Changeset 1472

Show
Ignore:
Timestamp:
04/08/08 10:43:11 (3 months ago)
Author:
kindlund
Message:

Still working on FW integration within Clone.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/branches/exp/kindlund-simpler_agent/lib/HoneyClient/Manager/VM/Clone.pm

    r1463 r1472  
    6868  my $ip_address = $clone->{'ip_address'}; 
    6969 
     70  # Specify the type of work you want the clone to handle. 
     71  my $work = { 
     72      "http://www.google.com/" => 1, 
     73      "http://www.cnn.com/" => 1, 
     74      "http://www.mitre.org/" => 10, 
     75  }; 
     76 
     77  # Drive the clone, using the work specified. 
     78  $clone = $clone->drive(work => $work); 
     79 
    7080  # Get the name of the cloned VM (as it appears in the VMware Console). 
    7181  my $name = $clone->{'name'}; 
    …… 
    528538 
    529539    if (($OBJECT_COUNT >= 0) && defined($self->{'config'})) { 
     540        # Signal firewall to deny traffic from this clone. 
     541        # XXX: Fill this in.  
    530542        
    531543        # Initialize a new handler, but suppress any initial connection errors. 
    …… 
    711723            $LOG->info("Initialized clone VM (" . $self->{'name'} . ") using IP (" . 
    712724                       $self->{'ip_address'} . ") and MAC (" . $self->{'mac_address'} . ")."); 
     725 
     726            # Signal firewall to allow traffic from this clone through. 
     727            # XXX: Test this. 
     728            $self->_allowNetwork(); 
     729 
    713730            $LOG->info("Waiting for Agent daemon to initialize inside clone VM."); 
    714731            $logMsgPrinted = 1; 
    …… 
    736753            # Register the cloned VM with the Drone database. 
    737754            my $dt = DateTime::HiRes->now(time_zone => "local"); 
    738      
     755    
     756            # XXX: We need to separate this call into 2 smaller ones. 
     757            #      1) Register basic client information. 
     758            #      2) Register OS/application details. 
     759            #      That way, if this function fails for some reason, 
     760            #      we have *some* sort of record in the database about it, 
     761            #      for cleanup purposes. 
     762 
    739763            # Construct the 'Client' object. 
    740764            my $client = { 
    …… 
    866890# If specified, dumps the supplied fingerprint information to 
    867891# a corresponding file. 
     892#  
     893# Inputs: self, fingerprint hashref 
    868894sub _dumpFingerprint { 
    869895 
    …… 
    871897    my ($self, $fingerprint) = @_; 
    872898 
     899    # XXX: Should this be a new .dump file, per compromise? 
    873900    # Dump the fingerprint to a file, if needed. 
    874901    my $COMPROMISE_FILE = getVar(name => "fingerprint_dump"); 
    …… 
    884911        $dump_file->close(); 
    885912    } 
     913} 
     914 
     915# Allows the specified VM to use the network. 
     916# 
     917# Inputs: self 
     918sub _allowNetwork { 
     919    # Extract arguments. 
     920    my ($self, %args) = @_; 
     921 
     922    # Determine if the firewall needs to be bypassed. 
     923    if ($self->{'_bypass_firewall'}) { 
     924        return; 
     925    } 
     926 
     927    # Build our VM's network connection table. 
     928    # Note: We assume our VM has a single MAC address 
     929    # and a single IP address. 
     930    my $netTable = {}; 
     931 
     932    # XXX: This code is a hack and needs to be fixed. 
     933    $netTable->{$self->{'name'}}->{'sources'}->{$self->{'mac_address'}}->{$self->{'ip_address'}} = { 
     934        # Allow all TCP traffic from this VM through on ports 80, 443, and 3690. 
     935        tcp => [ 80, ], #443, 3690 ], 
     936    }; 
     937 
     938    # XXX: This is a defect.  The current FW code requires we set a target, but 
     939    # doesn't care what hostname we provide -- as long as it's resolvable. 
     940    # However, it *does* care about the target ports, which are hardcoded. 
     941    $netTable->{$self->{'name'}}->{'targets'} = { 
     942        'www.cnn.com' => { 
     943            tcp => [ 80, 443, 3690 ], 
     944        }, 
     945    }; 
     946 
     947    $LOG->info("Allowing VM (" . $self->{'name'} . ") network access."); 
     948    $self->{'_fw_handle'}->addChain($netTable); 
     949    $self->{'_fw_handle'}->addRules($netTable); 
     950} 
     951 
     952# Denies the specified VM use of the network. 
     953#  
     954# Inputs: self 
     955sub _denyNetwork { 
     956    # Extract arguments. 
     957    my ($self, %args) = @_; 
     958 
     959    # Determine if the firewall needs to be bypassed. 
     960    if ($self->{'_bypass_firewall'}) { 
     961        return; 
     962    } 
     963 
     964    # Build our VM's network connection table. 
     965    # Note: We assume our VM has a single MAC address 
     966    # and a single IP address. 
     967    my $netTable = {}; 
     968     
     969    # XXX: This code is a hack and needs to be fixed. 
     970    $netTable->{$self->{'name'}}->{'sources'}->{$self->{'mac_address'}}->{$self->{'ip_address'}} = { 
     971        # Deny all TCP traffic from this VM. 
     972        tcp => [ 80, ], #443, 3690 ], 
     973    }; 
     974 
     975    $LOG->info("Denying VM (" . $self->{'name'} . ") network access."); 
     976    $self->{'_fw_handle'}->deleteChain($netTable); 
    886977} 
    887978 
    …… 
    9681059 
    9691060    # Create a generic empty clone, with test state data. 
    970     my $clone = HoneyClient::Manager::VM::Clone->new(test => 1, master_vm_config => $masterVM, _dont_init => 1); 
    971     is($clone->{test}, 1, "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1)") or diag("The new() call failed."); 
    972     isa_ok($clone, 'HoneyClient::Manager::VM::Clone', "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1)") or diag("The new() call failed."); 
     1061    my $clone = HoneyClient::Manager::VM::Clone->new(test => 1, master_vm_config => $masterVM, _dont_init => 1, _bypass_firewall => 1); 
     1062    is($clone->{test}, 1, "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1, _bypass_firewall => 1)") or diag("The new() call failed."); 
     1063    isa_ok($clone, 'HoneyClient::Manager::VM::Clone', "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1, _bypass_firewall => 1)") or diag("The new() call failed."); 
    9731064    $clone = undef; 
    9741065 
    …… 
    9811072                       "# with a fully functional master VM that has the HoneyClient code\n" . 
    9821073                       "# loaded upon boot-up.\n" . 
     1074                       "#\n" . 
     1075                       "# This test also requires that the firewall VM is registered,\n" . 
     1076                       "# powered on, and operational.\n" . 
    9831077                       "#\n" . 
    9841078                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    …… 
    10731167        _agent_handle => undef, 
    10741168 
     1169        # A SOAP handle to the FW daemon.  (This internal variable 
     1170        # should never be modified externally.) 
     1171        _fw_handle => undef, 
     1172 
    10751173        # A variable indicated how long the object should wait for 
    10761174        # between subsequent retries to any SOAP server 
    …… 
    10781176        # be modified externally.) 
    10791177        _retry_period => 2, 
     1178 
     1179        # A variable indicating if the firewall should be bypassed. 
     1180        # (For testing use only.) 
     1181        _bypass_firewall => 0, 
    10801182    ); 
    10811183 
    …… 
    10971199    # Set a valid handle for the VM daemon. 
    10981200    $self->{'_vm_handle'} = getClientHandle(namespace => "HoneyClient::Manager::VM"); 
     1201     
     1202    # Set a valid handle for the FW daemon. 
     1203    $self->{'_fw_handle'} = getClientHandle(namespace => "HoneyClient::Manager::FW"); 
     1204 
     1205    # XXX: Delete this, eventually. 
     1206    $LOG->info("Installing default firewall rules."); 
     1207    $self->{'_fw_handle'}->installDefaultRules(); 
     1208 
     1209    # Determine if the firewall needs to be bypassed. 
     1210    if ($self->{'_bypass_firewall'}) { 
     1211        $self->{'_fw_handle'}->allowAllTraffic(); 
     1212    } 
    10991213 
    11001214    # If the clone's configuration wasn't supplied initially, then 
    …… 
    11841298                       "# loaded upon boot-up.\n" . 
    11851299                       "#\n" . 
     1300                       "# This test also requires that the firewall VM is registered,\n" . 
     1301                       "# powered on, and operational.\n" . 
     1302                       "#\n" . 
    11861303                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    11871304                       "#\n" . 
    …… 
    11901307 
    11911308        # Create a generic empty clone, with test state data. 
    1192         my $clone = HoneyClient::Manager::VM::Clone->new(); 
     1309        my $clone = HoneyClient::Manager::VM::Clone->new(_bypass_firewall => 1); 
    11931310        my $cloneConfig = $clone->{config}; 
    11941311 
    …… 
    12541371    } 
    12551372 
     1373    # Signal firewall to deny traffic from this clone. 
     1374    # XXX: Fill this in.  
     1375 
    12561376    # Extract the VM configuration file. 
    12571377    my $vmConfig = $self->{'config'}; 
    …… 
    13431463                       "# loaded upon boot-up.\n" . 
    13441464                       "#\n" . 
     1465                       "# This test also requires that the firewall VM is registered,\n" . 
     1466                       "# powered on, and operational.\n" . 
     1467                       "#\n" . 
    13451468                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    13461469                       "#\n" . 
    …… 
    13491472 
    13501473        # Create a generic empty clone, with test state data. 
    1351         my $clone = HoneyClient::Manager::VM::Clone->new(); 
     1474        my $clone = HoneyClient::Manager::VM::Clone->new(_bypass_firewall => 1); 
    13521475        my $cloneConfig = $clone->{config}; 
    13531476 
    …… 
    14311554        $result = thaw(decode_base64($som->result())); 
    14321555 
    1433 # XXX: Delete this, eventually. 
    1434 print Dumper($result) . "\n"; 
    1435      
    14361556        # Figure out if there was a compromise found. 
    14371557        if (scalar(@{$result->{'fingerprint'}->{os_processes}})) { 
    …… 
    14781598        } 
    14791599    } 
     1600 
     1601    # XXX: Add error handling. 
    14801602 
    14811603    return $self; 

  • honeyclient/branches/exp/kindlund-simpler_agent/t/honeyclient_manager_vm_clone.t

    r1461 r1472  
    198198 
    199199    # Create a generic empty clone, with test state data. 
    200     my $clone = HoneyClient::Manager::VM::Clone->new(test => 1, master_vm_config => $masterVM, _dont_init => 1); 
    201     is($clone->{test}, 1, "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1)") or diag("The new() call failed."); 
    202     isa_ok($clone, 'HoneyClient::Manager::VM::Clone', "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1)") or diag("The new() call failed."); 
     200    my $clone = HoneyClient::Manager::VM::Clone->new(test => 1, master_vm_config => $masterVM, _dont_init => 1, _bypass_firewall => 1); 
     201    is($clone->{test}, 1, "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1, _bypass_firewall => 1)") or diag("The new() call failed."); 
     202    isa_ok($clone, 'HoneyClient::Manager::VM::Clone', "new(test => 1, master_vm_config => '$masterVM', _dont_init => 1, _bypass_firewall => 1)") or diag("The new() call failed."); 
    203203    $clone = undef; 
    204204 
    …… 
    211211                       "# with a fully functional master VM that has the HoneyClient code\n" . 
    212212                       "# loaded upon boot-up.\n" . 
     213                       "#\n" . 
     214                       "# This test also requires that the firewall VM is registered,\n" . 
     215                       "# powered on, and operational.\n" . 
    213216                       "#\n" . 
    214217                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    …… 
    264267                       "# loaded upon boot-up.\n" . 
    265268                       "#\n" . 
     269                       "# This test also requires that the firewall VM is registered,\n" . 
     270                       "# powered on, and operational.\n" . 
     271                       "#\n" . 
    266272                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    267273                       "#\n" . 
    …… 
    270276 
    271277        # Create a generic empty clone, with test state data. 
    272         my $clone = HoneyClient::Manager::VM::Clone->new(); 
     278        my $clone = HoneyClient::Manager::VM::Clone->new(_bypass_firewall => 1); 
    273279        my $cloneConfig = $clone->{config}; 
    274280 
    …… 
    325331                       "# loaded upon boot-up.\n" . 
    326332                       "#\n" . 
     333                       "# This test also requires that the firewall VM is registered,\n" . 
     334                       "# powered on, and operational.\n" . 
     335                       "#\n" . 
    327336                       "# Your master VM is: " . getVar(name => "master_vm_config", namespace => "HoneyClient::Manager::VM") . "\n" . 
    328337                       "#\n" . 
    …… 
    331340 
    332341        # Create a generic empty clone, with test state data. 
    333         my $clone = HoneyClient::Manager::VM::Clone->new(); 
     342        my $clone = HoneyClient::Manager::VM::Clone->new(_bypass_firewall => 1); 
    334343        my $cloneConfig = $clone->{config}; 
    335344 
    336 # TODO: Fix this. 
    337345        $clone = $clone->drive(work => { 'http://www.google.com/' => 1 }); 
    338346        isa_ok($clone, 'HoneyClient::Manager::VM::Clone', "drive(work => { 'http://www.google.com/' => 1})") or diag("The drive() call failed.");