Self-signed SSL certificate #1208

shreyamalviya · 2021-06-04T08:13:01Z

Fixes #1145

PR Checklist

Have you added an explanation of what your changes do and why you'd like to include them?
Is the TravisCI build passing?
Was the CHANGELOG.md updated to reflect the changes?
Was the documentation framework updated to reflect the changes?

Testing Checklist

Added relevant unit tests?
Have you successfully tested your changes locally? Elaborate:

Tested by {Running the Monkey locally with relevant config/running Island/...}
If applicable, add screenshots or log transcripts of the feature working

Explain Changes

Are the commit messages enough? If not, elaborate.

…ate files

monkey/monkey_island/cc/setup/certificate/certificate_setup.py

monkey/monkey_island/cc/services/utils/file_permissions.py

monkey/monkey_island/cc/setup/certificate/certificate_setup.py

monkey/monkey_island/cc/setup/island_config_options.py

monkey/monkey_island/cc/setup/certificate/certificate_setup.py

Resolves #1032

…anduser()\'

…y/monkey_island/cc/setup/certificate_setup.py

codecov · 2021-06-07T14:48:25Z

Codecov Report

Merging #1208 (3841dd7) into develop (00434b9) will increase coverage by 0.19%.
The diff coverage is 77.35%.

❗ Current head 3841dd7 differs from pull request most recent head 6aa7649. Consider uploading reports for the commit 6aa7649 to get more accurate results

@@             Coverage Diff             @@
##           develop    #1208      +/-   ##
===========================================
+ Coverage    28.72%   28.91%   +0.19%     
===========================================
  Files          428      430       +2     
  Lines        12959    13001      +42     
===========================================
+ Hits          3722     3759      +37     
- Misses        9237     9242       +5

Impacted Files	Coverage Δ
monkey/monkey_island/cc/server_setup.py	`0.00% <0.00%> (ø)`
monkey/monkey_island/cc/setup/config_setup.py	`0.00% <0.00%> (ø)`
monkey/common/utils/exceptions.py	`100.00% <100.00%> (ø)`
monkey/monkey_island/cc/server_utils/consts.py	`92.85% <100.00%> (+1.19%)`	⬆️
monkey/monkey_island/cc/server_utils/file_utils.py	`100.00% <100.00%> (ø)`
...ey/monkey_island/cc/setup/island_config_options.py	`100.00% <100.00%> (ø)`
...island/cc/setup/island_config_options_validator.py	`100.00% <100.00%> (ø)`
monkey/tests/unit_tests/monkey_island/conftest.py	`100.00% <100.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 00434b9...6aa7649. Read the comment docs.

The file is named "test_island_config_options.py". Including "island_config_options" in every test/function name is reduntant.

_expand_path() is a utility function used by IslandConfigOptions. It doesn't need to be part of the class. It can potentially be reused by other modules that require the same functionality.

shreyamalviya · 2021-06-09T13:45:41Z

monkey/monkey_island/cc/server_utils/file_utils.py

+                    return False
+            elif sid == admins_sid:
+                continue
+            # TODO: consider removing; so many system accounts/groups exist, it's likely to fail


If we can know if the ACE is of a built-in account/group, skip those and check others.

mssalvatore · 2021-06-09T13:48:33Z

monkey/monkey_island/cc/server_utils/file_utils.py

+    # checks that admin has any permissions, user has `expected_permissions`,
+    # and everyone else has no permissions


checks that admin has any permissions

I think this comment is misleading. If I'm reading the code correctly, we don't check the admin permissions at all, we just skip/ignore them. We can probably nix this comment.

mssalvatore · 2021-06-09T13:49:13Z

monkey/monkey_island/cc/setup/island_config_options_validator.py

+
+def raise_on_invalid_options(options: IslandConfigOptions):
+    _raise_if_not_isfile(options.crt_path)
+    _raise_if_incorrect_permissions(options.crt_path, 0o400, 1179817)


Lets use constants instead of magic numbers.

mssalvatore · 2021-06-09T13:52:44Z

monkey/monkey_island/cc/setup/island_config_options_validator.py

+    expected_permissions = (
+        windows_expected_permissions if is_windows_os() else linux_expected_permissions
+    )


Need unit tests for this.

Removed code to display it in octal since it makes no sense on Windows. Added `oct()` around linux permissions when expected_permissions is being defined.

…dator

monkey/monkey_island/cc/server_utils/file_utils.py

We don't check admin permissions at all, and admin is included in "everyone else".

shreyamalviya added 6 commits June 4, 2021 12:23

Add support for custom certificate (partially)

c9a5383

Implement has_sufficient_permissions function for checking certific…

c1463b4

…ate files

Add log message for which certificate is being used

6f1154f

Move has_sufficient_permissions to a separate file in utils/

a2bd59c

Expand cert and key path in IslandConfigOptions

88ae762

Post-rebase fixes

d740173

mssalvatore requested changes Jun 4, 2021

View reviewed changes

shreyamalviya and others added 11 commits June 7, 2021 13:22

Extract file checking activities

53a1264

Rename "required" permissions to "expected" permissions

4ad49d1

Use octal representation for permissions

5ba8eff

docs: Reword docker supported operating systems

8c1e76f

docs: Add steps for user-provided certificate for docker container

16ed2e5

docs: Add --volume workaround to docker troubleshooting

6c04124

Resolves #1032

docs: Fix minor capitalization issue in docker setup

82c3273

Add _expand_path() to wrap os.path.expandvars()\' and os.path.exp…

227039f

…anduser()\'

Move monkey_island/cc/setup/certificate/certificate_setup.py to monke…

2b73ec7

…y/monkey_island/cc/setup/certificate_setup.py

Modify server_config.json ssl cert fields

42a9a79

Pass file paths to setup_certificate() instead of IslandConfigOptions

4f601ca

mssalvatore added 11 commits June 7, 2021 11:08

docs: Add a skeleton setup page for Linux AppImage package

a420403

docs: Add setup instructions for linux AppImage package

871fce1

docs: Small change to docker setup to keep consistent with linux.md

eb04420

island: Add a generalized testing function to test_island_config_options

ea0d6f0

island: Remove redundant "test_island_config_options" from tests

f2a2efc

The file is named "test_island_config_options.py". Including "island_config_options" in every test/function name is reduntant.

island: Add tests for ssl_certificate_file

4231f31

island: Add tests for ssl_certificate_key_file

f0a109a

island: Change _expand_path() from a static to regular function

e4866b1

_expand_path() is a utility function used by IslandConfigOptions. It doesn't need to be part of the class. It can potentially be reused by other modules that require the same functionality.

island: Move _expand_path() to file_utils.py so it can be reused

0519153

island: move set_home_env() to conftest.py so it can be reused

8744011

island: Add unit tests for expand_path()

bf0fe10

island: Set tighter permissions on certs in create_certificate.sh

3841dd7

shreyamalviya force-pushed the custom-certificate branch from 3841dd7 to 2e3a22d Compare June 9, 2021 08:22

shreyamalviya marked this pull request as ready for review June 9, 2021 11:06

shreyamalviya requested a review from mssalvatore June 9, 2021 11:07

shreyamalviya added 7 commits June 9, 2021 07:39

Fix consts.py (mix up during rebase)

10e7b19

Modify has_expected_permissions() to check files on Windows

011ab2a

Change default cert permissions in bat script for creating default cert

f1d85db

Fix Windows file permission checking

438a63b

Fix Windows file permissions checking

fcd758e

Add tests for Windows file permissions checking

cd2f627

Fix/ignore flake8 and fix isort warnings

dc8e2b0

mssalvatore force-pushed the custom-certificate branch from 94dca1e to dc8e2b0 Compare June 9, 2021 13:29

shreyamalviya commented Jun 9, 2021

View reviewed changes

island: Split has_expected_permissions() into os-specific functions

945e1ad

mssalvatore requested changes Jun 9, 2021

View reviewed changes

shreyamalviya and others added 9 commits June 9, 2021 19:37

Modify comment in monkey_island/cc/server_utils/file_utils.py

84b0664

Use constants instead of permission masks

424aceb

Modify log message when checking file permissions

91aad66

Removed code to display it in octal since it makes no sense on Windows. Added `oct()` around linux permissions when expected_permissions is being defined.

Add Windows tests for island_config_options_validator.py

8a321f0

Format test_island_config_options_validator.py with black

91a7c42

Add missing constant in config_setup.py

5aaa844

island: Pass int, not str to has_expected_permissions()

7fe10af

island: Consolidate duplicate code in test_island_config_options_vali…

cf5b137

…dator

tests: Refactor create_empty_file() -> create_empty_tmp_file()

67d4f18

mssalvatore reviewed Jun 9, 2021

View reviewed changes

monkey/monkey_island/cc/server_utils/file_utils.py Outdated Show resolved Hide resolved

mssalvatore added 2 commits June 9, 2021 14:20

island: remove misleading comment

9131f86

We don't check admin permissions at all, and admin is included in "everyone else".

island: Use config file in ~/.monkey_island if it exists

6aa7649

mssalvatore approved these changes Jun 9, 2021

View reviewed changes

mssalvatore merged commit 1c5daf1 into develop Jun 9, 2021

mssalvatore deleted the custom-certificate branch June 9, 2021 19:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Self-signed SSL certificate #1208

Self-signed SSL certificate #1208

Uh oh!

shreyamalviya commented Jun 4, 2021 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jun 7, 2021 •

edited

Loading

Uh oh!

shreyamalviya Jun 9, 2021

Uh oh!

mssalvatore Jun 9, 2021

Uh oh!

mssalvatore Jun 9, 2021

Uh oh!

mssalvatore Jun 9, 2021

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		# checks that admin has any permissions, user has `expected_permissions`,
		# and everyone else has no permissions

Self-signed SSL certificate #1208

Self-signed SSL certificate #1208

Uh oh!

Conversation

shreyamalviya commented Jun 4, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Checklist

Testing Checklist

Explain Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jun 7, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

shreyamalviya Jun 9, 2021

Choose a reason for hiding this comment

Uh oh!

mssalvatore Jun 9, 2021

Choose a reason for hiding this comment

Uh oh!

mssalvatore Jun 9, 2021

Choose a reason for hiding this comment

Uh oh!

mssalvatore Jun 9, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shreyamalviya commented Jun 4, 2021 •

edited

Loading

codecov bot commented Jun 7, 2021 •

edited

Loading