On 7/16/12 7:22 PM, Michael Palmiotto wrote:
>> +<!-- Check not referenced in any Rule
>> + <select
>> idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
>> selected="true"/>
>> +-->
>> +<!-- Value not referenced in any Rules
>> + <refine-value
>> idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
>> selector="enabled"/>
>> +-->
>> It's called out on
>> scap-security-guide/RHEL6/input/system/network/kernel.xml:295
> Consider me totally out of the loop at this point, and transforms might
> address this, but isn't this snippet for a different ID?
> Thanks
> --Spencer
I think you're actually both right and the blame lies in my court.
Shawn was probably looking at the patch cover letter, while Spencer was
looking at the diff.
Let me clear this up. The cover letter for my patch reflects the wrong
idref (ie bogus_error_responses rather than bogus_error_messages).
It was intended to say, "[PATCH] Commented out unreferenced
sysctl_net_ipv4_icmp_ignore_bogus_error_messages check/value."
I am still not seeing the bogus_error_messages check/value being
referenced in any Rules.
My apologies for the confusion.
Actually, looks like you found something much more fun.
[shawn@rhel6 input]$ grep -rni "set_sysctl_net_ipv4_icmp_ignore_bogus" *
profiles/common.xml:62:<select
idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
system/network/kernel.xml:295:<Rule
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
In kernel.xml:295, we have:
<Rule
id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
.... here the title should be "... Error Responses"
And then in common.xml we have:
<select
idref="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
selected="true"/>
.... this really should be
"...bogus_error_responses"
And then we have
checks/sysctl_net_ipv4_icmp_ignore_bogus_error_messages.xml, which
should be deleted.
I'll make a quick patch for this.