Changeset 364

Timestamp:

05/25/07 16:16:50 (1 year ago)

Author:

kindlund

Message:

Rearchitecture design.

Files:

• honeyclient/branches/exp/kindlund-filesystem/lib/HoneyClient/Agent.pm (modified) (3 diffs)

honeyclient/branches/exp/kindlund-filesystem/lib/HoneyClient/Agent.pm

@@ -726 +726 @@
-        _unlock($data);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-            
-        # Acquire data lock.
@@ -973 +743 @@
-            #$data->{$driverName}->{'thread_id'} = undef;
-        }
-# XXX: Check to see if this works okay.
-        $thread->detach();
-
-        # Release data lock.
-        _unlock($data);
+
+# XXX: Check to see if this works okay.
+#        $thread->join();
-    }
-
@@ -986 +757 @@
-    # return true.
-    return 1;
+}
+
+# TODO: Clean up this comment block.
+# This function should do the following:
+# - Initialize all drivers with starting state.
+# - "Drive" each driver, one-by-one.
+# - Collect any integrity violations found, with offending
+#   state information.
+#
+# Notes:
+# This function will eventually sit in a sub-thread, allowing the parent
+# thread to return without any delay.  It is expected that the Manager
+# would then subsequently call a getStatus() operation, in order to
+# then poll for any new violations found.
+#
+# TODO: We need to create a fault reporting mechanism, in order
+# to properly deal with exceptions/faults that occur within this
+# thread.
+sub childThread {
+
+    # Extract arguments.
+    my $driverName = shift;
+
+# XXX: Check if we need this.
+#    threads->yield();
+
+    # Trap all faults that may occur from these asynchronous operations.
+    eval {
+
+        ###################################
+        ### Driver Initialization Phase ###
+        ###################################
+
+        # Initially set local integrity object to undef.
+        my $integrity = undef;
+                
+        # Initially set all driver objects to undef. 
+        my $driver = undef;
+    
+        # Acquire lock on stored driver state.
+        $data = _lock();
+
+        if ($PERFORM_INTEGRITY_CHECKS) {
+            # XXX: WARNING - The $integrityState object data is NOT thread-safe
+            # (since it relies on external data stored on the file system).
+            # As such, do NOT try to call integrity checks on multiple, simultaneous
+            # asynchronous threaded drivers.
+            $integrity = thaw($integrityState);
+            # Perform initial integrity baseline check.
+            #print "Initializing Integrity Check...\n";
+            # TODO: Initialize Integrity Checks
+            #$integrity = HoneyClient::Agent::Integrity->new();
+        }
+
+        # Now, initialize each driver object. 
+        # Figure out which $driver object to use...
+        my $driverClass = 'HoneyClient::Agent::Driver::Browser::' . $driverName;
+                
+        if (!defined($data->{$driverName}->{'state'})) {
+    
+            # If the driver state is undefined, then
+            # create a new state object.
+            $driver = $driverClass->new();
+
+        } else {
+            # Then the driver state object is already defined,
+            # so go ahead and reuse it.
+            $driver = $driverClass->new(
+                        %{$data->{$driverName}->{'state'}}, 
+            );
+        }
+
+        # Next, we make sure we have no updates, before we update
+        # the corresponding shared memory version.
+        $driver = _update($driver);
+
+        # Once we've initialized the object, be sure to update
+        # the corresponding shared memory version.  We do this
+        # one time before the loop starts, in case we end up
+        # finishing before we drove anywhere.
+                
+        # Copy object data to shared memory.
+        $data->{$driverName}->{'next'} = $driver->next();
+        $data->{$driverName}->{'status'} = $driver->status();
+        $data->{$driverName}->{'status'}->{'is_compromised'} = 0;
+        $data->{$driverName}->{'status'}->{'is_running'} = 1;
+        $data->{$driverName}->{'state'} = $driver;
+
+# XXX: Check to see if this is okay.
+#       if ($driver->isFinished()) {
+#           # Thread is about to finish, set the ID back to undef.
+#           # This looks ugly, but setting it this early avoids the
+#           # potential race condition of when the run() thread is finished
+#           # and when updateState() checks for $driverData->{$driverName}->{'thread_id'}
+#           # to be set to undef.
+#           $data->{$driverName}->{'thread_id'} = undef;
+#       }
+
+        # Release lock on stored driver state.
+        _unlock($data);
+                
+        ###################################
+        ### Driver Running Phase        ###
+        ###################################
+
+        # Boolean to indicate that the driver is about to transition
+        # to a new set of targets upon the next drive() operation.
+        my $driverTargetsChanged = 0;
+
+        while (!$driver->isFinished() && !$driverTargetsChanged) {
+            # XXX: Debug.  Remove this.
+            # We assume $driver->next() returns defined data.
+            foreach my $resource (keys %{$driver->next()->{resources}}) {
+                print "Using Resource: " . $resource . "\n";
+            }
+
+            # Drive the driver for one step.
+            # If the operation fails, then an exception will be generated.
+            $driver->drive();
+   
+            # Acquire lock on stored driver state.
+            $data = _lock();
+                    
+            # Check for any additional external driver updates.
+            $driver = _update($driver);
+
+            # Check to see if our driver's targets have changed.
+            $driverTargetsChanged = not(Compare($data->{$driverName}->{'next'}->{'targets'}, $driver->next()->{'targets'}));
+            # XXX: Delete this, eventually.
+            if ($driverTargetsChanged) {
+                print "Driver targets have changed.\n";
+                #$Data::Dumper::Terse = 0;
+                #$Data::Dumper::Indent = 1;
+                #print "Current: " . Dumper($data->{$driverName}->{'next'}->{'targets'}) . "\n";
+                #print "Next: " . Dumper($driver->next()->{'targets'}) . "\n";
+            }
+
+            # Copy object data to shared memory.
+            $data->{$driverName}->{'next'} = $driver->next();
+            $data->{$driverName}->{'status'} = $driver->status();
+            $data->{$driverName}->{'status'}->{'is_compromised'} = 0;
+            $data->{$driverName}->{'status'}->{'is_running'} = 1;
+            $data->{$driverName}->{'state'} = $driver;
+
+            # Release lock on stored driver state.
+            _unlock($data);
+        }
+                
+        # TODO: Perform Integrity Check
+        my $isCompromised = 0;
+        if (defined($integrity)) {
+            # For now, we update a scalar called 'is_compromised' within
+            # the $data->{$driverName}->{'status'} sub-hashtable.
+            print "Performing Integrity Checks...\n";
+            my $changes = $integrity->check();
+            if (scalar(@{$changes->{registry}}) || 
+                scalar(@{$changes->{filesystem}})) {
+                print "Integrity Check: FAILED\n";
+                $isCompromised = 1;
+            } else {
+                print "Integrity Check: PASSED\n";
+            }
+        }
+        # XXX: Check to make sure this doesn't destroy the integrity
+        # object prematurely.
+        # DESTROY this reference, but don't kill any temporary files created.
+        $integrity = undef;
+
+        # Update driver state one last time, before exiting.
+                
+        # Acquire lock on stored driver state.
+        $data = _lock();
+                    
+        # Check for any additional external driver updates.
+        $driver = _update($driver);
+
+        # Copy object data to shared memory.
+        $data->{$driverName}->{'next'} = $driver->next();
+        $data->{$driverName}->{'status'} = $driver->status();
+        $data->{$driverName}->{'status'}->{'is_compromised'} = $isCompromised;
+        $data->{$driverName}->{'status'}->{'is_running'} = 0;
+        $data->{$driverName}->{'state'} = $driver;
+ 
+        # Thread is about to finish, set the ID back to undef.
+# XXX: Check to see if this is okay.
+#       $data->{$driverName}->{'thread_id'} = undef;
+
+        # Release lock on stored driver state.
+        _unlock($data);
+
+        # XXX: Debugging, remove eventually. 
+        print "Exiting run() thread.\n";
+        #print Dumper($driver);
+        # Verbose debugging:
+        #print Dumper($driver->status());
+        # Short-hand debugging:
+        #my $status = $driver->status();
+        #print "R(" . $status->{relative_links_remaining} . ") | [ " .
+        #      "V(" . $status->{links_remaining} . ") + ".
+        #      "P(" . $status->{links_processed} . ") = " .
+        #      "T(" . $status->{links_total} . ") ] " .
+        #      "| (" . $status->{percent_complete} . ")\n";
+    };
+    
+    ###################################
+    ### Driver Cleanup Phase        ###
+    ###################################
+           
+    # Check to see if any errors occurred within the thread.
+    # Queue any faults found, to transmit back to the next SOAP
+    # caller. 
+    if ($@) {
+        # Release any pending locks, to avoid deadlocks.
+        _unlock();
+
+        # Acquire lock on stored driver state.
+        $data = _lock();
+                 
+        # Make sure we update our state to reflect ourself dying.
+# XXX: Check to see if this is okay.
+#       $data->{$driverName}->{'thread_id'} = undef;
+
+        # Release lock on stored driver state.
+        _unlock($data);
+    
+        # TODO: Do proper fault queuing.
+        print "FAULT: " . $@ . "\n";
+    }
+
+    # This threads->detach() call needs to be at the end of the
+    # thread code, because by calling this, we signal that the
+    # child thread is no longer running and thus the
+    # thread->is_running() would return false.
+    #threads->detach();
+    # XXX: Debugging, remove eventually. 
+    print "About to return out of child thread.\n";
+    #return;
-}
-