='ASNObject', fromsubclass_=False): if self.as_number is not None: - showIndent(outfile, level) - outfile.write('<%sas-number>%s\n' % (namespace_, self.gds_format_integer(self.as_number, input_name='as-number'), namespace_)) + showIndent(write, level) + write('<%sas-number>%s\n' % (namespace_, self.gds_format_integer(self.as_number, input_name='as-number'), namespace_)) def hasContent_(self): if ( self.as_number is not None @@ -2541,20 +2541,20 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='ASNObject'): + def exportLiteral(self, write, level, name_='ASNObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = %d,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %d,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.as_number is not None: - showIndent(outfile, level) - outfile.write('as_number=%d,\n' % self.as_number) + showIndent(write, level) + write('as_number=%d,\n' % self.as_number) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2621,37 +2621,37 @@ def validate_ClassificationTypeEnum(self, value): pass def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='classificationObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='classificationObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='classificationObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='classificationObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='classificationObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='classificationObject'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) + write(' type=%s' % (quote_attrib(self.type_), )) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='classificationObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='classificationObject', fromsubclass_=False): if self.classificationName is not None: - showIndent(outfile, level) - outfile.write('<%sclassificationName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.classificationName).encode(ExternalEncoding), input_name='classificationName'), 'mmdef:')) + showIndent(write, level) + write('<%sclassificationName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.classificationName).encode(ExternalEncoding), input_name='classificationName'), 'mmdef:')) if self.companyName is not None: - showIndent(outfile, level) - outfile.write('<%scompanyName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.companyName).encode(ExternalEncoding), input_name='companyName'), 'mmdef:')) + showIndent(write, level) + write('<%scompanyName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.companyName).encode(ExternalEncoding), input_name='companyName'), 'mmdef:')) if self.category is not None: - showIndent(outfile, level) - outfile.write('<%scategory>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.category).encode(ExternalEncoding), input_name='category'), 'mmdef:')) + showIndent(write, level) + write('<%scategory>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.category).encode(ExternalEncoding), input_name='category'), 'mmdef:')) if self.classificationDetails is not None: - self.classificationDetails.export(outfile, level, namespace_, name_='classificationDetails') + self.classificationDetails.export(write, level, namespace_, name_='classificationDetails') def hasContent_(self): if ( self.classificationName is not None or @@ -2662,36 +2662,36 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='classificationObject'): + def exportLiteral(self, write, level, name_='classificationObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.classificationName is not None: - showIndent(outfile, level) - outfile.write('classificationName=%s,\n' % quote_python(self.classificationName).encode(ExternalEncoding)) + showIndent(write, level) + write('classificationName=%s,\n' % quote_python(self.classificationName).encode(ExternalEncoding)) if self.companyName is not None: - showIndent(outfile, level) - outfile.write('companyName=%s,\n' % quote_python(self.companyName).encode(ExternalEncoding)) + showIndent(write, level) + write('companyName=%s,\n' % quote_python(self.companyName).encode(ExternalEncoding)) if self.category is not None: - showIndent(outfile, level) - outfile.write('category=%s,\n' % quote_python(self.category).encode(ExternalEncoding)) + showIndent(write, level) + write('category=%s,\n' % quote_python(self.category).encode(ExternalEncoding)) if self.classificationDetails is not None: - showIndent(outfile, level) - outfile.write('classificationDetails=model_.classificationDetails(\n') - self.classificationDetails.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('classificationDetails=model_.classificationDetails(\n') + self.classificationDetails.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2754,36 +2754,36 @@ def get_product(self): return self.product def set_product(self, product): self.product = product def get_productVersion(self): return self.productVersion def set_productVersion(self, productVersion): self.productVersion = productVersion - def export(self, outfile, level, namespace_='', name_='classificationDetails', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='classificationDetails', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='classificationDetails') + self.exportAttributes(write, level, already_processed, namespace_, name_='classificationDetails') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='classificationDetails'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='classificationDetails'): pass - def exportChildren(self, outfile, level, namespace_='', name_='classificationDetails', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='classificationDetails', fromsubclass_=False): if self.definitionVersion is not None: - showIndent(outfile, level) - outfile.write('<%sdefinitionVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.definitionVersion).encode(ExternalEncoding), input_name='definitionVersion'), namespace_)) + showIndent(write, level) + write('<%sdefinitionVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.definitionVersion).encode(ExternalEncoding), input_name='definitionVersion'), namespace_)) if self.detectionAddedTimeStamp is not None: - showIndent(outfile, level) - outfile.write('<%sdetectionAddedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionAddedTimeStamp).encode(ExternalEncoding), input_name='detectionAddedTimeStamp'), namespace_)) + showIndent(write, level) + write('<%sdetectionAddedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionAddedTimeStamp).encode(ExternalEncoding), input_name='detectionAddedTimeStamp'), namespace_)) if self.detectionShippedTimeStamp is not None: - showIndent(outfile, level) - outfile.write('<%sdetectionShippedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionShippedTimeStamp).encode(ExternalEncoding), input_name='detectionShippedTimeStamp'), namespace_)) + showIndent(write, level) + write('<%sdetectionShippedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionShippedTimeStamp).encode(ExternalEncoding), input_name='detectionShippedTimeStamp'), namespace_)) if self.product is not None: - showIndent(outfile, level) - outfile.write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) + showIndent(write, level) + write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) if self.productVersion is not None: - showIndent(outfile, level) - outfile.write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) + showIndent(write, level) + write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) def hasContent_(self): if ( self.definitionVersion is not None or @@ -2795,29 +2795,29 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='classificationDetails'): + def exportLiteral(self, write, level, name_='classificationDetails'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.definitionVersion is not None: - showIndent(outfile, level) - outfile.write('definitionVersion=%s,\n' % quote_python(self.definitionVersion).encode(ExternalEncoding)) + showIndent(write, level) + write('definitionVersion=%s,\n' % quote_python(self.definitionVersion).encode(ExternalEncoding)) if self.detectionAddedTimeStamp is not None: - showIndent(outfile, level) - outfile.write('detectionAddedTimeStamp=%s,\n' % quote_python(self.detectionAddedTimeStamp).encode(ExternalEncoding)) + showIndent(write, level) + write('detectionAddedTimeStamp=%s,\n' % quote_python(self.detectionAddedTimeStamp).encode(ExternalEncoding)) if self.detectionShippedTimeStamp is not None: - showIndent(outfile, level) - outfile.write('detectionShippedTimeStamp=%s,\n' % quote_python(self.detectionShippedTimeStamp).encode(ExternalEncoding)) + showIndent(write, level) + write('detectionShippedTimeStamp=%s,\n' % quote_python(self.detectionShippedTimeStamp).encode(ExternalEncoding)) if self.product is not None: - showIndent(outfile, level) - outfile.write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) + showIndent(write, level) + write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) if self.productVersion is not None: - showIndent(outfile, level) - outfile.write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) + showIndent(write, level) + write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2948,45 +2948,45 @@ def get_importance(self): return self.importance def set_importance(self, importance): self.importance = importance def get_location(self): return self.location def set_location(self, location): self.location = location - def export(self, outfile, level, namespace_='', name_='fieldDataEntry', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='fieldDataEntry', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='fieldDataEntry') + self.exportAttributes(write, level, already_processed, namespace_, name_='fieldDataEntry') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='fieldDataEntry'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='fieldDataEntry'): pass - def exportChildren(self, outfile, level, namespace_='', name_='fieldDataEntry', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='fieldDataEntry', fromsubclass_=False): if self.references is not None: - self.references.export(outfile, level, namespace_, name_='references', ) + self.references.export(write, level, namespace_, name_='references', ) if self.startDate is not None: - showIndent(outfile, level) - outfile.write('<%sstartDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.startDate).encode(ExternalEncoding), input_name='startDate'), namespace_)) + showIndent(write, level) + write('<%sstartDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.startDate).encode(ExternalEncoding), input_name='startDate'), namespace_)) if self.endDate is not None: - showIndent(outfile, level) - outfile.write('<%sendDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.endDate).encode(ExternalEncoding), input_name='endDate'), namespace_)) + showIndent(write, level) + write('<%sendDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.endDate).encode(ExternalEncoding), input_name='endDate'), namespace_)) if self.firstSeenDate is not None: - showIndent(outfile, level) - outfile.write('<%sfirstSeenDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.firstSeenDate).encode(ExternalEncoding), input_name='firstSeenDate'), namespace_)) + showIndent(write, level) + write('<%sfirstSeenDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.firstSeenDate).encode(ExternalEncoding), input_name='firstSeenDate'), namespace_)) if self.origin is not None: - showIndent(outfile, level) - outfile.write('<%sorigin>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.origin).encode(ExternalEncoding), input_name='origin'), namespace_)) + showIndent(write, level) + write('<%sorigin>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.origin).encode(ExternalEncoding), input_name='origin'), namespace_)) if self.commonality is not None: - showIndent(outfile, level) - outfile.write('<%scommonality>%s\n' % (namespace_, self.gds_format_integer(self.commonality, input_name='commonality'), namespace_)) + showIndent(write, level) + write('<%scommonality>%s\n' % (namespace_, self.gds_format_integer(self.commonality, input_name='commonality'), namespace_)) for volume_ in self.volume: - volume_.export(outfile, level, namespace_, name_='volume') + volume_.export(write, level, namespace_, name_='volume') if self.importance is not None: - showIndent(outfile, level) - outfile.write('<%simportance>%s\n' % (namespace_, self.gds_format_integer(self.importance, input_name='importance'), namespace_)) + showIndent(write, level) + write('<%simportance>%s\n' % (namespace_, self.gds_format_integer(self.importance, input_name='importance'), namespace_)) if self.location is not None: - self.location.export(outfile, level, namespace_, name_='location') + self.location.export(write, level, namespace_, name_='location') def hasContent_(self): if ( self.references is not None or @@ -3002,56 +3002,56 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='fieldDataEntry'): + def exportLiteral(self, write, level, name_='fieldDataEntry'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): if self.references is not None: - showIndent(outfile, level) - outfile.write('references=model_.references(\n') - self.references.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('references=model_.references(\n') + self.references.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.startDate is not None: - showIndent(outfile, level) - outfile.write('startDate=%s,\n' % quote_python(self.startDate).encode(ExternalEncoding)) + showIndent(write, level) + write('startDate=%s,\n' % quote_python(self.startDate).encode(ExternalEncoding)) if self.endDate is not None: - showIndent(outfile, level) - outfile.write('endDate=%s,\n' % quote_python(self.endDate).encode(ExternalEncoding)) + showIndent(write, level) + write('endDate=%s,\n' % quote_python(self.endDate).encode(ExternalEncoding)) if self.firstSeenDate is not None: - showIndent(outfile, level) - outfile.write('firstSeenDate=%s,\n' % quote_python(self.firstSeenDate).encode(ExternalEncoding)) + showIndent(write, level) + write('firstSeenDate=%s,\n' % quote_python(self.firstSeenDate).encode(ExternalEncoding)) if self.origin is not None: - showIndent(outfile, level) - outfile.write('origin=%s,\n' % quote_python(self.origin).encode(ExternalEncoding)) + showIndent(write, level) + write('origin=%s,\n' % quote_python(self.origin).encode(ExternalEncoding)) if self.commonality is not None: - showIndent(outfile, level) - outfile.write('commonality=%d,\n' % self.commonality) - showIndent(outfile, level) - outfile.write('volume=[\n') + showIndent(write, level) + write('commonality=%d,\n' % self.commonality) + showIndent(write, level) + write('volume=[\n') level += 1 for volume_ in self.volume: - showIndent(outfile, level) - outfile.write('model_.volume(\n') - volume_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.volume(\n') + volume_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') if self.importance is not None: - showIndent(outfile, level) - outfile.write('importance=%d,\n' % self.importance) + showIndent(write, level) + write('importance=%d,\n' % self.importance) if self.location is not None: - showIndent(outfile, level) - outfile.write('location=model_.location(\n') - self.location.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('location=model_.location(\n') + self.location.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3129,23 +3129,23 @@ def get_ref(self): return self.ref def set_ref(self, ref): self.ref = ref def add_ref(self, value): self.ref.append(value) def insert_ref(self, index, value): self.ref[index] = value - def export(self, outfile, level, namespace_='', name_='references', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='references', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='references') + self.exportAttributes(write, level, already_processed, namespace_, name_='references') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='references'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='references'): pass - def exportChildren(self, outfile, level, namespace_='', name_='references', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='references', fromsubclass_=False): for ref_ in self.ref: - ref_.export(outfile, level, namespace_, name_='ref') + ref_.export(write, level, namespace_, name_='ref') def hasContent_(self): if ( self.ref @@ -3153,26 +3153,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='references'): + def exportLiteral(self, write, level, name_='references'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('ref=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('ref=[\n') level += 1 for ref_ in self.ref: - showIndent(outfile, level) - outfile.write('model_.reference(\n') - ref_.exportLiteral(outfile, level, name_='reference') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.reference(\n') + ref_.exportLiteral(write, level, name_='reference') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3208,23 +3208,23 @@ def validate_VolumeUnitsEnum(self, value): pass def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='volume', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='volume', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='volume') + self.exportAttributes(write, level, already_processed, namespace_, name_='volume') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='volume'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='volume'): if self.units is not None and 'units' not in already_processed: already_processed.append('units') - outfile.write(' units=%s' % (quote_attrib(self.units), )) - def exportChildren(self, outfile, level, namespace_='', name_='volume', fromsubclass_=False): + write(' units=%s' % (quote_attrib(self.units), )) + def exportChildren(self, write, level, namespace_='', name_='volume', fromsubclass_=False): pass def hasContent_(self): if ( @@ -3233,19 +3233,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='volume'): + def exportLiteral(self, write, level, name_='volume'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.units is not None and 'units' not in already_processed: already_processed.append('units') - showIndent(outfile, level) - outfile.write('units = "%s",\n' % (self.units,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('units = "%s",\n' % (self.units,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -3284,23 +3284,23 @@ def validate_LocationTypeEnum(self, value): pass def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='location', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='location', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='location') + self.exportAttributes(write, level, already_processed, namespace_, name_='location') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='location'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='location'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) - def exportChildren(self, outfile, level, namespace_='', name_='location', fromsubclass_=False): + write(' type=%s' % (quote_attrib(self.type_), )) + def exportChildren(self, write, level, namespace_='', name_='location', fromsubclass_=False): pass def hasContent_(self): if ( @@ -3309,19 +3309,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='location'): + def exportLiteral(self, write, level, name_='location'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -3355,21 +3355,21 @@ def factory(*args_, **kwargs_): factory = staticmethod(factory) def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='reference', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='reference', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='reference') + self.exportAttributes(write, level, already_processed, namespace_, name_='reference') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='reference'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='reference'): pass - def exportChildren(self, outfile, level, namespace_='', name_='reference', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='reference', fromsubclass_=False): pass def hasContent_(self): if ( @@ -3378,16 +3378,16 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='reference'): + def exportLiteral(self, write, level, name_='reference'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -3422,23 +3422,23 @@ def validate_PropertyTypeEnum(self, value): pass def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='property', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='property', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='property') + self.exportAttributes(write, level, already_processed, namespace_, name_='property') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='property'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='property'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) - def exportChildren(self, outfile, level, namespace_='', name_='property', fromsubclass_=False): + write(' type=%s' % (quote_attrib(self.type_), )) + def exportChildren(self, write, level, namespace_='', name_='property', fromsubclass_=False): pass def hasContent_(self): if ( @@ -3447,19 +3447,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='property'): + def exportLiteral(self, write, level, name_='property'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -3514,30 +3514,30 @@ def add_property(self, value): self.property.append(value) def insert_property(self, index, value): self.property[index] = value def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='objectProperty', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='objectProperty', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='objectProperty') + self.exportAttributes(write, level, already_processed, namespace_, name_='objectProperty') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='objectProperty'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='objectProperty'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='', name_='objectProperty', fromsubclass_=False): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='', name_='objectProperty', fromsubclass_=False): if self.references is not None: - self.references.export(outfile, level, namespace_, name_='references', ) + self.references.export(write, level, namespace_, name_='references', ) if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + showIndent(write, level) + write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) for property_ in self.property: - property_.export(outfile, level, namespace_, name_='property') + property_.export(write, level, namespace_, name_='property') def hasContent_(self): if ( self.references is not None or @@ -3547,38 +3547,38 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='objectProperty'): + def exportLiteral(self, write, level, name_='objectProperty'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.references is not None: - showIndent(outfile, level) - outfile.write('references=model_.references(\n') - self.references.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('references=model_.references(\n') + self.references.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) - showIndent(outfile, level) - outfile.write('property=[\n') + showIndent(write, level) + write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) + showIndent(write, level) + write('property=[\n') level += 1 for property_ in self.property: - showIndent(outfile, level) - outfile.write('model_.property(\n') - property_.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.property(\n') + property_.exportLiteral(write, level) + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3647,33 +3647,33 @@ def validate_RelationshipTypeEnum(self, value): pass def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='relationship', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='relationship', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='relationship') + self.exportAttributes(write, level, already_processed, namespace_, name_='relationship') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='relationship'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='relationship'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (quote_attrib(self.type_), )) + write(' type=%s' % (quote_attrib(self.type_), )) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (quote_attrib(self.id), )) - def exportChildren(self, outfile, level, namespace_='', name_='relationship', fromsubclass_=False): + write(' id=%s' % (quote_attrib(self.id), )) + def exportChildren(self, write, level, namespace_='', name_='relationship', fromsubclass_=False): if self.source is not None: - self.source.export(outfile, level, namespace_, name_='source', ) + self.source.export(write, level, namespace_, name_='source', ) if self.target is not None: - self.target.export(outfile, level, namespace_, name_='target', ) + self.target.export(write, level, namespace_, name_='target', ) if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + showIndent(write, level) + write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) def hasContent_(self): if ( self.source is not None or @@ -3683,36 +3683,36 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='relationship'): + def exportLiteral(self, write, level, name_='relationship'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = %s,\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.source is not None: - showIndent(outfile, level) - outfile.write('source=model_.source(\n') - self.source.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('source=model_.source(\n') + self.source.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.target is not None: - showIndent(outfile, level) - outfile.write('target=model_.target(\n') - self.target.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('target=model_.target(\n') + self.target.exportLiteral(write, level) + showIndent(write, level) + write('),\n') if self.timestamp is not None: - showIndent(outfile, level) - outfile.write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) + showIndent(write, level) + write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3763,23 +3763,23 @@ def get_ref(self): return self.ref def set_ref(self, ref): self.ref = ref def add_ref(self, value): self.ref.append(value) def insert_ref(self, index, value): self.ref[index] = value - def export(self, outfile, level, namespace_='', name_='source', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='source', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='source') + self.exportAttributes(write, level, already_processed, namespace_, name_='source') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='source'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='source'): pass - def exportChildren(self, outfile, level, namespace_='', name_='source', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='source', fromsubclass_=False): for ref_ in self.ref: - ref_.export(outfile, level, namespace_, name_='ref') + ref_.export(write, level, namespace_, name_='ref') def hasContent_(self): if ( self.ref @@ -3787,26 +3787,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='source'): + def exportLiteral(self, write, level, name_='source'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('ref=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('ref=[\n') level += 1 for ref_ in self.ref: - showIndent(outfile, level) - outfile.write('model_.reference(\n') - ref_.exportLiteral(outfile, level, name_='reference') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.reference(\n') + ref_.exportLiteral(write, level, name_='reference') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3841,23 +3841,23 @@ def get_ref(self): return self.ref def set_ref(self, ref): self.ref = ref def add_ref(self, value): self.ref.append(value) def insert_ref(self, index, value): self.ref[index] = value - def export(self, outfile, level, namespace_='', name_='target', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='target', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='target') + self.exportAttributes(write, level, already_processed, namespace_, name_='target') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='target'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='target'): pass - def exportChildren(self, outfile, level, namespace_='', name_='target', fromsubclass_=False): + def exportChildren(self, write, level, namespace_='', name_='target', fromsubclass_=False): for ref_ in self.ref: - ref_.export(outfile, level, namespace_, name_='ref') + ref_.export(write, level, namespace_, name_='ref') def hasContent_(self): if ( self.ref @@ -3865,26 +3865,26 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='target'): + def exportLiteral(self, write, level, name_='target'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): pass - def exportLiteralChildren(self, outfile, level, name_): - showIndent(outfile, level) - outfile.write('ref=[\n') + def exportLiteralChildren(self, write, level, name_): + showIndent(write, level) + write('ref=[\n') level += 1 for ref_ in self.ref: - showIndent(outfile, level) - outfile.write('model_.reference(\n') - ref_.exportLiteral(outfile, level, name_='reference') - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('model_.reference(\n') + ref_.exportLiteral(write, level, name_='reference') + showIndent(write, level) + write('),\n') level -= 1 - showIndent(outfile, level) - outfile.write('],\n') + showIndent(write, level) + write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3940,46 +3940,46 @@ def get_CPEname(self): return self.CPEname def set_CPEname(self, CPEname): self.CPEname = CPEname def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='softwarePackageObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='softwarePackageObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='softwarePackageObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='softwarePackageObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='softwarePackageObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='softwarePackageObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='softwarePackageObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='softwarePackageObject', fromsubclass_=False): if self.vendor is not None: - showIndent(outfile, level) - outfile.write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) + showIndent(write, level) + write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) if self.productgroup is not None: - showIndent(outfile, level) - outfile.write('<%sproductgroup>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productgroup).encode(ExternalEncoding), input_name='productgroup'), namespace_)) + showIndent(write, level) + write('<%sproductgroup>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productgroup).encode(ExternalEncoding), input_name='productgroup'), namespace_)) if self.product is not None: - showIndent(outfile, level) - outfile.write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) + showIndent(write, level) + write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) if self.version is not None: - showIndent(outfile, level) - outfile.write('<%sversion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.version).encode(ExternalEncoding), input_name='version'), namespace_)) + showIndent(write, level) + write('<%sversion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.version).encode(ExternalEncoding), input_name='version'), namespace_)) if self.update is not None: - showIndent(outfile, level) - outfile.write('<%supdate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.update).encode(ExternalEncoding), input_name='update'), namespace_)) + showIndent(write, level) + write('<%supdate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.update).encode(ExternalEncoding), input_name='update'), namespace_)) if self.edition is not None: - showIndent(outfile, level) - outfile.write('<%sedition>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.edition).encode(ExternalEncoding), input_name='edition'), namespace_)) + showIndent(write, level) + write('<%sedition>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.edition).encode(ExternalEncoding), input_name='edition'), namespace_)) if self.language is not None: - showIndent(outfile, level) - outfile.write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.language).encode(ExternalEncoding), input_name='language'), namespace_)) + showIndent(write, level) + write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.language).encode(ExternalEncoding), input_name='language'), namespace_)) if self.CPEname is not None: - self.CPEname.export(outfile, level, namespace_, name_='CPEname') + self.CPEname.export(write, level, namespace_, name_='CPEname') def hasContent_(self): if ( self.vendor is not None or @@ -3994,44 +3994,44 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='softwarePackageObject'): + def exportLiteral(self, write, level, name_='softwarePackageObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.vendor is not None: - showIndent(outfile, level) - outfile.write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) + showIndent(write, level) + write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) if self.productgroup is not None: - showIndent(outfile, level) - outfile.write('productgroup=%s,\n' % quote_python(self.productgroup).encode(ExternalEncoding)) + showIndent(write, level) + write('productgroup=%s,\n' % quote_python(self.productgroup).encode(ExternalEncoding)) if self.product is not None: - showIndent(outfile, level) - outfile.write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) + showIndent(write, level) + write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) if self.version is not None: - showIndent(outfile, level) - outfile.write('version=%s,\n' % quote_python(self.version).encode(ExternalEncoding)) + showIndent(write, level) + write('version=%s,\n' % quote_python(self.version).encode(ExternalEncoding)) if self.update is not None: - showIndent(outfile, level) - outfile.write('update=%s,\n' % quote_python(self.update).encode(ExternalEncoding)) + showIndent(write, level) + write('update=%s,\n' % quote_python(self.update).encode(ExternalEncoding)) if self.edition is not None: - showIndent(outfile, level) - outfile.write('edition=%s,\n' % quote_python(self.edition).encode(ExternalEncoding)) + showIndent(write, level) + write('edition=%s,\n' % quote_python(self.edition).encode(ExternalEncoding)) if self.language is not None: - showIndent(outfile, level) - outfile.write('language=%s,\n' % quote_python(self.language).encode(ExternalEncoding)) + showIndent(write, level) + write('language=%s,\n' % quote_python(self.language).encode(ExternalEncoding)) if self.CPEname is not None: - showIndent(outfile, level) - outfile.write('CPEname=model_.CPEname(\n') - self.CPEname.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('CPEname=model_.CPEname(\n') + self.CPEname.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -4100,23 +4100,23 @@ def get_cpeVersion(self): return self.cpeVersion def set_cpeVersion(self, cpeVersion): self.cpeVersion = cpeVersion def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='CPEname', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='CPEname', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='CPEname') + self.exportAttributes(write, level, already_processed, namespace_, name_='CPEname') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='CPEname'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='CPEname'): if self.cpeVersion is not None and 'cpeVersion' not in already_processed: already_processed.append('cpeVersion') - outfile.write(' cpeVersion=%s' % (self.gds_format_string(quote_attrib(self.cpeVersion).encode(ExternalEncoding), input_name='cpeVersion'), )) - def exportChildren(self, outfile, level, namespace_='', name_='CPEname', fromsubclass_=False): + write(' cpeVersion=%s' % (self.gds_format_string(quote_attrib(self.cpeVersion).encode(ExternalEncoding), input_name='cpeVersion'), )) + def exportChildren(self, write, level, namespace_='', name_='CPEname', fromsubclass_=False): pass def hasContent_(self): if ( @@ -4125,19 +4125,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='CPEname'): + def exportLiteral(self, write, level, name_='CPEname'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.cpeVersion is not None and 'cpeVersion' not in already_processed: already_processed.append('cpeVersion') - showIndent(outfile, level) - outfile.write('cpeVersion = "%s",\n' % (self.cpeVersion,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('cpeVersion = "%s",\n' % (self.cpeVersion,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -4189,40 +4189,40 @@ def get_type(self): return self.type_ def set_type(self, type_): self.type_ = type_ def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='digitalSignatureObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='digitalSignatureObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='digitalSignatureObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='digitalSignatureObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='digitalSignatureObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='digitalSignatureObject'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - outfile.write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) + write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='digitalSignatureObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='digitalSignatureObject', fromsubclass_=False): if self.certificateIssuer is not None: - showIndent(outfile, level) - outfile.write('<%scertificateIssuer>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateIssuer).encode(ExternalEncoding), input_name='certificateIssuer'), namespace_)) + showIndent(write, level) + write('<%scertificateIssuer>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateIssuer).encode(ExternalEncoding), input_name='certificateIssuer'), namespace_)) if self.certificateSubject is not None: - showIndent(outfile, level) - outfile.write('<%scertificateSubject>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateSubject).encode(ExternalEncoding), input_name='certificateSubject'), namespace_)) + showIndent(write, level) + write('<%scertificateSubject>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateSubject).encode(ExternalEncoding), input_name='certificateSubject'), namespace_)) if self.certificateValidity is not None: - showIndent(outfile, level) - outfile.write('<%scertificateValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.certificateValidity)), input_name='certificateValidity'), namespace_)) + showIndent(write, level) + write('<%scertificateValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.certificateValidity)), input_name='certificateValidity'), namespace_)) if self.certificateRevocationTimestamp is not None: - showIndent(outfile, level) - outfile.write('<%scertificateRevocationTimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateRevocationTimestamp).encode(ExternalEncoding), input_name='certificateRevocationTimestamp'), namespace_)) + showIndent(write, level) + write('<%scertificateRevocationTimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateRevocationTimestamp).encode(ExternalEncoding), input_name='certificateRevocationTimestamp'), namespace_)) if self.signingTimestamp is not None: - self.signingTimestamp.export(outfile, level, namespace_, name_='signingTimestamp') + self.signingTimestamp.export(write, level, namespace_, name_='signingTimestamp') def hasContent_(self): if ( self.certificateIssuer is not None or @@ -4234,39 +4234,39 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='digitalSignatureObject'): + def exportLiteral(self, write, level, name_='digitalSignatureObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - showIndent(outfile, level) - outfile.write('type_ = "%s",\n' % (self.type_,)) + showIndent(write, level) + write('type_ = "%s",\n' % (self.type_,)) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.certificateIssuer is not None: - showIndent(outfile, level) - outfile.write('certificateIssuer=%s,\n' % quote_python(self.certificateIssuer).encode(ExternalEncoding)) + showIndent(write, level) + write('certificateIssuer=%s,\n' % quote_python(self.certificateIssuer).encode(ExternalEncoding)) if self.certificateSubject is not None: - showIndent(outfile, level) - outfile.write('certificateSubject=%s,\n' % quote_python(self.certificateSubject).encode(ExternalEncoding)) + showIndent(write, level) + write('certificateSubject=%s,\n' % quote_python(self.certificateSubject).encode(ExternalEncoding)) if self.certificateValidity is not None: - showIndent(outfile, level) - outfile.write('certificateValidity=%s,\n' % self.certificateValidity) + showIndent(write, level) + write('certificateValidity=%s,\n' % self.certificateValidity) if self.certificateRevocationTimestamp is not None: - showIndent(outfile, level) - outfile.write('certificateRevocationTimestamp=%s,\n' % quote_python(self.certificateRevocationTimestamp).encode(ExternalEncoding)) + showIndent(write, level) + write('certificateRevocationTimestamp=%s,\n' % quote_python(self.certificateRevocationTimestamp).encode(ExternalEncoding)) if self.signingTimestamp is not None: - showIndent(outfile, level) - outfile.write('signingTimestamp=model_.signingTimestamp(\n') - self.signingTimestamp.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('signingTimestamp=model_.signingTimestamp(\n') + self.signingTimestamp.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -4327,23 +4327,23 @@ def get_valid(self): return self.valid def set_valid(self, valid): self.valid = valid def get_valueOf_(self): return self.valueOf_ def set_valueOf_(self, valueOf_): self.valueOf_ = valueOf_ - def export(self, outfile, level, namespace_='', name_='signingTimestamp', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='signingTimestamp', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='signingTimestamp') + self.exportAttributes(write, level, already_processed, namespace_, name_='signingTimestamp') if self.hasContent_(): - outfile.write('>') - outfile.write(str(self.valueOf_).encode(ExternalEncoding)) - self.exportChildren(outfile, level + 1, namespace_, name_) - outfile.write('\n' % (namespace_, name_)) + write('>') + write(str(self.valueOf_).encode(ExternalEncoding)) + self.exportChildren(write, level + 1, namespace_, name_) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='signingTimestamp'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='signingTimestamp'): if self.valid is not None and 'valid' not in already_processed: already_processed.append('valid') - outfile.write(' valid="%s"' % self.gds_format_boolean(self.gds_str_lower(str(self.valid)), input_name='valid')) - def exportChildren(self, outfile, level, namespace_='', name_='signingTimestamp', fromsubclass_=False): + write(' valid="%s"' % self.gds_format_boolean(self.gds_str_lower(str(self.valid)), input_name='valid')) + def exportChildren(self, write, level, namespace_='', name_='signingTimestamp', fromsubclass_=False): pass def hasContent_(self): if ( @@ -4352,19 +4352,19 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='signingTimestamp'): + def exportLiteral(self, write, level, name_='signingTimestamp'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - showIndent(outfile, level) - outfile.write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + showIndent(write, level) + write('valueOf_ = """%s""",\n' % (self.valueOf_,)) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.valid is not None and 'valid' not in already_processed: already_processed.append('valid') - showIndent(outfile, level) - outfile.write('valid = %s,\n' % (self.valid,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('valid = %s,\n' % (self.valid,)) + def exportLiteralChildren(self, write, level, name_): pass def build(self, node): self.buildAttributes(node, node.attrib, []) @@ -4414,31 +4414,31 @@ def get_signingTimestamp(self): return self.signingTimestamp def set_signingTimestamp(self, signingTimestamp): self.signingTimestamp = signingTimestamp def get_id(self): return self.id def set_id(self, id): self.id = id - def export(self, outfile, level, namespace_='', name_='taggantObject', namespacedef_=''): - showIndent(outfile, level) - outfile.write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) + def export(self, write, level, namespace_='', name_='taggantObject', namespacedef_=''): + showIndent(write, level) + write('<%s%s%s' % (namespace_, name_, namespacedef_ and ' ' + namespacedef_ or '', )) already_processed = [] - self.exportAttributes(outfile, level, already_processed, namespace_, name_='taggantObject') + self.exportAttributes(write, level, already_processed, namespace_, name_='taggantObject') if self.hasContent_(): - outfile.write('>\n') - self.exportChildren(outfile, level + 1, namespace_, name_) - showIndent(outfile, level) - outfile.write('\n' % (namespace_, name_)) + write('>\n') + self.exportChildren(write, level + 1, namespace_, name_) + showIndent(write, level) + write('\n' % (namespace_, name_)) else: - outfile.write('/>\n') - def exportAttributes(self, outfile, level, already_processed, namespace_='', name_='taggantObject'): + write('/>\n') + def exportAttributes(self, write, level, already_processed, namespace_='', name_='taggantObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - outfile.write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) - def exportChildren(self, outfile, level, namespace_='', name_='taggantObject', fromsubclass_=False): + write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + def exportChildren(self, write, level, namespace_='', name_='taggantObject', fromsubclass_=False): if self.vendorID is not None: - showIndent(outfile, level) - outfile.write('<%svendorID>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendorID).encode(ExternalEncoding), input_name='vendorID'), namespace_)) + showIndent(write, level) + write('<%svendorID>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendorID).encode(ExternalEncoding), input_name='vendorID'), namespace_)) if self.taggantValidity is not None: - showIndent(outfile, level) - outfile.write('<%staggantValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.taggantValidity)), input_name='taggantValidity'), namespace_)) + showIndent(write, level) + write('<%staggantValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.taggantValidity)), input_name='taggantValidity'), namespace_)) if self.signingTimestamp is not None: - self.signingTimestamp.export(outfile, level, namespace_, name_='signingTimestamp') + self.signingTimestamp.export(write, level, namespace_, name_='signingTimestamp') def hasContent_(self): if ( self.vendorID is not None or @@ -4448,29 +4448,29 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, outfile, level, name_='taggantObject'): + def exportLiteral(self, write, level, name_='taggantObject'): level += 1 - self.exportLiteralAttributes(outfile, level, [], name_) + self.exportLiteralAttributes(write, level, [], name_) if self.hasContent_(): - self.exportLiteralChildren(outfile, level, name_) - def exportLiteralAttributes(self, outfile, level, already_processed, name_): + self.exportLiteralChildren(write, level, name_) + def exportLiteralAttributes(self, write, level, already_processed, name_): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - showIndent(outfile, level) - outfile.write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, outfile, level, name_): + showIndent(write, level) + write('id = "%s",\n' % (self.id,)) + def exportLiteralChildren(self, write, level, name_): if self.vendorID is not None: - showIndent(outfile, level) - outfile.write('vendorID=%s,\n' % quote_python(self.vendorID).encode(ExternalEncoding)) + showIndent(write, level) + write('vendorID=%s,\n' % quote_python(self.vendorID).encode(ExternalEncoding)) if self.taggantValidity is not None: - showIndent(outfile, level) - outfile.write('taggantValidity=%s,\n' % self.taggantValidity) + showIndent(write, level) + write('taggantValidity=%s,\n' % self.taggantValidity) if self.signingTimestamp is not None: - showIndent(outfile, level) - outfile.write('signingTimestamp=model_.signingTimestamp(\n') - self.signingTimestamp.exportLiteral(outfile, level) - showIndent(outfile, level) - outfile.write('),\n') + showIndent(write, level) + write('signingTimestamp=model_.signingTimestamp(\n') + self.signingTimestamp.exportLiteral(write, level) + showIndent(write, level) + write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: From 27f3ec3d3532b2bfba524fe50ec4f48e2ff5524a Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 18 Sep 2014 09:02:39 -0400 Subject: [PATCH 084/297] Updated maec.Entity and maec.EntityList to more naturally derive from python-cybox --- maec/__init__.py | 150 +---------------------------------------------- 1 file changed, 2 insertions(+), 148 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index afbf6b3..f86ba78 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -8,7 +8,7 @@ import bindings.maec_bundle as bundle_binding import bindings.maec_package as package_binding from cybox import Entity as cyboxEntity -from cybox import EntityList as cyboxEntityList +from cybox import EntityList from cybox import TypedField from cybox.utils import Namespace from maec.utils import maecMETA, EntityParser @@ -47,7 +47,7 @@ def to_xml_file(self, filename, namespace_dict=None): namespace_dict = self.__input_namespaces__ out_file = open(filename, 'w') out_file.write("\n") - self.to_obj().export(out_file, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) + self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() def _get_namespace_def(self, additional_ns_dict=None): @@ -106,152 +106,6 @@ def _get_children(self): if isinstance(item, Entity) or isinstance(item, cyboxEntity): yield item - @classmethod - def from_dict(cls, cls_dict=None): - if cls_dict is None: - return None - - entity = cls() - - # Shortcut if an actual dict is not provided: - if not isinstance(cls_dict, dict): - value = cls_dict - # Call the class's constructor - try: - return cls(value) - except TypeError: - raise TypeError("Could not instantiate a %s from a %s: %s" % - (cls, type(value), value)) - - for field in cls._get_vars(): - val = cls_dict.get(field.key_name) - if field.type_: - if issubclass(field.type_, EntityList) or issubclass(field.type_, cyboxEntityList): - val = field.type_.from_list(val) - elif field.multiple: - if val is not None: - val = [field.type_.from_dict(x) for x in val] - else: - val = [] - else: - val = field.type_.from_dict(val) - else: - if field.multiple and not val: - val = [] - setattr(entity, field.attr_name, val) - - return entity - -class EntityList(collections.MutableSequence, Entity): - _contained_type = object - - # Don't try to cast list types (yet) - _try_cast = False - - def __init__(self, *args): - super(EntityList, self).__init__() - self._inner = [] - - for arg in args: - if isinstance(arg, list): - self.extend(arg) - else: - self.append(arg) - - def __getitem__(self, key): - return self._inner.__getitem__(key) - - def __setitem__(self, key, value): - if not self._is_valid(value): - value = self._fix_value(value) - self._inner.__setitem__(key, value) - - def __delitem__(self, key): - self._inner.__delitem__(key) - - def __len__(self): - return len(self._inner) - - def insert(self, idx, value): - if not self._is_valid(value): - value = self._fix_value(value) - self._inner.insert(idx, value) - - def _is_valid(self, value): - """Check if this is a valid object to add to the list. - - Subclasses can override this function, but it's probably better to - modify the istypeof function on the _contained_type. - """ - return self._contained_type.istypeof(value) - - def _fix_value(self, value): - """Attempt to coerce value into the correct type. - - Subclasses can override this function. - """ - try: - new_value = self._contained_type(value) - except: - raise ValueError("Can't put '%s' (%s) into a %s" % - (value, type(value), self.__class__)) - return new_value - - # The next four functions can be overridden, but otherwise define the - # default behavior for EntityList subclasses which define the following - # class-level members: - # - _binding_class - # - _binding_var - # - _contained_type - - def to_obj(self): - tmp_list = [x.to_obj() for x in self] - - list_obj = self._binding_class() - - setattr(list_obj, self._binding_var, tmp_list) - - return list_obj - - def to_list(self): - return [h.to_dict() for h in self] - - # Alias the `to_list` function as `to_dict` - to_dict = to_list - - @classmethod - def from_obj(cls, list_obj): - if not list_obj: - return None - - list_ = cls() - - for item in getattr(list_obj, cls._binding_var): - list_.append(cls._contained_type.from_obj(item)) - - return list_ - - @classmethod - def from_list(cls, list_list): - if not isinstance(list_list, list): - return None - - list_ = cls() - - for item in list_list: - list_.append(cls._contained_type.from_dict(item)) - - return list_ - - @classmethod - def object_from_list(cls, entitylist_list): - """Convert from list representation to object representation.""" - return cls.from_list(entitylist_list).to_obj() - - @classmethod - def list_from_object(cls, entitylist_obj): - """Convert from object representation to list representation.""" - return cls.from_obj(entitylist_obj).to_list() def parse_xml_instance(filename, check_version = True): """Parse a MAEC instance and return the correct Binding and API objects From a5b3b43d10aa28bb9c86198350a4f30fb22f6d0d Mon Sep 17 00:00:00 2001 From: apsillers Date: Thu, 18 Sep 2014 10:12:32 -0400 Subject: [PATCH 085/297] Fix unit test behaviors --- maec/bundle/bundle.py | 2 +- maec/test/bundle/behavior_test.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index a4562a1..8a57458 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -338,7 +338,7 @@ class Bundle(maec.Entity): candidate_indicators = maec.TypedField("Candidate_Indicators", CandidateIndicatorList) collections = maec.TypedField("Collections", Collections) - def __init__(self, id = None, defined_subject = "False", schema_version = "4.1", content_type = None, malware_instance_object = None): + def __init__(self, id = None, defined_subject = False, schema_version = "4.1", content_type = None, malware_instance_object = None): super(Bundle, self).__init__() if id: self.id_ = id diff --git a/maec/test/bundle/behavior_test.py b/maec/test/bundle/behavior_test.py index 389bc17..e6b2286 100644 --- a/maec/test/bundle/behavior_test.py +++ b/maec/test/bundle/behavior_test.py @@ -27,7 +27,7 @@ class TestBehavior(EntityTestCase, unittest.TestCase): }, 'action_composition': { 'action':[{ 'behavioral_ordering': 1 }], - 'action_reference':[{ 'behavioral_ordering': 1 }], + 'action_reference':[{ 'action_id': 'some_id' }], 'action_equivalence_reference':[{ 'behavioral_ordering': 1 }] } } From 6e9a56b76253987c637178b09e94a22e05daf39a Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 22 Sep 2014 12:57:24 -0400 Subject: [PATCH 086/297] Updated to_obj for compatibility with python-cybox and removed setter method usage --- maec/bundle/av_classification.py | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index cd4de82..b6d6e8d 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -4,7 +4,7 @@ # All rights reserved # Compatible with MAEC v4.1 -# Last updated 08/28/2014 +# Last updated 09/22/2014 import maec import maec.bindings.maec_bundle as bundle_binding @@ -12,6 +12,8 @@ class AVClassification(ToolInformation): _namespace = maec.bundle._namespace + _binding = bundle_binding + _binding_class = bundle_binding.AVClassificationType def __init__(self, classification = None, tool_name = None, tool_vendor = None): super(AVClassification, self).__init__(tool_name, tool_vendor) @@ -19,12 +21,18 @@ def __init__(self, classification = None, tool_name = None, tool_vendor = None): self.definition_version = None self.classification_name = classification - def to_obj(self): - av_classification_obj = super(AVClassification, self).to_obj(bundle_binding.AVClassificationType()) - if self.engine_version is not None : av_classification_obj.set_Engine_Version(self.engine_version) - if self.definition_version is not None : av_classification_obj.set_Definition_Version(self.definition_version) - if self.classification_name is not None : av_classification_obj.set_Classification_Name(self.classification_name) - return av_classification_obj + def to_obj(self, return_obj = None, ns_info = None): + if not return_obj: + return_obj = self._binding_class() + + super(AVClassification, self).to_obj(return_obj=return_obj, ns_info=ns_info) + if self.engine_version is not None : + return_obj.Engine_Version = self.engine_version + if self.definition_version is not None : + return_obj.Definition_Version = self.definition_version + if self.classification_name is not None : + return_obj.Classification_Name = self.classification_name + return return_obj def to_dict(self): av_classification_dict = super(AVClassification, self).to_dict() @@ -48,9 +56,9 @@ def from_obj(av_classification_obj): if not av_classification_obj: return None av_classification_ = ToolInformation.from_obj(av_classification_obj, AVClassification()) - av_classification_.engine_version = av_classification_obj.get_Engine_Version() - av_classification_.definition_version = av_classification_obj.get_Definition_Version() - av_classification_.classification_name = av_classification_obj.get_Classification_Name() + av_classification_.engine_version = av_classification_obj.Engine_Version + av_classification_.definition_version = av_classification_obj.Definition_Version + av_classification_.classification_name = av_classification_obj.Classification_Name return av_classification_ class AVClassifications(maec.EntityList): From f96f73a25756429d0fa6c4a2f588efbee78ad3f2 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 22 Sep 2014 16:27:36 -0400 Subject: [PATCH 087/297] Fixed references to old property names --- maec/bundle/process_tree.py | 44 ++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 9b9d157..3e56ff6 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -40,39 +40,39 @@ def add_spawned_process(self, process_node, process_id = None): """Add a spawned process to the Process Tree node, either directly or to a particular process embedded in the node based on its ID.""" if not process_id: - if not self.spawned_processes: - self.spawned_processes = [] - self.spawned_processes.append(process_node) + if not self.spawned_process: + self.spawned_process = [] + self.spawned_process.append(process_node) elif process_id: if str(self.pid) == process_id: - if not self.spawned_processes: - self.spawned_processes = [] - self.spawned_processes.append(process_node) + if not self.spawned_process: + self.spawned_process = [] + self.spawned_process.append(process_node) else: embedded_process = self.find_embedded_process(process_id) if embedded_process: - if not embedded_process.spawned_processes: - embedded_process.spawned_processes = [] - embedded_process.spawned_processes.append(process_node) + if not embedded_process.spawned_process: + embedded_process.spawned_process = [] + embedded_process.spawned_process.append(process_node) def add_injected_process(self, process_node, process_id = None): """Add an injected process to the Process Tree node, either directly or to a particular process embedded in the node based on its ID.""" if not process_id: - if not self.injected_processes: - self.injected_processes = [] - self.injected_processes.append(process_node) + if not self.injected_process: + self.injected_process = [] + self.injected_process.append(process_node) elif process_id: if str(self.pid) == process_id: - if not self.injected_processes: - self.injected_processes = [] - self.injected_processes.append(process_node) + if not self.injected_process: + self.injected_process = [] + self.injected_process.append(process_node) else: embedded_process = self.find_embedded_process(process_id) if embedded_process: - if not embedded_process.injected_processes: - embedded_process.injected_processes = [] - embedded_process.injected_processes.append(process_node) + if not embedded_process.injected_process: + embedded_process.injected_process = [] + embedded_process.injected_process.append(process_node) def add_initiated_action(self, action_id): """Add an initiated Action to the Process Tree node, based on its ID.""" @@ -83,14 +83,14 @@ def add_initiated_action(self, action_id): def find_embedded_process(self, process_id): """Find a Process embedded somewhere in the Process Tree node tree, based on its ID.""" embedded_process = None - if self.spawned_processes: - for spawned_process in self.spawned_processes: + if self.spawned_process: + for spawned_process in self.spawned_process: if str(spawned_process.pid) == str(process_id): embedded_process = spawned_process else: embedded_process = spawned_process.find_embedded_process(process_id) - if self.injected_processes: - for injected_process in self.injected_processes: + if self.injected_process: + for injected_process in self.injected_process: if str(injected_process.pid) == str(process_id): embedded_process = injected_process else: From 6d405d6146bf7e862966ffaff14b450cd97cc937 Mon Sep 17 00:00:00 2001 From: apsillers Date: Tue, 23 Sep 2014 10:39:07 -0400 Subject: [PATCH 088/297] Unit test updates --- maec/test/__init__.py | 0 maec/test/bundle/av_classification_test.py | 31 ++++++++++ maec/test/bundle/bundle_test.py | 2 +- maec/test/bundle/capability_test.py | 53 ++++++++++++++++ maec/test/bundle/process_tree_test.py | 58 +++++++++++++++++ maec/test/package/analysis_test.py | 44 +++++++++++++ maec/test/package/malware_subject_test.py | 41 +++--------- maec/test/package/package_test.py | 72 ++++++++++------------ 8 files changed, 230 insertions(+), 71 deletions(-) create mode 100644 maec/test/__init__.py create mode 100644 maec/test/bundle/av_classification_test.py create mode 100644 maec/test/bundle/capability_test.py create mode 100644 maec/test/bundle/process_tree_test.py create mode 100644 maec/test/package/analysis_test.py diff --git a/maec/test/__init__.py b/maec/test/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/maec/test/bundle/av_classification_test.py b/maec/test/bundle/av_classification_test.py new file mode 100644 index 0000000..494508b --- /dev/null +++ b/maec/test/bundle/av_classification_test.py @@ -0,0 +1,31 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.av_classification import AVClassification + +class TestAVClassification(EntityTestCase, unittest.TestCase): + klass = AVClassification + + _full_dict = { + 'classification_name':'Some!Trojan', + 'vendor':'McAfee' + } + + def test_id_autoset(self): + o = AVClassification() + o.classification_name = 'Some!Trojan'; + o.vendor = 'McAfee' + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = AVClassification('Some!Trojan') + o.vendor = 'McAfee' + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() diff --git a/maec/test/bundle/bundle_test.py b/maec/test/bundle/bundle_test.py index 80d2840..3d1db1b 100644 --- a/maec/test/bundle/bundle_test.py +++ b/maec/test/bundle/bundle_test.py @@ -24,4 +24,4 @@ def test_round_trip(self): self.assertEqual(o.to_dict(), o2.to_dict()) if __name__ == "__main__": - unittest.main() \ No newline at end of file + unittest.main() diff --git a/maec/test/bundle/capability_test.py b/maec/test/bundle/capability_test.py new file mode 100644 index 0000000..53fd4a5 --- /dev/null +++ b/maec/test/bundle/capability_test.py @@ -0,0 +1,53 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.capability import Capability + +class TestCapability(EntityTestCase, unittest.TestCase): + klass = Capability + + _full_dict = { + 'description':'Perform some action', + 'strategic_objective':[{ + 'name': { + 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#DataTheftStrategicObjectivesVocab-1.0', + 'value':'steal stored information' + }, + 'property':[{ + 'name': { + 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', + 'value':'encryption algorithm' + }, + 'value': 'AES-256' + }, + { + 'name': { + 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', + 'value':'protocol used' + }, + 'value': 'TCP' + }] + }], + 'tactical_objective':[{ + 'name': { + 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#FraudTacticalObjectivesVocab-1.0', + 'value':'access premium service' + } + }] + } + + def test_id_autoset(self): + o = Capability() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Capability() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/bundle/process_tree_test.py b/maec/test/bundle/process_tree_test.py new file mode 100644 index 0000000..2475b02 --- /dev/null +++ b/maec/test/bundle/process_tree_test.py @@ -0,0 +1,58 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.process_tree import ProcessTree, ProcessTreeNode + +class TestCapability(EntityTestCase, unittest.TestCase): + klass = ProcessTree + + _full_dict = { + "root_process": { + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-7f44d6ed-1a0b-4bff-ae57-1491b751444f", + "injected_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-2897a24c-5f0b-4850-a995-578c98f47ed7" + }], + "spawned_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-3aacff1f-2c78-46c7-8e71-95d1a61dc05a", + "spawned_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-a355d96b-8545-4ce5-b7e5-86670076ecf8" + }] + }, { + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-d5589470-c6a5-4d54-a576-62e79c9ba8a0" + }] + } + } + + + def test_id_autoset(self): + o = ProcessTreeNode() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = ProcessTree() + root = ProcessTreeNode() + spawned_child1 = ProcessTreeNode() + spawned_child2 = ProcessTreeNode() + injected_child = ProcessTreeNode() + spawned_grandchild = ProcessTreeNode() + + o.set_root_process(root) + root.add_spawned_process(spawned_child1) + root.add_spawned_process(spawned_child2) + root.add_injected_process(injected_child) + spawned_child1.add_spawned_process(spawned_grandchild) + + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/package/analysis_test.py b/maec/test/package/analysis_test.py new file mode 100644 index 0000000..8261e6c --- /dev/null +++ b/maec/test/package/analysis_test.py @@ -0,0 +1,44 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.package.analysis import Analysis, Source + + +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Analysis + + _full_dict = { + "source": { + "url": "http://www.threatexpert.com", + "organization": "ThreatExpert", + "name": "ThreatExpert", + "method": "triage" + }, + "start_datetime": "2014-08-06T18:30:00", + "id": "example:analysis-5e1a1095-65a7-459e-9272-2c7883d9c20f" + } + + + def test_id_autoset(self): + o = Analysis() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Analysis() + o.source = Source() + o.source.name = "ThreatExpert" + o.source.organization = "ThreatExpert" + o.source.method = "triage" + o.source.url = "http://www.threatexpert.com" + + o.start_datetime = "2014-08-06T18:30:00" + + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index c6edf48..85b5a09 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -4,47 +4,26 @@ import unittest from cybox.test import EntityTestCase, round_trip -from maec.package.malware_subject import MalwareSubject -from maec.bundle.bundle import Bundle +from maec.package.analysis import Analysis -class TestMalwareSubject(EntityTestCase, unittest.TestCase): - klass = MalwareSubject + +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Analysis _full_dict = { - 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, - 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', - 'properties': {'file_name': 'abcd.dll', - 'size_in_bytes': 123456L, - 'xsi:type': 'FileObjectType'} - }], - 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', - 'name': {'value': 'create file', - 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} - }], - 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': 'persistence'}]}, - 'defined_subject': False, - 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', - 'schema_version': '4.1'}] - }, - 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', - 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', - 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', - 'type': u'MD5'}], - 'size_in_bytes': 35532L, - 'xsi:type': 'FileObjectType'}}} + + } def test_id_autoset(self): - o = MalwareSubject() + o = Analysis() self.assertNotEqual(o.id_, None) def test_round_trip(self): - o = MalwareSubject() - o.add_findings_bundle(Bundle()) + o = Analysis() o2 = round_trip(o) self.assertEqual(o.to_dict(), o2.to_dict()) if __name__ == "__main__": - unittest.main() \ No newline at end of file + unittest.main() + \ No newline at end of file diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index 51d759a..c2a6934 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -3,55 +3,49 @@ import unittest -from cybox.core import Object, Observables, RelatedObject, Relationship -from cybox.objects.address_object import Address -from cybox.objects.email_message_object import EmailMessage -from cybox.objects.uri_object import URI -from cybox.test import EntityTestCase, round_trip, round_trip_dict -from cybox.utils import CacheMiss, set_id_method -from maec.package.package import Package +from cybox.test import EntityTestCase, round_trip +from maec.package.malware_subject import MalwareSubject +from maec.bundle.bundle import Bundle - -class TestPackage(EntityTestCase, unittest.TestCase): - klass = Package +class TestMalwareSubject(EntityTestCase, unittest.TestCase): + klass = MalwareSubject _full_dict = { - 'id': 'example:package-2794fd8f-7850-48c0-82c1-87e1a25a7a91', - 'malware_subjects': [{'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, - 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', - 'properties': {'file_name': 'abcd.dll', - 'size_in_bytes': 123456L, - 'xsi:type': 'FileObjectType'} - }], - 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', - 'name': {'value': 'create file', - 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} - }], - 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': 'persistence'}]}, - 'defined_subject': False, - 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', - 'schema_version': '4.1'}] - }, - 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', - 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', - 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', - 'type': u'MD5'}], - 'size_in_bytes': 35532L, - 'xsi:type': 'FileObjectType'}}}], - 'schema_version': '2.1' - } + 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': {'file_name': 'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType'} + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': {'value': 'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} + }], + 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence'}]}, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1'}] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5'}], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType'}}} def test_id_autoset(self): - o = Package() + o = MalwareSubject() self.assertNotEqual(o.id_, None) def test_round_trip(self): - o = Package() + o = MalwareSubject() + o.add_findings_bundle(Bundle()) o2 = round_trip(o) self.assertEqual(o.to_dict(), o2.to_dict()) if __name__ == "__main__": - unittest.main() \ No newline at end of file + unittest.main() + \ No newline at end of file From 5e9381432477b4ad9673e4df2a7aa50ac05328ad Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 25 Sep 2014 09:17:00 -0400 Subject: [PATCH 089/297] Added missing return_obj and ns_info parameters to to_obj() methods in *CollectionList classes --- maec/bundle/bundle.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 8a57458..19e2231 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -147,7 +147,7 @@ class BehaviorCollectionList(maec.EntityList): def __init__(self): super(BehaviorCollectionList, self).__init__() - def to_obj(self): + def to_obj(self, return_obj = None, ns_info = None): behavior_collection_list_obj = bundle_binding.BehaviorCollectionListType() for behavior_collection in self: if len(behavior_collection.behavior_list) > 0: @@ -178,7 +178,7 @@ class ActionCollectionList(maec.EntityList): def __init__(self): super(ActionCollectionList, self).__init__() - def to_obj(self): + def to_obj(self, return_obj = None, ns_info = None): action_collection_list_obj = bundle_binding.ActionCollectionListType() for action_collection in self: if len(action_collection.action_list) > 0: @@ -209,7 +209,7 @@ class ObjectCollectionList(maec.EntityList): def __init__(self): super(ObjectCollectionList, self).__init__() - def to_obj(self): + def to_obj(self, return_obj = None, ns_info = None): object_collection_list_obj = bundle_binding.ObjectCollectionListType() for object_collection in self: if len(object_collection.object_list) > 0: @@ -240,7 +240,7 @@ class CandidateIndicatorCollectionList(maec.EntityList): def __init__(self): super(CandidateIndicatorCollectionList, self).__init__() - def to_obj(self): + def to_obj(self, return_obj = None, ns_info = None): candidate_indicator_collection_list_obj = bundle_binding.CandidateIndicatorCollectionListType() for candidate_indicator_collection in self: if len(candidate_indicator_collection.candidate_indicator_list) > 0: From c9bdf68dd540b86706cf9f3476c177cfbaf22330 Mon Sep 17 00:00:00 2001 From: apsillers Date: Thu, 25 Sep 2014 12:12:57 -0400 Subject: [PATCH 090/297] Remove incorrect test --- maec/test/bundle/av_classification_test.py | 6 ------ 1 file changed, 6 deletions(-) diff --git a/maec/test/bundle/av_classification_test.py b/maec/test/bundle/av_classification_test.py index 494508b..8fc76a2 100644 --- a/maec/test/bundle/av_classification_test.py +++ b/maec/test/bundle/av_classification_test.py @@ -14,12 +14,6 @@ class TestAVClassification(EntityTestCase, unittest.TestCase): 'vendor':'McAfee' } - def test_id_autoset(self): - o = AVClassification() - o.classification_name = 'Some!Trojan'; - o.vendor = 'McAfee' - self.assertNotEqual(o.id_, None) - def test_round_trip(self): o = AVClassification('Some!Trojan') o.vendor = 'McAfee' From 5c5664e67f0a39ed132cc9b3aa2bcdf14760a5d9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 26 Sep 2014 09:00:30 -0400 Subject: [PATCH 091/297] Updated AVClassification to be a maec.Entity subclass --- maec/bundle/av_classification.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index b6d6e8d..056fbae 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -4,13 +4,13 @@ # All rights reserved # Compatible with MAEC v4.1 -# Last updated 09/22/2014 +# Last updated 09/26/2014 import maec import maec.bindings.maec_bundle as bundle_binding from cybox.common import ToolInformation -class AVClassification(ToolInformation): +class AVClassification(ToolInformation, maec.Entity): _namespace = maec.bundle._namespace _binding = bundle_binding _binding_class = bundle_binding.AVClassificationType From 885f664accaf0a894ead205a3394b6fb382ece28 Mon Sep 17 00:00:00 2001 From: Charlie Hanner Date: Wed, 1 Oct 2014 12:42:22 -0400 Subject: [PATCH 092/297] Modified xml output to support custom_headers --- maec/__init__.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index f86ba78..e7c4129 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -38,7 +38,7 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" - def to_xml_file(self, filename, namespace_dict=None): + def to_xml_file(self, filename, namespace_dict=None, custom_header=None): """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" # Update the namespace dictionary with namespaces found upon import if namespace_dict and hasattr(self, '__input_namespaces__'): @@ -46,7 +46,11 @@ def to_xml_file(self, filename, namespace_dict=None): elif not namespace_dict and hasattr(self, '__input_namespaces__'): namespace_dict = self.__input_namespaces__ out_file = open(filename, 'w') - out_file.write("\n") + if custom_header: + for line in custom_header: + out_file.write[custom_header] + else: + out_file.write("\n") self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() @@ -112,7 +116,7 @@ def parse_xml_instance(filename, check_version = True): Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" object_dictionary = {} entity_parser = EntityParser() - + object_dictionary['binding'] = entity_parser.parse_xml_to_obj(filename, check_version) object_dictionary['api'] = entity_parser.parse_xml(filename, check_version) From b9b4035a34dd22523a5cb95ff89137c7ecc706bd Mon Sep 17 00:00:00 2001 From: Charlie Hanner Date: Wed, 1 Oct 2014 13:54:23 -0400 Subject: [PATCH 093/297] Fixed for loop error --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index e7c4129..7b37040 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -48,7 +48,7 @@ def to_xml_file(self, filename, namespace_dict=None, custom_header=None): out_file = open(filename, 'w') if custom_header: for line in custom_header: - out_file.write[custom_header] + out_file.write[line] else: out_file.write("\n") self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) From 0ad664be9f8747437acfec953adad34287c07502 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 3 Oct 2014 12:53:33 -0400 Subject: [PATCH 094/297] Initial commit --- maec/misc/__init__.py | 0 maec/misc/options.py | 22 ++++++++++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 maec/misc/__init__.py create mode 100644 maec/misc/options.py diff --git a/maec/misc/__init__.py b/maec/misc/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/maec/misc/options.py b/maec/misc/options.py new file mode 100644 index 0000000..ed36a82 --- /dev/null +++ b/maec/misc/options.py @@ -0,0 +1,22 @@ +class ScriptOptions(object): + """Defines configurable options for MAEC scripts and utilities. + + Attributes: + deduplicate_bundles: If ``True``, the script will deduplicate all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + dereference_bundles: If ``True``, the script will deference all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + normalize_bundles: If ``True``, the script will normalize all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + + """ + def __init__(self): + self.deduplicate_bundles = False + self.dereference_bundles = False + self.normalize_bundles = False \ No newline at end of file From 1f1605e34a94ad2db98bc0d058f9e3a6adce0164 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 3 Oct 2014 14:40:00 -0400 Subject: [PATCH 095/297] Updated Bundle ID usage to account for recent updates --- maec/utils/deduplicator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index b84cb87..79dfe3b 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -85,7 +85,7 @@ def handle_unique_objects(cls, bundle, all_objects): for object_collection in bundle.collections.object_collections: counter += 1 # Find the namespace used in the Bundle IDs - bundle_namespace = bundle.id.split('-')[1] + bundle_namespace = bundle.id_.split('-')[1] # Build the collection ID collection_id = "maec-" + bundle_namespace + "-objc-" + str(counter) # Add the named Object collection From a4bef96cb5012b24909bbb6446e404ae458ca852 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 3 Oct 2014 15:47:28 -0400 Subject: [PATCH 096/297] Fixed some issues with deduplicated object -> duplicate object mapping --- maec/utils/deduplicator.py | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 79dfe3b..84481da 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -21,6 +21,10 @@ def deduplicate(cls, bundle): cls.objects_dict = {} # Dictionary of non-unique -> unique Object ID mappings cls.object_ids_mapping = {} + # Dictionary of Objects with IDs + cls.id_objects = {} + # Dictionary of Objects with IDrefs + cls.idref_objects = {} # Get all Objects in the Bundle all_objects = bundle.get_all_objects(include_actions=True) # Perform the Object mapping @@ -65,15 +69,18 @@ def cleanup(cls, bundle): def handle_duplicate_objects(cls, bundle, all_objects): """Replace all of the duplicate Objects with references to the unique object placed in the "Re-used Objects" Collection.""" for duplicate_object_id, unique_object_id in cls.object_ids_mapping.items(): - for object in all_objects: - if object.id_ == duplicate_object_id or object.idref == duplicate_object_id: - # Modify the existing Object to serve as a reference to - # the unique Object in the collection + # Modify the existing Object to serve as a reference to + # the unique Object in the collection + if cls.id_objects[duplicate_object_id]: + object = cls.id_objects[duplicate_object_id] + object.idref = unique_object_id + object.id_ = None + object.properties = None + object.related_objects = None + object.domain_specific_object_properties = None + elif cls.idref_objects[duplicate_object_id]: + for object in cls.idref_objects[duplicate_object_id]: object.idref = unique_object_id - object.id_ = None - object.properties = None - object.related_objects = None - object.domain_specific_object_properties = None @classmethod def handle_unique_objects(cls, bundle, all_objects): @@ -123,6 +130,14 @@ def map_objects(cls, all_objects): """Map the non-unique Objects to their unique (first observed) counterparts.""" # Do the object mapping for obj in all_objects: + # Add the Object to its respective dictionary + if obj.id_: + cls.id_objects[obj.id_] = obj + elif obj.idref and obj.idref not in cls.idref_objects: + cls.idref_objects[obj.idref] = [obj] + elif obj.idref and obj.idref in cls.idref_objects: + cls.idref_objects[obj.idref].append(obj) + # Find a matching ID for the Object matching_object_id = cls.find_matching_object(obj) if matching_object_id: cls.object_ids_mapping[obj.id_] = matching_object_id From 5aff56bfcd4b9db0de3905f888e4df1359ac9028 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 3 Oct 2014 15:51:08 -0400 Subject: [PATCH 097/297] Fixed some issues with deduplicated object -> duplicate object mapping --- maec/utils/deduplicator.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 84481da..1dffdde 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -71,14 +71,14 @@ def handle_duplicate_objects(cls, bundle, all_objects): for duplicate_object_id, unique_object_id in cls.object_ids_mapping.items(): # Modify the existing Object to serve as a reference to # the unique Object in the collection - if cls.id_objects[duplicate_object_id]: + if duplicate_object_id and duplicate_object_id in cls.id_objects: object = cls.id_objects[duplicate_object_id] object.idref = unique_object_id object.id_ = None object.properties = None object.related_objects = None object.domain_specific_object_properties = None - elif cls.idref_objects[duplicate_object_id]: + elif duplicate_object_id and duplicate_object_id in cls.idref_objects: for object in cls.idref_objects[duplicate_object_id]: object.idref = unique_object_id From a231c761cb0fed922a015bf1daa67635192b25fb Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 6 Oct 2014 14:29:07 -0400 Subject: [PATCH 098/297] Fixed typo --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index aa2219d..ec0edbe 100644 --- a/README.rst +++ b/README.rst @@ -30,7 +30,7 @@ There are currently two levels of APIs for dealing with MAEC content: - A low-level API is provided by auto-generated XML Schema - Python class bindings. These bindings were generated using `generateDS - `_. With these, any CybOX + `_. With these, any MAEC content can be parsed from or written to XML, but requires a bit more knowledge of the actual MAEC schemas. These "binding classes" are all located in the ``maec.bindings`` package. From 29d49ea171babe28638cea8892306adac3bbe9db Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 15 Oct 2014 18:16:00 -0400 Subject: [PATCH 099/297] Updated required python-cybox version --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index aec5169..67173e2 100644 --- a/setup.py +++ b/setup.py @@ -35,7 +35,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.3', 'cybox>=2.1.0.7,<2.1.1.0'], + install_requires=['lxml>=2.3', 'cybox>=2.1.0.8,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", From ecc8a0bc823e314a254004373f3aa91cc4a597af Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 15 Oct 2014 18:17:16 -0400 Subject: [PATCH 100/297] Bumped version to 4.1.0.8 --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index 7b37040..bbcc1b5 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.7" +__version__ = "4.1.0.8" import collections import json From 571080fb5381bdc4a0decf93eacdcd9bfb2217cb Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 15 Oct 2014 18:26:18 -0400 Subject: [PATCH 101/297] Initial commit --- CHANGES.txt | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 CHANGES.txt diff --git a/CHANGES.txt b/CHANGES.txt new file mode 100644 index 0000000..a38431a --- /dev/null +++ b/CHANGES.txt @@ -0,0 +1,7 @@ +Version 4.1.0.8 +2014-10-15 +- Performance enhancements in to_xml() serialization (ref: python-stix #163) +- Greatly expanded documentation (http://maec.readthedocs.org/en/latest/) +- Added unit tests +- [#53] Added script options class +- Various bug fixes \ No newline at end of file From fdce837229654f1249394c0cec2f777cf2f50d77 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 15 Oct 2014 18:39:40 -0400 Subject: [PATCH 102/297] Bumped up latest version to 4.1.0.8 --- docs/index.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/index.rst b/docs/index.rst index 9b74223..e80b4f7 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -20,7 +20,7 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.7 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.8 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== From f93f88609bb3e9667ba5e9b65764a8cc3cf51b42 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 16 Oct 2014 08:23:50 -0400 Subject: [PATCH 103/297] Updated PyPi links and fixed typo --- docs/index.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/index.rst b/docs/index.rst index e80b4f7..d595190 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -7,7 +7,7 @@ python-maec |release| Documentation ==================================== The python-maec library provides an API for developing and consuming Malware -Attribute Enumeration and Characterizaiton (MAEC) content. Developers can +Attribute Enumeration and Characterization (MAEC) content. Developers can leverage the API to create applications that create, consume, translate, or otherwise work with MAEC content. @@ -25,8 +25,8 @@ MAEC Version python-maec Version 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.7 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.7 +__ https://pypi.python.org/pypi/maec/4.1.0.8 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.8 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 From ed7e2dc15aacf40c66ea1292ccb505ee6f1e5097 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 16 Oct 2014 08:02:32 -0500 Subject: [PATCH 104/297] Update README.rst Make PyPI happy! --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index ec0edbe..5925502 100644 --- a/README.rst +++ b/README.rst @@ -43,7 +43,7 @@ There are currently two levels of APIs for dealing with MAEC content: Importing from JSON is also supported. Compatibility ----------- +------------- The python-maec library is tested and written against python ``2.7.x``. Compatibility with other python versions is neither guaranteed nor implied. Versioning From 1b907f9caa73b50279bab38a1241592df3f09f96 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 16 Oct 2014 15:53:13 -0400 Subject: [PATCH 105/297] Added ability to extract and use additional namespaces in __get_namespaces --- maec/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maec/__init__.py b/maec/__init__.py index bbcc1b5..fbe0e11 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -97,6 +97,12 @@ def _get_namespaces(self, recurse=True): nsset.update(x._get_namespaces()) del self.touched + # Add any additional namespaces that may be included in the entity + entity_dict = self.__dict__ + input_ns = entity_dict.get("__input_namespaces__", {}) + for namespace, alias in input_ns.items(): + namespaces.append(Namespace(namespace, alias)) + return nsset def _get_children(self): From aeba9603236fc271f5b39ff34152494ca4f86c80 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 16 Oct 2014 15:53:45 -0400 Subject: [PATCH 106/297] Added structures for extra namespaces and schemalocations --- maec/package/package.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/maec/package/package.py b/maec/package/package.py index 1981105..b10597c 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -32,6 +32,8 @@ def __init__(self, id = None, schema_version = "2.1", timestamp = None): self.schema_version = schema_version self.timestamp = timestamp self.malware_subjects = MalwareSubjectList() + self.__input_namespaces__ = {} + self.__input_schemalocations__ = {} #Public methods #Add a malware subject to this Package From 3f8d5442e3b1728f471c0a5a9a032f9b8543f089 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 16 Oct 2014 15:54:42 -0400 Subject: [PATCH 107/297] Added structures for extra namespaces and schemalocations --- maec/bundle/bundle.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 19e2231..eba0c85 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -349,6 +349,8 @@ def __init__(self, id = None, defined_subject = False, schema_version = "4.1", c self.content_type = content_type self.timestamp = None self.malware_instance_object_attributes = malware_instance_object + self.__input_namespaces__ = {} + self.__input_schemalocations__ = {} def set_malware_instance_object_atttributes(self, malware_instance_object): """Set the top-level Malware Instance Object Attributes entity in the Bundle.""" From 6206499481debdb86a1b251e988206e38edb4832 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 17 Oct 2014 10:15:54 -0400 Subject: [PATCH 108/297] Removed _get_children; no longer necessary due to the maec.Entity subclassing of cybox.Entity --- maec/__init__.py | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index fbe0e11..1dc9160 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -105,18 +105,6 @@ def _get_namespaces(self, recurse=True): return nsset - def _get_children(self): - #TODO: eventually everything should be in _fields, not the top level - # of vars() - for k, v in vars(self).items() + self._fields.items(): - if isinstance(v, Entity) or isinstance(v, cyboxEntity): - yield v - elif isinstance(v, list): - for item in v: - if isinstance(item, Entity) or isinstance(item, cyboxEntity): - yield item - - def parse_xml_instance(filename, check_version = True): """Parse a MAEC instance and return the correct Binding and API objects Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" From e3bf2e41a2f011b8f88ba955d8111b4179301dad Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 17 Oct 2014 11:04:24 -0400 Subject: [PATCH 109/297] Fixed typo in set_malware_instance_object_attributes. Closes #27 --- maec/bundle/bundle.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index eba0c85..6138655 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -352,7 +352,7 @@ def __init__(self, id = None, defined_subject = False, schema_version = "4.1", c self.__input_namespaces__ = {} self.__input_schemalocations__ = {} - def set_malware_instance_object_atttributes(self, malware_instance_object): + def set_malware_instance_object_attributes(self, malware_instance_object): """Set the top-level Malware Instance Object Attributes entity in the Bundle.""" self.malware_instance_object_attributes = malware_instance_object From 7cb65c115a7ea0c848cd1575f076c3812e63c3e1 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Oct 2014 10:10:13 -0400 Subject: [PATCH 110/297] Updated type to type_ in MalwareSubjectRelationship --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index eeda25d..1b3a8e3 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -38,7 +38,7 @@ class MalwareSubjectRelationship(maec.Entity): _namespace = maec.package._namespace malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) - type = maec.TypedField("type", VocabString) + type_ = maec.TypedField("type", VocabString) def __init__(self): super(MalwareSubjectRelationship, self).__init__() From 9de161f6a1f853cd9daafbecce5da1a753184dc4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Oct 2014 10:12:45 -0400 Subject: [PATCH 111/297] Fixed typo in maec.TypedField field name --- maec/package/malware_subject.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 1b3a8e3..d8066de 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -38,7 +38,7 @@ class MalwareSubjectRelationship(maec.Entity): _namespace = maec.package._namespace malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) - type_ = maec.TypedField("type", VocabString) + type_ = maec.TypedField("Type", VocabString) def __init__(self): super(MalwareSubjectRelationship, self).__init__() From 23da33981ee2134286795260129b3e15b1ac4806 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 21 Oct 2014 10:49:22 -0400 Subject: [PATCH 112/297] Fixed some issues with additional namespace handling in _get_namespaces --- maec/__init__.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 1dc9160..9185c65 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -10,7 +10,7 @@ from cybox import Entity as cyboxEntity from cybox import EntityList from cybox import TypedField -from cybox.utils import Namespace +from cybox.utils import Namespace, META from maec.utils import maecMETA, EntityParser def get_xmlns_string(ns_set): @@ -101,7 +101,10 @@ def _get_namespaces(self, recurse=True): entity_dict = self.__dict__ input_ns = entity_dict.get("__input_namespaces__", {}) for namespace, alias in input_ns.items(): - namespaces.append(Namespace(namespace, alias)) + maec_ns = maecMETA.lookup_namespace(namespace) + cybox_ns = META.lookup_namespace(namespace) + if not maec_ns and not cybox_ns: + nsset.add(Namespace(namespace, alias)) return nsset From 20e5ae1cf8f635b5ef9a2896fab19dc60e4aa409 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 21 Oct 2014 15:29:32 -0400 Subject: [PATCH 113/297] Added None-type checks for related objects in get_all_objects --- maec/bundle/bundle.py | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 6138655..8fad9e5 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -1,10 +1,10 @@ -#MAEC Bundle Class +# MAEC Bundle Class -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 08/25/2014 +# Compatible with MAEC v4.1 +# Last updated 10/21/2014 import datetime @@ -457,15 +457,17 @@ def get_all_objects(self, include_actions = False): if self.objects: for obj in self.objects: all_objects.append(obj) - for related_obj in obj.related_objects: - all_objects.append(related_obj) + if obj.related_objects: + for related_obj in obj.related_objects: + all_objects.append(related_obj) if self.collections and self.collections.object_collections: for collection in self.collections.object_collections: for obj in collection.object_list: all_objects.append(obj) - for related_obj in obj.related_objects: - all_objects.append(related_obj) + if obj.related_objects: + for related_obj in obj.related_objects: + all_objects.append(related_obj) # Include Objects in Actions, if include_actions flag is specified if include_actions: @@ -474,8 +476,9 @@ def get_all_objects(self, include_actions = False): if associated_objects: for associated_object in associated_objects: all_objects.append(associated_object) - for related_obj in associated_object.related_objects: - all_objects.append(related_obj) + if associated_object.related_objects: + for related_obj in associated_object.related_objects: + all_objects.append(related_obj) # Add the Object corresponding to the Malware Instance Object Attributes, if specified if self.malware_instance_object_attributes: From 18eb2d3176e53ecaf9858cc7574e7f5628df2d9c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 21 Oct 2014 15:38:58 -0400 Subject: [PATCH 114/297] Added None-type checks for collections in get_object_by_id --- maec/bundle/bundle.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 8fad9e5..00786c9 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -507,7 +507,7 @@ def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): for associated_obj in action.associated_objects: if associated_obj.id_ == id: return associated_obj - if self.collections: + if self.collections and self.collections.action_collections: for collection in self.collections.action_collections: for action in collection.action_list: if action.id_ == id: @@ -522,7 +522,7 @@ def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): if obj.id_ == id: return obj - if self.collections: + if self.collections and self.collections.object_collections: for collection in self.collections.object_collections: for obj in collection.object_list: if obj.id_ == id: From aedd1c7309e03c05df547290cb72ce9111a5b02d Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Oct 2014 11:01:56 -0400 Subject: [PATCH 115/297] Fixed property usage in merge_findings_bundles --- maec/utils/merge.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index e0ab9c0..ef6d12d 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -11,10 +11,10 @@ from cybox.utils import Namespace from maec.package.package import Package from maec.bundle.bundle import Bundle -from maec.package.malware_subject import MalwareSubject, MalwareConfigurationDetails,\ - FindingsBundleList, MetaAnalysis, Analyses,\ - MinorVariants, MalwareSubjectRelationshipList,\ - MalwareSubjectList +from maec.package.malware_subject import (MalwareSubject, MalwareConfigurationDetails, + FindingsBundleList, MetaAnalysis, Analyses, + MinorVariants, MalwareSubjectRelationshipList, + MalwareSubjectList) def dict_merge(target, *args): '''Merge multiple dictionaries into one''' @@ -133,9 +133,9 @@ def merge_findings_bundles(findings_bundles_list): if meta_analysis_list: merged_meta_analysis = MetaAnalysis.from_dict(merge_entities(meta_analysis_list)) # Merge the list of bundles - merged_bundles = list(itertools.chain(*[x.bundles for x in findings_bundles_list if x.bundles])) + merged_bundles = list(itertools.chain(*[x.bundle for x in findings_bundles_list if x.bundle])) # Merge the list of external bundle references - merged_bundle_external_references = list(itertools.chain(*[x.bundle_external_references for x in findings_bundles_list if x.bundle_external_references])) + merged_bundle_external_references = list(itertools.chain(*[x.bundle_external_reference for x in findings_bundles_list if x.bundle_external_reference])) # Construct the merged Findings Bundle List entity merged_findings_bundle_list = FindingsBundleList() From b46a0b8c3cfdc6f8f9de317195fac68d9f835cf4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Oct 2014 11:12:16 -0400 Subject: [PATCH 116/297] Fixed more property usage in merge_findings_bundles --- maec/utils/merge.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index ef6d12d..4cb187d 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -142,9 +142,9 @@ def merge_findings_bundles(findings_bundles_list): if merged_meta_analysis: merged_findings_bundle_list.meta_analysis = merged_meta_analysis if merged_bundles: - merged_findings_bundle_list.bundles = merged_bundles + merged_findings_bundle_list.bundle = merged_bundles if merged_bundle_external_references: - merged_findings_bundle_list.bundle_external_references = merged_bundle_external_references + merged_findings_bundle_list.bundle_external_reference = merged_bundle_external_references return merged_findings_bundle_list From 5b0b82e85ab9d3aa80e75eee796b7375fe3fa421 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Oct 2014 11:19:36 -0400 Subject: [PATCH 117/297] Updated bin_malware_subjects to operate on python-maec/cybox instances and not dictionaries --- maec/utils/merge.py | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 4cb187d..801248c 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -81,21 +81,14 @@ def bin_malware_subjects(malware_subject_list, default_hash_type='md5'): if mal_inst_obj: obj_properties = mal_inst_obj.properties if obj_properties and obj_properties.hashes: - hashes_list = obj_properties.hashes.to_list() - for hash_dict in hashes_list: - if 'type' in hash_dict and 'simple_hash_value' in hash_dict: + for hash in obj_properties.hashes: + if hash.type_ and hash.simple_hash_value: hash_type = '' hash_value = '' # Get the hash type - if isinstance(hash_dict['type'], str): - hash_type = str(hash_dict['type']).lower() - elif isinstance(hash_dict['type'], dict): - hash_type = str(hash_dict['type']['value']).lower() + hash_type = str(hash.type_).lower() # Get the hash value - if isinstance(hash_dict['simple_hash_value'], str): - hash_value = str(hash_dict['simple_hash_value']).lower() - elif isinstance(hash_dict['simple_hash_value'], dict): - hash_value = str(hash_dict['simple_hash_value']['value']).lower() + hash_value = str(hash.simple_hash_value).lower() # Check the hash type and bin accordingly if hash_type == default_hash_type: From c0eb909869c76c31285650d1bf15a8f6eceab3b4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Oct 2014 13:46:30 -0400 Subject: [PATCH 118/297] Updated merge_packages to merge input namespace/schemalocations dictionaries. Also, made it return a merged_package entity rather than output to XML --- maec/utils/merge.py | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 801248c..71be6fb 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -51,9 +51,11 @@ def merge_documents(input_list, output_file): print 'Error: unsupported document type. Currently only MAEC Packages are supported' # Merge the MAEC packages - merge_packages(parsed_documents, output_file) + merged_package = merge_packages(parsed_documents) + # Write the merged package to the output file + merged_package.to_xml_file(output_file, {"https://github.com/MAECProject/python-maec":"merged"}) -def merge_packages(package_list, output_file): +def merge_packages(package_list): '''Merge a list of input MAEC Packages and write them to an output Package file''' malware_subjects = [] # Instantiate the ID generator class (for automatic ID generation) @@ -65,11 +67,18 @@ def merge_packages(package_list, output_file): malware_subjects.append(malware_subject) # Merge the Malware Subjects merged_subjects = merge_malware_subjects(malware_subjects) + # Merge the input namespace/schemaLocation dictionaries + merged_namespaces = {} + merged_schemalocations = {} + for package in package_list: + merged_namespaces.update(package.__input_namespaces__) + merged_schemalocations.update(package.__input_schemalocations__) # Create a new Package with the merged Malware Subjects merged_package = Package() merged_package.malware_subjects = MalwareSubjectList(merged_subjects) - # Write the Package to the output file - merged_package.to_xml_file(output_file, {"https://github.com/MAECProject/python-maec":"merged"}) + merged_package.__input_namespaces__ = merged_namespaces + merged_package.__input_schemalocations__ = merged_schemalocations + return merged_package def bin_malware_subjects(malware_subject_list, default_hash_type='md5'): '''Bin a list of Malware Subjects by hash @@ -179,6 +188,8 @@ def merge_binned_malware_subjects(merged_malware_subject, binned_list, id_mappin # Merge the compatible platforms merged_compatible_platforms = list(itertools.chain(*[x.compatible_platform for x in binned_list if x.compatible_platform])) + + # Build the merged Malware Subject merged_malware_subject.malware_instance_object_attributes = merged_inst_obj if deduplicated_labels: merged_malware_subject.label = deduplicated_labels From 912a61f28ea09e219d6144e9ec461fd0e797c821 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Oct 2014 13:48:14 -0400 Subject: [PATCH 119/297] Updated docstring for merge_packages --- maec/utils/merge.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 71be6fb..8b21e04 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -56,7 +56,7 @@ def merge_documents(input_list, output_file): merged_package.to_xml_file(output_file, {"https://github.com/MAECProject/python-maec":"merged"}) def merge_packages(package_list): - '''Merge a list of input MAEC Packages and write them to an output Package file''' + '''Merge a list of input MAEC Packages and return a merged Package instance.''' malware_subjects = [] # Instantiate the ID generator class (for automatic ID generation) NS = Namespace("https://github.com/MAECProject/python-maec", "merged") From e76d923460e8b77ad3a236376af008deb1840254 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 5 Nov 2014 11:38:06 -0500 Subject: [PATCH 120/297] Updated parser instances to set resolve_entities to False --- maec/utils/parser.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/utils/parser.py b/maec/utils/parser.py index 72678bb..8df6f78 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -73,7 +73,7 @@ def parse_xml_to_obj(self, xml_file, check_version=True): xml_file -- A filename/path or a file-like object reprenting a MAEC instance document check_version -- Inspect the version before parsing. """ - parser = etree.ETCompatXMLParser(huge_tree=True) + parser = etree.ETCompatXMLParser(huge_tree=True, resolve_entities=False) tree = etree.parse(xml_file, parser=parser) # Check the root and determine the type of document we're dealing with @@ -101,7 +101,7 @@ def parse_xml(self, xml_file, check_version=True): xml_file -- A filename/path or a file-like object reprenting a MAEC instance (i.e. Package or Bundle) document check_version -- Inspect the version before parsing. """ - parser = etree.ETCompatXMLParser(huge_tree=True) + parser = etree.ETCompatXMLParser(huge_tree=True, resolve_entities=False) tree = etree.parse(xml_file, parser=parser) api_obj = None From a697fc4bd09accef57f82171225c08dc0c5e7656 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 6 Nov 2014 13:25:23 -0600 Subject: [PATCH 121/297] Add initial landscape.io config file. [ci skip] --- .landscape.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .landscape.yaml diff --git a/.landscape.yaml b/.landscape.yaml new file mode 100644 index 0000000..a923692 --- /dev/null +++ b/.landscape.yaml @@ -0,0 +1,3 @@ +ignore-paths: + - docs + - maec/bindings From 6d72b799a698aefa68250bb11fc29e63026ff84d Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 10 Nov 2014 14:17:07 -0600 Subject: [PATCH 122/297] Update README.rst --- README.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/README.rst b/README.rst index 5925502..977704a 100644 --- a/README.rst +++ b/README.rst @@ -6,6 +6,7 @@ A Python library for parsing, manipulating, and generating MAEC content. :Source: https://github.com/MAECProject/python-maec :Documentation: http://maec.readthedocs.org :Information: http://maec.mitre.org +:Download: https://pypi.python.org/pypi/maec/ |version badge| |downloads badge| From 696e1914f8da326e8fbcff7e8db78d01d793dc12 Mon Sep 17 00:00:00 2001 From: apsillers Date: Mon, 10 Nov 2014 16:14:45 -0500 Subject: [PATCH 123/297] Add output options for to_xml_file --- maec/__init__.py | 249 ++++++++++++++++++++++--------------------- maec/misc/options.py | 51 +++++---- 2 files changed, 158 insertions(+), 142 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 9185c65..79c217a 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,120 +1,129 @@ -__version__ = "4.1.0.8" - -import collections -import json -import inspect -import maec -from StringIO import StringIO -import bindings.maec_bundle as bundle_binding -import bindings.maec_package as package_binding -from cybox import Entity as cyboxEntity -from cybox import EntityList -from cybox import TypedField -from cybox.utils import Namespace, META -from maec.utils import maecMETA, EntityParser - -def get_xmlns_string(ns_set): - """Build a string with 'xmlns' definitions for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - xmlns_format = 'xmlns:{0.prefix}="{0.name}"' - return "\n\t".join([xmlns_format.format(x) for x in ns_set if x]) - - -def get_schemaloc_string(ns_set): - """Build a "schemaLocation" string for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - schemaloc_format = '{0.name} {0.schema_location}' - # Only include schemas that have a schema_location defined (for instance, - # 'xsi' does not. - return " ".join([schemaloc_format.format(x) for x in ns_set - if x and x.schema_location]) - -class Entity(cyboxEntity): - """Base class for all classes in the MAEC SimpleAPI.""" - - def to_xml_file(self, filename, namespace_dict=None, custom_header=None): - """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" - # Update the namespace dictionary with namespaces found upon import - if namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict.update(self.__input_namespaces__) - elif not namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict = self.__input_namespaces__ - out_file = open(filename, 'w') - if custom_header: - for line in custom_header: - out_file.write[line] - else: - out_file.write("\n") - self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) - out_file.close() - - def _get_namespace_def(self, additional_ns_dict=None): - # copy necessary namespaces - - namespaces = self._get_namespaces() - - # if there are any other namepaces, include xsi for "schemaLocation" - # also, include the MAEC default vocabularies schema by default - if namespaces: - namespaces.update([maecMETA.lookup_prefix('xsi')]) - namespaces.update([maecMETA.lookup_prefix('maecVocabs')]) - - if namespaces and additional_ns_dict: - namespace_list = [x.name for x in namespaces if x] - for ns, prefix in additional_ns_dict.iteritems(): - if ns not in namespace_list: - namespaces.update([Namespace(ns, prefix)]) - - if not namespaces: - return "" - - namespaces = sorted(namespaces, key=str) - - return ('\n\t' + get_xmlns_string(namespaces) + - '\n\txsi:schemaLocation="' + get_schemaloc_string(namespaces) + - '"') - - def _get_namespaces(self, recurse=True): - nsset = set() - - # Get all _namespaces for parent classes - namespaces = [x._namespace for x in self.__class__.__mro__ - if hasattr(x, '_namespace')] - - nsset.update([maecMETA.lookup_namespace(ns) for ns in namespaces]) - - #In case of recursive relationships, don't process this item twice - self.touched = True - if recurse: - for x in self._get_children(): - if not hasattr(x, 'touched'): - nsset.update(x._get_namespaces()) - del self.touched - - # Add any additional namespaces that may be included in the entity - entity_dict = self.__dict__ - input_ns = entity_dict.get("__input_namespaces__", {}) - for namespace, alias in input_ns.items(): - maec_ns = maecMETA.lookup_namespace(namespace) - cybox_ns = META.lookup_namespace(namespace) - if not maec_ns and not cybox_ns: - nsset.add(Namespace(namespace, alias)) - - return nsset - -def parse_xml_instance(filename, check_version = True): - """Parse a MAEC instance and return the correct Binding and API objects - Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" - object_dictionary = {} - entity_parser = EntityParser() - - object_dictionary['binding'] = entity_parser.parse_xml_to_obj(filename, check_version) - object_dictionary['api'] = entity_parser.parse_xml(filename, check_version) - - return object_dictionary +__version__ = "4.1.0.8" + +import collections +import json +import inspect +import maec +from StringIO import StringIO +import bindings.maec_bundle as bundle_binding +import bindings.maec_package as package_binding +from cybox import Entity as cyboxEntity +from cybox import EntityList +from cybox import TypedField +from cybox.utils import Namespace, META +from maec.utils import maecMETA, EntityParser + +def get_xmlns_string(ns_set): + """Build a string with 'xmlns' definitions for every namespace in ns_set. + + Arguments: + - ns_set: a set (or other iterable) of Namespace objects + """ + xmlns_format = 'xmlns:{0.prefix}="{0.name}"' + return "\n\t".join([xmlns_format.format(x) for x in ns_set if x]) + + +def get_schemaloc_string(ns_set): + """Build a "schemaLocation" string for every namespace in ns_set. + + Arguments: + - ns_set: a set (or other iterable) of Namespace objects + """ + schemaloc_format = '{0.name} {0.schema_location}' + # Only include schemas that have a schema_location defined (for instance, + # 'xsi' does not. + return " ".join([schemaloc_format.format(x) for x in ns_set + if x and x.schema_location]) + +class Entity(cyboxEntity): + """Base class for all classes in the MAEC SimpleAPI.""" + + def to_xml_file(self, filename, namespace_dict=None, custom_header=None, options_used=None): + """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" + # Update the namespace dictionary with namespaces found upon import + if namespace_dict and hasattr(self, '__input_namespaces__'): + namespace_dict.update(self.__input_namespaces__) + elif not namespace_dict and hasattr(self, '__input_namespaces__'): + namespace_dict = self.__input_namespaces__ + out_file = open(filename, 'w') + if custom_header: + for line in custom_header: + out_file.write[line] + else: + out_file.write("\n") + + if options_used: + import pprint + out_file.write("", "\\-\\->") + out_file.write(options_output) + out_file.write("\n-->\n") + + self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) + out_file.close() + + def _get_namespace_def(self, additional_ns_dict=None): + # copy necessary namespaces + + namespaces = self._get_namespaces() + + # if there are any other namepaces, include xsi for "schemaLocation" + # also, include the MAEC default vocabularies schema by default + if namespaces: + namespaces.update([maecMETA.lookup_prefix('xsi')]) + namespaces.update([maecMETA.lookup_prefix('maecVocabs')]) + + if namespaces and additional_ns_dict: + namespace_list = [x.name for x in namespaces if x] + for ns, prefix in additional_ns_dict.iteritems(): + if ns not in namespace_list: + namespaces.update([Namespace(ns, prefix)]) + + if not namespaces: + return "" + + namespaces = sorted(namespaces, key=str) + + return ('\n\t' + get_xmlns_string(namespaces) + + '\n\txsi:schemaLocation="' + get_schemaloc_string(namespaces) + + '"') + + def _get_namespaces(self, recurse=True): + nsset = set() + + # Get all _namespaces for parent classes + namespaces = [x._namespace for x in self.__class__.__mro__ + if hasattr(x, '_namespace')] + + nsset.update([maecMETA.lookup_namespace(ns) for ns in namespaces]) + + #In case of recursive relationships, don't process this item twice + self.touched = True + if recurse: + for x in self._get_children(): + if not hasattr(x, 'touched'): + nsset.update(x._get_namespaces()) + del self.touched + + # Add any additional namespaces that may be included in the entity + entity_dict = self.__dict__ + input_ns = entity_dict.get("__input_namespaces__", {}) + for namespace, alias in input_ns.items(): + maec_ns = maecMETA.lookup_namespace(namespace) + cybox_ns = META.lookup_namespace(namespace) + if not maec_ns and not cybox_ns: + nsset.add(Namespace(namespace, alias)) + + return nsset + +def parse_xml_instance(filename, check_version = True): + """Parse a MAEC instance and return the correct Binding and API objects + Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" + object_dictionary = {} + entity_parser = EntityParser() + + object_dictionary['binding'] = entity_parser.parse_xml_to_obj(filename, check_version) + object_dictionary['api'] = entity_parser.parse_xml(filename, check_version) + + return object_dictionary diff --git a/maec/misc/options.py b/maec/misc/options.py index ed36a82..2535916 100644 --- a/maec/misc/options.py +++ b/maec/misc/options.py @@ -1,22 +1,29 @@ -class ScriptOptions(object): - """Defines configurable options for MAEC scripts and utilities. - - Attributes: - deduplicate_bundles: If ``True``, the script will deduplicate all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - dereference_bundles: If ``True``, the script will deference all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - normalize_bundles: If ``True``, the script will normalize all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - - """ - def __init__(self): - self.deduplicate_bundles = False - self.dereference_bundles = False - self.normalize_bundles = False \ No newline at end of file +class ScriptOptions(object): + """Defines configurable options for MAEC scripts and utilities. + + Attributes: + deduplicate_bundles: If ``True``, the script will deduplicate all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + dereference_bundles: If ``True``, the script will deference all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + normalize_bundles: If ``True``, the script will normalize all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + + """ + def __init__(self): + self.deduplicate_bundles = False + self.dereference_bundles = False + self.normalize_bundles = False + + def to_dict(self): + return { + "deduplicate_bundles": self.deduplicate_bundles, + "dereference_bundles": self.dereference_bundles, + "normalize_bundles": self.normalize_bundles + } \ No newline at end of file From 51f7dd88e6432aac70c04ff430371418ba734af8 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 10 Nov 2014 16:42:44 -0600 Subject: [PATCH 124/297] Add landscape.io badge to README [ci skip] --- README.rst | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 977704a..568eceb 100644 --- a/README.rst +++ b/README.rst @@ -8,10 +8,13 @@ A Python library for parsing, manipulating, and generating MAEC content. :Information: http://maec.mitre.org :Download: https://pypi.python.org/pypi/maec/ -|version badge| |downloads badge| +|landscape.io badge| |version badge| |downloads badge| .. TODO: add Travis Badge +.. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.png + :target: https://landscape.io/github/MAECProject/python-maec/master + :alt: Code Health .. |version badge| image:: https://pypip.in/v/maec/badge.png :target: https://pypi.python.org/pypi/maec/ .. |downloads badge| image:: https://pypip.in/d/maec/badge.png From fb862932294b973e91042b9b93b1d5eaad18cc64 Mon Sep 17 00:00:00 2001 From: Andrew Sillers Date: Mon, 10 Nov 2014 20:46:26 -0500 Subject: [PATCH 125/297] Changed key/value output method for output data --- maec/__init__.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 79c217a..cb82d2e 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -53,12 +53,12 @@ def to_xml_file(self, filename, namespace_dict=None, custom_header=None, options out_file.write("\n") if options_used: - import pprint out_file.write("", "\\-\\->") - out_file.write(options_output) - out_file.write("\n-->\n") + for key, value in options_used.iteritems(): + sanitized_key = str(key).replace("-->", "\\-\\->") + sanitized_value = str(value).replace("-->", "\\-\\->") + out_file.write(sanitized_key + ": " + sanitized_value + "\n") + out_file.write("-->\n") self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() From 6bde5e6c963bb3f944e06039fda317a628607d59 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 12 Nov 2014 09:01:49 -0500 Subject: [PATCH 126/297] Removed un-used/deprecated sets import --- maec/utils/deduplicator.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 1dffdde..30c17ce 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -5,7 +5,6 @@ # See LICENSE.txt for complete terms import collections import cybox -import sets import copy from cybox.common.properties import BaseProperty From ececba669824351a75196cf8dd2a215a829347c0 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 12 Nov 2014 10:26:26 -0500 Subject: [PATCH 127/297] Updated custom_header in to_xml_file to encompass script_options --- maec/__init__.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index cb82d2e..7fc0505 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -38,7 +38,7 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" - def to_xml_file(self, filename, namespace_dict=None, custom_header=None, options_used=None): + def to_xml_file(self, filename, namespace_dict=None, custom_header=None): """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" # Update the namespace dictionary with namespaces found upon import if namespace_dict and hasattr(self, '__input_namespaces__'): @@ -46,19 +46,20 @@ def to_xml_file(self, filename, namespace_dict=None, custom_header=None, options elif not namespace_dict and hasattr(self, '__input_namespaces__'): namespace_dict = self.__input_namespaces__ out_file = open(filename, 'w') - if custom_header: + out_file.write("\n") + # Write out the custom header, if included + if isinstance(custom_header, list): for line in custom_header: out_file.write[line] - else: - out_file.write("\n") - - if options_used: + elif isinstance(custom_header, dict): out_file.write("", "\\-\\->") sanitized_value = str(value).replace("-->", "\\-\\->") out_file.write(sanitized_key + ": " + sanitized_value + "\n") out_file.write("-->\n") + elif isinstance(custom_header, basestring): + out_file.write(custom_header) self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() From 8e43f15c9a6d31b5fb5b4ac273043015693ca56c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 12 Nov 2014 12:35:05 -0500 Subject: [PATCH 128/297] Added get_action_context method to ObjectHistoryEntry --- maec/bundle/object_history.py | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/maec/bundle/object_history.py b/maec/bundle/object_history.py index 0b8f472..eb89faa 100644 --- a/maec/bundle/object_history.py +++ b/maec/bundle/object_history.py @@ -1,10 +1,10 @@ -#MAEC Object History Classes +# MAEC Object History Classes -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2014, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 08/25/2014 +# Compatible with MAEC v4.1 +# Last updated 11/12/2014 class ObjectHistory(object): @classmethod @@ -30,3 +30,22 @@ def __init__(self, object = None): def get_action_names(self): """Return a list of the Actions that operated on the Object, via their names""" return [x.name.value for x in self.actions if x.name] + + def get_action_context(self): + """Return a list of the Actions that operated on the Object, via their names, + along with the Association_Type used in the Action. + """ + context_list = [] + for action in self.actions: + if action.name: + action_name = action.name.value + else: + action_name = None + for associated_object in action.associated_objects: + if associated_object.association_type: + association_type = associated_object.association_type.value + else: + association_type = None + if associated_object.id_ == self.object.id_ or associated_object.idref == self.object.id_: + context_list.append((action_name, association_type)) + return context_list \ No newline at end of file From 18fe8c74e9fb890193d6785adb03f35abdd0238d Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 13 Nov 2014 13:42:42 -0600 Subject: [PATCH 129/297] Fix line endings --- maec/__init__.py | 260 +++++++++++++++++++++---------------------- maec/misc/options.py | 58 +++++----- 2 files changed, 159 insertions(+), 159 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 7fc0505..6be4eda 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,130 +1,130 @@ -__version__ = "4.1.0.8" - -import collections -import json -import inspect -import maec -from StringIO import StringIO -import bindings.maec_bundle as bundle_binding -import bindings.maec_package as package_binding -from cybox import Entity as cyboxEntity -from cybox import EntityList -from cybox import TypedField -from cybox.utils import Namespace, META -from maec.utils import maecMETA, EntityParser - -def get_xmlns_string(ns_set): - """Build a string with 'xmlns' definitions for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - xmlns_format = 'xmlns:{0.prefix}="{0.name}"' - return "\n\t".join([xmlns_format.format(x) for x in ns_set if x]) - - -def get_schemaloc_string(ns_set): - """Build a "schemaLocation" string for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - schemaloc_format = '{0.name} {0.schema_location}' - # Only include schemas that have a schema_location defined (for instance, - # 'xsi' does not. - return " ".join([schemaloc_format.format(x) for x in ns_set - if x and x.schema_location]) - -class Entity(cyboxEntity): - """Base class for all classes in the MAEC SimpleAPI.""" - - def to_xml_file(self, filename, namespace_dict=None, custom_header=None): - """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" - # Update the namespace dictionary with namespaces found upon import - if namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict.update(self.__input_namespaces__) - elif not namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict = self.__input_namespaces__ - out_file = open(filename, 'w') - out_file.write("\n") - # Write out the custom header, if included - if isinstance(custom_header, list): - for line in custom_header: - out_file.write[line] - elif isinstance(custom_header, dict): - out_file.write("", "\\-\\->") - sanitized_value = str(value).replace("-->", "\\-\\->") - out_file.write(sanitized_key + ": " + sanitized_value + "\n") - out_file.write("-->\n") - elif isinstance(custom_header, basestring): - out_file.write(custom_header) - - self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) - out_file.close() - - def _get_namespace_def(self, additional_ns_dict=None): - # copy necessary namespaces - - namespaces = self._get_namespaces() - - # if there are any other namepaces, include xsi for "schemaLocation" - # also, include the MAEC default vocabularies schema by default - if namespaces: - namespaces.update([maecMETA.lookup_prefix('xsi')]) - namespaces.update([maecMETA.lookup_prefix('maecVocabs')]) - - if namespaces and additional_ns_dict: - namespace_list = [x.name for x in namespaces if x] - for ns, prefix in additional_ns_dict.iteritems(): - if ns not in namespace_list: - namespaces.update([Namespace(ns, prefix)]) - - if not namespaces: - return "" - - namespaces = sorted(namespaces, key=str) - - return ('\n\t' + get_xmlns_string(namespaces) + - '\n\txsi:schemaLocation="' + get_schemaloc_string(namespaces) + - '"') - - def _get_namespaces(self, recurse=True): - nsset = set() - - # Get all _namespaces for parent classes - namespaces = [x._namespace for x in self.__class__.__mro__ - if hasattr(x, '_namespace')] - - nsset.update([maecMETA.lookup_namespace(ns) for ns in namespaces]) - - #In case of recursive relationships, don't process this item twice - self.touched = True - if recurse: - for x in self._get_children(): - if not hasattr(x, 'touched'): - nsset.update(x._get_namespaces()) - del self.touched - - # Add any additional namespaces that may be included in the entity - entity_dict = self.__dict__ - input_ns = entity_dict.get("__input_namespaces__", {}) - for namespace, alias in input_ns.items(): - maec_ns = maecMETA.lookup_namespace(namespace) - cybox_ns = META.lookup_namespace(namespace) - if not maec_ns and not cybox_ns: - nsset.add(Namespace(namespace, alias)) - - return nsset - -def parse_xml_instance(filename, check_version = True): - """Parse a MAEC instance and return the correct Binding and API objects - Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" - object_dictionary = {} - entity_parser = EntityParser() - - object_dictionary['binding'] = entity_parser.parse_xml_to_obj(filename, check_version) - object_dictionary['api'] = entity_parser.parse_xml(filename, check_version) - - return object_dictionary +__version__ = "4.1.0.8" + +import collections +import json +import inspect +import maec +from StringIO import StringIO +import bindings.maec_bundle as bundle_binding +import bindings.maec_package as package_binding +from cybox import Entity as cyboxEntity +from cybox import EntityList +from cybox import TypedField +from cybox.utils import Namespace, META +from maec.utils import maecMETA, EntityParser + +def get_xmlns_string(ns_set): + """Build a string with 'xmlns' definitions for every namespace in ns_set. + + Arguments: + - ns_set: a set (or other iterable) of Namespace objects + """ + xmlns_format = 'xmlns:{0.prefix}="{0.name}"' + return "\n\t".join([xmlns_format.format(x) for x in ns_set if x]) + + +def get_schemaloc_string(ns_set): + """Build a "schemaLocation" string for every namespace in ns_set. + + Arguments: + - ns_set: a set (or other iterable) of Namespace objects + """ + schemaloc_format = '{0.name} {0.schema_location}' + # Only include schemas that have a schema_location defined (for instance, + # 'xsi' does not. + return " ".join([schemaloc_format.format(x) for x in ns_set + if x and x.schema_location]) + +class Entity(cyboxEntity): + """Base class for all classes in the MAEC SimpleAPI.""" + + def to_xml_file(self, filename, namespace_dict=None, custom_header=None): + """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" + # Update the namespace dictionary with namespaces found upon import + if namespace_dict and hasattr(self, '__input_namespaces__'): + namespace_dict.update(self.__input_namespaces__) + elif not namespace_dict and hasattr(self, '__input_namespaces__'): + namespace_dict = self.__input_namespaces__ + out_file = open(filename, 'w') + out_file.write("\n") + # Write out the custom header, if included + if isinstance(custom_header, list): + for line in custom_header: + out_file.write[line] + elif isinstance(custom_header, dict): + out_file.write("", "\\-\\->") + sanitized_value = str(value).replace("-->", "\\-\\->") + out_file.write(sanitized_key + ": " + sanitized_value + "\n") + out_file.write("-->\n") + elif isinstance(custom_header, basestring): + out_file.write(custom_header) + + self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) + out_file.close() + + def _get_namespace_def(self, additional_ns_dict=None): + # copy necessary namespaces + + namespaces = self._get_namespaces() + + # if there are any other namepaces, include xsi for "schemaLocation" + # also, include the MAEC default vocabularies schema by default + if namespaces: + namespaces.update([maecMETA.lookup_prefix('xsi')]) + namespaces.update([maecMETA.lookup_prefix('maecVocabs')]) + + if namespaces and additional_ns_dict: + namespace_list = [x.name for x in namespaces if x] + for ns, prefix in additional_ns_dict.iteritems(): + if ns not in namespace_list: + namespaces.update([Namespace(ns, prefix)]) + + if not namespaces: + return "" + + namespaces = sorted(namespaces, key=str) + + return ('\n\t' + get_xmlns_string(namespaces) + + '\n\txsi:schemaLocation="' + get_schemaloc_string(namespaces) + + '"') + + def _get_namespaces(self, recurse=True): + nsset = set() + + # Get all _namespaces for parent classes + namespaces = [x._namespace for x in self.__class__.__mro__ + if hasattr(x, '_namespace')] + + nsset.update([maecMETA.lookup_namespace(ns) for ns in namespaces]) + + #In case of recursive relationships, don't process this item twice + self.touched = True + if recurse: + for x in self._get_children(): + if not hasattr(x, 'touched'): + nsset.update(x._get_namespaces()) + del self.touched + + # Add any additional namespaces that may be included in the entity + entity_dict = self.__dict__ + input_ns = entity_dict.get("__input_namespaces__", {}) + for namespace, alias in input_ns.items(): + maec_ns = maecMETA.lookup_namespace(namespace) + cybox_ns = META.lookup_namespace(namespace) + if not maec_ns and not cybox_ns: + nsset.add(Namespace(namespace, alias)) + + return nsset + +def parse_xml_instance(filename, check_version = True): + """Parse a MAEC instance and return the correct Binding and API objects + Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" + object_dictionary = {} + entity_parser = EntityParser() + + object_dictionary['binding'] = entity_parser.parse_xml_to_obj(filename, check_version) + object_dictionary['api'] = entity_parser.parse_xml(filename, check_version) + + return object_dictionary diff --git a/maec/misc/options.py b/maec/misc/options.py index 2535916..62f5bb1 100644 --- a/maec/misc/options.py +++ b/maec/misc/options.py @@ -1,29 +1,29 @@ -class ScriptOptions(object): - """Defines configurable options for MAEC scripts and utilities. - - Attributes: - deduplicate_bundles: If ``True``, the script will deduplicate all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - dereference_bundles: If ``True``, the script will deference all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - normalize_bundles: If ``True``, the script will normalize all - Objects in all Bundles (either as standalone entities or embedded - in Malware Subjects) before returning or writing out the MAEC document. - Default value is ``False``. - - """ - def __init__(self): - self.deduplicate_bundles = False - self.dereference_bundles = False - self.normalize_bundles = False - - def to_dict(self): - return { - "deduplicate_bundles": self.deduplicate_bundles, - "dereference_bundles": self.dereference_bundles, - "normalize_bundles": self.normalize_bundles - } \ No newline at end of file +class ScriptOptions(object): + """Defines configurable options for MAEC scripts and utilities. + + Attributes: + deduplicate_bundles: If ``True``, the script will deduplicate all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + dereference_bundles: If ``True``, the script will deference all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + normalize_bundles: If ``True``, the script will normalize all + Objects in all Bundles (either as standalone entities or embedded + in Malware Subjects) before returning or writing out the MAEC document. + Default value is ``False``. + + """ + def __init__(self): + self.deduplicate_bundles = False + self.dereference_bundles = False + self.normalize_bundles = False + + def to_dict(self): + return { + "deduplicate_bundles": self.deduplicate_bundles, + "dereference_bundles": self.dereference_bundles, + "normalize_bundles": self.normalize_bundles + } From db28b153529297b8f083495303beacb99c0ab36a Mon Sep 17 00:00:00 2001 From: apsillers Date: Tue, 18 Nov 2014 13:43:02 -0500 Subject: [PATCH 130/297] Add tool exception classes --- maec/misc/exceptions.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 maec/misc/exceptions.py diff --git a/maec/misc/exceptions.py b/maec/misc/exceptions.py new file mode 100644 index 0000000..400c3fe --- /dev/null +++ b/maec/misc/exceptions.py @@ -0,0 +1,14 @@ +"""Common exception classes used by MAEC conversion tools.""" + +"""Indicates a failure caused by a rejected API key.""" +class APIKeyException(Exception): + pass + +"""Indicates a failure caused by a rejected API key.""" +class NetworkFailureException(Exception): + pass + +"""Indicates a failure caused by a request for a resource unknown to some service. +(e.g., asking for a report from ThreatExpert by MD5, but the MD5 is unknown to ThreatExpert)""" +class LookupNotFoundException(Exception): + pass From 8a2b1706dca8e94746e5e4b2f1a8c2936d3a5fb4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 19 Nov 2014 14:58:26 -0500 Subject: [PATCH 131/297] Added ability to provide custom namespace in merge_packages --- maec/utils/merge.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 8b21e04..3c7caf8 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -55,11 +55,14 @@ def merge_documents(input_list, output_file): # Write the merged package to the output file merged_package.to_xml_file(output_file, {"https://github.com/MAECProject/python-maec":"merged"}) -def merge_packages(package_list): +def merge_packages(package_list, namespace = None): '''Merge a list of input MAEC Packages and return a merged Package instance.''' malware_subjects = [] # Instantiate the ID generator class (for automatic ID generation) - NS = Namespace("https://github.com/MAECProject/python-maec", "merged") + if not namespace: + NS = Namespace("https://github.com/MAECProject/python-maec", "merged") + else: + NS = namespace maec.utils.set_id_namespace(NS) # Build the list of Malware Subjects for package in package_list: From 358754bb986524f90b6c5851554b4ab759d95878 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Mon, 24 Nov 2014 13:43:48 -0500 Subject: [PATCH 132/297] Fixed issue where namespaces were not being discovered during to_obj() invocation. --- maec/bundle/av_classification.py | 5 +++-- maec/bundle/bundle.py | 24 ++++++++++++++++-------- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index 056fbae..236224c 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -21,12 +21,13 @@ def __init__(self, classification = None, tool_name = None, tool_vendor = None): self.definition_version = None self.classification_name = classification - def to_obj(self, return_obj = None, ns_info = None): + def to_obj(self, return_obj=None, ns_info=None): if not return_obj: return_obj = self._binding_class() super(AVClassification, self).to_obj(return_obj=return_obj, ns_info=ns_info) - if self.engine_version is not None : + + if self.engine_version is not None : return_obj.Engine_Version = self.engine_version if self.definition_version is not None : return_obj.Definition_Version = self.definition_version diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 00786c9..ac9e4f2 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -147,11 +147,13 @@ class BehaviorCollectionList(maec.EntityList): def __init__(self): super(BehaviorCollectionList, self).__init__() - def to_obj(self, return_obj = None, ns_info = None): + def to_obj(self, return_obj=None, ns_info=None): + self._collect_ns_info(ns_info) + behavior_collection_list_obj = bundle_binding.BehaviorCollectionListType() for behavior_collection in self: if len(behavior_collection.behavior_list) > 0: - behavior_collection_list_obj.add_Behavior_Collection(behavior_collection.to_obj()) + behavior_collection_list_obj.add_Behavior_Collection(behavior_collection.to_obj(ns_info=ns_info)) if behavior_collection_list_obj.hasContent_(): return behavior_collection_list_obj @@ -178,11 +180,13 @@ class ActionCollectionList(maec.EntityList): def __init__(self): super(ActionCollectionList, self).__init__() - def to_obj(self, return_obj = None, ns_info = None): + def to_obj(self, return_obj=None, ns_info=None): + self._collect_ns_info(ns_info) + action_collection_list_obj = bundle_binding.ActionCollectionListType() for action_collection in self: if len(action_collection.action_list) > 0: - action_collection_list_obj.add_Action_Collection(action_collection.to_obj()) + action_collection_list_obj.add_Action_Collection(action_collection.to_obj(ns_info=ns_info)) if action_collection_list_obj.hasContent_(): return action_collection_list_obj @@ -209,11 +213,13 @@ class ObjectCollectionList(maec.EntityList): def __init__(self): super(ObjectCollectionList, self).__init__() - def to_obj(self, return_obj = None, ns_info = None): + def to_obj(self, return_obj=None, ns_info=None): + self._collect_ns_info(ns_info) + object_collection_list_obj = bundle_binding.ObjectCollectionListType() for object_collection in self: if len(object_collection.object_list) > 0: - object_collection_list_obj.add_Object_Collection(object_collection.to_obj()) + object_collection_list_obj.add_Object_Collection(object_collection.to_obj(ns_info=ns_info)) if object_collection_list_obj.hasContent_(): return object_collection_list_obj @@ -240,11 +246,13 @@ class CandidateIndicatorCollectionList(maec.EntityList): def __init__(self): super(CandidateIndicatorCollectionList, self).__init__() - def to_obj(self, return_obj = None, ns_info = None): + def to_obj(self, return_obj=None, ns_info=None): + self._collect_ns_info(ns_info) + candidate_indicator_collection_list_obj = bundle_binding.CandidateIndicatorCollectionListType() for candidate_indicator_collection in self: if len(candidate_indicator_collection.candidate_indicator_list) > 0: - candidate_indicator_collection_list_obj.add_Candidate_Indicator_Collection(candidate_indicator_collection.to_obj()) + candidate_indicator_collection_list_obj.add_Candidate_Indicator_Collection(candidate_indicator_collection.to_obj(ns_info=ns_info)) if candidate_indicator_collection_list_obj.hasContent_(): return candidate_indicator_collection_list_obj From 167eede2acb74fde773ebfe65c7de450118e97b8 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 26 Nov 2014 09:50:50 -0500 Subject: [PATCH 133/297] Updated to v4.1.0.9 --- CHANGES.txt | 7 +++++++ maec/__init__.py | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGES.txt b/CHANGES.txt index a38431a..3d7b98e 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,10 @@ +Version 4.1.0.9 +2014-11-26 +- Added __input_namespaces and __input_schemalocations to Package and Bundle +- [#58] Added tool exception classes +- [#57] Expanded custom_header support in to_xml_file() +- Various bug fixes + Version 4.1.0.8 2014-10-15 - Performance enhancements in to_xml() serialization (ref: python-stix #163) diff --git a/maec/__init__.py b/maec/__init__.py index 6be4eda..b7f207b 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.8" +__version__ = "4.1.0.9" import collections import json From afe36116591ea87c9e99175747904b2e2cf54470 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 26 Nov 2014 10:01:25 -0500 Subject: [PATCH 134/297] Updated versions for v4.1.0.9 --- docs/index.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/index.rst b/docs/index.rst index d595190..8d410ef 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -20,13 +20,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.8 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.9 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.8 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.8 +__ https://pypi.python.org/pypi/maec/4.1.0.9 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.9 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 From 89738b6cab0fe72ded73062f67da8bec4046e461 Mon Sep 17 00:00:00 2001 From: apsillers Date: Thu, 4 Dec 2014 11:35:02 -0500 Subject: [PATCH 135/297] Support lists and strings as custom_header contents --- maec/__init__.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index b7f207b..be09bf0 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -49,8 +49,10 @@ def to_xml_file(self, filename, namespace_dict=None, custom_header=None): out_file.write("\n") # Write out the custom header, if included if isinstance(custom_header, list): + out_file.write("", "\\-\\->") + "\n") + out_file.write("-->\n") elif isinstance(custom_header, dict): out_file.write("\n") elif isinstance(custom_header, basestring): - out_file.write(custom_header) + out_file.write("", "\\-\\->") + "\n") + out_file.write("-->\n") self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) out_file.close() From 8c0b3c4e03707d735aa2f0ddb265c3cda5902665 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 5 Dec 2014 09:01:44 -0600 Subject: [PATCH 136/297] Add __init__.py files so tests get discovered automatically --- maec/test/bundle/__init__.py | 0 maec/test/package/__init__.py | 0 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 maec/test/bundle/__init__.py create mode 100644 maec/test/package/__init__.py diff --git a/maec/test/bundle/__init__.py b/maec/test/bundle/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/maec/test/package/__init__.py b/maec/test/package/__init__.py new file mode 100644 index 0000000..e69de29 From 0b4966dac2931a4d1998fbcf3e0e8ce30c7ef741 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 5 Dec 2014 11:01:38 -0600 Subject: [PATCH 137/297] Enable Travis and Tox testing --- .gitignore | 1 + .travis.yml | 18 ++++++++++++++++++ requirements.txt | 2 +- setup.py | 4 ++++ tox.ini | 12 ++++++++++++ 5 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 .travis.yml create mode 100644 tox.ini diff --git a/.gitignore b/.gitignore index 8fcbf60..6061b3c 100644 --- a/.gitignore +++ b/.gitignore @@ -6,5 +6,6 @@ dist/ .settings/ .project .pydevproject +.tox docs/_build diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..eb95e8a --- /dev/null +++ b/.travis.yml @@ -0,0 +1,18 @@ +language: python +python: + - "2.6" + - "2.7" + +install: + - pip install -r requirements.txt + +script: + - nosetests + +branches: + only: + - master + +notifications: + email: + - maec-commits-list@lists.mitre.org diff --git a/requirements.txt b/requirements.txt index 142b6ca..54d4638 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ --e .[docs] +-e .[docs,test] diff --git a/setup.py b/setup.py index 67173e2..e716d7d 100644 --- a/setup.py +++ b/setup.py @@ -24,6 +24,10 @@ def get_version(): # included as sphinx.ext.napoleon 'sphinxcontrib-napoleon==0.2.4', ], + 'test': [ + "nose==1.3.0", + "tox==1.6.1" + ], } setup( diff --git a/tox.ini b/tox.ini new file mode 100644 index 0000000..f671bba --- /dev/null +++ b/tox.ini @@ -0,0 +1,12 @@ +# Tox (http://tox.testrun.org/) is a tool for running tests +# in multiple virtualenvs. This configuration file will run the +# test suite on all supported python versions. To use it, "pip install tox" +# and then run "tox" from this directory. + +[tox] +envlist = py26, py27 + +[testenv] +commands = + nosetests maec +deps = -rrequirements.txt From e75b03654df7e403185290474aa5b7972ba12023 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 5 Dec 2014 11:07:02 -0600 Subject: [PATCH 138/297] Include Travis Badge in README. --- README.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.rst b/README.rst index 568eceb..bcb7d82 100644 --- a/README.rst +++ b/README.rst @@ -8,10 +8,11 @@ A Python library for parsing, manipulating, and generating MAEC content. :Information: http://maec.mitre.org :Download: https://pypi.python.org/pypi/maec/ -|landscape.io badge| |version badge| |downloads badge| - -.. TODO: add Travis Badge +|travis badge| |landscape.io badge| |version badge| |downloads badge| +.. |travis badge| image:: https://api.travis-ci.org/MAECProject/python-maec.png?branch=master + :target: https://travis-ci.org/MAECProject/python-maec + :alt: Build Status .. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.png :target: https://landscape.io/github/MAECProject/python-maec/master :alt: Code Health From 9d6313c5b3c7d75afd96c2587a2741f3725600f7 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 8 Dec 2014 14:42:50 -0600 Subject: [PATCH 139/297] Lower dependency versions. Test RHEL configuration. Fix #39 --- .travis.yml | 11 ++++++----- README.rst | 20 ++++++++++++++------ setup.py | 2 +- tox.ini | 18 ++++++++++++------ 4 files changed, 33 insertions(+), 18 deletions(-) diff --git a/.travis.yml b/.travis.yml index eb95e8a..ea5285c 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,13 +1,14 @@ language: python -python: - - "2.6" - - "2.7" +env: + - TOXENV=py26 + - TOXENV=py27 + - TOXENV=rhel6 install: - - pip install -r requirements.txt + - pip install tox script: - - nosetests + - tox branches: only: diff --git a/README.rst b/README.rst index bcb7d82..3edbd10 100644 --- a/README.rst +++ b/README.rst @@ -62,9 +62,13 @@ to indicate new versions of the python-maec library itself. Installation ------------ -The ``maec`` package depends on the following Python libraries: \* ``lxml`` >= -3.1.x \* ``python-cybox`` >= 2.1.x.x \* ``setuptools`` (only if installing -using setup.py) +The ``maec`` package depends on the following Python libraries: + +* ``lxml`` + +* ``python-cybox`` + +* ``setuptools`` (only if installing using setup.py) For Windows installers of the above libraries, we recommend looking here: http://www.lfd.uci.edu/~gohlke/pythonlibs. python-cybox can be found at @@ -73,9 +77,13 @@ https://github.com/CybOXProject/python-cybox/releases. To build ``lxml`` on Ubuntu, you will need the following packages from the Ubuntu package repository: -- python-dev -- libxml2-dev -- libxslt1-dev +* python-dev + +* libxml2-dev + +* libxslt1-dev + +* zlib1g-dev For more information about installing lxml, see http://lxml.de/installation.html diff --git a/setup.py b/setup.py index e716d7d..1bbe0a3 100644 --- a/setup.py +++ b/setup.py @@ -39,7 +39,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.3', 'cybox>=2.1.0.8,<2.1.1.0'], + install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.8,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", diff --git a/tox.ini b/tox.ini index f671bba..bf03ece 100644 --- a/tox.ini +++ b/tox.ini @@ -1,12 +1,18 @@ -# Tox (http://tox.testrun.org/) is a tool for running tests -# in multiple virtualenvs. This configuration file will run the -# test suite on all supported python versions. To use it, "pip install tox" -# and then run "tox" from this directory. - [tox] -envlist = py26, py27 +envlist = py26, py27, rhel6 [testenv] commands = nosetests maec + sphinx-build -b doctest docs docs/_build/doctest + sphinx-build -b html docs docs/_build/html deps = -rrequirements.txt + +[testenv:rhel6] +basepython=python2.6 +commands = + nosetests maec +deps = + lxml==2.2.3 + python-dateutil==1.4.1 + nose From 3346f0632dbde32749b798ccd8c45f7273d4771c Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 8 Dec 2014 14:55:16 -0600 Subject: [PATCH 140/297] Clean up doc formatting --- docs/_includes/wip_prolog.rst | 8 --- docs/api/analytics/distance.rst | 2 +- docs/api/bundle/action_reference_list.rst | 2 +- docs/api/bundle/av_classification.rst | 2 +- docs/api/bundle/behavior.rst | 2 +- docs/api/bundle/behavior_reference.rst | 2 +- docs/api/bundle/bundle.rst | 4 +- docs/api/bundle/bundle_reference.rst | 2 +- docs/api/bundle/candidate_indicator.rst | 2 +- docs/api/bundle/malware_action.rst | 2 +- docs/api/bundle/object_history.rst | 2 +- docs/api/bundle/object_reference.rst | 2 +- docs/api/bundle/process_tree.rst | 2 +- docs/api/package/action_equivalence.rst | 6 +-- docs/api/package/analysis.rst | 6 +-- docs/api/package/grouping_relationship.rst | 6 +-- docs/api/package/malware_subject.rst | 6 +-- .../api/package/malware_subject_reference.rst | 6 +-- docs/api/package/object_equivalence.rst | 6 +-- docs/api/package/package.rst | 6 +-- docs/api/utils/comparator.rst | 4 +- docs/api/utils/deduplicator.rst | 2 +- docs/api/utils/idgen.rst | 2 +- docs/api/utils/merge.rst | 2 +- docs/api/utils/nsparser.rst | 2 +- docs/api/utils/parser.rst | 2 +- docs/examples.rst | 51 ++++++++++--------- 27 files changed, 68 insertions(+), 73 deletions(-) delete mode 100644 docs/_includes/wip_prolog.rst diff --git a/docs/_includes/wip_prolog.rst b/docs/_includes/wip_prolog.rst deleted file mode 100644 index 861794d..0000000 --- a/docs/_includes/wip_prolog.rst +++ /dev/null @@ -1,8 +0,0 @@ -.. warning:: - - This documentation is still a work in progress. If you have any issues or - questions, please ask on the maec-discussion mailing list or file a bug - in our `issue tracker`_. - -.. _issue tracker: https://github.com/MAECProject/python-maec/issue - diff --git a/docs/api/analytics/distance.rst b/docs/api/analytics/distance.rst index 0c06394..c638a84 100644 --- a/docs/api/analytics/distance.rst +++ b/docs/api/analytics/distance.rst @@ -1,5 +1,5 @@ :mod:`maec.analytics.distance` Module -==================================== +===================================== .. module:: maec.analytics.distance diff --git a/docs/api/bundle/action_reference_list.rst b/docs/api/bundle/action_reference_list.rst index 772dde2..d708379 100644 --- a/docs/api/bundle/action_reference_list.rst +++ b/docs/api/bundle/action_reference_list.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.action_reference_list` Module -==================================== +=============================================== .. module:: maec.bundle.action_reference_list diff --git a/docs/api/bundle/av_classification.rst b/docs/api/bundle/av_classification.rst index 0bfac97..e226449 100644 --- a/docs/api/bundle/av_classification.rst +++ b/docs/api/bundle/av_classification.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.av_classification` Module -==================================== +=========================================== .. module:: maec.bundle.av_classification diff --git a/docs/api/bundle/behavior.rst b/docs/api/bundle/behavior.rst index cbd88f7..e2b8494 100644 --- a/docs/api/bundle/behavior.rst +++ b/docs/api/bundle/behavior.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.behavior` Module -==================================== +================================== .. module:: maec.bundle.behavior diff --git a/docs/api/bundle/behavior_reference.rst b/docs/api/bundle/behavior_reference.rst index 276f349..42e1622 100644 --- a/docs/api/bundle/behavior_reference.rst +++ b/docs/api/bundle/behavior_reference.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.behavior_reference` Module -==================================== +============================================ .. module:: maec.bundle.behavior_reference diff --git a/docs/api/bundle/bundle.rst b/docs/api/bundle/bundle.rst index c0b9eb2..2355ba0 100644 --- a/docs/api/bundle/bundle.rst +++ b/docs/api/bundle/bundle.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.bundle` Module -==================================== +================================ .. module:: maec.bundle.bundle @@ -64,4 +64,4 @@ Classes .. autoclass:: BehaviorReference :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/bundle/bundle_reference.rst b/docs/api/bundle/bundle_reference.rst index ce637a5..ccae7c5 100644 --- a/docs/api/bundle/bundle_reference.rst +++ b/docs/api/bundle/bundle_reference.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.bundle_reference` Module -==================================== +========================================== .. module:: maec.bundle.bundle_reference diff --git a/docs/api/bundle/candidate_indicator.rst b/docs/api/bundle/candidate_indicator.rst index 9ce2ba8..1b9ea2d 100644 --- a/docs/api/bundle/candidate_indicator.rst +++ b/docs/api/bundle/candidate_indicator.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.candidate_indicator` Module -==================================== +============================================= .. module:: maec.bundle.candidate_indicator diff --git a/docs/api/bundle/malware_action.rst b/docs/api/bundle/malware_action.rst index e064516..8110809 100644 --- a/docs/api/bundle/malware_action.rst +++ b/docs/api/bundle/malware_action.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.malware_action` Module -==================================== +======================================== .. module:: maec.bundle.malware_action diff --git a/docs/api/bundle/object_history.rst b/docs/api/bundle/object_history.rst index 746eb56..d03eb5d 100644 --- a/docs/api/bundle/object_history.rst +++ b/docs/api/bundle/object_history.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.object_history` Module -==================================== +======================================== .. module:: maec.bundle.object_history diff --git a/docs/api/bundle/object_reference.rst b/docs/api/bundle/object_reference.rst index 2e4cf80..815f465 100644 --- a/docs/api/bundle/object_reference.rst +++ b/docs/api/bundle/object_reference.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.object_reference` Module -==================================== +========================================== .. module:: maec.bundle.object_reference diff --git a/docs/api/bundle/process_tree.rst b/docs/api/bundle/process_tree.rst index a67b78a..5e8006f 100644 --- a/docs/api/bundle/process_tree.rst +++ b/docs/api/bundle/process_tree.rst @@ -1,5 +1,5 @@ :mod:`maec.bundle.process_tree` Module -==================================== +====================================== .. module:: maec.bundle.process_tree diff --git a/docs/api/package/action_equivalence.rst b/docs/api/package/action_equivalence.rst index 987e7dd..2371fd9 100644 --- a/docs/api/package/action_equivalence.rst +++ b/docs/api/package/action_equivalence.rst @@ -1,6 +1,6 @@ :mod:`maec.package.action_equivalence` Module -==================================== - +============================================= + .. module:: maec.package.action_equivalence Classes @@ -12,4 +12,4 @@ Classes .. autoclass:: ActionEquivalenceList :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/analysis.rst b/docs/api/package/analysis.rst index d1fdd0d..8c94c61 100644 --- a/docs/api/package/analysis.rst +++ b/docs/api/package/analysis.rst @@ -1,6 +1,6 @@ :mod:`maec.package.analysis` Module -==================================== - +=================================== + .. module:: maec.package.analysis Classes @@ -60,4 +60,4 @@ Classes .. autoclass:: Source :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/grouping_relationship.rst b/docs/api/package/grouping_relationship.rst index bedfb19..a51b1cf 100644 --- a/docs/api/package/grouping_relationship.rst +++ b/docs/api/package/grouping_relationship.rst @@ -1,6 +1,6 @@ :mod:`maec.package.grouping_relationship` Module -==================================== - +================================================ + .. module:: maec.package.grouping_relationship Classes @@ -28,4 +28,4 @@ Classes .. autoclass:: ClusterEdgeNodePair :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/malware_subject.rst b/docs/api/package/malware_subject.rst index 1f15ebf..03497a6 100644 --- a/docs/api/package/malware_subject.rst +++ b/docs/api/package/malware_subject.rst @@ -1,6 +1,6 @@ :mod:`maec.package.malware_subject` Module -==================================== - +========================================== + .. module:: maec.package.malware_subject Classes @@ -64,4 +64,4 @@ Classes .. autoclass:: MinorVariants :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/malware_subject_reference.rst b/docs/api/package/malware_subject_reference.rst index a2d3693..760da5b 100644 --- a/docs/api/package/malware_subject_reference.rst +++ b/docs/api/package/malware_subject_reference.rst @@ -1,6 +1,6 @@ :mod:`maec.package.malware_subject_reference` Module -==================================== - +==================================================== + .. module:: maec.package.malware_subject_reference Classes @@ -8,4 +8,4 @@ Classes .. autoclass:: MalwareSubjectReference :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/object_equivalence.rst b/docs/api/package/object_equivalence.rst index 91c776d..a134a50 100644 --- a/docs/api/package/object_equivalence.rst +++ b/docs/api/package/object_equivalence.rst @@ -1,6 +1,6 @@ :mod:`maec.package.object_equivalence` Module -==================================== - +============================================= + .. module:: maec.package.object_equivalence Classes @@ -12,4 +12,4 @@ Classes .. autoclass:: ObjectEquivalenceList :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/package/package.rst b/docs/api/package/package.rst index 0938196..937f82f 100644 --- a/docs/api/package/package.rst +++ b/docs/api/package/package.rst @@ -1,6 +1,6 @@ :mod:`maec.package.package` Module -==================================== - +================================== + .. module:: maec.package.package Classes @@ -8,4 +8,4 @@ Classes .. autoclass:: Package :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/utils/comparator.rst b/docs/api/utils/comparator.rst index 82279aa..efdef77 100644 --- a/docs/api/utils/comparator.rst +++ b/docs/api/utils/comparator.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.comparator` Module -==================================== +=================================== .. module:: maec.utils.comparator @@ -20,4 +20,4 @@ Classes .. autoclass:: ComparisonResult :show-inheritance: - :members: \ No newline at end of file + :members: diff --git a/docs/api/utils/deduplicator.rst b/docs/api/utils/deduplicator.rst index 5aa657c..6dfbfcb 100644 --- a/docs/api/utils/deduplicator.rst +++ b/docs/api/utils/deduplicator.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.deduplicator` Module -==================================== +===================================== .. module:: maec.utils.deduplicator diff --git a/docs/api/utils/idgen.rst b/docs/api/utils/idgen.rst index 7aa07b0..0e10a60 100644 --- a/docs/api/utils/idgen.rst +++ b/docs/api/utils/idgen.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.idgen` Module -==================================== +============================== .. module:: maec.utils.idgen diff --git a/docs/api/utils/merge.rst b/docs/api/utils/merge.rst index 4de3e35..b4aa256 100644 --- a/docs/api/utils/merge.rst +++ b/docs/api/utils/merge.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.merge` Module -==================================== +============================== .. module:: maec.utils.merge diff --git a/docs/api/utils/nsparser.rst b/docs/api/utils/nsparser.rst index e51e265..3daef3b 100644 --- a/docs/api/utils/nsparser.rst +++ b/docs/api/utils/nsparser.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.nsparser` Module -==================================== +================================= .. module:: maec.utils.nsparser diff --git a/docs/api/utils/parser.rst b/docs/api/utils/parser.rst index dc750da..7ac1be9 100644 --- a/docs/api/utils/parser.rst +++ b/docs/api/utils/parser.rst @@ -1,5 +1,5 @@ :mod:`maec.utils.parser` Module -==================================== +=============================== .. module:: maec.utils.parser diff --git a/docs/examples.rst b/docs/examples.rst index 6248114..db9c179 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -1,7 +1,7 @@ .. _examples: Examples -======================== +======== This page includes some basic examples of creating and parsing MAEC content. @@ -20,9 +20,9 @@ that shouldn't be done in production code: document. In production code, you should omit this statement, which causes random UUIDs to be created instead, or create explicit IDs yourself for Malware Subjects and Actions. - + Creating Packages -------------------- +----------------- The most commonly used MAEC output format is the MAEC Package, which can contain one or more Malware Subjects. Malware Subjects (discussed in more detail below) @@ -35,12 +35,12 @@ different types of analysis. from maec.package.package import Package from maec.package.malware_subject import MalwareSubject from maec.utils import IDGenerator, set_id_method - + set_id_method(IDGenerator.METHOD_INT) p = Package() ms = MalwareSubject() p.add_malware_subject(ms) - + print p.to_xml(include_namespaces=False) Which outputs: @@ -55,7 +55,7 @@ Which outputs: Creating Malware Subjects -------------------- +------------------------- The easiest way to create a Malware Subject is to construct one and then set various properties on it. The Malware_Instance_Object_Attributes field on a @@ -69,7 +69,7 @@ that it is characterizing. from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File - + set_id_method(IDGenerator.METHOD_INT) ms = MalwareSubject() ms.malware_instance_object_attributes = Object() @@ -90,9 +90,10 @@ Which outputs: - + Creating Bundles --------------------- +---------------- + In MAEC, the ``Bundle`` represents a container for capturing the results from a particular malware analysis that was performed on a malware instance. While a ``Bundle`` is most commonly included as part of a Malware Subject, it can also @@ -100,7 +101,8 @@ be used a standalone output format when only malware analysis results for a malware instance wish to be shared. We'll cover both cases here. Creating Standalone Bundles --------------------- +--------------------------- + Standalone Bundles function very similarly to Malware Subjects. Therefore, the easiest way to create a standalone Bundle is to construct one and then set various properties on it. The Malware_Instance_Object_Attributes field on a @@ -113,14 +115,14 @@ instance that it is characterizing. from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File - - set_id_method(IDGenerator.METHOD_INT) + + set_id_method(IDGenerator.METHOD_INT) b = Bundle() b.malware_instance_object_attributes = Object() b.malware_instance_object_attributes.properties = File() b.malware_instance_object_attributes.properties.file_name = "malware.exe" b.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" - + print b.to_xml(include_namespaces=False) Which outputs: @@ -137,7 +139,8 @@ Which outputs: Creating and adding Bundles to a Malware Subject --------------------- +------------------------------------------------ + Bundles in a Malware Subject are defined nearly identically to those of the standalone variety, with the sole exception that they do not require their Malware_Instance_Object_Attributes field to be set, since this would already @@ -149,17 +152,17 @@ be defined in their parent Malware Subject. from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File - - set_id_method(IDGenerator.METHOD_INT) + + set_id_method(IDGenerator.METHOD_INT) ms = MalwareSubject() ms.malware_instance_object_attributes = Object() ms.malware_instance_object_attributes.properties = File() ms.malware_instance_object_attributes.properties.file_name = "malware.exe" ms.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" - + b = Bundle() ms.add_findings_bundle(b) - + print ms.to_xml(include_namespaces=False) Which outputs: @@ -177,7 +180,7 @@ Which outputs: Creating and adding Actions to a Bundle --------------------- +--------------------------------------- MAEC uses its ``MalwareAction`` to capture the low-level dynamic entities, such as API calls or their abstractions, performed by malware. A ``MalwareAction`` is @@ -192,26 +195,26 @@ needed. from maec.utils import IDGenerator, set_id_method from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType from cybox.objects.file_object import File - + set_id_method(IDGenerator.METHOD_INT) b = Bundle() a = MalwareAction() ao = AssociatedObject() - + ao.properties = File() ao.properties.file_name = "badware.exe" ao.properties.size_in_bytes = "123456" ao.association_type = AssociationType() ao.association_type.value = 'output' ao.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' - + a.name = 'create file' a.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' a.associated_objects = AssociatedObjects() a.associated_objects.append(ao) - + b.add_action(a) - + print b.to_xml(include_namespaces = False) .. testoutput:: From 4676c00d6f6538abf4b015ead2596910be30901f Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 8 Dec 2014 15:13:01 -0600 Subject: [PATCH 141/297] Fix bugs in doctests --- docs/examples.rst | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/examples.rst b/docs/examples.rst index db9c179..0b9e692 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -147,6 +147,7 @@ Malware_Instance_Object_Attributes field to be set, since this would already be defined in their parent Malware Subject. .. testcode:: + from maec.package.malware_subject import MalwareSubject from maec.bundle.bundle import Bundle from maec.utils import IDGenerator, set_id_method @@ -176,6 +177,9 @@ Which outputs: C:\Windows\Temp\malware.exe + + + @@ -190,6 +194,7 @@ discussed above). As with the other MAEC entities, the easiest way to use the needed. .. testcode:: + from maec.bundle.bundle import Bundle from maec.bundle.malware_action import MalwareAction from maec.utils import IDGenerator, set_id_method @@ -235,4 +240,3 @@ needed. - From 4545ca4b28c9b660f52d83312643c19aaff32e55 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 11 Dec 2014 10:38:03 -0500 Subject: [PATCH 142/297] A few minor updates for performance --- maec/utils/deduplicator.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 30c17ce..39faedc 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -67,7 +67,7 @@ def cleanup(cls, bundle): @classmethod def handle_duplicate_objects(cls, bundle, all_objects): """Replace all of the duplicate Objects with references to the unique object placed in the "Re-used Objects" Collection.""" - for duplicate_object_id, unique_object_id in cls.object_ids_mapping.items(): + for duplicate_object_id, unique_object_id in cls.object_ids_mapping.iteritems(): # Modify the existing Object to serve as a reference to # the unique Object in the collection if duplicate_object_id and duplicate_object_id in cls.id_objects: @@ -147,18 +147,18 @@ def get_typedfield_values(cls, val, name, values, ignoreCase = False): # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): if ignoreCase: - values.add(name + ":" + str(val)) + values.add(":".join([name,str(val)])) else: - values.add(name + ":" + str(val).lower()) + values.add(":".join([name,str(val).lower()])) # If it's a list, then we need to iterate through each of its members elif isinstance(val, collections.MutableSequence): for list_item in val: for list_item_property in list_item._get_vars(): - cls.get_typedfield_values(getattr(list_item, str(list_item_property)), name + "/" + str(list_item_property), values, ignoreCase) + cls.get_typedfield_values(getattr(list_item, str(list_item_property)), "/".join([name,str(list_item_property)]), values, ignoreCase) # If it's a cybox.Entity, then we need to iterate through its properties elif isinstance(val, cybox.Entity): for item_property in val._get_vars(): - cls.get_typedfield_values(getattr(val, str(item_property)), name + "/" + str(item_property), values, ignoreCase) + cls.get_typedfield_values(getattr(val, str(item_property)), "/".join([name,str(item_property)]), values, ignoreCase) @classmethod def get_object_values(cls, obj, ignoreCase = False): @@ -172,7 +172,6 @@ def get_object_values(cls, obj, ignoreCase = False): cls.get_typedfield_values(val, str(typed_field), values, ignoreCase) return values - @classmethod def find_matching_object(cls, obj): """Find a matching object, if it exists.""" @@ -182,7 +181,7 @@ def find_matching_object(cls, obj): if xsi_type and xsi_type in cls.objects_dict: types_dict = cls.objects_dict[xsi_type] # See if we already have an identical object in the dictionary - for obj_id, obj_values in types_dict.items(): + for obj_id, obj_values in types_dict.iteritems(): if obj_values == object_values: # If so, return its ID for use in the IDREF return obj_id From bce0443b02bff31046e4168c45cc3550f22c5485 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 15 Dec 2014 15:12:07 -0500 Subject: [PATCH 143/297] Removed common code and extraneous imports --- maec/bindings/maec_bundle.py | 513 +------------------------------- maec/bindings/maec_container.py | 513 +------------------------------- maec/bindings/maec_package.py | 513 +------------------------------- maec/bindings/mmdef_1_2.py | 339 +-------------------- 4 files changed, 12 insertions(+), 1866 deletions(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 10f6590..e082ee2 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -1,520 +1,13 @@ -#!/usr/bin/env python -# -*- coding: utf-8 -*- - -# -# Generated Mon Apr 29 08:31:10 2013 by generateDS.py version 2.9a. -# +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. import sys -import getopt -import re as re_ +from maec.bindings import * from cybox.bindings import cybox_core from cybox.bindings import cybox_common from cybox.bindings import code_object from cybox.bindings import process_object -import base64 -from datetime import datetime, tzinfo, timedelta - -etree_ = None -Verbose_import_ = False -( XMLParser_import_none, XMLParser_import_lxml, - XMLParser_import_elementtree - ) = range(3) -XMLParser_import_library = None -try: - # lxml - from lxml import etree as etree_ - XMLParser_import_library = XMLParser_import_lxml - if Verbose_import_: - print("running with lxml.etree") -except ImportError: - try: - # cElementTree from Python 2.5+ - import xml.etree.cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree on Python 2.5+") - except ImportError: - try: - # ElementTree from Python 2.5+ - import xml.etree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree on Python 2.5+") - except ImportError: - try: - # normal cElementTree install - import cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree") - except ImportError: - try: - # normal ElementTree install - import elementtree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree") - except ImportError: - raise ImportError( - "Failed to import ElementTree from any known place") - -def parsexml_(*args, **kwargs): - if (XMLParser_import_library == XMLParser_import_lxml and - 'parser' not in kwargs): - # Use the lxml ElementTree compatible parser so that, e.g., - # we ignore comments. - kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) - doc = etree_.parse(*args, **kwargs) - return doc - -# -# User methods -# -# Calls to the methods in these classes are generated by generateDS.py. -# You can replace these methods by re-implementing the following class -# in a module named generatedssuper.py. - -try: - from generatedssuper import GeneratedsSuper -except ImportError, exp: - - class GeneratedsSuper(object): - tzoff_pattern = re_.compile(r'(\+|-)((0\d|1[0-3]):[0-5]\d|14:00)$') - class _FixedOffsetTZ(tzinfo): - def __init__(self, offset, name): - self.__offset = timedelta(minutes = offset) - self.__name = name - def utcoffset(self, dt): - return self.__offset - def tzname(self, dt): - return self.__name - def dst(self, dt): - return None - def gds_format_string(self, input_data, input_name=''): - return input_data - def gds_validate_string(self, input_data, node, input_name=''): - return input_data - def gds_format_base64(self, input_data, input_name=''): - return base64.b64encode(input_data) - def gds_validate_base64(self, input_data, node, input_name=''): - return input_data - def gds_format_integer(self, input_data, input_name=''): - return '%d' % input_data - def gds_validate_integer(self, input_data, node, input_name=''): - return input_data - def gds_format_integer_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_integer_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of integers') - return input_data - def gds_format_float(self, input_data, input_name=''): - return '%f' % input_data - def gds_validate_float(self, input_data, node, input_name=''): - return input_data - def gds_format_float_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_float_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of floats') - return input_data - def gds_format_double(self, input_data, input_name=''): - return '%e' % input_data - def gds_validate_double(self, input_data, node, input_name=''): - return input_data - def gds_format_double_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_double_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of doubles') - return input_data - def gds_format_boolean(self, input_data, input_name=''): - return ('%s' % input_data).lower() - def gds_validate_boolean(self, input_data, node, input_name=''): - return input_data - def gds_format_boolean_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_boolean_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - if value not in ('true', '1', 'false', '0', ): - raise_parse_error(node, - 'Requires sequence of booleans ' - '("true", "1", "false", "0")') - return input_data - def gds_validate_datetime(self, input_data, node, input_name=''): - return input_data - def gds_format_datetime(self, input_data, input_name=''): - if input_data.microsecond == 0: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S') - else: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S.%f') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_datetime(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - if len(input_data.split('.')) > 1: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S.%f') - else: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S') - return dt.replace(tzinfo = tz) - - def gds_validate_date(self, input_data, node, input_name=''): - return input_data - def gds_format_date(self, input_data, input_name=''): - _svalue = input_data.strftime('%Y-%m-%d') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_date(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - return datetime.strptime(input_data, - '%Y-%m-%d').replace(tzinfo = tz) - def gds_str_lower(self, instring): - return instring.lower() - def get_path_(self, node): - path_list = [] - self.get_path_list_(node, path_list) - path_list.reverse() - path = '/'.join(path_list) - return path - Tag_strip_pattern_ = re_.compile(r'\{.*\}') - def get_path_list_(self, node, path_list): - if node is None: - return - tag = GeneratedsSuper.Tag_strip_pattern_.sub('', node.tag) - if tag: - path_list.append(tag) - self.get_path_list_(node.getparent(), path_list) - def get_class_obj_(self, node, default_class=None): - class_obj1 = default_class - if 'xsi' in node.nsmap: - classname = node.get('{%s}type' % node.nsmap['xsi']) - if classname is not None: - names = classname.split(':') - if len(names) == 2: - classname = names[1] - class_obj2 = globals().get(classname) - if class_obj2 is not None: - class_obj1 = class_obj2 - return class_obj1 - def gds_build_any(self, node, type_name=None): - return None - - -# -# If you have installed IPython you can uncomment and use the following. -# IPython is available from http://ipython.scipy.org/. -# - -## from IPython.Shell import IPShellEmbed -## args = '' -## ipshell = IPShellEmbed(args, -## banner = 'Dropping into IPython', -## exit_msg = 'Leaving Interpreter, back to program.') - -# Then use the following line where and when you want to drop into the -# IPython shell: -# ipshell(' -- Entering ipshell.\nHit Ctrl-D to exit') - -# -# Globals -# - -ExternalEncoding = 'utf-8' -Tag_pattern_ = re_.compile(r'({.*})?(.*)') -String_cleanup_pat_ = re_.compile(r"[\n\r\s]+") -Namespace_extract_pat_ = re_.compile(r'{(.*)}(.*)') - -# -# Support/utility functions. -# - -def showIndent(write, level, pretty_print=True): - if pretty_print: - for idx in range(level): - write(' ') - -def quote_xml(inStr): - if not inStr: - return '' - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - return unicode(s1) - -def quote_attrib(inStr): - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - if '"' in s1: - if "'" in s1: - s1 = '"%s"' % s1.replace('"', """) - else: - s1 = "'%s'" % s1 - else: - s1 = '"%s"' % s1 - return unicode(s1) - -def quote_python(inStr): - s1 = inStr - if s1.find("'") == -1: - if s1.find('\n') == -1: - return "'%s'" % s1 - else: - return "'''%s'''" % s1 - else: - if s1.find('"') != -1: - s1 = s1.replace('"', '\\"') - if s1.find('\n') == -1: - return '"%s"' % s1 - else: - return '"""%s"""' % s1 - -def get_all_text_(node): - if node.text is not None: - text = node.text - else: - text = '' - for child in node: - if child.tail is not None: - text += child.tail - return text - -def find_attr_value_(attr_name, node): - attrs = node.attrib - attr_parts = attr_name.split(':') - value = None - if len(attr_parts) == 1: - value = attrs.get(attr_name) - elif len(attr_parts) == 2: - prefix, name = attr_parts - namespace = node.nsmap.get(prefix) - if namespace is not None: - value = attrs.get('{%s}%s' % (namespace, name, )) - return value - - -class GDSParseError(Exception): - pass - -def raise_parse_error(node, msg): - if XMLParser_import_library == XMLParser_import_lxml: - msg = '%s (element %s/line %d)' % ( - msg, node.tag, node.sourceline, ) - else: - msg = '%s (element %s)' % (msg, node.tag, ) - raise GDSParseError(msg) - - -class MixedContainer: - # Constants for category: - CategoryNone = 0 - CategoryText = 1 - CategorySimple = 2 - CategoryComplex = 3 - # Constants for content_type: - TypeNone = 0 - TypeText = 1 - TypeString = 2 - TypeInteger = 3 - TypeFloat = 4 - TypeDecimal = 5 - TypeDouble = 6 - TypeBoolean = 7 - TypeBase64 = 8 - def __init__(self, category, content_type, name, value): - self.category = category - self.content_type = content_type - self.name = name - self.value = value - def getCategory(self): - return self.category - def getContenttype(self, content_type): - return self.content_type - def getValue(self): - return self.value - def getName(self): - return self.name - def export(self, write, level, name, namespace, pretty_print=True): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - write(self.value) - elif self.category == MixedContainer.CategorySimple: - self.exportSimple(write, level, name) - else: # category == MixedContainer.CategoryComplex - self.value.export(write, level, namespace, name, pretty_print) - def exportSimple(self, write, level, name): - if self.content_type == MixedContainer.TypeString: - write('<%s>%s' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeInteger or \ - self.content_type == MixedContainer.TypeBoolean: - write('<%s>%d' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeFloat or \ - self.content_type == MixedContainer.TypeDecimal: - write('<%s>%f' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeDouble: - write('<%s>%g' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeBase64: - write('<%s>%s' % - (self.name, base64.b64encode(self.value), self.name)) - def to_etree(self, element): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - if len(element) > 0: - if element[-1].tail is None: - element[-1].tail = self.value - else: - element[-1].tail += self.value - else: - if element.text is None: - element.text = self.value - else: - element.text += self.value - elif self.category == MixedContainer.CategorySimple: - subelement = etree_.SubElement(element, '%s' % self.name) - subelement.text = self.to_etree_simple() - else: # category == MixedContainer.CategoryComplex - self.value.to_etree(element) - def to_etree_simple(self): - if self.content_type == MixedContainer.TypeString: - text = self.value - elif (self.content_type == MixedContainer.TypeInteger or - self.content_type == MixedContainer.TypeBoolean): - text = '%d' % self.value - elif (self.content_type == MixedContainer.TypeFloat or - self.content_type == MixedContainer.TypeDecimal): - text = '%f' % self.value - elif self.content_type == MixedContainer.TypeDouble: - text = '%g' % self.value - elif self.content_type == MixedContainer.TypeBase64: - text = '%s' % base64.b64encode(self.value) - return text - def exportLiteral(self, write, level, name): - if self.category == MixedContainer.CategoryText: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - elif self.category == MixedContainer.CategorySimple: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - else: # category == MixedContainer.CategoryComplex - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s",\n' % \ - (self.category, self.content_type, self.name,)) - self.value.exportLiteral(write, level + 1) - showIndent(write, level) - write(')\n') - - -class MemberSpec_(object): - def __init__(self, name='', data_type='', container=0): - self.name = name - self.data_type = data_type - self.container = container - def set_name(self, name): self.name = name - def get_name(self): return self.name - def set_data_type(self, data_type): self.data_type = data_type - def get_data_type_chain(self): return self.data_type - def get_data_type(self): - if isinstance(self.data_type, list): - if len(self.data_type) > 0: - return self.data_type[-1] - else: - return 'xs:string' - else: - return self.data_type - def set_container(self, container): self.container = container - def get_container(self): return self.container - -def _cast(typ, value): - if typ is None or value is None: - return value - return typ(value) - -# -# Data representation classes. -# class BehaviorType(GeneratedsSuper): """The BehaviorType is one of the foundational MAEC types, and serves diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index c98e76a..f60a2b5 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -1,517 +1,10 @@ -#!/usr/bin/env python -# -*- coding: utf-8 -*- - -# -# Generated Mon Apr 29 08:31:25 2013 by generateDS.py version 2.9a. -# +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. import sys -import getopt -import re as re_ +from maec.bindings import * from maec.bindings import maec_package as maec_package_schema -import base64 -from datetime import datetime, tzinfo, timedelta - -etree_ = None -Verbose_import_ = False -( XMLParser_import_none, XMLParser_import_lxml, - XMLParser_import_elementtree - ) = range(3) -XMLParser_import_library = None -try: - # lxml - from lxml import etree as etree_ - XMLParser_import_library = XMLParser_import_lxml - if Verbose_import_: - print("running with lxml.etree") -except ImportError: - try: - # cElementTree from Python 2.5+ - import xml.etree.cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree on Python 2.5+") - except ImportError: - try: - # ElementTree from Python 2.5+ - import xml.etree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree on Python 2.5+") - except ImportError: - try: - # normal cElementTree install - import cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree") - except ImportError: - try: - # normal ElementTree install - import elementtree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree") - except ImportError: - raise ImportError( - "Failed to import ElementTree from any known place") - -def parsexml_(*args, **kwargs): - if (XMLParser_import_library == XMLParser_import_lxml and - 'parser' not in kwargs): - # Use the lxml ElementTree compatible parser so that, e.g., - # we ignore comments. - kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) - doc = etree_.parse(*args, **kwargs) - return doc - -# -# User methods -# -# Calls to the methods in these classes are generated by generateDS.py. -# You can replace these methods by re-implementing the following class -# in a module named generatedssuper.py. - -try: - from generatedssuper import GeneratedsSuper -except ImportError, exp: - - class GeneratedsSuper(object): - tzoff_pattern = re_.compile(r'(\+|-)((0\d|1[0-3]):[0-5]\d|14:00)$') - class _FixedOffsetTZ(tzinfo): - def __init__(self, offset, name): - self.__offset = timedelta(minutes = offset) - self.__name = name - def utcoffset(self, dt): - return self.__offset - def tzname(self, dt): - return self.__name - def dst(self, dt): - return None - def gds_format_string(self, input_data, input_name=''): - return input_data - def gds_validate_string(self, input_data, node, input_name=''): - return input_data - def gds_format_base64(self, input_data, input_name=''): - return base64.b64encode(input_data) - def gds_validate_base64(self, input_data, node, input_name=''): - return input_data - def gds_format_integer(self, input_data, input_name=''): - return '%d' % input_data - def gds_validate_integer(self, input_data, node, input_name=''): - return input_data - def gds_format_integer_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_integer_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of integers') - return input_data - def gds_format_float(self, input_data, input_name=''): - return '%f' % input_data - def gds_validate_float(self, input_data, node, input_name=''): - return input_data - def gds_format_float_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_float_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of floats') - return input_data - def gds_format_double(self, input_data, input_name=''): - return '%e' % input_data - def gds_validate_double(self, input_data, node, input_name=''): - return input_data - def gds_format_double_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_double_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of doubles') - return input_data - def gds_format_boolean(self, input_data, input_name=''): - return ('%s' % input_data).lower() - def gds_validate_boolean(self, input_data, node, input_name=''): - return input_data - def gds_format_boolean_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_boolean_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - if value not in ('true', '1', 'false', '0', ): - raise_parse_error(node, - 'Requires sequence of booleans ' - '("true", "1", "false", "0")') - return input_data - def gds_validate_datetime(self, input_data, node, input_name=''): - return input_data - def gds_format_datetime(self, input_data, input_name=''): - if input_data.microsecond == 0: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S') - else: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S.%f') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_datetime(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - if len(input_data.split('.')) > 1: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S.%f') - else: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S') - return dt.replace(tzinfo = tz) - - def gds_validate_date(self, input_data, node, input_name=''): - return input_data - def gds_format_date(self, input_data, input_name=''): - _svalue = input_data.strftime('%Y-%m-%d') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_date(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - return datetime.strptime(input_data, - '%Y-%m-%d').replace(tzinfo = tz) - def gds_str_lower(self, instring): - return instring.lower() - def get_path_(self, node): - path_list = [] - self.get_path_list_(node, path_list) - path_list.reverse() - path = '/'.join(path_list) - return path - Tag_strip_pattern_ = re_.compile(r'\{.*\}') - def get_path_list_(self, node, path_list): - if node is None: - return - tag = GeneratedsSuper.Tag_strip_pattern_.sub('', node.tag) - if tag: - path_list.append(tag) - self.get_path_list_(node.getparent(), path_list) - def get_class_obj_(self, node, default_class=None): - class_obj1 = default_class - if 'xsi' in node.nsmap: - classname = node.get('{%s}type' % node.nsmap['xsi']) - if classname is not None: - names = classname.split(':') - if len(names) == 2: - classname = names[1] - class_obj2 = globals().get(classname) - if class_obj2 is not None: - class_obj1 = class_obj2 - return class_obj1 - def gds_build_any(self, node, type_name=None): - return None - - -# -# If you have installed IPython you can uncomment and use the following. -# IPython is available from http://ipython.scipy.org/. -# - -## from IPython.Shell import IPShellEmbed -## args = '' -## ipshell = IPShellEmbed(args, -## banner = 'Dropping into IPython', -## exit_msg = 'Leaving Interpreter, back to program.') - -# Then use the following line where and when you want to drop into the -# IPython shell: -# ipshell(' -- Entering ipshell.\nHit Ctrl-D to exit') - -# -# Globals -# - -ExternalEncoding = 'utf-8' -Tag_pattern_ = re_.compile(r'({.*})?(.*)') -String_cleanup_pat_ = re_.compile(r"[\n\r\s]+") -Namespace_extract_pat_ = re_.compile(r'{(.*)}(.*)') - -# -# Support/utility functions. -# - -def showIndent(write, level, pretty_print=True): - if pretty_print: - for idx in range(level): - write(' ') - -def quote_xml(inStr): - if not inStr: - return '' - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - return unicode(s1) - -def quote_attrib(inStr): - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - if '"' in s1: - if "'" in s1: - s1 = '"%s"' % s1.replace('"', """) - else: - s1 = "'%s'" % s1 - else: - s1 = '"%s"' % s1 - return unicode(s1) - -def quote_python(inStr): - s1 = inStr - if s1.find("'") == -1: - if s1.find('\n') == -1: - return "'%s'" % s1 - else: - return "'''%s'''" % s1 - else: - if s1.find('"') != -1: - s1 = s1.replace('"', '\\"') - if s1.find('\n') == -1: - return '"%s"' % s1 - else: - return '"""%s"""' % s1 - -def get_all_text_(node): - if node.text is not None: - text = node.text - else: - text = '' - for child in node: - if child.tail is not None: - text += child.tail - return text - -def find_attr_value_(attr_name, node): - attrs = node.attrib - attr_parts = attr_name.split(':') - value = None - if len(attr_parts) == 1: - value = attrs.get(attr_name) - elif len(attr_parts) == 2: - prefix, name = attr_parts - namespace = node.nsmap.get(prefix) - if namespace is not None: - value = attrs.get('{%s}%s' % (namespace, name, )) - return value - - -class GDSParseError(Exception): - pass - -def raise_parse_error(node, msg): - if XMLParser_import_library == XMLParser_import_lxml: - msg = '%s (element %s/line %d)' % ( - msg, node.tag, node.sourceline, ) - else: - msg = '%s (element %s)' % (msg, node.tag, ) - raise GDSParseError(msg) - - -class MixedContainer: - # Constants for category: - CategoryNone = 0 - CategoryText = 1 - CategorySimple = 2 - CategoryComplex = 3 - # Constants for content_type: - TypeNone = 0 - TypeText = 1 - TypeString = 2 - TypeInteger = 3 - TypeFloat = 4 - TypeDecimal = 5 - TypeDouble = 6 - TypeBoolean = 7 - TypeBase64 = 8 - def __init__(self, category, content_type, name, value): - self.category = category - self.content_type = content_type - self.name = name - self.value = value - def getCategory(self): - return self.category - def getContenttype(self, content_type): - return self.content_type - def getValue(self): - return self.value - def getName(self): - return self.name - def export(self, write, level, name, namespace, pretty_print=True): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - write(self.value) - elif self.category == MixedContainer.CategorySimple: - self.exportSimple(write, level, name) - else: # category == MixedContainer.CategoryComplex - self.value.export(write, level, namespace, name, pretty_print) - def exportSimple(self, write, level, name): - if self.content_type == MixedContainer.TypeString: - write('<%s>%s' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeInteger or \ - self.content_type == MixedContainer.TypeBoolean: - write('<%s>%d' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeFloat or \ - self.content_type == MixedContainer.TypeDecimal: - write('<%s>%f' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeDouble: - write('<%s>%g' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeBase64: - write('<%s>%s' % - (self.name, base64.b64encode(self.value), self.name)) - def to_etree(self, element): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - if len(element) > 0: - if element[-1].tail is None: - element[-1].tail = self.value - else: - element[-1].tail += self.value - else: - if element.text is None: - element.text = self.value - else: - element.text += self.value - elif self.category == MixedContainer.CategorySimple: - subelement = etree_.SubElement(element, '%s' % self.name) - subelement.text = self.to_etree_simple() - else: # category == MixedContainer.CategoryComplex - self.value.to_etree(element) - def to_etree_simple(self): - if self.content_type == MixedContainer.TypeString: - text = self.value - elif (self.content_type == MixedContainer.TypeInteger or - self.content_type == MixedContainer.TypeBoolean): - text = '%d' % self.value - elif (self.content_type == MixedContainer.TypeFloat or - self.content_type == MixedContainer.TypeDecimal): - text = '%f' % self.value - elif self.content_type == MixedContainer.TypeDouble: - text = '%g' % self.value - elif self.content_type == MixedContainer.TypeBase64: - text = '%s' % base64.b64encode(self.value) - return text - def exportLiteral(self, write, level, name): - if self.category == MixedContainer.CategoryText: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - elif self.category == MixedContainer.CategorySimple: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - else: # category == MixedContainer.CategoryComplex - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s",\n' % \ - (self.category, self.content_type, self.name,)) - self.value.exportLiteral(write, level + 1) - showIndent(write, level) - write(')\n') - - -class MemberSpec_(object): - def __init__(self, name='', data_type='', container=0): - self.name = name - self.data_type = data_type - self.container = container - def set_name(self, name): self.name = name - def get_name(self): return self.name - def set_data_type(self, data_type): self.data_type = data_type - def get_data_type_chain(self): return self.data_type - def get_data_type(self): - if isinstance(self.data_type, list): - if len(self.data_type) > 0: - return self.data_type[-1] - else: - return 'xs:string' - else: - return self.data_type - def set_container(self, container): self.container = container - def get_container(self): return self.container - -def _cast(typ, value): - if typ is None or value is None: - return value - return typ(value) - -# -# Data representation classes. -# class ContainerType(GeneratedsSuper): """The ContainerType encompasses all forms of MAEC data. Currently, diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index 0b12cf7..b1425a0 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -1,14 +1,9 @@ -#!/usr/bin/env python -# -*- coding: utf-8 -*- - -# -# Generated Mon Apr 29 08:30:56 2013 by generateDS.py version 2.9a. -# +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. import sys -import getopt -import re as re_ +from maec.bindings import * from maec.bindings import maec_bundle as maec_bundle_schema from maec.bindings import mmdef_1_2 as metadatasharing from cybox.bindings import cybox_core @@ -16,508 +11,6 @@ from cybox.bindings import cybox_common from cybox.bindings import file_object from cybox.bindings import uri_object -import base64 -from datetime import datetime, tzinfo, timedelta - -etree_ = None -Verbose_import_ = False -( XMLParser_import_none, XMLParser_import_lxml, - XMLParser_import_elementtree - ) = range(3) -XMLParser_import_library = None -try: - # lxml - from lxml import etree as etree_ - XMLParser_import_library = XMLParser_import_lxml - if Verbose_import_: - print("running with lxml.etree") -except ImportError: - try: - # cElementTree from Python 2.5+ - import xml.etree.cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree on Python 2.5+") - except ImportError: - try: - # ElementTree from Python 2.5+ - import xml.etree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree on Python 2.5+") - except ImportError: - try: - # normal cElementTree install - import cElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with cElementTree") - except ImportError: - try: - # normal ElementTree install - import elementtree.ElementTree as etree_ - XMLParser_import_library = XMLParser_import_elementtree - if Verbose_import_: - print("running with ElementTree") - except ImportError: - raise ImportError( - "Failed to import ElementTree from any known place") - -def parsexml_(*args, **kwargs): - if (XMLParser_import_library == XMLParser_import_lxml and - 'parser' not in kwargs): - # Use the lxml ElementTree compatible parser so that, e.g., - # we ignore comments. - kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) - doc = etree_.parse(*args, **kwargs) - return doc - -# -# User methods -# -# Calls to the methods in these classes are generated by generateDS.py. -# You can replace these methods by re-implementing the following class -# in a module named generatedssuper.py. - -try: - from generatedssuper import GeneratedsSuper -except ImportError, exp: - - class GeneratedsSuper(object): - tzoff_pattern = re_.compile(r'(\+|-)((0\d|1[0-3]):[0-5]\d|14:00)$') - class _FixedOffsetTZ(tzinfo): - def __init__(self, offset, name): - self.__offset = timedelta(minutes = offset) - self.__name = name - def utcoffset(self, dt): - return self.__offset - def tzname(self, dt): - return self.__name - def dst(self, dt): - return None - def gds_format_string(self, input_data, input_name=''): - return input_data - def gds_validate_string(self, input_data, node, input_name=''): - return input_data - def gds_format_base64(self, input_data, input_name=''): - return base64.b64encode(input_data) - def gds_validate_base64(self, input_data, node, input_name=''): - return input_data - def gds_format_integer(self, input_data, input_name=''): - return '%d' % input_data - def gds_validate_integer(self, input_data, node, input_name=''): - return input_data - def gds_format_integer_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_integer_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of integers') - return input_data - def gds_format_float(self, input_data, input_name=''): - return '%f' % input_data - def gds_validate_float(self, input_data, node, input_name=''): - return input_data - def gds_format_float_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_float_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of floats') - return input_data - def gds_format_double(self, input_data, input_name=''): - return '%e' % input_data - def gds_validate_double(self, input_data, node, input_name=''): - return input_data - def gds_format_double_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_double_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of doubles') - return input_data - def gds_format_boolean(self, input_data, input_name=''): - return ('%s' % input_data).lower() - def gds_validate_boolean(self, input_data, node, input_name=''): - return input_data - def gds_format_boolean_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_boolean_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - if value not in ('true', '1', 'false', '0', ): - raise_parse_error(node, - 'Requires sequence of booleans ' - '("true", "1", "false", "0")') - return input_data - def gds_validate_datetime(self, input_data, node, input_name=''): - return input_data - def gds_format_datetime(self, input_data, input_name=''): - if input_data.microsecond == 0: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S') - else: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S.%f') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_datetime(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - if len(input_data.split('.')) > 1: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S.%f') - else: - dt = datetime.strptime( - input_data, '%Y-%m-%dT%H:%M:%S') - return dt.replace(tzinfo = tz) - - def gds_validate_date(self, input_data, node, input_name=''): - return input_data - def gds_format_date(self, input_data, input_name=''): - _svalue = input_data.strftime('%Y-%m-%d') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - def gds_parse_date(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = GeneratedsSuper._FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = GeneratedsSuper.tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = GeneratedsSuper._FixedOffsetTZ( - tzoff, results.group(0)) - input_data = input_data[:-6] - return datetime.strptime(input_data, - '%Y-%m-%d').replace(tzinfo = tz) - def gds_str_lower(self, instring): - return instring.lower() - def get_path_(self, node): - path_list = [] - self.get_path_list_(node, path_list) - path_list.reverse() - path = '/'.join(path_list) - return path - Tag_strip_pattern_ = re_.compile(r'\{.*\}') - def get_path_list_(self, node, path_list): - if node is None: - return - tag = GeneratedsSuper.Tag_strip_pattern_.sub('', node.tag) - if tag: - path_list.append(tag) - self.get_path_list_(node.getparent(), path_list) - def get_class_obj_(self, node, default_class=None): - class_obj1 = default_class - if 'xsi' in node.nsmap: - classname = node.get('{%s}type' % node.nsmap['xsi']) - if classname is not None: - names = classname.split(':') - if len(names) == 2: - classname = names[1] - class_obj2 = globals().get(classname) - if class_obj2 is not None: - class_obj1 = class_obj2 - return class_obj1 - def gds_build_any(self, node, type_name=None): - return None - - -# -# If you have installed IPython you can uncomment and use the following. -# IPython is available from http://ipython.scipy.org/. -# - -## from IPython.Shell import IPShellEmbed -## args = '' -## ipshell = IPShellEmbed(args, -## banner = 'Dropping into IPython', -## exit_msg = 'Leaving Interpreter, back to program.') - -# Then use the following line where and when you want to drop into the -# IPython shell: -# ipshell(' -- Entering ipshell.\nHit Ctrl-D to exit') - -# -# Globals -# - -ExternalEncoding = 'utf-8' -Tag_pattern_ = re_.compile(r'({.*})?(.*)') -String_cleanup_pat_ = re_.compile(r"[\n\r\s]+") -Namespace_extract_pat_ = re_.compile(r'{(.*)}(.*)') - -# -# Support/utility functions. -# - -def showIndent(write, level, pretty_print=True): - if pretty_print: - for idx in range(level): - write(' ') - -def quote_xml(inStr): - if not inStr: - return '' - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - return unicode(s1) - -def quote_attrib(inStr): - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - if '"' in s1: - if "'" in s1: - s1 = '"%s"' % s1.replace('"', """) - else: - s1 = "'%s'" % s1 - else: - s1 = '"%s"' % s1 - return unicode(s1) - -def quote_python(inStr): - s1 = inStr - if s1.find("'") == -1: - if s1.find('\n') == -1: - return "'%s'" % s1 - else: - return "'''%s'''" % s1 - else: - if s1.find('"') != -1: - s1 = s1.replace('"', '\\"') - if s1.find('\n') == -1: - return '"%s"' % s1 - else: - return '"""%s"""' % s1 - -def get_all_text_(node): - if node.text is not None: - text = node.text - else: - text = '' - for child in node: - if child.tail is not None: - text += child.tail - return text - -def find_attr_value_(attr_name, node): - attrs = node.attrib - attr_parts = attr_name.split(':') - value = None - if len(attr_parts) == 1: - value = attrs.get(attr_name) - elif len(attr_parts) == 2: - prefix, name = attr_parts - namespace = node.nsmap.get(prefix) - if namespace is not None: - value = attrs.get('{%s}%s' % (namespace, name, )) - return value - - -class GDSParseError(Exception): - pass - -def raise_parse_error(node, msg): - if XMLParser_import_library == XMLParser_import_lxml: - msg = '%s (element %s/line %d)' % ( - msg, node.tag, node.sourceline, ) - else: - msg = '%s (element %s)' % (msg, node.tag, ) - raise GDSParseError(msg) - - -class MixedContainer: - # Constants for category: - CategoryNone = 0 - CategoryText = 1 - CategorySimple = 2 - CategoryComplex = 3 - # Constants for content_type: - TypeNone = 0 - TypeText = 1 - TypeString = 2 - TypeInteger = 3 - TypeFloat = 4 - TypeDecimal = 5 - TypeDouble = 6 - TypeBoolean = 7 - TypeBase64 = 8 - def __init__(self, category, content_type, name, value): - self.category = category - self.content_type = content_type - self.name = name - self.value = value - def getCategory(self): - return self.category - def getContenttype(self, content_type): - return self.content_type - def getValue(self): - return self.value - def getName(self): - return self.name - def export(self, write, level, name, namespace, pretty_print=True): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - write(self.value) - elif self.category == MixedContainer.CategorySimple: - self.exportSimple(write, level, name) - else: # category == MixedContainer.CategoryComplex - self.value.export(write, level, namespace, name, pretty_print) - def exportSimple(self, write, level, name): - if self.content_type == MixedContainer.TypeString: - write('<%s>%s' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeInteger or \ - self.content_type == MixedContainer.TypeBoolean: - write('<%s>%d' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeFloat or \ - self.content_type == MixedContainer.TypeDecimal: - write('<%s>%f' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeDouble: - write('<%s>%g' % - (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeBase64: - write('<%s>%s' % - (self.name, base64.b64encode(self.value), self.name)) - def to_etree(self, element): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - if len(element) > 0: - if element[-1].tail is None: - element[-1].tail = self.value - else: - element[-1].tail += self.value - else: - if element.text is None: - element.text = self.value - else: - element.text += self.value - elif self.category == MixedContainer.CategorySimple: - subelement = etree_.SubElement(element, '%s' % self.name) - subelement.text = self.to_etree_simple() - else: # category == MixedContainer.CategoryComplex - self.value.to_etree(element) - def to_etree_simple(self): - if self.content_type == MixedContainer.TypeString: - text = self.value - elif (self.content_type == MixedContainer.TypeInteger or - self.content_type == MixedContainer.TypeBoolean): - text = '%d' % self.value - elif (self.content_type == MixedContainer.TypeFloat or - self.content_type == MixedContainer.TypeDecimal): - text = '%f' % self.value - elif self.content_type == MixedContainer.TypeDouble: - text = '%g' % self.value - elif self.content_type == MixedContainer.TypeBase64: - text = '%s' % base64.b64encode(self.value) - return text - def exportLiteral(self, write, level, name): - if self.category == MixedContainer.CategoryText: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - elif self.category == MixedContainer.CategorySimple: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' - % (self.category, self.content_type, self.name, self.value)) - else: # category == MixedContainer.CategoryComplex - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s",\n' % \ - (self.category, self.content_type, self.name,)) - self.value.exportLiteral(write, level + 1) - showIndent(write, level) - write(')\n') - - -class MemberSpec_(object): - def __init__(self, name='', data_type='', container=0): - self.name = name - self.data_type = data_type - self.container = container - def set_name(self, name): self.name = name - def get_name(self): return self.name - def set_data_type(self, data_type): self.data_type = data_type - def get_data_type_chain(self): return self.data_type - def get_data_type(self): - if isinstance(self.data_type, list): - if len(self.data_type) > 0: - return self.data_type[-1] - else: - return 'xs:string' - else: - return self.data_type - def set_container(self, container): self.container = container - def get_container(self): return self.container - -def _cast(typ, value): - if typ is None or value is None: - return value - return typ(value) - -# -# Data representation classes. -# class AnalysisEnvironmentType(GeneratedsSuper): """The AnalysisEnvironmentType provides mechanisms for characterizing diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index ca37024..b5caa08 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -1,342 +1,9 @@ -#!/usr/bin/env python -# -*- coding: utf-8 -*- - -# -# Generated Wed Feb 01 11:30:10 2012 by generateDS.py version 2.7b. -# +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. import sys -import getopt -import re as re_ - -etree_ = None -Verbose_import_ = False -( XMLParser_import_none, XMLParser_import_lxml, - XMLParser_import_elementtree - ) = range(3) -XMLParser_import_library = None -try: - # lxml - from lxml import etree as etree_ - XMLParser_import_library = XMLParser_import_lxml - if Verbose_import_: - print("running with lxml.etree") -except ImportError: - if Verbose_import_: - print 'Error: LXML version 2.3+ required for parsing files' - -def parsexml_(*args, **kwargs): - if (XMLParser_import_library == XMLParser_import_lxml and - 'parser' not in kwargs): - # Use the lxml ElementTree compatible parser so that, e.g., - # we ignore comments. - kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) - doc = etree_.parse(*args, **kwargs) - return doc - -# -# User methods -# -# Calls to the methods in these classes are generated by generateDS.py. -# You can replace these methods by re-implementing the following class -# in a module named generatedssuper.py. - -try: - from generatedssuper import GeneratedsSuper -except ImportError, exp: - - class GeneratedsSuper(object): - def gds_format_string(self, input_data, input_name=''): - return input_data - def gds_validate_string(self, input_data, node, input_name=''): - return input_data - def gds_format_integer(self, input_data, input_name=''): - return '%d' % input_data - def gds_validate_integer(self, input_data, node, input_name=''): - return input_data - def gds_format_integer_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_integer_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of integers') - return input_data - def gds_format_float(self, input_data, input_name=''): - return '%f' % input_data - def gds_validate_float(self, input_data, node, input_name=''): - return input_data - def gds_format_float_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_float_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of floats') - return input_data - def gds_format_double(self, input_data, input_name=''): - return '%e' % input_data - def gds_validate_double(self, input_data, node, input_name=''): - return input_data - def gds_format_double_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_double_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of doubles') - return input_data - def gds_format_boolean(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_boolean(self, input_data, node, input_name=''): - return input_data - def gds_format_boolean_list(self, input_data, input_name=''): - return '%s' % input_data - def gds_validate_boolean_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - if value not in ('true', '1', 'false', '0', ): - raise_parse_error(node, 'Requires sequence of booleans ("true", "1", "false", "0")') - return input_data - def gds_str_lower(self, instring): - return instring.lower() - def get_path_(self, node): - path_list = [] - self.get_path_list_(node, path_list) - path_list.reverse() - path = '/'.join(path_list) - return path - Tag_strip_pattern_ = re_.compile(r'\{.*\}') - def get_path_list_(self, node, path_list): - if node is None: - return - tag = GeneratedsSuper.Tag_strip_pattern_.sub('', node.tag) - if tag: - path_list.append(tag) - self.get_path_list_(node.getparent(), path_list) - def get_class_obj_(self, node, default_class=None): - class_obj1 = default_class - if 'xsi' in node.nsmap: - classname = node.get('{%s}type' % node.nsmap['xsi']) - if classname is not None: - names = classname.split(':') - if len(names) == 2: - classname = names[1] - class_obj2 = globals().get(classname) - if class_obj2 is not None: - class_obj1 = class_obj2 - return class_obj1 - def gds_build_any(self, node, type_name=None): - return None - - -# -# If you have installed IPython you can uncomment and use the following. -# IPython is available from http://ipython.scipy.org/. -# - -## from IPython.Shell import IPShellEmbed -## args = '' -## ipshell = IPShellEmbed(args, -## banner = 'Dropping into IPython', -## exit_msg = 'Leaving Interpreter, back to program.') - -# Then use the following line where and when you want to drop into the -# IPython shell: -# ipshell(' -- Entering ipshell.\nHit Ctrl-D to exit') - -# -# Globals -# - -ExternalEncoding = 'utf-8' -Tag_pattern_ = re_.compile(r'({.*})?(.*)') -String_cleanup_pat_ = re_.compile(r"[\n\r\s]+") -Namespace_extract_pat_ = re_.compile(r'{(.*)}(.*)') - -# -# Support/utility functions. -# - -def showIndent(write, level): - for idx in range(level): - write(' ') - -def quote_xml(inStr): - if not inStr: - return '' - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - return unicode(s1) - -def quote_attrib(inStr): - s1 = (isinstance(inStr, basestring) and inStr or - '%s' % inStr) - s1 = s1.replace('&', '&') - s1 = s1.replace('<', '<') - s1 = s1.replace('>', '>') - if '"' in s1: - if "'" in s1: - s1 = '"%s"' % s1.replace('"', """) - else: - s1 = "'%s'" % s1 - else: - s1 = '"%s"' % s1 - return unicode(s1) - -def quote_python(inStr): - s1 = inStr - if s1.find("'") == -1: - if s1.find('\n') == -1: - return "'%s'" % s1 - else: - return "'''%s'''" % s1 - else: - if s1.find('"') != -1: - s1 = s1.replace('"', '\\"') - if s1.find('\n') == -1: - return '"%s"' % s1 - else: - return '"""%s"""' % s1 - -def get_all_text_(node): - if node.text is not None: - text = node.text - else: - text = '' - for child in node: - if child.tail is not None: - text += child.tail - return text - -def find_attr_value_(attr_name, node): - attrs = node.attrib - attr_parts = attr_name.split(':') - value = None - if len(attr_parts) == 1: - value = attrs.get(attr_name) - elif len(attr_parts) == 2: - prefix, name = attr_parts - namespace = node.nsmap.get(prefix) - if namespace is not None: - value = attrs.get('{%s}%s' % (namespace, name, )) - return value - - -class GDSParseError(Exception): - pass - -def raise_parse_error(node, msg): - if XMLParser_import_library == XMLParser_import_lxml: - msg = '%s (element %s/line %d)' % (msg, node.tag, node.sourceline, ) - else: - msg = '%s (element %s)' % (msg, node.tag, ) - raise GDSParseError(msg) - - -class MixedContainer: - # Constants for category: - CategoryNone = 0 - CategoryText = 1 - CategorySimple = 2 - CategoryComplex = 3 - # Constants for content_type: - TypeNone = 0 - TypeText = 1 - TypeString = 2 - TypeInteger = 3 - TypeFloat = 4 - TypeDecimal = 5 - TypeDouble = 6 - TypeBoolean = 7 - def __init__(self, category, content_type, name, value): - self.category = category - self.content_type = content_type - self.name = name - self.value = value - def getCategory(self): - return self.category - def getContenttype(self, content_type): - return self.content_type - def getValue(self): - return self.value - def getName(self): - return self.name - def export(self, write, level, name, namespace): - if self.category == MixedContainer.CategoryText: - # Prevent exporting empty content as empty lines. - if self.value.strip(): - write(self.value) - elif self.category == MixedContainer.CategorySimple: - self.exportSimple(write, level, name) - else: # category == MixedContainer.CategoryComplex - self.value.export(write, level, namespace,name) - def exportSimple(self, write, level, name): - if self.content_type == MixedContainer.TypeString: - write('<%s>%s' % (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeInteger or \ - self.content_type == MixedContainer.TypeBoolean: - write('<%s>%d' % (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeFloat or \ - self.content_type == MixedContainer.TypeDecimal: - write('<%s>%f' % (self.name, self.value, self.name)) - elif self.content_type == MixedContainer.TypeDouble: - write('<%s>%g' % (self.name, self.value, self.name)) - def exportLiteral(self, write, level, name): - if self.category == MixedContainer.CategoryText: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ - (self.category, self.content_type, self.name, self.value)) - elif self.category == MixedContainer.CategorySimple: - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s", "%s"),\n' % \ - (self.category, self.content_type, self.name, self.value)) - else: # category == MixedContainer.CategoryComplex - showIndent(write, level) - write('model_.MixedContainer(%d, %d, "%s",\n' % \ - (self.category, self.content_type, self.name,)) - self.value.exportLiteral(write, level + 1) - showIndent(write, level) - write(')\n') - - -class MemberSpec_(object): - def __init__(self, name='', data_type='', container=0): - self.name = name - self.data_type = data_type - self.container = container - def set_name(self, name): self.name = name - def get_name(self): return self.name - def set_data_type(self, data_type): self.data_type = data_type - def get_data_type_chain(self): return self.data_type - def get_data_type(self): - if isinstance(self.data_type, list): - if len(self.data_type) > 0: - return self.data_type[-1] - else: - return 'xs:string' - else: - return self.data_type - def set_container(self, container): self.container = container - def get_container(self): return self.container - -def _cast(typ, value): - if typ is None or value is None: - return value - return typ(value) -# -# Data representation classes. -# +from maec.bindings import * class malwareMetaData(GeneratedsSuper): """This is the top level element for the xml document. Required From a2f1e9005c598a02e3702f040fd21bce563426c4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 15 Dec 2014 15:12:32 -0500 Subject: [PATCH 144/297] Copied from python-cybox --- maec/bindings/__init__.py | 378 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 378 insertions(+) diff --git a/maec/bindings/__init__.py b/maec/bindings/__init__.py index e69de29..6685197 100644 --- a/maec/bindings/__init__.py +++ b/maec/bindings/__init__.py @@ -0,0 +1,378 @@ +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import base64 +from datetime import datetime, tzinfo, timedelta +import re +import contextlib + +from xml.sax import saxutils +from lxml import etree as etree_ + +CDATA_START = "" + +ExternalEncoding = 'utf-8' +Tag_pattern_ = re.compile(r'({.*})?(.*)') + +# These are only used internally +_tzoff_pattern = re.compile(r'(\+|-)((0\d|1[0-3]):[0-5]\d|14:00)$') +_Tag_strip_pattern_ = re.compile(r'\{.*\}') + + +@contextlib.contextmanager +def save_encoding(encoding='utf-8'): + global ExternalEncoding + + try: + orig_encoding = ExternalEncoding + ExternalEncoding = encoding + yield + finally: + ExternalEncoding = orig_encoding + + +def parsexml_(*args, **kwargs): + if 'parser' not in kwargs: + # Use the lxml ElementTree compatible parser so that, e.g., + # we ignore comments. + kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) + return etree_.parse(*args, **kwargs) + + +class _FixedOffsetTZ(tzinfo): + + def __init__(self, offset, name): + self.__offset = timedelta(minutes = offset) + self.__name = name + + def utcoffset(self, dt): + return self.__offset + + def tzname(self, dt): + return self.__name + + def dst(self, dt): + return None + + +class GeneratedsSuper(object): + + def gds_format_string(self, input_data, input_name=''): + return input_data + + def gds_validate_string(self, input_data, node, input_name=''): + return input_data + + def gds_format_base64(self, input_data, input_name=''): + return base64.b64encode(input_data) + + def gds_validate_base64(self, input_data, node, input_name=''): + return input_data + + def gds_format_integer(self, input_data, input_name=''): + return '%d' % input_data + + def gds_validate_integer(self, input_data, node, input_name=''): + return input_data + + def gds_format_integer_list(self, input_data, input_name=''): + return '%s' % input_data + + def gds_validate_integer_list(self, input_data, node, input_name=''): + values = input_data.split() + for value in values: + try: + fvalue = float(value) + except (TypeError, ValueError), exp: + raise_parse_error(node, 'Requires sequence of integers') + return input_data + + def gds_format_float(self, input_data, input_name=''): + return '%f' % input_data + + def gds_validate_float(self, input_data, node, input_name=''): + return input_data + + def gds_format_float_list(self, input_data, input_name=''): + return '%s' % input_data + + def gds_validate_float_list(self, input_data, node, input_name=''): + values = input_data.split() + for value in values: + try: + fvalue = float(value) + except (TypeError, ValueError), exp: + raise_parse_error(node, 'Requires sequence of floats') + return input_data + + def gds_format_double(self, input_data, input_name=''): + return '%e' % input_data + + def gds_validate_double(self, input_data, node, input_name=''): + return input_data + + def gds_format_double_list(self, input_data, input_name=''): + return '%s' % input_data + + def gds_validate_double_list(self, input_data, node, input_name=''): + values = input_data.split() + for value in values: + try: + fvalue = float(value) + except (TypeError, ValueError), exp: + raise_parse_error(node, 'Requires sequence of doubles') + return input_data + + def gds_format_boolean(self, input_data, input_name=''): + return ('%s' % input_data).lower() + + def gds_validate_boolean(self, input_data, node, input_name=''): + return input_data + + def gds_format_boolean_list(self, input_data, input_name=''): + return '%s' % input_data + + def gds_validate_boolean_list(self, input_data, node, input_name=''): + values = input_data.split() + for value in values: + if value not in ('true', '1', 'false', '0', ): + raise_parse_error(node, + 'Requires sequence of booleans ' + '("true", "1", "false", "0")') + return input_data + + def gds_validate_datetime(self, input_data, node, input_name=''): + return input_data + + def gds_format_datetime(self, input_data, input_name=''): + if isinstance(input_data, basestring): + return input_data + if input_data.microsecond == 0: + _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S') + else: + _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S.%f') + if input_data.tzinfo is not None: + tzoff = input_data.tzinfo.utcoffset(input_data) + if tzoff is not None: + total_seconds = tzoff.seconds + (86400 * tzoff.days) + if total_seconds == 0: + _svalue += 'Z' + else: + if total_seconds < 0: + _svalue += '-' + total_seconds *= -1 + else: + _svalue += '+' + hours = total_seconds // 3600 + minutes = (total_seconds - (hours * 3600)) // 60 + _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) + return _svalue + + def gds_parse_datetime(self, input_data, node, input_name=''): + tz = None + if input_data[-1] == 'Z': + tz = _FixedOffsetTZ(0, 'GMT') + input_data = input_data[:-1] + else: + results = _tzoff_pattern.search(input_data) + if results is not None: + tzoff_parts = results.group(2).split(':') + tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) + if results.group(1) == '-': + tzoff *= -1 + tz = _FixedOffsetTZ(tzoff, results.group(0)) + input_data = input_data[:-6] + if len(input_data.split('.')) > 1: + dt = datetime.strptime(input_data, '%Y-%m-%dT%H:%M:%S.%f') + else: + dt = datetime.strptime(input_data, '%Y-%m-%dT%H:%M:%S') + return dt.replace(tzinfo = tz) + + def gds_validate_date(self, input_data, node, input_name=''): + return input_data + + def gds_format_date(self, input_data, input_name=''): + if isinstance(input_data, basestring): + return input_data + _svalue = input_data.strftime('%Y-%m-%d') + if input_data.tzinfo is not None: + tzoff = input_data.tzinfo.utcoffset(input_data) + if tzoff is not None: + total_seconds = tzoff.seconds + (86400 * tzoff.days) + if total_seconds == 0: + _svalue += 'Z' + else: + if total_seconds < 0: + _svalue += '-' + total_seconds *= -1 + else: + _svalue += '+' + hours = total_seconds // 3600 + minutes = (total_seconds - (hours * 3600)) // 60 + _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) + return _svalue + + def gds_parse_date(self, input_data, node, input_name=''): + tz = None + if input_data[-1] == 'Z': + tz = _FixedOffsetTZ(0, 'GMT') + input_data = input_data[:-1] + else: + results = _tzoff_pattern.search(input_data) + if results is not None: + tzoff_parts = results.group(2).split(':') + tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) + if results.group(1) == '-': + tzoff *= -1 + tz = _FixedOffsetTZ(tzoff, results.group(0)) + input_data = input_data[:-6] + return datetime.strptime(input_data, '%Y-%m-%d').replace(tzinfo = tz) + + def gds_str_lower(self, instring): + return instring.lower() + + def get_path_(self, node): + path_list = [] + self.get_path_list_(node, path_list) + path_list.reverse() + path = '/'.join(path_list) + return path + + def get_path_list_(self, node, path_list): + if node is None: + return + tag = _Tag_strip_pattern_.sub('', node.tag) + if tag: + path_list.append(tag) + self.get_path_list_(node.getparent(), path_list) + + def get_class_obj_(self, node, default_class=None): + class_obj1 = default_class + if 'xsi' in node.nsmap: + classname = node.get('{%s}type' % node.nsmap['xsi']) + if classname is not None: + names = classname.split(':') + if len(names) == 2: + classname = names[1] + class_obj2 = globals().get(classname) + if class_obj2 is not None: + class_obj1 = class_obj2 + return class_obj1 + + def gds_build_any(self, node, type_name=None): + return None + + +def showIndent(lwrite, level, pretty_print=True): + if pretty_print: + lwrite(' ' * level) + + +def quote_xml(text): + if text is None: + return u'' + + # Convert `text` to unicode string. This is mainly a catch-all for non + # string/unicode types like bool and int. + try: + text = unicode(text) + except UnicodeDecodeError: + text = text.decode(ExternalEncoding) + + # If it's a CDATA block, return the text as is. + if text.startswith(CDATA_START): + return text + + # If it's not a CDATA block, escape the XML and return the character + # encoded string. + return saxutils.escape(text) + + +def quote_attrib(text): + if text is None: + return u'""' + + # Convert `text` to unicode string. This is mainly a catch-all for non + # string/unicode types like bool and int. + try: + text = unicode(text) + except UnicodeDecodeError: + text = text.decode(ExternalEncoding) + + # Return the escaped the value of text. + # Note: This wraps the escaped text in quotation marks. + return saxutils.quoteattr(text) + + +def quote_python(inStr): + s1 = inStr + if s1.find("'") == -1: + if s1.find('\n') == -1: + return "'%s'" % s1 + else: + return "'''%s'''" % s1 + else: + if s1.find('"') != -1: + s1 = s1.replace('"', '\\"') + if s1.find('\n') == -1: + return '"%s"' % s1 + else: + return '"""%s"""' % s1 + + +def get_all_text_(node): + if node.text is not None: + text = node.text + else: + text = '' + for child in node: + if child.tail is not None: + text += child.tail + return text + + +def find_attr_value_(attr_name, node): + attrs = node.attrib + attr_parts = attr_name.split(':') + value = None + if len(attr_parts) == 1: + value = attrs.get(attr_name) + elif len(attr_parts) == 2: + prefix, name = attr_parts + namespace = node.nsmap.get(prefix) + if namespace is not None: + value = attrs.get('{%s}%s' % (namespace, name, )) + return value + + +class GDSParseError(Exception): + pass + + +def raise_parse_error(node, msg): + msg = '%s (element %s/line %d)' % (msg, node.tag, node.sourceline, ) + raise GDSParseError(msg) + + +def _cast(typ, value): + if typ is None or value is None: + return value + return typ(value) + + +__all__ = [ + '_cast', + 'etree_', + 'ExternalEncoding', + 'find_attr_value_', + 'get_all_text_', + 'parsexml_', + 'quote_xml', + 'quote_attrib', + 'quote_python', + 'raise_parse_error', + 'showIndent', + 'Tag_pattern_', + 'GeneratedsSuper', +] \ No newline at end of file From 2c232a8b290676ea556a1765751acd4b4a15fef0 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 16 Dec 2014 09:48:41 -0500 Subject: [PATCH 145/297] Removed all .encode(ExternalEncoding) calls in exportAttributes and exportChildren --- maec/bindings/maec_bundle.py | 56 ++++++------- maec/bindings/maec_package.py | 44 +++++----- maec/bindings/mmdef_1_2.py | 154 +++++++++++++++++----------------- 3 files changed, 127 insertions(+), 127 deletions(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index e082ee2..b7adc60 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -102,7 +102,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' status=%s' % (quote_attrib(self.status), )) if self.duration is not None and 'duration' not in already_processed: already_processed.add('duration') - write(' duration=%s' % (self.gds_format_string(quote_attrib(self.duration).encode(ExternalEncoding), input_name='duration'), )) + write(' duration=%s' % (quote_attrib(self.duration).encode(ExternalEncoding))) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) @@ -118,7 +118,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior self.Purpose.export(write, level, 'maecBundle:', name_='Purpose', pretty_print=pretty_print) if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) if self.Discovery_Method is not None: self.Discovery_Method.export(write, level, 'maecBundle:', name_='Discovery_Method', pretty_print=pretty_print) if self.Action_Composition is not None: @@ -341,7 +341,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' id=%s' % (quote_attrib(self.id), )) if self.schema_version is not None and 'schema_version' not in already_processed: already_processed.add('schema_version') - write(' schema_version=%s' % (self.gds_format_string(quote_attrib(self.schema_version).encode(ExternalEncoding), input_name='schema_version'), )) + write(' schema_version=%s' % (quote_attrib(self.schema_version))) if self.timestamp is not None and 'timestamp' not in already_processed: already_processed.add('timestamp') write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) @@ -565,10 +565,10 @@ def export(self, write, level, namespace_='maecBundle:', name_='APICallType', na def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='APICallType'): if self.normalized_function_name is not None and 'normalized_function_name' not in already_processed: already_processed.add('normalized_function_name') - write(' normalized_function_name=%s' % (self.gds_format_string(quote_attrib(self.normalized_function_name).encode(ExternalEncoding), input_name='normalized_function_name'), )) + write(' normalized_function_name=%s' % (quote_attrib(self.normalized_function_name))) if self.function_name is not None and 'function_name' not in already_processed: already_processed.add('function_name') - write(' function_name=%s' % (self.gds_format_string(quote_attrib(self.function_name).encode(ExternalEncoding), input_name='function_name'), )) + write(' function_name=%s' % (quote_attrib(self.function_name))) def exportChildren(self, write, level, namespace_='maecBundle:', name_='APICallType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' @@ -576,10 +576,10 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='APICallT eol_ = '' if self.Address is not None: showIndent(write, level, pretty_print) - write('<%sAddress>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Address).encode(ExternalEncoding), input_name='Address'), 'maecBundle:', eol_)) + write('<%sAddress>%s%s' % ('maecBundle:', quote_xml(self.Address), 'maecBundle:', eol_)) if self.Return_Value is not None: showIndent(write, level, pretty_print) - write('<%sReturn_Value>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Return_Value).encode(ExternalEncoding), input_name='Return_Value'), 'maecBundle:', eol_)) + write('<%sReturn_Value>%s%s' % ('maecBundle:', quote_xml(self.Return_Value), 'maecBundle:', eol_)) if self.Parameters is not None: self.Parameters.export(write, level, 'maecBundle:', name_='Parameters', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='APICallType'): @@ -832,7 +832,7 @@ def export(self, write, level, namespace_='maecBundle:', name_='CVEVulnerability def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CVEVulnerabilityType'): if self.cve_id is not None and 'cve_id' not in already_processed: already_processed.add('cve_id') - write(' cve_id=%s' % (self.gds_format_string(quote_attrib(self.cve_id).encode(ExternalEncoding), input_name='cve_id'), )) + write(' cve_id=%s' % (quote_attrib(self.cve_id))) def exportChildren(self, write, level, namespace_='maecBundle:', name_='CVEVulnerabilityType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' @@ -840,7 +840,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='CVEVulne eol_ = '' if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def exportLiteral(self, write, level, name_='CVEVulnerabilityType'): level += 1 already_processed = set() @@ -929,7 +929,7 @@ def export(self, write, level, namespace_='maecBundle:', name_='BaseCollectionTy def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='BaseCollectionType'): if self.name is not None and 'name' not in already_processed: already_processed.add('name') - write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) + write(' name=%s' % (quote_attrib(self.name))) if self.extensiontype_ is not None and 'xsi:type' not in already_processed: already_processed.add('xsi:type') write(' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"') @@ -941,13 +941,13 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='BaseColl eol_ = '' if self.Affinity_Type is not None: showIndent(write, level, pretty_print) - write('<%sAffinity_Type>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Type).encode(ExternalEncoding), input_name='Affinity_Type'), 'maecBundle:', eol_)) + write('<%sAffinity_Type>%s%s' % ('maecBundle:', quote_xml(self.Affinity_Type), 'maecBundle:', eol_)) if self.Affinity_Degree is not None: showIndent(write, level, pretty_print) - write('<%sAffinity_Degree>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Affinity_Degree).encode(ExternalEncoding), input_name='Affinity_Degree'), 'maecBundle:', eol_)) + write('<%sAffinity_Degree>%s%s' % ('maecBundle:', quote_xml(self.Affinity_Degree), 'maecBundle:', eol_)) if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def exportLiteral(self, write, level, name_='BaseCollectionType'): level += 1 already_processed = set() @@ -1239,10 +1239,10 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) if self.name is not None and 'name' not in already_processed: already_processed.add('name') - write(' name=%s' % (self.gds_format_string(quote_attrib(self.name).encode(ExternalEncoding), input_name='name'), )) + write(' name=%s' % (quote_attrib(self.name))) if self.value is not None and 'value' not in already_processed: already_processed.add('value') - write(' value=%s' % (self.gds_format_string(quote_attrib(self.value).encode(ExternalEncoding), input_name='value'), )) + write(' value=%s' % (quote_attrib(self.value))) def exportChildren(self, write, level, namespace_='maecBundle:', name_='ParameterType', fromsubclass_=False, pretty_print=True): pass def exportLiteral(self, write, level, name_='ParameterType'): @@ -1518,7 +1518,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) if self.Vulnerability_Exploit is not None: self.Vulnerability_Exploit.export(write, level, 'maecBundle:', name_='Vulnerability_Exploit', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='BehaviorPurposeType'): @@ -1718,7 +1718,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ExploitT self.CVE.export(write, level, 'maecBundle:', name_='CVE', pretty_print=pretty_print) for CWE_ID_ in self.CWE_ID: showIndent(write, level, pretty_print) - write('<%sCWE_ID>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(CWE_ID_).encode(ExternalEncoding), input_name='CWE_ID'), 'maecBundle:', eol_)) + write('<%sCWE_ID>%s%s' % ('maecBundle:', quote_xml(CWE_ID_), 'maecBundle:', eol_)) if self.Targeted_Platforms is not None: self.Targeted_Platforms.export(write, level, 'maecBundle:', name_='Targeted_Platforms', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='ExploitType'): @@ -2882,7 +2882,7 @@ def export(self, write, level, namespace_='maecBundle:', name_='CandidateIndicat def exportAttributes(self, write, level, already_processed, namespace_='maecBundle:', name_='CandidateIndicatorType'): if self.version is not None and 'version' not in already_processed: already_processed.add('version') - write(' version=%s' % (self.gds_format_string(quote_attrib(self.version).encode(ExternalEncoding), input_name='version'), )) + write(' version=%s' % (quote_attrib(self.version))) if self.creation_datetime is not None and 'creation_datetime' not in already_processed: already_processed.add('creation_datetime') write(' creation_datetime="%s"' % self.gds_format_datetime(self.creation_datetime, input_name='creation_datetime')) @@ -2904,10 +2904,10 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat write('<%sNumeric_Importance>%s%s' % ('maecBundle:', self.gds_format_integer(self.Numeric_Importance, input_name='Numeric_Importance'), 'maecBundle:', eol_)) if self.Author is not None: showIndent(write, level, pretty_print) - write('<%sAuthor>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Author).encode(ExternalEncoding), input_name='Author'), 'maecBundle:', eol_)) + write('<%sAuthor>%s%s' % ('maecBundle:', quote_xml(self.Author), 'maecBundle:', eol_)) if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) if self.Malware_Entity is not None: self.Malware_Entity.export(write, level, 'maecBundle:', name_='Malware_Entity', pretty_print=pretty_print) if self.Composition is not None: @@ -3165,10 +3165,10 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareE self.Type.export(write, level, 'maecBundle:', name_='Type', pretty_print=pretty_print) if self.Name is not None: showIndent(write, level, pretty_print) - write('<%sName>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecBundle:', eol_)) + write('<%sName>%s%s' % ('maecBundle:', quote_xml(self.Name), 'maecBundle:', eol_)) if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def exportLiteral(self, write, level, name_='MalwareEntityType'): level += 1 already_processed = set() @@ -4158,13 +4158,13 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassi eol_ = '' if self.Engine_Version is not None: showIndent(write, level, pretty_print) - write('<%sEngine_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Engine_Version).encode(ExternalEncoding), input_name='Engine_Version'), 'maecBundle:', eol_)) + write('<%sEngine_Version>%s%s' % ('maecBundle:', quote_xml(self.Engine_Version), 'maecBundle:', eol_)) if self.Definition_Version is not None: showIndent(write, level, pretty_print) - write('<%sDefinition_Version>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Definition_Version).encode(ExternalEncoding), input_name='Definition_Version'), 'maecBundle:', eol_)) + write('<%sDefinition_Version>%s%s' % ('maecBundle:', quote_xml(self.Definition_Version), 'maecBundle:', eol_)) if self.Classification_Name is not None: showIndent(write, level, pretty_print) - write('<%sClassification_Name>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Classification_Name).encode(ExternalEncoding), input_name='Classification_Name'), 'maecBundle:', eol_)) + write('<%sClassification_Name>%s%s' % ('maecBundle:', quote_xml(self.Classification_Name), 'maecBundle:', eol_)) def exportLiteral(self, write, level, name_='AVClassificationType'): level += 1 already_processed = set() @@ -4729,7 +4729,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior else: eol_ = '' if self.Purpose is not None: - write('<%sPurpose>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Purpose).encode(ExternalEncoding), input_name='Purpose'), 'maecBundle:', eol_)) + write('<%sPurpose>%s%s' % ('maecBundle:', quote_xml(self.Purpose), 'maecBundle:', eol_)) if self.Behavior_List is not None: self.Behavior_List.export(write, level, 'maecBundle:', name_='Behavior_List', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='BehaviorCollectionType'): @@ -5071,7 +5071,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili eol_ = '' if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) for Property_ in self.Property: Property_.export(write, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) for Strategic_Objective_ in self.Strategic_Objective: @@ -5464,7 +5464,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili self.Name.export(write, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) if self.Description is not None: showIndent(write, level, pretty_print) - write('<%sDescription>%s%s' % ('maecBundle:', self.gds_format_string(quote_xml(self.Description).encode(ExternalEncoding), input_name='Description'), 'maecBundle:', eol_)) + write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) for Property_ in self.Property: Property_.export(write, level, 'maecBundle:', name_='Property', pretty_print=pretty_print) for Behavior_Reference_ in self.Behavior_Reference: diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index b1425a0..486b267 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -179,19 +179,19 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='SourceT eol_ = '' if self.Name is not None: showIndent(write, level, pretty_print) - write('<%sName>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Name).encode(ExternalEncoding), input_name='Name'), 'maecPackage:', eol_)) + write('<%sName>%s%s' % ('maecPackage:', quote_xml(self.Name), 'maecPackage:', eol_)) if self.Method is not None: showIndent(write, level, pretty_print) - write('<%sMethod>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Method).encode(ExternalEncoding), input_name='Method'), 'maecPackage:', eol_)) + write('<%sMethod>%s%s' % ('maecPackage:', quote_xml(self.Method), 'maecPackage:', eol_)) if self.Reference is not None: showIndent(write, level, pretty_print) - write('<%sReference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Reference).encode(ExternalEncoding), input_name='Reference'), 'maecPackage:', eol_)) + write('<%sReference>%s%s' % ('maecPackage:', quote_xml(self.Reference), 'maecPackage:', eol_)) if self.Organization is not None: showIndent(write, level, pretty_print) - write('<%sOrganization>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Organization).encode(ExternalEncoding), input_name='Organization'), 'maecPackage:', eol_)) + write('<%sOrganization>%s%s' % ('maecPackage:', quote_xml(self.Organization), 'maecPackage:', eol_)) if self.URL is not None: showIndent(write, level, pretty_print) - write('<%sURL>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.URL).encode(ExternalEncoding), input_name='URL'), 'maecPackage:', eol_)) + write('<%sURL>%s%s' % ('maecPackage:', quote_xml(self.URL), 'maecPackage:', eol_)) def exportLiteral(self, write, level, name_='SourceType'): level += 1 already_processed = set() @@ -563,7 +563,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Dynamic eol_ = '' if self.Command_Line is not None: showIndent(write, level, pretty_print) - write('<%sCommand_Line>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Command_Line).encode(ExternalEncoding), input_name='Command_Line'), 'maecPackage:', eol_)) + write('<%sCommand_Line>%s%s' % ('maecPackage:', quote_xml(self.Command_Line), 'maecPackage:', eol_)) if self.Analysis_Duration is not None: showIndent(write, level, pretty_print) write('<%sAnalysis_Duration>%s%s' % ('maecPackage:', self.gds_format_float(self.Analysis_Duration, input_name='Analysis_Duration'), 'maecPackage:', eol_)) @@ -2177,10 +2177,10 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Groupin self.Type.export(write, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) if self.Malware_Family_Name is not None: showIndent(write, level, pretty_print) - write('<%sMalware_Family_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Family_Name).encode(ExternalEncoding), input_name='Malware_Family_Name'), 'maecPackage:', eol_)) + write('<%sMalware_Family_Name>%s%s' % ('maecPackage:', quote_xml(self.Malware_Family_Name), 'maecPackage:', eol_)) if self.Malware_Toolkit_Name is not None: showIndent(write, level, pretty_print) - write('<%sMalware_Toolkit_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Malware_Toolkit_Name).encode(ExternalEncoding), input_name='Malware_Toolkit_Name'), 'maecPackage:', eol_)) + write('<%sMalware_Toolkit_Name>%s%s' % ('maecPackage:', quote_xml(self.Malware_Toolkit_Name), 'maecPackage:', eol_)) if self.Clustering_Metadata is not None: self.Clustering_Metadata.export(write, level, 'maecPackage:', name_='Clustering_Metadata', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='GroupingRelationshipType'): @@ -2387,10 +2387,10 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster eol_ = '' if self.Algorithm_Name is not None: showIndent(write, level, pretty_print) - write('<%sAlgorithm_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Name).encode(ExternalEncoding), input_name='Algorithm_Name'), 'maecPackage:', eol_)) + write('<%sAlgorithm_Name>%s%s' % ('maecPackage:', quote_xml(self.Algorithm_Name), 'maecPackage:', eol_)) if self.Algorithm_Version is not None: showIndent(write, level, pretty_print) - write('<%sAlgorithm_Version>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Algorithm_Version).encode(ExternalEncoding), input_name='Algorithm_Version'), 'maecPackage:', eol_)) + write('<%sAlgorithm_Version>%s%s' % ('maecPackage:', quote_xml(self.Algorithm_Version), 'maecPackage:', eol_)) if self.Algorithm_Parameters is not None: self.Algorithm_Parameters.export(write, level, 'maecPackage:', name_='Algorithm_Parameters', pretty_print=pretty_print) if self.Cluster_Size is not None: @@ -2398,7 +2398,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster write('<%sCluster_Size>%s%s' % ('maecPackage:', self.gds_format_integer(self.Cluster_Size, input_name='Cluster_Size'), 'maecPackage:', eol_)) if self.Cluster_Description is not None: showIndent(write, level, pretty_print) - write('<%sCluster_Description>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Cluster_Description).encode(ExternalEncoding), input_name='Cluster_Description'), 'maecPackage:', eol_)) + write('<%sCluster_Description>%s%s' % ('maecPackage:', quote_xml(self.Cluster_Description), 'maecPackage:', eol_)) if self.Cluster_Composition is not None: self.Cluster_Composition.export(write, level, 'maecPackage:', name_='Cluster_Composition', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='ClusteringMetadataType'): @@ -2655,7 +2655,7 @@ def export(self, write, level, namespace_='maecPackage:', name_='ClusterComposit def exportAttributes(self, write, level, already_processed, namespace_='maecPackage:', name_='ClusterCompositionType'): if self.score_type is not None and 'score_type' not in already_processed: already_processed.add('score_type') - write(' score_type=%s' % (self.gds_format_string(quote_attrib(self.score_type).encode(ExternalEncoding), input_name='score_type'), )) + write(' score_type=%s' % (quote_attrib(self.score_type))) def exportChildren(self, write, level, namespace_='maecPackage:', name_='ClusterCompositionType', fromsubclass_=False, pretty_print=True): if pretty_print: eol_ = '\n' @@ -3661,7 +3661,7 @@ def export(self, write, level, namespace_='maecPackage:', name_='CommentType', n self.exportAttributes(write, level, already_processed, namespace_, name_='CommentType') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_, pretty_print=pretty_print) write('%s' % (namespace_, name_, eol_)) else: @@ -3673,10 +3673,10 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack write(' timestamp="%s"' % self.gds_format_datetime(self.timestamp, input_name='timestamp')) if self.author is not None and 'author' not in already_processed: already_processed.add('author') - write(' author=%s' % (self.gds_format_string(quote_attrib(self.author).encode(ExternalEncoding), input_name='author'), )) + write(' author=%s' % (quote_attrib(self.author))) if self.observation_name is not None and 'observation_name' not in already_processed: already_processed.add('observation_name') - write(' observation_name=%s' % (self.gds_format_string(quote_attrib(self.observation_name).encode(ExternalEncoding), input_name='observation_name'), )) + write(' observation_name=%s' % (quote_attrib(self.observation_name))) def exportChildren(self, write, level, namespace_='maecPackage:', name_='CommentType', fromsubclass_=False, pretty_print=True): super(CommentType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) pass @@ -3796,10 +3796,10 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' if self.Exception_Code is not None: showIndent(write, level, pretty_print) - write('<%sException_Code>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Exception_Code).encode(ExternalEncoding), input_name='Exception_Code'), namespace_, eol_)) + write('<%sException_Code>%s%s' % (namespace_, quote_xml(self.Exception_Code), namespace_, eol_)) if self.Faulting_Address is not None: showIndent(write, level, pretty_print) - write('<%sFaulting_Address>%s%s' % (namespace_, self.gds_format_string(quote_xml(self.Faulting_Address).encode(ExternalEncoding), input_name='Faulting_Address'), namespace_, eol_)) + write('<%sFaulting_Address>%s%s' % (namespace_, quote_xml(self.Faulting_Address), namespace_, eol_)) if self.Description is not None: showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % (namespace_, self.gds_format_integer(self.Description, input_name='Description'), namespace_, eol_)) @@ -4014,7 +4014,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.Name.export(write, level, 'maecPackage:', name_='Name', pretty_print=pretty_print) if self.Value is not None: showIndent(write, level, pretty_print) - write('<%sValue>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Value).encode(ExternalEncoding), input_name='Value'), 'maecPackage:', eol_)) + write('<%sValue>%s%s' % ('maecPackage:', quote_xml(self.Value), 'maecPackage:', eol_)) def exportLiteral(self, write, level, name_='MalwareConfigurationParameterType'): level += 1 already_processed = set() @@ -4352,7 +4352,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' if self.Key is not None: showIndent(write, level, pretty_print) - write('<%sKey>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Key).encode(ExternalEncoding), input_name='Key'), 'maecPackage:', eol_)) + write('<%sKey>%s%s' % ('maecPackage:', quote_xml(self.Key), 'maecPackage:', eol_)) if self.Algorithm_Name is not None: self.Algorithm_Name.export(write, level, 'maecPackage:', name_='Algorithm_Name', pretty_print=pretty_print) def exportLiteral(self, write, level, name_='MalwareConfigurationObfuscationAlgorithmType'): @@ -4572,13 +4572,13 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' if self.File_Offset is not None: showIndent(write, level, pretty_print) - write('<%sFile_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.File_Offset).encode(ExternalEncoding), input_name='File_Offset'), 'maecPackage:', eol_)) + write('<%sFile_Offset>%s%s' % ('maecPackage:', quote_xml(self.File_Offset), 'maecPackage:', eol_)) if self.Section_Name is not None: showIndent(write, level, pretty_print) - write('<%sSection_Name>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Name).encode(ExternalEncoding), input_name='Section_Name'), 'maecPackage:', eol_)) + write('<%sSection_Name>%s%s' % ('maecPackage:', quote_xml(self.Section_Name), 'maecPackage:', eol_)) if self.Section_Offset is not None: showIndent(write, level, pretty_print) - write('<%sSection_Offset>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(self.Section_Offset).encode(ExternalEncoding), input_name='Section_Offset'), 'maecPackage:', eol_)) + write('<%sSection_Offset>%s%s' % ('maecPackage:', quote_xml(self.Section_Offset), 'maecPackage:', eol_)) def exportLiteral(self, write, level, name_='MalwareBinaryConfigurationStorageDetailsType'): level += 1 already_processed = set() diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index b5caa08..62e0aed 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -142,20 +142,20 @@ def exportAttributes(self, write, level, already_processed, namespace_='', name_ write(' version="%s"' % self.gds_format_float(self.version, input_name='version')) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='malwareMetaData', fromsubclass_=False): if self.company is not None: showIndent(write, level) - write('<%scompany>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.company).encode(ExternalEncoding), input_name='company'), namespace_)) + write('<%scompany>%s\n' % (namespace_, quote_xml(self.company), namespace_)) if self.author is not None: showIndent(write, level) - write('<%sauthor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.author).encode(ExternalEncoding), input_name='author'), namespace_)) + write('<%sauthor>%s\n' % (namespace_, quote_xml(self.author), namespace_)) if self.comment is not None: showIndent(write, level) - write('<%scomment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.comment).encode(ExternalEncoding), input_name='comment'), namespace_)) + write('<%scomment>%s\n' % (namespace_, quote_xml(self.comment), namespace_)) if self.timestamp is not None: showIndent(write, level) - write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + write('<%stimestamp>%s\n' % (namespace_, quote_xml(self.timestamp), namespace_)) if self.objects is not None: self.objects.export(write, level, namespace_, name_='objects') if self.objectProperties is not None: @@ -1051,71 +1051,71 @@ def exportChildren(self, write, level, namespace_='', name_='fileObject', fromsu write('<%ssize>%s\n' % (namespace_, self.gds_format_integer(self.size, input_name='size'), namespace_)) if self.crc32 is not None: showIndent(write, level) - write('<%scrc32>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.crc32).encode(ExternalEncoding), input_name='crc32'), namespace_)) + write('<%scrc32>%s\n' % (namespace_, quote_xml(self.crc32), namespace_)) for fileType_ in self.fileType: showIndent(write, level) - write('<%sfileType>%s\n' % (namespace_, self.gds_format_string(quote_xml(fileType_).encode(ExternalEncoding), input_name='fileType'), namespace_)) + write('<%sfileType>%s\n' % (namespace_, quote_xml(fileType_), namespace_)) for extraHash_ in self.extraHash: extraHash_.export(write, level, namespace_, name_='extraHash') for filename_ in self.filename: showIndent(write, level) - write('<%sfilename>%s\n' % (namespace_, self.gds_format_string(quote_xml(filename_).encode(ExternalEncoding), input_name='filename'), namespace_)) + write('<%sfilename>%s\n' % (namespace_, quote_xml(filename_), namespace_)) for normalizedNativePath_ in self.normalizedNativePath: showIndent(write, level) - write('<%snormalizedNativePath>%s\n' % (namespace_, self.gds_format_string(quote_xml(normalizedNativePath_).encode(ExternalEncoding), input_name='normalizedNativePath'), namespace_)) + write('<%snormalizedNativePath>%s\n' % (namespace_, quote_xml(normalizedNativePath_), namespace_)) for filenameWithinInstaller_ in self.filenameWithinInstaller: showIndent(write, level) - write('<%sfilenameWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(filenameWithinInstaller_).encode(ExternalEncoding), input_name='filenameWithinInstaller'), namespace_)) + write('<%sfilenameWithinInstaller>%s\n' % (namespace_, quote_xml(filenameWithinInstaller_), namespace_)) for folderWithinInstaller_ in self.folderWithinInstaller: showIndent(write, level) - write('<%sfolderWithinInstaller>%s\n' % (namespace_, self.gds_format_string(quote_xml(folderWithinInstaller_).encode(ExternalEncoding), input_name='folderWithinInstaller'), namespace_)) + write('<%sfolderWithinInstaller>%s\n' % (namespace_, quote_xml(folderWithinInstaller_), namespace_)) if self.vendor is not None: showIndent(write, level) - write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) + write('<%svendor>%s\n' % (namespace_, quote_xml(self.vendor), namespace_)) for internalName_ in self.internalName: showIndent(write, level) - write('<%sinternalName>%s\n' % (namespace_, self.gds_format_string(quote_xml(internalName_).encode(ExternalEncoding), input_name='internalName'), namespace_)) + write('<%sinternalName>%s\n' % (namespace_, quote_xml(internalName_), namespace_)) for language_ in self.language: showIndent(write, level) - write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(language_).encode(ExternalEncoding), input_name='language'), namespace_)) + write('<%slanguage>%s\n' % (namespace_, quote_xml(language_), namespace_)) if self.productName is not None: showIndent(write, level) - write('<%sproductName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productName).encode(ExternalEncoding), input_name='productName'), namespace_)) + write('<%sproductName>%s\n' % (namespace_, quote_xml(self.productName), namespace_)) if self.fileVersion is not None: showIndent(write, level) - write('<%sfileVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.fileVersion).encode(ExternalEncoding), input_name='fileVersion'), namespace_)) + write('<%sfileVersion>%s\n' % (namespace_, quote_xml(self.fileVersion), namespace_)) if self.productVersion is not None: showIndent(write, level) - write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) + write('<%sproductVersion>%s\n' % (namespace_, quote_xml(self.productVersion), namespace_)) if self.developmentEnvironment is not None: showIndent(write, level) - write('<%sdevelopmentEnvironment>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.developmentEnvironment).encode(ExternalEncoding), input_name='developmentEnvironment'), namespace_)) + write('<%sdevelopmentEnvironment>%s\n' % (namespace_, quote_xml(self.developmentEnvironment), namespace_)) if self.checksum is not None: self.checksum.export(write, level, namespace_, name_='checksum') if self.architecture is not None: showIndent(write, level) - write('<%sarchitecture>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.architecture).encode(ExternalEncoding), input_name='architecture'), namespace_)) + write('<%sarchitecture>%s\n' % (namespace_, quote_xml(self.architecture), namespace_)) if self.buildTimeDateStamp is not None: showIndent(write, level) - write('<%sbuildTimeDateStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.buildTimeDateStamp).encode(ExternalEncoding), input_name='buildTimeDateStamp'), namespace_)) + write('<%sbuildTimeDateStamp>%s\n' % (namespace_, quote_xml(self.buildTimeDateStamp), namespace_)) if self.compilerVersion is not None: showIndent(write, level) - write('<%scompilerVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.compilerVersion).encode(ExternalEncoding), input_name='compilerVersion'), namespace_)) + write('<%scompilerVersion>%s\n' % (namespace_, quote_xml(self.compilerVersion), namespace_)) if self.linkerVersion is not None: showIndent(write, level) write('<%slinkerVersion>%s\n' % (namespace_, self.gds_format_float(self.linkerVersion, input_name='linkerVersion'), namespace_)) if self.minOSVersionCPE is not None: showIndent(write, level) - write('<%sminOSVersionCPE>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.minOSVersionCPE).encode(ExternalEncoding), input_name='minOSVersionCPE'), namespace_)) + write('<%sminOSVersionCPE>%s\n' % (namespace_, quote_xml(self.minOSVersionCPE), namespace_)) if self.numberOfSections is not None: showIndent(write, level) write('<%snumberOfSections>%s\n' % (namespace_, self.gds_format_integer(self.numberOfSections, input_name='numberOfSections'), namespace_)) if self.MIMEType is not None: showIndent(write, level) - write('<%sMIMEType>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.MIMEType).encode(ExternalEncoding), input_name='MIMEType'), namespace_)) + write('<%sMIMEType>%s\n' % (namespace_, quote_xml(self.MIMEType), namespace_)) if self.requiredPrivilege is not None: showIndent(write, level) - write('<%srequiredPrivilege>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.requiredPrivilege).encode(ExternalEncoding), input_name='requiredPrivilege'), namespace_)) + write('<%srequiredPrivilege>%s\n' % (namespace_, quote_xml(self.requiredPrivilege), namespace_)) if self.digitalSignature is not None: self.digitalSignature.export(write, level, namespace_, name_='digitalSignature') if self.taggant is not None: @@ -1501,7 +1501,7 @@ def export(self, write, level, namespace_='', name_='extraHash', namespacedef_=' self.exportAttributes(write, level, already_processed, namespace_, name_='extraHash') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -1509,7 +1509,7 @@ def export(self, write, level, namespace_='', name_='extraHash', namespacedef_=' def exportAttributes(self, write, level, already_processed, namespace_='', name_='extraHash'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) + write(' type=%s' % (quote_attrib(self.type_))) def exportChildren(self, write, level, namespace_='', name_='extraHash', fromsubclass_=False): pass def hasContent_(self): @@ -1589,14 +1589,14 @@ def export(self, write, level, namespace_='', name_='registryObject', namespaced def exportAttributes(self, write, level, already_processed, namespace_='', name_='registryObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='registryObject', fromsubclass_=False): if self.key is not None: showIndent(write, level) - write('<%skey>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.key).encode(ExternalEncoding), input_name='key'), namespace_)) + write('<%skey>%s\n' % (namespace_, quote_xml(self.key), namespace_)) if self.valueName is not None: showIndent(write, level) - write('<%svalueName>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.valueName).encode(ExternalEncoding), input_name='valueName'), namespace_)) + write('<%svalueName>%s\n' % (namespace_, quote_xml(self.valueName), namespace_)) def hasContent_(self): if ( self.key is not None or @@ -1680,11 +1680,11 @@ def export(self, write, level, namespace_='', name_='entityObject', namespacedef def exportAttributes(self, write, level, already_processed, namespace_='', name_='entityObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='entityObject', fromsubclass_=False): if self.name is not None: showIndent(write, level) - write('<%sname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.name).encode(ExternalEncoding), input_name='name'), namespace_)) + write('<%sname>%s\n' % (namespace_, quote_xml(self.name), namespace_)) def hasContent_(self): if ( self.name is not None @@ -1789,25 +1789,25 @@ def exportAttributes(self, write, level, already_processed, namespace_='', name_ def exportChildren(self, write, level, namespace_='', name_='uriObject', fromsubclass_=False): if self.uriString is not None: showIndent(write, level) - write('<%suriString>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.uriString).encode(ExternalEncoding), input_name='uriString'), namespace_)) + write('<%suriString>%s\n' % (namespace_, quote_xml(self.uriString), namespace_)) if self.protocol is not None: showIndent(write, level) - write('<%sprotocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.protocol).encode(ExternalEncoding), input_name='protocol'), namespace_)) + write('<%sprotocol>%s\n' % (namespace_, quote_xml(self.protocol), namespace_)) if self.hostname is not None: showIndent(write, level) - write('<%shostname>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.hostname).encode(ExternalEncoding), input_name='hostname'), namespace_)) + write('<%shostname>%s\n' % (namespace_, quote_xml(self.hostname), namespace_)) if self.domain is not None: showIndent(write, level) - write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) + write('<%sdomain>%s\n' % (namespace_, quote_xml(self.domain), namespace_)) if self.port is not None: showIndent(write, level) write('<%sport>%s\n' % (namespace_, self.gds_format_integer(self.port, input_name='port'), namespace_)) if self.path is not None: showIndent(write, level) - write('<%spath>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.path).encode(ExternalEncoding), input_name='path'), namespace_)) + write('<%spath>%s\n' % (namespace_, quote_xml(self.path), namespace_)) if self.ipProtocol is not None: showIndent(write, level) - write('<%sipProtocol>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.ipProtocol).encode(ExternalEncoding), input_name='ipProtocol'), namespace_)) + write('<%sipProtocol>%s\n' % (namespace_, quote_xml(self.ipProtocol), namespace_)) def hasContent_(self): if ( self.uriString is not None or @@ -2032,7 +2032,7 @@ def export(self, write, level, namespace_='', name_='IPAddress', namespacedef_=' self.exportAttributes(write, level, already_processed, namespace_, name_='IPAddress') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -2115,11 +2115,11 @@ def export(self, write, level, namespace_='', name_='domainObject', namespacedef def exportAttributes(self, write, level, already_processed, namespace_='', name_='domainObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='domainObject', fromsubclass_=False): if self.domain is not None: showIndent(write, level) - write('<%sdomain>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.domain).encode(ExternalEncoding), input_name='domain'), namespace_)) + write('<%sdomain>%s\n' % (namespace_, quote_xml(self.domain), namespace_)) def hasContent_(self): if ( self.domain is not None @@ -2306,17 +2306,17 @@ def exportAttributes(self, write, level, already_processed, namespace_='', name_ write(' type=%s' % (quote_attrib(self.type_), )) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='classificationObject', fromsubclass_=False): if self.classificationName is not None: showIndent(write, level) - write('<%sclassificationName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.classificationName).encode(ExternalEncoding), input_name='classificationName'), 'mmdef:')) + write('<%sclassificationName>%s\n' % ('mmdef:', quote_xml(self.classificationName), 'mmdef:')) if self.companyName is not None: showIndent(write, level) - write('<%scompanyName>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.companyName).encode(ExternalEncoding), input_name='companyName'), 'mmdef:')) + write('<%scompanyName>%s\n' % ('mmdef:', quote_xml(self.companyName), 'mmdef:')) if self.category is not None: showIndent(write, level) - write('<%scategory>%s\n' % ('mmdef:', self.gds_format_string(quote_xml(self.category).encode(ExternalEncoding), input_name='category'), 'mmdef:')) + write('<%scategory>%s\n' % ('mmdef:', quote_xml(self.category), 'mmdef:')) if self.classificationDetails is not None: self.classificationDetails.export(write, level, namespace_, name_='classificationDetails') def hasContent_(self): @@ -2438,19 +2438,19 @@ def exportAttributes(self, write, level, already_processed, namespace_='', name_ def exportChildren(self, write, level, namespace_='', name_='classificationDetails', fromsubclass_=False): if self.definitionVersion is not None: showIndent(write, level) - write('<%sdefinitionVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.definitionVersion).encode(ExternalEncoding), input_name='definitionVersion'), namespace_)) + write('<%sdefinitionVersion>%s\n' % (namespace_, quote_xml(self.definitionVersion), namespace_)) if self.detectionAddedTimeStamp is not None: showIndent(write, level) - write('<%sdetectionAddedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionAddedTimeStamp).encode(ExternalEncoding), input_name='detectionAddedTimeStamp'), namespace_)) + write('<%sdetectionAddedTimeStamp>%s\n' % (namespace_, quote_xml(self.detectionAddedTimeStamp), namespace_)) if self.detectionShippedTimeStamp is not None: showIndent(write, level) - write('<%sdetectionShippedTimeStamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.detectionShippedTimeStamp).encode(ExternalEncoding), input_name='detectionShippedTimeStamp'), namespace_)) + write('<%sdetectionShippedTimeStamp>%s\n' % (namespace_, quote_xml(self.detectionShippedTimeStamp), namespace_)) if self.product is not None: showIndent(write, level) - write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) + write('<%sproduct>%s\n' % (namespace_, quote_xml(self.product), namespace_)) if self.productVersion is not None: showIndent(write, level) - write('<%sproductVersion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productVersion).encode(ExternalEncoding), input_name='productVersion'), namespace_)) + write('<%sproductVersion>%s\n' % (namespace_, quote_xml(self.productVersion), namespace_)) def hasContent_(self): if ( self.definitionVersion is not None or @@ -2634,16 +2634,16 @@ def exportChildren(self, write, level, namespace_='', name_='fieldDataEntry', fr self.references.export(write, level, namespace_, name_='references', ) if self.startDate is not None: showIndent(write, level) - write('<%sstartDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.startDate).encode(ExternalEncoding), input_name='startDate'), namespace_)) + write('<%sstartDate>%s\n' % (namespace_, quote_xml(self.startDate), namespace_)) if self.endDate is not None: showIndent(write, level) - write('<%sendDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.endDate).encode(ExternalEncoding), input_name='endDate'), namespace_)) + write('<%sendDate>%s\n' % (namespace_, quote_xml(self.endDate), namespace_)) if self.firstSeenDate is not None: showIndent(write, level) - write('<%sfirstSeenDate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.firstSeenDate).encode(ExternalEncoding), input_name='firstSeenDate'), namespace_)) + write('<%sfirstSeenDate>%s\n' % (namespace_, quote_xml(self.firstSeenDate), namespace_)) if self.origin is not None: showIndent(write, level) - write('<%sorigin>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.origin).encode(ExternalEncoding), input_name='origin'), namespace_)) + write('<%sorigin>%s\n' % (namespace_, quote_xml(self.origin), namespace_)) if self.commonality is not None: showIndent(write, level) write('<%scommonality>%s\n' % (namespace_, self.gds_format_integer(self.commonality, input_name='commonality'), namespace_)) @@ -2882,7 +2882,7 @@ def export(self, write, level, namespace_='', name_='volume', namespacedef_=''): self.exportAttributes(write, level, already_processed, namespace_, name_='volume') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -2958,7 +2958,7 @@ def export(self, write, level, namespace_='', name_='location', namespacedef_='' self.exportAttributes(write, level, already_processed, namespace_, name_='location') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -3029,7 +3029,7 @@ def export(self, write, level, namespace_='', name_='reference', namespacedef_=' self.exportAttributes(write, level, already_processed, namespace_, name_='reference') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -3096,7 +3096,7 @@ def export(self, write, level, namespace_='', name_='property', namespacedef_='' self.exportAttributes(write, level, already_processed, namespace_, name_='property') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -3202,7 +3202,7 @@ def exportChildren(self, write, level, namespace_='', name_='objectProperty', fr self.references.export(write, level, namespace_, name_='references', ) if self.timestamp is not None: showIndent(write, level) - write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + write('<%stimestamp>%s\n' % (namespace_, quote_xml(self.timestamp), namespace_)) for property_ in self.property: property_.export(write, level, namespace_, name_='property') def hasContent_(self): @@ -3340,7 +3340,7 @@ def exportChildren(self, write, level, namespace_='', name_='relationship', from self.target.export(write, level, namespace_, name_='target', ) if self.timestamp is not None: showIndent(write, level) - write('<%stimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.timestamp).encode(ExternalEncoding), input_name='timestamp'), namespace_)) + write('<%stimestamp>%s\n' % (namespace_, quote_xml(self.timestamp), namespace_)) def hasContent_(self): if ( self.source is not None or @@ -3622,29 +3622,29 @@ def export(self, write, level, namespace_='', name_='softwarePackageObject', nam def exportAttributes(self, write, level, already_processed, namespace_='', name_='softwarePackageObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='softwarePackageObject', fromsubclass_=False): if self.vendor is not None: showIndent(write, level) - write('<%svendor>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendor).encode(ExternalEncoding), input_name='vendor'), namespace_)) + write('<%svendor>%s\n' % (namespace_, quote_xml(self.vendor), namespace_)) if self.productgroup is not None: showIndent(write, level) - write('<%sproductgroup>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.productgroup).encode(ExternalEncoding), input_name='productgroup'), namespace_)) + write('<%sproductgroup>%s\n' % (namespace_, quote_xml(self.productgroup), namespace_)) if self.product is not None: showIndent(write, level) - write('<%sproduct>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.product).encode(ExternalEncoding), input_name='product'), namespace_)) + write('<%sproduct>%s\n' % (namespace_, quote_xml(self.product), namespace_)) if self.version is not None: showIndent(write, level) - write('<%sversion>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.version).encode(ExternalEncoding), input_name='version'), namespace_)) + write('<%sversion>%s\n' % (namespace_, quote_xml(self.version), namespace_)) if self.update is not None: showIndent(write, level) - write('<%supdate>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.update).encode(ExternalEncoding), input_name='update'), namespace_)) + write('<%supdate>%s\n' % (namespace_, quote_xml(self.update), namespace_)) if self.edition is not None: showIndent(write, level) - write('<%sedition>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.edition).encode(ExternalEncoding), input_name='edition'), namespace_)) + write('<%sedition>%s\n' % (namespace_, quote_xml(self.edition), namespace_)) if self.language is not None: showIndent(write, level) - write('<%slanguage>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.language).encode(ExternalEncoding), input_name='language'), namespace_)) + write('<%slanguage>%s\n' % (namespace_, quote_xml(self.language), namespace_)) if self.CPEname is not None: self.CPEname.export(write, level, namespace_, name_='CPEname') def hasContent_(self): @@ -3774,7 +3774,7 @@ def export(self, write, level, namespace_='', name_='CPEname', namespacedef_='') self.exportAttributes(write, level, already_processed, namespace_, name_='CPEname') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -3782,7 +3782,7 @@ def export(self, write, level, namespace_='', name_='CPEname', namespacedef_='') def exportAttributes(self, write, level, already_processed, namespace_='', name_='CPEname'): if self.cpeVersion is not None and 'cpeVersion' not in already_processed: already_processed.append('cpeVersion') - write(' cpeVersion=%s' % (self.gds_format_string(quote_attrib(self.cpeVersion).encode(ExternalEncoding), input_name='cpeVersion'), )) + write(' cpeVersion=%s' % (quote_attrib(self.cpeVersion))) def exportChildren(self, write, level, namespace_='', name_='CPEname', fromsubclass_=False): pass def hasContent_(self): @@ -3871,23 +3871,23 @@ def export(self, write, level, namespace_='', name_='digitalSignatureObject', na def exportAttributes(self, write, level, already_processed, namespace_='', name_='digitalSignatureObject'): if self.type_ is not None and 'type_' not in already_processed: already_processed.append('type_') - write(' type=%s' % (self.gds_format_string(quote_attrib(self.type_).encode(ExternalEncoding), input_name='type'), )) + write(' type=%s' % (quote_attrib(self.type_))) if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='digitalSignatureObject', fromsubclass_=False): if self.certificateIssuer is not None: showIndent(write, level) - write('<%scertificateIssuer>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateIssuer).encode(ExternalEncoding), input_name='certificateIssuer'), namespace_)) + write('<%scertificateIssuer>%s\n' % (namespace_, quote_xml(self.certificateIssuer), namespace_)) if self.certificateSubject is not None: showIndent(write, level) - write('<%scertificateSubject>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateSubject).encode(ExternalEncoding), input_name='certificateSubject'), namespace_)) + write('<%scertificateSubject>%s\n' % (namespace_, quote_xml(self.certificateSubject), namespace_)) if self.certificateValidity is not None: showIndent(write, level) write('<%scertificateValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.certificateValidity)), input_name='certificateValidity'), namespace_)) if self.certificateRevocationTimestamp is not None: showIndent(write, level) - write('<%scertificateRevocationTimestamp>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.certificateRevocationTimestamp).encode(ExternalEncoding), input_name='certificateRevocationTimestamp'), namespace_)) + write('<%scertificateRevocationTimestamp>%s\n' % (namespace_, quote_xml(self.certificateRevocationTimestamp), namespace_)) if self.signingTimestamp is not None: self.signingTimestamp.export(write, level, namespace_, name_='signingTimestamp') def hasContent_(self): @@ -4001,7 +4001,7 @@ def export(self, write, level, namespace_='', name_='signingTimestamp', namespac self.exportAttributes(write, level, already_processed, namespace_, name_='signingTimestamp') if self.hasContent_(): write('>') - write(str(self.valueOf_).encode(ExternalEncoding)) + write(quote_xml(self.valueOf_)) self.exportChildren(write, level + 1, namespace_, name_) write('\n' % (namespace_, name_)) else: @@ -4096,11 +4096,11 @@ def export(self, write, level, namespace_='', name_='taggantObject', namespacede def exportAttributes(self, write, level, already_processed, namespace_='', name_='taggantObject'): if self.id is not None and 'id' not in already_processed: already_processed.append('id') - write(' id=%s' % (self.gds_format_string(quote_attrib(self.id).encode(ExternalEncoding), input_name='id'), )) + write(' id=%s' % (quote_attrib(self.id))) def exportChildren(self, write, level, namespace_='', name_='taggantObject', fromsubclass_=False): if self.vendorID is not None: showIndent(write, level) - write('<%svendorID>%s\n' % (namespace_, self.gds_format_string(quote_xml(self.vendorID).encode(ExternalEncoding), input_name='vendorID'), namespace_)) + write('<%svendorID>%s\n' % (namespace_, quote_xml(self.vendorID), namespace_)) if self.taggantValidity is not None: showIndent(write, level) write('<%staggantValidity>%s\n' % (namespace_, self.gds_format_boolean(self.gds_str_lower(str(self.taggantValidity)), input_name='taggantValidity'), namespace_)) From de9f6f12d12767e50d98361dcaf8da5c95cdcf5f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 16 Dec 2014 11:14:12 -0500 Subject: [PATCH 146/297] Initial commit --- maec/test/encoding_test.py | 176 +++++++++++++++++++++++++++++++++++++ 1 file changed, 176 insertions(+) create mode 100644 maec/test/encoding_test.py diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py new file mode 100644 index 0000000..2d2f377 --- /dev/null +++ b/maec/test/encoding_test.py @@ -0,0 +1,176 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +"""Tests for various encoding issues throughout the library""" + +import unittest +from StringIO import StringIO + +import maec.bindings as bindings +from maec.package.malware_subject import MalwareConfigurationParameter +from maec.package.analysis import DynamicAnalysisMetadata +from maec.package.grouping_relationship import GroupingRelationship +from maec.bundle.bundle import Bundle +from maec.bundle.av_classification import AVClassification +from maec.bundle.behavior import Behavior +from maec.bundle.capability import Capability + +from cybox.test import round_trip + +UNICODE_STR = u"❤ ♎ ☀ ★ ☂ ♞ ☯ ☭ ☢ €☎⚑ ❄♫✂" + +class EncodingTests(unittest.TestCase): + + @classmethod + def setUpClass(cls): + cls.orig_encoding = bindings.ExternalEncoding + bindings.ExternalEncoding = 'utf-16' + + @classmethod + def tearDownClass(cls): + bindings.ExternalEncoding = cls.orig_encoding + + def test_malware_configuration_parameter(self): + config = MalwareConfigurationParameter() + config.value = UNICODE_STR + config2 = round_trip(config) + self.assertEqual(config.value, config2.value) + + def test_dynamic_analysis_metadata(self): + metadata = DynamicAnalysisMetadata() + metadata.command_line = UNICODE_STR + metadata2 = round_trip(metadata) + self.assertEqual(metadata.command_line, metadata2.command_line) + + def test_grouping_relationship(self): + relationship = GroupingRelationship() + relationship.malware_family_name = UNICODE_STR + relationship.malware_toolkit_name = UNICODE_STR + relationship2 = round_trip(relationship) + self.assertEqual(relationship.malware_family_name, relationship2.malware_family_name) + self.assertEqual(relationship.malware_toolkit_name, relationship2.malware_toolkit_name) + + def test_behavior(self): + behavior = Behavior() + behavior.description = UNICODE_STR + behavior2 = round_trip(behavior) + self.assertEqual(behavior.description, behavior2.description) + + def test_capability(self): + capability = Capability() + capability.description = UNICODE_STR + capability2 = round_trip(capability) + self.assertEqual(capability.description, capability2.description) + + def test_av_classification(self): + av_class = AVClassification() + av_class.engine_version = UNICODE_STR + av_class.definition_version = UNICODE_STR + av_class.classification_name = UNICODE_STR + av_class2 = round_trip(av_class) + self.assertEqual(av_class.engine_version, av_class2.engine_version) + self.assertEqual(av_class.definition_version, av_class2.definition_version) + self.assertEqual(av_class.classification_name, av_class2.classification_name) + + def test_quote_xml(self): + s = bindings.quote_xml(UNICODE_STR) + self.assertEqual(s, UNICODE_STR) + + def test_quote_attrib(self): + """Tests that the maec.bindings.quote_attrib method works properly + on unicode inputs. + + Note: + The quote_attrib method (more specifically, saxutils.quoteattr()) + adds quotation marks around the input data, so we need to strip + the leading and trailing chars to test effectively + """ + s = bindings.quote_attrib(UNICODE_STR) + s = s[1:-1] + self.assertEqual(s, UNICODE_STR) + + def test_quote_attrib_int(self): + i = 65536 + s = bindings.quote_attrib(i) + self.assertEqual(u'"65536"', s) + + def test_quote_attrib_bool(self): + b = True + s = bindings.quote_attrib(b) + self.assertEqual(u'"True"', s) + + def test_quote_xml_int(self): + i = 65536 + s = bindings.quote_xml(i) + self.assertEqual(unicode(i), s) + + def test_quote_xml_bool(self): + b = True + s = bindings.quote_xml(b) + self.assertEqual(unicode(b), s) + + def test_quote_xml_encoded(self): + encoding = bindings.ExternalEncoding + encoded = UNICODE_STR.encode(encoding) + quoted = bindings.quote_xml(encoded) + self.assertEqual(UNICODE_STR, quoted) + + def test_quote_attrib_encoded(self): + encoding = bindings.ExternalEncoding + encoded = UNICODE_STR.encode(encoding) + quoted = bindings.quote_attrib(encoded)[1:-1] + self.assertEqual(UNICODE_STR, quoted) + + def test_quote_xml_zero(self): + i = 0 + s = bindings.quote_xml(i) + self.assertEqual(unicode(i), s) + + def test_quote_attrib_zero(self): + i = 0 + s = bindings.quote_attrib(i) + self.assertEqual(u'"0"', s) + + def test_quote_xml_none(self): + i = None + s = bindings.quote_xml(i) + self.assertEqual(u'', s) + + def test_quote_attrib_none(self): + i = None + s = bindings.quote_attrib(i) + self.assertEqual(u'""', s) + + def test_quote_attrib_empty(self): + i = '' + s = bindings.quote_attrib(i) + self.assertEqual(u'""', s) + + def test_quote_xml_empty(self): + i = '' + s = bindings.quote_xml(i) + self.assertEqual(u'', s) + + def test_to_xml_utf16_encoded(self): + encoding = 'utf-16' + b = Behavior() + b.description = UNICODE_STR + xml = b.to_xml(encoding=encoding) + self.assertTrue(UNICODE_STR in xml.decode(encoding)) + + def test_to_xml_default_encoded(self): + b = Behavior() + b.description = UNICODE_STR + xml = b.to_xml() + self.assertTrue(UNICODE_STR in xml.decode('utf-8')) + + def test_to_xml_no_encoding(self): + b = Behavior() + b.description = UNICODE_STR + xml = b.to_xml(encoding=None) + self.assertTrue(isinstance(xml, unicode)) + self.assertTrue(UNICODE_STR in xml) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file From 6f427a1423061eb4450c722ee2df9292b68e06c8 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 16 Dec 2014 13:15:02 -0500 Subject: [PATCH 147/297] Removed extraneous exportLiteral* methods --- maec/bindings/maec_bundle.py | 1305 ------------------------------- maec/bindings/maec_container.py | 44 -- maec/bindings/maec_package.py | 942 ---------------------- maec/bindings/mmdef_1_2.py | 966 ----------------------- 4 files changed, 3257 deletions(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index b7adc60..c10a641 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -127,53 +127,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior self.Associated_Code.export(write, level, 'maecBundle:', name_='Associated_Code', pretty_print=pretty_print) if self.Relationships is not None: self.Relationships.export(write, level, 'maecBundle:', name_='Relationships', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.status is not None and 'status' not in already_processed: - already_processed.add('status') - showIndent(write, level) - write('status = %s,\n' % (self.status,)) - if self.duration is not None and 'duration' not in already_processed: - already_processed.add('duration') - showIndent(write, level) - write('duration = "%s",\n' % (self.duration,)) - if self.ordinal_position is not None and 'ordinal_position' not in already_processed: - already_processed.add('ordinal_position') - showIndent(write, level) - write('ordinal_position = %d,\n' % (self.ordinal_position,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Purpose is not None: - write('Purpose=model_.BehaviorPurposeType(\n') - self.Purpose.exportLiteral(write, level, name_='Purpose') - write('),\n') - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - if self.Discovery_Method is not None: - write('Discovery_Method=model_.cybox_common.MeasureSourceType(\n') - self.Discovery_Method.exportLiteral(write, level, name_='Discovery_Method') - write('),\n') - if self.Action_Composition is not None: - write('Action_Composition=model_.BehavioralActionsType(\n') - self.Action_Composition.exportLiteral(write, level, name_='Action_Composition') - write('),\n') - if self.Associated_Code is not None: - write('Associated_Code=model_.AssociatedCodeType(\n') - self.Associated_Code.exportLiteral(write, level, name_='Associated_Code') - write('),\n') - if self.Relationships is not None: - write('Relationships=model_.BehaviorRelationshipListType(\n') - self.Relationships.exportLiteral(write, level, name_='Relationships') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -368,70 +321,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MAEC_Bun self.Candidate_Indicators.export(write, level, 'maecBundle:', name_='Candidate_Indicators', pretty_print=pretty_print) if self.Collections is not None: self.Collections.export(write, level, 'maecBundle:', name_='Collections', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MAEC_Bundle'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.defined_subject is not None and 'defined_subject' not in already_processed: - already_processed.add('defined_subject') - showIndent(write, level) - write('defined_subject = %s,\n' % (self.defined_subject,)) - if self.content_type is not None and 'content_type' not in already_processed: - already_processed.add('content_type') - showIndent(write, level) - write('content_type = %s,\n' % (self.content_type,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.schema_version is not None and 'schema_version' not in already_processed: - already_processed.add('schema_version') - showIndent(write, level) - write('schema_version = "%s",\n' % (self.schema_version,)) - if self.timestamp is not None and 'timestamp' not in already_processed: - already_processed.add('timestamp') - showIndent(write, level) - write('timestamp = "%s",\n' % (self.timestamp,)) - def exportLiteralChildren(self, write, level, name_): - if self.Malware_Instance_Object_Attributes is not None: - write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') - self.Malware_Instance_Object_Attributes.exportLiteral(write, level, name_='Malware_Instance_Object_Attributes') - write('),\n') - if self.AV_Classifications is not None: - write('AV_Classifications=model_.AVClassificationsType(\n') - self.AV_Classifications.exportLiteral(write, level, name_='AV_Classifications') - write('),\n') - if self.Process_Tree is not None: - write('Process_Tree=model_.ProcessTreeType(\n') - self.Process_Tree.exportLiteral(write, level, name_='Process_Tree') - write('),\n') - if self.Capabilities is not None: - write('Capabilities=model_.CapabilityListType(\n') - self.Capabilities.exportLiteral(write, level, name_='Capabilities') - write('),\n') - if self.Behaviors is not None: - write('Behaviors=model_.BehaviorListType(\n') - self.Behaviors.exportLiteral(write, level, name_='Behaviors') - write('),\n') - if self.Actions is not None: - write('Actions=model_.ActionListType(\n') - self.Actions.exportLiteral(write, level, name_='Actions') - write('),\n') - if self.Objects is not None: - write('Objects=model_.ObjectListType(\n') - self.Objects.exportLiteral(write, level, name_='Objects') - write('),\n') - if self.Candidate_Indicators is not None: - write('Candidate_Indicators=model_.CandidateIndicatorListType(\n') - self.Candidate_Indicators.exportLiteral(write, level, name_='Candidate_Indicators') - write('),\n') - if self.Collections is not None: - write('Collections=model_.CollectionsType(\n') - self.Collections.exportLiteral(write, level, name_='Collections') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -582,32 +471,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='APICallT write('<%sReturn_Value>%s%s' % ('maecBundle:', quote_xml(self.Return_Value), 'maecBundle:', eol_)) if self.Parameters is not None: self.Parameters.export(write, level, 'maecBundle:', name_='Parameters', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='APICallType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.normalized_function_name is not None and 'normalized_function_name' not in already_processed: - already_processed.add('normalized_function_name') - showIndent(write, level) - write('normalized_function_name = "%s",\n' % (self.normalized_function_name,)) - if self.function_name is not None and 'function_name' not in already_processed: - already_processed.add('function_name') - showIndent(write, level) - write('function_name = "%s",\n' % (self.function_name,)) - def exportLiteralChildren(self, write, level, name_): - if self.Address is not None: - showIndent(write, level) - write('Address=%s,\n' % quote_python(self.Address).encode(ExternalEncoding)) - if self.Return_Value is not None: - showIndent(write, level) - write('Return_Value=%s,\n' % quote_python(self.Return_Value).encode(ExternalEncoding)) - if self.Parameters is not None: - write('Parameters=model_.ParameterListType(\n') - self.Parameters.exportLiteral(write, level, name_='Parameters') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -719,41 +582,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionIm self.API_Call.export(write, level, 'maecBundle:', name_='API_Call', pretty_print=pretty_print) for Code_ in self.Code: Code_.export(write, level, 'maecBundle:', name_='Code', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionImplementationType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.add('type_') - showIndent(write, level) - write('type_ = %s,\n' % (self.type_,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Compatible_Platforms is not None: - write('Compatible_Platforms=model_.PlatformListType(\n') - self.Compatible_Platforms.exportLiteral(write, level, name_='Compatible_Platforms') - write('),\n') - if self.API_Call is not None: - write('API_Call=model_.APICallType(\n') - self.API_Call.exportLiteral(write, level, name_='API_Call') - write('),\n') - showIndent(write, level) - write('Code=[\n') - level += 1 - for Code_ in self.Code: - write('model_.code_object.CodeObjectType(\n') - Code_.exportLiteral(write, level, name_='code_object.CodeObjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -841,21 +669,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='CVEVulne if self.Description is not None: showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) - def exportLiteral(self, write, level, name_='CVEVulnerabilityType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.cve_id is not None and 'cve_id' not in already_processed: - already_processed.add('cve_id') - showIndent(write, level) - write('cve_id = "%s",\n' % (self.cve_id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -948,27 +761,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='BaseColl if self.Description is not None: showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) - def exportLiteral(self, write, level, name_='BaseCollectionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.name is not None and 'name' not in already_processed: - already_processed.add('name') - showIndent(write, level) - write('name = "%s",\n' % (self.name,)) - def exportLiteralChildren(self, write, level, name_): - if self.Affinity_Type is not None: - showIndent(write, level) - write('Affinity_Type=%s,\n' % quote_python(self.Affinity_Type).encode(ExternalEncoding)) - if self.Affinity_Degree is not None: - showIndent(write, level) - write('Affinity_Degree=%s,\n' % quote_python(self.Affinity_Degree).encode(ExternalEncoding)) - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1058,29 +850,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' for Behavior_Reference_ in self.Behavior_Reference: Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorRelationshipType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.add('type_') - showIndent(write, level) - write('type_ = %s,\n' % (self.type_,)) - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Behavior_Reference=[\n') - level += 1 - for Behavior_Reference_ in self.Behavior_Reference: - write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1151,26 +920,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassi eol_ = '' for AV_Classification_ in self.AV_Classification: AV_Classification_.export(write, level, 'maecBundle:', name_='AV_Classification', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AVClassificationsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('AV_Classification=[\n') - level += 1 - for AV_Classification_ in self.AV_Classification: - write('model_.AVClassificationType(\n') - AV_Classification_.exportLiteral(write, level, name_='AVClassificationType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1245,27 +994,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' value=%s' % (quote_attrib(self.value))) def exportChildren(self, write, level, namespace_='maecBundle:', name_='ParameterType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='ParameterType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.ordinal_position is not None and 'ordinal_position' not in already_processed: - already_processed.add('ordinal_position') - showIndent(write, level) - write('ordinal_position = %d,\n' % (self.ordinal_position,)) - if self.name is not None and 'name' not in already_processed: - already_processed.add('name') - showIndent(write, level) - write('name = "%s",\n' % (self.name,)) - if self.value is not None and 'value' not in already_processed: - already_processed.add('value') - showIndent(write, level) - write('value = "%s",\n' % (self.value,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1345,26 +1073,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Paramete eol_ = '' for Parameter_ in self.Parameter: Parameter_.export(write, level, 'maecBundle:', name_='Parameter', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ParameterListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Parameter=[\n') - level += 1 - for Parameter_ in self.Parameter: - write('model_.ParameterType(\n') - Parameter_.exportLiteral(write, level, name_='ParameterType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1432,26 +1140,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Associat eol_ = '' for Code_Snippet_ in self.Code_Snippet: Code_Snippet_.export(write, level, 'maecBundle:', name_='Code_Snippet', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AssociatedCodeType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Code_Snippet=[\n') - level += 1 - for Code_Snippet_ in self.Code_Snippet: - write('model_.code_object.CodeObjectType(\n') - Code_Snippet_.exportLiteral(write, level, name_='code_object.CodeObjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1521,22 +1209,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) if self.Vulnerability_Exploit is not None: self.Vulnerability_Exploit.export(write, level, 'maecBundle:', name_='Vulnerability_Exploit', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorPurposeType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - if self.Vulnerability_Exploit is not None: - write('Vulnerability_Exploit=model_.ExploitType(\n') - self.Vulnerability_Exploit.exportLiteral(write, level, name_='Vulnerability_Exploit') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1608,26 +1280,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Platform eol_ = '' for Platform_ in self.Platform: Platform_.export(write, level, 'maecBundle:', name_='Platform', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='PlatformListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Platform=[\n') - level += 1 - for Platform_ in self.Platform: - write('model_.cybox_common.PlatformSpecificationType(\n') - Platform_.exportLiteral(write, level, name_='cybox_common.PlatformSpecificationType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1721,35 +1373,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ExploitT write('<%sCWE_ID>%s%s' % ('maecBundle:', quote_xml(CWE_ID_), 'maecBundle:', eol_)) if self.Targeted_Platforms is not None: self.Targeted_Platforms.export(write, level, 'maecBundle:', name_='Targeted_Platforms', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ExploitType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.known_vulnerability is not None and 'known_vulnerability' not in already_processed: - already_processed.add('known_vulnerability') - showIndent(write, level) - write('known_vulnerability = %s,\n' % (self.known_vulnerability,)) - def exportLiteralChildren(self, write, level, name_): - if self.CVE is not None: - write('CVE=model_.CVEVulnerabilityType(\n') - self.CVE.exportLiteral(write, level, name_='CVE') - write('),\n') - showIndent(write, level) - write('CWE_ID=[\n') - level += 1 - for CWE_ID_ in self.CWE_ID: - showIndent(write, level) - write('%s,\n' % quote_python(CWE_ID_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - if self.Targeted_Platforms is not None: - write('Targeted_Platforms=model_.PlatformListType(\n') - self.Targeted_Platforms.exportLiteral(write, level, name_='Targeted_Platforms') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1833,26 +1456,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorRelationshipListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Relationship=[\n') - level += 1 - for Relationship_ in self.Relationship: - write('model_.BehaviorRelationshipType(\n') - Relationship_.exportLiteral(write, level, name_='BehaviorRelationshipType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1953,59 +1556,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) for Action_Equivalence_Reference_ in self.Action_Equivalence_Reference: Action_Equivalence_Reference_.export(write, level, 'maecBundle:', name_='Action_Equivalence_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehavioralActionsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action_Collection=[\n') - level += 1 - for Action_Collection_ in self.Action_Collection: - write('model_.ActionCollectionType(\n') - Action_Collection_.exportLiteral(write, level, name_='ActionCollectionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Action=[\n') - level += 1 - for Action_ in self.Action: - write('model_.BehavioralActionType(\n') - Action_.exportLiteral(write, level, name_='BehavioralActionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Action_Reference=[\n') - level += 1 - for Action_Reference_ in self.Action_Reference: - write('model_.BehavioralActionReferenceType(\n') - Action_Reference_.exportLiteral(write, level, name_='BehavioralActionReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Action_Equivalence_Reference=[\n') - level += 1 - for Action_Equivalence_Reference_ in self.Action_Equivalence_Reference: - write('model_.BehavioralActionEquivalenceReferenceType(\n') - Action_Equivalence_Reference_.exportLiteral(write, level, name_='BehavioralActionEquivalenceReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2084,26 +1634,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' for Behavior_ in self.Behavior: Behavior_.export(write, level, 'maecBundle:', name_='Behavior', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Behavior=[\n') - level += 1 - for Behavior_ in self.Behavior: - write('model_.BehaviorType(\n') - Behavior_.exportLiteral(write, level, name_='BehaviorType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2170,26 +1700,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionLi eol_ = '' for Action_ in self.Action: Action_.export(write, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action=[\n') - level += 1 - for Action_ in self.Action: - write('model_.MalwareActionType(\n') - Action_.exportLiteral(write, level, name_='MalwareActionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2256,26 +1766,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectLi eol_ = '' for Object_ in self.Object: Object_.export(write, level, 'maecBundle:', name_='Object', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Object=[\n') - level += 1 - for Object_ in self.Object: - write('model_.cybox_core.ObjectType(\n') - Object_.exportLiteral(write, level, name_='cybox_core.ObjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2337,19 +1827,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' behavior_idref=%s' % (quote_attrib(self.behavior_idref), )) def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='BehaviorReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.behavior_idref is not None and 'behavior_idref' not in already_processed: - already_processed.add('behavior_idref') - showIndent(write, level) - write('behavior_idref = %s,\n' % (self.behavior_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2411,19 +1888,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' object_idref=%s' % (quote_attrib(self.object_idref), )) def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='ObjectReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.object_idref is not None and 'object_idref' not in already_processed: - already_processed.add('object_idref') - showIndent(write, level) - write('object_idref = %s,\n' % (self.object_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2499,23 +1963,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='BehavioralActionEquivalenceReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.action_equivalence_idref is not None and 'action_equivalence_idref' not in already_processed: - already_processed.add('action_equivalence_idref') - showIndent(write, level) - write('action_equivalence_idref = %s,\n' % (self.action_equivalence_idref,)) - if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: - already_processed.add('behavioral_ordering') - showIndent(write, level) - write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2592,26 +2039,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' for Behavior_Reference_ in self.Behavior_Reference: Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorReferenceListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Behavior_Reference=[\n') - level += 1 - for Behavior_Reference_ in self.Behavior_Reference: - write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2678,26 +2105,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionRe eol_ = '' for Action_Reference_ in self.Action_Reference: Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionReferenceListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action_Reference=[\n') - level += 1 - for Action_Reference_ in self.Action_Reference: - write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2765,26 +2172,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectRe eol_ = '' for Object_Reference_ in self.Object_Reference: Object_Reference_.export(write, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectReferenceListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Object_Reference=[\n') - level += 1 - for Object_Reference_ in self.Object_Reference: - write('model_.ObjectReferenceType(\n') - Object_Reference_.exportLiteral(write, level, name_='ObjectReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2912,51 +2299,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat self.Malware_Entity.export(write, level, 'maecBundle:', name_='Malware_Entity', pretty_print=pretty_print) if self.Composition is not None: self.Composition.export(write, level, 'maecBundle:', name_='Composition', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CandidateIndicatorType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.version is not None and 'version' not in already_processed: - already_processed.add('version') - showIndent(write, level) - write('version = "%s",\n' % (self.version,)) - if self.creation_datetime is not None and 'creation_datetime' not in already_processed: - already_processed.add('creation_datetime') - showIndent(write, level) - write('creation_datetime = "%s",\n' % (self.creation_datetime,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: - already_processed.add('lastupdate_datetime') - showIndent(write, level) - write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) - def exportLiteralChildren(self, write, level, name_): - if self.Importance is not None: - write('Importance=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Importance.exportLiteral(write, level, name_='Importance') - write('),\n') - if self.Numeric_Importance is not None: - showIndent(write, level) - write('Numeric_Importance=%d,\n' % self.Numeric_Importance) - if self.Author is not None: - showIndent(write, level) - write('Author=%s,\n' % quote_python(self.Author).encode(ExternalEncoding)) - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - if self.Malware_Entity is not None: - write('Malware_Entity=model_.MalwareEntityType(\n') - self.Malware_Entity.exportLiteral(write, level, name_='Malware_Entity') - write('),\n') - if self.Composition is not None: - write('Composition=model_.CandidateIndicatorCompositionType(\n') - self.Composition.exportLiteral(write, level, name_='Composition') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3071,26 +2413,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat eol_ = '' for Candidate_Indicator_ in self.Candidate_Indicator: Candidate_Indicator_.export(write, level, 'maecBundle:', name_='Candidate_Indicator', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CandidateIndicatorListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Candidate_Indicator=[\n') - level += 1 - for Candidate_Indicator_ in self.Candidate_Indicator: - write('model_.CandidateIndicatorType(\n') - Candidate_Indicator_.exportLiteral(write, level, name_='CandidateIndicatorType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3169,25 +2491,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareE if self.Description is not None: showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) - def exportLiteral(self, write, level, name_='MalwareEntityType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Type is not None: - write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(write, level, name_='Type') - write('),\n') - if self.Name is not None: - showIndent(write, level) - write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3276,31 +2579,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Collecti self.Object_Collections.export(write, level, 'maecBundle:', name_='Object_Collections', pretty_print=pretty_print) if self.Candidate_Indicator_Collections is not None: self.Candidate_Indicator_Collections.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collections', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CollectionsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Behavior_Collections is not None: - write('Behavior_Collections=model_.BehaviorCollectionListType(\n') - self.Behavior_Collections.exportLiteral(write, level, name_='Behavior_Collections') - write('),\n') - if self.Action_Collections is not None: - write('Action_Collections=model_.ActionCollectionListType(\n') - self.Action_Collections.exportLiteral(write, level, name_='Action_Collections') - write('),\n') - if self.Object_Collections is not None: - write('Object_Collections=model_.ObjectCollectionListType(\n') - self.Object_Collections.exportLiteral(write, level, name_='Object_Collections') - write('),\n') - if self.Candidate_Indicator_Collections is not None: - write('Candidate_Indicator_Collections=model_.CandidateIndicatorCollectionListType(\n') - self.Candidate_Indicator_Collections.exportLiteral(write, level, name_='Candidate_Indicator_Collections') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3373,19 +2651,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' bundle_idref=%s' % (quote_attrib(self.bundle_idref), )) def exportChildren(self, write, level, namespace_='maecBundle:', name_='BundleReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='BundleReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.bundle_idref is not None and 'bundle_idref' not in already_processed: - already_processed.add('bundle_idref') - showIndent(write, level) - write('bundle_idref = %s,\n' % (self.bundle_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3449,19 +2714,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessT eol_ = '' if self.Root_Process is not None: self.Root_Process.export(write, level, 'maecBundle:', name_='Root_Process', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ProcessTreeType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Root_Process is not None: - write('Root_Process=model_.ProcessTreeNodeType(\n') - self.Root_Process.exportLiteral(write, level, name_='Root_Process') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3570,62 +2822,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat Object_Reference_.export(write, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) for Sub_Composition_ in self.Sub_Composition: Sub_Composition_.export(write, level, 'maecBundle:', name_='Sub_Composition', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CandidateIndicatorCompositionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.operator is not None and 'operator' not in already_processed: - already_processed.add('operator') - showIndent(write, level) - write('operator = %s,\n' % (self.operator,)) - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Behavior_Reference=[\n') - level += 1 - for Behavior_Reference_ in self.Behavior_Reference: - write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Action_Reference=[\n') - level += 1 - for Action_Reference_ in self.Action_Reference: - write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Object_Reference=[\n') - level += 1 - for Object_Reference_ in self.Object_Reference: - write('model_.ObjectReferenceType(\n') - Object_Reference_.exportLiteral(write, level, name_='ObjectReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Sub_Composition=[\n') - level += 1 - for Sub_Composition_ in self.Sub_Composition: - write('model_.CandidateIndicatorCompositionType(\n') - Sub_Composition_.exportLiteral(write, level, name_='CandidateIndicatorCompositionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3715,24 +2911,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat eol_ = '' if self.Candidate_Indicator_List is not None: self.Candidate_Indicator_List.export(write, level, 'maecBundle:', name_='Candidate_Indicator_List', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CandidateIndicatorCollectionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - super(CandidateIndicatorCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(CandidateIndicatorCollectionType, self).exportLiteralChildren(write, level, name_) - if self.Candidate_Indicator_List is not None: - write('Candidate_Indicator_List=model_.CandidateIndicatorListType(\n') - self.Candidate_Indicator_List.exportLiteral(write, level, name_='Candidate_Indicator_List') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3805,26 +2983,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat eol_ = '' for Candidate_Indicator_Collection_ in self.Candidate_Indicator_Collection: Candidate_Indicator_Collection_.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collection', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CandidateIndicatorCollectionListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Candidate_Indicator_Collection=[\n') - level += 1 - for Candidate_Indicator_Collection_ in self.Candidate_Indicator_Collection: - write('model_.CandidateIndicatorCollectionType(\n') - Candidate_Indicator_Collection_.exportLiteral(write, level, name_='CandidateIndicatorCollectionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3892,26 +3050,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior eol_ = '' for Behavior_Collection_ in self.Behavior_Collection: Behavior_Collection_.export(write, level, 'maecBundle:', name_='Behavior_Collection', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorCollectionListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Behavior_Collection=[\n') - level += 1 - for Behavior_Collection_ in self.Behavior_Collection: - write('model_.BehaviorCollectionType(\n') - Behavior_Collection_.exportLiteral(write, level, name_='BehaviorCollectionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3978,26 +3116,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCo eol_ = '' for Action_Collection_ in self.Action_Collection: Action_Collection_.export(write, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionCollectionListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action_Collection=[\n') - level += 1 - for Action_Collection_ in self.Action_Collection: - write('model_.ActionCollectionType(\n') - Action_Collection_.exportLiteral(write, level, name_='ActionCollectionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4064,26 +3182,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCo eol_ = '' for Object_Collection_ in self.Object_Collection: Object_Collection_.export(write, level, 'maecBundle:', name_='Object_Collection', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectCollectionListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Object_Collection=[\n') - level += 1 - for Object_Collection_ in self.Object_Collection: - write('model_.ObjectCollectionType(\n') - Object_Collection_.exportLiteral(write, level, name_='ObjectCollectionType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4165,25 +3263,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassi if self.Classification_Name is not None: showIndent(write, level, pretty_print) write('<%sClassification_Name>%s%s' % ('maecBundle:', quote_xml(self.Classification_Name), 'maecBundle:', eol_)) - def exportLiteral(self, write, level, name_='AVClassificationType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - super(AVClassificationType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(AVClassificationType, self).exportLiteralChildren(write, level, name_) - if self.Engine_Version is not None: - showIndent(write, level) - write('Engine_Version=%s,\n' % quote_python(self.Engine_Version).encode(ExternalEncoding)) - if self.Definition_Version is not None: - showIndent(write, level) - write('Definition_Version=%s,\n' % quote_python(self.Definition_Version).encode(ExternalEncoding)) - if self.Classification_Name is not None: - showIndent(write, level) - write('Classification_Name=%s,\n' % quote_python(self.Classification_Name).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4303,50 +3382,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessT Spawned_Process_.export(write, level, 'maecBundle:', name_='Spawned_Process', pretty_print=pretty_print) for Injected_Process_ in self.Injected_Process: Injected_Process_.export(write, level, 'maecBundle:', name_='Injected_Process', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ProcessTreeNodeType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.parent_action_idref is not None and 'parent_action_idref' not in already_processed: - already_processed.add('parent_action_idref') - showIndent(write, level) - write('parent_action_idref = %s,\n' % (self.parent_action_idref,)) - super(ProcessTreeNodeType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(ProcessTreeNodeType, self).exportLiteralChildren(write, level, name_) - if self.Initiated_Actions is not None: - write('Initiated_Actions=model_.ActionReferenceListType(\n') - self.Initiated_Actions.exportLiteral(write, level, name_='Initiated_Actions') - write('),\n') - showIndent(write, level) - write('Spawned_Process=[\n') - level += 1 - for Spawned_Process_ in self.Spawned_Process: - write('model_.ProcessTreeNodeType(\n') - Spawned_Process_.exportLiteral(write, level, name_='ProcessTreeNodeType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Injected_Process=[\n') - level += 1 - for Injected_Process_ in self.Injected_Process: - write('model_.ProcessTreeNodeType(\n') - Injected_Process_.exportLiteral(write, level, name_='ProcessTreeNodeType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4434,21 +3469,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionReferenceType', fromsubclass_=False, pretty_print=True): super(BehavioralActionReferenceType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) pass - def exportLiteral(self, write, level, name_='BehavioralActionReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: - already_processed.add('behavioral_ordering') - showIndent(write, level) - write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - super(BehavioralActionReferenceType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(BehavioralActionReferenceType, self).exportLiteralChildren(write, level, name_) - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4531,24 +3551,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCo eol_ = '' if self.Object_List is not None: self.Object_List.export(write, level, 'maecBundle:', name_='Object_List', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectCollectionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - super(ObjectCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(ObjectCollectionType, self).exportLiteralChildren(write, level, name_) - if self.Object_List is not None: - write('Object_List=model_.ObjectListType(\n') - self.Object_List.exportLiteral(write, level, name_='Object_List') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4630,24 +3632,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCo eol_ = '' if self.Action_List is not None: self.Action_List.export(write, level, 'maecBundle:', name_='Action_List', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionCollectionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - super(ActionCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(ActionCollectionType, self).exportLiteralChildren(write, level, name_) - if self.Action_List is not None: - write('Action_List=model_.ActionListType(\n') - self.Action_List.exportLiteral(write, level, name_='Action_List') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4732,26 +3716,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior write('<%sPurpose>%s%s' % ('maecBundle:', quote_xml(self.Purpose), 'maecBundle:', eol_)) if self.Behavior_List is not None: self.Behavior_List.export(write, level, 'maecBundle:', name_='Behavior_List', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehaviorCollectionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - super(BehaviorCollectionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(BehaviorCollectionType, self).exportLiteralChildren(write, level, name_) - if self.Purpose is not None: - write('Purpose=%s,\n' % quote_python(self.Purpose).encode(ExternalEncoding)) - if self.Behavior_List is not None: - write('Behavior_List=model_.BehaviorListType(\n') - self.Behavior_List.exportLiteral(write, level, name_='Behavior_List') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4843,20 +3807,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareA eol_ = '' if self.Implementation is not None: self.Implementation.export(write, level, 'maecBundle:', name_='Implementation', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareActionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - super(MalwareActionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(MalwareActionType, self).exportLiteralChildren(write, level, name_) - if self.Implementation is not None: - write('Implementation=model_.ActionImplementationType(\n') - self.Implementation.exportLiteral(write, level, name_='Implementation') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4927,20 +3877,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' behavioral_ordering="%s"' % self.gds_format_integer(self.behavioral_ordering, input_name='behavioral_ordering')) def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionType', fromsubclass_=False, pretty_print=True): super(BehavioralActionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='BehavioralActionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.behavioral_ordering is not None and 'behavioral_ordering' not in already_processed: - already_processed.add('behavioral_ordering') - showIndent(write, level) - write('behavioral_ordering = %d,\n' % (self.behavioral_ordering,)) - super(BehavioralActionType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(BehavioralActionType, self).exportLiteralChildren(write, level, name_) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5082,80 +4018,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.name is not None and 'name' not in already_processed: - already_processed.add('name') - showIndent(write, level) - write('name = %s,\n' % (self.name,)) - def exportLiteralChildren(self, write, level, name_): - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - showIndent(write, level) - write('Property=[\n') - level += 1 - for Property_ in self.Property: - write('model_.CapabilityPropertyType(\n') - Property_.exportLiteral(write, level, name_='CapabilityPropertyType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Strategic_Objective=[\n') - level += 1 - for Strategic_Objective_ in self.Strategic_Objective: - write('model_.CapabilityObjectiveType(\n') - Strategic_Objective_.exportLiteral(write, level, name_='CapabilityObjectiveType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Tactical_Objective=[\n') - level += 1 - for Tactical_Objective_ in self.Tactical_Objective: - write('model_.CapabilityObjectiveType(\n') - Tactical_Objective_.exportLiteral(write, level, name_='CapabilityObjectiveType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Behavior_Reference=[\n') - level += 1 - for Behavior_Reference_ in self.Behavior_Reference: - write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Relationship=[\n') - level += 1 - for Relationship_ in self.Relationship: - write('model_.CapabilityRelationshipType(\n') - Relationship_.exportLiteral(write, level, name_='CapabilityRelationshipType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5260,30 +4122,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili Capability_.export(write, level, 'maecBundle:', name_='Capability', pretty_print=pretty_print) for Capability_Reference_ in self.Capability_Reference: Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Capability is not None: - write('Capability=model_.CapabilityType(\n') - self.Capability.exportLiteral(write, level, name_='Capability') - write('),\n') - showIndent(write, level) - write('Capability_Reference=[\n') - level += 1 - for Capability_Reference_ in self.Capability_Reference: - write('model_.CapabilityReferenceType(\n') - Capability_Reference_.exportLiteral(write, level, name_='CapabilityReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5349,19 +4187,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' capability_idref=%s' % (quote_attrib(self.capability_idref), )) def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='CapabilityReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.capability_idref is not None and 'capability_idref' not in already_processed: - already_processed.add('capability_idref') - showIndent(write, level) - write('capability_idref = %s,\n' % (self.capability_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5471,58 +4296,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityObjectiveType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Name is not None: - write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(write, level, name_='Name') - write('),\n') - if self.Description is not None: - showIndent(write, level) - write('Description=%s,\n' % quote_python(self.Description).encode(ExternalEncoding)) - showIndent(write, level) - write('Property=[\n') - level += 1 - for Property_ in self.Property: - write('model_.CapabilityPropertyType(\n') - Property_.exportLiteral(write, level, name_='CapabilityPropertyType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Behavior_Reference=[\n') - level += 1 - for Behavior_Reference_ in self.Behavior_Reference: - write('model_.BehaviorReferenceType(\n') - Behavior_Reference_.exportLiteral(write, level, name_='BehaviorReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Relationship=[\n') - level += 1 - for Relationship_ in self.Relationship: - write('model_.CapabilityObjectiveRelationshipType(\n') - Relationship_.exportLiteral(write, level, name_='CapabilityObjectiveRelationshipType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5615,30 +4388,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili self.Relationship_Type.export(write, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) for Capability_Reference_ in self.Capability_Reference: Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityRelationshipType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Relationship_Type is not None: - write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Relationship_Type.exportLiteral(write, level, name_='Relationship_Type') - write('),\n') - showIndent(write, level) - write('Capability_Reference=[\n') - level += 1 - for Capability_Reference_ in self.Capability_Reference: - write('model_.CapabilityType(\n') - Capability_Reference_.exportLiteral(write, level, name_='CapabilityType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5717,30 +4466,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili self.Relationship_Type.export(write, level, 'maecBundle:', name_='Relationship_Type', pretty_print=pretty_print) for Objective_Reference_ in self.Objective_Reference: Objective_Reference_.export(write, level, 'maecBundle:', name_='Objective_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityObjectiveRelationshipType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Relationship_Type is not None: - write('Relationship_Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Relationship_Type.exportLiteral(write, level, name_='Relationship_Type') - write('),\n') - showIndent(write, level) - write('Objective_Reference=[\n') - level += 1 - for Objective_Reference_ in self.Objective_Reference: - write('model_.CapabilityObjectiveReferenceType(\n') - Objective_Reference_.exportLiteral(write, level, name_='CapabilityObjectiveReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5807,19 +4532,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' objective_idref=%s' % (quote_attrib(self.objective_idref), )) def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='CapabilityObjectiveReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.objective_idref is not None and 'objective_idref' not in already_processed: - already_processed.add('objective_idref') - showIndent(write, level) - write('objective_idref = %s,\n' % (self.objective_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -5891,23 +4603,6 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili self.Name.export(write, level, 'maecBundle:', name_='Name', pretty_print=pretty_print) if self.Value is not None: self.Value.export(write, level, 'maecBundle:', name_='Value', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapabilityPropertyType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Name is not None: - write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(write, level, name_='Name') - write('),\n') - if self.Value is not None: - write('Value=model_.cybox_common.StringObjectPropertyType(\n') - self.Value.exportLiteral(write, level, name_='Value') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index f60a2b5..8fe0a48 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -76,30 +76,6 @@ def exportChildren(self, write, level, namespace_='maecContainer:', name_='MAEC_ eol_ = '' if self.Packages is not None: self.Packages.export(write, level, 'maecContainer:', name_='Packages', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MAEC_Container'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.timestamp is not None and 'timestamp' not in already_processed: - already_processed.add('timestamp') - showIndent(write, level) - write('timestamp = "%s",\n' % (self.timestamp,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.schema_version is not None and 'schema_version' not in already_processed: - already_processed.add('schema_version') - showIndent(write, level) - write('schema_version = %s,\n' % (self.schema_version)) - def exportLiteralChildren(self, write, level, name_): - if self.Packages is not None: - write('Packages=model_.PackageListType(\n') - self.Packages.exportLiteral(write, level, name_='Packages') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -180,26 +156,6 @@ def exportChildren(self, write, level, namespace_='maecContainer:', name_='Packa eol_ = '' for Package_ in self.Package: Package_.export(write, level, 'maecContainer:', name_='Package', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='PackageListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Package=[\n') - level += 1 - for Package_ in self.Package: - write('model_.maec_package_schema.PackageType(\n') - Package_.exportLiteral(write, level, name_='maec_package_schema.PackageType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index 486b267..e131836 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -72,27 +72,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi self.Analysis_Systems.export(write, level, 'maecPackage:', name_='Analysis_Systems', pretty_print=pretty_print) if self.Network_Infrastructure is not None: self.Network_Infrastructure.export(write, level, 'maecPackage:', name_='Network_Infrastructure', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AnalysisEnvironmentType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Hypervisor_Host_System is not None: - write('Hypervisor_Host_System=model_.HypervisorHostSystemType(\n') - self.Hypervisor_Host_System.exportLiteral(write, level, name_='Hypervisor_Host_System') - write('),\n') - if self.Analysis_Systems is not None: - write('Analysis_Systems=model_.AnalysisSystemListType(\n') - self.Analysis_Systems.exportLiteral(write, level, name_='Analysis_Systems') - write('),\n') - if self.Network_Infrastructure is not None: - write('Network_Infrastructure=model_.NetworkInfrastructureType(\n') - self.Network_Infrastructure.exportLiteral(write, level, name_='Network_Infrastructure') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -192,30 +171,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='SourceT if self.URL is not None: showIndent(write, level, pretty_print) write('<%sURL>%s%s' % ('maecPackage:', quote_xml(self.URL), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='SourceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Name is not None: - showIndent(write, level) - write('Name=%s,\n' % quote_python(self.Name).encode(ExternalEncoding)) - if self.Method is not None: - showIndent(write, level) - write('Method=%s,\n' % quote_python(self.Method).encode(ExternalEncoding)) - if self.Reference is not None: - showIndent(write, level) - write('Reference=%s,\n' % quote_python(self.Reference).encode(ExternalEncoding)) - if self.Organization is not None: - showIndent(write, level) - write('Organization=%s,\n' % quote_python(self.Organization).encode(ExternalEncoding)) - if self.URL is not None: - showIndent(write, level) - write('URL=%s,\n' % quote_python(self.URL).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -299,26 +254,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Comment eol_ = '' for Comment_ in self.Comment: Comment_.export(write, level, 'maecPackage:', name_='Comment', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CommentListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Comment=[\n') - level += 1 - for Comment_ in self.Comment: - write('model_.CommentType(\n') - Comment_.exportLiteral(write, level, name_='CommentType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -386,26 +321,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi eol_ = '' for Analysis_System_ in self.Analysis_System: Analysis_System_.export(write, level, 'maecPackage:', name_='Analysis_System', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AnalysisSystemListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Analysis_System=[\n') - level += 1 - for Analysis_System_ in self.Analysis_System: - write('model_.AnalysisSystemType(\n') - Analysis_System_.exportLiteral(write, level, name_='AnalysisSystemType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -473,26 +388,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ToolLis eol_ = '' for Tool_ in self.Tool: Tool_.export(write, level, 'maecPackage:', name_='Tool', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ToolListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Tool=[\n') - level += 1 - for Tool_ in self.Tool: - write('model_.cybox_common.ToolInformationType(\n') - Tool_.exportLiteral(write, level, name_='cybox_common.ToolInformationType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -570,24 +465,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Dynamic if self.Exit_Code is not None: showIndent(write, level, pretty_print) write('<%sExit_Code>%s%s' % ('maecPackage:', self.gds_format_integer(self.Exit_Code, input_name='Exit_Code'), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='DynamicAnalysisMetadataType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Command_Line is not None: - showIndent(write, level) - write('Command_Line=%s,\n' % quote_python(self.Command_Line).encode(ExternalEncoding)) - if self.Analysis_Duration is not None: - showIndent(write, level) - write('Analysis_Duration=%f,\n' % self.Analysis_Duration) - if self.Exit_Code is not None: - showIndent(write, level) - write('Exit_Code=%d,\n' % self.Exit_Code) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -772,78 +649,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi self.Analysis_Environment.export(write, level, 'maecPackage:', name_='Analysis_Environment', pretty_print=pretty_print) if self.Report is not None: self.Report.export(write, level, 'maecPackage:', name_='Report', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AnalysisType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.start_datetime is not None and 'start_datetime' not in already_processed: - already_processed.add('start_datetime') - showIndent(write, level) - write('start_datetime = "%s",\n' % (self.start_datetime,)) - if self.complete_datetime is not None and 'complete_datetime' not in already_processed: - already_processed.add('complete_datetime') - showIndent(write, level) - write('complete_datetime = "%s",\n' % (self.complete_datetime,)) - if self.method is not None and 'method' not in already_processed: - already_processed.add('method') - showIndent(write, level) - write('method = %s,\n' % (self.method,)) - if self.ordinal_position is not None and 'ordinal_position' not in already_processed: - already_processed.add('ordinal_position') - showIndent(write, level) - write('ordinal_position = %d,\n' % (self.ordinal_position,)) - if self.lastupdate_datetime is not None and 'lastupdate_datetime' not in already_processed: - already_processed.add('lastupdate_datetime') - showIndent(write, level) - write('lastupdate_datetime = "%s",\n' % (self.lastupdate_datetime,)) - if self.type is not None and 'type' not in already_processed: - already_processed.add('type') - showIndent(write, level) - write('type = %s,\n' % (self.type,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Source is not None: - write('Source=model_.SourceType(\n') - self.Source.exportLiteral(write, level, name_='Source') - write('),\n') - if self.Analysts is not None: - write('Analysts=model_.cybox_common.PersonnelType(\n') - self.Analysts.exportLiteral(write, level, name_='Analysts') - write('),\n') - if self.Summary is not None: - write('Summary=model_.cybox_common.StructuredTextType(\n') - self.Summary.exportLiteral(write, level, name_='Summary') - write('),\n') - if self.Comments is not None: - write('Comments=model_.CommentListType(\n') - self.Comments.exportLiteral(write, level, name_='Comments') - write('),\n') - if self.Findings_Bundle_Reference is not None: - write('Findings_Bundle_Reference=model_.maec_bundle_schema.BundleReferenceType(\n') - self.Findings_Bundle_Reference.exportLiteral(write, level, name_='Findings_Bundle_Reference') - write('),\n') - if self.Tools is not None: - write('Tools=model_.ToolListType(\n') - self.Tools.exportLiteral(write, level, name_='Tools') - write('),\n') - if self.Dynamic_Analysis_Metadata is not None: - write('Dynamic_Analysis_Metadata=model_.DynamicAnalysisMetadataType(\n') - self.Dynamic_Analysis_Metadata.exportLiteral(write, level, name_='Dynamic_Analysis_Metadata') - write('),\n') - if self.Analysis_Environment is not None: - write('Analysis_Environment=model_.AnalysisEnvironmentType(\n') - self.Analysis_Environment.exportLiteral(write, level, name_='Analysis_Environment') - write('),\n') - if self.Report is not None: - write('Report=model_.cybox_common.StructuredTextType(\n') - self.Report.exportLiteral(write, level, name_='Report') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -984,26 +789,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi eol_ = '' for Analysis_ in self.Analysis: Analysis_.export(write, level, 'maecPackage:', name_='Analysis', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AnalysisListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Analysis=[\n') - level += 1 - for Analysis_ in self.Analysis: - write('model_.AnalysisType(\n') - Analysis_.exportLiteral(write, level, name_='AnalysisType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1072,26 +857,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Install eol_ = '' for Program_ in self.Program: Program_.export(write, level, 'maecPackage:', name_='Program', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='InstalledProgramsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Program=[\n') - level += 1 - for Program_ in self.Program: - write('model_.cybox_common.PlatformSpecificationType(\n') - Program_.exportLiteral(write, level, name_='cybox_common.PlatformSpecificationType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1189,34 +954,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MAEC_Pa self.Malware_Subjects.export(write, level, 'maecPackage:', name_='Malware_Subjects', pretty_print=pretty_print) if self.Grouping_Relationships is not None: self.Grouping_Relationships.export(write, level, 'maecPackage:', name_='Grouping_Relationships', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MAEC_Package'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.timestamp is not None and 'timestamp' not in already_processed: - already_processed.add('timestamp') - showIndent(write, level) - write('timestamp = "%s",\n' % (self.timestamp,)) - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - if self.schema_version is not None and 'schema_version' not in already_processed: - already_processed.add('schema_version') - showIndent(write, level) - write('schema_version = %s,\n' % (self.schema_version,)) - def exportLiteralChildren(self, write, level, name_): - if self.Malware_Subjects is not None: - write('Malware_Subjects=model_.MalwareSubjectListType(\n') - self.Malware_Subjects.exportLiteral(write, level, name_='Malware_Subjects') - write('),\n') - if self.Grouping_Relationships is not None: - write('Grouping_Relationships=model_.GroupingRelationshipListType(\n') - self.Grouping_Relationships.exportLiteral(write, level, name_='Grouping_Relationships') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1370,42 +1107,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.Relationships.export(write, level, 'maecPackage:', name_='Relationships', pretty_print=pretty_print) for Compatible_Platform_ in self.Compatible_Platform: Compatible_Platform_.export(write, level, 'maecPackage:', name_='Compatible_Platform', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareSubjectType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.Malware_Instance_Object_Attributes is not None: - write('Malware_Instance_Object_Attributes=model_.cybox_core.ObjectType(\n') - self.Malware_Instance_Object_Attributes.exportLiteral(write, level, name_='Malware_Instance_Object_Attributes') - write('),\n') - if self.Minor_Variants is not None: - write('Minor_Variants=model_.MinorVariantListType(\n') - self.Minor_Variants.exportLiteral(write, level, name_='Minor_Variants') - write('),\n') - if self.Field_Data is not None: - write('Field_Data=model_.metadatasharing.fieldDataEntry(\n') - self.Field_Data.exportLiteral(write, level, name_='Field_Data') - write('),\n') - if self.Analyses is not None: - write('Analyses=model_.AnalysisListType(\n') - self.Analyses.exportLiteral(write, level, name_='Analyses') - write('),\n') - if self.Findings_Bundles is not None: - write('Findings_Bundles=model_.FindingsBundleListType(\n') - self.Findings_Bundles.exportLiteral(write, level, name_='Findings_Bundles') - write('),\n') - if self.Relationships is not None: - write('Relationships=model_.MalwareSubjectRelationshipListType(\n') - self.Relationships.exportLiteral(write, level, name_='Relationships') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1514,23 +1215,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MetaAna self.Action_Equivalences.export(write, level, 'maecPackage:', name_='Action_Equivalences', pretty_print=pretty_print) if self.Object_Equivalences is not None: self.Object_Equivalences.export(write, level, 'maecPackage:', name_='Object_Equivalences', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MetaAnalysisType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Action_Equivalences is not None: - write('Action_Equivalences=model_.ActionEquivalenceListType(\n') - self.Action_Equivalences.exportLiteral(write, level, name_='Action_Equivalences') - write('),\n') - if self.Object_Equivalences is not None: - write('Object_Equivalences=model_.ObjectEquivalenceListType(\n') - self.Object_Equivalences.exportLiteral(write, level, name_='Object_Equivalences') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1609,30 +1293,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.Type.export(write, level, 'maecPackage:', name_='Type', pretty_print=pretty_print) for Malware_Subject_Reference_ in self.Malware_Subject_Reference: Malware_Subject_Reference_.export(write, level, 'maecPackage:', name_='Malware_Subject_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareSubjectRelationshipType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Type is not None: - write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(write, level, name_='Type') - write('),\n') - showIndent(write, level) - write('Malware_Subject_Reference=[\n') - level += 1 - for Malware_Subject_Reference_ in self.Malware_Subject_Reference: - write('model_.MalwareSubjectReferenceType(\n') - Malware_Subject_Reference_.exportLiteral(write, level, name_='MalwareSubjectReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1705,26 +1365,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecPackage:', name_='Relationship', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareSubjectRelationshipListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Relationship=[\n') - level += 1 - for Relationship_ in self.Relationship: - write('model_.MalwareSubjectRelationshipType(\n') - Relationship_.exportLiteral(write, level, name_='MalwareSubjectRelationshipType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1786,19 +1426,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack write(' malware_subject_idref=%s' % (quote_attrib(self.malware_subject_idref), )) def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='MalwareSubjectReferenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.malware_subject_idref is not None and 'malware_subject_idref' not in already_processed: - already_processed.add('malware_subject_idref') - showIndent(write, level) - write('malware_subject_idref = %s,\n' % (self.malware_subject_idref,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1865,26 +1492,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' for Malware_Subject_ in self.Malware_Subject: Malware_Subject_.export(write, level, 'maecPackage:', name_='Malware_Subject', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareSubjectListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Malware_Subject=[\n') - level += 1 - for Malware_Subject_ in self.Malware_Subject: - write('model_.MalwareSubjectType(\n') - Malware_Subject_.exportLiteral(write, level, name_='MalwareSubjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -1953,26 +1560,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MinorVa eol_ = '' for Minor_Variant_ in self.Minor_Variant: Minor_Variant_.export(write, level, 'maecPackage:', name_='Minor_Variant', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MinorVariantListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Minor_Variant=[\n') - level += 1 - for Minor_Variant_ in self.Minor_Variant: - write('model_.cybox_core.ObjectType(\n') - Minor_Variant_.exportLiteral(write, level, name_='cybox_core.ObjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2059,39 +1646,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Finding for Bundle_External_Reference_ in self.Bundle_External_Reference: showIndent(write, level, pretty_print) write('<%sBundle_External_Reference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(Bundle_External_Reference_).encode(ExternalEncoding), input_name='Bundle_External_Reference'), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='FindingsBundleListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Meta_Analysis is not None: - write('Meta_Analysis=model_.MetaAnalysisType(\n') - self.Meta_Analysis.exportLiteral(write, level, name_='Meta_Analysis') - write('),\n') - showIndent(write, level) - write('Bundle=[\n') - level += 1 - for Bundle_ in self.Bundle: - write('model_.maec_bundle_schema.BundleType(\n') - Bundle_.exportLiteral(write, level, name_='maec_bundle_schema.BundleType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('Bundle_External_Reference=[\n') - level += 1 - for Bundle_External_Reference_ in self.Bundle_External_Reference: - showIndent(write, level) - write('%s,\n' % quote_python(Bundle_External_Reference_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2183,29 +1737,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Groupin write('<%sMalware_Toolkit_Name>%s%s' % ('maecPackage:', quote_xml(self.Malware_Toolkit_Name), 'maecPackage:', eol_)) if self.Clustering_Metadata is not None: self.Clustering_Metadata.export(write, level, 'maecPackage:', name_='Clustering_Metadata', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='GroupingRelationshipType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Type is not None: - write('Type=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Type.exportLiteral(write, level, name_='Type') - write('),\n') - if self.Malware_Family_Name is not None: - showIndent(write, level) - write('Malware_Family_Name=%s,\n' % quote_python(self.Malware_Family_Name).encode(ExternalEncoding)) - if self.Malware_Toolkit_Name is not None: - showIndent(write, level) - write('Malware_Toolkit_Name=%s,\n' % quote_python(self.Malware_Toolkit_Name).encode(ExternalEncoding)) - if self.Clustering_Metadata is not None: - write('Clustering_Metadata=model_.ClusteringMetadataType(\n') - self.Clustering_Metadata.exportLiteral(write, level, name_='Clustering_Metadata') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2285,26 +1816,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Groupin eol_ = '' for Grouping_Relationship_ in self.Grouping_Relationship: Grouping_Relationship_.export(write, level, 'maecPackage:', name_='Grouping_Relationship', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='GroupingRelationshipListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Grouping_Relationship=[\n') - level += 1 - for Grouping_Relationship_ in self.Grouping_Relationship: - write('model_.GroupingRelationshipType(\n') - Grouping_Relationship_.exportLiteral(write, level, name_='GroupingRelationshipType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2401,35 +1912,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster write('<%sCluster_Description>%s%s' % ('maecPackage:', quote_xml(self.Cluster_Description), 'maecPackage:', eol_)) if self.Cluster_Composition is not None: self.Cluster_Composition.export(write, level, 'maecPackage:', name_='Cluster_Composition', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ClusteringMetadataType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Algorithm_Name is not None: - showIndent(write, level) - write('Algorithm_Name=%s,\n' % quote_python(self.Algorithm_Name).encode(ExternalEncoding)) - if self.Algorithm_Version is not None: - showIndent(write, level) - write('Algorithm_Version=%s,\n' % quote_python(self.Algorithm_Version).encode(ExternalEncoding)) - if self.Algorithm_Parameters is not None: - write('Algorithm_Parameters=model_.ClusteringAlgorithmParametersType(\n') - self.Algorithm_Parameters.exportLiteral(write, level, name_='Algorithm_Parameters') - write('),\n') - if self.Cluster_Size is not None: - showIndent(write, level) - write('Cluster_Size=%d,\n' % self.Cluster_Size) - if self.Cluster_Description is not None: - showIndent(write, level) - write('Cluster_Description=%s,\n' % quote_python(self.Cluster_Description).encode(ExternalEncoding)) - if self.Cluster_Composition is not None: - write('Cluster_Composition=model_.ClusterCompositionType(\n') - self.Cluster_Composition.exportLiteral(write, level, name_='Cluster_Composition') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2546,30 +2028,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster self.Malware_Subject_Node_A.export(write, level, 'maecPackage:', name_='Malware_Subject_Node_A', pretty_print=pretty_print) if self.Malware_Subject_Node_B is not None: self.Malware_Subject_Node_B.export(write, level, 'maecPackage:', name_='Malware_Subject_Node_B', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ClusterEdgeNodePairType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.similarity_distance is not None and 'similarity_distance' not in already_processed: - already_processed.add('similarity_distance') - showIndent(write, level) - write('similarity_distance = %f,\n' % (self.similarity_distance,)) - if self.similarity_index is not None and 'similarity_index' not in already_processed: - already_processed.add('similarity_index') - showIndent(write, level) - write('similarity_index = %f,\n' % (self.similarity_index,)) - def exportLiteralChildren(self, write, level, name_): - if self.Malware_Subject_Node_A is not None: - write('Malware_Subject_Node_A=model_.MalwareSubjectReferenceType(\n') - self.Malware_Subject_Node_A.exportLiteral(write, level, name_='Malware_Subject_Node_A') - write('),\n') - if self.Malware_Subject_Node_B is not None: - write('Malware_Subject_Node_B=model_.MalwareSubjectReferenceType(\n') - self.Malware_Subject_Node_B.exportLiteral(write, level, name_='Malware_Subject_Node_B') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2663,29 +2121,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster eol_ = '' for Edge_Node_Pair_ in self.Edge_Node_Pair: Edge_Node_Pair_.export(write, level, 'maecPackage:', name_='Edge_Node_Pair', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ClusterCompositionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.score_type is not None and 'score_type' not in already_processed: - already_processed.add('score_type') - showIndent(write, level) - write('score_type = "%s",\n' % (self.score_type,)) - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Edge_Node_Pair=[\n') - level += 1 - for Edge_Node_Pair_ in self.Edge_Node_Pair: - write('model_.ClusterEdgeNodePairType(\n') - Edge_Node_Pair_.exportLiteral(write, level, name_='ClusterEdgeNodePairType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2759,21 +2194,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster if self.Number_of_Iterations is not None: showIndent(write, level, pretty_print) write('<%sNumber_of_Iterations>%s%s' % ('maecPackage:', self.gds_format_integer(self.Number_of_Iterations, input_name='Number_of_Iterations'), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='ClusteringAlgorithmParametersType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Distance_Threshold is not None: - showIndent(write, level) - write('Distance_Threshold=%f,\n' % self.Distance_Threshold) - if self.Number_of_Iterations is not None: - showIndent(write, level) - write('Number_of_Iterations=%d,\n' % self.Number_of_Iterations) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2850,19 +2270,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Network eol_ = '' if self.Captured_Protocols is not None: self.Captured_Protocols.export(write, level, 'maecPackage:', name_='Captured_Protocols', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='NetworkInfrastructureType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Captured_Protocols is not None: - write('Captured_Protocols=model_.CapturedProtocolListType(\n') - self.Captured_Protocols.exportLiteral(write, level, name_='Captured_Protocols') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -2941,29 +2348,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionE eol_ = '' for Action_Reference_ in self.Action_Reference: Action_Reference_.export(write, level, 'maecPackage:', name_='Action_Reference', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionEquivalenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action_Reference=[\n') - level += 1 - for Action_Reference_ in self.Action_Reference: - write('model_.cybox_core.ActionReferenceType(\n') - Action_Reference_.exportLiteral(write, level, name_='cybox_core.ActionReferenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3034,26 +2418,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionE eol_ = '' for Action_Equivalence_ in self.Action_Equivalence: Action_Equivalence_.export(write, level, 'maecPackage:', name_='Action_Equivalence', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ActionEquivalenceListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Action_Equivalence=[\n') - level += 1 - for Action_Equivalence_ in self.Action_Equivalence: - write('model_.ActionEquivalenceType(\n') - Action_Equivalence_.exportLiteral(write, level, name_='ActionEquivalenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3122,26 +2486,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Capture eol_ = '' for Protocol_ in self.Protocol: Protocol_.export(write, level, 'maecPackage:', name_='Protocol', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='CapturedProtocolListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Protocol=[\n') - level += 1 - for Protocol_ in self.Protocol: - write('model_.CapturedProtocolType(\n') - Protocol_.exportLiteral(write, level, name_='CapturedProtocolType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3229,31 +2573,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack write(' layer4_protocol=%s' % (quote_attrib(self.layer4_protocol), )) def exportChildren(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolType', fromsubclass_=False, pretty_print=True): pass - def exportLiteral(self, write, level, name_='CapturedProtocolType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.layer7_protocol is not None and 'layer7_protocol' not in already_processed: - already_processed.add('layer7_protocol') - showIndent(write, level) - write('layer7_protocol = %s,\n' % (self.layer7_protocol,)) - if self.port_number is not None and 'port_number' not in already_processed: - already_processed.add('port_number') - showIndent(write, level) - write('port_number = %d,\n' % (self.port_number,)) - if self.interaction_level is not None and 'interaction_level' not in already_processed: - already_processed.add('interaction_level') - showIndent(write, level) - write('interaction_level = %s,\n' % (self.interaction_level,)) - if self.layer4_protocol is not None and 'layer4_protocol' not in already_processed: - already_processed.add('layer4_protocol') - showIndent(write, level) - write('layer4_protocol = %s,\n' % (self.layer4_protocol,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3338,26 +2657,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectE eol_ = '' for Object_Equivalence_ in self.Object_Equivalence: Object_Equivalence_.export(write, level, 'maecPackage:', name_='Object_Equivalence', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectEquivalenceListType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Object_Equivalence=[\n') - level += 1 - for Object_Equivalence_ in self.Object_Equivalence: - write('model_.ObjectEquivalenceType(\n') - Object_Equivalence_.exportLiteral(write, level, name_='ObjectEquivalenceType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3423,20 +2722,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack write(' id=%s' % (quote_attrib(self.id), )) def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', fromsubclass_=False, pretty_print=True): super(ObjectEquivalenceType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='ObjectEquivalenceType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.add('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - super(ObjectEquivalenceType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(ObjectEquivalenceType, self).exportLiteralChildren(write, level, name_) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3504,20 +2789,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Hypervi eol_ = '' if self.VM_Hypervisor is not None: self.VM_Hypervisor.export(write, level, 'maecPackage:', name_='VM_Hypervisor', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='HypervisorHostSystemType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - super(HypervisorHostSystemType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(HypervisorHostSystemType, self).exportLiteralChildren(write, level, name_) - if self.VM_Hypervisor is not None: - write('VM_Hypervisor=model_.cybox_common.PlatformSpecificationType(\n') - self.VM_Hypervisor.exportLiteral(write, level, name_='VM_Hypervisor') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3585,20 +2856,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi eol_ = '' if self.Installed_Programs is not None: self.Installed_Programs.export(write, level, 'maecPackage:', name_='Installed_Programs', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='AnalysisSystemType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - super(AnalysisSystemType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(AnalysisSystemType, self).exportLiteralChildren(write, level, name_) - if self.Installed_Programs is not None: - write('Installed_Programs=model_.InstalledProgramsType(\n') - self.Installed_Programs.exportLiteral(write, level, name_='Installed_Programs') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3680,27 +2937,6 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack def exportChildren(self, write, level, namespace_='maecPackage:', name_='CommentType', fromsubclass_=False, pretty_print=True): super(CommentType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) pass - def exportLiteral(self, write, level, name_='CommentType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.timestamp is not None and 'timestamp' not in already_processed: - already_processed.add('timestamp') - showIndent(write, level) - write('timestamp = "%s",\n' % (self.timestamp,)) - if self.author is not None and 'author' not in already_processed: - already_processed.add('author') - showIndent(write, level) - write('author = "%s",\n' % (self.author,)) - super(CommentType, self).exportLiteralAttributes(write, level, already_processed, name_) - def exportLiteralChildren(self, write, level, name_): - super(CommentType, self).exportLiteralChildren(write, level, name_) - pass def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3803,27 +3039,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware if self.Description is not None: showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % (namespace_, self.gds_format_integer(self.Description, input_name='Description'), namespace_, eol_)) - def exportLiteral(self, write, level, name_='MalwareExceptionType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.is_fatal is not None and 'is_fatal' not in already_processed: - already_processed.add('is_fatal') - showIndent(write, level) - write('is_fatal = %s,\n' % (self.is_fatal,)) - def exportLiteralChildren(self, write, level, name_): - if self.Exception_Code is not None: - showIndent(write, level) - write('Exception_Code=%s,\n' % quote_python(self.Exception_Code).encode(ExternalEncoding)) - if self.Faulting_Address is not None: - showIndent(write, level) - write('Faulting_Address=%s,\n' % quote_python(self.Faulting_Address).encode(ExternalEncoding)) - if self.Description is not None: - showIndent(write, level) - write('Description=%d,\n' % self.Description) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -3920,27 +3135,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.Tools.export(write, level, namespace_, name_='Tools', pretty_print=pretty_print) for Debugging_File_ in self.Debugging_File: Debugging_File_.export(write, level, namespace_, name_='Debugging_File', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareDevelopmentEnvironmentType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Tools is not None: - showIndent(write, level) - write('Tools=%s,\n' % quote_python(self.Tools).encode(ExternalEncoding)) - showIndent(write, level) - write('Debugging_File=[\n') - level += 1 - for Debugging_File_ in self.Debugging_File: - showIndent(write, level) - write('%s,\n' % quote_python(Debugging_File_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4015,22 +3209,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware if self.Value is not None: showIndent(write, level, pretty_print) write('<%sValue>%s%s' % ('maecPackage:', quote_xml(self.Value), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='MalwareConfigurationParameterType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Name is not None: - write('Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Name.exportLiteral(write, level, name_='Name') - write('),\n') - if self.Value is not None: - showIndent(write, level) - write('Value=%s,\n' % quote_python(self.Value).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4114,34 +3292,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.Obfuscation.export(write, level, 'maecPackage:', name_='Obfuscation', pretty_print=pretty_print) for Configuration_Parameter_ in self.Configuration_Parameter: Configuration_Parameter_.export(write, level, 'maecPackage:', name_='Configuration_Parameter', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareConfigurationDetailsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Storage is not None: - write('Storage=model_.MalwareConfigurationStorageDetailsType(\n') - self.Storage.exportLiteral(write, level, name_='Storage') - write('),\n') - if self.Obfuscation is not None: - write('Obfuscation=model_.MalwareConfigurationObfuscationDetailsType(\n') - self.Obfuscation.exportLiteral(write, level, name_='Obfuscation') - write('),\n') - showIndent(write, level) - write('Configuration_Parameter=[\n') - level += 1 - for Configuration_Parameter_ in self.Configuration_Parameter: - write('model_.MalwareConfigurationParameterType(\n') - Configuration_Parameter_.exportLiteral(write, level, name_='MalwareConfigurationParameterType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4233,33 +3383,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware eol_ = '' for Algorithm_Details_ in self.Algorithm_Details: Algorithm_Details_.export(write, level, 'maecPackage:', name_='Algorithm_Details', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareConfigurationObfuscationDetailsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.is_encoded is not None and 'is_encoded' not in already_processed: - already_processed.add('is_encoded') - showIndent(write, level) - write('is_encoded = %s,\n' % (self.is_encoded,)) - if self.is_encrypted is not None and 'is_encrypted' not in already_processed: - already_processed.add('is_encrypted') - showIndent(write, level) - write('is_encrypted = %s,\n' % (self.is_encrypted,)) - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('Algorithm_Details=[\n') - level += 1 - for Algorithm_Details_ in self.Algorithm_Details: - write('model_.MalwareConfigurationObfuscationAlgorithmType(\n') - Algorithm_Details_.exportLiteral(write, level, name_='MalwareConfigurationObfuscationAlgorithmType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4355,25 +3478,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware write('<%sKey>%s%s' % ('maecPackage:', quote_xml(self.Key), 'maecPackage:', eol_)) if self.Algorithm_Name is not None: self.Algorithm_Name.export(write, level, 'maecPackage:', name_='Algorithm_Name', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareConfigurationObfuscationAlgorithmType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.ordinal_position is not None and 'ordinal_position' not in already_processed: - already_processed.add('ordinal_position') - showIndent(write, level) - write('ordinal_position = %d,\n' % (self.ordinal_position,)) - def exportLiteralChildren(self, write, level, name_): - if self.Key is not None: - showIndent(write, level) - write('Key=%s,\n' % quote_python(self.Key).encode(ExternalEncoding)) - if self.Algorithm_Name is not None: - write('Algorithm_Name=model_.cybox_common.ControlledVocabularyStringType(\n') - self.Algorithm_Name.exportLiteral(write, level, name_='Algorithm_Name') - write('),\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4465,34 +3569,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware self.File.export(write, level, 'maecPackage:', name_='File', pretty_print=pretty_print) for URL_ in self.URL: URL_.export(write, level, 'maecPackage:', name_='URL', pretty_print=pretty_print) - def exportLiteral(self, write, level, name_='MalwareConfigurationStorageDetailsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.Malware_Binary is not None: - write('Malware_Binary=model_.MalwareBinaryConfigurationStorageDetailsType(\n') - self.Malware_Binary.exportLiteral(write, level, name_='Malware_Binary') - write('),\n') - if self.File is not None: - write('File=model_.file_object.FileObjectType(\n') - self.File.exportLiteral(write, level, name_='File') - write('),\n') - showIndent(write, level) - write('URL=[\n') - level += 1 - for URL_ in self.URL: - write('model_.uri_object.URIObjectType(\n') - URL_.exportLiteral(write, level, name_='uri_object.URIObjectType') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) @@ -4579,24 +3655,6 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware if self.Section_Offset is not None: showIndent(write, level, pretty_print) write('<%sSection_Offset>%s%s' % ('maecPackage:', quote_xml(self.Section_Offset), 'maecPackage:', eol_)) - def exportLiteral(self, write, level, name_='MalwareBinaryConfigurationStorageDetailsType'): - level += 1 - already_processed = set() - self.exportLiteralAttributes(write, level, already_processed, name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.File_Offset is not None: - showIndent(write, level) - write('File_Offset=%s,\n' % quote_python(self.File_Offset).encode(ExternalEncoding)) - if self.Section_Name is not None: - showIndent(write, level) - write('Section_Name=%s,\n' % quote_python(self.Section_Name).encode(ExternalEncoding)) - if self.Section_Offset is not None: - showIndent(write, level) - write('Section_Offset=%s,\n' % quote_python(self.Section_Offset).encode(ExternalEncoding)) def build(self, node): already_processed = set() self.buildAttributes(node, node.attrib, already_processed) diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 62e0aed..44379a2 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -178,57 +178,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='malwareMetaData'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.version is not None and 'version' not in already_processed: - already_processed.append('version') - showIndent(write, level) - write('version = %f,\n' % (self.version,)) - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.company is not None: - showIndent(write, level) - write('company=%s,\n' % quote_python(self.company).encode(ExternalEncoding)) - if self.author is not None: - showIndent(write, level) - write('author=%s,\n' % quote_python(self.author).encode(ExternalEncoding)) - if self.comment is not None: - showIndent(write, level) - write('comment=%s,\n' % quote_python(self.comment).encode(ExternalEncoding)) - if self.timestamp is not None: - showIndent(write, level) - write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) - if self.objects is not None: - showIndent(write, level) - write('objects=model_.objects(\n') - self.objects.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.objectProperties is not None: - showIndent(write, level) - write('objectProperties=model_.objectProperties(\n') - self.objectProperties.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.relationships is not None: - showIndent(write, level) - write('relationships=model_.relationships(\n') - self.relationships.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.fieldData is not None: - showIndent(write, level) - write('fieldData=model_.fieldData(\n') - self.fieldData.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -442,146 +391,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='objects'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('file=[\n') - level += 1 - for file_ in self.file: - showIndent(write, level) - write('model_.fileObject(\n') - file_.exportLiteral(write, level, name_='fileObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('uri=[\n') - level += 1 - for uri_ in self.uri: - showIndent(write, level) - write('model_.uriObject(\n') - uri_.exportLiteral(write, level, name_='uriObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('domain=[\n') - level += 1 - for domain_ in self.domain: - showIndent(write, level) - write('model_.domainObject(\n') - domain_.exportLiteral(write, level, name_='domainObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('registry=[\n') - level += 1 - for registry_ in self.registry: - showIndent(write, level) - write('model_.registryObject(\n') - registry_.exportLiteral(write, level, name_='registryObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('ip=[\n') - level += 1 - for ip_ in self.ip: - showIndent(write, level) - write('model_.IPObject(\n') - ip_.exportLiteral(write, level, name_='IPObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('asn=[\n') - level += 1 - for asn_ in self.asn: - showIndent(write, level) - write('model_.ASNObject(\n') - asn_.exportLiteral(write, level, name_='ASNObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('entity=[\n') - level += 1 - for entity_ in self.entity: - showIndent(write, level) - write('model_.entityObject(\n') - entity_.exportLiteral(write, level, name_='entityObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('classification=[\n') - level += 1 - for classification_ in self.classification: - showIndent(write, level) - write('model_.classificationObject(\n') - classification_.exportLiteral(write, level, name_='classificationObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('softwarePackage=[\n') - level += 1 - for softwarePackage_ in self.softwarePackage: - showIndent(write, level) - write('model_.softwarePackageObject(\n') - softwarePackage_.exportLiteral(write, level, name_='softwarePackageObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('digitalSignature=[\n') - level += 1 - for digitalSignature_ in self.digitalSignature: - showIndent(write, level) - write('model_.digitalSignatureObject(\n') - digitalSignature_.exportLiteral(write, level, name_='digitalSignatureObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('taggant=[\n') - level += 1 - for taggant_ in self.taggant: - showIndent(write, level) - write('model_.taggantObject(\n') - taggant_.exportLiteral(write, level, name_='taggantObject') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -681,26 +490,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='objectProperties'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('objectProperty=[\n') - level += 1 - for objectProperty_ in self.objectProperty: - showIndent(write, level) - write('model_.objectProperty(\n') - objectProperty_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -759,26 +548,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='relationships'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('relationship=[\n') - level += 1 - for relationship_ in self.relationship: - showIndent(write, level) - write('model_.relationship(\n') - relationship_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -837,26 +606,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='fieldData'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('fieldDataEntry=[\n') - level += 1 - for fieldDataEntry_ in self.fieldDataEntry: - showIndent(write, level) - write('model_.fieldDataEntry(\n') - fieldDataEntry_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1156,179 +905,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='fileObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.md5 is not None: - showIndent(write, level) - write('md5=model_.xs_hexBinary(\n') - self.md5.exportLiteral(write, level, name_='md5') - showIndent(write, level) - write('),\n') - if self.sha1 is not None: - showIndent(write, level) - write('sha1=model_.xs_hexBinary(\n') - self.sha1.exportLiteral(write, level, name_='sha1') - showIndent(write, level) - write('),\n') - if self.sha256 is not None: - showIndent(write, level) - write('sha256=model_.xs_hexBinary(\n') - self.sha256.exportLiteral(write, level, name_='sha256') - showIndent(write, level) - write('),\n') - if self.sha512 is not None: - showIndent(write, level) - write('sha512=model_.xs_hexBinary(\n') - self.sha512.exportLiteral(write, level, name_='sha512') - showIndent(write, level) - write('),\n') - if self.size is not None: - showIndent(write, level) - write('size=%d,\n' % self.size) - if self.crc32 is not None: - showIndent(write, level) - write('crc32=%s,\n' % quote_python(self.crc32).encode(ExternalEncoding)) - showIndent(write, level) - write('fileType=[\n') - level += 1 - for fileType_ in self.fileType: - showIndent(write, level) - write('%s,\n' % quote_python(fileType_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('extraHash=[\n') - level += 1 - for extraHash_ in self.extraHash: - showIndent(write, level) - write('model_.extraHash(\n') - extraHash_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('filename=[\n') - level += 1 - for filename_ in self.filename: - showIndent(write, level) - write('%s,\n' % quote_python(filename_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('normalizedNativePath=[\n') - level += 1 - for normalizedNativePath_ in self.normalizedNativePath: - showIndent(write, level) - write('%s,\n' % quote_python(normalizedNativePath_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('filenameWithinInstaller=[\n') - level += 1 - for filenameWithinInstaller_ in self.filenameWithinInstaller: - showIndent(write, level) - write('%s,\n' % quote_python(filenameWithinInstaller_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('folderWithinInstaller=[\n') - level += 1 - for folderWithinInstaller_ in self.folderWithinInstaller: - showIndent(write, level) - write('%s,\n' % quote_python(folderWithinInstaller_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - if self.vendor is not None: - showIndent(write, level) - write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) - showIndent(write, level) - write('internalName=[\n') - level += 1 - for internalName_ in self.internalName: - showIndent(write, level) - write('%s,\n' % quote_python(internalName_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - showIndent(write, level) - write('language=[\n') - level += 1 - for language_ in self.language: - showIndent(write, level) - write('%s,\n' % quote_python(language_).encode(ExternalEncoding)) - level -= 1 - showIndent(write, level) - write('],\n') - if self.productName is not None: - showIndent(write, level) - write('productName=%s,\n' % quote_python(self.productName).encode(ExternalEncoding)) - if self.fileVersion is not None: - showIndent(write, level) - write('fileVersion=%s,\n' % quote_python(self.fileVersion).encode(ExternalEncoding)) - if self.productVersion is not None: - showIndent(write, level) - write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) - if self.developmentEnvironment is not None: - showIndent(write, level) - write('developmentEnvironment=%s,\n' % quote_python(self.developmentEnvironment).encode(ExternalEncoding)) - if self.checksum is not None: - showIndent(write, level) - write('checksum=model_.xs_hexBinary(\n') - self.checksum.exportLiteral(write, level, name_='checksum') - showIndent(write, level) - write('),\n') - if self.architecture is not None: - showIndent(write, level) - write('architecture=%s,\n' % quote_python(self.architecture).encode(ExternalEncoding)) - if self.buildTimeDateStamp is not None: - showIndent(write, level) - write('buildTimeDateStamp=%s,\n' % quote_python(self.buildTimeDateStamp).encode(ExternalEncoding)) - if self.compilerVersion is not None: - showIndent(write, level) - write('compilerVersion=%s,\n' % quote_python(self.compilerVersion).encode(ExternalEncoding)) - if self.linkerVersion is not None: - showIndent(write, level) - write('linkerVersion=%f,\n' % self.linkerVersion) - if self.minOSVersionCPE is not None: - showIndent(write, level) - write('minOSVersionCPE=%s,\n' % quote_python(self.minOSVersionCPE).encode(ExternalEncoding)) - if self.numberOfSections is not None: - showIndent(write, level) - write('numberOfSections=%d,\n' % self.numberOfSections) - if self.MIMEType is not None: - showIndent(write, level) - write('MIMEType=%s,\n' % quote_python(self.MIMEType).encode(ExternalEncoding)) - if self.requiredPrivilege is not None: - showIndent(write, level) - write('requiredPrivilege=%s,\n' % quote_python(self.requiredPrivilege).encode(ExternalEncoding)) - if self.digitalSignature is not None: - showIndent(write, level) - write('digitalSignature=model_.digitalSignatureObject(\n') - self.digitalSignature.exportLiteral(write, level, name_='digitalSignature') - showIndent(write, level) - write('),\n') - if self.taggant is not None: - showIndent(write, level) - write('taggant=model_.taggantObject(\n') - self.taggant.exportLiteral(write, level, name_='taggant') - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1519,20 +1095,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='extraHash'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -1605,23 +1167,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='registryObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.key is not None: - showIndent(write, level) - write('key=%s,\n' % quote_python(self.key).encode(ExternalEncoding)) - if self.valueName is not None: - showIndent(write, level) - write('valueName=%s,\n' % quote_python(self.valueName).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1692,20 +1237,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='entityObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.name is not None: - showIndent(write, level) - write('name=%s,\n' % quote_python(self.name).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1821,38 +1352,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='uriObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.uriString is not None: - showIndent(write, level) - write('uriString=%s,\n' % quote_python(self.uriString).encode(ExternalEncoding)) - if self.protocol is not None: - showIndent(write, level) - write('protocol=%s,\n' % quote_python(self.protocol).encode(ExternalEncoding)) - if self.hostname is not None: - showIndent(write, level) - write('hostname=%s,\n' % quote_python(self.hostname).encode(ExternalEncoding)) - if self.domain is not None: - showIndent(write, level) - write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) - if self.port is not None: - showIndent(write, level) - write('port=%d,\n' % self.port) - if self.path is not None: - showIndent(write, level) - write('path=%s,\n' % quote_python(self.path).encode(ExternalEncoding)) - if self.ipProtocol is not None: - showIndent(write, level) - write('ipProtocol=%s,\n' % quote_python(self.ipProtocol).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -1958,29 +1457,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='IPObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.startAddress is not None: - showIndent(write, level) - write('startAddress=model_.IPAddress(\n') - self.startAddress.exportLiteral(write, level, name_='startAddress') - showIndent(write, level) - write('),\n') - if self.endAddress is not None: - showIndent(write, level) - write('endAddress=model_.IPAddress(\n') - self.endAddress.exportLiteral(write, level, name_='endAddress') - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2050,20 +1526,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='IPAddress'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -2127,20 +1589,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='domainObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.domain is not None: - showIndent(write, level) - write('domain=%s,\n' % quote_python(self.domain).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2208,20 +1656,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='ASNObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = %d,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.as_number is not None: - showIndent(write, level) - write('as_number=%d,\n' % self.as_number) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2329,36 +1763,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='classificationObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.classificationName is not None: - showIndent(write, level) - write('classificationName=%s,\n' % quote_python(self.classificationName).encode(ExternalEncoding)) - if self.companyName is not None: - showIndent(write, level) - write('companyName=%s,\n' % quote_python(self.companyName).encode(ExternalEncoding)) - if self.category is not None: - showIndent(write, level) - write('category=%s,\n' % quote_python(self.category).encode(ExternalEncoding)) - if self.classificationDetails is not None: - showIndent(write, level) - write('classificationDetails=model_.classificationDetails(\n') - self.classificationDetails.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2462,29 +1866,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='classificationDetails'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.definitionVersion is not None: - showIndent(write, level) - write('definitionVersion=%s,\n' % quote_python(self.definitionVersion).encode(ExternalEncoding)) - if self.detectionAddedTimeStamp is not None: - showIndent(write, level) - write('detectionAddedTimeStamp=%s,\n' % quote_python(self.detectionAddedTimeStamp).encode(ExternalEncoding)) - if self.detectionShippedTimeStamp is not None: - showIndent(write, level) - write('detectionShippedTimeStamp=%s,\n' % quote_python(self.detectionShippedTimeStamp).encode(ExternalEncoding)) - if self.product is not None: - showIndent(write, level) - write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) - if self.productVersion is not None: - showIndent(write, level) - write('productVersion=%s,\n' % quote_python(self.productVersion).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2669,56 +2050,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='fieldDataEntry'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - if self.references is not None: - showIndent(write, level) - write('references=model_.references(\n') - self.references.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.startDate is not None: - showIndent(write, level) - write('startDate=%s,\n' % quote_python(self.startDate).encode(ExternalEncoding)) - if self.endDate is not None: - showIndent(write, level) - write('endDate=%s,\n' % quote_python(self.endDate).encode(ExternalEncoding)) - if self.firstSeenDate is not None: - showIndent(write, level) - write('firstSeenDate=%s,\n' % quote_python(self.firstSeenDate).encode(ExternalEncoding)) - if self.origin is not None: - showIndent(write, level) - write('origin=%s,\n' % quote_python(self.origin).encode(ExternalEncoding)) - if self.commonality is not None: - showIndent(write, level) - write('commonality=%d,\n' % self.commonality) - showIndent(write, level) - write('volume=[\n') - level += 1 - for volume_ in self.volume: - showIndent(write, level) - write('model_.volume(\n') - volume_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') - if self.importance is not None: - showIndent(write, level) - write('importance=%d,\n' % self.importance) - if self.location is not None: - showIndent(write, level) - write('location=model_.location(\n') - self.location.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2820,26 +2151,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='references'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('ref=[\n') - level += 1 - for ref_ in self.ref: - showIndent(write, level) - write('model_.reference(\n') - ref_.exportLiteral(write, level, name_='reference') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -2900,20 +2211,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='volume'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.units is not None and 'units' not in already_processed: - already_processed.append('units') - showIndent(write, level) - write('units = "%s",\n' % (self.units,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -2976,20 +2273,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='location'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -3045,17 +2328,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='reference'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -3114,20 +2386,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='property'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -3214,38 +2472,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='objectProperty'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.references is not None: - showIndent(write, level) - write('references=model_.references(\n') - self.references.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.timestamp is not None: - showIndent(write, level) - write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) - showIndent(write, level) - write('property=[\n') - level += 1 - for property_ in self.property: - showIndent(write, level) - write('model_.property(\n') - property_.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3350,36 +2576,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='relationship'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = %s,\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.source is not None: - showIndent(write, level) - write('source=model_.source(\n') - self.source.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.target is not None: - showIndent(write, level) - write('target=model_.target(\n') - self.target.exportLiteral(write, level) - showIndent(write, level) - write('),\n') - if self.timestamp is not None: - showIndent(write, level) - write('timestamp=%s,\n' % quote_python(self.timestamp).encode(ExternalEncoding)) def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3454,26 +2650,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='source'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('ref=[\n') - level += 1 - for ref_ in self.ref: - showIndent(write, level) - write('model_.reference(\n') - ref_.exportLiteral(write, level, name_='reference') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3532,26 +2708,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='target'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - pass - def exportLiteralChildren(self, write, level, name_): - showIndent(write, level) - write('ref=[\n') - level += 1 - for ref_ in self.ref: - showIndent(write, level) - write('model_.reference(\n') - ref_.exportLiteral(write, level, name_='reference') - showIndent(write, level) - write('),\n') - level -= 1 - showIndent(write, level) - write('],\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3661,44 +2817,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='softwarePackageObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.vendor is not None: - showIndent(write, level) - write('vendor=%s,\n' % quote_python(self.vendor).encode(ExternalEncoding)) - if self.productgroup is not None: - showIndent(write, level) - write('productgroup=%s,\n' % quote_python(self.productgroup).encode(ExternalEncoding)) - if self.product is not None: - showIndent(write, level) - write('product=%s,\n' % quote_python(self.product).encode(ExternalEncoding)) - if self.version is not None: - showIndent(write, level) - write('version=%s,\n' % quote_python(self.version).encode(ExternalEncoding)) - if self.update is not None: - showIndent(write, level) - write('update=%s,\n' % quote_python(self.update).encode(ExternalEncoding)) - if self.edition is not None: - showIndent(write, level) - write('edition=%s,\n' % quote_python(self.edition).encode(ExternalEncoding)) - if self.language is not None: - showIndent(write, level) - write('language=%s,\n' % quote_python(self.language).encode(ExternalEncoding)) - if self.CPEname is not None: - showIndent(write, level) - write('CPEname=model_.CPEname(\n') - self.CPEname.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -3792,20 +2910,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='CPEname'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.cpeVersion is not None and 'cpeVersion' not in already_processed: - already_processed.append('cpeVersion') - showIndent(write, level) - write('cpeVersion = "%s",\n' % (self.cpeVersion,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -3901,39 +3005,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='digitalSignatureObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.type_ is not None and 'type_' not in already_processed: - already_processed.append('type_') - showIndent(write, level) - write('type_ = "%s",\n' % (self.type_,)) - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.certificateIssuer is not None: - showIndent(write, level) - write('certificateIssuer=%s,\n' % quote_python(self.certificateIssuer).encode(ExternalEncoding)) - if self.certificateSubject is not None: - showIndent(write, level) - write('certificateSubject=%s,\n' % quote_python(self.certificateSubject).encode(ExternalEncoding)) - if self.certificateValidity is not None: - showIndent(write, level) - write('certificateValidity=%s,\n' % self.certificateValidity) - if self.certificateRevocationTimestamp is not None: - showIndent(write, level) - write('certificateRevocationTimestamp=%s,\n' % quote_python(self.certificateRevocationTimestamp).encode(ExternalEncoding)) - if self.signingTimestamp is not None: - showIndent(write, level) - write('signingTimestamp=model_.signingTimestamp(\n') - self.signingTimestamp.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: @@ -4019,20 +3090,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='signingTimestamp'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - showIndent(write, level) - write('valueOf_ = """%s""",\n' % (self.valueOf_,)) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.valid is not None and 'valid' not in already_processed: - already_processed.append('valid') - showIndent(write, level) - write('valid = %s,\n' % (self.valid,)) - def exportLiteralChildren(self, write, level, name_): - pass def build(self, node): self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) @@ -4115,29 +3172,6 @@ def hasContent_(self): return True else: return False - def exportLiteral(self, write, level, name_='taggantObject'): - level += 1 - self.exportLiteralAttributes(write, level, [], name_) - if self.hasContent_(): - self.exportLiteralChildren(write, level, name_) - def exportLiteralAttributes(self, write, level, already_processed, name_): - if self.id is not None and 'id' not in already_processed: - already_processed.append('id') - showIndent(write, level) - write('id = "%s",\n' % (self.id,)) - def exportLiteralChildren(self, write, level, name_): - if self.vendorID is not None: - showIndent(write, level) - write('vendorID=%s,\n' % quote_python(self.vendorID).encode(ExternalEncoding)) - if self.taggantValidity is not None: - showIndent(write, level) - write('taggantValidity=%s,\n' % self.taggantValidity) - if self.signingTimestamp is not None: - showIndent(write, level) - write('signingTimestamp=model_.signingTimestamp(\n') - self.signingTimestamp.exportLiteral(write, level) - showIndent(write, level) - write('),\n') def build(self, node): self.buildAttributes(node, node.attrib, []) for child in node: From 7ef67ee4af0b6153e0096cc70eeaa8a3fca9cace Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Tue, 16 Dec 2014 13:51:52 -0500 Subject: [PATCH 148/297] Added utf-8 encoding declaration to the top --- maec/bindings/mmdef_1_2.py | 1 + 1 file changed, 1 insertion(+) diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 44379a2..88698a3 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -1,3 +1,4 @@ +# -*- coding: utf-8 -*- # Copyright (c) 2014, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. From c09517473720b86568b136950b92019f87705ebf Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Tue, 16 Dec 2014 14:00:50 -0500 Subject: [PATCH 149/297] Modified tox.ini to point to python-cybox/master. * This will need to be updated after the nextd python-cybox release. --- tox.ini | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tox.ini b/tox.ini index bf03ece..883faeb 100644 --- a/tox.ini +++ b/tox.ini @@ -6,7 +6,9 @@ commands = nosetests maec sphinx-build -b doctest docs docs/_build/doctest sphinx-build -b html docs docs/_build/html -deps = -rrequirements.txt +deps = + https://github.com/CybOXProject/python-cybox/archive/master.zip + -rrequirements.txt [testenv:rhel6] basepython=python2.6 @@ -15,4 +17,5 @@ commands = deps = lxml==2.2.3 python-dateutil==1.4.1 + https://github.com/CybOXProject/python-cybox/archive/master.zip nose From c7efe3a836dd976ab12ff81f6715e202f0728e0b Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 16 Dec 2014 14:19:11 -0500 Subject: [PATCH 150/297] Updated context manager to work with cybox bindings --- maec/bindings/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/maec/bindings/__init__.py b/maec/bindings/__init__.py index 6685197..2ac39af 100644 --- a/maec/bindings/__init__.py +++ b/maec/bindings/__init__.py @@ -5,6 +5,7 @@ from datetime import datetime, tzinfo, timedelta import re import contextlib +import cybox.bindings as cybox_bindings from xml.sax import saxutils from lxml import etree as etree_ @@ -25,11 +26,16 @@ def save_encoding(encoding='utf-8'): global ExternalEncoding try: - orig_encoding = ExternalEncoding + orig_maec_encoding = ExternalEncoding + orig_cybox_encoding = cybox_bindings.ExternalEncoding + ExternalEncoding = encoding + cybox_bindings.ExternalEncoding = encoding + yield finally: - ExternalEncoding = orig_encoding + ExternalEncoding = orig_maec_encoding + cybox_bindings.ExternalEncoding = orig_cybox_encoding def parsexml_(*args, **kwargs): From 79ad404f96d910e8ff20edad8571053d3a0b2211 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 17 Dec 2014 13:13:05 -0500 Subject: [PATCH 151/297] Updated to_xml_file() to use to_xml() and added support for file-like objects. Closes #60 --- maec/__init__.py | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index be09bf0..5e2d3e1 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -38,14 +38,26 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" - def to_xml_file(self, filename, namespace_dict=None, custom_header=None): - """Export an object to an XML file. Only supports Package or Bundle objects at the moment.""" + def to_xml_file(self, file, namespace_dict=None, custom_header=None): + """Export an object to an XML file. Only supports Package or Bundle objects at the moment. + + Args: + file: the name of a file or a file-like object to write the output to. + namespace_dict: a dictionary of mappings of additional XML namespaces to + prefixes. + custom_header: a string, list, or dictionary that represents a custom + XML header to be written to the output. + """ # Update the namespace dictionary with namespaces found upon import if namespace_dict and hasattr(self, '__input_namespaces__'): namespace_dict.update(self.__input_namespaces__) elif not namespace_dict and hasattr(self, '__input_namespaces__'): namespace_dict = self.__input_namespaces__ - out_file = open(filename, 'w') + # Check whether we're dealing with a filename or file-like Object + if isinstance(file, basestring): + out_file = open(file, 'w') + else: + out_file = file out_file.write("\n") # Write out the custom header, if included if isinstance(custom_header, list): @@ -64,8 +76,7 @@ def to_xml_file(self, filename, namespace_dict=None, custom_header=None): out_file.write("", "\\-\\->") + "\n") out_file.write("-->\n") - - self.to_obj().export(out_file.write, 0, namespacedef_ = self._get_namespace_def(namespace_dict)) + out_file.write(self.to_xml(namespace_dict=namespace_dict)) out_file.close() def _get_namespace_def(self, additional_ns_dict=None): From b333b991dac48f43a68f5d2167d5ce237403fa92 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 17 Dec 2014 13:16:00 -0500 Subject: [PATCH 152/297] Fixed indentation --- docs/api/__init__.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api/__init__.rst b/docs/api/__init__.rst index 41406cf..0f87c0c 100644 --- a/docs/api/__init__.rst +++ b/docs/api/__init__.rst @@ -8,7 +8,7 @@ Classes .. autoclass:: Entity :show-inheritance: - :members: + :members: .. autoclass:: EntityList :show-inheritance: From f92c8ee9e5cef2ef13daa1acd4a8c5060521882f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 22 Dec 2014 13:03:09 -0500 Subject: [PATCH 153/297] Bumped up version to 4.1.0.10 --- CHANGES.txt | 7 +++++++ docs/index.rst | 6 +++--- maec/__init__.py | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 3d7b98e..7a33a0e 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,10 @@ +Version 4.1.0.10 +2014-12-22 +- Various Unicode-related fixes in the bindings [#32] +- [#58] Namespace collection +- [#60] Added support for File-like objects in to_xml_file() +- Various bug fixes + Version 4.1.0.9 2014-11-26 - Added __input_namespaces and __input_schemalocations to Package and Bundle diff --git a/docs/index.rst b/docs/index.rst index 8d410ef..9002710 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -20,13 +20,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.9 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.10 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.9 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.9 +__ https://pypi.python.org/pypi/maec/4.1.0.10 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.10 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 diff --git a/maec/__init__.py b/maec/__init__.py index 5e2d3e1..78ccfc3 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.9" +__version__ = "4.1.0.10" import collections import json From 9c05210bb9dc21bf8b91e578801c49af6823a616 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 22 Dec 2014 13:03:47 -0500 Subject: [PATCH 154/297] Updated required version of python-cybox --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 1bbe0a3..849786a 100644 --- a/setup.py +++ b/setup.py @@ -39,7 +39,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.8,<2.1.1.0'], + install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.9,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", From 43b40a8cc17d86bfff704be1f4fcf0da6a591f62 Mon Sep 17 00:00:00 2001 From: rbroberg Date: Mon, 22 Dec 2014 11:33:11 -0700 Subject: [PATCH 155/297] replace STIXPackage with Package; working xml sample filename --- docs/getting_started.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/getting_started.rst b/docs/getting_started.rst index effa514..27113c6 100644 --- a/docs/getting_started.rst +++ b/docs/getting_started.rst @@ -33,11 +33,11 @@ Creating a MAEC Package from maec.package.package import Package # Import the MAEC Package API from maec.package.malware_subject import MalwareSubject # Import the MAEC Malware Subject API - package = STIXPackage() # Create an instance of Package + package = Package() # Create an instance of Package malware_subject = MalwareSubject() # Create an instance of MalwareSubject package.add_malware_subject(malware_subject) # Add the Malware Subject to the Package - print(stix_package.to_xml()) # Print the XML for this MAEC Package + print(package.to_xml()) # Print the XML for this MAEC Package Parsing MAEC XML **************** @@ -46,7 +46,7 @@ Parsing MAEC XML import maec # Import the python-maec API - fn = 'stix_content.xml' # The MAEC content filename + fn = 'sample_maec_package.xml' # generate by running examples\package_generation_example.py maec_objects = maec.parse_xml_instance(fn) # Parse using the from_xml() method api_object = maec_objects['api'] # Get the API object from the parsed objects From 15106f2f910d147da3609ec5d71637268a89c1ea Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 23 Dec 2014 09:58:56 -0500 Subject: [PATCH 156/297] Removed pointers to python-cybox/master --- tox.ini | 2 -- 1 file changed, 2 deletions(-) diff --git a/tox.ini b/tox.ini index 883faeb..fcf8d9f 100644 --- a/tox.ini +++ b/tox.ini @@ -7,7 +7,6 @@ commands = sphinx-build -b doctest docs docs/_build/doctest sphinx-build -b html docs docs/_build/html deps = - https://github.com/CybOXProject/python-cybox/archive/master.zip -rrequirements.txt [testenv:rhel6] @@ -17,5 +16,4 @@ commands = deps = lxml==2.2.3 python-dateutil==1.4.1 - https://github.com/CybOXProject/python-cybox/archive/master.zip nose From 60cc7a6801468faf174f089a28bb8a642b186d89 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 13 Feb 2015 10:51:14 -0500 Subject: [PATCH 157/297] Updated copyright strings --- LICENSE.txt | 2 +- docs/index.rst | 2 +- docs/installation.rst | 2 +- examples/comparator_example.py | 2 +- examples/package_generation_example.py | 3 +- maec/analytics/distance.py | 2 +- maec/analytics/static_features.py | 2 +- maec/bindings/__init__.py | 2 +- maec/bindings/maec_bundle.py | 2 +- maec/bindings/maec_container.py | 2 +- maec/bindings/maec_package.py | 2 +- maec/bindings/mmdef_1_2.py | 2 +- maec/bundle/action_reference_list.py | 3 +- maec/bundle/av_classification.py | 2 +- maec/bundle/behavior.py | 10 +- maec/bundle/behavior_reference.py | 2 +- maec/bundle/bundle.py | 2 +- maec/bundle/bundle_reference.py | 2 +- maec/bundle/candidate_indicator.py | 2 +- maec/bundle/capability.py | 2 +- maec/bundle/malware_action.py | 2 +- maec/bundle/object_history.py | 2 +- maec/bundle/object_reference.py | 2 +- maec/bundle/process_tree.py | 2 +- maec/package/action_equivalence.py | 56 +-- maec/package/analysis.py | 404 ++++++++--------- maec/package/grouping_relationship.py | 172 ++++---- maec/package/malware_subject.py | 488 ++++++++++----------- maec/package/malware_subject_reference.py | 44 +- maec/package/object_equivalence.py | 58 +-- maec/package/package.py | 154 +++---- maec/test/bundle/av_classification_test.py | 50 +-- maec/test/bundle/behavior_test.py | 90 ++-- maec/test/bundle/bundle_test.py | 54 +-- maec/test/bundle/capability_test.py | 104 ++--- maec/test/bundle/process_tree_test.py | 114 ++--- maec/test/encoding_test.py | 2 +- maec/test/package/analysis_test.py | 86 ++-- maec/test/package/malware_subject_test.py | 56 +-- maec/test/package/package_test.py | 100 ++--- maec/utils/__init__.py | 2 +- maec/utils/deduplicator.py | 2 +- maec/utils/idgen.py | 2 +- maec/utils/merge.py | 2 +- maec/utils/nsparser.py | 2 +- maec/utils/parser.py | 2 +- scripts/calculate_distance.py | 2 +- scripts/run_deduplicator.py | 12 +- setup.py | 2 +- 49 files changed, 1063 insertions(+), 1055 deletions(-) diff --git a/LICENSE.txt b/LICENSE.txt index ba71b84..fdf626e 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -1,4 +1,4 @@ -Copyright (c) 2014, The MITRE Corporation +Copyright (c) 2015, The MITRE Corporation All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a/docs/index.rst b/docs/index.rst index 9002710..d88a7df 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -1,5 +1,5 @@ .. python-maec documentation master file, created by - sphinx-quickstart on Thu May 1 10:36:32 2014. + sphinx-quickstart on Thu May 1 10:36:32 2015. You can adapt this file completely to your liking, but it should at least contain the root `toctree` directive. diff --git a/docs/installation.rst b/docs/installation.rst index daf9d02..910e734 100644 --- a/docs/installation.rst +++ b/docs/installation.rst @@ -101,7 +101,7 @@ OR .. parsed-literal:: $ python - Python 2.7.6 (default, Mar 22 2014, 22:59:56) + Python 2.7.6 (default, Mar 22 2015, 22:59:56) [GCC 4.8.2] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import MAEC diff --git a/examples/comparator_example.py b/examples/comparator_example.py index e64b48e..d26a415 100644 --- a/examples/comparator_example.py +++ b/examples/comparator_example.py @@ -2,7 +2,7 @@ import maec.bindings.maec_bundle as maec_bundle_binding from maec.bundle.bundle import Bundle # Matching properties dictionary -match_on_dictionary = {'FileObjectType': ['full_name'], +match_on_dictionary = {'FileObjectType': ['file_name'], 'WindowsRegistryKeyObjectType': ['hive', 'values.name/data'], 'WindowsMutexObjectType': ['name']} # Parse in the input Bundle documents and create their python-maec Bundle class representations diff --git a/examples/package_generation_example.py b/examples/package_generation_example.py index b458dc1..838dfb4 100644 --- a/examples/package_generation_example.py +++ b/examples/package_generation_example.py @@ -8,7 +8,7 @@ from cybox.core import AssociatedObjects, AssociatedObject, Object, AssociationType from cybox.common import Hash, HashList from cybox.objects.file_object import File -from maec.bundle.bundle import Bundle +from maec.bundle.bundle import Bundle, Collections from maec.bundle.malware_action import MalwareAction from maec.bundle.capability import Capability from maec.package.analysis import Analysis @@ -57,6 +57,7 @@ bundle.add_capability(capability) # Add the Bundle to the Malware Subject subject.add_findings_bundle(bundle) +subject.findings_bundles.bundle = [bundle] # Add the Malware Subject to the Package package.add_malware_subject(subject) # Export the Package Bindings Object to an XML file and use the namespaceparser for writing out the namespace definitions diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py index e34ee9b..12dff90 100644 --- a/maec/analytics/distance.py +++ b/maec/analytics/distance.py @@ -1,5 +1,5 @@ # MAEC Distance Measure-related Classes - BETA -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # See LICENSE.txt for complete terms diff --git a/maec/analytics/static_features.py b/maec/analytics/static_features.py index f045b85..04f8f03 100644 --- a/maec/analytics/static_features.py +++ b/maec/analytics/static_features.py @@ -1,5 +1,5 @@ # MAEC Static Features List -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved static_features_dict = {'file_name' : {'feature_name' : 'file_name'}, diff --git a/maec/bindings/__init__.py b/maec/bindings/__init__.py index 2ac39af..ac20839 100644 --- a/maec/bindings/__init__.py +++ b/maec/bindings/__init__.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import base64 diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index c10a641..9c3642f 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index 8fe0a48..93d0570 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index e131836..fd04d34 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 88698a3..086b966 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index 10b5d83..c39c066 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -1,6 +1,6 @@ #MAEC Action Reference List Class -#Copyright (c) 2014, The MITRE Corporation +#Copyright (c) 2015, The MITRE Corporation #All rights reserved #Compatible with MAEC v4.1 @@ -17,3 +17,4 @@ class ActionReferenceList(maec.EntityList): _binding_class = bundle_binding.ActionReferenceListType _binding_var = "Action_Reference" _namespace = maec.bundle._namespace + \ No newline at end of file diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index 236224c..3feaf8c 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -1,6 +1,6 @@ # MAEC AV Classification classes -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 90e7e1a..7b5b6e4 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -1,10 +1,10 @@ -#MAEC Behavior Class +# MAEC Behavior Class -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 04/15/2014 +# Compatible with MAEC v4.1 +# Last updated 08/27/2014 import maec import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index 910de78..f16e816 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -1,6 +1,6 @@ # MAEC Behavior Reference Class -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index ac9e4f2..b1ef340 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -1,6 +1,6 @@ # MAEC Bundle Class -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index 77c17a7..f95e696 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -1,6 +1,6 @@ #MAEC Bundle Reference Class -#Copyright (c) 2014, The MITRE Corporation +#Copyright (c) 2015, The MITRE Corporation #All rights reserved #Compatible with MAEC v4.1 diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 9691918..11fa404 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -1,6 +1,6 @@ # MAEC Candidate Indicator Class -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index 5910e4e..0fea673 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -1,6 +1,6 @@ # MAEC Capability Classes -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 0a116f9..8bc2a27 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -1,6 +1,6 @@ # MAEC Malware Action Classes -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/object_history.py b/maec/bundle/object_history.py index eb89faa..bf60c56 100644 --- a/maec/bundle/object_history.py +++ b/maec/bundle/object_history.py @@ -1,6 +1,6 @@ # MAEC Object History Classes -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index 6326fd0..0ad67d1 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -1,6 +1,6 @@ # MAEC Object Reference Class -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 3e56ff6..d5b1aa3 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -1,6 +1,6 @@ # MAEC Process Tree classes -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index d94d187..873a209 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -1,29 +1,29 @@ -#MAEC Action Equivalence Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import maec -import maec.bindings.maec_package as package_binding -from cybox.core import ActionReference - -class ActionEquivalence(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ActionEquivalenceType - _namespace = maec.package._namespace - - id_ = maec.TypedField('id') - action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) - - def __init__(self): - super(ActionEquivalence, self).__init__() - self.id_ = maec.utils.idgen.create_id(prefix="action_equivalence") - -class ActionEquivalenceList(maec.EntityList): - _contained_type = ActionEquivalence - _binding_class = package_binding.ActionEquivalenceListType - _binding_var = "Action_Equivalence" +#MAEC Action Equivalence Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +from cybox.core import ActionReference + +class ActionEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ActionEquivalenceType + _namespace = maec.package._namespace + + id_ = maec.TypedField('id') + action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) + + def __init__(self): + super(ActionEquivalence, self).__init__() + self.id_ = maec.utils.idgen.create_id(prefix="action_equivalence") + +class ActionEquivalenceList(maec.EntityList): + _contained_type = ActionEquivalence + _binding_class = package_binding.ActionEquivalenceListType + _binding_var = "Action_Equivalence" _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 4d1bdc3..88e5d68 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -1,202 +1,202 @@ -#MAEC Analysis Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import cybox -from cybox.common import (PlatformSpecification, Personnel, StructuredText, - ToolInformation) -from cybox.objects.system_object import System - -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.bundle_reference import BundleReference - -class Source(maec.Entity): - _binding = package_binding - _binding_class = package_binding.SourceType - _namespace = maec.package._namespace - - name = maec.TypedField("Name") - method = maec.TypedField("Method") - reference = maec.TypedField("Reference") - organization = maec.TypedField("Organization") - url = maec.TypedField("URL") - - def __init__(self): - super(Source, self).__init__() - -class Comment(StructuredText): - _binding = package_binding - _binding_class = package_binding.CommentType - _namespace = maec.package._namespace - - author = maec.TypedField("author") - timestamp = maec.TypedField("timestamp") - observation_name = maec.TypedField("observation_name") - - def __init__(self): - super(Comment, self).__init__() - - def is_plain(self): - """Whether this can be represented as a string rather than a dictionary - """ - return (super(Comment, self).is_plain() and - self.author is None and - self.timestamp is None and - self.observation_name is None) - -class CommentList(maec.EntityList): - _contained_type = Comment - _binding_class = package_binding.CommentListType - _binding_var = "Comment" - _namespace = maec.package._namespace - -class ToolList(maec.EntityList): - _contained_type = ToolInformation - _binding_class = package_binding.ToolListType - _binding_var = "Tool" - _namespace = maec.package._namespace - -class DynamicAnalysisMetadata(maec.Entity): - _binding = package_binding - _binding_class = package_binding.DynamicAnalysisMetadataType - _namespace = maec.package._namespace - - command_line = maec.TypedField("Command_Line") - analysis_duration = maec.TypedField("Analysis_Duration") - exit_code = maec.TypedField("Exit_Code") - #raised_exception = maec.TypedField("Raised_Exception", MalwareException) - - def __init__(self): - super(DynamicAnalysisMetadata, self).__init__() - -class HypervisorHostSystem(System): - _binding = package_binding - _binding_class = package_binding.HypervisorHostSystemType - _namespace = maec.package._namespace - - vm_hypervisor = maec.TypedField("VM_Hypervisor", PlatformSpecification) - - def __init__(self): - super(HypervisorHostSystem, self).__init__() - -class InstalledPrograms(maec.EntityList): - _contained_type = PlatformSpecification - _binding_class = package_binding.InstalledProgramsType - _binding_var = "Program" - _namespace = maec.package._namespace - -class AnalysisSystem(System): - _binding = package_binding - _binding_class = package_binding.AnalysisSystemType - _namespace = maec.package._namespace - - installed_programs = maec.TypedField("Installed_Programs", InstalledPrograms) - - def __init__(self): - super(AnalysisSystem, self).__init__() - self.installed_programs = InstalledPrograms() - -class AnalysisSystemList(maec.EntityList): - _contained_type = AnalysisSystem - _binding_class = package_binding.AnalysisSystemListType - _binding_var = "Analysis_System" - _namespace = maec.package._namespace - -class CapturedProtocol(maec.Entity): - _binding = package_binding - _binding_class = package_binding.CapturedProtocolType - _namespace = maec.package._namespace - - layer7_protocol = maec.TypedField("layer7_protocol") - layer4_protocol = maec.TypedField("layer4_protocol") - port_number = maec.TypedField("port_number") - interaction_level = maec.TypedField("interaction_level") - - def __init__(self): - super(CapturedProtocol, self).__init__() - -class CapturedProtocolList(maec.EntityList): - _contained_type = CapturedProtocol - _binding_class = package_binding.CapturedProtocolListType - _binding_var = "Protocol" - _namespace = maec.package._namespace - -class NetworkInfrastructure(maec.Entity): - _binding = package_binding - _binding_class = package_binding.NetworkInfrastructureType - _namespace = maec.package._namespace - - captured_protocols = maec.TypedField("Captured_Protocols", CapturedProtocolList) - - def __init__(self): - super(NetworkInfrastructure, self).__init__() - self.captured_protocols = CapturedProtocolList() - -class AnalysisEnvironment(maec.Entity): - _binding = package_binding - _binding_class = package_binding.AnalysisEnvironmentType - _namespace = maec.package._namespace - - hypervisor_host_system = maec.TypedField("Hypervisor_Host_System", HypervisorHostSystem) - analysis_systems = maec.TypedField("Analysis_Systems", AnalysisSystemList) - network_infrastructure = maec.TypedField("Network_Infrastructure", NetworkInfrastructure) - - def __init__(self): - super(AnalysisEnvironment, self).__init__() - -class Analysis(maec.Entity): - _binding = package_binding - _binding_class = package_binding.AnalysisType - _namespace = maec.package._namespace - - id_ = maec.TypedField("id") - method = maec.TypedField("method") - type_ = maec.TypedField("type") - ordinal_position = maec.TypedField("ordinal_position") - start_datetime = maec.TypedField("start_datetime") - complete_datetime = maec.TypedField("complete_datetime") - lastupdate_datetime = maec.TypedField("lastupdate_datetime") - source = maec.TypedField("Source", Source) - analysts = maec.TypedField("Analysts", Personnel) - summary = maec.TypedField("Summary", StructuredText) - comments = maec.TypedField("Comments", CommentList) - findings_bundle_reference = maec.TypedField("Findings_Bundle_Reference", BundleReference, multiple = True) - tools = maec.TypedField("Tools", ToolList) - dynamic_analysis_metadata = maec.TypedField("Dynamic_Analysis_Metadata", DynamicAnalysisMetadata) - analysis_environment = maec.TypedField("Analysis_Environment", AnalysisEnvironment) - report = maec.TypedField("Report", StructuredText) - - def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): - super(Analysis, self).__init__() - if id: - self.id_ = id - else: - self.id_ = maec.utils.idgen.create_id(prefix="analysis") - self.method = method - self.type_ = type - self.findings_bundle_reference = findings_bundle_reference - - #"Public" methods - # set the findings_bundle_reference values; accepts a list of bundle ID values - def set_findings_bundle(self, bundle_id): - self.findings_bundle_reference = [BundleReference.from_dict({'bundle_idref' : bundle_id})] - - # add a tool to this Anaysis's ToolList - def add_tool(self, tool): - if not self.tools: - self.tools = ToolList() - self.tools.append(tool) - - - - - - - - - +#MAEC Analysis Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import cybox +from cybox.common import (PlatformSpecification, Personnel, StructuredText, + ToolInformation) +from cybox.objects.system_object import System + +import maec +import maec.bindings.maec_package as package_binding +from maec.bundle.bundle_reference import BundleReference + +class Source(maec.Entity): + _binding = package_binding + _binding_class = package_binding.SourceType + _namespace = maec.package._namespace + + name = maec.TypedField("Name") + method = maec.TypedField("Method") + reference = maec.TypedField("Reference") + organization = maec.TypedField("Organization") + url = maec.TypedField("URL") + + def __init__(self): + super(Source, self).__init__() + +class Comment(StructuredText): + _binding = package_binding + _binding_class = package_binding.CommentType + _namespace = maec.package._namespace + + author = maec.TypedField("author") + timestamp = maec.TypedField("timestamp") + observation_name = maec.TypedField("observation_name") + + def __init__(self): + super(Comment, self).__init__() + + def is_plain(self): + """Whether this can be represented as a string rather than a dictionary + """ + return (super(Comment, self).is_plain() and + self.author is None and + self.timestamp is None and + self.observation_name is None) + +class CommentList(maec.EntityList): + _contained_type = Comment + _binding_class = package_binding.CommentListType + _binding_var = "Comment" + _namespace = maec.package._namespace + +class ToolList(maec.EntityList): + _contained_type = ToolInformation + _binding_class = package_binding.ToolListType + _binding_var = "Tool" + _namespace = maec.package._namespace + +class DynamicAnalysisMetadata(maec.Entity): + _binding = package_binding + _binding_class = package_binding.DynamicAnalysisMetadataType + _namespace = maec.package._namespace + + command_line = maec.TypedField("Command_Line") + analysis_duration = maec.TypedField("Analysis_Duration") + exit_code = maec.TypedField("Exit_Code") + #raised_exception = maec.TypedField("Raised_Exception", MalwareException) + + def __init__(self): + super(DynamicAnalysisMetadata, self).__init__() + +class HypervisorHostSystem(System): + _binding = package_binding + _binding_class = package_binding.HypervisorHostSystemType + _namespace = maec.package._namespace + + vm_hypervisor = maec.TypedField("VM_Hypervisor", PlatformSpecification) + + def __init__(self): + super(HypervisorHostSystem, self).__init__() + +class InstalledPrograms(maec.EntityList): + _contained_type = PlatformSpecification + _binding_class = package_binding.InstalledProgramsType + _binding_var = "Program" + _namespace = maec.package._namespace + +class AnalysisSystem(System): + _binding = package_binding + _binding_class = package_binding.AnalysisSystemType + _namespace = maec.package._namespace + + installed_programs = maec.TypedField("Installed_Programs", InstalledPrograms) + + def __init__(self): + super(AnalysisSystem, self).__init__() + self.installed_programs = InstalledPrograms() + +class AnalysisSystemList(maec.EntityList): + _contained_type = AnalysisSystem + _binding_class = package_binding.AnalysisSystemListType + _binding_var = "Analysis_System" + _namespace = maec.package._namespace + +class CapturedProtocol(maec.Entity): + _binding = package_binding + _binding_class = package_binding.CapturedProtocolType + _namespace = maec.package._namespace + + layer7_protocol = maec.TypedField("layer7_protocol") + layer4_protocol = maec.TypedField("layer4_protocol") + port_number = maec.TypedField("port_number") + interaction_level = maec.TypedField("interaction_level") + + def __init__(self): + super(CapturedProtocol, self).__init__() + +class CapturedProtocolList(maec.EntityList): + _contained_type = CapturedProtocol + _binding_class = package_binding.CapturedProtocolListType + _binding_var = "Protocol" + _namespace = maec.package._namespace + +class NetworkInfrastructure(maec.Entity): + _binding = package_binding + _binding_class = package_binding.NetworkInfrastructureType + _namespace = maec.package._namespace + + captured_protocols = maec.TypedField("Captured_Protocols", CapturedProtocolList) + + def __init__(self): + super(NetworkInfrastructure, self).__init__() + self.captured_protocols = CapturedProtocolList() + +class AnalysisEnvironment(maec.Entity): + _binding = package_binding + _binding_class = package_binding.AnalysisEnvironmentType + _namespace = maec.package._namespace + + hypervisor_host_system = maec.TypedField("Hypervisor_Host_System", HypervisorHostSystem) + analysis_systems = maec.TypedField("Analysis_Systems", AnalysisSystemList) + network_infrastructure = maec.TypedField("Network_Infrastructure", NetworkInfrastructure) + + def __init__(self): + super(AnalysisEnvironment, self).__init__() + +class Analysis(maec.Entity): + _binding = package_binding + _binding_class = package_binding.AnalysisType + _namespace = maec.package._namespace + + id_ = maec.TypedField("id") + method = maec.TypedField("method") + type_ = maec.TypedField("type") + ordinal_position = maec.TypedField("ordinal_position") + start_datetime = maec.TypedField("start_datetime") + complete_datetime = maec.TypedField("complete_datetime") + lastupdate_datetime = maec.TypedField("lastupdate_datetime") + source = maec.TypedField("Source", Source) + analysts = maec.TypedField("Analysts", Personnel) + summary = maec.TypedField("Summary", StructuredText) + comments = maec.TypedField("Comments", CommentList) + findings_bundle_reference = maec.TypedField("Findings_Bundle_Reference", BundleReference, multiple = True) + tools = maec.TypedField("Tools", ToolList) + dynamic_analysis_metadata = maec.TypedField("Dynamic_Analysis_Metadata", DynamicAnalysisMetadata) + analysis_environment = maec.TypedField("Analysis_Environment", AnalysisEnvironment) + report = maec.TypedField("Report", StructuredText) + + def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): + super(Analysis, self).__init__() + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="analysis") + self.method = method + self.type_ = type + self.findings_bundle_reference = findings_bundle_reference + + #"Public" methods + # set the findings_bundle_reference values; accepts a list of bundle ID values + def set_findings_bundle(self, bundle_id): + self.findings_bundle_reference = [BundleReference.from_dict({'bundle_idref' : bundle_id})] + + # add a tool to this Anaysis's ToolList + def add_tool(self, tool): + if not self.tools: + self.tools = ToolList() + self.tools.append(tool) + + + + + + + + + diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 45bd052..0483eb5 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -1,86 +1,86 @@ -#MAEC Grouping Relationship Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import cybox -import maec -import maec.bindings.maec_package as package_binding -from maec.package.malware_subject_reference import MalwareSubjectReference -from cybox.common import VocabString - -class ClusterEdgeNodePair(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusterEdgeNodePairType - _namespace = maec.package._namespace - - similarity_index = maec.TypedField("similarity_index") - similarity_distance = maec.TypedField("similarity_distance") - malware_subject_node_a = maec.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) - malware_subject_node_b = maec.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) - - def __init__(self): - super(ClusterEdgeNodePair, self).__init__() - -class ClusterComposition(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusterCompositionType - _namespace = maec.package._namespace - - score_type = maec.TypedField("score_type") - edge_node_pair = maec.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) - - def __init__(self): - super(ClusterComposition, self).__init__() - -class ClusteringAlgorithmParameters(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusteringAlgorithmParametersType - _namespace = maec.package._namespace - - distance_threashold = maec.TypedField("Distance_Threashold") - number_of_iterations = maec.TypedField("Number_of_Iterations") - - def __init__(self): - super(ClusteringAlgorithmParameters, self).__init__() - -class ClusteringMetadata(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusteringMetadataType - _namespace = maec.package._namespace - - algorithm_name = maec.TypedField("Algorithm_Name") - algorithm_version = maec.TypedField("Algorithm_Version") - algorithm_parameters = maec.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) - cluster_size = maec.TypedField("Cluster_Size") - cluster_description = maec.TypedField("Cluster_Description") - cluster_composition = maec.TypedField("Cluster_Composition", ClusterComposition) - - def __init__(self): - super(ClusteringMetadata, self).__init__() - -class GroupingRelationship(maec.Entity): - _binding = package_binding - _binding_class = package_binding.GroupingRelationshipType - _namespace = maec.package._namespace - - type_ = maec.TypedField("Type", VocabString) - malware_family_name = maec.TypedField("Malware_Family_Name") - malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") - clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) - - def __init__(self): - super(GroupingRelationship, self).__init__() - -class GroupingRelationshipList(maec.EntityList): - _contained_type = GroupingRelationship - _binding_class = package_binding.GroupingRelationshipListType - _binding_var = "Grouping_Relationship" - _namespace = maec.package._namespace - - - - +#MAEC Grouping Relationship Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import cybox +import maec +import maec.bindings.maec_package as package_binding +from maec.package.malware_subject_reference import MalwareSubjectReference +from cybox.common import VocabString + +class ClusterEdgeNodePair(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterEdgeNodePairType + _namespace = maec.package._namespace + + similarity_index = maec.TypedField("similarity_index") + similarity_distance = maec.TypedField("similarity_distance") + malware_subject_node_a = maec.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) + malware_subject_node_b = maec.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) + + def __init__(self): + super(ClusterEdgeNodePair, self).__init__() + +class ClusterComposition(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterCompositionType + _namespace = maec.package._namespace + + score_type = maec.TypedField("score_type") + edge_node_pair = maec.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) + + def __init__(self): + super(ClusterComposition, self).__init__() + +class ClusteringAlgorithmParameters(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringAlgorithmParametersType + _namespace = maec.package._namespace + + distance_threashold = maec.TypedField("Distance_Threashold") + number_of_iterations = maec.TypedField("Number_of_Iterations") + + def __init__(self): + super(ClusteringAlgorithmParameters, self).__init__() + +class ClusteringMetadata(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringMetadataType + _namespace = maec.package._namespace + + algorithm_name = maec.TypedField("Algorithm_Name") + algorithm_version = maec.TypedField("Algorithm_Version") + algorithm_parameters = maec.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) + cluster_size = maec.TypedField("Cluster_Size") + cluster_description = maec.TypedField("Cluster_Description") + cluster_composition = maec.TypedField("Cluster_Composition", ClusterComposition) + + def __init__(self): + super(ClusteringMetadata, self).__init__() + +class GroupingRelationship(maec.Entity): + _binding = package_binding + _binding_class = package_binding.GroupingRelationshipType + _namespace = maec.package._namespace + + type_ = maec.TypedField("Type", VocabString) + malware_family_name = maec.TypedField("Malware_Family_Name") + malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") + clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) + + def __init__(self): + super(GroupingRelationship, self).__init__() + +class GroupingRelationshipList(maec.EntityList): + _contained_type = GroupingRelationship + _binding_class = package_binding.GroupingRelationshipListType + _binding_var = "Grouping_Relationship" + _namespace = maec.package._namespace + + + + diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index d8066de..744cceb 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -1,245 +1,245 @@ -#MAEC Malware Subject Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import cybox -from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation -from cybox.objects.file_object import File -from cybox.objects.uri_object import URI -from cybox.core import Object - -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.bundle import Bundle -from maec.package.action_equivalence import ActionEquivalenceList -from maec.package.analysis import Analysis -from maec.package.malware_subject_reference import MalwareSubjectReference -from maec.package.object_equivalence import ObjectEquivalenceList - -class MinorVariants(maec.EntityList): - _contained_type = Object - _binding_class = package_binding.MinorVariantListType - _binding_var = "Minor_Variant" - _namespace = maec.package._namespace - -class Analyses(maec.EntityList): - _contained_type = Analysis - _binding_class = package_binding.AnalysisListType - _binding_var = "Analysis" - _namespace = maec.package._namespace - -class MalwareSubjectRelationship(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareSubjectRelationshipType - _namespace = maec.package._namespace - - malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) - type_ = maec.TypedField("Type", VocabString) - - def __init__(self): - super(MalwareSubjectRelationship, self).__init__() - - -class MalwareSubjectRelationshipList(maec.EntityList): - _contained_type = MalwareSubjectRelationship - _binding_class = package_binding.MalwareSubjectRelationshipListType - _binding_var = "Relationship" - _namespace = maec.package._namespace - -class MetaAnalysis(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MetaAnalysisType - _namespace = maec.package._namespace - - action_equivalences = maec.TypedField("Action_Equivalences", ActionEquivalenceList) - object_equivalences = maec.TypedField("Object_Equivalences", ObjectEquivalenceList) - - def __init__(self): - super(MetaAnalysis, self).__init__() - -class FindingsBundleList(maec.Entity): - _binding = package_binding - _binding_class = package_binding.FindingsBundleListType - _namespace = maec.package._namespace - - meta_analysis = maec.TypedField("Meta_Analysis", MetaAnalysis) - bundle = maec.TypedField("Bundle", Bundle, multiple = True) - bundle_external_reference = maec.TypedField("Bundle_External_Reference", multiple = True) - - def __init__(self): - super(FindingsBundleList, self).__init__() - - def add_bundle(self, bundle): - if not self.bundle: - self.bundle = [] - self.bundle.append(bundle) - - def add_bundle_external_reference(self, bundle_external_reference): - if not self.bundle_external_reference: - self.bundle_external_reference = [] - self.bundle_external_reference.append(bundle_external_reference) - -class MalwareDevelopmentEnvironment(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareDevelopmentEnvironmentType - _namespace = maec.package._namespace - - tools = maec.TypedField("Tools", ToolInformation) - debugging_file = maec.TypedField("Debugging_File", File, multiple = True) - - def __init__(self): - super(MalwareDevelopmentEnvironment, self).__init__() - - -class MalwareConfigurationParameter(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareConfigurationParameterType - _namespace = maec.package._namespace - - name = maec.TypedField("Name", VocabString) - value = maec.TypedField("Value") - - def __init__(self): - super(MalwareConfigurationParameter, self).__init__() - - -class MalwareBinaryConfigurationStorageDetails(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType - _namespace = maec.package._namespace - - file_offset = maec.TypedField("File_Offset") - section_name = maec.TypedField("Section_Name") - section_offset = maec.TypedField("Section_Offset") - - def __init__(self): - super(MalwareBinaryConfigurationStorageDetails, self).__init__() - -class MalwareConfigurationStorageDetails(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareConfigurationStorageDetailsType - _namespace = maec.package._namespace - - malware_binary = maec.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) - file = maec.TypedField("File", File) - url = maec.TypedField("URL", URI, multiple = True) - - def __init__(self): - super(MalwareConfigurationStorageDetails, self).__init__() - -class MalwareConfigurationObfuscationAlgorithm(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType - _namespace = maec.package._namespace - - ordinal_position = maec.TypedField("ordinal_position") - key = maec.TypedField("Key") - algorithm_name = maec.TypedField("Algorithm_Name", VocabString) - - def __init__(self): - super(MalwareConfigurationObfuscationAlgorithm, self).__init__() - - -class MalwareConfigurationObfuscationDetails(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType - _namespace = maec.package._namespace - - is_encoded = maec.TypedField("is_encoded") - is_encrypted = maec.TypedField("is_encrypted") - algorithm_details = maec.TypedField("Algorithm_Details", MalwareConfigurationObfuscationAlgorithm, multiple = True) - - def __init__(self): - super(MalwareConfigurationObfuscationDetails, self).__init__() - self.algorithm_details = [] - - -class MalwareConfigurationDetails(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareConfigurationDetailsType - _namespace = maec.package._namespace - - storage = maec.TypedField("Storage", MalwareConfigurationStorageDetails) - obfuscation = maec.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) - configuration_parameter = maec.TypedField("Configuration_Parameter", MalwareConfigurationParameter, multiple = True) - - def __init__(self): - super(MalwareConfigurationDetails, self).__init__() - -class MalwareSubject(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareSubjectType - _namespace = maec.package._namespace - - id_ = maec.TypedField("id") - malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) - label = maec.TypedField("Label", VocabString, multiple=True) - configuration_details = maec.TypedField("Configuration_Details", MalwareConfigurationDetails) - minor_variants = maec.TypedField("Minor_Variants", MinorVariants) - development_environment = maec.TypedField("Development_Environment", MalwareDevelopmentEnvironment) - #field_data = maec.TypedField("field_data") # TODO: support metadata:fieldDataEntry - analyses = maec.TypedField("Analyses", Analyses) - findings_bundles = maec.TypedField("Findings_Bundles", FindingsBundleList) - relationships = maec.TypedField("Relationships", MalwareSubjectRelationshipList) - compatible_platform = maec.TypedField("Compatible_Platform", PlatformSpecification, multiple=True) - - def __init__(self, id = None, malware_instance_object_attributes = None): - super(MalwareSubject, self).__init__() - if id: - self.id_ = id - else: - self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") - #Set the Malware Instance Object Attributes (a CybOX object) if they are not none - self.malware_instance_object_attributes = malware_instance_object_attributes - - #Public methods - #Set the Malware_Instance_Object_Attributes with a CybOX object - def set_malware_instance_object_attributes(self, malware_instance_object_attributes): - self.malware_instance_object_attributes = malware_instance_object_attributes - - #Add an Analysis to the Analyses - def add_analysis(self, analysis): - if not self.analyses: - self.analyses = Analyses() - self.analyses.append(analysis) - - def get_analyses(self): - return self.analyses - - #Get all Bundles in the Subject - def get_all_bundles(self): - return self.findings_bundles.bundle - - #Add a MAEC Bundle to the Findings Bundles - def add_findings_bundle(self, bundle): - if not self.findings_bundles: - self.findings_bundles = FindingsBundleList() - self.findings_bundles.add_bundle(bundle) - - def deduplicate_bundles(self): - """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" - all_bundles = self.get_all_bundles() - for bundle in all_bundles: - bundle.deduplicate() - - def dereference_bundles(self): - """Dereference all Findings Bundles in the Malware Subject. For now, only handles Objects""" - all_bundles = self.get_all_bundles() - for bundle in all_bundles: - bundle.dereference_objects([self.malware_instance_object_attributes]) - - def normalize_bundles(self): - """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" - all_bundles = self.get_all_bundles() - for bundle in all_bundles: - bundle.normalize_objects() - -class MalwareSubjectList(maec.EntityList): - _contained_type = MalwareSubject - _binding_class = package_binding.MalwareSubjectListType - _binding_var = "Malware_Subject" +#MAEC Malware Subject Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import cybox +from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation +from cybox.objects.file_object import File +from cybox.objects.uri_object import URI +from cybox.core import Object + +import maec +import maec.bindings.maec_package as package_binding +from maec.bundle.bundle import Bundle +from maec.package.action_equivalence import ActionEquivalenceList +from maec.package.analysis import Analysis +from maec.package.malware_subject_reference import MalwareSubjectReference +from maec.package.object_equivalence import ObjectEquivalenceList + +class MinorVariants(maec.EntityList): + _contained_type = Object + _binding_class = package_binding.MinorVariantListType + _binding_var = "Minor_Variant" + _namespace = maec.package._namespace + +class Analyses(maec.EntityList): + _contained_type = Analysis + _binding_class = package_binding.AnalysisListType + _binding_var = "Analysis" + _namespace = maec.package._namespace + +class MalwareSubjectRelationship(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectRelationshipType + _namespace = maec.package._namespace + + malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) + type_ = maec.TypedField("Type", VocabString) + + def __init__(self): + super(MalwareSubjectRelationship, self).__init__() + + +class MalwareSubjectRelationshipList(maec.EntityList): + _contained_type = MalwareSubjectRelationship + _binding_class = package_binding.MalwareSubjectRelationshipListType + _binding_var = "Relationship" + _namespace = maec.package._namespace + +class MetaAnalysis(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MetaAnalysisType + _namespace = maec.package._namespace + + action_equivalences = maec.TypedField("Action_Equivalences", ActionEquivalenceList) + object_equivalences = maec.TypedField("Object_Equivalences", ObjectEquivalenceList) + + def __init__(self): + super(MetaAnalysis, self).__init__() + +class FindingsBundleList(maec.Entity): + _binding = package_binding + _binding_class = package_binding.FindingsBundleListType + _namespace = maec.package._namespace + + meta_analysis = maec.TypedField("Meta_Analysis", MetaAnalysis) + bundle = maec.TypedField("Bundle", Bundle, multiple = True) + bundle_external_reference = maec.TypedField("Bundle_External_Reference", multiple = True) + + def __init__(self): + super(FindingsBundleList, self).__init__() + + def add_bundle(self, bundle): + if not self.bundle: + self.bundle = [] + self.bundle.append(bundle) + + def add_bundle_external_reference(self, bundle_external_reference): + if not self.bundle_external_reference: + self.bundle_external_reference = [] + self.bundle_external_reference.append(bundle_external_reference) + +class MalwareDevelopmentEnvironment(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareDevelopmentEnvironmentType + _namespace = maec.package._namespace + + tools = maec.TypedField("Tools", ToolInformation) + debugging_file = maec.TypedField("Debugging_File", File, multiple = True) + + def __init__(self): + super(MalwareDevelopmentEnvironment, self).__init__() + + +class MalwareConfigurationParameter(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationParameterType + _namespace = maec.package._namespace + + name = maec.TypedField("Name", VocabString) + value = maec.TypedField("Value") + + def __init__(self): + super(MalwareConfigurationParameter, self).__init__() + + +class MalwareBinaryConfigurationStorageDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType + _namespace = maec.package._namespace + + file_offset = maec.TypedField("File_Offset") + section_name = maec.TypedField("Section_Name") + section_offset = maec.TypedField("Section_Offset") + + def __init__(self): + super(MalwareBinaryConfigurationStorageDetails, self).__init__() + +class MalwareConfigurationStorageDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationStorageDetailsType + _namespace = maec.package._namespace + + malware_binary = maec.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) + file = maec.TypedField("File", File) + url = maec.TypedField("URL", URI, multiple = True) + + def __init__(self): + super(MalwareConfigurationStorageDetails, self).__init__() + +class MalwareConfigurationObfuscationAlgorithm(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType + _namespace = maec.package._namespace + + ordinal_position = maec.TypedField("ordinal_position") + key = maec.TypedField("Key") + algorithm_name = maec.TypedField("Algorithm_Name", VocabString) + + def __init__(self): + super(MalwareConfigurationObfuscationAlgorithm, self).__init__() + + +class MalwareConfigurationObfuscationDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType + _namespace = maec.package._namespace + + is_encoded = maec.TypedField("is_encoded") + is_encrypted = maec.TypedField("is_encrypted") + algorithm_details = maec.TypedField("Algorithm_Details", MalwareConfigurationObfuscationAlgorithm, multiple = True) + + def __init__(self): + super(MalwareConfigurationObfuscationDetails, self).__init__() + self.algorithm_details = [] + + +class MalwareConfigurationDetails(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareConfigurationDetailsType + _namespace = maec.package._namespace + + storage = maec.TypedField("Storage", MalwareConfigurationStorageDetails) + obfuscation = maec.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) + configuration_parameter = maec.TypedField("Configuration_Parameter", MalwareConfigurationParameter, multiple = True) + + def __init__(self): + super(MalwareConfigurationDetails, self).__init__() + +class MalwareSubject(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectType + _namespace = maec.package._namespace + + id_ = maec.TypedField("id") + malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) + label = maec.TypedField("Label", VocabString, multiple=True) + configuration_details = maec.TypedField("Configuration_Details", MalwareConfigurationDetails) + minor_variants = maec.TypedField("Minor_Variants", MinorVariants) + development_environment = maec.TypedField("Development_Environment", MalwareDevelopmentEnvironment) + #field_data = maec.TypedField("field_data") # TODO: support metadata:fieldDataEntry + analyses = maec.TypedField("Analyses", Analyses) + findings_bundles = maec.TypedField("Findings_Bundles", FindingsBundleList) + relationships = maec.TypedField("Relationships", MalwareSubjectRelationshipList) + compatible_platform = maec.TypedField("Compatible_Platform", PlatformSpecification, multiple=True) + + def __init__(self, id = None, malware_instance_object_attributes = None): + super(MalwareSubject, self).__init__() + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") + #Set the Malware Instance Object Attributes (a CybOX object) if they are not none + self.malware_instance_object_attributes = malware_instance_object_attributes + + #Public methods + #Set the Malware_Instance_Object_Attributes with a CybOX object + def set_malware_instance_object_attributes(self, malware_instance_object_attributes): + self.malware_instance_object_attributes = malware_instance_object_attributes + + #Add an Analysis to the Analyses + def add_analysis(self, analysis): + if not self.analyses: + self.analyses = Analyses() + self.analyses.append(analysis) + + def get_analyses(self): + return self.analyses + + #Get all Bundles in the Subject + def get_all_bundles(self): + return self.findings_bundles.bundle + + #Add a MAEC Bundle to the Findings Bundles + def add_findings_bundle(self, bundle): + if not self.findings_bundles: + self.findings_bundles = FindingsBundleList() + self.findings_bundles.add_bundle(bundle) + + def deduplicate_bundles(self): + """DeDuplicate all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.deduplicate() + + def dereference_bundles(self): + """Dereference all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.dereference_objects([self.malware_instance_object_attributes]) + + def normalize_bundles(self): + """Normalize all Findings Bundles in the Malware Subject. For now, only handles Objects""" + all_bundles = self.get_all_bundles() + for bundle in all_bundles: + bundle.normalize_objects() + +class MalwareSubjectList(maec.EntityList): + _contained_type = MalwareSubject + _binding_class = package_binding.MalwareSubjectListType + _binding_var = "Malware_Subject" _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index d6483d1..20311cb 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -1,22 +1,22 @@ -#MAEC Malware Subject Reference Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import maec -import maec.bindings.maec_package as package_binding -import cybox - -class MalwareSubjectReference(maec.Entity): - _binding = package_binding - _binding_class = package_binding.MalwareSubjectReferenceType - _namespace = maec.package._namespace - - malware_subject_idref = maec.TypedField("malware_subject_idref") - - def __init__(self, malware_subject_idref = None): - super(MalwareSubjectReference, self).__init__() - self.malware_subject_idref = malware_subject_idref +#MAEC Malware Subject Reference Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +import cybox + +class MalwareSubjectReference(maec.Entity): + _binding = package_binding + _binding_class = package_binding.MalwareSubjectReferenceType + _namespace = maec.package._namespace + + malware_subject_idref = maec.TypedField("malware_subject_idref") + + def __init__(self, malware_subject_idref = None): + super(MalwareSubjectReference, self).__init__() + self.malware_subject_idref = malware_subject_idref diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 42a8d17..03d9e1e 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -1,30 +1,30 @@ -#MAEC Action Equivalence Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import cybox -import maec -import maec.bindings.maec_package as package_binding -from maec.bundle.object_reference import ObjectReference - -class ObjectEquivalence(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ObjectEquivalenceType - _namespace = maec.package._namespace - - id_ = maec.TypedField("id") - object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) - - def init(self, id = None): - super(ObjectEquivalence, self).__init__() - self.id_ = id - -class ObjectEquivalenceList(maec.EntityList): - _contained_type = ObjectEquivalence - _binding_class = package_binding.ObjectEquivalenceListType - _binding_var = "Object_Equivalence" +#MAEC Action Equivalence Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import cybox +import maec +import maec.bindings.maec_package as package_binding +from maec.bundle.object_reference import ObjectReference + +class ObjectEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ObjectEquivalenceType + _namespace = maec.package._namespace + + id_ = maec.TypedField("id") + object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) + + def init(self, id = None): + super(ObjectEquivalence, self).__init__() + self.id_ = id + +class ObjectEquivalenceList(maec.EntityList): + _contained_type = ObjectEquivalence + _binding_class = package_binding.ObjectEquivalenceListType + _binding_var = "Object_Equivalence" _namespace = maec.package._namespace \ No newline at end of file diff --git a/maec/package/package.py b/maec/package/package.py index b10597c..a0f6e9a 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -1,77 +1,77 @@ -#MAEC Package Class - -#Copyright (c) 2014, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - -import maec -import maec.bindings.maec_package as package_binding -from maec.package.malware_subject import MalwareSubjectList -from maec.package.grouping_relationship import GroupingRelationshipList -from cybox.common import DateTime - -class Package(maec.Entity): - _binding = package_binding - _binding_class = package_binding.PackageType - _namespace = maec.package._namespace - - id_ = maec.TypedField('id') - timestamp = maec.TypedField('timestamp') - schema_version = maec.TypedField('schema_version') - malware_subjects = maec.TypedField('Malware_Subjects', MalwareSubjectList) - grouping_relationships = maec.TypedField('Grouping_Relationships', GroupingRelationshipList) - - def __init__(self, id = None, schema_version = "2.1", timestamp = None): - super(Package, self).__init__() - if id: - self.id_ = id - else: - self.id_ = maec.utils.idgen.create_id(prefix="package") - self.schema_version = schema_version - self.timestamp = timestamp - self.malware_subjects = MalwareSubjectList() - self.__input_namespaces__ = {} - self.__input_schemalocations__ = {} - - #Public methods - #Add a malware subject to this Package - def add_malware_subject(self, malware_subject): - self.malware_subjects.append(malware_subject) - - #Add a grouping relationship - def add_grouping_relationship(self, grouping_relationship): - if not self.grouping_relationships: - self.grouping_relationships = GroupingRelationshipList() - self.grouping_relationships.append(grouping_relationship) - - # Create new Package from the XML document at the specified path - @staticmethod - def from_xml(xml_file): - ''' - Returns a tuple of (api_object, binding_object). - Parameters: - xml_file - either a filename or a stream object - ''' - - if isinstance(xml_file, basestring): - f = open(xml_file, "rb") - else: - f = xml_file - - doc = package_binding.parsexml_(f) - maec_package_obj = package_binding.PackageType().factory() - maec_package_obj.build(doc.getroot()) - maec_package = Package.from_obj(maec_package_obj) - - return (maec_package, maec_package_obj) - - # Transform duplicate objects within this Package into references pointing to a single canonical object - def deduplicate_malware_subjects(self): - """DeDuplicate all Malware_Subjects in the Package. For now, only handles Objects in Findings Bundles""" - for malware_subject in self.malware_subjects: - malware_subject.deduplicate_bundles() - - - +#MAEC Package Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +#Compatible with MAEC v4.1 +#Last updated 08/20/2014 + +import maec +import maec.bindings.maec_package as package_binding +from maec.package.malware_subject import MalwareSubjectList +from maec.package.grouping_relationship import GroupingRelationshipList +from cybox.common import DateTime + +class Package(maec.Entity): + _binding = package_binding + _binding_class = package_binding.PackageType + _namespace = maec.package._namespace + + id_ = maec.TypedField('id') + timestamp = maec.TypedField('timestamp') + schema_version = maec.TypedField('schema_version') + malware_subjects = maec.TypedField('Malware_Subjects', MalwareSubjectList) + grouping_relationships = maec.TypedField('Grouping_Relationships', GroupingRelationshipList) + + def __init__(self, id = None, schema_version = "2.1", timestamp = None): + super(Package, self).__init__() + if id: + self.id_ = id + else: + self.id_ = maec.utils.idgen.create_id(prefix="package") + self.schema_version = schema_version + self.timestamp = timestamp + self.malware_subjects = MalwareSubjectList() + self.__input_namespaces__ = {} + self.__input_schemalocations__ = {} + + #Public methods + #Add a malware subject to this Package + def add_malware_subject(self, malware_subject): + self.malware_subjects.append(malware_subject) + + #Add a grouping relationship + def add_grouping_relationship(self, grouping_relationship): + if not self.grouping_relationships: + self.grouping_relationships = GroupingRelationshipList() + self.grouping_relationships.append(grouping_relationship) + + # Create new Package from the XML document at the specified path + @staticmethod + def from_xml(xml_file): + ''' + Returns a tuple of (api_object, binding_object). + Parameters: + xml_file - either a filename or a stream object + ''' + + if isinstance(xml_file, basestring): + f = open(xml_file, "rb") + else: + f = xml_file + + doc = package_binding.parsexml_(f) + maec_package_obj = package_binding.PackageType().factory() + maec_package_obj.build(doc.getroot()) + maec_package = Package.from_obj(maec_package_obj) + + return (maec_package, maec_package_obj) + + # Transform duplicate objects within this Package into references pointing to a single canonical object + def deduplicate_malware_subjects(self): + """DeDuplicate all Malware_Subjects in the Package. For now, only handles Objects in Findings Bundles""" + for malware_subject in self.malware_subjects: + malware_subject.deduplicate_bundles() + + + diff --git a/maec/test/bundle/av_classification_test.py b/maec/test/bundle/av_classification_test.py index 8fc76a2..9ce1e9d 100644 --- a/maec/test/bundle/av_classification_test.py +++ b/maec/test/bundle/av_classification_test.py @@ -1,25 +1,25 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.bundle.av_classification import AVClassification - -class TestAVClassification(EntityTestCase, unittest.TestCase): - klass = AVClassification - - _full_dict = { - 'classification_name':'Some!Trojan', - 'vendor':'McAfee' - } - - def test_round_trip(self): - o = AVClassification('Some!Trojan') - o.vendor = 'McAfee' - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": - unittest.main() +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.av_classification import AVClassification + +class TestAVClassification(EntityTestCase, unittest.TestCase): + klass = AVClassification + + _full_dict = { + 'classification_name':'Some!Trojan', + 'vendor':'McAfee' + } + + def test_round_trip(self): + o = AVClassification('Some!Trojan') + o.vendor = 'McAfee' + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() diff --git a/maec/test/bundle/behavior_test.py b/maec/test/bundle/behavior_test.py index e6b2286..36d95ba 100644 --- a/maec/test/bundle/behavior_test.py +++ b/maec/test/bundle/behavior_test.py @@ -1,46 +1,46 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.bundle.bundle import Behavior - -class TestBehavior(EntityTestCase, unittest.TestCase): - klass = Behavior - - _full_dict = { - 'ordinal_position': 1, - 'status': 'Success', - 'duration': 'PT3S', - 'description': 'Malware engages in some behavior wherein...', - 'purpose': { - 'description': 'Here is why the malware does this...', - 'vulnerability_exploit': { - 'known_vulnerability': True, - 'cve': { - 'cve_id': 'CVE-2013-1337', - 'description': '.NET vulnerability' - }, - 'targeted_platforms': [{ 'description': 'Windows ME' }] - } - }, - 'action_composition': { - 'action':[{ 'behavioral_ordering': 1 }], - 'action_reference':[{ 'action_id': 'some_id' }], - 'action_equivalence_reference':[{ 'behavioral_ordering': 1 }] - } - } - - def test_id_autoset(self): - o = Behavior() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = Behavior() - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.bundle import Behavior + +class TestBehavior(EntityTestCase, unittest.TestCase): + klass = Behavior + + _full_dict = { + 'ordinal_position': 1, + 'status': 'Success', + 'duration': 'PT3S', + 'description': 'Malware engages in some behavior wherein...', + 'purpose': { + 'description': 'Here is why the malware does this...', + 'vulnerability_exploit': { + 'known_vulnerability': True, + 'cve': { + 'cve_id': 'CVE-2013-1337', + 'description': '.NET vulnerability' + }, + 'targeted_platforms': [{ 'description': 'Windows ME' }] + } + }, + 'action_composition': { + 'action':[{ 'behavioral_ordering': 1 }], + 'action_reference':[{ 'action_id': 'some_id' }], + 'action_equivalence_reference':[{ 'behavioral_ordering': 1 }] + } + } + + def test_id_autoset(self): + o = Behavior() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Behavior() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": unittest.main() \ No newline at end of file diff --git a/maec/test/bundle/bundle_test.py b/maec/test/bundle/bundle_test.py index 3d1db1b..e0b4db1 100644 --- a/maec/test/bundle/bundle_test.py +++ b/maec/test/bundle/bundle_test.py @@ -1,27 +1,27 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.bundle.bundle import Bundle - -class TestBundle(EntityTestCase, unittest.TestCase): - klass = Bundle - - _full_dict = { - 'defined_subject':False - } - - def test_id_autoset(self): - o = Bundle() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = Bundle() - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": - unittest.main() +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.bundle import Bundle + +class TestBundle(EntityTestCase, unittest.TestCase): + klass = Bundle + + _full_dict = { + 'defined_subject':False + } + + def test_id_autoset(self): + o = Bundle() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Bundle() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() diff --git a/maec/test/bundle/capability_test.py b/maec/test/bundle/capability_test.py index 53fd4a5..ff2d139 100644 --- a/maec/test/bundle/capability_test.py +++ b/maec/test/bundle/capability_test.py @@ -1,53 +1,53 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.bundle.capability import Capability - -class TestCapability(EntityTestCase, unittest.TestCase): - klass = Capability - - _full_dict = { - 'description':'Perform some action', - 'strategic_objective':[{ - 'name': { - 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#DataTheftStrategicObjectivesVocab-1.0', - 'value':'steal stored information' - }, - 'property':[{ - 'name': { - 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', - 'value':'encryption algorithm' - }, - 'value': 'AES-256' - }, - { - 'name': { - 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', - 'value':'protocol used' - }, - 'value': 'TCP' - }] - }], - 'tactical_objective':[{ - 'name': { - 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#FraudTacticalObjectivesVocab-1.0', - 'value':'access premium service' - } - }] - } - - def test_id_autoset(self): - o = Capability() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = Capability() - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.capability import Capability + +class TestCapability(EntityTestCase, unittest.TestCase): + klass = Capability + + _full_dict = { + 'description':'Perform some action', + 'strategic_objective':[{ + 'name': { + 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#DataTheftStrategicObjectivesVocab-1.0', + 'value':'steal stored information' + }, + 'property':[{ + 'name': { + 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', + 'value':'encryption algorithm' + }, + 'value': 'AES-256' + }, + { + 'name': { + 'vocab_reference': 'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#CommonCapabilityPropertiesVocab-1.0', + 'value':'protocol used' + }, + 'value': 'TCP' + }] + }], + 'tactical_objective':[{ + 'name': { + 'vocab_reference':'http://maec.mitre.org/XMLSchema/default_vocabularies/2.1/maec_default_vocabularies.xsd#FraudTacticalObjectivesVocab-1.0', + 'value':'access premium service' + } + }] + } + + def test_id_autoset(self): + o = Capability() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Capability() + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": unittest.main() \ No newline at end of file diff --git a/maec/test/bundle/process_tree_test.py b/maec/test/bundle/process_tree_test.py index 2475b02..ee5016d 100644 --- a/maec/test/bundle/process_tree_test.py +++ b/maec/test/bundle/process_tree_test.py @@ -1,58 +1,58 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.bundle.process_tree import ProcessTree, ProcessTreeNode - -class TestCapability(EntityTestCase, unittest.TestCase): - klass = ProcessTree - - _full_dict = { - "root_process": { - "xsi:type": "ProcessTreeNodeType", - "id": "example:process_tree-7f44d6ed-1a0b-4bff-ae57-1491b751444f", - "injected_process": [{ - "xsi:type": "ProcessTreeNodeType", - "id": "example:process_tree-2897a24c-5f0b-4850-a995-578c98f47ed7" - }], - "spawned_process": [{ - "xsi:type": "ProcessTreeNodeType", - "id": "example:process_tree-3aacff1f-2c78-46c7-8e71-95d1a61dc05a", - "spawned_process": [{ - "xsi:type": "ProcessTreeNodeType", - "id": "example:process_tree-a355d96b-8545-4ce5-b7e5-86670076ecf8" - }] - }, { - "xsi:type": "ProcessTreeNodeType", - "id": "example:process_tree-d5589470-c6a5-4d54-a576-62e79c9ba8a0" - }] - } - } - - - def test_id_autoset(self): - o = ProcessTreeNode() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = ProcessTree() - root = ProcessTreeNode() - spawned_child1 = ProcessTreeNode() - spawned_child2 = ProcessTreeNode() - injected_child = ProcessTreeNode() - spawned_grandchild = ProcessTreeNode() - - o.set_root_process(root) - root.add_spawned_process(spawned_child1) - root.add_spawned_process(spawned_child2) - root.add_injected_process(injected_child) - spawned_child1.add_spawned_process(spawned_grandchild) - - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.bundle.process_tree import ProcessTree, ProcessTreeNode + +class TestCapability(EntityTestCase, unittest.TestCase): + klass = ProcessTree + + _full_dict = { + "root_process": { + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-7f44d6ed-1a0b-4bff-ae57-1491b751444f", + "injected_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-2897a24c-5f0b-4850-a995-578c98f47ed7" + }], + "spawned_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-3aacff1f-2c78-46c7-8e71-95d1a61dc05a", + "spawned_process": [{ + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-a355d96b-8545-4ce5-b7e5-86670076ecf8" + }] + }, { + "xsi:type": "ProcessTreeNodeType", + "id": "example:process_tree-d5589470-c6a5-4d54-a576-62e79c9ba8a0" + }] + } + } + + + def test_id_autoset(self): + o = ProcessTreeNode() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = ProcessTree() + root = ProcessTreeNode() + spawned_child1 = ProcessTreeNode() + spawned_child2 = ProcessTreeNode() + injected_child = ProcessTreeNode() + spawned_grandchild = ProcessTreeNode() + + o.set_root_process(root) + root.add_spawned_process(spawned_child1) + root.add_spawned_process(spawned_child2) + root.add_injected_process(injected_child) + spawned_child1.add_spawned_process(spawned_grandchild) + + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": unittest.main() \ No newline at end of file diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py index 2d2f377..9f3cc1c 100644 --- a/maec/test/encoding_test.py +++ b/maec/test/encoding_test.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. """Tests for various encoding issues throughout the library""" diff --git a/maec/test/package/analysis_test.py b/maec/test/package/analysis_test.py index 8261e6c..5b575e7 100644 --- a/maec/test/package/analysis_test.py +++ b/maec/test/package/analysis_test.py @@ -1,44 +1,44 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.package.analysis import Analysis, Source - - -class TestPackage(EntityTestCase, unittest.TestCase): - klass = Analysis - - _full_dict = { - "source": { - "url": "http://www.threatexpert.com", - "organization": "ThreatExpert", - "name": "ThreatExpert", - "method": "triage" - }, - "start_datetime": "2014-08-06T18:30:00", - "id": "example:analysis-5e1a1095-65a7-459e-9272-2c7883d9c20f" - } - - - def test_id_autoset(self): - o = Analysis() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = Analysis() - o.source = Source() - o.source.name = "ThreatExpert" - o.source.organization = "ThreatExpert" - o.source.method = "triage" - o.source.url = "http://www.threatexpert.com" - - o.start_datetime = "2014-08-06T18:30:00" - - o2 = round_trip(o, True) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.package.analysis import Analysis, Source + + +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Analysis + + _full_dict = { + "source": { + "url": "http://www.threatexpert.com", + "organization": "ThreatExpert", + "name": "ThreatExpert", + "method": "triage" + }, + "start_datetime": "2014-08-06T18:30:00", + "id": "example:analysis-5e1a1095-65a7-459e-9272-2c7883d9c20f" + } + + + def test_id_autoset(self): + o = Analysis() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Analysis() + o.source = Source() + o.source.name = "ThreatExpert" + o.source.organization = "ThreatExpert" + o.source.method = "triage" + o.source.url = "http://www.threatexpert.com" + + o.start_datetime = "2014-08-06T18:30:00" + + o2 = round_trip(o, True) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": unittest.main() \ No newline at end of file diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index 85b5a09..ceeb1b8 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -1,29 +1,29 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.package.analysis import Analysis - - -class TestPackage(EntityTestCase, unittest.TestCase): - klass = Analysis - - _full_dict = { - - } - - def test_id_autoset(self): - o = Analysis() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = Analysis() - o2 = round_trip(o) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": - unittest.main() +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.package.analysis import Analysis + + +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Analysis + + _full_dict = { + + } + + def test_id_autoset(self): + o = Analysis() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = Analysis() + o2 = round_trip(o) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index c2a6934..7449fe4 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -1,51 +1,51 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import unittest - -from cybox.test import EntityTestCase, round_trip -from maec.package.malware_subject import MalwareSubject -from maec.bundle.bundle import Bundle - -class TestMalwareSubject(EntityTestCase, unittest.TestCase): - klass = MalwareSubject - - _full_dict = { - 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, - 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', - 'properties': {'file_name': 'abcd.dll', - 'size_in_bytes': 123456L, - 'xsi:type': 'FileObjectType'} - }], - 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', - 'name': {'value': 'create file', - 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} - }], - 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': 'persistence'}]}, - 'defined_subject': False, - 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', - 'schema_version': '4.1'}] - }, - 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', - 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', - 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', - 'type': u'MD5'}], - 'size_in_bytes': 35532L, - 'xsi:type': 'FileObjectType'}}} - - def test_id_autoset(self): - o = MalwareSubject() - self.assertNotEqual(o.id_, None) - - def test_round_trip(self): - o = MalwareSubject() - o.add_findings_bundle(Bundle()) - o2 = round_trip(o) - - self.assertEqual(o.to_dict(), o2.to_dict()) - -if __name__ == "__main__": - unittest.main() +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from cybox.test import EntityTestCase, round_trip +from maec.package.malware_subject import MalwareSubject +from maec.bundle.bundle import Bundle + +class TestMalwareSubject(EntityTestCase, unittest.TestCase): + klass = MalwareSubject + + _full_dict = { + 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': {'file_name': 'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType'} + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': {'value': 'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} + }], + 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence'}]}, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1'}] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5'}], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType'}}} + + def test_id_autoset(self): + o = MalwareSubject() + self.assertNotEqual(o.id_, None) + + def test_round_trip(self): + o = MalwareSubject() + o.add_findings_bundle(Bundle()) + o2 = round_trip(o) + + self.assertEqual(o.to_dict(), o2.to_dict()) + +if __name__ == "__main__": + unittest.main() \ No newline at end of file diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index b868860..018d6f6 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -1,6 +1,6 @@ #MAEC Utility Methods -#Copyright (c) 2014, The MITRE Corporation +#Copyright (c) 2015, The MITRE Corporation #All rights reserved diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 39faedc..9fe8b6a 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -1,5 +1,5 @@ # MAEC Bundle Deduplicator Module -# Copyright (c) 2014, The MITRE Corporation +# Copyright (c) 2015, The MITRE Corporation # All rights reserved # See LICENSE.txt for complete terms diff --git a/maec/utils/idgen.py b/maec/utils/idgen.py index 33566b4..5445fbc 100644 --- a/maec/utils/idgen.py +++ b/maec/utils/idgen.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import uuid diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 3c7caf8..2543cfa 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. # Methods for merging MAEC documents diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 987a687..9e81316 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -1,6 +1,6 @@ #MAEC Namespace Parser -#Copyright (c) 2014, The MITRE Corporation +#Copyright (c) 2015, The MITRE Corporation #All rights reserved #Compatible with MAEC v4.1 diff --git a/maec/utils/parser.py b/maec/utils/parser.py index 8df6f78..57f7f0a 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import maec diff --git a/scripts/calculate_distance.py b/scripts/calculate_distance.py index 2e95f22..fa8f279 100644 --- a/scripts/calculate_distance.py +++ b/scripts/calculate_distance.py @@ -3,7 +3,7 @@ # NOTE: This code imports and uses the maec.analytics.distance module, which uses the external numpy library. # Numpy can be found here: https://pypi.python.org/pypi/numpy -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import os diff --git a/scripts/run_deduplicator.py b/scripts/run_deduplicator.py index 8088fef..a6ba590 100644 --- a/scripts/run_deduplicator.py +++ b/scripts/run_deduplicator.py @@ -4,6 +4,7 @@ import pprint import sys import os +import timeit import maec from maec.bundle.bundle import Bundle from maec.package.package import Package @@ -19,16 +20,21 @@ # Process a set of MAEC binding objects and peform the deduplication as appropriate def process_maec_file(filename): new_filename = filename[:filename.find(".xml")] + "_deduplicated.xml" + start_time = timeit.default_timer() parsed_objects = maec.parse_xml_instance(filename) + print "Parsing: " + str(timeit.default_timer() - start_time) + start_time = timeit.default_timer() if parsed_objects and isinstance(parsed_objects['api'], Package): parsed_objects['api'].deduplicate_malware_subjects() parsed_objects['api'].to_xml_file(new_filename) elif parsed_objects and isinstance(parsed_objects['api'], Bundle): parsed_objects['api'].deduplicate() parsed_objects['api'].to_xml_file(new_filename) + elapsed = timeit.default_timer() - start_time + print "Deduplicating: " + str(timeit.default_timer() - start_time) def main(): - sys.stdout.write("Deduplicating.") + #sys.stdout.write("Deduplicating.") infilenames = [] list_mode = False directoryname = '' @@ -50,7 +56,7 @@ def main(): if list_mode: files = args[1:] for file in files: - sys.stdout.write(".") + #sys.stdout.write(".") process_maec_file(file) elif directoryname != '': for filename in os.listdir(directoryname): @@ -59,6 +65,6 @@ def main(): pass else: process_maec_file(os.path.join(directoryname, filename)) - sys.stdout.write("Done.") + #sys.stdout.write("Done.") if __name__ == "__main__": main() \ No newline at end of file diff --git a/setup.py b/setup.py index 849786a..96f737b 100644 --- a/setup.py +++ b/setup.py @@ -1,4 +1,4 @@ -# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. from os.path import abspath, dirname, join From 87f4dd680e9278b0e4ec678716169e74ac89467a Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 16 Feb 2015 13:56:37 -0500 Subject: [PATCH 158/297] Fixed logic bug in object w/idref deduplication --- maec/utils/deduplicator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 9fe8b6a..e7a036b 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -77,7 +77,7 @@ def handle_duplicate_objects(cls, bundle, all_objects): object.properties = None object.related_objects = None object.domain_specific_object_properties = None - elif duplicate_object_id and duplicate_object_id in cls.idref_objects: + if duplicate_object_id and duplicate_object_id in cls.idref_objects: for object in cls.idref_objects[duplicate_object_id]: object.idref = unique_object_id From 2f7463271e4cf8d3c54bb0d27934000532b11b8b Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 19 Feb 2015 13:33:40 -0500 Subject: [PATCH 159/297] Added relative imports --- maec/analytics/__init__.py | 2 + maec/bundle/__init__.py | 31 ++++++++++++++- maec/bundle/action_reference_list.py | 3 +- maec/bundle/av_classification.py | 5 ++- maec/bundle/behavior.py | 21 ++++++----- maec/bundle/behavior_reference.py | 3 +- maec/bundle/bundle.py | 46 +++++++++++------------ maec/bundle/bundle_reference.py | 3 +- maec/bundle/candidate_indicator.py | 9 +++-- maec/bundle/capability.py | 17 +++++---- maec/bundle/malware_action.py | 11 +++--- maec/bundle/object_reference.py | 5 ++- maec/bundle/process_tree.py | 3 +- maec/misc/__init__.py | 3 ++ maec/package/__init__.py | 30 ++++++++++++++- maec/package/action_equivalence.py | 5 ++- maec/package/analysis.py | 31 +++++++-------- maec/package/grouping_relationship.py | 13 ++++--- maec/package/malware_subject.py | 39 ++++++++++--------- maec/package/malware_subject_reference.py | 3 +- maec/package/object_equivalence.py | 7 ++-- maec/package/package.py | 6 +-- maec/utils/__init__.py | 5 ++- maec/utils/merge.py | 11 +++--- 24 files changed, 193 insertions(+), 119 deletions(-) diff --git a/maec/analytics/__init__.py b/maec/analytics/__init__.py index e69de29..1932538 100644 --- a/maec/analytics/__init__.py +++ b/maec/analytics/__init__.py @@ -0,0 +1,2 @@ +from .distance import Distance, StaticFeatureVector, DynamicFeatureVector +from .static_features import static_features_dict \ No newline at end of file diff --git a/maec/bundle/__init__.py b/maec/bundle/__init__.py index e397f01..3f274bd 100644 --- a/maec/bundle/__init__.py +++ b/maec/bundle/__init__.py @@ -1 +1,30 @@ -_namespace = 'http://maec.mitre.org/XMLSchema/maec-bundle-4' \ No newline at end of file +_namespace = 'http://maec.mitre.org/XMLSchema/maec-bundle-4' + +import maec +from .malware_action import (MalwareAction, ActionImplementation, APICall, + ParameterList, Parameter) +from .av_classification import AVClassification, AVClassifications +from .behavior_reference import BehaviorReference +from .behavior import (Behavior, AssociatedCode, BehaviorPurpose, Exploit, + CVEVulnerability, PlatformList, BehavioralActions, + BehavioralAction, BehavioralActionReference, + BehavioralActionEquivalenceReference) +from .action_reference_list import ActionReferenceList +from .candidate_indicator import (CandidateIndicatorList, CandidateIndicator, + CandidateIndicatorComposition, MalwareEntity) +from .process_tree import ProcessTree, ProcessTreeNode +from .bundle_reference import BundleReference +from .capability import (CapabilityList, Capability, CapabilityObjective, + CapabilityProperty, CapabilityRelationship, + CapabilityObjectiveRelationship, CapabilityReference, + CapabilityObjectiveReference) +from .object_history import ObjectHistoryEntry, ObjectHistory +from .object_reference import ObjectReferenceList, ObjectReference +from .bundle import (Bundle, BehaviorReference, Collections, + CandidateIndicatorCollectionList, ObjectCollectionList, + ActionCollectionList, BehaviorCollectionList, + CandidateIndicatorCollection, ObjectCollection, + BehaviorCollection, ActionCollection, BaseCollection, + ObjectList, ActionList, BehaviorList) + + diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index c39c066..6188a41 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -9,6 +9,7 @@ from cybox.core import ActionReference import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding @@ -16,5 +17,5 @@ class ActionReferenceList(maec.EntityList): _contained_type = ActionReference _binding_class = bundle_binding.ActionReferenceListType _binding_var = "Action_Reference" - _namespace = maec.bundle._namespace + _namespace = _namespace \ No newline at end of file diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index 3feaf8c..cc02f34 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -7,11 +7,12 @@ # Last updated 09/26/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding from cybox.common import ToolInformation class AVClassification(ToolInformation, maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.AVClassificationType @@ -66,4 +67,4 @@ class AVClassifications(maec.EntityList): _contained_type = AVClassification _binding_class = bundle_binding.AVClassificationsType _binding_var = "AV_Classification" - _namespace = maec.bundle._namespace + _namespace = _namespace diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 7b5b6e4..8cba634 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -7,6 +7,7 @@ # Last updated 08/27/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding from cybox.core.action_reference import ActionReference from cybox.common.measuresource import MeasureSource @@ -19,7 +20,7 @@ class BehavioralActionEquivalenceReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType - _namespace = maec.bundle._namespace + _namespace = _namespace action_equivalence_idref = maec.TypedField('action_equivalence_idref') behavioral_ordering = maec.TypedField('behavioral_ordering') @@ -27,21 +28,21 @@ class BehavioralActionEquivalenceReference(maec.Entity): class BehavioralActionReference(ActionReference): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionReferenceType - _namespace = maec.bundle._namespace + _namespace = _namespace behavioral_ordering = maec.TypedField('behavioral_ordering') class BehavioralAction(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionType - _namespace = maec.bundle._namespace + _namespace = _namespace behavioral_ordering = maec.TypedField('behavioral_ordering') class BehavioralActions(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionsType - _namespace = maec.bundle._namespace + _namespace = _namespace #action_collection = maec.TypedField('Action_Collection', ActionCollection, multiple=True) #TODO: solve recursive import action = maec.TypedField('Action', BehavioralAction, multiple=True) @@ -53,12 +54,12 @@ class PlatformList(maec.EntityList): _binding_class = bundle_binding.PlatformListType _binding_var = "Platform" _contained_type = PlatformSpecification - _namespace = maec.bundle._namespace + _namespace = _namespace class CVEVulnerability(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CVEVulnerabilityType - _namespace = maec.bundle._namespace + _namespace = _namespace cve_id = maec.TypedField('cve_id') description = maec.TypedField('Description') @@ -66,7 +67,7 @@ class CVEVulnerability(maec.Entity): class Exploit(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ExploitType - _namespace = maec.bundle._namespace + _namespace = _namespace known_vulnerability = maec.TypedField('known_vulnerability') cve = maec.TypedField('CVE', CVEVulnerability) @@ -76,7 +77,7 @@ class Exploit(maec.Entity): class BehaviorPurpose(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorPurposeType - _namespace = maec.bundle._namespace + _namespace = _namespace description = maec.TypedField('Description') vulnerability_exploit = maec.TypedField('Vulnerability_Exploit', Exploit) @@ -86,12 +87,12 @@ class AssociatedCode(maec.EntityList): _binding_class = bundle_binding.AssociatedCodeType _binding_var = "Code_Snippet" _contained_type = Code - _namespace = maec.bundle._namespace + _namespace = _namespace class Behavior(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField('id') ordinal_position = maec.TypedField('ordinal_position') diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index f16e816..a18cd16 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -7,12 +7,13 @@ # Last updated 08/28/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding class BehaviorReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorReferenceType - _namespace = maec.bundle._namespace + _namespace = _namespace behavior_idref = maec.TypedField("behavior_idref") diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index b1ef340..2808189 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -13,41 +13,37 @@ from cybox.utils.normalize import normalize_object_properties import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle.malware_action import MalwareAction -from maec.bundle.av_classification import AVClassifications -from maec.bundle.behavior import Behavior -from maec.bundle.candidate_indicator import CandidateIndicator, CandidateIndicatorList -from maec.bundle.action_reference_list import ActionReferenceList -from maec.bundle.process_tree import ProcessTree -from maec.bundle.capability import CapabilityList -from maec.bundle.object_history import ObjectHistory -from maec.utils.comparator import BundleComparator -from maec.utils.deduplicator import BundleDeduplicator +from maec.bundle import (MalwareAction, AVClassifications, Behavior, + CandidateIndicator, CandidateIndicatorList, + ActionReferenceList, ProcessTree, CapabilityList, + ObjectHistory) +from maec.utils import BundleComparator, BundleDeduplicator class BehaviorList(maec.EntityList): _contained_type = Behavior _binding_class = bundle_binding.BehaviorListType _binding_var = "Behavior" - _namespace = maec.bundle._namespace + _namespace = _namespace class ActionList(maec.EntityList): _contained_type = MalwareAction _binding_class = bundle_binding.ActionListType _binding_var = "Action" - _namespace = maec.bundle._namespace + _namespace = _namespace class ObjectList(maec.EntityList): _contained_type = Object _binding_class = bundle_binding.ObjectListType _binding_var = "Object" - _namespace = maec.bundle._namespace + _namespace = _namespace class BaseCollection(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BaseCollectionType - _namespace = maec.bundle._namespace + _namespace = _namespace name = maec.TypedField("name") affinity_type = maec.TypedField("Affinity_Type") @@ -61,7 +57,7 @@ def __init__(self, name = None): class ActionCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.ActionCollectionType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField("id") action_list = maec.TypedField("Action_List", ActionList) @@ -81,7 +77,7 @@ def add_action(self, action): class BehaviorCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.BehaviorCollectionType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField("id") behavior_list = maec.TypedField("Behavior_List", BehaviorList) @@ -101,7 +97,7 @@ def add_behavior(self, behavior): class ObjectCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.ObjectCollectionType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField("id") object_list = maec.TypedField("Object_List", ObjectList) @@ -121,7 +117,7 @@ def add_object(self, object): class CandidateIndicatorCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.CandidateIndicatorCollectionType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField("id") candidate_indicator_list = maec.TypedField("Candidate_Indicator_List", CandidateIndicatorList) @@ -142,7 +138,7 @@ class BehaviorCollectionList(maec.EntityList): _contained_type = BehaviorCollection _binding_class = bundle_binding.BehaviorCollectionListType _binding_var = "Behavior_Collection" - _namespace = maec.bundle._namespace + _namespace = _namespace def __init__(self): super(BehaviorCollectionList, self).__init__() @@ -175,7 +171,7 @@ class ActionCollectionList(maec.EntityList): _contained_type = ActionCollection _binding_class = bundle_binding.ActionCollectionListType _binding_var = "Action_Collection" - _namespace = maec.bundle._namespace + _namespace = _namespace def __init__(self): super(ActionCollectionList, self).__init__() @@ -208,7 +204,7 @@ class ObjectCollectionList(maec.EntityList): _contained_type = ObjectCollection _binding_class = bundle_binding.ObjectCollectionListType _binding_var = "Object_Collection" - _namespace = maec.bundle._namespace + _namespace = _namespace def __init__(self): super(ObjectCollectionList, self).__init__() @@ -241,7 +237,7 @@ class CandidateIndicatorCollectionList(maec.EntityList): _contained_type = CandidateIndicatorCollection _binding_class = bundle_binding.CandidateIndicatorCollectionListType _binding_var = "Candidate_Indicator_Collection" - _namespace = maec.bundle._namespace + _namespace = _namespace def __init__(self): super(CandidateIndicatorCollectionList, self).__init__() @@ -273,7 +269,7 @@ def get_named_collection(self, collection_name): class Collections(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CollectionsType - _namespace = maec.bundle._namespace + _namespace = _namespace behavior_collections = maec.TypedField("Behavior_Collections", BehaviorCollectionList) action_collections = maec.TypedField("Action_Collections", ActionCollectionList) @@ -322,13 +318,13 @@ def has_content(self): class BehaviorReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorReferenceType - _namespace = maec.bundle._namespace + _namespace = _namespace behavior_idref = maec.TypedField('behavior_idref') class Bundle(maec.Entity): _binding = bundle_binding - _namespace = maec.bundle._namespace + _namespace = _namespace _binding_class = bundle_binding.BundleType id_ = maec.TypedField("id") diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index f95e696..43b533d 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -7,10 +7,11 @@ #Last updated 08/14/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding class BundleReference(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.BundleReferenceType diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 11fa404..807add3 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -7,6 +7,7 @@ # Last updated 08/27/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding from maec.bundle.object_reference import ObjectReference from maec.bundle.behavior_reference import BehaviorReference @@ -16,7 +17,7 @@ class MalwareEntity(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.MalwareEntityType - _namespace = maec.bundle._namespace + _namespace = _namespace type_ = maec.TypedField("Type", VocabString) name = maec.TypedField("Name") @@ -28,7 +29,7 @@ def __init__(self): class CandidateIndicatorComposition(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CandidateIndicatorCompositionType - _namespace = maec.bundle._namespace + _namespace = _namespace operator = maec.TypedField("operator") behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) @@ -45,7 +46,7 @@ def __init__(self): class CandidateIndicator(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CandidateIndicatorType - _namespace = maec.bundle._namespace + _namespace = _namespace id_ = maec.TypedField("id") creation_datetime = maec.TypedField("creation_datetime") @@ -69,4 +70,4 @@ class CandidateIndicatorList(maec.EntityList): _contained_type = CandidateIndicator _binding_class = bundle_binding.CandidateIndicatorListType _binding_var = "Candidate_Indicator" - _namespace = maec.bundle._namespace \ No newline at end of file + _namespace = _namespace \ No newline at end of file diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index 0fea673..e61a214 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -7,12 +7,13 @@ # Last updated 8/26/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding from maec.bundle.behavior_reference import BehaviorReference from cybox.common import VocabString, String class CapabilityObjectiveReference(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveReferenceType @@ -22,7 +23,7 @@ def __init__(self): super(CapabilityObjectiveReference, self).__init__() class CapabilityReference(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityReferenceType @@ -32,7 +33,7 @@ def __init__(self): super(CapabilityReference, self).__init__() class CapabilityObjectiveRelationship(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveRelationshipType @@ -44,7 +45,7 @@ def __init__(self): self.objective_reference = [] class CapabilityRelationship(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityRelationshipType @@ -56,7 +57,7 @@ def __init__(self): self.capability_reference = [] class CapabilityProperty(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityPropertyType @@ -67,7 +68,7 @@ def __init__(self): super(CapabilityProperty, self).__init__() class CapabilityObjective(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveType @@ -86,7 +87,7 @@ def __init__(self, id = None): self.id_ = maec.utils.idgen.create_id(prefix="capability_objective") class Capability(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityType @@ -120,7 +121,7 @@ def add_strategic_objective(self, strategic_objective): self.strategic_objective.append(strategic_objective) class CapabilityList(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityListType diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 8bc2a27..384aebb 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -11,10 +11,11 @@ from cybox.objects.code_object import Code import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding class Parameter(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.ParameterType @@ -29,10 +30,10 @@ class ParameterList(maec.EntityList): _contained_type = Parameter _binding_class = bundle_binding.ParameterListType _binding_var = "Parameter" - _namespace = maec.bundle._namespace + _namespace = _namespace class APICall(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.APICallType @@ -46,7 +47,7 @@ def __init__(self): super(APICall, self).__init__() class ActionImplementation(maec.Entity): - _namespace = maec.bundle._namespace + _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.ActionImplementationType @@ -62,7 +63,7 @@ def __init__(self): class MalwareAction(Action): _binding = bundle_binding _binding_class = bundle_binding.MalwareActionType - _namespace = maec.bundle._namespace + _namespace = _namespace implementation = cybox.TypedField("Implementation", ActionImplementation) diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index 0ad67d1..8bab39d 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -7,12 +7,13 @@ # Last updated 08/28/2014 import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding class ObjectReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ObjectReferenceType - _namespace = maec.bundle._namespace + _namespace = _namespace def __init__(self, object_idref = None): super(ObjectReference, self).__init__() @@ -22,4 +23,4 @@ class ObjectReferenceList(maec.EntityList): _contained_type = ObjectReference _binding_class = bundle_binding.ObjectReferenceListType _binding_var = "Object_Reference" - _namespace = maec.bundle._namespace \ No newline at end of file + _namespace = _namespace \ No newline at end of file diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index d5b1aa3..ba3061d 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -11,6 +11,7 @@ from cybox.core import ActionReference import maec +from . import _namespace import maec.bindings.maec_bundle as bundle_binding from maec.bundle.action_reference_list import ActionReferenceList @@ -108,7 +109,7 @@ def set_parent_action(self, parent_action_id): class ProcessTree(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ProcessTreeType - _namespace = maec.bundle._namespace + _namespace = _namespace root_process = maec.TypedField("Root_Process", ProcessTreeNode) diff --git a/maec/misc/__init__.py b/maec/misc/__init__.py index e69de29..7e3d740 100644 --- a/maec/misc/__init__.py +++ b/maec/misc/__init__.py @@ -0,0 +1,3 @@ +from .exceptions import (LookupNotFoundException, NetworkFailureException, + APIKeyException) +from .options import ScriptOptions \ No newline at end of file diff --git a/maec/package/__init__.py b/maec/package/__init__.py index 76c00c6..0aa544c 100644 --- a/maec/package/__init__.py +++ b/maec/package/__init__.py @@ -1 +1,29 @@ -_namespace = 'http://maec.mitre.org/XMLSchema/maec-package-2' \ No newline at end of file +_namespace = 'http://maec.mitre.org/XMLSchema/maec-package-2' + +import maec +from .action_equivalence import ActionEquivalenceList, ActionEquivalence +from .malware_subject_reference import MalwareSubjectReference +from .object_equivalence import ObjectEquivalence, ObjectEquivalenceList +from .analysis import (Analysis, AnalysisEnvironment, NetworkInfrastructure, + CapturedProtocolList, CapturedProtocol, + AnalysisSystemList, AnalysisSystem, InstalledPrograms, + HypervisorHostSystem, DynamicAnalysisMetadata, + ToolList, CommentList, Comment, Source) +from .grouping_relationship import (GroupingRelationshipList, + GroupingRelationship, ClusteringMetadata, + ClusteringAlgorithmParameters, + ClusterComposition, ClusterEdgeNodePair) +from .malware_subject import (MalwareSubjectList, MalwareSubject, + MalwareConfigurationDetails, + MalwareConfigurationObfuscationDetails, + MalwareConfigurationObfuscationAlgorithm, + MalwareConfigurationStorageDetails, + MalwareBinaryConfigurationStorageDetails, + MalwareConfigurationParameter, + MalwareDevelopmentEnvironment, + FindingsBundleList, MetaAnalysis, + MalwareSubjectRelationshipList, + MalwareSubjectRelationship, Analyses, + MinorVariants) + +from .package import Package diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index 873a209..acc4524 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -7,13 +7,14 @@ #Last updated 08/20/2014 import maec +from . import _namespace import maec.bindings.maec_package as package_binding from cybox.core import ActionReference class ActionEquivalence(maec.Entity): _binding = package_binding _binding_class = package_binding.ActionEquivalenceType - _namespace = maec.package._namespace + _namespace = _namespace id_ = maec.TypedField('id') action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) @@ -26,4 +27,4 @@ class ActionEquivalenceList(maec.EntityList): _contained_type = ActionEquivalence _binding_class = package_binding.ActionEquivalenceListType _binding_var = "Action_Equivalence" - _namespace = maec.package._namespace \ No newline at end of file + _namespace = _namespace \ No newline at end of file diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 88e5d68..c6e4194 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -12,13 +12,14 @@ from cybox.objects.system_object import System import maec +from . import _namespace import maec.bindings.maec_package as package_binding -from maec.bundle.bundle_reference import BundleReference +from maec.bundle import BundleReference class Source(maec.Entity): _binding = package_binding _binding_class = package_binding.SourceType - _namespace = maec.package._namespace + _namespace = _namespace name = maec.TypedField("Name") method = maec.TypedField("Method") @@ -32,7 +33,7 @@ def __init__(self): class Comment(StructuredText): _binding = package_binding _binding_class = package_binding.CommentType - _namespace = maec.package._namespace + _namespace = _namespace author = maec.TypedField("author") timestamp = maec.TypedField("timestamp") @@ -53,18 +54,18 @@ class CommentList(maec.EntityList): _contained_type = Comment _binding_class = package_binding.CommentListType _binding_var = "Comment" - _namespace = maec.package._namespace + _namespace = _namespace class ToolList(maec.EntityList): _contained_type = ToolInformation _binding_class = package_binding.ToolListType _binding_var = "Tool" - _namespace = maec.package._namespace + _namespace = _namespace class DynamicAnalysisMetadata(maec.Entity): _binding = package_binding _binding_class = package_binding.DynamicAnalysisMetadataType - _namespace = maec.package._namespace + _namespace = _namespace command_line = maec.TypedField("Command_Line") analysis_duration = maec.TypedField("Analysis_Duration") @@ -77,7 +78,7 @@ def __init__(self): class HypervisorHostSystem(System): _binding = package_binding _binding_class = package_binding.HypervisorHostSystemType - _namespace = maec.package._namespace + _namespace = _namespace vm_hypervisor = maec.TypedField("VM_Hypervisor", PlatformSpecification) @@ -88,12 +89,12 @@ class InstalledPrograms(maec.EntityList): _contained_type = PlatformSpecification _binding_class = package_binding.InstalledProgramsType _binding_var = "Program" - _namespace = maec.package._namespace + _namespace = _namespace class AnalysisSystem(System): _binding = package_binding _binding_class = package_binding.AnalysisSystemType - _namespace = maec.package._namespace + _namespace = _namespace installed_programs = maec.TypedField("Installed_Programs", InstalledPrograms) @@ -105,12 +106,12 @@ class AnalysisSystemList(maec.EntityList): _contained_type = AnalysisSystem _binding_class = package_binding.AnalysisSystemListType _binding_var = "Analysis_System" - _namespace = maec.package._namespace + _namespace = _namespace class CapturedProtocol(maec.Entity): _binding = package_binding _binding_class = package_binding.CapturedProtocolType - _namespace = maec.package._namespace + _namespace = _namespace layer7_protocol = maec.TypedField("layer7_protocol") layer4_protocol = maec.TypedField("layer4_protocol") @@ -124,12 +125,12 @@ class CapturedProtocolList(maec.EntityList): _contained_type = CapturedProtocol _binding_class = package_binding.CapturedProtocolListType _binding_var = "Protocol" - _namespace = maec.package._namespace + _namespace = _namespace class NetworkInfrastructure(maec.Entity): _binding = package_binding _binding_class = package_binding.NetworkInfrastructureType - _namespace = maec.package._namespace + _namespace = _namespace captured_protocols = maec.TypedField("Captured_Protocols", CapturedProtocolList) @@ -140,7 +141,7 @@ def __init__(self): class AnalysisEnvironment(maec.Entity): _binding = package_binding _binding_class = package_binding.AnalysisEnvironmentType - _namespace = maec.package._namespace + _namespace = _namespace hypervisor_host_system = maec.TypedField("Hypervisor_Host_System", HypervisorHostSystem) analysis_systems = maec.TypedField("Analysis_Systems", AnalysisSystemList) @@ -152,7 +153,7 @@ def __init__(self): class Analysis(maec.Entity): _binding = package_binding _binding_class = package_binding.AnalysisType - _namespace = maec.package._namespace + _namespace = _namespace id_ = maec.TypedField("id") method = maec.TypedField("method") diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 0483eb5..0ac07dc 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -8,6 +8,7 @@ import cybox import maec +from . import _namespace import maec.bindings.maec_package as package_binding from maec.package.malware_subject_reference import MalwareSubjectReference from cybox.common import VocabString @@ -15,7 +16,7 @@ class ClusterEdgeNodePair(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusterEdgeNodePairType - _namespace = maec.package._namespace + _namespace = _namespace similarity_index = maec.TypedField("similarity_index") similarity_distance = maec.TypedField("similarity_distance") @@ -28,7 +29,7 @@ def __init__(self): class ClusterComposition(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusterCompositionType - _namespace = maec.package._namespace + _namespace = _namespace score_type = maec.TypedField("score_type") edge_node_pair = maec.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) @@ -39,7 +40,7 @@ def __init__(self): class ClusteringAlgorithmParameters(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusteringAlgorithmParametersType - _namespace = maec.package._namespace + _namespace = _namespace distance_threashold = maec.TypedField("Distance_Threashold") number_of_iterations = maec.TypedField("Number_of_Iterations") @@ -50,7 +51,7 @@ def __init__(self): class ClusteringMetadata(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusteringMetadataType - _namespace = maec.package._namespace + _namespace = _namespace algorithm_name = maec.TypedField("Algorithm_Name") algorithm_version = maec.TypedField("Algorithm_Version") @@ -65,7 +66,7 @@ def __init__(self): class GroupingRelationship(maec.Entity): _binding = package_binding _binding_class = package_binding.GroupingRelationshipType - _namespace = maec.package._namespace + _namespace = _namespace type_ = maec.TypedField("Type", VocabString) malware_family_name = maec.TypedField("Malware_Family_Name") @@ -79,7 +80,7 @@ class GroupingRelationshipList(maec.EntityList): _contained_type = GroupingRelationship _binding_class = package_binding.GroupingRelationshipListType _binding_var = "Grouping_Relationship" - _namespace = maec.package._namespace + _namespace = _namespace diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 744cceb..c61b05b 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -13,29 +13,28 @@ from cybox.core import Object import maec +from . import _namespace import maec.bindings.maec_package as package_binding -from maec.bundle.bundle import Bundle -from maec.package.action_equivalence import ActionEquivalenceList -from maec.package.analysis import Analysis -from maec.package.malware_subject_reference import MalwareSubjectReference -from maec.package.object_equivalence import ObjectEquivalenceList +from maec.bundle import Bundle +from maec.package import (ActionEquivalenceList, Analysis, + MalwareSubjectReference, ObjectEquivalenceList) class MinorVariants(maec.EntityList): _contained_type = Object _binding_class = package_binding.MinorVariantListType _binding_var = "Minor_Variant" - _namespace = maec.package._namespace + _namespace = _namespace class Analyses(maec.EntityList): _contained_type = Analysis _binding_class = package_binding.AnalysisListType _binding_var = "Analysis" - _namespace = maec.package._namespace + _namespace = _namespace class MalwareSubjectRelationship(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareSubjectRelationshipType - _namespace = maec.package._namespace + _namespace = _namespace malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) type_ = maec.TypedField("Type", VocabString) @@ -48,12 +47,12 @@ class MalwareSubjectRelationshipList(maec.EntityList): _contained_type = MalwareSubjectRelationship _binding_class = package_binding.MalwareSubjectRelationshipListType _binding_var = "Relationship" - _namespace = maec.package._namespace + _namespace = _namespace class MetaAnalysis(maec.Entity): _binding = package_binding _binding_class = package_binding.MetaAnalysisType - _namespace = maec.package._namespace + _namespace = _namespace action_equivalences = maec.TypedField("Action_Equivalences", ActionEquivalenceList) object_equivalences = maec.TypedField("Object_Equivalences", ObjectEquivalenceList) @@ -64,7 +63,7 @@ def __init__(self): class FindingsBundleList(maec.Entity): _binding = package_binding _binding_class = package_binding.FindingsBundleListType - _namespace = maec.package._namespace + _namespace = _namespace meta_analysis = maec.TypedField("Meta_Analysis", MetaAnalysis) bundle = maec.TypedField("Bundle", Bundle, multiple = True) @@ -86,7 +85,7 @@ def add_bundle_external_reference(self, bundle_external_reference): class MalwareDevelopmentEnvironment(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareDevelopmentEnvironmentType - _namespace = maec.package._namespace + _namespace = _namespace tools = maec.TypedField("Tools", ToolInformation) debugging_file = maec.TypedField("Debugging_File", File, multiple = True) @@ -98,7 +97,7 @@ def __init__(self): class MalwareConfigurationParameter(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationParameterType - _namespace = maec.package._namespace + _namespace = _namespace name = maec.TypedField("Name", VocabString) value = maec.TypedField("Value") @@ -110,7 +109,7 @@ def __init__(self): class MalwareBinaryConfigurationStorageDetails(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType - _namespace = maec.package._namespace + _namespace = _namespace file_offset = maec.TypedField("File_Offset") section_name = maec.TypedField("Section_Name") @@ -122,7 +121,7 @@ def __init__(self): class MalwareConfigurationStorageDetails(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationStorageDetailsType - _namespace = maec.package._namespace + _namespace = _namespace malware_binary = maec.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) file = maec.TypedField("File", File) @@ -134,7 +133,7 @@ def __init__(self): class MalwareConfigurationObfuscationAlgorithm(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType - _namespace = maec.package._namespace + _namespace = _namespace ordinal_position = maec.TypedField("ordinal_position") key = maec.TypedField("Key") @@ -147,7 +146,7 @@ def __init__(self): class MalwareConfigurationObfuscationDetails(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType - _namespace = maec.package._namespace + _namespace = _namespace is_encoded = maec.TypedField("is_encoded") is_encrypted = maec.TypedField("is_encrypted") @@ -161,7 +160,7 @@ def __init__(self): class MalwareConfigurationDetails(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareConfigurationDetailsType - _namespace = maec.package._namespace + _namespace = _namespace storage = maec.TypedField("Storage", MalwareConfigurationStorageDetails) obfuscation = maec.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) @@ -173,7 +172,7 @@ def __init__(self): class MalwareSubject(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareSubjectType - _namespace = maec.package._namespace + _namespace = _namespace id_ = maec.TypedField("id") malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) @@ -242,4 +241,4 @@ class MalwareSubjectList(maec.EntityList): _contained_type = MalwareSubject _binding_class = package_binding.MalwareSubjectListType _binding_var = "Malware_Subject" - _namespace = maec.package._namespace \ No newline at end of file + _namespace = _namespace \ No newline at end of file diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 20311cb..4dbd060 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -7,13 +7,14 @@ #Last updated 08/20/2014 import maec +from . import _namespace import maec.bindings.maec_package as package_binding import cybox class MalwareSubjectReference(maec.Entity): _binding = package_binding _binding_class = package_binding.MalwareSubjectReferenceType - _namespace = maec.package._namespace + _namespace = _namespace malware_subject_idref = maec.TypedField("malware_subject_idref") diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 03d9e1e..3def53f 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -8,13 +8,14 @@ import cybox import maec +from . import _namespace import maec.bindings.maec_package as package_binding -from maec.bundle.object_reference import ObjectReference +from maec.bundle import ObjectReference class ObjectEquivalence(maec.Entity): _binding = package_binding _binding_class = package_binding.ObjectEquivalenceType - _namespace = maec.package._namespace + _namespace = _namespace id_ = maec.TypedField("id") object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) @@ -27,4 +28,4 @@ class ObjectEquivalenceList(maec.EntityList): _contained_type = ObjectEquivalence _binding_class = package_binding.ObjectEquivalenceListType _binding_var = "Object_Equivalence" - _namespace = maec.package._namespace \ No newline at end of file + _namespace = _namespace \ No newline at end of file diff --git a/maec/package/package.py b/maec/package/package.py index a0f6e9a..726bf97 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -7,15 +7,15 @@ #Last updated 08/20/2014 import maec +from . import _namespace import maec.bindings.maec_package as package_binding -from maec.package.malware_subject import MalwareSubjectList -from maec.package.grouping_relationship import GroupingRelationshipList +from maec.package import MalwareSubjectList, GroupingRelationshipList from cybox.common import DateTime class Package(maec.Entity): _binding = package_binding _binding_class = package_binding.PackageType - _namespace = maec.package._namespace + _namespace = _namespace id_ = maec.TypedField('id') timestamp = maec.TypedField('timestamp') diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 018d6f6..765a7f8 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -8,10 +8,13 @@ #Last updated 02/18/2014 """MAEC utility methods""" - +import maec from .nsparser import maecMETA from .idgen import * from .parser import EntityParser +from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, + ComparisonResult) +from .deduplicator import BundleDeduplicator diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 2543cfa..f4c2c2d 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -9,12 +9,11 @@ from cybox.core import Object from cybox.common import HashList from cybox.utils import Namespace -from maec.package.package import Package -from maec.bundle.bundle import Bundle -from maec.package.malware_subject import (MalwareSubject, MalwareConfigurationDetails, - FindingsBundleList, MetaAnalysis, Analyses, - MinorVariants, MalwareSubjectRelationshipList, - MalwareSubjectList) +from maec.bundle import Bundle +from maec.package import (Package, MalwareSubject, MalwareConfigurationDetails, + FindingsBundleList, MetaAnalysis, Analyses, + MinorVariants, MalwareSubjectRelationshipList, + MalwareSubjectList) def dict_merge(target, *args): '''Merge multiple dictionaries into one''' From fb857133db3c439bb356f0a2064749bb5681f280 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 19 Feb 2015 13:39:02 -0500 Subject: [PATCH 160/297] Updated for relative imports --- maec/bundle/__init__.py | 2 +- maec/bundle/behavior.py | 2 +- maec/bundle/candidate_indicator.py | 3 +-- maec/bundle/capability.py | 2 +- maec/bundle/process_tree.py | 2 +- 5 files changed, 5 insertions(+), 6 deletions(-) diff --git a/maec/bundle/__init__.py b/maec/bundle/__init__.py index 3f274bd..38d4cbb 100644 --- a/maec/bundle/__init__.py +++ b/maec/bundle/__init__.py @@ -3,6 +3,7 @@ import maec from .malware_action import (MalwareAction, ActionImplementation, APICall, ParameterList, Parameter) +from .object_reference import ObjectReferenceList, ObjectReference from .av_classification import AVClassification, AVClassifications from .behavior_reference import BehaviorReference from .behavior import (Behavior, AssociatedCode, BehaviorPurpose, Exploit, @@ -19,7 +20,6 @@ CapabilityObjectiveRelationship, CapabilityReference, CapabilityObjectiveReference) from .object_history import ObjectHistoryEntry, ObjectHistory -from .object_reference import ObjectReferenceList, ObjectReference from .bundle import (Bundle, BehaviorReference, Collections, CandidateIndicatorCollectionList, ObjectCollectionList, ActionCollectionList, BehaviorCollectionList, diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 8cba634..ada0206 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -9,10 +9,10 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding +from maec.bundle import MalwareAction from cybox.core.action_reference import ActionReference from cybox.common.measuresource import MeasureSource from cybox.common.platform_specification import PlatformSpecification -from maec.bundle.malware_action import MalwareAction from cybox.objects.code_object import Code #from maec.bundle.bundle import ActionCollection import datetime diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 807add3..cbe575e 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -9,8 +9,7 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle.object_reference import ObjectReference -from maec.bundle.behavior_reference import BehaviorReference +from maec.bundle import ObjectReference, BehaviorReference from cybox.common import VocabString from cybox.core import ActionReference diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index e61a214..d730ea5 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -9,7 +9,7 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle.behavior_reference import BehaviorReference +from maec.bundle import BehaviorReference from cybox.common import VocabString, String class CapabilityObjectiveReference(maec.Entity): diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index ba3061d..7d0013a 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -13,7 +13,7 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle.action_reference_list import ActionReferenceList +from maec.bundle import ActionReferenceList class ProcessTreeNode(Process): _binding = bundle_binding From c547964e390350d24e49e16ae3a36ed8449df355 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 19 Feb 2015 14:41:30 -0500 Subject: [PATCH 161/297] Updated examples to use relative imports --- examples/comparator_example.py | 2 +- examples/package_generation_example.py | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/examples/comparator_example.py b/examples/comparator_example.py index d26a415..cc47c92 100644 --- a/examples/comparator_example.py +++ b/examples/comparator_example.py @@ -1,6 +1,6 @@ import pprint import maec.bindings.maec_bundle as maec_bundle_binding -from maec.bundle.bundle import Bundle +from maec.bundle import Bundle # Matching properties dictionary match_on_dictionary = {'FileObjectType': ['file_name'], 'WindowsRegistryKeyObjectType': ['hive', 'values.name/data'], diff --git a/examples/package_generation_example.py b/examples/package_generation_example.py index 838dfb4..7022dbc 100644 --- a/examples/package_generation_example.py +++ b/examples/package_generation_example.py @@ -8,12 +8,8 @@ from cybox.core import AssociatedObjects, AssociatedObject, Object, AssociationType from cybox.common import Hash, HashList from cybox.objects.file_object import File -from maec.bundle.bundle import Bundle, Collections -from maec.bundle.malware_action import MalwareAction -from maec.bundle.capability import Capability -from maec.package.analysis import Analysis -from maec.package.malware_subject import MalwareSubject -from maec.package.package import Package +from maec.bundle import Bundle, Collections, MalwareAction, Capability +from maec.package import Analysis, MalwareSubject, Package from cybox.utils import Namespace import maec.utils From efae0991dad555149c60890b9d625899bbb320c9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 19 Feb 2015 14:54:41 -0500 Subject: [PATCH 162/297] Updated for relative imports --- docs/api_vs_bindings/api_snippet.rst | 3 +-- docs/examples.rst | 15 +++++++-------- docs/getting_started.rst | 12 ++++++------ 3 files changed, 14 insertions(+), 16 deletions(-) diff --git a/docs/api_vs_bindings/api_snippet.rst b/docs/api_vs_bindings/api_snippet.rst index eee8330..b9ef8f6 100644 --- a/docs/api_vs_bindings/api_snippet.rst +++ b/docs/api_vs_bindings/api_snippet.rst @@ -1,8 +1,7 @@ .. code-block:: python # Import the required APIs - from maec.bundle.bundle import Bundle - from maec.bundle.malware_action import MalwareAction + from maec.bundle import Bundle, MalwareAction from maec.utils import IDGenerator, set_id_method from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType from cybox.objects.file_object import File diff --git a/docs/examples.rst b/docs/examples.rst index 0b9e692..523172d 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -32,8 +32,7 @@ different types of analysis. .. testcode:: - from maec.package.package import Package - from maec.package.malware_subject import MalwareSubject + from maec.package import Package, MalwareSubject from maec.utils import IDGenerator, set_id_method set_id_method(IDGenerator.METHOD_INT) @@ -65,7 +64,7 @@ that it is characterizing. .. testcode:: - from maec.package.malware_subject import MalwareSubject + from maec.package import MalwareSubject from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File @@ -111,7 +110,7 @@ instance that it is characterizing. .. testcode:: - from maec.bundle.bundle import Bundle + from maec.bundle import Bundle from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File @@ -148,8 +147,8 @@ be defined in their parent Malware Subject. .. testcode:: - from maec.package.malware_subject import MalwareSubject - from maec.bundle.bundle import Bundle + from maec.package import MalwareSubject + from maec.bundle import Bundle from maec.utils import IDGenerator, set_id_method from cybox.core import Object from cybox.objects.file_object import File @@ -195,8 +194,8 @@ needed. .. testcode:: - from maec.bundle.bundle import Bundle - from maec.bundle.malware_action import MalwareAction + from maec.bundle import Bundle + from maec.bundle import MalwareAction from maec.utils import IDGenerator, set_id_method from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType from cybox.objects.file_object import File diff --git a/docs/getting_started.rst b/docs/getting_started.rst index 27113c6..ed5570e 100644 --- a/docs/getting_started.rst +++ b/docs/getting_started.rst @@ -30,14 +30,14 @@ Creating a MAEC Package .. code-block:: python - from maec.package.package import Package # Import the MAEC Package API - from maec.package.malware_subject import MalwareSubject # Import the MAEC Malware Subject API + from maec.package import Package # Import the MAEC Package API + from maec.package import MalwareSubject # Import the MAEC Malware Subject API - package = Package() # Create an instance of Package - malware_subject = MalwareSubject() # Create an instance of MalwareSubject - package.add_malware_subject(malware_subject) # Add the Malware Subject to the Package + package = Package() # Create an instance of Package + malware_subject = MalwareSubject() # Create an instance of MalwareSubject + package.add_malware_subject(malware_subject) # Add the Malware Subject to the Package - print(package.to_xml()) # Print the XML for this MAEC Package + print(package.to_xml()) # Print the XML for this MAEC Package Parsing MAEC XML **************** From a07d32f7126c406499201c5bf8706c5e2db3c27e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 20 Feb 2015 12:24:33 -0500 Subject: [PATCH 163/297] Updated version to 4.1.0.11 --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index 78ccfc3..462274d 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.10" +__version__ = "4.1.0.11" import collections import json From 347336e839e983c9694b244a86e8a82d1516aeed Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 20 Feb 2015 12:26:18 -0500 Subject: [PATCH 164/297] Updated for 4.1.0.11 --- CHANGES.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES.txt b/CHANGES.txt index 7a33a0e..1075fcb 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,8 @@ +Version 4.1.0.11 +2015-02-20 +- Fixed a deduplicator logic bug +- Added relative imports for API classes + Version 4.1.0.10 2014-12-22 - Various Unicode-related fixes in the bindings [#32] From bcd22fd491f5e0c5827cb8b3d3716083a1bf2582 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 20 Feb 2015 12:27:22 -0500 Subject: [PATCH 165/297] Updated for 4.1.0.11 --- docs/index.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/index.rst b/docs/index.rst index d88a7df..b535980 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -20,13 +20,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.10 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.11 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.10 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.10 +__ https://pypi.python.org/pypi/maec/4.1.0.11 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.11 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 From 8e3616c63895cec37cc31103c6484d95aa51424b Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Apr 2015 10:35:30 -0400 Subject: [PATCH 166/297] Bump version to 4.1.0.12-dev --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index 462274d..b110068 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.11" +__version__ = "4.1.0.12-dev" import collections import json From 9b109dce40e1652fbc505a56543c1802e05f0ff9 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Apr 2015 16:15:45 -0400 Subject: [PATCH 167/297] Normalize dev version number. --- maec/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index b110068..d1fbcbf 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -__version__ = "4.1.0.12-dev" +__version__ = "4.1.0.12.dev0" import collections import json From 1e4ce9bc39b01a95eae89e78c109ebbad314df92 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Apr 2015 09:44:28 -0400 Subject: [PATCH 168/297] Add version.py and standardize parts of setup.py --- maec/__init__.py | 16 +++++++++++----- maec/version.py | 4 ++++ setup.py | 14 ++++++++++---- 3 files changed, 25 insertions(+), 9 deletions(-) create mode 100644 maec/version.py diff --git a/maec/__init__.py b/maec/__init__.py index d1fbcbf..10bc44f 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,18 +1,24 @@ -__version__ = "4.1.0.12.dev0" +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. import collections -import json import inspect -import maec +import json from StringIO import StringIO -import bindings.maec_bundle as bundle_binding -import bindings.maec_package as package_binding + from cybox import Entity as cyboxEntity from cybox import EntityList from cybox import TypedField from cybox.utils import Namespace, META + +import bindings.maec_bundle as bundle_binding +import bindings.maec_package as package_binding +import maec from maec.utils import maecMETA, EntityParser +from .version import __version__ # noqa + + def get_xmlns_string(ns_set): """Build a string with 'xmlns' definitions for every namespace in ns_set. diff --git a/maec/version.py b/maec/version.py new file mode 100644 index 0000000..069b579 --- /dev/null +++ b/maec/version.py @@ -0,0 +1,4 @@ +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +__version__ = "4.1.0.12.dev0" diff --git a/setup.py b/setup.py index 96f737b..63fe378 100644 --- a/setup.py +++ b/setup.py @@ -1,19 +1,25 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. +#!/usr/bin/env python + +# Copyright (c) 2015 - The MITRE Corporation +# For license information, see the LICENSE.txt file from os.path import abspath, dirname, join + + from setuptools import setup, find_packages -INIT_FILE = join(dirname(abspath(__file__)), 'maec', '__init__.py') +BASE_DIR = dirname(abspath(__file__)) +VERSION_FILE = join(BASE_DIR, 'maec', 'version.py') def get_version(): - with open(INIT_FILE) as f: + with open(VERSION_FILE) as f: for line in f.readlines(): if line.startswith("__version__"): version = line.split()[-1].strip('"') return version raise AttributeError("Package does not have a __version__") + with open('README.rst') as f: readme = f.read() From d1e7cf3ffa64e7317875e2c2686f0db8dde127dc Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Apr 2015 12:13:48 -0400 Subject: [PATCH 169/297] Add package version to rst_prolog. --- docs/conf.py | 10 ++-------- docs/index.rst | 5 ----- 2 files changed, 2 insertions(+), 13 deletions(-) diff --git a/docs/conf.py b/docs/conf.py index 4751ba7..13b08cb 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -20,14 +20,8 @@ master_doc = 'index' rst_prolog = """ -.. warning:: - - This documentation is still a work in progress. If you have any issues or - questions, please ask on the maec-discussion mailing list or file a bug - in our `issue tracker`_. - -.. _issue tracker: https://github.com/MAECProject/python-maec/issues -""" +**Version**: {} +""".format(release) exclude_patterns = ['_build'] pygments_style = 'sphinx' diff --git a/docs/index.rst b/docs/index.rst index b535980..83a5620 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -1,8 +1,3 @@ -.. python-maec documentation master file, created by - sphinx-quickstart on Thu May 1 10:36:32 2015. - You can adapt this file completely to your liking, but it should at least - contain the root `toctree` directive. - python-maec |release| Documentation ==================================== From dce61d379d6233548f80f88bedc639b3f5096061 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Apr 2015 12:41:46 -0400 Subject: [PATCH 170/297] Use sphinx-rtd-theme. --- docs/api_vs_bindings/index.rst | 8 +------- docs/conf.py | 32 +++++++++++--------------------- setup.py | 1 + 3 files changed, 13 insertions(+), 28 deletions(-) diff --git a/docs/api_vs_bindings/index.rst b/docs/api_vs_bindings/index.rst index b20b91f..9472188 100644 --- a/docs/api_vs_bindings/index.rst +++ b/docs/api_vs_bindings/index.rst @@ -3,12 +3,6 @@ APIs or bindings? This page describes both the **APIs** and the **bindings** provided by the *python-maec* library. -.. toctree:: - :hidden: - - api_snippet - binding_snippet - Overview -------- @@ -61,4 +55,4 @@ Feedback If there is a problem with the APIs or bindings, or if there is functionality missing from the APIs that forces the use of the bindings, let us know in the `python-maec issue tracker`_ -.. _python-maec issue tracker: https://github.com/MAECProject/python-maec/issues \ No newline at end of file +.. _python-maec issue tracker: https://github.com/MAECProject/python-maec/issues diff --git a/docs/conf.py b/docs/conf.py index 13b08cb..21351f5 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -1,3 +1,5 @@ +import os + import maec project = u'python-maec' @@ -23,29 +25,17 @@ **Version**: {} """.format(release) -exclude_patterns = ['_build'] +exclude_patterns = ['_build', 'api_vs_bindings/*_snippet.rst'] pygments_style = 'sphinx' -html_theme = 'default' -html_style = '/default.css' -html_static_path = ['_static'] -htmlhelp_basename = 'python-maecdoc' - -html_theme_options = { - 'codebgcolor': '#EEE', - 'footerbgcolor': '#FFF', - 'footertextcolor': '#114684', - 'headbgcolor': '#E0DBD2', - 'headtextcolor': '#F15A22', - 'headlinkcolor': '#114684', - 'linkcolor': '#706C60', - 'relbarbgcolor': '#114684', - 'relbartextcolor': '#F15A22', - 'sidebarbgcolor': '#FFF', - 'sidebarlinkcolor': '#706C60', - 'sidebartextcolor': '#000', - 'visitedlinkcolor': '#706C60', -} +on_rtd = os.environ.get('READTHEDOCS', None) == 'True' +if not on_rtd: # only import and set the theme if we're building docs locally + import sphinx_rtd_theme + html_theme = 'sphinx_rtd_theme' + html_theme_path = [sphinx_rtd_theme.get_html_theme_path()] +else: + html_theme = 'default' + html_sidebars = {"**": ['localtoc.html', 'relations.html', 'sourcelink.html', 'searchbox.html', 'links.html']} diff --git a/setup.py b/setup.py index 63fe378..0431f91 100644 --- a/setup.py +++ b/setup.py @@ -29,6 +29,7 @@ def get_version(): # TODO: remove when updating to Sphinx 1.3, since napoleon will be # included as sphinx.ext.napoleon 'sphinxcontrib-napoleon==0.2.4', + 'sphinx_rtd_theme==0.1.7', ], 'test': [ "nose==1.3.0", From 1a74159f21d281b062a55e26312a39b662d1f660 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Apr 2015 12:59:26 -0400 Subject: [PATCH 171/297] Fix zero-length field error when building docs in Python 2.6 --- docs/conf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/conf.py b/docs/conf.py index 21351f5..b2b74e5 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -22,7 +22,7 @@ master_doc = 'index' rst_prolog = """ -**Version**: {} +**Version**: {0} """.format(release) exclude_patterns = ['_build', 'api_vs_bindings/*_snippet.rst'] From a71d20359e6fb3c714f3e5e2ebefe6d8b589fcb6 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 3 Apr 2015 10:36:09 -0400 Subject: [PATCH 172/297] Clean up and standardize docs and conf.py --- docs/_static/cybox.png | Bin 6075 -> 0 bytes docs/_static/maec.png | Bin 3246 -> 0 bytes docs/_static/stix.png | Bin 4252 -> 0 bytes docs/_static/taxii.png | Bin 5421 -> 0 bytes docs/_templates/links.html | 9 --------- docs/conf.py | 20 +++++++++++--------- 6 files changed, 11 insertions(+), 18 deletions(-) delete mode 100644 docs/_static/cybox.png delete mode 100644 docs/_static/maec.png delete mode 100644 docs/_static/stix.png delete mode 100644 docs/_static/taxii.png delete mode 100644 docs/_templates/links.html diff --git a/docs/_static/cybox.png b/docs/_static/cybox.png deleted file mode 100644 index d335a3f7317f257358053afa196cd33c0ecdedf5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6075 zcmV;s7ewfZP)_P=+#;p$ugxLmB>y(S1 zIOTN5?*AeC^7%pi2j?wc`L=#H6f)guHREbM@CX60ir5d_Jwo1Dxf%od_XPmVdpXM) zA0O{h6syfNO+mI=DY1NcwSN7&en}Ls+-!`lLzl;@h*OJ4x|W6Rln(+FW3w z1O^5o4pUcQsKto%YK0P-%?93{cUP=NoO6Q!Fc8SRTV!wc|FRH}vLrzWr=g*z@pEz;i{EnTw4kjihyBQIX#J zf{wcD84~~y4&^#$0C@iQWOwL1@Bvq~wp*-@Xb^F@EX6ZNjqUNw@-3`M%`1mJNVp7uQfEZ+n_Pjn)Xm+Ce za{Wu^ehXfSX*hXlxtbk7#2`y7&n{!N$BxVz@u=OUt`Rk~IXw3yQKc9M+Ij4l>9FFf zsgL55yJa*Y0&#!{*9rfl`0}g00Dyh_zj1Egv2(+{_cocUI6U~_+!YktD*&EEn34jE zVuvd#4pr(jLX$52P_0orgh{B=rn^^S8G z!YkyBC+=*85E0wFW!oXU&05n32dbsi0B07+5`$G_u!szzz(54(M9?&jkO}xz9cPap zLE+g$uv)D-K{Zrw-<|_GY4?rB*uFLJc-G~|0*HJQ5SaiSwWCfXj_p_L!Y^fKAKz>l zwM5R3s@yh$F~DV`Nm;{$dGp@mnE0?z`U?5+;5u}9Wb}ic)ZtGk&RCE^h_KSetf4~B zIRk{>B?ABkJ|Khu{7YoKH1E}$8xR0YfUbT3VAkw~zdPPvHf_7%+TkNdK}77Mk2fz1 z1OhevTt-@29YC4@g_uRF1S52qOu#TLIG&gE!EbdKH2oi|+~r$EkO_#OA6wVLQUEt4 z0{~d3Ebn0szU#^E-2ka-UlF^-bA-rDCucYk$?287+jvd<{n^aY3*yLWQCg8LRaL57_iJ|C9 z0WRm}Lf15Cx(*_O)vBO!atc(F!KZQ*X@u+(M{wobQMldidEFlDJn4GMzu@pam((iX zbEbe1!6oPST{tdg4FI(3IJmtxZQ3?xWMv49P(2Y%CuazIZ<+RrF%ML-MpSN020<1; zUOR^U5!Y~5?bK5h;ubL`!mfx#)pkIp~@JlXGaA2F^K{ z5OyU+#l=u84EC$!*=<(DRY^s_?~lEFIj_Yv85xt0!(}rTh!pyXn}BYL^)!m?<`e4Q zXYXZWuOArsIITZB6@#UJD1jTVd* z7Hr;&vlAXgcGei-$bxa=kZSRPq1@n%OakY&DwqAKeXq$V$S-K?iHwBH9SH&9Y)T3* z4ipv@Lf6BqLe(@Fh5=O##}U&o!HEzGsgMK)nE{drh@u3$%ZpGbbbTe(N{I&myfMAf zYKiCWAp_7g!Q(C0zC7s!uLJMR8YX<0+M7^2`SxCN!7vns41f$kw*GknID2dNqWrgb>WD`Y0CC=8qHJC{50+Q4Rn=pz!1xZWw+tfsiI8fBJba z5&$GgVos+MCh_aWy#`&^p(x6=U;|MQU>F91p&(4dglU=}TqWff?F>nhU>Lt{Tm604 zMgYLJzs%|p@N3s~4}=8aiJ2G20KkqfF5EsLvcz<5TqQ)K=sO`}>fBu@DGq(fc<2mF z22*3T4UJXr);j+BJ+d>UEpe+1lffcj<aof)bWMlA1aKk*f@p`pi%71m&SBhiiPkHgDno~wpxP3xI&`E9r z++fgk+;b;{%%0o^t6!~Oz)atEZV(JzKp-fM0f5mHUcD;No5`R69K}vMw%yoUB=D>5 z%3p#!0H_#$^P=<3rArF}#g|mNN}}B&Rs#T=P5BXEAVY)62_^?j0tCijwaO4B@w$7G zWf|sG_n;^WA|u1~3@5-a2|6bjoFEt>xZJM8*JM96?L`d9C?^H2nJ>FzTQRN^V!dpr z1qHjw01QLIh1~d;W-Zt+&wu^c?GeI_;NQpqU=s8Yr9J&}p=11Wr|-yZ$>!0w$uI$f zP*NiG=AnNm3+Io)qrIm!f{;`m24G=ya{eUY;0+HO3^2p`kbdiK77;{l=nN(RgOGnE zOrk8yf3;aH@D&$>0H_8*GYMb}ip>VAEMIR87={4`Komt-tumsc!;XS;Kr;!d0U%Ti z#VW(;bbbW@8GWW=&I?m;HaMoS)7|(Hm<$$%AJh;&c3Fdi1+Ho^0bR3p%Dz;o&4dv( z@YD;ZZcRvpUD`-S2;5}QHP$%4z^L`gjLLXx&Cx$h$cjbn_mOt-AaMp=l`vvPwMhVQ z#h*CKZm$S#05M+7y;*aSn^)@$84s42p|d*MMQ8#M8M&2gx>@fCM2MlkhDU0yk5WC<@y2u z)~}fjBEX<38)c;`xWV9!z~aR-Sn;B1lTOQm{~c~Hn5KlnV(0qZpKWr^nO5c2gaiV? z?_e0mNC!+!KvALeApi{NlX^$1Bq`?fBtz9f22fa}^xd_&N(71Z+miveZ7Wi4sCOhXBB>2vCE5Bt*HOD9Vv)RjVAhCc8!3 zXI6P)A5P!~V3+CC!smoH0f5=pQL8__H=c|@C_E3F`|XXbH{O=Z+OVuifzwv}CK&{n zpis~qpE>N}=aZj(*8>3cnykjWtmUOXoLcMtQm>~!@&R6Xq4f?CS5A-#a6^d8S~2VS z2zOnO0XXg94V|sKOGyWRQHO*|Skj1z7drj+mTf!tqJE>1VM18-3~<>_CLj>DcIzZw zACz;Nq1YTHMcK!Zb2%S=jo?!`e5whn!;RG1wb8u!y-0tc1JcvekybYioQcpmf%9-` zmQxr&w5)-f2Kjvc>uG$u^e3A}MEC6>5Q79l)r#m20H16#G47e~Fer0aNtEkCUos8A z1cCuqo5#lfv%@V30e}??%V$N{eVYs&3>*js<69g*(d=MGzpVBL_x8oaaf3>I_~_xS zShcc?69Cq2`ni>~;Kil@01?_7WSHPOoJ?vyoRJKXp#%oj1Hk>QZ!DHL|G5SsQ^4iR zp5=o^?yesGwI4QqxC?1Uqk!!k)tKK;YbD>7zcOSumS+K=IqD5{okxMO=JDJ zbLVVvF;OTucN|xWOK>G*qA+NpFkqlWV<--B6o*U{hfEZd7$^*edq|2b;QO-$xP10U z$fP4X`(j4ZCXId^G-PI26|u=&#adb6I$&3@?3wYx_nD(OI&~0{^?Vut!qWNG|DuS# zkGKJFgUKa+XBGgAoNyjHcX4*pLk?*zi}Bs(F7z87+U)aL)33Tz=$apfcHp#WoLL?f z>D*UXWXbmXRWmUW@t1PWr-njOC%dywmrh+8MvWg4@vEY8!5e$AcaKq1)f;{Z$ewUR z5Rk3(NvjsOOR{`#zc)m(ckI#u#KPzYq$s^2Bp=nES?Sn(&Dh`X>9a&)#{xI01<=12?QWU;W&Es5^~QRMPfoMKYjX4RzbnhC(D&>qJ$X$uwy6x zoC#1h9e#_1wV@E6U;wafR}MO~iAUDrJo)=Wo+o^MVV0&cg|RR(rm4Zu3qceDz`?l) z$>M^=;sy~A9~T<`=3-k`X$F2cGy89bUcPlWp&=xeL!Z|c2y1V)WII2!eZDBQ9WROu z<;(e+UCOo2RYP(MZmQt?G62Ic3`iEa97M?q2EgT}_cJqCrefJ0|JvfWHrj0VhHkGL zojY|xQc@x>%r9`9Jagt@yWPIb>-8!mJK%^)fD#c2%>;-6#5n@KBIKO;3Aq=}KqeJY z(UHY!NFANoJL7tDe8{}n z(zm5%LFp@=u-OJIBm!)9D%`ME@cy3iE!u2d;Ptd0BZv$Z3stS261;H!oHD<#kc|TU zS`SeoBRU%6yL4kqax|f4yMfD26OW#`b=Z)*f0H8H% z-bJ52;fC4r6)UTFz25GkBsJ1h)nl5blYpSW*d@2yeXv3OdhbO?N8M12Rjk@lNJ-vg zw^+SICP$NcOnqjiXe?b}V%Wgai`SLwkD-4?4Rmf(k&*M19gN^~a3LbXSJJ<~7sW+j z5FmBBUr;~zh+A(;#D@28w;^_8?KWiSa{z!=t>!=0zD*ua@4%_&BmB_uWBeBTyf^OQ zeD-$}eFxmUbux3-oW32?JNqY1nMOm0kEG@AtfWmJd`JTa4C;3~+L!oCWFm49(XWhg z@E_mZ*6arjxwV}h>Ur{i=hWTKU7!6NoEwj?(X8&@^!81N?r+M?j0gF{cT*M-u~{$7 z8S&6VkJ3}qo}tG_kEM6lt*1{u*<8}FL8E~HFk<*{{MVv+({b1Tu2*~Ph(=YvDr%id z)GEcK?#<0@L?qm)i~|P_V!*&~hkf{n$Cvi#kwH&RoI*o}jijyHcF>Z=uU%}`^xhW# z$#!ISbFh{z9`9UquGS)}`cNf{5Dfwl;YRk>qhiwClr!b2>Dy19JlU>BY7OM)=V8>y z5m>usZO+&G_c!0ZW82C9WI}|y%I=lU^_8OGm6#d>GXy9WeAeMXGys6tU*dmw+;`W7 zyDTf-S(7ki$cS%GojTdBVx@`*1_S8U^+Bv!xoXdjZJ*ZtPbcH96LN2#eXo;H0Gk8( zRcoS8LPb0xtt`v+5|a`U;dG*3pFa5W zy7imRoH~8~{%^jy)Vo)2l;J9d4c-I*=ym^*M%S)Q$hh+@NMEP~ix$7uq)(p#GmcDkM^eARRw$Y91vr2^rfmQK3_D3g zK~#9!?OJJcR7D!S^0Y_E^1`r)^R7il3uuqg#4F^ymvL-P&=s*Yo zV!|poDxwgPL4vFz97kO7pd*VYgk;!563E)?>-VbWN7BiAO^2i*GX8k?oIdH)tE%@^ z-KzV2UsVGtRH#s)LWK$yDpaUYp+bcU6)IFT4&KiGQt|)v*LSFs@&_QrVtn$AZsQkj z?bO(Pllm$&i%RV%N^~xO08g1or`d30U*do2YukKSYJWkbF92YkvVLLB6OOz!({{H8 z2SujNktpo}fXd4`Fl-L|0+G5){&e@6IXkbw*MrXEGjRUnxd4FH(P_Qi5*;E@3};{i zMan>`2gMTtLXgXIwQb~w+J<8a_p)u)Aip%O=2!rF- z@szPq-sKLL*v(%fW9Dr^&c>OLK%!XVkx?h&;|8Jq=v4zwU%7Qsl-NKy8TEi?Kr6dT zTpv7qc~-0F6-@vjctl#`5yErm$!;%xSdeH?@Q|f-w#zNFjg%-0@-CMs>+bIa?O8n) zj4@EK*YB*qtWhL8C^B_+sm*zeF_?Wd&~V&!2AtLM+iL%>PG-XW36AZ-<%ipQ1om~(Y`|OXgcGAU*gzwP7uh|P9m$BF_v0zfO6zN%s za1Yh&WPlY?<97hA`O$5;cR|RAw7w3vxRf#F+;AL$LCdc*YPppBPZrj+>oqY;TU6nk zXmg2~l(D8Vd%zg$Z*{mw0m!;%r#>NZD|Vz!Mo{FkLW#1L-p{o>_e;sayT|%j3df&dvj#S_&LVfh8*Suv?-}dyVzyHqDG344erwX(No(K@_Rm$ z>9dcpm=yqkn+KAX8ui+41h^TX)5I1ZNXo>ce}_bA<4D&26PF&p)AJI$@RE15_2Af* z+JZ{go!W&^N)4V!=8hQf23j@OS{!Z~Etdk5mfu@=_T7rWHcB7nV!Y%pAvHS$fYm9k zR7?)fS*P`D`{?Q=lU(u1Tkv-3RG)q1?^y%@cp!EquIDVs1rS`}dHC(?ur^lMYZJsL z6#7QsUjP;RG zTxLUXkO=`}Rz=waXP4R)ORQ0UGSA$y|2FLI_rv4)W^iC6iqJCuh}3h8)*(79eoQQdAyJsrlQec?e@r5MtD7HroVoj;unn3x#D} zJ$c2C@4tl5nDovS4k1Lg%1#jA3V>17eS%Wj9l-fJy*oIlD$=ZU2%F^P0X*hzSvAY; zBf=sPeEE1k$Da+L7yz7t*w1V6SqUNE1HkuN=QOxO4+(ceM!jLLL}_oCfm8z9t>MU7 znS2CN${q%QZgH8_;hy-4f^m+lB^>!#UM5Jie?yFGK79FHmq<;rB=x!=kzLOnENJxH zgEF-9@^v305M2(dfd zJ-m}_t%fhXzBeg{Cq$@KE%sE$QRzkic<-Cs8D7UOr<$7drR5HHt~`OFjMc024pDjv zK&U*h(?d$XQyYPCB>=Ab@eylnCEj@v;W>``!w@1$w5OLpvG)yYdA(Y`-j{84SOsZ8 zb$0r^SI+U>rCsx_8lE^kT3wxN^8MpCw(|AfZWGs3?=CKx0XzVRAPCZMnT4PI{qnAq z9i~06?KH7{E0xDNAasSJcLIPOetc^33WJWnq4Xid5E!5hx!;7;>D1j4jqnNqOLH=& z3f0^BGXO7m5=%j(bGyc6{_{$SRiP!O0Nw5q06fRp-Jpd4f<4bJ7gr7da9b{M=EK?O zHgV19i$xVZJtwN|IUA0fcPv0$_yXirC0Oi&2q0e3_L3B6HD~ADx|@j*C3e~?qG@V# z3gG~L`M>XwhzS{b2DI`DE5DItu4e$0$|R_1QH3KJva=takfJM}%>N1ingnQ^AShDE zizp4O%cv{Gm6>wiG2QU{&&kp;U5^t2LFPkvp6B8Lz!;g@pguxJEWfR6&FU4}HIVLdxxe5ll&lPQ!g&lOya;I>!-m!|O0D-Xk#p5TMhf0l=Uc zn~}G3o|7;r>NCn7^Yv~^)UpK1SlgQai3>xtmw#6>BF3%4jORzX4O)Ja($PyJ+Qg(U zvL8xD*tm>(`?{SKI&DwSDeGGTfPL;W?iQk8Fot${(5&Z&FUi{7a#QAp;E-U; z*aj0KNz4F1p`Rf^#&5jNci!`gO0+Wl#Ut%38v)?Ux29Ls*KoNCNfc>_P;kBG{r#Wc zh|uUXlSC0$V+RQOYKmEBO$kNSg_QS4DLde(zhsohg(G+8{Hid!g?TgBZQv(V7B70aA-t}tbM-~uB1M?{W~+!Wx|`iD_yof%ZZ&~JR2i2!h0Wt627Doz~{9Kf?%Bf z!V_!b!h`+b<12G^-Z=p1FfIdUx6Bfn4@*rDM7BlU-zyZ)|c)p3*$Q>(nxQ7tJyBkEv>Fo(< z8=Ky>%r3|rI{Cr7-nOiGwqEUv51|8GA%N zBvGQ#MdglYOH^u!TcStJM%_h`vJjUb^*nd2#Mhk>M9KzSy=Cn;{r${cK&Jep_`F|E z-7T?!Ug7K4KH223-p6@<1qX6+{rtlDTAur|j_A_@U|gA9SYUO!CySK&B!dug$zs$+-q@G8tL5(^_n_olEC+65(A*)xdUc{w$G)Ug`b6v zT!EtfN%xkAP)a)jxCMZ5gy?Nf@pR8;vv6`-ts-3gG!gA$R+N=H#qSv4AyA{$kdKJh zwdSc0UiSE+!vMknxB&2ARhjrt#g4vUFafyfX`|=Jx`Uf%)pwkJQ$802Oaob@*8m9K z1wU?`4FLG{qXZX#qUw706`#Q(A~ZpATfpto+CvTlRhzj*Zdq$GIZ_J zMfaW)#2B}55S-QKW8wEs=kOh@)q@+P=0hN{R z1(8zXo!@`&ne*J|oM+}aGxwhReDCK@oTmCy3Nj`#001bSsVHiLvo$z`NQpsPDH_}X zPQ+HKPZfdd|E{9;_vzruO*a)IPXHjN{ck{kyaE`wNP>QbR3iCFOh(C#Ko%1u0{}Je zGevn_--SKn0A0G(hU=iCJJA~lHp-K^5XN}c(i`kVhoM@0KbvAjpOxkqH;O!@pog;e z);a3ut!a$}G;MQ8Ws=ZI5_6n)X$O|Mld(fd{YDP%uc-lEt_abPSozHqT<2n>HFT^-W@+bzwo*`k-4l{{ktzs1Gm?RTt$9R@70Ob@DZb5>4Y}H~Ee!Jh_p?3VGo+}kjfE_V zfQX2Q2AEI$C>T;CCuw4A{5B#Y;-!+3(mX3Gt8>uJUON$?cC#h2F30ap?v(24>QT01 z1&6r9b97rX1uc;kI^UiZ()7K&JC~o;!NCFhidD+2@R6&T4gT=Cs;Z#(uHow1T9S&2 z$~`+5`;Y1F&8zb+p>KL1goK0#2_57-J5|MkFx<+@QHdOz@1%vmV{-$8fo6}jAx~## zXGboYXW#G)1qB5chAJwtcgi9>29Rvju#K_T0Ud2^rVEaS0l?DIUQUD)E1-~;p1#s+ z<=$Bbg+d=@MZJ9aGRe!sW1B$E%=FIXa%mB9Zrb+C=MEXXTLm$X+($0y$olH>9sktl zV`gs>5D<(R^)GEK%QNN1gHKgvSCl`)ymKo~iju9f>Wgn)$6x?m*N$_W(QqPib{nF#ve` z_HEW1>3|a`kaPdz0Qw{Aty>niaKgAA1`0B-J)E0(Y*Nzb=-02ccDc|{GdAjJw2zO$ z4!T8~j*iZ7WW2T&zh) zz{ZaHlayb;w8rNk(C8>cl(bAv3P?yvO@$GXOlMu0G&r3nw6+G&0>4+tH<#Y@`2Q9C zs;j#y6Ime6LLhf_btOyB!0;S`!+t~oU68I9%^szW*4FR1xVii4H|o^#M7Az2ZPKc% zolid)eO3UlGUa!xvQe)*(CBGGHu_|Z&Y_Iydj?wVYD!GaY3fZ>+?eL;uc@4_b@lbn zAZ%=GI5uDzs9T(mV0t-pCv18!gN|1ymoFe7;EA@jHUS_aCU#QOQq%T(XeCf4qzef~ zJ}pw=m!OnXE55zGousckG&J-F&_q=k4Rl?cA3*?zddXCj%;-24n>za-1x${-HNJ(- z%?06p&vEI-ke_XS_?shv`L;W94?Sp|BTSW8p9J3P``H{5Je0v(NIQw!-2y%FrmFju zD{LG5V|rSI4&XQM82RHbosgV--KxU1-MEBGmR4SDa6Y4^eXyV*CRR2j8_rX-BSa)Rg#2QcQC0pG`BT_jQ&W=>>PIO_$$RhK z=3LzU%;(m&wzAzYPT=6^=(B0f3fylMI&icxuF?8p2^19wn9(lT+7%ZBUGt0LRxZxY zdn2>6`ioby#o85=G?QMQIR_@_N1~!LK+4i^sa&yUo2Iex-)iNOR4)4+Ew+>=Uty%7 zkv-i^PZ`x(-C3)vs{sIl@?D%H;^?>F0@yZVQ_3qy0F_eho{?PP>vTbVofj`C5QrN2 zYEDNslGiyoO(i}t!`TQzK+FkS>vM5-h;9{g`7X|P?;h!n>+iHQnvSX}$38h@YFb)a znF-~6y(fUh+E6Ck$j){it2IXrKcb(tZV_TJ_3zhS#O7iKf9H2z`yi%3eLJOx9-i*b z3!mw9|8o08Y(<zeko*e2~2ZNZ!fQE7CQ=I zn~~VF5~8%MEMg!>%-MJxGU#zqMBE&=Ri;57Mb;;hF9)QK4&B?Yf(qn(=PoF=>fM2qKU#Q*`Kl^Ml7@vQ#zu!hg!; zd()xMB?^UtH;KPPd@yTg0&sXdoHu=N0l+ysbLJ%}>rmUp-#Bb2A^%h$%}z|B?D?rQ zlhl*h0Rrsr@2en@NQ*?h)z#JSxpIL)LCF*iPgGUOE32wlhlhsl43Cc+xPq^^EGjC3 zgQ~?}W74?qdi(Zmm*K33gn((g|FMR~*pIl`lbGY3xoasQArBtFbkgV7kM+Bx-4@T( zlU8pEq#;5f>#K}VA(Q%hd$VD~YaD!he8W>yo}EUE`@Xb2K|w(w?eIp{W>c3O5qoWQ zP}oJF?vSF2ii)LkI9K|yNn~{NmG#!Ck1f@=p&&H_%cIdMvofwdYWmj)Fa@zPRjTv9 zfAtyZ>HU^Q<#8<1{&a~St9W^NJwb=?=hk|9dhW08NK1N6l_3kIFaJ!L#HwtruKt-Q z?H)*mQvtDYaW_v-Pe}kS`)#cXe9Md?f!!mT_37()Zw~C@A`0C0%+k^_(}z1{VnVY( zCWy(Q{x7c0@5rjHy}ios@lR>zemfC`l1Wmq+Sa*shZ9}C(;c9u0+(JuQ+t|p^!{OHpJ$F-n|MuYG;wq}G71;d}MUJ3>(mj?b zi+2vt-Y&brMeU4Aun3DY081-vHo_d!!4vkUe|P?Kh)m#_+d{T^@K&qcym-qWMdDkLW+I^avh;NQiwBUIZ}xnTbaBDNBqxuj zOGrqJ>*?y=XsoZNpkpQlbGX>w@W%4`dNiWr%<5YlEzcD>(0>qRXtxtdDHPtFq0Bq! z6-pj0S4>LmX}RKOLJ~MT8Lsm}vf#0wkR_<8<{cNmhb2H7k(ZO}!rc(^**BH+Jz#U$ z_`0{ddvLar{1lJ}G8WlgANa*LLFsMd|+wax?|AjH9!& z-u%LX8N6<=#d~kzcwxaLD@ zKSoAIO852k1p~F%v71^PHxq51^4qXDIobDCVAQ9XDGa~sl5l=q#dQm04EN|)v~mkD zAPdCZS)uOFpFbz&p?W_ROd*x5Y-bFIwn5bl z?djg)BSN5`EYi>(p~ORK0mKLfmN@p5F(9de%xtARBuxUs)A)fYMHFK?m-J?5EMel!?I6XKxxZmB~tz~3ngyMhEB2rdc>!xOCXs9A5C)X{< zOY>TNZe-1)Gbp8|$;NUaJ2TVS-qp1cDin<-VNA%8XR}Kp24e{TV`F2IR8&-GTFdGN zsBr{jM2&aZEoB{dOAs~TP!HmI*9JX3y-b9$nzC}g8ysGE()~{9EU*LIr@pef`p(_W zZG!YhxV~ysbteN1W~i=sK_cx%!_3?oHM~Xx7+dU2?5xG68L#pgJ0td9)GlUaWMnv1 z)Tz^}mg`|!xRKX!)9t4P1F(cd7q03^?e#w`2H;WobQ{k%f zJzO>jy)yUnfT5ymI{t1a)z;RMpDxnH_F0wBY$s=f!Fwbqco>G>2D$s+$zJ+C$c+*D zRZ-F_I8=qyAGEN6S5MKveWVuvXlQ7xBp^CqJupX9qL)Ul5O*-P))EQSVwxex#FwLs z+?*fW-NG_@bcr^r z1JVBHTj_0K8>bC7@$!kC)OXb}T^UIvqz7v^Q>^h$hkcax_V(96=)pm7d||8i-Y0SM znysn#A*;*FzjrJGpO_;bFiai%>bbwXyllqFF=hcvD=2v2?d^SM!Wvm96C{^j?|-~4 zUaX15i>LEw>?h^N1QH842|#c1;i zmENgcIkFVU=aYuur{}r`W+3V(C%!w?jb=&l@hxjwdX|>#Fcd3T_mX#ZciVJLOoj*7 ze^ax2#pKT~zyNDl^ph#W7-nK=ezUf-{@H31AE5mF^&qQV1lR>0npajbp{ z&f-pfqM&zuLxaARqvH;Hs)`GyZ-kDZC=BY2GyJXU-*5ObI9Mi_IayRpOo1;mJhlKL z&ICczuvrE1keis8P-JFi>Vf$GS6;ZHuC7j_ADW8&b|q^?JRGplaqu)daU5)47MIiu lWhnl?Kd=1~9|OH6sm{B66iq_E4E{#|o++s-ViYXG{|9*4BMtxn diff --git a/docs/_static/taxii.png b/docs/_static/taxii.png deleted file mode 100644 index da095edbb7bcb90e9a6ebf752d6f5cb6330af958..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5421 zcmV+|71HX7P)pk&YZJ7*(4+(q>)fVLV!mwToDun6cALn*DE4VLJ>p|0w{?T=|~3! zi3%5`SRNt>C>BJniqv?iO7As|B%8L`v**m*Kh9=1+d>eypZ9q$^Z6Wd_DuQJ`L!8< zx>ncfT3xGab*--b-)PG-qwnkb3l}cDr|Z4{{)$?U_}r7OPyDW!MhH+)rpM4(MT0;H2Y~mpmSV)naab{><;rN& zdA%nPN;uBv*T3~^ZrY?xAJ49=Y5muSCPyViTwfF(Xtl5SQXxCD87Ku51$gyY0lhm= za{NYY&V%@7YOdh5B7lfQ6$(-l{Rk=KYaZS8lvCIb(o! z-6L%TE-T!N#+#NPZH|~WZThSQXC}YWdRqIqQ_VQ1iWgmlF}iUJ&Ocup-iZLvrWx9G zNfZXUsTT3^Uj27XV+hBUJPHsD0iXcDh>_#)e%4Zb$DrB6k{b!?9FKVyb4v20Lr31( z1YE8OX>(Xoc}k1Iq_&NvHUP&jhwZT0)xOxjO{1j>@^YbEuZRvjmyz40WbFIOaa*g3CeNevVbk8 zNfv-J&0|Qfr#lO&P^ddED97#-1ORF!5bA&5I9`aKKH_V<*KaqqD!aOITT*Pf>#N7S z@L(PqVYu|*?U0^2|8vXE6U`T#&oQ8PN6P<_xX^U|r0L7Q_sauc#QEdJ9X49? zYWy}3iJyM&?-RxjY1p~>>CRM3{UW2&C_;Sw^6s@kJagVppYA!AIQ&|HhOD2eL-U3% zn9DcGIC7ei)Mn-8ZY{Di0N}L+M=?92_w=qwXC~ThcJ!TCiOV@EeR?gh_*EU^qXqnN z#eDQiX|s9m6cUf;{xw<)nb#mB?x&x7Nvv_`r6Db1tXeSt1Ze~gjVKI$^UX>6+hH-c zA28^R-K&mWjXvJ60mYKhT4$f744ArF0s%*KQ0~|n?i5>uv0ibij$)L!3_NKKV zA|QYvwQ1qVUeo!!SH}^nzi|Txy#fH3z3it`ap4bbhzLG1WKx<2KmMkmz@m=%d>6xr zJ{)bEmx*!VrQJ9PGFC_^Ds>Pq087W}5K)idrxTI;$IL!B1-11HVqt8u0U)2eV}P*ejyw4PIti+xe0QJEy(A{eVy7HX9&Q0F72`ZP3~4``n*iR)8WQ z;$~R){60Ol17FsLh>y=?ribXqH~CwqoX!hIX)$b`1cd>XGLE-Dw_|070JE83?ivZ- z?q|+<-5#KLx}%8ex3u!5g7C?}DIa_%wKCrK%w!FoTyv&W&sd!APhBWwa(H0AUoX8m zCIbLq)Y_JW2H4!^6X3vc2CJ33s~Q6uMi3-~{m~!bw^hPvnFH|i`e(|nSz?D?xM3_B z*h7P{&$)K&`tKA>`oM-0=NJ}!>e}gM6R>2A4jMth#se)j51zPt*ZpETxl2rsDeizRKFRszgjRU}zp(e?PaOU2E8R%Gw| zCfFn=G>t5cnYUzZt%*tB_2ZbY{uTGn*l=LsNR6AS>^aVz%a3_h#IUC|xOi1xl3yN` z3IN8|@7%qL6LQxPGQIN+M?Ce%FW7|CwBUA)ZYF_JuQjZ8TJihMsGReK%|0$J6TR}A zkN_LXE5#vqLX2fsl%0h>-zWP*1nd8Vh@rg&Zxb9uF#H(}2!KPE>hD~Cu;)ntNKa4q zLp|}!2Xfa2>Q4#e&s){0&z)==6;c`IW%ek;>8rZ@qvaz`&X~Xc!?QV|0AX%0v>JxE z(A@M0&TEb1C#z>;z|birSMrS$tTqADhG-EK;6CQ>k5aTqpxA#>#MG}|NZ-4CvQj$> z!E0$d_1Cd()k_BLplSCYqMj(?pu?^w5_Z>1Wo37^^R-YciX=U~XIoib`m zO#YSK1OP$<<<|@bhHv&Mu#~xv`Sln>Q9egfoQzSOzZn)VqUOMX+=Jkj-yf6ZcY}I$ zjC`Rv0H8sL{ES9qUK6esXz_c|Q(sqoDzOD;%O1H5I1m^}&?Px1t+phMo$)>Y$DD`P zc4&4b>gZ_&uP>Lp#+8n z-*|pV!+Hfx2=$K2Tv4FU_@~)LOl8=_s)?VA^U4`+k?vB1Uc&6>9$+0H%%W=09@!4~D(s z-EKEeV1tK_1OPM(+V|g45e!g>mky-Fo<-5slpNwHlGbdhA$F|VCcD+DI<_L1GDwTQ6K$xJfP!LR@Ei$;J`&KY z&FP27jp+T_jHO>M_Dw&zYewH=lXd6tCXRWk>wh&Wd(0muO&bbGO&0J#O92lg3rI;4 zU^4nEI4YDt9-Q<`f4>U+`lPqeG_oQ+Hq_eW+Db*mNGGpVC_^ry0jDUSUVTF zr>}6#S|g!eFyZ|lJUn&olxO4oMY4CxXmZ~LavMw%LJt15X_OUyE4z%V$5z!J?i+?E z0ztZ>?ius+Qoa4sWlmaD9;6@l3=YtST`LTdz8W$F-H-?hZb ztul_EW28;I#hemzegXhYd;M7tf#2Wi?p^p0-yfOBke7${3r$TD9~T93+kl|PzG|nD z?Gs8dcVe&YQ|Eu-#hpO|`$s&T{L7HI1`1|;Xh-%**N_gaD4yvgBCm)l>%IxjiwdLs z!%13b9frEF1Q<5Y291UzHu(CeMU%UAo3ZE%4}n*wf!q)My?ny!T|t)r`sNTvqc;WKXaMkA78m@RgI$v z)=btRzeI;G4>n$WEdMW$p1q+j>(Wj@-_9<7b>IX?`cfMbV@vU9^W)#9k9@wZH~9qr ziL;PeI(1U(9W-;nCs;N2@zGt(d#IN-QQ*)?j;$wpd=Oxuinr+@iXPWH4DNjV0h8WC zFbrtjxFWo7$I=1ce~Y&PVEBYjuyWymCz{s(ZWLz;I)3f9G6rDMVm+XgSGYD_VJbq@uW#_ z*LxN+gN#7D`FIzE6fQ$iJvRE4fe}s2d$+b~T8=3z6#S6w65DIQCqxN%D>pUVrK z16%+AOqjbny=g?tu6sH!i%Qq9UTSv{a+jYPAIg1?I26{`!YIGg$;6lvgX5x!yffjA4;~eX(s5 zOPu>S_0;iNz7Bs}30dF|%!0X-a5+~jtd!_UbuM==(orC}k$9<`jLO)<3U# zH0h@P&>z6Nn_MYOSP-x@T?d5$UmlEGJ#t3&J^)zz?q~qOjpE?G7juo40Z(W!zQ0Q! zH||m}Wu*;~^()21@C)C~U3sv9t6Eq6f%Cn31V-HWQw?{@oqRGHjUfP91qKE_5fTzI z!Duu#zT+K|TSSXQroAZ&L{X6=YOF~Bn_Vm~Dy3Bi9jGk5GR$TduAaLt5LZ$~00MF` zKd5MK)-P-4z2{rIGA6!-uHAZABTNA&7-!)sjB2}#0XY_Jh?ZE*VQjlWq;k@Q9L=>4 zz5=Xv9dtTCvI8$Yqd}laAlnZ`Saz5Xr&nog+N;X}0E>@rJ|AM}wozf%dOVsUV9mD@ zEaj>;uhjfGkD6Is5qH=ou!ZmFy z1CgCpjuKEXmPVsFWwBUpSS*$UK|w*}jzi=}I;CnM+YE#{%&CV~1c%oz z-?C+=0swuxHxIZ~W}t*Km%Aqb7$*f40rDTm_LXO?Sc;LO#`%PGpz0_nfk-S1{V3}25znzj1*FYU52n3zm3OI6xlk4_Q(xpT1Tj$Pv4HKuj z=X@<6o~jK~w&+95K+Y{0mNHc!c7@_rF+}9f&}!5SQI;8cj5rE~0gQ1Z#0kinpoQo##^pAOMVlg#XVHQ&js~FwQwHlGI6Pfm zp@f%boPwo{ficyIk9|&yKAlBXgEbuQZ;Qa8b0&xa2c^K!-Ws$`aD=&(;^S@CuySJ# zC{<~i_@Wj)JBg0_mB2p_E10uJf~;`J3h;P)0n>)*)SHV0xK$!z=KsV%k{lKyfMCJ^ z9YV~i$*`127(V?Ja&Fl{2oMxNkoB4l(e`MTc%?9*qtwW+&1Z03S;PeqI_Uv&vP)lP9USd#J5rDi)46FYkInSdy zv@-Hhodjt0sz5{z?A==eyR5pG%3Bn$7*sO=z*Yim+GxX>s~n6032_9IdKe)%u$1#T zvJaFax6l<)^=q#KQXB#?672ZKhON69G@^Q|q+3HB+6Fro5P;mXmH2g!1c3sw0t|UX z2ei=uj=Q@BS7hwnE5R;v$TARX5P&iRU{`%dSq{hAkJOqN07QlojOt`SNPV^LtynmI z%PzyEo2oMp3nH)<7yyGSV>@>y9DDX$t`dkzlBDMVZ1oa|q9{Q&n=Qy0{wt1um});2 zCP9{6DTE>ufNPvN6K4wScBhYr-7bJLK~+UZlVusQT=h-?E?3JRIV4Gf&8Ci*Yy^Z0 z)z;^bWjkcqWu}=ztDRvJ*d+-}QD9R5MF5ywMTjFdQ0(ALhU`FzF~R-(o5>CsRXpJi z9J!;P!)CL=<`9TvBjAhxOijIr1IH@1$ua<@QPTikg|iG-3ZCUy z6@Xn<*VJk_f&&5B!2?MlD7BgZLY*v+k0K~7DF){pqSlO?{K@un7Ol_rmhryeQ+!__ z=lcRUKi!hIYSqeRoeB6?3v`_CGdZ7Q>kM3=E(_izg>rs4z}f%D#|9o`BF=uZ0i5q~ z%-?U~|N2m0Wm!1@9u`darA-DGjJ+lv8S3h95wGV(-v_$k@Je6N?IzTZ%XFL{bj^R^ zalx&B_HfbFf6&ASJ?Y+`)>Gu{S4V%giGMy*=hojTC73I}x^O7?#>g8*x@e532VU@v zk@Nj(|BbCi9urR7*4VX7r}pnPah@H=0bod4A0L@IXO4#h3Iic7i$<%WHs;z}jH~67 zDmPCFoB=@9u}AeAKx(MTK^-UY+|gfkm_!|GR^8#^3|{34XTP5VBwj@}^LP5HX8n#$ zeDLIfvta8Kj|$<#wOf1&L<6okr&T|k;jB8f za7w2-(VTm53mmMPdEp*c$vNlV^Q&O+DjYo5=U!`gNrZEsG*lzRDGASh7Y)ScnL6i= zS`~c5;7+ZrDtNn_SeN2EE;f6t?=BE?hi%|I2H=1YoS%|n+F>>aX(*)-C=eQ>1p)=9 zqM0HX9)83ISyBIgUaOWAFzEn|I>c0;p<^crr4=e;1C0R824~?duz@JG9J`<7!z^qln9T5nRQ}AF12^vx5U7HqxAZEoO6hK2b+COMROaTYu zKzInCsb>HJRQOtjqkRV(;)`532S+<_ -

Related Documentation

-
- - - - -
- diff --git a/docs/conf.py b/docs/conf.py index b2b74e5..d7c113d 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -12,10 +12,13 @@ 'sphinx.ext.doctest', 'sphinx.ext.ifconfig', 'sphinx.ext.intersphinx', + 'sphinx.ext.viewcode', 'sphinxcontrib.napoleon', ] -intersphinx_mapping = {'http://docs.python.org/': None} +intersphinx_mapping = { + 'python': ('http://docs.python.org/', None), +} templates_path = ['_templates'] source_suffix = '.rst' @@ -25,22 +28,21 @@ **Version**: {0} """.format(release) -exclude_patterns = ['_build', 'api_vs_bindings/*_snippet.rst'] -pygments_style = 'sphinx' +exclude_patterns = [ + '_build', + 'api_vs_bindings/*_snippet.rst', +] on_rtd = os.environ.get('READTHEDOCS', None) == 'True' -if not on_rtd: # only import and set the theme if we're building docs locally +if not on_rtd: import sphinx_rtd_theme html_theme = 'sphinx_rtd_theme' html_theme_path = [sphinx_rtd_theme.get_html_theme_path()] else: html_theme = 'default' -html_sidebars = {"**": ['localtoc.html', 'relations.html', 'sourcelink.html', -'searchbox.html', 'links.html']} - latex_elements = {} latex_documents = [ - ('index', 'python-maec.tex', u'python-maec Documentation', - u'The MITRE Corporation', 'manual'), + ('index', 'python-maec.tex', u'python-maec Documentation', + u'The MITRE Corporation', 'manual'), ] From 58abf1c91b32306cf56ed68bd4439d239e2a3374 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Thu, 9 Apr 2015 14:34:17 -0400 Subject: [PATCH 173/297] Added flip_dict utility method. --- maec/utils/__init__.py | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 765a7f8..8a4dc95 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -1,13 +1,23 @@ -#MAEC Utility Methods +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved +"""MAEC utility methods""" -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved +def flip_dict(d): + """Returns a copy of the input dictionary `d` where the values of `d` + become the keys and the keys become the values. -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 + Note: + This does not even attempt to address key collisions. -"""MAEC utility methods""" + Args: + d: A dictionary + + """ + return dict((v,k) for k, v in d.iteritems()) + + +# Namespace flattening import maec from .nsparser import maecMETA from .idgen import * @@ -15,8 +25,3 @@ from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, ComparisonResult) from .deduplicator import BundleDeduplicator - - - - - From f7dac1bfbbc93ee6c03ae2c6c9aff69100f0f81d Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Thu, 9 Apr 2015 14:35:08 -0400 Subject: [PATCH 174/297] Added missing _namespace class attribute. --- maec/bundle/process_tree.py | 1 + 1 file changed, 1 insertion(+) diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 7d0013a..62a9ae6 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -18,6 +18,7 @@ class ProcessTreeNode(Process): _binding = bundle_binding _binding_class = bundle_binding.ProcessTreeNodeType + _namespace = _namespace _XSI_NS = "maecBundle" _XSI_TYPE = "ProcessTreeNodeType" superclass = Process From af97695759178433e8c88dec6088ace4cc8090c0 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Thu, 9 Apr 2015 14:36:04 -0400 Subject: [PATCH 175/297] Refactored Package.from_xml() to leverage EntityParser. --- maec/package/package.py | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/maec/package/package.py b/maec/package/package.py index 726bf97..b73ae34 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -6,11 +6,15 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 +from cybox.common import DateTime + import maec -from . import _namespace import maec.bindings.maec_package as package_binding from maec.package import MalwareSubjectList, GroupingRelationshipList -from cybox.common import DateTime + +from . import _namespace + + class Package(maec.Entity): _binding = package_binding @@ -45,7 +49,8 @@ def add_grouping_relationship(self, grouping_relationship): if not self.grouping_relationships: self.grouping_relationships = GroupingRelationshipList() self.grouping_relationships.append(grouping_relationship) - + + # Create new Package from the XML document at the specified path @staticmethod def from_xml(xml_file): @@ -54,16 +59,11 @@ def from_xml(xml_file): Parameters: xml_file - either a filename or a stream object ''' - - if isinstance(xml_file, basestring): - f = open(xml_file, "rb") - else: - f = xml_file - - doc = package_binding.parsexml_(f) - maec_package_obj = package_binding.PackageType().factory() - maec_package_obj.build(doc.getroot()) - maec_package = Package.from_obj(maec_package_obj) + from maec.utils.parser import EntityParser + + parser = EntityParser() + maec_package = parser.parse_xml(xml_file) + maec_package_obj = maec_package.to_obj() return (maec_package, maec_package_obj) From 6b47184fc95a673ff3bf15c0559a54151febbe21 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Thu, 9 Apr 2015 14:36:35 -0400 Subject: [PATCH 176/297] Flipped the parsed __input_namespace__ mapping to be prefix to namespace. --- maec/__init__.py | 33 ++++++++++++++++++++++++--------- maec/utils/parser.py | 4 +--- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 10bc44f..239f65a 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -14,7 +14,7 @@ import bindings.maec_bundle as bundle_binding import bindings.maec_package as package_binding import maec -from maec.utils import maecMETA, EntityParser +from maec.utils import flip_dict, maecMETA, EntityParser from .version import __version__ # noqa @@ -44,8 +44,18 @@ def get_schemaloc_string(ns_set): class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" + def _ns_to_prefix_input_namespaces(self): + """The namespace that are extracted during parse are mapped from + namespace prefix to namespace. The serialization code expects a mapping + from namespace to prefix. + + """ + input_namespaces = getattr(self, '__input_namespaces__', {}) + return flip_dict(input_namespaces) + def to_xml_file(self, file, namespace_dict=None, custom_header=None): - """Export an object to an XML file. Only supports Package or Bundle objects at the moment. + """Export an object to an XML file. Only supports Package or Bundle + objects at the moment. Args: file: the name of a file or a file-like object to write the output to. @@ -53,12 +63,18 @@ def to_xml_file(self, file, namespace_dict=None, custom_header=None): prefixes. custom_header: a string, list, or dictionary that represents a custom XML header to be written to the output. + """ + if not namespace_dict: + namespace_dict = {} + else: + # Make a copy so we don't pollute the source + namespace_dict = dict(namespace_dict.iteritems()) + # Update the namespace dictionary with namespaces found upon import - if namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict.update(self.__input_namespaces__) - elif not namespace_dict and hasattr(self, '__input_namespaces__'): - namespace_dict = self.__input_namespaces__ + input_namespaces = self._ns_to_prefix_input_namespaces() + namespace_dict.update(input_namespaces) + # Check whether we're dealing with a filename or file-like Object if isinstance(file, basestring): out_file = open(file, 'w') @@ -129,9 +145,8 @@ def _get_namespaces(self, recurse=True): del self.touched # Add any additional namespaces that may be included in the entity - entity_dict = self.__dict__ - input_ns = entity_dict.get("__input_namespaces__", {}) - for namespace, alias in input_ns.items(): + input_ns = self._ns_to_prefix_input_namespaces() + for namespace, alias in input_ns.iteritems(): maec_ns = maecMETA.lookup_namespace(namespace) cybox_ns = META.lookup_namespace(namespace) if not maec_ns and not cybox_ns: diff --git a/maec/utils/parser.py b/maec/utils/parser.py index 57f7f0a..bd752f8 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -62,9 +62,7 @@ def _apply_input_namespaces(self, tree, entity): except AttributeError: root = tree - entity.__input_namespaces__ = {} - for alias,ns in root.nsmap.iteritems(): - entity.__input_namespaces__[ns] = alias + entity.__input_namespaces__ = dict(root.nsmap.iteritems()) def parse_xml_to_obj(self, xml_file, check_version=True): """Creates a MAEC binding object from the supplied xml file. From 60ed7dfde1a90653b391c8db3d97dd0554f1f415 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 16 Apr 2015 16:08:06 -0400 Subject: [PATCH 177/297] Updated iteritems to items to account for potential dictionary mutation during iteration --- maec/utils/deduplicator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index e7a036b..3b71bda 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -181,7 +181,7 @@ def find_matching_object(cls, obj): if xsi_type and xsi_type in cls.objects_dict: types_dict = cls.objects_dict[xsi_type] # See if we already have an identical object in the dictionary - for obj_id, obj_values in types_dict.iteritems(): + for obj_id, obj_values in types_dict.items(): if obj_values == object_values: # If so, return its ID for use in the IDREF return obj_id From ba65b676d97fd6e89e8d90ac605da6dbd9cf9b57 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Apr 2015 15:21:14 -0400 Subject: [PATCH 178/297] Initial commit --- maec/vocabs/vocabs.py | 1924 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 1924 insertions(+) create mode 100644 maec/vocabs/vocabs.py diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py new file mode 100644 index 0000000..5c6c1b3 --- /dev/null +++ b/maec/vocabs/vocabs.py @@ -0,0 +1,1924 @@ +from cybox.common import VocabString + +class DataTheftTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataTheftTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'steal dialed phone numbers', + 'steal email data', + 'steal referrer urls', + 'steal cryptocurrency data', + 'steal pki software certificate', + 'steal browser cache', + 'steal serial numbers', + 'steal sms database', + 'steal cookie', + 'steal password hash', + 'steal make/model', + 'steal documents', + 'steal network address', + 'steal open port', + 'steal images', + 'steal browser history', + 'steal web/network credential', + 'steal pki key', + 'steal contact list data', + 'steal database content', + ) + TERM_STEAL_DIALED_PHONE_NUMBERS = 'steal dialed phone numbers' + TERM_STEAL_EMAIL_DATA = 'steal email data' + TERM_STEAL_PKI_KEY = 'steal pki key' + TERM_STEAL_CRYPTOCURRENCY_DATA = 'steal cryptocurrency data' + TERM_STEAL_PKI_SOFTWARE_CERTIFICATE = 'steal pki software certificate' + TERM_STEAL_BROWSER_CACHE = 'steal browser cache' + TERM_STEAL_SERIAL_NUMBERS = 'steal serial numbers' + TERM_STEAL_SMS_DATABASE = 'steal sms database' + TERM_STEAL_COOKIE = 'steal cookie' + TERM_STEAL_PASSWORD_HASH = 'steal password hash' + TERM_STEAL_MAKE_MODEL = 'steal make/model' + TERM_STEAL_DOCUMENTS = 'steal documents' + TERM_STEAL_CONTACT_LIST_DATA = 'steal contact list data' + TERM_STEAL_REFERRER_URLS = 'steal referrer urls' + TERM_STEAL_DATABASE_CONTENT = 'steal database content' + TERM_STEAL_BROWSER_HISTORY = 'steal browser history' + TERM_STEAL_WEB_NETWORK_CREDENTIAL = 'steal web/network credential' + TERM_STEAL_IMAGES = 'steal images' + TERM_STEAL_NETWORK_ADDRESS = 'steal network address' + TERM_STEAL_OPEN_PORT = 'steal open port' + + +class MachineAccessControlTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MachineAccessControlTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'control machine via remote command', + ) + TERM_CONTROL_MACHINE_VIA_REMOTE_COMMAND = 'control machine via remote command' + + +class DataTheftProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataTheftPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'targeted application', + 'targeted website', + ) + TERM_TARGETED_APPLICATION = 'targeted application' + TERM_TARGETED_WEBSITE = 'targeted website' + + +class SecondaryOperationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecondaryOperationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'trigger type', + ) + TERM_TRIGGER_TYPE = 'trigger type' + + +class SystemActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SystemActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'add scheduled task', + 'shutdown system', + 'sleep system', + 'get elapsed system up time', + 'get netbios name', + 'set netbios name', + 'get system host name', + 'set system host name', + 'get system time', + 'set system time', + 'get system local time', + 'set system local time', + 'get username', + 'enumerate system handles', + 'get system global flags', + 'set system global flags', + 'get windows directory', + 'get windows system directory', + 'get windows temporary files directory', + ) + TERM_ENUMERATE_SYSTEM_HANDLES = 'enumerate system handles' + TERM_ADD_SCHEDULED_TASK = 'add scheduled task' + TERM_GET_WINDOWS_DIRECTORY = 'get windows directory' + TERM_SLEEP_SYSTEM = 'sleep system' + TERM_GET_ELAPSED_SYSTEM_UP_TIME = 'get elapsed system up time' + TERM_SET_SYSTEM_HOST_NAME = 'set system host name' + TERM_SHUTDOWN_SYSTEM = 'shutdown system' + TERM_GET_NETBIOS_NAME = 'get netbios name' + TERM_GET_SYSTEM_TIME = 'get system time' + TERM_SET_SYSTEM_LOCAL_TIME = 'set system local time' + TERM_SET_SYSTEM_TIME = 'set system time' + TERM_GET_WINDOWS_TEMPORARY_FILES_DIRECTORY = 'get windows temporary files directory' + TERM_GET_SYSTEM_LOCAL_TIME = 'get system local time' + TERM_GET_USERNAME = 'get username' + TERM_SET_NETBIOS_NAME = 'set netbios name' + TERM_GET_WINDOWS_SYSTEM_DIRECTORY = 'get windows system directory' + TERM_GET_SYSTEM_HOST_NAME = 'get system host name' + TERM_GET_SYSTEM_GLOBAL_FLAGS = 'get system global flags' + TERM_SET_SYSTEM_GLOBAL_FLAGS = 'set system global flags' + + +class AvailabilityViolationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AvailabilityViolationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'denial of service', + 'compromise local system availability', + 'crack passwords', + 'mine for cryptocurrency', + 'compromise access to information assets', + ) + TERM_DENIAL_OF_SERVICE = 'denial of service' + TERM_COMPROMISE_ACCESS_TO_INFORMATION_ASSETS = 'compromise access to information assets' + TERM_COMPROMISE_LOCAL_SYSTEM_AVAILABILITY = 'compromise local system availability' + TERM_MINE_FOR_CRYPTOCURRENCY = 'mine for cryptocurrency' + TERM_CRACK_PASSWORDS = 'crack passwords' + + +class ActionObjectAssociationType(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'input', + 'output', + 'side-effect', + ) + TERM_INPUT = 'input' + TERM_SIDE_EFFECT = 'side-effect' + TERM_OUTPUT = 'output' + + +class CommonCapabilityProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:CommonCapabilityPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'encryption algorithm', + 'protocol used', + ) + TERM_ENCRYPTION_ALGORITHM = 'encryption algorithm' + TERM_PROTOCOL_USED = 'protocol used' + + +class RemoteMachineManipulationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'compromise remote machine', + ) + TERM_COMPROMISE_REMOTE_MACHINE = 'compromise remote machine' + + +class PrivilegeEscalationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PrivilegeEscalationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'impersonate user', + 'escalate user privilege', + ) + TERM_IMPERSONATE_USER = 'impersonate user' + TERM_ESCALATE_USER_PRIVILEGE = 'escalate user privilege' + + +class DebuggingActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DebuggingActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'check for remote debugger', + 'check for kernel debugger', + ) + TERM_CHECK_FOR_KERNEL_DEBUGGER = 'check for kernel debugger' + TERM_CHECK_FOR_REMOTE_DEBUGGER = 'check for remote debugger' + + +class DataExfiltrationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataExfiltrationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'perform data exfiltration', + 'obfuscate data for exfiltration', + 'stage data for exfiltration', + ) + TERM_STAGE_DATA_FOR_EXFILTRATION = 'stage data for exfiltration' + TERM_OBFUSCATE_DATA_FOR_EXFILTRATION = 'obfuscate data for exfiltration' + TERM_PERFORM_DATA_EXFILTRATION = 'perform data exfiltration' + + +class DeviceDriverActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DeviceDriverActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'load and call driver', + 'load driver', + 'unload driver', + 'emulate driver', + ) + TERM_LOAD_AND_CALL_DRIVER = 'load and call driver' + TERM_UNLOAD_DRIVER = 'unload driver' + TERM_LOAD_DRIVER = 'load driver' + TERM_EMULATE_DRIVER = 'emulate driver' + + +class ImportanceType(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ImportanceTypeVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'high', + 'medium', + 'low', + 'informational', + 'numeric', + 'unknown', + ) + TERM_MEDIUM = 'medium' + TERM_UNKNOWN = 'unknown' + TERM_NUMERIC = 'numeric' + TERM_HIGH = 'high' + TERM_LOW = 'low' + TERM_INFORMATIONAL = 'informational' + + +class HTTPActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:HTTPActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'send http get request', + 'send http head request', + 'send http post request', + 'send http put request', + 'send http delete request', + 'send http trace request', + 'send http options request', + 'send http connect request', + 'send http patch request', + 'receive http response', + ) + TERM_SEND_HTTP_PATCH_REQUEST = 'send http patch request' + TERM_SEND_HTTP_POST_REQUEST = 'send http post request' + TERM_SEND_HTTP_GET_REQUEST = 'send http get request' + TERM_SEND_HTTP_HEAD_REQUEST = 'send http head request' + TERM_RECEIVE_HTTP_RESPONSE = 'receive http response' + TERM_SEND_HTTP_TRACE_REQUEST = 'send http trace request' + TERM_SEND_HTTP_OPTIONS_REQUEST = 'send http options request' + TERM_SEND_HTTP_DELETE_REQUEST = 'send http delete request' + TERM_SEND_HTTP_CONNECT_REQUEST = 'send http connect request' + TERM_SEND_HTTP_PUT_REQUEST = 'send http put request' + + +class AntiDetectionStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiDetectionStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'security software evasion', + 'hide executing code', + 'self-modification', + 'anti-memory forensics', + 'hide non-executing code', + 'hide malware artifacts', + ) + TERM_SECURITY_SOFTWARE_EVASION = 'security software evasion' + TERM_HIDE_EXECUTING_CODE = 'hide executing code' + TERM_SELF_MODIFICATION = 'self-modification' + TERM_ANTI_MEMORY_FORENSICS = 'anti-memory forensics' + TERM_HIDE_NON_EXECUTING_CODE = 'hide non-executing code' + TERM_HIDE_MALWARE_ARTIFACTS = 'hide malware artifacts' + + +class SocketActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SocketActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'accept socket connection', + 'bind address to socket', + 'create socket', + 'close socket', + 'connect to socket', + 'disconnect from socket', + 'listen on socket', + 'send data on socket', + 'receive data on socket', + 'send data to address on socket', + 'get host by address', + 'get host by name', + ) + TERM_CLOSE_SOCKET = 'close socket' + TERM_CONNECT_TO_SOCKET = 'connect to socket' + TERM_ACCEPT_SOCKET_CONNECTION = 'accept socket connection' + TERM_SEND_DATA_ON_SOCKET = 'send data on socket' + TERM_RECEIVE_DATA_ON_SOCKET = 'receive data on socket' + TERM_SEND_DATA_TO_ADDRESS_ON_SOCKET = 'send data to address on socket' + TERM_CREATE_SOCKET = 'create socket' + TERM_DISCONNECT_FROM_SOCKET = 'disconnect from socket' + TERM_GET_HOST_BY_ADDRESS = 'get host by address' + TERM_LISTEN_ON_SOCKET = 'listen on socket' + TERM_BIND_ADDRESS_TO_SOCKET = 'bind address to socket' + TERM_GET_HOST_BY_NAME = 'get host by name' + + +class CommandandControlTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:CommandandControlTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'check for payload', + 'validate data', + 'control malware via remote command', + 'send system information', + 'send heartbeat data', + 'generate c2 domain name(s)', + 'update configuration', + ) + TERM_CHECK_FOR_PAYLOAD = 'check for payload' + TERM_VALIDATE_DATA = 'validate data' + TERM_UPDATE_CONFIGURATION = 'update configuration' + TERM_SEND_SYSTEM_INFORMATION = 'send system information' + TERM_SEND_HEARTBEAT_DATA = 'send heartbeat data' + TERM_GENERATE_C2_DOMAIN_NAME_S = 'generate c2 domain name(s)' + TERM_CONTROL_MALWARE_VIA_REMOTE_COMMAND = 'control malware via remote command' + + +class HookingActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:HookingActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'add system call hook', + 'add windows hook', + 'hide hook', + ) + TERM_ADD_SYSTEM_CALL_HOOK = 'add system call hook' + TERM_HIDE_HOOK = 'hide hook' + TERM_ADD_WINDOWS_HOOK = 'add windows hook' + + +class GroupingRelationship(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:GroupingRelationshipVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'same malware family', + 'clustered together', + 'observed together', + 'part of intrusion set', + 'same malware toolkit', + ) + TERM_PART_OF_INTRUSION_SET = 'part of intrusion set' + TERM_CLUSTERED_TOGETHER = 'clustered together' + TERM_SAME_MALWARE_TOOLKIT = 'same malware toolkit' + TERM_SAME_MALWARE_FAMILY = 'same malware family' + TERM_OBSERVED_TOGETHER = 'observed together' + + +class PersistenceProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PersistencePropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'scope', + ) + TERM_SCOPE = 'scope' + + +class DestructionProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DestructionPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'erasure scope', + ) + TERM_ERASURE_SCOPE = 'erasure scope' + + +class AntiCodeAnalysisStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'anti-debugging', + 'code obfuscation', + 'anti-disassembly', + ) + TERM_ANTI_DEBUGGING = 'anti-debugging' + TERM_CODE_OBFUSCATION = 'code obfuscation' + TERM_ANTI_DISASSEMBLY = 'anti-disassembly' + + +class AvailabilityViolationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AvailabilityViolationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'compromise data availability', + 'compromise system availability', + 'consume system resources', + ) + TERM_CONSUME_SYSTEM_RESOURCES = 'consume system resources' + TERM_COMPROMISE_DATA_AVAILABILITY = 'compromise data availability' + TERM_COMPROMISE_SYSTEM_AVAILABILITY = 'compromise system availability' + + +class IPCActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:IPCActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create named pipe', + 'delete named pipe', + 'connect to named pipe', + 'disconnect from named pipe', + 'read from named pipe', + 'write to named pipe', + 'create mailslot', + 'read from mailslot', + 'write to mailslot', + ) + TERM_DISCONNECT_FROM_NAMED_PIPE = 'disconnect from named pipe' + TERM_READ_FROM_NAMED_PIPE = 'read from named pipe' + TERM_CREATE_MAILSLOT = 'create mailslot' + TERM_READ_FROM_MAILSLOT = 'read from mailslot' + TERM_CREATE_NAMED_PIPE = 'create named pipe' + TERM_DELETE_NAMED_PIPE = 'delete named pipe' + TERM_WRITE_TO_NAMED_PIPE = 'write to named pipe' + TERM_CONNECT_TO_NAMED_PIPE = 'connect to named pipe' + TERM_WRITE_TO_MAILSLOT = 'write to mailslot' + + +class DirectoryActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DirectoryActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'create directory', + 'delete directory', + 'monitor directory', + 'hide directory', + ) + TERM_MONITOR_DIRECTORY = 'monitor directory' + TERM_DELETE_DIRECTORY = 'delete directory' + TERM_CREATE_DIRECTORY = 'create directory' + TERM_HIDE_DIRECTORY = 'hide directory' + + +class NetworkShareActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:NetworkShareActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'add connection to network share', + 'add network share', + 'delete network share', + 'connect to network share', + 'disconnect from network share', + 'enumerate network shares', + ) + TERM_ENUMERATE_NETWORK_SHARES = 'enumerate network shares' + TERM_DISCONNECT_FROM_NETWORK_SHARE = 'disconnect from network share' + TERM_ADD_NETWORK_SHARE = 'add network share' + TERM_ADD_CONNECTION_TO_NETWORK_SHARE = 'add connection to network share' + TERM_DELETE_NETWORK_SHARE = 'delete network share' + TERM_CONNECT_TO_NETWORK_SHARE = 'connect to network share' + + +class InfectionPropagationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:InfectionPropagationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'scope', + 'infection targeting', + 'autonomy', + 'targeted file type', + 'targeted file architecture type', + 'file infection type', + ) + TERM_AUTONOMY = 'autonomy' + TERM_TARGETED_FILE_TYPE = 'targeted file type' + TERM_FILE_INFECTION_TYPE = 'file infection type' + TERM_INFECTION_TARGETING = 'infection targeting' + TERM_SCOPE = 'scope' + TERM_TARGETED_FILE_ARCHITECTURE_TYPE = 'targeted file architecture type' + + +class ProbingStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ProbingStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'probe host configuration', + 'probe network environment', + ) + TERM_PROBE_NETWORK_ENVIRONMENT = 'probe network environment' + TERM_PROBE_HOST_CONFIGURATION = 'probe host configuration' + + +class InfectionPropagationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:InfectionPropagationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'identify file', + 'perform autonomous remote infection', + 'identify target machine(s)', + 'perform social-engineering based remote infection', + 'inventory victims', + 'write code into file', + 'modify file', + ) + TERM_IDENTIFY_FILE = 'identify file' + TERM_PERFORM_AUTONOMOUS_REMOTE_INFECTION = 'perform autonomous remote infection' + TERM_IDENTIFY_TARGET_MACHINE_S = 'identify target machine(s)' + TERM_PERFORM_SOCIAL_ENGINEERING_BASED_REMOTE_INFECTION = 'perform social-engineering based remote infection' + TERM_INVENTORY_VICTIMS = 'inventory victims' + TERM_WRITE_CODE_INTO_FILE = 'write code into file' + TERM_MODIFY_FILE = 'modify file' + + +class DataExfiltrationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataExfiltrationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'archive type', + 'file type', + ) + TERM_ARCHIVE_TYPE = 'archive type' + TERM_FILE_TYPE = 'file type' + + +class LibraryActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:LibraryActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'enumerate libraries', + 'free library', + 'load library', + 'get function address', + 'call library function', + ) + TERM_GET_FUNCTION_ADDRESS = 'get function address' + TERM_LOAD_LIBRARY = 'load library' + TERM_CALL_LIBRARY_FUNCTION = 'call library function' + TERM_FREE_LIBRARY = 'free library' + TERM_ENUMERATE_LIBRARIES = 'enumerate libraries' + + +class MalwareDevelopmentTool(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareDevelopmentToolVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'builder', + 'compiler', + 'linker', + 'packer', + 'crypter', + 'protector', + ) + TERM_PACKER = 'packer' + TERM_BUILDER = 'builder' + TERM_LINKER = 'linker' + TERM_CRYPTER = 'crypter' + TERM_PROTECTOR = 'protector' + TERM_COMPILER = 'compiler' + + +class FileActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:FileActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'create file', + 'delete file', + 'copy file', + 'create file symbolic link', + 'find file', + 'get file attributes', + 'set file attributes', + 'lock file', + 'unlock file', + 'modify file', + 'move file', + 'open file', + 'read from file', + 'write to file', + 'rename file', + 'create file alternate data stream', + 'send control code to file', + 'create file mapping', + 'open file mapping', + 'execute file', + 'hide file', + 'close file', + ) + TERM_CREATE_FILE_MAPPING = 'create file mapping' + TERM_FIND_FILE = 'find file' + TERM_READ_FROM_FILE = 'read from file' + TERM_MOVE_FILE = 'move file' + TERM_CREATE_FILE_SYMBOLIC_LINK = 'create file symbolic link' + TERM_SEND_CONTROL_CODE_TO_FILE = 'send control code to file' + TERM_WRITE_TO_FILE = 'write to file' + TERM_EXECUTE_FILE = 'execute file' + TERM_CLOSE_FILE = 'close file' + TERM_COPY_FILE = 'copy file' + TERM_CREATE_FILE_ALTERNATE_DATA_STREAM = 'create file alternate data stream' + TERM_LOCK_FILE = 'lock file' + TERM_HIDE_FILE = 'hide file' + TERM_UNLOCK_FILE = 'unlock file' + TERM_GET_FILE_ATTRIBUTES = 'get file attributes' + TERM_RENAME_FILE = 'rename file' + TERM_OPEN_FILE_MAPPING = 'open file mapping' + TERM_DELETE_FILE = 'delete file' + TERM_SET_FILE_ATTRIBUTES = 'set file attributes' + TERM_OPEN_FILE = 'open file' + TERM_CREATE_FILE = 'create file' + TERM_MODIFY_FILE = 'modify file' + + +class CommandandControlProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:CommandandControlPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'frequency', + ) + TERM_FREQUENCY = 'frequency' + + +class IRCActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:IRCActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'connect to irc server', + 'disconnect from irc server', + 'set irc nickname', + 'join irc channel', + 'leave irc channel', + 'send irc private message', + 'receive irc private message', + ) + TERM_RECEIVE_IRC_PRIVATE_MESSAGE = 'receive irc private message' + TERM_JOIN_IRC_CHANNEL = 'join irc channel' + TERM_SEND_IRC_PRIVATE_MESSAGE = 'send irc private message' + TERM_LEAVE_IRC_CHANNEL = 'leave irc channel' + TERM_CONNECT_TO_IRC_SERVER = 'connect to irc server' + TERM_DISCONNECT_FROM_IRC_SERVER = 'disconnect from irc server' + TERM_SET_IRC_NICKNAME = 'set irc nickname' + + +class InfectionPropagationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:InfectionPropagationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'prevent duplicate infection', + 'infect file', + 'infect remote machine', + ) + TERM_INFECT_FILE = 'infect file' + TERM_PREVENT_DUPLICATE_INFECTION = 'prevent duplicate infection' + TERM_INFECT_REMOTE_MACHINE = 'infect remote machine' + + +class MalwareCapability(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareCapabilityVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'command and control', + 'remote machine manipulation', + 'privilege escalation', + 'data theft', + 'spying', + 'secondary operation', + 'anti-detection', + 'anti-code analysis', + 'infection/propagation', + 'anti-behavioral analysis', + 'integrity violation', + 'data exfiltration', + 'probing', + 'anti-removal', + 'security degradation', + 'availability violation', + 'destruction', + 'fraud', + 'persistence', + 'machine access/control', + ) + TERM_COMMAND_AND_CONTROL = 'command and control' + TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' + TERM_INFECTION_PROPAGATION = 'infection/propagation' + TERM_SPYING = 'spying' + TERM_SECONDARY_OPERATION = 'secondary operation' + TERM_ANTI_DETECTION = 'anti-detection' + TERM_ANTI_BEHAVIORAL_ANALYSIS = 'anti-behavioral analysis' + TERM_MACHINE_ACCESS_CONTROL = 'machine access/control' + TERM_DATA_THEFT = 'data theft' + TERM_ANTI_CODE_ANALYSIS = 'anti-code analysis' + TERM_INTEGRITY_VIOLATION = 'integrity violation' + TERM_DATA_EXFILTRATION = 'data exfiltration' + TERM_SECURITY_DEGRADATION = 'security degradation' + TERM_ANTI_REMOVAL = 'anti-removal' + TERM_PRIVILEGE_ESCALATION = 'privilege escalation' + TERM_AVAILABILITY_VIOLATION = 'availability violation' + TERM_FRAUD = 'fraud' + TERM_PROBING = 'probing' + TERM_PERSISTENCE = 'persistence' + TERM_DESTRUCTION = 'destruction' + + +class AntiBehavioralAnalysisProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'targeted vm', + 'targeted sandbox', + ) + TERM_TARGETED_VM = 'targeted vm' + TERM_TARGETED_SANDBOX = 'targeted sandbox' + + +class DNSActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DNSActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'send dns query', + 'send reverse dns lookup', + ) + TERM_SEND_DNS_QUERY = 'send dns query' + TERM_SEND_REVERSE_DNS_LOOKUP = 'send reverse dns lookup' + + +class RemoteMachineManipulationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'access remote machine', + 'search for remote machines', + ) + TERM_ACCESS_REMOTE_MACHINE = 'access remote machine' + TERM_SEARCH_FOR_REMOTE_MACHINES = 'search for remote machines' + + +class ProcessActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ProcessActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create process', + 'kill process', + 'create process as user', + 'enumerate processes', + 'open process', + 'flush process instruction cache', + 'get process current directory', + 'set process current directory', + 'get process environment variable', + 'set process environment variable', + 'sleep process', + 'get process startupinfo', + ) + TERM_GET_PROCESS_CURRENT_DIRECTORY = 'get process current directory' + TERM_SET_PROCESS_ENVIRONMENT_VARIABLE = 'set process environment variable' + TERM_ENUMERATE_PROCESSES = 'enumerate processes' + TERM_SET_PROCESS_CURRENT_DIRECTORY = 'set process current directory' + TERM_GET_PROCESS_ENVIRONMENT_VARIABLE = 'get process environment variable' + TERM_SLEEP_PROCESS = 'sleep process' + TERM_FLUSH_PROCESS_INSTRUCTION_CACHE = 'flush process instruction cache' + TERM_KILL_PROCESS = 'kill process' + TERM_CREATE_PROCESS = 'create process' + TERM_GET_PROCESS_STARTUPINFO = 'get process startupinfo' + TERM_CREATE_PROCESS_AS_USER = 'create process as user' + TERM_OPEN_PROCESS = 'open process' + + +class PersistenceStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PersistenceStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'persist to re-infect system', + 'gather information for improvement', + 'ensure compatibility', + 'persist to continuously execute on system', + ) + TERM_PERSIST_TO_RE_INFECT_SYSTEM = 'persist to re-infect system' + TERM_GATHER_INFORMATION_FOR_IMPROVEMENT = 'gather information for improvement' + TERM_ENSURE_COMPATIBILITY = 'ensure compatibility' + TERM_PERSIST_TO_CONTINUOUSLY_EXECUTE_ON_SYSTEM = 'persist to continuously execute on system' + + +class NetworkActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:NetworkActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'open port', + 'close port', + 'connect to ip', + 'disconnect from ip', + 'connect to url', + 'connect to socket address', + 'download file', + 'upload file', + 'listen on port', + 'send email message', + 'send icmp request', + 'send network packet', + 'receive network packet', + ) + TERM_SEND_EMAIL_MESSAGE = 'send email message' + TERM_SEND_NETWORK_PACKET = 'send network packet' + TERM_DISCONNECT_FROM_IP = 'disconnect from ip' + TERM_CONNECT_TO_IP = 'connect to ip' + TERM_CLOSE_PORT = 'close port' + TERM_DOWNLOAD_FILE = 'download file' + TERM_SEND_ICMP_REQUEST = 'send icmp request' + TERM_CONNECT_TO_URL = 'connect to url' + TERM_CONNECT_TO_SOCKET_ADDRESS = 'connect to socket address' + TERM_OPEN_PORT = 'open port' + TERM_UPLOAD_FILE = 'upload file' + TERM_LISTEN_ON_PORT = 'listen on port' + TERM_RECEIVE_NETWORK_PACKET = 'receive network packet' + + +class SecondaryOperationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecondaryOperationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'patch operating system file(s)', + 'remove traces of infection', + 'log activity', + 'lay dormant', + 'install other components', + 'suicide exit', + ) + TERM_PATCH_OPERATING_SYSTEM_FILE_S = 'patch operating system file(s)' + TERM_REMOVE_TRACES_OF_INFECTION = 'remove traces of infection' + TERM_LAY_DORMANT = 'lay dormant' + TERM_INSTALL_OTHER_COMPONENTS = 'install other components' + TERM_SUICIDE_EXIT = 'suicide exit' + TERM_LOG_ACTIVITY = 'log activity' + + +class FraudTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:FraudTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'access premium service', + ) + TERM_ACCESS_PREMIUM_SERVICE = 'access premium service' + + +class ProcessMemoryActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ProcessMemoryActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'allocate process virtual memory', + 'free process virtual memory', + 'modify process virtual memory protection', + 'read from process memory', + 'write to process memory', + 'map file into process', + 'unmap file from process', + 'map library into process', + ) + TERM_UNMAP_FILE_FROM_PROCESS = 'unmap file from process' + TERM_MODIFY_PROCESS_VIRTUAL_MEMORY_PROTECTION = 'modify process virtual memory protection' + TERM_WRITE_TO_PROCESS_MEMORY = 'write to process memory' + TERM_READ_FROM_PROCESS_MEMORY = 'read from process memory' + TERM_ALLOCATE_PROCESS_VIRTUAL_MEMORY = 'allocate process virtual memory' + TERM_MAP_LIBRARY_INTO_PROCESS = 'map library into process' + TERM_FREE_PROCESS_VIRTUAL_MEMORY = 'free process virtual memory' + TERM_MAP_FILE_INTO_PROCESS = 'map file into process' + + +class RegistryActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:RegistryActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create registry key', + 'delete registry key', + 'open registry key', + 'close registry key', + 'create registry key value', + 'delete registry key value', + 'enumerate registry key subkeys', + 'enumerate registry key values', + 'get registry key attributes', + 'read registry key value', + 'modify registry key value', + 'modify registry key', + 'monitor registry key', + ) + TERM_MODIFY_REGISTRY_KEY = 'modify registry key' + TERM_MONITOR_REGISTRY_KEY = 'monitor registry key' + TERM_CLOSE_REGISTRY_KEY = 'close registry key' + TERM_DELETE_REGISTRY_KEY = 'delete registry key' + TERM_OPEN_REGISTRY_KEY = 'open registry key' + TERM_ENUMERATE_REGISTRY_KEY_SUBKEYS = 'enumerate registry key subkeys' + TERM_ENUMERATE_REGISTRY_KEY_VALUES = 'enumerate registry key values' + TERM_READ_REGISTRY_KEY_VALUE = 'read registry key value' + TERM_GET_REGISTRY_KEY_ATTRIBUTES = 'get registry key attributes' + TERM_CREATE_REGISTRY_KEY_VALUE = 'create registry key value' + TERM_CREATE_REGISTRY_KEY = 'create registry key' + TERM_MODIFY_REGISTRY_KEY_VALUE = 'modify registry key value' + TERM_DELETE_REGISTRY_KEY_VALUE = 'delete registry key value' + + +class AvailabilityViolationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AvailabilityViolationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'cryptocurrency type', + ) + TERM_CRYPTOCURRENCY_TYPE = 'cryptocurrency type' + + +class CommandandControlStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:CommandandControlStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'determine c2 server', + 'receive data from c2 server', + 'send data to c2 server', + ) + TERM_DETERMINE_C2_SERVER = 'determine c2 server' + TERM_RECEIVE_DATA_FROM_C2_SERVER = 'receive data from c2 server' + TERM_SEND_DATA_TO_C2_SERVER = 'send data to c2 server' + + +class DestructionTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DestructionTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'erase data', + 'destroy firmware', + 'destroy hardware', + ) + TERM_ERASE_DATA = 'erase data' + TERM_DESTROY_FIRMWARE = 'destroy firmware' + TERM_DESTROY_HARDWARE = 'destroy hardware' + + +class SpyingStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SpyingStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'capture system input peripheral data', + 'capture system state data', + 'capture system interface data', + 'capture system output peripheral data', + ) + TERM_CAPTURE_SYSTEM_INPUT_PERIPHERAL_DATA = 'capture system input peripheral data' + TERM_CAPTURE_SYSTEM_INTERFACE_DATA = 'capture system interface data' + TERM_CAPTURE_SYSTEM_OUTPUT_PERIPHERAL_DATA = 'capture system output peripheral data' + TERM_CAPTURE_SYSTEM_STATE_DATA = 'capture system state data' + + +class FTPActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:FTPActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'connect to ftp server', + 'disconnect from ftp server', + 'send ftp command', + ) + TERM_CONNECT_TO_FTP_SERVER = 'connect to ftp server' + TERM_SEND_FTP_COMMAND = 'send ftp command' + TERM_DISCONNECT_FROM_FTP_SERVER = 'disconnect from ftp server' + + +class MachineAccessControlStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MachineAccessControlStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'control local machine', + 'install backdoor', + ) + TERM_CONTROL_LOCAL_MACHINE = 'control local machine' + TERM_INSTALL_BACKDOOR = 'install backdoor' + + +class IntegrityViolationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:IntegrityViolationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'compromise system operational integrity', + 'compromise user data integrity', + 'annoy user', + 'compromise network operational integrity', + 'compromise system data integrity', + ) + TERM_COMPROMISE_SYSTEM_DATA_INTEGRITY = 'compromise system data integrity' + TERM_ANNOY_USER = 'annoy user' + TERM_COMPROMISE_NETWORK_OPERATIONAL_INTEGRITY = 'compromise network operational integrity' + TERM_COMPROMISE_USER_DATA_INTEGRITY = 'compromise user data integrity' + TERM_COMPROMISE_SYSTEM_OPERATIONAL_INTEGRITY = 'compromise system operational integrity' + + +class ProbingTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ProbingTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'identify os', + 'check for proxy', + 'check for firewall', + 'check for network drives', + 'map local network', + 'inventory system applications', + 'check language', + 'check for internet connectivity', + ) + TERM_IDENTIFY_OS = 'identify os' + TERM_CHECK_FOR_PROXY = 'check for proxy' + TERM_INVENTORY_SYSTEM_APPLICATIONS = 'inventory system applications' + TERM_CHECK_FOR_NETWORK_DRIVES = 'check for network drives' + TERM_MAP_LOCAL_NETWORK = 'map local network' + TERM_CHECK_FOR_FIREWALL = 'check for firewall' + TERM_CHECK_LANGUAGE = 'check language' + TERM_CHECK_FOR_INTERNET_CONNECTIVITY = 'check for internet connectivity' + + +class MalwareEntityType(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareEntityTypeVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'instance', + 'family', + 'class', + ) + TERM_INSTANCE = 'instance' + TERM_CLASS = 'class' + TERM_FAMILY = 'family' + + +class FraudStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:FraudStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'perform premium rate fraud', + 'perform click fraud', + ) + TERM_PERFORM_CLICK_FRAUD = 'perform click fraud' + TERM_PERFORM_PREMIUM_RATE_FRAUD = 'perform premium rate fraud' + + +class SpyingTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SpyingTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'capture system screenshot', + 'capture camera input', + 'capture file system', + 'capture printer output', + 'capture gps data', + 'capture keyboard input', + 'capture mouse input', + 'capture microphone input', + 'capture system network traffic', + 'capture touchscreen input', + 'capture system memory', + ) + TERM_CAPTURE_SYSTEM_SCREENSHOT = 'capture system screenshot' + TERM_CAPTURE_KEYBOARD_INPUT = 'capture keyboard input' + TERM_CAPTURE_FILE_SYSTEM = 'capture file system' + TERM_CAPTURE_CAMERA_INPUT = 'capture camera input' + TERM_CAPTURE_GPS_DATA = 'capture gps data' + TERM_CAPTURE_PRINTER_OUTPUT = 'capture printer output' + TERM_CAPTURE_MOUSE_INPUT = 'capture mouse input' + TERM_CAPTURE_MICROPHONE_INPUT = 'capture microphone input' + TERM_CAPTURE_SYSTEM_NETWORK_TRAFFIC = 'capture system network traffic' + TERM_CAPTURE_TOUCHSCREEN_INPUT = 'capture touchscreen input' + TERM_CAPTURE_SYSTEM_MEMORY = 'capture system memory' + + +class ProcessThreadActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ProcessThreadActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create thread', + 'kill thread', + 'create remote thread in process', + 'enumerate threads', + 'get thread username', + 'impersonate process', + 'revert thread to self', + 'get thread context', + 'set thread context', + 'queue apc in thread', + ) + TERM_CREATE_THREAD = 'create thread' + TERM_SET_THREAD_CONTEXT = 'set thread context' + TERM_ENUMERATE_THREADS = 'enumerate threads' + TERM_QUEUE_APC_IN_THREAD = 'queue apc in thread' + TERM_GET_THREAD_USERNAME = 'get thread username' + TERM_REVERT_THREAD_TO_SELF = 'revert thread to self' + TERM_CREATE_REMOTE_THREAD_IN_PROCESS = 'create remote thread in process' + TERM_GET_THREAD_CONTEXT = 'get thread context' + TERM_KILL_THREAD = 'kill thread' + TERM_IMPERSONATE_PROCESS = 'impersonate process' + + +class DataTheftStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataTheftStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'steal stored information', + 'steal user data', + 'steal system information', + 'steal authentication credentials', + ) + TERM_STEAL_STORED_INFORMATION = 'steal stored information' + TERM_STEAL_USER_DATA = 'steal user data' + TERM_STEAL_SYSTEM_INFORMATION = 'steal system information' + TERM_STEAL_AUTHENTICATION_CREDENTIALS = 'steal authentication credentials' + + +class AntiCodeAnalysisTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'transform control flow', + 'restructure arrays', + 'detect debugging', + 'prevent debugging', + 'defeat flow-oriented (recursive traversal) disassembler', + 'defeat linear disassembler', + 'obfuscate instructions', + 'obfuscate imports', + 'defeat call graph generation', + 'obfuscate runtime code', + ) + TERM_DEFEAT_CALL_GRAPH_GENERATION = 'defeat call graph generation' + TERM_RESTRUCTURE_ARRAYS = 'restructure arrays' + TERM_DETECT_DEBUGGING = 'detect debugging' + TERM_PREVENT_DEBUGGING = 'prevent debugging' + TERM_DEFEAT_FLOW_ORIENTED_RECURSIVE_TRAVERSAL_DISASSEMBLER = 'defeat flow-oriented (recursive traversal) disassembler' + TERM_DEFEAT_LINEAR_DISASSEMBLER = 'defeat linear disassembler' + TERM_OBFUSCATE_INSTRUCTIONS = 'obfuscate instructions' + TERM_OBFUSCATE_IMPORTS = 'obfuscate imports' + TERM_TRANSFORM_CONTROL_FLOW = 'transform control flow' + TERM_OBFUSCATE_RUNTIME_CODE = 'obfuscate runtime code' + + +class PrivilegeEscalationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PrivilegeEscalationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'elevate cpu mode', + ) + TERM_ELEVATE_CPU_MODE = 'elevate cpu mode' + + +class MalwareSubjectRelationship(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareSubjectRelationshipVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'downloads', + 'downloaded by', + 'drops', + 'dropped by', + 'extracts', + 'extracted from', + 'direct descendant of', + 'direct ancestor of', + 'memory image of', + 'contained in memory image', + 'disk image of', + 'contained in disk image', + 'network traffic capture of', + 'contained in network traffic capture', + 'packed version of', + 'unpacked version of', + 'installs', + 'installed by', + '64-bit version of', + '32-bit version of', + 'encrypted version of', + 'decrypted version of', + ) + TERM_NETWORK_TRAFFIC_CAPTURE_OF = 'network traffic capture of' + TERM_64_BIT_VERSION_OF = '64-bit version of' + TERM_DROPPED_BY = 'dropped by' + TERM_MEMORY_IMAGE_OF = 'memory image of' + TERM_32_BIT_VERSION_OF = '32-bit version of' + TERM_INSTALLED_BY = 'installed by' + TERM_DIRECT_DESCENDANT_OF = 'direct descendant of' + TERM_DIRECT_ANCESTOR_OF = 'direct ancestor of' + TERM_DROPS = 'drops' + TERM_DOWNLOADS = 'downloads' + TERM_ENCRYPTED_VERSION_OF = 'encrypted version of' + TERM_EXTRACTED_FROM = 'extracted from' + TERM_DISK_IMAGE_OF = 'disk image of' + TERM_PACKED_VERSION_OF = 'packed version of' + TERM_CONTAINED_IN_MEMORY_IMAGE = 'contained in memory image' + TERM_UNPACKED_VERSION_OF = 'unpacked version of' + TERM_CONTAINED_IN_NETWORK_TRAFFIC_CAPTURE = 'contained in network traffic capture' + TERM_INSTALLS = 'installs' + TERM_EXTRACTS = 'extracts' + TERM_DOWNLOADED_BY = 'downloaded by' + TERM_CONTAINED_IN_DISK_IMAGE = 'contained in disk image' + TERM_DECRYPTED_VERSION_OF = 'decrypted version of' + + +class AntiBehavioralAnalysisTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'detect vm environment', + 'overload sandbox', + 'prevent execution in sandbox', + 'detect sandbox environment', + 'prevent execution in vm', + ) + TERM_DETECT_VM_ENVIRONMENT = 'detect vm environment' + TERM_OVERLOAD_SANDBOX = 'overload sandbox' + TERM_PREVENT_EXECUTION_IN_SANDBOX = 'prevent execution in sandbox' + TERM_DETECT_SANDBOX_ENVIRONMENT = 'detect sandbox environment' + TERM_PREVENT_EXECUTION_IN_VM = 'prevent execution in vm' + + +class PersistenceTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PersistenceTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'reinstantiate self after initial detection', + 'limit application type/version', + 'persist after os install/reinstall', + 'drop/retrieve debug log file', + 'persist independent of hard disk/os changes', + 'persist after system reboot', + ) + TERM_REINSTANTIATE_SELF_AFTER_INITIAL_DETECTION = 'reinstantiate self after initial detection' + TERM_LIMIT_APPLICATION_TYPE_VERSION = 'limit application type/version' + TERM_PERSIST_AFTER_OS_INSTALL_REINSTALL = 'persist after os install/reinstall' + TERM_DROP_RETRIEVE_DEBUG_LOG_FILE = 'drop/retrieve debug log file' + TERM_PERSIST_INDEPENDENT_OF_HARD_DISK_OS_CHANGES = 'persist independent of hard disk/os changes' + TERM_PERSIST_AFTER_SYSTEM_REBOOT = 'persist after system reboot' + + +class SynchronizationActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SynchronizationActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create mutex', + 'delete mutex', + 'open mutex', + 'release mutex', + 'create semaphore', + 'delete semaphore', + 'open semaphore', + 'release semaphore', + 'create event', + 'delete event', + 'open event', + 'reset event', + 'create critical section', + 'delete critical section', + 'open critical section', + 'release critical section', + ) + TERM_CREATE_EVENT = 'create event' + TERM_CREATE_MUTEX = 'create mutex' + TERM_OPEN_MUTEX = 'open mutex' + TERM_DELETE_MUTEX = 'delete mutex' + TERM_OPEN_SEMAPHORE = 'open semaphore' + TERM_OPEN_EVENT = 'open event' + TERM_RELEASE_MUTEX = 'release mutex' + TERM_DELETE_CRITICAL_SECTION = 'delete critical section' + TERM_CREATE_CRITICAL_SECTION = 'create critical section' + TERM_RELEASE_SEMAPHORE = 'release semaphore' + TERM_DELETE_EVENT = 'delete event' + TERM_RESET_EVENT = 'reset event' + TERM_RELEASE_CRITICAL_SECTION = 'release critical section' + TERM_CREATE_SEMAPHORE = 'create semaphore' + TERM_DELETE_SEMAPHORE = 'delete semaphore' + TERM_OPEN_CRITICAL_SECTION = 'open critical section' + + +class AntiRemovalTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiRemovalTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'prevent registry deletion', + 'prevent api unhooking', + 'prevent file access', + 'prevent memory access', + 'prevent registry access', + 'prevent file deletion', + ) + TERM_PREVENT_REGISTRY_DELETION = 'prevent registry deletion' + TERM_PREVENT_API_UNHOOKING = 'prevent api unhooking' + TERM_PREVENT_FILE_ACCESS = 'prevent file access' + TERM_PREVENT_MEMORY_ACCESS = 'prevent memory access' + TERM_PREVENT_REGISTRY_ACCESS = 'prevent registry access' + TERM_PREVENT_FILE_DELETION = 'prevent file deletion' + + +class SecurityDegradationStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecurityDegradationStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'disable service provider security features', + 'degrade security programs', + 'disable system updates', + 'disable os security features', + 'disable [host-based or os] access controls', + ) + TERM_DISABLE_SERVICE_PROVIDER_SECURITY_FEATURES = 'disable service provider security features' + TERM_DEGRADE_SECURITY_PROGRAMS = 'degrade security programs' + TERM_DISABLE_SYSTEM_UPDATES = 'disable system updates' + TERM_DISABLE_OS_SECURITY_FEATURES = 'disable os security features' + TERM_DISABLE_[HOST_BASED_OR_OS]_ACCESS_CONTROLS = 'disable [host-based or os] access controls' + + +class PrivilegeEscalationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:PrivilegeEscalationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'user privilege escalation type', + ) + TERM_USER_PRIVILEGE_ESCALATION_TYPE = 'user privilege escalation type' + + +class GUIActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:GUIActionNameVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'create window', + 'kill window', + 'create dialog box', + 'enumerate windows', + 'find window', + 'hide window', + 'show window', + ) + TERM_FIND_WINDOW = 'find window' + TERM_SHOW_WINDOW = 'show window' + TERM_KILL_WINDOW = 'kill window' + TERM_ENUMERATE_WINDOWS = 'enumerate windows' + TERM_CREATE_WINDOW = 'create window' + TERM_CREATE_DIALOG_BOX = 'create dialog box' + TERM_HIDE_WINDOW = 'hide window' + + +class SecurityDegradationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecurityDegradationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'stop execution of security program', + 'disable firewall', + 'disable access right checking', + 'disable kernel patching protection', + 'prevent access to security websites', + 'remove sms warning messages', + 'modify security program configuration', + 'prevent security program from running', + 'disable system update services/daemons', + 'disable system service pack/patch installation', + 'disable system file overwrite protection', + 'disable privilege limiting', + 'gather security product info', + 'disable os security alerts', + 'disable user account control', + ) + TERM_STOP_EXECUTION_OF_SECURITY_PROGRAM = 'stop execution of security program' + TERM_DISABLE_FIREWALL = 'disable firewall' + TERM_DISABLE_ACCESS_RIGHT_CHECKING = 'disable access right checking' + TERM_DISABLE_KERNEL_PATCHING_PROTECTION = 'disable kernel patching protection' + TERM_PREVENT_SECURITY_PROGRAM_FROM_RUNNING = 'prevent security program from running' + TERM_REMOVE_SMS_WARNING_MESSAGES = 'remove sms warning messages' + TERM_MODIFY_SECURITY_PROGRAM_CONFIGURATION = 'modify security program configuration' + TERM_PREVENT_ACCESS_TO_SECURITY_WEBSITES = 'prevent access to security websites' + TERM_DISABLE_SYSTEM_UPDATE_SERVICES_DAEMONS = 'disable system update services/daemons' + TERM_DISABLE_SYSTEM_SERVICE_PACK_PATCH_INSTALLATION = 'disable system service pack/patch installation' + TERM_DISABLE_SYSTEM_FILE_OVERWRITE_PROTECTION = 'disable system file overwrite protection' + TERM_DISABLE_PRIVILEGE_LIMITING = 'disable privilege limiting' + TERM_GATHER_SECURITY_PRODUCT_INFO = 'gather security product info' + TERM_DISABLE_OS_SECURITY_ALERTS = 'disable os security alerts' + TERM_DISABLE_USER_ACCOUNT_CONTROL = 'disable user account control' + + +class MalwareConfigurationParameter(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareConfigurationParameterVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'magic number', + 'id', + 'group id', + 'mutex', + 'filename', + 'installation path', + ) + TERM_MAGIC_NUMBER = 'magic number' + TERM_GROUP_ID = 'group id' + TERM_FILENAME = 'filename' + TERM_MUTEX = 'mutex' + TERM_INSTALLATION_PATH = 'installation path' + TERM_ID = 'id' + + +class MachineAccessControlProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MachineAccessControlPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'backdoor type', + ) + TERM_BACKDOOR_TYPE = 'backdoor type' + + +class ServiceActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:ServiceActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'create service', + 'delete service', + 'start service', + 'stop service', + 'enumerate services', + 'modify service configuration', + 'open service', + 'send control code to service', + ) + TERM_SEND_CONTROL_CODE_TO_SERVICE = 'send control code to service' + TERM_MODIFY_SERVICE_CONFIGURATION = 'modify service configuration' + TERM_CREATE_SERVICE = 'create service' + TERM_START_SERVICE = 'start service' + TERM_ENUMERATE_SERVICES = 'enumerate services' + TERM_STOP_SERVICE = 'stop service' + TERM_DELETE_SERVICE = 'delete service' + TERM_OPEN_SERVICE = 'open service' + + +class AntiBehavioralAnalysisStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'anti-vm', + 'anti-sandbox', + ) + TERM_ANTI_VM = 'anti-vm' + TERM_ANTI_SANDBOX = 'anti-sandbox' + + +class CapabilityObjectiveRelationship(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:CapabilityObjectiveRelationshipVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'child of', + 'parent of', + 'incorporates', + 'incorporated by', + ) + TERM_CHILD_OF = 'child of' + TERM_PARENT_OF = 'parent of' + TERM_INCORPORATED_BY = 'incorporated by' + TERM_INCORPORATES = 'incorporates' + + +class DataExfiltrationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DataExfiltrationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'exfiltrate via covert channel', + 'exfiltrate via fax', + 'exfiltrate via physical media', + 'encrypt data', + 'exfiltrate via network', + 'hide data', + 'package data', + 'exfiltrate via dumpster dive', + 'move data to staging server', + 'exfiltrate via voip/phone', + ) + TERM_EXFILTRATE_VIA_COVERT_CHANNEL = 'exfiltrate via covert channel' + TERM_EXFILTRATE_VIA_FAX = 'exfiltrate via fax' + TERM_EXFILTRATE_VIA_PHYSICAL_MEDIA = 'exfiltrate via physical media' + TERM_ENCRYPT_DATA = 'encrypt data' + TERM_EXFILTRATE_VIA_NETWORK = 'exfiltrate via network' + TERM_HIDE_DATA = 'hide data' + TERM_PACKAGE_DATA = 'package data' + TERM_EXFILTRATE_VIA_DUMPSTER_DIVE = 'exfiltrate via dumpster dive' + TERM_MOVE_DATA_TO_STAGING_SERVER = 'move data to staging server' + TERM_EXFILTRATE_VIA_VOIP_PHONE = 'exfiltrate via voip/phone' + + +class UserActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:UserActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'add user', + 'delete user', + 'enumerate users', + 'get user attributes', + 'logon as user', + 'change password', + 'add user to group', + 'remove user from group', + 'invoke user privilege', + ) + TERM_DELETE_USER = 'delete user' + TERM_CHANGE_PASSWORD = 'change password' + TERM_LOGON_AS_USER = 'logon as user' + TERM_ENUMERATE_USERS = 'enumerate users' + TERM_REMOVE_USER_FROM_GROUP = 'remove user from group' + TERM_ADD_USER_TO_GROUP = 'add user to group' + TERM_ADD_USER = 'add user' + TERM_INVOKE_USER_PRIVILEGE = 'invoke user privilege' + TERM_GET_USER_ATTRIBUTES = 'get user attributes' + + +class DestructionStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DestructionStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'destroy physical entity', + 'destroy virtual entity', + ) + TERM_DESTROY_PHYSICAL_ENTITY = 'destroy physical entity' + TERM_DESTROY_VIRTUAL_ENTITY = 'destroy virtual entity' + + +class AntiRemovalStrategicObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiRemovalStrategicObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'prevent malware artifact access', + 'prevent malware artifact deletion', + ) + TERM_PREVENT_MALWARE_ARTIFACT_ACCESS = 'prevent malware artifact access' + TERM_PREVENT_MALWARE_ARTIFACT_DELETION = 'prevent malware artifact deletion' + + +class SecondaryOperationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecondaryOperationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'install secondary module', + 'install secondary malware', + 'install legitimate software', + 'remove self', + 'remove system artifacts', + ) + TERM_INSTALL_SECONDARY_MODULE = 'install secondary module' + TERM_INSTALL_SECONDARY_MALWARE = 'install secondary malware' + TERM_INSTALL_LEGITIMATE_SOFTWARE = 'install legitimate software' + TERM_REMOVE_SELF = 'remove self' + TERM_REMOVE_SYSTEM_ARTIFACTS = 'remove system artifacts' + + +class MalwareLabel(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:MalwareLabelVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'adware', + 'appender', + 'backdoor', + 'boot sector virus', + 'bot', + 'clicker', + 'companion virus', + 'cavity filler', + 'data diddler', + 'downloader', + 'dropper file', + 'file infector virus', + 'fork bomb', + 'greyware', + 'implant', + 'infector', + 'keylogger', + 'kleptographic worm', + 'macro virus', + 'malcode', + 'mass-mailer', + 'metamorphic virus', + 'mid-infector', + 'mobile code', + 'multipartite virus', + 'password stealer', + 'polymorphic virus', + 'premium dialer/smser', + 'prepender', + 'ransomware', + 'rat', + 'rogue anti-malware', + 'rootkit', + 'shellcode', + 'spaghetti packer', + 'spyware', + 'trojan horse', + 'variant', + 'virus', + 'wabbit', + 'web bug', + 'wiper', + 'worm', + 'zip bomb', + ) + TERM_DATA_DIDDLER = 'data diddler' + TERM_PASSWORD_STEALER = 'password stealer' + TERM_ADWARE = 'adware' + TERM_WABBIT = 'wabbit' + TERM_RANSOMWARE = 'ransomware' + TERM_PREPENDER = 'prepender' + TERM_MOBILE_CODE = 'mobile code' + TERM_SPYWARE = 'spyware' + TERM_WEB_BUG = 'web bug' + TERM_RAT = 'rat' + TERM_ROOTKIT = 'rootkit' + TERM_COMPANION_VIRUS = 'companion virus' + TERM_MACRO_VIRUS = 'macro virus' + TERM_MALCODE = 'malcode' + TERM_SHELLCODE = 'shellcode' + TERM_ROGUE_ANTI_MALWARE = 'rogue anti-malware' + TERM_FORK_BOMB = 'fork bomb' + TERM_PREMIUM_DIALER_SMSER = 'premium dialer/smser' + TERM_SPAGHETTI_PACKER = 'spaghetti packer' + TERM_METAMORPHIC_VIRUS = 'metamorphic virus' + TERM_POLYMORPHIC_VIRUS = 'polymorphic virus' + TERM_BACKDOOR = 'backdoor' + TERM_CLICKER = 'clicker' + TERM_IMPLANT = 'implant' + TERM_INFECTOR = 'infector' + TERM_APPENDER = 'appender' + TERM_BOOT_SECTOR_VIRUS = 'boot sector virus' + TERM_MULTIPARTITE_VIRUS = 'multipartite virus' + TERM_DOWNLOADER = 'downloader' + TERM_VARIANT = 'variant' + TERM_KEYLOGGER = 'keylogger' + TERM_CAVITY_FILLER = 'cavity filler' + TERM_VIRUS = 'virus' + TERM_MASS_MAILER = 'mass-mailer' + TERM_GREYWARE = 'greyware' + TERM_MID_INFECTOR = 'mid-infector' + TERM_KLEPTOGRAPHIC_WORM = 'kleptographic worm' + TERM_WIPER = 'wiper' + TERM_DROPPER_FILE = 'dropper file' + TERM_ZIP_BOMB = 'zip bomb' + TERM_BOT = 'bot' + TERM_WORM = 'worm' + TERM_FILE_INFECTOR_VIRUS = 'file infector virus' + TERM_TROJAN_HORSE = 'trojan horse' + + +class SecurityDegradationProperties(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:SecurityDegradationPropertiesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'targeted program', + ) + TERM_TARGETED_PROGRAM = 'targeted program' + + +class DiskActionName(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:DiskActionNameVocab-1.1' + _VOCAB_VERSION = '1.1' + _ALLOWED_VALUES = ( + 'get disk type', + 'get disk attributes', + 'mount disk', + 'unmount disk', + 'emulate disk', + 'list disks', + 'monitor disk', + ) + TERM_GET_DISK_ATTRIBUTES = 'get disk attributes' + TERM_GET_DISK_TYPE = 'get disk type' + TERM_MONITOR_DISK = 'monitor disk' + TERM_MOUNT_DISK = 'mount disk' + TERM_LIST_DISKS = 'list disks' + TERM_EMULATE_DISK = 'emulate disk' + TERM_UNMOUNT_DISK = 'unmount disk' + + +class IntegrityViolationTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:IntegrityViolationTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'subvert system', + 'corrupt system data', + 'annoy local system user', + 'intercept/manipulate network traffic', + 'annoy remote user', + 'corrupt user data', + ) + TERM_SUBVERT_SYSTEM = 'subvert system' + TERM_CORRUPT_SYSTEM_DATA = 'corrupt system data' + TERM_ANNOY_LOCAL_SYSTEM_USER = 'annoy local system user' + TERM_INTERCEPT_MANIPULATE_NETWORK_TRAFFIC = 'intercept/manipulate network traffic' + TERM_ANNOY_REMOTE_USER = 'annoy remote user' + TERM_CORRUPT_USER_DATA = 'corrupt user data' + + +class AntiDetectionTacticalObjectives(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' + _XSI_TYPE = 'maecVocabs:AntiDetectionTacticalObjectivesVocab-1.0' + _VOCAB_VERSION = '1.0' + _ALLOWED_VALUES = ( + 'hide open network ports', + 'execute before/external to kernel/hypervisor', + 'encrypt self', + 'hide processes', + 'hide network traffic', + 'change/add content', + 'execute stealthy code', + 'hide registry artifacts', + 'hide userspace libraries', + 'hide arbitrary virtual memory', + 'execute non-main cpu code', + 'feed misinformation during physical memory acquisition', + 'prevent physical memory acquisition', + 'prevent native api hooking', + 'obfuscate artifact properties', + 'hide kernel modules', + 'hide code in file', + 'hide services', + 'hide file system artifacts', + 'hide threads', + ) + TERM_HIDE_FILE_SYSTEM_ARTIFACTS = 'hide file system artifacts' + TERM_HIDE_OPEN_NETWORK_PORTS = 'hide open network ports' + TERM_EXECUTE_BEFORE_EXTERNAL_TO_KERNEL_HYPERVISOR = 'execute before/external to kernel/hypervisor' + TERM_HIDE_KERNEL_MODULES = 'hide kernel modules' + TERM_HIDE_PROCESSES = 'hide processes' + TERM_CHANGE_ADD_CONTENT = 'change/add content' + TERM_EXECUTE_STEALTHY_CODE = 'execute stealthy code' + TERM_HIDE_REGISTRY_ARTIFACTS = 'hide registry artifacts' + TERM_HIDE_USERSPACE_LIBRARIES = 'hide userspace libraries' + TERM_HIDE_ARBITRARY_VIRTUAL_MEMORY = 'hide arbitrary virtual memory' + TERM_EXECUTE_NON_MAIN_CPU_CODE = 'execute non-main cpu code' + TERM_FEED_MISINFORMATION_DURING_PHYSICAL_MEMORY_ACQUISITION = 'feed misinformation during physical memory acquisition' + TERM_PREVENT_PHYSICAL_MEMORY_ACQUISITION = 'prevent physical memory acquisition' + TERM_PREVENT_NATIVE_API_HOOKING = 'prevent native api hooking' + TERM_OBFUSCATE_ARTIFACT_PROPERTIES = 'obfuscate artifact properties' + TERM_ENCRYPT_SELF = 'encrypt self' + TERM_HIDE_SERVICES = 'hide services' + TERM_HIDE_CODE_IN_FILE = 'hide code in file' + TERM_HIDE_NETWORK_TRAFFIC = 'hide network traffic' + TERM_HIDE_THREADS = 'hide threads' + + + +#: Mapping of Controlled Vocabulary xsi:type's to their class implementations. +_VOCAB_MAP = {} + + +def add_vocab(cls): + _VOCAB_MAP[cls._XSI_TYPE] = cls + + +add_vocab(DataTheftTacticalObjectives) +add_vocab(MachineAccessControlTacticalObjectives) +add_vocab(DataTheftProperties) +add_vocab(SecondaryOperationProperties) +add_vocab(SystemActionName) +add_vocab(AvailabilityViolationTacticalObjectives) +add_vocab(ActionObjectAssociationType) +add_vocab(CommonCapabilityProperties) +add_vocab(RemoteMachineManipulationTacticalObjectives) +add_vocab(PrivilegeEscalationStrategicObjectives) +add_vocab(DebuggingActionName) +add_vocab(DataExfiltrationStrategicObjectives) +add_vocab(DeviceDriverActionName) +add_vocab(ImportanceType) +add_vocab(HTTPActionName) +add_vocab(AntiDetectionStrategicObjectives) +add_vocab(SocketActionName) +add_vocab(CommandandControlTacticalObjectives) +add_vocab(HookingActionName) +add_vocab(GroupingRelationship) +add_vocab(PersistenceProperties) +add_vocab(DestructionProperties) +add_vocab(AntiCodeAnalysisStrategicObjectives) +add_vocab(AvailabilityViolationStrategicObjectives) +add_vocab(IPCActionName) +add_vocab(DirectoryActionName) +add_vocab(NetworkShareActionName) +add_vocab(InfectionPropagationProperties) +add_vocab(ProbingStrategicObjectives) +add_vocab(InfectionPropagationTacticalObjectives) +add_vocab(DataExfiltrationProperties) +add_vocab(LibraryActionName) +add_vocab(MalwareDevelopmentTool) +add_vocab(FileActionName) +add_vocab(CommandandControlProperties) +add_vocab(IRCActionName) +add_vocab(InfectionPropagationStrategicObjectives) +add_vocab(MalwareCapability) +add_vocab(AntiBehavioralAnalysisProperties) +add_vocab(DNSActionName) +add_vocab(RemoteMachineManipulationStrategicObjectives) +add_vocab(ProcessActionName) +add_vocab(PersistenceStrategicObjectives) +add_vocab(NetworkActionName) +add_vocab(SecondaryOperationStrategicObjectives) +add_vocab(FraudTacticalObjectives) +add_vocab(ProcessMemoryActionName) +add_vocab(RegistryActionName) +add_vocab(AvailabilityViolationProperties) +add_vocab(CommandandControlStrategicObjectives) +add_vocab(DestructionTacticalObjectives) +add_vocab(SpyingStrategicObjectives) +add_vocab(FTPActionName) +add_vocab(MachineAccessControlStrategicObjectives) +add_vocab(IntegrityViolationStrategicObjectives) +add_vocab(ProbingTacticalObjectives) +add_vocab(MalwareEntityType) +add_vocab(FraudStrategicObjectives) +add_vocab(SpyingTacticalObjectives) +add_vocab(ProcessThreadActionName) +add_vocab(DataTheftStrategicObjectives) +add_vocab(AntiCodeAnalysisTacticalObjectives) +add_vocab(PrivilegeEscalationTacticalObjectives) +add_vocab(MalwareSubjectRelationship) +add_vocab(AntiBehavioralAnalysisTacticalObjectives) +add_vocab(PersistenceTacticalObjectives) +add_vocab(SynchronizationActionName) +add_vocab(AntiRemovalTacticalObjectives) +add_vocab(SecurityDegradationStrategicObjectives) +add_vocab(PrivilegeEscalationProperties) +add_vocab(GUIActionName) +add_vocab(SecurityDegradationTacticalObjectives) +add_vocab(MalwareConfigurationParameter) +add_vocab(MachineAccessControlProperties) +add_vocab(ServiceActionName) +add_vocab(AntiBehavioralAnalysisStrategicObjectives) +add_vocab(CapabilityObjectiveRelationship) +add_vocab(DataExfiltrationTacticalObjectives) +add_vocab(UserActionName) +add_vocab(DestructionStrategicObjectives) +add_vocab(AntiRemovalStrategicObjectives) +add_vocab(SecondaryOperationTacticalObjectives) +add_vocab(MalwareLabel) +add_vocab(SecurityDegradationProperties) +add_vocab(DiskActionName) +add_vocab(IntegrityViolationTacticalObjectives) +add_vocab(AntiDetectionTacticalObjectives) From 4ff3bfeda87f479b887732571c0caf2a50df80f9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Apr 2015 15:32:24 -0400 Subject: [PATCH 179/297] Fixed formatting issue in class member name --- maec/vocabs/vocabs.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 5c6c1b3..c017f74 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1379,7 +1379,7 @@ class SecurityDegradationStrategicObjectives(VocabString): TERM_DEGRADE_SECURITY_PROGRAMS = 'degrade security programs' TERM_DISABLE_SYSTEM_UPDATES = 'disable system updates' TERM_DISABLE_OS_SECURITY_FEATURES = 'disable os security features' - TERM_DISABLE_[HOST_BASED_OR_OS]_ACCESS_CONTROLS = 'disable [host-based or os] access controls' + TERM_DISABLE_HOST_BASED_OR_OS_ACCESS_CONTROLS = 'disable [host-based or os] access controls' class PrivilegeEscalationProperties(VocabString): From 076c297983f4224c0b7135dc4e3432664572375c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Apr 2015 15:37:34 -0400 Subject: [PATCH 180/297] Updated to use new vocabulary implementation for label field --- maec/package/malware_subject.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index c61b05b..c96ac74 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -7,7 +7,7 @@ #Last updated 08/20/2014 import cybox -from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation +from cybox.common import vocabs, VocabString, PlatformSpecification, ToolInformationList, ToolInformation from cybox.objects.file_object import File from cybox.objects.uri_object import URI from cybox.core import Object @@ -18,6 +18,7 @@ from maec.bundle import Bundle from maec.package import (ActionEquivalenceList, Analysis, MalwareSubjectReference, ObjectEquivalenceList) +from maec.vocabs.vocabs import MalwareLabel class MinorVariants(maec.EntityList): _contained_type = Object @@ -176,7 +177,7 @@ class MalwareSubject(maec.Entity): id_ = maec.TypedField("id") malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) - label = maec.TypedField("Label", VocabString, multiple=True) + label = vocabs.VocabField("Label", MalwareLabel, multiple=True) configuration_details = maec.TypedField("Configuration_Details", MalwareConfigurationDetails) minor_variants = maec.TypedField("Minor_Variants", MinorVariants) development_environment = maec.TypedField("Development_Environment", MalwareDevelopmentEnvironment) From 3ad77527ca135cb9328b12e948258d63b838cc3e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Apr 2015 15:37:48 -0400 Subject: [PATCH 181/297] Added missing init file --- maec/vocabs/__init__.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 maec/vocabs/__init__.py diff --git a/maec/vocabs/__init__.py b/maec/vocabs/__init__.py new file mode 100644 index 0000000..e69de29 From 298b664ab92f2fdc1607d384f7712da36bf712b6 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 20 Apr 2015 15:38:56 -0400 Subject: [PATCH 182/297] Added copyright header --- maec/vocabs/vocabs.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index c017f74..f3931fb 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1,3 +1,6 @@ +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + from cybox.common import VocabString class DataTheftTacticalObjectives(VocabString): From eb8fe632e608d3c956aff56a2abc45e356d61135 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 21 Apr 2015 10:14:35 -0400 Subject: [PATCH 183/297] A few more default vocabulary usage updates --- maec/package/grouping_relationship.py | 5 +++-- maec/package/malware_subject.py | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 0ac07dc..5d55e73 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -11,7 +11,8 @@ from . import _namespace import maec.bindings.maec_package as package_binding from maec.package.malware_subject_reference import MalwareSubjectReference -from cybox.common import VocabString +from cybox.common import vocabs +from maec.vocabs.vocabs import GroupingRelationship as GroupingRelationshipVocab class ClusterEdgeNodePair(maec.Entity): _binding = package_binding @@ -68,7 +69,7 @@ class GroupingRelationship(maec.Entity): _binding_class = package_binding.GroupingRelationshipType _namespace = _namespace - type_ = maec.TypedField("Type", VocabString) + type_ = vocabs.VocabField("Type", GroupingRelationshipVocab) malware_family_name = maec.TypedField("Malware_Family_Name") malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index c96ac74..1555937 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -19,6 +19,8 @@ from maec.package import (ActionEquivalenceList, Analysis, MalwareSubjectReference, ObjectEquivalenceList) from maec.vocabs.vocabs import MalwareLabel +from maec.vocabs.vocabs import MalwareConfigurationParameter as MalwareConfigParameterVocab +from maec.vocabs.vocabs import MalwareSubjectRelationship as MalwareSubjectRelationshipVocab class MinorVariants(maec.EntityList): _contained_type = Object @@ -38,7 +40,7 @@ class MalwareSubjectRelationship(maec.Entity): _namespace = _namespace malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) - type_ = maec.TypedField("Type", VocabString) + type_ = vocabs.VocabField("Type", MalwareSubjectRelationshipVocab) def __init__(self): super(MalwareSubjectRelationship, self).__init__() @@ -100,7 +102,7 @@ class MalwareConfigurationParameter(maec.Entity): _binding_class = package_binding.MalwareConfigurationParameterType _namespace = _namespace - name = maec.TypedField("Name", VocabString) + name = vocabs.VocabField("Name", MalwareConfigParameterVocab) value = maec.TypedField("Value") def __init__(self): From 29a8ef72519846b5e084e8f8561d97ae2f5b991e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 21 Apr 2015 10:48:55 -0400 Subject: [PATCH 184/297] Updated to use add_allowed_values decorator --- maec/vocabs/vocabs.py | 914 ++++-------------------------------------- 1 file changed, 88 insertions(+), 826 deletions(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index f3931fb..26ce432 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1,34 +1,13 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -from cybox.common import VocabString +from cybox.common import vocabs, VocabString +@vocabs.add_allowed_values class DataTheftTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'steal dialed phone numbers', - 'steal email data', - 'steal referrer urls', - 'steal cryptocurrency data', - 'steal pki software certificate', - 'steal browser cache', - 'steal serial numbers', - 'steal sms database', - 'steal cookie', - 'steal password hash', - 'steal make/model', - 'steal documents', - 'steal network address', - 'steal open port', - 'steal images', - 'steal browser history', - 'steal web/network credential', - 'steal pki key', - 'steal contact list data', - 'steal database content', - ) TERM_STEAL_DIALED_PHONE_NUMBERS = 'steal dialed phone numbers' TERM_STEAL_EMAIL_DATA = 'steal email data' TERM_STEAL_PKI_KEY = 'steal pki key' @@ -50,64 +29,33 @@ class DataTheftTacticalObjectives(VocabString): TERM_STEAL_NETWORK_ADDRESS = 'steal network address' TERM_STEAL_OPEN_PORT = 'steal open port' - +@vocabs.add_allowed_values class MachineAccessControlTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'control machine via remote command', - ) TERM_CONTROL_MACHINE_VIA_REMOTE_COMMAND = 'control machine via remote command' - +@vocabs.add_allowed_values class DataTheftProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'targeted application', - 'targeted website', - ) TERM_TARGETED_APPLICATION = 'targeted application' TERM_TARGETED_WEBSITE = 'targeted website' - +@vocabs.add_allowed_values class SecondaryOperationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'trigger type', - ) TERM_TRIGGER_TYPE = 'trigger type' - +@vocabs.add_allowed_values class SystemActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SystemActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'add scheduled task', - 'shutdown system', - 'sleep system', - 'get elapsed system up time', - 'get netbios name', - 'set netbios name', - 'get system host name', - 'set system host name', - 'get system time', - 'set system time', - 'get system local time', - 'set system local time', - 'get username', - 'enumerate system handles', - 'get system global flags', - 'set system global flags', - 'get windows directory', - 'get windows system directory', - 'get windows temporary files directory', - ) TERM_ENUMERATE_SYSTEM_HANDLES = 'enumerate system handles' TERM_ADD_SCHEDULED_TASK = 'add scheduled task' TERM_GET_WINDOWS_DIRECTORY = 'get windows directory' @@ -128,127 +76,81 @@ class SystemActionName(VocabString): TERM_GET_SYSTEM_GLOBAL_FLAGS = 'get system global flags' TERM_SET_SYSTEM_GLOBAL_FLAGS = 'set system global flags' - +@vocabs.add_allowed_values class AvailabilityViolationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'denial of service', - 'compromise local system availability', - 'crack passwords', - 'mine for cryptocurrency', - 'compromise access to information assets', - ) TERM_DENIAL_OF_SERVICE = 'denial of service' TERM_COMPROMISE_ACCESS_TO_INFORMATION_ASSETS = 'compromise access to information assets' TERM_COMPROMISE_LOCAL_SYSTEM_AVAILABILITY = 'compromise local system availability' TERM_MINE_FOR_CRYPTOCURRENCY = 'mine for cryptocurrency' TERM_CRACK_PASSWORDS = 'crack passwords' - +@vocabs.add_allowed_values class ActionObjectAssociationType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'input', - 'output', - 'side-effect', - ) TERM_INPUT = 'input' TERM_SIDE_EFFECT = 'side-effect' TERM_OUTPUT = 'output' - +@vocabs.add_allowed_values class CommonCapabilityProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommonCapabilityPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'encryption algorithm', - 'protocol used', - ) TERM_ENCRYPTION_ALGORITHM = 'encryption algorithm' TERM_PROTOCOL_USED = 'protocol used' - +@vocabs.add_allowed_values class RemoteMachineManipulationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'compromise remote machine', - ) TERM_COMPROMISE_REMOTE_MACHINE = 'compromise remote machine' - +@vocabs.add_allowed_values class PrivilegeEscalationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'impersonate user', - 'escalate user privilege', - ) TERM_IMPERSONATE_USER = 'impersonate user' TERM_ESCALATE_USER_PRIVILEGE = 'escalate user privilege' - +@vocabs.add_allowed_values class DebuggingActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DebuggingActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'check for remote debugger', - 'check for kernel debugger', - ) TERM_CHECK_FOR_KERNEL_DEBUGGER = 'check for kernel debugger' TERM_CHECK_FOR_REMOTE_DEBUGGER = 'check for remote debugger' - +@vocabs.add_allowed_values class DataExfiltrationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'perform data exfiltration', - 'obfuscate data for exfiltration', - 'stage data for exfiltration', - ) TERM_STAGE_DATA_FOR_EXFILTRATION = 'stage data for exfiltration' TERM_OBFUSCATE_DATA_FOR_EXFILTRATION = 'obfuscate data for exfiltration' TERM_PERFORM_DATA_EXFILTRATION = 'perform data exfiltration' - +@vocabs.add_allowed_values class DeviceDriverActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DeviceDriverActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'load and call driver', - 'load driver', - 'unload driver', - 'emulate driver', - ) TERM_LOAD_AND_CALL_DRIVER = 'load and call driver' TERM_UNLOAD_DRIVER = 'unload driver' TERM_LOAD_DRIVER = 'load driver' TERM_EMULATE_DRIVER = 'emulate driver' - +@vocabs.add_allowed_values class ImportanceType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ImportanceTypeVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'high', - 'medium', - 'low', - 'informational', - 'numeric', - 'unknown', - ) TERM_MEDIUM = 'medium' TERM_UNKNOWN = 'unknown' TERM_NUMERIC = 'numeric' @@ -256,23 +158,11 @@ class ImportanceType(VocabString): TERM_LOW = 'low' TERM_INFORMATIONAL = 'informational' - +@vocabs.add_allowed_values class HTTPActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:HTTPActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'send http get request', - 'send http head request', - 'send http post request', - 'send http put request', - 'send http delete request', - 'send http trace request', - 'send http options request', - 'send http connect request', - 'send http patch request', - 'receive http response', - ) TERM_SEND_HTTP_PATCH_REQUEST = 'send http patch request' TERM_SEND_HTTP_POST_REQUEST = 'send http post request' TERM_SEND_HTTP_GET_REQUEST = 'send http get request' @@ -284,19 +174,11 @@ class HTTPActionName(VocabString): TERM_SEND_HTTP_CONNECT_REQUEST = 'send http connect request' TERM_SEND_HTTP_PUT_REQUEST = 'send http put request' - +@vocabs.add_allowed_values class AntiDetectionStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiDetectionStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'security software evasion', - 'hide executing code', - 'self-modification', - 'anti-memory forensics', - 'hide non-executing code', - 'hide malware artifacts', - ) TERM_SECURITY_SOFTWARE_EVASION = 'security software evasion' TERM_HIDE_EXECUTING_CODE = 'hide executing code' TERM_SELF_MODIFICATION = 'self-modification' @@ -304,25 +186,11 @@ class AntiDetectionStrategicObjectives(VocabString): TERM_HIDE_NON_EXECUTING_CODE = 'hide non-executing code' TERM_HIDE_MALWARE_ARTIFACTS = 'hide malware artifacts' - +@vocabs.add_allowed_values class SocketActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SocketActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'accept socket connection', - 'bind address to socket', - 'create socket', - 'close socket', - 'connect to socket', - 'disconnect from socket', - 'listen on socket', - 'send data on socket', - 'receive data on socket', - 'send data to address on socket', - 'get host by address', - 'get host by name', - ) TERM_CLOSE_SOCKET = 'close socket' TERM_CONNECT_TO_SOCKET = 'connect to socket' TERM_ACCEPT_SOCKET_CONNECTION = 'accept socket connection' @@ -336,20 +204,11 @@ class SocketActionName(VocabString): TERM_BIND_ADDRESS_TO_SOCKET = 'bind address to socket' TERM_GET_HOST_BY_NAME = 'get host by name' - +@vocabs.add_allowed_values class CommandandControlTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'check for payload', - 'validate data', - 'control malware via remote command', - 'send system information', - 'send heartbeat data', - 'generate c2 domain name(s)', - 'update configuration', - ) TERM_CHECK_FOR_PAYLOAD = 'check for payload' TERM_VALIDATE_DATA = 'validate data' TERM_UPDATE_CONFIGURATION = 'update configuration' @@ -358,102 +217,63 @@ class CommandandControlTacticalObjectives(VocabString): TERM_GENERATE_C2_DOMAIN_NAME_S = 'generate c2 domain name(s)' TERM_CONTROL_MALWARE_VIA_REMOTE_COMMAND = 'control malware via remote command' - +@vocabs.add_allowed_values class HookingActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:HookingActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'add system call hook', - 'add windows hook', - 'hide hook', - ) TERM_ADD_SYSTEM_CALL_HOOK = 'add system call hook' TERM_HIDE_HOOK = 'hide hook' TERM_ADD_WINDOWS_HOOK = 'add windows hook' - +@vocabs.add_allowed_values class GroupingRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:GroupingRelationshipVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'same malware family', - 'clustered together', - 'observed together', - 'part of intrusion set', - 'same malware toolkit', - ) TERM_PART_OF_INTRUSION_SET = 'part of intrusion set' TERM_CLUSTERED_TOGETHER = 'clustered together' TERM_SAME_MALWARE_TOOLKIT = 'same malware toolkit' TERM_SAME_MALWARE_FAMILY = 'same malware family' TERM_OBSERVED_TOGETHER = 'observed together' - +@vocabs.add_allowed_values class PersistenceProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistencePropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'scope', - ) TERM_SCOPE = 'scope' - +@vocabs.add_allowed_values class DestructionProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'erasure scope', - ) TERM_ERASURE_SCOPE = 'erasure scope' - +@vocabs.add_allowed_values class AntiCodeAnalysisStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'anti-debugging', - 'code obfuscation', - 'anti-disassembly', - ) TERM_ANTI_DEBUGGING = 'anti-debugging' TERM_CODE_OBFUSCATION = 'code obfuscation' TERM_ANTI_DISASSEMBLY = 'anti-disassembly' - +@vocabs.add_allowed_values class AvailabilityViolationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'compromise data availability', - 'compromise system availability', - 'consume system resources', - ) TERM_CONSUME_SYSTEM_RESOURCES = 'consume system resources' TERM_COMPROMISE_DATA_AVAILABILITY = 'compromise data availability' TERM_COMPROMISE_SYSTEM_AVAILABILITY = 'compromise system availability' - +@vocabs.add_allowed_values class IPCActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IPCActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create named pipe', - 'delete named pipe', - 'connect to named pipe', - 'disconnect from named pipe', - 'read from named pipe', - 'write to named pipe', - 'create mailslot', - 'read from mailslot', - 'write to mailslot', - ) TERM_DISCONNECT_FROM_NAMED_PIPE = 'disconnect from named pipe' TERM_READ_FROM_NAMED_PIPE = 'read from named pipe' TERM_CREATE_MAILSLOT = 'create mailslot' @@ -464,35 +284,21 @@ class IPCActionName(VocabString): TERM_CONNECT_TO_NAMED_PIPE = 'connect to named pipe' TERM_WRITE_TO_MAILSLOT = 'write to mailslot' - +@vocabs.add_allowed_values class DirectoryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DirectoryActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'create directory', - 'delete directory', - 'monitor directory', - 'hide directory', - ) TERM_MONITOR_DIRECTORY = 'monitor directory' TERM_DELETE_DIRECTORY = 'delete directory' TERM_CREATE_DIRECTORY = 'create directory' TERM_HIDE_DIRECTORY = 'hide directory' - +@vocabs.add_allowed_values class NetworkShareActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:NetworkShareActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'add connection to network share', - 'add network share', - 'delete network share', - 'connect to network share', - 'disconnect from network share', - 'enumerate network shares', - ) TERM_ENUMERATE_NETWORK_SHARES = 'enumerate network shares' TERM_DISCONNECT_FROM_NETWORK_SHARE = 'disconnect from network share' TERM_ADD_NETWORK_SHARE = 'add network share' @@ -500,19 +306,11 @@ class NetworkShareActionName(VocabString): TERM_DELETE_NETWORK_SHARE = 'delete network share' TERM_CONNECT_TO_NETWORK_SHARE = 'connect to network share' - +@vocabs.add_allowed_values class InfectionPropagationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'scope', - 'infection targeting', - 'autonomy', - 'targeted file type', - 'targeted file architecture type', - 'file infection type', - ) TERM_AUTONOMY = 'autonomy' TERM_TARGETED_FILE_TYPE = 'targeted file type' TERM_FILE_INFECTION_TYPE = 'file infection type' @@ -520,32 +318,19 @@ class InfectionPropagationProperties(VocabString): TERM_SCOPE = 'scope' TERM_TARGETED_FILE_ARCHITECTURE_TYPE = 'targeted file architecture type' - +@vocabs.add_allowed_values class ProbingStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProbingStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'probe host configuration', - 'probe network environment', - ) TERM_PROBE_NETWORK_ENVIRONMENT = 'probe network environment' TERM_PROBE_HOST_CONFIGURATION = 'probe host configuration' - +@vocabs.add_allowed_values class InfectionPropagationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'identify file', - 'perform autonomous remote infection', - 'identify target machine(s)', - 'perform social-engineering based remote infection', - 'inventory victims', - 'write code into file', - 'modify file', - ) TERM_IDENTIFY_FILE = 'identify file' TERM_PERFORM_AUTONOMOUS_REMOTE_INFECTION = 'perform autonomous remote infection' TERM_IDENTIFY_TARGET_MACHINE_S = 'identify target machine(s)' @@ -554,49 +339,30 @@ class InfectionPropagationTacticalObjectives(VocabString): TERM_WRITE_CODE_INTO_FILE = 'write code into file' TERM_MODIFY_FILE = 'modify file' - +@vocabs.add_allowed_values class DataExfiltrationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'archive type', - 'file type', - ) TERM_ARCHIVE_TYPE = 'archive type' TERM_FILE_TYPE = 'file type' - +@vocabs.add_allowed_values class LibraryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:LibraryActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'enumerate libraries', - 'free library', - 'load library', - 'get function address', - 'call library function', - ) TERM_GET_FUNCTION_ADDRESS = 'get function address' TERM_LOAD_LIBRARY = 'load library' TERM_CALL_LIBRARY_FUNCTION = 'call library function' TERM_FREE_LIBRARY = 'free library' TERM_ENUMERATE_LIBRARIES = 'enumerate libraries' - +@vocabs.add_allowed_values class MalwareDevelopmentTool(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareDevelopmentToolVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'builder', - 'compiler', - 'linker', - 'packer', - 'crypter', - 'protector', - ) TERM_PACKER = 'packer' TERM_BUILDER = 'builder' TERM_LINKER = 'linker' @@ -604,35 +370,11 @@ class MalwareDevelopmentTool(VocabString): TERM_PROTECTOR = 'protector' TERM_COMPILER = 'compiler' - +@vocabs.add_allowed_values class FileActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FileActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'create file', - 'delete file', - 'copy file', - 'create file symbolic link', - 'find file', - 'get file attributes', - 'set file attributes', - 'lock file', - 'unlock file', - 'modify file', - 'move file', - 'open file', - 'read from file', - 'write to file', - 'rename file', - 'create file alternate data stream', - 'send control code to file', - 'create file mapping', - 'open file mapping', - 'execute file', - 'hide file', - 'close file', - ) TERM_CREATE_FILE_MAPPING = 'create file mapping' TERM_FIND_FILE = 'find file' TERM_READ_FROM_FILE = 'read from file' @@ -656,30 +398,18 @@ class FileActionName(VocabString): TERM_CREATE_FILE = 'create file' TERM_MODIFY_FILE = 'modify file' - +@vocabs.add_allowed_values class CommandandControlProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'frequency', - ) TERM_FREQUENCY = 'frequency' - +@vocabs.add_allowed_values class IRCActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IRCActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'connect to irc server', - 'disconnect from irc server', - 'set irc nickname', - 'join irc channel', - 'leave irc channel', - 'send irc private message', - 'receive irc private message', - ) TERM_RECEIVE_IRC_PRIVATE_MESSAGE = 'receive irc private message' TERM_JOIN_IRC_CHANNEL = 'join irc channel' TERM_SEND_IRC_PRIVATE_MESSAGE = 'send irc private message' @@ -688,47 +418,20 @@ class IRCActionName(VocabString): TERM_DISCONNECT_FROM_IRC_SERVER = 'disconnect from irc server' TERM_SET_IRC_NICKNAME = 'set irc nickname' - +@vocabs.add_allowed_values class InfectionPropagationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'prevent duplicate infection', - 'infect file', - 'infect remote machine', - ) TERM_INFECT_FILE = 'infect file' TERM_PREVENT_DUPLICATE_INFECTION = 'prevent duplicate infection' TERM_INFECT_REMOTE_MACHINE = 'infect remote machine' - +@vocabs.add_allowed_values class MalwareCapability(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareCapabilityVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'command and control', - 'remote machine manipulation', - 'privilege escalation', - 'data theft', - 'spying', - 'secondary operation', - 'anti-detection', - 'anti-code analysis', - 'infection/propagation', - 'anti-behavioral analysis', - 'integrity violation', - 'data exfiltration', - 'probing', - 'anti-removal', - 'security degradation', - 'availability violation', - 'destruction', - 'fraud', - 'persistence', - 'machine access/control', - ) TERM_COMMAND_AND_CONTROL = 'command and control' TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' TERM_INFECTION_PROPAGATION = 'infection/propagation' @@ -750,61 +453,35 @@ class MalwareCapability(VocabString): TERM_PERSISTENCE = 'persistence' TERM_DESTRUCTION = 'destruction' - +@vocabs.add_allowed_values class AntiBehavioralAnalysisProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'targeted vm', - 'targeted sandbox', - ) TERM_TARGETED_VM = 'targeted vm' TERM_TARGETED_SANDBOX = 'targeted sandbox' - +@vocabs.add_allowed_values class DNSActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DNSActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'send dns query', - 'send reverse dns lookup', - ) TERM_SEND_DNS_QUERY = 'send dns query' TERM_SEND_REVERSE_DNS_LOOKUP = 'send reverse dns lookup' - +@vocabs.add_allowed_values class RemoteMachineManipulationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'access remote machine', - 'search for remote machines', - ) TERM_ACCESS_REMOTE_MACHINE = 'access remote machine' TERM_SEARCH_FOR_REMOTE_MACHINES = 'search for remote machines' - +@vocabs.add_allowed_values class ProcessActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create process', - 'kill process', - 'create process as user', - 'enumerate processes', - 'open process', - 'flush process instruction cache', - 'get process current directory', - 'set process current directory', - 'get process environment variable', - 'set process environment variable', - 'sleep process', - 'get process startupinfo', - ) TERM_GET_PROCESS_CURRENT_DIRECTORY = 'get process current directory' TERM_SET_PROCESS_ENVIRONMENT_VARIABLE = 'set process environment variable' TERM_ENUMERATE_PROCESSES = 'enumerate processes' @@ -818,42 +495,21 @@ class ProcessActionName(VocabString): TERM_CREATE_PROCESS_AS_USER = 'create process as user' TERM_OPEN_PROCESS = 'open process' - +@vocabs.add_allowed_values class PersistenceStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistenceStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'persist to re-infect system', - 'gather information for improvement', - 'ensure compatibility', - 'persist to continuously execute on system', - ) TERM_PERSIST_TO_RE_INFECT_SYSTEM = 'persist to re-infect system' TERM_GATHER_INFORMATION_FOR_IMPROVEMENT = 'gather information for improvement' TERM_ENSURE_COMPATIBILITY = 'ensure compatibility' TERM_PERSIST_TO_CONTINUOUSLY_EXECUTE_ON_SYSTEM = 'persist to continuously execute on system' - +@vocabs.add_allowed_values class NetworkActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:NetworkActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'open port', - 'close port', - 'connect to ip', - 'disconnect from ip', - 'connect to url', - 'connect to socket address', - 'download file', - 'upload file', - 'listen on port', - 'send email message', - 'send icmp request', - 'send network packet', - 'receive network packet', - ) TERM_SEND_EMAIL_MESSAGE = 'send email message' TERM_SEND_NETWORK_PACKET = 'send network packet' TERM_DISCONNECT_FROM_IP = 'disconnect from ip' @@ -868,19 +524,11 @@ class NetworkActionName(VocabString): TERM_LISTEN_ON_PORT = 'listen on port' TERM_RECEIVE_NETWORK_PACKET = 'receive network packet' - +@vocabs.add_allowed_values class SecondaryOperationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'patch operating system file(s)', - 'remove traces of infection', - 'log activity', - 'lay dormant', - 'install other components', - 'suicide exit', - ) TERM_PATCH_OPERATING_SYSTEM_FILE_S = 'patch operating system file(s)' TERM_REMOVE_TRACES_OF_INFECTION = 'remove traces of infection' TERM_LAY_DORMANT = 'lay dormant' @@ -888,31 +536,18 @@ class SecondaryOperationStrategicObjectives(VocabString): TERM_SUICIDE_EXIT = 'suicide exit' TERM_LOG_ACTIVITY = 'log activity' - +@vocabs.add_allowed_values class FraudTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FraudTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'access premium service', - ) TERM_ACCESS_PREMIUM_SERVICE = 'access premium service' - +@vocabs.add_allowed_values class ProcessMemoryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessMemoryActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'allocate process virtual memory', - 'free process virtual memory', - 'modify process virtual memory protection', - 'read from process memory', - 'write to process memory', - 'map file into process', - 'unmap file from process', - 'map library into process', - ) TERM_UNMAP_FILE_FROM_PROCESS = 'unmap file from process' TERM_MODIFY_PROCESS_VIRTUAL_MEMORY_PROTECTION = 'modify process virtual memory protection' TERM_WRITE_TO_PROCESS_MEMORY = 'write to process memory' @@ -922,26 +557,11 @@ class ProcessMemoryActionName(VocabString): TERM_FREE_PROCESS_VIRTUAL_MEMORY = 'free process virtual memory' TERM_MAP_FILE_INTO_PROCESS = 'map file into process' - +@vocabs.add_allowed_values class RegistryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RegistryActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create registry key', - 'delete registry key', - 'open registry key', - 'close registry key', - 'create registry key value', - 'delete registry key value', - 'enumerate registry key subkeys', - 'enumerate registry key values', - 'get registry key attributes', - 'read registry key value', - 'modify registry key value', - 'modify registry key', - 'monitor registry key', - ) TERM_MODIFY_REGISTRY_KEY = 'modify registry key' TERM_MONITOR_REGISTRY_KEY = 'monitor registry key' TERM_CLOSE_REGISTRY_KEY = 'close registry key' @@ -956,119 +576,74 @@ class RegistryActionName(VocabString): TERM_MODIFY_REGISTRY_KEY_VALUE = 'modify registry key value' TERM_DELETE_REGISTRY_KEY_VALUE = 'delete registry key value' - +@vocabs.add_allowed_values class AvailabilityViolationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'cryptocurrency type', - ) TERM_CRYPTOCURRENCY_TYPE = 'cryptocurrency type' - +@vocabs.add_allowed_values class CommandandControlStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'determine c2 server', - 'receive data from c2 server', - 'send data to c2 server', - ) TERM_DETERMINE_C2_SERVER = 'determine c2 server' TERM_RECEIVE_DATA_FROM_C2_SERVER = 'receive data from c2 server' TERM_SEND_DATA_TO_C2_SERVER = 'send data to c2 server' - +@vocabs.add_allowed_values class DestructionTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'erase data', - 'destroy firmware', - 'destroy hardware', - ) TERM_ERASE_DATA = 'erase data' TERM_DESTROY_FIRMWARE = 'destroy firmware' TERM_DESTROY_HARDWARE = 'destroy hardware' - +@vocabs.add_allowed_values class SpyingStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SpyingStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'capture system input peripheral data', - 'capture system state data', - 'capture system interface data', - 'capture system output peripheral data', - ) TERM_CAPTURE_SYSTEM_INPUT_PERIPHERAL_DATA = 'capture system input peripheral data' TERM_CAPTURE_SYSTEM_INTERFACE_DATA = 'capture system interface data' TERM_CAPTURE_SYSTEM_OUTPUT_PERIPHERAL_DATA = 'capture system output peripheral data' TERM_CAPTURE_SYSTEM_STATE_DATA = 'capture system state data' - +@vocabs.add_allowed_values class FTPActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FTPActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'connect to ftp server', - 'disconnect from ftp server', - 'send ftp command', - ) TERM_CONNECT_TO_FTP_SERVER = 'connect to ftp server' TERM_SEND_FTP_COMMAND = 'send ftp command' TERM_DISCONNECT_FROM_FTP_SERVER = 'disconnect from ftp server' - +@vocabs.add_allowed_values class MachineAccessControlStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'control local machine', - 'install backdoor', - ) TERM_CONTROL_LOCAL_MACHINE = 'control local machine' TERM_INSTALL_BACKDOOR = 'install backdoor' - +@vocabs.add_allowed_values class IntegrityViolationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IntegrityViolationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'compromise system operational integrity', - 'compromise user data integrity', - 'annoy user', - 'compromise network operational integrity', - 'compromise system data integrity', - ) TERM_COMPROMISE_SYSTEM_DATA_INTEGRITY = 'compromise system data integrity' TERM_ANNOY_USER = 'annoy user' TERM_COMPROMISE_NETWORK_OPERATIONAL_INTEGRITY = 'compromise network operational integrity' TERM_COMPROMISE_USER_DATA_INTEGRITY = 'compromise user data integrity' TERM_COMPROMISE_SYSTEM_OPERATIONAL_INTEGRITY = 'compromise system operational integrity' - +@vocabs.add_allowed_values class ProbingTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProbingTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'identify os', - 'check for proxy', - 'check for firewall', - 'check for network drives', - 'map local network', - 'inventory system applications', - 'check language', - 'check for internet connectivity', - ) TERM_IDENTIFY_OS = 'identify os' TERM_CHECK_FOR_PROXY = 'check for proxy' TERM_INVENTORY_SYSTEM_APPLICATIONS = 'inventory system applications' @@ -1078,50 +653,28 @@ class ProbingTacticalObjectives(VocabString): TERM_CHECK_LANGUAGE = 'check language' TERM_CHECK_FOR_INTERNET_CONNECTIVITY = 'check for internet connectivity' - +@vocabs.add_allowed_values class MalwareEntityType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareEntityTypeVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'instance', - 'family', - 'class', - ) TERM_INSTANCE = 'instance' TERM_CLASS = 'class' TERM_FAMILY = 'family' - +@vocabs.add_allowed_values class FraudStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FraudStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'perform premium rate fraud', - 'perform click fraud', - ) TERM_PERFORM_CLICK_FRAUD = 'perform click fraud' TERM_PERFORM_PREMIUM_RATE_FRAUD = 'perform premium rate fraud' - +@vocabs.add_allowed_values class SpyingTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SpyingTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'capture system screenshot', - 'capture camera input', - 'capture file system', - 'capture printer output', - 'capture gps data', - 'capture keyboard input', - 'capture mouse input', - 'capture microphone input', - 'capture system network traffic', - 'capture touchscreen input', - 'capture system memory', - ) TERM_CAPTURE_SYSTEM_SCREENSHOT = 'capture system screenshot' TERM_CAPTURE_KEYBOARD_INPUT = 'capture keyboard input' TERM_CAPTURE_FILE_SYSTEM = 'capture file system' @@ -1134,23 +687,11 @@ class SpyingTacticalObjectives(VocabString): TERM_CAPTURE_TOUCHSCREEN_INPUT = 'capture touchscreen input' TERM_CAPTURE_SYSTEM_MEMORY = 'capture system memory' - +@vocabs.add_allowed_values class ProcessThreadActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessThreadActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create thread', - 'kill thread', - 'create remote thread in process', - 'enumerate threads', - 'get thread username', - 'impersonate process', - 'revert thread to self', - 'get thread context', - 'set thread context', - 'queue apc in thread', - ) TERM_CREATE_THREAD = 'create thread' TERM_SET_THREAD_CONTEXT = 'set thread context' TERM_ENUMERATE_THREADS = 'enumerate threads' @@ -1162,39 +703,21 @@ class ProcessThreadActionName(VocabString): TERM_KILL_THREAD = 'kill thread' TERM_IMPERSONATE_PROCESS = 'impersonate process' - +@vocabs.add_allowed_values class DataTheftStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'steal stored information', - 'steal user data', - 'steal system information', - 'steal authentication credentials', - ) TERM_STEAL_STORED_INFORMATION = 'steal stored information' TERM_STEAL_USER_DATA = 'steal user data' TERM_STEAL_SYSTEM_INFORMATION = 'steal system information' TERM_STEAL_AUTHENTICATION_CREDENTIALS = 'steal authentication credentials' - +@vocabs.add_allowed_values class AntiCodeAnalysisTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'transform control flow', - 'restructure arrays', - 'detect debugging', - 'prevent debugging', - 'defeat flow-oriented (recursive traversal) disassembler', - 'defeat linear disassembler', - 'obfuscate instructions', - 'obfuscate imports', - 'defeat call graph generation', - 'obfuscate runtime code', - ) TERM_DEFEAT_CALL_GRAPH_GENERATION = 'defeat call graph generation' TERM_RESTRUCTURE_ARRAYS = 'restructure arrays' TERM_DETECT_DEBUGGING = 'detect debugging' @@ -1206,45 +729,18 @@ class AntiCodeAnalysisTacticalObjectives(VocabString): TERM_TRANSFORM_CONTROL_FLOW = 'transform control flow' TERM_OBFUSCATE_RUNTIME_CODE = 'obfuscate runtime code' - +@vocabs.add_allowed_values class PrivilegeEscalationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'elevate cpu mode', - ) TERM_ELEVATE_CPU_MODE = 'elevate cpu mode' - +@vocabs.add_allowed_values class MalwareSubjectRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareSubjectRelationshipVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'downloads', - 'downloaded by', - 'drops', - 'dropped by', - 'extracts', - 'extracted from', - 'direct descendant of', - 'direct ancestor of', - 'memory image of', - 'contained in memory image', - 'disk image of', - 'contained in disk image', - 'network traffic capture of', - 'contained in network traffic capture', - 'packed version of', - 'unpacked version of', - 'installs', - 'installed by', - '64-bit version of', - '32-bit version of', - 'encrypted version of', - 'decrypted version of', - ) TERM_NETWORK_TRAFFIC_CAPTURE_OF = 'network traffic capture of' TERM_64_BIT_VERSION_OF = '64-bit version of' TERM_DROPPED_BY = 'dropped by' @@ -1268,37 +764,22 @@ class MalwareSubjectRelationship(VocabString): TERM_CONTAINED_IN_DISK_IMAGE = 'contained in disk image' TERM_DECRYPTED_VERSION_OF = 'decrypted version of' - +@vocabs.add_allowed_values class AntiBehavioralAnalysisTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'detect vm environment', - 'overload sandbox', - 'prevent execution in sandbox', - 'detect sandbox environment', - 'prevent execution in vm', - ) TERM_DETECT_VM_ENVIRONMENT = 'detect vm environment' TERM_OVERLOAD_SANDBOX = 'overload sandbox' TERM_PREVENT_EXECUTION_IN_SANDBOX = 'prevent execution in sandbox' TERM_DETECT_SANDBOX_ENVIRONMENT = 'detect sandbox environment' TERM_PREVENT_EXECUTION_IN_VM = 'prevent execution in vm' - +@vocabs.add_allowed_values class PersistenceTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistenceTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'reinstantiate self after initial detection', - 'limit application type/version', - 'persist after os install/reinstall', - 'drop/retrieve debug log file', - 'persist independent of hard disk/os changes', - 'persist after system reboot', - ) TERM_REINSTANTIATE_SELF_AFTER_INITIAL_DETECTION = 'reinstantiate self after initial detection' TERM_LIMIT_APPLICATION_TYPE_VERSION = 'limit application type/version' TERM_PERSIST_AFTER_OS_INSTALL_REINSTALL = 'persist after os install/reinstall' @@ -1306,29 +787,11 @@ class PersistenceTacticalObjectives(VocabString): TERM_PERSIST_INDEPENDENT_OF_HARD_DISK_OS_CHANGES = 'persist independent of hard disk/os changes' TERM_PERSIST_AFTER_SYSTEM_REBOOT = 'persist after system reboot' - +@vocabs.add_allowed_values class SynchronizationActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SynchronizationActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create mutex', - 'delete mutex', - 'open mutex', - 'release mutex', - 'create semaphore', - 'delete semaphore', - 'open semaphore', - 'release semaphore', - 'create event', - 'delete event', - 'open event', - 'reset event', - 'create critical section', - 'delete critical section', - 'open critical section', - 'release critical section', - ) TERM_CREATE_EVENT = 'create event' TERM_CREATE_MUTEX = 'create mutex' TERM_OPEN_MUTEX = 'open mutex' @@ -1346,19 +809,11 @@ class SynchronizationActionName(VocabString): TERM_DELETE_SEMAPHORE = 'delete semaphore' TERM_OPEN_CRITICAL_SECTION = 'open critical section' - +@vocabs.add_allowed_values class AntiRemovalTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiRemovalTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'prevent registry deletion', - 'prevent api unhooking', - 'prevent file access', - 'prevent memory access', - 'prevent registry access', - 'prevent file deletion', - ) TERM_PREVENT_REGISTRY_DELETION = 'prevent registry deletion' TERM_PREVENT_API_UNHOOKING = 'prevent api unhooking' TERM_PREVENT_FILE_ACCESS = 'prevent file access' @@ -1366,48 +821,29 @@ class AntiRemovalTacticalObjectives(VocabString): TERM_PREVENT_REGISTRY_ACCESS = 'prevent registry access' TERM_PREVENT_FILE_DELETION = 'prevent file deletion' - +@vocabs.add_allowed_values class SecurityDegradationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'disable service provider security features', - 'degrade security programs', - 'disable system updates', - 'disable os security features', - 'disable [host-based or os] access controls', - ) TERM_DISABLE_SERVICE_PROVIDER_SECURITY_FEATURES = 'disable service provider security features' TERM_DEGRADE_SECURITY_PROGRAMS = 'degrade security programs' TERM_DISABLE_SYSTEM_UPDATES = 'disable system updates' TERM_DISABLE_OS_SECURITY_FEATURES = 'disable os security features' TERM_DISABLE_HOST_BASED_OR_OS_ACCESS_CONTROLS = 'disable [host-based or os] access controls' - +@vocabs.add_allowed_values class PrivilegeEscalationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'user privilege escalation type', - ) TERM_USER_PRIVILEGE_ESCALATION_TYPE = 'user privilege escalation type' - +@vocabs.add_allowed_values class GUIActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:GUIActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'create window', - 'kill window', - 'create dialog box', - 'enumerate windows', - 'find window', - 'hide window', - 'show window', - ) TERM_FIND_WINDOW = 'find window' TERM_SHOW_WINDOW = 'show window' TERM_KILL_WINDOW = 'kill window' @@ -1416,28 +852,11 @@ class GUIActionName(VocabString): TERM_CREATE_DIALOG_BOX = 'create dialog box' TERM_HIDE_WINDOW = 'hide window' - +@vocabs.add_allowed_values class SecurityDegradationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'stop execution of security program', - 'disable firewall', - 'disable access right checking', - 'disable kernel patching protection', - 'prevent access to security websites', - 'remove sms warning messages', - 'modify security program configuration', - 'prevent security program from running', - 'disable system update services/daemons', - 'disable system service pack/patch installation', - 'disable system file overwrite protection', - 'disable privilege limiting', - 'gather security product info', - 'disable os security alerts', - 'disable user account control', - ) TERM_STOP_EXECUTION_OF_SECURITY_PROGRAM = 'stop execution of security program' TERM_DISABLE_FIREWALL = 'disable firewall' TERM_DISABLE_ACCESS_RIGHT_CHECKING = 'disable access right checking' @@ -1454,19 +873,11 @@ class SecurityDegradationTacticalObjectives(VocabString): TERM_DISABLE_OS_SECURITY_ALERTS = 'disable os security alerts' TERM_DISABLE_USER_ACCOUNT_CONTROL = 'disable user account control' - +@vocabs.add_allowed_values class MalwareConfigurationParameter(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareConfigurationParameterVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'magic number', - 'id', - 'group id', - 'mutex', - 'filename', - 'installation path', - ) TERM_MAGIC_NUMBER = 'magic number' TERM_GROUP_ID = 'group id' TERM_FILENAME = 'filename' @@ -1474,31 +885,18 @@ class MalwareConfigurationParameter(VocabString): TERM_INSTALLATION_PATH = 'installation path' TERM_ID = 'id' - +@vocabs.add_allowed_values class MachineAccessControlProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'backdoor type', - ) TERM_BACKDOOR_TYPE = 'backdoor type' - +@vocabs.add_allowed_values class ServiceActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ServiceActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'create service', - 'delete service', - 'start service', - 'stop service', - 'enumerate services', - 'modify service configuration', - 'open service', - 'send control code to service', - ) TERM_SEND_CONTROL_CODE_TO_SERVICE = 'send control code to service' TERM_MODIFY_SERVICE_CONFIGURATION = 'modify service configuration' TERM_CREATE_SERVICE = 'create service' @@ -1508,51 +906,29 @@ class ServiceActionName(VocabString): TERM_DELETE_SERVICE = 'delete service' TERM_OPEN_SERVICE = 'open service' - +@vocabs.add_allowed_values class AntiBehavioralAnalysisStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'anti-vm', - 'anti-sandbox', - ) TERM_ANTI_VM = 'anti-vm' TERM_ANTI_SANDBOX = 'anti-sandbox' - +@vocabs.add_allowed_values class CapabilityObjectiveRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CapabilityObjectiveRelationshipVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'child of', - 'parent of', - 'incorporates', - 'incorporated by', - ) TERM_CHILD_OF = 'child of' TERM_PARENT_OF = 'parent of' TERM_INCORPORATED_BY = 'incorporated by' TERM_INCORPORATES = 'incorporates' - +@vocabs.add_allowed_values class DataExfiltrationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'exfiltrate via covert channel', - 'exfiltrate via fax', - 'exfiltrate via physical media', - 'encrypt data', - 'exfiltrate via network', - 'hide data', - 'package data', - 'exfiltrate via dumpster dive', - 'move data to staging server', - 'exfiltrate via voip/phone', - ) TERM_EXFILTRATE_VIA_COVERT_CHANNEL = 'exfiltrate via covert channel' TERM_EXFILTRATE_VIA_FAX = 'exfiltrate via fax' TERM_EXFILTRATE_VIA_PHYSICAL_MEDIA = 'exfiltrate via physical media' @@ -1564,22 +940,11 @@ class DataExfiltrationTacticalObjectives(VocabString): TERM_MOVE_DATA_TO_STAGING_SERVER = 'move data to staging server' TERM_EXFILTRATE_VIA_VOIP_PHONE = 'exfiltrate via voip/phone' - +@vocabs.add_allowed_values class UserActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:UserActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'add user', - 'delete user', - 'enumerate users', - 'get user attributes', - 'logon as user', - 'change password', - 'add user to group', - 'remove user from group', - 'invoke user privilege', - ) TERM_DELETE_USER = 'delete user' TERM_CHANGE_PASSWORD = 'change password' TERM_LOGON_AS_USER = 'logon as user' @@ -1590,99 +955,38 @@ class UserActionName(VocabString): TERM_INVOKE_USER_PRIVILEGE = 'invoke user privilege' TERM_GET_USER_ATTRIBUTES = 'get user attributes' - +@vocabs.add_allowed_values class DestructionStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'destroy physical entity', - 'destroy virtual entity', - ) TERM_DESTROY_PHYSICAL_ENTITY = 'destroy physical entity' TERM_DESTROY_VIRTUAL_ENTITY = 'destroy virtual entity' - +@vocabs.add_allowed_values class AntiRemovalStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiRemovalStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'prevent malware artifact access', - 'prevent malware artifact deletion', - ) TERM_PREVENT_MALWARE_ARTIFACT_ACCESS = 'prevent malware artifact access' TERM_PREVENT_MALWARE_ARTIFACT_DELETION = 'prevent malware artifact deletion' - +@vocabs.add_allowed_values class SecondaryOperationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'install secondary module', - 'install secondary malware', - 'install legitimate software', - 'remove self', - 'remove system artifacts', - ) TERM_INSTALL_SECONDARY_MODULE = 'install secondary module' TERM_INSTALL_SECONDARY_MALWARE = 'install secondary malware' TERM_INSTALL_LEGITIMATE_SOFTWARE = 'install legitimate software' TERM_REMOVE_SELF = 'remove self' TERM_REMOVE_SYSTEM_ARTIFACTS = 'remove system artifacts' - +@vocabs.add_allowed_values class MalwareLabel(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareLabelVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'adware', - 'appender', - 'backdoor', - 'boot sector virus', - 'bot', - 'clicker', - 'companion virus', - 'cavity filler', - 'data diddler', - 'downloader', - 'dropper file', - 'file infector virus', - 'fork bomb', - 'greyware', - 'implant', - 'infector', - 'keylogger', - 'kleptographic worm', - 'macro virus', - 'malcode', - 'mass-mailer', - 'metamorphic virus', - 'mid-infector', - 'mobile code', - 'multipartite virus', - 'password stealer', - 'polymorphic virus', - 'premium dialer/smser', - 'prepender', - 'ransomware', - 'rat', - 'rogue anti-malware', - 'rootkit', - 'shellcode', - 'spaghetti packer', - 'spyware', - 'trojan horse', - 'variant', - 'virus', - 'wabbit', - 'web bug', - 'wiper', - 'worm', - 'zip bomb', - ) TERM_DATA_DIDDLER = 'data diddler' TERM_PASSWORD_STEALER = 'password stealer' TERM_ADWARE = 'adware' @@ -1728,30 +1032,18 @@ class MalwareLabel(VocabString): TERM_FILE_INFECTOR_VIRUS = 'file infector virus' TERM_TROJAN_HORSE = 'trojan horse' - +@vocabs.add_allowed_values class SecurityDegradationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'targeted program', - ) TERM_TARGETED_PROGRAM = 'targeted program' - +@vocabs.add_allowed_values class DiskActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DiskActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - _ALLOWED_VALUES = ( - 'get disk type', - 'get disk attributes', - 'mount disk', - 'unmount disk', - 'emulate disk', - 'list disks', - 'monitor disk', - ) TERM_GET_DISK_ATTRIBUTES = 'get disk attributes' TERM_GET_DISK_TYPE = 'get disk type' TERM_MONITOR_DISK = 'monitor disk' @@ -1760,19 +1052,11 @@ class DiskActionName(VocabString): TERM_EMULATE_DISK = 'emulate disk' TERM_UNMOUNT_DISK = 'unmount disk' - +@vocabs.add_allowed_values class IntegrityViolationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IntegrityViolationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'subvert system', - 'corrupt system data', - 'annoy local system user', - 'intercept/manipulate network traffic', - 'annoy remote user', - 'corrupt user data', - ) TERM_SUBVERT_SYSTEM = 'subvert system' TERM_CORRUPT_SYSTEM_DATA = 'corrupt system data' TERM_ANNOY_LOCAL_SYSTEM_USER = 'annoy local system user' @@ -1780,33 +1064,11 @@ class IntegrityViolationTacticalObjectives(VocabString): TERM_ANNOY_REMOTE_USER = 'annoy remote user' TERM_CORRUPT_USER_DATA = 'corrupt user data' - +@vocabs.add_allowed_values class AntiDetectionTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiDetectionTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - _ALLOWED_VALUES = ( - 'hide open network ports', - 'execute before/external to kernel/hypervisor', - 'encrypt self', - 'hide processes', - 'hide network traffic', - 'change/add content', - 'execute stealthy code', - 'hide registry artifacts', - 'hide userspace libraries', - 'hide arbitrary virtual memory', - 'execute non-main cpu code', - 'feed misinformation during physical memory acquisition', - 'prevent physical memory acquisition', - 'prevent native api hooking', - 'obfuscate artifact properties', - 'hide kernel modules', - 'hide code in file', - 'hide services', - 'hide file system artifacts', - 'hide threads', - ) TERM_HIDE_FILE_SYSTEM_ARTIFACTS = 'hide file system artifacts' TERM_HIDE_OPEN_NETWORK_PORTS = 'hide open network ports' TERM_EXECUTE_BEFORE_EXTERNAL_TO_KERNEL_HYPERVISOR = 'execute before/external to kernel/hypervisor' From 76f0048b1c047b73f3c94b32eb08a78761682af4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Apr 2015 14:36:58 -0400 Subject: [PATCH 185/297] Added new EnumString class and CapabilityName instance --- maec/vocabs/vocabs.py | 82 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 81 insertions(+), 1 deletion(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 26ce432..6adcddd 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1,8 +1,68 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. +import maec from cybox.common import vocabs, VocabString +class EnumString(maec.Entity): + # All subclasses should override this + _ALLOWED_VALUES = None + + def __init__(self, value=None): + super(EnumString, self).__init__() + self.value = value + + @property + def value(self): + return self._value + + @value.setter + def value(self, v): + allowed = self._ALLOWED_VALUES + + if not v: + self._value = None + elif allowed and (v not in allowed): + error = "Value must be one of {0}. Received '{1}'" + error = error.format(allowed, v) + raise ValueError(error) + else: + self._value = v + + def __str__(self): + return str(self.value) + + def __eq__(self, other): + return other == self.value + + def to_obj(self, return_obj=None, ns_info=None): + return self.value + + def to_dict(self): + return self.value + + @classmethod + def from_obj(cls, vocab_obj, return_obj=None): + if not vocab_obj: + return None + + return_obj = EnumString() + if isinstance(vocab_obj, basestring): + return_obj.value = vocab_obj + + return return_obj + + @classmethod + def from_dict(cls, vocab_dict, return_obj=None): + if not vocab_dict: + return None + + return_obj = EnumString() + if isinstance(vocab_dict, basestring): + return_obj.value = vocab_dict + + return return_obj + @vocabs.add_allowed_values class DataTheftTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' @@ -1090,7 +1150,27 @@ class AntiDetectionTacticalObjectives(VocabString): TERM_HIDE_NETWORK_TRAFFIC = 'hide network traffic' TERM_HIDE_THREADS = 'hide threads' - +class CapabilityName(EnumString): + _ALLOWED_VALUES = ['command and control', + 'remote machine manipulation', + 'privilege escalation', + 'data theft', + 'spying', + 'secondary operation', + 'anti-detection', + 'anti-code analysis', + 'infection/propagation', + 'anti-behavioral analysis', + 'integrity violation', + 'data exfiltration', + 'probing', + 'anti-removal', + 'security degradation', + 'availability violation', + 'destruction', + 'fraud', + 'persistence', + 'machine access/control'] #: Mapping of Controlled Vocabulary xsi:type's to their class implementations. _VOCAB_MAP = {} From 0d1480e35e6a921423485ca2bea5296827e54481 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 22 Apr 2015 14:37:22 -0400 Subject: [PATCH 186/297] Updated Name on Capability to use new CapabilityName class --- maec/bundle/capability.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index d730ea5..cf77380 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -11,6 +11,7 @@ import maec.bindings.maec_bundle as bundle_binding from maec.bundle import BehaviorReference from cybox.common import VocabString, String +from maec.vocabs.vocabs import CapabilityName class CapabilityObjectiveReference(maec.Entity): _namespace = _namespace @@ -92,7 +93,7 @@ class Capability(maec.Entity): _binding_class = bundle_binding.CapabilityType id_ = maec.TypedField("id") - name = maec.TypedField("name") + name = maec.TypedField("name", CapabilityName) description = maec.TypedField("Description") property = maec.TypedField("Property", CapabilityProperty, multiple = True) strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple = True) From 60a6298637440cb17226935ec5c3a47702b39a9c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 08:55:25 -0400 Subject: [PATCH 187/297] Removed unused import --- maec/package/analysis.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index c6e4194..cfc7072 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -6,7 +6,6 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 -import cybox from cybox.common import (PlatformSpecification, Personnel, StructuredText, ToolInformation) from cybox.objects.system_object import System From 794ccad8af1c04e9d959982e55a09f18bf77c2d6 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 08:59:49 -0400 Subject: [PATCH 188/297] Removed unused import --- maec/bundle/bundle.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 2808189..1844c64 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -6,9 +6,6 @@ # Compatible with MAEC v4.1 # Last updated 10/21/2014 - -import datetime - from cybox.core import Object from cybox.utils.normalize import normalize_object_properties From ef4587494368fab59f45d552f0fc843293f7a6a4 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:00:52 -0400 Subject: [PATCH 189/297] Removed unused import --- maec/bundle/bundle.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 1844c64..4b71319 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -12,8 +12,7 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import (MalwareAction, AVClassifications, Behavior, - CandidateIndicator, CandidateIndicatorList, +from maec.bundle import (MalwareAction, AVClassifications, Behavior, CandidateIndicatorList, ActionReferenceList, ProcessTree, CapabilityList, ObjectHistory) from maec.utils import BundleComparator, BundleDeduplicator From 7299b0e91dd5551a9d984b7ea48a57887c4eda45 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:03:08 -0400 Subject: [PATCH 190/297] Removed unused imports --- maec/package/malware_subject.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index c61b05b..41aaea4 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -6,8 +6,7 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 -import cybox -from cybox.common import VocabString, PlatformSpecification, ToolInformationList, ToolInformation +from cybox.common import VocabString, PlatformSpecification, ToolInformation from cybox.objects.file_object import File from cybox.objects.uri_object import URI from cybox.core import Object From 68d54dccaba99db89ecef40c61a4a1439969de09 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:04:58 -0400 Subject: [PATCH 191/297] Removed unused import --- maec/package/grouping_relationship.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 0ac07dc..1ea68ad 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -6,7 +6,6 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 -import cybox import maec from . import _namespace import maec.bindings.maec_package as package_binding From 519978b510d2642ca645b41dc10642ae59a30d42 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:06:09 -0400 Subject: [PATCH 192/297] Removed unused import --- maec/package/object_equivalence.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 3def53f..8758fa1 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -6,7 +6,6 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 -import cybox import maec from . import _namespace import maec.bindings.maec_package as package_binding From 529dc96894ecfd36faa482b70a1f8192d3174f4f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:06:59 -0400 Subject: [PATCH 193/297] Removed unused import --- maec/package/malware_subject_reference.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 4dbd060..16e646b 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -9,7 +9,6 @@ import maec from . import _namespace import maec.bindings.maec_package as package_binding -import cybox class MalwareSubjectReference(maec.Entity): _binding = package_binding From 0be676e3a844f8e13af70cb35264a4642ddbff4f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:09:00 -0400 Subject: [PATCH 194/297] Removed unused import --- maec/bundle/process_tree.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 62a9ae6..8d6ae1f 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -8,7 +8,6 @@ import cybox from cybox.objects.process_object import Process -from cybox.core import ActionReference import maec from . import _namespace From 1dd8184f1ce6015595d18078aa72d8ea2a853df9 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:10:03 -0400 Subject: [PATCH 195/297] Removed unused import --- maec/package/package.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/maec/package/package.py b/maec/package/package.py index b73ae34..0469425 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -6,16 +6,11 @@ #Compatible with MAEC v4.1 #Last updated 08/20/2014 -from cybox.common import DateTime - import maec import maec.bindings.maec_package as package_binding from maec.package import MalwareSubjectList, GroupingRelationshipList - from . import _namespace - - class Package(maec.Entity): _binding = package_binding _binding_class = package_binding.PackageType From 7ea53fbd5bf8e34bf0e496577153916e319b60f1 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:11:05 -0400 Subject: [PATCH 196/297] Removed unused import --- maec/bundle/behavior.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index ada0206..6486945 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -9,7 +9,6 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import MalwareAction from cybox.core.action_reference import ActionReference from cybox.common.measuresource import MeasureSource from cybox.common.platform_specification import PlatformSpecification From 9ca389d204337f00d85d3c7c67709a83bfd63029 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:11:25 -0400 Subject: [PATCH 197/297] Removed unused import --- maec/bundle/behavior.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 6486945..4f4197b 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -14,7 +14,6 @@ from cybox.common.platform_specification import PlatformSpecification from cybox.objects.code_object import Code #from maec.bundle.bundle import ActionCollection -import datetime class BehavioralActionEquivalenceReference(maec.Entity): _binding = bundle_binding From 42f3e249f1eaeba0bd5b471c27a515992afde6de Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:14:09 -0400 Subject: [PATCH 198/297] Removed unused imports --- maec/utils/nsparser.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 9e81316..abf7f98 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -6,9 +6,7 @@ #Compatible with MAEC v4.1 #Last updated 02/18/2014 -import maec.bindings.maec_bundle as bundle_binding -import maec.bindings.maec_package as package_binding -from cybox.utils import Namespace, META +from cybox.utils import Namespace import itertools From 1f875b47dc0c38ec2107888d372ce878145a0276 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:14:26 -0400 Subject: [PATCH 199/297] Removed unused imports --- maec/utils/nsparser.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index abf7f98..52fced7 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -8,8 +8,6 @@ from cybox.utils import Namespace -import itertools - class Metadata(object): """Metadata about MAEC namespaces.""" From 241dfad93654fb80fcd69c2bbfaa5f9f43cdd9cb Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:16:03 -0400 Subject: [PATCH 200/297] Removed unused imports --- maec/utils/merge.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index f4c2c2d..b171668 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -2,14 +2,12 @@ # See LICENSE.txt for complete terms. # Methods for merging MAEC documents -import sys import itertools import maec from copy import deepcopy from cybox.core import Object from cybox.common import HashList from cybox.utils import Namespace -from maec.bundle import Bundle from maec.package import (Package, MalwareSubject, MalwareConfigurationDetails, FindingsBundleList, MetaAnalysis, Analyses, MinorVariants, MalwareSubjectRelationshipList, From 52b286b41e3b357fb4c43aafd320d2e755e34d46 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:17:21 -0400 Subject: [PATCH 201/297] Removed unused import --- maec/utils/parser.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/utils/parser.py b/maec/utils/parser.py index bd752f8..b94f79e 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -2,7 +2,6 @@ # See LICENSE.txt for complete terms. import maec -from distutils.version import StrictVersion from lxml import etree class UnsupportedVersionError(Exception): From f636dc73e64f6c22722f61381788eb18e3a02489 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 09:36:03 -0400 Subject: [PATCH 202/297] Removed unnecessary last updated/compatible text --- maec/bundle/action_reference_list.py | 2 -- maec/bundle/av_classification.py | 2 -- maec/bundle/behavior.py | 3 --- maec/bundle/behavior_reference.py | 2 -- maec/bundle/bundle.py | 3 --- maec/bundle/bundle_reference.py | 3 --- maec/bundle/candidate_indicator.py | 3 --- maec/bundle/capability.py | 3 --- maec/bundle/malware_action.py | 3 --- maec/bundle/object_history.py | 3 --- maec/bundle/object_reference.py | 3 --- maec/bundle/process_tree.py | 3 --- maec/package/action_equivalence.py | 3 --- maec/package/analysis.py | 9 +++------ maec/package/grouping_relationship.py | 8 +++----- maec/package/malware_subject.py | 9 +++------ maec/package/malware_subject_reference.py | 9 +++------ maec/package/object_equivalence.py | 9 +++------ maec/package/package.py | 9 +++------ 19 files changed, 18 insertions(+), 71 deletions(-) diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index 6188a41..dd62218 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -3,8 +3,6 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 from cybox.core import ActionReference diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index cc02f34..fd51992 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -3,8 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 09/26/2014 import maec from . import _namespace diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 4f4197b..9ad589f 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/27/2014 - import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index a18cd16..220e58a 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -3,8 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/28/2014 import maec from . import _namespace diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 4b71319..5898b9a 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 10/21/2014 - from cybox.core import Object from cybox.utils.normalize import normalize_object_properties diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index 43b533d..a7f7994 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -3,9 +3,6 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved -#Compatible with MAEC v4.1 -#Last updated 08/14/2014 - import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index cbe575e..7fbe33d 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/27/2014 - import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index d730ea5..89c058b 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 8/26/2014 - import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 384aebb..8f1d10b 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/27/2014 - import cybox from cybox.core import Action from cybox.objects.code_object import Code diff --git a/maec/bundle/object_history.py b/maec/bundle/object_history.py index bf60c56..df56ddf 100644 --- a/maec/bundle/object_history.py +++ b/maec/bundle/object_history.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 11/12/2014 - class ObjectHistory(object): @classmethod def build(cls, bundle): diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index 8bab39d..360d1c1 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/28/2014 - import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 8d6ae1f..5dd1c4a 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -3,9 +3,6 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -# Compatible with MAEC v4.1 -# Last updated 08/27/2014 - import cybox from cybox.objects.process_object import Process diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index acc4524..be2bb6f 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -3,9 +3,6 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 - import maec from . import _namespace import maec.bindings.maec_package as package_binding diff --git a/maec/package/analysis.py b/maec/package/analysis.py index cfc7072..bc5c377 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -1,10 +1,7 @@ -#MAEC Analysis Class +# MAEC Analysis Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved from cybox.common import (PlatformSpecification, Personnel, StructuredText, ToolInformation) diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 1ea68ad..96c3b9f 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -1,10 +1,8 @@ -#MAEC Grouping Relationship Class +# MAEC Grouping Relationship Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 import maec from . import _namespace diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 41aaea4..b413642 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -1,10 +1,7 @@ -#MAEC Malware Subject Class +# MAEC Malware Subject Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved from cybox.common import VocabString, PlatformSpecification, ToolInformation from cybox.objects.file_object import File diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 16e646b..63de6ce 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -1,10 +1,7 @@ -#MAEC Malware Subject Reference Class +# MAEC Malware Subject Reference Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved import maec from . import _namespace diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 8758fa1..6be9d10 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -1,10 +1,7 @@ -#MAEC Action Equivalence Class +# MAEC Action Equivalence Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved import maec from . import _namespace diff --git a/maec/package/package.py b/maec/package/package.py index 0469425..7bc553a 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -1,10 +1,7 @@ -#MAEC Package Class +# MAEC Package Class -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -#Compatible with MAEC v4.1 -#Last updated 08/20/2014 +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved import maec import maec.bindings.maec_package as package_binding From 20369c15b3f80c5425a68ca5c24b1a3f40940457 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 10:17:02 -0400 Subject: [PATCH 203/297] Removed unused import --- maec/bundle/bundle.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 5898b9a..efeb5db 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -9,8 +9,8 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import (MalwareAction, AVClassifications, Behavior, CandidateIndicatorList, - ActionReferenceList, ProcessTree, CapabilityList, +from maec.bundle import (MalwareAction, AVClassifications, Behavior, + CandidateIndicatorList, ProcessTree, CapabilityList, ObjectHistory) from maec.utils import BundleComparator, BundleDeduplicator From ec8744bb3257e603aa26a0a39f94ab0532acb730 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 23 Apr 2015 15:38:15 -0400 Subject: [PATCH 204/297] Updatd CapabilityName to use add_allowed_values decorator --- maec/vocabs/vocabs.py | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 6adcddd..2e84274 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1150,27 +1150,28 @@ class AntiDetectionTacticalObjectives(VocabString): TERM_HIDE_NETWORK_TRAFFIC = 'hide network traffic' TERM_HIDE_THREADS = 'hide threads' +@vocabs.add_allowed_values class CapabilityName(EnumString): - _ALLOWED_VALUES = ['command and control', - 'remote machine manipulation', - 'privilege escalation', - 'data theft', - 'spying', - 'secondary operation', - 'anti-detection', - 'anti-code analysis', - 'infection/propagation', - 'anti-behavioral analysis', - 'integrity violation', - 'data exfiltration', - 'probing', - 'anti-removal', - 'security degradation', - 'availability violation', - 'destruction', - 'fraud', - 'persistence', - 'machine access/control'] + TERM_COMMAND_AND_CONTROL = "command and control" + TERM_REMOTE_MACHINE_MANIPULATION = "remote machine manipulation" + TERM_PRIVILEGE_ESCALATION = "privilege escalation" + TERM_DATA_THEFT = "data theft" + TERM_SPYING = "spying" + TERM_SECONDARY_OPERATION = "secondary operation" + TERM_ANTI_DETECTION = "anti-detection" + TERM_ANTI_CODE_ANALYSIS = "anti-code analysis" + TERM_INFECTION_PROPAGATION = "infection/propagation" + TERM_ANTI_BEHAVIORAL_ANALYSIS = "anti-behavioral analysis" + TERM_INTEGRITY_VIOLATION = "integrity violation" + TERM_DATA_EXFILTRATION = "data exfiltration" + TERM_PROBING = "probing" + TERM_ANTI_REMOVAL = "anti-removal" + TERM_SECURITY_DEGRADATION = "security degradation" + TERM_AVAILABILITY_VIOLATION = "availability violation" + TERM_DESTRUCTION = "destruction" + TERM_FRAUD = "fraud" + TERM_PERSISTENCE = "persistence" + TERM_MACHINE_ACCESS_CONTROL = "machine access/control" #: Mapping of Controlled Vocabulary xsi:type's to their class implementations. _VOCAB_MAP = {} From d6deff8d745519acccf987636615eaa64db0f22c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Fri, 24 Apr 2015 10:39:44 -0400 Subject: [PATCH 205/297] Updated EnumString to subclass off object instead of Entity --- maec/vocabs/vocabs.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 2e84274..c2f9ae1 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -4,7 +4,7 @@ import maec from cybox.common import vocabs, VocabString -class EnumString(maec.Entity): +class EnumString(object): # All subclasses should override this _ALLOWED_VALUES = None @@ -63,6 +63,10 @@ def from_dict(cls, vocab_dict, return_obj=None): return return_obj + @classmethod + def istypeof(cls, obj): + return isinstance(obj, cls) + @vocabs.add_allowed_values class DataTheftTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' From 9b1b54e25a63847424abbff90ca7947253fbf873 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 24 Apr 2015 15:58:56 -0500 Subject: [PATCH 206/297] Clean up vocabs --- maec/bundle/capability.py | 5 +- maec/vocabs/vocabs.py | 1093 +++++++++++++++++++------------------ 2 files changed, 577 insertions(+), 521 deletions(-) diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index ab520e9..04176d8 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -8,7 +8,8 @@ import maec.bindings.maec_bundle as bundle_binding from maec.bundle import BehaviorReference from cybox.common import VocabString, String -from maec.vocabs.vocabs import CapabilityName +from maec.vocabs.vocabs import MalwareCapability + class CapabilityObjectiveReference(maec.Entity): _namespace = _namespace @@ -90,7 +91,7 @@ class Capability(maec.Entity): _binding_class = bundle_binding.CapabilityType id_ = maec.TypedField("id") - name = maec.TypedField("name", CapabilityName) + name = maec.TypedField("name", MalwareCapability) description = maec.TypedField("Description") property = maec.TypedField("Property", CapabilityProperty, multiple = True) strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple = True) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index c2f9ae1..e4b53ab 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -2,7 +2,7 @@ # See LICENSE.txt for complete terms. import maec -from cybox.common import vocabs, VocabString +from cybox.common.vocabs import VocabString, register_vocab class EnumString(object): # All subclasses should override this @@ -67,1208 +67,1263 @@ def from_dict(cls, vocab_dict, return_obj=None): def istypeof(cls, obj): return isinstance(obj, cls) -@vocabs.add_allowed_values + +@register_vocab class DataTheftTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_STEAL_BROWSER_CACHE = 'steal browser cache' + TERM_STEAL_BROWSER_HISTORY = 'steal browser history' + TERM_STEAL_CONTACT_LIST_DATA = 'steal contact list data' + TERM_STEAL_COOKIE = 'steal cookie' + TERM_STEAL_CRYPTOCURRENCY_DATA = 'steal cryptocurrency data' + TERM_STEAL_DATABASE_CONTENT = 'steal database content' TERM_STEAL_DIALED_PHONE_NUMBERS = 'steal dialed phone numbers' + TERM_STEAL_DOCUMENTS = 'steal documents' TERM_STEAL_EMAIL_DATA = 'steal email data' + TERM_STEAL_IMAGES = 'steal images' + TERM_STEAL_MAKE_MODEL = 'steal make/model' + TERM_STEAL_NETWORK_ADDRESS = 'steal network address' + TERM_STEAL_OPEN_PORT = 'steal open port' + TERM_STEAL_PASSWORD_HASH = 'steal password hash' TERM_STEAL_PKI_KEY = 'steal pki key' - TERM_STEAL_CRYPTOCURRENCY_DATA = 'steal cryptocurrency data' TERM_STEAL_PKI_SOFTWARE_CERTIFICATE = 'steal pki software certificate' - TERM_STEAL_BROWSER_CACHE = 'steal browser cache' + TERM_STEAL_REFERRER_URLS = 'steal referrer urls' TERM_STEAL_SERIAL_NUMBERS = 'steal serial numbers' TERM_STEAL_SMS_DATABASE = 'steal sms database' - TERM_STEAL_COOKIE = 'steal cookie' - TERM_STEAL_PASSWORD_HASH = 'steal password hash' - TERM_STEAL_MAKE_MODEL = 'steal make/model' - TERM_STEAL_DOCUMENTS = 'steal documents' - TERM_STEAL_CONTACT_LIST_DATA = 'steal contact list data' - TERM_STEAL_REFERRER_URLS = 'steal referrer urls' - TERM_STEAL_DATABASE_CONTENT = 'steal database content' - TERM_STEAL_BROWSER_HISTORY = 'steal browser history' TERM_STEAL_WEB_NETWORK_CREDENTIAL = 'steal web/network credential' - TERM_STEAL_IMAGES = 'steal images' - TERM_STEAL_NETWORK_ADDRESS = 'steal network address' - TERM_STEAL_OPEN_PORT = 'steal open port' -@vocabs.add_allowed_values + +@register_vocab class MachineAccessControlTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CONTROL_MACHINE_VIA_REMOTE_COMMAND = 'control machine via remote command' -@vocabs.add_allowed_values + +@register_vocab class DataTheftProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_TARGETED_APPLICATION = 'targeted application' TERM_TARGETED_WEBSITE = 'targeted website' -@vocabs.add_allowed_values + +@register_vocab class SecondaryOperationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_TRIGGER_TYPE = 'trigger type' -@vocabs.add_allowed_values + +@register_vocab class SystemActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SystemActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_ENUMERATE_SYSTEM_HANDLES = 'enumerate system handles' + TERM_ADD_SCHEDULED_TASK = 'add scheduled task' - TERM_GET_WINDOWS_DIRECTORY = 'get windows directory' - TERM_SLEEP_SYSTEM = 'sleep system' + TERM_ENUMERATE_SYSTEM_HANDLES = 'enumerate system handles' TERM_GET_ELAPSED_SYSTEM_UP_TIME = 'get elapsed system up time' - TERM_SET_SYSTEM_HOST_NAME = 'set system host name' - TERM_SHUTDOWN_SYSTEM = 'shutdown system' TERM_GET_NETBIOS_NAME = 'get netbios name' - TERM_GET_SYSTEM_TIME = 'get system time' - TERM_SET_SYSTEM_LOCAL_TIME = 'set system local time' - TERM_SET_SYSTEM_TIME = 'set system time' - TERM_GET_WINDOWS_TEMPORARY_FILES_DIRECTORY = 'get windows temporary files directory' + TERM_GET_SYSTEM_GLOBAL_FLAGS = 'get system global flags' + TERM_GET_SYSTEM_HOST_NAME = 'get system host name' TERM_GET_SYSTEM_LOCAL_TIME = 'get system local time' + TERM_GET_SYSTEM_TIME = 'get system time' TERM_GET_USERNAME = 'get username' - TERM_SET_NETBIOS_NAME = 'set netbios name' + TERM_GET_WINDOWS_DIRECTORY = 'get windows directory' TERM_GET_WINDOWS_SYSTEM_DIRECTORY = 'get windows system directory' - TERM_GET_SYSTEM_HOST_NAME = 'get system host name' - TERM_GET_SYSTEM_GLOBAL_FLAGS = 'get system global flags' + TERM_GET_WINDOWS_TEMPORARY_FILES_DIRECTORY = 'get windows temporary files directory' + TERM_SET_NETBIOS_NAME = 'set netbios name' TERM_SET_SYSTEM_GLOBAL_FLAGS = 'set system global flags' + TERM_SET_SYSTEM_HOST_NAME = 'set system host name' + TERM_SET_SYSTEM_LOCAL_TIME = 'set system local time' + TERM_SET_SYSTEM_TIME = 'set system time' + TERM_SHUTDOWN_SYSTEM = 'shutdown system' + TERM_SLEEP_SYSTEM = 'sleep system' -@vocabs.add_allowed_values + +@register_vocab class AvailabilityViolationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_DENIAL_OF_SERVICE = 'denial of service' + TERM_COMPROMISE_ACCESS_TO_INFORMATION_ASSETS = 'compromise access to information assets' TERM_COMPROMISE_LOCAL_SYSTEM_AVAILABILITY = 'compromise local system availability' - TERM_MINE_FOR_CRYPTOCURRENCY = 'mine for cryptocurrency' TERM_CRACK_PASSWORDS = 'crack passwords' + TERM_DENIAL_OF_SERVICE = 'denial of service' + TERM_MINE_FOR_CRYPTOCURRENCY = 'mine for cryptocurrency' -@vocabs.add_allowed_values + +@register_vocab class ActionObjectAssociationType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_INPUT = 'input' - TERM_SIDE_EFFECT = 'side-effect' TERM_OUTPUT = 'output' + TERM_SIDE_EFFECT = 'side-effect' -@vocabs.add_allowed_values + +@register_vocab class CommonCapabilityProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommonCapabilityPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ENCRYPTION_ALGORITHM = 'encryption algorithm' TERM_PROTOCOL_USED = 'protocol used' -@vocabs.add_allowed_values + +@register_vocab class RemoteMachineManipulationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_COMPROMISE_REMOTE_MACHINE = 'compromise remote machine' -@vocabs.add_allowed_values + +@register_vocab class PrivilegeEscalationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_IMPERSONATE_USER = 'impersonate user' + TERM_ESCALATE_USER_PRIVILEGE = 'escalate user privilege' + TERM_IMPERSONATE_USER = 'impersonate user' -@vocabs.add_allowed_values + +@register_vocab class DebuggingActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DebuggingActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CHECK_FOR_KERNEL_DEBUGGER = 'check for kernel debugger' TERM_CHECK_FOR_REMOTE_DEBUGGER = 'check for remote debugger' -@vocabs.add_allowed_values + +@register_vocab class DataExfiltrationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_STAGE_DATA_FOR_EXFILTRATION = 'stage data for exfiltration' + TERM_OBFUSCATE_DATA_FOR_EXFILTRATION = 'obfuscate data for exfiltration' TERM_PERFORM_DATA_EXFILTRATION = 'perform data exfiltration' + TERM_STAGE_DATA_FOR_EXFILTRATION = 'stage data for exfiltration' -@vocabs.add_allowed_values + +@register_vocab class DeviceDriverActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DeviceDriverActionNameVocab-1.1' _VOCAB_VERSION = '1.1' + + TERM_EMULATE_DRIVER = 'emulate driver' TERM_LOAD_AND_CALL_DRIVER = 'load and call driver' - TERM_UNLOAD_DRIVER = 'unload driver' TERM_LOAD_DRIVER = 'load driver' - TERM_EMULATE_DRIVER = 'emulate driver' + TERM_UNLOAD_DRIVER = 'unload driver' -@vocabs.add_allowed_values + +@register_vocab class ImportanceType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ImportanceTypeVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_MEDIUM = 'medium' - TERM_UNKNOWN = 'unknown' - TERM_NUMERIC = 'numeric' + TERM_HIGH = 'high' - TERM_LOW = 'low' TERM_INFORMATIONAL = 'informational' + TERM_LOW = 'low' + TERM_MEDIUM = 'medium' + TERM_NUMERIC = 'numeric' + TERM_UNKNOWN = 'unknown' -@vocabs.add_allowed_values + +@register_vocab class HTTPActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:HTTPActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_SEND_HTTP_PATCH_REQUEST = 'send http patch request' - TERM_SEND_HTTP_POST_REQUEST = 'send http post request' + + TERM_RECEIVE_HTTP_RESPONSE = 'receive http response' + TERM_SEND_HTTP_CONNECT_REQUEST = 'send http connect request' + TERM_SEND_HTTP_DELETE_REQUEST = 'send http delete request' TERM_SEND_HTTP_GET_REQUEST = 'send http get request' TERM_SEND_HTTP_HEAD_REQUEST = 'send http head request' - TERM_RECEIVE_HTTP_RESPONSE = 'receive http response' - TERM_SEND_HTTP_TRACE_REQUEST = 'send http trace request' TERM_SEND_HTTP_OPTIONS_REQUEST = 'send http options request' - TERM_SEND_HTTP_DELETE_REQUEST = 'send http delete request' - TERM_SEND_HTTP_CONNECT_REQUEST = 'send http connect request' + TERM_SEND_HTTP_PATCH_REQUEST = 'send http patch request' + TERM_SEND_HTTP_POST_REQUEST = 'send http post request' TERM_SEND_HTTP_PUT_REQUEST = 'send http put request' + TERM_SEND_HTTP_TRACE_REQUEST = 'send http trace request' -@vocabs.add_allowed_values + +@register_vocab class AntiDetectionStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiDetectionStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_SECURITY_SOFTWARE_EVASION = 'security software evasion' - TERM_HIDE_EXECUTING_CODE = 'hide executing code' - TERM_SELF_MODIFICATION = 'self-modification' + TERM_ANTI_MEMORY_FORENSICS = 'anti-memory forensics' - TERM_HIDE_NON_EXECUTING_CODE = 'hide non-executing code' + TERM_HIDE_EXECUTING_CODE = 'hide executing code' TERM_HIDE_MALWARE_ARTIFACTS = 'hide malware artifacts' + TERM_HIDE_NON_EXECUTING_CODE = 'hide non-executing code' + TERM_SECURITY_SOFTWARE_EVASION = 'security software evasion' + TERM_SELF_MODIFICATION = 'self-modification' -@vocabs.add_allowed_values + +@register_vocab class SocketActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SocketActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_ACCEPT_SOCKET_CONNECTION = 'accept socket connection' + TERM_BIND_ADDRESS_TO_SOCKET = 'bind address to socket' TERM_CLOSE_SOCKET = 'close socket' TERM_CONNECT_TO_SOCKET = 'connect to socket' - TERM_ACCEPT_SOCKET_CONNECTION = 'accept socket connection' - TERM_SEND_DATA_ON_SOCKET = 'send data on socket' - TERM_RECEIVE_DATA_ON_SOCKET = 'receive data on socket' - TERM_SEND_DATA_TO_ADDRESS_ON_SOCKET = 'send data to address on socket' TERM_CREATE_SOCKET = 'create socket' TERM_DISCONNECT_FROM_SOCKET = 'disconnect from socket' TERM_GET_HOST_BY_ADDRESS = 'get host by address' - TERM_LISTEN_ON_SOCKET = 'listen on socket' - TERM_BIND_ADDRESS_TO_SOCKET = 'bind address to socket' TERM_GET_HOST_BY_NAME = 'get host by name' + TERM_LISTEN_ON_SOCKET = 'listen on socket' + TERM_RECEIVE_DATA_ON_SOCKET = 'receive data on socket' + TERM_SEND_DATA_ON_SOCKET = 'send data on socket' + TERM_SEND_DATA_TO_ADDRESS_ON_SOCKET = 'send data to address on socket' -@vocabs.add_allowed_values + +@register_vocab class CommandandControlTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CHECK_FOR_PAYLOAD = 'check for payload' - TERM_VALIDATE_DATA = 'validate data' - TERM_UPDATE_CONFIGURATION = 'update configuration' - TERM_SEND_SYSTEM_INFORMATION = 'send system information' - TERM_SEND_HEARTBEAT_DATA = 'send heartbeat data' - TERM_GENERATE_C2_DOMAIN_NAME_S = 'generate c2 domain name(s)' TERM_CONTROL_MALWARE_VIA_REMOTE_COMMAND = 'control malware via remote command' + TERM_GENERATE_C2_DOMAIN_NAME_S = 'generate c2 domain name(s)' + TERM_SEND_HEARTBEAT_DATA = 'send heartbeat data' + TERM_SEND_SYSTEM_INFORMATION = 'send system information' + TERM_UPDATE_CONFIGURATION = 'update configuration' + TERM_VALIDATE_DATA = 'validate data' -@vocabs.add_allowed_values + +@register_vocab class HookingActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:HookingActionNameVocab-1.1' _VOCAB_VERSION = '1.1' + TERM_ADD_SYSTEM_CALL_HOOK = 'add system call hook' - TERM_HIDE_HOOK = 'hide hook' TERM_ADD_WINDOWS_HOOK = 'add windows hook' + TERM_HIDE_HOOK = 'hide hook' -@vocabs.add_allowed_values + +@register_vocab class GroupingRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:GroupingRelationshipVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_PART_OF_INTRUSION_SET = 'part of intrusion set' + TERM_CLUSTERED_TOGETHER = 'clustered together' - TERM_SAME_MALWARE_TOOLKIT = 'same malware toolkit' - TERM_SAME_MALWARE_FAMILY = 'same malware family' TERM_OBSERVED_TOGETHER = 'observed together' + TERM_PART_OF_INTRUSION_SET = 'part of intrusion set' + TERM_SAME_MALWARE_FAMILY = 'same malware family' + TERM_SAME_MALWARE_TOOLKIT = 'same malware toolkit' -@vocabs.add_allowed_values + +@register_vocab class PersistenceProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistencePropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_SCOPE = 'scope' -@vocabs.add_allowed_values + +@register_vocab class DestructionProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ERASURE_SCOPE = 'erasure scope' -@vocabs.add_allowed_values + +@register_vocab class AntiCodeAnalysisStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ANTI_DEBUGGING = 'anti-debugging' - TERM_CODE_OBFUSCATION = 'code obfuscation' TERM_ANTI_DISASSEMBLY = 'anti-disassembly' + TERM_CODE_OBFUSCATION = 'code obfuscation' -@vocabs.add_allowed_values + +@register_vocab class AvailabilityViolationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_CONSUME_SYSTEM_RESOURCES = 'consume system resources' + TERM_COMPROMISE_DATA_AVAILABILITY = 'compromise data availability' TERM_COMPROMISE_SYSTEM_AVAILABILITY = 'compromise system availability' + TERM_CONSUME_SYSTEM_RESOURCES = 'consume system resources' -@vocabs.add_allowed_values + +@register_vocab class IPCActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IPCActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_DISCONNECT_FROM_NAMED_PIPE = 'disconnect from named pipe' - TERM_READ_FROM_NAMED_PIPE = 'read from named pipe' + + TERM_CONNECT_TO_NAMED_PIPE = 'connect to named pipe' TERM_CREATE_MAILSLOT = 'create mailslot' - TERM_READ_FROM_MAILSLOT = 'read from mailslot' TERM_CREATE_NAMED_PIPE = 'create named pipe' TERM_DELETE_NAMED_PIPE = 'delete named pipe' - TERM_WRITE_TO_NAMED_PIPE = 'write to named pipe' - TERM_CONNECT_TO_NAMED_PIPE = 'connect to named pipe' + TERM_DISCONNECT_FROM_NAMED_PIPE = 'disconnect from named pipe' + TERM_READ_FROM_MAILSLOT = 'read from mailslot' + TERM_READ_FROM_NAMED_PIPE = 'read from named pipe' TERM_WRITE_TO_MAILSLOT = 'write to mailslot' + TERM_WRITE_TO_NAMED_PIPE = 'write to named pipe' -@vocabs.add_allowed_values + +@register_vocab class DirectoryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DirectoryActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_MONITOR_DIRECTORY = 'monitor directory' - TERM_DELETE_DIRECTORY = 'delete directory' + TERM_CREATE_DIRECTORY = 'create directory' + TERM_DELETE_DIRECTORY = 'delete directory' TERM_HIDE_DIRECTORY = 'hide directory' + TERM_MONITOR_DIRECTORY = 'monitor directory' -@vocabs.add_allowed_values + +@register_vocab class NetworkShareActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:NetworkShareActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_ENUMERATE_NETWORK_SHARES = 'enumerate network shares' - TERM_DISCONNECT_FROM_NETWORK_SHARE = 'disconnect from network share' - TERM_ADD_NETWORK_SHARE = 'add network share' + TERM_ADD_CONNECTION_TO_NETWORK_SHARE = 'add connection to network share' - TERM_DELETE_NETWORK_SHARE = 'delete network share' + TERM_ADD_NETWORK_SHARE = 'add network share' TERM_CONNECT_TO_NETWORK_SHARE = 'connect to network share' + TERM_DELETE_NETWORK_SHARE = 'delete network share' + TERM_DISCONNECT_FROM_NETWORK_SHARE = 'disconnect from network share' + TERM_ENUMERATE_NETWORK_SHARES = 'enumerate network shares' -@vocabs.add_allowed_values + +@register_vocab class InfectionPropagationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_AUTONOMY = 'autonomy' - TERM_TARGETED_FILE_TYPE = 'targeted file type' TERM_FILE_INFECTION_TYPE = 'file infection type' TERM_INFECTION_TARGETING = 'infection targeting' TERM_SCOPE = 'scope' TERM_TARGETED_FILE_ARCHITECTURE_TYPE = 'targeted file architecture type' + TERM_TARGETED_FILE_TYPE = 'targeted file type' -@vocabs.add_allowed_values + +@register_vocab class ProbingStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProbingStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_PROBE_NETWORK_ENVIRONMENT = 'probe network environment' + TERM_PROBE_HOST_CONFIGURATION = 'probe host configuration' + TERM_PROBE_NETWORK_ENVIRONMENT = 'probe network environment' -@vocabs.add_allowed_values + +@register_vocab class InfectionPropagationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_IDENTIFY_FILE = 'identify file' - TERM_PERFORM_AUTONOMOUS_REMOTE_INFECTION = 'perform autonomous remote infection' TERM_IDENTIFY_TARGET_MACHINE_S = 'identify target machine(s)' - TERM_PERFORM_SOCIAL_ENGINEERING_BASED_REMOTE_INFECTION = 'perform social-engineering based remote infection' TERM_INVENTORY_VICTIMS = 'inventory victims' - TERM_WRITE_CODE_INTO_FILE = 'write code into file' TERM_MODIFY_FILE = 'modify file' + TERM_PERFORM_AUTONOMOUS_REMOTE_INFECTION = 'perform autonomous remote infection' + TERM_PERFORM_SOCIAL_ENGINEERING_BASED_REMOTE_INFECTION = 'perform social-engineering based remote infection' + TERM_WRITE_CODE_INTO_FILE = 'write code into file' -@vocabs.add_allowed_values + +@register_vocab class DataExfiltrationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ARCHIVE_TYPE = 'archive type' TERM_FILE_TYPE = 'file type' -@vocabs.add_allowed_values + +@register_vocab class LibraryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:LibraryActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_GET_FUNCTION_ADDRESS = 'get function address' - TERM_LOAD_LIBRARY = 'load library' + TERM_CALL_LIBRARY_FUNCTION = 'call library function' - TERM_FREE_LIBRARY = 'free library' TERM_ENUMERATE_LIBRARIES = 'enumerate libraries' + TERM_FREE_LIBRARY = 'free library' + TERM_GET_FUNCTION_ADDRESS = 'get function address' + TERM_LOAD_LIBRARY = 'load library' -@vocabs.add_allowed_values + +@register_vocab class MalwareDevelopmentTool(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareDevelopmentToolVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_PACKER = 'packer' + TERM_BUILDER = 'builder' - TERM_LINKER = 'linker' + TERM_COMPILER = 'compiler' TERM_CRYPTER = 'crypter' + TERM_LINKER = 'linker' + TERM_PACKER = 'packer' TERM_PROTECTOR = 'protector' - TERM_COMPILER = 'compiler' -@vocabs.add_allowed_values + +@register_vocab class FileActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FileActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_CREATE_FILE_MAPPING = 'create file mapping' - TERM_FIND_FILE = 'find file' - TERM_READ_FROM_FILE = 'read from file' - TERM_MOVE_FILE = 'move file' - TERM_CREATE_FILE_SYMBOLIC_LINK = 'create file symbolic link' - TERM_SEND_CONTROL_CODE_TO_FILE = 'send control code to file' - TERM_WRITE_TO_FILE = 'write to file' - TERM_EXECUTE_FILE = 'execute file' + TERM_CLOSE_FILE = 'close file' TERM_COPY_FILE = 'copy file' + TERM_CREATE_FILE = 'create file' TERM_CREATE_FILE_ALTERNATE_DATA_STREAM = 'create file alternate data stream' - TERM_LOCK_FILE = 'lock file' - TERM_HIDE_FILE = 'hide file' - TERM_UNLOCK_FILE = 'unlock file' - TERM_GET_FILE_ATTRIBUTES = 'get file attributes' - TERM_RENAME_FILE = 'rename file' - TERM_OPEN_FILE_MAPPING = 'open file mapping' + TERM_CREATE_FILE_MAPPING = 'create file mapping' + TERM_CREATE_FILE_SYMBOLIC_LINK = 'create file symbolic link' TERM_DELETE_FILE = 'delete file' - TERM_SET_FILE_ATTRIBUTES = 'set file attributes' - TERM_OPEN_FILE = 'open file' - TERM_CREATE_FILE = 'create file' + TERM_EXECUTE_FILE = 'execute file' + TERM_FIND_FILE = 'find file' + TERM_GET_FILE_ATTRIBUTES = 'get file attributes' + TERM_HIDE_FILE = 'hide file' + TERM_LOCK_FILE = 'lock file' TERM_MODIFY_FILE = 'modify file' + TERM_MOVE_FILE = 'move file' + TERM_OPEN_FILE = 'open file' + TERM_OPEN_FILE_MAPPING = 'open file mapping' + TERM_READ_FROM_FILE = 'read from file' + TERM_RENAME_FILE = 'rename file' + TERM_SEND_CONTROL_CODE_TO_FILE = 'send control code to file' + TERM_SET_FILE_ATTRIBUTES = 'set file attributes' + TERM_UNLOCK_FILE = 'unlock file' + TERM_WRITE_TO_FILE = 'write to file' -@vocabs.add_allowed_values + +@register_vocab class CommandandControlProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_FREQUENCY = 'frequency' -@vocabs.add_allowed_values + +@register_vocab class IRCActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IRCActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_RECEIVE_IRC_PRIVATE_MESSAGE = 'receive irc private message' - TERM_JOIN_IRC_CHANNEL = 'join irc channel' - TERM_SEND_IRC_PRIVATE_MESSAGE = 'send irc private message' - TERM_LEAVE_IRC_CHANNEL = 'leave irc channel' + TERM_CONNECT_TO_IRC_SERVER = 'connect to irc server' TERM_DISCONNECT_FROM_IRC_SERVER = 'disconnect from irc server' + TERM_JOIN_IRC_CHANNEL = 'join irc channel' + TERM_LEAVE_IRC_CHANNEL = 'leave irc channel' + TERM_RECEIVE_IRC_PRIVATE_MESSAGE = 'receive irc private message' + TERM_SEND_IRC_PRIVATE_MESSAGE = 'send irc private message' TERM_SET_IRC_NICKNAME = 'set irc nickname' -@vocabs.add_allowed_values + +@register_vocab class InfectionPropagationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:InfectionPropagationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_INFECT_FILE = 'infect file' - TERM_PREVENT_DUPLICATE_INFECTION = 'prevent duplicate infection' TERM_INFECT_REMOTE_MACHINE = 'infect remote machine' + TERM_PREVENT_DUPLICATE_INFECTION = 'prevent duplicate infection' -@vocabs.add_allowed_values + +@register_vocab class MalwareCapability(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareCapabilityVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_COMMAND_AND_CONTROL = 'command and control' - TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' - TERM_INFECTION_PROPAGATION = 'infection/propagation' - TERM_SPYING = 'spying' - TERM_SECONDARY_OPERATION = 'secondary operation' - TERM_ANTI_DETECTION = 'anti-detection' + TERM_ANTI_BEHAVIORAL_ANALYSIS = 'anti-behavioral analysis' - TERM_MACHINE_ACCESS_CONTROL = 'machine access/control' - TERM_DATA_THEFT = 'data theft' TERM_ANTI_CODE_ANALYSIS = 'anti-code analysis' - TERM_INTEGRITY_VIOLATION = 'integrity violation' - TERM_DATA_EXFILTRATION = 'data exfiltration' - TERM_SECURITY_DEGRADATION = 'security degradation' + TERM_ANTI_DETECTION = 'anti-detection' TERM_ANTI_REMOVAL = 'anti-removal' - TERM_PRIVILEGE_ESCALATION = 'privilege escalation' TERM_AVAILABILITY_VIOLATION = 'availability violation' + TERM_COMMAND_AND_CONTROL = 'command and control' + TERM_DATA_EXFILTRATION = 'data exfiltration' + TERM_DATA_THEFT = 'data theft' + TERM_DESTRUCTION = 'destruction' TERM_FRAUD = 'fraud' - TERM_PROBING = 'probing' + TERM_INFECTION_PROPAGATION = 'infection/propagation' + TERM_INTEGRITY_VIOLATION = 'integrity violation' + TERM_MACHINE_ACCESS_CONTROL = 'machine access/control' TERM_PERSISTENCE = 'persistence' - TERM_DESTRUCTION = 'destruction' + TERM_PRIVILEGE_ESCALATION = 'privilege escalation' + TERM_PROBING = 'probing' + TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' + TERM_SECONDARY_OPERATION = 'secondary operation' + TERM_SECURITY_DEGRADATION = 'security degradation' + TERM_SPYING = 'spying' -@vocabs.add_allowed_values + +@register_vocab class AntiBehavioralAnalysisProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_TARGETED_VM = 'targeted vm' + TERM_TARGETED_SANDBOX = 'targeted sandbox' + TERM_TARGETED_VM = 'targeted vm' -@vocabs.add_allowed_values + +@register_vocab class DNSActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DNSActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_SEND_DNS_QUERY = 'send dns query' TERM_SEND_REVERSE_DNS_LOOKUP = 'send reverse dns lookup' -@vocabs.add_allowed_values + +@register_vocab class RemoteMachineManipulationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RemoteMachineManipulationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ACCESS_REMOTE_MACHINE = 'access remote machine' TERM_SEARCH_FOR_REMOTE_MACHINES = 'search for remote machines' -@vocabs.add_allowed_values + +@register_vocab class ProcessActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_GET_PROCESS_CURRENT_DIRECTORY = 'get process current directory' - TERM_SET_PROCESS_ENVIRONMENT_VARIABLE = 'set process environment variable' + + TERM_CREATE_PROCESS = 'create process' + TERM_CREATE_PROCESS_AS_USER = 'create process as user' TERM_ENUMERATE_PROCESSES = 'enumerate processes' - TERM_SET_PROCESS_CURRENT_DIRECTORY = 'set process current directory' - TERM_GET_PROCESS_ENVIRONMENT_VARIABLE = 'get process environment variable' - TERM_SLEEP_PROCESS = 'sleep process' TERM_FLUSH_PROCESS_INSTRUCTION_CACHE = 'flush process instruction cache' - TERM_KILL_PROCESS = 'kill process' - TERM_CREATE_PROCESS = 'create process' + TERM_GET_PROCESS_CURRENT_DIRECTORY = 'get process current directory' + TERM_GET_PROCESS_ENVIRONMENT_VARIABLE = 'get process environment variable' TERM_GET_PROCESS_STARTUPINFO = 'get process startupinfo' - TERM_CREATE_PROCESS_AS_USER = 'create process as user' + TERM_KILL_PROCESS = 'kill process' TERM_OPEN_PROCESS = 'open process' + TERM_SET_PROCESS_CURRENT_DIRECTORY = 'set process current directory' + TERM_SET_PROCESS_ENVIRONMENT_VARIABLE = 'set process environment variable' + TERM_SLEEP_PROCESS = 'sleep process' -@vocabs.add_allowed_values + +@register_vocab class PersistenceStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistenceStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_PERSIST_TO_RE_INFECT_SYSTEM = 'persist to re-infect system' - TERM_GATHER_INFORMATION_FOR_IMPROVEMENT = 'gather information for improvement' + TERM_ENSURE_COMPATIBILITY = 'ensure compatibility' + TERM_GATHER_INFORMATION_FOR_IMPROVEMENT = 'gather information for improvement' TERM_PERSIST_TO_CONTINUOUSLY_EXECUTE_ON_SYSTEM = 'persist to continuously execute on system' + TERM_PERSIST_TO_RE_INFECT_SYSTEM = 'persist to re-infect system' -@vocabs.add_allowed_values + +@register_vocab class NetworkActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:NetworkActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_SEND_EMAIL_MESSAGE = 'send email message' - TERM_SEND_NETWORK_PACKET = 'send network packet' - TERM_DISCONNECT_FROM_IP = 'disconnect from ip' - TERM_CONNECT_TO_IP = 'connect to ip' + TERM_CLOSE_PORT = 'close port' - TERM_DOWNLOAD_FILE = 'download file' - TERM_SEND_ICMP_REQUEST = 'send icmp request' - TERM_CONNECT_TO_URL = 'connect to url' + TERM_CONNECT_TO_IP = 'connect to ip' TERM_CONNECT_TO_SOCKET_ADDRESS = 'connect to socket address' - TERM_OPEN_PORT = 'open port' - TERM_UPLOAD_FILE = 'upload file' + TERM_CONNECT_TO_URL = 'connect to url' + TERM_DISCONNECT_FROM_IP = 'disconnect from ip' + TERM_DOWNLOAD_FILE = 'download file' TERM_LISTEN_ON_PORT = 'listen on port' + TERM_OPEN_PORT = 'open port' TERM_RECEIVE_NETWORK_PACKET = 'receive network packet' + TERM_SEND_EMAIL_MESSAGE = 'send email message' + TERM_SEND_ICMP_REQUEST = 'send icmp request' + TERM_SEND_NETWORK_PACKET = 'send network packet' + TERM_UPLOAD_FILE = 'upload file' -@vocabs.add_allowed_values + +@register_vocab class SecondaryOperationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_INSTALL_OTHER_COMPONENTS = 'install other components' + TERM_LAY_DORMANT = 'lay dormant' + TERM_LOG_ACTIVITY = 'log activity' TERM_PATCH_OPERATING_SYSTEM_FILE_S = 'patch operating system file(s)' TERM_REMOVE_TRACES_OF_INFECTION = 'remove traces of infection' - TERM_LAY_DORMANT = 'lay dormant' - TERM_INSTALL_OTHER_COMPONENTS = 'install other components' TERM_SUICIDE_EXIT = 'suicide exit' - TERM_LOG_ACTIVITY = 'log activity' -@vocabs.add_allowed_values + +@register_vocab class FraudTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FraudTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ACCESS_PREMIUM_SERVICE = 'access premium service' -@vocabs.add_allowed_values + +@register_vocab class ProcessMemoryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessMemoryActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_UNMAP_FILE_FROM_PROCESS = 'unmap file from process' - TERM_MODIFY_PROCESS_VIRTUAL_MEMORY_PROTECTION = 'modify process virtual memory protection' - TERM_WRITE_TO_PROCESS_MEMORY = 'write to process memory' - TERM_READ_FROM_PROCESS_MEMORY = 'read from process memory' + TERM_ALLOCATE_PROCESS_VIRTUAL_MEMORY = 'allocate process virtual memory' - TERM_MAP_LIBRARY_INTO_PROCESS = 'map library into process' TERM_FREE_PROCESS_VIRTUAL_MEMORY = 'free process virtual memory' TERM_MAP_FILE_INTO_PROCESS = 'map file into process' + TERM_MAP_LIBRARY_INTO_PROCESS = 'map library into process' + TERM_MODIFY_PROCESS_VIRTUAL_MEMORY_PROTECTION = 'modify process virtual memory protection' + TERM_READ_FROM_PROCESS_MEMORY = 'read from process memory' + TERM_UNMAP_FILE_FROM_PROCESS = 'unmap file from process' + TERM_WRITE_TO_PROCESS_MEMORY = 'write to process memory' -@vocabs.add_allowed_values + +@register_vocab class RegistryActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:RegistryActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_MODIFY_REGISTRY_KEY = 'modify registry key' - TERM_MONITOR_REGISTRY_KEY = 'monitor registry key' + TERM_CLOSE_REGISTRY_KEY = 'close registry key' + TERM_CREATE_REGISTRY_KEY = 'create registry key' + TERM_CREATE_REGISTRY_KEY_VALUE = 'create registry key value' TERM_DELETE_REGISTRY_KEY = 'delete registry key' - TERM_OPEN_REGISTRY_KEY = 'open registry key' + TERM_DELETE_REGISTRY_KEY_VALUE = 'delete registry key value' TERM_ENUMERATE_REGISTRY_KEY_SUBKEYS = 'enumerate registry key subkeys' TERM_ENUMERATE_REGISTRY_KEY_VALUES = 'enumerate registry key values' - TERM_READ_REGISTRY_KEY_VALUE = 'read registry key value' TERM_GET_REGISTRY_KEY_ATTRIBUTES = 'get registry key attributes' - TERM_CREATE_REGISTRY_KEY_VALUE = 'create registry key value' - TERM_CREATE_REGISTRY_KEY = 'create registry key' + TERM_MODIFY_REGISTRY_KEY = 'modify registry key' TERM_MODIFY_REGISTRY_KEY_VALUE = 'modify registry key value' - TERM_DELETE_REGISTRY_KEY_VALUE = 'delete registry key value' + TERM_MONITOR_REGISTRY_KEY = 'monitor registry key' + TERM_OPEN_REGISTRY_KEY = 'open registry key' + TERM_READ_REGISTRY_KEY_VALUE = 'read registry key value' -@vocabs.add_allowed_values + +@register_vocab class AvailabilityViolationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AvailabilityViolationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CRYPTOCURRENCY_TYPE = 'cryptocurrency type' -@vocabs.add_allowed_values + +@register_vocab class CommandandControlStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CommandandControlStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_DETERMINE_C2_SERVER = 'determine c2 server' TERM_RECEIVE_DATA_FROM_C2_SERVER = 'receive data from c2 server' TERM_SEND_DATA_TO_C2_SERVER = 'send data to c2 server' -@vocabs.add_allowed_values + +@register_vocab class DestructionTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_ERASE_DATA = 'erase data' + TERM_DESTROY_FIRMWARE = 'destroy firmware' TERM_DESTROY_HARDWARE = 'destroy hardware' + TERM_ERASE_DATA = 'erase data' -@vocabs.add_allowed_values + +@register_vocab class SpyingStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SpyingStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CAPTURE_SYSTEM_INPUT_PERIPHERAL_DATA = 'capture system input peripheral data' TERM_CAPTURE_SYSTEM_INTERFACE_DATA = 'capture system interface data' TERM_CAPTURE_SYSTEM_OUTPUT_PERIPHERAL_DATA = 'capture system output peripheral data' TERM_CAPTURE_SYSTEM_STATE_DATA = 'capture system state data' -@vocabs.add_allowed_values + +@register_vocab class FTPActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FTPActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CONNECT_TO_FTP_SERVER = 'connect to ftp server' - TERM_SEND_FTP_COMMAND = 'send ftp command' TERM_DISCONNECT_FROM_FTP_SERVER = 'disconnect from ftp server' + TERM_SEND_FTP_COMMAND = 'send ftp command' -@vocabs.add_allowed_values + +@register_vocab class MachineAccessControlStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CONTROL_LOCAL_MACHINE = 'control local machine' TERM_INSTALL_BACKDOOR = 'install backdoor' -@vocabs.add_allowed_values + +@register_vocab class IntegrityViolationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IntegrityViolationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_COMPROMISE_SYSTEM_DATA_INTEGRITY = 'compromise system data integrity' + TERM_ANNOY_USER = 'annoy user' TERM_COMPROMISE_NETWORK_OPERATIONAL_INTEGRITY = 'compromise network operational integrity' - TERM_COMPROMISE_USER_DATA_INTEGRITY = 'compromise user data integrity' + TERM_COMPROMISE_SYSTEM_DATA_INTEGRITY = 'compromise system data integrity' TERM_COMPROMISE_SYSTEM_OPERATIONAL_INTEGRITY = 'compromise system operational integrity' + TERM_COMPROMISE_USER_DATA_INTEGRITY = 'compromise user data integrity' -@vocabs.add_allowed_values + +@register_vocab class ProbingTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProbingTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_IDENTIFY_OS = 'identify os' + + TERM_CHECK_FOR_FIREWALL = 'check for firewall' + TERM_CHECK_FOR_INTERNET_CONNECTIVITY = 'check for internet connectivity' + TERM_CHECK_FOR_NETWORK_DRIVES = 'check for network drives' TERM_CHECK_FOR_PROXY = 'check for proxy' + TERM_CHECK_LANGUAGE = 'check language' + TERM_IDENTIFY_OS = 'identify os' TERM_INVENTORY_SYSTEM_APPLICATIONS = 'inventory system applications' - TERM_CHECK_FOR_NETWORK_DRIVES = 'check for network drives' TERM_MAP_LOCAL_NETWORK = 'map local network' - TERM_CHECK_FOR_FIREWALL = 'check for firewall' - TERM_CHECK_LANGUAGE = 'check language' - TERM_CHECK_FOR_INTERNET_CONNECTIVITY = 'check for internet connectivity' -@vocabs.add_allowed_values + +@register_vocab class MalwareEntityType(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareEntityTypeVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_INSTANCE = 'instance' + TERM_CLASS = 'class' TERM_FAMILY = 'family' + TERM_INSTANCE = 'instance' -@vocabs.add_allowed_values + +@register_vocab class FraudStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:FraudStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_PERFORM_CLICK_FRAUD = 'perform click fraud' TERM_PERFORM_PREMIUM_RATE_FRAUD = 'perform premium rate fraud' -@vocabs.add_allowed_values + +@register_vocab class SpyingTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SpyingTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_CAPTURE_SYSTEM_SCREENSHOT = 'capture system screenshot' - TERM_CAPTURE_KEYBOARD_INPUT = 'capture keyboard input' - TERM_CAPTURE_FILE_SYSTEM = 'capture file system' + TERM_CAPTURE_CAMERA_INPUT = 'capture camera input' + TERM_CAPTURE_FILE_SYSTEM = 'capture file system' TERM_CAPTURE_GPS_DATA = 'capture gps data' - TERM_CAPTURE_PRINTER_OUTPUT = 'capture printer output' - TERM_CAPTURE_MOUSE_INPUT = 'capture mouse input' + TERM_CAPTURE_KEYBOARD_INPUT = 'capture keyboard input' TERM_CAPTURE_MICROPHONE_INPUT = 'capture microphone input' + TERM_CAPTURE_MOUSE_INPUT = 'capture mouse input' + TERM_CAPTURE_PRINTER_OUTPUT = 'capture printer output' + TERM_CAPTURE_SYSTEM_MEMORY = 'capture system memory' TERM_CAPTURE_SYSTEM_NETWORK_TRAFFIC = 'capture system network traffic' + TERM_CAPTURE_SYSTEM_SCREENSHOT = 'capture system screenshot' TERM_CAPTURE_TOUCHSCREEN_INPUT = 'capture touchscreen input' - TERM_CAPTURE_SYSTEM_MEMORY = 'capture system memory' -@vocabs.add_allowed_values + +@register_vocab class ProcessThreadActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ProcessThreadActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_CREATE_REMOTE_THREAD_IN_PROCESS = 'create remote thread in process' TERM_CREATE_THREAD = 'create thread' - TERM_SET_THREAD_CONTEXT = 'set thread context' TERM_ENUMERATE_THREADS = 'enumerate threads' - TERM_QUEUE_APC_IN_THREAD = 'queue apc in thread' - TERM_GET_THREAD_USERNAME = 'get thread username' - TERM_REVERT_THREAD_TO_SELF = 'revert thread to self' - TERM_CREATE_REMOTE_THREAD_IN_PROCESS = 'create remote thread in process' TERM_GET_THREAD_CONTEXT = 'get thread context' - TERM_KILL_THREAD = 'kill thread' + TERM_GET_THREAD_USERNAME = 'get thread username' TERM_IMPERSONATE_PROCESS = 'impersonate process' + TERM_KILL_THREAD = 'kill thread' + TERM_QUEUE_APC_IN_THREAD = 'queue apc in thread' + TERM_REVERT_THREAD_TO_SELF = 'revert thread to self' + TERM_SET_THREAD_CONTEXT = 'set thread context' -@vocabs.add_allowed_values + +@register_vocab class DataTheftStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataTheftStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_STEAL_AUTHENTICATION_CREDENTIALS = 'steal authentication credentials' TERM_STEAL_STORED_INFORMATION = 'steal stored information' - TERM_STEAL_USER_DATA = 'steal user data' TERM_STEAL_SYSTEM_INFORMATION = 'steal system information' - TERM_STEAL_AUTHENTICATION_CREDENTIALS = 'steal authentication credentials' + TERM_STEAL_USER_DATA = 'steal user data' -@vocabs.add_allowed_values + +@register_vocab class AntiCodeAnalysisTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiCodeAnalysisTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_DEFEAT_CALL_GRAPH_GENERATION = 'defeat call graph generation' - TERM_RESTRUCTURE_ARRAYS = 'restructure arrays' - TERM_DETECT_DEBUGGING = 'detect debugging' - TERM_PREVENT_DEBUGGING = 'prevent debugging' TERM_DEFEAT_FLOW_ORIENTED_RECURSIVE_TRAVERSAL_DISASSEMBLER = 'defeat flow-oriented (recursive traversal) disassembler' TERM_DEFEAT_LINEAR_DISASSEMBLER = 'defeat linear disassembler' - TERM_OBFUSCATE_INSTRUCTIONS = 'obfuscate instructions' + TERM_DETECT_DEBUGGING = 'detect debugging' TERM_OBFUSCATE_IMPORTS = 'obfuscate imports' - TERM_TRANSFORM_CONTROL_FLOW = 'transform control flow' + TERM_OBFUSCATE_INSTRUCTIONS = 'obfuscate instructions' TERM_OBFUSCATE_RUNTIME_CODE = 'obfuscate runtime code' + TERM_PREVENT_DEBUGGING = 'prevent debugging' + TERM_RESTRUCTURE_ARRAYS = 'restructure arrays' + TERM_TRANSFORM_CONTROL_FLOW = 'transform control flow' -@vocabs.add_allowed_values + +@register_vocab class PrivilegeEscalationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_ELEVATE_CPU_MODE = 'elevate cpu mode' -@vocabs.add_allowed_values + +@register_vocab class MalwareSubjectRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareSubjectRelationshipVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_NETWORK_TRAFFIC_CAPTURE_OF = 'network traffic capture of' - TERM_64_BIT_VERSION_OF = '64-bit version of' - TERM_DROPPED_BY = 'dropped by' - TERM_MEMORY_IMAGE_OF = 'memory image of' + TERM_32_BIT_VERSION_OF = '32-bit version of' - TERM_INSTALLED_BY = 'installed by' - TERM_DIRECT_DESCENDANT_OF = 'direct descendant of' + TERM_64_BIT_VERSION_OF = '64-bit version of' + TERM_CONTAINED_IN_DISK_IMAGE = 'contained in disk image' + TERM_CONTAINED_IN_MEMORY_IMAGE = 'contained in memory image' + TERM_CONTAINED_IN_NETWORK_TRAFFIC_CAPTURE = 'contained in network traffic capture' + TERM_DECRYPTED_VERSION_OF = 'decrypted version of' TERM_DIRECT_ANCESTOR_OF = 'direct ancestor of' - TERM_DROPS = 'drops' - TERM_DOWNLOADS = 'downloads' - TERM_ENCRYPTED_VERSION_OF = 'encrypted version of' - TERM_EXTRACTED_FROM = 'extracted from' + TERM_DIRECT_DESCENDANT_OF = 'direct descendant of' TERM_DISK_IMAGE_OF = 'disk image of' + TERM_DOWNLOADED_BY = 'downloaded by' + TERM_DOWNLOADS = 'downloads' + TERM_DROPPED_BY = 'dropped by' + TERM_DROPS = 'drops' + TERM_ENCRYPTED_VERSION_OF = 'encrypted version of' + TERM_EXTRACTED_FROM = 'extracted from' + TERM_EXTRACTS = 'extracts' + TERM_INSTALLED_BY = 'installed by' + TERM_INSTALLS = 'installs' + TERM_MEMORY_IMAGE_OF = 'memory image of' + TERM_NETWORK_TRAFFIC_CAPTURE_OF = 'network traffic capture of' TERM_PACKED_VERSION_OF = 'packed version of' - TERM_CONTAINED_IN_MEMORY_IMAGE = 'contained in memory image' TERM_UNPACKED_VERSION_OF = 'unpacked version of' - TERM_CONTAINED_IN_NETWORK_TRAFFIC_CAPTURE = 'contained in network traffic capture' - TERM_INSTALLS = 'installs' - TERM_EXTRACTS = 'extracts' - TERM_DOWNLOADED_BY = 'downloaded by' - TERM_CONTAINED_IN_DISK_IMAGE = 'contained in disk image' - TERM_DECRYPTED_VERSION_OF = 'decrypted version of' -@vocabs.add_allowed_values + +@register_vocab class AntiBehavioralAnalysisTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_DETECT_SANDBOX_ENVIRONMENT = 'detect sandbox environment' TERM_DETECT_VM_ENVIRONMENT = 'detect vm environment' TERM_OVERLOAD_SANDBOX = 'overload sandbox' TERM_PREVENT_EXECUTION_IN_SANDBOX = 'prevent execution in sandbox' - TERM_DETECT_SANDBOX_ENVIRONMENT = 'detect sandbox environment' TERM_PREVENT_EXECUTION_IN_VM = 'prevent execution in vm' -@vocabs.add_allowed_values + +@register_vocab class PersistenceTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PersistenceTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_REINSTANTIATE_SELF_AFTER_INITIAL_DETECTION = 'reinstantiate self after initial detection' + + TERM_DROP_RETRIEVE_DEBUG_LOG_FILE = 'drop/retrieve debug log file' TERM_LIMIT_APPLICATION_TYPE_VERSION = 'limit application type/version' TERM_PERSIST_AFTER_OS_INSTALL_REINSTALL = 'persist after os install/reinstall' - TERM_DROP_RETRIEVE_DEBUG_LOG_FILE = 'drop/retrieve debug log file' - TERM_PERSIST_INDEPENDENT_OF_HARD_DISK_OS_CHANGES = 'persist independent of hard disk/os changes' TERM_PERSIST_AFTER_SYSTEM_REBOOT = 'persist after system reboot' + TERM_PERSIST_INDEPENDENT_OF_HARD_DISK_OS_CHANGES = 'persist independent of hard disk/os changes' + TERM_REINSTANTIATE_SELF_AFTER_INITIAL_DETECTION = 'reinstantiate self after initial detection' -@vocabs.add_allowed_values + +@register_vocab class SynchronizationActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SynchronizationActionNameVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_CREATE_CRITICAL_SECTION = 'create critical section' TERM_CREATE_EVENT = 'create event' TERM_CREATE_MUTEX = 'create mutex' - TERM_OPEN_MUTEX = 'open mutex' + TERM_CREATE_SEMAPHORE = 'create semaphore' + TERM_DELETE_CRITICAL_SECTION = 'delete critical section' + TERM_DELETE_EVENT = 'delete event' TERM_DELETE_MUTEX = 'delete mutex' - TERM_OPEN_SEMAPHORE = 'open semaphore' + TERM_DELETE_SEMAPHORE = 'delete semaphore' + TERM_OPEN_CRITICAL_SECTION = 'open critical section' TERM_OPEN_EVENT = 'open event' + TERM_OPEN_MUTEX = 'open mutex' + TERM_OPEN_SEMAPHORE = 'open semaphore' + TERM_RELEASE_CRITICAL_SECTION = 'release critical section' TERM_RELEASE_MUTEX = 'release mutex' - TERM_DELETE_CRITICAL_SECTION = 'delete critical section' - TERM_CREATE_CRITICAL_SECTION = 'create critical section' TERM_RELEASE_SEMAPHORE = 'release semaphore' - TERM_DELETE_EVENT = 'delete event' TERM_RESET_EVENT = 'reset event' - TERM_RELEASE_CRITICAL_SECTION = 'release critical section' - TERM_CREATE_SEMAPHORE = 'create semaphore' - TERM_DELETE_SEMAPHORE = 'delete semaphore' - TERM_OPEN_CRITICAL_SECTION = 'open critical section' -@vocabs.add_allowed_values + +@register_vocab class AntiRemovalTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiRemovalTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_PREVENT_REGISTRY_DELETION = 'prevent registry deletion' + TERM_PREVENT_API_UNHOOKING = 'prevent api unhooking' TERM_PREVENT_FILE_ACCESS = 'prevent file access' + TERM_PREVENT_FILE_DELETION = 'prevent file deletion' TERM_PREVENT_MEMORY_ACCESS = 'prevent memory access' TERM_PREVENT_REGISTRY_ACCESS = 'prevent registry access' - TERM_PREVENT_FILE_DELETION = 'prevent file deletion' + TERM_PREVENT_REGISTRY_DELETION = 'prevent registry deletion' + -@vocabs.add_allowed_values +@register_vocab class SecurityDegradationStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_DISABLE_SERVICE_PROVIDER_SECURITY_FEATURES = 'disable service provider security features' + TERM_DEGRADE_SECURITY_PROGRAMS = 'degrade security programs' - TERM_DISABLE_SYSTEM_UPDATES = 'disable system updates' - TERM_DISABLE_OS_SECURITY_FEATURES = 'disable os security features' TERM_DISABLE_HOST_BASED_OR_OS_ACCESS_CONTROLS = 'disable [host-based or os] access controls' + TERM_DISABLE_OS_SECURITY_FEATURES = 'disable os security features' + TERM_DISABLE_SERVICE_PROVIDER_SECURITY_FEATURES = 'disable service provider security features' + TERM_DISABLE_SYSTEM_UPDATES = 'disable system updates' -@vocabs.add_allowed_values + +@register_vocab class PrivilegeEscalationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:PrivilegeEscalationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_USER_PRIVILEGE_ESCALATION_TYPE = 'user privilege escalation type' -@vocabs.add_allowed_values + +@register_vocab class GUIActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:GUIActionNameVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_FIND_WINDOW = 'find window' - TERM_SHOW_WINDOW = 'show window' - TERM_KILL_WINDOW = 'kill window' - TERM_ENUMERATE_WINDOWS = 'enumerate windows' - TERM_CREATE_WINDOW = 'create window' + TERM_CREATE_DIALOG_BOX = 'create dialog box' + TERM_CREATE_WINDOW = 'create window' + TERM_ENUMERATE_WINDOWS = 'enumerate windows' + TERM_FIND_WINDOW = 'find window' TERM_HIDE_WINDOW = 'hide window' + TERM_KILL_WINDOW = 'kill window' + TERM_SHOW_WINDOW = 'show window' + -@vocabs.add_allowed_values +@register_vocab class SecurityDegradationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_STOP_EXECUTION_OF_SECURITY_PROGRAM = 'stop execution of security program' - TERM_DISABLE_FIREWALL = 'disable firewall' + TERM_DISABLE_ACCESS_RIGHT_CHECKING = 'disable access right checking' + TERM_DISABLE_FIREWALL = 'disable firewall' TERM_DISABLE_KERNEL_PATCHING_PROTECTION = 'disable kernel patching protection' - TERM_PREVENT_SECURITY_PROGRAM_FROM_RUNNING = 'prevent security program from running' - TERM_REMOVE_SMS_WARNING_MESSAGES = 'remove sms warning messages' - TERM_MODIFY_SECURITY_PROGRAM_CONFIGURATION = 'modify security program configuration' - TERM_PREVENT_ACCESS_TO_SECURITY_WEBSITES = 'prevent access to security websites' - TERM_DISABLE_SYSTEM_UPDATE_SERVICES_DAEMONS = 'disable system update services/daemons' - TERM_DISABLE_SYSTEM_SERVICE_PACK_PATCH_INSTALLATION = 'disable system service pack/patch installation' - TERM_DISABLE_SYSTEM_FILE_OVERWRITE_PROTECTION = 'disable system file overwrite protection' - TERM_DISABLE_PRIVILEGE_LIMITING = 'disable privilege limiting' - TERM_GATHER_SECURITY_PRODUCT_INFO = 'gather security product info' TERM_DISABLE_OS_SECURITY_ALERTS = 'disable os security alerts' + TERM_DISABLE_PRIVILEGE_LIMITING = 'disable privilege limiting' + TERM_DISABLE_SYSTEM_FILE_OVERWRITE_PROTECTION = 'disable system file overwrite protection' + TERM_DISABLE_SYSTEM_SERVICE_PACK_PATCH_INSTALLATION = 'disable system service pack/patch installation' + TERM_DISABLE_SYSTEM_UPDATE_SERVICES_DAEMONS = 'disable system update services/daemons' TERM_DISABLE_USER_ACCOUNT_CONTROL = 'disable user account control' + TERM_GATHER_SECURITY_PRODUCT_INFO = 'gather security product info' + TERM_MODIFY_SECURITY_PROGRAM_CONFIGURATION = 'modify security program configuration' + TERM_PREVENT_ACCESS_TO_SECURITY_WEBSITES = 'prevent access to security websites' + TERM_PREVENT_SECURITY_PROGRAM_FROM_RUNNING = 'prevent security program from running' + TERM_REMOVE_SMS_WARNING_MESSAGES = 'remove sms warning messages' + TERM_STOP_EXECUTION_OF_SECURITY_PROGRAM = 'stop execution of security program' -@vocabs.add_allowed_values + +@register_vocab class MalwareConfigurationParameter(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareConfigurationParameterVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_MAGIC_NUMBER = 'magic number' - TERM_GROUP_ID = 'group id' + TERM_FILENAME = 'filename' - TERM_MUTEX = 'mutex' - TERM_INSTALLATION_PATH = 'installation path' + TERM_GROUP_ID = 'group id' TERM_ID = 'id' + TERM_INSTALLATION_PATH = 'installation path' + TERM_MAGIC_NUMBER = 'magic number' + TERM_MUTEX = 'mutex' + -@vocabs.add_allowed_values +@register_vocab class MachineAccessControlProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MachineAccessControlPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_BACKDOOR_TYPE = 'backdoor type' -@vocabs.add_allowed_values + +@register_vocab class ServiceActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:ServiceActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_SEND_CONTROL_CODE_TO_SERVICE = 'send control code to service' - TERM_MODIFY_SERVICE_CONFIGURATION = 'modify service configuration' + TERM_CREATE_SERVICE = 'create service' - TERM_START_SERVICE = 'start service' - TERM_ENUMERATE_SERVICES = 'enumerate services' - TERM_STOP_SERVICE = 'stop service' TERM_DELETE_SERVICE = 'delete service' + TERM_ENUMERATE_SERVICES = 'enumerate services' + TERM_MODIFY_SERVICE_CONFIGURATION = 'modify service configuration' TERM_OPEN_SERVICE = 'open service' + TERM_SEND_CONTROL_CODE_TO_SERVICE = 'send control code to service' + TERM_START_SERVICE = 'start service' + TERM_STOP_SERVICE = 'stop service' + -@vocabs.add_allowed_values +@register_vocab class AntiBehavioralAnalysisStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiBehavioralAnalysisStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_ANTI_VM = 'anti-vm' + TERM_ANTI_SANDBOX = 'anti-sandbox' + TERM_ANTI_VM = 'anti-vm' + -@vocabs.add_allowed_values +@register_vocab class CapabilityObjectiveRelationship(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:CapabilityObjectiveRelationshipVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_CHILD_OF = 'child of' - TERM_PARENT_OF = 'parent of' TERM_INCORPORATED_BY = 'incorporated by' TERM_INCORPORATES = 'incorporates' + TERM_PARENT_OF = 'parent of' + -@vocabs.add_allowed_values +@register_vocab class DataExfiltrationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DataExfiltrationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_ENCRYPT_DATA = 'encrypt data' TERM_EXFILTRATE_VIA_COVERT_CHANNEL = 'exfiltrate via covert channel' + TERM_EXFILTRATE_VIA_DUMPSTER_DIVE = 'exfiltrate via dumpster dive' TERM_EXFILTRATE_VIA_FAX = 'exfiltrate via fax' - TERM_EXFILTRATE_VIA_PHYSICAL_MEDIA = 'exfiltrate via physical media' - TERM_ENCRYPT_DATA = 'encrypt data' TERM_EXFILTRATE_VIA_NETWORK = 'exfiltrate via network' + TERM_EXFILTRATE_VIA_PHYSICAL_MEDIA = 'exfiltrate via physical media' + TERM_EXFILTRATE_VIA_VOIP_PHONE = 'exfiltrate via voip/phone' TERM_HIDE_DATA = 'hide data' - TERM_PACKAGE_DATA = 'package data' - TERM_EXFILTRATE_VIA_DUMPSTER_DIVE = 'exfiltrate via dumpster dive' TERM_MOVE_DATA_TO_STAGING_SERVER = 'move data to staging server' - TERM_EXFILTRATE_VIA_VOIP_PHONE = 'exfiltrate via voip/phone' + TERM_PACKAGE_DATA = 'package data' + -@vocabs.add_allowed_values +@register_vocab class UserActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:UserActionNameVocab-1.1' _VOCAB_VERSION = '1.1' - TERM_DELETE_USER = 'delete user' + + TERM_ADD_USER = 'add user' + TERM_ADD_USER_TO_GROUP = 'add user to group' TERM_CHANGE_PASSWORD = 'change password' - TERM_LOGON_AS_USER = 'logon as user' + TERM_DELETE_USER = 'delete user' TERM_ENUMERATE_USERS = 'enumerate users' - TERM_REMOVE_USER_FROM_GROUP = 'remove user from group' - TERM_ADD_USER_TO_GROUP = 'add user to group' - TERM_ADD_USER = 'add user' - TERM_INVOKE_USER_PRIVILEGE = 'invoke user privilege' TERM_GET_USER_ATTRIBUTES = 'get user attributes' + TERM_INVOKE_USER_PRIVILEGE = 'invoke user privilege' + TERM_LOGON_AS_USER = 'logon as user' + TERM_REMOVE_USER_FROM_GROUP = 'remove user from group' -@vocabs.add_allowed_values + +@register_vocab class DestructionStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DestructionStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_DESTROY_PHYSICAL_ENTITY = 'destroy physical entity' TERM_DESTROY_VIRTUAL_ENTITY = 'destroy virtual entity' -@vocabs.add_allowed_values + +@register_vocab class AntiRemovalStrategicObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiRemovalStrategicObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_PREVENT_MALWARE_ARTIFACT_ACCESS = 'prevent malware artifact access' TERM_PREVENT_MALWARE_ARTIFACT_DELETION = 'prevent malware artifact deletion' -@vocabs.add_allowed_values + +@register_vocab class SecondaryOperationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecondaryOperationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_INSTALL_SECONDARY_MODULE = 'install secondary module' - TERM_INSTALL_SECONDARY_MALWARE = 'install secondary malware' + TERM_INSTALL_LEGITIMATE_SOFTWARE = 'install legitimate software' + TERM_INSTALL_SECONDARY_MALWARE = 'install secondary malware' + TERM_INSTALL_SECONDARY_MODULE = 'install secondary module' TERM_REMOVE_SELF = 'remove self' TERM_REMOVE_SYSTEM_ARTIFACTS = 'remove system artifacts' -@vocabs.add_allowed_values + +@register_vocab class MalwareLabel(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:MalwareLabelVocab-1.0' _VOCAB_VERSION = '1.0' + + TERM_ADWARE = 'adware' + TERM_APPENDER = 'appender' + TERM_BACKDOOR = 'backdoor' + TERM_BOOT_SECTOR_VIRUS = 'boot sector virus' + TERM_BOT = 'bot' + TERM_CAVITY_FILLER = 'cavity filler' + TERM_CLICKER = 'clicker' + TERM_COMPANION_VIRUS = 'companion virus' TERM_DATA_DIDDLER = 'data diddler' + TERM_DOWNLOADER = 'downloader' + TERM_DROPPER_FILE = 'dropper file' + TERM_FILE_INFECTOR_VIRUS = 'file infector virus' + TERM_FORK_BOMB = 'fork bomb' + TERM_GREYWARE = 'greyware' + TERM_IMPLANT = 'implant' + TERM_INFECTOR = 'infector' + TERM_KEYLOGGER = 'keylogger' + TERM_KLEPTOGRAPHIC_WORM = 'kleptographic worm' + TERM_MACRO_VIRUS = 'macro virus' + TERM_MALCODE = 'malcode' + TERM_MASS_MAILER = 'mass-mailer' + TERM_METAMORPHIC_VIRUS = 'metamorphic virus' + TERM_MID_INFECTOR = 'mid-infector' + TERM_MOBILE_CODE = 'mobile code' + TERM_MULTIPARTITE_VIRUS = 'multipartite virus' TERM_PASSWORD_STEALER = 'password stealer' - TERM_ADWARE = 'adware' - TERM_WABBIT = 'wabbit' - TERM_RANSOMWARE = 'ransomware' + TERM_POLYMORPHIC_VIRUS = 'polymorphic virus' + TERM_PREMIUM_DIALER_SMSER = 'premium dialer/smser' TERM_PREPENDER = 'prepender' - TERM_MOBILE_CODE = 'mobile code' - TERM_SPYWARE = 'spyware' - TERM_WEB_BUG = 'web bug' + TERM_RANSOMWARE = 'ransomware' TERM_RAT = 'rat' + TERM_ROGUE_ANTI_MALWARE = 'rogue anti-malware' TERM_ROOTKIT = 'rootkit' - TERM_COMPANION_VIRUS = 'companion virus' - TERM_MACRO_VIRUS = 'macro virus' - TERM_MALCODE = 'malcode' TERM_SHELLCODE = 'shellcode' - TERM_ROGUE_ANTI_MALWARE = 'rogue anti-malware' - TERM_FORK_BOMB = 'fork bomb' - TERM_PREMIUM_DIALER_SMSER = 'premium dialer/smser' TERM_SPAGHETTI_PACKER = 'spaghetti packer' - TERM_METAMORPHIC_VIRUS = 'metamorphic virus' - TERM_POLYMORPHIC_VIRUS = 'polymorphic virus' - TERM_BACKDOOR = 'backdoor' - TERM_CLICKER = 'clicker' - TERM_IMPLANT = 'implant' - TERM_INFECTOR = 'infector' - TERM_APPENDER = 'appender' - TERM_BOOT_SECTOR_VIRUS = 'boot sector virus' - TERM_MULTIPARTITE_VIRUS = 'multipartite virus' - TERM_DOWNLOADER = 'downloader' + TERM_SPYWARE = 'spyware' + TERM_TROJAN_HORSE = 'trojan horse' TERM_VARIANT = 'variant' - TERM_KEYLOGGER = 'keylogger' - TERM_CAVITY_FILLER = 'cavity filler' TERM_VIRUS = 'virus' - TERM_MASS_MAILER = 'mass-mailer' - TERM_GREYWARE = 'greyware' - TERM_MID_INFECTOR = 'mid-infector' - TERM_KLEPTOGRAPHIC_WORM = 'kleptographic worm' + TERM_WABBIT = 'wabbit' + TERM_WEB_BUG = 'web bug' TERM_WIPER = 'wiper' - TERM_DROPPER_FILE = 'dropper file' - TERM_ZIP_BOMB = 'zip bomb' - TERM_BOT = 'bot' TERM_WORM = 'worm' - TERM_FILE_INFECTOR_VIRUS = 'file infector virus' - TERM_TROJAN_HORSE = 'trojan horse' + TERM_ZIP_BOMB = 'zip bomb' + -@vocabs.add_allowed_values +@register_vocab class SecurityDegradationProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:SecurityDegradationPropertiesVocab-1.0' _VOCAB_VERSION = '1.0' + TERM_TARGETED_PROGRAM = 'targeted program' -@vocabs.add_allowed_values + +@register_vocab class DiskActionName(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:DiskActionNameVocab-1.1' _VOCAB_VERSION = '1.1' + + TERM_EMULATE_DISK = 'emulate disk' TERM_GET_DISK_ATTRIBUTES = 'get disk attributes' TERM_GET_DISK_TYPE = 'get disk type' + TERM_LIST_DISKS = 'list disks' TERM_MONITOR_DISK = 'monitor disk' TERM_MOUNT_DISK = 'mount disk' - TERM_LIST_DISKS = 'list disks' - TERM_EMULATE_DISK = 'emulate disk' TERM_UNMOUNT_DISK = 'unmount disk' -@vocabs.add_allowed_values + +@register_vocab class IntegrityViolationTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:IntegrityViolationTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_SUBVERT_SYSTEM = 'subvert system' - TERM_CORRUPT_SYSTEM_DATA = 'corrupt system data' + TERM_ANNOY_LOCAL_SYSTEM_USER = 'annoy local system user' - TERM_INTERCEPT_MANIPULATE_NETWORK_TRAFFIC = 'intercept/manipulate network traffic' TERM_ANNOY_REMOTE_USER = 'annoy remote user' + TERM_CORRUPT_SYSTEM_DATA = 'corrupt system data' TERM_CORRUPT_USER_DATA = 'corrupt user data' + TERM_INTERCEPT_MANIPULATE_NETWORK_TRAFFIC = 'intercept/manipulate network traffic' + TERM_SUBVERT_SYSTEM = 'subvert system' + -@vocabs.add_allowed_values +@register_vocab class AntiDetectionTacticalObjectives(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = 'maecVocabs:AntiDetectionTacticalObjectivesVocab-1.0' _VOCAB_VERSION = '1.0' - TERM_HIDE_FILE_SYSTEM_ARTIFACTS = 'hide file system artifacts' - TERM_HIDE_OPEN_NETWORK_PORTS = 'hide open network ports' - TERM_EXECUTE_BEFORE_EXTERNAL_TO_KERNEL_HYPERVISOR = 'execute before/external to kernel/hypervisor' - TERM_HIDE_KERNEL_MODULES = 'hide kernel modules' - TERM_HIDE_PROCESSES = 'hide processes' + TERM_CHANGE_ADD_CONTENT = 'change/add content' - TERM_EXECUTE_STEALTHY_CODE = 'execute stealthy code' - TERM_HIDE_REGISTRY_ARTIFACTS = 'hide registry artifacts' - TERM_HIDE_USERSPACE_LIBRARIES = 'hide userspace libraries' - TERM_HIDE_ARBITRARY_VIRTUAL_MEMORY = 'hide arbitrary virtual memory' + TERM_ENCRYPT_SELF = 'encrypt self' + TERM_EXECUTE_BEFORE_EXTERNAL_TO_KERNEL_HYPERVISOR = 'execute before/external to kernel/hypervisor' TERM_EXECUTE_NON_MAIN_CPU_CODE = 'execute non-main cpu code' + TERM_EXECUTE_STEALTHY_CODE = 'execute stealthy code' TERM_FEED_MISINFORMATION_DURING_PHYSICAL_MEMORY_ACQUISITION = 'feed misinformation during physical memory acquisition' - TERM_PREVENT_PHYSICAL_MEMORY_ACQUISITION = 'prevent physical memory acquisition' - TERM_PREVENT_NATIVE_API_HOOKING = 'prevent native api hooking' - TERM_OBFUSCATE_ARTIFACT_PROPERTIES = 'obfuscate artifact properties' - TERM_ENCRYPT_SELF = 'encrypt self' - TERM_HIDE_SERVICES = 'hide services' + TERM_HIDE_ARBITRARY_VIRTUAL_MEMORY = 'hide arbitrary virtual memory' TERM_HIDE_CODE_IN_FILE = 'hide code in file' + TERM_HIDE_FILE_SYSTEM_ARTIFACTS = 'hide file system artifacts' + TERM_HIDE_KERNEL_MODULES = 'hide kernel modules' TERM_HIDE_NETWORK_TRAFFIC = 'hide network traffic' + TERM_HIDE_OPEN_NETWORK_PORTS = 'hide open network ports' + TERM_HIDE_PROCESSES = 'hide processes' + TERM_HIDE_REGISTRY_ARTIFACTS = 'hide registry artifacts' + TERM_HIDE_SERVICES = 'hide services' TERM_HIDE_THREADS = 'hide threads' - -@vocabs.add_allowed_values -class CapabilityName(EnumString): - TERM_COMMAND_AND_CONTROL = "command and control" - TERM_REMOTE_MACHINE_MANIPULATION = "remote machine manipulation" - TERM_PRIVILEGE_ESCALATION = "privilege escalation" - TERM_DATA_THEFT = "data theft" - TERM_SPYING = "spying" - TERM_SECONDARY_OPERATION = "secondary operation" - TERM_ANTI_DETECTION = "anti-detection" - TERM_ANTI_CODE_ANALYSIS = "anti-code analysis" - TERM_INFECTION_PROPAGATION = "infection/propagation" - TERM_ANTI_BEHAVIORAL_ANALYSIS = "anti-behavioral analysis" - TERM_INTEGRITY_VIOLATION = "integrity violation" - TERM_DATA_EXFILTRATION = "data exfiltration" - TERM_PROBING = "probing" - TERM_ANTI_REMOVAL = "anti-removal" - TERM_SECURITY_DEGRADATION = "security degradation" - TERM_AVAILABILITY_VIOLATION = "availability violation" - TERM_DESTRUCTION = "destruction" - TERM_FRAUD = "fraud" - TERM_PERSISTENCE = "persistence" - TERM_MACHINE_ACCESS_CONTROL = "machine access/control" - -#: Mapping of Controlled Vocabulary xsi:type's to their class implementations. -_VOCAB_MAP = {} - - -def add_vocab(cls): - _VOCAB_MAP[cls._XSI_TYPE] = cls - - -add_vocab(DataTheftTacticalObjectives) -add_vocab(MachineAccessControlTacticalObjectives) -add_vocab(DataTheftProperties) -add_vocab(SecondaryOperationProperties) -add_vocab(SystemActionName) -add_vocab(AvailabilityViolationTacticalObjectives) -add_vocab(ActionObjectAssociationType) -add_vocab(CommonCapabilityProperties) -add_vocab(RemoteMachineManipulationTacticalObjectives) -add_vocab(PrivilegeEscalationStrategicObjectives) -add_vocab(DebuggingActionName) -add_vocab(DataExfiltrationStrategicObjectives) -add_vocab(DeviceDriverActionName) -add_vocab(ImportanceType) -add_vocab(HTTPActionName) -add_vocab(AntiDetectionStrategicObjectives) -add_vocab(SocketActionName) -add_vocab(CommandandControlTacticalObjectives) -add_vocab(HookingActionName) -add_vocab(GroupingRelationship) -add_vocab(PersistenceProperties) -add_vocab(DestructionProperties) -add_vocab(AntiCodeAnalysisStrategicObjectives) -add_vocab(AvailabilityViolationStrategicObjectives) -add_vocab(IPCActionName) -add_vocab(DirectoryActionName) -add_vocab(NetworkShareActionName) -add_vocab(InfectionPropagationProperties) -add_vocab(ProbingStrategicObjectives) -add_vocab(InfectionPropagationTacticalObjectives) -add_vocab(DataExfiltrationProperties) -add_vocab(LibraryActionName) -add_vocab(MalwareDevelopmentTool) -add_vocab(FileActionName) -add_vocab(CommandandControlProperties) -add_vocab(IRCActionName) -add_vocab(InfectionPropagationStrategicObjectives) -add_vocab(MalwareCapability) -add_vocab(AntiBehavioralAnalysisProperties) -add_vocab(DNSActionName) -add_vocab(RemoteMachineManipulationStrategicObjectives) -add_vocab(ProcessActionName) -add_vocab(PersistenceStrategicObjectives) -add_vocab(NetworkActionName) -add_vocab(SecondaryOperationStrategicObjectives) -add_vocab(FraudTacticalObjectives) -add_vocab(ProcessMemoryActionName) -add_vocab(RegistryActionName) -add_vocab(AvailabilityViolationProperties) -add_vocab(CommandandControlStrategicObjectives) -add_vocab(DestructionTacticalObjectives) -add_vocab(SpyingStrategicObjectives) -add_vocab(FTPActionName) -add_vocab(MachineAccessControlStrategicObjectives) -add_vocab(IntegrityViolationStrategicObjectives) -add_vocab(ProbingTacticalObjectives) -add_vocab(MalwareEntityType) -add_vocab(FraudStrategicObjectives) -add_vocab(SpyingTacticalObjectives) -add_vocab(ProcessThreadActionName) -add_vocab(DataTheftStrategicObjectives) -add_vocab(AntiCodeAnalysisTacticalObjectives) -add_vocab(PrivilegeEscalationTacticalObjectives) -add_vocab(MalwareSubjectRelationship) -add_vocab(AntiBehavioralAnalysisTacticalObjectives) -add_vocab(PersistenceTacticalObjectives) -add_vocab(SynchronizationActionName) -add_vocab(AntiRemovalTacticalObjectives) -add_vocab(SecurityDegradationStrategicObjectives) -add_vocab(PrivilegeEscalationProperties) -add_vocab(GUIActionName) -add_vocab(SecurityDegradationTacticalObjectives) -add_vocab(MalwareConfigurationParameter) -add_vocab(MachineAccessControlProperties) -add_vocab(ServiceActionName) -add_vocab(AntiBehavioralAnalysisStrategicObjectives) -add_vocab(CapabilityObjectiveRelationship) -add_vocab(DataExfiltrationTacticalObjectives) -add_vocab(UserActionName) -add_vocab(DestructionStrategicObjectives) -add_vocab(AntiRemovalStrategicObjectives) -add_vocab(SecondaryOperationTacticalObjectives) -add_vocab(MalwareLabel) -add_vocab(SecurityDegradationProperties) -add_vocab(DiskActionName) -add_vocab(IntegrityViolationTacticalObjectives) -add_vocab(AntiDetectionTacticalObjectives) + TERM_HIDE_USERSPACE_LIBRARIES = 'hide userspace libraries' + TERM_OBFUSCATE_ARTIFACT_PROPERTIES = 'obfuscate artifact properties' + TERM_PREVENT_NATIVE_API_HOOKING = 'prevent native api hooking' + TERM_PREVENT_PHYSICAL_MEMORY_ACQUISITION = 'prevent physical memory acquisition' From 3a59db208a217468d786bc40df7ef64e86a9d8a4 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 24 Apr 2015 16:00:53 -0500 Subject: [PATCH 207/297] Fix failing test. --- maec/test/package/package_test.py | 73 +++++++++++++++++++++---------- 1 file changed, 49 insertions(+), 24 deletions(-) diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index 7449fe4..ce9ee0e 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -11,29 +11,54 @@ class TestMalwareSubject(EntityTestCase, unittest.TestCase): klass = MalwareSubject _full_dict = { - 'findings_bundles': {'bundle': [{'actions': [{'associated_objects': [{'association_type': {'value': 'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0'}, - 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', - 'properties': {'file_name': 'abcd.dll', - 'size_in_bytes': 123456L, - 'xsi:type': 'FileObjectType'} - }], - 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', - 'name': {'value': 'create file', - 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0'} - }], - 'capabilities': {'capability': [{'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': 'persistence'}]}, - 'defined_subject': False, - 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', - 'schema_version': '4.1'}] - }, - 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', - 'malware_instance_object_attributes': {'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', - 'properties': {'hashes': [{'simple_hash_value': '8743b52063cd84097a65d1633f5c74f5', - 'type': u'MD5'}], - 'size_in_bytes': 35532L, - 'xsi:type': 'FileObjectType'}}} + 'findings_bundles': { + 'bundle': [{ + 'actions': [{ + 'associated_objects': [{ + 'association_type': { + 'value': u'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + }, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': { + 'file_name': u'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType' + } + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': { + 'value': u'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0' + }, + }], + 'capabilities': { + 'capability': [{ + 'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': { + 'value': 'persistence', + 'xsi:type': 'maecVocabs:MalwareCapabilityVocab-1.0', + } + }], + }, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1' + }] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': { + 'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': { + 'hashes': [{ + 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5' + }], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType' + } + } + } def test_id_autoset(self): o = MalwareSubject() @@ -48,4 +73,4 @@ def test_round_trip(self): if __name__ == "__main__": unittest.main() - \ No newline at end of file + From 0dcce24000677a1a4396e09f3a7bcd77e45e79f7 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 10:19:49 -0400 Subject: [PATCH 208/297] Removed EnumString and tweaked MalwareCapability --- maec/vocabs/vocabs.py | 113 +++++++++--------------------------------- 1 file changed, 23 insertions(+), 90 deletions(-) diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index e4b53ab..6ca2a67 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -4,68 +4,29 @@ import maec from cybox.common.vocabs import VocabString, register_vocab -class EnumString(object): - # All subclasses should override this - _ALLOWED_VALUES = None - - def __init__(self, value=None): - super(EnumString, self).__init__() - self.value = value - - @property - def value(self): - return self._value - - @value.setter - def value(self, v): - allowed = self._ALLOWED_VALUES - - if not v: - self._value = None - elif allowed and (v not in allowed): - error = "Value must be one of {0}. Received '{1}'" - error = error.format(allowed, v) - raise ValueError(error) - else: - self._value = v - - def __str__(self): - return str(self.value) - - def __eq__(self, other): - return other == self.value - - def to_obj(self, return_obj=None, ns_info=None): - return self.value - - def to_dict(self): - return self.value - - @classmethod - def from_obj(cls, vocab_obj, return_obj=None): - if not vocab_obj: - return None - - return_obj = EnumString() - if isinstance(vocab_obj, basestring): - return_obj.value = vocab_obj - - return return_obj - - @classmethod - def from_dict(cls, vocab_dict, return_obj=None): - if not vocab_dict: - return None - - return_obj = EnumString() - if isinstance(vocab_dict, basestring): - return_obj.value = vocab_dict - - return return_obj - - @classmethod - def istypeof(cls, obj): - return isinstance(obj, cls) +@register_vocab +class MalwareCapability(VocabString): + _XSI_TYPE = "maecVocabs:MalwareCapabilityEnum-1.0" + TERM_ANTI_BEHAVIORAL_ANALYSIS = 'anti-behavioral analysis' + TERM_ANTI_CODE_ANALYSIS = 'anti-code analysis' + TERM_ANTI_DETECTION = 'anti-detection' + TERM_ANTI_REMOVAL = 'anti-removal' + TERM_AVAILABILITY_VIOLATION = 'availability violation' + TERM_COMMAND_AND_CONTROL = 'command and control' + TERM_DATA_EXFILTRATION = 'data exfiltration' + TERM_DATA_THEFT = 'data theft' + TERM_DESTRUCTION = 'destruction' + TERM_FRAUD = 'fraud' + TERM_INFECTION_PROPAGATION = 'infection/propagation' + TERM_INTEGRITY_VIOLATION = 'integrity violation' + TERM_MACHINE_ACCESS_CONTROL = 'machine access/control' + TERM_PERSISTENCE = 'persistence' + TERM_PRIVILEGE_ESCALATION = 'privilege escalation' + TERM_PROBING = 'probing' + TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' + TERM_SECONDARY_OPERATION = 'secondary operation' + TERM_SECURITY_DEGRADATION = 'security degradation' + TERM_SPYING = 'spying' @register_vocab @@ -566,34 +527,6 @@ class InfectionPropagationStrategicObjectives(VocabString): TERM_PREVENT_DUPLICATE_INFECTION = 'prevent duplicate infection' -@register_vocab -class MalwareCapability(VocabString): - _namespace = 'http://maec.mitre.org/default_vocabularies-1' - _XSI_TYPE = 'maecVocabs:MalwareCapabilityVocab-1.0' - _VOCAB_VERSION = '1.0' - - TERM_ANTI_BEHAVIORAL_ANALYSIS = 'anti-behavioral analysis' - TERM_ANTI_CODE_ANALYSIS = 'anti-code analysis' - TERM_ANTI_DETECTION = 'anti-detection' - TERM_ANTI_REMOVAL = 'anti-removal' - TERM_AVAILABILITY_VIOLATION = 'availability violation' - TERM_COMMAND_AND_CONTROL = 'command and control' - TERM_DATA_EXFILTRATION = 'data exfiltration' - TERM_DATA_THEFT = 'data theft' - TERM_DESTRUCTION = 'destruction' - TERM_FRAUD = 'fraud' - TERM_INFECTION_PROPAGATION = 'infection/propagation' - TERM_INTEGRITY_VIOLATION = 'integrity violation' - TERM_MACHINE_ACCESS_CONTROL = 'machine access/control' - TERM_PERSISTENCE = 'persistence' - TERM_PRIVILEGE_ESCALATION = 'privilege escalation' - TERM_PROBING = 'probing' - TERM_REMOTE_MACHINE_MANIPULATION = 'remote machine manipulation' - TERM_SECONDARY_OPERATION = 'secondary operation' - TERM_SECURITY_DEGRADATION = 'security degradation' - TERM_SPYING = 'spying' - - @register_vocab class AntiBehavioralAnalysisProperties(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' From bd8eb007ee3cf69624d1d51be217051f25e089ad Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 10:21:56 -0400 Subject: [PATCH 209/297] Reverted Capability/name construction --- maec/test/package/package_test.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index ce9ee0e..d38fb5e 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -35,10 +35,8 @@ class TestMalwareSubject(EntityTestCase, unittest.TestCase): 'capabilities': { 'capability': [{ 'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': { - 'value': 'persistence', - 'xsi:type': 'maecVocabs:MalwareCapabilityVocab-1.0', - } + 'name': 'persistence' + }], }, 'defined_subject': False, From 8d53dbcd92cf6996d26231b2b7b22f4e6332b5ce Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 27 Apr 2015 10:19:13 -0500 Subject: [PATCH 210/297] Clean up unused imports. --- maec/package/malware_subject.py | 4 ++-- maec/vocabs/vocabs.py | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 6671e43..be0498a 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -3,7 +3,7 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved -from cybox.common import vocabs, VocabString, PlatformSpecification, ToolInformationList, ToolInformation +from cybox.common import vocabs, VocabString, PlatformSpecification, ToolInformation from cybox.objects.file_object import File from cybox.objects.uri_object import URI from cybox.core import Object @@ -240,4 +240,4 @@ class MalwareSubjectList(maec.EntityList): _contained_type = MalwareSubject _binding_class = package_binding.MalwareSubjectListType _binding_var = "Malware_Subject" - _namespace = _namespace \ No newline at end of file + _namespace = _namespace diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 6ca2a67..6845ef2 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1,12 +1,15 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -import maec from cybox.common.vocabs import VocabString, register_vocab + @register_vocab class MalwareCapability(VocabString): + _namespace = 'http://maec.mitre.org/default_vocabularies-1' _XSI_TYPE = "maecVocabs:MalwareCapabilityEnum-1.0" + _VOCAB_VERSION = '1.0' + TERM_ANTI_BEHAVIORAL_ANALYSIS = 'anti-behavioral analysis' TERM_ANTI_CODE_ANALYSIS = 'anti-code analysis' TERM_ANTI_DETECTION = 'anti-detection' From 1939ba8064fbb11942d96f009111cf0cb13f8149 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Mon, 27 Apr 2015 10:22:10 -0500 Subject: [PATCH 211/297] Remove unused vocab and general cleanup. --- maec/bundle/capability.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index 04176d8..c0da8c5 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -8,7 +8,6 @@ import maec.bindings.maec_bundle as bundle_binding from maec.bundle import BehaviorReference from cybox.common import VocabString, String -from maec.vocabs.vocabs import MalwareCapability class CapabilityObjectiveReference(maec.Entity): @@ -91,7 +90,7 @@ class Capability(maec.Entity): _binding_class = bundle_binding.CapabilityType id_ = maec.TypedField("id") - name = maec.TypedField("name", MalwareCapability) + name = maec.TypedField("name") description = maec.TypedField("Description") property = maec.TypedField("Property", CapabilityProperty, multiple = True) strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple = True) From 32b513319782361a2b589b411b823b820bea79de Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 12:50:24 -0400 Subject: [PATCH 212/297] Added #noqa for ignoring certain pylint fps --- maec/bundle/__init__.py | 51 ++++++++++++++++++++-------------------- maec/misc/__init__.py | 6 ++--- maec/package/__init__.py | 51 ++++++++++++++++++++-------------------- maec/utils/__init__.py | 13 +++++----- 4 files changed, 59 insertions(+), 62 deletions(-) diff --git a/maec/bundle/__init__.py b/maec/bundle/__init__.py index 38d4cbb..64d4a80 100644 --- a/maec/bundle/__init__.py +++ b/maec/bundle/__init__.py @@ -1,30 +1,29 @@ _namespace = 'http://maec.mitre.org/XMLSchema/maec-bundle-4' -import maec -from .malware_action import (MalwareAction, ActionImplementation, APICall, - ParameterList, Parameter) -from .object_reference import ObjectReferenceList, ObjectReference -from .av_classification import AVClassification, AVClassifications -from .behavior_reference import BehaviorReference -from .behavior import (Behavior, AssociatedCode, BehaviorPurpose, Exploit, - CVEVulnerability, PlatformList, BehavioralActions, - BehavioralAction, BehavioralActionReference, - BehavioralActionEquivalenceReference) -from .action_reference_list import ActionReferenceList -from .candidate_indicator import (CandidateIndicatorList, CandidateIndicator, - CandidateIndicatorComposition, MalwareEntity) -from .process_tree import ProcessTree, ProcessTreeNode -from .bundle_reference import BundleReference -from .capability import (CapabilityList, Capability, CapabilityObjective, - CapabilityProperty, CapabilityRelationship, - CapabilityObjectiveRelationship, CapabilityReference, - CapabilityObjectiveReference) -from .object_history import ObjectHistoryEntry, ObjectHistory -from .bundle import (Bundle, BehaviorReference, Collections, - CandidateIndicatorCollectionList, ObjectCollectionList, - ActionCollectionList, BehaviorCollectionList, - CandidateIndicatorCollection, ObjectCollection, - BehaviorCollection, ActionCollection, BaseCollection, - ObjectList, ActionList, BehaviorList) +from .malware_action import (MalwareAction, ActionImplementation, APICall, # noqa + ParameterList, Parameter) # noqa +from .object_reference import ObjectReferenceList, ObjectReference # noqa +from .av_classification import AVClassification, AVClassifications # noqa +from .behavior_reference import BehaviorReference # noqa +from .behavior import (Behavior, AssociatedCode, BehaviorPurpose, Exploit, # noqa + CVEVulnerability, PlatformList, BehavioralActions, # noqa + BehavioralAction, BehavioralActionReference, # noqa + BehavioralActionEquivalenceReference) # noqa +from .action_reference_list import ActionReferenceList # noqa +from .candidate_indicator import (CandidateIndicatorList, CandidateIndicator, # noqa + CandidateIndicatorComposition, MalwareEntity) # noqa +from .process_tree import ProcessTree, ProcessTreeNode # noqa +from .bundle_reference import BundleReference # noqa +from .capability import (CapabilityList, Capability, CapabilityObjective, # noqa + CapabilityProperty, CapabilityRelationship, # noqa + CapabilityObjectiveRelationship, CapabilityReference, # noqa + CapabilityObjectiveReference) # noqa +from .object_history import ObjectHistoryEntry, ObjectHistory # noqa +from .bundle import (Bundle, BehaviorReference, Collections, # noqa + CandidateIndicatorCollectionList, ObjectCollectionList, # noqa + ActionCollectionList, BehaviorCollectionList, # noqa + CandidateIndicatorCollection, ObjectCollection, # noqa + BehaviorCollection, ActionCollection, BaseCollection, # noqa + ObjectList, ActionList, BehaviorList) # noqa diff --git a/maec/misc/__init__.py b/maec/misc/__init__.py index 7e3d740..5404cce 100644 --- a/maec/misc/__init__.py +++ b/maec/misc/__init__.py @@ -1,3 +1,3 @@ -from .exceptions import (LookupNotFoundException, NetworkFailureException, - APIKeyException) -from .options import ScriptOptions \ No newline at end of file +from .exceptions import (LookupNotFoundException, NetworkFailureException, # noqa + APIKeyException) # noqa +from .options import ScriptOptions # noqa \ No newline at end of file diff --git a/maec/package/__init__.py b/maec/package/__init__.py index 0aa544c..0943921 100644 --- a/maec/package/__init__.py +++ b/maec/package/__init__.py @@ -1,29 +1,28 @@ _namespace = 'http://maec.mitre.org/XMLSchema/maec-package-2' -import maec -from .action_equivalence import ActionEquivalenceList, ActionEquivalence -from .malware_subject_reference import MalwareSubjectReference -from .object_equivalence import ObjectEquivalence, ObjectEquivalenceList -from .analysis import (Analysis, AnalysisEnvironment, NetworkInfrastructure, - CapturedProtocolList, CapturedProtocol, - AnalysisSystemList, AnalysisSystem, InstalledPrograms, - HypervisorHostSystem, DynamicAnalysisMetadata, - ToolList, CommentList, Comment, Source) -from .grouping_relationship import (GroupingRelationshipList, - GroupingRelationship, ClusteringMetadata, - ClusteringAlgorithmParameters, - ClusterComposition, ClusterEdgeNodePair) -from .malware_subject import (MalwareSubjectList, MalwareSubject, - MalwareConfigurationDetails, - MalwareConfigurationObfuscationDetails, - MalwareConfigurationObfuscationAlgorithm, - MalwareConfigurationStorageDetails, - MalwareBinaryConfigurationStorageDetails, - MalwareConfigurationParameter, - MalwareDevelopmentEnvironment, - FindingsBundleList, MetaAnalysis, - MalwareSubjectRelationshipList, - MalwareSubjectRelationship, Analyses, - MinorVariants) +from .action_equivalence import ActionEquivalenceList, ActionEquivalence # noqa +from .malware_subject_reference import MalwareSubjectReference # noqa +from .object_equivalence import ObjectEquivalence, ObjectEquivalenceList # noqa +from .analysis import (Analysis, AnalysisEnvironment, NetworkInfrastructure, # noqa + CapturedProtocolList, CapturedProtocol, # noqa + AnalysisSystemList, AnalysisSystem, InstalledPrograms, # noqa + HypervisorHostSystem, DynamicAnalysisMetadata, # noqa + ToolList, CommentList, Comment, Source) # noqa +from .grouping_relationship import (GroupingRelationshipList, # noqa + GroupingRelationship, ClusteringMetadata, # noqa + ClusteringAlgorithmParameters, # noqa + ClusterComposition, ClusterEdgeNodePair) # noqa +from .malware_subject import (MalwareSubjectList, MalwareSubject, # noqa + MalwareConfigurationDetails, # noqa + MalwareConfigurationObfuscationDetails, # noqa + MalwareConfigurationObfuscationAlgorithm, # noqa + MalwareConfigurationStorageDetails, # noqa + MalwareBinaryConfigurationStorageDetails, # noqa + MalwareConfigurationParameter, # noqa + MalwareDevelopmentEnvironment, # noqa + FindingsBundleList, MetaAnalysis, # noqa + MalwareSubjectRelationshipList, # noqa + MalwareSubjectRelationship, Analyses, # noqa + MinorVariants) # noqa -from .package import Package +from .package import Package # noqa diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 8a4dc95..8d9c799 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -18,10 +18,9 @@ def flip_dict(d): # Namespace flattening -import maec -from .nsparser import maecMETA -from .idgen import * -from .parser import EntityParser -from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, - ComparisonResult) -from .deduplicator import BundleDeduplicator +from .nsparser import maecMETA # noqa +from .idgen import * # noqa +from .parser import EntityParser # noqa +from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, # noqa + ComparisonResult) # noqa +from .deduplicator import BundleDeduplicator # noqa From f10d88890fa2d13f740c00834b541b37a39522aa Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 13:09:21 -0400 Subject: [PATCH 213/297] Fixed a few unit tests (ms_test was empty and package_test was really testing Malware Subjects) --- maec/test/package/malware_subject_test.py | 58 ++++++++++++-- maec/test/package/package_test.py | 97 ++++++++++++----------- 2 files changed, 101 insertions(+), 54 deletions(-) diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index ceeb1b8..6123587 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -4,22 +4,68 @@ import unittest from cybox.test import EntityTestCase, round_trip -from maec.package.analysis import Analysis +from maec.package.malware_subject import MalwareSubject +from maec.bundle.bundle import Bundle - -class TestPackage(EntityTestCase, unittest.TestCase): - klass = Analysis +class TestMalwareSubject(EntityTestCase, unittest.TestCase): + klass = MalwareSubject _full_dict = { + 'label':['worm','virus'], + 'findings_bundles': { + 'bundle': [{ + 'actions': [{ + 'associated_objects': [{ + 'association_type': { + 'value': u'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + }, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': { + 'file_name': u'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType' + } + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': { + 'value': u'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0' + }, + }], + 'capabilities': { + 'capability': [{ + 'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence' + }], + }, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1' + }] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': { + 'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': { + 'hashes': [{ + 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5' + }], + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType' + } + } } def test_id_autoset(self): - o = Analysis() + o = MalwareSubject() self.assertNotEqual(o.id_, None) def test_round_trip(self): - o = Analysis() + o = MalwareSubject() + o.add_findings_bundle(Bundle()) o2 = round_trip(o) self.assertEqual(o.to_dict(), o2.to_dict()) diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index d38fb5e..5dd92e5 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -4,67 +4,68 @@ import unittest from cybox.test import EntityTestCase, round_trip -from maec.package.malware_subject import MalwareSubject -from maec.bundle.bundle import Bundle +from maec.package import Package -class TestMalwareSubject(EntityTestCase, unittest.TestCase): - klass = MalwareSubject +class TestPackage(EntityTestCase, unittest.TestCase): + klass = Package _full_dict = { - 'findings_bundles': { - 'bundle': [{ - 'actions': [{ - 'associated_objects': [{ - 'association_type': { - 'value': u'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + 'malware_subjects':[{ + 'findings_bundles': { + 'bundle': [{ + 'actions': [{ + 'associated_objects': [{ + 'association_type': { + 'value': u'output', + 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' + }, + 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', + 'properties': { + 'file_name': u'abcd.dll', + 'size_in_bytes': 123456L, + 'xsi:type': 'FileObjectType' + } + }], + 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', + 'name': { + 'value': u'create file', + 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0' }, - 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', - 'properties': { - 'file_name': u'abcd.dll', - 'size_in_bytes': 123456L, - 'xsi:type': 'FileObjectType' - } }], - 'id': 'example:action-912c7a09-91f5-4737-9b5a-129eb42488bf', - 'name': { - 'value': u'create file', - 'xsi:type': 'maecVocabs:FileActionNameVocab-1.0' - }, - }], - 'capabilities': { - 'capability': [{ - 'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', - 'name': 'persistence' + 'capabilities': { + 'capability': [{ + 'id': 'example:capability-5b1f99c6-203b-422d-831e-b440a1a32052', + 'name': 'persistence' + }], + }, + 'defined_subject': False, + 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', + 'schema_version': '4.1' + }] + }, + 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', + 'malware_instance_object_attributes': { + 'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', + 'properties': { + 'hashes': [{ + 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', + 'type': u'MD5' }], - }, - 'defined_subject': False, - 'id': 'example:bundle-09642c48-9136-4f46-98b2-e8f9fb6f69ad', - 'schema_version': '4.1' - }] - }, - 'id': 'example:malware_subject-89f6a399-badf-43cc-bf66-fd97c66ce4b2', - 'malware_instance_object_attributes': { - 'id': 'example:Object-aeb67018-a0e9-4199-bafa-1f0c581fb315', - 'properties': { - 'hashes': [{ - 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', - 'type': u'MD5' - }], - 'size_in_bytes': 35532L, - 'xsi:type': 'FileObjectType' - } - } + 'size_in_bytes': 35532L, + 'xsi:type': 'FileObjectType' + } + }}], + 'grouping_relationships':[{'type':{'value':'same malware family', + 'xsi:type':'maecVocabs:GroupingRelationshipTypeVocab-1.0'}}] } def test_id_autoset(self): - o = MalwareSubject() + o = Package() self.assertNotEqual(o.id_, None) def test_round_trip(self): - o = MalwareSubject() - o.add_findings_bundle(Bundle()) + o = Package() o2 = round_trip(o) self.assertEqual(o.to_dict(), o2.to_dict()) From 8a732105208363de94d59044aa4aebe30eb7493f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 14:54:46 -0400 Subject: [PATCH 214/297] Updated for coherency w/ CybOX vocabulary updates --- examples/package_generation_example.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/examples/package_generation_example.py b/examples/package_generation_example.py index 7022dbc..814f1c2 100644 --- a/examples/package_generation_example.py +++ b/examples/package_generation_example.py @@ -6,7 +6,7 @@ # - A single Capability embedded in the Bundle from cybox.core import AssociatedObjects, AssociatedObject, Object, AssociationType -from cybox.common import Hash, HashList +from cybox.common import Hash, HashList, VocabString from cybox.objects.file_object import File from maec.bundle import Bundle, Collections, MalwareAction, Capability from maec.package import Analysis, MalwareSubject, Package @@ -35,12 +35,13 @@ associated_object.properties = File() associated_object.properties.file_name = 'abcd.dll' associated_object.properties.size_in_bytes = '123456' -associated_object.association_type = AssociationType() +associated_object.association_type = VocabString() associated_object.association_type.value = 'output' associated_object.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' # Create the Action from another dictionary action = MalwareAction() -action.name = 'create file' +action.name = VocabString() +action.name.value = 'create file' action.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' action.associated_objects = AssociatedObjects() action.associated_objects.append(associated_object) From e3f17d8db408811ab1bdef6c1f3e91db57795c49 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 14:55:36 -0400 Subject: [PATCH 215/297] Updated for new python-cybox dependency --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 0431f91..4f5fdc0 100644 --- a/setup.py +++ b/setup.py @@ -46,7 +46,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.9,<2.1.1.0'], + install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.11,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", From 28e8f1200f5229c45329b416b6106a1ce5e08d4c Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 14:58:47 -0400 Subject: [PATCH 216/297] Updated for coherency w/ python-cybox vocabulary updates --- docs/examples.rst | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/examples.rst b/docs/examples.rst index 523172d..bdbc32e 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -197,8 +197,9 @@ needed. from maec.bundle import Bundle from maec.bundle import MalwareAction from maec.utils import IDGenerator, set_id_method - from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType + from cybox.core import Object, AssociatedObjects, AssociatedObject from cybox.objects.file_object import File + from cybox.common import VocabString set_id_method(IDGenerator.METHOD_INT) b = Bundle() @@ -208,11 +209,12 @@ needed. ao.properties = File() ao.properties.file_name = "badware.exe" ao.properties.size_in_bytes = "123456" - ao.association_type = AssociationType() + ao.association_type = VocabString() ao.association_type.value = 'output' ao.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' - a.name = 'create file' + a.name = VocabString() + a.name.value = 'create file' a.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' a.associated_objects = AssociatedObjects() a.associated_objects.append(ao) From 58480ebbe2d979babd464388755b14c1ac7b7e69 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 15:00:07 -0400 Subject: [PATCH 217/297] Updated for coherency w/ python-cybox vocabulary updates --- docs/api_vs_bindings/api_snippet.rst | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/api_vs_bindings/api_snippet.rst b/docs/api_vs_bindings/api_snippet.rst index b9ef8f6..202d1ce 100644 --- a/docs/api_vs_bindings/api_snippet.rst +++ b/docs/api_vs_bindings/api_snippet.rst @@ -3,8 +3,9 @@ # Import the required APIs from maec.bundle import Bundle, MalwareAction from maec.utils import IDGenerator, set_id_method - from cybox.core import Object, AssociatedObjects, AssociatedObject, AssociationType + from cybox.core import Object, AssociatedObjects, AssociatedObject from cybox.objects.file_object import File + from cybox.common import VocabString # Instantiate the MAEC/CybOX Entities set_id_method(IDGenerator.METHOD_INT) @@ -16,12 +17,13 @@ ao.properties = File() ao.properties.file_name = "badware.exe" ao.properties.size_in_bytes = "123456" - ao.association_type = AssociationType() + ao.association_type = VocabString() ao.association_type.value = 'output' ao.association_type.xsi_type = 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' # Build the Action and add the Associated Object to it - a.name = 'create file' + a.name = VocabString() + a.name.value = 'create file' a.name.xsi_type = 'maecVocabs:FileActionNameVocab-1.0' a.associated_objects = AssociatedObjects() a.associated_objects.append(ao) @@ -30,4 +32,4 @@ b.add_action(a) # Output the Bundle to stdout - print b.to_xml(include_namespaces = False) \ No newline at end of file + print b.to_xml(include_namespaces = False) From 6ac786696e2dc5f5231035013f3b1df7b111b468 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 15:19:54 -0400 Subject: [PATCH 218/297] Add relative import for vocabs --- maec/vocabs/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/maec/vocabs/__init__.py b/maec/vocabs/__init__.py index e69de29..d82ed31 100644 --- a/maec/vocabs/__init__.py +++ b/maec/vocabs/__init__.py @@ -0,0 +1 @@ +from .vocabs import * # noqa \ No newline at end of file From 1df7d8962d70432100f1b87d9b39912b4716b05e Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 27 Apr 2015 15:31:36 -0400 Subject: [PATCH 219/297] Updated to 4.1.0.12 --- CHANGES.txt | 7 ++++++- docs/index.rst | 6 +++--- maec/version.py | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 1075fcb..96b0451 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,8 @@ +Version 4.1.0.12 +2015-04-27 +- Added formal vocabulary support (a la python-stix/cybox) +- [#69] Updated python-cybox dependency to 2.1.0.11 + Version 4.1.0.11 2015-02-20 - Fixed a deduplicator logic bug @@ -23,4 +28,4 @@ Version 4.1.0.8 - Greatly expanded documentation (http://maec.readthedocs.org/en/latest/) - Added unit tests - [#53] Added script options class -- Various bug fixes \ No newline at end of file +- Various bug fixes diff --git a/docs/index.rst b/docs/index.rst index 83a5620..f667181 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -15,13 +15,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.11 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.12 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.11 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.11 +__ https://pypi.python.org/pypi/maec/4.1.0.12 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.12 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 diff --git a/maec/version.py b/maec/version.py index 069b579..04e48f8 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.12.dev0" +__version__ = "4.1.0.12" From aed2cc50b95e4357d1bb0149a2a846461262061d Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Tue, 28 Apr 2015 12:39:27 -0400 Subject: [PATCH 220/297] Update version.py --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index 04e48f8..433fd32 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.12" +__version__ = "4.1.0.13dev0" From da36399eaf09b5b3711b45c2f41abca17fa0fe58 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 1 May 2015 14:33:42 -0500 Subject: [PATCH 221/297] PEP8 cleanup. --- maec/bundle/capability.py | 39 +++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index c0da8c5..f6bfacd 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -19,7 +19,8 @@ class CapabilityObjectiveReference(maec.Entity): def __init__(self): super(CapabilityObjectiveReference, self).__init__() - + + class CapabilityReference(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -30,30 +31,33 @@ class CapabilityReference(maec.Entity): def __init__(self): super(CapabilityReference, self).__init__() + class CapabilityObjectiveRelationship(maec.Entity): _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveRelationshipType relationship_type = maec.TypedField("Relationship_Type", VocabString) - objective_reference = maec.TypedField("Objective_Reference", CapabilityObjectiveReference, multiple = True) + objective_reference = maec.TypedField("Objective_Reference", CapabilityObjectiveReference, multiple=True) def __init__(self): super(CapabilityObjectiveRelationship, self).__init__() self.objective_reference = [] + class CapabilityRelationship(maec.Entity): _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityRelationshipType relationship_type = maec.TypedField("Relationship_Type", VocabString) - capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple = True) + capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple=True) def __init__(self): super(CapabilityRelationship, self).__init__() self.capability_reference = [] + class CapabilityProperty(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -65,6 +69,7 @@ class CapabilityProperty(maec.Entity): def __init__(self): super(CapabilityProperty, self).__init__() + class CapabilityObjective(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -73,17 +78,18 @@ class CapabilityObjective(maec.Entity): id_ = maec.TypedField("id") name = maec.TypedField("Name", VocabString) description = maec.TypedField("Description") - property = maec.TypedField("Property", CapabilityProperty, multiple = True) - behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) - relationship = maec.TypedField("Relationship", CapabilityObjectiveRelationship, multiple = True) + property = maec.TypedField("Property", CapabilityProperty, multiple=True) + behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple=True) + relationship = maec.TypedField("Relationship", CapabilityObjectiveRelationship, multiple=True) - def __init__(self, id = None): + def __init__(self, id=None): super(CapabilityObjective, self).__init__() if id: self.id_ = id else: self.id_ = maec.utils.idgen.create_id(prefix="capability_objective") + class Capability(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -92,13 +98,13 @@ class Capability(maec.Entity): id_ = maec.TypedField("id") name = maec.TypedField("name") description = maec.TypedField("Description") - property = maec.TypedField("Property", CapabilityProperty, multiple = True) - strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple = True) - tactical_objective = maec.TypedField("Tactical_Objective", CapabilityObjective, multiple = True) - behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) - relationship = maec.TypedField("Relationship", CapabilityRelationship, multiple = True) + property = maec.TypedField("Property", CapabilityProperty, multiple=True) + strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple=True) + tactical_objective = maec.TypedField("Tactical_Objective", CapabilityObjective, multiple=True) + behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple=True) + relationship = maec.TypedField("Relationship", CapabilityRelationship, multiple=True) - def __init__(self, id = None, name = None): + def __init__(self, id=None, name=None): super(Capability, self).__init__() if id: self.id_ = id @@ -117,14 +123,15 @@ def add_strategic_objective(self, strategic_objective): if not self.strategic_objective: self.strategic_objective = [] self.strategic_objective.append(strategic_objective) - + + class CapabilityList(maec.Entity): _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.CapabilityListType - capability = maec.TypedField("Capability", Capability, multiple = True) - capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple = True) + capability = maec.TypedField("Capability", Capability, multiple=True) + capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple=True) def __init__(self): super(CapabilityList, self).__init__() From 915ed9b0f3949849b906974f702554fb6d7f0ba5 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 11 May 2015 13:44:31 -0400 Subject: [PATCH 222/297] Updated Comment to work properly with CybOX StructuredText --- maec/package/analysis.py | 48 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 46 insertions(+), 2 deletions(-) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index bc5c377..7539d27 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -35,8 +35,8 @@ class Comment(StructuredText): timestamp = maec.TypedField("timestamp") observation_name = maec.TypedField("observation_name") - def __init__(self): - super(Comment, self).__init__() + def __init__(self, value=None): + super(Comment, self).__init__(value) def is_plain(self): """Whether this can be represented as a string rather than a dictionary @@ -46,6 +46,50 @@ def is_plain(self): self.timestamp is None and self.observation_name is None) + def to_obj(self, return_obj=None, ns_info=None): + comment_obj = super(Comment, self).to_obj(return_obj=package_binding.CommentType()) + if self.author: comment_obj.author = self.author + if self.timestamp: comment_obj.timestamp = self.timestamp + if self.observation_name: comment_obj.observation_name = self.observation_name + + return comment_obj + + def to_dict(self): + comment_dict = super(Comment, self).to_dict() + if self.author: comment_dict['author'] = self.author + if self.timestamp: comment_dict['timestamp'] = self.timestamp + if self.observation_name: comment_dict['observation_name'] = self.observation_name + + return comment_dict + + @classmethod + def from_obj(cls, comment_obj): + if not comment_obj: + return None + + comment = Comment(comment_obj.valueOf_) + if comment_obj.author: comment.author = comment_obj.author + if comment_obj.timestamp: comment.timestamp = comment_obj.timestamp + if comment_obj.observation_name: comment.observation_name = comment_obj.observation_name + + return comment + + @classmethod + def from_dict(cls, comment_dict): + if not comment_dict: + return None + + comment = Comment() + if not isinstance(comment_dict, dict): + comment.value = comment_dict + else: + comment.value = comment_dict.get('value') + comment.author = comment_dict.get('author') + comment.timestamp = comment_dict.get('timestamp') + comment.observation_name = comment_dict.get('observation_name') + + return comment + class CommentList(maec.EntityList): _contained_type = Comment _binding_class = package_binding.CommentListType From f5bbb83f3bcd66704c86ed09022a64803b4fb40e Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 29 May 2015 14:00:45 -0500 Subject: [PATCH 223/297] Bump sphinx version to 1.3.1 to match Read The Docs. --- docs/conf.py | 2 +- setup.py | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/docs/conf.py b/docs/conf.py index d7c113d..ab8d807 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -13,7 +13,7 @@ 'sphinx.ext.ifconfig', 'sphinx.ext.intersphinx', 'sphinx.ext.viewcode', - 'sphinxcontrib.napoleon', + 'sphinx.ext.napoleon', ] intersphinx_mapping = { diff --git a/setup.py b/setup.py index 4f5fdc0..ae35cac 100644 --- a/setup.py +++ b/setup.py @@ -25,11 +25,8 @@ def get_version(): extras_require = { 'docs': [ - 'Sphinx==1.2.1', - # TODO: remove when updating to Sphinx 1.3, since napoleon will be - # included as sphinx.ext.napoleon - 'sphinxcontrib-napoleon==0.2.4', - 'sphinx_rtd_theme==0.1.7', + 'Sphinx==1.3.1', + 'sphinx_rtd_theme==0.1.8', ], 'test': [ "nose==1.3.0", From 2053a65c504db4f1079a9aa578d4d8dceb7ce9a7 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 29 May 2015 14:36:20 -0500 Subject: [PATCH 224/297] Use mixbox for common binding code. --- maec/bindings/__init__.py | 384 -------------------------------- maec/bindings/maec_bundle.py | 5 +- maec/bindings/maec_container.py | 5 +- maec/bindings/maec_package.py | 5 +- maec/bindings/mmdef_1_2.py | 2 +- maec/test/encoding_test.py | 91 +------- setup.py | 2 +- 7 files changed, 17 insertions(+), 477 deletions(-) diff --git a/maec/bindings/__init__.py b/maec/bindings/__init__.py index ac20839..e69de29 100644 --- a/maec/bindings/__init__.py +++ b/maec/bindings/__init__.py @@ -1,384 +0,0 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import base64 -from datetime import datetime, tzinfo, timedelta -import re -import contextlib -import cybox.bindings as cybox_bindings - -from xml.sax import saxutils -from lxml import etree as etree_ - -CDATA_START = "" - -ExternalEncoding = 'utf-8' -Tag_pattern_ = re.compile(r'({.*})?(.*)') - -# These are only used internally -_tzoff_pattern = re.compile(r'(\+|-)((0\d|1[0-3]):[0-5]\d|14:00)$') -_Tag_strip_pattern_ = re.compile(r'\{.*\}') - - -@contextlib.contextmanager -def save_encoding(encoding='utf-8'): - global ExternalEncoding - - try: - orig_maec_encoding = ExternalEncoding - orig_cybox_encoding = cybox_bindings.ExternalEncoding - - ExternalEncoding = encoding - cybox_bindings.ExternalEncoding = encoding - - yield - finally: - ExternalEncoding = orig_maec_encoding - cybox_bindings.ExternalEncoding = orig_cybox_encoding - - -def parsexml_(*args, **kwargs): - if 'parser' not in kwargs: - # Use the lxml ElementTree compatible parser so that, e.g., - # we ignore comments. - kwargs['parser'] = etree_.ETCompatXMLParser(huge_tree=True) - return etree_.parse(*args, **kwargs) - - -class _FixedOffsetTZ(tzinfo): - - def __init__(self, offset, name): - self.__offset = timedelta(minutes = offset) - self.__name = name - - def utcoffset(self, dt): - return self.__offset - - def tzname(self, dt): - return self.__name - - def dst(self, dt): - return None - - -class GeneratedsSuper(object): - - def gds_format_string(self, input_data, input_name=''): - return input_data - - def gds_validate_string(self, input_data, node, input_name=''): - return input_data - - def gds_format_base64(self, input_data, input_name=''): - return base64.b64encode(input_data) - - def gds_validate_base64(self, input_data, node, input_name=''): - return input_data - - def gds_format_integer(self, input_data, input_name=''): - return '%d' % input_data - - def gds_validate_integer(self, input_data, node, input_name=''): - return input_data - - def gds_format_integer_list(self, input_data, input_name=''): - return '%s' % input_data - - def gds_validate_integer_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of integers') - return input_data - - def gds_format_float(self, input_data, input_name=''): - return '%f' % input_data - - def gds_validate_float(self, input_data, node, input_name=''): - return input_data - - def gds_format_float_list(self, input_data, input_name=''): - return '%s' % input_data - - def gds_validate_float_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of floats') - return input_data - - def gds_format_double(self, input_data, input_name=''): - return '%e' % input_data - - def gds_validate_double(self, input_data, node, input_name=''): - return input_data - - def gds_format_double_list(self, input_data, input_name=''): - return '%s' % input_data - - def gds_validate_double_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - try: - fvalue = float(value) - except (TypeError, ValueError), exp: - raise_parse_error(node, 'Requires sequence of doubles') - return input_data - - def gds_format_boolean(self, input_data, input_name=''): - return ('%s' % input_data).lower() - - def gds_validate_boolean(self, input_data, node, input_name=''): - return input_data - - def gds_format_boolean_list(self, input_data, input_name=''): - return '%s' % input_data - - def gds_validate_boolean_list(self, input_data, node, input_name=''): - values = input_data.split() - for value in values: - if value not in ('true', '1', 'false', '0', ): - raise_parse_error(node, - 'Requires sequence of booleans ' - '("true", "1", "false", "0")') - return input_data - - def gds_validate_datetime(self, input_data, node, input_name=''): - return input_data - - def gds_format_datetime(self, input_data, input_name=''): - if isinstance(input_data, basestring): - return input_data - if input_data.microsecond == 0: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S') - else: - _svalue = input_data.strftime('%Y-%m-%dT%H:%M:%S.%f') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - - def gds_parse_datetime(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = _FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = _tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = _FixedOffsetTZ(tzoff, results.group(0)) - input_data = input_data[:-6] - if len(input_data.split('.')) > 1: - dt = datetime.strptime(input_data, '%Y-%m-%dT%H:%M:%S.%f') - else: - dt = datetime.strptime(input_data, '%Y-%m-%dT%H:%M:%S') - return dt.replace(tzinfo = tz) - - def gds_validate_date(self, input_data, node, input_name=''): - return input_data - - def gds_format_date(self, input_data, input_name=''): - if isinstance(input_data, basestring): - return input_data - _svalue = input_data.strftime('%Y-%m-%d') - if input_data.tzinfo is not None: - tzoff = input_data.tzinfo.utcoffset(input_data) - if tzoff is not None: - total_seconds = tzoff.seconds + (86400 * tzoff.days) - if total_seconds == 0: - _svalue += 'Z' - else: - if total_seconds < 0: - _svalue += '-' - total_seconds *= -1 - else: - _svalue += '+' - hours = total_seconds // 3600 - minutes = (total_seconds - (hours * 3600)) // 60 - _svalue += '{0:02d}:{1:02d}'.format(hours, minutes) - return _svalue - - def gds_parse_date(self, input_data, node, input_name=''): - tz = None - if input_data[-1] == 'Z': - tz = _FixedOffsetTZ(0, 'GMT') - input_data = input_data[:-1] - else: - results = _tzoff_pattern.search(input_data) - if results is not None: - tzoff_parts = results.group(2).split(':') - tzoff = int(tzoff_parts[0]) * 60 + int(tzoff_parts[1]) - if results.group(1) == '-': - tzoff *= -1 - tz = _FixedOffsetTZ(tzoff, results.group(0)) - input_data = input_data[:-6] - return datetime.strptime(input_data, '%Y-%m-%d').replace(tzinfo = tz) - - def gds_str_lower(self, instring): - return instring.lower() - - def get_path_(self, node): - path_list = [] - self.get_path_list_(node, path_list) - path_list.reverse() - path = '/'.join(path_list) - return path - - def get_path_list_(self, node, path_list): - if node is None: - return - tag = _Tag_strip_pattern_.sub('', node.tag) - if tag: - path_list.append(tag) - self.get_path_list_(node.getparent(), path_list) - - def get_class_obj_(self, node, default_class=None): - class_obj1 = default_class - if 'xsi' in node.nsmap: - classname = node.get('{%s}type' % node.nsmap['xsi']) - if classname is not None: - names = classname.split(':') - if len(names) == 2: - classname = names[1] - class_obj2 = globals().get(classname) - if class_obj2 is not None: - class_obj1 = class_obj2 - return class_obj1 - - def gds_build_any(self, node, type_name=None): - return None - - -def showIndent(lwrite, level, pretty_print=True): - if pretty_print: - lwrite(' ' * level) - - -def quote_xml(text): - if text is None: - return u'' - - # Convert `text` to unicode string. This is mainly a catch-all for non - # string/unicode types like bool and int. - try: - text = unicode(text) - except UnicodeDecodeError: - text = text.decode(ExternalEncoding) - - # If it's a CDATA block, return the text as is. - if text.startswith(CDATA_START): - return text - - # If it's not a CDATA block, escape the XML and return the character - # encoded string. - return saxutils.escape(text) - - -def quote_attrib(text): - if text is None: - return u'""' - - # Convert `text` to unicode string. This is mainly a catch-all for non - # string/unicode types like bool and int. - try: - text = unicode(text) - except UnicodeDecodeError: - text = text.decode(ExternalEncoding) - - # Return the escaped the value of text. - # Note: This wraps the escaped text in quotation marks. - return saxutils.quoteattr(text) - - -def quote_python(inStr): - s1 = inStr - if s1.find("'") == -1: - if s1.find('\n') == -1: - return "'%s'" % s1 - else: - return "'''%s'''" % s1 - else: - if s1.find('"') != -1: - s1 = s1.replace('"', '\\"') - if s1.find('\n') == -1: - return '"%s"' % s1 - else: - return '"""%s"""' % s1 - - -def get_all_text_(node): - if node.text is not None: - text = node.text - else: - text = '' - for child in node: - if child.tail is not None: - text += child.tail - return text - - -def find_attr_value_(attr_name, node): - attrs = node.attrib - attr_parts = attr_name.split(':') - value = None - if len(attr_parts) == 1: - value = attrs.get(attr_name) - elif len(attr_parts) == 2: - prefix, name = attr_parts - namespace = node.nsmap.get(prefix) - if namespace is not None: - value = attrs.get('{%s}%s' % (namespace, name, )) - return value - - -class GDSParseError(Exception): - pass - - -def raise_parse_error(node, msg): - msg = '%s (element %s/line %d)' % (msg, node.tag, node.sourceline, ) - raise GDSParseError(msg) - - -def _cast(typ, value): - if typ is None or value is None: - return value - return typ(value) - - -__all__ = [ - '_cast', - 'etree_', - 'ExternalEncoding', - 'find_attr_value_', - 'get_all_text_', - 'parsexml_', - 'quote_xml', - 'quote_attrib', - 'quote_python', - 'raise_parse_error', - 'showIndent', - 'Tag_pattern_', - 'GeneratedsSuper', -] \ No newline at end of file diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 9c3642f..26d5fd2 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -3,7 +3,8 @@ import sys -from maec.bindings import * +from mixbox.binding_utils import * + from cybox.bindings import cybox_core from cybox.bindings import cybox_common from cybox.bindings import code_object @@ -4801,4 +4802,4 @@ def main(): "ActionCollectionListType": ActionCollectionListType, "ObjectCollectionListType": ObjectCollectionListType, "AVClassificationType": AVClassificationType -} \ No newline at end of file +} diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index 93d0570..d851d2c 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -3,7 +3,8 @@ import sys -from maec.bindings import * +from mixbox.binding_utils import * + from maec.bindings import maec_package as maec_package_schema class ContainerType(GeneratedsSuper): @@ -264,4 +265,4 @@ def main(): GDSClassesMapping = { "ContainerType": ContainerType, "PackageListType": PackageListType -} \ No newline at end of file +} diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index fd04d34..ff15b89 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -3,7 +3,8 @@ import sys -from maec.bindings import * +from mixbox.binding_utils import * + from maec.bindings import maec_bundle as maec_bundle_schema from maec.bindings import mmdef_1_2 as metadatasharing from cybox.bindings import cybox_core @@ -3835,4 +3836,4 @@ def main(): "CapturedProtocolType": CapturedProtocolType, "ObjectEquivalenceType": ObjectEquivalenceType, "ObjectEquivalenceListType": ObjectEquivalenceListType -} \ No newline at end of file +} diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 086b966..d4743bf 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -4,7 +4,7 @@ import sys -from maec.bindings import * +from mixbox.binding_utils import * class malwareMetaData(GeneratedsSuper): """This is the top level element for the xml document. Required diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py index 9f3cc1c..33873e1 100644 --- a/maec/test/encoding_test.py +++ b/maec/test/encoding_test.py @@ -5,9 +5,9 @@ """Tests for various encoding issues throughout the library""" import unittest -from StringIO import StringIO -import maec.bindings as bindings +from mixbox import binding_utils + from maec.package.malware_subject import MalwareConfigurationParameter from maec.package.analysis import DynamicAnalysisMetadata from maec.package.grouping_relationship import GroupingRelationship @@ -24,12 +24,12 @@ class EncodingTests(unittest.TestCase): @classmethod def setUpClass(cls): - cls.orig_encoding = bindings.ExternalEncoding - bindings.ExternalEncoding = 'utf-16' + cls.orig_encoding = binding_utils.ExternalEncoding + binding_utils.ExternalEncoding = 'utf-16' @classmethod def tearDownClass(cls): - bindings.ExternalEncoding = cls.orig_encoding + binding_utils.ExternalEncoding = cls.orig_encoding def test_malware_configuration_parameter(self): config = MalwareConfigurationParameter() @@ -73,85 +73,6 @@ def test_av_classification(self): self.assertEqual(av_class.definition_version, av_class2.definition_version) self.assertEqual(av_class.classification_name, av_class2.classification_name) - def test_quote_xml(self): - s = bindings.quote_xml(UNICODE_STR) - self.assertEqual(s, UNICODE_STR) - - def test_quote_attrib(self): - """Tests that the maec.bindings.quote_attrib method works properly - on unicode inputs. - - Note: - The quote_attrib method (more specifically, saxutils.quoteattr()) - adds quotation marks around the input data, so we need to strip - the leading and trailing chars to test effectively - """ - s = bindings.quote_attrib(UNICODE_STR) - s = s[1:-1] - self.assertEqual(s, UNICODE_STR) - - def test_quote_attrib_int(self): - i = 65536 - s = bindings.quote_attrib(i) - self.assertEqual(u'"65536"', s) - - def test_quote_attrib_bool(self): - b = True - s = bindings.quote_attrib(b) - self.assertEqual(u'"True"', s) - - def test_quote_xml_int(self): - i = 65536 - s = bindings.quote_xml(i) - self.assertEqual(unicode(i), s) - - def test_quote_xml_bool(self): - b = True - s = bindings.quote_xml(b) - self.assertEqual(unicode(b), s) - - def test_quote_xml_encoded(self): - encoding = bindings.ExternalEncoding - encoded = UNICODE_STR.encode(encoding) - quoted = bindings.quote_xml(encoded) - self.assertEqual(UNICODE_STR, quoted) - - def test_quote_attrib_encoded(self): - encoding = bindings.ExternalEncoding - encoded = UNICODE_STR.encode(encoding) - quoted = bindings.quote_attrib(encoded)[1:-1] - self.assertEqual(UNICODE_STR, quoted) - - def test_quote_xml_zero(self): - i = 0 - s = bindings.quote_xml(i) - self.assertEqual(unicode(i), s) - - def test_quote_attrib_zero(self): - i = 0 - s = bindings.quote_attrib(i) - self.assertEqual(u'"0"', s) - - def test_quote_xml_none(self): - i = None - s = bindings.quote_xml(i) - self.assertEqual(u'', s) - - def test_quote_attrib_none(self): - i = None - s = bindings.quote_attrib(i) - self.assertEqual(u'""', s) - - def test_quote_attrib_empty(self): - i = '' - s = bindings.quote_attrib(i) - self.assertEqual(u'""', s) - - def test_quote_xml_empty(self): - i = '' - s = bindings.quote_xml(i) - self.assertEqual(u'', s) - def test_to_xml_utf16_encoded(self): encoding = 'utf-16' b = Behavior() @@ -173,4 +94,4 @@ def test_to_xml_no_encoding(self): self.assertTrue(UNICODE_STR in xml) if __name__ == "__main__": - unittest.main() \ No newline at end of file + unittest.main() diff --git a/setup.py b/setup.py index ae35cac..2ea1a2f 100644 --- a/setup.py +++ b/setup.py @@ -43,7 +43,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['lxml>=2.2.3', 'cybox>=2.1.0.11,<2.1.1.0'], + install_requires=['mixbox', 'lxml>=2.2.3', 'cybox>=2.1.0.11,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", From 1f4b7592f4f5af2849b48913ac69e8e60d81f8ea Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 19 Jun 2015 09:47:52 -0500 Subject: [PATCH 225/297] Depend on development verison of python-cybox. --- setup.py | 2 +- tox.ini | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 2ea1a2f..36d6829 100644 --- a/setup.py +++ b/setup.py @@ -43,7 +43,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['mixbox', 'lxml>=2.2.3', 'cybox>=2.1.0.11,<2.1.1.0'], + install_requires=['mixbox', 'lxml>=2.2.3', 'cybox>=2.1.0.12.dev0,<2.1.1.0'], extras_require=extras_require, classifiers=[ "Programming Language :: Python", diff --git a/tox.ini b/tox.ini index fcf8d9f..9ed54c8 100644 --- a/tox.ini +++ b/tox.ini @@ -14,6 +14,7 @@ basepython=python2.6 commands = nosetests maec deps = + cybox>=2.1.0.12.dev0 lxml==2.2.3 python-dateutil==1.4.1 nose From 0cef96cdf69a686fca03708b648ff4ab30bb7c2a Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 19 Jun 2015 09:49:39 -0500 Subject: [PATCH 226/297] Use TypedFields from mixbox. --- maec/__init__.py | 1 - maec/bundle/action_reference_list.py | 3 +- maec/bundle/behavior.py | 54 ++++++++-------- maec/bundle/behavior_reference.py | 5 +- maec/bundle/bundle.py | 66 +++++++++---------- maec/bundle/bundle_reference.py | 6 +- maec/bundle/candidate_indicator.py | 40 ++++++------ maec/bundle/capability.py | 50 ++++++++------- maec/bundle/malware_action.py | 28 ++++---- maec/bundle/process_tree.py | 18 +++--- maec/package/action_equivalence.py | 8 ++- maec/package/analysis.py | 78 ++++++++++++----------- maec/package/grouping_relationship.py | 35 +++++----- maec/package/malware_subject.py | 70 ++++++++++---------- maec/package/malware_subject_reference.py | 4 +- maec/package/object_equivalence.py | 8 ++- maec/package/package.py | 12 ++-- maec/vocabs/vocabs.py | 1 - 18 files changed, 257 insertions(+), 230 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 239f65a..86b6085 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -8,7 +8,6 @@ from cybox import Entity as cyboxEntity from cybox import EntityList -from cybox import TypedField from cybox.utils import Namespace, META import bindings.maec_bundle as bundle_binding diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index dd62218..a9033ed 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -3,6 +3,7 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved +from mixbox import fields from cybox.core import ActionReference @@ -16,4 +17,4 @@ class ActionReferenceList(maec.EntityList): _binding_class = bundle_binding.ActionReferenceListType _binding_var = "Action_Reference" _namespace = _namespace - \ No newline at end of file + diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 9ad589f..95b4e9e 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding @@ -17,32 +19,32 @@ class BehavioralActionEquivalenceReference(maec.Entity): _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType _namespace = _namespace - action_equivalence_idref = maec.TypedField('action_equivalence_idref') - behavioral_ordering = maec.TypedField('behavioral_ordering') + action_equivalence_idref = fields.TypedField('action_equivalence_idref') + behavioral_ordering = fields.TypedField('behavioral_ordering') class BehavioralActionReference(ActionReference): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionReferenceType _namespace = _namespace - behavioral_ordering = maec.TypedField('behavioral_ordering') + behavioral_ordering = fields.TypedField('behavioral_ordering') class BehavioralAction(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionType _namespace = _namespace - behavioral_ordering = maec.TypedField('behavioral_ordering') + behavioral_ordering = fields.TypedField('behavioral_ordering') class BehavioralActions(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehavioralActionsType _namespace = _namespace - #action_collection = maec.TypedField('Action_Collection', ActionCollection, multiple=True) #TODO: solve recursive import - action = maec.TypedField('Action', BehavioralAction, multiple=True) - action_reference = maec.TypedField('Action_Reference', BehavioralActionReference, multiple=True) - action_equivalence_reference = maec.TypedField('Action_Equivalence_Reference', BehavioralActionEquivalenceReference, multiple=True) + #action_collection = fields.TypedField('Action_Collection', ActionCollection, multiple=True) #TODO: solve recursive import + action = fields.TypedField('Action', BehavioralAction, multiple=True) + action_reference = fields.TypedField('Action_Reference', BehavioralActionReference, multiple=True) + action_equivalence_reference = fields.TypedField('Action_Equivalence_Reference', BehavioralActionEquivalenceReference, multiple=True) class PlatformList(maec.EntityList): _binding = bundle_binding @@ -56,26 +58,26 @@ class CVEVulnerability(maec.Entity): _binding_class = bundle_binding.CVEVulnerabilityType _namespace = _namespace - cve_id = maec.TypedField('cve_id') - description = maec.TypedField('Description') + cve_id = fields.TypedField('cve_id') + description = fields.TypedField('Description') class Exploit(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ExploitType _namespace = _namespace - known_vulnerability = maec.TypedField('known_vulnerability') - cve = maec.TypedField('CVE', CVEVulnerability) - cwe_id = maec.TypedField('CWE_ID', multiple=True) - targeted_platforms = maec.TypedField('Targeted_Platforms', PlatformList) + known_vulnerability = fields.TypedField('known_vulnerability') + cve = fields.TypedField('CVE', CVEVulnerability) + cwe_id = fields.TypedField('CWE_ID', multiple=True) + targeted_platforms = fields.TypedField('Targeted_Platforms', PlatformList) class BehaviorPurpose(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorPurposeType _namespace = _namespace - description = maec.TypedField('Description') - vulnerability_exploit = maec.TypedField('Vulnerability_Exploit', Exploit) + description = fields.TypedField('Description') + vulnerability_exploit = fields.TypedField('Vulnerability_Exploit', Exploit) class AssociatedCode(maec.EntityList): _binding = bundle_binding @@ -89,16 +91,16 @@ class Behavior(maec.Entity): _binding_class = bundle_binding.BehaviorType _namespace = _namespace - id_ = maec.TypedField('id') - ordinal_position = maec.TypedField('ordinal_position') - status = maec.TypedField('status') - duration = maec.TypedField('duration') - purpose = maec.TypedField('Purpose', BehaviorPurpose) - description = maec.TypedField('Description') - discovery_method = maec.TypedField('Discovery_Method', MeasureSource) - action_composition = maec.TypedField('Action_Composition', BehavioralActions) - associated_code = maec.TypedField('Associated_Code', AssociatedCode) - #relationships = maec.TypedField('Relationships', BehaviorRelationshipList) # TODO: implement + id_ = fields.TypedField('id') + ordinal_position = fields.TypedField('ordinal_position') + status = fields.TypedField('status') + duration = fields.TypedField('duration') + purpose = fields.TypedField('Purpose', BehaviorPurpose) + description = fields.TypedField('Description') + discovery_method = fields.TypedField('Discovery_Method', MeasureSource) + action_composition = fields.TypedField('Action_Composition', BehavioralActions) + associated_code = fields.TypedField('Associated_Code', AssociatedCode) + #relationships = fields.TypedField('Relationships', BehaviorRelationshipList) # TODO: implement def __init__(self, id = None, description = None): super(Behavior, self).__init__() diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index 220e58a..3c74a15 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -3,6 +3,7 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields import maec from . import _namespace @@ -13,8 +14,8 @@ class BehaviorReference(maec.Entity): _binding_class = bundle_binding.BehaviorReferenceType _namespace = _namespace - behavior_idref = maec.TypedField("behavior_idref") + behavior_idref = fields.TypedField("behavior_idref") def __init__(self, behavior_idref = None): super(BehaviorReference, self).__init__() - self.behavior_idref = behavior_idref \ No newline at end of file + self.behavior_idref = behavior_idref diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index efeb5db..11b2cae 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + from cybox.core import Object from cybox.utils.normalize import normalize_object_properties @@ -38,10 +40,10 @@ class BaseCollection(maec.Entity): _binding_class = bundle_binding.BaseCollectionType _namespace = _namespace - name = maec.TypedField("name") - affinity_type = maec.TypedField("Affinity_Type") - affinity_degree = maec.TypedField("Affinity_Degree") - description = maec.TypedField("Description") + name = fields.TypedField("name") + affinity_type = fields.TypedField("Affinity_Type") + affinity_degree = fields.TypedField("Affinity_Degree") + description = fields.TypedField("Description") def __init__(self, name = None): super(BaseCollection, self).__init__() @@ -52,8 +54,8 @@ class ActionCollection(BaseCollection): _binding_class = bundle_binding.ActionCollectionType _namespace = _namespace - id_ = maec.TypedField("id") - action_list = maec.TypedField("Action_List", ActionList) + id_ = fields.TypedField("id") + action_list = fields.TypedField("Action_List", ActionList) def __init__(self, name = None, id = None): super(ActionCollection, self).__init__(name) @@ -72,8 +74,8 @@ class BehaviorCollection(BaseCollection): _binding_class = bundle_binding.BehaviorCollectionType _namespace = _namespace - id_ = maec.TypedField("id") - behavior_list = maec.TypedField("Behavior_List", BehaviorList) + id_ = fields.TypedField("id") + behavior_list = fields.TypedField("Behavior_List", BehaviorList) def __init__(self, name = None, id = None): super(BehaviorCollection, self).__init__(name) @@ -92,8 +94,8 @@ class ObjectCollection(BaseCollection): _binding_class = bundle_binding.ObjectCollectionType _namespace = _namespace - id_ = maec.TypedField("id") - object_list = maec.TypedField("Object_List", ObjectList) + id_ = fields.TypedField("id") + object_list = fields.TypedField("Object_List", ObjectList) def __init__(self, name = None, id = None): super(ObjectCollection, self).__init__(name) @@ -112,8 +114,8 @@ class CandidateIndicatorCollection(BaseCollection): _binding_class = bundle_binding.CandidateIndicatorCollectionType _namespace = _namespace - id_ = maec.TypedField("id") - candidate_indicator_list = maec.TypedField("Candidate_Indicator_List", CandidateIndicatorList) + id_ = fields.TypedField("id") + candidate_indicator_list = fields.TypedField("Candidate_Indicator_List", CandidateIndicatorList) def __init__(self, name = None, id = None): super(CandidateIndicatorCollection, self).__init__(name) @@ -264,10 +266,10 @@ class Collections(maec.Entity): _binding_class = bundle_binding.CollectionsType _namespace = _namespace - behavior_collections = maec.TypedField("Behavior_Collections", BehaviorCollectionList) - action_collections = maec.TypedField("Action_Collections", ActionCollectionList) - object_collections = maec.TypedField("Object_Collections", ObjectCollectionList) - candidate_indicator_collections = maec.TypedField("Candidate_Indicator_Collections", CandidateIndicatorCollectionList) + behavior_collections = fields.TypedField("Behavior_Collections", BehaviorCollectionList) + action_collections = fields.TypedField("Action_Collections", ActionCollectionList) + object_collections = fields.TypedField("Object_Collections", ObjectCollectionList) + candidate_indicator_collections = fields.TypedField("Candidate_Indicator_Collections", CandidateIndicatorCollectionList) def __init__(self): super(Collections, self).__init__() @@ -313,27 +315,27 @@ class BehaviorReference(maec.Entity): _binding_class = bundle_binding.BehaviorReferenceType _namespace = _namespace - behavior_idref = maec.TypedField('behavior_idref') + behavior_idref = fields.TypedField('behavior_idref') class Bundle(maec.Entity): _binding = bundle_binding _namespace = _namespace _binding_class = bundle_binding.BundleType - id_ = maec.TypedField("id") - schema_version = maec.TypedField("schema_version") - defined_subject = maec.TypedField("defined_subject") - content_type = maec.TypedField("content_type") - timestamp = maec.TypedField("timestamp") - malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) - av_classifications = maec.TypedField("AV_Classifications", AVClassifications) - actions = maec.TypedField("Actions", ActionList) - process_tree = maec.TypedField("Process_Tree", ProcessTree) - behaviors = maec.TypedField("Behaviors", BehaviorList) - capabilities = maec.TypedField("Capabilities", CapabilityList) - objects = maec.TypedField("Objects", ObjectList) - candidate_indicators = maec.TypedField("Candidate_Indicators", CandidateIndicatorList) - collections = maec.TypedField("Collections", Collections) + id_ = fields.TypedField("id") + schema_version = fields.TypedField("schema_version") + defined_subject = fields.TypedField("defined_subject") + content_type = fields.TypedField("content_type") + timestamp = fields.TypedField("timestamp") + malware_instance_object_attributes = fields.TypedField("Malware_Instance_Object_Attributes", Object) + av_classifications = fields.TypedField("AV_Classifications", AVClassifications) + actions = fields.TypedField("Actions", ActionList) + process_tree = fields.TypedField("Process_Tree", ProcessTree) + behaviors = fields.TypedField("Behaviors", BehaviorList) + capabilities = fields.TypedField("Capabilities", CapabilityList) + objects = fields.TypedField("Objects", ObjectList) + candidate_indicators = fields.TypedField("Candidate_Indicators", CandidateIndicatorList) + collections = fields.TypedField("Collections", Collections) def __init__(self, id = None, defined_subject = False, schema_version = "4.1", content_type = None, malware_instance_object = None): super(Bundle, self).__init__() @@ -616,4 +618,4 @@ def dereference_objects(self, extra_objects = []): @classmethod def compare(cls, bundle_list, match_on = None, case_sensitive = True): """Compare the Bundle to a list of other Bundles, returning a BundleComparator object.""" - return BundleComparator.compare(bundle_list, match_on, case_sensitive) \ No newline at end of file + return BundleComparator.compare(bundle_list, match_on, case_sensitive) diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index a7f7994..3fa97f0 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -3,6 +3,8 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding @@ -12,9 +14,9 @@ class BundleReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BundleReferenceType - bundle_idref = maec.TypedField("bundle_idref") + bundle_idref = fields.TypedField("bundle_idref") def __init__(self, bundle_idref = None): super(BundleReference, self).__init__() self.bundle_idref = bundle_idref - \ No newline at end of file + diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 7fbe33d..6f6fcc2 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding @@ -15,9 +17,9 @@ class MalwareEntity(maec.Entity): _binding_class = bundle_binding.MalwareEntityType _namespace = _namespace - type_ = maec.TypedField("Type", VocabString) - name = maec.TypedField("Name") - description = maec.TypedField("Description") + type_ = fields.TypedField("Type", VocabString) + name = fields.TypedField("Name") + description = fields.TypedField("Description") def __init__(self): super(MalwareEntity, self).__init__() @@ -27,11 +29,11 @@ class CandidateIndicatorComposition(maec.Entity): _binding_class = bundle_binding.CandidateIndicatorCompositionType _namespace = _namespace - operator = maec.TypedField("operator") - behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple = True) - action_reference = maec.TypedField("Action_Reference", ActionReference, multiple = True) - object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) - sub_composition = maec.TypedField("Sub_Composition", multiple = True) + operator = fields.TypedField("operator") + behavior_reference = fields.TypedField("Behavior_Reference", BehaviorReference, multiple = True) + action_reference = fields.TypedField("Action_Reference", ActionReference, multiple = True) + object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) + sub_composition = fields.TypedField("Sub_Composition", multiple = True) def __init__(self): super(CandidateIndicatorComposition, self).__init__() @@ -44,16 +46,16 @@ class CandidateIndicator(maec.Entity): _binding_class = bundle_binding.CandidateIndicatorType _namespace = _namespace - id_ = maec.TypedField("id") - creation_datetime = maec.TypedField("creation_datetime") - lastupdate_datetime = maec.TypedField("lastupdate_datetime") - version = maec.TypedField("version") - importance = maec.TypedField("Importance", VocabString) - numeric_importance = maec.TypedField("Numeric_Importance") - author = maec.TypedField("Author") - description = maec.TypedField("Description") - malware_entity = maec.TypedField("Malware_Entity", MalwareEntity) - composition = maec.TypedField("Composition", CandidateIndicatorComposition) + id_ = fields.TypedField("id") + creation_datetime = fields.TypedField("creation_datetime") + lastupdate_datetime = fields.TypedField("lastupdate_datetime") + version = fields.TypedField("version") + importance = fields.TypedField("Importance", VocabString) + numeric_importance = fields.TypedField("Numeric_Importance") + author = fields.TypedField("Author") + description = fields.TypedField("Description") + malware_entity = fields.TypedField("Malware_Entity", MalwareEntity) + composition = fields.TypedField("Composition", CandidateIndicatorComposition) def __init__(self, id = None): super(CandidateIndicator, self).__init__() @@ -66,4 +68,4 @@ class CandidateIndicatorList(maec.EntityList): _contained_type = CandidateIndicator _binding_class = bundle_binding.CandidateIndicatorListType _binding_var = "Candidate_Indicator" - _namespace = _namespace \ No newline at end of file + _namespace = _namespace diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index f6bfacd..db46f25 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding @@ -15,7 +17,7 @@ class CapabilityObjectiveReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveReferenceType - objective_idref = maec.TypedField("objective_idref") + objective_idref = fields.TypedField("objective_idref") def __init__(self): super(CapabilityObjectiveReference, self).__init__() @@ -26,7 +28,7 @@ class CapabilityReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityReferenceType - capability_idref = maec.TypedField("capability_idref") + capability_idref = fields.TypedField("capability_idref") def __init__(self): super(CapabilityReference, self).__init__() @@ -37,8 +39,8 @@ class CapabilityObjectiveRelationship(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveRelationshipType - relationship_type = maec.TypedField("Relationship_Type", VocabString) - objective_reference = maec.TypedField("Objective_Reference", CapabilityObjectiveReference, multiple=True) + relationship_type = fields.TypedField("Relationship_Type", VocabString) + objective_reference = fields.TypedField("Objective_Reference", CapabilityObjectiveReference, multiple=True) def __init__(self): super(CapabilityObjectiveRelationship, self).__init__() @@ -50,8 +52,8 @@ class CapabilityRelationship(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityRelationshipType - relationship_type = maec.TypedField("Relationship_Type", VocabString) - capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple=True) + relationship_type = fields.TypedField("Relationship_Type", VocabString) + capability_reference = fields.TypedField("Capability_Reference", CapabilityReference, multiple=True) def __init__(self): super(CapabilityRelationship, self).__init__() @@ -63,8 +65,8 @@ class CapabilityProperty(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityPropertyType - name = maec.TypedField("Name", VocabString) - value = maec.TypedField("Value", String) + name = fields.TypedField("Name", VocabString) + value = fields.TypedField("Value", String) def __init__(self): super(CapabilityProperty, self).__init__() @@ -75,12 +77,12 @@ class CapabilityObjective(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityObjectiveType - id_ = maec.TypedField("id") - name = maec.TypedField("Name", VocabString) - description = maec.TypedField("Description") - property = maec.TypedField("Property", CapabilityProperty, multiple=True) - behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple=True) - relationship = maec.TypedField("Relationship", CapabilityObjectiveRelationship, multiple=True) + id_ = fields.TypedField("id") + name = fields.TypedField("Name", VocabString) + description = fields.TypedField("Description") + property = fields.TypedField("Property", CapabilityProperty, multiple=True) + behavior_reference = fields.TypedField("Behavior_Reference", BehaviorReference, multiple=True) + relationship = fields.TypedField("Relationship", CapabilityObjectiveRelationship, multiple=True) def __init__(self, id=None): super(CapabilityObjective, self).__init__() @@ -95,14 +97,14 @@ class Capability(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityType - id_ = maec.TypedField("id") - name = maec.TypedField("name") - description = maec.TypedField("Description") - property = maec.TypedField("Property", CapabilityProperty, multiple=True) - strategic_objective = maec.TypedField("Strategic_Objective", CapabilityObjective, multiple=True) - tactical_objective = maec.TypedField("Tactical_Objective", CapabilityObjective, multiple=True) - behavior_reference = maec.TypedField("Behavior_Reference", BehaviorReference, multiple=True) - relationship = maec.TypedField("Relationship", CapabilityRelationship, multiple=True) + id_ = fields.TypedField("id") + name = fields.TypedField("name") + description = fields.TypedField("Description") + property = fields.TypedField("Property", CapabilityProperty, multiple=True) + strategic_objective = fields.TypedField("Strategic_Objective", CapabilityObjective, multiple=True) + tactical_objective = fields.TypedField("Tactical_Objective", CapabilityObjective, multiple=True) + behavior_reference = fields.TypedField("Behavior_Reference", BehaviorReference, multiple=True) + relationship = fields.TypedField("Relationship", CapabilityRelationship, multiple=True) def __init__(self, id=None, name=None): super(Capability, self).__init__() @@ -130,8 +132,8 @@ class CapabilityList(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CapabilityListType - capability = maec.TypedField("Capability", Capability, multiple=True) - capability_reference = maec.TypedField("Capability_Reference", CapabilityReference, multiple=True) + capability = fields.TypedField("Capability", Capability, multiple=True) + capability_reference = fields.TypedField("Capability_Reference", CapabilityReference, multiple=True) def __init__(self): super(CapabilityList, self).__init__() diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 8f1d10b..3fb3cf3 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import cybox from cybox.core import Action from cybox.objects.code_object import Code @@ -16,9 +18,9 @@ class Parameter(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ParameterType - ordinal_position = maec.TypedField("ordinal_position") - name = maec.TypedField("name") - value = maec.TypedField("value") + ordinal_position = fields.TypedField("ordinal_position") + name = fields.TypedField("name") + value = fields.TypedField("value") def __init__(self): super(Parameter, self).__init__() @@ -34,11 +36,11 @@ class APICall(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.APICallType - function_name = maec.TypedField("function_name") - normalized_function_name = maec.TypedField("normalized_function_name") - address = maec.TypedField("Address") - return_value = maec.TypedField("Return_Value") - parameters = maec.TypedField("Parameters", ParameterList) + function_name = fields.TypedField("function_name") + normalized_function_name = fields.TypedField("normalized_function_name") + address = fields.TypedField("Address") + return_value = fields.TypedField("Return_Value") + parameters = fields.TypedField("Parameters", ParameterList) def __init__(self): super(APICall, self).__init__() @@ -48,11 +50,11 @@ class ActionImplementation(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ActionImplementationType - id_ = maec.TypedField("id") - type_ = maec.TypedField("type_", key_name = "type") + id_ = fields.TypedField("id") + type_ = fields.TypedField("type_", key_name = "type") #compatible_platforms TODO: Add support - api_call = maec.TypedField("API_Call", APICall) - code = maec.TypedField("Code", Code, multiple = True) + api_call = fields.TypedField("API_Call", APICall) + code = fields.TypedField("Code", Code, multiple = True) def __init__(self): super(ActionImplementation, self).__init__() @@ -62,7 +64,7 @@ class MalwareAction(Action): _binding_class = bundle_binding.MalwareActionType _namespace = _namespace - implementation = cybox.TypedField("Implementation", ActionImplementation) + implementation = fields.TypedField("Implementation", ActionImplementation) def __init__(self): super(MalwareAction, self).__init__() diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 5dd1c4a..67b6144 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import cybox from cybox.objects.process_object import Process @@ -19,12 +21,12 @@ class ProcessTreeNode(Process): _XSI_TYPE = "ProcessTreeNodeType" superclass = Process - id_ = cybox.TypedField("id") - parent_action_idref = cybox.TypedField("parent_action_idref") - ordinal_position = cybox.TypedField("ordinal_position") - initiated_actions = cybox.TypedField("Initiated_Actions", ActionReferenceList) - spawned_process = cybox.TypedField("Spawned_Process", multiple = True) - injected_process = cybox.TypedField("Injected_Process", multiple = True) + id_ = fields.TypedField("id") + parent_action_idref = fields.TypedField("parent_action_idref") + ordinal_position = fields.TypedField("ordinal_position") + initiated_actions = fields.TypedField("Initiated_Actions", ActionReferenceList) + spawned_process = fields.TypedField("Spawned_Process", multiple = True) + injected_process = fields.TypedField("Injected_Process", multiple = True) def __init__(self, id = None, parent_action_idref = None): super(ProcessTreeNode, self).__init__() @@ -108,7 +110,7 @@ class ProcessTree(maec.Entity): _binding_class = bundle_binding.ProcessTreeType _namespace = _namespace - root_process = maec.TypedField("Root_Process", ProcessTreeNode) + root_process = fields.TypedField("Root_Process", ProcessTreeNode) def __init__(self, root_process = None): super(ProcessTree, self).__init__() @@ -120,4 +122,4 @@ def set_root_process(self, root_process): # Allow recursive definition of ProcessTreeNodes ProcessTreeNode.spawned_process.type_ = ProcessTreeNode -ProcessTreeNode.injected_process.type_ = ProcessTreeNode \ No newline at end of file +ProcessTreeNode.injected_process.type_ = ProcessTreeNode diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index be2bb6f..3bd6a41 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -3,6 +3,8 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_package as package_binding @@ -13,8 +15,8 @@ class ActionEquivalence(maec.Entity): _binding_class = package_binding.ActionEquivalenceType _namespace = _namespace - id_ = maec.TypedField('id') - action_reference = maec.TypedField('Action_Reference', ActionReference, multiple = True) + id_ = fields.TypedField('id') + action_reference = fields.TypedField('Action_Reference', ActionReference, multiple = True) def __init__(self): super(ActionEquivalence, self).__init__() @@ -24,4 +26,4 @@ class ActionEquivalenceList(maec.EntityList): _contained_type = ActionEquivalence _binding_class = package_binding.ActionEquivalenceListType _binding_var = "Action_Equivalence" - _namespace = _namespace \ No newline at end of file + _namespace = _namespace diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 7539d27..a4b3cfc 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + from cybox.common import (PlatformSpecification, Personnel, StructuredText, ToolInformation) from cybox.objects.system_object import System @@ -17,11 +19,11 @@ class Source(maec.Entity): _binding_class = package_binding.SourceType _namespace = _namespace - name = maec.TypedField("Name") - method = maec.TypedField("Method") - reference = maec.TypedField("Reference") - organization = maec.TypedField("Organization") - url = maec.TypedField("URL") + name = fields.TypedField("Name") + method = fields.TypedField("Method") + reference = fields.TypedField("Reference") + organization = fields.TypedField("Organization") + url = fields.TypedField("URL") def __init__(self): super(Source, self).__init__() @@ -31,9 +33,9 @@ class Comment(StructuredText): _binding_class = package_binding.CommentType _namespace = _namespace - author = maec.TypedField("author") - timestamp = maec.TypedField("timestamp") - observation_name = maec.TypedField("observation_name") + author = fields.TypedField("author") + timestamp = fields.TypedField("timestamp") + observation_name = fields.TypedField("observation_name") def __init__(self, value=None): super(Comment, self).__init__(value) @@ -107,10 +109,10 @@ class DynamicAnalysisMetadata(maec.Entity): _binding_class = package_binding.DynamicAnalysisMetadataType _namespace = _namespace - command_line = maec.TypedField("Command_Line") - analysis_duration = maec.TypedField("Analysis_Duration") - exit_code = maec.TypedField("Exit_Code") - #raised_exception = maec.TypedField("Raised_Exception", MalwareException) + command_line = fields.TypedField("Command_Line") + analysis_duration = fields.TypedField("Analysis_Duration") + exit_code = fields.TypedField("Exit_Code") + #raised_exception = fields.TypedField("Raised_Exception", MalwareException) def __init__(self): super(DynamicAnalysisMetadata, self).__init__() @@ -120,7 +122,7 @@ class HypervisorHostSystem(System): _binding_class = package_binding.HypervisorHostSystemType _namespace = _namespace - vm_hypervisor = maec.TypedField("VM_Hypervisor", PlatformSpecification) + vm_hypervisor = fields.TypedField("VM_Hypervisor", PlatformSpecification) def __init__(self): super(HypervisorHostSystem, self).__init__() @@ -136,7 +138,7 @@ class AnalysisSystem(System): _binding_class = package_binding.AnalysisSystemType _namespace = _namespace - installed_programs = maec.TypedField("Installed_Programs", InstalledPrograms) + installed_programs = fields.TypedField("Installed_Programs", InstalledPrograms) def __init__(self): super(AnalysisSystem, self).__init__() @@ -153,10 +155,10 @@ class CapturedProtocol(maec.Entity): _binding_class = package_binding.CapturedProtocolType _namespace = _namespace - layer7_protocol = maec.TypedField("layer7_protocol") - layer4_protocol = maec.TypedField("layer4_protocol") - port_number = maec.TypedField("port_number") - interaction_level = maec.TypedField("interaction_level") + layer7_protocol = fields.TypedField("layer7_protocol") + layer4_protocol = fields.TypedField("layer4_protocol") + port_number = fields.TypedField("port_number") + interaction_level = fields.TypedField("interaction_level") def __init__(self): super(CapturedProtocol, self).__init__() @@ -172,7 +174,7 @@ class NetworkInfrastructure(maec.Entity): _binding_class = package_binding.NetworkInfrastructureType _namespace = _namespace - captured_protocols = maec.TypedField("Captured_Protocols", CapturedProtocolList) + captured_protocols = fields.TypedField("Captured_Protocols", CapturedProtocolList) def __init__(self): super(NetworkInfrastructure, self).__init__() @@ -183,9 +185,9 @@ class AnalysisEnvironment(maec.Entity): _binding_class = package_binding.AnalysisEnvironmentType _namespace = _namespace - hypervisor_host_system = maec.TypedField("Hypervisor_Host_System", HypervisorHostSystem) - analysis_systems = maec.TypedField("Analysis_Systems", AnalysisSystemList) - network_infrastructure = maec.TypedField("Network_Infrastructure", NetworkInfrastructure) + hypervisor_host_system = fields.TypedField("Hypervisor_Host_System", HypervisorHostSystem) + analysis_systems = fields.TypedField("Analysis_Systems", AnalysisSystemList) + network_infrastructure = fields.TypedField("Network_Infrastructure", NetworkInfrastructure) def __init__(self): super(AnalysisEnvironment, self).__init__() @@ -195,22 +197,22 @@ class Analysis(maec.Entity): _binding_class = package_binding.AnalysisType _namespace = _namespace - id_ = maec.TypedField("id") - method = maec.TypedField("method") - type_ = maec.TypedField("type") - ordinal_position = maec.TypedField("ordinal_position") - start_datetime = maec.TypedField("start_datetime") - complete_datetime = maec.TypedField("complete_datetime") - lastupdate_datetime = maec.TypedField("lastupdate_datetime") - source = maec.TypedField("Source", Source) - analysts = maec.TypedField("Analysts", Personnel) - summary = maec.TypedField("Summary", StructuredText) - comments = maec.TypedField("Comments", CommentList) - findings_bundle_reference = maec.TypedField("Findings_Bundle_Reference", BundleReference, multiple = True) - tools = maec.TypedField("Tools", ToolList) - dynamic_analysis_metadata = maec.TypedField("Dynamic_Analysis_Metadata", DynamicAnalysisMetadata) - analysis_environment = maec.TypedField("Analysis_Environment", AnalysisEnvironment) - report = maec.TypedField("Report", StructuredText) + id_ = fields.TypedField("id") + method = fields.TypedField("method") + type_ = fields.TypedField("type") + ordinal_position = fields.TypedField("ordinal_position") + start_datetime = fields.TypedField("start_datetime") + complete_datetime = fields.TypedField("complete_datetime") + lastupdate_datetime = fields.TypedField("lastupdate_datetime") + source = fields.TypedField("Source", Source) + analysts = fields.TypedField("Analysts", Personnel) + summary = fields.TypedField("Summary", StructuredText) + comments = fields.TypedField("Comments", CommentList) + findings_bundle_reference = fields.TypedField("Findings_Bundle_Reference", BundleReference, multiple = True) + tools = fields.TypedField("Tools", ToolList) + dynamic_analysis_metadata = fields.TypedField("Dynamic_Analysis_Metadata", DynamicAnalysisMetadata) + analysis_environment = fields.TypedField("Analysis_Environment", AnalysisEnvironment) + report = fields.TypedField("Report", StructuredText) def __init__(self, id = None, method = None, type = None, findings_bundle_reference = []): super(Analysis, self).__init__() diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index e81e80d..6119dcd 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -3,6 +3,7 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields import maec from . import _namespace @@ -16,10 +17,10 @@ class ClusterEdgeNodePair(maec.Entity): _binding_class = package_binding.ClusterEdgeNodePairType _namespace = _namespace - similarity_index = maec.TypedField("similarity_index") - similarity_distance = maec.TypedField("similarity_distance") - malware_subject_node_a = maec.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) - malware_subject_node_b = maec.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) + similarity_index = fields.TypedField("similarity_index") + similarity_distance = fields.TypedField("similarity_distance") + malware_subject_node_a = fields.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) + malware_subject_node_b = fields.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) def __init__(self): super(ClusterEdgeNodePair, self).__init__() @@ -29,8 +30,8 @@ class ClusterComposition(maec.Entity): _binding_class = package_binding.ClusterCompositionType _namespace = _namespace - score_type = maec.TypedField("score_type") - edge_node_pair = maec.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) + score_type = fields.TypedField("score_type") + edge_node_pair = fields.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) def __init__(self): super(ClusterComposition, self).__init__() @@ -40,8 +41,8 @@ class ClusteringAlgorithmParameters(maec.Entity): _binding_class = package_binding.ClusteringAlgorithmParametersType _namespace = _namespace - distance_threashold = maec.TypedField("Distance_Threashold") - number_of_iterations = maec.TypedField("Number_of_Iterations") + distance_threashold = fields.TypedField("Distance_Threashold") + number_of_iterations = fields.TypedField("Number_of_Iterations") def __init__(self): super(ClusteringAlgorithmParameters, self).__init__() @@ -51,12 +52,12 @@ class ClusteringMetadata(maec.Entity): _binding_class = package_binding.ClusteringMetadataType _namespace = _namespace - algorithm_name = maec.TypedField("Algorithm_Name") - algorithm_version = maec.TypedField("Algorithm_Version") - algorithm_parameters = maec.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) - cluster_size = maec.TypedField("Cluster_Size") - cluster_description = maec.TypedField("Cluster_Description") - cluster_composition = maec.TypedField("Cluster_Composition", ClusterComposition) + algorithm_name = fields.TypedField("Algorithm_Name") + algorithm_version = fields.TypedField("Algorithm_Version") + algorithm_parameters = fields.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) + cluster_size = fields.TypedField("Cluster_Size") + cluster_description = fields.TypedField("Cluster_Description") + cluster_composition = fields.TypedField("Cluster_Composition", ClusterComposition) def __init__(self): super(ClusteringMetadata, self).__init__() @@ -67,9 +68,9 @@ class GroupingRelationship(maec.Entity): _namespace = _namespace type_ = vocabs.VocabField("Type", GroupingRelationshipVocab) - malware_family_name = maec.TypedField("Malware_Family_Name") - malware_toolkit_name = maec.TypedField("Malware_Toolkit_Name") - clustering_metadata = maec.TypedField("Clustering_Metadata", ClusteringMetadata) + malware_family_name = fields.TypedField("Malware_Family_Name") + malware_toolkit_name = fields.TypedField("Malware_Toolkit_Name") + clustering_metadata = fields.TypedField("Clustering_Metadata", ClusteringMetadata) def __init__(self): super(GroupingRelationship, self).__init__() diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index be0498a..3deb0c6 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + from cybox.common import vocabs, VocabString, PlatformSpecification, ToolInformation from cybox.objects.file_object import File from cybox.objects.uri_object import URI @@ -35,7 +37,7 @@ class MalwareSubjectRelationship(maec.Entity): _binding_class = package_binding.MalwareSubjectRelationshipType _namespace = _namespace - malware_subject_reference = maec.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) + malware_subject_reference = fields.TypedField("Malware_Subject_Reference", MalwareSubjectReference, multiple = True) type_ = vocabs.VocabField("Type", MalwareSubjectRelationshipVocab) def __init__(self): @@ -53,8 +55,8 @@ class MetaAnalysis(maec.Entity): _binding_class = package_binding.MetaAnalysisType _namespace = _namespace - action_equivalences = maec.TypedField("Action_Equivalences", ActionEquivalenceList) - object_equivalences = maec.TypedField("Object_Equivalences", ObjectEquivalenceList) + action_equivalences = fields.TypedField("Action_Equivalences", ActionEquivalenceList) + object_equivalences = fields.TypedField("Object_Equivalences", ObjectEquivalenceList) def __init__(self): super(MetaAnalysis, self).__init__() @@ -64,9 +66,9 @@ class FindingsBundleList(maec.Entity): _binding_class = package_binding.FindingsBundleListType _namespace = _namespace - meta_analysis = maec.TypedField("Meta_Analysis", MetaAnalysis) - bundle = maec.TypedField("Bundle", Bundle, multiple = True) - bundle_external_reference = maec.TypedField("Bundle_External_Reference", multiple = True) + meta_analysis = fields.TypedField("Meta_Analysis", MetaAnalysis) + bundle = fields.TypedField("Bundle", Bundle, multiple = True) + bundle_external_reference = fields.TypedField("Bundle_External_Reference", multiple = True) def __init__(self): super(FindingsBundleList, self).__init__() @@ -86,8 +88,8 @@ class MalwareDevelopmentEnvironment(maec.Entity): _binding_class = package_binding.MalwareDevelopmentEnvironmentType _namespace = _namespace - tools = maec.TypedField("Tools", ToolInformation) - debugging_file = maec.TypedField("Debugging_File", File, multiple = True) + tools = fields.TypedField("Tools", ToolInformation) + debugging_file = fields.TypedField("Debugging_File", File, multiple = True) def __init__(self): super(MalwareDevelopmentEnvironment, self).__init__() @@ -99,7 +101,7 @@ class MalwareConfigurationParameter(maec.Entity): _namespace = _namespace name = vocabs.VocabField("Name", MalwareConfigParameterVocab) - value = maec.TypedField("Value") + value = fields.TypedField("Value") def __init__(self): super(MalwareConfigurationParameter, self).__init__() @@ -110,9 +112,9 @@ class MalwareBinaryConfigurationStorageDetails(maec.Entity): _binding_class = package_binding.MalwareBinaryConfigurationStorageDetailsType _namespace = _namespace - file_offset = maec.TypedField("File_Offset") - section_name = maec.TypedField("Section_Name") - section_offset = maec.TypedField("Section_Offset") + file_offset = fields.TypedField("File_Offset") + section_name = fields.TypedField("Section_Name") + section_offset = fields.TypedField("Section_Offset") def __init__(self): super(MalwareBinaryConfigurationStorageDetails, self).__init__() @@ -122,9 +124,9 @@ class MalwareConfigurationStorageDetails(maec.Entity): _binding_class = package_binding.MalwareConfigurationStorageDetailsType _namespace = _namespace - malware_binary = maec.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) - file = maec.TypedField("File", File) - url = maec.TypedField("URL", URI, multiple = True) + malware_binary = fields.TypedField("Malware_Binary", MalwareBinaryConfigurationStorageDetails) + file = fields.TypedField("File", File) + url = fields.TypedField("URL", URI, multiple = True) def __init__(self): super(MalwareConfigurationStorageDetails, self).__init__() @@ -134,9 +136,9 @@ class MalwareConfigurationObfuscationAlgorithm(maec.Entity): _binding_class = package_binding.MalwareConfigurationObfuscationAlgorithmType _namespace = _namespace - ordinal_position = maec.TypedField("ordinal_position") - key = maec.TypedField("Key") - algorithm_name = maec.TypedField("Algorithm_Name", VocabString) + ordinal_position = fields.TypedField("ordinal_position") + key = fields.TypedField("Key") + algorithm_name = fields.TypedField("Algorithm_Name", VocabString) def __init__(self): super(MalwareConfigurationObfuscationAlgorithm, self).__init__() @@ -147,9 +149,9 @@ class MalwareConfigurationObfuscationDetails(maec.Entity): _binding_class = package_binding.MalwareConfigurationObfuscationDetailsType _namespace = _namespace - is_encoded = maec.TypedField("is_encoded") - is_encrypted = maec.TypedField("is_encrypted") - algorithm_details = maec.TypedField("Algorithm_Details", MalwareConfigurationObfuscationAlgorithm, multiple = True) + is_encoded = fields.TypedField("is_encoded") + is_encrypted = fields.TypedField("is_encrypted") + algorithm_details = fields.TypedField("Algorithm_Details", MalwareConfigurationObfuscationAlgorithm, multiple = True) def __init__(self): super(MalwareConfigurationObfuscationDetails, self).__init__() @@ -161,9 +163,9 @@ class MalwareConfigurationDetails(maec.Entity): _binding_class = package_binding.MalwareConfigurationDetailsType _namespace = _namespace - storage = maec.TypedField("Storage", MalwareConfigurationStorageDetails) - obfuscation = maec.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) - configuration_parameter = maec.TypedField("Configuration_Parameter", MalwareConfigurationParameter, multiple = True) + storage = fields.TypedField("Storage", MalwareConfigurationStorageDetails) + obfuscation = fields.TypedField("Obfuscation", MalwareConfigurationObfuscationDetails) + configuration_parameter = fields.TypedField("Configuration_Parameter", MalwareConfigurationParameter, multiple = True) def __init__(self): super(MalwareConfigurationDetails, self).__init__() @@ -173,17 +175,17 @@ class MalwareSubject(maec.Entity): _binding_class = package_binding.MalwareSubjectType _namespace = _namespace - id_ = maec.TypedField("id") - malware_instance_object_attributes = maec.TypedField("Malware_Instance_Object_Attributes", Object) + id_ = fields.TypedField("id") + malware_instance_object_attributes = fields.TypedField("Malware_Instance_Object_Attributes", Object) label = vocabs.VocabField("Label", MalwareLabel, multiple=True) - configuration_details = maec.TypedField("Configuration_Details", MalwareConfigurationDetails) - minor_variants = maec.TypedField("Minor_Variants", MinorVariants) - development_environment = maec.TypedField("Development_Environment", MalwareDevelopmentEnvironment) - #field_data = maec.TypedField("field_data") # TODO: support metadata:fieldDataEntry - analyses = maec.TypedField("Analyses", Analyses) - findings_bundles = maec.TypedField("Findings_Bundles", FindingsBundleList) - relationships = maec.TypedField("Relationships", MalwareSubjectRelationshipList) - compatible_platform = maec.TypedField("Compatible_Platform", PlatformSpecification, multiple=True) + configuration_details = fields.TypedField("Configuration_Details", MalwareConfigurationDetails) + minor_variants = fields.TypedField("Minor_Variants", MinorVariants) + development_environment = fields.TypedField("Development_Environment", MalwareDevelopmentEnvironment) + #field_data = fields.TypedField("field_data") # TODO: support metadata:fieldDataEntry + analyses = fields.TypedField("Analyses", Analyses) + findings_bundles = fields.TypedField("Findings_Bundles", FindingsBundleList) + relationships = fields.TypedField("Relationships", MalwareSubjectRelationshipList) + compatible_platform = fields.TypedField("Compatible_Platform", PlatformSpecification, multiple=True) def __init__(self, id = None, malware_instance_object_attributes = None): super(MalwareSubject, self).__init__() diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index 63de6ce..de3b897 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_package as package_binding @@ -12,7 +14,7 @@ class MalwareSubjectReference(maec.Entity): _binding_class = package_binding.MalwareSubjectReferenceType _namespace = _namespace - malware_subject_idref = maec.TypedField("malware_subject_idref") + malware_subject_idref = fields.TypedField("malware_subject_idref") def __init__(self, malware_subject_idref = None): super(MalwareSubjectReference, self).__init__() diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 6be9d10..d65c8a8 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec from . import _namespace import maec.bindings.maec_package as package_binding @@ -13,8 +15,8 @@ class ObjectEquivalence(maec.Entity): _binding_class = package_binding.ObjectEquivalenceType _namespace = _namespace - id_ = maec.TypedField("id") - object_reference = maec.TypedField("Object_Reference", ObjectReference, multiple = True) + id_ = fields.TypedField("id") + object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) def init(self, id = None): super(ObjectEquivalence, self).__init__() @@ -24,4 +26,4 @@ class ObjectEquivalenceList(maec.EntityList): _contained_type = ObjectEquivalence _binding_class = package_binding.ObjectEquivalenceListType _binding_var = "Object_Equivalence" - _namespace = _namespace \ No newline at end of file + _namespace = _namespace diff --git a/maec/package/package.py b/maec/package/package.py index 7bc553a..943f44c 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -3,6 +3,8 @@ # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from mixbox import fields + import maec import maec.bindings.maec_package as package_binding from maec.package import MalwareSubjectList, GroupingRelationshipList @@ -13,11 +15,11 @@ class Package(maec.Entity): _binding_class = package_binding.PackageType _namespace = _namespace - id_ = maec.TypedField('id') - timestamp = maec.TypedField('timestamp') - schema_version = maec.TypedField('schema_version') - malware_subjects = maec.TypedField('Malware_Subjects', MalwareSubjectList) - grouping_relationships = maec.TypedField('Grouping_Relationships', GroupingRelationshipList) + id_ = fields.TypedField('id') + timestamp = fields.TypedField('timestamp') + schema_version = fields.TypedField('schema_version') + malware_subjects = fields.TypedField('Malware_Subjects', MalwareSubjectList) + grouping_relationships = fields.TypedField('Grouping_Relationships', GroupingRelationshipList) def __init__(self, id = None, schema_version = "2.1", timestamp = None): super(Package, self).__init__() diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 6845ef2..44eeed2 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -3,7 +3,6 @@ from cybox.common.vocabs import VocabString, register_vocab - @register_vocab class MalwareCapability(VocabString): _namespace = 'http://maec.mitre.org/default_vocabularies-1' From a6955063a58495a671178e9e6668719c5b3cc756 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 19 Jun 2015 13:03:37 -0500 Subject: [PATCH 227/297] Clean up issues identified by landscape.io --- maec/bundle/action_reference_list.py | 3 --- maec/bundle/malware_action.py | 13 +++---------- maec/bundle/process_tree.py | 3 ++- 3 files changed, 5 insertions(+), 14 deletions(-) diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index a9033ed..05b6fe6 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -3,8 +3,6 @@ #Copyright (c) 2015, The MITRE Corporation #All rights reserved -from mixbox import fields - from cybox.core import ActionReference import maec @@ -17,4 +15,3 @@ class ActionReferenceList(maec.EntityList): _binding_class = bundle_binding.ActionReferenceListType _binding_var = "Action_Reference" _namespace = _namespace - diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 3fb3cf3..66cf378 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -5,7 +5,6 @@ from mixbox import fields -import cybox from cybox.core import Action from cybox.objects.code_object import Code @@ -13,6 +12,7 @@ from . import _namespace import maec.bindings.maec_bundle as bundle_binding + class Parameter(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -22,8 +22,6 @@ class Parameter(maec.Entity): name = fields.TypedField("name") value = fields.TypedField("value") - def __init__(self): - super(Parameter, self).__init__() class ParameterList(maec.EntityList): _contained_type = Parameter @@ -31,6 +29,7 @@ class ParameterList(maec.EntityList): _binding_var = "Parameter" _namespace = _namespace + class APICall(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -42,8 +41,6 @@ class APICall(maec.Entity): return_value = fields.TypedField("Return_Value") parameters = fields.TypedField("Parameters", ParameterList) - def __init__(self): - super(APICall, self).__init__() class ActionImplementation(maec.Entity): _namespace = _namespace @@ -56,8 +53,6 @@ class ActionImplementation(maec.Entity): api_call = fields.TypedField("API_Call", APICall) code = fields.TypedField("Code", Code, multiple = True) - def __init__(self): - super(ActionImplementation, self).__init__() class MalwareAction(Action): _binding = bundle_binding @@ -65,9 +60,7 @@ class MalwareAction(Action): _namespace = _namespace implementation = fields.TypedField("Implementation", ActionImplementation) - + def __init__(self): super(MalwareAction, self).__init__() self.id_ = maec.utils.idgen.create_id(prefix="action") - - diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 67b6144..4e04481 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -5,7 +5,6 @@ from mixbox import fields -import cybox from cybox.objects.process_object import Process import maec @@ -13,6 +12,7 @@ import maec.bindings.maec_bundle as bundle_binding from maec.bundle import ActionReferenceList + class ProcessTreeNode(Process): _binding = bundle_binding _binding_class = bundle_binding.ProcessTreeNodeType @@ -105,6 +105,7 @@ def set_parent_action(self, parent_action_id): """Set the ID of the parent action of the Process Tree node.""" self.parent_action_idref = parent_action_id + class ProcessTree(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.ProcessTreeType From 292dd1ff369453595c8e9b1b6393b1d33b82e6db Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 19 Jun 2015 13:48:59 -0500 Subject: [PATCH 228/297] Bump version to 4.1.0.13.dev1 --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index 433fd32..ade01fc 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13dev0" +__version__ = "4.1.0.13.dev1" From 58b43d070e6ef871f3e12c0b255f9e91ccfebca4 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 30 Jun 2015 16:39:50 -0500 Subject: [PATCH 229/297] Clean up imports in maec.bundle.bundle --- maec/bundle/bundle.py | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 11b2cae..edb6745 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -9,13 +9,18 @@ from cybox.utils.normalize import normalize_object_properties import maec -from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import (MalwareAction, AVClassifications, Behavior, - CandidateIndicatorList, ProcessTree, CapabilityList, - ObjectHistory) from maec.utils import BundleComparator, BundleDeduplicator +from . import _namespace +from .malware_action import MalwareAction +from .av_classification import AVClassifications +from .behavior import Behavior +from .candidate_indicator import CandidateIndicatorList +from .process_tree import ProcessTree +from .capability import CapabilityList +from .object_history import ObjectHistory + class BehaviorList(maec.EntityList): _contained_type = Behavior @@ -23,18 +28,21 @@ class BehaviorList(maec.EntityList): _binding_var = "Behavior" _namespace = _namespace + class ActionList(maec.EntityList): _contained_type = MalwareAction _binding_class = bundle_binding.ActionListType _binding_var = "Action" _namespace = _namespace - + + class ObjectList(maec.EntityList): _contained_type = Object _binding_class = bundle_binding.ObjectListType _binding_var = "Object" _namespace = _namespace + class BaseCollection(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BaseCollectionType @@ -49,6 +57,7 @@ def __init__(self, name = None): super(BaseCollection, self).__init__() self.name = name + class ActionCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.ActionCollectionType @@ -69,6 +78,7 @@ def add_action(self, action): """Add an input Action to the Collection.""" self.action_list.append(action) + class BehaviorCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.BehaviorCollectionType @@ -89,6 +99,7 @@ def add_behavior(self, behavior): """Add an input Behavior to the Collection.""" self.behavior_list.append(behavior) + class ObjectCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.ObjectCollectionType @@ -109,6 +120,7 @@ def add_object(self, object): """Add an input Object to the Collection.""" self.object_list.append(object) + class CandidateIndicatorCollection(BaseCollection): _binding = bundle_binding _binding_class = bundle_binding.CandidateIndicatorCollectionType @@ -129,6 +141,7 @@ def add_candidate_indicator(self, candidate_indicator): """Add an input Candidate Indicator to the Collection.""" self.candidate_indicator_list.append(candidate_indicator) + class BehaviorCollectionList(maec.EntityList): _contained_type = BehaviorCollection _binding_class = bundle_binding.BehaviorCollectionListType @@ -162,6 +175,7 @@ def get_named_collection(self, collection_name): return collection return None + class ActionCollectionList(maec.EntityList): _contained_type = ActionCollection _binding_class = bundle_binding.ActionCollectionListType @@ -195,6 +209,7 @@ def get_named_collection(self, collection_name): return collection return None + class ObjectCollectionList(maec.EntityList): _contained_type = ObjectCollection _binding_class = bundle_binding.ObjectCollectionListType @@ -228,6 +243,7 @@ def get_named_collection(self, collection_name): return collection return None + class CandidateIndicatorCollectionList(maec.EntityList): _contained_type = CandidateIndicatorCollection _binding_class = bundle_binding.CandidateIndicatorCollectionListType @@ -261,6 +277,7 @@ def get_named_collection(self, collection_name): return collection return None + class Collections(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.CollectionsType @@ -310,6 +327,7 @@ def has_content(self): return True return False + class BehaviorReference(maec.Entity): _binding = bundle_binding _binding_class = bundle_binding.BehaviorReferenceType @@ -317,6 +335,7 @@ class BehaviorReference(maec.Entity): behavior_idref = fields.TypedField('behavior_idref') + class Bundle(maec.Entity): _binding = bundle_binding _namespace = _namespace From 75ec4cd14ccd2dd6f711bb1454820975e481eebb Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 30 Jun 2015 16:41:33 -0500 Subject: [PATCH 230/297] Fix bug in MAEC bundle bindings. --- maec/bindings/maec_bundle.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 26d5fd2..90155e8 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -1571,7 +1571,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): obj_.build(child_) self.Action_Collection.append(obj_) elif nodeName_ == 'Action': - obj_ = MalwareActionType.factory() + obj_ = BehavioralActionType.factory() obj_.build(child_) self.Action.append(obj_) elif nodeName_ == 'Action_Reference': From 2a36d9ac824003bfdf9810d9ac1b4a976df13e19 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 30 Jun 2015 16:43:01 -0500 Subject: [PATCH 231/297] Clean up MAEC bundle imports. --- maec/bundle/behavior.py | 8 ++++++-- maec/bundle/process_tree.py | 5 +++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 95b4e9e..bec2421 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -12,7 +12,6 @@ from cybox.common.measuresource import MeasureSource from cybox.common.platform_specification import PlatformSpecification from cybox.objects.code_object import Code -#from maec.bundle.bundle import ActionCollection class BehavioralActionEquivalenceReference(maec.Entity): _binding = bundle_binding @@ -41,7 +40,8 @@ class BehavioralActions(maec.Entity): _binding_class = bundle_binding.BehavioralActionsType _namespace = _namespace - #action_collection = fields.TypedField('Action_Collection', ActionCollection, multiple=True) #TODO: solve recursive import + #TODO: action_collection.type_ is set below to avoid circular import. + action_collection = fields.TypedField('Action_Collection', None, multiple=True) action = fields.TypedField('Action', BehavioralAction, multiple=True) action_reference = fields.TypedField('Action_Reference', BehavioralActionReference, multiple=True) action_equivalence_reference = fields.TypedField('Action_Equivalence_Reference', BehavioralActionEquivalenceReference, multiple=True) @@ -109,3 +109,7 @@ def __init__(self, id = None, description = None): else: self.id_ = maec.utils.idgen.create_id(prefix="behavior") self.description = description + + +from maec.bundle.bundle import ActionCollection +BehavioralActions.action_collection.type_ = ActionCollection diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index 4e04481..ef32880 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -8,9 +8,10 @@ from cybox.objects.process_object import Process import maec -from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import ActionReferenceList + +from . import _namespace +from .action_reference_list import ActionReferenceList class ProcessTreeNode(Process): From b9dabfad8f7442591e7140c768b2ff6b0b53ab88 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 30 Jun 2015 16:43:36 -0500 Subject: [PATCH 232/297] Use namespaces from mixbox. --- maec/__init__.py | 29 ++++++++++------------- maec/test/encoding_test.py | 1 + maec/utils/__init__.py | 5 ++-- maec/utils/idgen.py | 8 ++++--- maec/utils/merge.py | 14 +++++++---- maec/utils/nsparser.py | 48 +++++++++----------------------------- 6 files changed, 41 insertions(+), 64 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index 86b6085..f14d59e 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,19 +1,15 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -import collections -import inspect -import json -from StringIO import StringIO - -from cybox import Entity as cyboxEntity -from cybox import EntityList -from cybox.utils import Namespace, META +from mixbox.entities import Entity as cyboxEntity +from mixbox.entities import EntityList +from mixbox.namespaces import Namespace, lookup_name, lookup_prefix +from cybox.utils import META import bindings.maec_bundle as bundle_binding import bindings.maec_package as package_binding import maec -from maec.utils import flip_dict, maecMETA, EntityParser +from maec.utils import flip_dict, EntityParser from .version import __version__ # noqa @@ -108,14 +104,14 @@ def _get_namespace_def(self, additional_ns_dict=None): # if there are any other namepaces, include xsi for "schemaLocation" # also, include the MAEC default vocabularies schema by default if namespaces: - namespaces.update([maecMETA.lookup_prefix('xsi')]) - namespaces.update([maecMETA.lookup_prefix('maecVocabs')]) + namespaces.update([lookup_prefix('xsi')]) + namespaces.update([lookup_prefix('maecVocabs')]) if namespaces and additional_ns_dict: namespace_list = [x.name for x in namespaces if x] for ns, prefix in additional_ns_dict.iteritems(): if ns not in namespace_list: - namespaces.update([Namespace(ns, prefix)]) + namespaces.update([Namespace(ns, prefix, '')]) if not namespaces: return "" @@ -133,7 +129,7 @@ def _get_namespaces(self, recurse=True): namespaces = [x._namespace for x in self.__class__.__mro__ if hasattr(x, '_namespace')] - nsset.update([maecMETA.lookup_namespace(ns) for ns in namespaces]) + nsset.update([lookup_name(ns) for ns in namespaces]) #In case of recursive relationships, don't process this item twice self.touched = True @@ -146,13 +142,12 @@ def _get_namespaces(self, recurse=True): # Add any additional namespaces that may be included in the entity input_ns = self._ns_to_prefix_input_namespaces() for namespace, alias in input_ns.iteritems(): - maec_ns = maecMETA.lookup_namespace(namespace) - cybox_ns = META.lookup_namespace(namespace) - if not maec_ns and not cybox_ns: - nsset.add(Namespace(namespace, alias)) + if not lookup_name(namespace): + nsset.add(Namespace(namespace, alias, '')) return nsset + def parse_xml_instance(filename, check_version = True): """Parse a MAEC instance and return the correct Binding and API objects Returns a dictionary of MAEC Package or Bundle Binding/API Objects""" diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py index 33873e1..1497fe0 100644 --- a/maec/test/encoding_test.py +++ b/maec/test/encoding_test.py @@ -15,6 +15,7 @@ from maec.bundle.av_classification import AVClassification from maec.bundle.behavior import Behavior from maec.bundle.capability import Capability +import maec.utils from cybox.test import round_trip diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 8d9c799..05d644b 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -16,11 +16,12 @@ def flip_dict(d): """ return dict((v,k) for k, v in d.iteritems()) - # Namespace flattening -from .nsparser import maecMETA # noqa from .idgen import * # noqa from .parser import EntityParser # noqa from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, # noqa ComparisonResult) # noqa from .deduplicator import BundleDeduplicator # noqa + +#Ensure MAEC namespaces get registered +from .nsparser import * # noqa diff --git a/maec/utils/idgen.py b/maec/utils/idgen.py index 5445fbc..003451d 100644 --- a/maec/utils/idgen.py +++ b/maec/utils/idgen.py @@ -2,9 +2,11 @@ # See LICENSE.txt for complete terms. import uuid + +from mixbox.namespaces import Namespace import cybox.utils -EXAMPLE_NAMESPACE = cybox.utils.Namespace("http://example.com", "example") +EXAMPLE_NAMESPACE = Namespace("http://example.com", "example", '') class InvalidMethodError(ValueError): def __init__(self, method): @@ -31,7 +33,7 @@ def namespace(self): @namespace.setter def namespace(self, value): - if not isinstance(value, cybox.utils.Namespace): + if not isinstance(value, Namespace): raise ValueError("Must be a Namespace object") self._namespace = value self.reset() @@ -115,4 +117,4 @@ def create_id(prefix=None): if not prefix: return _get_generator().create_id() else: - return _get_generator().create_id(prefix) \ No newline at end of file + return _get_generator().create_id(prefix) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index b171668..76fb7ca 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -1,13 +1,17 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -# Methods for merging MAEC documents -import itertools -import maec +"""Methods for merging MAEC documents""" + from copy import deepcopy +import itertools + +from mixbox.namespaces import Namespace + from cybox.core import Object from cybox.common import HashList -from cybox.utils import Namespace + +import maec from maec.package import (Package, MalwareSubject, MalwareConfigurationDetails, FindingsBundleList, MetaAnalysis, Analyses, MinorVariants, MalwareSubjectRelationshipList, @@ -236,4 +240,4 @@ def merge_malware_subjects(malware_subject_list): # Update the relationships for the Malware Subjects to account for the merges update_relationships(output_subjects, id_mappings) # Return the list of original and merged Malware Subjects - return output_subjects \ No newline at end of file + return output_subjects diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 52fced7..05f9da9 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -1,42 +1,16 @@ -#MAEC Namespace Parser +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved +# Compatible with MAEC v4.1 -#Compatible with MAEC v4.1 -#Last updated 02/18/2014 +from mixbox.namespaces import Namespace, register_namespace -from cybox.utils import Namespace -class Metadata(object): - """Metadata about MAEC namespaces.""" +NS_MAEC_BUNDLE = Namespace('http://maec.mitre.org/XMLSchema/maec-bundle-4', 'maecBundle', 'http://maec.mitre.org/language/version4.1/maec_bundle_schema.xsd') +NS_MAEC_PACKAGE = Namespace('http://maec.mitre.org/XMLSchema/maec-package-2', 'maecPackage', 'http://maec.mitre.org/language/version4.1/maec_package_schema.xsd') +NS_MAEC_VOCABS = Namespace('http://maec.mitre.org/default_vocabularies-1', 'maecVocabs', 'http://maec.mitre.org/language/version4.1/maec_default_vocabularies.xsd') - def __init__(self, namespace_list): - self._ns_dict = {} - self._prefix_dict = {} - - for ns in namespace_list: - n = Namespace(*ns) - self.add_namespace(n) - - def add_namespace(self, namespace): - self._ns_dict[namespace.name] = namespace - self._prefix_dict[namespace.prefix] = namespace - - def lookup_namespace(self, namespace): - return self._ns_dict.get(namespace) - - def lookup_prefix(self, prefix): - return self._prefix_dict.get(prefix) - - -# A list of (namespace, prefix, schemalocation) tuples -# This is loaded by the Metadata class and should not be accessed directly. -NS_LIST = [ - ('http://www.w3.org/2001/XMLSchema-instance', 'xsi', ''), - ('http://maec.mitre.org/XMLSchema/maec-bundle-4', 'maecBundle', 'http://maec.mitre.org/language/version4.1/maec_bundle_schema.xsd'), - ('http://maec.mitre.org/XMLSchema/maec-package-2', 'maecPackage', 'http://maec.mitre.org/language/version4.1/maec_package_schema.xsd'), - ('http://maec.mitre.org/default_vocabularies-1', 'maecVocabs', 'http://maec.mitre.org/language/version4.1/maec_default_vocabularies.xsd') -] - -maecMETA = Metadata(NS_LIST) +# Magic to automatically register all Namespaces defined in this module. +for k, v in dict(globals()).items(): + if k.startswith('NS_'): + register_namespace(v) From 4b407123f7b0af9f56409350fe12da3be1b16363 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Jul 2015 09:50:43 -0500 Subject: [PATCH 233/297] Use namespace utility functions from mixbox --- maec/__init__.py | 25 ++----------------------- 1 file changed, 2 insertions(+), 23 deletions(-) diff --git a/maec/__init__.py b/maec/__init__.py index f14d59e..b8bf567 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -3,7 +3,8 @@ from mixbox.entities import Entity as cyboxEntity from mixbox.entities import EntityList -from mixbox.namespaces import Namespace, lookup_name, lookup_prefix +from mixbox.namespaces import (Namespace, get_xmlns_string, + get_schemaloc_string, lookup_name, lookup_prefix) from cybox.utils import META import bindings.maec_bundle as bundle_binding @@ -14,28 +15,6 @@ from .version import __version__ # noqa -def get_xmlns_string(ns_set): - """Build a string with 'xmlns' definitions for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - xmlns_format = 'xmlns:{0.prefix}="{0.name}"' - return "\n\t".join([xmlns_format.format(x) for x in ns_set if x]) - - -def get_schemaloc_string(ns_set): - """Build a "schemaLocation" string for every namespace in ns_set. - - Arguments: - - ns_set: a set (or other iterable) of Namespace objects - """ - schemaloc_format = '{0.name} {0.schema_location}' - # Only include schemas that have a schema_location defined (for instance, - # 'xsi' does not. - return " ".join([schemaloc_format.format(x) for x in ns_set - if x and x.schema_location]) - class Entity(cyboxEntity): """Base class for all classes in the MAEC SimpleAPI.""" From 4c9410ee05600d9d8dad65387100162008e14d1f Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Jul 2015 13:38:33 -0500 Subject: [PATCH 234/297] Add basic test for nsparser module. --- maec/test/utils/__init__.py | 0 maec/test/utils/nsparser_test.py | 18 ++++++++++++++++++ maec/utils/nsparser.py | 7 +++++-- 3 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 maec/test/utils/__init__.py create mode 100644 maec/test/utils/nsparser_test.py diff --git a/maec/test/utils/__init__.py b/maec/test/utils/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/maec/test/utils/nsparser_test.py b/maec/test/utils/nsparser_test.py new file mode 100644 index 0000000..b48911d --- /dev/null +++ b/maec/test/utils/nsparser_test.py @@ -0,0 +1,18 @@ +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import unittest + +from maec.utils.nsparser import MAEC_NAMESPACES + + +class NSParserTests(unittest.TestCase): + + def test_import(self): + """Verify that the namespace list was imported successfully.""" + self.assertTrue(MAEC_NAMESPACES) + self.assertEqual(3, len(MAEC_NAMESPACES)) + + +if __name__ == "__main__": + unittest.main() diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 05f9da9..43ecac7 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -3,14 +3,17 @@ # Compatible with MAEC v4.1 -from mixbox.namespaces import Namespace, register_namespace - +from mixbox.namespaces import Namespace, NamespaceSet, register_namespace NS_MAEC_BUNDLE = Namespace('http://maec.mitre.org/XMLSchema/maec-bundle-4', 'maecBundle', 'http://maec.mitre.org/language/version4.1/maec_bundle_schema.xsd') NS_MAEC_PACKAGE = Namespace('http://maec.mitre.org/XMLSchema/maec-package-2', 'maecPackage', 'http://maec.mitre.org/language/version4.1/maec_package_schema.xsd') NS_MAEC_VOCABS = Namespace('http://maec.mitre.org/default_vocabularies-1', 'maecVocabs', 'http://maec.mitre.org/language/version4.1/maec_default_vocabularies.xsd') + +MAEC_NAMESPACES = NamespaceSet() + # Magic to automatically register all Namespaces defined in this module. for k, v in dict(globals()).items(): if k.startswith('NS_'): register_namespace(v) + MAEC_NAMESPACES.add(v) From 95adf6ec8b9c89ed9a5a5f8978c0a41ec42fbea7 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Jul 2015 14:38:16 -0500 Subject: [PATCH 235/297] Use idgen from mixbox. --- maec/bundle/behavior.py | 3 +- maec/bundle/bundle.py | 11 +-- maec/bundle/candidate_indicator.py | 3 +- maec/bundle/capability.py | 5 +- maec/bundle/malware_action.py | 3 +- maec/bundle/process_tree.py | 3 +- maec/package/action_equivalence.py | 3 +- maec/package/analysis.py | 3 +- maec/package/malware_subject.py | 3 +- maec/package/package.py | 3 +- maec/utils/__init__.py | 1 - maec/utils/idgen.py | 120 ----------------------------- maec/utils/merge.py | 3 +- 13 files changed, 27 insertions(+), 137 deletions(-) delete mode 100644 maec/utils/idgen.py diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index bec2421..2d0d9b2 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen import maec from . import _namespace @@ -107,7 +108,7 @@ def __init__(self, id = None, description = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="behavior") + self.id_ = idgen.create_id(prefix="behavior") self.description = description diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index edb6745..7c0b11b 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen from cybox.core import Object from cybox.utils.normalize import normalize_object_properties @@ -71,7 +72,7 @@ def __init__(self, name = None, id = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="action_collection") + self.id_ = idgen.create_id(prefix="action_collection") self.action_list = ActionList() def add_action(self, action): @@ -92,7 +93,7 @@ def __init__(self, name = None, id = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="behavior_collection") + self.id_ = idgen.create_id(prefix="behavior_collection") self.behavior_list = BehaviorList() def add_behavior(self, behavior): @@ -113,7 +114,7 @@ def __init__(self, name = None, id = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="object_collection") + self.id_ = idgen.create_id(prefix="object_collection") self.object_list = ObjectList() def add_object(self, object): @@ -134,7 +135,7 @@ def __init__(self, name = None, id = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="candidate_indicator_collection") + self.id_ = idgen.create_id(prefix="candidate_indicator_collection") self.candidate_indicator_list = CandidateIndicatorList() def add_candidate_indicator(self, candidate_indicator): @@ -361,7 +362,7 @@ def __init__(self, id = None, defined_subject = False, schema_version = "4.1", c if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="bundle") + self.id_ = idgen.create_id(prefix="bundle") self.schema_version = schema_version self.defined_subject = defined_subject self.content_type = content_type diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index 6f6fcc2..db204a7 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen import maec from . import _namespace @@ -62,7 +63,7 @@ def __init__(self, id = None): if id: id_ = id else: - id_ = maec.utils.idgen.create_id(prefix="candidate_indicator") + id_ = idgen.create_id(prefix="candidate_indicator") class CandidateIndicatorList(maec.EntityList): _contained_type = CandidateIndicator diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index db46f25..47bc6eb 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen import maec from . import _namespace @@ -89,7 +90,7 @@ def __init__(self, id=None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="capability_objective") + self.id_ = idgen.create_id(prefix="capability_objective") class Capability(maec.Entity): @@ -111,7 +112,7 @@ def __init__(self, id=None, name=None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="capability") + self.id_ = idgen.create_id(prefix="capability") self.name = name def add_tactical_objective(self, tactical_objective): diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index 66cf378..b711418 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen from cybox.core import Action from cybox.objects.code_object import Code @@ -63,4 +64,4 @@ class MalwareAction(Action): def __init__(self): super(MalwareAction, self).__init__() - self.id_ = maec.utils.idgen.create_id(prefix="action") + self.id_ = idgen.create_id(prefix="action") diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index ef32880..f99599b 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen from cybox.objects.process_object import Process @@ -34,7 +35,7 @@ def __init__(self, id = None, parent_action_idref = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="process_tree") + self.id_ = idgen.create_id(prefix="process_tree") self.parent_action_idref = parent_action_idref def add_spawned_process(self, process_node, process_id = None): diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index 3bd6a41..108bc6f 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -4,6 +4,7 @@ #All rights reserved from mixbox import fields +from mixbox import idgen import maec from . import _namespace @@ -20,7 +21,7 @@ class ActionEquivalence(maec.Entity): def __init__(self): super(ActionEquivalence, self).__init__() - self.id_ = maec.utils.idgen.create_id(prefix="action_equivalence") + self.id_ = idgen.create_id(prefix="action_equivalence") class ActionEquivalenceList(maec.EntityList): _contained_type = ActionEquivalence diff --git a/maec/package/analysis.py b/maec/package/analysis.py index a4b3cfc..72cd7fe 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen from cybox.common import (PlatformSpecification, Personnel, StructuredText, ToolInformation) @@ -219,7 +220,7 @@ def __init__(self, id = None, method = None, type = None, findings_bundle_refere if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="analysis") + self.id_ = idgen.create_id(prefix="analysis") self.method = method self.type_ = type self.findings_bundle_reference = findings_bundle_reference diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 3deb0c6..21c81e0 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen from cybox.common import vocabs, VocabString, PlatformSpecification, ToolInformation from cybox.objects.file_object import File @@ -192,7 +193,7 @@ def __init__(self, id = None, malware_instance_object_attributes = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="malware_subject") + self.id_ = idgen.create_id(prefix="malware_subject") #Set the Malware Instance Object Attributes (a CybOX object) if they are not none self.malware_instance_object_attributes = malware_instance_object_attributes diff --git a/maec/package/package.py b/maec/package/package.py index 943f44c..2337587 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -4,6 +4,7 @@ # All rights reserved from mixbox import fields +from mixbox import idgen import maec import maec.bindings.maec_package as package_binding @@ -26,7 +27,7 @@ def __init__(self, id = None, schema_version = "2.1", timestamp = None): if id: self.id_ = id else: - self.id_ = maec.utils.idgen.create_id(prefix="package") + self.id_ = idgen.create_id(prefix="package") self.schema_version = schema_version self.timestamp = timestamp self.malware_subjects = MalwareSubjectList() diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 05d644b..41345f8 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -17,7 +17,6 @@ def flip_dict(d): return dict((v,k) for k, v in d.iteritems()) # Namespace flattening -from .idgen import * # noqa from .parser import EntityParser # noqa from .comparator import (ObjectHash, BundleComparator, SimilarObjectCluster, # noqa ComparisonResult) # noqa diff --git a/maec/utils/idgen.py b/maec/utils/idgen.py deleted file mode 100644 index 003451d..0000000 --- a/maec/utils/idgen.py +++ /dev/null @@ -1,120 +0,0 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. -# See LICENSE.txt for complete terms. - -import uuid - -from mixbox.namespaces import Namespace -import cybox.utils - -EXAMPLE_NAMESPACE = Namespace("http://example.com", "example", '') - -class InvalidMethodError(ValueError): - def __init__(self, method): - ValueError.__init__(self, "invalid method: %s" % method) - -class IDGenerator(object): - """Utility class for generating MAEC IDs for objects""" - METHOD_UUID = 1 - METHOD_INT = 2 - - METHODS = (METHOD_UUID, METHOD_INT) - - def __init__(self, namespace=EXAMPLE_NAMESPACE, method=METHOD_UUID): - self.namespace = namespace - self.method = method - self.reset() - - def reset(self): - self.next_int = 1 - - @property - def namespace(self): - return self._namespace - - @namespace.setter - def namespace(self, value): - if not isinstance(value, Namespace): - raise ValueError("Must be a Namespace object") - self._namespace = value - self.reset() - - @property - def method(self): - return self._method - - @method.setter - def method(self, value): - if value not in IDGenerator.METHODS: - raise InvalidMethodError("invalid method: %s" % value) - self._method = value - self.reset() - - def create_id(self, prefix="guid"): - """Create an ID. - - Note that if `prefix` is not provided, it will be `quid`, even if the - `method` is `METHOD_INT`. - """ - if self.method == IDGenerator.METHOD_UUID: - id_ = str(uuid.uuid4()) - elif self.method == IDGenerator.METHOD_INT: - id_ = self.next_int - self.next_int += 1 - else: - raise InvalidMethodError() - - return "%s:%s-%s" % (self.namespace.prefix, prefix, id_) - -# Singleton instance within this module. It is lazily instantiated, so simply -# importing the utils module will not create the object. -__generator = None - -def _get_generator(): - """Return the `maec.utils` module's generator object. - - Only under rare circumstances should this function be called by external - code. More likely, external code should initialize its own IDGenerator or - use the `set_id_namespace`, `set_id_method`, or `create_id` functions of - the `maec.utils` module. - """ - global __generator - if not __generator: - __generator = IDGenerator() - return __generator - - -def set_id_namespace(namespace, set_cybox = True): - """ Set the namespace for the module-level ID Generator. - The second parameter defines whether or not to set the - namespace in python-cybox, with a default value of True.""" - _get_generator().namespace = namespace - - # Set the corresponding CybOX method - if set_cybox: - cybox.utils.set_id_namespace(namespace) - -def set_id_method(method, set_cybox = True): - """ Set the method for the module-level ID Generator. - The second parameter defines whether or not to set the - id method in python-cybox, with a default value of True.""" - _get_generator().method = method - - # Set the corresponding CybOX method - if set_cybox: - cybox.utils.set_id_method(method) - - -def get_id_namespace(): - """Return the namespace associated with generated ids""" - return _get_generator().namespace.iterkeys().next() - -def get_id_namespace_alias(): - """Returns the namespace alias assoicated with generated ids""" - return _get_generator().namespace.itervalues().next() - -def create_id(prefix=None): - """ Create an ID using the module-level ID Generator""" - if not prefix: - return _get_generator().create_id() - else: - return _get_generator().create_id(prefix) diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 76fb7ca..7e1d40d 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -6,6 +6,7 @@ from copy import deepcopy import itertools +from mixbox import idgen from mixbox.namespaces import Namespace from cybox.core import Object @@ -165,7 +166,7 @@ def merge_binned_malware_subjects(merged_malware_subject, binned_list, id_mappin mal_inst_obj_list = [x.malware_instance_object_attributes for x in binned_list] merged_inst_obj = Object.from_dict(merge_entities(mal_inst_obj_list)) # Give the merged Object a new ID - merged_inst_obj.id_ = maec.utils.idgen.create_id('object') + merged_inst_obj.id_ = idgen.create_id('object') # Deduplicate the hash values, if they exist if merged_inst_obj.properties and merged_inst_obj.properties.hashes: hashes = merged_inst_obj.properties.hashes From 06cc9c09cc8c57659e3baa61c2cd5979cb31d007 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 1 Jul 2015 15:54:17 -0500 Subject: [PATCH 236/297] Remove unused import. --- maec/__init__.py | 1 - 1 file changed, 1 deletion(-) diff --git a/maec/__init__.py b/maec/__init__.py index b8bf567..76f86e8 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -5,7 +5,6 @@ from mixbox.entities import EntityList from mixbox.namespaces import (Namespace, get_xmlns_string, get_schemaloc_string, lookup_name, lookup_prefix) -from cybox.utils import META import bindings.maec_bundle as bundle_binding import bindings.maec_package as package_binding From 84a89ab6e5837623194348cb5a15001a77447827 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Jul 2015 09:22:03 -0500 Subject: [PATCH 237/297] Update documentation to reflect use of mixbox. Since a common idgen module is used, there aren't separate counters for cybox and maec IDs. Also, the imports have changed. Removed the documentation for the idgen and nsparser modules, since they are no longer used. --- docs/api/index.rst | 39 +++++++++++++++--------------- docs/api/utils/idgen.rst | 11 --------- docs/api/utils/nsparser.rst | 11 --------- docs/examples.rst | 48 +++++++++++++++++++++---------------- 4 files changed, 46 insertions(+), 63 deletions(-) delete mode 100644 docs/api/utils/idgen.rst delete mode 100644 docs/api/utils/nsparser.rst diff --git a/docs/api/index.rst b/docs/api/index.rst index 5f9b24c..a3cb1eb 100644 --- a/docs/api/index.rst +++ b/docs/api/index.rst @@ -5,54 +5,53 @@ The *python-maec* APIs are the recommended tools for reading, writing, and manip .. note:: - The python-maec APIs are currently under development. As such, API coverage of MAEC data constructs is incomplete; please bear with us as we work toward complete coverage. This documentation also serves to outline current API coverage. + The python-maec APIs are currently under development. As such, API coverage of MAEC data constructs is incomplete; please bear with us as we work toward complete coverage. This documentation also serves to outline current API coverage. **MAEC** -- Modules located in the base `maec`_ package .. _maec: https://github.com/MAECProject/python-maec/tree/master/maec .. toctree:: - :titlesonly: + :titlesonly: + + __init__ - __init__ - **MAEC Bundle** -- Modules located in the `maec.bundle`_ package .. _maec.bundle: https://github.com/MAECProject/python-maec/tree/master/maec/bundle .. toctree:: - :titlesonly: - :glob: + :titlesonly: + :glob: + + bundle/* - bundle/* - **MAEC Package** -- Modules located in the `maec.package`_ package .. _maec.package: https://github.com/MAECProject/python-maec/tree/master/maec/package .. toctree:: - :titlesonly: - :glob: + :titlesonly: + :glob: + + package/* - package/* - **MAEC Utils** -- Modules located in the `maec.utils`_ package .. _maec.utils: https://github.com/MAECProject/python-maec/tree/master/maec/utils .. toctree:: - :titlesonly: - :glob: + :titlesonly: + :glob: + + utils/* - utils/* - **MAEC Analytics** -- Modules located in the `maec.analytics`_ package .. _maec.analytics: https://github.com/MAECProject/python-maec/tree/master/maec/analytics .. toctree:: - :titlesonly: - :glob: + :titlesonly: + :glob: - analytics/* - \ No newline at end of file + analytics/* diff --git a/docs/api/utils/idgen.rst b/docs/api/utils/idgen.rst deleted file mode 100644 index 0e10a60..0000000 --- a/docs/api/utils/idgen.rst +++ /dev/null @@ -1,11 +0,0 @@ -:mod:`maec.utils.idgen` Module -============================== - -.. module:: maec.utils.idgen - -Classes -------- - -.. autoclass:: IDGenerator - :show-inheritance: - :members: diff --git a/docs/api/utils/nsparser.rst b/docs/api/utils/nsparser.rst deleted file mode 100644 index 3daef3b..0000000 --- a/docs/api/utils/nsparser.rst +++ /dev/null @@ -1,11 +0,0 @@ -:mod:`maec.utils.nsparser` Module -================================= - -.. module:: maec.utils.nsparser - -Classes -------- - -.. autoclass:: Metadata - :show-inheritance: - :members: diff --git a/docs/examples.rst b/docs/examples.rst index bdbc32e..fc6f3fa 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -32,10 +32,11 @@ different types of analysis. .. testcode:: + from mixbox.idgen import IDGenerator, set_id_method + set_id_method(IDGenerator.METHOD_INT) + from maec.package import Package, MalwareSubject - from maec.utils import IDGenerator, set_id_method - set_id_method(IDGenerator.METHOD_INT) p = Package() ms = MalwareSubject() p.add_malware_subject(ms) @@ -64,12 +65,13 @@ that it is characterizing. .. testcode:: - from maec.package import MalwareSubject - from maec.utils import IDGenerator, set_id_method + from mixbox.idgen import IDGenerator, set_id_method + set_id_method(IDGenerator.METHOD_INT) + from cybox.core import Object from cybox.objects.file_object import File + from maec.package import MalwareSubject - set_id_method(IDGenerator.METHOD_INT) ms = MalwareSubject() ms.malware_instance_object_attributes = Object() ms.malware_instance_object_attributes.properties = File() @@ -82,7 +84,7 @@ Which outputs: .. testoutput:: - + malware.exe C:\Windows\Temp\malware.exe @@ -110,12 +112,13 @@ instance that it is characterizing. .. testcode:: - from maec.bundle import Bundle - from maec.utils import IDGenerator, set_id_method + from mixbox.idgen import IDGenerator, set_id_method + set_id_method(IDGenerator.METHOD_INT) + from cybox.core import Object from cybox.objects.file_object import File + from maec.bundle import Bundle - set_id_method(IDGenerator.METHOD_INT) b = Bundle() b.malware_instance_object_attributes = Object() b.malware_instance_object_attributes.properties = File() @@ -129,7 +132,7 @@ Which outputs: .. testoutput:: - + malware.exe C:\Windows\Temp\malware.exe @@ -147,13 +150,15 @@ be defined in their parent Malware Subject. .. testcode:: - from maec.package import MalwareSubject - from maec.bundle import Bundle - from maec.utils import IDGenerator, set_id_method + from mixbox.idgen import IDGenerator, set_id_method + set_id_method(IDGenerator.METHOD_INT) + from cybox.core import Object from cybox.objects.file_object import File - set_id_method(IDGenerator.METHOD_INT) + from maec.package import MalwareSubject + from maec.bundle import Bundle + ms = MalwareSubject() ms.malware_instance_object_attributes = Object() ms.malware_instance_object_attributes.properties = File() @@ -170,14 +175,14 @@ Which outputs: .. testoutput:: - + malware.exe C:\Windows\Temp\malware.exe - + @@ -194,14 +199,15 @@ needed. .. testcode:: - from maec.bundle import Bundle - from maec.bundle import MalwareAction - from maec.utils import IDGenerator, set_id_method + from mixbox.idgen import IDGenerator, set_id_method + set_id_method(IDGenerator.METHOD_INT) + from cybox.core import Object, AssociatedObjects, AssociatedObject from cybox.objects.file_object import File from cybox.common import VocabString + from maec.bundle import Bundle + from maec.bundle import MalwareAction - set_id_method(IDGenerator.METHOD_INT) b = Bundle() a = MalwareAction() ao = AssociatedObject() @@ -230,7 +236,7 @@ needed. create file - + badware.exe 123456 From 360191450c4267c7d38663d8ff6e53ac42d5b134 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Jul 2015 09:22:46 -0500 Subject: [PATCH 238/297] Bump required versions of mixbox, cybox --- setup.py | 8 +++++++- tox.ini | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/setup.py b/setup.py index 36d6829..27a64b2 100644 --- a/setup.py +++ b/setup.py @@ -23,6 +23,12 @@ def get_version(): with open('README.rst') as f: readme = f.read() +install_requires = [ + 'lxml>=2.2.3', + 'mixbox>=0.0.8', + 'cybox>=2.1.0.12.dev1,<2.1.1.0', +] + extras_require = { 'docs': [ 'Sphinx==1.3.1', @@ -43,7 +49,7 @@ def get_version(): long_description=readme, url="http://maec.mitre.org", packages=find_packages(), - install_requires=['mixbox', 'lxml>=2.2.3', 'cybox>=2.1.0.12.dev0,<2.1.1.0'], + install_requires=install_requires, extras_require=extras_require, classifiers=[ "Programming Language :: Python", diff --git a/tox.ini b/tox.ini index 9ed54c8..22e6590 100644 --- a/tox.ini +++ b/tox.ini @@ -14,7 +14,7 @@ basepython=python2.6 commands = nosetests maec deps = - cybox>=2.1.0.12.dev0 + cybox>=2.1.0.12.dev1 lxml==2.2.3 python-dateutil==1.4.1 nose From af7d139391fc797e1fa5a6540f0589e5b0c2a1c0 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 2 Jul 2015 09:48:16 -0500 Subject: [PATCH 239/297] Bump version to 4.1.0.13.dev2 --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index ade01fc..207c4ad 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13.dev1" +__version__ = "4.1.0.13.dev2" From 8b0ba66380194d7d29cb65cd77887923e757eb80 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 15 Jul 2015 14:19:16 -0500 Subject: [PATCH 240/297] Use mixbox parser. --- maec/test/utils/parser_test.py | 99 +++++++++++++++++++++++++ maec/utils/parser.py | 129 +++++++-------------------------- 2 files changed, 125 insertions(+), 103 deletions(-) create mode 100644 maec/test/utils/parser_test.py diff --git a/maec/test/utils/parser_test.py b/maec/test/utils/parser_test.py new file mode 100644 index 0000000..6b1bce7 --- /dev/null +++ b/maec/test/utils/parser_test.py @@ -0,0 +1,99 @@ +# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +from StringIO import StringIO +import unittest + +from mixbox.parser import (UnknownVersionError, UnsupportedRootElementError, + UnsupportedVersionError) + +from maec.bundle import Bundle +from maec.package import Package +from maec.utils import EntityParser + + +class ParserTests(unittest.TestCase): + + def test_valid_package(self): + valid_package = """ + + + """ + + parser = EntityParser() + package = parser.parse_xml(StringIO(valid_package)) + + self.assertEqual(Package, type(package)) + self.assertEqual("example:package-1", package.id_) + + def test_valid_bundle(self): + valid_bundle = """ + + + """ + + parser = EntityParser() + package = parser.parse_xml(StringIO(valid_bundle)) + + self.assertEqual("example:bundle-1", package.id_) + + def test_wrong_root_element(self): + wrong_root = """ + + + """ + + parser = EntityParser() + self.assertRaises(UnsupportedRootElementError, + parser.parse_xml, StringIO(wrong_root)) + + # If there's not a valid root element, there's no way to check the + # version number. + self.assertRaises(UnsupportedVersionError, + parser.parse_xml, StringIO(wrong_root), + check_root=False) + + def test_wrong_version(self): + wrong_version = """ + + + """ + + parser = EntityParser() + self.assertRaises(UnsupportedVersionError, + parser.parse_xml, StringIO(wrong_version)) + + package = parser.parse_xml(StringIO(wrong_version), + check_version=False) + + self.assertEqual("example:package-1", package.id_) + self.assertEqual("10.1.8", package.schema_version) + + def test_missing_version(self): + missing_version = """ + + + """ + + parser = EntityParser() + self.assertRaises(UnknownVersionError, + parser.parse_xml, StringIO(missing_version)) + + package = parser.parse_xml(StringIO(missing_version), + check_version=False) + + self.assertEqual("example:package-1", package.id_) + + +if __name__ == "__main__": + unittest.main() diff --git a/maec/utils/parser.py b/maec/utils/parser.py index b94f79e..b330980 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -1,114 +1,37 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -import maec -from lxml import etree +import mixbox.parser +from mixbox.parser import (UnknownVersionError, UnsupportedVersionError, + UnsupportedRootElementError) -class UnsupportedVersionError(Exception): - pass +# Alias for backwards compatibility +UnsupportedRootElement = UnsupportedRootElementError -class UnknownVersionError(Exception): - pass +TAG_MAEC_BUNDLE = "{http://maec.mitre.org/XMLSchema/maec-bundle-4}MAEC_Bundle" +TAG_MAEC_PACKAGE = "{http://maec.mitre.org/XMLSchema/maec-package-2}MAEC_Package" -class UnsupportedRootElement(Exception): - pass -class EntityParser(object): - def __init__(self): - self.is_bundle = False - self.is_package = False +class EntityParser(mixbox.parser.EntityParser): - def _check_version(self, tree): - '''Returns true of the instance document @tree is a version supported by python-maec''' + def supported_tags(self): + return [TAG_MAEC_BUNDLE, TAG_MAEC_PACKAGE] - try: - root = tree.getroot() # is tree an lxml.Element or lxml.ElementTree - except AttributeError: - root = tree + def get_version(self, root): + return root.attrib.get('schema_version') - if not root.attrib.get('schema_version'): - raise UnknownVersionError("No version attribute set on xml instance. Unable to determine version compatibility") + def supported_versions(self, tag): + if tag == TAG_MAEC_BUNDLE: + return ['4.1'] + elif tag == TAG_MAEC_PACKAGE: + return ['2.1'] + else: + return [] - python_maec_version = maec.__version__ # ex: '4.1.0.0' - supported_maec_version = ('4.1', '2.1') # ex: '4.1.0' - document_version = root.attrib['schema_version'] - - if document_version not in supported_maec_version: - raise UnsupportedVersionError("Your python-maec library supports MAEC %s, or the MAEC Bundle Schema at %s and MAEC Package Schema at %s. Document version was %s" % (supported_maec_version[0], supported_maec_version[0], supported_maec_version[1], document_version)) - - return True - - def _check_root(self, tree): - try: - root = tree.getroot() # is tree an lxml.Element or lxml.ElementTree - except AttributeError: - root = tree - # General compatibility check - if root.tag not in ("{http://maec.mitre.org/XMLSchema/maec-bundle-4}MAEC_Bundle", "{http://maec.mitre.org/XMLSchema/maec-package-2}MAEC_Package"): - raise UnsupportedRootElement("Document root element must be an instance of MAEC_Package or MAEC_Bundle") - - # Determine if we're dealing with a MAEC Bundle or MAEC Package - if "MAEC_Bundle" in root.tag: - self.is_bundle = True - elif "MAEC_Package" in root.tag: - self.is_package = True - - return True - - def _apply_input_namespaces(self, tree, entity): - try: - root = tree.getroot() # is tree an lxml.Element or lxml.ElementTree - except AttributeError: - root = tree - - entity.__input_namespaces__ = dict(root.nsmap.iteritems()) - - def parse_xml_to_obj(self, xml_file, check_version=True): - """Creates a MAEC binding object from the supplied xml file. - - Arguments: - xml_file -- A filename/path or a file-like object reprenting a MAEC instance document - check_version -- Inspect the version before parsing. - """ - parser = etree.ETCompatXMLParser(huge_tree=True, resolve_entities=False) - tree = etree.parse(xml_file, parser=parser) - - # Check the root and determine the type of document we're dealing with - self._check_root(tree) - - if check_version: - self._check_version(tree) - - binding_obj = None - if self.is_package: - import maec.bindings.maec_package as maec_package_binding - binding_obj = maec_package_binding.PackageType().factory() - binding_obj.build(tree.getroot()) - elif self.is_bundle: - import maec.bindings.maec_bundle as maec_bundle_binding - binding_obj = maec_bundle_binding.BundleType().factory() - binding_obj.build(tree.getroot()) - - return binding_obj - - def parse_xml(self, xml_file, check_version=True): - """Creates a python-maec Bundle or Package object from the supplied xml_file. - - Arguments: - xml_file -- A filename/path or a file-like object reprenting a MAEC instance (i.e. Package or Bundle) document - check_version -- Inspect the version before parsing. - """ - parser = etree.ETCompatXMLParser(huge_tree=True, resolve_entities=False) - tree = etree.parse(xml_file, parser=parser) - - api_obj = None - binding_obj = self.parse_xml_to_obj(xml_file, check_version) - if self.is_package: - from maec.package.package import Package # resolve circular dependencies - api_obj = Package.from_obj(binding_obj) - elif self.is_bundle: - from maec.bundle.bundle import Bundle # resolve circular dependencies - api_obj = Bundle.from_obj(binding_obj) - self._apply_input_namespaces(tree, api_obj) - - return api_obj \ No newline at end of file + def get_entity_class(self, tag): + if tag == TAG_MAEC_BUNDLE: + from maec.bundle import Bundle + return Bundle + elif tag == TAG_MAEC_PACKAGE: + from maec.package import Package + return Package From 5b51850233e187e17fadcca41520b65db1e013cb Mon Sep 17 00:00:00 2001 From: Greg Back Date: Wed, 15 Jul 2015 14:22:07 -0500 Subject: [PATCH 241/297] Bump required version of mixbox. --- setup.py | 2 +- tox.ini | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 27a64b2..ad7c83d 100644 --- a/setup.py +++ b/setup.py @@ -25,7 +25,7 @@ def get_version(): install_requires = [ 'lxml>=2.2.3', - 'mixbox>=0.0.8', + 'mixbox>=0.0.10', 'cybox>=2.1.0.12.dev1,<2.1.1.0', ] diff --git a/tox.ini b/tox.ini index 22e6590..39adae1 100644 --- a/tox.ini +++ b/tox.ini @@ -16,5 +16,6 @@ commands = deps = cybox>=2.1.0.12.dev1 lxml==2.2.3 + mixbox>=0.0.10 python-dateutil==1.4.1 nose From 6f08edfafebdc578c40c8527cddd940cec177734 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Tue, 4 Aug 2015 10:01:57 -0400 Subject: [PATCH 242/297] Updated cybox dependency version --- setup.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index ad7c83d..a7c1714 100644 --- a/setup.py +++ b/setup.py @@ -23,10 +23,11 @@ def get_version(): with open('README.rst') as f: readme = f.read() + install_requires = [ 'lxml>=2.2.3', 'mixbox>=0.0.10', - 'cybox>=2.1.0.12.dev1,<2.1.1.0', + 'cybox>=2.1.0.13.dev0,<2.1.1.0', ] extras_require = { From e6be56f9fb6265c3d4724ef958568635dbf14e70 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Tue, 4 Aug 2015 10:14:17 -0400 Subject: [PATCH 243/297] Bumped version to 4.1.0.13.dev3 --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index 207c4ad..09e95e6 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13.dev2" +__version__ = "4.1.0.13.dev3" From 23c1ea8f2784aa3739b2b2cf05fa8b708c382d53 Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Mon, 5 Oct 2015 15:32:46 -0400 Subject: [PATCH 244/297] A minor change as a result of the mixbox namespaces code revamp. --- maec/utils/nsparser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 43ecac7..24a0ae0 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -16,4 +16,4 @@ for k, v in dict(globals()).items(): if k.startswith('NS_'): register_namespace(v) - MAEC_NAMESPACES.add(v) + MAEC_NAMESPACES.add_namespace(v) From 6225a2be3be641fb20206a61277b0b1a170c2f36 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Wed, 14 Oct 2015 14:43:40 -0400 Subject: [PATCH 245/297] Updated python-maec code to work with 'typedfields' branches in python-cybox and mixbox repositories. The comparator_example seems to not work properly yet. --- examples/package_generation_example.py | 4 +- maec/bundle/av_classification.py | 69 ++++++++++++++------------ maec/bundle/bundle.py | 20 +++----- maec/package/analysis.py | 57 ++++++++++++--------- maec/utils/comparator.py | 5 +- 5 files changed, 83 insertions(+), 72 deletions(-) diff --git a/examples/package_generation_example.py b/examples/package_generation_example.py index 814f1c2..c81a6f3 100644 --- a/examples/package_generation_example.py +++ b/examples/package_generation_example.py @@ -14,8 +14,8 @@ import maec.utils # Instantiate the ID generator class (for automatic ID generation) with our example namespace -NS = Namespace("http://example.com/", "example") -maec.utils.set_id_namespace(NS) +NS = Namespace("http://example.com/", "example", "") +maec.utils.register_namespace(NS) # Instantiate the Bundle, Package, MalwareSubject, and Analysis classes bundle = Bundle(defined_subject=False) package = Package() diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index fd51992..25959d5 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -1,66 +1,69 @@ # MAEC AV Classification classes - # Copyright (c) 2015, The MITRE Corporation # All rights reserved +from cybox.common import ToolInformation import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding -from cybox.common import ToolInformation + class AVClassification(ToolInformation, maec.Entity): _namespace = _namespace _binding = bundle_binding _binding_class = bundle_binding.AVClassificationType - def __init__(self, classification = None, tool_name = None, tool_vendor = None): - super(AVClassification, self).__init__(tool_name, tool_vendor) + def __init__(self, classification=None, tool_name=None, tool_vendor=None): + super(AVClassification, self).__init__(tool_name=tool_name, tool_vendor=tool_vendor) self.engine_version = None self.definition_version = None self.classification_name = classification - def to_obj(self, return_obj=None, ns_info=None): - if not return_obj: - return_obj = self._binding_class() - - super(AVClassification, self).to_obj(return_obj=return_obj, ns_info=ns_info) - + def to_obj(self, ns_info=None): + obj = super(AVClassification, self).to_obj(ns_info=ns_info) if self.engine_version is not None : - return_obj.Engine_Version = self.engine_version + obj.Engine_Version = self.engine_version if self.definition_version is not None : - return_obj.Definition_Version = self.definition_version + obj.Definition_Version = self.definition_version if self.classification_name is not None : - return_obj.Classification_Name = self.classification_name - return return_obj + obj.Classification_Name = self.classification_name + return obj def to_dict(self): - av_classification_dict = super(AVClassification, self).to_dict() - if self.engine_version is not None : av_classification_dict['engine_version'] = self.engine_version - if self.definition_version is not None : av_classification_dict['definition_version'] = self.definition_version - if self.classification_name is not None : av_classification_dict['classification_name'] = self.classification_name - return av_classification_dict + d = super(AVClassification, self).to_dict() + + if self.engine_version is not None: + d['engine_version'] = self.engine_version + if self.definition_version is not None: + d['definition_version'] = self.definition_version + if self.classification_name is not None: + d['classification_name'] = self.classification_name + + return d - @staticmethod - def from_dict(av_classification_dict): - if not av_classification_dict: + @classmethod + def from_dict(cls, cls_dict): + if not cls_dict: return None - av_classification_ = ToolInformation.from_dict(av_classification_dict, AVClassification()) - av_classification_.engine_version = av_classification_dict.get('engine_version') - av_classification_.definition_version = av_classification_dict.get('definition_version') - av_classification_.classification_name = av_classification_dict.get('classification_name') + + av_classification_ = super(AVClassification, cls).from_dict(cls_dict) + av_classification_.engine_version = cls_dict.get('engine_version') + av_classification_.definition_version = cls_dict.get('definition_version') + av_classification_.classification_name = cls_dict.get('classification_name') return av_classification_ - @staticmethod - def from_obj(av_classification_obj): - if not av_classification_obj: + @classmethod + def from_obj(cls, cls_obj): + if not cls_obj: return None - av_classification_ = ToolInformation.from_obj(av_classification_obj, AVClassification()) - av_classification_.engine_version = av_classification_obj.Engine_Version - av_classification_.definition_version = av_classification_obj.Definition_Version - av_classification_.classification_name = av_classification_obj.Classification_Name + av_classification_ = super(AVClassification, cls).from_obj(cls_obj) + av_classification_.engine_version = cls_obj.Engine_Version + av_classification_.definition_version = cls_obj.Definition_Version + av_classification_.classification_name = cls_obj.Classification_Name return av_classification_ + class AVClassifications(maec.EntityList): _contained_type = AVClassification _binding_class = bundle_binding.AVClassificationsType diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 7c0b11b..ab5d6c4 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -152,10 +152,9 @@ class BehaviorCollectionList(maec.EntityList): def __init__(self): super(BehaviorCollectionList, self).__init__() - def to_obj(self, return_obj=None, ns_info=None): - self._collect_ns_info(ns_info) + def to_obj(self, ns_info=None): + behavior_collection_list_obj = super(BehaviorCollectionList, self).to_obj() - behavior_collection_list_obj = bundle_binding.BehaviorCollectionListType() for behavior_collection in self: if len(behavior_collection.behavior_list) > 0: behavior_collection_list_obj.add_Behavior_Collection(behavior_collection.to_obj(ns_info=ns_info)) @@ -186,10 +185,9 @@ class ActionCollectionList(maec.EntityList): def __init__(self): super(ActionCollectionList, self).__init__() - def to_obj(self, return_obj=None, ns_info=None): - self._collect_ns_info(ns_info) + def to_obj(self, ns_info=None): + action_collection_list_obj = super(ActionCollectionList, self).to_obj() - action_collection_list_obj = bundle_binding.ActionCollectionListType() for action_collection in self: if len(action_collection.action_list) > 0: action_collection_list_obj.add_Action_Collection(action_collection.to_obj(ns_info=ns_info)) @@ -220,10 +218,9 @@ class ObjectCollectionList(maec.EntityList): def __init__(self): super(ObjectCollectionList, self).__init__() - def to_obj(self, return_obj=None, ns_info=None): - self._collect_ns_info(ns_info) + def to_obj(self, ns_info=None): + object_collection_list_obj = super(ObjectCollectionList, self).to_obj() - object_collection_list_obj = bundle_binding.ObjectCollectionListType() for object_collection in self: if len(object_collection.object_list) > 0: object_collection_list_obj.add_Object_Collection(object_collection.to_obj(ns_info=ns_info)) @@ -254,10 +251,9 @@ class CandidateIndicatorCollectionList(maec.EntityList): def __init__(self): super(CandidateIndicatorCollectionList, self).__init__() - def to_obj(self, return_obj=None, ns_info=None): - self._collect_ns_info(ns_info) + def to_obj(self, ns_info=None): + candidate_indicator_collection_list_obj = super(CandidateIndicatorCollectionList, self).to_obj() - candidate_indicator_collection_list_obj = bundle_binding.CandidateIndicatorCollectionListType() for candidate_indicator_collection in self: if len(candidate_indicator_collection.candidate_indicator_list) > 0: candidate_indicator_collection_list_obj.add_Candidate_Indicator_Collection(candidate_indicator_collection.to_obj(ns_info=ns_info)) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 72cd7fe..ae9b466 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -49,47 +49,58 @@ def is_plain(self): self.timestamp is None and self.observation_name is None) - def to_obj(self, return_obj=None, ns_info=None): - comment_obj = super(Comment, self).to_obj(return_obj=package_binding.CommentType()) - if self.author: comment_obj.author = self.author - if self.timestamp: comment_obj.timestamp = self.timestamp - if self.observation_name: comment_obj.observation_name = self.observation_name + def to_obj(self, ns_info=None): + comment_obj = super(Comment, self).to_obj() + + if self.author: + comment_obj.author = self.author + if self.timestamp: + comment_obj.timestamp = self.timestamp + if self.observation_name: + comment_obj.observation_name = self.observation_name return comment_obj def to_dict(self): comment_dict = super(Comment, self).to_dict() - if self.author: comment_dict['author'] = self.author - if self.timestamp: comment_dict['timestamp'] = self.timestamp - if self.observation_name: comment_dict['observation_name'] = self.observation_name + if self.author: + comment_dict['author'] = self.author + if self.timestamp: + comment_dict['timestamp'] = self.timestamp + if self.observation_name: + comment_dict['observation_name'] = self.observation_name return comment_dict @classmethod - def from_obj(cls, comment_obj): - if not comment_obj: + def from_obj(cls, cls_obj): + if not cls_obj: return None - comment = Comment(comment_obj.valueOf_) - if comment_obj.author: comment.author = comment_obj.author - if comment_obj.timestamp: comment.timestamp = comment_obj.timestamp - if comment_obj.observation_name: comment.observation_name = comment_obj.observation_name + comment = super(Comment, cls).from_obj(cls_obj) + comment.value = cls_obj.valueOf_ + + if cls_obj.author: + comment.author = cls_obj.author + if cls_obj.timestamp: + comment.timestamp = cls_obj.timestamp + if cls_obj.observation_name: + comment.observation_name = cls_obj.observation_name return comment @classmethod - def from_dict(cls, comment_dict): - if not comment_dict: + def from_dict(cls, cls_dict): + if not cls_dict: return None - comment = Comment() - if not isinstance(comment_dict, dict): - comment.value = comment_dict + if not isinstance(cls_dict, dict): + comment = cls(cls_dict) else: - comment.value = comment_dict.get('value') - comment.author = comment_dict.get('author') - comment.timestamp = comment_dict.get('timestamp') - comment.observation_name = comment_dict.get('observation_name') + super(Comment, cls).from_dict(cls_dict) + comment.author = cls_dict.get('author') + comment.timestamp = cls_dict.get('timestamp') + comment.observation_name = cls_dict.get('observation_name') return comment diff --git a/maec/utils/comparator.py b/maec/utils/comparator.py index 1ffa8b0..d8076a8 100644 --- a/maec/utils/comparator.py +++ b/maec/utils/comparator.py @@ -5,7 +5,7 @@ class ComparisonResult(object): def __init__(self, bundle_list, lookup_table): self.lookup_table = lookup_table self.bundle_list = bundle_list - + def get_unique(self, bundle_list=None): unique_objs = {} @@ -121,6 +121,7 @@ def get_sources(cls, lookup_table, obj_hash): val.append(obj_dict_list[0]['ownerBundle']) return val + class ObjectHash(object): @classmethod def get_hash(cls, obj, match_on, case_sensitive): @@ -128,7 +129,7 @@ def get_hash(cls, obj, match_on, case_sensitive): cls.case_sensitive = case_sensitive hash_val = '' - for typed_field in obj.properties._get_vars(): + for typed_field in obj.properties.typed_fields: # Make sure the typed field is comparable if typed_field.comparable: # Check if we're dealing with a nested element that we want to compare From 978d82ebbe1ababd4910a5ed92bd0ddf74675f1e Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Wed, 14 Oct 2015 15:52:24 -0400 Subject: [PATCH 246/297] Updated comparator.py and comparator example to leverage typedfields python-cybox and mixbox methods/properties. --- maec/utils/comparator.py | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/maec/utils/comparator.py b/maec/utils/comparator.py index d8076a8..e6338f4 100644 --- a/maec/utils/comparator.py +++ b/maec/utils/comparator.py @@ -59,7 +59,8 @@ def add_object(self, obj, owner): def get_object_by_owner_id(self, owner_id): return self[owner_id][0]["object"] - + + class BundleComparator(object): @classmethod def compare(cls, bundle_list, match_on = None, case_sensitive = True): @@ -68,18 +69,13 @@ def compare(cls, bundle_list, match_on = None, case_sensitive = True): if not match_on: # Default matching properties cls.match_on = { - 'FileObjectType': - ['file_name', 'file_path'], - 'WindowsRegistryKeyObjectType': - ['hive','key'], - 'WindowsMutexObjectType': - ['name'], - 'SocketObjectType': - ['address_value', 'port_value'], - 'WindowsPipeObjectType': - ['name'], - 'ProcessObjectType': - ['name']} + 'FileObjectType': ['file_name', 'file_path'], + 'WindowsRegistryKeyObjectType': ['hive','key'], + 'WindowsMutexObjectType': ['name'], + 'SocketObjectType': ['address_value', 'port_value'], + 'WindowsPipeObjectType': ['name'], + 'ProcessObjectType': ['name'] + } else: cls.match_on = match_on @@ -129,18 +125,18 @@ def get_hash(cls, obj, match_on, case_sensitive): cls.case_sensitive = case_sensitive hash_val = '' - for typed_field in obj.properties.typed_fields: + for attrname, typed_field in obj.properties.typed_fields_with_attrnames: # Make sure the typed field is comparable if typed_field.comparable: # Check if we're dealing with a nested element that we want to compare - nested_element = cls.is_nested_match(str(typed_field), cls.match_on[obj.properties._XSI_TYPE]) + nested_element = cls.is_nested_match(attrname, cls.match_on[obj.properties._XSI_TYPE]) # Handle the normal, non-nested case - if not nested_element and str(typed_field) in cls.match_on[obj.properties._XSI_TYPE]: - hash_val = cls.get_val(obj, typed_field, hash_val) + if not nested_element and attrname in cls.match_on[obj.properties._XSI_TYPE]: + hash_val = cls.get_val(obj, attrname, hash_val) # Handle the nested case elif nested_element: split_nested_element = nested_element.split('.') - hash_val = cls.get_val(obj, typed_field, hash_val, split_nested_element[1:]) + hash_val = cls.get_val(obj, attrname, hash_val, split_nested_element[1:]) if not cls.case_sensitive: return hash_val.lower() else: From 96171b677bd7c9fda251af6f2b503c47356873a0 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Wed, 14 Oct 2015 20:22:17 -0400 Subject: [PATCH 247/297] Broken commit. Began refactoring comparator module. --- maec/utils/deduplicator.py | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 3b71bda..106cb9c 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -3,11 +3,16 @@ # All rights reserved # See LICENSE.txt for complete terms + import collections -import cybox import copy + +from mixbox import entities + +import cybox from cybox.common.properties import BaseProperty + class BundleDeduplicator(object): @classmethod def deduplicate(cls, bundle): @@ -150,26 +155,29 @@ def get_typedfield_values(cls, val, name, values, ignoreCase = False): values.add(":".join([name,str(val)])) else: values.add(":".join([name,str(val).lower()])) + return + # If it's a list, then we need to iterate through each of its members - elif isinstance(val, collections.MutableSequence): + if isinstance(val, cybox.Entity): + for attrname, item_property in val.typed_fields_with_attrnames: + path = "{name}/{attrname}".format(**locals()) + fieldval = getattr(val, attrname) + cls.get_typedfield_values(fieldval, path, values, ignoreCase) + + if isinstance(val, collections.MutableSequence): for list_item in val: - for list_item_property in list_item._get_vars(): - cls.get_typedfield_values(getattr(list_item, str(list_item_property)), "/".join([name,str(list_item_property)]), values, ignoreCase) - # If it's a cybox.Entity, then we need to iterate through its properties - elif isinstance(val, cybox.Entity): - for item_property in val._get_vars(): - cls.get_typedfield_values(getattr(val, str(item_property)), "/".join([name,str(item_property)]), values, ignoreCase) + cls.get_typedfield_values(list_item, name, values, ignoreCase) @classmethod def get_object_values(cls, obj, ignoreCase = False): """Get the values specified for an Object's properties as a set.""" values = set() - for typed_field in obj.properties._get_vars(): + for attrname, typed_field in obj.properties.typed_fields_with_attrnames: # Make sure the typed field is comparable if typed_field.comparable: - val = getattr(obj.properties, str(typed_field)) + val = getattr(obj.properties, attrname) if val is not None: - cls.get_typedfield_values(val, str(typed_field), values, ignoreCase) + cls.get_typedfield_values(val, attrname, values, ignoreCase) return values @classmethod From 9ffb3fabd70aac133eca0b3a0fbd67b90653cbb9 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Wed, 14 Oct 2015 21:10:42 -0400 Subject: [PATCH 248/297] Added comments to deduplicator and changed some string formatting. --- maec/utils/deduplicator.py | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 106cb9c..8819c31 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -9,7 +9,7 @@ from mixbox import entities -import cybox +from cybox.core import RelatedObject, AssociatedObject from cybox.common.properties import BaseProperty @@ -113,9 +113,9 @@ def add_unique_objects(cls, bundle, all_objects): for object in all_objects: if object.id_ and object.id_ == unique_object_id: object_copy = copy.deepcopy(object) - if isinstance(object_copy, cybox.core.AssociatedObject): + if isinstance(object_copy, AssociatedObject): object_copy.association_type = None - elif isinstance(object_copy, cybox.core.RelatedObject): + elif isinstance(object_copy, RelatedObject): object_copy.relationship = None # Modify the existing Object to serve as a reference to the Object in the collection object.idref = object.id_ @@ -147,29 +147,31 @@ def map_objects(cls, all_objects): cls.object_ids_mapping[obj.id_] = matching_object_id @classmethod - def get_typedfield_values(cls, val, name, values, ignoreCase = False): + def get_typedfield_values(cls, val, name, values, ignoreCase=False): """Returns the value contained in a TypedField or its nested members, if applicable.""" # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): - if ignoreCase: - values.add(":".join([name,str(val)])) - else: - values.add(":".join([name,str(val).lower()])) + val = str(val) if ignoreCase else str(val).lower() + values.add("%s:%s" % (name, val)) return - # If it's a list, then we need to iterate through each of its members - if isinstance(val, cybox.Entity): + # If it's an Entity, iterate over the typedfields and find the values + # for each field. + if isinstance(val, entities.Entity): for attrname, item_property in val.typed_fields_with_attrnames: path = "{name}/{attrname}".format(**locals()) fieldval = getattr(val, attrname) cls.get_typedfield_values(fieldval, path, values, ignoreCase) + # If the value is a mutable sequence, attempt to find TypedFields as + # in each item. EntityLists are Entity subclasses that can have + # TypedFields, so we don't make this an elif. if isinstance(val, collections.MutableSequence): for list_item in val: cls.get_typedfield_values(list_item, name, values, ignoreCase) @classmethod - def get_object_values(cls, obj, ignoreCase = False): + def get_object_values(cls, obj, ignoreCase=False): """Get the values specified for an Object's properties as a set.""" values = set() for attrname, typed_field in obj.properties.typed_fields_with_attrnames: From 44ab42683869fc22b4246e7fa762f54abbce5796 Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Thu, 22 Oct 2015 13:25:40 -0400 Subject: [PATCH 249/297] Changes to the deduplication code. Mostly style related. * Swapped out some string concatenation code for format() and % formatted strings. * Replaced some list comprehensions with generator comprehensions since the lists weren't being used ever. * Modified some if/elif/else chains to remove redundant "if foo and " by adding a top-level "if not foo: return/continue/break" statement. --- maec/utils/deduplicator.py | 48 +++++++++++++++++++++++++------------ scripts/run_deduplicator.py | 7 ++++-- 2 files changed, 38 insertions(+), 17 deletions(-) diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 8819c31..e99729d 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -37,34 +37,37 @@ def deduplicate(cls, bundle): if cls.object_ids_mapping: # Next, add the unique objects to their own collection cls.handle_unique_objects(bundle, all_objects) - # Replace the non-unique Objects with references + # Replace the non-unique Objects with references # to unique Objects across the entire Bundle cls.handle_duplicate_objects(bundle, all_objects) # Finally, perform some cleanup to handle strange # cases where you may have Objects pointing to each other cls.cleanup(bundle) - @classmethod def cleanup(cls, bundle): """Cleanup and remove and Objects that may be referencing the re-used Objects. - Otherwise, this can create Object->Object->Object etc. references which don't make sense.""" + Otherwise, this can create Object->Object->Object etc. references which don't make sense. + """ + object_ids = cls.object_ids_mapping.values() # copy aside for lookup later + # Cleanup the root-level Objects if bundle.objects: # List of Objects to remove - objs = [x for x in bundle.objects if (x.idref and x.idref in cls.object_ids_mapping.values())] + objs = (x for x in bundle.objects if (x.idref and x.idref in object_ids)) # Remove the extraneous Objects for obj in objs: bundle.objects.remove(obj) + # Cleanup the Object Collections if bundle.collections and bundle.collections.object_collections: for collection in bundle.collections.object_collections: # Ignore the re-used objects collection - if collection.name and collection.name == "Deduplicated Objects": + if collection.name == "Deduplicated Objects": continue # List of Objects to remove - objs = [x for x in collection.object_list if (x.idref and x.idref in cls.object_ids_mapping.values())] + objs = (x for x in collection.object_list if (x.idref and x.idref in object_ids)) for obj in objs: collection.object_list.remove(obj) @@ -82,6 +85,7 @@ def handle_duplicate_objects(cls, bundle, all_objects): object.properties = None object.related_objects = None object.domain_specific_object_properties = None + if duplicate_object_id and duplicate_object_id in cls.idref_objects: for object in cls.idref_objects[duplicate_object_id]: object.idref = unique_object_id @@ -93,14 +97,17 @@ def handle_unique_objects(cls, bundle, all_objects): # First, find the ID of the last Object Collection (if applicable) counter = 1 if bundle.collections and bundle.collections.object_collections: - for object_collection in bundle.collections.object_collections: - counter += 1 + counter += len(bundle.collections.object_collections) + # Find the namespace used in the Bundle IDs bundle_namespace = bundle.id_.split('-')[1] + # Build the collection ID - collection_id = "maec-" + bundle_namespace + "-objc-" + str(counter) + collection_id = "maec-%s-objc-%s" % (bundle_namespace, counter) + # Add the named Object collection bundle.add_named_object_collection("Deduplicated Objects", collection_id) + # Add the unique Objects to the collection cls.add_unique_objects(bundle, all_objects) @@ -117,16 +124,20 @@ def add_unique_objects(cls, bundle, all_objects): object_copy.association_type = None elif isinstance(object_copy, RelatedObject): object_copy.relationship = None + # Modify the existing Object to serve as a reference to the Object in the collection object.idref = object.id_ object.id_ = None object.properties = None object.related_objects = None object.domain_specific_object_properties = None + # Add the unique Object to the collection bundle.add_object(object_copy, "Deduplicated Objects") + # Break out of the all_objects loop break + added_ids.append(unique_object_id) @classmethod @@ -141,6 +152,7 @@ def map_objects(cls, all_objects): cls.idref_objects[obj.idref] = [obj] elif obj.idref and obj.idref in cls.idref_objects: cls.idref_objects[obj.idref].append(obj) + # Find a matching ID for the Object matching_object_id = cls.find_matching_object(obj) if matching_object_id: @@ -151,7 +163,7 @@ def get_typedfield_values(cls, val, name, values, ignoreCase=False): """Returns the value contained in a TypedField or its nested members, if applicable.""" # If it's a BaseProperty instance, then we're done. Return it. if isinstance(val, BaseProperty): - val = str(val) if ignoreCase else str(val).lower() + val = str(val) if ignoreCase else str(val).lower() # TODO (bworrell): This seems backwards. values.add("%s:%s" % (name, val)) return @@ -187,17 +199,23 @@ def find_matching_object(cls, obj): """Find a matching object, if it exists.""" if obj and obj.properties: object_values = cls.get_object_values(obj) - xsi_type = obj.properties._XSI_TYPE - if xsi_type and xsi_type in cls.objects_dict: + xsi_type = obj.properties._XSI_TYPE + + if not xsi_type: + return None + elif xsi_type in cls.objects_dict: types_dict = cls.objects_dict[xsi_type] + # See if we already have an identical object in the dictionary - for obj_id, obj_values in types_dict.items(): + for obj_id, obj_values in types_dict.iteritems(): if obj_values == object_values: # If so, return its ID for use in the IDREF return obj_id + # If not, add it to the dictionary types_dict[obj.id_] = object_values - elif xsi_type and xsi_type not in cls.objects_dict: + else: types_dict = {obj.id_:object_values} cls.objects_dict[xsi_type] = types_dict - return None + + return None diff --git a/scripts/run_deduplicator.py b/scripts/run_deduplicator.py index a6ba590..b2ccfa9 100644 --- a/scripts/run_deduplicator.py +++ b/scripts/run_deduplicator.py @@ -19,10 +19,12 @@ # Process a set of MAEC binding objects and peform the deduplication as appropriate def process_maec_file(filename): - new_filename = filename[:filename.find(".xml")] + "_deduplicated.xml" + fn, ext = os.path.splitext(filename) + new_filename = "%s_deduplicated.xml" % fn start_time = timeit.default_timer() parsed_objects = maec.parse_xml_instance(filename) print "Parsing: " + str(timeit.default_timer() - start_time) + start_time = timeit.default_timer() if parsed_objects and isinstance(parsed_objects['api'], Package): parsed_objects['api'].deduplicate_malware_subjects() @@ -30,8 +32,9 @@ def process_maec_file(filename): elif parsed_objects and isinstance(parsed_objects['api'], Bundle): parsed_objects['api'].deduplicate() parsed_objects['api'].to_xml_file(new_filename) + elapsed = timeit.default_timer() - start_time - print "Deduplicating: " + str(timeit.default_timer() - start_time) + print "Deduplicating: %s" % elapsed def main(): #sys.stdout.write("Deduplicating.") From 28f2de59d7f0e4021367cc4aade27b45174772bd Mon Sep 17 00:00:00 2001 From: Bryan Worrell Date: Fri, 23 Oct 2015 16:25:40 -0400 Subject: [PATCH 250/297] Removed unused import. --- scripts/run_deduplicator.py | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/run_deduplicator.py b/scripts/run_deduplicator.py index b2ccfa9..b191641 100644 --- a/scripts/run_deduplicator.py +++ b/scripts/run_deduplicator.py @@ -1,7 +1,6 @@ # run_deduplicator script # v0.10 BETA # Runs the MAEC Deduplicator against a list or folder of MAEC files -import pprint import sys import os import timeit From f7113179a0dc8f694e85b5af120f0233ba1e41d7 Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Tue, 3 Nov 2015 19:13:03 -0500 Subject: [PATCH 251/297] package_generation_example.py used old APIs and didn't work. I updated it. maec/__init__.py contains a custom mixbox.Entity subclass which no longer worked. I think the root cause was that it assumed mixbox.namespaces.lookup_name() returned a Namespace object, but it now returns a prefix. That messed up the namespace handling in this class. It's now fixed to use the mixbox NamespaceSet class. Some wonky code is cleaned up too. --- examples/package_generation_example.py | 7 +---- maec/__init__.py | 42 +++++++++----------------- 2 files changed, 16 insertions(+), 33 deletions(-) diff --git a/examples/package_generation_example.py b/examples/package_generation_example.py index 814f1c2..a0945ad 100644 --- a/examples/package_generation_example.py +++ b/examples/package_generation_example.py @@ -8,14 +8,9 @@ from cybox.core import AssociatedObjects, AssociatedObject, Object, AssociationType from cybox.common import Hash, HashList, VocabString from cybox.objects.file_object import File -from maec.bundle import Bundle, Collections, MalwareAction, Capability +from maec.bundle import Bundle, MalwareAction, Capability from maec.package import Analysis, MalwareSubject, Package -from cybox.utils import Namespace -import maec.utils -# Instantiate the ID generator class (for automatic ID generation) with our example namespace -NS = Namespace("http://example.com/", "example") -maec.utils.set_id_namespace(NS) # Instantiate the Bundle, Package, MalwareSubject, and Analysis classes bundle = Bundle(defined_subject=False) package = Package() diff --git a/maec/__init__.py b/maec/__init__.py index 76f86e8..675c1cc 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -3,11 +3,9 @@ from mixbox.entities import Entity as cyboxEntity from mixbox.entities import EntityList -from mixbox.namespaces import (Namespace, get_xmlns_string, - get_schemaloc_string, lookup_name, lookup_prefix) +from mixbox.namespaces import ( get_xmlns_string, + make_namespace_subset_from_uris, get_schemaloc_string, lookup_prefix) -import bindings.maec_bundle as bundle_binding -import bindings.maec_package as package_binding import maec from maec.utils import flip_dict, EntityParser @@ -42,7 +40,7 @@ def to_xml_file(self, file, namespace_dict=None, custom_header=None): namespace_dict = {} else: # Make a copy so we don't pollute the source - namespace_dict = dict(namespace_dict.iteritems()) + namespace_dict = namespace_dict.copy() # Update the namespace dictionary with namespaces found upon import input_namespaces = self._ns_to_prefix_input_namespaces() @@ -82,32 +80,23 @@ def _get_namespace_def(self, additional_ns_dict=None): # if there are any other namepaces, include xsi for "schemaLocation" # also, include the MAEC default vocabularies schema by default if namespaces: - namespaces.update([lookup_prefix('xsi')]) - namespaces.update([lookup_prefix('maecVocabs')]) + namespaces.add(lookup_prefix('xsi')) + namespaces.add(lookup_prefix('maecVocabs')) - if namespaces and additional_ns_dict: - namespace_list = [x.name for x in namespaces if x] - for ns, prefix in additional_ns_dict.iteritems(): - if ns not in namespace_list: - namespaces.update([Namespace(ns, prefix, '')]) - - if not namespaces: + ns_set = make_namespace_subset_from_uris(namespaces) + if additional_ns_dict: + for ns, prefix in additional_ns_dict.iteritems(): + ns_set.add_namespace_uri(ns, prefix) + else: return "" - namespaces = sorted(namespaces, key=str) - - return ('\n\t' + get_xmlns_string(namespaces) + - '\n\txsi:schemaLocation="' + get_schemaloc_string(namespaces) + - '"') + return ('\n\t' + ns_set.get_xmlns_string(sort=True, delim='\n\t') + + '\n\t' + ns_set.get_schemaloc_string(sort=True, delim='\n\t')) def _get_namespaces(self, recurse=True): - nsset = set() - # Get all _namespaces for parent classes - namespaces = [x._namespace for x in self.__class__.__mro__ - if hasattr(x, '_namespace')] - - nsset.update([lookup_name(ns) for ns in namespaces]) + nsset = set(x._namespace for x in self.__class__.__mro__ + if hasattr(x, '_namespace')) #In case of recursive relationships, don't process this item twice self.touched = True @@ -120,8 +109,7 @@ def _get_namespaces(self, recurse=True): # Add any additional namespaces that may be included in the entity input_ns = self._ns_to_prefix_input_namespaces() for namespace, alias in input_ns.iteritems(): - if not lookup_name(namespace): - nsset.add(Namespace(namespace, alias, '')) + nsset.update(namespace) return nsset From 18343734e14b1691973100f1f703d7076eab26d3 Mon Sep 17 00:00:00 2001 From: apsillers Date: Wed, 30 Dec 2015 12:16:53 -0500 Subject: [PATCH 252/297] Change MalwareSubjectList to use TypedField --- maec/package/malware_subject.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 21c81e0..b5c8ac1 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -240,7 +240,8 @@ def normalize_bundles(self): bundle.normalize_objects() class MalwareSubjectList(maec.EntityList): - _contained_type = MalwareSubject _binding_class = package_binding.MalwareSubjectListType - _binding_var = "Malware_Subject" + #_binding_var = "Malware_Subject" _namespace = _namespace + + malware_subject = fields.TypedField("Malware_Subject", MalwareSubject, multiple=True) \ No newline at end of file From b1eeaee32eb8f920e061eccda7870a99e7e295db Mon Sep 17 00:00:00 2001 From: Austin West Date: Fri, 22 Jan 2016 16:27:25 -0700 Subject: [PATCH 253/297] Use argparse to parse CL args --- scripts/maec_4.0.1_to_4.1.py | 54 +++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/scripts/maec_4.0.1_to_4.1.py b/scripts/maec_4.0.1_to_4.1.py index cc5a96b..64c4d51 100644 --- a/scripts/maec_4.0.1_to_4.1.py +++ b/scripts/maec_4.0.1_to_4.1.py @@ -4,6 +4,7 @@ import sys import os import shutil +import argparse import maec from maec.bundle.bundle import Bundle from maec.package.package import Package @@ -47,41 +48,42 @@ def usage(): """ def main(): - infilename = None - outfilename = None - directoryname = '' - filepath = '' - - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 2: - usage() - sys.exit(1) - - for i in range(0,len(args)): - if args[i] == '-i': - infilename = args[i+1] - elif args[i] == '-o': - outfilename = args[i+1] - elif args[i] == '-d': - directoryname = args[i+1] + # Setup the argument parser + parser = argparse.ArgumentParser( + description='MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility' + ) + mutex_group = parser.add_mutually_exclusive_group() + required_name = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '--input', '-i', + help='input maec 4.0.1 xml file' + ) + mutex_group.add_argument( + '--directory', '-d', + help='directory containing maec 4.0.1 xml files to convert to 4.1 xml files' + ) + required_name.add_argument( + '--output', '-o', required=True, + help='output maec 4.1 xml file' + ) + + args = parser.parse_args() - if directoryname != '': - for filename in os.listdir(directoryname): + if args.directory: + for filename in os.listdir(args.directory): print filename if '.xml' not in filename: pass elif '_report.maec-4.0.1' not in filename: - update_maec(os.path.join(directoryname, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml') + update_maec(os.path.join(args.directory, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml') else: - new_filepath = os.path.join(directoryname, filename.replace('_report.maec-4.0.1', '')) - shutil.move(os.path.join(directoryname, filename), new_filepath) + new_filepath = os.path.join(args.directory, filename.replace('_report.maec-4.0.1', '')) + shutil.move(os.path.join(args.directory, filename), new_filepath) update_maec(new_filepath, new_filepath.rstrip('.xml') + '_cuckoobox_maec.xml') # Basic parameter checking - elif infilename and outfilename: - update_maec(infilename, outfilename) + elif args.input and args.output: + update_maec(args.input, args.output) if __name__ == "__main__": main() From 616a5cadce5788dac2801bb4cc7bc8bf83eb377a Mon Sep 17 00:00:00 2001 From: Austin West Date: Sat, 23 Jan 2016 15:41:07 -0700 Subject: [PATCH 254/297] Use argparse lib to ingest CL args --- scripts/merge_packages.py | 55 ++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 32 deletions(-) diff --git a/scripts/merge_packages.py b/scripts/merge_packages.py index 60190aa..d643d07 100644 --- a/scripts/merge_packages.py +++ b/scripts/merge_packages.py @@ -4,6 +4,7 @@ # Attempts to merge related Malware Subjects import sys import os +import argparse import maec from maec.utils.merge import merge_documents @@ -11,48 +12,38 @@ MAEC Package Merge Script v0.10 BETA *Merges two or more MAEC Package XML documents *Attempts to merge related (e.g., same MD5 hash) Malware Subjects - -Usage: python merge_packages.py -o -l OR -d """ def main(): - infilenames = [] - list_mode = False - directoryname = '' - outfilename = '' - - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 3: - print USAGE_TEXT - sys.exit(1) - - for i in range(0,len(args)): - if args[i] == '-o': - outfilename = args[i+1] - elif args[i] == '-l': - list_mode = True - elif args[i] == '-d': - directoryname = args[i+1] - - if outfilename == '': - print USAGE_TEXT - sys.exit(1) + parser = argparse.ArgumentParser(description=USAGE_TEXT) + mutex_group = parser.add_mutually_exclusive_group() + required_group = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '-l', '--list', nargs='+', + help='single whitespace separated list of MAEC Package files' + ) + mutex_group.add_argument( + '-d', '--directory', + help='directory name' + ) + required_group.add_argument( + '-o', '--output', required=True, + help='output file name' + ) + args = parser.parse_args() sys.stdout.write("Merging...") # Get the list of input files and perform the merge operation - if list_mode: - files = args[3:] - merge_documents(files, outfilename) - elif directoryname != '': + if args.list: + merge_documents(args.list, args.output) + elif args.directory: file_list = [] - for filename in os.listdir(directoryname): + for filename in os.listdir(args.directory): if '.xml' not in filename: pass else: - file_list.append(os.path.join(directoryname, filename)) - merge_documents(file_list, outfilename) + file_list.append(os.path.join(args.directory, filename)) + merge_documents(file_list, args.output) sys.stdout.write("Done.") if __name__ == "__main__": From 3ba47f09d0f1c118dea5dc19d4e7e8b727438fcf Mon Sep 17 00:00:00 2001 From: Austin West Date: Sat, 23 Jan 2016 15:57:17 -0700 Subject: [PATCH 255/297] Use argparse to parse CL args --- scripts/maec_4.0.1_to_4.1.py | 54 ++++++++++++++++++----------------- scripts/merge_packages.py | 55 +++++++++++++++--------------------- scripts/run_comparator.py | 44 +++++++++++++---------------- scripts/run_deduplicator.py | 39 +++++++++++++------------ 4 files changed, 89 insertions(+), 103 deletions(-) diff --git a/scripts/maec_4.0.1_to_4.1.py b/scripts/maec_4.0.1_to_4.1.py index cc5a96b..73b291e 100644 --- a/scripts/maec_4.0.1_to_4.1.py +++ b/scripts/maec_4.0.1_to_4.1.py @@ -4,6 +4,7 @@ import sys import os import shutil +import argparse import maec from maec.bundle.bundle import Bundle from maec.package.package import Package @@ -47,41 +48,42 @@ def usage(): """ def main(): - infilename = None - outfilename = None - directoryname = '' - filepath = '' - - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 2: - usage() - sys.exit(1) - - for i in range(0,len(args)): - if args[i] == '-i': - infilename = args[i+1] - elif args[i] == '-o': - outfilename = args[i+1] - elif args[i] == '-d': - directoryname = args[i+1] + # Setup the argument parser + parser = argparse.ArgumentParser( + description='MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility' + ) + mutex_group = parser.add_mutually_exclusive_group(required=True) + required_name = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '--input', '-i', + help='input maec 4.0.1 xml file' + ) + mutex_group.add_argument( + '--directory', '-d', + help='directory containing maec 4.0.1 xml files to convert to 4.1 xml files' + ) + required_name.add_argument( + '--output', '-o', required=True, + help='output maec 4.1 xml file' + ) + + args = parser.parse_args() - if directoryname != '': - for filename in os.listdir(directoryname): + if args.directory: + for filename in os.listdir(args.directory): print filename if '.xml' not in filename: pass elif '_report.maec-4.0.1' not in filename: - update_maec(os.path.join(directoryname, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml') + update_maec(os.path.join(args.directory, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml') else: - new_filepath = os.path.join(directoryname, filename.replace('_report.maec-4.0.1', '')) - shutil.move(os.path.join(directoryname, filename), new_filepath) + new_filepath = os.path.join(args.directory, filename.replace('_report.maec-4.0.1', '')) + shutil.move(os.path.join(args.directory, filename), new_filepath) update_maec(new_filepath, new_filepath.rstrip('.xml') + '_cuckoobox_maec.xml') # Basic parameter checking - elif infilename and outfilename: - update_maec(infilename, outfilename) + elif args.input and args.output: + update_maec(args.input, args.output) if __name__ == "__main__": main() diff --git a/scripts/merge_packages.py b/scripts/merge_packages.py index 60190aa..88697a4 100644 --- a/scripts/merge_packages.py +++ b/scripts/merge_packages.py @@ -4,6 +4,7 @@ # Attempts to merge related Malware Subjects import sys import os +import argparse import maec from maec.utils.merge import merge_documents @@ -11,48 +12,38 @@ MAEC Package Merge Script v0.10 BETA *Merges two or more MAEC Package XML documents *Attempts to merge related (e.g., same MD5 hash) Malware Subjects - -Usage: python merge_packages.py -o -l OR -d """ def main(): - infilenames = [] - list_mode = False - directoryname = '' - outfilename = '' - - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 3: - print USAGE_TEXT - sys.exit(1) - - for i in range(0,len(args)): - if args[i] == '-o': - outfilename = args[i+1] - elif args[i] == '-l': - list_mode = True - elif args[i] == '-d': - directoryname = args[i+1] - - if outfilename == '': - print USAGE_TEXT - sys.exit(1) + parser = argparse.ArgumentParser(description=USAGE_TEXT) + mutex_group = parser.add_mutually_exclusive_group(required=True) + required_group = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '-l', '--list', nargs='+', + help='single whitespace separated list of MAEC Package files' + ) + mutex_group.add_argument( + '-d', '--directory', + help='directory name' + ) + required_group.add_argument( + '-o', '--output', required=True, + help='output file name' + ) + args = parser.parse_args() sys.stdout.write("Merging...") # Get the list of input files and perform the merge operation - if list_mode: - files = args[3:] - merge_documents(files, outfilename) - elif directoryname != '': + if args.list: + merge_documents(args.list, args.output) + elif args.directory: file_list = [] - for filename in os.listdir(directoryname): + for filename in os.listdir(args.directory): if '.xml' not in filename: pass else: - file_list.append(os.path.join(directoryname, filename)) - merge_documents(file_list, outfilename) + file_list.append(os.path.join(args.directory, filename)) + merge_documents(file_list, args.output) sys.stdout.write("Done.") if __name__ == "__main__": diff --git a/scripts/run_comparator.py b/scripts/run_comparator.py index 55ba1c1..997ba44 100644 --- a/scripts/run_comparator.py +++ b/scripts/run_comparator.py @@ -4,6 +4,7 @@ import pprint import sys import os +import argparse import maec from maec.bundle.bundle import Bundle from maec.package.package import Package @@ -12,8 +13,6 @@ MAEC Run Comparator Script v0.11 BETA *Performs Object->Object comparison of 2 or more input MAEC documents *Prints common/unique Objects between MAEC Bundles - -Usage: python run_comparator.py -l OR -d """ # Process a set of MAEC binding objects and extract the Bundles as appropriate @@ -29,36 +28,31 @@ def process_maec_file(filename, bundle_list): bundle_list.append(parsed_objects['api']) def main(): - infilenames = [] - list_mode = False - directoryname = '' + parser = argparse.ArgumentParser(description=USAGE_TEXT) + mutex_group = parser.add_mutually_exclusive_group(required=True) + mutex_group.add_argument( + '-l', '--list', nargs='+', + help='single whitespace separated list of MAEC files' + ) + mutex_group.add_argument( + '-d', '--directory', + help='directory name' + ) + args = parser.parse_args() + # List of Bundle instances to compare bundle_list = [] - - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 2: - print USAGE_TEXT - sys.exit(1) - for i in range(0,len(args)): - if args[i] == '-l': - list_mode = True - elif args[i] == '-d': - directoryname = args[i+1] - # Parse the input files and get the MAEC Bundles from each - if list_mode: - files = args[1:] - for file in files: + if args.list: + for file in args.list: process_maec_file(file, bundle_list) - elif directoryname != '': - for filename in os.listdir(directoryname): + elif args.directory: + for filename in os.listdir(args.directory): if '.xml' not in filename: pass else: - process_maec_file(os.path.join(directoryname, filename), bundle_list) + process_maec_file(os.path.join(args.directory, filename), bundle_list) # Matching properties dictionary match_on_dictionary = {'FileObjectType': ['file_path'], @@ -75,4 +69,4 @@ def main(): pprint.pprint(comparison_results.get_unique()) print "****************************" if __name__ == "__main__": - main() \ No newline at end of file + main() diff --git a/scripts/run_deduplicator.py b/scripts/run_deduplicator.py index a6ba590..0fc9bc1 100644 --- a/scripts/run_deduplicator.py +++ b/scripts/run_deduplicator.py @@ -4,6 +4,7 @@ import pprint import sys import os +import argparse import timeit import maec from maec.bundle.bundle import Bundle @@ -34,37 +35,35 @@ def process_maec_file(filename): print "Deduplicating: " + str(timeit.default_timer() - start_time) def main(): + parser = argparse.ArgumentParser(description=USAGE_TEXT) + mutex_group = parser.add_mutually_exclusive_group(required=True) + mutex_group.add_argument( + '-l', '--list', nargs='+', + help='single whitespace separated list of MAEC files' + ) + mutex_group.add_argument( + '-d', '--directory', + help='directory name' + ) + args = parser.parse_args() + #sys.stdout.write("Deduplicating.") infilenames = [] list_mode = False directoryname = '' - #Get the command-line arguments - args = sys.argv[1:] - - if len(args) < 2: - print USAGE_TEXT - sys.exit(1) - - for i in range(0,len(args)): - if args[i] == '-l': - list_mode = True - elif args[i] == '-d': - directoryname = args[i+1] - # Parse the input files and get the MAEC Bundles from each - if list_mode: - files = args[1:] - for file in files: + if args.list: + for file in args.list: #sys.stdout.write(".") process_maec_file(file) - elif directoryname != '': - for filename in os.listdir(directoryname): + elif args.directory: + for filename in os.listdir(args.directory): sys.stdout.write(".") if '.xml' not in filename: pass else: - process_maec_file(os.path.join(directoryname, filename)) + process_maec_file(os.path.join(args.directory, filename)) #sys.stdout.write("Done.") if __name__ == "__main__": - main() \ No newline at end of file + main() From eca294a500f6999f162100b6c38b7510034770e2 Mon Sep 17 00:00:00 2001 From: Austin West Date: Sat, 23 Jan 2016 16:04:12 -0700 Subject: [PATCH 256/297] Readd accidentally deleted scripts --- scripts/maec_4.0.1_to_4.1.py | 88 ++++++++++++++++++++++++++++++++++++ scripts/merge_packages.py | 50 ++++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100755 scripts/maec_4.0.1_to_4.1.py create mode 100755 scripts/merge_packages.py diff --git a/scripts/maec_4.0.1_to_4.1.py b/scripts/maec_4.0.1_to_4.1.py new file mode 100755 index 0000000..7f53135 --- /dev/null +++ b/scripts/maec_4.0.1_to_4.1.py @@ -0,0 +1,88 @@ +# MAEC 4.0.1 to MAEC 4.1 Converter Script +# Translates a MAEC 4.0.1 Package or Bundle into a valid MAEC 4.1 Package or Bundle + +import sys +import os +import shutil +import argparse +import maec +from maec.bundle.bundle import Bundle +from maec.package.package import Package + +# Update the MAEC v4.0.1 file to MAEC v4.1 +def update_maec(infilename, outfilename): + # Parse the input document using the parse_xml_instance() method + maec_objects = maec.parse_xml_instance(infilename, check_version = False) + + # Get the API Object from the parsed input + api_object = maec_objects['api'] + + # Determine if we're dealing with a Package or Bundle + if isinstance(api_object, Package): + # Update the Package schema_version + api_object.schema_version = "2.1" + for malware_subject in api_object.malware_subjects: + for analysis in malware_subject.analyses: + # Replace the Analysis type value of "manual" with "in-depth" + if analysis.type and analysis.type == "manual": + analysis.type = "in-depth" + # Update the schema_versions on the Bundles + for bundle in malware_subject.findings_bundles.bundles: + bundle.schema_version = "4.1" + elif isinstance(api_object, Bundle): + # Update the Bundle schema_version + api_object.schema_version = "4.1" + + # Output the updated MAEC object to XML + api_object.to_xml_file(outfilename) + +# Print the usage text +def usage(): + print USAGE_TEXT + sys.exit(1) + +USAGE_TEXT = """ +MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility +Usage: python maec_4.0.1_to_4.1.py -i -o +""" + +def main(): + # Setup the argument parser + parser = argparse.ArgumentParser( + description='MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility' + ) + mutex_group = parser.add_mutually_exclusive_group(required=True) + required_name = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '--input', '-i', + help='input maec 4.0.1 xml file' + ) + mutex_group.add_argument( + '--directory', '-d', + help='directory containing maec 4.0.1 xml files to convert to 4.1 xml files' + ) + required_name.add_argument( + '--output', '-o', required=True, + help='output maec 4.1 xml file' + ) + + args = parser.parse_args() + + if args.directory: + for filename in os.listdir(args.directory): + print filename + if '.xml' not in filename: + pass + elif '_report.maec-4.0.1' not in filename: + update_maec(os.path.join(args.directory, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml') + else: + new_filepath = os.path.join(args.directory, filename.replace('_report.maec-4.0.1', '')) + shutil.move(os.path.join(args.directory, filename), new_filepath) + update_maec(new_filepath, new_filepath.rstrip('.xml') + '_cuckoobox_maec.xml') + + # Basic parameter checking + elif args.input and args.output: + update_maec(args.input, args.output) + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/scripts/merge_packages.py b/scripts/merge_packages.py new file mode 100755 index 0000000..9425937 --- /dev/null +++ b/scripts/merge_packages.py @@ -0,0 +1,50 @@ +# merge_packages script +# v0.10 BETA +# Merges two or more MAEC Package documents (.xml files) +# Attempts to merge related Malware Subjects +import sys +import os +import argparse +import maec +from maec.utils.merge import merge_documents + +USAGE_TEXT = """ +MAEC Package Merge Script v0.10 BETA + *Merges two or more MAEC Package XML documents + *Attempts to merge related (e.g., same MD5 hash) Malware Subjects +""" + +def main(): + parser = argparse.ArgumentParser(description=USAGE_TEXT) + mutex_group = parser.add_mutually_exclusive_group(required=True) + required_group = parser.add_argument_group('required arguments') + mutex_group.add_argument( + '-l', '--list', nargs='+', + help='single whitespace separated list of MAEC Package files' + ) + mutex_group.add_argument( + '-d', '--directory', + help='directory name' + ) + required_group.add_argument( + '-o', '--output', required=True, + help='output file name' + ) + args = parser.parse_args() + + sys.stdout.write("Merging...") + # Get the list of input files and perform the merge operation + if args.list: + merge_documents(args.list, args.output) + elif args.directory: + file_list = [] + for filename in os.listdir(args.directory): + if '.xml' not in filename: + pass + else: + file_list.append(os.path.join(args.directory, filename)) + merge_documents(file_list, args.output) + sys.stdout.write("Done.") + +if __name__ == "__main__": + main() \ No newline at end of file From e8444f97196a9198d42f282ec63943cf13f6e31d Mon Sep 17 00:00:00 2001 From: apsillers Date: Tue, 9 Feb 2016 17:40:37 -0500 Subject: [PATCH 257/297] Update EntitiyLists to use mixbox's new single-multifield approach --- maec/bundle/action_reference_list.py | 33 ++-- maec/bundle/av_classification.py | 4 +- maec/bundle/behavior.py | 230 +++++++++++++------------- maec/bundle/bundle.py | 24 +-- maec/bundle/candidate_indicator.py | 143 ++++++++-------- maec/bundle/malware_action.py | 133 ++++++++------- maec/bundle/object_reference.py | 47 +++--- maec/package/action_equivalence.py | 59 ++++--- maec/package/analysis.py | 15 +- maec/package/grouping_relationship.py | 171 ++++++++++--------- maec/package/malware_subject.py | 12 +- maec/package/object_equivalence.py | 57 ++++--- 12 files changed, 453 insertions(+), 475 deletions(-) diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index 05b6fe6..aaf604a 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -1,17 +1,16 @@ -#MAEC Action Reference List Class - -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -from cybox.core import ActionReference - -import maec -from . import _namespace -import maec.bindings.maec_bundle as bundle_binding - - -class ActionReferenceList(maec.EntityList): - _contained_type = ActionReference - _binding_class = bundle_binding.ActionReferenceListType - _binding_var = "Action_Reference" - _namespace = _namespace +#MAEC Action Reference List Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +from cybox.core import ActionReference + +import maec +from . import _namespace +import maec.bindings.maec_bundle as bundle_binding +from mixbox import fields + +class ActionReferenceList(maec.EntityList): + _binding_class = bundle_binding.ActionReferenceListType + _namespace = _namespace + action_reference = fields.TypedField("Action_Reference", ActionReference, multiple=True) diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index 25959d5..f83700a 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -3,6 +3,7 @@ # All rights reserved from cybox.common import ToolInformation +from mixbox import fields import maec from . import _namespace @@ -65,7 +66,6 @@ def from_obj(cls, cls_obj): class AVClassifications(maec.EntityList): - _contained_type = AVClassification _binding_class = bundle_binding.AVClassificationsType - _binding_var = "AV_Classification" _namespace = _namespace + av_classification = fields.TypedField("AV_Classification", AVClassification, multiple=True) diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 2d0d9b2..07881a3 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -1,116 +1,114 @@ -# MAEC Behavior Class - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -from mixbox import fields -from mixbox import idgen - -import maec -from . import _namespace -import maec.bindings.maec_bundle as bundle_binding -from cybox.core.action_reference import ActionReference -from cybox.common.measuresource import MeasureSource -from cybox.common.platform_specification import PlatformSpecification -from cybox.objects.code_object import Code - -class BehavioralActionEquivalenceReference(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType - _namespace = _namespace - - action_equivalence_idref = fields.TypedField('action_equivalence_idref') - behavioral_ordering = fields.TypedField('behavioral_ordering') - -class BehavioralActionReference(ActionReference): - _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionReferenceType - _namespace = _namespace - - behavioral_ordering = fields.TypedField('behavioral_ordering') - -class BehavioralAction(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionType - _namespace = _namespace - - behavioral_ordering = fields.TypedField('behavioral_ordering') - -class BehavioralActions(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionsType - _namespace = _namespace - - #TODO: action_collection.type_ is set below to avoid circular import. - action_collection = fields.TypedField('Action_Collection', None, multiple=True) - action = fields.TypedField('Action', BehavioralAction, multiple=True) - action_reference = fields.TypedField('Action_Reference', BehavioralActionReference, multiple=True) - action_equivalence_reference = fields.TypedField('Action_Equivalence_Reference', BehavioralActionEquivalenceReference, multiple=True) - -class PlatformList(maec.EntityList): - _binding = bundle_binding - _binding_class = bundle_binding.PlatformListType - _binding_var = "Platform" - _contained_type = PlatformSpecification - _namespace = _namespace - -class CVEVulnerability(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.CVEVulnerabilityType - _namespace = _namespace - - cve_id = fields.TypedField('cve_id') - description = fields.TypedField('Description') - -class Exploit(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.ExploitType - _namespace = _namespace - - known_vulnerability = fields.TypedField('known_vulnerability') - cve = fields.TypedField('CVE', CVEVulnerability) - cwe_id = fields.TypedField('CWE_ID', multiple=True) - targeted_platforms = fields.TypedField('Targeted_Platforms', PlatformList) - -class BehaviorPurpose(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.BehaviorPurposeType - _namespace = _namespace - - description = fields.TypedField('Description') - vulnerability_exploit = fields.TypedField('Vulnerability_Exploit', Exploit) - -class AssociatedCode(maec.EntityList): - _binding = bundle_binding - _binding_class = bundle_binding.AssociatedCodeType - _binding_var = "Code_Snippet" - _contained_type = Code - _namespace = _namespace - -class Behavior(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.BehaviorType - _namespace = _namespace - - id_ = fields.TypedField('id') - ordinal_position = fields.TypedField('ordinal_position') - status = fields.TypedField('status') - duration = fields.TypedField('duration') - purpose = fields.TypedField('Purpose', BehaviorPurpose) - description = fields.TypedField('Description') - discovery_method = fields.TypedField('Discovery_Method', MeasureSource) - action_composition = fields.TypedField('Action_Composition', BehavioralActions) - associated_code = fields.TypedField('Associated_Code', AssociatedCode) - #relationships = fields.TypedField('Relationships', BehaviorRelationshipList) # TODO: implement - - def __init__(self, id = None, description = None): - super(Behavior, self).__init__() - if id: - self.id_ = id - else: - self.id_ = idgen.create_id(prefix="behavior") - self.description = description - - -from maec.bundle.bundle import ActionCollection -BehavioralActions.action_collection.type_ = ActionCollection +# MAEC Behavior Class + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields +from mixbox import idgen + +import maec +from . import _namespace +import maec.bindings.maec_bundle as bundle_binding +from cybox.core.action_reference import ActionReference +from cybox.common.measuresource import MeasureSource +from cybox.common.platform_specification import PlatformSpecification +from cybox.objects.code_object import Code + +class BehavioralActionEquivalenceReference(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType + _namespace = _namespace + + action_equivalence_idref = fields.TypedField('action_equivalence_idref') + behavioral_ordering = fields.TypedField('behavioral_ordering') + +class BehavioralActionReference(ActionReference): + _binding = bundle_binding + _binding_class = bundle_binding.BehavioralActionReferenceType + _namespace = _namespace + + behavioral_ordering = fields.TypedField('behavioral_ordering') + +class BehavioralAction(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehavioralActionType + _namespace = _namespace + + behavioral_ordering = fields.TypedField('behavioral_ordering') + +class BehavioralActions(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehavioralActionsType + _namespace = _namespace + + #TODO: action_collection.type_ is set below to avoid circular import. + action_collection = fields.TypedField('Action_Collection', None, multiple=True) + action = fields.TypedField('Action', BehavioralAction, multiple=True) + action_reference = fields.TypedField('Action_Reference', BehavioralActionReference, multiple=True) + action_equivalence_reference = fields.TypedField('Action_Equivalence_Reference', BehavioralActionEquivalenceReference, multiple=True) + +class PlatformList(maec.EntityList): + _binding = bundle_binding + _binding_class = bundle_binding.PlatformListType + _namespace = _namespace + platform = fields.TypedField("Platform", PlatformSpecification, multiple=True) + +class CVEVulnerability(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CVEVulnerabilityType + _namespace = _namespace + + cve_id = fields.TypedField('cve_id') + description = fields.TypedField('Description') + +class Exploit(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.ExploitType + _namespace = _namespace + + known_vulnerability = fields.TypedField('known_vulnerability') + cve = fields.TypedField('CVE', CVEVulnerability) + cwe_id = fields.TypedField('CWE_ID', multiple=True) + targeted_platforms = fields.TypedField('Targeted_Platforms', PlatformList) + +class BehaviorPurpose(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehaviorPurposeType + _namespace = _namespace + + description = fields.TypedField('Description') + vulnerability_exploit = fields.TypedField('Vulnerability_Exploit', Exploit) + +class AssociatedCode(maec.EntityList): + _binding = bundle_binding + _binding_class = bundle_binding.AssociatedCodeType + _namespace = _namespace + code_snippet = fields.TypedField("Code_Snippet", Code, multiple=True) + +class Behavior(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.BehaviorType + _namespace = _namespace + + id_ = fields.TypedField('id') + ordinal_position = fields.TypedField('ordinal_position') + status = fields.TypedField('status') + duration = fields.TypedField('duration') + purpose = fields.TypedField('Purpose', BehaviorPurpose) + description = fields.TypedField('Description') + discovery_method = fields.TypedField('Discovery_Method', MeasureSource) + action_composition = fields.TypedField('Action_Composition', BehavioralActions) + associated_code = fields.TypedField('Associated_Code', AssociatedCode) + #relationships = fields.TypedField('Relationships', BehaviorRelationshipList) # TODO: implement + + def __init__(self, id = None, description = None): + super(Behavior, self).__init__() + if id: + self.id_ = id + else: + self.id_ = idgen.create_id(prefix="behavior") + self.description = description + + +from maec.bundle.bundle import ActionCollection +BehavioralActions.action_collection.type_ = ActionCollection diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index ab5d6c4..7211396 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -24,24 +24,20 @@ class BehaviorList(maec.EntityList): - _contained_type = Behavior _binding_class = bundle_binding.BehaviorListType - _binding_var = "Behavior" _namespace = _namespace - + behavior = fields.TypedField("Behavior", Behavior, multiple=True) class ActionList(maec.EntityList): - _contained_type = MalwareAction _binding_class = bundle_binding.ActionListType - _binding_var = "Action" _namespace = _namespace - + action = fields.TypedField("Action", MalwareAction, multiple=True) + class ObjectList(maec.EntityList): - _contained_type = Object _binding_class = bundle_binding.ObjectListType - _binding_var = "Object" _namespace = _namespace + object = fields.TypedField("Object", Object, multiple=True) class BaseCollection(maec.Entity): @@ -144,10 +140,9 @@ def add_candidate_indicator(self, candidate_indicator): class BehaviorCollectionList(maec.EntityList): - _contained_type = BehaviorCollection _binding_class = bundle_binding.BehaviorCollectionListType - _binding_var = "Behavior_Collection" _namespace = _namespace + behavior_collection = fields.TypedField("Behavior_Collection", BehaviorCollection, multiple=True) def __init__(self): super(BehaviorCollectionList, self).__init__() @@ -177,10 +172,9 @@ def get_named_collection(self, collection_name): class ActionCollectionList(maec.EntityList): - _contained_type = ActionCollection _binding_class = bundle_binding.ActionCollectionListType - _binding_var = "Action_Collection" _namespace = _namespace + action_collection = fields.TypedField("Action_Collection", ActionCollection, multiple=True) def __init__(self): super(ActionCollectionList, self).__init__() @@ -210,10 +204,9 @@ def get_named_collection(self, collection_name): class ObjectCollectionList(maec.EntityList): - _contained_type = ObjectCollection _binding_class = bundle_binding.ObjectCollectionListType - _binding_var = "Object_Collection" _namespace = _namespace + object_collection = fields.TypedField("Object_Collection", ObjectCollection, multiple=True) def __init__(self): super(ObjectCollectionList, self).__init__() @@ -243,10 +236,9 @@ def get_named_collection(self, collection_name): class CandidateIndicatorCollectionList(maec.EntityList): - _contained_type = CandidateIndicatorCollection _binding_class = bundle_binding.CandidateIndicatorCollectionListType - _binding_var = "Candidate_Indicator_Collection" _namespace = _namespace + candidate_indicator_collection = fields.TypedField("Candidate_Indicator_Collection", CandidateIndicatorCollection, multiple=True) def __init__(self): super(CandidateIndicatorCollectionList, self).__init__() diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index db204a7..b95cc56 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -1,72 +1,71 @@ -# MAEC Candidate Indicator Class - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -from mixbox import fields -from mixbox import idgen - -import maec -from . import _namespace -import maec.bindings.maec_bundle as bundle_binding -from maec.bundle import ObjectReference, BehaviorReference -from cybox.common import VocabString -from cybox.core import ActionReference - -class MalwareEntity(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.MalwareEntityType - _namespace = _namespace - - type_ = fields.TypedField("Type", VocabString) - name = fields.TypedField("Name") - description = fields.TypedField("Description") - - def __init__(self): - super(MalwareEntity, self).__init__() - -class CandidateIndicatorComposition(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.CandidateIndicatorCompositionType - _namespace = _namespace - - operator = fields.TypedField("operator") - behavior_reference = fields.TypedField("Behavior_Reference", BehaviorReference, multiple = True) - action_reference = fields.TypedField("Action_Reference", ActionReference, multiple = True) - object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) - sub_composition = fields.TypedField("Sub_Composition", multiple = True) - - def __init__(self): - super(CandidateIndicatorComposition, self).__init__() - -# Allow recursive definition of CandidateIndicatorCompositions -CandidateIndicatorComposition.sub_composition.type_ = CandidateIndicatorComposition - -class CandidateIndicator(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.CandidateIndicatorType - _namespace = _namespace - - id_ = fields.TypedField("id") - creation_datetime = fields.TypedField("creation_datetime") - lastupdate_datetime = fields.TypedField("lastupdate_datetime") - version = fields.TypedField("version") - importance = fields.TypedField("Importance", VocabString) - numeric_importance = fields.TypedField("Numeric_Importance") - author = fields.TypedField("Author") - description = fields.TypedField("Description") - malware_entity = fields.TypedField("Malware_Entity", MalwareEntity) - composition = fields.TypedField("Composition", CandidateIndicatorComposition) - - def __init__(self, id = None): - super(CandidateIndicator, self).__init__() - if id: - id_ = id - else: - id_ = idgen.create_id(prefix="candidate_indicator") - -class CandidateIndicatorList(maec.EntityList): - _contained_type = CandidateIndicator - _binding_class = bundle_binding.CandidateIndicatorListType - _binding_var = "Candidate_Indicator" - _namespace = _namespace +# MAEC Candidate Indicator Class + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields +from mixbox import idgen + +import maec +from . import _namespace +import maec.bindings.maec_bundle as bundle_binding +from maec.bundle import ObjectReference, BehaviorReference +from cybox.common import VocabString +from cybox.core import ActionReference + +class MalwareEntity(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.MalwareEntityType + _namespace = _namespace + + type_ = fields.TypedField("Type", VocabString) + name = fields.TypedField("Name") + description = fields.TypedField("Description") + + def __init__(self): + super(MalwareEntity, self).__init__() + +class CandidateIndicatorComposition(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CandidateIndicatorCompositionType + _namespace = _namespace + + operator = fields.TypedField("operator") + behavior_reference = fields.TypedField("Behavior_Reference", BehaviorReference, multiple = True) + action_reference = fields.TypedField("Action_Reference", ActionReference, multiple = True) + object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) + sub_composition = fields.TypedField("Sub_Composition", multiple = True) + + def __init__(self): + super(CandidateIndicatorComposition, self).__init__() + +# Allow recursive definition of CandidateIndicatorCompositions +CandidateIndicatorComposition.sub_composition.type_ = CandidateIndicatorComposition + +class CandidateIndicator(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.CandidateIndicatorType + _namespace = _namespace + + id_ = fields.TypedField("id") + creation_datetime = fields.TypedField("creation_datetime") + lastupdate_datetime = fields.TypedField("lastupdate_datetime") + version = fields.TypedField("version") + importance = fields.TypedField("Importance", VocabString) + numeric_importance = fields.TypedField("Numeric_Importance") + author = fields.TypedField("Author") + description = fields.TypedField("Description") + malware_entity = fields.TypedField("Malware_Entity", MalwareEntity) + composition = fields.TypedField("Composition", CandidateIndicatorComposition) + + def __init__(self, id = None): + super(CandidateIndicator, self).__init__() + if id: + id_ = id + else: + id_ = idgen.create_id(prefix="candidate_indicator") + +class CandidateIndicatorList(maec.EntityList): + _binding_class = bundle_binding.CandidateIndicatorListType + _namespace = _namespace + candidate_indicator = fields.TypedField("Candidate_Indicator", CandidateIndicator, multiple=True) diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index b711418..a9d09f5 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -1,67 +1,66 @@ -# MAEC Malware Action Classes - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -from mixbox import fields -from mixbox import idgen - -from cybox.core import Action -from cybox.objects.code_object import Code - -import maec -from . import _namespace -import maec.bindings.maec_bundle as bundle_binding - - -class Parameter(maec.Entity): - _namespace = _namespace - _binding = bundle_binding - _binding_class = bundle_binding.ParameterType - - ordinal_position = fields.TypedField("ordinal_position") - name = fields.TypedField("name") - value = fields.TypedField("value") - - -class ParameterList(maec.EntityList): - _contained_type = Parameter - _binding_class = bundle_binding.ParameterListType - _binding_var = "Parameter" - _namespace = _namespace - - -class APICall(maec.Entity): - _namespace = _namespace - _binding = bundle_binding - _binding_class = bundle_binding.APICallType - - function_name = fields.TypedField("function_name") - normalized_function_name = fields.TypedField("normalized_function_name") - address = fields.TypedField("Address") - return_value = fields.TypedField("Return_Value") - parameters = fields.TypedField("Parameters", ParameterList) - - -class ActionImplementation(maec.Entity): - _namespace = _namespace - _binding = bundle_binding - _binding_class = bundle_binding.ActionImplementationType - - id_ = fields.TypedField("id") - type_ = fields.TypedField("type_", key_name = "type") - #compatible_platforms TODO: Add support - api_call = fields.TypedField("API_Call", APICall) - code = fields.TypedField("Code", Code, multiple = True) - - -class MalwareAction(Action): - _binding = bundle_binding - _binding_class = bundle_binding.MalwareActionType - _namespace = _namespace - - implementation = fields.TypedField("Implementation", ActionImplementation) - - def __init__(self): - super(MalwareAction, self).__init__() - self.id_ = idgen.create_id(prefix="action") +# MAEC Malware Action Classes + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields +from mixbox import idgen + +from cybox.core import Action +from cybox.objects.code_object import Code + +import maec +from . import _namespace +import maec.bindings.maec_bundle as bundle_binding + + +class Parameter(maec.Entity): + _namespace = _namespace + _binding = bundle_binding + _binding_class = bundle_binding.ParameterType + + ordinal_position = fields.TypedField("ordinal_position") + name = fields.TypedField("name") + value = fields.TypedField("value") + + +class ParameterList(maec.EntityList): + _binding_class = bundle_binding.ParameterListType + _namespace = _namespace + parameter = fields.TypedField("Parameter", Parameter, multiple=True) + + +class APICall(maec.Entity): + _namespace = _namespace + _binding = bundle_binding + _binding_class = bundle_binding.APICallType + + function_name = fields.TypedField("function_name") + normalized_function_name = fields.TypedField("normalized_function_name") + address = fields.TypedField("Address") + return_value = fields.TypedField("Return_Value") + parameters = fields.TypedField("Parameters", ParameterList) + + +class ActionImplementation(maec.Entity): + _namespace = _namespace + _binding = bundle_binding + _binding_class = bundle_binding.ActionImplementationType + + id_ = fields.TypedField("id") + type_ = fields.TypedField("type_", key_name = "type") + #compatible_platforms TODO: Add support + api_call = fields.TypedField("API_Call", APICall) + code = fields.TypedField("Code", Code, multiple = True) + + +class MalwareAction(Action): + _binding = bundle_binding + _binding_class = bundle_binding.MalwareActionType + _namespace = _namespace + + implementation = fields.TypedField("Implementation", ActionImplementation) + + def __init__(self): + super(MalwareAction, self).__init__() + self.id_ = idgen.create_id(prefix="action") diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index 360d1c1..dbf9dcd 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -1,23 +1,24 @@ -# MAEC Object Reference Class - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -import maec -from . import _namespace -import maec.bindings.maec_bundle as bundle_binding - -class ObjectReference(maec.Entity): - _binding = bundle_binding - _binding_class = bundle_binding.ObjectReferenceType - _namespace = _namespace - - def __init__(self, object_idref = None): - super(ObjectReference, self).__init__() - self.object_idref = object_idref - -class ObjectReferenceList(maec.EntityList): - _contained_type = ObjectReference - _binding_class = bundle_binding.ObjectReferenceListType - _binding_var = "Object_Reference" - _namespace = _namespace \ No newline at end of file +# MAEC Object Reference Class + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields + +import maec +from . import _namespace +import maec.bindings.maec_bundle as bundle_binding + +class ObjectReference(maec.Entity): + _binding = bundle_binding + _binding_class = bundle_binding.ObjectReferenceType + _namespace = _namespace + + def __init__(self, object_idref = None): + super(ObjectReference, self).__init__() + self.object_idref = object_idref + +class ObjectReferenceList(maec.EntityList): + _binding_class = bundle_binding.ObjectReferenceListType + _namespace = _namespace + object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple=True) diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index 108bc6f..f9513bb 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -1,30 +1,29 @@ -#MAEC Action Equivalence Class - -#Copyright (c) 2015, The MITRE Corporation -#All rights reserved - -from mixbox import fields -from mixbox import idgen - -import maec -from . import _namespace -import maec.bindings.maec_package as package_binding -from cybox.core import ActionReference - -class ActionEquivalence(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ActionEquivalenceType - _namespace = _namespace - - id_ = fields.TypedField('id') - action_reference = fields.TypedField('Action_Reference', ActionReference, multiple = True) - - def __init__(self): - super(ActionEquivalence, self).__init__() - self.id_ = idgen.create_id(prefix="action_equivalence") - -class ActionEquivalenceList(maec.EntityList): - _contained_type = ActionEquivalence - _binding_class = package_binding.ActionEquivalenceListType - _binding_var = "Action_Equivalence" - _namespace = _namespace +#MAEC Action Equivalence Class + +#Copyright (c) 2015, The MITRE Corporation +#All rights reserved + +from mixbox import fields +from mixbox import idgen + +import maec +from . import _namespace +import maec.bindings.maec_package as package_binding +from cybox.core import ActionReference + +class ActionEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ActionEquivalenceType + _namespace = _namespace + + id_ = fields.TypedField('id') + action_reference = fields.TypedField('Action_Reference', ActionReference, multiple = True) + + def __init__(self): + super(ActionEquivalence, self).__init__() + self.id_ = idgen.create_id(prefix="action_equivalence") + +class ActionEquivalenceList(maec.EntityList): + _binding_class = package_binding.ActionEquivalenceListType + _namespace = _namespace + action_equivalence = fields.TypedField("Action_Equivalence", ActionEquivalence, multiple=True) diff --git a/maec/package/analysis.py b/maec/package/analysis.py index ae9b466..9905e97 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -105,16 +105,14 @@ def from_dict(cls, cls_dict): return comment class CommentList(maec.EntityList): - _contained_type = Comment _binding_class = package_binding.CommentListType - _binding_var = "Comment" _namespace = _namespace + comment = fields.TypedField("Comment", Comment, multiple=True) class ToolList(maec.EntityList): - _contained_type = ToolInformation _binding_class = package_binding.ToolListType - _binding_var = "Tool" _namespace = _namespace + tool = fields.TypedField("Tool", ToolInformation, multiple=True) class DynamicAnalysisMetadata(maec.Entity): _binding = package_binding @@ -140,10 +138,9 @@ def __init__(self): super(HypervisorHostSystem, self).__init__() class InstalledPrograms(maec.EntityList): - _contained_type = PlatformSpecification _binding_class = package_binding.InstalledProgramsType - _binding_var = "Program" _namespace = _namespace + program = fields.TypedField("Program", PlatformSpecification, multiple=True) class AnalysisSystem(System): _binding = package_binding @@ -157,10 +154,9 @@ def __init__(self): self.installed_programs = InstalledPrograms() class AnalysisSystemList(maec.EntityList): - _contained_type = AnalysisSystem _binding_class = package_binding.AnalysisSystemListType - _binding_var = "Analysis_System" _namespace = _namespace + analysis_system = fields.TypedField("Analysis_System", AnalysisSystem, multiple=True) class CapturedProtocol(maec.Entity): _binding = package_binding @@ -176,10 +172,9 @@ def __init__(self): super(CapturedProtocol, self).__init__() class CapturedProtocolList(maec.EntityList): - _contained_type = CapturedProtocol _binding_class = package_binding.CapturedProtocolListType - _binding_var = "Protocol" _namespace = _namespace + protocol = fields.TypedField("Protocol", CapturedProtocol, multiple=True) class NetworkInfrastructure(maec.Entity): _binding = package_binding diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index 6119dcd..ea1aaf2 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -1,86 +1,85 @@ -# MAEC Grouping Relationship Class - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -from mixbox import fields - -import maec -from . import _namespace -import maec.bindings.maec_package as package_binding -from maec.package.malware_subject_reference import MalwareSubjectReference -from cybox.common import vocabs -from maec.vocabs.vocabs import GroupingRelationship as GroupingRelationshipVocab - -class ClusterEdgeNodePair(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusterEdgeNodePairType - _namespace = _namespace - - similarity_index = fields.TypedField("similarity_index") - similarity_distance = fields.TypedField("similarity_distance") - malware_subject_node_a = fields.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) - malware_subject_node_b = fields.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) - - def __init__(self): - super(ClusterEdgeNodePair, self).__init__() - -class ClusterComposition(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusterCompositionType - _namespace = _namespace - - score_type = fields.TypedField("score_type") - edge_node_pair = fields.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) - - def __init__(self): - super(ClusterComposition, self).__init__() - -class ClusteringAlgorithmParameters(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusteringAlgorithmParametersType - _namespace = _namespace - - distance_threashold = fields.TypedField("Distance_Threashold") - number_of_iterations = fields.TypedField("Number_of_Iterations") - - def __init__(self): - super(ClusteringAlgorithmParameters, self).__init__() - -class ClusteringMetadata(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ClusteringMetadataType - _namespace = _namespace - - algorithm_name = fields.TypedField("Algorithm_Name") - algorithm_version = fields.TypedField("Algorithm_Version") - algorithm_parameters = fields.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) - cluster_size = fields.TypedField("Cluster_Size") - cluster_description = fields.TypedField("Cluster_Description") - cluster_composition = fields.TypedField("Cluster_Composition", ClusterComposition) - - def __init__(self): - super(ClusteringMetadata, self).__init__() - -class GroupingRelationship(maec.Entity): - _binding = package_binding - _binding_class = package_binding.GroupingRelationshipType - _namespace = _namespace - - type_ = vocabs.VocabField("Type", GroupingRelationshipVocab) - malware_family_name = fields.TypedField("Malware_Family_Name") - malware_toolkit_name = fields.TypedField("Malware_Toolkit_Name") - clustering_metadata = fields.TypedField("Clustering_Metadata", ClusteringMetadata) - - def __init__(self): - super(GroupingRelationship, self).__init__() - -class GroupingRelationshipList(maec.EntityList): - _contained_type = GroupingRelationship - _binding_class = package_binding.GroupingRelationshipListType - _binding_var = "Grouping_Relationship" - _namespace = _namespace - - - - +# MAEC Grouping Relationship Class + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields + +import maec +from . import _namespace +import maec.bindings.maec_package as package_binding +from maec.package.malware_subject_reference import MalwareSubjectReference +from cybox.common import vocabs +from maec.vocabs.vocabs import GroupingRelationship as GroupingRelationshipVocab + +class ClusterEdgeNodePair(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterEdgeNodePairType + _namespace = _namespace + + similarity_index = fields.TypedField("similarity_index") + similarity_distance = fields.TypedField("similarity_distance") + malware_subject_node_a = fields.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) + malware_subject_node_b = fields.TypedField("Malware_Subject_Node_B", MalwareSubjectReference) + + def __init__(self): + super(ClusterEdgeNodePair, self).__init__() + +class ClusterComposition(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusterCompositionType + _namespace = _namespace + + score_type = fields.TypedField("score_type") + edge_node_pair = fields.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) + + def __init__(self): + super(ClusterComposition, self).__init__() + +class ClusteringAlgorithmParameters(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringAlgorithmParametersType + _namespace = _namespace + + distance_threashold = fields.TypedField("Distance_Threashold") + number_of_iterations = fields.TypedField("Number_of_Iterations") + + def __init__(self): + super(ClusteringAlgorithmParameters, self).__init__() + +class ClusteringMetadata(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ClusteringMetadataType + _namespace = _namespace + + algorithm_name = fields.TypedField("Algorithm_Name") + algorithm_version = fields.TypedField("Algorithm_Version") + algorithm_parameters = fields.TypedField("Algorithm_Parameters", ClusteringAlgorithmParameters) + cluster_size = fields.TypedField("Cluster_Size") + cluster_description = fields.TypedField("Cluster_Description") + cluster_composition = fields.TypedField("Cluster_Composition", ClusterComposition) + + def __init__(self): + super(ClusteringMetadata, self).__init__() + +class GroupingRelationship(maec.Entity): + _binding = package_binding + _binding_class = package_binding.GroupingRelationshipType + _namespace = _namespace + + type_ = vocabs.VocabField("Type", GroupingRelationshipVocab) + malware_family_name = fields.TypedField("Malware_Family_Name") + malware_toolkit_name = fields.TypedField("Malware_Toolkit_Name") + clustering_metadata = fields.TypedField("Clustering_Metadata", ClusteringMetadata) + + def __init__(self): + super(GroupingRelationship, self).__init__() + +class GroupingRelationshipList(maec.EntityList): + _binding_class = package_binding.GroupingRelationshipListType + _namespace = _namespace + grouping_relationship = fields.TypedField("Grouping_Relationship", GroupingRelationship, multiple=True) + + + + diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index b5c8ac1..7115aa4 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -22,16 +22,14 @@ from maec.vocabs.vocabs import MalwareSubjectRelationship as MalwareSubjectRelationshipVocab class MinorVariants(maec.EntityList): - _contained_type = Object _binding_class = package_binding.MinorVariantListType - _binding_var = "Minor_Variant" _namespace = _namespace + minor_variant = fields.TypedField("Minor_Variant", Object, multiple=True) class Analyses(maec.EntityList): - _contained_type = Analysis _binding_class = package_binding.AnalysisListType - _binding_var = "Analysis" _namespace = _namespace + analysis = fields.TypedField("Analysis", Analysis, multiple=True) class MalwareSubjectRelationship(maec.Entity): _binding = package_binding @@ -46,10 +44,9 @@ def __init__(self): class MalwareSubjectRelationshipList(maec.EntityList): - _contained_type = MalwareSubjectRelationship _binding_class = package_binding.MalwareSubjectRelationshipListType - _binding_var = "Relationship" _namespace = _namespace + relationship = fields.TypedField("Relationship", MalwareSubjectRelationship, multiple=True) class MetaAnalysis(maec.Entity): _binding = package_binding @@ -244,4 +241,5 @@ class MalwareSubjectList(maec.EntityList): #_binding_var = "Malware_Subject" _namespace = _namespace - malware_subject = fields.TypedField("Malware_Subject", MalwareSubject, multiple=True) \ No newline at end of file + malware_subject = fields.TypedField("Malware_Subject", MalwareSubject, multiple=True) + \ No newline at end of file diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index d65c8a8..78135c1 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -1,29 +1,28 @@ -# MAEC Action Equivalence Class - -# Copyright (c) 2015, The MITRE Corporation -# All rights reserved - -from mixbox import fields - -import maec -from . import _namespace -import maec.bindings.maec_package as package_binding -from maec.bundle import ObjectReference - -class ObjectEquivalence(maec.Entity): - _binding = package_binding - _binding_class = package_binding.ObjectEquivalenceType - _namespace = _namespace - - id_ = fields.TypedField("id") - object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) - - def init(self, id = None): - super(ObjectEquivalence, self).__init__() - self.id_ = id - -class ObjectEquivalenceList(maec.EntityList): - _contained_type = ObjectEquivalence - _binding_class = package_binding.ObjectEquivalenceListType - _binding_var = "Object_Equivalence" - _namespace = _namespace +# MAEC Action Equivalence Class + +# Copyright (c) 2015, The MITRE Corporation +# All rights reserved + +from mixbox import fields + +import maec +from . import _namespace +import maec.bindings.maec_package as package_binding +from maec.bundle import ObjectReference + +class ObjectEquivalence(maec.Entity): + _binding = package_binding + _binding_class = package_binding.ObjectEquivalenceType + _namespace = _namespace + + id_ = fields.TypedField("id") + object_reference = fields.TypedField("Object_Reference", ObjectReference, multiple = True) + + def init(self, id = None): + super(ObjectEquivalence, self).__init__() + self.id_ = id + +class ObjectEquivalenceList(maec.EntityList): + _binding_class = package_binding.ObjectEquivalenceListType + _namespace = _namespace + object_equivalence = fields.TypedField("Object_Equivalence", ObjectEquivalence, multiple=True) From fa837ffc914b8ff22b719782227b70ca300b87d6 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas Date: Tue, 8 Mar 2016 15:34:22 -0500 Subject: [PATCH 258/297] Strong bindings for data markings. --- maec/bindings/maec_bundle.py | 53 +++++++++++++++++++++++++++++++++ maec/bindings/maec_container.py | 2 ++ maec/bindings/maec_package.py | 42 ++++++++++++++++++++++++++ maec/bindings/mmdef_1_2.py | 31 +++++++++++++++++++ 4 files changed, 128 insertions(+) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 90155e8..49cd7e4 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -129,6 +129,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior if self.Relationships is not None: self.Relationships.export(write, level, 'maecBundle:', name_='Relationships', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -323,6 +324,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MAEC_Bun if self.Collections is not None: self.Collections.export(write, level, 'maecBundle:', name_='Collections', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -473,6 +475,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='APICallT if self.Parameters is not None: self.Parameters.export(write, level, 'maecBundle:', name_='Parameters', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -584,6 +587,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionIm for Code_ in self.Code: Code_.export(write, level, 'maecBundle:', name_='Code', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -671,6 +675,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='CVEVulne showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -763,6 +768,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='BaseColl showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -852,6 +858,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Behavior_Reference_ in self.Behavior_Reference: Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -922,6 +929,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassi for AV_Classification_ in self.AV_Classification: AV_Classification_.export(write, level, 'maecBundle:', name_='AV_Classification', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -996,6 +1004,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='ParameterType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1075,6 +1084,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Paramete for Parameter_ in self.Parameter: Parameter_.export(write, level, 'maecBundle:', name_='Parameter', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1142,6 +1152,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Associat for Code_Snippet_ in self.Code_Snippet: Code_Snippet_.export(write, level, 'maecBundle:', name_='Code_Snippet', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1211,6 +1222,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior if self.Vulnerability_Exploit is not None: self.Vulnerability_Exploit.export(write, level, 'maecBundle:', name_='Vulnerability_Exploit', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1282,6 +1294,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Platform for Platform_ in self.Platform: Platform_.export(write, level, 'maecBundle:', name_='Platform', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1375,6 +1388,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ExploitT if self.Targeted_Platforms is not None: self.Targeted_Platforms.export(write, level, 'maecBundle:', name_='Targeted_Platforms', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1458,6 +1472,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1558,6 +1573,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Action_Equivalence_Reference_ in self.Action_Equivalence_Reference: Action_Equivalence_Reference_.export(write, level, 'maecBundle:', name_='Action_Equivalence_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1636,6 +1652,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Behavior_ in self.Behavior: Behavior_.export(write, level, 'maecBundle:', name_='Behavior', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1702,6 +1719,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionLi for Action_ in self.Action: Action_.export(write, level, 'maecBundle:', name_='Action', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1768,6 +1786,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectLi for Object_ in self.Object: Object_.export(write, level, 'maecBundle:', name_='Object', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1829,6 +1848,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehaviorReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1890,6 +1910,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1965,6 +1986,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionEquivalenceReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2041,6 +2063,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Behavior_Reference_ in self.Behavior_Reference: Behavior_Reference_.export(write, level, 'maecBundle:', name_='Behavior_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2107,6 +2130,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionRe for Action_Reference_ in self.Action_Reference: Action_Reference_.export(write, level, 'maecBundle:', name_='Action_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2174,6 +2198,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectRe for Object_Reference_ in self.Object_Reference: Object_Reference_.export(write, level, 'maecBundle:', name_='Object_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2301,6 +2326,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat if self.Composition is not None: self.Composition.export(write, level, 'maecBundle:', name_='Composition', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2415,6 +2441,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat for Candidate_Indicator_ in self.Candidate_Indicator: Candidate_Indicator_.export(write, level, 'maecBundle:', name_='Candidate_Indicator', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2493,6 +2520,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareE showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % ('maecBundle:', quote_xml(self.Description), 'maecBundle:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2581,6 +2609,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Collecti if self.Candidate_Indicator_Collections is not None: self.Candidate_Indicator_Collections.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collections', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2653,6 +2682,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='BundleReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2716,6 +2746,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessT if self.Root_Process is not None: self.Root_Process.export(write, level, 'maecBundle:', name_='Root_Process', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2824,6 +2855,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat for Sub_Composition_ in self.Sub_Composition: Sub_Composition_.export(write, level, 'maecBundle:', name_='Sub_Composition', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2913,6 +2945,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat if self.Candidate_Indicator_List is not None: self.Candidate_Indicator_List.export(write, level, 'maecBundle:', name_='Candidate_Indicator_List', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2985,6 +3018,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Candidat for Candidate_Indicator_Collection_ in self.Candidate_Indicator_Collection: Candidate_Indicator_Collection_.export(write, level, 'maecBundle:', name_='Candidate_Indicator_Collection', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3052,6 +3086,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior for Behavior_Collection_ in self.Behavior_Collection: Behavior_Collection_.export(write, level, 'maecBundle:', name_='Behavior_Collection', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3118,6 +3153,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCo for Action_Collection_ in self.Action_Collection: Action_Collection_.export(write, level, 'maecBundle:', name_='Action_Collection', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3184,6 +3220,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCo for Object_Collection_ in self.Object_Collection: Object_Collection_.export(write, level, 'maecBundle:', name_='Object_Collection', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3265,6 +3302,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='AVClassi showIndent(write, level, pretty_print) write('<%sClassification_Name>%s%s' % ('maecBundle:', quote_xml(self.Classification_Name), 'maecBundle:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3384,6 +3422,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ProcessT for Injected_Process_ in self.Injected_Process: Injected_Process_.export(write, level, 'maecBundle:', name_='Injected_Process', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3471,6 +3510,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior super(BehavioralActionReferenceType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3553,6 +3593,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ObjectCo if self.Object_List is not None: self.Object_List.export(write, level, 'maecBundle:', name_='Object_List', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3634,6 +3675,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='ActionCo if self.Action_List is not None: self.Action_List.export(write, level, 'maecBundle:', name_='Action_List', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3718,6 +3760,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Behavior if self.Behavior_List is not None: self.Behavior_List.export(write, level, 'maecBundle:', name_='Behavior_List', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3809,6 +3852,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='MalwareA if self.Implementation is not None: self.Implementation.export(write, level, 'maecBundle:', name_='Implementation', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3879,6 +3923,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='BehavioralActionType', fromsubclass_=False, pretty_print=True): super(BehavioralActionType, self).exportChildren(write, level, 'maecBundle:', name_, True, pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4020,6 +4065,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4124,6 +4170,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili for Capability_Reference_ in self.Capability_Reference: Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4189,6 +4236,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4298,6 +4346,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecBundle:', name_='Relationship', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4390,6 +4439,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili for Capability_Reference_ in self.Capability_Reference: Capability_Reference_.export(write, level, 'maecBundle:', name_='Capability_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4468,6 +4518,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili for Objective_Reference_ in self.Objective_Reference: Objective_Reference_.export(write, level, 'maecBundle:', name_='Objective_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4534,6 +4585,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund def exportChildren(self, write, level, namespace_='maecBundle:', name_='CapabilityObjectiveReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -4605,6 +4657,7 @@ def exportChildren(self, write, level, namespace_='maecBundle:', name_='Capabili if self.Value is not None: self.Value.export(write, level, 'maecBundle:', name_='Value', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index d851d2c..4b30cb4 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -78,6 +78,7 @@ def exportChildren(self, write, level, namespace_='maecContainer:', name_='MAEC_ if self.Packages is not None: self.Packages.export(write, level, 'maecContainer:', name_='Packages', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -158,6 +159,7 @@ def exportChildren(self, write, level, namespace_='maecContainer:', name_='Packa for Package_ in self.Package: Package_.export(write, level, 'maecContainer:', name_='Package', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index ff15b89..1e3d031 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -74,6 +74,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi if self.Network_Infrastructure is not None: self.Network_Infrastructure.export(write, level, 'maecPackage:', name_='Network_Infrastructure', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -173,6 +174,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='SourceT showIndent(write, level, pretty_print) write('<%sURL>%s%s' % ('maecPackage:', quote_xml(self.URL), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -256,6 +258,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Comment for Comment_ in self.Comment: Comment_.export(write, level, 'maecPackage:', name_='Comment', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -323,6 +326,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi for Analysis_System_ in self.Analysis_System: Analysis_System_.export(write, level, 'maecPackage:', name_='Analysis_System', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -390,6 +394,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ToolLis for Tool_ in self.Tool: Tool_.export(write, level, 'maecPackage:', name_='Tool', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -467,6 +472,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Dynamic showIndent(write, level, pretty_print) write('<%sExit_Code>%s%s' % ('maecPackage:', self.gds_format_integer(self.Exit_Code, input_name='Exit_Code'), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -651,6 +657,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi if self.Report is not None: self.Report.export(write, level, 'maecPackage:', name_='Report', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -791,6 +798,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi for Analysis_ in self.Analysis: Analysis_.export(write, level, 'maecPackage:', name_='Analysis', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -859,6 +867,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Install for Program_ in self.Program: Program_.export(write, level, 'maecPackage:', name_='Program', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -956,6 +965,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MAEC_Pa if self.Grouping_Relationships is not None: self.Grouping_Relationships.export(write, level, 'maecPackage:', name_='Grouping_Relationships', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1109,6 +1119,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Compatible_Platform_ in self.Compatible_Platform: Compatible_Platform_.export(write, level, 'maecPackage:', name_='Compatible_Platform', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1217,6 +1228,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MetaAna if self.Object_Equivalences is not None: self.Object_Equivalences.export(write, level, 'maecPackage:', name_='Object_Equivalences', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1295,6 +1307,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Malware_Subject_Reference_ in self.Malware_Subject_Reference: Malware_Subject_Reference_.export(write, level, 'maecPackage:', name_='Malware_Subject_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1367,6 +1380,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Relationship_ in self.Relationship: Relationship_.export(write, level, 'maecPackage:', name_='Relationship', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1428,6 +1442,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack def exportChildren(self, write, level, namespace_='maecPackage:', name_='MalwareSubjectReferenceType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1494,6 +1509,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Malware_Subject_ in self.Malware_Subject: Malware_Subject_.export(write, level, 'maecPackage:', name_='Malware_Subject', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1562,6 +1578,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='MinorVa for Minor_Variant_ in self.Minor_Variant: Minor_Variant_.export(write, level, 'maecPackage:', name_='Minor_Variant', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1648,6 +1665,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Finding showIndent(write, level, pretty_print) write('<%sBundle_External_Reference>%s%s' % ('maecPackage:', self.gds_format_string(quote_xml(Bundle_External_Reference_).encode(ExternalEncoding), input_name='Bundle_External_Reference'), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1739,6 +1757,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Groupin if self.Clustering_Metadata is not None: self.Clustering_Metadata.export(write, level, 'maecPackage:', name_='Clustering_Metadata', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1818,6 +1837,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Groupin for Grouping_Relationship_ in self.Grouping_Relationship: Grouping_Relationship_.export(write, level, 'maecPackage:', name_='Grouping_Relationship', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -1914,6 +1934,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster if self.Cluster_Composition is not None: self.Cluster_Composition.export(write, level, 'maecPackage:', name_='Cluster_Composition', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2030,6 +2051,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster if self.Malware_Subject_Node_B is not None: self.Malware_Subject_Node_B.export(write, level, 'maecPackage:', name_='Malware_Subject_Node_B', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2123,6 +2145,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster for Edge_Node_Pair_ in self.Edge_Node_Pair: Edge_Node_Pair_.export(write, level, 'maecPackage:', name_='Edge_Node_Pair', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2196,6 +2219,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Cluster showIndent(write, level, pretty_print) write('<%sNumber_of_Iterations>%s%s' % ('maecPackage:', self.gds_format_integer(self.Number_of_Iterations, input_name='Number_of_Iterations'), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2272,6 +2296,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Network if self.Captured_Protocols is not None: self.Captured_Protocols.export(write, level, 'maecPackage:', name_='Captured_Protocols', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2350,6 +2375,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionE for Action_Reference_ in self.Action_Reference: Action_Reference_.export(write, level, 'maecPackage:', name_='Action_Reference', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2420,6 +2446,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ActionE for Action_Equivalence_ in self.Action_Equivalence: Action_Equivalence_.export(write, level, 'maecPackage:', name_='Action_Equivalence', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2488,6 +2515,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Capture for Protocol_ in self.Protocol: Protocol_.export(write, level, 'maecPackage:', name_='Protocol', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2575,6 +2603,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack def exportChildren(self, write, level, namespace_='maecPackage:', name_='CapturedProtocolType', fromsubclass_=False, pretty_print=True): pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2659,6 +2688,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectE for Object_Equivalence_ in self.Object_Equivalence: Object_Equivalence_.export(write, level, 'maecPackage:', name_='Object_Equivalence', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2724,6 +2754,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecPack def exportChildren(self, write, level, namespace_='maecPackage:', name_='ObjectEquivalenceType', fromsubclass_=False, pretty_print=True): super(ObjectEquivalenceType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2791,6 +2822,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Hypervi if self.VM_Hypervisor is not None: self.VM_Hypervisor.export(write, level, 'maecPackage:', name_='VM_Hypervisor', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2858,6 +2890,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Analysi if self.Installed_Programs is not None: self.Installed_Programs.export(write, level, 'maecPackage:', name_='Installed_Programs', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -2939,6 +2972,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Comment super(CommentType, self).exportChildren(write, level, 'maecPackage:', name_, True, pretty_print=pretty_print) pass def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) self.valueOf_ = get_all_text_(node) @@ -3041,6 +3075,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware showIndent(write, level, pretty_print) write('<%sDescription>%s%s' % (namespace_, self.gds_format_integer(self.Description, input_name='Description'), namespace_, eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3137,6 +3172,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Debugging_File_ in self.Debugging_File: Debugging_File_.export(write, level, namespace_, name_='Debugging_File', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3211,6 +3247,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware showIndent(write, level, pretty_print) write('<%sValue>%s%s' % ('maecPackage:', quote_xml(self.Value), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3294,6 +3331,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Configuration_Parameter_ in self.Configuration_Parameter: Configuration_Parameter_.export(write, level, 'maecPackage:', name_='Configuration_Parameter', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3385,6 +3423,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for Algorithm_Details_ in self.Algorithm_Details: Algorithm_Details_.export(write, level, 'maecPackage:', name_='Algorithm_Details', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3480,6 +3519,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware if self.Algorithm_Name is not None: self.Algorithm_Name.export(write, level, 'maecPackage:', name_='Algorithm_Name', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3571,6 +3611,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware for URL_ in self.URL: URL_.export(write, level, 'maecPackage:', name_='URL', pretty_print=pretty_print) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: @@ -3657,6 +3698,7 @@ def exportChildren(self, write, level, namespace_='maecPackage:', name_='Malware showIndent(write, level, pretty_print) write('<%sSection_Offset>%s%s' % ('maecPackage:', quote_xml(self.Section_Offset), 'maecPackage:', eol_)) def build(self, node): + self.__sourcenode__ = node already_processed = set() self.buildAttributes(node, node.attrib, already_processed) for child in node: diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index d4743bf..17629fe 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -180,6 +180,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -393,6 +394,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -492,6 +494,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -550,6 +553,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -608,6 +612,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -907,6 +912,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1097,6 +1103,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -1169,6 +1176,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1239,6 +1247,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1354,6 +1363,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1459,6 +1469,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1528,6 +1539,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -1591,6 +1603,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1658,6 +1671,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1765,6 +1779,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -1868,6 +1883,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2052,6 +2068,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2153,6 +2170,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2213,6 +2231,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -2275,6 +2294,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -2330,6 +2350,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -2388,6 +2409,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -2474,6 +2496,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2578,6 +2601,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2652,6 +2676,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2710,6 +2735,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2819,6 +2845,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -2912,6 +2939,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -3007,6 +3035,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] @@ -3092,6 +3121,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) self.valueOf_ = get_all_text_(node) for child in node: @@ -3174,6 +3204,7 @@ def hasContent_(self): else: return False def build(self, node): + self.__sourcenode__ = node self.buildAttributes(node, node.attrib, []) for child in node: nodeName_ = Tag_pattern_.match(child.tag).groups()[-1] From a4f4fc67d6920daaee1b70abd0e8829aecbf85e2 Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Mon, 4 Apr 2016 17:21:39 -0400 Subject: [PATCH 259/297] Fixed some vocab test issues: a fully defined vocab string in the test dict (i.e. a dict with a value and xsi:type) round-trips to a plain string. I switched it to a plain string in the test dict. --- maec/test/package/malware_subject_test.py | 5 +---- maec/test/package/package_test.py | 5 +---- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index 6123587..767d574 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -16,10 +16,7 @@ class TestMalwareSubject(EntityTestCase, unittest.TestCase): 'bundle': [{ 'actions': [{ 'associated_objects': [{ - 'association_type': { - 'value': u'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' - }, + 'association_type': u'output', 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', 'properties': { 'file_name': u'abcd.dll', diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index 5dd92e5..7d85644 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -15,10 +15,7 @@ class TestPackage(EntityTestCase, unittest.TestCase): 'bundle': [{ 'actions': [{ 'associated_objects': [{ - 'association_type': { - 'value': u'output', - 'xsi:type': 'maecVocabs:ActionObjectAssociationTypeVocab-1.0' - }, + 'association_type': u'output', 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', 'properties': { 'file_name': u'abcd.dll', From 837ea59b26a13aa4173751cdb1c0b427cd535463 Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Thu, 14 Apr 2016 11:05:59 -0400 Subject: [PATCH 260/297] Fixed a typo in ObjectHash.get_hash() --- maec/utils/comparator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/utils/comparator.py b/maec/utils/comparator.py index e6338f4..50e43fd 100644 --- a/maec/utils/comparator.py +++ b/maec/utils/comparator.py @@ -125,7 +125,7 @@ def get_hash(cls, obj, match_on, case_sensitive): cls.case_sensitive = case_sensitive hash_val = '' - for attrname, typed_field in obj.properties.typed_fields_with_attrnames: + for attrname, typed_field in obj.properties.typed_fields_with_attrnames(): # Make sure the typed field is comparable if typed_field.comparable: # Check if we're dealing with a nested element that we want to compare From 6b4e65b3929146a8b85f3be8db3b5a12eeaaeb04 Mon Sep 17 00:00:00 2001 From: Robert Roberge Date: Tue, 7 Jun 2016 22:47:33 -0400 Subject: [PATCH 261/297] Updated Read Me Updated "Information" reference from mitre.org site to github documentation site. Also, added a missing end period. --- README.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.rst b/README.rst index 3edbd10..85d5841 100644 --- a/README.rst +++ b/README.rst @@ -5,7 +5,7 @@ A Python library for parsing, manipulating, and generating MAEC content. :Source: https://github.com/MAECProject/python-maec :Documentation: http://maec.readthedocs.org -:Information: http://maec.mitre.org +:Information: https://maecproject.github.io/ :Download: https://pypi.python.org/pypi/maec/ |travis badge| |landscape.io badge| |version badge| |downloads badge| @@ -86,7 +86,7 @@ Ubuntu package repository: * zlib1g-dev For more information about installing lxml, see -http://lxml.de/installation.html +http://lxml.de/installation.html. Feedback -------- From 179cc5c5df0d1d6abec9bf8c2be37aa7d5ad383a Mon Sep 17 00:00:00 2001 From: Robert Roberge Date: Mon, 13 Jun 2016 22:57:11 -0400 Subject: [PATCH 262/297] Updated ReadMe Spelled-out MAEC acronym in intro text and added discussion list url to feedback section. --- README.rst | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/README.rst b/README.rst index 85d5841..50ab74a 100644 --- a/README.rst +++ b/README.rst @@ -1,7 +1,7 @@ python-maec =========== -A Python library for parsing, manipulating, and generating MAEC content. +A Python library for parsing, manipulating, and generating Malware Attribute Enumeration and Characterization (MAEC™) content. :Source: https://github.com/MAECProject/python-maec :Documentation: http://maec.readthedocs.org @@ -12,13 +12,13 @@ A Python library for parsing, manipulating, and generating MAEC content. .. |travis badge| image:: https://api.travis-ci.org/MAECProject/python-maec.png?branch=master :target: https://travis-ci.org/MAECProject/python-maec - :alt: Build Status + :alt: Build Status .. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.png :target: https://landscape.io/github/MAECProject/python-maec/master - :alt: Code Health -.. |version badge| image:: https://pypip.in/v/maec/badge.png + :alt: Code Health +.. |Version Badge| image:: https://pypip.in/v/maec/badge.png :target: https://pypi.python.org/pypi/maec/ -.. |downloads badge| image:: https://pypip.in/d/maec/badge.png +.. |Downloads Badge| image:: https://pypip.in/d/maec/badge.png :target: https://pypi.python.org/pypi/maec/ @@ -92,5 +92,4 @@ Feedback -------- Bug reports and feature requests are welcome and encouraged. Pull requests are -especially appreciated. Feel free to use the issue tracker on GitHub or send an -email directly to maec@mitre.org. +especially appreciated. Feel free to use the issue tracker on GitHub, join the [MAEC Community Email Discussion List](https://maec.mitre.org/community/discussionlist.html), or send an email directly to maec@mitre.org. From 54b1852522337af7fb2f1cdec7ec3aa7143e8228 Mon Sep 17 00:00:00 2001 From: Robert Roberge Date: Wed, 6 Jul 2016 22:53:56 -0400 Subject: [PATCH 263/297] Update README.rst --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 50ab74a..8551985 100644 --- a/README.rst +++ b/README.rst @@ -1,7 +1,7 @@ python-maec =========== -A Python library for parsing, manipulating, and generating Malware Attribute Enumeration and Characterization (MAEC™) content. +A Python library for parsing, manipulating, and generating [Malware Attribute Enumeration and Characterization (MAEC™)](https://maecproject.github.io/) content. :Source: https://github.com/MAECProject/python-maec :Documentation: http://maec.readthedocs.org From d422e31b014f34cdd1ed5cb7c54bd23a54c69f91 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 7 Jul 2016 12:37:44 -0500 Subject: [PATCH 264/297] Update email discussion list link in README --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 8551985..cc7e241 100644 --- a/README.rst +++ b/README.rst @@ -92,4 +92,4 @@ Feedback -------- Bug reports and feature requests are welcome and encouraged. Pull requests are -especially appreciated. Feel free to use the issue tracker on GitHub, join the [MAEC Community Email Discussion List](https://maec.mitre.org/community/discussionlist.html), or send an email directly to maec@mitre.org. +especially appreciated. Feel free to use the issue tracker on GitHub, join the `MAEC Community Email Discussion List `_, or send an email directly to maec@mitre.org. From 5d4aaa85b6cd29e507ef41ed7c24b577be15d120 Mon Sep 17 00:00:00 2001 From: Robert Roberge Date: Thu, 7 Jul 2016 21:36:02 -0400 Subject: [PATCH 265/297] Updated ReadMe Made link inline. --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index cc7e241..b934910 100644 --- a/README.rst +++ b/README.rst @@ -1,7 +1,7 @@ python-maec =========== -A Python library for parsing, manipulating, and generating [Malware Attribute Enumeration and Characterization (MAEC™)](https://maecproject.github.io/) content. +A Python library for parsing, manipulating, and generating `Malware Attribute Enumeration and Characterization (MAEC™) `_ content. :Source: https://github.com/MAECProject/python-maec :Documentation: http://maec.readthedocs.org From 657a90d960c1216c441becca5aa0f8c9d3e38186 Mon Sep 17 00:00:00 2001 From: Chris Lenk Date: Tue, 12 Jul 2016 13:31:22 -0400 Subject: [PATCH 266/297] Replace pypip badges with shield.io pypip.in is down ( badges/pypipins#37 ) --- README.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.rst b/README.rst index b934910..fcf8080 100644 --- a/README.rst +++ b/README.rst @@ -16,9 +16,9 @@ A Python library for parsing, manipulating, and generating `Malware Attribute En .. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.png :target: https://landscape.io/github/MAECProject/python-maec/master :alt: Code Health -.. |Version Badge| image:: https://pypip.in/v/maec/badge.png +.. |Version Badge| image:: https://img.shields.io/pypi/v/maec.png?maxAge=2592000 :target: https://pypi.python.org/pypi/maec/ -.. |Downloads Badge| image:: https://pypip.in/d/maec/badge.png +.. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.png?maxAge=2592000 :target: https://pypi.python.org/pypi/maec/ From 9dced3f7490bb2d22f699e5b5eaac016d30270af Mon Sep 17 00:00:00 2001 From: clenk Date: Tue, 12 Jul 2016 15:58:24 -0400 Subject: [PATCH 267/297] Initial Python 3 support --- .travis.yml | 9 +++++- docs/api_vs_bindings/api_snippet.rst | 2 +- docs/examples.rst | 10 +++---- maec/__init__.py | 18 +++++++----- maec/bindings/maec_bundle.py | 24 +++++++-------- maec/bindings/maec_container.py | 6 ++-- maec/bindings/maec_package.py | 36 +++++++++++------------ maec/bindings/mmdef_1_2.py | 22 +++++++------- maec/test/encoding_test.py | 3 +- maec/test/package/malware_subject_test.py | 4 +-- maec/test/package/package_test.py | 4 +-- maec/test/utils/parser_test.py | 2 +- maec/utils/__init__.py | 3 +- maec/utils/deduplicator.py | 3 +- maec/utils/merge.py | 5 ++-- tox.ini | 2 +- 16 files changed, 83 insertions(+), 70 deletions(-) diff --git a/.travis.yml b/.travis.yml index ea5285c..8445983 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,11 +1,18 @@ language: python + +python: + - 3.5 + env: - TOXENV=py26 - TOXENV=py27 + - TOXENV=py33 + - TOXENV=py34 + - TOXENV=py35 - TOXENV=rhel6 install: - - pip install tox + - pip install -U tox script: - tox diff --git a/docs/api_vs_bindings/api_snippet.rst b/docs/api_vs_bindings/api_snippet.rst index 202d1ce..1c9930f 100644 --- a/docs/api_vs_bindings/api_snippet.rst +++ b/docs/api_vs_bindings/api_snippet.rst @@ -32,4 +32,4 @@ b.add_action(a) # Output the Bundle to stdout - print b.to_xml(include_namespaces = False) + print(b.to_xml(include_namespaces = False)) diff --git a/docs/examples.rst b/docs/examples.rst index fc6f3fa..43fd8c3 100644 --- a/docs/examples.rst +++ b/docs/examples.rst @@ -41,7 +41,7 @@ different types of analysis. ms = MalwareSubject() p.add_malware_subject(ms) - print p.to_xml(include_namespaces=False) + print(p.to_xml(include_namespaces=False, encoding=None)) Which outputs: @@ -77,7 +77,7 @@ that it is characterizing. ms.malware_instance_object_attributes.properties = File() ms.malware_instance_object_attributes.properties.file_name = "malware.exe" ms.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" - print ms.to_xml(include_namespaces=False) + print(ms.to_xml(include_namespaces=False, encoding=None)) Which outputs: @@ -125,7 +125,7 @@ instance that it is characterizing. b.malware_instance_object_attributes.properties.file_name = "malware.exe" b.malware_instance_object_attributes.properties.file_path = "C:\Windows\Temp\malware.exe" - print b.to_xml(include_namespaces=False) + print(b.to_xml(include_namespaces=False, encoding=None)) Which outputs: @@ -168,7 +168,7 @@ be defined in their parent Malware Subject. b = Bundle() ms.add_findings_bundle(b) - print ms.to_xml(include_namespaces=False) + print(ms.to_xml(include_namespaces=False, encoding=None)) Which outputs: @@ -227,7 +227,7 @@ needed. b.add_action(a) - print b.to_xml(include_namespaces = False) + print(b.to_xml(include_namespaces = False, encoding=None)) .. testoutput:: diff --git a/maec/__init__.py b/maec/__init__.py index 76f86e8..12dc842 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,13 +1,15 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. +from __future__ import absolute_import from mixbox.entities import Entity as cyboxEntity from mixbox.entities import EntityList from mixbox.namespaces import (Namespace, get_xmlns_string, get_schemaloc_string, lookup_name, lookup_prefix) +from mixbox.vendor.six import iteritems, string_types -import bindings.maec_bundle as bundle_binding -import bindings.maec_package as package_binding +from .bindings import maec_bundle as bundle_binding +from .bindings import maec_package as package_binding import maec from maec.utils import flip_dict, EntityParser @@ -42,14 +44,14 @@ def to_xml_file(self, file, namespace_dict=None, custom_header=None): namespace_dict = {} else: # Make a copy so we don't pollute the source - namespace_dict = dict(namespace_dict.iteritems()) + namespace_dict = dict(iteritems(namespace_dict)) # Update the namespace dictionary with namespaces found upon import input_namespaces = self._ns_to_prefix_input_namespaces() namespace_dict.update(input_namespaces) # Check whether we're dealing with a filename or file-like Object - if isinstance(file, basestring): + if isinstance(file, string_types): out_file = open(file, 'w') else: out_file = file @@ -62,12 +64,12 @@ def to_xml_file(self, file, namespace_dict=None, custom_header=None): out_file.write("-->\n") elif isinstance(custom_header, dict): out_file.write("", "\\-\\->") sanitized_value = str(value).replace("-->", "\\-\\->") out_file.write(sanitized_key + ": " + sanitized_value + "\n") out_file.write("-->\n") - elif isinstance(custom_header, basestring): + elif isinstance(custom_header, string_types): out_file.write("", "\\-\\->") + "\n") out_file.write("-->\n") @@ -87,7 +89,7 @@ def _get_namespace_def(self, additional_ns_dict=None): if namespaces and additional_ns_dict: namespace_list = [x.name for x in namespaces if x] - for ns, prefix in additional_ns_dict.iteritems(): + for ns, prefix in iteritems(additional_ns_dict): if ns not in namespace_list: namespaces.update([Namespace(ns, prefix, '')]) @@ -119,7 +121,7 @@ def _get_namespaces(self, recurse=True): # Add any additional namespaces that may be included in the entity input_ns = self._ns_to_prefix_input_namespaces() - for namespace, alias in input_ns.iteritems(): + for namespace, alias in iteritems(input_ns): if not lookup_name(namespace): nsset.add(Namespace(namespace, alias, '')) diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 90155e8..4b53c8b 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -103,7 +103,7 @@ def exportAttributes(self, write, level, already_processed, namespace_='maecBund write(' status=%s' % (quote_attrib(self.status), )) if self.duration is not None and 'duration' not in already_processed: already_processed.add('duration') - write(' duration=%s' % (quote_attrib(self.duration).encode(ExternalEncoding))) + write(' duration=%s' % (quote_attrib(self.duration))) if self.ordinal_position is not None and 'ordinal_position' not in already_processed: already_processed.add('ordinal_position') write(' ordinal_position="%s"' % self.gds_format_integer(self.ordinal_position, input_name='ordinal_position')) @@ -148,7 +148,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('ordinal_position') try: self.ordinal_position = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.ordinal_position <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -355,7 +355,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('timestamp') try: self.timestamp = self.gds_parse_datetime(value, node, 'timestamp') - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (timestamp): %s' % exp) def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): if nodeName_ == 'Malware_Instance_Object_Attributes': @@ -1007,7 +1007,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('ordinal_position') try: self.ordinal_position = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.ordinal_position <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -1980,7 +1980,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('behavioral_ordering') try: self.behavioral_ordering = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.behavioral_ordering <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -2316,7 +2316,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('creation_datetime') try: self.creation_datetime = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (creation_datetime): %s' % exp) value = find_attr_value_('id', node) if value is not None and 'id' not in already_processed: @@ -2327,7 +2327,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('lastupdate_datetime') try: self.lastupdate_datetime = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (lastupdate_datetime): %s' % exp) def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): if nodeName_ == 'Importance': @@ -2338,7 +2338,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) if ival_ <= 0: raise_parse_error(child_, 'requires positiveInteger') @@ -3482,7 +3482,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('behavioral_ordering') try: self.behavioral_ordering = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.behavioral_ordering <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -3890,7 +3890,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('behavioral_ordering') try: self.behavioral_ordering = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.behavioral_ordering <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -4628,7 +4628,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): """ def usage(): - print USAGE_TEXT + print(USAGE_TEXT) sys.exit(1) def get_root_tag(node): @@ -4668,7 +4668,7 @@ def parseEtree(inFileName): return rootObj, rootElement def parseString(inString): - from StringIO import StringIO + from mixbox.vendor.six import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() rootTag, rootClass = get_root_tag(rootNode) diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index d851d2c..f0a1110 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -89,7 +89,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('timestamp') try: self.timestamp = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (timestamp): %s' % exp) value = find_attr_value_('id', node) if value is not None and 'id' not in already_processed: @@ -177,7 +177,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): """ def usage(): - print USAGE_TEXT + print(USAGE_TEXT) sys.exit(1) def get_root_tag(node): @@ -217,7 +217,7 @@ def parseEtree(inFileName): return rootObj, rootElement def parseString(inString): - from StringIO import StringIO + from mixbox.vendor.six import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() rootTag, rootClass = get_root_tag(rootNode) diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index ff15b89..af8c0a5 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -483,7 +483,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: fval_ = float(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires float or double: %s' % exp) fval_ = self.gds_validate_float(fval_, node, 'Analysis_Duration') self.Analysis_Duration = fval_ @@ -491,7 +491,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'Exit_Code') self.Exit_Code = ival_ @@ -662,14 +662,14 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('start_datetime') try: self.start_datetime = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (start_datetime): %s' % exp) value = find_attr_value_('complete_datetime', node) if value is not None and 'complete_datetime' not in already_processed: already_processed.add('complete_datetime') try: self.complete_datetime = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (complete_datetime): %s' % exp) value = find_attr_value_('method', node) if value is not None and 'method' not in already_processed: @@ -680,7 +680,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('ordinal_position') try: self.ordinal_position = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.ordinal_position <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -689,7 +689,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('lastupdate_datetime') try: self.lastupdate_datetime = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (lastupdate_datetime): %s' % exp) value = find_attr_value_('type', node) if value is not None and 'type' not in already_processed: @@ -967,7 +967,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('timestamp') try: self.timestamp = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (timestamp): %s' % exp) value = find_attr_value_('id', node) if value is not None and 'id' not in already_processed: @@ -1938,7 +1938,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) if ival_ <= 0: raise_parse_error(child_, 'requires positiveInteger') @@ -2041,14 +2041,14 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('similarity_distance') try: self.similarity_distance = float(value) - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad float/double attribute (similarity_distance): %s' % exp) value = find_attr_value_('similarity_index', node) if value is not None and 'similarity_index' not in already_processed: already_processed.add('similarity_index') try: self.similarity_index = float(value) - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad float/double attribute (similarity_index): %s' % exp) def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): if nodeName_ == 'Malware_Subject_Node_A': @@ -2208,7 +2208,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: fval_ = float(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires float or double: %s' % exp) fval_ = self.gds_validate_float(fval_, node, 'Distance_Threshold') self.Distance_Threshold = fval_ @@ -2216,7 +2216,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) if ival_ <= 0: raise_parse_error(child_, 'requires positiveInteger') @@ -2590,7 +2590,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('port_number') try: self.port_number = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.port_number <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -2951,7 +2951,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('timestamp') try: self.timestamp = value - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad date-time attribute (timestamp): %s' % exp) value = find_attr_value_('author', node) if value is not None and 'author' not in already_processed: @@ -3070,7 +3070,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'Description') self.Description = ival_ @@ -3491,7 +3491,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.add('ordinal_position') try: self.ordinal_position = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) if self.ordinal_position <= 0: raise_parse_error(node, 'Invalid PositiveInteger') @@ -3684,7 +3684,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): """ def usage(): - print USAGE_TEXT + print(USAGE_TEXT) sys.exit(1) def get_root_tag(node): @@ -3724,7 +3724,7 @@ def parseEtree(inFileName): return rootObj, rootElement def parseString(inString): - from StringIO import StringIO + from mixbox.vendor.six import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() rootTag, rootClass = get_root_tag(rootNode) diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index d4743bf..7951809 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -190,7 +190,7 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.append('version') try: self.version = float(value) - except ValueError, exp: + except ValueError as exp: raise ValueError('Bad float/double attribute (version): %s' % exp) value = find_attr_value_('id', node) if value is not None and 'id' not in already_processed: @@ -937,7 +937,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'size') self.size = ival_ @@ -1017,7 +1017,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: fval_ = float(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires float or double: %s' % exp) fval_ = self.gds_validate_float(fval_, node, 'linkerVersion') self.linkerVersion = fval_ @@ -1029,7 +1029,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'numberOfSections') self.numberOfSections = ival_ @@ -1386,7 +1386,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'port') self.port = ival_ @@ -1668,14 +1668,14 @@ def buildAttributes(self, node, attrs, already_processed): already_processed.append('id') try: self.id = int(value) - except ValueError, exp: + except ValueError as exp: raise_parse_error(node, 'Bad integer attribute: %s' % exp) def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): if nodeName_ == 'as-number': sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'as_number') self.as_number = ival_ @@ -2084,7 +2084,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'commonality') self.commonality = ival_ @@ -2097,7 +2097,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): sval_ = child_.text try: ival_ = int(sval_) - except (TypeError, ValueError), exp: + except (TypeError, ValueError) as exp: raise_parse_error(child_, 'requires integer: %s' % exp) ival_ = self.gds_validate_integer(ival_, node, 'importance') self.importance = ival_ @@ -3210,7 +3210,7 @@ def buildChildren(self, child_, node, nodeName_, fromsubclass_=False): """ def usage(): - print USAGE_TEXT + print(USAGE_TEXT) sys.exit(1) def parse(inFileName): @@ -3231,7 +3231,7 @@ def parse(inFileName): def parseString(inString): - from StringIO import StringIO + from mixbox.vendor.six import StringIO doc = parsexml_(StringIO(inString)) rootNode = doc.getroot() rootTag, rootClass = get_root_tag(rootNode) diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py index 1497fe0..9f6ea69 100644 --- a/maec/test/encoding_test.py +++ b/maec/test/encoding_test.py @@ -7,6 +7,7 @@ import unittest from mixbox import binding_utils +from mixbox.vendor.six import text_type from maec.package.malware_subject import MalwareConfigurationParameter from maec.package.analysis import DynamicAnalysisMetadata @@ -91,7 +92,7 @@ def test_to_xml_no_encoding(self): b = Behavior() b.description = UNICODE_STR xml = b.to_xml(encoding=None) - self.assertTrue(isinstance(xml, unicode)) + self.assertTrue(isinstance(xml, text_type)) self.assertTrue(UNICODE_STR in xml) if __name__ == "__main__": diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index 6123587..035f4ce 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -23,7 +23,7 @@ class TestMalwareSubject(EntityTestCase, unittest.TestCase): 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', 'properties': { 'file_name': u'abcd.dll', - 'size_in_bytes': 123456L, + 'size_in_bytes': 123456, 'xsi:type': 'FileObjectType' } }], @@ -53,7 +53,7 @@ class TestMalwareSubject(EntityTestCase, unittest.TestCase): 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', 'type': u'MD5' }], - 'size_in_bytes': 35532L, + 'size_in_bytes': 35532, 'xsi:type': 'FileObjectType' } } diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index 5dd92e5..697107d 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -22,7 +22,7 @@ class TestPackage(EntityTestCase, unittest.TestCase): 'id': 'example:Object-fdba414a-e46a-4abf-ad50-4dcda819129c', 'properties': { 'file_name': u'abcd.dll', - 'size_in_bytes': 123456L, + 'size_in_bytes': 123456, 'xsi:type': 'FileObjectType' } }], @@ -52,7 +52,7 @@ class TestPackage(EntityTestCase, unittest.TestCase): 'simple_hash_value': u'8743b52063cd84097a65d1633f5c74f5', 'type': u'MD5' }], - 'size_in_bytes': 35532L, + 'size_in_bytes': 35532, 'xsi:type': 'FileObjectType' } }}], diff --git a/maec/test/utils/parser_test.py b/maec/test/utils/parser_test.py index 6b1bce7..42812a7 100644 --- a/maec/test/utils/parser_test.py +++ b/maec/test/utils/parser_test.py @@ -1,7 +1,7 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -from StringIO import StringIO +from mixbox.vendor.six import StringIO import unittest from mixbox.parser import (UnknownVersionError, UnsupportedRootElementError, diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 41345f8..0fa8e93 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -2,6 +2,7 @@ # All rights reserved """MAEC utility methods""" +from mixbox.vendor.six import iteritems def flip_dict(d): """Returns a copy of the input dictionary `d` where the values of `d` @@ -14,7 +15,7 @@ def flip_dict(d): d: A dictionary """ - return dict((v,k) for k, v in d.iteritems()) + return dict((v,k) for k, v in iteritems(d)) # Namespace flattening from .parser import EntityParser # noqa diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 3b71bda..b3ab6f0 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -7,6 +7,7 @@ import cybox import copy from cybox.common.properties import BaseProperty +from mixbox.vendor.six import iteritems class BundleDeduplicator(object): @classmethod @@ -67,7 +68,7 @@ def cleanup(cls, bundle): @classmethod def handle_duplicate_objects(cls, bundle, all_objects): """Replace all of the duplicate Objects with references to the unique object placed in the "Re-used Objects" Collection.""" - for duplicate_object_id, unique_object_id in cls.object_ids_mapping.iteritems(): + for duplicate_object_id, unique_object_id in iteritems(cls.object_ids_mapping): # Modify the existing Object to serve as a reference to # the unique Object in the collection if duplicate_object_id and duplicate_object_id in cls.id_objects: diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 7e1d40d..137cad4 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -8,6 +8,7 @@ from mixbox import idgen from mixbox.namespaces import Namespace +from mixbox.vendor.six import iteritems from cybox.core import Object from cybox.common import HashList @@ -29,7 +30,7 @@ def dict_merge(target, *args): obj = args[0] if not isinstance(obj, dict): return obj - for k, v in obj.iteritems(): + for k, v in iteritems(obj): if k in target and isinstance(target[k], dict): dict_merge(target[k], v) elif k in target and isinstance(target[k], list): @@ -50,7 +51,7 @@ def merge_documents(input_list, output_file): if isinstance(document, Package): continue else: - print 'Error: unsupported document type. Currently only MAEC Packages are supported' + print('Error: unsupported document type. Currently only MAEC Packages are supported') # Merge the MAEC packages merged_package = merge_packages(parsed_documents) diff --git a/tox.ini b/tox.ini index 39adae1..2e070eb 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py26, py27, rhel6 +envlist = py26, py27, py33, py34, py35, rhel6 [testenv] commands = From e985cd1bf6fd0a07c41f75f2ae91bd47870fb020 Mon Sep 17 00:00:00 2001 From: Chris Lenk Date: Tue, 26 Jul 2016 13:17:49 -0400 Subject: [PATCH 268/297] Update README.rst Update Compatibility, Installation, and Dependencies sections. --- README.rst | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/README.rst b/README.rst index fcf8080..9c5c15f 100644 --- a/README.rst +++ b/README.rst @@ -49,7 +49,7 @@ There are currently two levels of APIs for dealing with MAEC content: Compatibility ------------- -The python-maec library is tested and written against python ``2.7.x``. Compatibility with other python versions is neither guaranteed nor implied. +The python-maec library is tested and written against python ``2.6, 2.7, and 3.3+``. Compatibility with other python versions is neither guaranteed nor implied. Versioning ---------- @@ -62,6 +62,20 @@ to indicate new versions of the python-maec library itself. Installation ------------ +The python-maec library can be installed via the distutils setup.py script +included at the root directory: + + $ python setup.py install + +The python-maec library is also hosted on `PyPI +`_ and can be installed with `pip +`_: + + $ pip install maec + +Dependencies +------------ + The ``maec`` package depends on the following Python libraries: * ``lxml`` From f5e5ced94ad3c75618ddd95f081b07846fcec3cb Mon Sep 17 00:00:00 2001 From: clenk Date: Fri, 29 Jul 2016 10:05:11 -0400 Subject: [PATCH 269/297] Require latest versions of mixbox and cybox --- setup.py | 4 ++-- tox.ini | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/setup.py b/setup.py index a7c1714..56491a7 100644 --- a/setup.py +++ b/setup.py @@ -26,8 +26,8 @@ def get_version(): install_requires = [ 'lxml>=2.2.3', - 'mixbox>=0.0.10', - 'cybox>=2.1.0.13.dev0,<2.1.1.0', + 'mixbox>=0.0.13', + 'cybox>=2.1.0.13.dev1,<2.1.1.0', ] extras_require = { diff --git a/tox.ini b/tox.ini index 2e070eb..f1eb433 100644 --- a/tox.ini +++ b/tox.ini @@ -14,8 +14,8 @@ basepython=python2.6 commands = nosetests maec deps = - cybox>=2.1.0.12.dev1 + cybox>=2.1.0.13.dev1 lxml==2.2.3 - mixbox>=0.0.10 + mixbox>=0.0.13 python-dateutil==1.4.1 nose From 676486ce1264732a08ee0bf2fb1a41774911f45a Mon Sep 17 00:00:00 2001 From: clenk Date: Fri, 29 Jul 2016 11:36:42 -0400 Subject: [PATCH 270/297] Add tests for adding collections to bundles, and fix the bugs this finds. Closes #76 and closes #77. --- maec/bundle/bundle.py | 6 +++--- maec/test/bundle/bundle_test.py | 27 +++++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 7211396..164ce12 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -554,7 +554,7 @@ def add_behavior(self, behavior, behavior_collection_name = None): #The collection has already been defined if self.collections.behavior_collections.has_collection(behavior_collection_name): behavior_collection = self.collections.behavior_collections.get_named_collection(behavior_collection_name) - behavior_collection.add_Behavior(behavior) + behavior_collection.add_behavior(behavior) elif behavior_collection_name == None: if not self.behaviors: self.behaviors = BehaviorList() @@ -562,9 +562,9 @@ def add_behavior(self, behavior, behavior_collection_name = None): def add_named_candidate_indicator_collection(self, collection_name, collection_id = None): """Add a new named Candidate Indicator Collection to the Collections entity in the Bundle.""" - if not self.collections(): + if not self.collections: self.collections = Collections() - if collection_name is not None and collection_id is not None: + if collection_name is not None: self.collections.add_named_candidate_indicator_collection(collection_name, collection_id) def add_candidate_indicator(self, candidate_indicator, candidate_indicator_collection_name = None): diff --git a/maec/test/bundle/bundle_test.py b/maec/test/bundle/bundle_test.py index e0b4db1..898bc8a 100644 --- a/maec/test/bundle/bundle_test.py +++ b/maec/test/bundle/bundle_test.py @@ -5,6 +5,10 @@ from cybox.test import EntityTestCase, round_trip from maec.bundle.bundle import Bundle +from maec.bundle.malware_action import MalwareAction +from cybox.core import Object +from maec.bundle.behavior import Behavior +from maec.bundle.candidate_indicator import CandidateIndicator class TestBundle(EntityTestCase, unittest.TestCase): klass = Bundle @@ -23,5 +27,28 @@ def test_round_trip(self): self.assertEqual(o.to_dict(), o2.to_dict()) + def test_add_collections(self): + o = Bundle() + + o.add_named_action_collection("Actions") + ma = MalwareAction() + o.add_action(ma, "Actions") + self.assertTrue(o.collections.action_collections.has_collection("Actions")) + + o.add_named_object_collection("Objects") + obj = Object() + o.add_object(obj, "Objects") + self.assertTrue(o.collections.object_collections.has_collection("Objects")) + + o.add_named_behavior_collection("Behaviors") + b = Behavior() + o.add_behavior(b, "Behaviors") + self.assertTrue(o.collections.behavior_collections.has_collection("Behaviors")) + + o.add_named_candidate_indicator_collection("Indicators") + ci = CandidateIndicator() + o.add_candidate_indicator(ci, "Indicators") + self.assertTrue(o.collections.candidate_indicator_collections.has_collection("Indicators")) + if __name__ == "__main__": unittest.main() From d34f674db30008d385be612c1205313ffb2e094d Mon Sep 17 00:00:00 2001 From: clenk Date: Mon, 1 Aug 2016 08:04:00 -0400 Subject: [PATCH 271/297] Bump version to 4.1.0.13.dev4 --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index 09e95e6..536195c 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13.dev3" +__version__ = "4.1.0.13.dev4" From 7544a0ac06d526c7807bee37c558367ac3607cc3 Mon Sep 17 00:00:00 2001 From: clenk Date: Tue, 9 Aug 2016 08:21:01 -0400 Subject: [PATCH 272/297] Bump version to v4.1.0.13 --- maec/version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/maec/version.py b/maec/version.py index 536195c..3e11480 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2015, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13.dev4" +__version__ = "4.1.0.13" From 8a8db455e90392ca298e57d72f3f5c08761a8c59 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 11 Aug 2016 08:41:24 -0500 Subject: [PATCH 273/297] Update changelog for v4.1.0.13 --- CHANGES.txt | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGES.txt b/CHANGES.txt index 96b0451..51c740a 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,9 @@ +Version 4.1.0.13 +2016-08-09 +- Add support for Python 3.3+ +- Use 'mixbox' library for features shared with python-cybox and python-stix. +- [#76] [#77] Fix typo bugs in bundle.py + Version 4.1.0.12 2015-04-27 - Added formal vocabulary support (a la python-stix/cybox) From 522cb09d93c689de8e7291d0212c30c0171d0305 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 16 Aug 2016 11:28:56 -0500 Subject: [PATCH 274/297] Update badges to .svg --- README.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.rst b/README.rst index 9c5c15f..ca93564 100644 --- a/README.rst +++ b/README.rst @@ -10,15 +10,15 @@ A Python library for parsing, manipulating, and generating `Malware Attribute En |travis badge| |landscape.io badge| |version badge| |downloads badge| -.. |travis badge| image:: https://api.travis-ci.org/MAECProject/python-maec.png?branch=master +.. |travis badge| image:: https://api.travis-ci.org/MAECProject/python-maec.svg?branch=master :target: https://travis-ci.org/MAECProject/python-maec :alt: Build Status -.. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.png +.. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.svg?style=flat :target: https://landscape.io/github/MAECProject/python-maec/master :alt: Code Health -.. |Version Badge| image:: https://img.shields.io/pypi/v/maec.png?maxAge=2592000 +.. |Version Badge| image:: https://img.shields.io/pypi/v/maec.svg?maxAge=2592000 :target: https://pypi.python.org/pypi/maec/ -.. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.png?maxAge=2592000 +.. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.svg?maxAge=2592000 :target: https://pypi.python.org/pypi/maec/ From dc382107605b80a0aef2814515bacdbaf24fb106 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 16 Aug 2016 11:32:42 -0500 Subject: [PATCH 275/297] Don't cache badges as long [ci skip] --- README.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.rst b/README.rst index ca93564..9a921b6 100644 --- a/README.rst +++ b/README.rst @@ -16,9 +16,9 @@ A Python library for parsing, manipulating, and generating `Malware Attribute En .. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.svg?style=flat :target: https://landscape.io/github/MAECProject/python-maec/master :alt: Code Health -.. |Version Badge| image:: https://img.shields.io/pypi/v/maec.svg?maxAge=2592000 +.. |Version Badge| image:: https://img.shields.io/pypi/v/maec.svg?maxAge=3600 :target: https://pypi.python.org/pypi/maec/ -.. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.svg?maxAge=2592000 +.. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.svg?maxAge=3600 :target: https://pypi.python.org/pypi/maec/ From 3abb3347518a429b875e786ded9a94d157e36dd5 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Tue, 7 Mar 2017 15:16:02 -0600 Subject: [PATCH 276/297] Update Travis notification addresses. --- .travis.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 8445983..87517cb 100644 --- a/.travis.yml +++ b/.travis.yml @@ -23,4 +23,5 @@ branches: notifications: email: - - maec-commits-list@lists.mitre.org + - gback@mitre.org + - stix-commits-list@lists.mitre.org From 8a6e023b42d96ecccfd782487bb07083a110ad73 Mon Sep 17 00:00:00 2001 From: Luigi Mori Date: Mon, 25 Sep 2017 13:14:53 +0200 Subject: [PATCH 277/297] Fix for duplicated collections Signed-off-by: Luigi Mori --- maec/bundle/bundle.py | 1 + 1 file changed, 1 insertion(+) diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 164ce12..6713a77 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -181,6 +181,7 @@ def __init__(self): def to_obj(self, ns_info=None): action_collection_list_obj = super(ActionCollectionList, self).to_obj() + action_collection_list_obj.set_Action_Collection([]) for action_collection in self: if len(action_collection.action_list) > 0: From d6e163367fc5a5ee009934a006277811ddf27f0a Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Thu, 28 Sep 2017 18:20:38 -0400 Subject: [PATCH 278/297] Update Travis CI and Tox configuration --- .gitignore | 1 + .travis.yml | 21 +++++++-------------- tox.ini | 12 ++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.gitignore b/.gitignore index 6061b3c..a04a143 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,7 @@ dist/ *.egg-info .settings/ .project +.idea .pydevproject .tox diff --git a/.travis.yml b/.travis.yml index 87517cb..bd29087 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,26 +1,19 @@ language: python python: - - 3.5 - -env: - - TOXENV=py26 - - TOXENV=py27 - - TOXENV=py33 - - TOXENV=py34 - - TOXENV=py35 - - TOXENV=rhel6 + - "2.6" + - "2.7" + - "3.3" + - "3.4" + - "3.5" + - "3.6" install: - - pip install -U tox + - pip install -U tox-travis script: - tox -branches: - only: - - master - notifications: email: - gback@mitre.org diff --git a/tox.ini b/tox.ini index f1eb433..ce38c8e 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py26, py27, py33, py34, py35, rhel6 +envlist = py26, py27, py33, py34, py35, py36, rhel6 [testenv] commands = @@ -10,7 +10,6 @@ deps = -rrequirements.txt [testenv:rhel6] -basepython=python2.6 commands = nosetests maec deps = @@ -19,3 +18,12 @@ deps = mixbox>=0.0.13 python-dateutil==1.4.1 nose + +[travis] +python = + 2.6: py26, rhel6 + 2.7: py27 + 3.3: py33 + 3.4: py34 + 3.5: py35 + 3.6: py36 From 109d4517b0123a5f01e31c15818f35772d451705 Mon Sep 17 00:00:00 2001 From: Colby Prior Date: Thu, 5 Jul 2018 14:35:04 +1000 Subject: [PATCH 279/297] README.rst had utf-8 encoding --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 56491a7..1d36dd2 100644 --- a/setup.py +++ b/setup.py @@ -20,7 +20,7 @@ def get_version(): raise AttributeError("Package does not have a __version__") -with open('README.rst') as f: +with open('README.rst', encoding='utf-8') as f: readme = f.read() From da63a11cb23d0e2fca5c049f89366e867e051d7d Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 5 Jul 2018 10:01:20 -0500 Subject: [PATCH 280/297] Clean up build/test environments. Drop support for 2.6 and 3.3 --- .travis.yml | 2 -- README.rst | 8 ++++---- setup.py | 15 ++++++++++----- tox.ini | 13 +------------ 4 files changed, 15 insertions(+), 23 deletions(-) diff --git a/.travis.yml b/.travis.yml index bd29087..700bcdb 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,9 +1,7 @@ language: python python: - - "2.6" - "2.7" - - "3.3" - "3.4" - "3.5" - "3.6" diff --git a/README.rst b/README.rst index 9a921b6..dea7835 100644 --- a/README.rst +++ b/README.rst @@ -12,10 +12,10 @@ A Python library for parsing, manipulating, and generating `Malware Attribute En .. |travis badge| image:: https://api.travis-ci.org/MAECProject/python-maec.svg?branch=master :target: https://travis-ci.org/MAECProject/python-maec - :alt: Build Status + :alt: Build Status .. |landscape.io badge| image:: https://landscape.io/github/MAECProject/python-maec/master/landscape.svg?style=flat :target: https://landscape.io/github/MAECProject/python-maec/master - :alt: Code Health + :alt: Code Health .. |Version Badge| image:: https://img.shields.io/pypi/v/maec.svg?maxAge=3600 :target: https://pypi.python.org/pypi/maec/ .. |Downloads Badge| image:: https://img.shields.io/pypi/dm/maec.svg?maxAge=3600 @@ -49,7 +49,7 @@ There are currently two levels of APIs for dealing with MAEC content: Compatibility ------------- -The python-maec library is tested and written against python ``2.6, 2.7, and 3.3+``. Compatibility with other python versions is neither guaranteed nor implied. +The python-maec library is tested against Python 2.7 and 3.4+. Versioning ---------- @@ -76,7 +76,7 @@ The python-maec library is also hosted on `PyPI Dependencies ------------ -The ``maec`` package depends on the following Python libraries: +The ``maec`` package depends on the following Python libraries: * ``lxml`` diff --git a/setup.py b/setup.py index 56491a7..bab5ce8 100644 --- a/setup.py +++ b/setup.py @@ -32,12 +32,12 @@ def get_version(): extras_require = { 'docs': [ - 'Sphinx==1.3.1', - 'sphinx_rtd_theme==0.1.8', + 'Sphinx', + 'sphinx_rtd_theme', ], 'test': [ - "nose==1.3.0", - "tox==1.6.1" + 'nose', + 'tox', ], } @@ -53,7 +53,12 @@ def get_version(): install_requires=install_requires, extras_require=extras_require, classifiers=[ - "Programming Language :: Python", + 'Programming Language :: Python :: 2', + 'Programming Language :: Python :: 2.7', + 'Programming Language :: Python :: 3', + 'Programming Language :: Python :: 3.4', + 'Programming Language :: Python :: 3.5', + 'Programming Language :: Python :: 3.6', "Development Status :: 4 - Beta", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", diff --git a/tox.ini b/tox.ini index ce38c8e..bf42ae9 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py26, py27, py33, py34, py35, py36, rhel6 +envlist = py27,py34,py35,py36 [testenv] commands = @@ -9,21 +9,10 @@ commands = deps = -rrequirements.txt -[testenv:rhel6] -commands = - nosetests maec -deps = - cybox>=2.1.0.13.dev1 - lxml==2.2.3 - mixbox>=0.0.13 - python-dateutil==1.4.1 - nose [travis] python = - 2.6: py26, rhel6 2.7: py27 - 3.3: py33 3.4: py34 3.5: py35 3.6: py36 From da1f251195baf20e7dd78a173f84c61e76c91c2a Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 5 Jul 2018 10:06:16 -0500 Subject: [PATCH 281/297] Remove intersphinx extension from documentation. --- docs/conf.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/conf.py b/docs/conf.py index ab8d807..60022ab 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -11,15 +11,10 @@ 'sphinx.ext.autodoc', 'sphinx.ext.doctest', 'sphinx.ext.ifconfig', - 'sphinx.ext.intersphinx', 'sphinx.ext.viewcode', 'sphinx.ext.napoleon', ] -intersphinx_mapping = { - 'python': ('http://docs.python.org/', None), -} - templates_path = ['_templates'] source_suffix = '.rst' master_doc = 'index' From 6a038521015e8bb081e0855859f67a273f9f1373 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 5 Jul 2018 10:06:33 -0500 Subject: [PATCH 282/297] Ignore whitespace so doctests pass. --- docs/conf.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/conf.py b/docs/conf.py index 60022ab..795f611 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -1,3 +1,4 @@ +import doctest import os import maec @@ -41,3 +42,5 @@ ('index', 'python-maec.tex', u'python-maec Documentation', u'The MITRE Corporation', 'manual'), ] + +doctest_default_flags = doctest.NORMALIZE_WHITESPACE \ No newline at end of file From c2e2d67cd91a5e8afeb80fbadbf5ee8a81797639 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 5 Jul 2018 10:10:00 -0500 Subject: [PATCH 283/297] Update copyright to 2018. --- LICENSE.txt | 4 +-- docs/conf.py | 2 +- maec/__init__.py | 4 +-- maec/analytics/distance.py | 12 ++++----- maec/analytics/static_features.py | 2 +- maec/bindings/maec_bundle.py | 2 +- maec/bindings/maec_container.py | 4 +-- maec/bindings/maec_package.py | 4 +-- maec/bindings/mmdef_1_2.py | 4 +-- maec/bundle/action_reference_list.py | 2 +- maec/bundle/av_classification.py | 6 ++--- maec/bundle/behavior.py | 22 ++++++++-------- maec/bundle/behavior_reference.py | 6 ++--- maec/bundle/bundle.py | 30 +++++++++++----------- maec/bundle/bundle_reference.py | 5 ++-- maec/bundle/candidate_indicator.py | 8 +++--- maec/bundle/capability.py | 2 +- maec/bundle/malware_action.py | 2 +- maec/bundle/object_history.py | 2 +- maec/bundle/object_reference.py | 6 ++--- maec/bundle/process_tree.py | 4 +-- maec/package/action_equivalence.py | 2 +- maec/package/analysis.py | 25 ++++++------------ maec/package/grouping_relationship.py | 12 +++------ maec/package/malware_subject.py | 11 ++++---- maec/package/malware_subject_reference.py | 2 +- maec/package/object_equivalence.py | 4 +-- maec/package/package.py | 11 +++----- maec/test/bundle/av_classification_test.py | 2 +- maec/test/bundle/behavior_test.py | 2 +- maec/test/bundle/bundle_test.py | 2 +- maec/test/bundle/capability_test.py | 2 +- maec/test/bundle/process_tree_test.py | 6 ++--- maec/test/encoding_test.py | 2 +- maec/test/package/analysis_test.py | 6 ++--- maec/test/package/malware_subject_test.py | 3 +-- maec/test/package/package_test.py | 3 +-- maec/test/utils/nsparser_test.py | 2 +- maec/test/utils/parser_test.py | 2 +- maec/utils/__init__.py | 4 +-- maec/utils/deduplicator.py | 2 +- maec/utils/merge.py | 8 +++--- maec/utils/nsparser.py | 2 +- maec/utils/parser.py | 2 +- maec/version.py | 2 +- maec/vocabs/vocabs.py | 2 +- scripts/calculate_distance.py | 8 +++--- setup.py | 2 +- 48 files changed, 121 insertions(+), 143 deletions(-) diff --git a/LICENSE.txt b/LICENSE.txt index fdf626e..a7dd435 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -1,4 +1,4 @@ -Copyright (c) 2015, The MITRE Corporation +Copyright (c) 2018, The MITRE Corporation All rights reserved. Redistribution and use in source and binary forms, with or without @@ -8,7 +8,7 @@ modification, are permitted provided that the following conditions are met: * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the name of The MITRE Corporation nor the + * Neither the name of The MITRE Corporation nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. diff --git a/docs/conf.py b/docs/conf.py index 795f611..37ffa6e 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -4,7 +4,7 @@ import maec project = u'python-maec' -copyright = u'2014, The MITRE Corporation' +copyright = u'2018, The MITRE Corporation' version = maec.__version__ release = version diff --git a/maec/__init__.py b/maec/__init__.py index beece9b..2ad2570 100644 --- a/maec/__init__.py +++ b/maec/__init__.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. from __future__ import absolute_import @@ -29,7 +29,7 @@ def _ns_to_prefix_input_namespaces(self): def to_xml_file(self, file, namespace_dict=None, custom_header=None): """Export an object to an XML file. Only supports Package or Bundle objects at the moment. - + Args: file: the name of a file or a file-like object to write the output to. namespace_dict: a dictionary of mappings of additional XML namespaces to diff --git a/maec/analytics/distance.py b/maec/analytics/distance.py index 12dff90..53609b2 100644 --- a/maec/analytics/distance.py +++ b/maec/analytics/distance.py @@ -1,5 +1,5 @@ # MAEC Distance Measure-related Classes - BETA -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved # See LICENSE.txt for complete terms @@ -139,7 +139,7 @@ def create_object_vector(self, object, static_feature_dict, callback_function = # Callback function parameters : feature name, existing feature value, new feature value elif callback_function: existing_value = static_feature_dict[feature_name] - static_feature_dict[feature_name] = callback_function(feature_name, existing_value, feature_value) + static_feature_dict[feature_name] = callback_function(feature_name, existing_value, feature_value) else: static_feature_dict[feature_name] = feature_value @@ -251,7 +251,7 @@ def bin_list(self, numeric_value, numeric_list, n=10): return bin_vector max_list = max(numeric_list) min_list = min(numeric_list) - bucket_size = (max_list-min_list)/n + bucket_size = (max_list-min_list)/n bin_value = int(math.floor((numeric_value - min_list)/bucket_size)) if bin_value == n: bin_value -= 1 @@ -455,7 +455,7 @@ def create_static_result_vector(self, static_vector): bin = self.bin_list(normalized_value, normalized_items, feature_options_dict['number of bins']) else: bin = self.bin_list(normalized_value, normalized_items) - results_vector.append(bin) + results_vector.append(bin) elif normalized_value is not None: results_vector.append(normalized_value) else: @@ -580,7 +580,7 @@ def calculate(self): self.perform_calculation() def print_distances(self, file_object, default_label = 'md5', delimiter = ','): - '''Print the distances between the Malware Subjects in delimited matrix format + '''Print the distances between the Malware Subjects in delimited matrix format to a File-like object. Try to use the MD5s of the Malware Subjects as the default label. @@ -611,5 +611,3 @@ def print_distances(self, file_object, default_label = 'md5', delimiter = ','): for distance_string in distance_strings: file_object.write(distance_string + "\n") file_object.flush() - - diff --git a/maec/analytics/static_features.py b/maec/analytics/static_features.py index 04f8f03..e95ace8 100644 --- a/maec/analytics/static_features.py +++ b/maec/analytics/static_features.py @@ -1,5 +1,5 @@ # MAEC Static Features List -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved static_features_dict = {'file_name' : {'feature_name' : 'file_name'}, diff --git a/maec/bindings/maec_bundle.py b/maec/bindings/maec_bundle.py index 58782ee..36af803 100644 --- a/maec/bindings/maec_bundle.py +++ b/maec/bindings/maec_bundle.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys diff --git a/maec/bindings/maec_container.py b/maec/bindings/maec_container.py index e80b145..dfe855c 100644 --- a/maec/bindings/maec_container.py +++ b/maec/bindings/maec_container.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys @@ -266,5 +266,5 @@ def main(): GDSClassesMapping = { "ContainerType": ContainerType, - "PackageListType": PackageListType + "PackageListType": PackageListType } diff --git a/maec/bindings/maec_package.py b/maec/bindings/maec_package.py index a26ba3d..a87e803 100644 --- a/maec/bindings/maec_package.py +++ b/maec/bindings/maec_package.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys @@ -1012,7 +1012,7 @@ def __init__(self, id=None, Malware_Instance_Object_Attributes=None, Label=None, self.Malware_Instance_Object_Attributes = Malware_Instance_Object_Attributes self.Configuration_Details = Configuration_Details self.Minor_Variants = Minor_Variants - self.Development_Environment = Development_Environment + self.Development_Environment = Development_Environment self.Field_Data = Field_Data self.Analyses = Analyses self.Findings_Bundles = Findings_Bundles diff --git a/maec/bindings/mmdef_1_2.py b/maec/bindings/mmdef_1_2.py index 3613975..b70d006 100644 --- a/maec/bindings/mmdef_1_2.py +++ b/maec/bindings/mmdef_1_2.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import sys @@ -3256,7 +3256,7 @@ def parse(inFileName): # Enable Python to collect the space used by the DOM. doc = None sys.stdout.write('\n') - rootObj.export(sys.stdout, 0, name_=rootTag, + rootObj.export(sys.stdout, 0, name_=rootTag, namespacedef_='') return rootObj diff --git a/maec/bundle/action_reference_list.py b/maec/bundle/action_reference_list.py index aaf604a..99f417e 100644 --- a/maec/bundle/action_reference_list.py +++ b/maec/bundle/action_reference_list.py @@ -1,6 +1,6 @@ #MAEC Action Reference List Class -#Copyright (c) 2015, The MITRE Corporation +#Copyright (c) 2018, The MITRE Corporation #All rights reserved from cybox.core import ActionReference diff --git a/maec/bundle/av_classification.py b/maec/bundle/av_classification.py index f83700a..1148303 100644 --- a/maec/bundle/av_classification.py +++ b/maec/bundle/av_classification.py @@ -1,5 +1,5 @@ # MAEC AV Classification classes -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from cybox.common import ToolInformation @@ -25,9 +25,9 @@ def to_obj(self, ns_info=None): obj = super(AVClassification, self).to_obj(ns_info=ns_info) if self.engine_version is not None : obj.Engine_Version = self.engine_version - if self.definition_version is not None : + if self.definition_version is not None : obj.Definition_Version = self.definition_version - if self.classification_name is not None : + if self.classification_name is not None : obj.Classification_Name = self.classification_name return obj diff --git a/maec/bundle/behavior.py b/maec/bundle/behavior.py index 07881a3..b4dc62e 100644 --- a/maec/bundle/behavior.py +++ b/maec/bundle/behavior.py @@ -1,6 +1,6 @@ # MAEC Behavior Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -16,7 +16,7 @@ class BehavioralActionEquivalenceReference(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType + _binding_class = bundle_binding.BehavioralActionEquivalenceReferenceType _namespace = _namespace action_equivalence_idref = fields.TypedField('action_equivalence_idref') @@ -24,21 +24,21 @@ class BehavioralActionEquivalenceReference(maec.Entity): class BehavioralActionReference(ActionReference): _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionReferenceType + _binding_class = bundle_binding.BehavioralActionReferenceType _namespace = _namespace behavioral_ordering = fields.TypedField('behavioral_ordering') class BehavioralAction(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionType + _binding_class = bundle_binding.BehavioralActionType _namespace = _namespace behavioral_ordering = fields.TypedField('behavioral_ordering') class BehavioralActions(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehavioralActionsType + _binding_class = bundle_binding.BehavioralActionsType _namespace = _namespace #TODO: action_collection.type_ is set below to avoid circular import. @@ -55,7 +55,7 @@ class PlatformList(maec.EntityList): class CVEVulnerability(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.CVEVulnerabilityType + _binding_class = bundle_binding.CVEVulnerabilityType _namespace = _namespace cve_id = fields.TypedField('cve_id') @@ -63,9 +63,9 @@ class CVEVulnerability(maec.Entity): class Exploit(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.ExploitType + _binding_class = bundle_binding.ExploitType _namespace = _namespace - + known_vulnerability = fields.TypedField('known_vulnerability') cve = fields.TypedField('CVE', CVEVulnerability) cwe_id = fields.TypedField('CWE_ID', multiple=True) @@ -73,7 +73,7 @@ class Exploit(maec.Entity): class BehaviorPurpose(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehaviorPurposeType + _binding_class = bundle_binding.BehaviorPurposeType _namespace = _namespace description = fields.TypedField('Description') @@ -81,13 +81,13 @@ class BehaviorPurpose(maec.Entity): class AssociatedCode(maec.EntityList): _binding = bundle_binding - _binding_class = bundle_binding.AssociatedCodeType + _binding_class = bundle_binding.AssociatedCodeType _namespace = _namespace code_snippet = fields.TypedField("Code_Snippet", Code, multiple=True) class Behavior(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehaviorType + _binding_class = bundle_binding.BehaviorType _namespace = _namespace id_ = fields.TypedField('id') diff --git a/maec/bundle/behavior_reference.py b/maec/bundle/behavior_reference.py index 3c74a15..c9eca18 100644 --- a/maec/bundle/behavior_reference.py +++ b/maec/bundle/behavior_reference.py @@ -1,6 +1,6 @@ # MAEC Behavior Reference Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -8,10 +8,10 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding - + class BehaviorReference(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.BehaviorReferenceType + _binding_class = bundle_binding.BehaviorReferenceType _namespace = _namespace behavior_idref = fields.TypedField("behavior_idref") diff --git a/maec/bundle/bundle.py b/maec/bundle/bundle.py index 6713a77..f4aad2a 100644 --- a/maec/bundle/bundle.py +++ b/maec/bundle/bundle.py @@ -1,6 +1,6 @@ # MAEC Bundle Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -32,7 +32,7 @@ class ActionList(maec.EntityList): _binding_class = bundle_binding.ActionListType _namespace = _namespace action = fields.TypedField("Action", MalwareAction, multiple=True) - + class ObjectList(maec.EntityList): _binding_class = bundle_binding.ObjectListType @@ -386,9 +386,9 @@ def add_named_action_collection(self, collection_name, collection_id = None): self.collections = Collections() if collection_name is not None: self.collections.add_named_action_collection(collection_name, collection_id) - + def add_action(self, action, action_collection_name = None): - """Add an Action to an existing named Action Collection in the Collections entity. + """Add an Action to an existing named Action Collection in the Collections entity. If it does not exist, add it to the top-level Actions entity.""" if action_collection_name is not None and self.collections: #The collection has already been defined @@ -406,7 +406,7 @@ def add_named_object_collection(self, collection_name, collection_id = None): self.collections = Collections() if collection_name is not None: self.collections.add_named_object_collection(collection_name, collection_id) - + def get_all_actions(self, bin = False): """Return a list of all Actions in the Bundle.""" all_actions = [] @@ -414,7 +414,7 @@ def get_all_actions(self, bin = False): if self.actions: for action in self.actions: all_actions.append(action) - + if self.collections and self.collections.action_collections: for collection in self.collections.action_collections: for action in collection.action_list: @@ -446,7 +446,7 @@ def get_all_actions_on_object(self, object): return object_actions def add_object(self, object, object_collection_name = None): - """Add an Object to an existing named Object Collection in the Collections entity. + """Add an Object to an existing named Object Collection in the Collections entity. If it does not exist, add it to the top-level Object entity.""" if object_collection_name is not None and self.collections: #The collection has already been defined @@ -468,7 +468,7 @@ def get_all_objects(self, include_actions = False): if obj.related_objects: for related_obj in obj.related_objects: all_objects.append(related_obj) - + if self.collections and self.collections.object_collections: for collection in self.collections.object_collections: for obj in collection.object_list: @@ -510,7 +510,7 @@ def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): for action in self.actions: if action.id_ == id: return action - + if action.associated_objects: for associated_obj in action.associated_objects: if associated_obj.id_ == id: @@ -520,7 +520,7 @@ def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): for action in collection.action_list: if action.id_ == id: return action - + if action.associated_objects: for associated_obj in action.associated_objects: if associated_obj.id_ == id: @@ -530,7 +530,7 @@ def get_object_by_id(self, id, extra_objects = [], ignore_actions = False): if obj.id_ == id: return obj - if self.collections and self.collections.object_collections: + if self.collections and self.collections.object_collections: for collection in self.collections.object_collections: for obj in collection.object_list: if obj.id_ == id: @@ -549,7 +549,7 @@ def add_named_behavior_collection(self, collection_name, collection_id = None): self.collections.add_named_behavior_collection(collection_name, collection_id) def add_behavior(self, behavior, behavior_collection_name = None): - """Add a Behavior to an existing named Behavior Collection in the Collections entity. + """Add a Behavior to an existing named Behavior Collection in the Collections entity. If it does not exist, add it to the top-level Behaviors entity.""" if behavior_collection_name is not None and self.collections: #The collection has already been defined @@ -569,7 +569,7 @@ def add_named_candidate_indicator_collection(self, collection_name, collection_i self.collections.add_named_candidate_indicator_collection(collection_name, collection_id) def add_candidate_indicator(self, candidate_indicator, candidate_indicator_collection_name = None): - """Add a Candidate Indicator to an existing named Candidate Indicator Collection in the Collections entity. + """Add a Candidate Indicator to an existing named Candidate Indicator Collection in the Collections entity. If it does not exist, add it to the top-level Candidate Indicators entity.""" if candidate_indicator_collection_name is not None and self.collections: #The collection has already been defined @@ -580,9 +580,9 @@ def add_candidate_indicator(self, candidate_indicator, candidate_indicator_colle if not self.candidate_indicators: self.candidate_indicators = CandidateIndicatorList() self.candidate_indicators.append(candidate_indicator) - + def deduplicate(self): - """Deduplicate all Objects in the Bundle. + """Deduplicate all Objects in the Bundle. Add duplicate Objects to new "Deduplicated Objects" Object Collection, and replace duplicate entries with references to corresponding Object.""" BundleDeduplicator.deduplicate(self) diff --git a/maec/bundle/bundle_reference.py b/maec/bundle/bundle_reference.py index 3fa97f0..fc1806e 100644 --- a/maec/bundle/bundle_reference.py +++ b/maec/bundle/bundle_reference.py @@ -1,6 +1,6 @@ #MAEC Bundle Reference Class -#Copyright (c) 2015, The MITRE Corporation +#Copyright (c) 2018, The MITRE Corporation #All rights reserved from mixbox import fields @@ -8,7 +8,7 @@ import maec from . import _namespace import maec.bindings.maec_bundle as bundle_binding - + class BundleReference(maec.Entity): _namespace = _namespace _binding = bundle_binding @@ -19,4 +19,3 @@ class BundleReference(maec.Entity): def __init__(self, bundle_idref = None): super(BundleReference, self).__init__() self.bundle_idref = bundle_idref - diff --git a/maec/bundle/candidate_indicator.py b/maec/bundle/candidate_indicator.py index b95cc56..5c23574 100644 --- a/maec/bundle/candidate_indicator.py +++ b/maec/bundle/candidate_indicator.py @@ -1,6 +1,6 @@ # MAEC Candidate Indicator Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -15,7 +15,7 @@ class MalwareEntity(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.MalwareEntityType + _binding_class = bundle_binding.MalwareEntityType _namespace = _namespace type_ = fields.TypedField("Type", VocabString) @@ -27,7 +27,7 @@ def __init__(self): class CandidateIndicatorComposition(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.CandidateIndicatorCompositionType + _binding_class = bundle_binding.CandidateIndicatorCompositionType _namespace = _namespace operator = fields.TypedField("operator") @@ -44,7 +44,7 @@ def __init__(self): class CandidateIndicator(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.CandidateIndicatorType + _binding_class = bundle_binding.CandidateIndicatorType _namespace = _namespace id_ = fields.TypedField("id") diff --git a/maec/bundle/capability.py b/maec/bundle/capability.py index 47bc6eb..86a9ac9 100644 --- a/maec/bundle/capability.py +++ b/maec/bundle/capability.py @@ -1,6 +1,6 @@ # MAEC Capability Classes -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields diff --git a/maec/bundle/malware_action.py b/maec/bundle/malware_action.py index a9d09f5..5500841 100644 --- a/maec/bundle/malware_action.py +++ b/maec/bundle/malware_action.py @@ -1,6 +1,6 @@ # MAEC Malware Action Classes -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields diff --git a/maec/bundle/object_history.py b/maec/bundle/object_history.py index df56ddf..c6a7706 100644 --- a/maec/bundle/object_history.py +++ b/maec/bundle/object_history.py @@ -1,6 +1,6 @@ # MAEC Object History Classes -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved class ObjectHistory(object): diff --git a/maec/bundle/object_reference.py b/maec/bundle/object_reference.py index dbf9dcd..b085977 100644 --- a/maec/bundle/object_reference.py +++ b/maec/bundle/object_reference.py @@ -1,13 +1,13 @@ # MAEC Object Reference Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields import maec from . import _namespace -import maec.bindings.maec_bundle as bundle_binding +import maec.bindings.maec_bundle as bundle_binding class ObjectReference(maec.Entity): _binding = bundle_binding @@ -17,7 +17,7 @@ class ObjectReference(maec.Entity): def __init__(self, object_idref = None): super(ObjectReference, self).__init__() self.object_idref = object_idref - + class ObjectReferenceList(maec.EntityList): _binding_class = bundle_binding.ObjectReferenceListType _namespace = _namespace diff --git a/maec/bundle/process_tree.py b/maec/bundle/process_tree.py index f99599b..c854e63 100644 --- a/maec/bundle/process_tree.py +++ b/maec/bundle/process_tree.py @@ -1,6 +1,6 @@ # MAEC Process Tree classes -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -110,7 +110,7 @@ def set_parent_action(self, parent_action_id): class ProcessTree(maec.Entity): _binding = bundle_binding - _binding_class = bundle_binding.ProcessTreeType + _binding_class = bundle_binding.ProcessTreeType _namespace = _namespace root_process = fields.TypedField("Root_Process", ProcessTreeNode) diff --git a/maec/package/action_equivalence.py b/maec/package/action_equivalence.py index f9513bb..e467fe0 100644 --- a/maec/package/action_equivalence.py +++ b/maec/package/action_equivalence.py @@ -1,6 +1,6 @@ #MAEC Action Equivalence Class -#Copyright (c) 2015, The MITRE Corporation +#Copyright (c) 2018, The MITRE Corporation #All rights reserved from mixbox import fields diff --git a/maec/package/analysis.py b/maec/package/analysis.py index 9905e97..d8e6a17 100644 --- a/maec/package/analysis.py +++ b/maec/package/analysis.py @@ -1,6 +1,6 @@ # MAEC Analysis Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -25,7 +25,7 @@ class Source(maec.Entity): reference = fields.TypedField("Reference") organization = fields.TypedField("Organization") url = fields.TypedField("URL") - + def __init__(self): super(Source, self).__init__() @@ -44,9 +44,9 @@ def __init__(self, value=None): def is_plain(self): """Whether this can be represented as a string rather than a dictionary """ - return (super(Comment, self).is_plain() and + return (super(Comment, self).is_plain() and self.author is None and - self.timestamp is None and + self.timestamp is None and self.observation_name is None) def to_obj(self, ns_info=None): @@ -123,7 +123,7 @@ class DynamicAnalysisMetadata(maec.Entity): analysis_duration = fields.TypedField("Analysis_Duration") exit_code = fields.TypedField("Exit_Code") #raised_exception = fields.TypedField("Raised_Exception", MalwareException) - + def __init__(self): super(DynamicAnalysisMetadata, self).__init__() @@ -136,12 +136,12 @@ class HypervisorHostSystem(System): def __init__(self): super(HypervisorHostSystem, self).__init__() - + class InstalledPrograms(maec.EntityList): _binding_class = package_binding.InstalledProgramsType _namespace = _namespace program = fields.TypedField("Program", PlatformSpecification, multiple=True) - + class AnalysisSystem(System): _binding = package_binding _binding_class = package_binding.AnalysisSystemType @@ -235,18 +235,9 @@ def __init__(self, id = None, method = None, type = None, findings_bundle_refere # set the findings_bundle_reference values; accepts a list of bundle ID values def set_findings_bundle(self, bundle_id): self.findings_bundle_reference = [BundleReference.from_dict({'bundle_idref' : bundle_id})] - + # add a tool to this Anaysis's ToolList def add_tool(self, tool): if not self.tools: self.tools = ToolList() self.tools.append(tool) - - - - - - - - - diff --git a/maec/package/grouping_relationship.py b/maec/package/grouping_relationship.py index ea1aaf2..2e29813 100644 --- a/maec/package/grouping_relationship.py +++ b/maec/package/grouping_relationship.py @@ -1,13 +1,13 @@ # MAEC Grouping Relationship Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields import maec from . import _namespace -import maec.bindings.maec_package as package_binding +import maec.bindings.maec_package as package_binding from maec.package.malware_subject_reference import MalwareSubjectReference from cybox.common import vocabs from maec.vocabs.vocabs import GroupingRelationship as GroupingRelationshipVocab @@ -16,7 +16,7 @@ class ClusterEdgeNodePair(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusterEdgeNodePairType _namespace = _namespace - + similarity_index = fields.TypedField("similarity_index") similarity_distance = fields.TypedField("similarity_distance") malware_subject_node_a = fields.TypedField("Malware_Subject_Node_A", MalwareSubjectReference) @@ -29,7 +29,7 @@ class ClusterComposition(maec.Entity): _binding = package_binding _binding_class = package_binding.ClusterCompositionType _namespace = _namespace - + score_type = fields.TypedField("score_type") edge_node_pair = fields.TypedField("Edge_Node_Pair", ClusterEdgeNodePair, multiple=True) @@ -79,7 +79,3 @@ class GroupingRelationshipList(maec.EntityList): _binding_class = package_binding.GroupingRelationshipListType _namespace = _namespace grouping_relationship = fields.TypedField("Grouping_Relationship", GroupingRelationship, multiple=True) - - - - diff --git a/maec/package/malware_subject.py b/maec/package/malware_subject.py index 7115aa4..9938285 100644 --- a/maec/package/malware_subject.py +++ b/maec/package/malware_subject.py @@ -1,6 +1,6 @@ # MAEC Malware Subject Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -15,7 +15,7 @@ from . import _namespace import maec.bindings.maec_package as package_binding from maec.bundle import Bundle -from maec.package import (ActionEquivalenceList, Analysis, +from maec.package import (ActionEquivalenceList, Analysis, MalwareSubjectReference, ObjectEquivalenceList) from maec.vocabs.vocabs import MalwareLabel from maec.vocabs.vocabs import MalwareConfigurationParameter as MalwareConfigParameterVocab @@ -25,7 +25,7 @@ class MinorVariants(maec.EntityList): _binding_class = package_binding.MinorVariantListType _namespace = _namespace minor_variant = fields.TypedField("Minor_Variant", Object, multiple=True) - + class Analyses(maec.EntityList): _binding_class = package_binding.AnalysisListType _namespace = _namespace @@ -235,11 +235,10 @@ def normalize_bundles(self): all_bundles = self.get_all_bundles() for bundle in all_bundles: bundle.normalize_objects() - + class MalwareSubjectList(maec.EntityList): _binding_class = package_binding.MalwareSubjectListType #_binding_var = "Malware_Subject" _namespace = _namespace - + malware_subject = fields.TypedField("Malware_Subject", MalwareSubject, multiple=True) - \ No newline at end of file diff --git a/maec/package/malware_subject_reference.py b/maec/package/malware_subject_reference.py index de3b897..aadaf1d 100644 --- a/maec/package/malware_subject_reference.py +++ b/maec/package/malware_subject_reference.py @@ -1,6 +1,6 @@ # MAEC Malware Subject Reference Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields diff --git a/maec/package/object_equivalence.py b/maec/package/object_equivalence.py index 78135c1..12a44d4 100644 --- a/maec/package/object_equivalence.py +++ b/maec/package/object_equivalence.py @@ -1,6 +1,6 @@ # MAEC Action Equivalence Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -8,7 +8,7 @@ import maec from . import _namespace import maec.bindings.maec_package as package_binding -from maec.bundle import ObjectReference +from maec.bundle import ObjectReference class ObjectEquivalence(maec.Entity): _binding = package_binding diff --git a/maec/package/package.py b/maec/package/package.py index 2337587..9fa8119 100644 --- a/maec/package/package.py +++ b/maec/package/package.py @@ -1,6 +1,6 @@ # MAEC Package Class -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved from mixbox import fields @@ -14,7 +14,7 @@ class Package(maec.Entity): _binding = package_binding _binding_class = package_binding.PackageType - _namespace = _namespace + _namespace = _namespace id_ = fields.TypedField('id') timestamp = fields.TypedField('timestamp') @@ -38,7 +38,7 @@ def __init__(self, id = None, schema_version = "2.1", timestamp = None): #Add a malware subject to this Package def add_malware_subject(self, malware_subject): self.malware_subjects.append(malware_subject) - + #Add a grouping relationship def add_grouping_relationship(self, grouping_relationship): if not self.grouping_relationships: @@ -59,7 +59,7 @@ def from_xml(xml_file): parser = EntityParser() maec_package = parser.parse_xml(xml_file) maec_package_obj = maec_package.to_obj() - + return (maec_package, maec_package_obj) # Transform duplicate objects within this Package into references pointing to a single canonical object @@ -67,6 +67,3 @@ def deduplicate_malware_subjects(self): """DeDuplicate all Malware_Subjects in the Package. For now, only handles Objects in Findings Bundles""" for malware_subject in self.malware_subjects: malware_subject.deduplicate_bundles() - - - diff --git a/maec/test/bundle/av_classification_test.py b/maec/test/bundle/av_classification_test.py index 9ce1e9d..3c34a03 100644 --- a/maec/test/bundle/av_classification_test.py +++ b/maec/test/bundle/av_classification_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest diff --git a/maec/test/bundle/behavior_test.py b/maec/test/bundle/behavior_test.py index 36d95ba..ebbf3e7 100644 --- a/maec/test/bundle/behavior_test.py +++ b/maec/test/bundle/behavior_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest diff --git a/maec/test/bundle/bundle_test.py b/maec/test/bundle/bundle_test.py index 898bc8a..04e01fd 100644 --- a/maec/test/bundle/bundle_test.py +++ b/maec/test/bundle/bundle_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest diff --git a/maec/test/bundle/capability_test.py b/maec/test/bundle/capability_test.py index ff2d139..1efe5ca 100644 --- a/maec/test/bundle/capability_test.py +++ b/maec/test/bundle/capability_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest diff --git a/maec/test/bundle/process_tree_test.py b/maec/test/bundle/process_tree_test.py index ee5016d..a52f625 100644 --- a/maec/test/bundle/process_tree_test.py +++ b/maec/test/bundle/process_tree_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest @@ -43,13 +43,13 @@ def test_round_trip(self): spawned_child2 = ProcessTreeNode() injected_child = ProcessTreeNode() spawned_grandchild = ProcessTreeNode() - + o.set_root_process(root) root.add_spawned_process(spawned_child1) root.add_spawned_process(spawned_child2) root.add_injected_process(injected_child) spawned_child1.add_spawned_process(spawned_grandchild) - + o2 = round_trip(o, True) self.assertEqual(o.to_dict(), o2.to_dict()) diff --git a/maec/test/encoding_test.py b/maec/test/encoding_test.py index 9f6ea69..0a41506 100644 --- a/maec/test/encoding_test.py +++ b/maec/test/encoding_test.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. """Tests for various encoding issues throughout the library""" diff --git a/maec/test/package/analysis_test.py b/maec/test/package/analysis_test.py index 5b575e7..5583bfc 100644 --- a/maec/test/package/analysis_test.py +++ b/maec/test/package/analysis_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest @@ -33,9 +33,9 @@ def test_round_trip(self): o.source.organization = "ThreatExpert" o.source.method = "triage" o.source.url = "http://www.threatexpert.com" - + o.start_datetime = "2014-08-06T18:30:00" - + o2 = round_trip(o, True) self.assertEqual(o.to_dict(), o2.to_dict()) diff --git a/maec/test/package/malware_subject_test.py b/maec/test/package/malware_subject_test.py index 834b236..4b21890 100644 --- a/maec/test/package/malware_subject_test.py +++ b/maec/test/package/malware_subject_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest @@ -69,4 +69,3 @@ def test_round_trip(self): if __name__ == "__main__": unittest.main() - \ No newline at end of file diff --git a/maec/test/package/package_test.py b/maec/test/package/package_test.py index 7c14707..e2f0034 100644 --- a/maec/test/package/package_test.py +++ b/maec/test/package/package_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest @@ -69,4 +69,3 @@ def test_round_trip(self): if __name__ == "__main__": unittest.main() - diff --git a/maec/test/utils/nsparser_test.py b/maec/test/utils/nsparser_test.py index b48911d..6215e12 100644 --- a/maec/test/utils/nsparser_test.py +++ b/maec/test/utils/nsparser_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import unittest diff --git a/maec/test/utils/parser_test.py b/maec/test/utils/parser_test.py index 42812a7..c69cb0c 100644 --- a/maec/test/utils/parser_test.py +++ b/maec/test/utils/parser_test.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. from mixbox.vendor.six import StringIO diff --git a/maec/utils/__init__.py b/maec/utils/__init__.py index 0fa8e93..ef331dc 100644 --- a/maec/utils/__init__.py +++ b/maec/utils/__init__.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved """MAEC utility methods""" @@ -24,4 +24,4 @@ def flip_dict(d): from .deduplicator import BundleDeduplicator # noqa #Ensure MAEC namespaces get registered -from .nsparser import * # noqa +from .nsparser import * # noqa diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index 846acdf..b10f1d0 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -1,5 +1,5 @@ # MAEC Bundle Deduplicator Module -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved # See LICENSE.txt for complete terms diff --git a/maec/utils/merge.py b/maec/utils/merge.py index 137cad4..b7258cc 100644 --- a/maec/utils/merge.py +++ b/maec/utils/merge.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. """Methods for merging MAEC documents""" @@ -25,7 +25,7 @@ def dict_merge(target, *args): for obj in args: dict_merge(target, obj) return target - + # Recursively merge dicts and set non-dict values obj = args[0] if not isinstance(obj, dict): @@ -104,7 +104,7 @@ def bin_malware_subjects(malware_subject_list, default_hash_type='md5'): hash_type = str(hash.type_).lower() # Get the hash value hash_value = str(hash.simple_hash_value).lower() - + # Check the hash type and bin accordingly if hash_type == default_hash_type: if hash_value in binned_subjects: @@ -210,7 +210,7 @@ def update_relationships(malware_subject_list, id_mappings): '''Update any existing Malware Subject relationships to account for merged Malware Subjects''' for malware_subject in malware_subject_list: if malware_subject.relationships: - relationships = malware_subject.relationships + relationships = malware_subject.relationships for relationship in relationships: malware_subject_references = relationship.malware_subject_references for malware_subject_reference in malware_subject_references: diff --git a/maec/utils/nsparser.py b/maec/utils/nsparser.py index 24a0ae0..a1c0647 100644 --- a/maec/utils/nsparser.py +++ b/maec/utils/nsparser.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation +# Copyright (c) 2018, The MITRE Corporation # All rights reserved # Compatible with MAEC v4.1 diff --git a/maec/utils/parser.py b/maec/utils/parser.py index b330980..efedc3d 100644 --- a/maec/utils/parser.py +++ b/maec/utils/parser.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import mixbox.parser diff --git a/maec/version.py b/maec/version.py index 3e11480..29afaf1 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. __version__ = "4.1.0.13" diff --git a/maec/vocabs/vocabs.py b/maec/vocabs/vocabs.py index 44eeed2..b06e7dd 100644 --- a/maec/vocabs/vocabs.py +++ b/maec/vocabs/vocabs.py @@ -1,4 +1,4 @@ -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. from cybox.common.vocabs import VocabString, register_vocab diff --git a/scripts/calculate_distance.py b/scripts/calculate_distance.py index fa8f279..0677f56 100644 --- a/scripts/calculate_distance.py +++ b/scripts/calculate_distance.py @@ -3,7 +3,7 @@ # NOTE: This code imports and uses the maec.analytics.distance module, which uses the external numpy library. # Numpy can be found here: https://pypi.python.org/pypi/numpy -# Copyright (c) 2015, The MITRE Corporation. All rights reserved. +# Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. import os @@ -26,7 +26,7 @@ def main(): # Parse the input files if args.l: - for file in args.l: + for file in args.l: api_obj = maec.parse_xml_instance(file)['api'] if isinstance(api_obj, Package): package_list.append(api_obj) @@ -51,7 +51,7 @@ def main(): out_file = open(args.output, mode='w') dist.print_distances(out_file) out_file.close() - + if __name__ == "__main__": - main() \ No newline at end of file + main() \ No newline at end of file diff --git a/setup.py b/setup.py index bab5ce8..ba86c5f 100644 --- a/setup.py +++ b/setup.py @@ -1,6 +1,6 @@ #!/usr/bin/env python -# Copyright (c) 2015 - The MITRE Corporation +# Copyright (c) 2018 - The MITRE Corporation # For license information, see the LICENSE.txt file from os.path import abspath, dirname, join From 2747c4a7fa6d51e8f63994d508fc84a78083a2e7 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Thu, 5 Jul 2018 10:19:04 -0500 Subject: [PATCH 284/297] Support opening a file with a given encoding on Python 2.7. --- setup.py | 1 + 1 file changed, 1 insertion(+) diff --git a/setup.py b/setup.py index 4e48f0e..a7b2a60 100644 --- a/setup.py +++ b/setup.py @@ -3,6 +3,7 @@ # Copyright (c) 2018 - The MITRE Corporation # For license information, see the LICENSE.txt file +from io import open # Allow `encoding` kwarg on Python 2.7 from os.path import abspath, dirname, join From 97b8dd266d4871e38a3efb035be5232c642102a0 Mon Sep 17 00:00:00 2001 From: Greg Back <1045796+gtback@users.noreply.github.com> Date: Wed, 1 Aug 2018 12:16:13 -0400 Subject: [PATCH 285/297] Update notification email [skip ci] --- .travis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 700bcdb..cef4100 100644 --- a/.travis.yml +++ b/.travis.yml @@ -14,5 +14,4 @@ script: notifications: email: - - gback@mitre.org - - stix-commits-list@lists.mitre.org + - stix-commits-list@groups.mitre.org From b1f5adf28acb51cfd5f55bf50b7f1c41254de064 Mon Sep 17 00:00:00 2001 From: Greg Back Date: Fri, 3 Aug 2018 09:12:44 -0500 Subject: [PATCH 286/297] Bump version to 4.1.0.14 --- CHANGES.txt | 7 +++++++ maec/version.py | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGES.txt b/CHANGES.txt index 51c740a..587bbc0 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,10 @@ +Version 4.1.0.14 +2018-08-03 +- Drop support for Python 2.6, 3.3 +- [#91] Don't duplicate Action Collections (@jtschichold) +- [#93] Handle non-ASCII characters in README (@colbyprior) +- Various packaging, testing, and other non-functional improvements + Version 4.1.0.13 2016-08-09 - Add support for Python 3.3+ diff --git a/maec/version.py b/maec/version.py index 29afaf1..57eb63f 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.13" +__version__ = "4.1.0.14" From 34ecc99467f2544bc8242d606758c84f4a05c59b Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Fri, 6 Sep 2019 16:37:09 -0400 Subject: [PATCH 287/297] update project test harness and requirements --- .travis.yml | 11 ++++++----- setup.cfg | 2 ++ setup.py | 31 ++++++++++++++++++------------- tox.ini | 9 ++++++--- 4 files changed, 32 insertions(+), 21 deletions(-) create mode 100644 setup.cfg diff --git a/.travis.yml b/.travis.yml index cef4100..1f090c2 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,17 +1,18 @@ language: python - +sudo: false # Since this is an older project, this is not the default. +cache: pip +dist: xenial python: - "2.7" - "3.4" - "3.5" - "3.6" - + - "3.7" install: - - pip install -U tox-travis - + - pip install -U pip setuptools + - pip install tox-travis script: - tox - notifications: email: - stix-commits-list@groups.mitre.org diff --git a/setup.cfg b/setup.cfg new file mode 100644 index 0000000..2be6836 --- /dev/null +++ b/setup.cfg @@ -0,0 +1,2 @@ +[bdist_wheel] +universal = True diff --git a/setup.py b/setup.py index a7b2a60..66f55ca 100644 --- a/setup.py +++ b/setup.py @@ -3,7 +3,7 @@ # Copyright (c) 2018 - The MITRE Corporation # For license information, see the LICENSE.txt file -from io import open # Allow `encoding` kwarg on Python 2.7 + from os.path import abspath, dirname, join @@ -12,6 +12,7 @@ BASE_DIR = dirname(abspath(__file__)) VERSION_FILE = join(BASE_DIR, 'maec', 'version.py') + def get_version(): with open(VERSION_FILE) as f: for line in f.readlines(): @@ -21,14 +22,16 @@ def get_version(): raise AttributeError("Package does not have a __version__") -with open('README.rst', encoding='utf-8') as f: - readme = f.read() +def get_long_description(): + with open('README.rst') as f: + return f.read() install_requires = [ - 'lxml>=2.2.3', - 'mixbox>=0.0.13', - 'cybox>=2.1.0.13.dev1,<2.1.1.0', + 'lxml>=2.2.3 ; python_version == "2.7" or python_version >= "3.5"', + 'lxml>=2.2.3,<4.4.0 ; python_version > "2.7" and python_version < "3.5"', + 'mixbox>=1.0.2', + 'cybox>=2.1.0.13,<2.1.1.0', ] extras_require = { @@ -48,18 +51,20 @@ def get_version(): author="MAEC Project", author_email="maec@mitre.org", description="An API for parsing and creating MAEC content.", - long_description=readme, + long_description=get_long_description(), url="http://maec.mitre.org", packages=find_packages(), install_requires=install_requires, extras_require=extras_require, + license="BSD", classifiers=[ - 'Programming Language :: Python :: 2', - 'Programming Language :: Python :: 2.7', - 'Programming Language :: Python :: 3', - 'Programming Language :: Python :: 3.4', - 'Programming Language :: Python :: 3.5', - 'Programming Language :: Python :: 3.6', + "Programming Language :: Python :: 2", + "Programming Language :: Python :: 2.7", + "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3.4", + "Programming Language :: Python :: 3.5", + "Programming Language :: Python :: 3.6", + "Programming Language :: Python :: 3.7", "Development Status :: 4 - Beta", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", diff --git a/tox.ini b/tox.ini index bf42ae9..0b520ed 100644 --- a/tox.ini +++ b/tox.ini @@ -1,14 +1,16 @@ [tox] -envlist = py27,py34,py35,py36 +envlist = py27,py34,py35,py36,py37 [testenv] commands = nosetests maec - sphinx-build -b doctest docs docs/_build/doctest - sphinx-build -b html docs docs/_build/html deps = -rrequirements.txt +[testenv:docs] +commands = + sphinx-build -W -b doctest -d {envtmpdir}/doctrees docs {envtmpdir}/doctest + sphinx-build -W -b html -d {envtmpdir}/doctrees docs {envtmpdir}/html [travis] python = @@ -16,3 +18,4 @@ python = 3.4: py34 3.5: py35 3.6: py36 + 3.7: py37 From 5a79efda05f3834057a6201daad90ef545504d18 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Fri, 6 Sep 2019 16:54:45 -0400 Subject: [PATCH 288/297] =?UTF-8?q?Bump=20version:=204.1.0.14=20=E2=86=92?= =?UTF-8?q?=204.1.0.15?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGES.txt | 4 ++++ maec/version.py | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGES.txt b/CHANGES.txt index 587bbc0..01c9e7c 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,7 @@ +Version 4.1.0.15 +2019-09-06 +- Update project requirements + Version 4.1.0.14 2018-08-03 - Drop support for Python 2.6, 3.3 diff --git a/maec/version.py b/maec/version.py index 57eb63f..9f86a64 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.14" +__version__ = "4.1.0.15" From 755f7d6b159d89472dbf2f36bdd0f382197028fe Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Tue, 17 Sep 2019 12:37:01 -0400 Subject: [PATCH 289/297] revert changes to read long_description --- setup.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup.py b/setup.py index 66f55ca..c8a445c 100644 --- a/setup.py +++ b/setup.py @@ -3,7 +3,7 @@ # Copyright (c) 2018 - The MITRE Corporation # For license information, see the LICENSE.txt file - +from io import open # Allow `encoding` kwarg on Python 2.7 from os.path import abspath, dirname, join @@ -23,7 +23,7 @@ def get_version(): def get_long_description(): - with open('README.rst') as f: + with open('README.rst', encoding='utf-8') as f: return f.read() From f7fb3b8b07b73c34ccd603a2fb419df4e3409574 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Tue, 17 Sep 2019 12:52:58 -0400 Subject: [PATCH 290/297] update README and project configuration --- CHANGES.txt | 4 ++++ setup.cfg | 9 +++++++++ 2 files changed, 13 insertions(+) diff --git a/CHANGES.txt b/CHANGES.txt index 01c9e7c..55721f9 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,7 @@ +Version 4.1.0.16 +2019-09-17 +- [#96] Fix problem when installing from Python 2.7 + Version 4.1.0.15 2019-09-06 - Update project requirements diff --git a/setup.cfg b/setup.cfg index 2be6836..30041d8 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,2 +1,11 @@ +[bumpversion] +current_version = 4.1.0.15 +parse = (?P\d+)\.(?P\d+)\.(?P\d+).(?P\d+) +serialize = {major}.{minor}.{patch}.{release} +commit = True +tag = True + +[bumpversion:file:maec/version.py] + [bdist_wheel] universal = True From 0990cc448f106193e82085a752219e6fd2cffad5 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Tue, 17 Sep 2019 12:57:32 -0400 Subject: [PATCH 291/297] =?UTF-8?q?Bump=20version:=204.1.0.15=20=E2=86=92?= =?UTF-8?q?=204.1.0.16?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- maec/version.py | 2 +- setup.cfg | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/maec/version.py b/maec/version.py index 9f86a64..26571b3 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.15" +__version__ = "4.1.0.16" diff --git a/setup.cfg b/setup.cfg index 30041d8..4b24ed4 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 4.1.0.15 +current_version = 4.1.0.16 parse = (?P\d+)\.(?P\d+)\.(?P\d+).(?P\d+) serialize = {major}.{minor}.{patch}.{release} commit = True @@ -9,3 +9,4 @@ tag = True [bdist_wheel] universal = True + From be639280ab479a99bd000594efeccca37ba4d10e Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Wed, 18 Sep 2019 09:55:55 -0400 Subject: [PATCH 292/297] Update setup.cfg --- setup.cfg | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/setup.cfg b/setup.cfg index 4b24ed4..d481174 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,7 +1,7 @@ [bumpversion] current_version = 4.1.0.16 -parse = (?P\d+)\.(?P\d+)\.(?P\d+).(?P\d+) -serialize = {major}.{minor}.{patch}.{release} +parse = (?P\d+)\.(?P\d+)\.(?P\d+).(?P\d+) +serialize = {major}.{minor}.{patch}.{revision} commit = True tag = True @@ -9,4 +9,3 @@ tag = True [bdist_wheel] universal = True - From 8711d23b5752bbabac62474faa8fb89320a3f636 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Wed, 18 Sep 2019 10:35:55 -0400 Subject: [PATCH 293/297] update documentation, add new test environments for harness --- README.rst | 4 ++-- docs/getting_started.rst | 2 +- docs/index.rst | 6 +++--- setup.cfg | 2 ++ tox.ini | 12 +++++++++--- 5 files changed, 17 insertions(+), 9 deletions(-) diff --git a/README.rst b/README.rst index dea7835..2ef5d63 100644 --- a/README.rst +++ b/README.rst @@ -1,10 +1,10 @@ python-maec =========== -A Python library for parsing, manipulating, and generating `Malware Attribute Enumeration and Characterization (MAEC™) `_ content. +A Python library for parsing, manipulating, and generating `Malware Attribute Enumeration and Characterization (MAEC™) `_ v4.1 content. :Source: https://github.com/MAECProject/python-maec -:Documentation: http://maec.readthedocs.org +:Documentation: https://maec.readthedocs.io/ :Information: https://maecproject.github.io/ :Download: https://pypi.python.org/pypi/maec/ diff --git a/docs/getting_started.rst b/docs/getting_started.rst index ed5570e..069c224 100644 --- a/docs/getting_started.rst +++ b/docs/getting_started.rst @@ -23,7 +23,7 @@ Once you have installed python-maec, you can begin writing Python applications t .. note:: - The *python-maec* library provides **bindings** and **APIs**, both of which can be used to parse and write MAEC XML files. For in-depth description of the *APIs, bindings, and the differences between the two*, please refer to :doc:`api_vs_bindings/index` + The *python-maec* library provides **bindings** and **APIs**, both of which can be used to parse and write MAEC XML files. For in-depth description of the *APIs, bindings, and the differences between the two*, please refer to :doc:`api_vs_bindings/index` Creating a MAEC Package *********************** diff --git a/docs/index.rst b/docs/index.rst index f667181..c140535 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -15,13 +15,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.12 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.16 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.12 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.12 +__ https://pypi.python.org/pypi/maec/4.1.0.16 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.16 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 diff --git a/setup.cfg b/setup.cfg index d481174..632bb88 100644 --- a/setup.cfg +++ b/setup.cfg @@ -7,5 +7,7 @@ tag = True [bumpversion:file:maec/version.py] +[bumpversion:file:docs/index.rst] + [bdist_wheel] universal = True diff --git a/tox.ini b/tox.ini index 0b520ed..3c839d3 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py27,py34,py35,py36,py37 +envlist = py27, py34, py35, py36, py37, docs, packaging [testenv] commands = @@ -12,10 +12,16 @@ commands = sphinx-build -W -b doctest -d {envtmpdir}/doctrees docs {envtmpdir}/doctest sphinx-build -W -b html -d {envtmpdir}/doctrees docs {envtmpdir}/html +[testenv:packaging] +deps = + readme_renderer +commands = + python setup.py check -r -s + [travis] python = - 2.7: py27 + 2.7: py27, docs, packaging 3.4: py34 3.5: py35 - 3.6: py36 + 3.6: py36, docs, packaging 3.7: py37 From 2da84ee607e18be8d44b50c768a97e967c650b66 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Wed, 18 Sep 2019 13:27:27 -0400 Subject: [PATCH 294/297] Update setup.py --- setup.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/setup.py b/setup.py index c8a445c..72a4dd4 100644 --- a/setup.py +++ b/setup.py @@ -52,7 +52,7 @@ def get_long_description(): author_email="maec@mitre.org", description="An API for parsing and creating MAEC content.", long_description=get_long_description(), - url="http://maec.mitre.org", + url="https://maecproject.github.io/", packages=find_packages(), install_requires=install_requires, extras_require=extras_require, @@ -69,5 +69,10 @@ def get_long_description(): "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Operating System :: OS Independent", - ] + ], + project_urls={ + 'Documentation': 'https://maec.readthedocs.io/', + 'Source Code': 'https://github.com/MAECProject/python-maec/', + 'Bug Tracker': 'https://github.com/MAECProject/python-maec/issues/', + }, ) From bbcfccd8ef4fe12b625f1a8b2ebeafa1de88d01d Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Mon, 16 Nov 2020 16:46:08 -0500 Subject: [PATCH 295/297] changes to prevent deprecation warnings --- maec/utils/comparator.py | 4 ++-- maec/utils/deduplicator.py | 4 ++-- setup.py | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/maec/utils/comparator.py b/maec/utils/comparator.py index 50e43fd..8aea9aa 100644 --- a/maec/utils/comparator.py +++ b/maec/utils/comparator.py @@ -1,5 +1,5 @@ # MAEC Comparator Classes -import collections +from mixbox import compat class ComparisonResult(object): def __init__(self, bundle_list, lookup_table): @@ -154,7 +154,7 @@ def get_val(cls, obj, typed_field, hash_val, nested_elements = None): val = getattr(obj.properties, str(typed_field)) if val is not None: hash_val += str(typed_field) + ":" - if isinstance(val, collections.MutableSequence): + if isinstance(val, compat.MutableSequence): for list_item in val: if '/' in str(nested_elements[0]): hash_val += '[' diff --git a/maec/utils/deduplicator.py b/maec/utils/deduplicator.py index b10f1d0..7b96fa3 100644 --- a/maec/utils/deduplicator.py +++ b/maec/utils/deduplicator.py @@ -4,9 +4,9 @@ # See LICENSE.txt for complete terms -import collections import copy +from mixbox import compat from mixbox import entities from cybox.core import RelatedObject, AssociatedObject @@ -179,7 +179,7 @@ def get_typedfield_values(cls, val, name, values, ignoreCase=False): # If the value is a mutable sequence, attempt to find TypedFields as # in each item. EntityLists are Entity subclasses that can have # TypedFields, so we don't make this an elif. - if isinstance(val, collections.MutableSequence): + if isinstance(val, compat.MutableSequence): for list_item in val: cls.get_typedfield_values(list_item, name, values, ignoreCase) diff --git a/setup.py b/setup.py index 72a4dd4..0d36427 100644 --- a/setup.py +++ b/setup.py @@ -30,7 +30,7 @@ def get_long_description(): install_requires = [ 'lxml>=2.2.3 ; python_version == "2.7" or python_version >= "3.5"', 'lxml>=2.2.3,<4.4.0 ; python_version > "2.7" and python_version < "3.5"', - 'mixbox>=1.0.2', + 'mixbox>=1.0.4', 'cybox>=2.1.0.13,<2.1.1.0', ] From 58b4160c81981527bc21831e5027b308b851f1c5 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Mon, 16 Nov 2020 16:51:59 -0500 Subject: [PATCH 296/297] update CI and project requirements --- .travis.yml | 3 ++- CHANGES.txt | 4 ++++ setup.cfg | 3 +++ setup.py | 1 + tox.ini | 3 ++- 5 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 1f090c2..e99e66d 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,5 +1,5 @@ +os: linux language: python -sudo: false # Since this is an older project, this is not the default. cache: pip dist: xenial python: @@ -8,6 +8,7 @@ python: - "3.5" - "3.6" - "3.7" + - "3.8" install: - pip install -U pip setuptools - pip install tox-travis diff --git a/CHANGES.txt b/CHANGES.txt index 55721f9..6c2de9a 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,3 +1,7 @@ +Version 4.1.0.17 +2020-11-16 +- Remove deprecation warning for collections module + Version 4.1.0.16 2019-09-17 - [#96] Fix problem when installing from Python 2.7 diff --git a/setup.cfg b/setup.cfg index 632bb88..85d2e45 100644 --- a/setup.cfg +++ b/setup.cfg @@ -9,5 +9,8 @@ tag = True [bumpversion:file:docs/index.rst] +[metadata] +license_file = LICENSE.txt + [bdist_wheel] universal = True diff --git a/setup.py b/setup.py index 0d36427..da68f08 100644 --- a/setup.py +++ b/setup.py @@ -65,6 +65,7 @@ def get_long_description(): "Programming Language :: Python :: 3.5", "Programming Language :: Python :: 3.6", "Programming Language :: Python :: 3.7", + "Programming Language :: Python :: 3.8", "Development Status :: 4 - Beta", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", diff --git a/tox.ini b/tox.ini index 3c839d3..d50a0b4 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = py27, py34, py35, py36, py37, docs, packaging +envlist = py27, py34, py35, py36, py37, py38, docs, packaging [testenv] commands = @@ -25,3 +25,4 @@ python = 3.5: py35 3.6: py36, docs, packaging 3.7: py37 + 3.8: py38 From 13e66105c9646156060d0896a4d54970ea358f44 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Mon, 16 Nov 2020 16:56:36 -0500 Subject: [PATCH 297/297] =?UTF-8?q?Bump=20version:=204.1.0.16=20=E2=86=92?= =?UTF-8?q?=204.1.0.17?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/index.rst | 6 +++--- maec/version.py | 2 +- setup.cfg | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/index.rst b/docs/index.rst index c140535..47a49af 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -15,13 +15,13 @@ version of MAEC. ============ =================== MAEC Version python-maec Version ============ =================== -4.1 4.1.0.16 (`PyPI`__) (`GitHub`__) +4.1 4.1.0.17 (`PyPI`__) (`GitHub`__) 4.0 4.0.1.0 (`PyPI`__) (`GitHub`__) 3.0 3.0.0b1 (`PyPI`__) (`GitHub`__) ============ =================== -__ https://pypi.python.org/pypi/maec/4.1.0.16 -__ https://github.com/MAECProject/python-maec/tree/v4.1.0.16 +__ https://pypi.python.org/pypi/maec/4.1.0.17 +__ https://github.com/MAECProject/python-maec/tree/v4.1.0.17 __ https://pypi.python.org/pypi/maec/4.0.1.0 __ https://github.com/MAECProject/python-maec/tree/v4.0.1.0 __ https://pypi.python.org/pypi/maec/3.0.0b1 diff --git a/maec/version.py b/maec/version.py index 26571b3..b87b594 100644 --- a/maec/version.py +++ b/maec/version.py @@ -1,4 +1,4 @@ # Copyright (c) 2018, The MITRE Corporation. All rights reserved. # See LICENSE.txt for complete terms. -__version__ = "4.1.0.16" +__version__ = "4.1.0.17" diff --git a/setup.cfg b/setup.cfg index 85d2e45..395669c 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 4.1.0.16 +current_version = 4.1.0.17 parse = (?P\d+)\.(?P\d+)\.(?P\d+).(?P\d+) serialize = {major}.{minor}.{patch}.{revision} commit = True @@ -14,3 +14,4 @@ license_file = LICENSE.txt [bdist_wheel] universal = True +