Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add IDS-VM as a defensive networking mechanism #422

Merged
merged 1 commit into from
May 9, 2024
Merged

Add IDS-VM as a defensive networking mechanism #422

merged 1 commit into from
May 9, 2024

Conversation

riskuuse
Copy link
Contributor

@riskuuse riskuuse commented Dec 20, 2023 •
edited
Loading

Description of changes

This PR adds a new VM that enables defensive mechanisms to internal network as well as to outgoing network. This is going to replace the earlier draft pull request PR #146.

  • Initially it utilizes mitmproxy toolset to monitor http and https traffic.
  • It establishes a web interface for the tool using mitmweb tool. The interface can be launched from the gui-vm by running command 'mitmweb-ui'. The web interface uses ssh-tunnel to securely pass on the interface.
  • The chromium-vm launcher is patched so that it does not create warnings or errors due to certificate created by mitmproxy without relaxing web security too much.
  • Also snort and tcpdump packages are included to ids-vm.

Checklist for things done

  • Summary of the proposed changes in the PR description
  • More detailed description in the commit message(s)
  • Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
  • Contribution guidelines followed
  • Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
  • PR linked to architecture documentation and requirement(s) (ticket id)
  • Test procedure described (or includes tests). Select one or more:
    • Tested on Lenovo X1 x86_64
    • Tested on Jetson Orin NX or AGX aarch64
    • Tested on Polarfire riscv64
  • Author has run nix flake check --accept-flake-config and it passes
  • All automatic Github Action checks pass - see actions
  • Author has added reviewers and removed PR draft status

Testing

  • After boot configure WiFi normally if necessary.
  • Open Chromium and browse for a while.
    • Notice the warning prompt about unsupported command-line flag. This is tradeoff between installing CA certificate manually
      and ignoring certificate warnings entirely.
  • Open GUI-VM terminal and run command 'mitmweb-ui' and type in ssh username(ghaf) and password(ghaf) when requested.
  • A new browser window opens with web interface of mitmproxy and you can see http(s) flows.
    • Notice that you will see recorded flows of your previous browsing and real time flows.

@riskuuse riskuuse temporarily deployed to internal-build-workflow December 20, 2023 12:00 — with GitHub Actions Inactive
@riskuuse riskuuse had a problem deploying to external-build-workflow December 20, 2023 12:00 — with GitHub Actions Failure
@riskuuse riskuuse temporarily deployed to internal-build-workflow December 20, 2023 14:56 — with GitHub Actions Inactive
@riskuuse riskuuse had a problem deploying to external-build-workflow December 20, 2023 14:56 — with GitHub Actions Failure
@riskuuse riskuuse temporarily deployed to internal-build-workflow December 21, 2023 08:39 — with GitHub Actions Inactive
@riskuuse riskuuse temporarily deployed to external-build-workflow December 21, 2023 08:39 — with GitHub Actions Inactive
@riskuuse riskuuse temporarily deployed to internal-build-workflow January 8, 2024 09:28 — with GitHub Actions Inactive
@riskuuse riskuuse had a problem deploying to external-build-workflow January 8, 2024 09:28 — with GitHub Actions Failure
@riskuuse riskuuse marked this pull request as ready for review January 8, 2024 09:29
@riskuuse riskuuse requested a review from vilvo January 8, 2024 09:29
@riskuuse riskuuse temporarily deployed to internal-build-workflow January 9, 2024 07:50 — with GitHub Actions Inactive
@riskuuse riskuuse had a problem deploying to external-build-workflow January 9, 2024 07:50 — with GitHub Actions Failure
@leivos-unikie leivos-unikie added the Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon label Jan 10, 2024
@leivos-unikie
Copy link
Contributor

  • Tested the mitproxy interface while browsing
  • All apps launch (except Gala)
  • Ran ci-test-automation test suite -> pass

@riskuuse riskuuse temporarily deployed to internal-build-workflow January 11, 2024 11:14 — with GitHub Actions Inactive
@riskuuse riskuuse had a problem deploying to external-build-workflow January 11, 2024 11:14 — with GitHub Actions Failure
@riskuuse
Copy link
Contributor Author

Removed some .license -files now with 40b6688, since PR #429 has been merged.

@riskuuse riskuuse temporarily deployed to internal-build-workflow April 18, 2024 07:05 — with GitHub Actions Inactive
@riskuuse riskuuse temporarily deployed to internal-build-workflow April 18, 2024 07:09 — with GitHub Actions Inactive
@riskuuse
Copy link
Contributor Author

Both ids-vm and mitmproxy made now optional and disabled by default. The mitmproxy is now introduced as a module for ids-vm.
Also some network settings are unified.

@riskuuse riskuuse temporarily deployed to internal-build-workflow April 18, 2024 07:23 — with GitHub Actions Inactive
vilvo
vilvo approved these changes Apr 18, 2024
View reviewed changes
Copy link
Contributor

@vilvo vilvo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Design could be moved to GA-space according to the new process but it's there in the PR so I'll leave it to the integration
  • Please check and cherry-pick/include the two commits I commented related to VMM and timeZone.

@leivos-unikie leivos-unikie added Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon and removed Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon labels Apr 22, 2024
leivos-unikie
leivos-unikie approved these changes Apr 22, 2024
View reviewed changes
Copy link
Contributor

@leivos-unikie leivos-unikie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested on Lenovo-X1

  • mitmweb-ui works
  • Apps launch
  • ci-test-automation run ok

mbssrc
mbssrc approved these changes Apr 30, 2024
View reviewed changes
Copy link
Collaborator

@mbssrc mbssrc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Just an FYI - the certificate warning goes away when using the flag --test-type.

@riskuuse riskuuse temporarily deployed to internal-build-workflow May 2, 2024 12:58 — with GitHub Actions Inactive
@riskuuse
Copy link
Contributor Author

riskuuse commented May 2, 2024

Rebased with 6fd3643

@riskuuse
Add IDS-VM as a defensive networking mechanism
7af8203 
- Adds new virtual machine called ids-vm to Lenovo X1 target.
- If enabled, sets it as a default gateway for other VMs except for net-vm.
- Adds mitmproxy as a module to ids-vm to monitor http and https traffic.
- Creates a web interface to the mitmproxy.
- Sets Chromium to ignore self-signed CA certificate generated by mitmproxy.
- Adds mitmproxy CA certificate to gala-vm to enable login.
- Both ids-vm and mitmproxy module are disabled by default.

Signed-off-by: Risto Kuusela <risto.kuusela@unikie.com>
@riskuuse riskuuse temporarily deployed to internal-build-workflow May 3, 2024 08:08 — with GitHub Actions Inactive
@clayhill66 clayhill66 added Needs Testing CI Team to pre-verify and removed Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon labels May 3, 2024
@barnabakos
Copy link
Collaborator

ci-test-automation passed;
apps launch;
mitmweb-ui works

@barnabakos barnabakos added Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon and removed Needs Testing CI Team to pre-verify labels May 4, 2024
@brianmcgillion brianmcgillion merged commit 388ebb9 into tiiuae:main May 9, 2024
13 checks passed
@jenninikko jenninikko mentioned this pull request Jun 18, 2024
Merged
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vilvo vilvo vilvo approved these changes

@mbssrc mbssrc mbssrc approved these changes

@leivos-unikie leivos-unikie leivos-unikie approved these changes

@barnabakos barnabakos barnabakos approved these changes

@jenninikko jenninikko Awaiting requested review from jenninikko

@unbel13ver unbel13ver Awaiting requested review from unbel13ver

Assignees
No one assigned
Labels
Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@riskuuse @leivos-unikie @barnabakos @vilvo @unbel13ver @mbssrc @brianmcgillion @clayhill66