Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Rsyslog rules to support RainerScript syntax #12010

Merged
merged 17 commits into from
May 28, 2024
Merged

Improve Rsyslog rules to support RainerScript syntax #12010

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
c7e18f8
Add Rainer script support to rule rsyslog_cron_logging
jan-cerny May 20, 2024
9b191b8
Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…
jan-cerny May 20, 2024
0e418bc
Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…
jan-cerny May 20, 2024
847a9c0
Add Rainer script support to rsyslog_encrypt_offload_defaultnetstream…
jan-cerny May 20, 2024
5786c4a
Extract regex to a Jinja variable
jan-cerny May 27, 2024
65a6ea4
Add .conf extension to the configuration files
jan-cerny May 27, 2024
a035ce2
Extract legaxy regex
jan-cerny May 27, 2024
6cb73c7
Extract regexes to a variable
jan-cerny May 27, 2024
66d0a44
Update rule description with the Rainer script syntax
jan-cerny May 27, 2024
846e2fa
Update rule description with Rainer script syntax
jan-cerny May 27, 2024
85ab249
Extract regexes to variables
jan-cerny May 27, 2024
48aab45
Extract regexes to variables
jan-cerny May 27, 2024
768762d
Update rule description with Rainer script syntax
jan-cerny May 27, 2024
0cf234e
Improve test scenario
jan-cerny May 28, 2024
d8157f5
Use correct name of RainerScript
jan-cerny May 28, 2024
4da9bdb
Ensure the directories are set up
jan-cerny May 28, 2024
e5bfb40
Add packages header to the test scenarios
jan-cerny May 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 36 additions & 1 deletion ...file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@
{{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
<criteria operator="AND">
<criteria operator="OR">
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
<criterion comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
<criterion comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
</criteria>
</criteria>
</definition>
Expand All @@ -26,6 +30,21 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" version="1">

<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer"
comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" version="1">
Expand All @@ -40,4 +59,20 @@
<ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" version="1">
<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer"
comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

</def-group>
13 changes: 13 additions & 0 deletions .../rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
done

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")' >> "$RSYSLOG_CONF"
5 changes: 5 additions & 0 deletions ...rypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer_wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="0")' >> "$RSYSLOG_CONF"