<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Charles and Clark:</div>
<div>Thanks for the update. There are two different types of fuzzing that are discussed here:</div>
<ol>
<li>Deep security fuzzing to find new security defects. Sulley looks like a good tool for this purpose. For this type of fuzzing, the goal is to generate huge amount of unexpected fuzz attack vectors to check whether the application could handle these data.
It will take a long time and it has the potential to find new security defects. </li><li>Light fuzzing automation that can be integrated with CI process. For this type of fuzzing, we have pre-defined fuzzing strings and we know the expected responses back. We can have a list of security tests defined: authentication & authorization, injection
issues, security transport layer issues, user input validation, denial of services, etc. It should give us consistent level of security coverage. This approach has the risk of missing new security defects. But once new security defects are identified, it is
possible to add security checks to make sure that they will be identified in the future. This types of security tests can be run the same time that QA function tests are run. It is easy for integrate. Rackspace has been working with our QE to build more security
test cases like these. For OpenStack, we are currently pushing security test cases to Barbican and Poppy projects. More should come in the future. </li></ol>
<div><br>
</div>
<div><br>
</div>
<div>
<div>
<div>Thanks and have a great day. </div>
<div><br>
</div>
<div>Yours,</div>
<div>Michael </div>
<div><br>
</div>
<div>-----------------------------------------------------------------------------</div>
<div>Michael Xin | Manager, Security Engineering - US </div>
<div>Product Security |Rackspace Hosting</div>
<div>Office #: 501-7341 or 210-312-7341</div>
<div>Mobile #: 210-284-8674 </div>
<div>5000 Walzem Road, San Antonio, Tx 78218</div>
<div>----------------------------------------------------------------------------</div>
<div>Experience fanatical support</div>
</div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Charles Neill <<a href="mailto:charles.neill@RACKSPACE.COM">charles.neill@RACKSPACE.COM</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 17, 2015 at 10:57 AM<br>
<span style="font-weight:bold">To: </span>"Clark, Robert Graham" <<a href="mailto:robert.clark@hp.com">robert.clark@hp.com</a>>, Timur Nurlygayanov <<a href="mailto:tnurlygayanov@mirantis.com">tnurlygayanov@mirantis.com</a>>, "<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>"
<<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack-security] [security] [QA] Do we have security tests suite for OpenStack components?<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>I'm actually working on some (very simple) fuzzing tests for the Barbican project right now. I've realized that using a Python client that is strictly defined for sending "good" data to an API isn't necessarily the best mechanism for truly fuzzing that
API. For example, the "requests" lib chokes on trying to convert unicode strings to ascii in HTTP request headers.</div>
<div><br>
</div>
<div>I'm contemplating using something like sulley (link: <a href="https://github.com/OpenRCE/sulley">https://github.com/OpenRCE/sulley</a>) for deeper fuzzing, but I don't have time to really dig into it at the moment. I'd love to hear others' thoughts on
this problem.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Charles Neill</div>
<div><br>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span><Clark>, Robert Graham <<a href="mailto:robert.clark@hp.com">robert.clark@hp.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 17, 2015 at 5:32 AM<br>
<span style="font-weight:bold">To: </span>Timur Nurlygayanov <<a href="mailto:tnurlygayanov@mirantis.com">tnurlygayanov@mirantis.com</a>>, "<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>" <<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack-security] [security] [QA] Do we have security tests suite for OpenStack components?<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Fuzzing with Tempest is something that was discussed at the last summit, I think Rackspace had some interesting work that wanted to share but I might
be miss-remembering.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">One of the issues is that unless you’re looking with issues in the python libraries used for handling the APIs (which would be interesting to find)
message/protocol fuzzing is pretty limited, instead we need something that really understands the API to perform fuzzing to find things that logically shouldn’t be allowed to happen – many of these will be broken state issues.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">-Rob<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"> Timur Nurlygayanov [<a href="mailto:tnurlygayanov@mirantis.com">mailto:tnurlygayanov@mirantis.com</a>]
<br>
<b>Sent:</b> 15 June 2015 18:21<br>
<b>To:</b> <a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a><br>
<b>Subject:</b> [Openstack-security] [security] [QA] Do we have security tests suite for OpenStack components?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi team,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Looks like we are using Bandit framework [1] for static analysis of code of different OpenStack components, but I can't find some integration security tests for OpenStack components. Do we have some additional
open-source test framework / tests suite for security testing of OpenStack components?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I found the blueprint in Tempest about fuzzy testing [2], so, we can start to develop some security tests in Tempest and use them to perform security testing on the integration level and also to validate some security bug fixes.<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Do we have some list with scenarios, which we can cover with fuzzing tests in Tempest? We can start from some tests which will validate fixed security issues, it will be really helpful if you can share some ideas about tests, which we have
to create. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you!<br>
<br>
[1] <a href="https://github.com/stackforge/bandit">https://github.com/stackforge/bandit</a><br>
[2] <a href="https://blueprints.launchpad.net/tempest/+spec/fuzzy-test">https://blueprints.launchpad.net/tempest/+spec/fuzzy-test</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family: Arial, sans-serif;">Timur,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: Arial, sans-serif;">Senior QA Engineer<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: Arial, sans-serif;">OpenStack Projects<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: Arial, sans-serif;">Mirantis Inc<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</div>
</span>
</body>
</html>