feat: complete multi-microservice project deployment, internal DNS, raw TCP and security penetration report

2026-10-13 00:01:14 +03:00
parent bdcd2d44f5
commit 2cea9f25ba
15 changed files with 1405 additions and 54 deletions
@@ -0,0 +1,259 @@
+const fs = require('fs');
+const { RemoteTerminal } = require('./remote_exec');
+
+const TOPOLOGY_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json';
+const LOG_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/logs/soc_multiservice_execution.log';
+const RESULTS_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/logs/soc_multiservice_results.json';
+
+const logs = [];
+const results = [];
+
+function log(phase, title, details = '') {
+  const ts = new Date().toISOString();
+  const entry = `[${ts}] [${phase}] === ${title} ===\n${details}\n`;
+  console.log(entry);
+  logs.push(entry);
+  fs.writeFileSync(LOG_FILE, logs.join('\n'));
+}
+
+function recordResult(category, testName, target, status, output, notes = '') {
+  results.push({
+    timestamp: new Date().toISOString(),
+    category,
+    testName,
+    target,
+    status,
+    notes,
+    output: (output || '').trim()
+  });
+  fs.writeFileSync(RESULTS_FILE, JSON.stringify(results, null, 2));
+}
+
+async function main() {
+  const topology = JSON.parse(fs.readFileSync(TOPOLOGY_FILE, 'utf8'));
+  const redisName = topology.services.redis.uniqueName;
+  const backendName = topology.services.backend.uniqueName;
+  const gatewayName = topology.services.gateway.uniqueName;
+  const gatewayDomain = topology.services.gateway.domain;
+
+  log('INIT', 'Starting Comprehensive Multi-Microservice QA & Security Suite for Project:', topology.projectName);
+
+  // Connect to soc-tester pod
+  const tester = new RemoteTerminal(topology.services.tester.domain ? `wss://${topology.services.tester.domain}/ws` : undefined);
+  await tester.connect();
+  log('INIT', 'Connected to soc-tester diagnostic container');
+
+  // Connect to soc-gateway pod
+  const gateway = new RemoteTerminal(`wss://${gatewayDomain}/ws`);
+  await gateway.connect();
+  log('INIT', 'Connected to soc-gateway edge container');
+
+  // ==========================================
+  // PHASE 1: RECONNAISSANCE & POD TOPOLOGY
+  // ==========================================
+  log('PHASE1-RECON', 'Container Network & OS Information (soc-tester)');
+  const osInfo = await tester.exec('uname -a && cat /etc/os-release | grep PRETTY_NAME');
+  log('PHASE1-RECON', 'OS Info', osInfo.output);
+  recordResult('Reconnaissance', 'OS & Kernel', 'soc-tester', 'PASS', osInfo.output);
+
+  const ipInfo = await tester.exec('ip addr show eth0 || ifconfig eth0');
+  log('PHASE1-RECON', 'IP & Network Interfaces', ipInfo.output);
+  recordResult('Reconnaissance', 'IP Interface', 'soc-tester', 'PASS', ipInfo.output);
+
+  const resolvConf = await tester.exec('cat /etc/resolv.conf');
+  log('PHASE1-RECON', 'CoreDNS Resolver Configuration', resolvConf.output);
+  recordResult('Reconnaissance', 'CoreDNS Config (/etc/resolv.conf)', 'CoreDNS', 'PASS', resolvConf.output);
+
+  // ==========================================
+  // PHASE 2: INTERNAL DNS VERIFICATION
+  // ==========================================
+  log('PHASE2-DNS', 'Internal DNS Resolution for Microservices');
+
+  // Test 2.1: soc-redis lookup
+  const dnsRedis = await tester.exec(`nslookup ${redisName}`);
+  log('PHASE2-DNS', `nslookup ${redisName}`, dnsRedis.output);
+  const redisResolved = dnsRedis.output.includes('10.42.');
+  recordResult('DNS Functionality', 'Resolve soc-redis', redisName, redisResolved ? 'PASS' : 'FAIL', dnsRedis.output, 'Resolves redis to internal overlay IP');
+
+  // Test 2.2: soc-backend lookup
+  const dnsBackend = await tester.exec(`nslookup ${backendName}`);
+  log('PHASE2-DNS', `nslookup ${backendName}`, dnsBackend.output);
+  const backendResolved = dnsBackend.output.includes('10.42.');
+  recordResult('DNS Functionality', 'Resolve soc-backend', backendName, backendResolved ? 'PASS' : 'FAIL', dnsBackend.output, 'Resolves backend to internal overlay IP');
+
+  // Test 2.3: soc-gateway lookup
+  const dnsGateway = await tester.exec(`nslookup ${gatewayName}`);
+  log('PHASE2-DNS', `nslookup ${gatewayName}`, dnsGateway.output);
+  const gatewayResolved = dnsGateway.output.includes('10.42.');
+  recordResult('DNS Functionality', 'Resolve soc-gateway', gatewayName, gatewayResolved ? 'PASS' : 'FAIL', dnsGateway.output, 'Resolves gateway to internal overlay IP');
+
+  // Test 2.4: dig full FQDN lookup
+  const digRedis = await tester.exec(`dig +short ${redisName}`);
+  log('PHASE2-DNS', `dig +short ${redisName}`, digRedis.output);
+  recordResult('DNS Functionality', 'Dig A Record', redisName, digRedis.output.trim() ? 'PASS' : 'FAIL', digRedis.output);
+
+  // Test 2.5: Reverse DNS PTR check
+  const redisIp = digRedis.output.trim();
+  if (redisIp) {
+    const ptrCheck = await tester.exec(`dig +short -x ${redisIp}`);
+    log('PHASE2-DNS', `Reverse DNS PTR for ${redisIp}`, ptrCheck.output);
+    recordResult('DNS Functionality', 'Reverse PTR Lookup', redisIp, 'INFO', ptrCheck.output);
+  }
+
+  // Test 2.6: Negative DNS test (non-existent host)
+  const negDns = await tester.exec('nslookup non-existent-service-mesh.local');
+  log('PHASE2-DNS', 'Negative DNS Lookup', negDns.output);
+  const negOk = negDns.output.includes('NXDOMAIN') || negDns.output.includes("can't find");
+  recordResult('DNS Functionality', 'Negative DNS Handling', 'non-existent-service-mesh.local', negOk ? 'PASS' : 'FAIL', negDns.output, 'Expect NXDOMAIN');
+
+  // ==========================================
+  // PHASE 3: RAW TCP PROTOCOL VERIFICATION (REDIS)
+  // ==========================================
+  log('PHASE3-TCP', 'Raw TCP Socket Communication with soc-redis (Port 6379)');
+
+  // Test 3.1: Raw TCP Port Check
+  const tcpProbe = await tester.exec(`nc -zv -w 3 ${redisName} 6379 2>&1`);
+  log('PHASE3-TCP', 'Raw TCP Port 6379 Probe', tcpProbe.output);
+  const portOpen = tcpProbe.output.includes('open');
+  recordResult('TCP Functionality', 'TCP Port 6379 Probe', `${redisName}:6379`, portOpen ? 'PASS' : 'FAIL', tcpProbe.output);
+
+  // Test 3.2: Redis PING Handshake
+  const pingRes = await tester.exec(`printf "*1\\r\\n\\$4\\r\\nPING\\r\\n" | nc -w 3 ${redisName} 6379`);
+  log('PHASE3-TCP', 'Raw TCP Redis PING', pingRes.output);
+  const pingOk = pingRes.output.includes('+PONG');
+  recordResult('TCP Functionality', 'Redis PING Handshake', `${redisName}:6379`, pingOk ? 'PASS' : 'FAIL', pingRes.output, 'Expect +PONG');
+
+  // Test 3.3: Write Security Threat Incident into Redis via raw TCP
+  const alertPayload = 'CRITICAL_RANSOMWARE_BLOCKED_ON_MESH';
+  const writeCmd = `printf "*3\\r\\n\\$3\\r\\nSET\\r\\n\\$16\\r\\nsoc:threat:id001\\r\\n\\$${alertPayload.length}\\r\\n${alertPayload}\\r\\n" | nc -w 3 ${redisName} 6379`;
+  const writeRes = await tester.exec(writeCmd);
+  log('PHASE3-TCP', 'Raw TCP Write Threat Event', writeRes.output);
+  const writeOk = writeRes.output.includes('+OK');
+  recordResult('TCP Functionality', 'Redis SET Security Event', `${redisName}:6379`, writeOk ? 'PASS' : 'FAIL', writeRes.output, 'Expect +OK');
+
+  // Test 3.4: Read Security Threat Incident from Redis via raw TCP
+  const readCmd = `printf "*2\\r\\n\\$3\\r\\nGET\\r\\n\\$16\\r\\nsoc:threat:id001\\r\\n" | nc -w 3 ${redisName} 6379`;
+  const readRes = await tester.exec(readCmd);
+  log('PHASE3-TCP', 'Raw TCP Read Threat Event', readRes.output);
+  const readOk = readRes.output.includes(alertPayload);
+  recordResult('TCP Functionality', 'Redis GET Security Event', `${redisName}:6379`, readOk ? 'PASS' : 'FAIL', readRes.output, `Retrieved ${alertPayload}`);
+
+  // Test 3.5: Atomic Security Threat Counter Increment
+  const incrCmd = `printf "*2\\r\\n\\$4\\r\\nINCR\\r\\n\\$24\\r\\nsoc:threats:total_count\\r\\n" | nc -w 3 ${redisName} 6379`;
+  const incrRes = await tester.exec(incrCmd);
+  log('PHASE3-TCP', 'Raw TCP Atomic Counter Increment', incrRes.output);
+  const incrOk = incrRes.output.includes(':');
+  recordResult('TCP Functionality', 'Redis INCR Attack Counter', `${redisName}:6379`, incrOk ? 'PASS' : 'FAIL', incrRes.output);
+
+  // Test 3.6: Multi-Microservice Mesh Hop: Edge Gateway to Redis via internal DNS
+  log('PHASE3-TCP', 'Gateway-to-Redis Direct Internal TCP Communication');
+  const gwPingRes = await gateway.exec(`printf "*1\\r\\n\\$4\\r\\nPING\\r\\n" | nc -w 3 ${redisName} 6379`);
+  log('PHASE3-TCP', 'Gateway-to-Redis Ping', gwPingRes.output);
+  const gwPingOk = gwPingRes.output.includes('+PONG');
+  recordResult('Inter-Service Mesh', 'soc-gateway -> soc-redis (Port 6379)', `${gatewayName} -> ${redisName}`, gwPingOk ? 'PASS' : 'FAIL', gwPingRes.output, 'Edge Gateway queries Database over internal mesh');
+
+  // Test 3.7: Gateway-to-Backend Direct Internal TCP Communication
+  log('PHASE3-TCP', 'Gateway-to-Backend Direct Internal TCP Communication');
+  const gwBackendRes = await gateway.exec(`nc -zv -w 3 ${backendName} 7681 2>&1`);
+  log('PHASE3-TCP', 'Gateway-to-Backend Port Probe', gwBackendRes.output);
+  const gwBackendOk = gwBackendRes.output.includes('open');
+  recordResult('Inter-Service Mesh', 'soc-gateway -> soc-backend (Port 7681)', `${gatewayName} -> ${backendName}`, gwBackendOk ? 'PASS' : 'FAIL', gwBackendRes.output, 'Gateway probes backend over internal mesh');
+
+  // ==========================================
+  // PHASE 4: EDGE INGRESS & PUBLIC REACHABILITY
+  // ==========================================
+  log('PHASE4-EDGE', 'External Edge Ingress Verification');
+  try {
+    const extFetch = await fetch(`https://${gatewayDomain}/`, { signal: AbortSignal.timeout(8000) });
+    const extBody = await extFetch.text();
+    const extOk = extFetch.status === 200;
+    log('PHASE4-EDGE', `Public Edge Ingress (https://${gatewayDomain}/)`, `HTTP Status: ${extFetch.status}, Length: ${extBody.length}`);
+    recordResult('Edge Ingress', 'Public Gateway URL', `https://${gatewayDomain}/`, extOk ? 'PASS' : 'FAIL', `HTTP Status: ${extFetch.status}`);
+  } catch (e) {
+    log('PHASE4-EDGE', 'Edge Ingress Error', e.message);
+    recordResult('Edge Ingress', 'Public Gateway URL', `https://${gatewayDomain}/`, 'FAIL', e.message);
+  }
+
+  // Verify private database has NO public route
+  try {
+    const redisExt = await fetch(`https://${redisName}.hosted.ghaymah.systems/`, { signal: AbortSignal.timeout(4000) });
+    const redisExtStatus = redisExt.status;
+    log('PHASE4-EDGE', 'Private Database Public Leak Test', `HTTP ${redisExtStatus}`);
+    recordResult('Edge Ingress Isolation', 'Database External Unreachability', `https://${redisName}.hosted.ghaymah.systems/`, redisExtStatus === 404 || redisExtStatus === 502 || redisExtStatus === 503 ? 'PASS' : 'WARNING', `Status: ${redisExtStatus}`, 'Private service should not be exposed externally');
+  } catch (e) {
+    log('PHASE4-EDGE', 'Private Database Public Leak Test', 'Connection blocked or NXDOMAIN (Expected)');
+    recordResult('Edge Ingress Isolation', 'Database External Unreachability', `${redisName}.hosted.ghaymah.systems`, 'PASS', e.message, 'Properly blocked at ingress');
+  }
+
+  // ==========================================
+  // PHASE 5: SECURITY & PENETRATION TESTING
+  // ==========================================
+  log('PHASE5-SEC', 'Security & Penetration Testing (Isolation, Lateral Movement, Egress)');
+
+  // Test 5.1: Intra-Tenant Cross-Project DNS Resolution
+  // Target: test-redis from project dns-tcp-test
+  const crossDns1 = await tester.exec('nslookup test-redis-feccbaec5bd7');
+  log('PHASE5-SEC', 'Cross-Project DNS: test-redis-feccbaec5bd7', crossDns1.output);
+  const crossDns1Resolved = crossDns1.output.includes('10.42.');
+  recordResult('Security / Isolation', 'Cross-Project DNS (test-redis-feccbaec5bd7)', 'test-redis-feccbaec5bd7', crossDns1Resolved ? 'FINDING' : 'SECURE', crossDns1.output, crossDns1Resolved ? 'Intra-tenant cross-project DNS allowed' : 'Project isolated');
+
+  // Target: auth-deploy from project auth-deploy
+  const crossDns2 = await tester.exec('nslookup auth-deploy-4c0bca85312b');
+  log('PHASE5-SEC', 'Cross-Project DNS: auth-deploy-4c0bca85312b', crossDns2.output);
+  const crossDns2Resolved = crossDns2.output.includes('10.42.');
+  recordResult('Security / Isolation', 'Cross-Project DNS (auth-deploy-4c0bca85312b)', 'auth-deploy-4c0bca85312b', crossDns2Resolved ? 'FINDING' : 'SECURE', crossDns2.output, crossDns2Resolved ? 'Intra-tenant cross-project DNS allowed' : 'Project isolated');
+
+  // Test 5.2: Intra-Tenant Cross-Project TCP Lateral Movement
+  const crossTcp1 = await tester.exec('nc -zv -w 3 test-redis-feccbaec5bd7 6379 2>&1');
+  log('PHASE5-SEC', 'Cross-Project TCP: test-redis-feccbaec5bd7:6379', crossTcp1.output);
+  const crossTcp1Open = crossTcp1.output.includes('open');
+  recordResult('Security / Isolation', 'Cross-Project TCP Lateral Movement (Redis 6379)', 'test-redis-feccbaec5bd7:6379', crossTcp1Open ? 'FINDING' : 'SECURE', crossTcp1.output, crossTcp1Open ? 'Unrestricted intra-tenant cross-project TCP socket connection allowed' : 'TCP connection blocked by NetworkPolicy');
+
+  const crossHttp2 = await tester.exec('wget -qO- -T 3 http://auth-deploy-4c0bca85312b/ | head -n 3');
+  log('PHASE5-SEC', 'Cross-Project HTTP: auth-deploy-4c0bca85312b:80', crossHttp2.output);
+  const crossHttp2Open = crossHttp2.output.includes('<') || crossHttp2.output.includes('html');
+  recordResult('Security / Isolation', 'Cross-Project HTTP Lateral Movement (Auth-deploy:80)', 'auth-deploy-4c0bca85312b:80', crossHttp2Open ? 'FINDING' : 'SECURE', crossHttp2.output, crossHttp2Open ? 'Cross-project HTTP communication succeeded' : 'HTTP blocked');
+
+  // Test 5.3: Infrastructure & Multi-Tenant Boundary Probing
+  // Target: Kubernetes API Server
+  const k8sApiProbe = await tester.exec('curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1');
+  log('PHASE5-SEC', 'Kubernetes API Server Probe (10.43.0.1:443)', k8sApiProbe.output);
+  recordResult('Security / Cluster Boundary', 'Kubernetes API Server (10.43.0.1:443)', '10.43.0.1:443', 'INFO', k8sApiProbe.output, 'Checks cluster API access controls');
+
+  // Target: Cloud Metadata Service (169.254.169.254)
+  const metaProbe = await tester.exec('curl -s -m 3 http://169.254.169.254/latest/meta-data/ || echo "BLOCKED_OR_UNREACHABLE"');
+  log('PHASE5-SEC', 'Cloud Metadata Service Probe (169.254.169.254)', metaProbe.output);
+  const metaBlocked = metaProbe.output.includes('BLOCKED_OR_UNREACHABLE') || !metaProbe.output.trim();
+  recordResult('Security / SSRF Isolation', 'Cloud Metadata Endpoint (169.254.169.254)', '169.254.169.254', metaBlocked ? 'PASS' : 'CRITICAL_LEAK', metaProbe.output, metaBlocked ? 'Cloud metadata endpoint unreachable' : 'CRITICAL: Metadata service exposed');
+
+  // Target: CoreDNS Prometheus Metrics (10.43.0.10:9153)
+  const dnsMetrics = await tester.exec('curl -s -m 3 http://10.43.0.10:9153/metrics | head -n 5 || echo "BLOCKED"');
+  log('PHASE5-SEC', 'CoreDNS Metrics Probe (10.43.0.10:9153)', dnsMetrics.output);
+  recordResult('Security / Cluster Telemetry', 'CoreDNS Metrics (10.43.0.10:9153)', '10.43.0.10:9153', dnsMetrics.output.includes('coredns_') ? 'INFO' : 'SECURE', dnsMetrics.output);
+
+  // Test 5.4: Subnet Port Sweep & Lateral Discovery
+  log('PHASE5-SEC', 'Scanning Local Subnet (10.42.5.95 - 10.42.5.105)');
+  const scanCmd = `for i in $(seq 97 103); do nc -zv -w 1 10.42.5.$i 6379 2>&1 | grep open || true; nc -zv -w 1 10.42.5.$i 7681 2>&1 | grep open || true; done`;
+  const scanRes = await tester.exec(scanCmd, 15000);
+  log('PHASE5-SEC', 'Subnet Port Sweep Results', scanRes.output);
+  recordResult('Security / Network Recon', 'Internal Subnet Port Sweep', '10.42.5.97-103', 'PASS', scanRes.output, 'Identified active service endpoints on overlay network');
+
+  // Test 5.5: Container Capabilities & Privilege Audit
+  const capCheck = await tester.exec('grep Cap /proc/self/status && whoami');
+  log('PHASE5-SEC', 'Container Privilege & Capabilities', capCheck.output);
+  recordResult('Security / Container Hardening', 'Privilege & Capabilities', 'soc-tester', 'INFO', capCheck.output);
+
+  // Test 5.6: Egress NAT Public IP Discovery
+  const egressIp = await tester.exec('curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org');
+  log('PHASE5-SEC', 'Egress Public IP', egressIp.output);
+  recordResult('Network / Egress NAT', 'Outbound Public IP', 'api.ipify.org', 'PASS', egressIp.output, 'Cluster node egress NAT IP');
+
+  tester.close();
+  gateway.close();
+
+  log('COMPLETE', 'Multi-Microservice QA and Security Test Suite Complete! Results recorded.');
+  console.log(`\nExecution Log saved to: ${LOG_FILE}`);
+  console.log(`Structured Results saved to: ${RESULTS_FILE}`);
+}
+
+main().catch(console.error);