diff --git a/stix2/v21/__init__.py b/stix2/v21/__init__.py index 77a28ee..70f2a79 100644 --- a/stix2/v21/__init__.py +++ b/stix2/v21/__init__.py @@ -21,7 +21,7 @@ from .bundle import Bundle from .common import ( TLP_AMBER, TLP_GREEN, TLP_RED, TLP_WHITE, CustomMarking, ExternalReference, GranularMarking, KillChainPhase, LanguageContent, MarkingDefinition, - StatementMarking, TLPMarking, + StatementMarking, STIXExtension, TLPMarking, ) from .observables import ( URL, AlternateDataStream, ArchiveExt, Artifact, AutonomousSystem, @@ -65,6 +65,7 @@ OBJ_MAP = { 'threat-actor': ThreatActor, 'tool': Tool, 'sighting': Sighting, + 'stix-extension': STIXExtension, 'vulnerability': Vulnerability, } @@ -121,7 +122,7 @@ __all__ = """ TLP_AMBER, TLP_GREEN, TLP_RED, TLP_WHITE, CustomMarking, ExternalReference, GranularMarking, KillChainPhase, LanguageContent, MarkingDefinition, - StatementMarking, TLPMarking, + StatementMarking, STIXExtension, TLPMarking, URL, AlternateDataStream, ArchiveExt, Artifact, AutonomousSystem, CustomExtension, CustomObservable, Directory, DomainName, EmailAddress, diff --git a/stix2/v21/base.py b/stix2/v21/base.py index 8b5a5f1..830a209 100644 --- a/stix2/v21/base.py +++ b/stix2/v21/base.py @@ -6,7 +6,11 @@ from ..base import ( class _STIXBase21(_STIXBase): - pass + + def __init__(self, **kwargs): + if 'extensions' in self._properties: + self._properties['extensions'].allow_custom = kwargs.get('allow_custom', False) + super(_STIXBase21, self).__init__(**kwargs) class _Observable(_Observable, _STIXBase21): diff --git a/stix2/v21/common.py b/stix2/v21/common.py index eae0865..60c4068 100644 --- a/stix2/v21/common.py +++ b/stix2/v21/common.py @@ -197,12 +197,13 @@ class MarkingDefinition(_STIXBase21, _MarkingsMixin): ('id', IDProperty(_type, spec_version='2.1')), ('created_by_ref', ReferenceProperty(valid_types='identity', spec_version='2.1')), ('created', TimestampProperty(default=lambda: NOW, precision='millisecond', precision_constraint='min')), - ('definition_type', StringProperty(required=True)), + ('definition_type', StringProperty()), ('name', StringProperty()), - ('definition', MarkingProperty(required=True)), + ('definition', MarkingProperty()), ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def __init__(self, **kwargs): diff --git a/stix2/v21/sdo.py b/stix2/v21/sdo.py index a359aa6..d538852 100644 --- a/stix2/v21/sdo.py +++ b/stix2/v21/sdo.py @@ -12,9 +12,10 @@ from ..exceptions import ( InvalidValueError, PropertyPresenceError, STIXDeprecationWarning, ) from ..properties import ( - BooleanProperty, EnumProperty, FloatProperty, IDProperty, IntegerProperty, - ListProperty, ObservableProperty, PatternProperty, ReferenceProperty, - StringProperty, TimestampProperty, TypeProperty, + BooleanProperty, EnumProperty, ExtensionsProperty, FloatProperty, + IDProperty, IntegerProperty, ListProperty, ObservableProperty, + PatternProperty, ReferenceProperty, StringProperty, TimestampProperty, + TypeProperty, ) from ..utils import NOW from .base import _DomainObject @@ -45,6 +46,7 @@ class AttackPattern(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -74,6 +76,7 @@ class Campaign(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -109,6 +112,7 @@ class CourseOfAction(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -136,6 +140,7 @@ class Grouping(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -165,6 +170,7 @@ class Identity(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -197,6 +203,7 @@ class Indicator(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def __init__(self, *args, **kwargs): @@ -254,6 +261,7 @@ class Infrastructure(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -296,6 +304,7 @@ class IntrusionSet(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -340,6 +349,7 @@ class Location(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -449,6 +459,7 @@ class Malware(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -504,6 +515,7 @@ class MalwareAnalysis(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -536,6 +548,7 @@ class Note(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -564,6 +577,7 @@ class ObservedData(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def __init__(self, *args, **kwargs): @@ -628,6 +642,7 @@ class Opinion(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -656,6 +671,7 @@ class Report(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -692,6 +708,7 @@ class ThreatActor(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) def _check_object_constraints(self): @@ -731,6 +748,7 @@ class Tool(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -756,6 +774,7 @@ class Vulnerability(_DomainObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) @@ -807,6 +826,7 @@ def CustomObject(type='x-custom-type', properties=None): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=type)), ], sorted([x for x in properties if x[0].startswith('x_')], key=lambda x: x[0]), ])) diff --git a/stix2/v21/sro.py b/stix2/v21/sro.py index d287373..d0e07f8 100644 --- a/stix2/v21/sro.py +++ b/stix2/v21/sro.py @@ -3,8 +3,9 @@ from collections import OrderedDict from ..properties import ( - BooleanProperty, IDProperty, IntegerProperty, ListProperty, - ReferenceProperty, StringProperty, TimestampProperty, TypeProperty, + BooleanProperty, ExtensionsProperty, IDProperty, IntegerProperty, + ListProperty, ReferenceProperty, StringProperty, TimestampProperty, + TypeProperty, ) from ..utils import NOW from .base import _RelationshipObject @@ -39,6 +40,7 @@ class Relationship(_RelationshipObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) # Explicitly define the first three kwargs to make readable Relationship declarations. @@ -95,6 +97,7 @@ class Sighting(_RelationshipObject): ('external_references', ListProperty(ExternalReference)), ('object_marking_refs', ListProperty(ReferenceProperty(valid_types='marking-definition', spec_version='2.1'))), ('granular_markings', ListProperty(GranularMarking)), + ('extensions', ExtensionsProperty(spec_version='2.1', enclosing_type=_type)), ]) # Explicitly define the first kwargs to make readable Sighting declarations.