IoT 開發筆記 - 關於歐盟 無線電設備指令 (Radio Equipment Directive, RED) RED-DA 對於聯網設備的資安自我檢查辦法

這兩年英國、新加坡、歐盟都有滿多資安相關的議題，例如英國 Product Security and Telecommunications Infrastructure (PSTI) 產品安全和電信基礎設施法案在 2024.04 生效，現在則幫忙公司處理歐盟 2025年夏天要推進的無線設備指令—委託法案 (Radio Equipment Directive – Delegated Act, 簡稱 RED-DA )

已知的粗略資訊：

• 商品若有聯網功能，需要依照 RED-DA 的要求自我檢驗一番，才能把商品賣進歐盟國家
• 尚未有中央單位負責檢驗，各大品牌找一些值得信任檢驗單位，請他們檢驗商品出檢驗報告，未來商品進歐盟時，被要求提供報告時，可以拿出來用

因此，產品負責人或銷售業務，其實要做的是趕緊找一間信任的資安檢驗公司，提出商品檢驗的需求，價格通常也不便宜，最重要檢驗的時程也不短，通常簽約繳件後也要數個月才會產出報告的，而報告其實是會高度依賴商品的使用情境跟品牌/廠牌，基本上代工廠不能公版做完一份就沒事，是品牌商也得依序產報告（找同一間資安公司，應當有些優惠吧？可以讓資安公司省去摸索商品，且相似的商品可以讓驗證機制加速）

總之，就會進行一些聯網設備(IoT)的處理，通常，資安公司也高度依賴產品公司的 IT 部門或負責研發的開發者提供的資訊。

為了加速檢驗報告的產生，公司可以先自行體檢：

• 使用 OpenVAS Scanner 等類似工具對聯網設備進行弱點掃描
• 請開發者整理產品用到了相關 libraries ，透過 CVE 資料庫進行查詢，若發現有漏洞就評估該怎樣更新
• 若像 WIFI AP 提供 http://192.168.1.1 登入後台使用，那至少必須改提供 https://192.168.1.1 自簽憑證方案

由於檢驗報告項目眾多，單純先列一下可以自我檢驗的部分，其他的部分，還是交給資安業者，讓專業的來吧

筆記一下，怎樣用 OpenVAS 來掃設備，當然，這是個 Docker 當道的時代，直接跑 Docker 即可，收工（誤），實測在 macOS 15 和 Windows 11 都可以正常運作的：

C:\Users\User>docker run -p 8443:443 --name openvas mikesplain/openvas

Unable to find image 'mikesplain/openvas:latest' locally

latest: Pulling from mikesplain/openvas

34667c7e4631: Pull complete

d18d76a881a4: Pull complete

119c7358fbfc: Pull complete

2aaf13f3eff0: Pull complete

67b182362ac2: Pull complete

c878d3d5e895: Pull complete

ec12cc49fe18: Pull complete

c4c454aeebef: Pull complete

27d3410150b2: Pull complete

e08d578dc278: Pull complete

44951337cd32: Pull complete

8c7fe885e62a: Pull complete

a4f833680e45: Pull complete

Digest: sha256:23c8412b5f9f370ba71e5cd3db36e6f2e269666cd8a3e3e7872f20f8063b2752

Status: Downloaded newer image for mikesplain/openvas:latest

Testing redis status...

Redis not yet ready...

Redis ready.

Checking for empty volume

Restarting services

 * Restarting openvas-scanner openvassd

   ...done.

 * Restarting openvas-manager openvasmd

   ...done.

 * Restarting openvas-gsa gsad

   ...done.

Reloading NVTs

Rebuilding NVT cache... done.

Checking setup

openvas-check-setup 2.3.3

  Test completeness and readiness of OpenVAS-9

  Please report us any non-detected problems and

  help us to improve this check routine:

  http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

  Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.

  Use the parameter --server to skip checks for client tools

  like GSD and OpenVAS-CLI.

Step 1: Checking OpenVAS Scanner ...

        OK: OpenVAS Scanner is present in version 5.1.3.

        OK: OpenVAS Scanner CA Certificate is present as .

...

接著就在本機開啟 https://localhost:8443/ 來運作：

添加一則 task (左上角的紫色 icon ) -> 指定設備的 IP -> 右下角有 Actions 記得按下 Play icon 

運行好一陣子後，就會看到一些報告了，像是幫你檢驗 Web server 的版本是否有漏洞、網頁上是否有需要更新的 js libraries，例如：

至於嵌入式系統內部的自我檢查，其實可以善用美國國家單位提供的服務： nvd.nist.gov/vuln/search

在那邊去輸入資訊查詢，像是 curl 啊，等等

當然，這邊純人工檢查極累 Orz 所以，也有 API 服務可以申請，就能夠批次詢問了，細節請參考：

nvd.nist.gov/developers/vulnerabilities

最後，把玩一下小工具：pypi.org/project/cve-vulnerability-scanner/

% NVD_API_KEY='XXXX-XXXX-XXXX-XXXX' cve-vulnerability-scanner -p zlib -v 1.2.13 -o /tmp/output.md ; cat /tmp/output.md 

Scanning zlib version 1.2.13

Loading cached data for zlib

Scan complete. Report generated in /tmp/output.md

# Security Vulnerability Report

Generated on: 2024-11-09 08:53:47

## zlib 1.2.13

### CVE-2023-45853

Severity: CRITICAL

CVSS Score: 9.8

Version Range: * to 1.3

Published: 2023-10-14T02:15:09.323

Last Modified: 2024-08-01T13:44:58.990

Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

### CVE-2023-48106

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T18:15:09.630

Last Modified: 2023-12-02T00:27:03.327

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.

### CVE-2023-48107

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T23:15:10.663

Last Modified: 2023-12-27T04:15:07.277

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.

### CVE-2023-6992

Severity: MEDIUM

CVSS Score: 5.5

Version Range: * to 2023-11-16

Published: 2024-01-04T12:15:23.690

Last Modified: 2024-01-10T01:14:35.027

Description: Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow.

A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software.

Patches: The issue has been patched in commit  8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

### CVE-2003-0107

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2003-03-07T05:00:00.000

Last Modified: 2022-06-22T16:40:46.327

Description: Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

### CVE-2004-0797

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2004-10-20T04:00:00.000

Last Modified: 2022-06-22T16:40:46.360

Description: The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).

### CVE-2005-2096

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-06T04:00:00.000

Last Modified: 2022-06-22T16:40:46.413

Description: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

### CVE-2005-1849

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-26T04:00:00.000

Last Modified: 2022-06-22T16:40:46.380

Description: inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to 2.015

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

這工具純把玩，困難之處就是做 version 和 library name 比對，這工具純示意，仍有非常大進步的空間，甚至該把這空間交給專業的資安公司就好，畢竟這是個分工的時代，且需要大量的人力檢視 Orz

Docker 開發筆記 - 使用 Docker Compose 架設 Gitlab 服務 / 處理自訂 Ports / HTTPS SSL 憑證 @ macOS 14.2.1

延續上一篇 Docker 開發筆記 - 使用 Docker Compose 架設 Jenkins 服務 @ macOS 14.2.1 活動，該寫一下 gitlab 架設筆記。其實過年期間有播空試試，但是處理很不順，再加上跑去玩樂就荒廢了。昨晚終於可以收尾一下，把一些使用過程列一下。當時踩坑的原因是自己沒有把環境清乾淨，花了大把時間除錯。

先來個環境簡介：

% docker version 

Client:

 Cloud integration: v1.0.35+desktop.10

 Version:           25.0.3

 API version:       1.44

 Go version:        go1.21.6

 Git commit:        4debf41

 Built:             Tue Feb  6 21:13:26 2024

 OS/Arch:           darwin/arm64

 Context:           desktop-linux

Server: Docker Desktop 4.27.2 (137060)

 Engine:

  Version:          25.0.3

  API version:      1.44 (minimum version 1.24)

  Go version:       go1.21.6

  Git commit:       f417435

  Built:            Tue Feb  6 21:14:22 2024

  OS/Arch:          linux/arm64

  Experimental:     false

 containerd:

  Version:          1.6.28

  GitCommit:        ae07eda36dd25f8a1b98dfbf587313b99c0190bb

 runc:

  Version:          1.1.12

  GitCommit:        v1.1.12-0-g51d5e94

 docker-init:

  Version:          0.19.0

  GitCommit:        de40ad0

清乾淨後再重啟：

% docker-compose down -v

% rm -rf ~/docker-gitlab

% docker-compose up

總之先來為回顧官網的 docker 教學吧！依照 gitlab 官網的安裝簡介 可以很快速地裝起來 ：

% cat /etc/hosts | grep gitlab

127.0.0.1 gitlab.example.com

% cat docker-compose.yml 

# https://docs.docker.com/compose/compose-file/compose-versioning/

version: '3.8' 

services:

  gitlab:

    image: gitlab/gitlab-ee:latest

    container_name: gitlab

    restart: always

    hostname: 'gitlab.example.com'

    environment:

      GITLAB_OMNIBUS_CONFIG: |

        external_url 'http://gitlab.example.com:8929'

        gitlab_rails['gitlab_shell_ssh_port'] = 2424

    ports:

      - '8929:8929'

      - '2424:2424'

    volumes:

      - '~/docker-gitlab/config:/etc/gitlab'

      - '~/docker-gitlab/logs:/var/log/gitlab'

      - '~/docker-gitlab/data:/var/opt/gitlab'

    shm_size: '256m'

% docker-compose up

...

% docker container ls                   

CONTAINER ID   IMAGE                     COMMAND             CREATED         STATUS                   PORTS                                                             NAMES

XXXXXXXXXXXX   gitlab/gitlab-ee:latest   "/assets/wrapper"   3 minutes ago   Up 3 minutes (healthy)   22/tcp, 443/tcp, 0.0.0.0:20080->80/tcp, 0.0.0.0:20022->2424/tcp   gitlab

主要是看到 docker container 狀態要顯示 healthy ，接著就可以去瀏覽 http://gitlab.example.com:8929 位置了（註：gitlab.example.com被我設定成 127.0.0.1）。

接著我還在惡搞切換 nginx port，以及碰到 chrome browser 的 ERR_UNSAFE_PORT，最後延宕了好一陣子 :P 就把剩下的流水帳心得都記錄一下：

• 關於 gitlab/gitlab-ee:latest 和 gitlab/gitlab-ce:latest ，據說 gitlab/gitlab-ee:latest 沒有序號啟動時，就等同於 gitlab/gitlab-ce:latest ，就統一用 gitlab/gitlab-ee:latest 即可
• 記得初次使用時，登入帳號是 root ，密碼躲在 /etc/gitlab/initial_root_password

% docker container ls

CONTAINER ID   IMAGE                     COMMAND             CREATED          STATUS                    PORTS                                                              NAMES

XXXXXXXX   gitlab/gitlab-ee:latest   "/assets/wrapper"   20 minutes ago   Up 18 minutes (healthy)   80/tcp, 443/tcp, 0.0.0.0:20443->20443/tcp, 0.0.0.0:20022->22/tcp   gitlab

% docker exec -it XXXXXXXX cat /etc/gitlab/initial_root_password

# WARNING: This value is valid only in the following conditions

#          1. If provided manually (either via `GITLAB_ROOT_PASSWORD` environment variable or via `gitlab_rails['initial_root_password']` setting in `gitlab.rb`, it was provided before database was seeded for the first time (usually, the first reconfigure run).

#          2. Password hasn't been changed manually, either via UI or via command line.

#

#          If the password shown here doesn't work, you must reset the admin password following https://docs.gitlab.com/ee/security/reset_user_password.html#reset-your-root-password.

Password: yNRnhTRu9IZ/eBvlC3BCDeuK6zn6BUBmGB+a89SMpn0=

# NOTE: This file will be automatically deleted in the first reconfigure run after 24 hours.

• 使用 GITLAB_OMNIBUS_CONFIG 可以便利的完成絕大部分的設定
• 自訂的 port 請避開 chrome browser 定義的 ERR_UNSAFE_PORT 清單，這個雷不小心會耗掉非常多時間的，例如我偷懶把 80 增加個 10000 變成 10080 ...就中招，讓我以為有什麼服務沒啟動成功
• https://chromium.googlesource.com/chromium/src.git/+/refs/heads/main/net/base/port_util.cc#27
• 善用 external_url 設定外部連進去的資訊，並且把 HOST:CONTAINER Ports 都填寫一樣是最輕鬆的方式：

    environment:

      GITLAB_OMNIBUS_CONFIG: |

        external_url 'http://gitlab.example.com:20080'

        gitlab_rails['gitlab_shell_ssh_port'] = 20022

    ports:

      - '20080:20080'

      - '20022:20022'

• 想要來惡搞讓 nginx 聽在不同 port ，那就要設定更多東西

    environment:

      GITLAB_OMNIBUS_CONFIG: |

        external_url 'http://gitlab.example.com:20080'

        nginx['listen_port'] = 80

        gitlab_rails['gitlab_shell_ssh_port'] = 22

    ports:

      - '20080:80'

      - '20022:22'

• 想要啟用加密連線，單靠 external_url 更新成 `https://` 的描述也會默認啟動 SSL 加密連線服務，但下一刻還得處理憑證問題，連續動作：

% mkdir -p ssl

% test -e ./ssl/localhost.key || openssl genpkey -algorithm RSA -out ./ssl/localhost.key

% test -e ./ssl/localhost.crt || openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ssl/localhost.key -out ./ssl/localhost.crt -subj '/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost'

% tree ssl 

ssl

├── localhost.crt

└── localhost.key

1 directory, 2 files 

 

% cat docker-compose.yml

 ...

     environment:

       GITLAB_OMNIBUS_CONFIG: |

         external_url 'https://gitlab.example.com:20443'

         #nginx['listen_port'] = 443

         nginx['ssl_certificate'] = "/etc/gitlab-ssl-usage/localhost.crt"

         nginx['ssl_certificate_key'] = "/etc/gitlab-ssl-usage/localhost.key"

         gitlab_rails['gitlab_shell_ssh_port'] = 22

     ports:

       - '20443:20443'

       - '20022:22'

     volumes:

       - './ssl:/etc/gitlab-ssl-usage'

• 若不想靠 volumes 掛進來，也可以改用 command 來發動

     command: ["sh", "-c", "mkdir -p /etc/gitlab-ssl-usage && (test -e /etc/gitlab-ssl-usage/localhost.key || openssl genpkey -algorithm RSA -out /etc/gitlab-ssl-usage/localhost.key ) && ( test -e /etc/gitlab-ssl-usage/localhost.crt || openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/gitlab-ssl-usage/localhost.key -out /etc/gitlab-ssl-usage/localhost.crt -subj '/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost' ) && /assets/wrapper "]

     #command: ["sh", "-c", "/tmp/config/setup.sh"]

     environment:

       GITLAB_OMNIBUS_CONFIG: |

         external_url 'https://gitlab.example.com:20443'

         nginx['ssl_certificate'] = "/etc/gitlab-ssl-usage/localhost.crt"

         nginx['ssl_certificate_key'] = "/etc/gitlab-ssl-usage/localhost.key"

         gitlab_rails['gitlab_shell_ssh_port'] = 22

     ports:

       - '20443:20443'

       - '20022:22'

• 最初實驗時還曾碰過 redis 跟 postgres 無法跑起來的問題 ( /var/opt/gitlab/postgresql/ , /var/opt/gitlab/redis/ )，以至於變成非常臭長的架構，我想沒事都可以不用這樣惡搞了，在此順便留戀一下

# https://docs.docker.com/compose/compose-file/compose-versioning/

version: '3.8' 

services:

  redis:

    restart: unless-stopped 

    image: redis:latest

    container_name: gitlab-redis

    volumes:

      - ~/docker_gitlab_home/redis:/data

      - ~/docker_gitlab_home/socket-redis:/var/run/redis

  postgres:

    image: postgres:latest

    container_name: gitlab-postgres

    restart: unless-stopped

    environment:

      POSTGRES_USER: gitlab

      POSTGRES_PASSWORD: gitlabAdmin

    volumes:

      - ~/docker_gitlab_home/postgres:/var/lib/postgresql/data

      - ~/docker_gitlab_home/socket-postgresql:/var/run/postgresql

  gitlab:

    # https://docs.gitlab.com/ee/install/docker.html#install-gitlab-using-docker-compose

    # https://hub.docker.com/r/gitlab/gitlab-ee/

    # https://hub.docker.com/r/gitlab/gitlab-ce

    image: gitlab/gitlab-ee:latest

    container_name: gitlab-main

    depends_on:

      - postgres

      - redis

    # https://docs.docker.com/config/containers/start-containers-automatically/#use-a-restart-policy

    restart: unless-stopped 

    hostname: 'localhost'

    command: ["sh", "-c", "mkdir -p /etc/gitlab-ssl-usage && (test -e /etc/gitlab-ssl-usage/localhost.key || openssl genpkey -algorithm RSA -out /etc/gitlab-ssl-usage/localhost.key ) && ( test -e /etc/gitlab-ssl-usage/localhost.crt || openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/gitlab-ssl-usage/localhost.key -out /etc/gitlab-ssl-usage/localhost.crt -subj '/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost' ) && /assets/wrapper "]

    environment:

      GITLAB_OMNIBUS_CONFIG: |

        # Add any other gitlab.rb configuration here, each on its own line

        #external_url 'http://localhost:20080'

        #nginx['listen_port'] = 80

        external_url 'https://localhost:20443'

        gitlab_rails['gitlab_shell_ssh_port'] = 22

        nginx['listen_port'] = 443

        nginx['listen_https'] = true

        nginx['ssl_certificate'] = "/etc/gitlab-ssl-usage/localhost.crt"

        nginx['ssl_certificate_key'] = "/etc/gitlab-ssl-usage/localhost.key"

        #letsencrypt['enable'] = false

        gitlab_rails['db_username'] = "gitlab"

        gitlab_rails['db_password'] = "gitlabAdmin"

    ports:

      # note: ERR_UNSAFE_PORT - https://chromium.googlesource.com/chromium/src.git/+/refs/heads/main/net/base/port_util.cc#27

      # HOST:CONTAINER

      - 20443:443

      #- 20080:80

      - 20022:22

    volumes:

      - ~/docker_gitlab_home/config:/etc/gitlab

      - ~/docker_gitlab_home/logs:/var/log/gitlab

      - ~/docker_gitlab_home/data:/var/opt/gitlab

      - ~/docker_gitlab_home/redis:/var/opt/gitlab/data/redis

      - ~/docker_gitlab_home/postgresql:/var/opt/gitlab/postgresql

      - ~/docker_gitlab_home/socket-postgresql:/var/opt/gitlab/postgresql/

      - ~/docker_gitlab_home/socket-redis:/var/opt/gitlab/redis/