Re: Re: Checking variables holding IP Addresses....
Martin Simons <[email protected]> Mon, 26 Aug 2024 12:59:39 -0700 (PDT)
| Newsgroups | gmane.comp.sysutils.cfengine.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Vratislav, Thank you for working on CFE-3446! Because of the issue, I am still trapped in CFEngine 3.7.5. I just checked, isipinsubnet() is not available for me. I am cleaning up my plocies right now and really look forward to jumping into 3.24 LTS! Martin. On Monday 26 August 2024 at 17:10:30 UTC+2 [email protected] wrote: > Hi Martin! > > On Mon, 2024-08-26 at 03:20 -0700, Martin Simons wrote: > > Dear CFEngineer, > > > > > Issue CFE-3446 seems to be solved, so in preparation of the move to 3.24 > I am fixing some policies dealing with variables. > > One of thos is IP checking. > > > > Good old Neil has this solution: > > > https://watson-wilson.ca/blog/2015/08/20/build-better-regular-expressions-in-cfengine/ > > > > It allows an address starting with '0.', however. > > So I tweaked it a bit: > > classes: > > > > "valid_hosts_ip" expression => > regcmp("(1[0-9]{0,2}|[3-9][0-9]{0,1}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[\.]([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])", > > "$(ip)"); > > > > It now checks IP addresses starting with a '1[0-9]{0,2}' first, that's > how all private address ranges start anyway. I have a test bundle > available, if needed. > > 👍️ > > I was just wondering if `isipinsubnet()` [1] could be an answer here. If > not, > what is the reason? Maybe we could extend it? > > > [1] > https://docs.cfengine.com/docs/master/reference-functions-isipinsubnet.html > > Thanks! > > -- > Vratislav > > > > > There also is this funny observation: > > https://en.wikipedia.org/wiki/Benford%27s_law > > > > Regards, > > Martin. > > On Wednesday 19 June 2019 at 14:41:36 UTC+2 Martin Simons wrote: > > > Dear CFEngineer, > > > > > > Too long time, no see. > > > > > > After pulling all my hair out. > > > > > > I am trying to configure ssh to use only specific IP-Addresses, > depending on the role. I am using a regular expression, which seems to > work. It validates an IP if it is valid and it sets a class if you feed it > an invalid value., but it does not set the class in case I feed it a > variable that is empty or undefind. > > > > > > bundle agent ip_list { > > > > > > vars: > > > > > > "ip_1" string => "10.68.71.5"; > > > "ip_2" string => "10.68.171.5"; > > > "ip_3" string => "192.168.123.123"; > > > > > > "ips" slist => { "$(ip_1)", "$(ip_2)", > "$(ip_3)" }; > > > > > > methods: > > > > > > "check_ip list" usebundle => check_ip( "$(ips)" ); > > > > > > reports: > > > > > > "$(this.bundle) ip's: *$(ips)*"; > > > > > > } > > > > > > bundle agent empty_var { > > > > > > vars: > > > > > > "ip_1" string => "10.68.71.5"; > > > "ip_2" string => "10.68.171.5"; > > > "ip_3" string => "$(nic.nic_admin)"; > > > > > > "ips" slist => { "$(ip_1)", "$(ip_2)", > "$(ip_3)" }; > > > > > > methods: > > > > > > "check_ip empty var" usebundle => check_ip( "$(ips)" ); > > > > > > reports: > > > > > > "$(this.bundle) ip's: *$(ips)*"; > > > > > > } > > > > > > bundle agent bogus { > > > > > > vars: > > > > > > "ip_1" string => "10.68.71.5"; > > > "ip_2" string => "10.68.171.5"; > > > "ip_3" string => "bogus"; > > > > > > "ips" slist => { "$(ip_1)", "$(ip_2)", > "$(ip_3)" }; > > > > > > methods: > > > > > > "check_ip bogus" usebundle => check_ip( "$(ips)" ); > > > > > > reports: > > > > > > "$(this.bundle) ip's: *$(ips)*"; > > > > > > } > > > bundle agent empty_string { > > > > > > vars: > > > > > > "ip_1" string => "10.68.71.5"; > > > "ip_2" string => "10.68.171.5"; > > > "ip_3" string => ""; > > > > > > "ips" slist => { "$(ip_1)", "$(ip_2)", > "$(ip_3)" }; > > > > > > methods: > > > > > > "check_ip empty string" usebundle => check_ip( "$(ips)" ); > > > > > > reports: > > > > > > "$(this.bundle) ip's: *$(ips)*"; > > > > > > } > > > > > > bundle agent check_ip(ips) { > > > > > > classes: > > > "match_$(ips)" > > > comment => "Oh, the horror!", > > > expression => regcmp( > > > > #"^(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})", > > > > "^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$", > > > $(ips) > > > ); > > > > > > methods: > > > > > > "!match_$(ips)":: > > > "Bell!!" usebundle => bell($(ips)); > > > > > > reports: > > > > > > "$(this.bundle): match_$(ips)*"; > > > > > > "!num_$(ips)":: > > > "$(this.bundle) iprange: $(ips)*"; > > > > > > "num_$(ips)":: > > > "$(this.bundle) iprange: $(ips)*"; > > > > > > } > > > > > > bundle agent bell(ips) { > > > > > > classes: > > > > > > "bad_ip" expression => regcmp( "bad_ip", $(bad_ip) ); > > > > > > vars: > > > > > > "bad_ip" string => "bad_ip"; > > > > > > methods: > > > > > > bad_ip:: > > > > > > "The show stops here!" usebundle => stop_the_show; > > > > > > reports: > > > > > > "$(this.bundle): Yell Bell! $(ips)"; > > > > > > bad_ip:: > > > > > > "$(this.bundle): $(bad_ip)"; > > > > > > } > > > > > > bundle agent stop_the_show { > > > > > > reports: > > > > > > "$(this.bundle): We stop the show!"; > > > > > > } > > > > > > body common control { > > > > > > bundlesequence => { "ip_list", "empty_var", "bogus", > "empty_string" }; > > > > > > } > > > > > > It stops when it encottners the first error, but lets the empty > variable pass. It does report the variable. > > > > > > What do I miss? > > > > > > Regards, > > > Martin. > > > > > > -- > > You received this message because you are subscribed to the Google > Groups "help-cfengine" group. > > > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > > To view this discussion on the web visit > https://groups.google.com/d/msgid/help-cfengine/4021c7ba-e455-47b0-b2f6-62c4d10542ccn%40googlegroups.com > . > > -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/56e20b2d-7841-4d66-a7e1-8cdba85ba364n%40googlegroups.com.