Changeset 409

Timestamp:

05/29/07 23:12:01 (1 year ago)

Author:

kindlund

Message:

Merged kindlund-filesystem branch back into trunk.

Files:

• honeyclient/trunk/bin/StartAgent.pl (modified) (4 diffs)
• honeyclient/trunk/bin/StartManager.pl (modified) (1 diff)
• honeyclient/trunk/etc/honeyclient.xml (modified) (4 diffs)
• honeyclient/trunk/etc/honeyclient_log.conf (modified) (2 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent.pm (modified) (20 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser.pm (modified) (2 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm (modified) (2 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Filesystem.pm (modified) (1 diff, 1 prop)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (10 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Registry/Parser.pm (modified) (9 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Registry/Parser.yp (modified) (9 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager.pm (modified) (12 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/VM.pm (modified) (19 diffs)
• honeyclient/trunk/lib/HoneyClient/Util/Config.pm (modified) (5 diffs)
• honeyclient/trunk/lib/HoneyClient/Util/SOAP.pm (modified) (2 diffs)

honeyclient/trunk/bin/StartAgent.pl

@@ -7 +7 @@
-use Carp ();
-
+use HoneyClient::Util::Config qw(getVar);
-use HoneyClient::Agent;
-use HoneyClient::Util::SOAP qw(getClientHandle);
@@ -12 +13 @@
-use MIME::Base64 qw(decode_base64 encode_base64);
-use Storable qw(thaw nfreeze);
+use Log::Log4perl qw(:easy);
+
+# The global logging object.
+our $LOG = get_logger();
-
-our ($stub, $som);
@@ -18 +23 @@
-our $agentState = undef;
-my $tempState = undef;
+our $faultDetected = 0;
-
-print "URL: " . $URL. "\n";
@@ -35 +41 @@
-    }
-
-
+
+
+
+
-    # XXX: Reenable this, eventually.
-
+
+
-
-

honeyclient/trunk/bin/StartManager.pl

@@ -25 +25 @@
-
-my $driver = "IE";
-6
+9
-my $maxrel = 5;
-my $nexturl = "";

honeyclient/trunk/etc/honeyclient.xml

@@ -54 +54 @@
-        etc/honeyclient_log.conf
-    </log_config>
+    <syslog_address description="The IP address of the syslog server that all logging messages will be sent to by both Agent and Manager processes over UDP port 514." default="10.0.0.1">
+        10.0.0.1
+    </syslog_address>
-    <!-- HoneyClient::Agent Options -->
-    <Agent>
@@ -121 +124 @@
-        </Driver>
-        <perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1">
-
+ 
-        </perform_integrity_checks>
-        <!-- HoneyClient::Agent::Integrity Options -->
@@ -137 +140 @@
-                    <regex>C:/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles.*</regex>
-                    <regex>C:/Documents and Settings/Administrator/Cookies.*</regex>
+                    <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Macromedia/Flash Player.*</regex>
-                    <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex>
-                    <regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex>
@@ -181 +185 @@
-                    <name>HKEY_CURRENT_USER</name>
-                    <name>HKEY_USERS</name>
- 
+
-                </hives_to_check>
-                <exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis.  These entries match registry key directories that change normally during the course of driving the target application.  As such, they are excluded from analysis in order to reduce false positives.  As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character.">

honeyclient/trunk/etc/honeyclient_log.conf

@@ -59 +59 @@
-#######################################################################
-
-
+
+
+
-#log4perl.logger.HoneyClient.Agent.Integrity.Registry=DEBUG, Screen
-# Suppress Parser Debugging Messages
@@ -70 +72 @@
-log4perl.appender.Screen.layout=Log::Log4perl::Layout::PatternLayout
-log4perl.appender.Screen.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n
+
+# Syslog Logging Settings
+log4perl.appender.Syslog=Log::Dispatch::Syslog
+log4perl.appender.Syslog.socket=inet
+log4perl.appender.Syslog.Threshold=DEBUG
+log4perl.appender.Syslog.layout=Log::Log4perl::Layout::PatternLayout
+log4perl.appender.Syslog.layout.ConversionPattern=%5p [%M] (%F:%L) - %m%n

honeyclient/trunk/lib/HoneyClient/Agent.pm

@@ -163 +163 @@
-
-# Make sure Storable loads.
-
+ dclone
-require_ok('Storable');
-can_ok('Storable', 'freeze');
-can_ok('Storable', 'nfreeze');
-can_ok('Storable', 'thaw');
-
+
+
-
-# Make sure MIME::Base64 loads.
@@ -209 +210 @@
-
-# Include Hash Serialization Utility Libraries
-# TODO: Update unit tests to include 'dclone'
-use Storable qw(freeze nfreeze thaw dclone);
-$Storable::Deparse = 1;
@@ -228 +228 @@
-use Data::Compare;
-
+# Include Logging Library
+use Log::Log4perl qw(:easy);
+
+# The global logging object.
+our $LOG = get_logger();
+
-# Complete URL of SOAP server, when initialized.
-our $URL_BASE       : shared = undef;
@@ -240 +246 @@
-    getVar(name => "perform_integrity_checks");
-
-
-
-
-
-
+
+
+
+
-
-# A globally shared, serialized hashtable, containing data per
@@ -344 +349 @@
-    # Sanity check.  Make sure the daemon isn't already running.
-    if (defined($DAEMON_PID)) {
+        $LOG->fatal("Error: " . __PACKAGE__ . " daemon is already running (PID = " . $DAEMON_PID .")!");
-        Carp::croak "Error: " . __PACKAGE__ . " daemon is already running (PID = $DAEMON_PID)!\n";
-    }
@@ -370 +376 @@
-
-    # Perform initial integrity baseline check.
-
-
-
-
-
-
-
-
-
+
+
+
+
-
-    # Release data lock.
@@ -412 +413 @@
-        # Make sure the fork was successful.
-        if (!defined($pid)) {
+            $LOG->fatal("Error: Unable to fork child process.\n$!");
-            Carp::croak "Error: Unable to fork child process.\n$!";
-        }
@@ -438 +440 @@
-    
-        for (;;) {
-
+()
-        }
-    }
@@ -472 +474 @@
-    # the parent process...
-    if (defined($DAEMON_PID) && ($DAEMON_PID != 0)) {
+        $LOG->error("Killing PID = " . $DAEMON_PID);
-        print STDERR "Killing PID = " . $DAEMON_PID . "\n";
-        # The Win32 version of kill() seems to only respond to SIGKILL(9).
@@ -494 +497 @@
-        %driverUpdateQueues   = ( );
-
+        # Destroy all integrity data, if defined.
+        if (defined($integrityData)) {
+            $integrityData->destroy();
+        }
+        $integrityData        = undef;
+        
-        # Release data lock.
-        _unlock();
@@ -562 +571 @@
-# When called from run(), this function takes in the corresponding
-# Driver object; checks to see if there's a new entry within the
-first
-y
+all
+ies
-# accordingly.
-#
-# The external updateState() call adds new driver state into the queue,
-# one entry per call.  The internal _update() function merges this
-one merge
-operation
-may *NOT
-only one entry
+merging everything
+queued
+*WILL
+all entries
-# call made.
-#
@@ -587 +596 @@
-    my $queue = $driverUpdateQueues{$driverName};
-
+    # XXX: One possible DoS condition here; what if
+    # the manager keeps feeding updates to the Agent
+    # before the Agent has a chance to do any work?
+    
-    # If we have data in our driver specific queue...
-if
+while
-
-        # Update our driver state with the first entry
@@ -663 +676 @@
-        # Read the TID.
-        $tid = $data->{$driverName}->{'thread_id'};
+
+# XXX: Delete this, eventually.
+print "Checking TID = " . Dumper($tid) . "\n";
+if (defined(threads->object($tid))) {
+    print "Thread defined.\n";
+    if (threads->object($tid)->is_running()) {
+        print "Thread is running.\n";
+    } else {
+        print "Thread is NOT running.\n";
+    }
+} else {
+    print "Thread NOT defined.\n";
+}
-        
-        # Sanity check: Return false, if we already have a
@@ -674 +700 @@
-
-            return 0;
+        } else {
+            # XXX: Remove this, eventually.
+            print "Creating a new run() child thread...\n";
-        }
-
@@ -693 +722 @@
-        _unlock($data);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
-            
-        # Acquire data lock.
@@ -907 +733 @@
-            
-        # Set the valid thread ID.
+        $data->{$driverName}->{'thread_id'} = $thread->tid();
-        if ($thread->is_running()) {
-
+
+
-        } else {
-
+
+
-        }
-
@@ -916 +745 @@
-        _unlock($data);
-    }
+
+    # XXX: Debugging, remove eventually. 
+    print "Run thread initialized.\n";
-
-    # At this point, the driver thread is initialized and running,
-    # return true.
-    return 1;
+}
+
+# TODO: Clean up this comment block.
+# This function should do the following:
+# - Initialize all drivers with starting state.
+# - "Drive" each driver, one-by-one.
+# - Collect any integrity violations found, with offending
+#   state information.
+#
+# Notes:
+# This function will eventually sit in a sub-thread, allowing the parent
+# thread to return without any delay.  It is expected that the Manager
+# would then subsequently call a getStatus() operation, in order to
+# then poll for any new violations found.
+#
+# TODO: We need to create a fault reporting mechanism, in order
+# to properly deal with exceptions/faults that occur within this
+# thread.
+sub worker {
+
+    # Extract arguments.
+    my $args = shift;
+    my $driverName = $args->{'driver_name'};
+    my $integrity  = $args->{'integrity'};
+
+    # Temporary variable, used to hold thawed driver data.
+    my $data = undef;
+
+    # Yield processing to parent thread.
+    threads->yield();
+
+    # Trap all faults that may occur from these asynchronous operations.
+    eval {
+
+        ###################################
+        ### Driver Initialization Phase ###
+        ###################################
+
+        # Initially set all driver objects to undef. 
+        my $driver = undef;
+    
+        # Acquire lock on stored driver state.
+        $data = _lock();
+
+        # Now, initialize each driver object. 
+        # Figure out which $driver object to use...
+        my $driverClass = 'HoneyClient::Agent::Driver::Browser::' . $driverName;
+
+        if (!defined($data->{$driverName}->{'state'})) {
+    
+            # If the driver state is undefined, then
+            # create a new state object.
+            $driver = $driverClass->new();
+
+        } else {
+            # Then the driver state object is already defined,
+            # so go ahead and reuse it.
+            $driver = $driverClass->new(
+                        %{$data->{$driverName}->{'state'}}, 
+            );
+        }
+
+        # Next, we make sure we have no updates, before we update
+        # the corresponding shared memory version.
+        $driver = _update($driver);
+
+        # Once we've initialized the object, be sure to update
+        # the corresponding shared memory version.  We do this
+        # one time before the loop starts, in case we end up
+        # finishing before we drove anywhere.
+                
+        # Copy object data to shared memory.
+        $data->{$driverName}->{'next'} = $driver->next();
+        $data->{$driverName}->{'status'} = $driver->status();
+        $data->{$driverName}->{'status'}->{'is_compromised'} = 0;
+        $data->{$driverName}->{'status'}->{'is_running'} = 1;
+        $data->{$driverName}->{'state'} = $driver;
+
+        # Release lock on stored driver state.
+        _unlock($data);
+                
+        ###################################
+        ### Driver Running Phase        ###
+        ###################################
+
+        # Boolean to indicate that the driver is about to transition
+        # to a new set of targets upon the next drive() operation.
+        my $driverTargetsChanged = 0;
+
+        while (!$driver->isFinished() && !$driverTargetsChanged) {
+            # XXX: Debug.  Remove this.
+            # We assume $driver->next() returns defined data.
+            foreach my $resource (keys %{$driver->next()->{resources}}) {
+                $LOG->info("Driving To Resource: " . $resource);
+            }
+
+            # Drive the driver for one step.
+            # If the operation fails, then an exception will be generated.
+            $driver->drive();
+   
+            # Acquire lock on stored driver state.
+            $data = _lock();
+                    
+            # Check for any additional external driver updates.
+            $driver = _update($driver);
+
+            # Check to see if our driver's targets have changed.
+            $driverTargetsChanged = not(Compare($data->{$driverName}->{'next'}->{'targets'}, $driver->next()->{'targets'}));
+            # XXX: Delete this, eventually.
+            if ($driverTargetsChanged) {
+                $LOG->info("Driver targets have changed.");
+                #$Data::Dumper::Terse = 0;
+                #$Data::Dumper::Indent = 1;
+                #print "Current: " . Dumper($data->{$driverName}->{'next'}->{'targets'}) . "\n";
+                #print "Next: " . Dumper($driver->next()->{'targets'}) . "\n";
+            }
+
+            # Copy object data to shared memory.
+            $data->{$driverName}->{'next'} = $driver->next();
+            $data->{$driverName}->{'status'} = $driver->status();
+            $data->{$driverName}->{'status'}->{'is_compromised'} = 0;
+            $data->{$driverName}->{'status'}->{'is_running'} = 1;
+            $data->{$driverName}->{'state'} = $driver;
+
+            # Release lock on stored driver state.
+            _unlock($data);
+        }
+                
+        # TODO: Perform Integrity Check
+        my $isCompromised = 0;
+        if (defined($integrity)) {
+            # For now, we update a scalar called 'is_compromised' within
+            # the $data->{$driverName}->{'status'} sub-hashtable.
+            $LOG->info("Performing Integrity Checks.");
+            my $changes = $integrity->check();
+            if (scalar(@{$changes->{registry}}) || 
+                scalar(@{$changes->{filesystem}})) {
+                $LOG->warn("Integrity Check: FAILED");
+                $isCompromised = 1;
+            } else {
+                $LOG->info("Integrity Check: PASSED");
+            }
+        }
+        # Release our copy of the integrity object, but do not destroy 
+        # any internal references.
+        $integrity = undef;
+
+        # Update driver state one last time, before exiting.
+                
+        # Acquire lock on stored driver state.
+        $data = _lock();
+                    
+        # Check for any additional external driver updates.
+        $driver = _update($driver);
+
+        # Copy object data to shared memory.
+        $data->{$driverName}->{'next'} = $driver->next();
+        $data->{$driverName}->{'status'} = $driver->status();
+        $data->{$driverName}->{'status'}->{'is_compromised'} = $isCompromised;
+        $data->{$driverName}->{'status'}->{'is_running'} = 0;
+        $data->{$driverName}->{'state'} = $driver;
+ 
+        # Release lock on stored driver state.
+        _unlock($data);
+    };
+    
+    ###################################
+    ### Driver Cleanup Phase        ###
+    ###################################
+           
+    # Check to see if any errors occurred within the thread.
+    # Queue any faults found, to transmit back to the next SOAP
+    # caller. 
+    if ($@) {
+        # Release any pending locks, to avoid deadlocks.
+        _unlock();
+
+        # TODO: Do proper fault queuing.
+        $LOG->error("FAULT: " . $@);
+    }
+
+    # XXX: Debugging, remove eventually. 
+    print "About to return out of child thread.\n";
+    if (!threads->is_detached()) {
+        threads->detach();
+    }
+    threads->exit();
-}
-
@@ -1010 +1029 @@
-            # Figure out which $driver object to use...
-            my $driverClass = 'HoneyClient::Agent::Driver::Browser::' . $driverName;
-
+
-            if (!defined($data->{$driverName}->{'state'})) {
-    
@@ -1036 +1055 @@
-            # would get overwritten, during the next updateState() call.
-            $data->{$driverName}->{'status'}->{'is_compromised'} = 0;
+            $data->{$driverName}->{'status'}->{'is_running'} = 0;
-            $data->{$driverName}->{'state'} = $driver;
-
@@ -1119 +1139 @@
-        if ($proc->{Name} eq $processName) {
-            # TODO: Should this statement be in here?
+            $LOG->warn("Killing Process ID: " . $proc->{ProcessId});
-            Carp::carp "Killing Process ID: " . $proc->{ProcessId} . "\n";
-            Win32::Process::KillProcess($proc->{ProcessId}, 0);

honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser.pm

@@ -234 +234 @@
-# TODO: Need unit testing.
-use URI::URL;
+
+# Include Logging Library
+use Log::Log4perl qw(:easy);
+
+# The global logging object.
+our $LOG = get_logger();
-
-=pod
@@ -1025 +1031 @@
-    if ($self->_remaining_number_of_relative_links_to_visit == 1) {
-
-elete this, eventually.
-print "Resetting relative links to visit counter.\n"
+o we need this message in here?
+$LOG->info("Resetting relative links to visit counter.")
-
-        # The counter has reached one, so drop all other relative links

honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm

@@ -535 +535 @@
-
-    # Log resolved arguments.
-
-
-
-
+
+
+
+
+
+
-
-    my $changes = {
@@ -568 +570 @@
-    if (defined($self->{'_registry'})) {
-        $self->{'_registry'}->closeFiles();
+    }
+}
+
+# TODO: Comment this.
+sub destroy {
+    my $self = shift;
+
+    if (defined($self->{'_registry'})) {
+        $self->{'_registry'}->destroy();
-    }
-}

honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Filesystem.pm

@@ -1008 +1008 @@
-
-    # Log resolved arguments.
-
-
-
-
+
+
+
+
+
+
-
-    # Analyze the filesystem.

honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Registry.pm

@@ -403 +403 @@
-
-# Base destructor function.
-
-
-
-
+
+
-    my $self = shift;
+
+    # Delete any temporary files created by the baseline
+    # and checkpoint parsers.
+    $self->_cleanupParsers($self->{_baseline_parsers});
+    $self->_cleanupParsers($self->{_checkpoint_parsers});
+}
+
+# Helper function, designed to cleanup temporary files created
+# by specified parsers.
+#
+# Inputs: HoneyClient::Agent::Integrity::Registry object,
+#         the hashtable collection of specified parsers
+#
+# Outputs: None.
+sub _cleanupParsers {
+    # Extract arguments.
+    my ($self, $parser_collection) = @_;
-
-    # Delete any temporary files created.
@@ -413 +428 @@
-    my $fname = undef;
-    foreach my $hive (@{$self->{hives_to_check}}) {
-self->{_baseline_parsers}
+parser_collection
-        if (defined($parser)) {
-            $fname = $parser->getFilename();
-            if (defined($fname) && (-f $fname)) {
-baseline of hive '" . $hive . "'
+temporary '" . $hive . "' hive data
-                            $fname . "'.");
-                if (!unlink($fname)) {
@@ -424 +439 @@
-                }
-            }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-        }
-    }
@@ -457 +459 @@
-    my $fname_tmp = undef;
-    foreach my $hive (@{$self->{hives_to_check}}) {
-
+
+
+
+
+
+
+
+
+
+
-        $fname_tmp = tmpnam(); 
-        $LOG->debug("Storing snapshot of hive '" . $hive . "' into '" . $fname . "'.");
@@ -1172 +1183 @@
-
-    # Log resolved arguments.
-
-
-
-
+
+
+
+
+
+
-
-    # Check to see if the class name is inherited or defined.
@@ -1390 +1403 @@
-
-    # Log resolved arguments.
-
-
-
-