<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 12/9/13, 3:48 PM, Rodney L. Mercer
      wrote:<br>
    </div>
    <blockquote cite="mid:1386622133.2799.32.camel@osc145" type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">When "Rule ID: kernel_module_ipv6_option_disabled" passes, "Rule ID:
sysctl_ipv6_default_accept_redirects" is doomed to failure.

I've figured out a fix for the failure of "Rule ID:
sysctl_ipv6_default_accept_redirects CCE-27166-8",
when "Rule ID: kernel_module_ipv6_option_disabled CCE-27153-6"
passes test.


I've attached the diff output between my changes and the original of the
sysctl_net_ipv6_conf_default_accept_redirects.xml file contents.

Unfortunately, the sysctl_net_ipv6_conf_default_accept_redirects.xml
file is generated by: create_sysctl_checks.py,  and the python script
does not take into account the problem.


Any suggestions for implementation are appreciated.

Thanks,
Rodney.
</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">sysctl_net_ipv6_conf_default_accept_redirects.xml.diff</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">[root@wahoo checks]# diff sysctl_net_ipv6_conf_default_accept_redirects.xml ~/sysctl_net_ipv6_conf_default_accept_redirects.xml.orig 
12,22c12,14
&lt;     &lt;criteria operator="OR"&gt;
&lt;       &lt;criteria operator="AND"&gt;
&lt;         &lt;criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" /&gt;
&lt;         &lt;criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" /&gt;
&lt;       &lt;/criteria&gt;
&lt;       &lt;criteria operator="AND"&gt;
&lt;         &lt;extend_definition comment="IPv6 disabled"
&lt;         definition_ref="kernel_module_ipv6_option_disabled" /&gt;
&lt;         &lt;criterion comment="ipv6 disabled any modprobe conf file" 
&lt;         test_ref="test_kernel_module_ipv6_option_disabled" /&gt;
&lt;       &lt;/criteria&gt;
---
</pre>
        <blockquote type="cite" style="color: #000000;">
          <pre wrap=""><span class="moz-txt-citetags">&gt; </span>    &lt;criteria operator="AND"&gt;
<span class="moz-txt-citetags">&gt; </span>      &lt;criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_runtime_sysctl_net_ipv6_conf_default_accept_redirects" /&gt;
<span class="moz-txt-citetags">&gt; </span>      &lt;criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="test_static_sysctl_net_ipv6_conf_default_accept_redirects" /&gt;
</pre>
        </blockquote>
      </div>
    </blockquote>
    <br>
    Works for me....<br>
    <br>
    [shawn@SSG-RHEL6 checks]$ sudo grep ipv6
    /etc/modprobe.d/disabled.conf <br>
    options ipv6 disable=1<br>
    <br>
    [shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
    kernel_module_ipv6_option_disabled.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/kernel_module_ipv6_option_disabledwCcEnH.xml<br>
    Writing results to :
    /tmp/kernel_module_ipv6_option_disabledwCcEnH.xml-results<br>
    Definition oval:scap-security-guide.testing:def:323: true<br>
    Evaluation done.<br>
    <br>
    [shawn@SSG-RHEL6 checks]$ sudo sysctl -a | grep
    net.ipv6.conf.default.accept_redirects<br>
    net.ipv6.conf.default.accept_redirects = 0<br>
    <br>
    [shawn@SSG-RHEL6 checks]$ sudo grep
    "net.ipv6.conf.default.accept_redirects" /etc/sysctl.conf <br>
    net.ipv6.conf.default.accept_redirects = 0<br>
    <br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    sysctl_net_ipv6_conf_default_accept_redirects.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirectsH7PBwZ.xml<br>
    Writing results to :
    /tmp/sysctl_net_ipv6_conf_default_accept_redirectsH7PBwZ.xml-results<br>
    Definition oval:scap-security-guide.testing:def:317: true<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
  </body>
</html>