search

commoncriteria / transforms

Repository for various transforms that are common across CC projects.
The Unlicense
1 stars 2 forks source link

Base-PP descriptor missing in Modified SFRs headings/text and Consistency Rationale headings #110

Open jfisherbah opened 5 months ago

jfisherbah commented 5 months ago

The HTML versions of PP-Modules are currently referencing themselves and their own product type in the Modified SFRs sections of the Module rather than the Base-PP and product type they are supposed to be referencing.

See for example sections 5.1 and 5.2 of https://commoncriteria.github.io/wlanclient/master/wlanclient.html. They both say "WLAN Clients PP Security Functional Requirements Direction" when one should reference the GPOS PP and the other should reference the MDF PP, like the published PDF version of the Module does (https://www.niap-ccevs.org/MMO/PP/MOD_WLANC_v1.0.pdf). Note however that the PDF version does still have an issue where it missing the product descriptor in the actual body text (see for example "...the security functions implemented by the as a whole..." rather than e.g. "...the security functions implemented by the operating system as a whole..."

The HTML versions of PP-Modules are currently referencing themselves in the Consistency Rationale sections of the Module rather than the Base-PP they are supposed to be referencing (though the body text is all correct in this case).

See for example sections 6.1 and 6.2 of of https://commoncriteria.github.io/wlanclient/master/wlanclient.html where the heading titles are wrong for the same reason, but in this case the body text is correct.

jfisherbah commented 5 months ago

Note that without checking exhaustively I can say that this only applies to some Modules and not others or that the issue manifests itself differently elsewhere so it could also just be an XML syntax error. For example, https://commoncriteria.github.io/vpnclient/master/vpnclient.html is incorrect but for different reasons that wlanclient is, but MACsec is correct.

robertmclemons commented 5 months ago

The work-around for the heading problem is to fully specify the base-pp in the <base-pp> tag. e.g.:

<base-pp id="bpp-gpos" name="Protection Profile for General Purpose Operating System" product="Operating System" short="gp os" version="4.3">

I haven't been able to figure out the real problem, so this is the way. I'm not sure how many of the other problems this fixes.