antfarm 0.3.0 → 0.4.0

data/lib/scripts/viz/display-traffic.rb

@@ -0,0 +1,111 @@
+#!/usr/bin/env ruby
+
+# Copyright (2008) Sandia Corporation.
+# Under the terms of Contract DE-AC04-94AL85000 with Sandia Corporation,
+# the U.S. Government retains certain rights in this software.
+#
+# Original Author: Michael Berg, Sandia National Laboratories <mjberg@sandia.gov>
+# Modified By: Bryan T. Richardson, Sandia National Laboratories <btricha@sandia.gov>
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or (at
+# your option) any later version.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, write to the Free Software Foundation, Inc.,
+# 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
+
+def print_help
+  puts "Usage: antfarm [options] viz [options] display-traffic"
+  puts
+  puts "This script utilizes the provided Prefuse-based Java application"
+  puts "to display traffic contained in the current database."
+  puts
+  puts "Script Options:"
+  puts "  --collapse-ports    Only include one node for each port number"
+  puts "                      discovered."
+end
+
+def display(options = [])
+  output = File.open("#{Antfarm.tmp_dir_to_use}/traffic.gml", "w")
+  output.puts "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+  output.puts "<graphml xmlns=\"http://graphml.graphdrawing.org/xmlns\">"
+  output.puts "  <graph edgedefault=\"undirected\">"
+  output.puts "    <key id=\"name\" for=\"node\" attr.name=\"name\" attr.type=\"string\" />"
+  output.puts "    <key id=\"type\" for=\"node\" attr.name=\"type\" attr.type=\"string\" />"
+  output.puts "    <key id=\"line\" for=\"edge\" attr.name=\"line\" attr.type=\"string\" />"
+  nodes = Array.new
+  ports = Array.new
+  Traffic.find(:all).each do |traffic|
+    source_node = traffic.source_layer3_interface.layer2_interface.node
+    target_node = traffic.target_layer3_interface.layer2_interface.node
+    port = traffic.port
+    unless nodes.include?(source_node)
+      output.puts "    <node id=\"node_#{source_node.id}\">"
+      output.puts "      <data key=\"name\">#{source_node.name.nil? ? source_node.device_type : source_node.name}</data>"
+      output.puts "      <data key=\"type\">#{source_node.device_type}</data>"
+      output.puts "    </node>"
+      nodes << source_node
+    end
+    unless nodes.include?(target_node)
+      output.puts "    <node id=\"node_#{target_node.id}\">"
+      output.puts "      <data key=\"name\">#{target_node.name.nil? ? target_node.device_type : target_node.name}</data>"
+      output.puts "      <data key=\"type\">#{target_node.device_type}</data>"
+      output.puts "    </node>"
+      nodes << target_node
+    end
+    if port.zero?
+      output.puts "    <edge source=\"node_#{source_node.id}\" target=\"node_#{target_node.id}\">"
+      output.puts "      <data key=\"line\">#{traffic.description}-PORTLESS</data>"
+      output.puts "    </edge>"
+    else
+      if options.include?('--collapse-ports')
+        unless ports.include?(port)
+          output.puts "    <node id=\"port_#{port}\">"
+          output.puts "      <data key=\"name\">#{port}</data>"
+          output.puts "      <data key=\"type\">PORT</data>"
+          output.puts "    </node>"
+          ports << port
+        end
+        output.puts "    <edge source=\"node_#{source_node.id}\" target=\"port_#{port}\">"
+        output.puts "      <data key=\"line\">#{traffic.description}</data>"
+        output.puts "    </edge>"
+        output.puts "    <edge source=\"port_#{port}\" target=\"node_#{target_node.id}\">"
+        output.puts "      <data key=\"line\">#{traffic.description}</data>"
+        output.puts "    </edge>"
+      else
+        output.puts "    <node id=\"port_#{source_node.id}_#{target_node.id}_#{port}\">"
+        output.puts "      <data key=\"name\">#{port}</data>"
+        output.puts "      <data key=\"type\">PORT</data>"
+        output.puts "    </node>"
+        output.puts "    <edge source=\"node_#{source_node.id}\" target=\"port_#{source_node.id}_#{target_node.id}_#{port}\">"
+        output.puts "      <data key=\"line\">#{traffic.description}</data>"
+        output.puts "    </edge>"
+        output.puts "    <edge source=\"port_#{source_node.id}_#{target_node.id}_#{port}\" target=\"node_#{target_node.id}\">"
+        output.puts "      <data key=\"line\">#{traffic.description}</data>"
+        output.puts "    </edge>"
+      end
+    end
+  end
+  output.puts "  </graph>"
+  output.puts "</graphml>"
+  output.close
+
+  if (defined? USER_DIR) && File.exists?("#{USER_DIR}/config/colors.xml")
+    `java -jar #{ANTFARM_ROOT}/lib/antfarm.jar -tree -colors #{USER_DIR}/config/colors.xml #{Antfarm.tmp_dir_to_use}/traffic.gml`
+  else
+    `java -jar #{ANTFARM_ROOT}/lib/antfarm.jar -tree #{Antfarm.tmp_dir_to_use}/traffic.gml`
+  end
+end
+
+if ['-h', '--help'].include?(ARGV[0])
+  print_help
+else
+  display(ARGV)
+end

data/lib/scripts/viz/dump-graphml.rb

@@ -201,7 +201,7 @@ def dump(file)
     end
 
     output.puts "    <edge source=\"node_#{source_node.id}\" target=\"node_#{target_node.id}\">"
-    output.puts "      <data key=\"line\">PCAP</data>"
+    output.puts "      <data key=\"line\">#{traffic.description}</data>"
     output.puts "    </edge>"
   end
 

data/lib/version.rb

@@ -0,0 +1,5 @@
+MAJOR    = 0
+MINOR    = 4
+REVISION = 0
+
+puts "ANTFARM Version #{MAJOR}.#{MINOR}.#{REVISION}"

data/rails/app/controllers/actions_controller.rb

@@ -0,0 +1,5 @@
+class ActionsController < ApplicationController
+  active_scaffold :action do |config|
+    config.list.columns = [:tool, :description, :start, :end]
+  end
+end

data/rails/app/controllers/dns_entries_controller.rb

@@ -0,0 +1,4 @@
+class DnsEntriesController < ApplicationController
+  active_scaffold :dns_entry do |config|
+  end
+end

data/rails/app/controllers/layer3_interfaces_controller.rb

@@ -1,6 +1,6 @@
 class Layer3InterfacesController < ApplicationController
   active_scaffold :layer3_interface do |config|
-    config.columns << :node
-    config.list.columns << :node
+#   config.columns << :node
+#   config.list.columns << :node
   end
 end

data/rails/app/controllers/nodes_controller.rb

@@ -1,9 +1,9 @@
 class NodesController < ApplicationController
   active_scaffold :node do |config|
     config.columns[:certainty_factor].label = 'Certainty Factor'
-    config.create.columns = [:name, :type, :certainty_factor, :layer2_interfaces]
-    config.list.columns = [:name, :type, :layer2_interfaces]
-    config.show.columns = [:name, :type, :certainty_factor, :layer2_interfaces]
-    config.update.columns = [:name, :type, :certainty_factor, :layer2_interfaces]
+    config.create.columns = [:name, :device_type, :certainty_factor, :layer2_interfaces]
+    config.list.columns = [:name, :device_type, :layer2_interfaces, :services, :operating_system]
+    config.show.columns = [:name, :device_type, :certainty_factor, :layer2_interfaces]
+    config.update.columns = [:name, :device_type, :certainty_factor, :layer2_interfaces]
   end
 end

data/rails/app/controllers/operating_systems_controller.rb

@@ -0,0 +1,5 @@
+class OperatingSystemsController < ApplicationController
+  active_scaffold :operating_system do |config|
+    config.list.columns = [:fingerprint, :certainty_factor, :node, :action]
+  end
+end

data/rails/app/controllers/services_controller.rb

@@ -0,0 +1,5 @@
+class ServicesController < ApplicationController
+  active_scaffold :service do |config|
+    config.list.columns = [:name, :protocol, :port, :certainty_factor, :node, :action]
+  end
+end

data/rails/app/controllers/traffic_controller.rb

@@ -1,4 +1,5 @@
 class TrafficController < ApplicationController
   active_scaffold :traffic do |config|
+    config.label = 'Traffic'
   end
 end

data/rails/app/views/layouts/application.html.erb

@@ -0,0 +1,35 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+       "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+  <head>
+    <meta http-equiv="content-type" content="text/html;charset=UTF-8" />
+    <title>ANTFARM :: Database Management</title>
+    <%= stylesheet_link_tag 'site' %>
+    <%= javascript_include_tag :defaults %>
+    <%= active_scaffold_includes %>
+  </head>
+  <body>
+    <center><h1>ANTFARM Database Management</h1></center>
+    <%= yield  %>
+    <center>
+      <div id='management-nav'>
+        <%= link_to 'Nodes', '/nodes' %> | 
+        <%= link_to 'Layer 2 Interfaces', '/layer2_interfaces' %> | 
+        <%= link_to 'Ethernet Interfaces', '/ethernet_interfaces' %> | 
+        <%= link_to 'Layer 3 Interfaces', '/layer3_interfaces' %> | 
+        <%= link_to 'IP Interfaces', '/ip_interfaces' %>
+        <br />
+        <%= link_to 'Layer 3 Networks', '/layer3_networks' %> | 
+        <%= link_to 'IP Networks', '/ip_networks' %> | 
+        <%= link_to 'Private Networks', '/private_networks' %> | 
+        <%= link_to 'Traffic', '/traffic' %>
+        <br />
+        <%= link_to 'DNS Entries', '/dns_entries' %> | 
+        <%= link_to 'Actions', '/actions' %> | 
+        <%= link_to 'Services', '/services' %> | 
+        <%= link_to 'Operating Systems', '/operating_systems' %>
+      </div>
+    </center>
+  </body>
+</html>

data/rails/public/stylesheets/site.css

@@ -0,0 +1,11 @@
+div#management-nav a {
+  color:#665;
+  font-weight:bold;
+  text-decoration:none;
+  font-size:small;
+}
+
+div#management-nav a:hover {
+  color:#665;
+  background-color:#fff;
+}

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification 
 name: antfarm
 version: !ruby/object:Gem::Version 
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors: 
-- Michael Berg & Bryan Richardson
+- Michael Berg and Bryan Richardson
 autorequire: 
 bindir: bin
 cert_chain: []
 
-date: 2008-08-15 00:00:00 -06:00
+date: 2008-10-02 00:00:00 -06:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -33,66 +33,72 @@ dependencies:
         version: 1.2.2
     version: 
 description: 
-email: btricha@sandia.gov & mjberg@sandia.gov
+email: btricha@sandia.gov and mjberg@sandia.gov
 executables: 
 - antfarm
 extensions: []
 
 extra_rdoc_files: 
-- README
+- README.rdoc
 files: 
 - bin/antfarm
 - config/environment.rb
 - config/boot.rb
 - db/schema.rb
 - db/migrate
+- db/migrate/012_create_services.rb
 - db/migrate/002_create_layer2_interfaces.rb
 - db/migrate/007_create_ip_networks.rb
+- db/migrate/013_create_operating_systems.rb
 - db/migrate/005_create_ethernet_interfaces.rb
 - db/migrate/004_create_layer3_networks.rb
 - db/migrate/009_create_traffic.rb
 - db/migrate/003_create_layer3_interfaces.rb
+- db/migrate/011_create_actions.rb
 - db/migrate/006_create_ip_interfaces.rb
 - db/migrate/008_create_private_networks.rb
+- db/migrate/010_create_dns_entries.rb
 - db/migrate/001_create_nodes.rb
 - lib/antfarm.rb
+- lib/cpscript.rb
+- lib/console.rb
 - lib/antfarm
 - lib/antfarm/private_network.rb
+- lib/antfarm/operating_system.rb
 - lib/antfarm/ethernet_interface.rb
+- lib/antfarm/dns_entry.rb
 - lib/antfarm/layer2_interface.rb
+- lib/antfarm/service.rb
 - lib/antfarm/ip_network.rb
 - lib/antfarm/layer3_interface.rb
 - lib/antfarm/layer3_network.rb
 - lib/antfarm/node.rb
 - lib/antfarm/ip_interface.rb
 - lib/antfarm/traffic.rb
+- lib/antfarm/action.rb
+- lib/version.rb
 - lib/init
 - lib/init/initializer.rb
 - lib/scparse.rb
 - lib/dbmanage.rb
 - lib/scripts
 - lib/scripts/load-network.rb
-- lib/scripts/load-router.rb
-- lib/scripts/load-route.rb
-- lib/scripts/route.rb
 - lib/scripts/load-host.rb
 - lib/scripts/pcap
 - lib/scripts/pcap/parse-pcap-file.rb
 - lib/scripts/nmap
-- lib/scripts/nmap/parse-xml-results.rb
+- lib/scripts/nmap/parse-xml.rb
 - lib/scripts/cisco
 - lib/scripts/cisco/parse-routes.rb
 - lib/scripts/cisco/parse-pix-config.rb
 - lib/scripts/cisco/parse-ip-ifaces.rb
 - lib/scripts/cisco/parse-network-objects.rb
 - lib/scripts/cisco/parse-arp.rb
-- lib/scripts/tethereal
-- lib/scripts/tethereal/load-ip.rb
-- lib/scripts/tethereal/load-arp.rb
-- lib/scripts/load-router-nomac.rb
+- lib/scripts/manipulate-dns.rb
 - lib/scripts/viz
 - lib/scripts/viz/display-networks.rb
 - lib/scripts/viz/dump-graphviz.rb
+- lib/scripts/viz/display-traffic.rb
 - lib/scripts/viz/dump-graphml.rb
 - lib/antfarm.jar
 - log/antfarm.log
@@ -130,6 +136,7 @@ files:
 - rails/public/422.html
 - rails/public/dispatch.cgi
 - rails/public/stylesheets
+- rails/public/stylesheets/site.css
 - rails/public/stylesheets/active_scaffold
 - rails/public/stylesheets/active_scaffold/default
 - rails/public/stylesheets/active_scaffold/default/stylesheet-ie.css
@@ -137,42 +144,26 @@ files:
 - rails/public/stylesheets/active_scaffold/DO_NOT_EDIT
 - rails/public/blank.html
 - rails/public/robots.txt
-- rails/public/000-index.html
 - rails/public/500.html
 - rails/app
-- rails/app/helpers
-- rails/app/helpers/application_helper.rb
-- rails/app/helpers/ethernet_interfaces_helper.rb
-- rails/app/helpers/ip_interfaces_helper.rb
-- rails/app/helpers/layer2_interfaces_helper.rb
-- rails/app/helpers/nodes_helper.rb
-- rails/app/helpers/layer3_interfaces_helper.rb
-- rails/app/helpers/ip_networks_helper.rb
-- rails/app/helpers/traffic_helper.rb
-- rails/app/helpers/private_networks_helper.rb
-- rails/app/helpers/layer3_networks_helper.rb
 - rails/app/controllers
 - rails/app/controllers/ip_interfaces_controller.rb
+- rails/app/controllers/operating_systems_controller.rb
 - rails/app/controllers/application.rb
 - rails/app/controllers/nodes_controller.rb
 - rails/app/controllers/ip_networks_controller.rb
+- rails/app/controllers/dns_entries_controller.rb
+- rails/app/controllers/services_controller.rb
 - rails/app/controllers/layer3_interfaces_controller.rb
 - rails/app/controllers/layer2_interfaces_controller.rb
+- rails/app/controllers/actions_controller.rb
 - rails/app/controllers/traffic_controller.rb
 - rails/app/controllers/private_networks_controller.rb
 - rails/app/controllers/layer3_networks_controller.rb
 - rails/app/controllers/ethernet_interfaces_controller.rb
 - rails/app/views
 - rails/app/views/layouts
-- rails/app/views/layouts/layer3_interfaces.html.erb
-- rails/app/views/layouts/layer2_interfaces.html.erb
-- rails/app/views/layouts/nodes.html.erb
-- rails/app/views/layouts/layer3_networks.html.erb
-- rails/app/views/layouts/ip_networks.html.erb
-- rails/app/views/layouts/ethernet_interfaces.html.erb
-- rails/app/views/layouts/traffic.html.erb
-- rails/app/views/layouts/private_networks.html.erb
-- rails/app/views/layouts/ip_interfaces.html.erb
+- rails/app/views/layouts/application.html.erb
 - rails/vendor
 - rails/vendor/rails
 - rails/vendor/rails/railties
@@ -2091,7 +2082,7 @@ files:
 - tmp/useless.txt
 - CHANGELOG
 - LICENSE
-- README
+- README.rdoc
 has_rdoc: true
 homepage: http://antfarm.rubyforge.org
 post_install_message: 

data/lib/scripts/load-route.rb

@@ -1,79 +0,0 @@
-#!/usr/bin/ruby
-
-# Copyright (2008) Sandia Corporation.
-# Under the terms of Contract DE-AC04-94AL85000 with Sandia Corporation,
-# the U.S. Government retains certain rights in this software.
-#
-# Original Author: Michael Berg, Sandia National Laboratories <mjberg@sandia.gov>
-# Modified By: Bryan T. Richardson, Sandia National Laboratories <btricha@sandia.gov>
-#
-# This library is free software; you can redistribute it and/or modify it
-# under the terms of the GNU Lesser General Public License as published by
-# the Free Software Foundation; either version 2.1 of the License, or (at
-# your option) any later version.
-#
-# This library is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
-# details.
-#
-# You should have received a copy of the GNU Lesser General Public License
-# along with this library; if not, write to the Free Software Foundation, Inc.,
-# 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
-
-def insert(addr_path)
-  path = Array.new
-  node_path = Array.new
-
-  # Insert the nodes
-  for addr in addr_path
-    if addr
-      iface = Hash.new
-      # Insert IP address
-      ip_if = IpInterface.create(:address => addr)
-      # Store the needed information for the next step
-      iface['ip_interface'] = ip_if
-      iface['ip_network'] = ip_if.layer3_interface.layer3_network.ip_network
-      iface['node'] = ip_if.layer3_interface.layer2_interface.node
-      path.push(iface)
-      node_path.push(ip_if.layer3_interface.layer2_interface.node)
-    end
-  end
-
-  # Insert the edges
-  for i in 0..(path.size - 2)
-    u = path[i]
-    v = path[i + 1]
-    if u and v
-      # Get nodes connected to the IP network
-      connected_nodes = Array.new
-      v['ip_network'].layer3_network.layer3_interfaces.each do |l3_if|
-        connected_nodes << l3_if.layer2_interface.node
-      end
-      unless connected_nodes.include?(u['node'])
-        # Create a new Layer2_Interface for the Node
-        layer2_if_id = @layer2_if_table.insert(CF_LACK_OF_PROOF, nil,
-                                               u['node_id'])
-        # Connect a new "unknown" Layer3_Interface that
-        # is connected to the specified layer3_net_id
-        @layer3_if_table.insert(CF_LACK_OF_PROOF, "IP",
-                                v['ip_network_id'], layer2_if_id)
-
-      end
-    end
-  end
-
-  return node_id_path
-end
-
-def parse
-  path = ['146.146.161.250', '146.146.150.6']
-  insert(path)
-
-  path = ['146.146.161.250', '146.146.151.224']
-  insert(path)
-
-  path = ['146.146.161.253', '146.146.252.185', '146.146.111.253',
-          '146.146.249.202', '209.64.200.65', '146.146.4.11']
-  insert(path)
-end