Class: Mu::Command::Cmd_runanalysis

Inherits:
Mu::Command show all
Defined in:
lib/mu/command/cmd_runanalysis.rb

Constant Summary

Constants inherited from Mu::Command

Api

Constants included from Helper

Helper::ESCAPES

Instance Attribute Summary collapse

Attributes inherited from Mu::Command

#options, #opts

Instance Method Summary collapse

Methods inherited from Mu::Command

#initialize

Methods included from Helper

#ask, #bin2hex, #error, #escape, #format_float, #get_file_as_string_array, #make_xml, #msg, #shift, #to_boolean

Constructor Details

This class inherits a constructor from Mu::Command

Instance Attribute Details

#api ⇒ Object

Returns the value of attribute api.



8
9
10
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 8

def api
  @api
end

#docroot ⇒ Object

Returns the value of attribute docroot.



8
9
10
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 8

def docroot
  @docroot
end

#host ⇒ Object

Returns the value of attribute host.



8
9
10
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 8

def host
  @host
end

#password ⇒ Object

Returns the value of attribute password.



8
9
10
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 8

def password
  @password
end

#username ⇒ Object

Returns the value of attribute username.



8
9
10
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 8

def username
  @username
end

Instance Method Details

#cmd_help(argv) ⇒ Object

displays command-line help

* argv = command-line arguments



12
13
14
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 12

def cmd_help argv
  help
end

#cmd_run(argv) ⇒ Object

capture has a set of three commands that are used to generate packet captures, poll the status and return the resulting file ex:

* argv = command-line arguments, requires a command (-c) argument
* command=run returns the job_id
* command=status (called after 'run'), requires the job_id (-u) argument
* command=get (called when status returns "Finished"), requires the job_id (-u) argument
* port = the Mu interface on which to capture packets



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 30

def cmd_run argv
   setup argv
   # set all params
   archive = @hash['archive']
   if archive == nil
   	archive = false
   end
   archive_options = @hash['archive_options']
   directory = @hash['directory']
   force = @hash['force']
   interval = @hash['interval']
   output = @hash['output']
   prepend = @hash['prepend']
   template = @hash['template']
   uuid = @hash['uuid']
   verify = @hash['verify']
   if verify == nil
   	verify = false
   end
   verifyonly = @hash['verifyonly']
   if verifyonly == nil
   	verifyonly = false
   end
   
   # set any timers to minimum non psychotic numbers
   sleeptime = 10 # 10 sec
   if force != nil
   	force = Integer(force)
   	if force < 1
   		force = 1
   	end
   else 
  	force = 0
   end
   if interval != nil
   	interval = Integer(interval)
   	if interval < 5
   		interval = 5
   	end
   	if interval < sleeptime
   		sleeptime = interval
   	end
   else 
   	interval = 0
   end
   
   # my_uuid_hash is a hash that will contain the name, and uuid of the test to run my_name => my_uuid
   my_uuid_hash = {}
   
   # determine proper execution path: uuid, template, or directory
   if directory != nil
   	# load all xml files in directory and add uuids to execution list
   	files = Dir.glob(File.join(@hash["directory"],"","*.xml"))
   	files.each do | file |
   		response = @api.import_templates(file)
   		log response, Logger::DEBUG
   		doc = make_xml(response)
  		unless doc.xpath("//model_object").empty?
  			doc.xpath("//model_object").each do |node|
  				my_uuid = node.xpath("uuid").text
  				my_name = node.xpath("name").text
  				my_type = node.xpath("type").text
  				if my_type=="Analysis"
  					log "type = #{my_type} uuid = #{my_uuid} name = #{my_name}", Logger::DEBUG
  					my_uuid_hash[my_uuid] = my_name
  				end
		end
    		end
   	end
   end
   if template != nil
   	# import template file into mu and add all uuids to list
   	response = @api.import_templates(template)
   	log response, Logger::DEBUG
   	doc = make_xml(response)
  	unless doc.xpath("//model_object").empty?
  		doc.xpath("//model_object").each do |node|
  			my_uuid = node.xpath("uuid").text
  			my_name = node.xpath("name").text
  			my_type = node.xpath("type").text
  			if my_type=="Analysis"
  				log "type = #{my_type} uuid = #{my_uuid} name = #{my_name}", Logger::DEBUG
  				my_uuid_hash[my_uuid] = my_name
  			end
	end
    	end
    end
    if uuid != nil
   	# add all uuids to list
   	if uuid =~ /,/
   		list = uuid.split(",")
   		list.each do | my_uuid |
   			response = @api.get_name(my_uuid)
   			my_uuid_hash[my_uuid] = response
   		end
   	else
   		# add single uuid to list
   		response = @api.get_name(uuid)
   		my_uuid_hash[uuid] = response
   	end
   end
   if my_uuid_hash.empty? 
   	log "no valid test option selected, please specify directory, template file, or uuid"
   	help
   	exit
   else
   	log "#{my_uuid_hash.size} tests in queue."
   end
   
   # now we run all the tests
   #log "RUNNING"
   results = {}
   map = my_uuid_hash.each_pair do |key,value|
   	t1 = Time.now.localtime.tv_sec
   	confidence_level_5,confidence_level_4,confidence_level_3,confidence_level_2,confidence_level_1 = 0, 0, 0, 0, 0
   	suspend_time = t1
   	polling_time = t1
		if prepend != nil
			name = "#{prepend}#{value}"
		else
			name = "#{value}#{Time.now.localtime}"
		end
		if @@output_dir != nil
			name = "#{@@output_dir}/#{prepend}#{value}"
		end
		log "my name = #{name} with uuid = #{key}", Logger::DEBUG
		# need to set new host values if host values are present
		hosts = @hash['hosts']
		if hosts != nil
			log "SET ALL HOSTS USING: #{hosts}", Logger::DEBUG
			new_uuid = set_hosts(key,hosts)
		end
		verify_good = false
		log "verify = #{verify} and verifyonly = #{verifyonly}"
		if verify || verifyonly
			log "verify = #{verify} and verifyonly = #{verifyonly}"
			verify_good = verify_analysis(key,name)
		end
		if verifyonly
			log "Verify Only! executing next test."
			next
		end
		if verify && !verify_good
			log "Analysis #{name} failed to verify! Executing next test."
			next
		end
		run = true
		run_uuid = ""
		run_uuid = @api.run(key, URI.encode(name))
		while run
			sleep(sleeptime)
  		status = @api.status(run_uuid)
  		log status
  		t2 = Time.now.localtime.tv_sec
  		log t2-t1
  		if interval > 0
  			if t2-polling_time > interval
  				faults = @api.get_faults(run_uuid)
  				log faults, Logger::DEBUG
  				# faults should be an xml doc already
  				unless faults.xpath("//fault_list_summary").empty?
  					count = 0
  					confidence_level_5,confidence_level_4,confidence_level_3,confidence_level_2,confidence_level_1 = 0, 0, 0, 0, 0
  					faults.xpath("//tba_fault").each do | node |
  						count += 1
  						confidence_level = node.xpath("confidence_level").text
  						title = node.xpath("title").text
  						fault_detection = node.xpath("fault_detection").text
  						fault_isolation = node.xpath("fault_isolation").text
  						attack_type = node.xpath("attack_type").text
  						if confidence_level =~ /5/
  							confidence_level_5 += 1
  						elsif confidence_level =~ /4/
  							confidence_level_4 += 1
  						elsif confidence_level =~ /3/
  							confidence_level_3 += 1
  						elsif confidence_level =~ /2/
  							confidence_level_2 += 1
  						elsif confidence_level =~ /1/
  							confidence_level_1 += 1
  						end
  					end
  					log "Current fault count: #{count}, confidence_level 5: #{confidence_level_5}"+ 
  						", confidence_level 4: #{confidence_level_4}, confidence_level 3: #{confidence_level_3}"+
  						", confidence_level 2: #{confidence_level_2}, confidence_level 1: #{confidence_level_1}"
  				end
  				polling_time = Time.now.localtime.tv_sec
  			end
  		end
  		if status =~ /ABORTED/ or status =~ /FINISHED/ or status =~ /FAILED/
  			run = false
  		elsif status =~ /SUSPENDED/
  			log "SUSPEND--->"
  			if t2-suspend_time > force*60
  				response = @api.resume(run_uuid)
  				log response
  				suspend_time = Time.now.localtime.tv_sec
  			end
  		end
  	end
  	# now we pull results for run and tabulate fault list if needed
  	if archive
  		evts = false
  		pcaps = false
  		samples = false
  		 = false
  		audit = false
  		sign = false
  		if archive_options =~ /evts/
  			evts = true
  		end
  		if archive_options =~ /pcaps/
  			pcaps = true
  		end
  		if archive_options =~ /samples/
  			samples = true
  		end
  		if archive_options =~ /logo/
  			 = true
  		end
  		if archive_options =~ /audit/
  			audit = true
  		end
  		if archive_options =~ /sign/
  			sign = true
  		end
  		log "evts = #{evts}, pcaps =  #{pcaps}, samples =  #{samples}, logo =  #{}, audit =  #{audit}, sign =  #{sign}", Logger::DEBUG
  		job_id = @api.archive("run",run_uuid,"",name,"Run via Mu Ruby Gem API #{Time.now}",evts,pcaps,samples,,audit,sign)
		job = true
		count = 0
		while job
			job_status = @api.archive("status", job_id)
			log "archive job_status = #{job_status}"
			if job_status =~ /Finished/
				job = false
			end
			sleep(sleeptime)
			count += 1
			if count > 30
				job = false
			end 
		end
		if File.exists?(name) && File.directory?(name)
			log "directiry #{name} already exists", Logger::DEBUG
		else
			log "creating directory for archive results: #{name}", Logger::DEBUG
				Dir.mkdir(name)
	end
		response = @api.archive("get",job_id,name)
	end
	faults = @api.get_faults(run_uuid)
  	log faults, Logger::DEBUG
  	# faults should be an xml doc already
  	unless faults.xpath("//fault_list_summary").empty?
  		count = 0
  		confidence_level_5,confidence_level_4,confidence_level_3,confidence_level_2,confidence_level_1 = 0, 0, 0, 0, 0
  		faults.xpath("//tba_fault").each do | node |
  			count += 1
  			confidence_level = node.xpath("confidence_level").text
		title = node.xpath("title").text
  			fault_detection = node.xpath("fault_detection").text
		fault_isolation = node.xpath("fault_isolation").text
  			attack_type = node.xpath("attack_type").text
  			if confidence_level =~ /5/
  				confidence_level_5 += 1
		elsif confidence_level =~ /4/
  				confidence_level_4 += 1
  			elsif confidence_level =~ /3/
  				confidence_level_3 += 1
		elsif confidence_level =~ /2/
  				confidence_level_2 += 1
		elsif confidence_level =~ /1/
  				confidence_level_1 += 1
		end
  		end
  		
  		log "Ending fault countfor #{name}: #{count}, confidence_level 5: #{confidence_level_5}"+ 
  			", confidence_level 4: #{confidence_level_4}, confidence_level 3: #{confidence_level_3}"+
  			", confidence_level 2: #{confidence_level_2}, confidence_level 1: #{confidence_level_1}"
  	end
end
   #response = @api.capture(command, port, job_id)
   
   return "RUN"
end

#log(message = "", level = nil) ⇒ Object

logging in this script



17
18
19
20
 
# File 'lib/mu/command/cmd_runanalysis.rb', line 17

def log(message="",level=nil)
  msg message, level
  File.open(@@output_log, "a") {|f| f.write(message) }
end