Added support for random agent names and aliases.

(cherry picked from commit 4deece66d533fe5b3134325b5a2ac8aa64b6a45d)
This commit is contained in:
Ramon Novoa 2016-09-27 15:19:22 +02:00
parent 2014f51410
commit 903d56e4ea
1 changed files with 215 additions and 55 deletions

270
pandora_agents/unix/pandora_agent Normal file → Executable file
View File

@ -100,6 +100,9 @@ use constant DF_CMDS => {
aix => 'df -kP',
freebsd => 'df -k'
};
# 2 to the power of 32.
use constant POW232 => 2**32;
# OS and OS version
my $OS = $^O;
@ -131,7 +134,8 @@ my %DefaultConf = (
'temporal' => '/var/spool/pandora',
'interval' => 300,
'debug' => 0,
'agent_name' => hostname (),
'agent_name' => '',
'agent_alias' => hostname(),
'agent_name_cmd' => '',
'description' => '',
'group' => '',
@ -798,6 +802,8 @@ sub read_config (;$) {
$temp_agent_name =~ s/^ *(.*?) *$/$1/;
$Conf{'agent_name'} = $temp_agent_name if ($temp_agent_name ne '');
} else {
$Conf{'agent_name'} = generate_agent_name();
}
# Update the agent MD5 since agent_name may have changed
@ -1183,73 +1189,78 @@ sub check_collections () {
}
###############################################################################
# MD5 leftrotate function. See http://en.wikipedia.org/wiki/MD5#Pseudocode.
# Return the MD5 checksum of the given string as a hex string.
# Pseudocode from: http://en.wikipedia.org/wiki/MD5#Pseudocode
###############################################################################
sub leftrotate ($$) {
my ($x, $c) = @_;
return (0xFFFFFFFF & ($x << $c)) | ($x >> (32 - $c));
}
###############################################################################
# Initialize some variables needed by the MD5 algorithm.
# See http://en.wikipedia.org/wiki/MD5#Pseudocode.
###############################################################################
my (@R, @K);
sub md5_init () {
# R specifies the per-round shift amounts
@R = (7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21);
# Use binary integer part of the sines of integers (radians) as constants
for (my $i = 0; $i < 64; $i++) {
$K[$i] = floor(abs(sin($i + 1)) * MOD232);
}
}
###############################################################################
# Return the MD5 checksum of the given string.
# Pseudocode from http://en.wikipedia.org/wiki/MD5#Pseudocode.
###############################################################################
sub md5 ($) {
my @S = (
7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21
);
my @K = (
0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee,
0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be,
0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa,
0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed,
0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c,
0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05,
0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039,
0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1,
0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391
);
sub md5 {
my $str = shift;
# Note: All variables are unsigned 32 bits and wrap modulo 2^32 when calculating
# No input!
if (!defined($str)) {
return "";
}
# Initialize variables
# Note: All variables are unsigned 32 bits and wrap modulo 2^32 when
# calculating.
# Initialize variables.
my $h0 = 0x67452301;
my $h1 = 0xEFCDAB89;
my $h2 = 0x98BADCFE;
my $h3 = 0x10325476;
# Pre-processing
# Pre-processing.
my $msg = unpack ("B*", pack ("A*", $str));
my $bit_len = length ($msg);
# Append "1" bit to message
# Append "1" bit to message.
$msg .= '1';
# Append "0" bits until message length in bits ≡ 448 (mod 512)
# Append "0" bits until message length in bits ≡ 448 (mod 512).
$msg .= '0' while ((length ($msg) % 512) != 448);
# Append bit /* bit, not byte */ length of unpadded message as 64-bit little-endian integer to message
$msg .= unpack ("B64", pack ("VV", $bit_len));
# Append bit /* bit, not byte */ length of unpadded message as 64-bit
# little-endian integer to message.
$msg .= unpack ("B32", pack ("V", $bit_len));
$msg .= unpack ("B32", pack ("V", $bit_len >> 32));
# Process the message in successive 512-bit chunks
# Process the message in successive 512-bit chunks.
for (my $i = 0; $i < length ($msg); $i += 512) {
my @w;
my $chunk = substr ($msg, $i, 512);
# Break chunk into sixteen 32-bit little-endian words w[i], 0 <= i <= 15
# Break chunk into sixteen 32-bit little-endian words w[i], 0 <= i <=
# 15.
for (my $j = 0; $j < length ($chunk); $j += 32) {
push (@w, unpack ("V", pack ("B32", substr ($chunk, $j, 32))));
}
# Initialize hash value for this chunk
# Initialize hash value for this chunk.
my $a = $h0;
my $b = $h1;
my $c = $h2;
@ -1257,7 +1268,7 @@ sub md5 ($) {
my $f;
my $g;
# Main loop
# Main loop.
for (my $y = 0; $y < 64; $y++) {
if ($y <= 15) {
$f = $d ^ ($b & ($c ^ $d));
@ -1279,19 +1290,163 @@ sub md5 ($) {
my $temp = $d;
$d = $c;
$c = $b;
$b = ($b + leftrotate (($a + $f + $K[$y] + $w[$g]) % MOD232, $R[$y])) % MOD232;
$b = ($b + leftrotate (($a + $f + $K[$y] + $w[$g]) % POW232, $S[$y])) % POW232;
$a = $temp;
}
# Add this chunk's hash to result so far
$h0 = ($h0 + $a) % MOD232;
$h1 = ($h1 + $b) % MOD232;
$h2 = ($h2 + $c) % MOD232;
$h3 = ($h3 + $d) % MOD232;
# Add this chunk's hash to result so far.
$h0 = ($h0 + $a) % POW232;
$h1 = ($h1 + $b) % POW232;
$h2 = ($h2 + $c) % POW232;
$h3 = ($h3 + $d) % POW232;
}
# Digest := h0 append h1 append h2 append h3 #(expressed as little-endian)
return unpack ("H*", pack ("V", $h0)) . unpack ("H*", pack ("V", $h1)) . unpack ("H*", pack ("V", $h2)) . unpack ("H*", pack ("V", $h3));
return unpack ("H*", pack ("V", $h0)) .
unpack ("H*", pack ("V", $h1)) .
unpack ("H*", pack ("V", $h2)) .
unpack ("H*", pack ("V", $h3));
}
###############################################################################
# MD5 leftrotate function. See: http://en.wikipedia.org/wiki/MD5#Pseudocode
###############################################################################
sub leftrotate {
my ($x, $c) = @_;
return (0xFFFFFFFF & ($x << $c)) | ($x >> (32 - $c));
}
###############################################################################
# Return the SHA256 checksum of the given string as a hex string.
# Pseudocode from: http://en.wikipedia.org/wiki/SHA-2#Pseudocode
###############################################################################
my @K2 = (
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
);
sub sha256 {
my $str = shift;
# No input!
if (!defined($str)) {
return "";
}
# Note: All variables are unsigned 32 bits and wrap modulo 2^32 when
# calculating.
# First 32 bits of the fractional parts of the square roots of the first 8
# primes.
my $h0 = 0x6a09e667;
my $h1 = 0xbb67ae85;
my $h2 = 0x3c6ef372;
my $h3 = 0xa54ff53a;
my $h4 = 0x510e527f;
my $h5 = 0x9b05688c;
my $h6 = 0x1f83d9ab;
my $h7 = 0x5be0cd19;
# Pre-processing.
my $msg = unpack ("B*", pack ("A*", $str));
my $bit_len = length ($msg);
# Append "1" bit to message.
$msg .= '1';
# Append "0" bits until message length in bits = 448 (mod 512).
$msg .= '0' while ((length ($msg) % 512) != 448);
# Append bit /* bit, not byte */ length of unpadded message as 64-bit
# big-endian integer to message.
$msg .= unpack ("B32", pack ("N", $bit_len >> 32));
$msg .= unpack ("B32", pack ("N", $bit_len));
# Process the message in successive 512-bit chunks.
for (my $i = 0; $i < length ($msg); $i += 512) {
my @w;
my $chunk = substr ($msg, $i, 512);
# Break chunk into sixteen 32-bit big-endian words.
for (my $j = 0; $j < length ($chunk); $j += 32) {
push (@w, unpack ("N", pack ("B32", substr ($chunk, $j, 32))));
}
# Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array:
for (my $i = 16; $i < 64; $i++) {
my $s0 = rightrotate($w[$i - 15], 7) ^ rightrotate($w[$i - 15], 18) ^ ($w[$i - 15] >> 3);
my $s1 = rightrotate($w[$i - 2], 17) ^ rightrotate($w[$i - 2], 19) ^ ($w[$i - 2] >> 10);
$w[$i] = ($w[$i - 16] + $s0 + $w[$i - 7] + $s1) % POW232;
}
# Initialize working variables to current hash value.
my $a = $h0;
my $b = $h1;
my $c = $h2;
my $d = $h3;
my $e = $h4;
my $f = $h5;
my $g = $h6;
my $h = $h7;
# Compression function main loop.
for (my $i = 0; $i < 64; $i++) {
my $S1 = rightrotate($e, 6) ^ rightrotate($e, 11) ^ rightrotate($e, 25);
my $ch = ($e & $f) ^ ((0xFFFFFFFF & (~ $e)) & $g);
my $temp1 = ($h + $S1 + $ch + $K2[$i] + $w[$i]) % POW232;
my $S0 = rightrotate($a, 2) ^ rightrotate($a, 13) ^ rightrotate($a, 22);
my $maj = ($a & $b) ^ ($a & $c) ^ ($b & $c);
my $temp2 = ($S0 + $maj) % POW232;
$h = $g;
$g = $f;
$f = $e;
$e = ($d + $temp1) % POW232;
$d = $c;
$c = $b;
$b = $a;
$a = ($temp1 + $temp2) % POW232;
}
# Add the compressed chunk to the current hash value.
$h0 = ($h0 + $a) % POW232;
$h1 = ($h1 + $b) % POW232;
$h2 = ($h2 + $c) % POW232;
$h3 = ($h3 + $d) % POW232;
$h4 = ($h4 + $e) % POW232;
$h5 = ($h5 + $f) % POW232;
$h6 = ($h6 + $g) % POW232;
$h7 = ($h7 + $h) % POW232;
}
# Produce the final hash value (big-endian).
return unpack ("H*", pack ("N", $h0)) .
unpack ("H*", pack ("N", $h1)) .
unpack ("H*", pack ("N", $h2)) .
unpack ("H*", pack ("N", $h3)) .
unpack ("H*", pack ("N", $h4)) .
unpack ("H*", pack ("N", $h5)) .
unpack ("H*", pack ("N", $h6)) .
unpack ("H*", pack ("N", $h7));
}
###############################################################################
# Rotate a 32-bit number a number of bits to the right.
###############################################################################
sub rightrotate {
my ($x, $c) = @_;
return (0xFFFFFFFF & ($x << (32 - $c))) | ($x >> $c);
}
################################################################################
@ -2176,6 +2331,13 @@ sub init_module ($) {
$module->{'alert_template'} = undef;
}
################################################################################
# Generate a unique agent name.
################################################################################
sub generate_agent_name {
return sha256(join('|', ($Conf{'agent_alias'}, $Conf{server_name}, time(), sprintf("%04d", rand(10000)))));
}
################################################################################
# Main.
################################################################################
@ -2208,9 +2370,6 @@ if (defined ($pandora_user)) {
# Guess the OS version
$OS_VERSION = guess_os_version ($OS);
# Initialize MD5 variables
md5_init ();
# Start logging
start_log ();
log_message ('log', 'Running as user ' . getpwuid ($>));
@ -2402,8 +2561,9 @@ while (1) {
"<agent_data description='" . $Conf{'description'} ."' group='" . $Conf{'group'} .
"' os_name='$OS' os_version='$OS_VERSION' interval='" . $Conf{'interval'} .
"' version='" . AGENT_VERSION . '(Build ' . AGENT_BUILD . ')' . ($Conf{'autotime'} eq '1' ? '' : "' timestamp='" . strftime ('%Y/%m/%d %H:%M:%S', localtime ())) .
"' agent_name='" . $Conf{'agent_name'} . "' timezone_offset='". $Conf{'timezone_offset'} .
"' custom_id='" . $Conf{'custom_id'} . "' url_address='". $Conf{'url_address'};
"' agent_name='" . $Conf{'agent_name'} . "' agent_alias='". $Conf{'agent_alias'} .
"' timezone_offset='". $Conf{'timezone_offset'} . "' custom_id='" . $Conf{'custom_id'} .
"' url_address='". $Conf{'url_address'};
if (defined ($Conf{'address'})) {
$xml_header .= "' address='" .$address;