Changeset 119

Timestamp:

12/17/06 02:35:40 (2 years ago)

Author:

kindlund

Message:

Completed basic capabilities of the Registry object; still have to add exclusion support.

Files:

• honeyclient/branches/bug/42/etc/honeyclient.xml (modified) (1 diff)
• honeyclient/branches/bug/42/etc/honeyclient_log.conf (modified) (1 diff)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (24 diffs)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm (modified) (1 diff)
• honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp (modified) (1 diff)
• honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry.t (modified) (3 diffs)

honeyclient/branches/bug/42/etc/honeyclient.xml

@@ -163 +163 @@
-            </test_dir>
-            <Registry>
+                <!-- HoneyClient::Agent::Integrity::Registry::Test Options -->
+                <Test>
+                    <!--
+                        Note: you should *never* need to change *any* values
+                        within this section of the configuration.  All contents
+                        are *only* used for unit testing.
+                    -->
+                    <before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg">
+                        t/test_registry/before.reg
+                    </before_registry_file>
+                    <after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg">
+                        t/test_registry/after.reg
+                    </after_registry_file>
+                </Test>
-                <Parser>
-                    <!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options -->

honeyclient/branches/bug/42/etc/honeyclient_log.conf

@@ -59 +59 @@
-#######################################################################
-
-DEBUG
+INFO
-# Suppress Parser Debugging Messages
-
+#
-log4perl.appender.Screen=Log::Log4perl::Appender::Screen
-# If you want colorized logging to the screen, enable this line, instead.

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry.pm

@@ -246 +246 @@
-can_ok('File::Temp', 'tmpnam');
-can_ok('File::Temp', 'unlink0');
+can_ok('File::Temp', 'tempfile');
-use File::Temp qw(tmpnam unlink0);
-
@@ -267 +268 @@
-use HoneyClient::Agent::Integrity::Registry::Parser;
-
+# Make sure HoneyClient::Agent::Integrity::Registry loads
+BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry')
+        or diag("Can't load HoneyClient::Agent::Integrity::Registry package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('HoneyClient::Agent::Integrity::Registry');
+use HoneyClient::Agent::Integrity::Registry;
+
+# Make sure File::Basename loads.
+BEGIN { use_ok('File::Basename', qw(dirname basename fileparse)) or diag("Can't load File::Basename package.  Check to make sure the package library is correctly listed within the path."); }
+require_ok('File::Basename');
+can_ok('File::Basename', 'dirname');
+can_ok('File::Basename', 'basename');
+can_ok('File::Basename', 'fileparse');
+use File::Basename qw(dirname basename fileparse);
+
-=end testing
-
@@ -312 +327 @@
-=back
-
+=head2 bypass_baseline 
+
+=over 4
+
+When set to 1, the object will forgo any type of initial baselining
+process, upon initialization.  Otherwise, baselining will occur
+as normal, upon initialization.
+
+=back
+
-=cut
-
-# XXX: Update this, eventually.
-my %PARAMS = (
-
@@ -320 +344 @@
-    # analyze.
-    hives_to_check => [ 
-#
-#
+
+
-                        'HKEY_CURRENT_USER',
-#
-#
+
+
-                      ],
-
@@ -332 +356 @@
-    # to all content in these matches will also be ignored.
-    key_dirnames_to_ignore => [ ],
+
+
+    # When set to 1, the object will forgo any type of initial baselining
+    # process, upon initialization.  Otherwise, baselining will occur
+    # as normal, upon initialization.
+    bypass_baseline => 0,
-
-    # Baseline File Collection
@@ -379 +409 @@
-    my $self = shift;
-
-    # TODO: Should eventually delete, based upon $self->_filenames
-    # Delete any temporary files created.
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -428 +475 @@
-        $parser = HoneyClient::Agent::Integrity::Registry::Parser->init(input_file   => $fname,
-                                                                        index_groups => 1);
-
-        # Preemptively unlink the file, to prevent any other process from mucking with it.
-        # XXX: Check if this can still be used.
-#        if (!unlink0($parser->getFileHandle(), $fname)) {
-#            $LOG->fatal("Error: Unable to unlink '" . $hive . "' hive data in '" . $fname ."'.");
-#            Carp::croak("Error: Unable to unlink '" . $hive . "' hive data in '" . $fname ."'.");
-#        }
-
-        $parser_collection->{$hive} = $parser;
@@ -669 +709 @@
-}
-
-
+
+
+
+
+
-sub _compare {
-
@@ -691 +735 @@
-    # State variable:
-    # - Positive value: Keep comparing groups, linearly.
-
+
+
-    #
-    # Note: When a comparison is different, then this variable's
@@ -704 +749 @@
-    my ($before_linenums, $after_linenums, $diff_types) = $self->_diff($before_parser, $after_parser);
-
+    # Helper variable, used to indirectly locate the corresponding
+    # diff type of the current group block.
+    my $found_index = undef;
+
-    # Helper variables, to extract the latest line number from the diff
-    # operation, along with the latest diff type.
@@ -739 +788 @@
-            $diff_type      = shift(@{$diff_types});
-
- print("Before: ", Dumper($before_linenum) . "\n");
- print("After: ", Dumper($after_linenum) . "\n");
-
-            # Return early, if no changes were found.
-            if (!defined($before_linenum) && !defined($after_linenum)) {
-                # TODO: delete this, eventually.
-                #$Data::Dumper::Terse = 1;
-                #$Data::Dumper::Indent = 1;
-                #print "Complete list: " . Dumper($changes) . "\n";
-
-                return $changes;
-            }
@@ -755 +796 @@
-            $before_total_linenums += $before_parser->getCurrentLineCount();
-            $after_total_linenums += $after_parser->getCurrentLineCount();
-print("Before Total Linenums: ", Dumper($before_total_linenums) . "\n");
-print("After Total Linenums: ", Dumper($after_total_linenums) . "\n");
-
-            # Seek to nearest common group, that we haven't already parsed.
-            # TODO: Check to make sure that linking them is okay.
-            if (($before_linenum > $before_total_linenums) &&
-                ($after_linenum > $after_total_linenums)) {
@@ -797 +835 @@
-            $after_total_linenums += $after_parser->getCurrentLineCount();
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-            # Reset the current change hashref.
@@ -1028 +1061 @@
-            }
-        }
-
-    }
-}
@@ -1042 +1074 @@
-The following functions have been implemented by any Registry object.
-
-Driver::Browser
+Integrity::Registry
-
-=over 4
@@ -1062 +1094 @@
-=begin testing
-
+diag("These tests will create temporary files in /tmp.  Be sure to cleanup this directory, if any of these tests fail.");
+
-# Create a generic Registry object, with test state data.
-
-
+
+
+
+
+
+
+
+
+
-
-=end testing
@@ -1112 +1153 @@
-    bless $self, $class;
-
-
-
+
+
+
+
+
-
-    # Finally, return the blessed object.
@@ -1121 +1165 @@
-=pod
-
-
+before_file => $before_filename, after_file => $after_filename
-
-=over 4
@@ -1129 +1173 @@
-
-I<Inputs>:
-
+
+
+
+
+
-
-I<Output>:
@@ -1156 +1204 @@
-  }, ]
-
+I<Notes>: If B<$before_filename> is specified, then B<$after_filename> must be 
+specified as well.
+
-=back
-
-=begin testing
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=end testing
@@ -1203 +1381 @@
-    }
-
-
+s
-    # hashtable represents a change between the registry hives.
-
+
+
-
-    # Check to see if a before and after file were specified.
@@ -1225 +1404 @@
-            $after_parser  = $self->{_checkpoint_parsers}->{$hive};
-
-
-
-
+
+
+
+
+
-
-            $LOG->info("Finished checking '" . $hive . "' hive.");
@@ -1237 +1418 @@
-}        
-
+=pod
+
+=head2 $object->getFilesCreated()
+
+=over 4
+
+Returns a list of temporary filenames that have been created by the
+Registry B<$object>.
+
+I<Output>: Returns a list of filenames.
+
+=back
+
+=begin testing
+
+# Perform Registry baseline on HKEY_CURRENT_CONFIG.
+diag("Performing baseline check of 'HKEY_CURRENT_CONFIG' hive; this may take some time...");
+my $registry = HoneyClient::Agent::Integrity::Registry->new(hives_to_check => [ 'HKEY_CURRENT_CONFIG' ]);
+my @files_created = $registry->getFilesCreated();
+use Data::Dumper;
+my $tmpfile = tmpnam();
+unlink($tmpfile); 
+my $tmpdir = dirname($tmpfile);
+foreach my $file (@files_created) {
+    like($file, qr/$tmpdir/, "getFilesCreated()") or diag("The getFilesCreated() call failed.");
+}
+
+=end testing
+
+=cut
+
+sub getFilesCreated {
+    # Extract arguments.
+    my ($self, %args) = @_;
+
+    # Log resolved arguments.
+    # Make Dumper format more terse.
+    $Data::Dumper::Terse = 1;
+    $Data::Dumper::Indent = 0;
+    $LOG->debug(Dumper(\%args));
+
+    return values(%{$self->{_filenames}});
+}
+
-1;
-
@@ -1247 +1472 @@
-=head1 BUGS & ASSUMPTIONS
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=head1 SEE ALSO

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm

@@ -1454 +1454 @@
-    if($self->YYData->{'search_is_linenum'}) {
-        my $found_linenum = @{$self->YYData->{'group_index_linenums'}}[$found_index];
-
-
+
-        return $found_linenum;
-    } else {

honeyclient/branches/bug/42/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp

@@ -1299 +1299 @@
-    if($self->YYData->{'search_is_linenum'}) {
-        my $found_linenum = @{$self->YYData->{'group_index_linenums'}}[$found_index];
-
-
+
-        return $found_linenum;
-    } else {

honeyclient/branches/bug/42/t/honeyclient_agent_integrity_registry.t

@@ -80 +80 @@
-can_ok('File::Temp', 'tmpnam');
-can_ok('File::Temp', 'unlink0');
+can_ok('File::Temp', 'tempfile');
-use File::Temp qw(tmpnam unlink0);
-
@@ -88 +89 @@
-use Filesys::CygwinPaths qw(:all);
-
+# Make sure Search::Binary loads
+BEGIN { use_ok('Search::Binary')
+        or diag("Can't load Search::Binary package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('Search::Binary');
+can_ok('Search::Binary', 'binary_search');
+use Search::Binary;
+
-# Make sure HoneyClient::Agent::Integrity::Registry::Parser loads
-BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry::Parser')
@@ -93 +101 @@
-require_ok('HoneyClient::Agent::Integrity::Registry::Parser');
-use HoneyClient::Agent::Integrity::Registry::Parser;
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-# Create a generic Registry object, with test state data.
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-1;
-}
-
-
-
-
-1;