Skip to content

Commit ea56dfd

Browse files
mlguptamlgupta
committed
Code Analysis
1 parent 63d74a5 commit ea56dfd

File tree

2 files changed

+101
-81
lines changed

2 files changed

+101
-81
lines changed

‎.github/workflows/codeql-analysis.yml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
# ******** NOTE ********
12+
13+
name: "CodeQL"
14+
15+
on:
16+
push:
17+
branches: [ master ]
18+
pull_request:
19+
# The branches below must be a subset of the branches above
20+
branches: [ master ]
21+
schedule:
22+
- cron: '15 11 * * 3'
23+
24+
jobs:
25+
analyze:
26+
name: Analyze
27+
runs-on: ubuntu-latest
28+
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
language: [ 'python' ]
33+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
34+
# Learn more...
35+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
41+
# Initializes the CodeQL tools for scanning.
42+
- name: Initialize CodeQL
43+
uses: github/codeql-action/init@v1
44+
with:
45+
languages: ${{ matrix.language }}
46+
# If you wish to specify custom queries, you can do so here or in a config file.
47+
# By default, queries listed here will override any specified in a config file.
48+
# Prefix the list here with "+" to use these queries and those in the config file.
49+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
50+
51+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
52+
# If this step fails, then you should remove it and run the build manually (see below)
53+
- name: Autobuild
54+
uses: github/codeql-action/autobuild@v1
55+
56+
# ℹ️ Command-line programs to run using the OS shell.
57+
# 📚 https://git.io/JvXDl
58+
59+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
60+
# and modify them (or add more) to build your code if your project
61+
# uses a compiled language
62+
63+
#- run: |
64+
# make bootstrap
65+
# make release
66+
67+
- name: Perform CodeQL Analysis
68+
uses: github/codeql-action/analyze@v1

‎app/utils/sshkrl.py

+33-81
Original file line numberDiff line numberDiff line change
@@ -21,22 +21,14 @@
2121

2222
class SSHKRL(object):
2323
''' SSHKRL Class '''
24-
ca_host_key = ''
25-
ca_user_key = ''
2624
ca_krl_file = ''
27-
ca_tmp_work_dir = ''
28-
ca_tmp_work_delete_flag = True
2925
krl_buf_len = 0
3026
krl = {}
3127

3228
def __init__(self):
3329
app.logger.debug("Enter")
3430
self.ca_dir = app.config["SSH_CA_DIR"]
35-
self.ca_host_key = self.ca_dir + "/" + app.config["SSH_CA_HOST_KEY"]
36-
self.ca_user_key = self.ca_dir + "/" + app.config["SSH_CA_USER_KEY"]
3731
self.ca_krl_file = self.ca_dir + "/" + app.config["SSH_CA_KRL_FILE"]
38-
self.ca_tmp_work_dir = self.ca_dir + "/" + app.config["SSH_CA_TMP_WORK_DIR"]
39-
self.ca_tmp_work_delete_flag = app.config["SSH_CA_TMP_DELETE_FLAG"]
4032

4133
try:
4234
with open(self.ca_krl_file, mode="rb") as krl_file:
@@ -63,38 +55,15 @@ def __init__(self):
6355
self.krl["krl_flags"] = krlbuf[krl_buf_ptr:krl_buf_ptr+8]
6456
krl_buf_ptr += 8
6557

66-
string_size = struct.unpack('>i', krlbuf[krl_buf_ptr:krl_buf_ptr+4])[0]
67-
krl_buf_ptr += 4
68-
69-
if (self.krl_buf_len < krl_buf_ptr + string_size):
70-
app.logger.error("KRL Parse Error at reserved string " + str(krl_buf_ptr))
71-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
72-
73-
krl_buf_ptr += string_size
74-
string_size = struct.unpack('>i', krlbuf[krl_buf_ptr:krl_buf_ptr+4])[0]
75-
krl_buf_ptr += 4
76-
77-
if (self.krl_buf_len < krl_buf_ptr + string_size):
78-
app.logger.error("KRL Parse Error at comment " + str(krl_buf_ptr))
79-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
58+
krl_buf_ptr, reserved_string = self.read_string_from_buf(krlbuf, krl_buf_ptr)
59+
krl_buf_ptr, self.krl["krl_comment"] = self.read_string_from_buf(krlbuf, krl_buf_ptr)
8060

81-
if (string_size > 0):
82-
self.krl["krl_comment"] = krlbuf[krl_buf_ptr:krl_buf_ptr+string_size]
83-
krl_buf_ptr += string_size
84-
8561
# Parse sections
8662
while (krl_buf_ptr < self.krl_buf_len):
8763
section_type = struct.unpack('c', krlbuf[krl_buf_ptr:krl_buf_ptr+1])[0]
8864
krl_buf_ptr += 1
89-
string_size = struct.unpack('>i', krlbuf[krl_buf_ptr:krl_buf_ptr+4])[0]
90-
krl_buf_ptr += 4
9165

92-
if (self.krl_buf_len < krl_buf_ptr + string_size):
93-
app.logger.error("KRL Parse Error at Sections " + str(krl_buf_ptr))
94-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
95-
96-
section_data = krlbuf[krl_buf_ptr:krl_buf_ptr+string_size]
97-
krl_buf_ptr += string_size
66+
krl_buf_ptr, section_data = self.read_string_from_buf(krlbuf, krl_buf_ptr)
9867

9968
if (section_type == b'\x01'):
10069
section_ptr = 0
@@ -103,41 +72,16 @@ def __init__(self):
10372
if ("krl_certs" not in self.krl):
10473
self.krl["krl_certs"] = []
10574
while (section_ptr < section_data_len):
106-
string_size = struct.unpack('>i', section_data[section_ptr:section_ptr+4])[0]
107-
section_ptr += 4
108-
109-
if (section_data_len < section_ptr + string_size):
110-
app.logger.error("KRL Parse Error at section 1. Section PTR: " + str(section_ptr))
111-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
112-
11375
krl_certs = {}
114-
115-
krl_certs["ca_key"] = section_data[section_ptr:section_ptr+string_size]
116-
section_ptr += string_size
117-
118-
string_size = struct.unpack('>i', section_data[section_ptr:section_ptr+4])[0]
119-
section_ptr += 4
120-
121-
if (section_data_len < section_ptr + string_size):
122-
app.logger.error("KRL Parse Error at section 1. Section PTR: " + str(section_ptr))
123-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
124-
125-
section_ptr += string_size
76+
section_ptr, krl_certs["ca_key"] = self.read_string_from_buf(section_data, section_ptr)
77+
section_ptr, reserved_string = self.read_string_from_buf(section_data, section_ptr)
12678

12779
cert_section_type = struct.unpack('c', section_data[section_ptr:section_ptr+1])[0]
12880
section_ptr += 1
12981

130-
string_size = struct.unpack('>i', section_data[section_ptr:section_ptr+4])[0]
131-
section_ptr += 4
132-
133-
if (section_data_len < section_ptr + string_size):
134-
app.logger.error("KRL Parse Error at section 1. Section PTR: " + str(section_ptr))
135-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
82+
section_ptr, cert_serial_list = self.read_string_from_buf(section_data, section_ptr)
13683

13784
if (cert_section_type == b'\x20'):
138-
cert_serial_list = section_data[section_ptr:section_ptr+string_size]
139-
section_ptr += string_size
140-
14185
cert_serial_list_ptr = 0
14286
cert_serial_list_len = len(cert_serial_list)
14387

@@ -147,49 +91,57 @@ def __init__(self):
14791
app.logger.debug("Cert Serial No: " + str(struct.unpack('>q', cert_serial_list[cert_serial_list_ptr:cert_serial_list_ptr+8])[0]))
14892
cert_serial_list_ptr += 8
14993
app.logger.debug("Cert Serial List Size: " + str(len(krl_certs["cert_serial_list"])))
150-
else:
151-
section_ptr += string_size
15294

15395
self.krl["krl_certs"].append(krl_certs)
15496
elif (section_type == b'\x02'):
15597
section_ptr = 0
15698
section_data_len = len(section_data)
15799
if ("krl_keys" not in self.krl):
158100
self.krl["krl_keys"] = []
101+
159102
while (section_ptr < section_data_len):
160-
string_size = struct.unpack('>i', section_data[section_ptr:section_ptr+4])[0]
161-
section_ptr += 4
162-
163-
if (section_data_len < section_ptr + string_size):
164-
app.logger.error("KRL Parse Error at section 2. Section PTR: " + str(section_ptr))
165-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
103+
section_ptr, krl_key = self.read_string_from_buf(section_data, section_ptr)
104+
self.krl["krl_keys"].append(krl_key)
166105

167-
self.krl["krl_keys"].append(section_data[section_ptr:section_ptr+string_size])
168-
section_ptr += string_size
169106
app.logger.debug("KRL Keys Size: " + str(len(self.krl["krl_keys"])))
170107
elif (section_type == b'\x05'):
171108
section_ptr = 0
172109
section_data_len = len(section_data)
173110
if ("krl_key_hash" not in self.krl):
174111
self.krl["krl_key_hash"] = []
175112
while (section_ptr < section_data_len):
176-
string_size = struct.unpack('>i', section_data[section_ptr:section_ptr+4])[0]
177-
section_ptr += 4
113+
section_ptr, krl_key_hash = self.read_string_from_buf(section_data, section_ptr)
114+
self.krl["krl_key_hash"].append(krl_key_hash)
115+
app.logger.debug("Key Hash: " + str(krl_key_hash))
178116

179-
if (section_data_len < section_ptr + string_size):
180-
app.logger.error("KRL Parse Error at section 5. Section PTR: " + str(section_ptr))
181-
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
182-
183-
self.krl["krl_key_hash"].append(section_data[section_ptr:section_ptr+string_size])
184-
app.logger.debug("Key Hash: " + section_data[section_ptr:section_ptr+string_size].hex())
185-
section_ptr += string_size
186117
app.logger.debug("KRL Key Hash Size: " + str(len(self.krl["krl_key_hash"])))
187118
except OSError as e:
188119
app.logger.error("OS error: " + str(e))
189120
raise KeyperError(errors["OSError"].get("msg"), errors["OSError"].get("status"))
190121

191122
app.logger.debug("Exit")
192123

124+
def read_string_from_buf(self, buf, ptr):
125+
''' Returns a string from buffer '''
126+
app.logger.debug("Enter")
127+
128+
result_string = None
129+
result_ptr = ptr
130+
buf_len = len(buf)
131+
132+
string_size = struct.unpack('>i', buf[result_ptr:result_ptr+4])[0]
133+
result_ptr += 4
134+
135+
if (buf_len < result_ptr + string_size):
136+
app.logger.error("KRL Parse Error at section. PTR: " + str(result_ptr))
137+
raise KeyperError(errors["KRLParseError"].get("msg"), errors["KRLParseError"].get("status"))
138+
139+
result_string = buf[result_ptr:result_ptr+string_size]
140+
result_ptr += string_size
141+
142+
app.logger.debug("Exit")
143+
return result_ptr, result_string
144+
193145
def is_key_revoked(self, key_hash):
194146
''' Checks if key hash in KRL '''
195147
app.logger.debug("Enter")

0 commit comments

Comments
 (0)