Repository: bottlerocket-os/bottlerocket
File: sources/bloodhound/src/bin/bottlerocket-checks/checks.rs (Rust)

Code before:

impl Checker for BR03020700Checker {
    fn execute(&self) -> CheckerResult {
        check_output_contains!(
            SYSCTL_CMD,
            ["net.ipv4.tcp_syncookies"],
            &["net.ipv4.tcp_syncookies = 1"],
            "unable to verify SYN flood cookie protection setting",
            "SYN flood cookie protection not enabled"
        )
    }

    fn metadata(&self) -> CheckerMetadata {
        CheckerMetadata {
            title: "Ensure TCP SYN Cookies is enabled".to_string(),
            id: "3.2.7".to_string(),
            level: 1,
            name: "br03020700".to_string(),
            mode: Mode::Automatic,
        }
    }
}

// =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<=

pub struct BR03030100Checker {}

impl Checker for BR03030100Checker {
    fn execute(&self) -> CheckerResult {
        let result = check_file_contains!(
            PROC_MODULES_FILE,
            &["sctp"],
            "unable to parse modules to check for sctp",
            "sctp is currently loaded"
        );

        // Check if we need to continue
        if result.status == CheckStatus::FAIL {
            return result;
        }

        check_output_contains!(
            MODPROBE_CMD,
            ["-n", "-v", "sctp"],
            &["install /bin/true"],
            "unable to parse modprobe output to check if sctp is enabled",
            "modprobe for sctp is not disabled"
        )
    }

    fn metadata(&self) -> CheckerMetadata {

Review comment (suggestion):
I assume your plan is to switch this to `look_for_word_in_file` once #3562 merges. The change looks good to me otherwise.

Code after:

impl Checker for BR03020700Checker {
    fn execute(&self) -> CheckerResult {
        check_output_contains!(
            SYSCTL_CMD,
            ["net.ipv4.tcp_syncookies"],
            &["net.ipv4.tcp_syncookies = 1"],
            "unable to verify SYN flood cookie protection setting",
            "SYN flood cookie protection not enabled"
        )
    }

    fn metadata(&self) -> CheckerMetadata {
        CheckerMetadata {
            title: "Ensure TCP SYN Cookies is enabled".to_string(),
            id: "3.2.7".to_string(),
            level: 1,
            name: "br03020700".to_string(),
            mode: Mode::Automatic,
        }
    }
}

// =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<=

pub struct BR03030100Checker {}

impl Checker for BR03030100Checker {
    fn execute(&self) -> CheckerResult {
        let mut result = CheckerResult::default();

        // Make sure sctp isn't already loaded
        if let Ok(found) = look_for_word_in_file(PROC_MODULES_FILE, "sctp") {
            if found {
                result.error = "sctp is currently loaded".to_string();
                result.status = CheckStatus::FAIL;
                return result;
            }
        } else {
            result.error = "unable to parse modules to check for sctp".to_string();
            return result;
        }

        check_output_contains!(
            MODPROBE_CMD,
            ["-n", "-v", "sctp"],
            &["install /bin/true"],
            "unable to parse modprobe output to check if sctp is enabled",
            "modprobe for sctp is not disabled"
        )
    }