Changeset 1128

Timestamp:

01/24/08 17:18:32 (7 months ago)

Author:

kindlund

Message:

Updated codebase to reflect Ruby API.

Files:

• honeyclient/trunk/lib/HoneyClient/Manager.pm (modified) (8 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/Database.pm (modified) (2 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/VM/Clone.pm (modified) (2 diffs)

honeyclient/trunk/lib/HoneyClient/Manager.pm

@@ -584 +584 @@
-    }
-    #XXX: Insert Urls. To be moved eventually.
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-
-    # XXX: There is an issue where if we try to quit but are in the
@@ -713 +710 @@
-    $stubFW->allowAllTraffic();
-
-# XXX: Remove these, eventually.
-#    $URL = HoneyClient::Manager::VM->init();
-#    print "VM Daemon Listening On: " . $URL . "\n";
-#   
-#    $stubVM = getClientHandle(namespace     => "HoneyClient::Manager::VM",
-#                              fault_handler => \&_handleFaultAndCleanup);
-    
-#    print "Calling setMasterVM()...\n";
-#    $som = $stubVM->setMasterVM(config => $args{'master_vm_config'});
-#    print "Result: " . $som->result() . "\n";
-
-#    print "Calling quickCloneVM()...\n";
-#    $som = $stubVM->quickCloneVM();
-#    print "Result: " . $som->result() . "\n";
-#    $vmCloneConfig = $som->result();
-
-#    # Make sure the VM is fully cloned, before trying to make any subsequent calls.
-#    print "Calling isRegisteredVM()...\n";
-#    $som = $stubVM->isRegisteredVM(config => $vmCloneConfig);
-#    $ret = $som->result();
-
-#    if (defined($ret)) {
-#        print "Result: " . $ret . "\n";
-#    }
-
-#    while (!defined($ret)) {
-#        sleep (3);
-#        print "Calling isRegisteredVM()...\n";
-#        $som = $stubVM->isRegisteredVM(config => $vmCloneConfig);
-#        $ret = $som->result();
-#        if (defined($ret)) {
-#            print "Result: " . $ret . "\n";
-#        }
-#    }
-
-#    print "Calling getStateVM()...\n";
-#    $som = $stubVM->getStateVM(config => $vmCloneConfig);
-#    $vmState = $som->result();
-#
-#    if ($vmState == VM_EXECUTION_STATE_ON) {
-#        print "ON\n";
-#    } elsif ($vmState == VM_EXECUTION_STATE_OFF) {
-#        print "OFF\n";
-#    } elsif ($vmState == VM_EXECUTION_STATE_SUSPENDED) {
-#        print "SUSPENDED\n";
-#    } elsif ($vmState == VM_EXECUTION_STATE_STUCK) {
-#        print "STUCK\n";
-#    } else {
-#        print "UNKNOWN\n";
-#    }
-
-#    while ($vmState != VM_EXECUTION_STATE_ON) {
-#        sleep (3);
-#
-#        print "Calling getStateVM()...\n";
-#        $som = $stubVM->getStateVM(config => $vmCloneConfig);
-#        $vmState = $som->result();
-#
-#        if ($vmState == VM_EXECUTION_STATE_ON) {
-#            print "ON\n";
-#        } elsif ($vmState == VM_EXECUTION_STATE_OFF) {
-#            print "OFF\n";
-#        } elsif ($vmState == VM_EXECUTION_STATE_SUSPENDED) {
-#            print "SUSPENDED\n";
-#        } elsif ($vmState == VM_EXECUTION_STATE_STUCK) {
-#            print "STUCK\n";
-#        } else {
-#            print "UNKNOWN\n";
-#        }
-#    }
-
-#    print "Calling getMACaddrVM()...\n";
-#    $som = $stubVM->getMACaddrVM(config => $vmCloneConfig);
-#    print "Result: " . $som->result() . "\n";
-#    $vmMAC = $som->result();
-
-#    # Figure out when the Agent on the VM is alive and well.
-#    $ret = undef;
-#    my $logMsgPrinted = 0;
-#    while (!$ret) {
-#        sleep (3);
-#        print "Calling getIPaddrVM()...\n";
-#        $som = $stubVM->getIPaddrVM(config => $vmCloneConfig);
-#        if (defined($som->result())) {
-#            print "Result: " . $som->result() . "\n";
-#        }
-#        $vmIP = $som->result();
-#
-#        print "Calling getNameVM()...\n";
-#        $som = $stubVM->getNameVM(config => $vmCloneConfig);
-#        print "Result: " . $som->result() . "\n";
-#        $vmName = $som->result();
-#
-#        if (defined($vmIP) && defined($vmName)) {
-#            if (!$logMsgPrinted) {
-#                $LOG->info("Created clone VM (" . $vmName . ") using IP (" . $vmIP . ") and MAC (" . $vmMAC . ").");
-#                $logMsgPrinted = 1;
-#            }
-#
-#            # Try contacting the Agent; ignore any faults.
-#            $SUPPRESS_ERRORS = 1;
-#            $stubAgent = getClientHandle(namespace     => "HoneyClient::Agent",
-#                                         address       => $vmIP,
-#                                         fault_handler => \&_handleFault);
-#
-#            eval {
-#                print "Calling getStatus()...\n";
-#                $som = $stubAgent->getStatus();
-#                $ret = thaw(decode_base64($som->result()));
-#                print "Result:\n";
-#                # Make Dumper format more verbose.
-#                $Data::Dumper::Terse = 0;
-#                $Data::Dumper::Indent = 2;
-#                print Dumper($ret);
-#
-#            };
-#            # Clear returned state, if any fault occurs.
-#            if ($@) {
-#                $ret = undef;
-#            }
-#            $SUPPRESS_ERRORS = 0;
-#        }
-#    }
-
-    # Create a new cloned VM.
-    $vm = HoneyClient::Manager::VM::Clone->new();
@@ -843 +716 @@
-    if ($DB_ENABLE) {
-        eval {
-
+
+
-        };
-clientDbId == 0
-clientDbId = 0
+vm->database_id == 0) || !defined($vm->database_id
+vm->database_id(0)
-            $LOG->warn("Failure Inserting Client Object:\n$@");
-        }
@@ -927 +801 @@
-                    # Check to see if the VM has been compromised.
-                    print "WARNING: VM HAS BEEN COMPROMISED!\n";
-#                    $LOG->info("Calling suspendVM(config => " . $vmCloneConfig . ").");
-#                    $som = $stubVM->suspendVM(config => $vmCloneConfig);
-#                    HoneyClient::Manager::VM->destroy();
-                    my $vmName = $vm->name;
-                    $vmCompromised = 1;
@@ -955 +826 @@
-                    $LOG->info("Archiving VM...");
-                    $vm->archive();
+
+                    # Insert Compromised Fingerprint into DB.
+                    if ($DB_ENABLE && ($vm->database_id > 0)) {
+                        # Put URL History in database.
+                        $LOG->info("Saving URL History to Database.");
+                        insert_url_history(agent_state => $args{'agent_state'},
+                                           client_id   => $vm->database_id);
+                   
+                        # Delete the 'last_resource' attribute.
+                        delete $fingerprint->{last_resource};
+
+                        # Associate the client who has this fingerprint.
+                        $fingerprint->{client_id} = $vm->database_id;
+
+                        $LOG->info("Inserting Fingerprint Into Database.");
+                        my $fingerprint_id = undef;
+                        eval {
+                            $fingerprint_id = HoneyClient::Manager::Database::insert_fingerprint($fingerprint);
+                        };
+                        if ($@ || ($fingerprint_id == 0) || !defined($fingerprint_id)) {
+                            $LOG->warn("Failure Inserting Fingerprint Object:\n$@");
+                        }
+
+                        $LOG->info("Database Insert Successful.");
+                    }
+                    # Make sure VM is suspended.
-                    $vm = undef;
-
-                    # Insert Compromised Fingerprint into DB.
-                    #if ($DB_ENABLE && ($clientDbId > 0)) {
-                    #    #XXX: This should occurr as a resource is accessed and will be moved. Also should be in Browser code.
-                    #    # Put Honeyclient Link History in database.
-                    #    $LOG->info("Saving Url History to Database.");
-                    #    $args{'agent_state'} = insert_url_history(agent_state => $args{'agent_state'});
-                    #    $globalAgentState = $args{'agent_state'};
-                    #
-                    #    # Remove the compromise time from the fingerprint. This is to be added to the Client Object
-                    #    delete $fingerprint->{last_resource};
-                    #    my $compromise_time = HoneyClient::DB::Time->new(delete($fingerprint->{'compromise_time'}));
-                    #    $LOG->info("Inserting Fingerprint Into Database.");
-                    #    my $fp = HoneyClient::DB::Fingerprint->new($fingerprint);
-                    #    my $fpId = $fp->insert();
-                    #    my $ctId = $compromise_time->insert();
-                    #    HoneyClient::DB::Client->update(
-                    #        '-set' => {
-                    #            status => $HoneyClient::DB::Client::STATUS_COMPROMISED,
-                    #            fingerprint => $fpId,
-                    #            compromise_time => $ctId,
-                    #        },
-                    #        '-where' => {
-                    #            id => $clientDbId,
-                    #        }
-                    #    );
-                    #    $LOG->info("Database Insert Successful.");
-                    #}
-                    return; # Return out of eval block.
-                } else {
@@ -994 +864 @@
-                        $LOG->info("All URLs exhausted.  Shutting down Manager.");
-                        $vm = undef;
-                        # Get a local copy of the configuration and kill the global copy.
-#                        my $vmCfg = $vmCloneConfig;
-#                        $vmCloneConfig = undef;
-#                        $LOG->info("Calling suspendVM(config => " . $vmCfg . ").");
-#                        $stubVM->suspendVM(config => $vmCfg);
-                        print "Done!\n";
-                        _cleanup();
@@ -1071 +936 @@
-    # Extract arguments.
-    my %args = @_;
-
+
-    my $agent_state = thaw(decode_base64($args{'agent_state'}));
-
-
-
+
-    foreach my $driver (keys %$agent_state) {
-        if ($agent_state->{$driver}) {
-
-
+
-            last;
-        }
-    }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-}
-
-sub dbRegisterClient {
-Name
+
-    my $dt = DateTime::HiRes->now();
-
-    $LOG->info("Attempting to Register Client $vmName.");
-
-    # Register the VM with the DB
-
-    #my $clientObj = HoneyClient::DB::Client->new({
-    #    system_id => $vmName,
-    #    status => $HoneyClient::DB::Client::STATUS_RUNNING,
-    #    # TODO: Collect host,application, and config through automation/config files
-    #    host => {
-    #        organization => 'MITRE',
-    #        host_name => Sys::Hostname::Long::hostname_long,
-    #        ip_address => Sys::HostIP->ip,
-    #    },
-    #    client_app => {
-    #        manufacturer => 'Microsoft',
-    #        name => 'Internet Explorer',
-    #        major_version => '6',
-    #    },
-    #    config => {
-    #        name => 'Default Windows XP SP2',
-    #        os_name => 'Microsoft Windows',
-    #        os_version => 'XP Professional',
-    #        os_patches => [{
-    #            name => 'Service Pack 2',
-    #        }],
-    #    },
-    #    start_time => $dt->ymd('-').'T'.$dt->hms(':'),
-    #});
-    #return $clientObj->insert();
-
-    my $client = {
-N
+->n
-        status => 'running',
-        # TODO: Collect host,application, and config through automation/config files
@@ -1174 +986 @@
-        start => $dt->ymd('-').'T'.$dt->hms(':'),
-    };
-
-
+
-}
-

honeyclient/trunk/lib/HoneyClient/Manager/Database.pm

@@ -1 +1 @@
-use strict;
-
- qw'freeze thaw Bless'
+
-use XML::RPC;
+use Carp qw();
+use Data::Dumper;
+use Data::Structure::Util;
-
-package HoneyClient::Manager::Database;
@@ -10 +13 @@
-sub AUTOLOAD {
-    my $obj = shift;
-$obj
+Data::Structure::Util::unbless($obj)
-    my $name = $AUTOLOAD;
-    $name =~  s/.*://;
-    
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
-sub insert {
-    my ($class,$obj) = @_;
-freeze($obj
+YAML::freeze(Data::Structure::Util::unbless($obj)
-
-    # Execute insert via XML-RPC and return id
-    eval {
-localhost
+172.16.164.103
-        return $xmlrpc->call("insert",$class,$obj_yaml);
-    };

honeyclient/trunk/lib/HoneyClient/Manager/VM/Clone.pm

@@ -382 +382 @@
-
-The name of the cloned VM.
+
+=back
+
+=head2 database_id
+
+=over 4
+
+The ID of the VM data, if it is stored within a database.
-
-=back
@@ -839 +847 @@
-        # A variable containing the name the cloned VM.
-        name => undef,
+
+        # A variable containing the database identifier, if any is specified.
+        database_id => undef,
-    
-        # A SOAP handle to the VM manager daemon.  (This internal variable