3 # COPYRIGHT NOTICE STARTS HERE
5 # Copyright 2019 Samsung Electronics Co., Ltd.
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
11 # http://www.apache.org/licenses/LICENSE-2.0
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
19 # COPYRIGHT NOTICE ENDS HERE
21 # Check all ports exposed outside of kubernetes cluster looking for non-SSL
28 # Return value: Number of discovered non-SSL ports
29 # Output: List of pods exposing non-SSL endpoints
34 Usage: $(basename $0) <k8s-namespace> [-l <list of non-SSL endpoints expected to fail this test>]
35 -l: list of non-SSL endpoints expected to fail this test
40 #Prerequisities commands list
41 REQ_APPS=(kubectl nmap awk column sort paste grep wc mktemp sed cat)
43 # Check for prerequisites apps
44 for cmd in "${REQ_APPS[@]}"; do
45 if ! [ -x "$(command -v "$cmd")" ]; then
46 echo "Error: command $cmd is not installed"
51 if [ "$#" -lt 1 ]; then
56 FILTERED_PORTS_LIST=$(mktemp nonssl_endpoints_XXXXXX)
57 XF_RAW_FILE_PATH=$(mktemp raw_filtered_nonssl_endpoints_XXXXXX)
60 if [ ! -f $XF_FILE_PATH ]; then
64 grep -o '^[^#]*' $XF_FILE_PATH > $XF_RAW_FILE_PATH
71 -h|--help|help) usage ;;
72 -l) XF_FILE_PATH=$3; strip_white_list; shift ;;
78 echo "------------------------------------------------------------------------"
80 if [ -s $XL_FILE_PATH ]; then
81 echo -e "--------------------\e[0;31m WARNING \e[0;m XFail List ----------------------------"
83 echo "------------------------------------------------------------------------"
86 # Get both values on single call as this may get slow
87 PORTS_SVCS=`kubectl get svc --namespace=$K8S_NAMESPACE -o go-template='{{range $item := .items}}{{range $port := $item.spec.ports}}{{if .nodePort}}{{.nodePort}}{{"\t"}}{{$item.metadata.name}}{{"\n"}}{{end}}{{end}}{{end}}' | column -t | sort -n`
89 # Split port number and service name
90 PORTS=`awk '{print $1}' <<<"$PORTS_SVCS"`
91 SVCS=`awk '{print $2}' <<<"$PORTS_SVCS"`
93 # Create a list in nmap-compatible format
94 PORT_LIST=`tr "\\n" "," <<<"$PORTS" | sed 's/,$//'; echo ''`
96 # Get IP address of some cluster node (both "external-ip" and "ExternalIP" labels are matched)
97 K8S_NODE=`kubectl describe nodes \`kubectl get nodes | grep -v NAME | head -n 1 | awk '{print $1}'\` | grep "external-ip\|ExternalIP" | awk '{print $2}'`
100 SCAN_RESULT=`nmap $K8S_NODE -sV -p $PORT_LIST 2>/dev/null | grep \tcp`
102 # Concatenate scan result with service name
103 RESULTS=`paste <(printf %s "$SVCS") <(printf %s "$SCAN_RESULT") | column -t`
105 # Find all non-SSL ports
106 HTTP_PORTS=`grep -v ssl <<< "$RESULTS" | grep open | tee "$FILTERED_PORTS_LIST"`
108 # Filter out whitelisted endpoints
109 while IFS= read -r line; do
110 # for each line we test if it is in the white list with a regular expression
111 while IFS= read -r wl_line; do
112 wl_name=$(echo $wl_line | awk {'print $1'})
113 wl_port=$(echo $wl_line | awk {'print $2'})
114 if grep -e $wl_name.*$wl_port <<< "$line"; then
115 # Found in white list, exclude it
116 sed -i "/^$wl_name.*$wl_port/d" $FILTERED_PORTS_LIST
118 done < $XF_RAW_FILE_PATH
119 done < $FILTERED_PORTS_LIST
122 N_FILTERED_PORTS_LIST=$(cat $FILTERED_PORTS_LIST | wc -l)
123 echo "------------------------------------"
124 echo "Nb error pod(s): $N_FILTERED_PORTS_LIST"
125 cat $FILTERED_PORTS_LIST
126 exit $N_FILTERED_PORTS_LIST