| *** zul has joined #openstack-security | 00:28 | |
| *** bpokorny has quit IRC | 00:41 | |
| *** sdake has joined #openstack-security | 00:58 | |
| *** tkelsey has joined #openstack-security | 01:01 | |
| *** austin987 has quit IRC | 01:03 | |
| *** tkelsey has quit IRC | 01:05 | |
| *** vinaypotluri has quit IRC | 01:11 | |
| *** sdake has quit IRC | 01:14 | |
| *** austin987 has joined #openstack-security | 01:15 | |
| *** sdake has joined #openstack-security | 01:16 | |
| *** sdake_ has joined #openstack-security | 01:22 | |
| *** sdake has quit IRC | 01:24 | |
| *** unrahul has quit IRC | 02:02 | |
| *** sdake has joined #openstack-security | 02:16 | |
| *** sdake_ has quit IRC | 02:19 | |
| *** jamielennox is now known as jamielennox|away | 03:03 | |
| *** austin987 has quit IRC | 03:06 | |
| *** austin987 has joined #openstack-security | 03:07 | |
| *** vinaypotluri has joined #openstack-security | 03:17 | |
| *** jamielennox|away is now known as jamielennox | 03:19 | |
| *** markvoelker has quit IRC | 03:47 | |
| *** tkelsey has joined #openstack-security | 04:03 | |
| *** tkelsey has quit IRC | 04:07 | |
| *** yuanying has quit IRC | 04:41 | |
| *** markvoelker has joined #openstack-security | 04:47 | |
| *** sdake_ has joined #openstack-security | 04:50 | |
| *** markvoelker has quit IRC | 04:52 | |
| *** sdake has quit IRC | 04:53 | |
| *** salv-orl_ has joined #openstack-security | 05:09 | |
| *** salv-orlando has quit IRC | 05:12 | |
| *** browne has joined #openstack-security | 05:25 | |
| *** sdake has joined #openstack-security | 05:27 | |
| *** sdake_ has quit IRC | 05:31 | |
| *** sdake_ has joined #openstack-security | 05:38 | |
| *** sdake has quit IRC | 05:41 | |
| *** sdake_ has quit IRC | 05:50 | |
| *** yuanying has joined #openstack-security | 06:02 | |
| *** browne has quit IRC | 06:07 | |
| *** rcernin has joined #openstack-security | 06:23 | |
| *** pcaruana has joined #openstack-security | 06:29 | |
| *** yuanying has quit IRC | 07:02 | |
| *** tkelsey has joined #openstack-security | 07:05 | |
| *** salv-orl_ has quit IRC | 07:09 | |
| *** salv-orlando has joined #openstack-security | 07:09 | |
| *** tkelsey has quit IRC | 07:09 | |
| *** tesseract has joined #openstack-security | 07:10 | |
| *** ccneill_ has joined #openstack-security | 07:18 | |
| *** ccneill has quit IRC | 07:20 | |
| *** dmk0202 has joined #openstack-security | 07:32 | |
| *** dmk0202 has quit IRC | 07:33 | |
| *** salv-orlando has quit IRC | 07:35 | |
| *** rcernin has quit IRC | 07:45 | |
| *** tkelsey has joined #openstack-security | 07:53 | |
| *** yuanying has joined #openstack-security | 08:05 | |
| *** jear has joined #openstack-security | 08:06 | |
| jear | about devstack and tls-proxy, is it really working ? | 08:07 |
|---|---|---|
| jear | when enabling service tls-proxy, stack.sh fails when setting up keystone, with : | 08:08 |
| jear | "Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL." | 08:08 |
| jear | "Could not determine a suitable URL for the plugin" | 08:08 |
| *** rcernin has joined #openstack-security | 08:10 | |
| *** redrobot has quit IRC | 08:21 | |
| *** v12aml has quit IRC | 08:22 | |
| *** Daviey_ has quit IRC | 08:23 | |
| *** Daviey has joined #openstack-security | 08:23 | |
| jear | how can i say to devstack to use 1 particular proxy to reach internet, and tls-proxy to make the API calls? | 08:23 |
| *** v12aml has joined #openstack-security | 08:23 | |
| *** redrobot has joined #openstack-security | 08:24 | |
| *** redrobot is now known as Guest31553 | 08:24 | |
| *** dmk0202 has joined #openstack-security | 08:27 | |
| *** tristanC_ has joined #openstack-security | 08:37 | |
| *** liverpoo1er has joined #openstack-security | 08:38 | |
| *** woodburn has quit IRC | 08:39 | |
| *** tristanC has quit IRC | 08:42 | |
| *** woodburn has joined #openstack-security | 08:42 | |
| *** mdavidson has quit IRC | 08:43 | |
| *** liverpooler has quit IRC | 08:43 | |
| *** mdavidson has joined #openstack-security | 08:44 | |
| *** tristanC_ is now known as tristanC | 08:44 | |
| *** z has quit IRC | 08:46 | |
| *** vinaypotluri has quit IRC | 08:46 | |
| *** tpeoples has quit IRC | 08:47 | |
| *** z has joined #openstack-security | 08:48 | |
| *** tpeoples has joined #openstack-security | 08:49 | |
| *** vinaypotluri has joined #openstack-security | 08:49 | |
| *** vinaypotluri has quit IRC | 08:51 | |
| *** jear has quit IRC | 09:17 | |
| *** openstackgerrit has quit IRC | 09:18 | |
| *** openstackgerrit has joined #openstack-security | 09:18 | |
| *** openstackgerrit has quit IRC | 10:03 | |
| *** openstackgerrit has joined #openstack-security | 10:03 | |
| *** rcernin has quit IRC | 10:05 | |
| *** Daviey has quit IRC | 10:29 | |
| *** Daviey has joined #openstack-security | 10:29 | |
| *** xsallowed has joined #openstack-security | 10:50 | |
| xsallowed | hello friends | 10:51 |
| *** xsallowed has quit IRC | 10:51 | |
| *** xsallowed has joined #openstack-security | 11:11 | |
| *** xsallowed has quit IRC | 11:22 | |
| *** rcernin has joined #openstack-security | 11:47 | |
| *** zigo has joined #openstack-security | 12:01 | |
| *** dave-mccowan has joined #openstack-security | 12:04 | |
| *** markvoelker has joined #openstack-security | 12:04 | |
| *** dmk0202 has quit IRC | 12:05 | |
| *** edmondsw has joined #openstack-security | 12:34 | |
| *** ametts has joined #openstack-security | 13:50 | |
| *** edtubill has joined #openstack-security | 13:52 | |
| *** sigmavirus24_ is now known as sigmavirus24 | 14:06 | |
| *** sdake has joined #openstack-security | 14:12 | |
| *** mvaldes has joined #openstack-security | 14:13 | |
| *** zul has quit IRC | 14:16 | |
| *** zul has joined #openstack-security | 14:16 | |
| *** SGGF has joined #openstack-security | 14:19 | |
| *** SGGF has quit IRC | 14:20 | |
| *** zul_ has joined #openstack-security | 14:21 | |
| *** zul has quit IRC | 14:23 | |
| *** pcaruana has quit IRC | 14:54 | |
| *** tesseract has quit IRC | 15:05 | |
| *** rcernin has quit IRC | 15:07 | |
| *** mvaldes has quit IRC | 15:11 | |
| *** browne has joined #openstack-security | 15:15 | |
| *** sdake has quit IRC | 15:20 | |
| *** unrahul has joined #openstack-security | 15:20 | |
| *** Trueghxst has joined #openstack-security | 15:26 | |
| Trueghxst | jjjj | 15:27 |
| *** Trueghxst has left #openstack-security | 15:27 | |
| *** mvaldes has joined #openstack-security | 15:32 | |
| *** vinaypotluri has joined #openstack-security | 15:39 | |
| *** bpokorny has joined #openstack-security | 15:49 | |
| *** Guest31553 is now known as redrobot | 15:50 | |
| *** sdake has joined #openstack-security | 15:51 | |
| *** bpokorny has quit IRC | 16:01 | |
| *** bpokorny has joined #openstack-security | 16:02 | |
| *** ccneill_ is now known as ccneill | 16:03 | |
| *** sdake has quit IRC | 16:07 | |
| *** dmk0202 has joined #openstack-security | 16:09 | |
| *** mdavidson has quit IRC | 16:11 | |
| *** tkelsey has quit IRC | 16:14 | |
| *** tkelsey has joined #openstack-security | 16:35 | |
| *** tkelsey has quit IRC | 16:40 | |
| *** ccneill_ has joined #openstack-security | 16:53 | |
| *** ccneill has quit IRC | 16:56 | |
| *** ccneill_ is now known as ccneill | 16:58 | |
| *** mdong has joined #openstack-security | 16:58 | |
| *** bpokorny has quit IRC | 17:06 | |
| *** bpokorny has joined #openstack-security | 17:16 | |
| *** browne has quit IRC | 17:19 | |
| *** mvaldes has quit IRC | 17:24 | |
| *** sdake has joined #openstack-security | 17:40 | |
| *** bpokorny has quit IRC | 17:44 | |
| *** mvaldes has joined #openstack-security | 17:53 | |
| openstackgerrit | Charles Neill proposed openstack/syntribos: Creates SynSignal and SignalHolder classes https://review.openstack.org/331286 | 18:06 |
| ccneill | mdong, unrahul, vinaypotluri: just pushed up a CR with the basics (SynSignal and SignalHolder), with an empty checks folder | 18:07 |
| *** browne has joined #openstack-security | 18:08 | |
| ccneill | mdong: I'm about to take a look at your CR | 18:08 |
| *** al_loew has joined #openstack-security | 18:12 | |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Moved SSL test out of BaseFuzzTestCase https://review.openstack.org/331288 | 18:17 |
| mdong | sounds goo ccneill, let me know what you think of the output schema | 18:18 |
| *** tsufiev has joined #openstack-security | 18:19 | |
| tsufiev | hello, folks! | 18:19 |
| tsufiev | I have a commit for Horizon which enhances its Create Image wizard with CORS support and allows to upload local image files directly to Glance | 18:20 |
| tsufiev | it works smoothly, but I have some security-related concerns that I'd like to discuss with you (whoever it may be) | 18:21 |
| tsufiev | here is the link: https://review.openstack.org/#/c/317365/11/openstack_dashboard/api/glance.py | 18:21 |
| tsufiev | summary: to allow JS to upload file using CORS it needs to pass Keystone token to glance, so Horizon server-side returns the token in a response to JS (client-side) code | 18:22 |
| tsufiev | that was seemed as a potential weak point of the feature security-wise, at least in the Horizon community | 18:23 |
| tsufiev | what do you think? | 18:23 |
| tsufiev | if you'd like to opine, please leave your feedback in the above patch :) | 18:31 |
| ccneill | mdong: commented on your CR | 18:46 |
| ccneill | mdong: I think I had something else in mind from our design session, and that may not have been others' impression, but I want to make sure we all agree before moving forward | 18:46 |
| ccneill | comparing the two reports, it's pretty clear that one is a lot shorter than the other, and I'm not sure we get much benefit from the way report | 18:47 |
| ccneill | report_by_issue arranges things currently | 18:47 |
| ccneill | but I like several aspects of it | 18:47 |
| ccneill | https://gist.github.com/anonymous/2a0e12ac23bc8b7d3936608ac600168d | 18:47 |
| ccneill | comparison of the two reporting styles ^ | 18:47 |
| ccneill | lol oops, didn't realize I wasn't logged in | 18:48 |
| mvaldes | ccneill: i thought you documented the format we were looking for | 18:49 |
| mvaldes | is it the same as that gist? | 18:49 |
| ccneill | sec | 18:50 |
| ccneill | ergh | 18:51 |
| ccneill | https://gist.github.com/cneill/147c05bdb4fd239ca552f1a4745a1e84 | 18:51 |
| ccneill | so I think this might fall squarely in the "my bad" category | 18:52 |
| ccneill | that gist is awful lol | 18:52 |
| ccneill | I kind of had a half-thought and wrote it down | 18:52 |
| ccneill | but didn't write down the OTHER way of doing it that I was imagining | 18:52 |
| ccneill | I was thinking of the difference as "by endpoint" versus "by issue" | 18:52 |
| ccneill | not "by issue" vs "by test" | 18:52 |
| ccneill | that isn't immediately clear from that gist, so that's my fault >_< | 18:53 |
| ccneill | I described what I was imaginging on mdong's CR https://review.openstack.org/#/c/330244/3 | 18:53 |
| mdong | hmm, yeah I was going off what was documented | 18:54 |
| ccneill | but! I do like several things in the other method, e.g. listing severities vs. "errors / successes / failures" since in most cases we really don't care about "successes" | 18:54 |
| mdong | but is this option still valuable? | 18:54 |
| ccneill | well, what are your thoughts on the two formats? | 18:55 |
| ccneill | I think that once we move towards 1 test = 1 issue, this distinction mostly becomes irrelevant, other than the differences between the two formats in terms of severity vs. success/fail, and getting rid of the "test_type" vs "defect_type" nesting | 18:56 |
| ccneill | right? | 18:57 |
| mdong | I think this option stops us from repeating BUFFER_OVERFLOW_HEADER and BUFFER_OVERFLOW_BODY | 18:57 |
| mdong | etc | 18:57 |
| ccneill | right | 18:57 |
| ccneill | I think we should do that in both cases | 18:57 |
| ccneill | I don't think we care about that information, since nothing materially changes between the two | 18:57 |
| ccneill | it's purely a "where did this payload go" question, not a "what test ran because _HEADER vs. _BODY is a different test" | 18:57 |
| mdong | it’s also a bit verbose since I made the param its own json object | 18:58 |
| mdong | instead of the string like it was | 18:58 |
| ccneill | again, I may've just had all this in my head and not said it out loud, or not written it down adequately, so my apologies for the confusion of what I was thinking | 18:58 |
| ccneill | right | 18:58 |
| mdong | but I think no matter what its gonna be more verbose than the old option | 18:59 |
| mdong | since we’re associating information per payload | 18:59 |
| ccneill | right | 18:59 |
| ccneill | I think what I had in mind was, if all the info in the "param" object is the same | 19:00 |
| ccneill | and instead of having "string": "blah", having "strings": ["blah", "bblah"] | 19:00 |
| ccneill | since otherwise it's just wasteful repetition | 19:00 |
| ccneill | and if the object DIFFERS, then we can differentiate | 19:01 |
| ccneill | ..that was a meaningful statement lol | 19:01 |
| mdong | ah I see | 19:01 |
| ccneill | also | 19:02 |
| ccneill | do we need "variables" to be a list vs. a string? | 19:02 |
| ccneill | we don't ever edit more than 1 variable at a time, at least for fuzz tests | 19:03 |
| ccneill | maybe we would need that in the future though.. | 19:03 |
| ccneill | I'm re-writing something more in the format I had in mind | 19:03 |
| mdong | no, it’s more that if a payload fails in both the username and the password | 19:03 |
| mdong | then the username and password both get added to the variables list | 19:03 |
| ccneill | https://gist.github.com/cneill/29a59040a6282751ce2dc54a6a65594c | 19:06 |
| ccneill | ah | 19:06 |
| ccneill | that makes sense | 19:06 |
| ccneill | mdong: ^ that's kind of more what I had in mind | 19:06 |
| ccneill | so the differentiator is having 2 signals vs. 1, thus changing the confidence between the two | 19:07 |
| ccneill | does that look reasonable? | 19:07 |
| ccneill | I actually like the param stuff being a dict instead of a messy string | 19:07 |
| ccneill | because it was always kind of hard to tell what the heck that string meant | 19:07 |
| mdong | yeah, I like that better | 19:08 |
| *** al_loew has quit IRC | 19:09 | |
| mdong | so is the first level still the endpoint? | 19:09 |
| ccneill | hmm | 19:10 |
| ccneill | I think the differences should be pretty minor between the "by endpoint" vs "by test" styles | 19:10 |
| ccneill | but I don't know what that difference looks like yet.. | 19:11 |
| ccneill | my thought is maybe we just make the changes to report_by_test, remove report_by_issue, and then maybe we loop back on "by endpoint" vs. "by test" later? | 19:11 |
| mdong | so get rid of report_by_issue altogether? | 19:12 |
| ccneill | because I think this specifically solves for something relevant to signals, whereas differentiating by endpoint vs. test is more of a convenience thing | 19:12 |
| ccneill | well, I think there are some pieces of it that we want to keep | 19:13 |
| ccneill | but as a distinction between "by_test" and "by_issue", yeah, I don't think we need both :\ | 19:13 |
| mdong | then I think I’d rather have by_issue rather than by_test | 19:13 |
| *** shakamunyi has joined #openstack-security | 19:13 | |
| mdong | I like the schema that you had in your gist | 19:13 |
| ccneill | yeah | 19:13 |
| ccneill | yeah, so whichever is closer to that, just take that and run with it | 19:14 |
| ccneill | I think it does make more sense being by issue | 19:14 |
| ccneill | because I don't think the end-user cares about the test, they care about the issue | 19:14 |
| ccneill | specifically, they don't care about SQL_INJECTION_BODY vs. SQL_INJECTION_HEADER | 19:15 |
| mdong | right | 19:15 |
| ccneill | cool | 19:15 |
| ccneill | I'll try not to put up confusing gists during meetings for us to puzzle over in the future lol >_< | 19:16 |
| mdong | so I’m gonna make the changes to report_by_issue to make it match the gist | 19:16 |
| ccneill | sounds good | 19:16 |
| mdong | haha no worries | 19:16 |
| ccneill | then I think you can remove the cli flag and report_by_test | 19:16 |
| mdong | yeah | 19:17 |
| *** al_loew has joined #openstack-security | 19:18 | |
| *** mvaldes has quit IRC | 19:27 | |
| unrahul | ccneill: mdong vinaypotluri Guys, this is the kind of approach I was taking in writing checks, https://gist.github.com/rahulunair/3a5a449027be9ba0f2723c6f11426a2d , here, if the check fails it does not return none, but a slug . What do you guys think>? | 19:27 |
| ccneill | hmmmm | 19:28 |
| ccneill | I'm still trying to figure that one out in my head | 19:28 |
| ccneill | I agree that returning None isn't great.. | 19:29 |
| ccneill | but at the same time it's a nice and tidy way to say "I did not find what I was looking for" | 19:30 |
| ccneill | whereas if we return a signal and have to introspect on it.. it just makes the logic of checking for a signal harder | 19:30 |
| ccneill | today, if you take the SignalHolder.register(check()) approach, it will just throw away any Nones | 19:30 |
| ccneill | but if we make it return a signal with some kind of "UNKNOWN" slug, we have to have a way to figure that out | 19:30 |
| ccneill | one way we COULD do it | 19:31 |
| ccneill | is by setting the signal's strength to 0 | 19:31 |
| ccneill | but I'm not sure if there's any use in saying "I ran this check and nothing interesting came back | 19:31 |
| ccneill | like, I don't think we would put that signal in the JSON output at the end | 19:32 |
| ccneill | and since checks are atomic, you wouldn't run one check, then run another, and retroactively go change the results of the first check based on that | 19:32 |
| ccneill | well.. maybe "atomic" isn't the word, but once a check is run, that's it | 19:33 |
| ccneill | other checks can take the information generated by that check and do something with it, but the original signal doesn't change | 19:33 |
| ccneill | so once we know "signal strength = 0", we know "we don't care about this" | 19:33 |
| unrahul | mm... that make sense ccneill , either there should be a standard that should be followed, so that we dont return diff things for the same 'not found' check.. aah.. i am not sure. | 19:33 |
| unrahul | signal_strength = 0 is one way to do it.. | 19:34 |
| ccneill | >_< so much ambiguity to resolve | 19:34 |
| unrahul | should we just go with that..?? | 19:34 |
| unrahul | or as in pascal and stuff signal_strength = 99 :D | 19:34 |
| unrahul | I will put it up for review on gerrit.. so that we can collect all the views.. | 19:35 |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Added command line option for reporting by issue rather than by test https://review.openstack.org/330244 | 19:37 |
| ccneill | sounds good | 19:38 |
| ccneill | I think signal strength is maybe not the best approach, because we end up carrying a fair amount of "state" around that we never actually do anything with | 19:38 |
| ccneill | right? | 19:38 |
| ccneill | like, subsequent checks would have to say | 19:38 |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Formatter now reports by issue rather than by test https://review.openstack.org/330244 | 19:38 |
| ccneill | look for this signal AND make sure its strength isn't 0 | 19:38 |
| ccneill | versus just look for this signal, which we already know has a signal strength != 0 | 19:38 |
| mdong | so turns out the reporter change was a really simple change | 19:38 |
| ccneill | nice | 19:39 |
| ccneill | glad to hear it mdong | 19:39 |
| ccneill | mdong: re: using strings for confidence, I think we should take the bandit approach and define some global constants in syntribos' __init__.py potentially | 19:44 |
| ccneill | or somewhere | 19:45 |
| ccneill | and convert those into strings in the reporter | 19:45 |
| ccneill | makes things much simpler | 19:45 |
| ccneill | er sorry, strings for severity* | 19:45 |
| ccneill | for confidence, I think we'll want to calculate some number that maps to a confidence interval | 19:46 |
| ccneill | but we haven't gotten that far yet, so we can leave that alone for now | 19:46 |
| ccneill | but the confidence should be easily modifiable based on additional signals | 19:46 |
| ccneill | without some kind of logic like "if low, now medium; if medium, now high", etc. | 19:46 |
| ccneill | so like += 5 | 19:47 |
| ccneill | with anything >= 10 = high, anything [5, 10) = medium, anything (0, 5) = low, and 0 = throw it away | 19:48 |
| ccneill | or something like that | 19:48 |
| ccneill | maybe 100 instead of 10 | 19:48 |
| ccneill | ¯\_(ツ)_/¯ | 19:48 |
| ccneill | I don't think severity will really be modified like that though, so just doing a like severity=syntribos.HIGH should suffice | 19:49 |
| ccneill | but that will require re-writing things, so we might want to save that for a different patch in the future | 19:49 |
| ccneill | for now, I would say just solve for the strings "High", "Medium", etc., and we'll loop back and do the constants later | 19:50 |
| ccneill | but I really just don't want us to have the dependency on CaseInsensitiveDicts | 19:50 |
| *** markvoelker has quit IRC | 19:55 | |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Formatter now reports by issue rather than by test https://review.openstack.org/330244 | 20:08 |
| *** markvoelker has joined #openstack-security | 20:10 | |
| *** edtubill has quit IRC | 20:12 | |
| openstackgerrit | Rahul U Nair proposed openstack/syntribos: signals check-file to fingerprint the SUT https://review.openstack.org/331340 | 20:23 |
| *** ediardo has joined #openstack-security | 20:37 | |
| *** mdong has quit IRC | 20:48 | |
| *** ametts has quit IRC | 21:13 | |
| *** edtubill has joined #openstack-security | 21:19 | |
| *** markvoelker has quit IRC | 21:21 | |
| *** edtubill has quit IRC | 21:22 | |
| *** dave-mccowan has quit IRC | 21:26 | |
| *** dmk0202 has quit IRC | 21:33 | |
| *** dmk0202 has joined #openstack-security | 21:34 | |
| *** dmk0202 has quit IRC | 21:50 | |
| *** edtubill has joined #openstack-security | 21:56 | |
| *** edtubill has quit IRC | 21:58 | |
| *** sdake has quit IRC | 22:38 | |
| *** sdake has joined #openstack-security | 22:41 | |
| *** edtubill has joined #openstack-security | 22:44 | |
| *** edtubill has quit IRC | 22:51 | |
| *** edtubill has joined #openstack-security | 22:52 | |
| *** edmondsw has quit IRC | 22:59 | |
| *** unrahul has quit IRC | 23:02 | |
| *** edtubill has quit IRC | 23:08 | |
| *** markvoelker has joined #openstack-security | 23:16 | |
| *** dave-mccowan has joined #openstack-security | 23:22 | |
| *** dave-mccowan has quit IRC | 23:26 | |
| *** al_loew has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!