Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@itaymmguardicore
Copy link
Contributor

Feature / Fixes

Add K8S capabilities to monkey

  • Have you added an explanation of what your changes do and why you'd like to include them?

  • Have you successfully tested your changes locally?

  • Example screenshot/log transcript of the feature working

Changes

  • Monkey can detect whether its on a K8S pod.
  • K8S pod will scan its suspected host node's subnet
  • Add K8S kubelet readonly fingerprint
  • Process K8S kubelet readonly finerprint to enhance infection map
  • Integrate the above features to get k8s info when monkey is on pod

k8s pod scan enabled by config
add telemetry processing for k8s
Fixes to usage of traceroute
Exported k8s island logic to service
Add invisible edges between k8s node and hosted pods, add support and generalization of edges to support it
various minor design improvements on island
# Conflicts:
#	monkey/monkey_island/cc/services/node.py
#	monkey/monkey_island/cc/services/report.py
#	monkey/monkey_island/cc/ui/src/components/map/MapOptions.js
#	monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js
Add recommendation for k8s issue
Show pods and not pod ips on pane
# Conflicts:
#	monkey/monkey_island/cc/services/report.py
Copy link
Contributor

@danielguardicore danielguardicore left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Went over some of it. Will setup test network to go over the rest of the k8 changes

"""
if isinstance(unicode_input, dict):
return {byteify(key): byteify(value) for key, value in six.iteritems(unicode_input)}
elif isinstance(unicode_input, list):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about tuples?

return [byteify(element) for element in unicode_input]
elif isinstance(unicode_input, unicode):
return byteify_str(unicode_input)
else:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When can this happen? Shouldn't we throw a ValueException or something?

"MSSQLFingerprint",
"ElasticFinger"
"ElasticFinger",
"K8sKubeletRoFinger"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"K8sKubeletRoFinger"
"K8sKubeletRoFinger",

from infection_monkey.network.info import local_ips, get_free_tcp_port
from infection_monkey.network.mssql_fingerprint import MSSQLFinger
from infection_monkey.network.mssql_fingerprint import MSSQLFinger
from infection_monkey.network.k8s_kubelet_ro_fingerprint import K8sKubeletRoFinger
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add newline?

Suggested change
from infection_monkey.network.k8s_kubelet_ro_fingerprint import K8sKubeletRoFinger
from infection_monkey.network.k8s_kubelet_ro_fingerprint import K8sKubeletRoFinger

@staticmethod
def parse_port_item(port):
return port['protocol'].lower() + '-' + str(port['containerPort'])

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Too many blank lines

return 'black';
}

function edgeGroupToOpacity(group) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add documentation somewhere why the edges are clear?

:param scan_type: A hostscanner class, will be instanced and used to scan for new machines
:param max_find: Max number of victims to find regardless of ranges
:param stop_callback: A callback to check at any point if we should stop scanning
:param system_info: system_info returned from system_info_collector
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand why this is here.
We collect system info in monkey.py before we initialize the network scanner. We can pass it there.

raise Exception("Cannot find local IP address for the machine")

LOG.info("Found local IP addresses of the machine: %r", self._ip_addresses)
# for fixed range, only scan once.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dead comment after removing the rest?


return None

def generate_ranges(self, system_info):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this, now we have an order for the scans.

:return: yields network range
"""
old_range_strs = set()
range_strs = set()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can be defined lower down?

@ShayNehmad ShayNehmad added Feature Issue that describes a new feature to be implemented. Monkey labels Jan 20, 2020
@VakarisZ VakarisZ removed the Monkey label Feb 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature Issue that describes a new feature to be implemented.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants