Re: Checking variables holding IP Addresses....

Dear CFEngineer,

Issue CFE-3446 seems to be solved, so in preparation of the move to 3.24 I 
am fixing some policies dealing with variables.
One of thos is IP checking.

Good old Neil has this solution:
https://watson-wilson.ca/blog/2015/08/20/build-better-regular-expressions-in-cfengine/

It allows an address starting with '0.', however.
So I tweaked it a bit:
classes:

  "valid_hosts_ip"                 expression => 
regcmp("(1[0-9]{0,2}|[3-9][0-9]{0,1}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])",
            "$(ip)");

It now checks IP addresses starting with a '1[0-9]{0,2}' first, that's how 
all private address ranges start anyway. I have a test bundle available, if 
needed.

There also is this funny observation:
https://en.wikipedia.org/wiki/Benford%27s_law

Regards,
Martin.
On Wednesday 19 June 2019 at 14:41:36 UTC+2 Martin Simons wrote:

> Dear CFEngineer,
>
> Too long time, no see.
>
> After pulling all my hair out.
>
> I am trying to configure ssh to use only specific IP-Addresses, depending 
> on the role. I am using a regular expression, which seems to work. It 
> validates an IP if it is valid and it sets a class if you feed it an 
> invalid value., but it does not set the class in case I feed it a variable 
> that is empty or undefind.
>
> bundle agent ip_list {
>
> vars:
>
>   "ip_1"                        string => "10.68.71.5";
>   "ip_2"                        string => "10.68.171.5";
>   "ip_3"                        string => "192.168.123.123";
>
>   "ips"                          slist => { "$(ip_1)", "$(ip_2)", 
> "$(ip_3)" };
>
> methods:
>
>   "check_ip list"            usebundle => check_ip( "$(ips)" );
>
> reports:
>
>   "$(this.bundle) ip's: *$(ips)*";
>
> }
>
> bundle agent empty_var {
>
> vars:
>
>   "ip_1"                        string => "10.68.71.5";
>   "ip_2"                        string => "10.68.171.5";
>   "ip_3"                        string => "$(nic.nic_admin)";
>
>   "ips"                          slist => { "$(ip_1)", "$(ip_2)", 
> "$(ip_3)" };
>
> methods:
>
>   "check_ip empty var"       usebundle => check_ip( "$(ips)" );
>
> reports:
>
>   "$(this.bundle) ip's: *$(ips)*";
>
> }
>
> bundle agent bogus {
>
> vars:
>
>   "ip_1"                        string => "10.68.71.5";
>   "ip_2"                        string => "10.68.171.5";
>   "ip_3"                        string => "bogus";
>
>   "ips"                          slist => { "$(ip_1)", "$(ip_2)", 
> "$(ip_3)" };
>
> methods:
>
>   "check_ip bogus"           usebundle => check_ip( "$(ips)" );
>
> reports:
>
>   "$(this.bundle) ip's: *$(ips)*";
>
> }
> bundle agent empty_string {
>
> vars:
>
>   "ip_1"                        string => "10.68.71.5";
>   "ip_2"                        string => "10.68.171.5";
>   "ip_3"                        string => "";
>
>   "ips"                          slist => { "$(ip_1)", "$(ip_2)", 
> "$(ip_3)" };
>
> methods:
>
>   "check_ip empty string"    usebundle => check_ip( "$(ips)" );
>
> reports:
>
>   "$(this.bundle) ip's: *$(ips)*";
>
> }
>
> bundle agent check_ip(ips) {
>
> classes:
>   "match_$(ips)"
>    comment    => "Oh, the horror!",
>    expression => regcmp(
>
> #"^(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})",
>
> "^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$",
>             $(ips)
>             );
>
> methods:
>
>  "!match_$(ips)"::
>   "Bell!!"            usebundle => bell($(ips));
>
> reports:
>
>   "$(this.bundle): match_$(ips)*";
>
>   "!num_$(ips)"::
>   "$(this.bundle) iprange: $(ips)*";
>
>   "num_$(ips)"::
>   "$(this.bundle) iprange: $(ips)*";
>
> }
>
> bundle agent bell(ips) {
>
> classes:
>
>   "bad_ip"        expression => regcmp( "bad_ip", $(bad_ip) );
>
> vars:
>
>   "bad_ip"            string => "bad_ip";
>
> methods:
>
>  bad_ip::
>
>   "The show stops here!"  usebundle => stop_the_show;
>
> reports:
>
>   "$(this.bundle): Yell Bell! $(ips)";
>
>  bad_ip::
>
>   "$(this.bundle): $(bad_ip)";
>
> }
>
> bundle agent stop_the_show {
>
> reports:
>
>   "$(this.bundle): We stop the show!";
>
> }
>
> body common control {
>
>         bundlesequence => { "ip_list", "empty_var", "bogus", 
> "empty_string" };
>
> }
>
> It stops when it encottners the first error, but lets the empty variable 
> pass. It does report the variable.
>
> What do I miss?
>
> Regards,
> Martin.
>
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/4021c7ba-e455-47b0-b2f6-62c4d10542ccn%40googlegroups.com.