Added system-characteristics data-flow constraints and tests (#724)

features/fedramp_extensions.feature

@@ -59,6 +59,24 @@ Examples:
   | has-authorization-boundary-diagram-link-rel-allowed-value-PASS.yaml |
   | has-configuration-management-plan-FAIL.yaml |
   | has-configuration-management-plan-PASS.yaml |
+  | has-data-flow-FAIL.yaml |
+  | has-data-flow-PASS.yaml |
+  | has-data-flow-description-FAIL.yaml |
+  | has-data-flow-description-PASS.yaml |
+  | has-data-flow-diagram-FAIL.yaml |
+  | has-data-flow-diagram-PASS.yaml |
+  | has-data-flow-diagram-caption-FAIL.yaml |
+  | has-data-flow-diagram-caption-PASS.yaml |
+  | has-data-flow-diagram-description-FAIL.yaml |
+  | has-data-flow-diagram-description-PASS.yaml |
+  | has-data-flow-diagram-link-FAIL.yaml |
+  | has-data-flow-diagram-link-PASS.yaml |
+  | has-data-flow-diagram-link-rel-FAIL.yaml |
+  | has-data-flow-diagram-link-rel-PASS.yaml |
+  | has-data-flow-diagram-link-rel-allowed-value-FAIL.yaml |
+  | has-data-flow-diagram-link-rel-allowed-value-PASS.yaml |
+  | has-data-flow-diagram-uuid-FAIL.yaml |
+  | has-data-flow-diagram-uuid-PASS.yaml |
   | has-federation-assurance-level-FAIL.yaml |
   | has-federation-assurance-level-PASS.yaml |
   | has-identity-assurance-level-FAIL.yaml |
@@ -150,6 +168,15 @@ Examples:
   | has-authorization-boundary-diagram-link-rel |
   | has-authorization-boundary-diagram-link-rel-allowed-value |
   | has-configuration-management-plan |
+  | has-data-flow |
+  | has-data-flow-description |
+  | has-data-flow-diagram |
+  | has-data-flow-diagram-caption |
+  | has-data-flow-diagram-description |
+  | has-data-flow-diagram-link |
+  | has-data-flow-diagram-link-rel |
+  | has-data-flow-diagram-link-rel-allowed-value |
+  | has-data-flow-diagram-uuid |
   | has-federation-assurance-level |
   | has-identity-assurance-level |
   | has-incident-response-plan |

src/validations/constraints/content/ssp-all-VALID.xml

@@ -132,6 +132,18 @@
         <caption>Network Diagram</caption>
       </diagram>
     </network-architecture>
+    <data-flow>
+      <description>
+        <p>A holistic, top-level explanation of the system's data flows.</p>
+      </description>
+      <diagram uuid="e3b98448-4219-46a5-b229-412423c566f3">
+        <description>
+          <p>A diagram-specific explanation.</p>
+        </description>
+        <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram"/>
+        <caption>Data Flow Diagram</caption>
+      </diagram>
+    </data-flow>
   </system-characteristics>
 
   <system-implementation>

src/validations/constraints/content/ssp-has-data-flow-INVALID.xml

@@ -0,0 +1,4 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-description-INVALID.xml

@@ -0,0 +1,6 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-INVALID.xml

@@ -0,0 +1,6 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-caption-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-description-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-link-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-link-rel-INVALID.xml

@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547"/>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-link-rel-allowed-value-INVALID.xml

@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="not-diagram"/>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-data-flow-diagram-uuid-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+    <data-flow>
+      <diagram>
+      </diagram>
+    </data-flow>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -110,6 +110,33 @@
             <expect id="has-network-architecture-diagram-link-rel-allowed-value" target="system-characteristics/network-architecture/diagram/link" test="@rel eq 'diagram'" level="ERROR">
                 <message>Each FedRAMP SSP network architecture diagram must have a link rel attribute with the value "diagram".</message>
             </expect>
+            <expect id="has-data-flow" target="system-characteristics" test="data-flow" level="WARNING">
+                <message>A FedRAMP SSP must include a data flow section.</message>
+            </expect>
+            <expect id="has-data-flow-diagram" target="system-characteristics/data-flow" test="diagram" level="ERROR">
+                <message>A FedRAMP SSP must have at least one data flow diagram.</message>
+            </expect>
+            <expect id="has-data-flow-description" target="system-characteristics/data-flow" test="description" level="ERROR">
+                <message>An OSCAL SSP document with a data flow must have a description.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-uuid" target="system-characteristics/data-flow/diagram" test="@uuid" level="ERROR">
+                <message>An OSCAL SSP document with a data flow diagram must have a unique identifier.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-description" target="system-characteristics/data-flow/diagram" test="description" level="ERROR">
+                <message>Each FedRAMP SSP data flow diagram must have a description.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-link" target="system-characteristics/data-flow/diagram" test="link" level="ERROR">
+                <message>Each FedRAMP SSP data flow diagram must have a link.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-caption" target="system-characteristics/data-flow/diagram" test="caption" level="ERROR">
+                <message>Each FedRAMP SSP data flow diagram must have a caption.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-link-rel" target="system-characteristics/data-flow/diagram/link" test="@rel" level="ERROR">
+                <message>Each FedRAMP SSP data flow diagram must have a link rel attribute.</message>
+            </expect>
+            <expect id="has-data-flow-diagram-link-rel-allowed-value" target="system-characteristics/data-flow/diagram/link" test="@rel eq 'diagram'" level="ERROR">
+                <message>Each FedRAMP SSP data flow diagram must have a link rel attribute with the value "diagram".</message>
+            </expect>
         </constraints>
     </context>
     <context>

src/validations/constraints/unit-tests/has-data-flow-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow
+  description: Test that system-characteristics does not have a data-flow element.
+  content: ../content/ssp-has-data-flow-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow
+  description: Test that system-characteristics has a data-flow element.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-description-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-description
+  description: Test that data-flow does not have a description.
+  content: ../content/ssp-has-data-flow-description-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-description
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-description-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-description
+  description: Test that data-flow does not have a description.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-description
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram
+  description: Test that data-flow does not have a diagram.
+  content: ../content/ssp-has-data-flow-diagram-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram
+  description: Test that data-flow has a diagram.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-caption-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-caption
+  description: Test that data-flow diagram does not have a caption.
+  content: ../content/ssp-has-data-flow-diagram-caption-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-caption
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-caption-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-caption
+  description: Test that data-flow diagram has a caption.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-caption
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-description-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-description
+  description: Test that data-flow diagram does not have a description.
+  content: ../content/ssp-has-data-flow-diagram-description-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-description
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-description-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-description
+  description: Test that data-flow diagram has a description.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-description
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-link-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-link
+  description: Test that data-flow diagram does not have a link.
+  content: ../content/ssp-has-data-flow-diagram-link-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-link-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-link
+  description: Test that data-flow diagram has a link.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-link-rel-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-link-rel
+  description: Test that data-flow diagram link does not have a rel attribute.
+  content: ../content/ssp-has-data-flow-diagram-link-rel-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link-rel
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-link-rel-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-link-rel
+  description: Test that data-flow diagram link has a rel attribute.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link-rel
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-link-rel-allowed-value-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-link-rel-allowed-value
+  description: Test that data-flow diagram link rel attribute does not equal "diagram".
+  content: ../content/ssp-has-data-flow-diagram-link-rel-allowed-value-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link-rel-allowed-value
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-link-rel-allowed-value-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-link-rel-allowed-value
+  description: Test that data-flow diagram link rel attribute equals "diagram".
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-link-rel-allowed-value
+      result: pass

src/validations/constraints/unit-tests/has-data-flow-diagram-uuid-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-data-flow-diagram-uuid
+  description: Test that data-flow diagram does not have a uuid attribute.
+  content: ../content/ssp-has-data-flow-diagram-uuid-INVALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-uuid
+      result: fail

src/validations/constraints/unit-tests/has-data-flow-diagram-uuid-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-data-flow-diagram-uuid
+  description: Test that data-flow diagram has a uuid attribute.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-data-flow-diagram-uuid
+      result: pass