

<def-group>
  <definition class="compliance" id="sysctl_net_ipv6_conf_all_router_solicitations" version="4">
    <metadata>
        <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in system configuration and system runtime.</description>
    </metadata>
    <criteria comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly" operator="OR">
      <extend_definition comment="is IPv6 enabled?"
                         definition_ref="sysctl_kernel_ipv6_disable"/>
      <criteria operator="AND">
        <extend_definition comment="net.ipv6.conf.all.router_solicitations configuration setting check"
                           definition_ref="sysctl_net_ipv6_conf_all_router_solicitations_static"/>

        <extend_definition comment="net.ipv6.conf.all.router_solicitations runtime setting check"
                           definition_ref="sysctl_net_ipv6_conf_all_router_solicitations_runtime"/>
      </criteria>
    </criteria>
  </definition>
</def-group>


<def-group>
  <definition class="compliance" id="sysctl_net_ipv6_conf_all_router_solicitations_runtime" version="3">
    <metadata>
        <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system runtime.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value"
                 test_ref="test_sysctl_net_ipv6_conf_all_router_solicitations_runtime"/>
    </criteria>
  </definition>

  <unix:sysctl_test id="test_sysctl_net_ipv6_conf_all_router_solicitations_runtime" version="1"
                    comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value"
                    check="all" check_existence="all_exist" state_operator="OR">
    <unix:object object_ref="object_sysctl_net_ipv6_conf_all_router_solicitations_runtime"/>

    <unix:state state_ref="state_sysctl_net_ipv6_conf_all_router_solicitations_runtime"/>

  </unix:sysctl_test>

  <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_router_solicitations_runtime" version="1">
    <unix:name>net.ipv6.conf.all.router_solicitations</unix:name>
  </unix:sysctl_object>


  <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_router_solicitations_runtime" version="1">
    <unix:value datatype="int" operation="equals"
                var_ref="sysctl_net_ipv6_conf_all_router_solicitations_value"/>
  </unix:sysctl_state>

  <external_variable id="sysctl_net_ipv6_conf_all_router_solicitations_value" version="1"
                     comment="External variable for net.ipv6.conf.all.router_solicitations" datatype="int"/>

</def-group>



<def-group>
  <definition class="compliance" id="sysctl_net_ipv6_conf_all_router_solicitations_static" version="3">
    <metadata>
        <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system configuration.</description>
    </metadata>

    <criteria operator="OR">
      <!--  Processing differently files in /usr/lib/sysctl.d/ as they are managed by packages and
            won't be fixed by remediations, see sysctl.d(5) -->
      <criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in sysctl files not managed by packages"
                    test_ref="test_sysctl_net_ipv6_conf_all_router_solicitations_static_user" />
      <criteria operator="AND">
        <criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations missing in sysctl files not managed by packages"
                    test_ref="test_sysctl_net_ipv6_conf_all_router_solicitations_static_user_missing" />
        
          <criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in sysctl files managed by packages"
                    test_ref="test_sysctl_net_ipv6_conf_all_router_solicitations_static_pkg_correct" />
        
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_sysctl_net_ipv6_conf_all_router_solicitations_static_user_missing" version="1"
                              check="all" check_existence="none_exist"
                              comment="net.ipv6.conf.all.router_solicitations static configuration">
    <ind:object object_ref="object_static_user_sysctl_net_ipv6_conf_all_router_solicitations" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_test id="test_sysctl_net_ipv6_conf_all_router_solicitations_static_user" version="1"
                              check="all" check_existence="all_exist"
                              comment="net.ipv6.conf.all.router_solicitations static configuration" state_operator="OR">
    <ind:object object_ref="object_static_user_sysctl_net_ipv6_conf_all_router_solicitations"/>

    <ind:state state_ref="state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations"/>

  </ind:textfilecontent54_test>

  
  <ind:textfilecontent54_test id="test_sysctl_net_ipv6_conf_all_router_solicitations_static_pkg_correct" version="2" check="all"
                          check_existence="all_exist"
                          comment="net.ipv6.conf.all.router_solicitations static configuration in /usr/lib/sysctl.d/*.conf"
                          state_operator="OR">
    <ind:object object_ref="object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations"/>

    <ind:state state_ref="state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations"/>

  </ind:textfilecontent54_test>
  

  <!-- Avoid directly referencing a possibly empty collection, one empty collection will cause the
       variable to have no value even when there are valid objects. -->
  <ind:textfilecontent54_object id="object_static_user_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <set>
      <object_reference>object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
      <object_reference>object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <set>
      <object_reference>object_static_etc_sysctls_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>

    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_sysctls_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <set>
      <object_reference>object_static_sysctl_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
      <object_reference>object_static_etc_sysctld_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <set>
      <object_reference>object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
      <object_reference>object_static_run_sysctld_sysctl_net_ipv6_conf_all_router_solicitations</object_reference>
    </set>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_object id="object_static_sysctl_sysctl_net_ipv6_conf_all_router_solicitations" version="1">

    <ind:filepath operation="pattern match">/etc(/ufw){0,1}/sysctl.conf$</ind:filepath>

    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_sysctld_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <ind:path>/etc/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_run_sysctld_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <ind:path>/run/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <ind:path>/usr/local/lib/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <ind:path>/usr/lib/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>




  <ind:textfilecontent54_state id="state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations" version="1">
    <ind:subexpression operation="equals" var_ref="sysctl_net_ipv6_conf_all_router_solicitations_value"
                       datatype="int" />
  </ind:textfilecontent54_state>

  <external_variable id="sysctl_net_ipv6_conf_all_router_solicitations_value" version="1"
                     comment="External variable for net.ipv6.conf.all.router_solicitations" datatype="int"/>


</def-group>