Re: Re: Checking variables holding IP Addresses....

"'Vratislav Podzimek' via help-cfengine" <[email protected]> Mon, 26 Aug 2024 17:10:22 +0200
Newsgroups	gmane.comp.sysutils.cfengine.general
Message-ID	<[email protected]>
Hi Martin!

On Mon, 2024-08-26 at 03:20 -0700, Martin Simons wrote:
> Dear CFEngineer,
> 
> Issue CFE-3446 seems to be solved, so in preparation of the move to 3.24 I am fixing some policies dealing with variables.
> One of thos is IP checking.
> 
> Good old Neil has this solution:
> https://watson-wilson.ca/blog/2015/08/20/build-better-regular-expressions-in-cfengine/
> 
> It allows an address starting with '0.', however.
> So I tweaked it a bit:
> classes:
> 
>   "valid_hosts_ip"                 expression => regcmp("(1[0-9]{0,2}|[3-9][0-9]{0,1}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])",
>             "$(ip)");
> 
> It now checks IP addresses starting with a '1[0-9]{0,2}' first, that's how all private address ranges start anyway. I have a test bundle available, if needed.
👍️

I was just wondering if `isipinsubnet()` [1] could be an answer here. If not,
what is the reason? Maybe we could extend it?


[1] https://docs.cfengine.com/docs/master/reference-functions-isipinsubnet.html

Thanks!

--
Vratislav

> 
> There also is this funny observation:
> https://en.wikipedia.org/wiki/Benford%27s_law
> 
> Regards,
> Martin.
> On Wednesday 19 June 2019 at 14:41:36 UTC+2 Martin Simons wrote:
> > Dear CFEngineer,
> > 
> > Too long time, no see.
> > 
> > After pulling all my hair out.
> > 
> > I am trying to configure ssh to use only specific IP-Addresses, depending on the role. I am using a regular expression, which seems to work. It validates an IP if it is valid and it sets a class if you feed it an invalid value., but it does not set the class in case I feed it a variable that is empty or undefind.
> > 
> >  bundle agent ip_list {
> > 
> > vars:
> > 
> >   "ip_1"                        string => "10.68.71.5";
> >   "ip_2"                        string => "10.68.171.5";
> >   "ip_3"                        string => "192.168.123.123";
> > 
> >   "ips"                          slist => { "$(ip_1)", "$(ip_2)", "$(ip_3)" };
> > 
> > methods:
> > 
> >   "check_ip list"            usebundle => check_ip( "$(ips)" );
> > 
> > reports:
> > 
> >   "$(this.bundle) ip's: *$(ips)*";
> > 
> > }
> > 
> > bundle agent empty_var {
> > 
> > vars:
> > 
> >   "ip_1"                        string => "10.68.71.5";
> >   "ip_2"                        string => "10.68.171.5";
> >   "ip_3"                        string => "$(nic.nic_admin)";
> > 
> >   "ips"                          slist => { "$(ip_1)", "$(ip_2)", "$(ip_3)" };
> > 
> > methods:
> > 
> >   "check_ip empty var"       usebundle => check_ip( "$(ips)" );
> > 
> > reports:
> > 
> >   "$(this.bundle) ip's: *$(ips)*";
> > 
> > }
> > 
> > bundle agent bogus {
> > 
> > vars:
> > 
> >   "ip_1"                        string => "10.68.71.5";
> >   "ip_2"                        string => "10.68.171.5";
> >   "ip_3"                        string => "bogus";
> > 
> >   "ips"                          slist => { "$(ip_1)", "$(ip_2)", "$(ip_3)" };
> > 
> > methods:
> > 
> >   "check_ip bogus"           usebundle => check_ip( "$(ips)" );
> > 
> > reports:
> > 
> >   "$(this.bundle) ip's: *$(ips)*";
> > 
> > }
> > bundle agent empty_string {
> > 
> > vars:
> > 
> >   "ip_1"                        string => "10.68.71.5";
> >   "ip_2"                        string => "10.68.171.5";
> >   "ip_3"                        string => "";
> > 
> >   "ips"                          slist => { "$(ip_1)", "$(ip_2)", "$(ip_3)" };
> > 
> > methods:
> > 
> >   "check_ip empty string"    usebundle => check_ip( "$(ips)" );
> > 
> > reports:
> > 
> >   "$(this.bundle) ip's: *$(ips)*";
> > 
> > }
> > 
> > bundle agent check_ip(ips) {
> > 
> > classes:
> >   "match_$(ips)"
> >    comment    => "Oh, the horror!",
> >    expression => regcmp(
> > #"^(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})",
> > "^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$",
> >             $(ips)
> >             );
> > 
> > methods:
> > 
> >  "!match_$(ips)"::
> >   "Bell!!"            usebundle => bell($(ips));
> > 
> > reports:
> > 
> >   "$(this.bundle): match_$(ips)*";
> > 
> >   "!num_$(ips)"::
> >   "$(this.bundle) iprange: $(ips)*";
> > 
> >   "num_$(ips)"::
> >   "$(this.bundle) iprange: $(ips)*";
> > 
> > }
> > 
> > bundle agent bell(ips) {
> > 
> > classes:
> > 
> >   "bad_ip"        expression => regcmp( "bad_ip", $(bad_ip) );
> > 
> > vars:
> > 
> >   "bad_ip"            string => "bad_ip";
> > 
> > methods:
> > 
> >  bad_ip::
> > 
> >   "The show stops here!"  usebundle => stop_the_show;
> > 
> > reports:
> > 
> >   "$(this.bundle): Yell Bell! $(ips)";
> > 
> >  bad_ip::
> > 
> >   "$(this.bundle): $(bad_ip)";
> > 
> > }
> > 
> > bundle agent stop_the_show {
> > 
> > reports:
> > 
> >   "$(this.bundle): We stop the show!";
> > 
> > }
> > 
> > body common control {
> > 
> >         bundlesequence => { "ip_list", "empty_var", "bogus", "empty_string" };
> > 
> > }
> > 
> > It stops when it encottners the first error, but lets the empty variable pass. It does report the variable.
> > 
> > What do I miss?
> > 
> > Regards,
> > Martin.
> > 
> -- 
> You received this message because you are subscribed to the Google Groups "help-cfengine" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/4021c7ba-e455-47b0-b2f6-62c4d10542ccn%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/1a1aadc737ff5d5c964f783c02dd51f720090b7c.camel%40northern.tech.
signature.asc (application/pgp-signature, 833 B)