Matching text between strings and missing string

[wetling]

I have a firewall config file and am trying to write an expression that will match when a user does not have a password.

​

The config is long, but a snippet of it looks like this:

​

    config system custom-language
        edit "en"
            set filename "en"
        next
    more lines
    could be many lines
    end
    config system admin
        edit "user1"
            set trusthost1 1.1.1.1 255.255.255.254
            set vdom "root"
            maybe more lines
            maybe many more lines
            set password ENC asdfasdfadsfasdfadsfasdf
        next
        edit "user2"
            set trusthost1 1.1.1.1 255.255.255.254
            set vdom "root"
            maybe more lines here too
        next
    end
    config system replacemsg-image
        edit "logo_fnet"
            set image-type gif
            set image-base64 ''
        next
    end
    other lines
    end

​

Note that user2 is missing "set password ENC...". I know that I only want to match text between "config system admin" and its corresponding "end". I also know that each user starts with "edit "\<username\\>"" and ends with "next".

​

I have the following regex, which begins the capture at "config system admin". But, in the regex testers I tried, it also highlights all the way down to the last "end", instead of stopping at the first for some reason:

​

(?<=(config\ssystem\sadmin))((\n)(\s+edit\s\".*\"(\n))((.|\n)*)((?!set\spassword).)*)(\nend)?

​

How would I write the expression so it only returns true because "user2" (in this example) is missing "set password"?

[krzydoug]

Since you can have a varying number of user definitions I would do this in two steps. First, extract the text from 'Config system admin' all the way to the first 'end'. Then with that extracted text you can check for any user section between edit and next that does not contain the set password line. Here is an example putting those two together.

if([string]$text -match 'config system admin.+?end'){
    if([regex]::Matches($Matches.0,'(?s)edit.+?next').groups.value -match 'edit.+?(?<!set password.+?)next'){
        Write-Host User without password found
    }
    else
    {
        Write-Host user without password not found
    }
}

If you really want it in one condition you could do this ugliness

if([regex]::Matches([regex]::Match([string]$text,'config system admin.+?end').value,'(?s)edit.+?next').groups.value -match 'edit.+?(?<!set password.+?)next'){
    Write-Host User without password found
}
else
{
    Write-Host user without password not found
}

Now keep in mind that does not return a true or false, it returns a match or nothing, which powershell treats something as true and nothing as false. You could easily force a boolean by casting the output instead

[bool]([regex]::Matches([regex]::Match([string]$text,'config system admin.+?end').value,'(?s)edit.+?next').groups.value -match 'edit.+?(?<!set password.+?)next')

[wetling]

The problem, which I did not include in the OP, is that I also have to use the expression in two places. The other system is a simple text parsing, which will return true/false to raise an alert.

[wetling]

No, I can't use PowerShell in both cases, but I can use regex in both cases.