Controlling FirewallD as OpenC2 actuator

This is a test of standard under development, provided for illustration purposes only.

Tries to implement FirewallD-based SLPF actuator for OpenC2 over HTTPS.

No warranty whatsoever.

Running environment

Quick-start

git clone https://github.com/korc/openc2-firewalld && cd openc2-firewalld
sudo apt install gnutls-bin golang firewalld
mkdir -p run-$$ && cd run-$$
../test/gen-certs.sh
go run ../cmd/oc2-proxy-server -cmdschema ../test/command-schema.json -respschema ../test/response-schema.json &
sudo systemctl start firewalld && sudo go run ../cmd/firewalld-oc2-client &
../test/test-request.sh ../test/test-query.json

Command-line options

OpenC2 command proxy server (consumer/producer)

go run github.com/korc/openc2-firewalld/cmd/oc2-proxy-server

• -listen string Listen address (default "localhost:1512")
• -cert string Server certificate (default "server.crt"). Empty string ("") will turn off TLS.
• -key string Private key for certificate (default "server.key")
• -cacert string Client CA certificate (default "ca.crt")
• -path string URL path to OpenC2 endpoint (default "/oc2")
• -www string Path to static html pages (ex: a copy of openc2-cmdgen)

OpenC2 command client (consumer)

go run github.com/korc/openc2-firewalld/cmd/firewalld-oc2-client

• -cert string Client X509 certificate (default "client.crt")
• -id string Asset ID to use
• -interval float wait interval in seconds (default 10)
• -key string Private key for x509 certificate (default "client.key")
• -server string OpenC2 server URL (default "http://localhost:1512/oc2")
• -zone string Zone to manipulate (default "public")

test/gen-certs.sh

• No options
• generates server, client and ca PEM-encoded .crt and .key files.
• client.crt will be signed by ca.crt.
• xxx.tmpl contain templates for certificates.