Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(extra730): Handle invalid date formats checking ACM certificates #1033

Merged
merged 2 commits into from
Feb 9, 2022
Merged

fix(extra730): Handle invalid date formats checking ACM certificates #1033

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d03385
fix(date): Darwin/BSD command
jfagoagas Feb 7, 2022
3f787cd
fix(date): Handle invalid date format
jfagoagas Feb 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 20 additions & 10 deletions checks/check_extra730
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,24 +27,34 @@ CHECK_DOC_extra730='https://docs.aws.amazon.com/config/latest/developerguide/acm
CHECK_CAF_EPIC_extra730='Data Protection'

extra730(){
# Only RSA key types, needed to recover Amazon Issued, Imported and Private PKIs
local ACM_KEY_TYPES="RSA_1024,RSA_2048,RSA_3072,RSA_4096"
local ACM_CERTIFICATE_STATUSES="ISSUED"

# "Check if ACM Certificates are about to expire in $DAYS_TO_EXPIRE_THRESHOLD days or less"
for regx in $REGIONS; do
LIST_OF_ACM_CERTS=$($AWSCLI acm list-certificates $PROFILE_OPT --region $regx --query 'CertificateSummaryList[].CertificateArn' --output text)
if [[ $LIST_OF_ACM_CERTS ]];then
LIST_OF_ACM_CERTS=$("${AWSCLI}" acm list-certificates ${PROFILE_OPT} --region "${regx}" --include keyTypes="${ACM_KEY_TYPES}" --certificate-statuses "${ACM_CERTIFICATE_STATUSES}" --query 'CertificateSummaryList[].CertificateArn' --output text)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about imported certificates?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It checks every ACM certificate whether it is Amazon Issued, Imported or comes from a Private PKI.

For that reason we have included two filters:

  • ACM_KEY_TYPES: to set the algorithms that can be used to generate key pairs.
  • ACM_CERTIFICATE_STATUSES: to only check ACM Certificates whose status is ISSUED. The following statuses are not checked:
PENDING_VALIDATION
INACTIVE
EXPIRED
VALIDATION_TIMED_OUT
REVOKED
FAILED

if [[ $LIST_OF_ACM_CERTS ]]; then
for cert in $LIST_OF_ACM_CERTS; do
CERT_DATA=$($AWSCLI acm describe-certificate $PROFILE_OPT --region $regx --certificate-arn $cert --query 'Certificate.[DomainName,NotAfter]' --output text)
echo "$CERT_DATA" | while read FQDN NOTAFTER; do
EXPIRES_DATE=$(timestamp_to_date $NOTAFTER)
COUNTER_DAYS=$(how_many_days_from_today $EXPIRES_DATE)
if [[ $COUNTER_DAYS -le $DAYS_TO_EXPIRE_THRESHOLD ]]; then
textFail "$regx: Certificate for $FQDN is about to expire in $COUNTER_DAYS days!" "$regx" "$FQDN"
CERT_DATA=$("${AWSCLI}" acm describe-certificate ${PROFILE_OPT} --region "${regx}" --certificate-arn "${cert}" --query 'Certificate.[DomainName,NotAfter]' --output text)
# Format: domain.test.com YYYY-MM-DDTHH:MM:SS
echo "$CERT_DATA" | while read -r FQDN NOTAFTER; do
EXPIRES_DATE=$(timestamp_to_date "${NOTAFTER}")
if [[ "${EXPIRES_DATE}" == "" ]]
then
textInfo "${regx}: Certificate for ${FQDN} has an incorrect timestamp format: ${NOTAFTER}" "${regx}" "${FQDN}"
else
textPass "$regx: Certificate for $FQDN expires in $COUNTER_DAYS days" "$regx" "$FQDN"
COUNTER_DAYS=$(how_many_days_from_today "${EXPIRES_DATE}")
if [[ $COUNTER_DAYS -le $DAYS_TO_EXPIRE_THRESHOLD ]]; then
textFail "${regx}: Certificate for ${FQDN} is about to expire in ${COUNTER_DAYS} days!" "${regx}" "${FQDN}"
else
textPass "${regx}: Certificate for ${FQDN} expires in ${COUNTER_DAYS} days" "${regx}" "{$FQDN}"
fi
fi
done
done
else
textInfo "$regx: No certificates found" "$regx"
textInfo "${regx}: No certificates found" "${regx}"
fi
done
}
32 changes: 12 additions & 20 deletions include/os_detector
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,28 +32,20 @@ bsd_how_older_from_today() {
# function to convert from timestamp to date
# output date format %Y-%m-%d
gnu_timestamp_to_date() {
# if date comes from cli v2 in format like 2020-04-29T10:13:09.191000-04:00
# we have to get only '%Y-%m-%d'
if [[ $1 = 20* ]];then
echo $1 | cut -f1 -d"T"
else
Comment on lines -37 to -39
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've deleted this date parsing because it allows something like 20wathever

# remove fractions of a second
TIMESTAMP_TO_CONVERT=$(echo $1 | cut -f1 -d".")
OUTPUT_DATE=$("$DATE_CMD" -d @$TIMESTAMP_TO_CONVERT +'%Y-%m-%d')
echo $OUTPUT_DATE
fi
# if date comes from cli v2 in format like 2020-04-29T10:13:09.191000-04:00, which is ISO8601

# remove fractions of a second
TIMESTAMP_TO_CONVERT=$(cut -f1 -d"." <<< "${1}")
OUTPUT_DATE=$("${DATE_CMD}" -d @"${TIMESTAMP_TO_CONVERT}" +'%Y-%m-%d')
echo "${OUTPUT_DATE}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this echo really needed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it's the way to return the OUTPUT_DATE value

}
bsd_timestamp_to_date() {
# if date comes from cli v2 in format like 2020-04-29T10:13:09.191000-04:00
# we have to get only '%Y-%m-%d'
if [[ $1 = 20* ]];then
echo $1 | cut -f1 -d"T"
else
Comment on lines -49 to -51
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've deleted this date parsing because it allows something like 20wathever

# remove fractions of a second
TIMESTAMP_TO_CONVERT=$(echo $1 | cut -f1 -d".")
OUTPUT_DATE=$("$DATE_CMD" -r $TIMESTAMP_TO_CONVERT +'%Y-%m-%d')
echo $OUTPUT_DATE
fi
# if date comes from cli v2 in format like 2020-04-29T10:13:09.191000-04:00, which is ISO8601

# remove fractions of a second
TIMESTAMP_TO_CONVERT=$(cut -f1 -d"." <<< "${1}")
OUTPUT_DATE=$("${DATE_CMD}" -jf %Y-%m-%d "${TIMESTAMP_TO_CONVERT}" +%F 2>/dev/null)
echo "${OUTPUT_DATE}"
}

gnu_decode_report() {
Expand Down