Changeset 1486

Timestamp:

04/08/08 14:48:13 (4 months ago)

Author:

kindlund

Message:

Got most of the FW handling code working properly, also added error checking during drive operations.

Files:

• honeyclient/branches/exp/kindlund-simpler_agent/lib/HoneyClient/Manager/VM/Clone.pm (modified) (14 diffs)

honeyclient/branches/exp/kindlund-simpler_agent/lib/HoneyClient/Manager/VM/Clone.pm

@@ -539 +539 @@
-    if (($OBJECT_COUNT >= 0) && defined($self->{'config'})) {
-        # Signal firewall to deny traffic from this clone.
-# XXX: Fill this in. 
+$self->_denyNetwork();
-       
-        # Initialize a new handler, but suppress any initial connection errors.
@@ -725 +725 @@
-
-            # Signal firewall to allow traffic from this clone through.
-            # XXX: Test this.
-            $self->_allowNetwork();
-
@@ -858 +857 @@
-                    !defined($args{'fingerprint'})) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-                } else {
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                }
-            } elsif (/compromised/) {
@@ -925 +935 @@
-    }
-
+    # Mark that the VM has been granted network access.
+    $self->{'_has_network_access'} = 1;
+
-    # Build our VM's network connection table.
-    # Note: We assume our VM has a single MAC address
@@ -946 +959 @@
-
-    $LOG->info("Allowing VM (" . $self->{'name'} . ") network access.");
+    # XXX: Currently, faults get propagated -- is this okay?
-    $self->{'_fw_handle'}->addChain($netTable);
-    $self->{'_fw_handle'}->addRules($netTable);
@@ -961 +975 @@
-        return;
-    }
+
+    # Check if the VM even has network access.
+    if (!$self->{'_has_network_access'}) {
+        return;
+    }
+    
+    # Mark that the VM has been denied network access.
+    $self->{'_has_network_access'} = 0;
-
-    # Build our VM's network connection table.
@@ -973 +995 @@
-    };
-
+    # XXX: This is a defect.  The current FW code requires we set a target, but
+    # doesn't care what hostname we provide -- as long as it's resolvable.
+    # However, it *does* care about the target ports, which are hardcoded.
+    $netTable->{$self->{'name'}}->{'targets'} = {
+        'www.cnn.com' => {
+            tcp => [ 80, 443, 3690 ],
+        },
+    };
+
-    $LOG->info("Denying VM (" . $self->{'name'} . ") network access.");
+    # XXX: Currently, faults get propagated -- is this okay?
+    $self->{'_fw_handle'}->deleteRules($netTable);
-    $self->{'_fw_handle'}->deleteChain($netTable);
-}
@@ -1180 +1213 @@
-        # (For testing use only.)
-        _bypass_firewall => 0,
+
+        # A variable indicating if the cloned VM has been granted
+        # network access.
+        _has_network_access => 0,
-    );
-
@@ -1203 +1240 @@
-    $self->{'_fw_handle'} = getClientHandle(namespace => "HoneyClient::Manager::FW");
-
-XXX: Delete
+TODO: Fix
-    $LOG->info("Installing default firewall rules.");
+    # XXX: Currently, faults get propagated -- is this okay?
-    $self->{'_fw_handle'}->installDefaultRules();
-
-    # Determine if the firewall needs to be bypassed.
-    if ($self->{'_bypass_firewall'}) {
+        # XXX: Currently, faults get propagated -- is this okay?
-        $self->{'_fw_handle'}->allowAllTraffic();
-    }
@@ -1372 +1411 @@
-
-    # Signal firewall to deny traffic from this clone.
-# XXX: Fill this in. 
+$self->_denyNetwork();
-
-    # Extract the VM configuration file.
@@ -1381 +1420 @@
-    $self->{'config'} = undef;
-    
-debug
+info
-    my $som = $self->{'_vm_handle'}->suspendVM(config => $vmConfig);
-
@@ -1549 +1588 @@
-        $currentWork = _pop($args{'work'});
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        # Figure out if there was a compromise found.
-
+} els
-            $LOG->warn("(" . $self->{'name'} . ") - " . $self->{'driver_name'} . " - Integrity Check: FAILED");
-
@@ -1588 +1650 @@
-
-        # Create a new clone, if a compromise was found and we still have work to do.
-scalar(@{$result->{'fingerprint'}->{os_processes}}
+($self->{'status'} eq "suspicious"
-            scalar(%{$args{'work'}})) {
-            # Be sure to carry over any customizations into the newly created
@@ -1599 +1661 @@
-    }
-
-XXX: Add error handling.
+TODO: Add more error handling?
-
-    return $self;