Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New module using what-vpn #117

Merged
merged 8 commits into from
Sep 3, 2024
Merged

New module using what-vpn #117

merged 8 commits into from
Sep 3, 2024

Conversation

lukigruszka
Copy link
Contributor

Makes use of what-vpn project, enabling Artemis to identify SSL VPN servers.
Takes IPs as input, subject to change (other alternatives are domains or HTTP servises)

# Timeout counted in seconds, after which the what-vpn module terminates a connection and starts using the next sniffer.
# Some of VPN gateways do not respond in any way to the HTTP(S) requests, so the timeout variable should be optimized in
# order to avoid false negatives while not blocking the task for too long.
WHATVPN_TIMEOUT_S = decouple.config(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: _S -> _SECOND

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed all occurrences


RUN apk add git
RUN pip install requests
RUN pip3 install https://github.com/dlenski/what-vpn/archive/master.zip
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pin versions

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pinned latest hash on master branch

FROM certpl/artemis:latest

RUN apk add git
RUN pip install requests
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requests is already in the artemis image

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed


identity = "what-vpn"
filters = [
{"type": TaskType.IP.value}
Copy link
Member

@kazet kazet Sep 1, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmmm, if you want a service on a port, use TaskType.SERVICE

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll stay with IP task type as profit from scanning all discovered ports is debatable while increase number of sent requests is noticeable.
Might change in the future based on observations.


error_messages = ["error", "timeout", "no match"]
if any(msg in output for msg in error_messages):
status = TaskStatus.OK
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TaskStatus.ERROR

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changed the logic to return separate OK and ERROR statuses

@kazet
Copy link
Member

kazet commented Sep 1, 2024

fix linter ;)

@kazet kazet merged commit ad6e93f into CERT-Polska:main Sep 3, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants