topic Re: config_system flaw in Firewall and Security Management

config_system flaw

Duane_Toler — Sat, 30 Apr 2022 06:13:24 GMT

(i hope this board is a decent choice...)

First of all: thanks to the R&D folks for providing us with config_system! It's a huge help for automation, and I know you know that already. 🙂 Thanks!

I seem to have found a bit of a flaw in config_system. I did have a minor error in syntax when I generated the FTW config (yes my fault). However, the dry-run check did not detect the syntax error properly.

My config was:

# Install Security Gateway. install_security_gw=" true "

This was generated from my own Ansbile Jinja2 template, and I know I had the error there. Notice the spaces inside the quotes. Since dry-run didn't detect the error, my playbook continued to execute and ran the task to run config_system with the config file.

After 30 minutes of no progress, everything timed out and died. config_system never really did anything. I re-ran it manually, and it sat at "Configuring products":

[Expert@gaia_demo:0]# /usr/bin/config_system -f /home/admin/gaia.ftw.config dos2unix: converting file /home/admin/gaia.ftw.config to Unix format ... Validating configuration file: Done Configuring OS parameters: Done Configuring products: -

It was still running in the process-list:

863 ? S 0:00 \_ /opt/CPsuite-R80.40/fw1/Python/bin/python3 /var/tmp/ansible-tmp-1651184043.6572037-2564807-184818913965851/AnsiballZ_command.py 865 ? S 0:01 \_ /bin/bash /usr/bin/config_system -f /home/admin/gaia.ftw.config

I then looked at the config file for sanity and saw the erroneous spaces. I fixed the config, ran it again, and it finished in just a few minutes (as expected)! That's when I realized this was the error. I found and fixed my Jinja2 template and now it all works. I understand this was "my fault", but it does show that there is a syntax-processing and some kind of run-time error in config_system. Oops.

The system was a fresh-install R80.40 (no Jumbo HFA yet; that was coming next in my playbook after the reboot once the products were configured; yes I updated CPDA beforehand, too).

I hope this is enough to have someone take a look internally. Take care!

Re: config_system flaw

the_rock — Fri, 29 Apr 2022 18:57:56 GMT

Thanks for that, very interesting!

Re: config_system flaw

Bob_Zimmerman — Fri, 29 Apr 2022 20:14:00 GMT

Does it also happen if you don't use quotes? Just curious.

Re: config_system flaw

Duane_Toler — Fri, 29 Apr 2022 20:21:09 GMT

Good point; I didn't check that. I generally assumed that all fields should have been quoted in that config. Next time I revert my snapshot and do a test-run of my Ansible playbook, I'll do it without quotes and just have a space after the = character. My instinct is that it will still succeed. We'll see, tho.

Of course, as I write all that, I now notice not ALL of my fields had quotes. 🙂 Hah. Sigh... Consistency #Fail 🙂

Re: config_system flaw

PhoneBoy — Sat, 30 Apr 2022 06:13:59 GMT

This is more of a gateway thing, so I moved it 🙂

Re: config_system flaw

Duane_Toler — Sun, 01 May 2022 04:19:38 GMT

My instinct was incorrect after all!

This is my configuration now:

# Install Security Gateway. install_security_gw= false # Enable DAIP (dynamic ip) gateway. # Should be "false" if CXL or Security Management enabled gateway_daip="false" # Enable/Disable CXL. gateway_cluster_member="false" # Install Security Management. install_security_managment= true

With the space after the quote it fails, and /var/log/ftw_install.log is never written, too.

I removed the spaces and now it runs, and /var/log/ftw_install.log is present.

# Install Security Gateway. install_security_gw=false # Enable DAIP (dynamic ip) gateway. # Should be "false" if CXL or Security Management enabled gateway_daip="false" # Enable/Disable CXL. gateway_cluster_member="false" # Install Security Management. install_security_managment=true

Looks like errant spaces after the = cause the problem. Oops. das Boog. 🙂

Re: config_system flaw

Bob_Zimmerman — Sun, 01 May 2022 22:36:42 GMT

I don't see any fields where a space is a valid character. Maybe toss a quick `grep ' '` into your test suite.

Still hoping for Vagrant images.

Re: config_system flaw

Duane_Toler — Tue, 03 May 2022 14:11:22 GMT

Right, but the issue is, and remains, that config_system doesn't do proper syntax checking. This is how and where exploits happen. I also re-ran it without any fields quoted, and so long as spaces aren't around the = separators, all is well. So the issue is "spaces around the field separators".

Re: config_system flaw

Bob_Zimmerman — Tue, 03 May 2022 14:55:02 GMT

You may need to quote the admin password hash depending on the algorithm in use, but that should be it.

While I think this should produce a meaningful error, it's hardly a security issue. config_system won't even do a dry-run once the box has been configured once.

Re: config_system flaw

Duane_Toler — Tue, 03 May 2022 15:05:00 GMT

I'm not banging on the "zOMGWTFBBQ!11one" security drum. I'm just saying "this is a runtime error" that should be fixed to fail better. I opened this with "yes I know this is my fault", but when you have automated systems building templates for other automated systems, proper failure and feedback is important. There's probably some fluffy "CI/CD pipeline" wording that would be relevant here somewhere.

It's an error that should be fixed. Seems silly to open a TAC case, and I didn't want to waste TAC's time for it; I was hoping some internal Check Point gurus would see this and look into it. If TAC is the right path, tho, to get the proper workorder and CR task, then ... ok.