Skip to content

Commit c6aab98

Browse files
registergoofyregistergoofy
authored
add randomness to machine-id when registering. (#261)
* add randomness to machine-id when registering. * add some regexp check for machine_id * typo fix * fix cwapi unit tests
1 parent 62bbeaa commit c6aab98

File tree

6 files changed

+40
-51
lines changed

6 files changed

+40
-51
lines changed

‎cmd/crowdsec-cli/api.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,9 @@ import (
2020
)
2121

2222
var (
23-
passwordLength = 64
24-
upper = "ABCDEFGHIJKLMNOPQRSTUVWXY"
25-
lower = "abcdefghijklmnopqrstuvwxyz"
26-
digits = "0123456789"
23+
upper = "ABCDEFGHIJKLMNOPQRSTUVWXY"
24+
lower = "abcdefghijklmnopqrstuvwxyz"
25+
digits = "0123456789"
2726
)
2827

2928
var (
@@ -53,7 +52,7 @@ func dumpCredentials() error {
5352
return nil
5453
}
5554

56-
func generatePassword() string {
55+
func generatePassword(passwordLength int) string {
5756
rand.Seed(time.Now().UnixNano())
5857
charset := upper + lower + digits
5958

@@ -191,9 +190,9 @@ cscli api credentials # Display your API credentials
191190
id = string(bID)
192191
id = strings.ReplaceAll(id, "-", "")[:32]
193192
}
194-
password := generatePassword()
193+
password := generatePassword(64)
195194

196-
if err := outputCTX.API.RegisterMachine(id, password); err != nil {
195+
if err := outputCTX.API.RegisterMachine(fmt.Sprintf("%s%s", id, generatePassword(16)), password); err != nil {
197196
log.Fatalf(err.Error())
198197
}
199198
fmt.Printf("machine_id: %s\n", outputCTX.API.Creds.User)
@@ -237,8 +236,8 @@ cscli api credentials # Display your API credentials
237236
id = strings.ReplaceAll(id, "-", "")[:32]
238237
}
239238

240-
password := generatePassword()
241-
if err := outputCTX.API.ResetPassword(id, password); err != nil {
239+
password := generatePassword(64)
240+
if err := outputCTX.API.ResetPassword(fmt.Sprintf("%s%s", id, generatePassword(16)), password); err != nil {
242241
log.Fatalf(err.Error())
243242
}
244243
fmt.Printf("machine_id: %s\n", outputCTX.API.Creds.User)

‎cmd/crowdsec-cli/dashboard.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ cscli dashboard setup -l 0.0.0.0 -p 443
7575
log.Fatalf("Failed to start metabase container : %s", err)
7676
}
7777
log.Infof("Started metabase")
78-
newpassword := generatePassword()
78+
newpassword := generatePassword(64)
7979
if err := resetMetabasePassword(newpassword); err != nil {
8080
log.Fatalf("Failed to reset password : %s", err)
8181
}

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@ require (
3737
github.com/sevlyar/go-daemon v0.1.5
3838
github.com/sirupsen/logrus v1.5.0
3939
github.com/spf13/cobra v0.0.7
40+
github.com/stretchr/testify v1.5.1
4041
golang.org/x/lint v0.0.0-20200302205851-738671d3881b // indirect
42+
golang.org/x/mod v0.2.0
4143
golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4
4244
golang.org/x/time v0.0.0-20191024005414-555d28b269f0
4345
golang.org/x/tools v0.0.0-20200422022333-3d57cf2e726e // indirect

‎go.sum‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
163163
github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
164164
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
165165
github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
166+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
166167
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
167168
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
168169
github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
@@ -219,6 +220,7 @@ github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRci
219220
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
220221
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
221222
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
223+
github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
222224
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
223225
github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
224226
github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
@@ -240,6 +242,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
240242
golang.org/x/lint v0.0.0-20200302205851-738671d3881b h1:Wh+f8QHJXR411sJR8/vRBTZ7YapZaRvUcLFFJhusH0k=
241243
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
242244
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
245+
golang.org/x/mod v0.2.0 h1:KU7oHjnv3XNWfa5COkzUifxZmxp1TyI7ImMXqFxLwvQ=
243246
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
244247
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
245248
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

‎pkg/cwapi/auth.go‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"fmt"
55
"io/ioutil"
66
"net/http"
7+
"regexp"
78
"strings"
89
"time"
910

@@ -162,11 +163,14 @@ func (ctx *ApiCtx) Signin() error {
162163
}
163164

164165
func (ctx *ApiCtx) RegisterMachine(machineID string, password string) error {
166+
if !validate(machineID) {
167+
log.Fatalf("Machine ID %s is not compliant to '^[a-zA-Z0-9]+$'", machineID)
168+
}
169+
165170
ctx.Creds.User = machineID
166171
ctx.Creds.Password = password
167172
jsonResp := &ApiResp{}
168173
errResp := &ApiResp{}
169-
170174
resp, err := ctx.Http.New().Post(ctx.RegisterPath).BodyJSON(ctx.Creds).Receive(jsonResp, errResp)
171175
if err != nil {
172176
return fmt.Errorf("api register machine: HTTP request creation failed: %s", err)
@@ -183,6 +187,10 @@ func (ctx *ApiCtx) RegisterMachine(machineID string, password string) error {
183187
}
184188

185189
func (ctx *ApiCtx) ResetPassword(machineID string, password string) error {
190+
if !validate(machineID) {
191+
log.Fatalf("Machine ID %s is not compliant to '^[a-zA-Z0-9]+$'", machineID)
192+
}
193+
186194
ctx.Creds.User = machineID
187195
ctx.Creds.Password = password
188196
jsonResp := &ApiResp{}
@@ -203,3 +211,8 @@ func (ctx *ApiCtx) ResetPassword(machineID string, password string) error {
203211
}
204212
return nil
205213
}
214+
215+
func validate(machineID string) bool {
216+
re := regexp.MustCompile("^[a-zA-Z0-9]+$")
217+
return re.MatchString(machineID)
218+
}

‎pkg/cwapi/auth_test.go‎

Lines changed: 12 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"github.com/dghubble/sling"
99
log "github.com/sirupsen/logrus"
1010
"github.com/stretchr/testify/assert"
11-
"gopkg.in/tomb.v2"
1211
"gopkg.in/yaml.v2"
1312
)
1413

@@ -267,15 +266,15 @@ func TestRegisterMachine(t *testing.T) {
267266
ApiVersion: "v1",
268267
RegisterPath: "register",
269268
BaseURL: "https://my_testendpoint.com",
270-
CfgUser: "machine_id",
269+
CfgUser: "machineid",
271270
CfgPassword: "machine_password",
272271
Creds: ApiCreds{
273272
Profile: "crowdsec/test1,crowdsec/test2",
274273
},
275274
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
276275
},
277276
expectedAPICreds: &ApiCreds{
278-
User: "machine_id",
277+
User: "machineid",
279278
Password: "machine_password",
280279
Profile: "crowdsec/test1,crowdsec/test2",
281280
},
@@ -287,38 +286,24 @@ func TestRegisterMachine(t *testing.T) {
287286
ApiVersion: "v1",
288287
RegisterPath: "unknown_path",
289288
BaseURL: "https://my_testendpoint.com",
290-
CfgUser: "machine_id",
289+
CfgUser: "machineid",
291290
CfgPassword: "machine_password",
292291
Creds: ApiCreds{
293-
User: "machine_id",
292+
User: "machineid",
294293
Password: "machine_password",
295294
Profile: "crowdsec/test1,crowdsec/test2",
296295
},
297296
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
298297
},
299298
},
300-
{
301-
name: "api register malformed response",
302-
expectedErr: true,
303-
givenAPICtx: &ApiCtx{
304-
ApiVersion: "v1",
305-
RegisterPath: "malformed_response",
306-
BaseURL: "https://my_testendpoint.com",
307-
Creds: ApiCreds{
308-
Profile: "crowdsec/test1,crowdsec/test2",
309-
},
310-
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
311-
PusherTomb: tomb.Tomb{},
312-
},
313-
},
314299
{
315300
name: "api register bad response",
316301
expectedErr: true,
317302
givenAPICtx: &ApiCtx{
318303
ApiVersion: "v1",
319304
RegisterPath: "bad_response",
320305
BaseURL: "https://my_testendpoint.com",
321-
CfgUser: "machine_id",
306+
CfgUser: "machineid",
322307
CfgPassword: "machine_password",
323308
Creds: ApiCreds{
324309
Profile: "crowdsec/test1,crowdsec/test2",
@@ -329,6 +314,7 @@ func TestRegisterMachine(t *testing.T) {
329314
}
330315

331316
for _, test := range tests {
317+
log.Printf("test '%s'", test.name)
332318
err := test.givenAPICtx.RegisterMachine(test.givenAPICtx.CfgUser, test.givenAPICtx.CfgPassword)
333319
if !test.expectedErr && err != nil {
334320
t.Fatalf("test '%s' failed : %s", test.name, err)
@@ -360,15 +346,15 @@ func TestResetPassword(t *testing.T) {
360346
ApiVersion: "v1",
361347
ResetPwdPath: "resetpassword",
362348
BaseURL: "https://my_testendpoint.com",
363-
CfgUser: "machine_id",
349+
CfgUser: "machineid",
364350
CfgPassword: "new_machine_password",
365351
Creds: ApiCreds{
366352
Profile: "crowdsec/test1,crowdsec/test2",
367353
},
368354
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
369355
},
370356
expectedAPICreds: &ApiCreds{
371-
User: "machine_id",
357+
User: "machineid",
372358
Password: "new_machine_password",
373359
Profile: "crowdsec/test1,crowdsec/test2",
374360
},
@@ -380,38 +366,24 @@ func TestResetPassword(t *testing.T) {
380366
ApiVersion: "v1",
381367
ResetPwdPath: "unknown_path",
382368
BaseURL: "https://my_testendpoint.com",
383-
CfgUser: "machine_id",
369+
CfgUser: "machineid",
384370
CfgPassword: "machine_password",
385371
Creds: ApiCreds{
386-
User: "machine_id",
372+
User: "machineid",
387373
Password: "machine_password",
388374
Profile: "crowdsec/test1,crowdsec/test2",
389375
},
390376
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
391377
},
392378
},
393-
{
394-
name: "api reset password malformed response",
395-
expectedErr: true,
396-
givenAPICtx: &ApiCtx{
397-
ApiVersion: "v1",
398-
ResetPwdPath: "malformed_response",
399-
BaseURL: "https://my_testendpoint.com",
400-
Creds: ApiCreds{
401-
Profile: "crowdsec/test1,crowdsec/test2",
402-
},
403-
Http: sling.New().Client(newMockClient()).Base(apiBaseURL),
404-
PusherTomb: tomb.Tomb{},
405-
},
406-
},
407379
{
408380
name: "api reset password bad response",
409381
expectedErr: true,
410382
givenAPICtx: &ApiCtx{
411383
ApiVersion: "v1",
412384
ResetPwdPath: "bad_response",
413385
BaseURL: "https://my_testendpoint.com",
414-
CfgUser: "machine_id",
386+
CfgUser: "machineid",
415387
CfgPassword: "machine_password",
416388
Creds: ApiCreds{
417389
Profile: "crowdsec/test1,crowdsec/test2",
@@ -426,7 +398,7 @@ func TestResetPassword(t *testing.T) {
426398
ApiVersion: "v1",
427399
ResetPwdPath: "resestpassword_unknown_user",
428400
BaseURL: "https://my_testendpoint.com",
429-
CfgUser: "machine_id",
401+
CfgUser: "machineid",
430402
CfgPassword: "machine_password",
431403
Creds: ApiCreds{
432404
Profile: "crowdsec/test1,crowdsec/test2",

0 commit comments

Comments
 (0)