search

google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
453 stars 89 forks source link

Remove external IPs when putting an instance into network quarantine (GCP) #351

Closed zkck closed 3 years ago

zkck commented 3 years ago

Closes #347

The current way GCE instances are put into quarantine is via firewall rules. This prevents new connections, but does not break ongoing connections. Removing the external IP addresses will break these ongoing connections.

The additions in this PR are the following subsequent steps to quarantining the instance:

  1. Removing all external IP addresses associated to an instance, breaking off all ongoing connections.
  2. Restoring the external IPs. If the IP address was static, it will be re-applied. Otherwise if it was ephemeral, an ephemeral address will be re-applied.
codecov-commenter commented 3 years ago

Codecov Report

:exclamation: No coverage uploaded for pull request base (main@7653dcd). Click here to learn what that means. The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #351   +/-   ##
=======================================
  Coverage        ?   58.92%           
=======================================
  Files           ?       34           
  Lines           ?     2795           
  Branches        ?        0           
=======================================
  Hits            ?     1647           
  Misses          ?     1148           
  Partials        ?        0
Flag Coverage Δ
nosetests 58.92% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 7653dcd...28c3e9c. Read the comment docs.