CloudyScripts 1.6.1 → 1.7.27

data/lib/audit/lib/benchmark/automatic_dependencies.rb

@@ -0,0 +1,13 @@
+# To change this template, choose Tools | Templates
+# and open the template in the editor.
+
+class AutomaticDependencies < Group
+  def initialize(childs)
+    super("AUTOMATIC_DEPENDENCIES", "automatic dependencies", "checks which are not contained in the benchmark, but neccessary to execute checks in the benchmark")
+    @children = childs
+  end
+
+  def in_report?()
+    false
+  end
+end

data/lib/audit/lib/benchmark/benchmark_factory.rb

@@ -0,0 +1,23 @@
+require 'benchmark/yaml_benchmark'
+
+class BenchmarkFactory
+	def initialize(options)
+		if options[:logger] then
+			@logger = options[:logger]
+		else
+			@logger = Logger.new(STDOUT)
+		end
+	end
+
+	def load(options)
+		raise "Need option :benchmark" unless options[:benchmark]
+		
+		if options[:benchmark] =~ /\.xml$/ then
+			return XccdfBenchmark.new({:benchmark => options[:benchmark], :logger => @logger})
+		elsif options[:benchmark] =~ /\.zip$/ then
+			return YamlBenchmark.new({:benchmark => options[:benchmark], :logger => @logger})
+		else
+			raise "Unknown benchmark type"
+		end
+	end
+end

data/lib/audit/lib/benchmark/benchmark_result.rb

@@ -0,0 +1,25 @@
+# To change this template, choose Tools | Templates
+# and open the template in the editor.
+
+class BenchmarkResult
+  attr_reader :audit
+  
+  def initialize(audit)
+    @audit = audit
+    @document = {}
+  end
+
+  def add(rule_result)
+    @document[rule_result.rule.id] = rule_result
+  end
+
+  def get(id)
+    return @benchmark if id == :root || id == 'BENCHMARK'
+    
+    return @document[id] || @benchmark.get_item(id)
+  end
+
+  def get_root()
+    return get(:root)
+  end
+end

data/lib/audit/lib/benchmark/check.rb

@@ -0,0 +1,34 @@
+require 'lazy'
+
+class Check
+	attr_reader :id 				# The ID by which this check is referenced from other elements
+	attr_reader :name 			# A human-readable name for this check
+	attr_reader :description 	# A short description of the goals of this check
+	attr_reader :script 			# The actual sh script that will be executed to gather values
+	attr_reader :dependencies 	# An array if ID string, which contain references to required Check (not Group!) 
+										# objects that must be executed before this check 
+	attr_reader :duration		# duration of this check in seconds; per default, one second is assumed
+	
+	def initialize(id, script, name = nil, dependencies = [], description = nil, duration = 1)
+		@id = id
+		@name = name
+		@dependencies = dependencies || []
+		@description = description
+		@script = script
+		@duration = (duration or 1)
+	end
+
+  def to_hash()
+    return {
+      :type => :CHECK,
+      :id => @id,
+      :name => @name,
+      :dependencies => Lazy.new(@dependencies, :map) {|check| check.id},
+      :description => @description
+    }
+  end
+
+  def in_report?()
+    return true
+  end
+end

data/lib/audit/lib/benchmark/group.rb

@@ -0,0 +1,30 @@
+require 'lazy'
+
+
+class Group
+	attr_reader :id # The unique ID by which this group is referenced from other elements
+	attr_reader :name # A human-readable name for this group
+	attr_reader :description # A descriptive string for this group
+	attr_accessor :children # Allowed children are Check and Group objects
+	
+	def initialize(id, name = nil, description = nil)
+		@id = id
+		@name = name
+		@description = description
+		@children = []
+	end
+
+  def to_hash()
+    return {
+      :type => :GROUP,
+      :id => @id,
+      :name => @name,
+      :description => @description,
+      :children => Lazy.new(Lazy.new(@children, :reject) {|x| !x.in_report?}, :map) {|child| Lazy.new(child, :to_hash)}
+    }
+  end
+
+  def in_report?()
+    true
+  end
+end

data/lib/audit/lib/benchmark/item_exception.rb

@@ -0,0 +1,13 @@
+class ItemException < Exception
+end
+
+class ItemNotFoundException < ItemException
+  attr_reader :missing_item
+  
+  def initialize(missing_item)
+    @missing_item = missing_item
+  end
+end
+
+class BadItemClassException < ItemException
+end

data/lib/audit/lib/benchmark/result_code.rb

@@ -0,0 +1,11 @@
+class ResultCode
+	PASS = "pass"
+	FAIL = "fail"
+	ERROR = "error"
+	UNKNOWN = "unknown"
+	NOTAPPLICABLE = "notapplicable"
+	NOTCHECKED = "notchecked"
+	NOTSELECTED = "notselected"
+	INFORMATIONAL = "informational"
+	FIXED = "fixed"
+end

data/lib/audit/lib/benchmark/rule_result.rb

@@ -0,0 +1,42 @@
+require 'benchmark/result_code'
+require 'lazy'
+
+class RuleResult
+  attr_reader :rule
+  attr_reader :check
+  attr_reader :rule_idref
+  attr_reader :result
+  attr_reader :version
+  attr_reader :timestamp
+  attr_reader :severity
+
+  def initialize(rule, results)
+    @timestamp = Time.now.utc
+#    @severity = rule.severity
+#    @version = rule.version
+
+    return_codes = results.reject {|x| x.type != ResultType::CHECK_FINISHED}
+    raise "Each rule should have exacty one return code" if return_codes.length != 1
+    return_code = return_codes[0]
+
+    if return_code.exit_code.downcase == "pass" then
+      @result = ResultCode::PASS
+    else
+      @result = ResultCode::FAIL
+    end
+
+    @rule_idref = rule.id
+    @rule = rule
+    @check = results
+  end
+
+  def to_hash()
+    return {
+      :type => :RULE_RESULT,
+      :timestamp => @timestamp,
+      :rule => @rule_idref,
+      :checks => Lazy.new(@check, :map) {|result| Lazy.new(result, :to_hash)},
+      :result => @result
+    }
+  end
+end

data/lib/audit/lib/benchmark/rule_role.rb

@@ -0,0 +1,5 @@
+class RuleRole
+	FULL = "full"
+	UNSCORED = "unscored"
+	UNCHECKED = "unchecked"
+end

data/lib/audit/lib/benchmark/rule_severity.rb

@@ -0,0 +1,13 @@
+class RuleSeverity
+	UNKNOWN = "unknown"
+	INFO = "info"
+	LOW = "low"
+	MEDIUM = "medium"
+	HIGH = "high"
+	
+	SEVERITIES = [UNKNOWN, INFO, LOW, MEDIUM, HIGH]
+	
+	def self.parse(str)
+		return ((SEVERITIES.include? str.downcase) ? str.downcase : UNKNOWN)
+	end
+end

data/lib/audit/lib/benchmark/yaml_benchmark.rb

@@ -0,0 +1,133 @@
+require 'yaml'
+require 'logger'
+require 'zip/zip'
+
+require 'benchmark/group'
+require 'benchmark/item_exception'
+require 'benchmark/check'
+require 'benchmark/audit_benchmark'
+require 'benchmark/automatic_dependencies'
+
+
+
+class YamlBenchmark < AuditBenchmark
+	CHECK_FILE_EXTENSION=".check"
+	GROUP_FILE_EXTENSION=".group"
+	GROUP_ID="ID"
+	GROUP_NAME="Name"
+	GROUP_DESCRIPTION="Description"
+	GROUP_CHILDREN="Children"
+	CHECK_ID="ID"
+	CHECK_SCRIPT="Script"
+	CHECK_NAME="Name"
+	CHECK_DEPENDENCIES="Depends"
+	CHECK_DESCRIPTION="Description"
+  CHECK_DURATION="Duration"
+	BENCHMARK_ID="BENCHMARK"
+	
+	attr_reader :id
+	attr_reader :name
+	attr_reader :description
+	attr_reader :children
+	
+	def initialize(options)
+		raise "Need option :benchmark" unless options[:benchmark]
+		
+		if options[:logger]
+			@logger = options[:logger]
+		else
+			@logger = Logger.new(STDOUT)
+		end
+		
+		if !File.exist?(options[:benchmark]) then
+			@logger.error("Specified benchmark file '#{options[:benchmark]}' does not exist") 
+			raise "Specified benchmark file '#{options[:benchmark]}' does not exist"
+		end
+		
+		@logger.info("Loading benchmark '#{options[:benchmark]}'")
+		
+		@item_repository = {}
+		@benchmark_file = options[:benchmark]
+		group_hashes = []
+		check_hashes = []
+		Zip::ZipFile.open(@benchmark_file, Zip::ZipFile::CREATE) do|zipfile|
+			zipfile.each do|file|
+				if file.name =~ /\.group$/ then
+					@logger.debug {"Loading group '#{file.name}'"}
+					
+					hash = YAML::load( file.get_input_stream )
+					raise "The group file '#{group_file}' does not contain the group's ID" unless hash[GROUP_ID]
+					raise "The group file '#{group_file}' does not contain any children" unless hash[GROUP_CHILDREN]	
+
+					@item_repository[hash[CHECK_ID]] = Group.new(hash[GROUP_ID], 
+				                                             hash[GROUP_NAME], 
+				                                             hash[GROUP_DESCRIPTION])
+					group_hashes << hash # keep group hash for later, because we still need to add children to the group
+				elsif file.name =~ /\.check$/ then
+					@logger.debug {"Loading check '#{file.name}'"}
+				
+					hash = YAML::load( file.get_input_stream )
+					raise "The check file '#{file.name}' does not contain the check's ID" unless hash[CHECK_ID]
+					raise "The check file '#{file.name}' does not contain a check script" unless hash[CHECK_SCRIPT]
+
+					@item_repository[hash[CHECK_ID]] = Check.new(hash[CHECK_ID], 
+				                                             hash[CHECK_SCRIPT], 
+				                                             hash[CHECK_NAME], 
+				                                             [], 
+				                                             hash[CHECK_DESCRIPTION],
+                                                     hash[CHECK_DURATION])
+					check_hashes << hash
+				else
+					@logger.info {"Ignoring unknown file '#{file.name}' in benchmark '#{@benchmark_file}'"}
+					# unknown file, ignore
+				end
+			end
+		end
+		
+		group_hashes.each do|group_hash|
+			group = @item_repository[group_hash[GROUP_ID]]
+			group_hash[GROUP_CHILDREN]. each do|child|
+				raise ItemNotFoundException.new(child), "Item '#{child}' from group '#{group.id}' not found" unless @item_repository[child]
+				item = @item_repository[child]
+				raise BadItemClassErooxception, "Item '#{child}' from group '#{group.id}' has wrong item class '#{item.class.name}'" unless item.class == Check || item.class == Group
+				
+				group.children << item
+			end
+		end
+		
+		# set dependencies
+		check_hashes.each do|check_hash|
+			check = @item_repository[check_hash[CHECK_ID]]
+			if check_hash[CHECK_DEPENDENCIES] then
+				check_hash[CHECK_DEPENDENCIES].each do|dep|
+					raise ItemNotFoundException.new(dep), "Item '#{dep}' which is depended on by check '#{check.id}' not found" unless @item_repository[dep]
+					check.dependencies << @item_repository[dep]
+				end
+			end
+		end
+		
+		benchmark = @item_repository[BENCHMARK_ID] or raise ItemNotFoundException.new("benchmark.group"), "Benchmark file benchmark.group not found in benchmark zipfile '#{benchmark_file}'"
+		raise BadItemClassException, "Benchmark has wrong item class #{benchmark.class.name}, expected is Group" unless benchmark.class == Group
+		@item_repository.delete(BENCHMARK_ID) #The benchmark group is not really an item, so remove it from the item set
+
+		@id = benchmark.id
+		@name = benchmark.name
+		@description = benchmark.description
+    @children = benchmark.children
+    auto_deps = AutomaticDependencies.new(automatic_dependencies())
+    @item_repository[auto_deps.id] = auto_deps
+		@children = [auto_deps] + benchmark.children
+
+	end
+	
+	#get a raw benchmark element by name. This is used by other classes like script generators
+	#to retrieve information from the benchmark that was stored there for them.
+	def element_impl(name)
+		return Zip::ZipFile.open(@benchmark_file, Zip::ZipFile::CREATE) {|zipfile| zipfile.read(name)}
+	end
+
+  def get_item(id)
+    raise ItemNotFoundException.new(id), "Item #{id} not found" if @item_repository[id].nil?
+    return @item_repository[id]
+  end
+end

data/lib/audit/lib/connection/ami_connection.rb

@@ -0,0 +1,4 @@
+require 'ssh_connection'
+
+class AmiConnection < SshConnection
+end

data/lib/audit/lib/connection/connection_factory.rb

@@ -0,0 +1,27 @@
+require 'connection/ssh_connection'
+
+
+class ConnectionFactory
+	def initialize(options)
+		if options[:logger] then
+			@logger = options[:logger]
+		else
+			@logger = Logger.new(STDOUT)
+		end
+	end
+	
+	def create(options)
+		raise "Need option :connection_type" unless options[:connection_type]
+		raise "Need option :connection_params" unless options[:connection_params] 
+
+		case options[:connection_type]
+			when :ssh
+				return SshConnection.new({:connection_params => options[:connection_params], :logger => @logger})
+			when :ami
+				return AmiConnection.new({:connection_params => options[:connection_params], :logger => @logger})
+			else
+				raise "Unknown connection type"
+		end
+	end
+end
+				

data/lib/audit/lib/connection/ssh_connection.rb

@@ -0,0 +1,243 @@
+require 'net/ssh'
+require 'net/scp'
+require 'net/sftp'
+require 'logger'
+
+class SshConnection
+	@@logger = Logger.new(STDOUT)
+	
+	def initialize(parameters)
+		raise "Need parameter :connection_params" unless parameters[:connection_params]
+		
+		if parameters[:logger] then
+			@@logger = parameters[:logger]
+		end
+
+		@parameters = parameters[:connection_params]
+		@parameters[:user] = 'root' unless @parameters[:user]
+		raise "No target host specified" unless @parameters[:host]
+	end
+
+	# open the ssh connection to the remote host
+	def open(&block)
+		if @ssh_session && !@ssh_session.closed? then
+			@@logger.warn("trying to open an already opened ssh connection")
+			raise "trying to open an already opened ssh connection"
+		end
+		
+		@@logger.info("opening ssh connection with parameters: " + @parameters.to_s)
+		
+		parameters = @parameters.clone()
+		host = @parameters[:host]
+		user = @parameters[:user]
+		
+		parameters.delete(:host)
+		parameters.delete(:user)
+		
+		if @parameters[:keys] then
+			@@logger.info("Starting SSH session with public key authentication")
+		elsif @parameters[:key_data] then
+			@@logger.info("Starting SSH session with public key authentication")
+		elsif @parameters[:password] then
+			@@logger.info("Starting SSH session with password authentication")
+		else
+			@@logger.error("No SSH authentication method found in parameters")
+			raise "No authentication method found"
+		end
+		
+		@ssh_session = Net::SSH.start(host, user, parameters)
+	
+		if block then
+			yield self
+			close
+		end
+	end
+	
+	def close
+		@ssh_session.close
+	end
+	
+	def <<(command)
+		exec(command)
+	end
+
+	# remote execute a command
+	def exec(command, stdin = nil)
+	  exit_status = 0 # define variable so that it will be available in the block at method scope
+	  @ssh_session.open_channel do |ch|
+	    @@logger.info("Executing command '#{command}'")
+	    ch.exec(command) do|ch, success|
+
+              if success then
+	        @@logger.debug("Command sucessfully executed")
+                ch.on_data() do|ch, data|
+                  #process_stdout(data) unless data
+                  @stdout_handler.call(data) unless @stdout_handler.nil? or data.nil?
+                end
+                ch.on_extended_data() do|ch, type, data|
+                  @stderr_handler.call(data) unless @stderr_handler.nil? or data.nil?
+                end
+                ch.on_request "exit-status" do|ch, data|
+                  exit_status = data.read_long unless data.nil?
+                end
+                ch.on_close do |ch|
+                  @close_handler.call() unless @close_handler.nil?
+                end
+                ch.on_eof do |ch|
+                  @close_handler.call() unless @close_handler.nil?
+                end
+
+                ch.send_data stdin if stdin
+              else
+	        @@logger.debug("")
+                exit_status = 127
+              end
+            end
+	    ch.wait
+	  end
+	
+	  return exit_status
+	end
+
+	#XXX: new remote execute a command
+	def exec_new(command, stdin = nil)
+	  exit_status = 0 # define variable so that it will be available in the block at method scope
+	  channel = @ssh_session.open_channel do |ch|
+	    ch.exec(command) do|ch, success|
+
+            if success then
+	        @@logger.info("SshConnection: starts executing '#{command}'")
+                ch.on_data() do|ch, data|
+                  #process_stdout(data) unless data
+                  @stdout_handler.call(data) unless @stdout_handler.nil? or data.nil?
+                end
+                ch.on_extended_data() do|ch, type, data|
+                  @stderr_handler.call(data) unless @stderr_handler.nil? or data.nil?
+                end
+                ch.on_request "exit-status" do|ch, data|
+                  exit_status = data.read_long unless data.nil?
+	          @@logger.info("SshConnection.on_request: process terminated with exit-status: #{exit_status}")
+	          if exit_status != 0
+	            @@logger.error("SshConnection.on_request: Remote command execution failed with code: #{exit_status}")
+	          end
+                end
+	        ch.on_request "exit-signal" do |ch, data|
+	          @@logger.info("SshConnection.on_request: process terminated with exit-signal: #{data.read_string}")
+	        end
+                ch.on_close do |ch|
+	          @@logger.info("SshConnection.on_close: remote end is closing!")
+                  #@close_handler.call() unless @close_handler.nil?
+                end
+                ch.on_eof do |ch|
+	          @@logger.info("SshConnection.on_eof: remote end is done sending data")
+                  #@close_handler.call() unless @close_handler.nil?
+                end
+	        ch.on_open_failed do |ch, code, desc|
+	          @@logger.info("SshConnection.on_open_failed: code=#{code} desc=#{desc}")
+	        end
+	        ch.on_process do |ch|
+	          #@@logger.debug("SshConnection.on_process; send line-feed/sleep")
+	          ch.send_data("\n")
+	        end
+
+                #ch.send_data stdin if stdin
+            else
+	        @@logger.debug("SshConnection: the remote command could not be invoked!")
+                exit_status = 127
+              end
+            end
+	    #ch.wait
+	  end
+	  channel.wait
+	  return exit_status
+	end
+
+	
+	#copy local file to remote path
+	def copy_to_remote(local_file, remote_path)
+		@ssh_session.scp.upload! local_file, remote_path
+	end
+	
+	#copy remote file to local path
+	def copy_from_remote(remote_file, local_path)
+		begin
+			@@logger.info { "Copying file from #{remote_file} to #{local_path}" }
+			@ssh_session.scp.download!(remote_file, local_path)
+			return true
+		rescue => err
+			@@logger.error { "SCP failed: #{err.message}" }
+			@@logger.error { "\t #{err.backtrace}" }
+		end
+	end
+
+  #write a string to a remote file
+  def write_to_remote_file(string, remote_path)
+    #filename = "/tmp/" + Random.srand().to_s() + ".sh"
+    filename = "/tmp/" + Kernel::srand().to_s() + ".sh"
+    File.open(filename, 'w') {|f| f.write(string)}
+    copy_to_remote(filename, remote_path)
+    File.delete(filename)
+  end
+	
+	#delete remote file
+	def delete_remote(remote_file)
+		exec("rm #{remote_file}")
+	end
+	
+	# copies remote file to local path and deletes remote file afterwards
+	def move_from_remote(remote_file, local_path)
+		copy_from_remote(remote_file, local_path)
+		delete_remote(remote_file)
+	end
+
+  # hook a handler who is called on text on stdout.
+	def on_stdout(&block)
+		@stdout_handler = block
+	end
+
+  # hook a handler who is called on text on stderr
+	def on_stderr(&block)
+		@stderr_handler = block
+	end
+
+  # hook a handler who is called on connection close
+	def on_close(&block)
+		@close_handler = block
+	end
+
+  #if the connection is closed
+	def closed?
+		return @ssh_session.nil? || @ssh_session.closed?
+	end
+
+  # return a string representation of the connection
+  def to_s()
+    return "ssh:#{@parameters[:user]}@#{@parameters[:host]}"
+  end
+
+  def to_hash()
+    return {
+      :type => :CONNECTION,
+      :subtype => :ssh,
+      :user => @parameters[:user],
+      :host => @parameters[:host]
+    }
+  end
+
+  #force the connection to close
+  def abort()
+    if @ssh_session && !@ssh_session.closed? then
+      #try to close connection gracefully
+      @ssh_session.close
+      # and if it won't, send out the hunter to bring in Snowwhite's heart after some time
+      Thread.new do
+        sleep 5
+        @ssh_session.shutdown! unless @ssh_session.nil? || @ssh_session.closed?
+      end
+    end
+  end
+	
+#	def SshConnection.finalize(id)
+#		
+#	end
+end