CloudyScripts 1.6.1 → 1.7.27

data/lib/audit/lib/transformers/web_view_transformer.rb

@@ -0,0 +1,171 @@
+# To change this template, choose Tools | Templates
+# and open the template in the editor.
+
+# icons taken from http://www.famfamfam.com/lab/icons/silk/
+
+require 'benchmark/audit_benchmark'
+require 'parser/result_type'
+require 'logger'
+
+class WebViewTransformer
+  IMAGE_PREFIX = "/images"
+  BENCHMARK_ID = "BENCHMARK"
+
+  @@LOG = Logger.new(STDOUT)
+
+
+  def self.get(audit, id)
+    if (id == :root) then
+      item = audit.benchmark
+     return {
+      'data'     => {
+        'title'    => item.name || item.id,
+        'attr'     => {},
+        'icon'     => 'folder'},
+      'attr'     => {
+        'id'       => BENCHMARK_ID},
+      'state'    => 'closed'}
+    else
+      return self.get_children(audit, id)
+    end
+  end
+
+  def self.get_children(audit, id)
+    if id == BENCHMARK_ID then
+      item = audit.benchmark
+    else
+      item = audit.results[id] || audit.benchmark.item_repository[id]
+    end
+    
+    if item.kind_of? AuditBenchmark then
+      return item.children.map {|x| self.get_item(audit, x.id)}
+    elsif item.kind_of? Group then
+      return item.children.map {|x| self.get_item(audit, x.id)}
+    elsif item.kind_of? RuleResult then
+      if item.rule.description then
+        results = [{
+              'data'     => {
+               'title'    => item.rule.description,
+               'icon'     => "#{IMAGE_PREFIX}/tag_blue.png"},
+              'state'    => 'opened',
+              'children' => []
+            }]
+      else
+        results = []
+      end
+
+      results = results + item.check.reject do|x|
+         x.methods.include?(:visible?) && (!x.visible?())
+      end.map do |x|
+          case x.type
+          when ResultType::MESSAGE then
+            {
+              'data' => {
+                'title' => x.to_string(),
+                'icon' => "#{IMAGE_PREFIX}/script.png"},
+              'state' => 'opened',
+              'children' => []
+            }
+          when ResultType::DATA then
+            {
+              'data' => {
+                'title' => x.to_string(),
+                'icon' => "#{IMAGE_PREFIX}/brick.png"},
+              'state' => 'opened',
+              'children' => []
+            }
+          when ResultType::PROGRAM_NAME then
+            {
+              'data' => {
+                'title' => x.to_string(),
+                'icon' => "#{IMAGE_PREFIX}/cog.png"},
+              'state' => 'opened',
+              'children' => []
+            }
+          else
+            {
+              'data' => {
+                'title' => x.to_string(),
+                'icon' => "file"},
+              'state' => 'opened',
+              'children' => []
+            }
+          end
+      end
+
+      return results
+    elsif item.kind_of? Check then
+      #check was not executed, thus no result
+      if item.description then
+        return [{
+              'data'     => {
+                'title'    => item.description,
+                'icon'     => "#{IMAGE_PREFIX}/tag_blue.png"},
+              'state'    => 'opened',
+              'children' => []
+            }]
+      else
+        return []
+      end
+    else
+      raise "Unknown item type #{item.class.name}"
+    end
+  end
+
+  def self.get_item(audit, id)
+    item = audit.results[id] || audit.benchmark.item_repository[id]
+
+    if item.kind_of? AuditBenchmark then
+      return {
+      'data'     => {
+        'title'    => item.name || item.id,
+        'icon'     => 'folder'},
+      'attr'     => {'id' => 'BENCHMARK'},
+      'state'    => 'closed'}
+    elsif item.kind_of? Group then
+      return {
+      'data'     => {
+        'title'    => item.name || item.id,
+        'icon'     => 'folder'},
+        'attr'     => {'id' => item.id},
+      'state'    => 'closed'}
+    elsif item.kind_of? RuleResult then
+       return {
+        'data'     => {
+          'title'    => item.rule.name || item.rule.id,
+          'icon'     => case item.result
+              when ResultCode::PASS then "#{IMAGE_PREFIX}/tick.png"
+              when ResultCode::FAIL then
+                if (item.severity == RuleSeverity::LOW || item.severity == RuleSeverity::INFO) then
+                  "#{IMAGE_PREFIX}/warning.png"
+                else
+                  "#{IMAGE_PREFIX}/fail.png"
+                end
+              else "#{IMAGE_PREFIX}/question.png"
+            end},
+        'attr'     => { 'id' => item.rule.id},
+        'state'    => 'closed'}
+    elsif item.kind_of? Check then
+      if item.description then
+        return {
+        'data'     => {
+          'title'    => item.name || item.id,
+          'icon'     => "#{IMAGE_PREFIX}/hourglass.png"},
+        'attr'     => {'id' => item.id},
+        'state'    => 'closed'}
+      else
+        return {
+        'data'     => {
+          'title'    => item.name || item.id,
+          'icon'     => "#{IMAGE_PREFIX}/hourglass.png"},
+        'attr'     => {'id' => item.id},
+        'state'    => 'opened',
+        'children' => []}
+      end
+    else
+      raise "Unknown item type #{item.class.name} for id #{id}"
+    end
+  end
+
+  
+end

data/lib/audit/lib/transformers/yaml_transformer.rb

@@ -0,0 +1,50 @@
+# To change this template, choose Tools | Templates
+# and open the template in the editor.
+
+class YamlTransformer
+  def initialize
+    
+  end
+
+  def self.transform(report)
+    self.transform_node(report, report.get_root)
+  end
+
+  def self.transform_node(report, node)
+    if node.kind_of? AuditBenchmark then
+      return self.transform_benchmark(report, node)
+    elsif node.kind_of? Group then
+      return self.transform_group(report, node)
+    elsif node.kind_of? RuleResult then
+      return self.transform_rule_result(report, node)
+    else
+      raise "Unknown report node type #{node.class.name}"
+    end
+  end
+
+  def self.transform_benchmark(report, node)
+    return {:id => node.id,
+            :name => node.name,
+            :description => node.description,
+            :children => node.children.map {|x| self.transform_node(report, report.get(x.id))}}
+  end
+
+  def self.transform_group(report, node)
+    return {:id => node.id,
+            :name => node.name,
+            :description => node.description,
+            :children => node.children.map {|x| self.transform_node(report, report.get(x.id))}}
+  end
+
+  def self.transform_rule_result(report, node)
+    return {:rule_refid => node.rule.id,
+            :name => node.rule.name,
+            :description => node.rule.description,
+            :check => node.check.map {|x| self.transform_check(x)}
+    }
+  end
+
+  def self.transform_check(check)
+    return check.to_hash()
+  end
+end

data/lib/audit/lib/util/random_string.rb

@@ -0,0 +1,22 @@
+# To change this template, choose Tools | Templates
+# and open the template in the editor.
+
+# Ruby 1.8 does not contains sample() function
+class Array
+  def sample()
+    return self.choice() 
+  end
+end
+
+class RandomString
+  def initialize
+    
+  end
+  def self.generate(length = 20, alphabet = ('A' .. 'Z').to_a + ('a' .. 'z').to_a + ('0' .. '9').to_a)
+    return (0 .. length).map { alphabet.sample }.join
+  end
+
+  def self.generate_name(length = 20)
+    return (('A' .. 'Z').to_a + ('a' .. 'z').to_a).sample + generate(length - 1)
+  end
+end

data/lib/audit/lib/version.rb

@@ -0,0 +1,7 @@
+require 'uri'
+
+class Version
+	attr_accessor :description
+	attr_accessor :timestamp
+	attr_accessor :updateUri
+end

data/lib/help/ec2_helper.rb

@@ -106,8 +106,10 @@ class Ec2Helper
     end
   end
 
-  def instance_prop(instance_id, prop)
-    instances = @ec2_api.describe_instances(:instance_id => instance_id)
+  def instance_prop(instance_id, prop, instances = nil)
+    if instances == nil
+      instances = @ec2_api.describe_instances(:instance_id => instance_id)
+    end
     begin
       if instances['reservationSet']['item'][0]['instancesSet']['item'].size == 0
         raise Exception.new("instance #{instance_id} not found")
@@ -157,4 +159,65 @@ class Ec2Helper
     false
   end
 
+  # From the information retrieved via EC2::describe_security_groups, look up
+  # all open ports for the group specified
+  def get_security_group_info(group_name, group_infos)
+    group_infos['securityGroupInfo']['item'].each() do |group_info|
+      return group_info if group_info['groupName'] == group_name
+    end
+    nil
+  end
+
+  # From the information retrieved via EC2::describe_instances for a specific
+  # instance, retrieve the names of the security groups belonging to that instance.
+  def lookup_security_group_names(instance_info)
+    group_names = []
+    puts "lookup_security_group_names(#{instance_info.inspect})"
+    instance_info['groupSet']['item'].each() {|group_info|
+      group_name = group_info['groupName'] || group_info['groupId']
+      group_names << group_name
+    }
+    group_names
+  end
+
+  # From the information retrieved via EC2::describe_security_groups, look up
+  # all open ports for the group specified
+  def lookup_open_ports(group_name, group_infos)
+    puts "group_infos = #{group_infos.inspect}"
+    group_info = get_security_group_info(group_name, group_infos)
+    puts "group_info for #{group_name} = #{group_info.inspect}"
+    open_ports = []
+    group_info['ipPermissions']['item'].each() {|permission|
+      if permission['ipRanges'] == nil
+        #no IP-Ranges defined (group based mode): ignore
+        next
+      end
+      prot = permission['ipProtocol']
+      from_port = permission['fromPort'].to_i
+      to_port = permission['toPort'].to_i
+      next if from_port != to_port #ignore port ranges
+      permission['ipRanges']['item'].each() {|ipRange|
+        if ipRange['cidrIp'] == "0.0.0.0/0"
+          #found one
+          open_ports << {:protocol => prot, :port => from_port}
+        end
+      }
+    }
+    open_ports
+  end
+
+  # Looks up the instanceId for the output retrieved by EC2::describe_instances(:instance_id => xxx)
+  # without the reservation set.
+  def get_instance_id(instance_info)
+    puts "look up instanceId in #{instance_info.inspect}"
+    instance_info['instancesSet']['item'][0]['instanceId']
+  end
+
+  # Looks up the instanceId for the output retrieved by EC2::describe_instances(:instance_id => xxx)
+  # without the reservation set.
+  def get_instance_prop(instance_info, prop)
+    puts "look up #{prop} in #{instance_info.inspect}"
+    instance_info['instancesSet']['item'][0][prop.to_s]
+  end
+
 end

data/lib/help/remote_command_handler.rb

@@ -11,6 +11,23 @@ class RemoteCommandHandler
     @use_sudo = false
   end
 
+  # Checks for a given IP/port if there's a response on that port.
+  def is_port_open?(ip, port)
+    begin
+      Timeout::timeout(5) do
+        begin
+          s = TCPSocket.new(ip, port)
+          s.close
+          return true
+        rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH
+          return false
+        end
+      end
+    rescue Timeout::Error
+      return false
+    end
+  end
+
   # Connect to the machine as root using a keyfile.
   # Params:
   # * ip: ip address of the machine to connect to

data/lib/help/state_transition_helper.rb

@@ -179,6 +179,14 @@ module StateTransitionHelper
     @logger.info("found #{sgs.size} security groups")
     @context[:security_groups] = sgs
   end
+
+  def retrieve_instances()
+    @context[:script].post_message("going to retrieve all instances...")
+    inst = @context[:ec2_api_handler].describe_instances()
+    @context[:script].post_message("found #{inst.size} instances")
+    @logger.info("found #{inst.size} instances")
+    @context[:ec2_instances] = inst
+  end
   
   # Creates a new EBS volume.
   # Input Parameters:

data/lib/scripts/ec2/open_port_checker.rb

@@ -0,0 +1,112 @@
+require "help/script_execution_state"
+require "scripts/ec2/ec2_script"
+require "help/remote_command_handler"
+#require "help/dm_crypt_helper"
+require "help/ec2_helper"
+require "AWS"
+
+# Identifies all server instances with their ports open and checks if
+# there are instances where no service runs on that port. Port ranges are
+# ignored.
+#
+
+class OpenPortChecker < Ec2Script
+  # Input parameters
+  # * ec2_api_handler => object that allows to access the EC2 API
+  def initialize(input_params)
+    super(input_params)
+  end
+
+  def check_input_parameters()
+    if @input_params[:ec2_api_handler] == nil
+      raise Exception.new("no EC2 handler specified")
+    end
+  end
+
+  def load_initial_state()
+    OpenPortCheckerState.load_state(@input_params)
+  end
+
+  private
+
+  # Here begins the state machine implementation
+  class OpenPortCheckerState < ScriptExecutionState
+    def self.load_state(context)
+      state = context[:initial_state] == nil ? InitialState.new(context) : context[:initial_state]
+      state
+    end
+
+  end
+
+  # Nothing done yet. Retrieve all security groups
+  class InitialState < OpenPortCheckerState
+    def enter
+      retrieve_instances()
+      InstancesRetrievedState.new(@context)
+    end
+  end
+
+  # Got all instances. If there are some, check security groups
+  class InstancesRetrievedState < OpenPortCheckerState
+    def enter
+      if @context[:ec2_instances].size == 0
+        Done.new(@context)
+      else
+        retrieve_security_groups()
+        SecurityGroupsRetrievedState.new(@context)
+      end
+    end
+  end
+
+  # Got all instances. If there are some, check security groups
+  class SecurityGroupsRetrievedState < OpenPortCheckerState
+    def enter
+      @context[:result][:port_checks] = []
+      ec2_helper = Ec2Helper.new(@context[:ec2_api_handler])
+      @context[:ec2_instances]['reservationSet']['item'].each() do |instance_info|
+        instance_id = ec2_helper.get_instance_id(instance_info)
+        @logger.debug("instance_info = #{instance_info.inspect}")
+        instance_ip = ec2_helper.get_instance_prop(instance_info, 'dnsName')
+        instance_state = ec2_helper.get_instance_prop(instance_info, 'instanceState')['name']
+        if instance_state != "running"
+          post_message("ignore instance #{instance_id} since not running")
+          next
+        end
+        sec_groups = ec2_helper.lookup_security_group_names(instance_info)
+        @logger.debug("group lookup for #{instance_id} => #{sec_groups.inspect}")
+        sec_groups.each() do |group_name|
+          port_infos = ec2_helper.lookup_open_ports(group_name, @context[:security_groups])
+          @logger.debug("port_infos for group #{group_name} #{port_infos.inspect}")
+          port_infos.each() do |port_info|
+            result = false
+            begin
+              result = @context[:remote_command_handler].is_port_open?(instance_ip, port_info[:port])
+              post_message("check port #{port_info[:port]} for instance #{instance_id} (on #{instance_ip}) #{result ? "successful" : "failed"}")
+            rescue Exception => e
+              @logger.warn("exception during executing port check: #{e}")
+            end
+            @context[:result][:port_checks] << {:instance => instance_id, :protocol => port_info[:protocol],
+              :port => port_info[:port], :success => result, :group_name => group_name
+            }
+          end
+        end
+      end
+      AnalysisDone.new(@context)
+    end
+  end
+
+  # Nothing done yet. Retrieve all security groups
+  class AnalysisDone < OpenPortCheckerState
+    def enter
+      Done.new(@context)
+    end
+  end
+
+  # Script done.
+  class Done < OpenPortCheckerState
+    def done?
+      true
+    end
+  end
+
+end