You are totally right. Should get back to regex classes.
Does this look better?
13c13
< <criterion test_ref="test_20135" />
---
<criterion test_ref="test_20135"
negate="true"/>
25c25
< <ind:subexpression
operation="equals">static</ind:subexpression>
---
<ind:subexpression operation="pattern
match">^(dhcp|bootp)$</ind:subexpression>
Thanks!
--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shane Shaffer
Sent: quarta-feira, 10 de Julho de 2013 15:58
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: Patch to
"RHEL6/input/checks/sysconfig_networking_bootproto_ifcfg.xml"
While I can't comment on whether the intent is right or wrong, I don't think the
suggested regular expression is quite correct. It may be giving you the result you
expected, but probably not for the right reason. Inside the [] the (, ), and | characters
lose their significance, so effectively that pattern is [^bcdhopt()|]. A value of
"static" would pass based on the s, a, or i characters. "none" would
pass because of the n or e characters. "dhcp" and "bootp" fail
because they contain only characters that are not permitted. But "pchd" would
also fail, as would any other permutation of the ten characters in the character class.
If you really want to allow anything other than "dhcp" or "bootp" it
is probably easiest to use something like ^(dhcp|bootp)$ and then negate the test.
Shane Shaffer
G2, Inc.
shane.shaffer@g2-inc.com<mailto:shane.shaffer@g2-inc.com>
On Wed, Jul 10, 2013 at 7:17 AM, Rui Pedro Bernardino
<rui-p-bernardino@ptinovacao.pt<mailto:rui-p-bernardino@ptinovacao.pt>>
wrote:
Hi all,
I think there's a mistake on how sysconfig_networking_bootproto_ifcfg checks whether
dhcp client is enabled. According to RHEL6 docs, BOOTPROTO should be one of
"none", "bootp" or "dhcp" and not "static";
/sbin/ifup assumes static IP configuration unless either "dhcp" or
"bootp" is specified.
I suggest altering the check from 'equals to "static"' to
'anything but "dhcp" or "bootp"', which matches how it will be
applied.
*** 22,28 ****
</ind:textfilecontent54_test>
<ind:textfilecontent54_state id="state_20135"
version="1">
! <ind:subexpression
operation="equals">static</ind:subexpression>
</ind:textfilecontent54_state>
<ind:textfilecontent54_object id="obj_20135"
version="1">
--- 22,28 ----
</ind:textfilecontent54_test>
<ind:textfilecontent54_state id="state_20135"
version="1">
! <ind:subexpression operation="pattern
match">[^(dhcp|bootp)]</ind:subexpression>
</ind:textfilecontent54_state>
<ind:textfilecontent54_object id="obj_20135"
version="1">
Regards
--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide