antfarm-core 0.5.0.beta1

data/lib/antfarm/plugins/cisco/parse-arp.rb

@@ -0,0 +1,90 @@
+################################################################################
+#                                                                              #
+# Copyright (2008-2010) Sandia Corporation. Under the terms of Contract        #
+# DE-AC04-94AL85000 with Sandia Corporation, the U.S. Government retains       #
+# certain rights in this software.                                             #
+#                                                                              #
+# Permission is hereby granted, free of charge, to any person obtaining a copy #
+# of this software and associated documentation files (the "Software"), to     #
+# deal in the Software without restriction, including without limitation the   #
+# rights to use, copy, modify, merge, publish, distribute, distribute with     #
+# modifications, sublicense, and/or sell copies of the Software, and to permit #
+# persons to whom the Software is furnished to do so, subject to the following #
+# conditions:                                                                  #
+#                                                                              #
+# The above copyright notice and this permission notice shall be included in   #
+# all copies or substantial portions of the Software.                          #
+#                                                                              #
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR   #
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,     #
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE  #
+# ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, #
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR #
+# IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE          #
+# SOFTWARE.                                                                    #
+#                                                                              #
+# Except as contained in this notice, the name(s) of the above copyright       #
+# holders shall not be used in advertising or otherwise to promote the sale,   #
+# use or other dealings in this Software without prior written authorization.  #
+#                                                                              #
+################################################################################
+
+module Antfarm
+  module Plugin
+    module Cisco
+      class FileDoesNotExistError < Antfarm::AntfarmError; end
+
+      class ParseArp
+        include Antfarm::Plugin
+
+        def initialize
+          super({ :name   => 'Parse ARP',
+                  :desc   => 'Parse an ARP dump from a Cisco network device',
+                  :author => 'Bryan T. Richardson <btricha>' },
+                [ { :name     => :input,
+                    :desc     => 'Dump file or directory',
+                    :type     => String,
+                    :required => true }
+                ])
+        end
+
+        def run(options)
+          input = options[:input]
+
+          if File.directory?(input)
+            Find.find(input) do |path|
+              if File.file?(path)
+                parse(path)
+              end
+            end
+          else
+            parse(input)
+          end
+        end
+
+        def parse(file)
+          print_message "Parsing file #{file}"
+
+          begin
+            File.open(file) do |list|
+              list.each do |line|
+                (junk, ip_addr, ethernet_addr) = line.split(' ')
+                ip_addr.strip!
+                ethernet_addr.strip!
+
+                Antfarm::Model::IpInterface.create(:address => ip_addr, :ethernet_address => ethernet_addr)
+              end
+            end
+
+          # TODO: merge by ethernet address
+
+          rescue Error::ENOENT
+            raise FileDoesNotExistError, "The file '#{file}' doesn't exist"
+          rescue Exception => e
+            raise Antfarm::AntfarmError, e.message
+          end
+        end
+      end
+    end
+  end
+end

data/lib/antfarm/plugins/cisco/parse-interfaces.rb

@@ -0,0 +1,126 @@
+################################################################################
+#                                                                              #
+# Copyright (2008-2010) Sandia Corporation. Under the terms of Contract        #
+# DE-AC04-94AL85000 with Sandia Corporation, the U.S. Government retains       #
+# certain rights in this software.                                             #
+#                                                                              #
+# Permission is hereby granted, free of charge, to any person obtaining a copy #
+# of this software and associated documentation files (the "Software"), to     #
+# deal in the Software without restriction, including without limitation the   #
+# rights to use, copy, modify, merge, publish, distribute, distribute with     #
+# modifications, sublicense, and/or sell copies of the Software, and to permit #
+# persons to whom the Software is furnished to do so, subject to the following #
+# conditions:                                                                  #
+#                                                                              #
+# The above copyright notice and this permission notice shall be included in   #
+# all copies or substantial portions of the Software.                          #
+#                                                                              #
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR   #
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,     #
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE  #
+# ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, #
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR #
+# IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE          #
+# SOFTWARE.                                                                    #
+#                                                                              #
+# Except as contained in this notice, the name(s) of the above copyright       #
+# holders shall not be used in advertising or otherwise to promote the sale,   #
+# use or other dealings in this Software without prior written authorization.  #
+#                                                                              #
+################################################################################
+
+module Antfarm
+  module Plugin
+    module Cisco
+      class FileDoesNotExistError < Antfarm::AntfarmError; end
+
+      class ParseInterfaces
+        include Antfarm::Plugin
+
+        def initialize
+          super({ :name   => 'Parse Interfaces',
+                  :desc   => 'Parse Cisco IOS configuration file, looking for IP interfaces',
+                  :author => 'Bryan T. Richardson <btricha>' },
+                [ { :name     => :input_file,
+                    :desc     => 'Cisco IOS config file',
+                    :type     => String,
+                    :required => true }
+                ])
+        end
+
+        def run(options)
+          print_message "Parsing file #{options[:input_file]}"
+
+          begin
+            pix_version_regexp   = Regexp.new('^PIX Version ((\d+)\.(\d+)\((\d+)\))')
+            hostname_regexp      = Regexp.new('^hostname (\S+)')
+            iface_regexp         = Regexp.new('^interface')
+            ipv4_regexp          = Regexp.new('((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})')
+            ip_addr_regexp       = Regexp.new('^ip address (\S+) %s %s' % [ipv4_regexp, ipv4_regexp])
+            iface_ip_addr_regexp = Regexp.new('^\s*ip address %s %s' % [ipv4_regexp, ipv4_regexp])
+
+            pix_version   = nil
+            hostname      = nil
+            iface_ips     = Array.new
+            capture_iface = false
+
+            File.open(options[:input_file]) do |file|
+              file.each do |line|
+                # Get PIX IOS version
+                unless pix_version
+                  if version = pix_version_regexp.match(line)
+                    pix_version = version[2].to_i
+                  end
+                end
+
+                # Get hostname
+                unless hostname
+                  if name = hostname_regexp.match(line)
+                    hostname = name[1]
+                  end
+                end
+                
+                # Get interface IP addresses
+                if pix_version == 6
+                  if ip_addr = ip_addr_regexp.match(line)
+                    iface_ips << "#{ip_addr[2]}/#{ip_addr[7]}"
+                  end
+                elsif capture_iface
+                  if line.strip! == "!"
+                    capture_iface = false
+                  else
+                    if ip_addr = iface_ip_addr_regexp.match(line)
+                      iface_ips << "#{ip_addr[1]}/#{ip_addr[6]}"
+                      capture_iface = false
+                    end
+                  end
+                else
+                  if iface = iface_regexp.match(line)
+                    capture_iface = true
+                  end
+                end
+              end
+            end
+
+            iface_ips.uniq!
+            iface_ips.each do |address|
+              ip_iface = Antfarm::Model::IpInterface.new :address => address
+              ip_iface.node_name = hostname if hostname
+              ip_iface.node_device_type = "Layer 3 Device"
+              
+              unless ip_iface.save
+                ip_iface.errors.each_full do |msg|
+                  print_error msg
+                end
+              end
+            end
+          rescue Errno::ENOENT
+            raise FileDoesNotExistError, "The file '#{options[:input_file]}' doesn't exist"
+          rescue Exception => e
+            raise Antfarm::AntfarmError, e.message
+          end
+        end
+      end
+    end
+  end
+end

data/lib/antfarm/plugins/cisco/parse-network-objects.rb

@@ -0,0 +1,105 @@
+################################################################################
+#                                                                              #
+# Copyright (2008-2010) Sandia Corporation. Under the terms of Contract        #
+# DE-AC04-94AL85000 with Sandia Corporation, the U.S. Government retains       #
+# certain rights in this software.                                             #
+#                                                                              #
+# Permission is hereby granted, free of charge, to any person obtaining a copy #
+# of this software and associated documentation files (the "Software"), to     #
+# deal in the Software without restriction, including without limitation the   #
+# rights to use, copy, modify, merge, publish, distribute, distribute with     #
+# modifications, sublicense, and/or sell copies of the Software, and to permit #
+# persons to whom the Software is furnished to do so, subject to the following #
+# conditions:                                                                  #
+#                                                                              #
+# The above copyright notice and this permission notice shall be included in   #
+# all copies or substantial portions of the Software.                          #
+#                                                                              #
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR   #
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,     #
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE  #
+# ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, #
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR #
+# IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE          #
+# SOFTWARE.                                                                    #
+#                                                                              #
+# Except as contained in this notice, the name(s) of the above copyright       #
+# holders shall not be used in advertising or otherwise to promote the sale,   #
+# use or other dealings in this Software without prior written authorization.  #
+#                                                                              #
+################################################################################
+
+module Antfarm
+  module Plugin
+    module Cisco
+      class FileDoesNotExistError < Antfarm::AntfarmError; end
+
+      class ParseNetworkObjects
+        include Antfarm::Plugin
+
+        def initialize
+          super({ :name   => 'Parse Network Objects',
+                  :desc   => 'Parses a Cisco IOS config file and creates an IP Interface for each network object',
+                  :author => 'Bryan T. Richardson <btricha>' },
+                [ { :name     => :input,
+                    :desc     => 'Cisco IOS config file or directory',
+                    :type     => String,
+                    :required => true }
+                ])
+        end
+
+        def run(options)
+          input = options[:input]
+
+          if File.directory?(input)
+            Find.find(input) do |path|
+              if File.file?(path)
+                parse(path)
+              end
+            end
+          else
+            parse(input)
+          end
+        end
+
+        def parse(file)
+          print_message "Parsing file #{file}"
+
+          begin
+            net_obj_host_regexp = Regexp.new('^\s*network-object host ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})')
+
+            net_obj_hosts = Array.new
+
+            File.open(file) do |list|
+              list.each do |line|
+                # Get network object hosts
+                if net_obj_host = net_obj_host_regexp.match(line)
+                  net_obj_hosts << net_obj_host[1]
+                end
+              end
+            end
+
+            net_obj_hosts.uniq!
+            net_obj_hosts.each do |address|
+              if Antfarm::Model::LayerThreeNetwork.network_containing(address)
+                ip_iface                  = Antfarm::Model::IpInterface.new :address => address
+                ip_iface.node_name        = address
+                ip_iface.node_device_type = "HOST"
+                
+                unless ip_iface.save
+                  ip_iface.errors.each_full do |msg|
+                    print_error msg
+                  end
+                end
+              end
+            end
+          rescue Errno::ENOENT
+            raise FileDoesNotExistError, "The file #{file} doesn't exist"
+          rescue Exception => e
+            raise Antfarm::AntfarmError, e.message
+          end
+        end
+      end
+    end
+  end
+end

data/lib/antfarm/plugins/cisco/parse-pix-config.rb

@@ -0,0 +1,243 @@
+################################################################################
+#                                                                              #
+# Copyright (2008-2010) Sandia Corporation. Under the terms of Contract        #
+# DE-AC04-94AL85000 with Sandia Corporation, the U.S. Government retains       #
+# certain rights in this software.                                             #
+#                                                                              #
+# Permission is hereby granted, free of charge, to any person obtaining a copy #
+# of this software and associated documentation files (the "Software"), to     #
+# deal in the Software without restriction, including without limitation the   #
+# rights to use, copy, modify, merge, publish, distribute, distribute with     #
+# modifications, sublicense, and/or sell copies of the Software, and to permit #
+# persons to whom the Software is furnished to do so, subject to the following #
+# conditions:                                                                  #
+#                                                                              #
+# The above copyright notice and this permission notice shall be included in   #
+# all copies or substantial portions of the Software.                          #
+#                                                                              #
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR   #
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,     #
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE  #
+# ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, #
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR #
+# IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE          #
+# SOFTWARE.                                                                    #
+#                                                                              #
+# Except as contained in this notice, the name(s) of the above copyright       #
+# holders shall not be used in advertising or otherwise to promote the sale,   #
+# use or other dealings in this Software without prior written authorization.  #
+#                                                                              #
+################################################################################
+
+module Antfarm
+  module Plugin
+    module Cisco
+      class FileDoesNotExistError < Antfarm::AntfarmError; end
+
+      class ParsePixConfig
+        include Antfarm::Plugin
+
+        def initialize
+          super({ :name   => 'Parse PIX Firewall Config',
+                  :desc   => 'Parses a Cisco PIX IOS config file',
+                  :author => 'Bryan T. Richardson <btricha>' },
+                [ { :name     => :input,
+                    :desc     => 'Cisco PIX IOS config file or directory',
+                    :type     => String,
+                    :required => true },
+                  { :name     => :tunnels,
+                    :desc     => 'Only parse IPSec Tunnels',
+                    :required => false }
+                ])
+        end
+
+        def run(options)
+          input   = options[:input]
+          tunnels = options[:tunnels]
+
+          if File.directory?(input)
+            Find.find(input) do |path|
+              if File.file?(path)
+                if tunnels
+                  parse_tunnels(path)
+                else
+                  parse(path)
+                end
+              end
+            end
+          else
+            if tunnels
+              parse_tunnels(input)
+            else
+              parse(input)
+            end
+          end
+        end
+
+        def parse(file)
+          print_message "Parsing file #{file}"
+
+          begin
+            hostname_regexp     = %r{^hostname (\S+)}
+            ip_addr_regexp      = %r{^\s*ip address[\s\S]* ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3}) ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            obj_grp_net_regexp  = %r{^\s*object-group network (\S+)}
+            net_obj_regexp      = %r{^\s*network-object ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3}) ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            net_obj_host_regexp = %r{^\s*network-object host ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            grp_obj_regexp      = %r{^\s*group-object}
+
+            # TODO: how to fill this array from command-line?
+            obj_grp_nets_to_skip = Array.new
+
+            hostname         = nil
+            fw_if_ips        = Array.new
+            net_obj_ips      = Array.new
+            net_obj_networks = Array.new
+
+            capture_host = false
+
+            File.open(file) do |list|
+              list.each do |line|
+                # Get hostname for PIX
+                if name = hostname_regexp.match(line)
+                  hostname = name[1]
+                end
+
+                # Get IP addresses and netmasks for PIX interfaces
+                if ip_addr = ip_addr_regexp.match(line)
+                  addr = ip_addr[1] + "/" + ip_addr[6]
+                  fw_if_ips << addr
+                end
+              end
+            end
+
+            fw_if_ips.uniq!
+            fw_if_ips.each do |address|
+              ip_if = Antfarm::Model::IpInterface.new :address => address
+              ip_if.node_name = hostname
+              ip_if.node_device_type = 'FW'
+              unless ip_if.save
+                ip_if.errors.each_full do |msg|
+                  print_error msg
+                end
+              end
+            end
+
+            net_obj_ips.uniq!
+            net_obj_ips.each do |address|
+              ip_if = Antfarm::Model::IpInterface.new :address => address
+              ip_if.node_device_type = 'FW NW OBJECT'
+              unless ip_if.save
+                ip_if.errors.each_full do |msg|
+                  print_error msg
+                end
+              end
+            end
+
+            net_obj_networks.uniq!
+            net_obj_networks.each do |network|
+              ip_net = Antfarm::Model::IpNetwork.new :address => network
+              unless ip_net.save
+                ip_net.errors.each_full do |msg|
+                  print_error msg
+                end
+              end
+            end
+          rescue Errno::ENOENT
+            raise FileDoesNotExistError, "The file #{file} doesn't exist"
+          rescue Exception => e
+            raise Antfarm::AntfarmError, e.message
+          end
+        end
+
+        def parse_tunnels(file)
+          print_message "Parsing file #{file}"
+
+          begin
+            version_regexp    = %r{^PIX Version ((\d+).(\d+)\((\d+)\))}
+            nameif_ip_regexp  = %r{^ip address (\S+) ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            interface_regexp  = %r{^interface}
+            nameif_regexp     = %r{^\s*nameif (\S+)}
+            ipaddr_regexp     = %r{^\s*ip address ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            crmap_addr_regexp = %r{^crypto map (\S+) [\s\S]* ((\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3})}
+            crmap_if_regexp   = %r{^crypto map (\S+) interface (\S+)}
+            ip_addr_list      = Array.new
+
+            v6        = false
+            v7        = false
+            cap_if    = false
+            cap_crmap = false
+
+            if_map  = Hash.new
+            if_name = nil
+
+            cr_addr_map = Hash.new
+            cr_if_map   = Hash.new
+
+            File.open(file) do |list|
+              list.each do |line|
+                if v6 == false && v7 == false
+                  if version = version_regexp.match(line)
+                    if version[2].to_i ==  6
+                      v6 = true
+                    elsif version[2].to_i ==  7
+                      v7 = true
+                    end
+                  end
+                elsif v6 == true
+                  if nameif_ip = nameif_ip_regexp.match(line)
+                    if_map[nameif_ip[1]] = nameif_ip[2]
+                  end
+                elsif v7 == true
+                  if cap_if == false
+                    if interface = interface_regexp.match(line)
+                      cap_if = true
+                    end
+                  else
+                    if nameif = nameif_regexp.match(line)
+                      cap_nameif = true
+                      if_name = nameif[1]
+                    elsif ipaddr = ipaddr_regexp.match(line)
+                      if_map[if_name] = ipaddr[1]
+                      cap_if = false
+                    end
+                  end
+                end
+
+                if crmap_addr = crmap_addr_regexp.match(line)
+                  unless cr_addr_map[crmap_addr[1]]
+                    cr_addr_map[crmap_addr[1]] = Array.new
+                  end
+
+                  cr_addr_map[crmap_addr[1]].push(crmap_addr[2])
+                elsif crmap_if = crmap_if_regexp.match(line)
+                  cr_if_map[crmap_if[1]] = crmap_if[2]
+                end
+              end
+            end
+
+            cr_if_map.each do |key,value|
+              ip_addr_list = cr_addr_map[key]
+              ip_addr      = if_map[value]
+
+              source_ip_if = Antfarm::Model::IpInterface.find_by_address(ip_addr)
+
+              if source_ip_if
+                ip_addr_list.each do |addr|
+                  target_ip_if = Antfarm::Model::IpInterface.find_by_address(addr)
+
+                  if target_ip_if
+  #                 Traffic.create(:source_layer3_interface => source_ip_if.layer3_interface, :target_layer3_interface => target_ip_if.layer3_interface, :description => 'TUNNEL')
+                  end
+                end
+              end
+            end
+          rescue Errno::ENOENT
+            raise FileDoesNotExistError, "The file #{file} doesn't exist"
+          rescue Exception => e
+            raise Antfarm::AntfarmError, e.message
+          end
+        end
+      end
+    end
+  end
+end