opensecurity: OpenSecurity/bin/vmmanager.py@b44a603b0b95

     1 '''

     2 Created on Nov 19, 2013

     4 @author: BarthaM

     5 '''

     6 import os

     7 import os.path

     8 from subprocess import Popen, PIPE, call

     9 import subprocess

    10 import sys

    11 import re

    12 import _winreg

    13 from cygwin import Cygwin

    14 import threading

    15 import time

    16 import string

    19 DEBUG = False

    21 class USBFilter:

    22     vendorid = ""

    23     productid = ""

    24     revision = ""

    26     def __init__(self, vendorid, productid, revision):

    27         self.vendorid = vendorid.lower()

    28         self.productid = productid.lower()

    29         self.revision = revision.lower()

    30         return

    32     def __eq__(self, other):

    33         return self.vendorid == other.vendorid and self.productid == other.productid and self.revision == other.revision

    35     def __hash__(self):

    36         return hash(self.vendorid) ^ hash(self.productid) ^ hash(self.revision)

    38     def __repr__(self):

    39         return "VendorId = \'" + str(self.vendorid) + "\' ProductId = \'" + str(self.productid) + "\' Revision = \'" + str(self.revision) + "\'"

    42 class VMManager(object):

    43     vmRootName = "SecurityDVM"

    44     systemProperties = None

    45     cygwin_path = 'c:\\cygwin64\\bin\\'

    46     vboxManage = 'VBoxManage'

    47     startNotifications = list()

    49     _instance = None

    50     #def __new__(cls, *args, **kwargs):

    51     #    if not cls._instance:

    52     #        cls._instance = super(VMManager, cls).__new__(cls, *args, **kwargs)

    53     #    return cls._instance

    55     _instance = None

    56     #def __new__(cls, *args, **kwargs):

    57     #    if not cls._instance:

    58     #        cls._instance = super(VMManager, cls).__new__(cls, *args, **kwargs)

    59     #    return cls._instance

    61     def __init__(self):

    62         self.cygwin_path = os.path.join(Cygwin.root(), 'bin') + os.path.sep

    63         self.vboxManage = os.path.join(self.getVBoxManagePath(), 'VBoxManage')

    64         self.systemProperties = self.getSystemProperties()

    65         return

    67     @staticmethod

    68     def getInstance():

    69         if VMManager._instance == None:

    70             VMManager._instance = VMManager()

    71         return VMManager._instance

    73     def putStartNotification(self, ip):

    74         self.startNotifications.append(ip)

    76     def isSDVMStarted(self, ip):

    77         return self.startNotifications.contains(ip)

    79     def execute(self, cmd):

    80         if DEBUG:

    81             print('trying to launch: ' + cmd)

    82         process = Popen(cmd, stdout=PIPE, stderr=PIPE) #shell = True

    83         if DEBUG:

    84             print('launched: ' + cmd)

    85         result = process.wait()

    86         res_stdout = process.stdout.read();

    87         res_stderr = process.stderr.read();

    88         if DEBUG:

    89             if res_stdout != "":

    90                 print res_stdout

    91             if res_stderr != "":

    92                 print res_stderr

    93         return result, res_stdout, res_stderr

    95     def getVBoxManagePath(self):

    96         """get the path to the VirtualBox installation on this system"""

    97         p = None

    98         try:

    99             k = _winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\Oracle\VirtualBox')

   100             p = _winreg.QueryValueEx(k, 'InstallDir')[0]

   101             _winreg.CloseKey(k)

   102         except:

   103             pass

   104         return p

   106     # return hosty system properties

   107     def getSystemProperties(self):

   108         cmd = self.vboxManage + ' list systemproperties'

   109         result = self.execute(cmd)

   110         if result[1]=='':

   111             return None

   112         props = dict((k.strip(),v.strip().strip('"')) for k,v in (line.split(':', 1) for line in result[1].strip().splitlines()))

   113         return props

   115     # return the folder containing the guest VMs

   116     def getDefaultMachineFolder(self):

   117         return self.systemProperties["Default machine folder"]

   119     #list the hostonly IFs exposed by the VBox host

   120     def getHostOnlyIFs(self):

   121         cmd = 'VBoxManage list hostonlyifs'

   122         result = self.execute(cmd)[1]

   123         if result=='':

   124             return None

   125         props = dict((k.strip(),v.strip().strip('"')) for k,v in (line.split(':', 1) for line in result.strip().splitlines()))

   126         return props

   128     def listRSDS(self):

   129         cmd = 'VBoxManage list usbhost'

   130         results = self.execute(cmd)[1]

   131         results = results.split('Host USB Devices:')[1].strip()

   133         items = list( "UUID:"+result for result in results.split('UUID:') if result != '')

   134         rsds = dict()

   135         for item in items:

   136             props = dict()

   137             for line in item.splitlines():

   138                 if line != "":

   139                     k,v = line[:line.index(':')].strip(), line[line.index(':')+1:].strip()

   140                     props[k] = v;

   142             if 'Product' in props.keys() and props['Product'] == 'Mass Storage':

   143                 usb_filter = USBFilter( re.search(r"\((?P<vid>[0-9A-Fa-f]+)\)", props['VendorId']).groupdict()['vid'],

   144                                         re.search(r"\((?P<pid>[0-9A-Fa-f]+)\)", props['ProductId']).groupdict()['pid'],

   145                                         re.search(r"\((?P<rev>[0-9A-Fa-f]+)\)", props['Revision']).groupdict()['rev'] )

   146                 rsds[props['UUID']] = usb_filter;

   147                 if DEBUG:

   148                     print usb_filter

   149         return rsds

   151     # list all existing VMs registered with VBox

   152     def listVM(self):

   153         cmd = 'VBoxManage list vms'

   154         result = self.execute(cmd)[1]

   155         vms = list(k.strip().strip('"') for k,_ in (line.split(' ') for line in result.splitlines()))

   156         return vms

   158     # list existing SDVMs

   159     def listSDVM(self):

   160         vms = self.listVM()

   161         svdms = []

   162         for vm in vms:

   163             if vm.startswith(self.vmRootName) and vm != self.vmRootName:

   164                 svdms.append(vm)

   165         return svdms

   167     # generate valid (not already existing SDVM name). necessary for creating a new VM

   168     def generateSDVMName(self):

   169         vms = self.listVM()

   170         for i in range(0,999):

   171             if(not self.vmRootName+str(i) in vms):

   172                 return self.vmRootName+str(i)

   173         return ''

   175     # return the RSDs attached to all existing SDVMs

   176     def getAttachedRSDs(self):

   177         vms = self.listSDVM()

   178         attached_devices = dict()

   179         for vm in vms:

   180             rsd_filter = self.getUSBFilter(vm)

   181             if rsd_filter != None:

   182                 attached_devices[vm] = rsd_filter

   183         return attached_devices

   185     # configures hostonly networking and DHCP server. requires admin rights

   186     def configureHostNetworking(self):

   187         #cmd = 'vboxmanage list hostonlyifs'

   188         #self.execute(cmd)

   189         #cmd = 'vboxmanage hostonlyif remove \"VirtualBox Host-Only Ethernet Adapter\"'

   190         #self.execute(cmd)

   191         #cmd = 'vboxmanage hostonlyif create'

   192         #self.execute(cmd)

   193         cmd = 'VBoxManage hostonlyif ipconfig \"VirtualBox Host-Only Ethernet Adapter\" --ip 192.168.56.1 --netmask 255.255.255.0'

   194         self.execute(cmd)

   195         #cmd = 'vboxmanage dhcpserver add'

   196         #self.execute(cmd)

   197         cmd = 'VBoxManage dhcpserver modify --ifname \"VirtualBox Host-Only Ethernet Adapter\" --ip 192.168.56.100 --netmask 255.255.255.0 --lowerip 192.168.56.101 --upperip 192.168.56.200'

   198         self.execute(cmd)

   200     #create new virtual machine instance based on template vm named SecurityDVM (\SecurityDVM\SecurityDVM.vmdk)

   201     def createVM(self, vm_name):

   202         hostonly_if = self.getHostOnlyIFs()

   203         machineFolder = self.getDefaultMachineFolder()

   204         cmd = 'VBoxManage createvm --name ' + vm_name + ' --ostype Debian --register'

   205         self.execute(cmd)

   206         cmd = 'VBoxManage modifyvm ' + vm_name + ' --memory 512 --vram 10 --cpus 1 --usb on --usbehci on --nic1 hostonly --hostonlyadapter1 \"' + hostonly_if['Name'] + '\" --nic2 nat'

   207         self.execute(cmd)

   208         cmd = 'VBoxManage storagectl ' + vm_name + ' --name contr1 --add sata --portcount 2'

   209         self.execute(cmd)

   210         cmd = 'VBoxManage storageattach ' + vm_name + ' --storagectl contr1 --port 0 --device 0 --type hdd --medium \"'+ machineFolder + '\SecurityDVM\SecurityDVM.vmdk\"'

   211         #--mtype immutable

   212         self.execute(cmd)

   213         return

   215     #remove VM from the system. should be used on VMs returned by listSDVMs

   216     def removeVM(self, vm_name):

   217         print('removing ' + vm_name)

   218         cmd = 'VBoxManage unregistervm ' + vm_name + ' --delete'

   219         print self.execute(cmd)

   220         machineFolder = self.getDefaultMachineFolder()

   221         cmd = self.cygwin_path + 'bash.exe --login -c \"rm -rf ' + machineFolder + '\\' + vm_name + '*\"'

   222         print self.execute(cmd)

   224     # start VM

   225     def startVM(self, vm_name):

   226         print('starting ' +  vm_name)

   227         cmd = 'VBoxManage startvm ' + vm_name + ' --type headless'

   228         print self.execute(cmd) #verify against (0, 'Waiting for VM "SecurityDVM0" to power on...\r\nVM "SecurityDVM0" has been successfully started.\r\n', '')

   230     # stop VM

   231     def stopVM(self, vm_name):

   232         print('stopping ' + vm_name)

   233         cmd = 'VBoxManage controlvm ' + vm_name + ' poweroff'

   234         print self.execute(cmd)

   236     # return the hostOnly IP for a running guest

   237     def getHostOnlyIP(self, vm_name):

   238         print('gettting hostOnly IP address ' + vm_name)

   239         cmd = 'VBoxManage guestproperty get ' + vm_name + ' /VirtualBox/GuestInfo/Net/0/V4/IP'

   240         result = self.execute(cmd)

   241         if result=='':

   242             return None

   243         result = result[1]

   244         if result.startswith('No value set!'):

   245             return None

   246         return result[result.index(':')+1:].strip()

   248     # attach removable storage device to VM by provision of filter

   249     def attachRSD(self, vm_name, rsd_filter):

   250         cmd = 'VBoxManage usbfilter add 0 --target ' + vm_name + ' --name OpenSecurityRSD --vendorid ' + rsd_filter.vendorid + ' --productid ' + rsd_filter.productid + ' --revision ' + rsd_filter.revision

   251         print self.execute(cmd)

   254     # return the description set for an existing VM

   255     def getVMInfo(self, vm_name):

   256         cmd = 'VBoxManage showvminfo ' + vm_name + ' --machinereadable'

   257         results = self.execute(cmd)[1]

   258         props = dict((k.strip(),v.strip().strip('"')) for k,v in (line.split('=', 1) for line in results.splitlines()))

   259         return props

   261     # return the configured USB filter for an existing VM

   262     def getUSBFilter(self, vm_name):

   263         props = self.getVMInfo(vm_name)

   264         keys = set(['USBFilterVendorId1', 'USBFilterProductId1', 'USBFilterRevision1'])

   265         keyset = set(props.keys())

   266         usb_filter = None

   267         if keyset.issuperset(keys):

   268             usb_filter = USBFilter(props['USBFilterVendorId1'], props['USBFilterProductId1'], props['USBFilterRevision1'])

   269         return usb_filter

   271     #generates ISO containing authorized_keys for use with guest VM

   272     def genCertificateISO(self, vm_name):

   273         machineFolder = self.getDefaultMachineFolder()

   274         # create .ssh folder in vm_name

   275         cmd = self.cygwin_path+'bash.exe --login -c \"mkdir -p \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\\"\"'

   276         result = self.execute(cmd)

   277         # generate dvm_key pair in vm_name / .ssh

   278         cmd = self.cygwin_path+'bash.exe --login -c \"ssh-keygen -q -t rsa -N \\"\\" -C \\\"' + vm_name + '\\\" -f \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\dvm_key\\\"\"'   #'echo -e "y\\n" |',

   279         result = self.execute(cmd)

   280         # set permissions for keys

   281         #TODO: test without chmod

   282         cmd = self.cygwin_path+'bash.exe --login -c \"chmod 500 \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\*\\\"\"'

   283         result = self.execute(cmd)

   284         # move out private key

   285         cmd = self.cygwin_path+'bash.exe --login -c \"mv \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\dvm_key\\\" \\\"' + machineFolder + '\\' + vm_name + '\\\"'

   286         result = self.execute(cmd)

   287         # rename public key to authorized_keys

   288         cmd = self.cygwin_path+'bash.exe --login -c \"mv \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\dvm_key.pub\\\" \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\authorized_keys\\\"'

   289         result = self.execute(cmd)

   290         # generate iso image with .ssh/authorized keys

   291         cmd = self.cygwin_path+'bash.exe --login -c \"/usr/bin/genisoimage -J -R -o \\\"' + machineFolder + '\\' + vm_name + '\\'+ vm_name + '.iso\\\" \\\"' + machineFolder + '\\' + vm_name + '\\.ssh\\\"\"'

   292         result = self.execute(cmd)

   294     # attaches generated ssh public cert to guest vm

   295     def attachCertificateISO(self, vm_name):

   296         machineFolder = self.getDefaultMachineFolder()

   297         cmd = 'vboxmanage storageattach ' + vm_name + ' --storagectl contr1 --port 1 --device 0 --type dvddrive --mtype readonly --medium \"' + machineFolder + '\\' + vm_name + '\\'+ vm_name + '.iso\"'

   298         result = self.execute(cmd)

   299         return result

   301     handleDeviceChangeLock = threading.Lock()

   303     # handles device change events

   304     def handleDeviceChange(self):

   305         if VMManager.handleDeviceChangeLock.acquire(True):

   306             #destroy unused vms

   307             new_ip = None

   308             attached_devices = self.getAttachedRSDs()

   309             connected_devices = self.listRSDS()

   310             for vm_name in attached_devices.keys():

   311                 if attached_devices[vm_name] not in connected_devices.values():

   312                     self.unmapNetworkDrive('h:')

   313                     self.stopVM(vm_name)

   314                     self.removeVM(vm_name)

   315             #create new vm for attached device if any

   316             attached_devices = self.getAttachedRSDs()

   317             for connected_device in connected_devices.values():

   318                 if (attached_devices and False) or (connected_device not in attached_devices.values()):

   319                     new_sdvm = self.generateSDVMName()

   320                     self.createVM(new_sdvm)

   321                     self.attachRSD(new_sdvm, connected_device)

   322                     #sleep like method

   323                     self.listSDVM()

   324                     self.startVM(new_sdvm)

   326                     while new_ip == None:

   327                         time.sleep(1)

   328                         new_ip = self.getHostOnlyIP(new_sdvm)

   329                     while new_ip not in self.startNotifications:

   330                         time.sleep(1)

   331                     #TODO: cleanup notifications somwhere else (eg. machine shutdown)

   332                     self.startNotifications.remove(new_ip)

   333             VMManager.handleDeviceChangeLock.release()

   334             return new_ip

   336     def handleBrowsingRequest(self):

   337         new_sdvm = self.generateSDVMName()

   338         self.createVM(new_sdvm)

   339         self.genCertificateISO(new_sdvm)

   340         self.attachCertificateISO(new_sdvm)

   341         return new_sdvm

   343     # executes command over ssh on guest vm

   344     def sshGuestExecute(self, vm_name, prog, user_name='opensec'):

   345         # get vm ip

   346         address = self.getHostOnlyIP(vm_name)

   347         machineFolder = self.getDefaultMachineFolder()

   348         # run command

   349         cmd = self.cygwin_path+'bash.exe --login -c \"ssh -i \\\"' + machineFolder + '\\' + vm_name + '\\dvm_key\\\"  ' + user_name + '@' + address + ' ' + prog + '\"'

   350         return self.execute(cmd)

   352     # executes command over ssh on guest vm with X forwarding

   353     def sshGuestX11Execute(self, vm_name, prog, user_name='opensec'):

   354         #TODO: verify if X server is running on user account

   355         #TODO: set DISPLAY accordingly

   356         address = self.getHostOnlyIP(vm_name)

   357         machineFolder = self.getDefaultMachineFolder()

   358         # run command

   359         cmd = self.cygwin_path+'bash.exe --login -c \"DISPLAY=:0 ssh -Y -i \\\"' + machineFolder + '\\' + vm_name + '\\dvm_key\\\"  '  + user_name + '@' + address + ' ' + prog + '\"'

   360         return self.execute(cmd)

   362     #Small function to check the availability of network resource.

   363     def isAvailable(self, path):

   364         cmd = 'IF EXIST ' + path + ' echo YES'

   365         result = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True).communicate()

   366         return string.find(str(result), 'YES',)

   368     #Small function to check if the mention location is a directory

   369     def isDirectory(self, path):

   370         cmd = 'dir ' + path + ' | FIND ".."'

   371         result = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True).communicate()

   372         return string.find(str(result), 'DIR',)

   374     def mapNetworkDrive(self, drive, networkPath, user, password):

   375         self.unmapNetworkDrive('h:')

   376         #Check for drive availability

   377         if self.isAvailable(drive) > -1:

   378             print "Drive letter is already in use: ", drive

   379             return -1

   380         #Check for network resource availability

   381         while self.isAvailable(networkPath) == -1:

   382             time.sleep(1)

   383             print "Path not accessible: ", networkPath, " retrying"

   384             #return -1

   386         #Prepare 'NET USE' commands

   387         cmd = 'NET USE ' + drive + ' ' + networkPath

   388         if user != None:

   389             cmd = cmd + ' ' + password + ' /User' + user

   391         print "cmd = ", cmd

   392         #Execute 'NET USE' command with authentication

   393         result = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True).communicate()

   394         print "Executed: ", cmd

   395         if string.find(str(result), 'successfully',) == -1:

   396             print cmd, " FAILED"

   397             return -1

   398         #Mapped with first try

   399         return 1

   401     def unmapNetworkDrive(self, drive):

   402         #Check if the drive is in use

   403         if self.isAvailable(drive) == -1:

   404             #Drive is not in use

   405             return -1

   406         #Prepare 'NET USE' command

   407         cmd = 'net use ' + drive + ' /DELETE'

   408         result = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True).communicate()

   409         if string.find(str(result), 'successfully',) == -1:

   410             return -1

   411         return 1

   413 if __name__ == '__main__':

   415     man = VMManager.getInstance()

   416     #man.removeVM('SecurityDVM0')

   417     #man.netUse('192.168.56.134', 'USB\\')

   418     ip = '192.168.56.139'

   419     man.mapNetworkDrive('h:', '\\\\' + ip + '\USB', None, None)

   421     #man.cygwin_path = 'c:\\cygwin64\\bin\\'

   422     #man.handleDeviceChange()

   423     #print man.listSDVM()

   424     #man.configureHostNetworking()

   425     #new_vm = man.generateSDVMName()

   426     #man.createVM(new_vm)

   427     #man.genCertificateISO(new_vm)

   428     #man.attachCertificateISO(new_vm)

   430     #man.attachCertificateISO(vm_name)

   431     #man.sshGuestExecute(vm_name, "ls")

   432     #man.sshGuestX11Execute(vm_name, "iceweasel")

   433     #cmd = "c:\\cygwin64\\bin\\bash.exe --login -c \"/bin/ls\""

   434     #man.execute(cmd)

author	mb
	Wed, 11 Dec 2013 12:07:16 +0100
changeset 40	b44a603b0b95
parent 36	cc6abcf9108b
child 41	76d9177ca509
child 42	e10a08095ccc
permissions	-rw-r--r--