mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.21k stars 410 forks source link

Refactor greenlet handling and fix related bugs #493

Closed srenfo closed 3 years ago

srenfo commented 4 years ago

This PR refactors all greenlet handling, especially in test code, and fixes all bugs that were exposed in the process.

I'm sorry that this is such a big PR but it's next to impossible to chop it into independent pieces. It may be best to view this commit by commit or as a side-by-side diff rather than a unified diff.

Highlights:

There are new tests for the refactored utility code.

Bug fixes:

Tests for these bugs are included. (All those tests would fail on the current master.)

Caveats:

srenfo commented 4 years ago

Let me know if you want me to remove parts of this or split it up in a certain way.

xandfury commented 4 years ago

Thanks for your contribution :slightly_smiling_face: Would need some time to review this. I hope that's okay.

srenfo commented 4 years ago

If this proves too unwieldy I can split it into multiple PRs that build on each other.

xandfury commented 4 years ago

Good job @srenfo :tada: I'll be happy to merge your changes. I can live without logger comments. But I strongly believe that we should keep the __main__ sections where ever they were added.

srenfo commented 4 years ago

Sorry, I'm rather busy at work right now. It may take another week or so but I'll come back to this. Ping me otherwise.

srenfo commented 4 years ago

I appreciate the kind words @glaslos and @xandfury, thank you!

How did you end up working on Conpot?

Primarily, it's convenient if you want to quickly spin up a server of an ICS protocol. For example, we're currently doing research work on/with IEC104 and sometimes you just want a random IEC104 server to talk to. :smile: For a previous research project we actually had it deployed as a honeypot, though not much came from that unfortunately.

So after using it for some time it's only appropriate to give back here and there.

We have contributed a few small PRs before, we just haven't tagged ourselves as a group.

glaslos commented 4 years ago

@xandfury any remaining concerns?

xandfury commented 4 years ago

Hey @srenfo. The changes look good to me. Can you fix the conflicts so that we can merge?

glaslos commented 4 years ago

@srenfo you probably want to run black over your branch before merging. Should be easier than fixing the merge conflicts.

srenfo commented 4 years ago

@srenfo you probably want to run black over your branch before merging. Should be easier than fixing the merge conflicts.

Are you sure this is a good idea with master currently failing? (I haven't looked into why it's failing exactly.) I can hold off until that's fixed.

Alternatively you could revert the broken commits (or actually remove them from master with a force push), reopen https://github.com/mushorg/conpot/pull/501 and do the fixes on the branch there. That would require eventually rebasing that branch of course if you wanted to merge this branch here in the meantime.

glaslos commented 3 years ago

@srenfo if you give me permissions to change the PR I can help with resolving the conflicts

srenfo commented 3 years ago

@srenfo if you give me permissions to change the PR I can help with resolving the conflicts

The conflicts should be resolved.

There's a chance Travis will complain since master has changed since this was first opened. Fingers crossed. :crossed_fingers:

glaslos commented 3 years ago

hm, maybe merge master to get the git action to run?

srenfo commented 3 years ago

Trying again... it's rebased on the current master, so a merge does nothing.

What's weird is that I've used this workflow before and it had always triggered the build (AFAICT).

I've also (re-)enabled "Allow edits and access to secrets by maintainers", though I believe it was the same before. Do you need me to do anything else?

srenfo commented 3 years ago

I've even added an empty commit to try to force the build to trigger, but apparently it's just slow.

As of this writing, the CI build is queued: https://travis-ci.org/github/mushorg/conpot/pull_requests

You can see that the black check succeeded in my fork (i. e. the source of this PR): https://github.com/srenfo/conpot/runs/1343712255

coveralls commented 3 years ago

Pull Request Test Coverage Report for Build 1236


Changes Missing Coverage Covered Lines Changed/Added Lines %
conpot/utils/greenlet.py 40 41 97.56%
<!-- Total: 71 72 98.61% -->
Files with Coverage Reduction New Missed Lines %
conpot/core/protocol_wrapper.py 1 95.45%
conpot/protocols/s7comm/s7_server.py 2 64.66%
conpot/protocols/http/command_responder.py 3 60.82%
conpot/protocols/IEC104/IEC104_server.py 5 86.02%
conpot/protocols/kamstrup/management_protocol/kamstrup_management_server.py 8 83.64%
conpot/protocols/enip/enip_server.py 20 65.14%
conpot/protocols/ftp/ftp_base_handler.py 20 83.08%
conpot/protocols/ftp/ftp_handler.py 26 81.23%
<!-- Total: 85 -->
Totals Coverage Status
Change from base Build 1233: 0.3%
Covered Lines: 5545
Relevant Lines: 7532

💛 - Coveralls
glaslos commented 3 years ago

Maybe the new pricing policies are having an effect? https://blog.travis-ci.com/2020-11-02-travis-ci-new-billing

glaslos commented 3 years ago

Alright, let's get this merged. Travis seems a bit confused due to the force-push.