nickrusso42518 / stig

Offline config file scanner to test for STIG compliance with flexible rule sets
BSD 3-Clause "New" or "Revised" License
49 stars 10 forks source link

Match more interface types #4

Open pdice opened 5 years ago

pdice commented 5 years ago

currently, some of the built in rules will only match interface types that meet the following pattern:

parent: ^interface\s+GigabitEthernet0/[0-9]+$

However, IOS L3 devices have more interface naming conventions than this. I think it would be good to instead of having a long ass regex here for all the interface patterns, this be an alias to something like L3Interfaces that then that longer regex gets substituted for.

For example, on an ISR4331, the built in interfaces will be name: interface GigabitEthernet0/0/0 - 2

The EHWIC L3 port first number will be higher.

Old 2800s will be name: interface FastEthernet0/0

2900s will be named: as above, GigabitEthernet0/[0-9]+$

I'm assuming as similar set of issues on the ASA side:

ASA5508s will be: interface GigabitEthernet1/1

ASA5505s will be:

ASA5510s will be:

ASA5516s will be:

ASA5525s will be:

nickrusso42518 commented 5 years ago

A more generic regex is probably the right answer, any kind of Ethernet interface \S+Ethernet\s+ or something like that, with any numbering scheme. Honestly the only reason we care about matching the word Ethernet is because of Ethernet-specific features like portfast, proxy-ARP, etc. The rest is irrelevant I think.

pdice commented 5 years ago

Agree

maybe something closer to

parent: ^interface\s+Ethernet/[0-9]+$

I think starting the line with interface is important though

nickrusso42518 commented 5 years ago

Yes, I was suggesting something like:

parent: ^interface\s+\S*Ethernet[0-9/.]+$"

This would work on Nexus and IOSv where simply Ethernet is used.