Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Origin link ID storage fix #2187

Merged
merged 4 commits into from Oct 18, 2021
Merged

Origin link ID storage fix #2187

merged 4 commits into from Oct 18, 2021

Conversation

uruwhy
Copy link
Contributor

@uruwhy uruwhy commented Jun 25, 2021

Description

Since link IDs are now UUID strings, we will change the agent's origin_link_id field to be stored as a string rather than as an integer.

This will help address origin link ID issues in #2162

Requires mitre/gocat#59

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Updated and ran tests.

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works

@uruwhy uruwhy removed the request for review from mchan143 July 1, 2021 13:04
@uruwhy uruwhy marked this pull request as draft July 1, 2021 13:04
@uruwhy uruwhy removed the request for review from kaylakraines July 1, 2021 13:04
@github-actions
Copy link

This issue is stale because it has been open 20 days with no activity. Remove stale label or comment or this will be closed in 5 days

@uruwhy uruwhy marked this pull request as ready for review October 13, 2021 17:55
@sonarcloud
Copy link

sonarcloud bot commented Oct 13, 2021

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@codecov
Copy link

codecov bot commented Oct 13, 2021

Codecov Report

Merging #2187 (b4628bf) into master (a3532c2) will not change coverage.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #2187   +/-   ##
=======================================
  Coverage   72.62%   72.62%           
=======================================
  Files         110      110           
  Lines        7942     7942           
=======================================
  Hits         5768     5768           
  Misses       2174     2174           
Impacted Files Coverage Δ
app/objects/c_agent.py 90.31% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a3532c2...b4628bf. Read the comment docs.

@bleepbop
Copy link
Contributor

bleepbop commented Oct 14, 2021

I'm getting an error when running a 54ndc47 agent. Seems like the instantiated agent still has origin_link_id as an int, because in the project logs I'm getting an ERROR (contact_http.py:40 _beacon) Malformed beacon: {'origin_link_id': ['Not a valid string.']}. HTML/TCP agents are working though

@uruwhy
Copy link
Contributor Author

uruwhy commented Oct 14, 2021

I'm getting an error when running a 54ndc47 agent. Seems like the instantiated agent still has origin_link_id as an int, because in the project logs I'm getting an ERROR (contact_http.py:40 _beacon) Malformed beacon: {'origin_link_id': ['Not a valid string.']}. HTML/TCP agents are working though

You'll need to make sure your gocat repo is using the branch from mitre/gocat#59 - unfortunately, I had to make changes to both the core platform code and the agent code itself. @bleepbop

Copy link
Contributor

@bleepbop bleepbop left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm getting an error when running a 54ndc47 agent. Seems like the instantiated agent still has origin_link_id as an int, because in the project logs I'm getting an ERROR (contact_http.py:40 _beacon) Malformed beacon: {'origin_link_id': ['Not a valid string.']}. HTML/TCP agents are working though

You'll need to make sure your gocat repo is using the branch from mitre/gocat#59 - unfortunately, I had to make changes to both the core platform code and the agent code itself. @bleepbop

Sorry, missed that before. Looks good to me!

Copy link
Contributor

@mchan143 mchan143 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good to me. I think an update to the documentation regarding Lateral Movement Tracking should probably have a note about origin_link_id being a string instead.

@uruwhy
Copy link
Contributor Author

uruwhy commented Oct 18, 2021

This looks good to me. I think an update to the documentation regarding Lateral Movement Tracking should probably have a note about origin_link_id being a string instead.

Good idea - I'll make a PR for fieldmanual

@uruwhy uruwhy merged commit 1f35413 into master Oct 18, 2021
@uruwhy uruwhy deleted the origin-link-id-update branch October 18, 2021 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants