Module/Rule/Rule.psm1
|
# Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the MIT License. using module .\..\Common\Common.psm1 $exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt', '*.md', '*.psm1', 'data.*.ps1') $supportFileList = Get-ChildItem -Path $PSScriptRoot -Recurse -File -Exclude $exclude foreach ($supportFile in $supportFileList) { Write-Verbose "Loading $($supportFile.FullName)" . $supportFile.FullName } # Header <# .SYNOPSIS The base class for all STIG rule types .DESCRIPTION The base class for all STIG rule types to support a common initializer and set of methods that apply to all rule types. PowerShell does not support abstract classes, but this class is not intended to be used directly. .PARAMETER Id The STIG ID .PARAMETER Title Title string from STIG .PARAMETER Severity Severity data from STIG .PARAMETER ConversionStatus Module processing status of the raw string .PARAMETER RawString The raw string from the check-content element of the STIG item .PARAMETER SplitCheckContent The raw check string split into multiple lines for pattern matching .PARAMETER IsNullOrEmpty A flag to determine if a value is supposed to be empty or not. Some items should be empty, but there needs to be a way to validate that empty is on purpose. .PARAMETER OrganizationValueRequired A flag to determine if a local organizational setting is required. .PARAMETER OrganizationValueTestString A string that can be invoked to test the chosen organizational value. .PARAMETER DscResource Defines the DSC resource used to configure the rule #> Class Rule : ICloneable { [string] $Id [string] $Title [severity] $Severity [status] $ConversionStatus [string] $DscResource [string] $DuplicateOf [string] $Description [Boolean] $IsNullOrEmpty [Boolean] $OrganizationValueRequired [string] $OrganizationValueTestString [string] $RawString hidden [string[]] $SplitCheckContent <# .SYNOPSIS Default constructor .DESCRIPTION This is the base class constructor #> Rule () { } <# .SYNOPSIS PowerSTIG XML deserialze constructor .DESCRIPTION This is the base class constructor that laods the base properties from the PowerSTIG XML #> Rule ([xml.xmlelement] $Rule) { # Load PowerSTIG xml mode $this.Id = $Rule.Id $this.Title = $Rule.Title $this.Severity = $Rule.Severity $this.Description = $Rule.Description # When a bool is evaluated if anything exists it is true, so we need provide a bool $this.OrganizationValueRequired = ($Rule.OrganizationValueRequired -eq 'true') $this.OrganizationValueTestString = $Rule.OrganizationValueTestString $this.DscResource = $rule.DscResource } <# .SYNOPSIS XCCDF XML constructor .DESCRIPTION This is the base class constructor #> Rule ([xml.xmlelement] $Rule, [switch] $Convert) { # This relaces the current InvokeClass method $this.Id = $Rule.Id $this.Title = $Rule.Title $this.Severity = $Rule.rule.severity $this.Description = $Rule.rule.description if ( Test-HtmlEncoding -CheckString $Rule.rule.Check.('check-content') ) { $this.RawString = ( ConvertFrom-HtmlEncoding -CheckString $Rule.rule.Check.('check-content') ) } else { $this.RawString = $Rule.rule.Check.('check-content') } $this.SplitCheckContent = [Rule]::SplitCheckContent( $this.rawString ) $this.IsNullOrEmpty = $false $this.OrganizationValueRequired = $false } #region Methods <# This method is needed in each convert class for a couple of reasons. 1. PSTypeConverter has to be implemented at a .NET type, which might cause issues with customers that use constrained language mode. 2. The parent class modules cannot load the child class modules (load loop) #> hidden [psobject] AsRule() { # Create an instance of the convert rule parent class $parentRule = $this.GetType().BaseType::new() # Get the property list from the convert rule $propertyList = $this | Get-Member -MemberType Properties # Copy the convert properties to the parent properties foreach ($property in $propertyList) { if ( $null -ne $this.($property.Name) ) { $parentRule.($property.Name) = $this.($property.Name) } } return $parentRule } <# .SYNOPSIS Returns the rule property to override based on the override tag #> hidden [string] GetOverrideValue() { # The path that is returned from GetType contains wierd backslashes that I can't figure out how to use. $moduleName = $this.GetType().Name -replace 'Rule', '' $baseclassPath = Resolve-Path -Path "$PSScriptRoot\..\Rule.$moduleName\$($this.GetType().Name).psm1" # Exception property tag is used in the base class to identify the property that is to be overridden # the patteren is as follows # [type] $Name <#(ExceptionValue)#> $exceptionPropertyTag = '\s+(?:\[\w+(?:\[\s*\])?\])\s\$(?<ExceptionValue>\w+)\s+<#\(ExceptionValue\)#>' $exceptionProperty = [regex]::Matches( (Get-Content -path $baseclassPath -raw), $exceptionPropertyTag ).Groups.Where( {$_.Name -eq 'ExceptionValue'}).Value return $exceptionProperty } <# .SYNOPSIS Applies an org setting to a rule #> [void] AddOrgSetting ([string] $Value) { $this.($this.GetOverrideValue()) = $Value } <# .SYNOPSIS Applies an exception to a rule #> [void] AddExceptionToPolicy ([string] $Value) { $this.UpdateRuleTitle('Exception') $this.($this.GetOverrideValue()) = $Value } <# .SYNOPSIS Applies a uniform title update format #> [void] UpdateRuleTitle ([string] $Value) { $this.Title = "[$Value] " + $this.Title } <# .SYNOPSIS Creates a shallow copy of the current object #> hidden [Object] Clone () { return $this.MemberwiseClone() } <# .SYNOPSIS Tests if the rule already exists .DESCRIPTION Compares the rule with existing converted rules .PARAMETER ReferenceObject The existing converted rules #> hidden [Boolean] IsDuplicateRule ( [object] $ReferenceObject ) { return Test-DuplicateRule -ReferenceObject $ReferenceObject -DifferenceObject $this } <# .SYNOPSIS Tags a rule as being duplicate .DESCRIPTION Is a rule is a duplicate, tag the title for easy filtering and reporting #> hidden [void] SetDuplicateTitle () { $this.title = $this.title + ' Duplicate' } <# .SYNOPSIS Sets the conversion status .DESCRIPTION Sets the conversion status .PARAMETER Value The value to be tested #> hidden [Boolean] SetStatus ( [String] $Value ) { if ( [String]::IsNullOrEmpty( $Value ) ) { $this.conversionstatus = [status]::fail return $true } else { return $false } } <# .SYNOPSIS Sets the conversion status with an allowed blank value .DESCRIPTION Sets the conversion status with an allowed blank value .PARAMETER Value The value to be tested .PARAMETER AllowNullOrEmpty A flag to allow blank values #> hidden [Boolean] SetStatus ( [String] $Value, [Boolean] $AllowNullOrEmpty ) { if ( [String]::IsNullOrEmpty( $Value ) -and -not $AllowNullOrEmpty ) { $this.conversionstatus = [status]::fail return $true } else { return $false } } <# .SYNOPSIS Sets the IsNullOrEmpty value to true .DESCRIPTION Sets the IsNullOrEmpty value to true #> hidden [void] SetIsNullOrEmpty () { $this.IsNullOrEmpty = $true } <# .SYNOPSIS Sets the OrganizationValueRequired value to true .DESCRIPTION Sets the OrganizationValueRequired value to true #> hidden [void] SetOrganizationValueRequired () { $this.OrganizationValueRequired = $true } <# .SYNOPSIS Gets the organization value test string .DESCRIPTION Gets the organization value test string .PARAMETER TestString The string to extract the #> hidden [string] GetOrganizationValueTestString ( [String] $TestString ) { return Get-OrganizationValueTestString -String $TestString } <# .SYNOPSIS Converts the object into a hashtable .DESCRIPTION Converts the object into a hashtable #> <#{TODO}#> # remove and cleanup testhelper.psm1 hidden [hashtable] ConvertToHashTable () { return ConvertTo-HashTable -InputObject $this } <# .SYNOPSIS Splits the check-content element in the xccdf into an array .DESCRIPTION Splits the check-content element in the xccdf into an array .PARAMETER CheckContent The rule text from the check-content element in the xccdf #> hidden static [string[]] SplitCheckContent ( [String] $CheckContent ) { return ( $CheckContent -split '\n' | Select-String -Pattern "\w" | ForEach-Object { $PSitem.ToString().Trim() } ) } <# .SYNOPSIS Get the fixtext from the xccdf .DESCRIPTION Get the fixtext from the xccdf .PARAMETER StigRule The StigRule to extract the fix text from #> hidden static [string[]] GetFixText ( [xml.xmlelement] $StigRule ) { $fullFix = $StigRule.Rule.fixtext.'#text' $return = $fullFix -split '\n' | Select-String -Pattern "\w" | ForEach-Object { $PSitem.ToString().Trim() } return $return } <# .SYNOPSIS Looks for the rule to see if it already exists .DESCRIPTION Looks for the rule to see if it already exists .PARAMETER RuleCollection The global rule collection #> hidden [bool] IsExistingRule ( [object] $RuleCollection ) { return Test-ExistingRule -RuleCollection $RuleCollection $this } #endregion #region Hard coded Methods <# .SYNOPSIS Checks to see if the STIG is a hard coded return value .DESCRIPTION Accepts defeat in that the STIG string data for a select few checks are too unwieldy to parse properly. The OVAL data does not provide much more help in a few of the cases, so the STIG Id's for these checks are hardcoded here to force a fixed value to be returned. #> hidden [bool] IsHardCoded () { return Test-ValueDataIsHardCoded -StigId $this.id } <# .SYNOPSIS Returns a hard coded conversion value .DESCRIPTION Returns a hard coded conversion value #> hidden [string] GetHardCodedString () { return Get-HardCodedString -StigId $this.id } <# .SYNOPSIS Checks to see if the STIG org value is a hard coded return value .DESCRIPTION Accepts defeat in that the STIG string data for a select few checks are too unwieldy to parse properly. The OVAL data does not provide much more help in a few of the cases, so the STIG Id's for these checks are hardcoded here to force a fixed value to be returned. #> hidden [bool] IsHardCodedOrganizationValueTestString () { return Test-IsHardCodedOrganizationValueTestString -StigId $this.id } <# .SYNOPSIS Returns a hard coded org value .DESCRIPTION Returns a hard coded org value #> hidden [string] GetHardCodedOrganizationValueTestString () { return Get-HardCodedOrganizationValueTestString -StigId $this.id } <#{TODO}#> <#Remove hidden [void] SetDscResource () { throw 'SetDscResource must be implemented in the child class' } #> #endregion } |