File Content Checks

[Adam Montville]

Some javascript/style in this post has been disabled (why?)

All:

 

I’ve been trying for a short while (new to OVAL construction) to specify an OVAL test that will check the contents of a Windows file.  At first, I could only find file attribute tests in the Windows schema, but then came across textfilecontent_test in the independent schema.  At this point, the ovaldi reads the file, but then errors because it can’t find the file name.  I’m afraid that my ind-def:path, ind-def:file, or ind-def:line elements are incorrect in my ind-textfilecontent_object. 

 

Here’s what I’m doing (mostly).

 

<oval_definitions>

…

<definition>

  <criteria>

    <criterion test_ref=”test”/>

  </criteria>

</definition>

…

<tests>

  <ind-def:textfilecontent_test id=”test”version=”1” check=”all”>

    <ind-def:object object_ref=”obj”/>

    <ind-def:state state_ref=”ste”/>

  </ind-def:textfilecontent_test>

</tests>

…

<objects>

  <ind-def:textfilecontent_object id=”obj”>

    <ind-def:path>C:\</ind-def:path>

    <ind-def:filename>test.txt</ind-def:filename>

    <ind-def:line>test</ind-def:line>

</objects>

…

<states>

  <ind-def:textfilecontent_state id=”ste”>

    <ind-def:line>test</ind-def:line>

  </ind-def:textfilecontent_state>

 

Any thoughts on what I’m most likely doing wrong?  I’m pretty sure I shouldn’t need the duplicate ind-def:line element in an object and a test, but when I was cooking this up the IDE indicated these were required by the schema.  So, that’s a bit confusing.  Also, I couldn’t find any real documentation with respect to proper formatting for paths, filenames, etc. 

 

Regards,

 

Adam Montville, CISSP | Policy Analyst

Direct: 503.276.7661

Mobile: [phone]

 

TRIPWIRE | The Leader in Configuration Audit & Control

www.tripwire.com

 

 

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

[Danny Haynes]

Some javascript/style in this post has been disabled (why?)

                Hi Adam,

 

Your ind-def:path and ind-def:filename entities look correct and would represent the file ‘C:\test.txt’.  One thing to point out, is that your ind-def:textfilecontent_object does not have a closing tag ‘</ind-def:textfilecontent_object>’, but, I am guessing that it is just a copy and paste error.  Another important thing to note is that the line entity should use the pattern match operation as the value specified in the line entity is a regular expression.   Now, when you say that the OVAL Interpreter cannot find the file, is an actual error being thrown by the OVAL Interpreter?  Or, are you referring to the fact that the object has a status of ‘does not exist’?  This can be determined by examining the ‘results.xml’ file.   Also, when you say that you shouldn’t need the duplicate ind-def:line entity in both the object and the test, do you mean the object and the state?  As specified in the OVAL Language, more specifically the independent-definitions-schema, the line entity is required in the ind-def:textfilecontent_object.  Also, would it be possible to post your actual OVAL Definition, or send it to me directly, as it would be much easier to troubleshoot your problem if I could reproduce it on my system?  In the meantime,  I have attached a sample OVAL Definition, and text file, for you to try on your system.  The attached OVAL Definition examines the attached text file ‘C:\test.txt’ and only collects text file content items for each line that contains digit characters as specified by the regular expression ‘$^[0-9]+$’.  It then checks these values to see if they satisfy the entities specified in the state, which say that in order for the test to return true, there must be at least one line entity that contains the digit character sequence ‘234’ as specified by the regular expression ‘^[0-9]*234[0-9]*$’.  Since at least one of the collected text file content items contain the digit character sequence ‘234’, this test will return true.  If you have any issues running the attached OVAL Definition, or have any other questions, please let me know.

 

Thanks,

 

Danny

 

From: Adam Montville [mailto:[hidden email]]
Sent: Tuesday, August 18, 2009 8:33 AM
To: oval-developer-list OVAL Developer List/Closed Public Discussion
Subject: [OVAL-DEVELOPER-LIST] File Content Checks

 

All:

 

I’ve been trying for a short while (new to OVAL construction) to specify an OVAL test that will check the contents of a Windows file.  At first, I could only find file attribute tests in the Windows schema, but then came across textfilecontent_test in the independent schema.  At this point, the ovaldi reads the file, but then errors because it can’t find the file name.  I’m afraid that my ind-def:path, ind-def:file, or ind-def:line elements are incorrect in my ind-textfilecontent_object. 

 

Here’s what I’m doing (mostly).

 

<oval_definitions>

…

<definition>

  <criteria>

    <criterion test_ref=”test”/>

  </criteria>

</definition>

…

<tests>

  <ind-def:textfilecontent_test id=”test”version=”1” check=”all”>

    <ind-def:object object_ref=”obj”/>

    <ind-def:state state_ref=”ste”/>

  </ind-def:textfilecontent_test>

</tests>

…

<objects>

  <ind-def:textfilecontent_object id=”obj”>

    <ind-def:path>C:\</ind-def:path>

    <ind-def:filename>test.txt</ind-def:filename>

    <ind-def:line>test</ind-def:line>

</objects>

…

<states>

  <ind-def:textfilecontent_state id=”ste”>

    <ind-def:line>test</ind-def:line>

  </ind-def:textfilecontent_state>

 

Any thoughts on what I’m most likely doing wrong?  I’m pretty sure I shouldn’t need the duplicate ind-def:line element in an object and a test, but when I was cooking this up the IDE indicated these were required by the schema.  So, that’s a bit confusing.  Also, I couldn’t find any real documentation with respect to proper formatting for paths, filenames, etc. 

 

Regards,

 

Adam Montville, CISSP | Policy Analyst

Direct: 503.276.7661

Mobile: [phone]

 

TRIPWIRE | The Leader in Configuration Audit & Control

www.tripwire.com

 

 

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].
a
abc
abcd
0
1
12
123
1234
12345
123456
abcde
abcdef
abcdefg
1234567
12345678
123456789
<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd
    http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd"
    xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
    xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
    xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5"
    xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">
    <generator>
        <oval:schema_version>5.5</oval:schema_version>
        <oval:timestamp>2009-01-12T10:41:00-05:00</oval:timestamp>
    </generator>
    <definitions>
   <definition id="oval:test:def:1" version="1" class="miscellaneous">
            <metadata>
                <title>ind-def:textfilecontent_test Sample OVAL Definition</title>
                <description>This definition is intended to evaluate to true if the there is a line in the text file 'C:\test.txt' that matches the regular expression '^[0-9]+234[0-9]+$'.</description>
            </metadata>
            <criteria operator="AND">
                <criterion comment="Check if the text file 'C:\test.txt' contains a line that matches the regular expression '^[0-9]+234[0-9]+$'." test_ref="oval:test:tst:1"/>
           </criteria>
        </definition>
     
    </definitions>
    <tests>
        <textfilecontent_test id="oval:test:tst:1" version="1" comment="Check if the text file 'C:\test.txt' contains a line that matches the regular expression '^[0-9]+234[0-9]+$'." check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
            <object object_ref="oval:test:obj:1"/>
            <state state_ref="oval:test:ste:1"/>
        </textfilecontent_test>
       
    </tests>
    <objects>
        <textfilecontent_object id="oval:test:obj:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
            <path>C:\</path>
            <filename>test.txt</filename>
            <line operation="pattern match">^[0-9]+$</line>
        </textfilecontent_object>
    </objects>
    <states>
        <textfilecontent_state id="oval:test:ste:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
            <line operation="pattern match">^[0-9]*234[0-9]*$</line>          
        </textfilecontent_state>
    </states>
</oval_definitions>

[Adam Montville]

Some javascript/style in this post has been disabled (why?)

Thanks for the response.  It was the pattern match operation.  Everything else was fine, except the copy/paste error.  I did receive help from Jeff Ito as well, so thanks to him also.

 

Adam

 

From: Haynes, Dan [mailto:[hidden email]]
Sent: Thursday, August 20, 2009 5:44 AM
To: [hidden email]
Subject: Re: [OVAL-DEVELOPER-LIST] File Content Checks

 

                Hi Adam,

 

Your ind-def:path and ind-def:filename entities look correct and would represent the file ‘C:\test.txt’.  One thing to point out, is that your ind-def:textfilecontent_object does not have a closing tag ‘</ind-def:textfilecontent_object>’, but, I am guessing that it is just a copy and paste error.  Another important thing to note is that the line entity should use the pattern match operation as the value specified in the line entity is a regular expression.   Now, when you say that the OVAL Interpreter cannot find the file, is an actual error being thrown by the OVAL Interpreter?  Or, are you referring to the fact that the object has a status of ‘does not exist’?  This can be determined by examining the ‘results.xml’ file.   Also, when you say that you shouldn’t need the duplicate ind-def:line entity in both the object and the test, do you mean the object and the state?  As specified in the OVAL Language, more specifically the independent-definitions-schema, the line entity is required in the ind-def:textfilecontent_object.  Also, would it be possible to post your actual OVAL Definition, or send it to me directly, as it would be much easier to troubleshoot your problem if I could reproduce it on my system?  In the meantime,  I have attached a sample OVAL Definition, and text file, for you to try on your system.  The attached OVAL Definition examines the attached text file ‘C:\test.txt’ and only collects text file content items for each line that contains digit characters as specified by the regular expression ‘$^[0-9]+$’.  It then checks these values to see if they satisfy the entities specified in the state, which say that in order for the test to return true, there must be at least one line entity that contains the digit character sequence ‘234’ as specified by the regular expression ‘^[0-9]*234[0-9]*$’.  Since at least one of the collected text file content items contain the digit character sequence ‘234’, this test will return true.  If you have any issues running the attached OVAL Definition, or have any other questions, please let me know.

 

Thanks,

 

Danny

 

From: Adam Montville [mailto:[hidden email]]
Sent: Tuesday, August 18, 2009 8:33 AM
To: oval-developer-list OVAL Developer List/Closed Public Discussion
Subject: [OVAL-DEVELOPER-LIST] File Content Checks

 

All:

 

I’ve been trying for a short while (new to OVAL construction) to specify an OVAL test that will check the contents of a Windows file.  At first, I could only find file attribute tests in the Windows schema, but then came across textfilecontent_test in the independent schema.  At this point, the ovaldi reads the file, but then errors because it can’t find the file name.  I’m afraid that my ind-def:path, ind-def:file, or ind-def:line elements are incorrect in my ind-textfilecontent_object. 

 

Here’s what I’m doing (mostly).

 

<oval_definitions>

…

<definition>

  <criteria>

    <criterion test_ref=”test”/>

  </criteria>

</definition>

…

<tests>

  <ind-def:textfilecontent_test id=”test”version=”1” check=”all”>

    <ind-def:object object_ref=”obj”/>

    <ind-def:state state_ref=”ste”/>

  </ind-def:textfilecontent_test>

</tests>

…

<objects>

  <ind-def:textfilecontent_object id=”obj”>

    <ind-def:path>C:\</ind-def:path>

    <ind-def:filename>test.txt</ind-def:filename>

    <ind-def:line>test</ind-def:line>

</objects>

…

<states>

  <ind-def:textfilecontent_state id=”ste”>

    <ind-def:line>test</ind-def:line>

  </ind-def:textfilecontent_state>

 

Any thoughts on what I’m most likely doing wrong?  I’m pretty sure I shouldn’t need the duplicate ind-def:line element in an object and a test, but when I was cooking this up the IDE indicated these were required by the schema.  So, that’s a bit confusing.  Also, I couldn’t find any real documentation with respect to proper formatting for paths, filenames, etc. 

 

Regards,

 

Adam Montville, CISSP | Policy Analyst

Direct: 503.276.7661

Mobile: [phone]

 

TRIPWIRE | The Leader in Configuration Audit & Control

www.tripwire.com

 

 

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].