Module/Rule.nxFileLine/Convert/nxFileLineRule.Convert.psm1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License.
using module .\..\..\Common\Common.psm1
using module .\..\..\Rule\Rule.psm1
using module .\..\nxFileLineRule.psm1

$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
foreach ($supportFile in $supportFileList)
{
    Write-Verbose "Loading $($supportFile.FullName)"
    . $supportFile.FullName
}

<#
    .SYNOPSIS
        Convert the contents of an xccdf check-content and/or fixtext element
        into a Linux package object.
    .DESCRIPTION
        The nxFileLineRuleConvert class is used to extract the Linux file contents
        modification from the check-content of the xccdf. Once a STIG rule is
        identified as a nxFileLine rule, it is passed to the nxFileLineRuleConvert
        class for parsing and validation.
#>

class nxFileLineRuleConvert : nxFileLineRule
{
    <#
        .SYNOPSIS
            Empty constructor for SplitFactory.
    #>

    nxFileLineRuleConvert ()
    {
    }

    <#
        .SYNOPSIS
            Converts a xccdf STIG rule element into a nxFileLineRule.
        .PARAMETER XccdfRule
            The STIG rule to convert.
    #>

    nxFileLineRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
    {
        if ($this.RawString -match 'You are accessing a U.S. Government \(USG\) [^"]+(?<=details.)')
        {
            $rawString = $this.RawString
        }
        else
        {
            $rawString = $this.SplitCheckContent
        }
        $this.SetFilePath($rawString)
        $this.SetContainsLine($rawString)
        $this.SetDoesNotContainPattern()
        if ($this.TestStringForRange($rawString))
        {
            $this.SetOrganizationValueTestString($rawString)
            $this.SetOrganizationValueRequired()
        }

        if ($this.conversionstatus -eq 'pass')
        {
            $this.SetDuplicateRule()
            $this.SetDscResource()
        }

        if ($this.OrganizationValueRequired -eq $true)
        {
            $this.set_ContainsLine([string]::Empty)
            $this.set_DoesNotContainPattern([string]::Empty)
        }

        if ($null -ne $this.DuplicateOf)
        {
            $this.ClearOrgSettings()
        }
    }

    <#
        .SYNOPSIS
            Extracts the line to be modified from the check-content and sets the value.
        .DESCRIPTION
            Gets the line to be modified from the xccdf content and sets the value. If
            the name that is returned is not valid, the parser status is set to fail.
    #>

    [void] SetContainsLine ([string[]] $CheckContent)
    {
        $containsLine = Get-nxFileLineContainsLine -CheckContent $CheckContent
        if (-not $this.SetStatus($containsLine))
        {
            $this.set_ContainsLine($containsLine)
        }
    }

    <#
        .SYNOPSIS
            Extracts the file path from the check-content and sets the value.
        .DESCRIPTION
            Gets the file path from the xccdf content and sets the value. If
            the path that is returned is not valid, the parser status is set to fail.
    #>

    [void] SetFilePath ([string] $CheckContent)
    {
        $filePath = Get-nxFileLineFilePath -CheckContent $CheckContent
        if (-not $this.SetStatus($filePath))
        {
            $this.set_FilePath($filePath)
        }
    }

    <#
        .SYNOPSIS
            Extracts the DoesNotContainPattern from the check-content and sets the value.
        .DESCRIPTION
            Gets the DoesNotContainPattern from the xccdf content and sets the value. If
            the DoesNotContainPattern that is returned is not valid, the parser status
            is set to fail.
    #>

    [void] SetDoesNotContainPattern ()
    {
        $doesNotContainPattern = Get-nxFileLineDoesNotContainPattern
        if (-not $this.SetStatus($doesNotContainPattern))
        {
            $this.set_DoesNotContainPattern($doesNotContainPattern)
        }
    }

    <#
        .SYNOPSIS
            Sets the Org Value String.
        .DESCRIPTION
            Sets the Org Value String to ensure the customer is aware of the correct nxFileLine condition.
    #>

    [void] SetOrganizationValueTestString ([string[]] $CheckContent)
    {
        $result = $CheckContent -match '\s*If.*(?:greater|less|and\/or\s*other|higher|more\s+than\s+"\w*").*this is a finding'
        $formattedResult = 'the following statement is true when leveraging the correct nxFileLine ContainsLine format: "{0}" ' -f $result
        if ($null -ne $result)
        {
            $this.set_OrganizationValueTestString($formattedResult)
        }
    }

    <#
        .SYNOPSIS
            Clears the Org Settings from the Rule Object.
        .DESCRIPTION
            Clears the Org Settings from the Rule Object, typically used if the rule is a duplicate.
    #>

    [void] ClearOrgSettings ()
    {
        $this.OrganizationValueRequired = $false
        $this.OrganizationValueTestString = [string]::Empty
    }

    <#
        .SYNOPSIS
            Tests for a range in the string.
        .DESCRIPTION
            Tests for a range in the string, used to determine if an Org Setting should be defined.
    #>

    [bool] TestStringForRange ([string] $CheckContent)
    {
        if ($CheckContent -match '\s*If\s+.*(?:greater|less|and\/or\s*other|higher|more\s+than\s+"\w*").*this is a finding')
        {
            return $true
        }
        return $false
    }

    <#
        .SYNOPSIS
            Match to detect nxFileLineRule.
    #>

    static [bool] Match ([string] $CheckContent)
    {
        if
        (
            # CheckContent match for Ubuntu STIG
            (
                $CheckContent -Match 'If\s+.*".*".*commented out.*this is a finding|If\s+.*"\w*".*is missing from.*file.*this is a finding' -or
                $CheckContent -Match '\s*sudo\s*aud(i)*tctl\s*-l\s*\|'
            ) -or
            # CheckContent match for RHEL STIG
            (
                $CheckContent -Match '#\s+(?:cat|grep|more).*/.*/.*(?:grep|).*' -and
                (
                    $CheckContent -Match 'If\s+.*(?:"\w*"|"\w*\s*\w"|the\s+line\s+is\s+commented\s+out).*,\s+this\s+is\s+a\s+finding' -or
                    $CheckContent -Match 'If\s+.*required\s+value\s+is\s+not\s+set.*,\s+this\s+is\s+a\s+finding' -or
                    $CheckContent -Match 'If\s+.*configuration\s+file\s+does\s+not\s+exist\s+or\s+allows\s+for.*,\s+this\s+is\s+a\s+finding' -or
                    $CheckContent -Match 'If\s+.*command(?:s|)\s+(?:does|do)\s+not\s+return\s+(?:any\s+|a\s+line\s+|)output.*,\s+this\s+is\s+a\s+finding' -or
                    $CheckContent -Match 'If\s+.*there\s+is\s+no\s+process\s+to\s+validate.*,\s+this\s+is\s+a\s+finding' -or
                    $CheckContent -Match 'If\s+there\s+is\s+no\s+evidence\s+(?:that\s+|)the\s+.*,\s+this\s+is\s+a\s+finding'
                )
            ) -and
            $CheckContent -NotMatch 'ESXi' -and
            $CheckContent -NotMatch '#\s*(?:cat|more)\s+\/etc\/fstab.*'
        )
        {
            return $true
        }

        return $false
    }

    <#
        .SYNOPSIS
            Tests if a rule contains multiple checks
        .DESCRIPTION
            Search the rule text to determine if multiple ContainLines are defined
        .PARAMETER CheckContent
            The rule text from the check-content element in the xccdf
    #>

    static [bool] HasMultipleRules ([string] $CheckContent)
    {
        return Test-nxFileLineMultipleEntries -CheckContent ([Rule]::SplitCheckContent($CheckContent))
    }

    <#
        .SYNOPSIS
            Splits a rule into multiple checks
        .DESCRIPTION
            Once a rule has been found to have multiple checks, the rule needs
            to be split. Each split rule id is appended with a dot and letter to
            keep reporting per the ID consistent. An example would be is V-1000
            contained 2 checks, then SplitMultipleRules would return 2 objects
            with rule ids V-1000.a and V-1000.b
        .PARAMETER CheckContent
            The rule text from the check-content element in the xccdf
    #>

    static [string[]] SplitMultipleRules ([string] $CheckContent)
    {
        return (Split-nxFileLineMultipleEntries -CheckContent ([Rule]::SplitCheckContent($CheckContent)))
    }

    <#
        .SYNOPSIS
            Sets the DSC Resource.
    #>

    hidden [void] SetDscResource ()
    {
        if ($null -eq $this.DuplicateOf)
        {
            $this.DscResource = 'nxFileLine'
        }
        else
        {
            $this.DscResource = 'None'
        }
    }
}