Changeset 245

Timestamp:

04/12/07 14:14:24 (2 years ago)

Author:

kindlund

Message:

Initial changes to Integrity object (to create a Filesystem object).

Files:

• honeyclient/branches/exp/kindlund-filesystem/lib/HoneyClient/Agent/Integrity.pm (modified) (15 diffs)
• honeyclient/branches/exp/kindlund-filesystem/t/honeyclient_agent_integrity.t (modified) (4 diffs)

honeyclient/branches/exp/kindlund-filesystem/lib/HoneyClient/Agent/Integrity.pm

@@ -6 +6 @@
-#              modifications.
-#
-
+, kindlund
-#
-# Copyright (C) 2006 The MITRE Corporation.  All rights reserved.
@@ -31 +31 @@
-=head1 NAME
-
-
-
-
-
+
+
-
-=head1 VERSION
-
-
+
-
-=head1 SYNOPSIS
+
+  use HoneyClient::Agent::Integrity;
+  use Data::Dumper;
+
+  # Create the Integrity object.  Upon creation, the object will
+  # be initialized, by performing a baseline of the Agent VM OS.
+  my $integrity = HoneyClient::Agent::Integrity->new();
+
+  # ... Some time elapses ...
+
+  # Check the Agent VM, for any violations.
+  my $changes = $integrity->check();
+
+  if (!defined($changes)) {
+      print "No integrity violations have occurred.\n";
+  } else {
+      print "System integrity has been compromised:\n";
+      print Dumper($changes);
+  }
+
+  # TODO: Need to update this example.
+
+  # $changes refers to an array of hashtable references, where
+  # each hashtable has the following format:
+  #
+  # $changes = [ {
+  #     # The registry directory name.
+  #     'key' => 'HKEY_LOCAL_MACHINE\Software...',
+  #
+  #     # Indicates if the registry directory was deleted,
+  #     # added, or changed.
+  #     'status' => 'deleted' | 'added' | 'changed',
+  #
+  #     # An array containing the list of entries within the
+  #     # registry directory that have been deleted, added, or
+  #     # changed.  If this array is empty, then the corresponding
+  #     # registry directory in the original and new hives contained
+  #     # no entries.
+  #     'entries'  => [ {
+  #         'name' => "\"string\"",  # A (potentially) quoted string; 
+  #                                  # "@" for default
+  #         'new_value' => "string", # New string; maybe undef, if deleted
+  #         'old_value' => "string", # Old string; maybe undef, if added
+  #     }, ],
+  # }, ]
+
+=head1 DESCRIPTION
+
+# TODO: This text needs to change.
-
-=head2 INITIALIZATION
@@ -92 +139 @@
-use Carp ();
-
+
+# Include Global Configuration Processing Library
+use HoneyClient::Util::Config qw(getVar);
+
+# Include the Registry Checking Library
+use HoneyClient::Agent::Integrity::Registry;
+
+# Include the File/Directory Search Library
+use File::Find qw(find);
+
+# Include the MD5 Checksum Library
+use Digest::MD5;
+
+# Include the Base 64 Encode/Decode Library
+use MIME::Base64 qw(encode_base64 decode_base64);
+
+# Use Storable Library
+use Storable qw(nfreeze thaw dclone);
+$Storable::Deparse = 1;
+$Storable::Eval = 1;
+
+# Use Dumper Library
+use Data::Dumper;
+
+# Use Basename Library
+use File::Basename qw(dirname);
+
+# Include Logging Library
+use Log::Log4perl qw(:easy);
+
+#######################################################################
+# Module Initialization                                               #
+#######################################################################
+
+BEGIN {
+    # Defines which functions can be called externally.
+    require Exporter;
+    our (@ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS, $VERSION);
+
+    # Set our package version.
+    $VERSION = 0.95;
+
+    @ISA = qw(Exporter);
+
+    # Symbols to export on request
+    @EXPORT = qw( );
+
+    # Items to export into callers namespace by default. Note: do not export
+    # names by default without a very good reason. Use EXPORT_OK instead.
+    # Do not simply export all your public functions/methods/constants.
+
+    # This allows declaration use HoneyClient::Agent::Integrity ':all';
+    # If you do not need this, moving things directly into @EXPORT or @EXPORT_OK
+    # will save memory.
+
+    %EXPORT_TAGS = (
+        'all' => [ qw( ) ],
+    );
+
+    # Symbols to autoexport (:DEFAULT tag)
+    @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } );
+
+    $SIG{PIPE} = 'IGNORE'; # Do not exit on broken pipes.
+}
+our (@EXPORT_OK, $VERSION);
+
-=pod
-
-=begin testing
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-require_ok('HoneyClient::Util::Config');
-can_ok('HoneyClient::Util::Config', 'getVar');
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-# Make sure File::Find loads.
@@ -119 +265 @@
-
-# Make sure Digest::MD5 loads.
-, qw(new)
-#
-#
+
+
+
-
-# Make sure MIME::Base64 loads.
@@ -130 +276 @@
-use MIME::Base64 qw(encode_base64 decode_base64);
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-###Testing Globals###
-# Directory where the known-good test files are stored
-
+#
-
-# List of files and directories to check during filesystem checking
-
+#
-
-# List of files or directories to exclude if found in subdirs during
-# filesystem check.
-
+#
-
-# File where found changes are written to
-
+#
-
-=end testing
@@ -156 +312 @@
-=cut
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-# These two hack variables are necessary currently in order to get values back 
-# out of the functions used with the find() function from File::Find. I can
@@ -249 +368 @@
-);
-
+=pod
+
+=head1 DEFAULT PARAMETER LIST
+
+When an Integrity B<$object> is instantiated using the B<new()> function,
+the following parameters are supplied default values.  Each value
+can be overridden by specifying the new (key => value) pair into the
+B<new()> function, as arguments.
+
+=head2 bypass_baseline 
+
+=over 4
+
+When set to 1, the object will forgo any type of initial baselining
+process, upon initialization.  Otherwise, baselining will occur
+as normal, upon initialization.
+
+=back
+
+=cut
-
-my %PARAMS = (
+    # When set to 1, the object will forgo any type of initial baselining
+    # process, upon initialization.  Otherwise, baselining will occur
+    # as normal, upon initialization.
+    bypass_baseline => 0,
-
-    # Contains the Registry object, once initialized.
+    # (For internal use only.)
-    _registry => undef,
-
@@ -281 +425 @@
-);
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=pod
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=cut
@@ -330 +588 @@
-    bless $self, $class;
-
+    # Perform baselining, if not bypassed.
+    if (!$self->{'bypass_baseline'}) {
+        $LOG->info("Baselining system.");
+        $self->_init();
+    }
+
-    # Finally, return the blessed object.
-    return $self;
@@ -340 +604 @@
-=head1 
-
-initAll
+_init
-
-=cut
-
-initAll
+_init
-    my $self = shift;
-initRegistry() MUST be called before initFileSystem, since initRegistry
-creates new files that must exist to be added to the exclusion list for
-initFileS
+The Registry object MUST be created before the Filesystem object, since
+the Registry object creates new files that must exist to be added to the
+Filesystem's baseline list of files that exist on the s
-    $self->{'_registry'} = HoneyClient::Agent::Integrity::Registry->new();
-   
+    #
-}
-
@@ -367 +631 @@
-    my $retval;
-
+    # One Idea:
-    # If at all possible we want the (faster) registry checks to short circut
-    # the overall checks so we don't have to do the very slow filesystem checks.
@@ -416 +681 @@
-change frequently). This file should be named as defined by $self->{file_exclude}.
-
-
+#
-
-#Testing initFileSystem();
-
-
-
-
-
-
-
-
-
-
-
+#
+
+#
+#
+#
+#
+#
+#
+#
+#
-#Bad test because it will be empty in the case of an error anyway?
-
-
-
-
-
-
-
-
-
-
+#
+
+#
+#
+#
+#
+#
+#
+#
+#
-#Bad test because it will be empty in the case of an error anyway?
-
-
-
-
-
-
-
-
-
+#
+
+#
+#
+#
+#
+#
+#
+#
-#Bad test because it will be empty in the case of an error anyway?
-
-
-
-
-
-
+#
+
+#
+#
+
+#
-
-=cut
@@ -497 +762 @@
-        else{
-            #XXX: Does this case matter(exist?) for pipes for instance?
-           print "A file that isn't a file or directory (or just general problem, or the file just isn't there) was found with file: $file
+            print "Warning: Ignoring '" . $file . "', since it is not a file or directory.
-        }
-    }
@@ -542 +807 @@
-which occured in the filesystem.
-
-
+#
-
-#Testing that checkFileSystem()
-
-
-
+#
+#
-
-#add
-
-
-
-
-
-
-
-
+#
+#
+#
+#
+#
+#
+#
+#
-#XXX Won't the die statement just be masked by the redirection of stdout/stderr?
-
-
-
+#
+#
+#
-
-
-#delete
-
-
-
-
+#
+#
+#
+#
-#XXX Won't the die statement just be masked by the redirection of stdout/stderr?
-
-
-
+#
+#
+#
-
-#change
-
-
-
-
+#
+#
+#
+#
-#XXX Won't the die statement just be masked by the redirection of stdout/stderr?
-
-
-
-
-
-
-
-
+#
+#
+#
+
+#
+#
+
+#
-
-=cut
@@ -736 +1001 @@
-}
-
-################################################################################
-
-sub _get_directories_to_check(){
-my $self = shift;
-my @checkdirs;
-
-    #Sets the VERY hardcoded default for now (late addition for ease of use, not clean code)
-    push @checkdirs, "/cygdrive/c/";
-
-    #Can override the default by creating this file (for now, eventually put directly into XML)
-    if($self->{file_checklist} ne "none"){
-        open CHECK, "$self->{file_checklist}" or 
-        die "You need a file named $self->{file_checklist} with fully-qualified " .
-         "file and directory names to check in order to run this program. " .
-         "Please see the POD documentation for more information.\n";
-        @checkdirs = ();
-        $/ = "\n";
-        while(<CHECK>) {
-            chomp;
-            print "reading in $_ from $self->{file_checklist}\n";
-            push @checkdirs, $_;
-        }
-        close CHECK;
-    }
-    return @checkdirs;
-}
-
-################################################################################
-
-# _found() takes input from $file_checklist, which is a file created by the
-# user specifying which directory to baseline and check. As long as the
-# directory is not in $file_exclude, then proceed with check.
-# Uses the global hash reference hack because
-# it's used by find() so can't take in/pass back stuff
-
-sub _found {
-        
-    my $foundfile = $File::Find::name;
-    
-    if (-f $foundfile) {
-        if (exists($g_ex_hash->{$foundfile})) {
-            return;
-        }
-
-        my $dir = dirname($foundfile);
-        while ($dir ne "/") {
-            # XXX: Need to add some sort of logic to account
-            # for off-by-one key names (i.e., /dir versus /dir/).
-            if (exists($g_ex_hash->{$dir})) {
-                return;
-            }
-            $dir = dirname($dir);
-        }
-
-#       if (!exists($g_ex_hash->{$foundfile})) {
-            push @{$g_hack}, $foundfile;
-#           print "found $foundfile\n";
-#           print "@{$g_hack}\n";
-#       }
-    }
-}
-
-################################################################################
-
-# This function is used to delve down into directories and make sure all the
-# contained files are excluded. Uses the global hash reference hack because
-# it's used by find() so can't take in/pass back stuff
-
-sub _recursive_exclude{
-    
-   my $foundfile = $File::Find::name;
-    if (-f $foundfile) {
-        $g_ex_hash->{$foundfile} = 1;
-##      print "\t _recursive_exclude()d $foundfile\n";
-    }
-}
-
-################################################################################
-
-# Helper function designed to programmatically get or set parameters
-# within this object, through indirect use of the AUTOLOAD function.
-#
-# It's best to explain by example:
-# Assume we have defined a driver object, like the following.
-#
-# use HoneyClient::Agent::Driver;
-# my $driver = Driver->new(someVar => 'someValue');
-#
-# What this function allows us to do, is programmatically, get or set
-# the 'someVar' parameter, like:
-#
-# my $value = $driver->someVar();    # Gets the value of 'someVar'.
-# my $value = $driver->someVar('2'); # Sets the value of 'someVar' to '2'
-#                                    # and returns '2'.
-#
-# Rather than creating getter/setter functions for every possible parameter,
-# the AUTOLOAD function allows us to create these operations in a generic,
-# reusable fashion.
-#
-# See "Autoloaded Data Methods" in perltoot for more details.
-# 
-# Inputs: set a new value (optional)
-# Outputs: the currently set value
-sub AUTOLOAD {
-    # Get the object.
-    my $self = shift;
-
-    # Sanity check: Make sure the supplied value is an object.
-    my $type = ref($self) or Carp::croak "Error: $self is not an object!\n";
-
-    # Now, get the name of the function.
-    my $name = $AUTOLOAD;
-
-    # Strip the fully-qualified portion of the function name.
-    $name =~ s/.*://;
-
-    # Make sure the parameter exists in the object, before we try
-    # to get or set it.
-    unless (exists $self->{$name}) {
-        Carp::croak "Error: Can't access '$name' parameter in class $type!\n";
-    }
-
-    if (@_) {
-        # If we were given an argument, then set the parameter's value.
-        return $self->{$name} = shift;
-    } else {
-        # Else, just return the existing value.
-        return $self->{$name};
-    }
-}
-
-################################################################################
-
-# Base destructor function.
-# Since none of our state data ever contains circular references,
-# we can simply leave the garbage collection up to Perl's internal
-# mechanism.
-#sub DESTROY {
-#}
-################################################################################
-
-
-1;
-

honeyclient/branches/exp/kindlund-filesystem/t/honeyclient_agent_integrity.t

@@ -9 +9 @@
-# =begin testing
-{
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
+
+
+
+
-require_ok('HoneyClient::Util::Config');
-can_ok('HoneyClient::Util::Config', 'getVar');
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-# Make sure File::Find loads.
@@ -32 +65 @@
-
-# Make sure Digest::MD5 loads.
-, qw(new)
-#
-#
+
+
+
-
-# Make sure MIME::Base64 loads.
@@ -43 +76 @@
-use MIME::Base64 qw(encode_base64 decode_base64);
-
-
-
-
-
-
-
-
+
+
+
+
+
-
+# Make sure HoneyClient::Agent::Integrity::Registry loads
+BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry')
+        or diag("Can't load HoneyClient::Agent::Integrity::Registry package. Check to make sure the package library is correctly listed within the path."); }
+require_ok('HoneyClient::Agent::Integrity::Registry');
+use HoneyClient::Agent::Integrity::Registry;
+
+# Make sure HoneyClient::Agent::Integrity loads.
+BEGIN { use_ok('HoneyClient::Agent::Integrity') or diag("Can't load HoneyClient::Agent::Integrity package.  Check to make sure the package library is correctly listed within the path."); }
+require_ok('HoneyClient::Agent::Integrity');
+use HoneyClient::Agent::Integrity;
+
+# TODO: Are these still needed?
-###Testing Globals###
-# Directory where the known-good test files are stored
-
+#
-
-# List of files and directories to check during filesystem checking
-
+#
-
-# List of files or directories to exclude if found in subdirs during
-# filesystem check.
-
+#
-
-# File where found changes are written to
-
+#
-}
-
@@ -70 +113 @@
-# =begin testing
-{
-#Testing initFileSystem(
+diag("These tests will create temporary files in /tmp.  Be sure to cleanup this directory, if any of these tests fail."
-
-
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
-}
-