GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

fix test 7.4 using 5.25 as a model

Browse source 
Signed-off-by: Taylor Lucy <talucy@franklinamerican.com>
This commit is contained in:
telepresencebot2 2018-11-14 14:24:35 -06:00 committed by Taylor Lucy
parent 7088b21f02
commit 4bf876296a
1 changed files with 20 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
tests/7_docker_swarm_configuration.sh
View file

@ -81,29 +81,35 @@ check_7_3() {
} }
# 7.4 # 7.4
check_7_4(){ check_7_4() {
id_7_4="7.4" id_7_4="7.4"
desc_7_4="Ensure data exchanged between containers are encrypted on different nodes on the overlay network" desc_7_4="Ensure data exchanged between containers are encrypted on different nodes on the overlay network"
check_7_4="$id_7_4 - $desc_7_4" check_7_4="$id_7_4 - $desc_7_4"
starttestjson "$id_7_4" "$desc_7_4" starttestjson "$id_7_4" "$desc_7_4"
totalChecks=$((totalChecks + 1)) totalChecks=$((totalChecks + 1))
if docker network ls --filter driver=overlay --quiet | \ fail=0
xargs docker network inspect --format '{{.Name}} {{ .Options }}' 2>/dev/null | \ unencrypted_networks=""
grep -v 'encrypted:' 2>/dev/null 1>&2; then
warn "$check_7_4"
currentScore=$((currentScore - 1))
for encnet in $(docker network ls --filter driver=overlay --quiet); do for encnet in $(docker network ls --filter driver=overlay --quiet); do
if docker network inspect --format '{{.Name}} {{ .Options }}' "$encnet" | \ if docker network inspect --format '{{.Name}} {{ .Options }}' "$encnet" | \
grep -v 'encrypted:' 2>/dev/null 1>&2; then grep -v 'encrypted:' 2>/dev/null 1>&2; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_7_4"
fail=1
fi
warn " * Unencrypted overlay network: $(docker network inspect --format '{{ .Name }} ({{ .Scope }})' "$encnet")" warn " * Unencrypted overlay network: $(docker network inspect --format '{{ .Name }} ({{ .Scope }})' "$encnet")"
resulttestjson "WARN" "Unencrypted overlay network: $(docker network inspect --format '{{ .Name }} ({{ .Scope }})' "$encnet")" unencrypted_networks="$unencrypted_networks $(docker network inspect --format '{{ .Name }} ({{ .Scope }})' "$encnet")"
fi fi
done done
else # We went through all the networks and found none that are unencrypted
if [ $fail -eq 0 ]; then
pass "$check_7_4" pass "$check_7_4"
resulttestjson "PASS" resulttestjson "PASS"
currentScore=$((currentScore + 1)) currentScore=$((currentScore + 1))
else
resulttestjson "WARN" "Unencrypted overlay networks:" "$unencrypted_networks"
currentScore=$((currentScore - 1))
fi fi
} }