aboutsummaryrefslogtreecommitdiffstats
path: root/test/security
AgeCommit message (Collapse)AuthorFilesLines
2019-07-08k8s: Make convenience targets CI-friendlyPawel Wieczorek1-2/+2
Previously "clean" target failed if there were no build artifacts. Now their absence is ignored. Issue-ID: SECCOM-235 Change-Id: I47beb2754a893e8b7453611116b4da2e516cca90 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Add tests for API server validatorsPawel Wieczorek4-1/+194
This patch also adds convenience target to the Makefile and updates documentation on relevant dependencies. Issue-ID: SECCOM-235 Change-Id: I57e00af3cd4c60af3128e3094607cc61bc1e5dbe Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Relax kublet HTTPS connection requirementPawel Wieczorek2-6/+7
According to kube-apiserver documentation [1] and CIS guideline 1.1.4 option "--kubelet-https=" might be absent in API server configuration. It has secure configuration (being set to "true") by default. [1] https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ Issue-ID: SECCOM-235 Change-Id: I604cdcace03f65185aab6a0b34d48cfec94277ab Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Make Rancher CLI provisioner configurablePawel Wieczorek1-5/+20
Apparently Linux AMD64 machines are not the only ones used for ONAP development (author meant no harm). Issue-ID: SECCOM-235 Change-Id: Ia78a02fb82dc5752d6b8fd2cef8e6ef583fd3ca6 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Make Rancher CLI provisioner reusablePawel Wieczorek2-9/+14
Having Rancher CLI proves itself useful on development machines as well. Issue-ID: SECCOM-235 Change-Id: I0de3109e1236cf6dc9cbc825342593041dcfdf2c Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Add Rancher CLI to test environmentPawel Wieczorek1-0/+9
Issue-ID: SECCOM-235 Change-Id: I46e2f8d61c3a82613b665fb6d9b57431bb2a1868 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Add virtual environment for testingPawel Wieczorek4-0/+143
This patch adds simplified ONAP deployment environment (Kubernetes cluster managed by Rancher). Its purpose is to provide cluster defaults for inspection without the need to access actual ONAP application deployment. Default node customization scripts were extracted ("tools/get_customization_scripts.sh" run within "tools/imported/" directory) from official documentation [1] and imported here in order not to introduce runtime online dependencies. This environment should probably be migrated in future to more appropriate place like devtool [2] (or at least use the same Vagrant boxes). [1] https://docs.onap.org/en/casablanca/submodules/oom.git/docs/oom_setup_kubernetes_rancher.html [2] https://git.onap.org/integration/devtool Issue-ID: SECCOM-235 Change-Id: I57f9f3caac0e8b391e9ed480f6bebba98e006882 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Validate API server address and port flagsPawel Wieczorek2-2/+37
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections regarding master node configuration are satisfied (1.1.6 and 1.1.7). Issue-ID: SECCOM-235 Change-Id: I5f215a6642b177e85d7e1c70860ba0c7e558ec4e Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Validate API server boolean flagsPawel Wieczorek2-1/+107
This patch verifies if CIS Kubernetes Benchmark v1.3.0 sections regarding master node configuration are satisfied (1.1.1 - 1.1.5, 1.1.8, 1.1.9, 1.1.20 and 1.1.23). Issue-ID: SECCOM-235 Change-Id: Ib964b5111b616a891c3963ef9695af660810e8ba Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-07-08k8s: Add documentation on runtime dependenciesPawel Wieczorek1-0/+12
Issue-ID: SECCOM-235 Change-Id: I370636220151a5755f467055418f866afe11d5d9 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-06-24k8s: Obtain relevant information from RancherPawel Wieczorek2-0/+95
This patch introduces Rancher queries using its CLI client. It depends on having utility binary located in PATH and providing configuration file prior first use. Issue-ID: SECCOM-235 Change-Id: Idb011e27b4801c5700b4482656463849736298da Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-06-20k8s: Add basic structure for validation toolPawel Wieczorek5-0/+58
This patch introduces CLI utility for checking if Kubernetes cluster follows security recommendations. Provided Makefile simplifies setup process by setting appropriate environment variables for the build. Further information can be found in README. Provided symlink allows proper document rendering on VCS hosting site. Issue-ID: SECCOM-235 Change-Id: I4a1337c9834322ee4fd742a9ccb979b9bc505f75 Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2019-05-29Search endpoint script fail silentlyLucjan Bryndza1-0/+11
When nmap or other commands are not installed on the system script fail silently without any information Signed-off-by: Lucjan Bryndza <l.bryndza@samsung.com> Change-Id: I599b987e223f88617aefa2c0de6cdcbbf3ff50b7 Issue-ID: SECCOM-231
2019-05-10Don't treat error reply as a proper JDWP handshakeKrzysztof Opasiak1-1/+2
As it turned out thanks to Yan Yang some ONAP services tend to return a propr JDWP handshake as a part of their error message. Let's filter out those services by checking number of lines returned by the server. We expect that proper JDWP handshake won't be longer than a single line. Issue-ID: SECCOM-231 Change-Id: I4b8950ebdf5fe118ec5f2dd5f4de583211784fb2 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2019-05-06Don't wait forever for jdwp responseKrzysztof Opasiak1-1/+2
Some of web services do not send any data when challenged with JDWP challenge. This makes the script waiting forever for response. To fix that let's introduce 10s timeout (experimental value) and replace empty string with a new line to avoid bash warnings. Issue-ID: SECCOM-231 Change-Id: I35546c001c5c54f298e8a4e346c2cf5d41e230ac Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2019-04-25Make the script working on Dublin releaseKrzysztof Opasiak1-1/+1
With the introduction of RKE instead of rancher format of pod description has slightly changed (annotations). Let's addjust our security tests to work correctly with recent ONAP release. Issue-ID: SECCOM-231 Change-Id: I49cdfcae9ce41a2b4bd4969958eddfaffe75b437 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2019-04-25User first node for port scanning instead of last oneKrzysztof Opasiak1-1/+1
It is more obvious to use first node in cluster instead of last one. Additionally in some cases nodes listed in the end may not expose all open ports (like it is in integration lab). Issue-ID: SECCOM-231 Change-Id: I200998b2e7b3a6de9b5f464e59e3b7dbbc0a656c Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2019-03-21Add script which looks for open JDWP portsKrzysztof Opasiak1-0/+93
ONAP should not expose any open JDWP ports even inside a cluser. Let's start enforcing this by adding test script to integration which will find all open JDWP ports. Based on initial work by: Radoslaw Zeszczuk <r.zeszczuk@samsung.com> Issue-ID: SECCOM-231 Change-Id: Ica46faad55850c74ed24728d54f6afdb3301a6d2 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2019-03-21Add script which checks for http portsKrzysztof Opasiak1-0/+68
ONAP should not exposed any http ports, https should be used instead. Let's start enforcing this by adding test script to integration which will find all http ports exposed outside of cluster. Issue-ID: SECCOM-231 Change-Id: I88e4b7890aaaa1bea06b496a6f97f4d5e9771215 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>