1
diff --git a/bootstack-ops/juju-bundle-export-mask.py b/bootstack-ops/juju-bundle-export-mask.py
2
0
deleted file mode 100755
0
deleted file mode 100755
3
index 0df53e1..0000000
4
--- a/bootstack-ops/juju-bundle-export-mask.py
5
+++ /dev/null
6
@@ -1,126 +0,0 @@
7
1
#!/usr/bin/env python
8
2
9
3
from __future__ import print_function
10
4
import re
11
5
import sys
12
6
import yaml
13
7
import argparse
14
8
import math
15
9
16
10
17
11
MASK_KEYS = '(.*(ssl-public-key|ssl[_-](ca|cert|key)|secret|password|pagerduty_key|license-file|registration-key|token|accesskey|private-ppa|(http|https)://.*:.+\@|os-credentials).*)|key'
18
12
19
13
20
14
def readbundle(filename):
21
15
    try:
22
16
        mybundle = yaml.load(filename.read())
23
17
    except yaml.YAMLError as exc:
24
18
        print(exc)
25
19
26
20
    return mybundle
27
21
28
22
29
23
def mask_keys_in_dict(mydict, mask, level='ROOT'):
30
24
    for k, v in mydict.iteritems():
31
25
        if isinstance(v, dict):
32
26
            mask_keys_in_dict(v, mask, level=('{}:{}'.format(level, k)))
33
27
        else:
34
28
            result = mask.match(k)
35
29
            if result is not None:
36
30
                mydict[k] = 'THIS_VALUE_IS_MASKED_FOR_SECURITY'
37
31
            elif type(v) in (str,):
38
32
                result = mask.match(v)
39
33
                if result is not None:
40
34
                    print('WARNING! Masked keyword "{}" found in value for {}'.format(result.groups()[1], level))
41
35
                    print('Check output file, may not be secure.')
42
36
                    print()
43
37
        if v == 'truetrue':
44
38
            mydict[k] = 'true'
45
39
        elif v == 'falsetrue':
46
40
            mydict[k] = 'false'
47
41
48
42
49
43
def parse_args():
50
44
    parser = argparse.ArgumentParser(
51
45
        description='Mask juju bundle export file secrets')
52
46
    parser.add_argument('-i', dest='infile', nargs='?',
53
47
                        type=argparse.FileType('r'), default=sys.stdin)
54
48
    parser.add_argument('-o', dest='outfile', nargs='?',
55
49
                        type=argparse.FileType('w'), default=sys.stdout)
56
50
57
51
    result = parser.parse_args(sys.argv[1:])
58
52
    return result
59
53
60
54
61
55
def shannon_entropy(data, iterator):
62
56
    """
63
57
    Borrowed from http://blog.dkbza.org/2007/05/scanning-data-for-entropy-anomalies.html
64
58
    """
65
59
    if not data:
66
60
        return 0
67
61
    entropy = 0
68
62
    for x in iterator:
69
63
        p_x = float(data.count(x)) / len(data)
70
64
        if p_x > 0:
71
65
            entropy += - p_x * math.log(p_x, 2)
72
66
    return entropy
73
67
74
68
75
69
def get_strings_of_set(word, char_set, threshold=8):
76
70
    count = 0
77
71
    letters = ""
78
72
    strings = []
79
73
    for char in word:
80
74
        if char in char_set:
81
75
            letters += char
82
76
            count += 1
83
77
        else:
84
78
            if count > threshold:
85
79
                strings.append(letters)
86
80
            letters = ""
87
81
            count = 0
88
82
    if count > threshold:
89
83
        strings.append(letters)
90
84
    return strings
91
85
92
86
93
87
def check_for_entropy_in_dict(bundle):
94
88
    lines = yaml.dump(bundle).split('\n')
95
89
    stringsFound = []
96
90
    entropy_found = False
97
91
    BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
98
92
    HEX_CHARS = "1234567890abcdefABCDEF"
99
93
    for line in lines:
100
94
        for word in line.split():
101
95
            base64_strings = get_strings_of_set(word, BASE64_CHARS)
102
96
            hex_strings = get_strings_of_set(word, HEX_CHARS)
103
97
            for string in base64_strings:
104
98
                b64Entropy = shannon_entropy(string, BASE64_CHARS)
105
99
                if b64Entropy > 3.8:
106
100
                    stringsFound.append(string)
107
101
                    entropy_found = True
108
102
                    print('WARNING! Entropy found in string "{}"'.format(string))
109
103
            for string in hex_strings:
110
104
                hexEntropy = shannon_entropy(string, HEX_CHARS)
111
105
                if hexEntropy > 3:
112
106
                    stringsFound.append(string)
113
107
                    entropy_found = True
114
108
                    print('WARNING! Entropy found in string "{}"'.format(string))
115
109
116
110
    if len(stringsFound) != 0:
117
111
        print('ERROR!!! Check output file for entropy warnings, may not be secure.')
118
112
119
113
    return entropy_found
120
114
121
115
122
116
def main():
123
117
    args = parse_args()
124
118
    bundle = readbundle(args.infile)
125
119
    mask_regex = re.compile(MASK_KEYS)
126
120
    mask_keys_in_dict(bundle, mask_regex)
127
121
    check_for_entropy_in_dict(bundle)
128
122
    print(yaml.dump(bundle, default_flow_style=False), file=args.outfile)
129
123
130
124
131
125
if __name__ == "__main__":
132
126
    main()
Status:	Merged
Approved by:	Xav Paice on 2020-05-19
Approved revision:	a9fbfa0baba7e300f4da7d38ff67b1f07fa7f743
Merged at revision:	2c6ef760296a91c213a3ff60c1a445a1cd952868
Proposed branch:	bootstack-ops:rm-juju-bundle-export-mask
Merge into:	bootstack-ops:master
Diff against target:	132 lines (+0/-126) 1 file modified dev/null (+0/-126)
Related bugs:	Link a bug report
Reviewer	Review Type	Date Requested	Status
Xav Paice (community)		2020-05-18	Approve on 2020-05-19
Review via email: mp+384086@code.launchpad.net