Changeset 1060

Timestamp:

11/29/07 14:41:47 (9 months ago)

Author:

xkovah

Message:

merging back in the xkovah-firewall_update changes

Files:

• honeyclient/trunk/bin/fw (copied) (copied from honeyclient/branches/exp/xkovah-firewall_update/bin/fw)
• honeyclient/trunk/etc/honeyclient.xml (modified) (2 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager.pm (modified) (6 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/FW.pm (modified) (35 diffs)

honeyclient/trunk/etc/honeyclient.xml

@@ -79 +79 @@
-            <!-- TODO: Update this. -->
-            <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60">
-2
+1
-            </timeout>
-            <ActiveContent>
@@ -98 +98 @@
-                </ignore_links_timed_out>
-                <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website.  If negative, then the browser will exhaust all possible relative links found, before moving on.  This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
-5
+1
-                </max_relative_links_to_visit>
-                <positive_words description="If a link contains any number of these words, then its probability of being visited (its score) will increase.">

honeyclient/trunk/lib/HoneyClient/Manager.pm

@@ -502 +502 @@
-    my $stubFW = getClientHandle(namespace     => "HoneyClient::Manager::FW");
-
-fwInit
+installDefaultRules
-    # Reset the firewall, to allow everything open.
-testConnect
+allowAllTraffic
-
-# XXX: Remove this, eventually.
@@ -670 +670 @@
-
-    # Open up the firewall initially, to allow the Agent to do an SVN update.
-
+
+
+
-
-# XXX: Remove these, eventually.
@@ -818 +820 @@
-        # corresponding driver will need.  (We may want to get this
-        # information eventually from the Agent, as part of Driver::next().)
-undef
+[80,443]
-    };
-
@@ -828 +830 @@
-  
-    # Initialize the firewall.
-fwInit
+installDefaultRules
-
-    # Add new chain, per cloned VM.
@@ -972 +974 @@
-                        # Get the new targets from the Agent.
-                        $vmStateTable->{$vm->name}->{targets} = $ret->{$args{'driver'}}->{next}->{targets};
+                        #$vmStateTable->{$vm->name}->{targets} = '0.0.0.0';
-
-                        print "VM State Table:\n";
@@ -998 +1001 @@
-                    # the daemon, in which case, we indefinately try to reset the
-                    # firewall accordingly.
-fwInit
+installDefaultRules
-                    $stubFW->addChain($vmStateTable);
-                    $stubFW->addRules($vmStateTable);

honeyclient/trunk/lib/HoneyClient/Manager/FW.pm

@@ -93 +93 @@
- #  Lets set our default honeyclient ruleset:
-  my $stub = getClientHandle(namespace => "HoneyClient::Manager::FW");
-fwInit
+installDefaultRules
-  my @initlist = $som->paramsall;
-  print "$_\n" foreach (@initlist);
@@ -100 +100 @@
-$hashref = this data structure will be passed from the manager to the HoneyClient::Manager::FW
-
-
+s
- print $stub->result;
- print "\n";
@@ -160 +160 @@
-use POSIX qw( WIFEXITED );
-use English '-no_match_vars';
+
+# Make Dumper format more verbose.
+$Data::Dumper::Terse = 0;
+$Data::Dumper::Indent = 2;
-
-# set our configuration file location
@@ -348 +352 @@
-=item *
-
-fwInit
-
-fwInit
+installDefaultRules
+
+installDefaultRules
-mainly handles creation of the default iptables ruleset for the honeyclient network.
-IPTables ruleset:
@@ -368 +372 @@
-
-eval{
-fwInit
+installDefaultRules
-    $URL = HoneyClient::Manager::FW->init_fw();
-    # Wait at least a second, in order to initialize the daemon.
@@ -374 +378 @@
-    # Connect to daemon as a client.
-    $stub = getClientHandle(namespace => "HoneyClient::Manager::FW");
-fwInit
+installDefaultRules
-    $som = $stub->_validateInit();
-fwInit current has set up 28 rules")   or diag("The fwInit
+installDefaultRules current has set up 28 rules")   or diag("The installDefaultRules
-    $som = $stub->_setAcceptPolicy();
-    $som = $stub->_flushChains();
@@ -395 +399 @@
-=cut
-
-fwInit
+installDefaultRules
-    my ($class) = shift();
-    my ($systempid, $f_success, $del_success, $acceptsuccess, $denysuccess,
@@ -408 +412 @@
-    #$systempid = _getpid($processname);
-    my $log = get_logger("HoneyClient::Manager::FW");
-fwInit
+installDefaultRules
-
-    # Could not connect to iptables
@@ -514 +518 @@
-
-I<Inputs>:  Requires hash reference (hohohohoh).
-
+s
-
-=cut
@@ -527 +531 @@
-    # Get the VM identifier.
-    foreach $vm_ID (keys %{$hashref}) {
+    my $vmObj = $hashref->{$vm_ID};
+    my $vmSources = $vmObj->{'sources'};
+    my $vmTargets = $vmObj->{'targets'};
-
-        # Get the VM's source MAC address.
-
+
+
-
-            # Get the VM's source IP address.
-
-
+
-            {
-
-                # Get the VM's source protocol.
-
-
-
-
-
-
+
-                {
-
@@ -550 +552 @@
-          # Get the list of ports.
-                    my @src_ports = ();
-
-
-
-
-
-
+
-                    {
-
-
-
+
-                    }
-
@@ -577 +572 @@
-
-                        # Get the target hosts.
-
-
+
-                        {
-
+
+
-                            # Get the target IPs.
-
+
+
-
-                                # Get the target protocol.
-
-
-
-
-
-
+
-                                {
-
+
-         #print STDERR "Destination Protocol: " . $dst_IP_proto . "\n";
-         # We skip over combinations, where the source and destination protocols
@@ -604 +595 @@
-          # Get the list of ports.
-                                    my @dst_ports = ();
-
-
-
-
-
-
+
-                                    {
-
-
-
+
-                                    }
-
+
+
+
+
-                                    # Figure out how big the array is.
-                                    my $num_of_dst_ports = scalar(@dst_ports);
-                                    my $dst_port_counter = 0;
-                                    my $dst_port         = undef;
+                                    my @holderArray = ();
-                                    do {
-
@@ -625 +613 @@
-                                 # is empty.
-                                        if ($num_of_dst_ports <= 0) {
-
+
+
-                                        } else {
-
-
+
-                                        }
-
-           # generate our rules here into a %HoH based on destination ip address
-$HoH{$dst_IP_addr} =
+push @holderArray,
-                                            "chain"       => "$vm_ID",
-                                            "source-mac"  => "$src_MAC_addr",
@@ -646 +634 @@
-                                        };
-                                        $dst_port_counter++;
-
-                                       $dst_port_counter >= $num_of_dst_ports)
+
+                                    $HoH{$dst_IP_addr} = \@holderArray
-                                }
-                            }
@@ -673 +661 @@
-and give me an array of VM names that will be added from the iptables chain list.  The reason we have broken
-add_vm_chain() up and made it its separate subroutine is because when we add a rule to the iptables ruleset, we
-
-
+
-
-I<Output>: returns true if VM chain was deleted, returns false if not
@@ -863 +850 @@
-$log->info("Flushing the entries and chains now...");
-    foreach my $chainname (@chainArray) {
-
+h
-        $table->flush_entries($chainname) or
-            die ("Error: Unable to flush entries in chain $chainname");
-        $log->info("Deleting $chainname");
-;
+ or
-            die ("Error: Unable to delete chain $chainname");
-    }
@@ -918 +905 @@
-=item *
-
-
-
-
-FWPunch
+s
+
+s
+addRules
-creates a new VM rule.  If the chain already exists, the rule can not be added since their is no corresponding chain.
-FWPunch
-
-
+addRules
+
+s
-will resemble the below data structure:
-
@@ -1018 +1005 @@
-
-eval{
-
+s
-    $URL = HoneyClient::Manager::FW->init_fw();
-    # Wait at least a second, in order to initialize the daemon.
@@ -1024 +1011 @@
-    # Connect to daemon as a client.
-    $stub = getClientHandle(namespace => "HoneyClient::Manager::FW");
-fwInit
+installDefaultRules
-    $som = $stub->addChain($hashref);
-
-() successfully passed and added a new rule.")   or diag("The addRule
+s
+s() successfully passed and added a new rule.")   or diag("The addRules
-    $som = $stub->_setAcceptPolicy();
-    $som = $stub->_flushChains();
@@ -1061 +1048 @@
-    # debugging options, automatically logs to logfile for review later
-    $log = get_logger("HoneyClient::Manager::FW");
-
+s
-
-    # getst the Chain name for which we will be inserting new rules on the fly
@@ -1084 +1071 @@
-# to the Honeyclient manager.  The manager is the one actually sending the hashref from which we are
-# parsing.
-
+s
-        my %rules = _parseHash($hashref);
-        print Dumper(\%rules);
@@ -1094 +1081 @@
-#my $state = [ 'ESTABLISHED', 'RELATED' ];
-# start looping through our HoH
-
-
+
+
+
-       # inserting the firewall rules into the "out" chain here.
-       # The insertion will be at the head of the chain due to the "0" location.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-        $table->commit() or die ("Error: Unable to commit changes to filter table");
-        my $end         = gettimeofday();
@@ -1796 +1784 @@
-
-   # start looping through our HoH to insert our rules into the iptables ruleset
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-        print "success = $success\n";
-    }
-    $table->commit() or die ("Error: Unable to commit changes to nat table");
@@ -1827 +1817 @@
-
-   # start looping through our HoH to insert our rules into the iptables ruleset
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    }
-    $table->commit() or die ("Error: Unable to commit changes to nat table");
@@ -2223 +2214 @@
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-##################################################################
-# Function name:  getStatus()
@@ -2332 +2252 @@
-
-eval{
-fw
+get
-    $URL = HoneyClient::Manager::FW->init_fw();
-    # Wait at least a second, in order to initialize the daemon.
@@ -2489 +2409 @@
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  insertMac();
-
-insertMac function add mac address filtering (Anti-spoofing) rules after the VM user-chains
-are created.  They must be remotely called after the vm_add_chain() function.
-
-I<Inputs>:
-B<$chain> is the name of the chain that you will be applying the Mac filtering to.
-B<$ip> is the VM ip address that will be filtered.
-B<$mac> is the mac address of the VM honeyclient.
-
-I<Output>: returns nothing
-
-=cut
-
-sub _insertMac {
-    my $table = IPTables::IPv4::init('filter');
-    my $class = shift;
-    my $chain = shift;
-    my $ip    = shift;
-    my $mac   = shift;
-    my ($vmchainout, $code, $status) = q{};
-    $vmchainout = "$chain-out";
-    my $iptables = "/sbin/iptables";
-
-# This tests to see if a value for $mac has been defined, if the image is not up and running (accepting
-# icmp request/replies, then mac will not be able to be found.  If it is found, $mac will be set, hence
-# defined.  Success will yield a 1 if rule insertion is successful, failure to insert the mac filter entry        # will return a 0
-    if (defined($mac)) {
-
-        # rules will be inserted at the HEAD of the user-defined chain
-        my $success =
-          $table->insert_entry(
-                               $vmchainout,
-                               {
-                                  "source"     => $ip,
-                                  'matches'    => ['mac'],
-                                  'mac-source' => "!$mac",
-                                  "jump"       => "DROP"
-                               },
-                               0
-          );
-        if (!$success) {
-            die ("Error: Unable to insert entry into chain $vmchainout");
-        }
-        $table->commit() or die ("Error: Unable to commit changes to filter table");
-        return $success;
-    } else {
-        $success = 0;
-        return $success;
-    }
-}
-
-=pod
-
-=item *
-
-_chain_exists();
-
@@ -2564 +2428 @@
-    # Connect to daemon as a client.
-    $stub = getClientHandle(namespace => "HoneyClient::Manager::FW");
-fwInit
+installDefaultRules
-    $som = $stub->addChain($hashref);
-    is($som->result, 1, "_chainExists($hashref) successfully passed.")  or diag("The _chainExists() call failed.");
@@ -2611 +2475 @@
-}
-
-=pod
-
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  isAlive();
-
-Tests for existance of a file to verify if firewall has been started (not currently active)
-
-I<Inputs>:
-B<$pidfile> is the name of the created PID file.
-
-I<Output>: creation of file with resolved IP addresses.
-
-=cut
-
-sub isAlive {
-    my ($pidfile) = "/var/run/firewall.pid";
-    my $alive = "";
-
-# we will be checking for the existance of a newly created firewall with the word ENABLED in it.
-    if (-f $pidfile) {
-        $alive = 1;
-    } else {
-        $alive = 0;
-    }
-    return ($alive);
-}
-
-=pod
@@ -2825 +2662 @@
-}
-
-=pod
-
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  _sendMail() is a helper function that sends email to other systems informing them of various actions with the firewall.
-
-_sendMail will send mail to the root account at localhost informing the root user of various firewall actions
-I<Inputs>:
-B<$from> is where the user is sending from
-B<$to> is where the user is sending to
-B<$subject> is the subject of the email
-B<$body> is content of the email
-I<Output>: returns nothing for now
-
-=cut
-
-sub _sendMail {
-    my $from    = shift;
-    my $to      = shift;
-    my $subject = shift;
-    my $body    = shift;
-    open(SM, "|-", "/bin/mail", "-s", $subject, $to, "-f", $from) or
-        die ("Error: Unable to send mail");
-    print SM $body, "\n";
-    close(SM) or die ("Error: Unable to send mail");
-}
-
-=pod
-
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  getcpuload is a  function that gives you the cpuload of the OS firewall.  This should help give a better understanding of how the
-firewall OS is running.
-
-I<Inputs>:
-nothing
-I<Output>: cpu load of the OS FW
-
-=cut
-
-sub getcpuload {
-    my ($class) = @_;
-    # TODO: Make sure system call returns properly.
-    my $uptime  = `$UPTIME`;
-    my $cpuLoad = 0;
-    if ($uptime =~ /load average:\s+([\d\.]+)/) {
-        $cpuLoad = $1;
-    }
-    return $cpuLoad;
-}
-
-=pod
@@ -3023 +2810 @@
-}
-
-=pod
-
-=item *
-
-fwOff() opens up our firewall.
-
-I<Inputs>: n/a
-I<Output>: nothing
-
-=cut
-
-sub fwOff {
-
-    # package name
-    my $class = shift;
-
-    # flush all entries in all chain and delete the chains
-    _flushChains();
-
-# turns off the firewall and sets the policy to the default chains (INPUT, OUTPUT, and FORWARD)
-# to ACCEPT
-    _setAcceptPolicy();
-}
-
-=pod
-
-=item *
-
-killProcess();
-
-This is a function kills all systems process based on the command line name give via the remote call.
-It looks through the process table and removes all processes with that key name.
-
-<Inputs>:
-no input
-
-I<Output>: destruction of all Process IDs.
-
-=cut
-
-sub killProcess {
-    use Proc::ProcessTable;
-    my $class   = shift;
-    my $process = shift;
-    my ($t, $p, $success) = "";
-    $t = new Proc::ProcessTable;
-    chomp($process);
-    foreach my $p (@{ $t->table }) {
-        if ($p->cmndline =~ /$process/) {
-            $success = 1;
-            print "Removing $process pid " . $p->pid . "\n";
-            $p->kill(9) or die ("Error: Unable to kill process $process");
-        }
-    }
-    return ($success);
-}
-
-=pod
-
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  checkDiskSize();
-
-checkDiskSize() checks the size of the honeywall partitions and makes sure the disk does not fill up.  If
-it reaches a certain level (90%), then it shoots off an email to root and logs it to hard disk.
-
-I<Inputs>:
-no inputs
-
-I<Output>: outputs the percentage of hard disk that is filled per partition.
-
-=cut
-
-sub checkDiskSize {
-    my $class  = shift;
-    my $target = "90";
-    my $disksize;
-    my $sendmail = 1;
-    my $MACHINE  = `uname`;
-    my $address  = "root";
-    my $linux    = 0;
-    my $mail     = "/usr/bin/mail";
-    my $df       = "/bin/df";
-    my $grep     = "/bin/grep";
-
-    if ($MACHINE =~ m/Linux/i) {
-        $linux = 1;
-    } else {
-        $linux = 0;
-    }
-    if ($linux) {
-        my @partitions =
-          qw(/dev/sda1 /dev/sda2 /dev/sda5 /dev/sda6 /dev/sda7 /dev/sda8 /dev/sda9);
-        foreach my $part (@partitions) {
-            # TODO: Check to make sure this system call returns properly.
-            $disksize = `$df -k | $grep $part | cut -b53-54`;
-            if ($disksize > 50) {
-                print "$part\t$disksize%\n";
-            } else {
-                print "All filesystems are within their limits\n";
-            }
-        }
-    }
-}
-
-=pod
-
-=item *
-
-[NOT IMPLEMENTED AT THIS TIME]:  isCompromised();
-
-isCompromised() checks the iptables log files to see if there has been a compromise to one of the VM images.
-
-I<Inputs>:  hash reference($hashref)
-
-I<Output>:  none
-
-=cut
-
-sub isCompromised {
-
-    # check to see if /var/log/iptables file exists
-    # if exists, parse all logs with TAG (hwall)
-    # grab the VMID of all those entries
-    # report back VMID(s) that could possibly be compromised
-    # return VMID list
-
-}
-
-
-=pod
-
-=item *
-
-checkLog();
-
-checkLog() checks for network anomalies (MAC address spoofing) or any blocked outbound traffic that orginates from
-anywhere from the VM subnet.
-
-I<Inputs>:  hash reference($hashref)
-
-I<Output>:  none
-
-=cut
-
-sub checkLog {
-    my $class    = shift;
-    my $hashref  = shift;
-#   my $filename = getVar(name => "iptableslog")
-    my $vmname   = _getVMName($hashref);
-    my $filename = "/root/honeyclient/sandbox/alphaFW/test.log";
-#   macCheck($hashref, $vmname, $filename);
-}
-
-=pod
-
-=item *
-
-runTcpdump() - starts a tcpdump procces for a specified VM machine.
-
-I<Inputs>:  VM name and the source IP address of the image.
-
-I<Output>:  none
-
-=cut
-
-#sub runTcpdump {