CODEWITHSUNDEEP
c#linqxml-parsinglinq-to-xmlnessus
Chris
Chris

Reputation: 934

Linq XML Xelement with Namespace Returns Null

I am parsing an .nessus file generated from an offline config file audit. I've set up a Linq for the ReportItem node and verified the namespace works, but when I try to get the cm:compliance-solution value it returns null (verified there is a value in this element also).

This is the Linq I'm using--fixText variable is the problem (verified by commenting out all others)

XElement xelement = XElement.Load(fileName);
IEnumerable<XElement> findings = xelement.Elements();
XNamespace ns = xelement.GetNamespaceOfPrefix("cm");

var findingDetails = from f in findings.Descendants("ReportItem")
             select new
                 {
                      title = f.Element(ns + "compliance-check-name").Value,
                      description = f.Element("description").Value,
                      vulLevel = f.Element(ns + "compliance-result").Value,
                      fixText = f.Element(ns + "compliance-solution").Value,
                      testID = f.Element(ns + "compliance-check-id").Value,
                      source = f.Element(ns + "compliance-audit-file").Value
                 };

Here is a sample .nessus file I'm working form:

<?xml version="1.0" ?>
<NessusClientData_v2 xmlns:cm="http://www.nessus.org/cm">
<Policy><policyName>Offline Config Audit</policyName>
</Policy>
<Report name="Router">
<ReportHost name="router-001.config"><HostProperties>
<tag name="source_type">offline_audit</tag>
<tag name="source_name">Cisco</tag>
<tag name="operating-system">Cisco IOS</tag>
<tag name="host-fqdn">router-001</tag>
<tag name="HOST_END">Fri Jun 29 09:56:38 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="2" pluginID="46689" pluginName="Cisco IOS Compliance Checks" pluginFamily="Policy Compliance">
<compliance>true</compliance>
<fname>cisco_compliance_check.nbin</fname>
<plugin_modification_date>2018/05/31</plugin_modification_date>
<plugin_name>Cisco IOS Compliance Checks</plugin_name>
<plugin_publication_date>2010/05/17</plugin_publication_date>
<plugin_type>local</plugin_type>
<risk_factor>None</risk_factor>
<script_version>$Revision: 1.278 $</script_version>
<cm:compliance-check-name>NET-VLAN-024 - Restricted VLAN not assigned to non-802.1x device.</cm:compliance-check-name>
<description>&quot;NET-VLAN-024 - Restricted VLAN not assigned to non-802.1x device.&quot; : [WARNING] The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

 A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

 NOTE: This check is derived from the L3 switch guidance, if the scan target is a router the check can be ignored.
 NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution : 

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

See Also : 

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R28_STIG.zip

Reference(s) : 

8500.2|ECND-2,CAT|II,Rule-ID|SV-20089r1_rule,STIG-ID|NET-VLAN-024,Vuln-ID|V-18545 </description>
<cm:compliance-audit-file>DISA_STIG_Cisco_Perimeter_Router_L3_Switch_V8R28.audit</cm:compliance-audit-file>
<cm:compliance-check-id>acfebcd97143973eabbc5132d9035dcc</cm:compliance-check-id>
<cm:compliance-info>The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

 A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

 NOTE: This check is derived from the L3 switch guidance, if the scan target is a router the check can be ignored.
 NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
</cm:compliance-info>
<cm:compliance-result>WARNING</cm:compliance-result>
<cm:compliance-reference>8500.2|ECND-2,CAT|II,Rule-ID|SV-20089r1_rule,STIG-ID|NET-VLAN-024,Vuln-ID|V-18545
</cm:compliance-reference>
<cm:compliance-solution>Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.
</cm:compliance-solution>
<cm:compliance-see-also>https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R28_STIG.zip
</cm:compliance-see-also>
</ReportItem>
</ReportHost>
</Report>
</NessusClientData_v2>

Error Details:

System.NullReferenceException
HResult=0x80004003
Message=Object reference not set to an instance of an object.

Upvotes: 0

Views: 160

Answers (1)

Matija Hrženjak
Matija Hrženjak

Reputation: 176

I ran your code against the example and everything went fine.

Try using ?.Value in the select part to find the null values easier.

Upvotes: 1

Related Questions