EVOLUTION-NINJA

Edit File: inspector.py

from datetime import datetime
import agent_util
import platform
import os
import sys
import logging
import socket
import sys

try:
    # Python 2.x
    import httplib
except:
    import http.client as httplib
try:
    import psutil
except:
    psutil = None

try:
    import distro
except:
    distro = None

try:
    import json
except ImportError:
    try:
        import simplejson as json
    # it's possible that we may not need json for the action that we're taking.
    # for example, for the rpm post install script, on a python version that
    # doesn't have json, we'll get this far in the code.  but the post
    # install doesn't use json, so we're fine
    except ImportError:
        json = None

def mac_address_octets(n):
    if sys.version_info[0] == 2:
        rng = xrange
    else:
        # python 3x uses range
        rng = range

for i in rng(6):
        yield n & 0xFF
        n >>= 8

def int_to_mac_address(n):
    """
    Expresses a decimal integer in standard MAC address format
     ex:
     7267271067680 -> '06:9c:0b:1c:48:20'
    """
    values = ["%02x" % a for a in mac_address_octets(n)]
    return ":".join(reversed(values))

def get_fqdn():
    hostname = socket.getfqdn()
    if "darwin" == sys.platform:
        """
        Mac is odd around ipv4/6 addresses - see:
        https://stackoverflow.com/questions/8625029/why-does-pythons-socket-getfqdn-return-a-long-string-that-looks-like-an-ipv6
        """
        if hostname.lower().endswith(".arpa"):
            hostname = socket.gethostname()

return hostname

def get_server_name():
    if "darwin" != sys.platform:
        return None
    try:
        """
        For Fortisase integration, get the value we want to specify for server_name, which
        is sent up in handshake and also for config changes. This allows us to match the
        name provided by Forticlient.
        """
        sc_util = agent_util.which("scutil", exc=True)
        _, output = agent_util.execute_command("{} --get ComputerName".format(sc_util))
        return output.strip()
    except:
        return None

def get_platform_uuids():
    log = logging.getLogger("Inspector")
    my_platform = sys.platform.lower()
    #
    # The keys in the rv dictionary should match the textkeys
    # in the table ServerIdentifierType
    rv = {"platform": sys.platform.lower()}
    if "darwin" == my_platform:
        try:
            ioreg_bin = agent_util.which("ioreg")
            rc, output = agent_util.execute_command(
                "{} -d2 -c IOPlatformExpertDevice | grep IOPlatformUUID".format(
                    ioreg_bin
                )
            )
            if 0 == rc:
                rv["uuid"] = output.strip().split("=")[1].strip().strip('"')
            else:
                log.error("ioreg error: {}".format(rc))
        except Exception as e:
            log.info("Gather UUID failure: {}".format(str(e)))
            pass
    return rv

def mac_address_iter():
    if psutil:
        for iface, addrs in psutil.net_if_addrs().items():
            for addr in addrs:
                if addr.family != psutil.AF_LINK:
                    continue
                if addr.address == "00:00:00:00:00:00":
                    continue
                yield addr.address

def get_mac_addresses():
    facts = {"macaddress": []}

try:
        import uuid

facts["uuid_getnode"] = int_to_mac_address(uuid.getnode())
    except Exception as err:
        logging.warning(err)
        logging.info(
            "Unable to import uuid module. Skipping MAC address fact collection."
        )

try:
        for i, mac_addr in enumerate(mac_address_iter()):
            facts["macaddress"].append(mac_addr)
    except ImportError:
        logging.info("Unable to import psutil, skipping MAC address fact collection")
    except Exception as err:
        logging.warning(err)
        logging.info("Unknown error during MAC address collection")

return facts

class Inspector(object):
    SOURCE_LIST_PATHS = ["/etc/apt/sources.list", "/etc/yum.repos.d/panopta.repo"]
    PANOPTA_REPO = "http://packages.panopta.com/"

def __init__(self, agent):
        self.agent = agent

def get_all_facts(self, wifi_info=None):
        facts = {}
        log = logging.getLogger("Inspector")
        try:
            facts.update(self.get_agent_facts())
            facts.update(self.get_python_facts())
            facts.update(self.get_process_facts())
            facts.update(get_mac_addresses())
            facts.update(self.get_hardware_facts())
            facts.update(self.get_time_facts())
            facts.update(self.get_hostname())
            facts.update(self.get_platform_facts())
            facts.update(self.get_machine_facts())
            facts.update(self.get_wifi_facts(wifi_info))
            facts.update(self.get_dem_network_facts())

if sys.version_info >= (2, 6, 0):
                # Cloud detection, but only if we're on a new enough Python to have timeout
                facts.update(self.get_cloud_facts())
        except Exception as e:
            log.info("get_all facts: {}".format(e))

return facts

def get_platform_facts(self):
        facts = {}
        if "darwin" == sys.platform:
            try:
                _, output = agent_util.execute_command("sw_vers | grep ProductVersion")
                pv = output.split(":")[1].strip()
                facts["MacOSVersion"] = pv
            except:
                pass
        return facts

def get_hostname(self):
        facts = {}
        facts["hostname"] = get_fqdn()
        return facts

def get_time_facts(self):
        facts = {}
        try:
            retcode, output = agent_util.execute_command("ls -l /etc/localtime")
            timezone = "/".join(output.strip().split("/")[-2:])
            facts["timezone"] = timezone
        except:
            log = logging.getLogger(self.__class__.__name__)
            log.exception("Unable to get Time Zone")
        return facts

def get_hardware_facts(self):
        """
        Gather CPU and memory specs for the machine
        """
        facts = {"hardware": {}}
        if "darwin" == sys.platform.lower():
            try:
                retcode, output = agent_util.execute_command(
                    "sysctl -a | grep machdep.cpu"
                )
                for line in output.strip().split("\n"):
                    try:
                        key, value = line.strip().split(":", 1)
                        if key in (
                            "machdep.cpu.brand_string",
                            "machdep.cpu.core_count",
                        ):
                            facts["hardware"][key] = value.strip()
                    except:
                        continue
            except:
                log = logging.getLogger(self.__class__.__name__)
                log.exception("Unable to get CPU hardware facts")

try:
                total_mem = os.sysconf("SC_PHYS_PAGES") * os.sysconf("SC_PAGE_SIZE")
                facts["hardware"]["mem_total"] = total_mem
            except:
                log = logging.getLogger(self.__class__.__name__)
                log.exception("Unable to get memory hardware facts")

else:
            try:
                retcode, output = agent_util.execute_command("lscpu")
                for line in output.strip().split("\n"):
                    try:
                        key, value = line.strip().split(":", 1)
                    except:
                        continue
                    key = key.strip().lower().replace("(s)", "").replace(" ", "_")
                    value = value.strip()
                    facts["hardware"][key] = value
            except:
                log = logging.getLogger(self.__class__.__name__)
                log.exception("Unable to get CPU hardware facts")

try:
                retcode, output = agent_util.execute_command("free -m")
                for line in output.strip().split("\n"):
                    fields = line.strip().split()
                    if fields[0].lower().startswith("mem"):
                        facts["hardware"]["mem_total"] = int(fields[1])
                    if fields[0].lower().startswith("swap"):
                        facts["hardware"]["swap_total"] = int(fields[1])
            except:
                log = logging.getLogger(self.__class__.__name__)
                log.exception("Unable to get memory hardware facts")

return facts

def get_agent_facts(self):
        facts = {}

# This is a little hokey, but the last time this file's metadata changed
        # *should* be when this file whas created, ie. when the Agent was
        # installed. I thought this was better than storing the install time in
        # the local database, since there is a possibility that it could get
        # corrupted.
        facts["installed_time"] = os.path.getctime(os.path.abspath(__file__))

facts["used_manifest"] = os.path.exists(self.agent.manifest_file)

facts["installed_from_repo"] = False
        for source_list_path in self.SOURCE_LIST_PATHS:
            if os.path.exists(source_list_path):
                try:
                    source_list = open(source_list_path)
                    facts["installed_from_repo"] = (
                        self.PANOPTA_REPO in source_list.read()
                    )
                    source_list.close()
                    if facts["installed_from_repo"]:
                        break
                except:
                    pass

brand = "panopta"
        if "darwin" == sys.platform or os.path.exists("/etc/fm-agent"):
            brand = "fortimonitor"
        # Set the agent brand, default to Panopta unless we have an FM-Agent config file
        facts["agent_brand"] = brand
        return facts

def get_python_facts(self):
        facts = {"python": {}}

facts["python"]["platform"] = platform.platform()
        facts["python"]["processor"] = platform.processor()
        facts["python"]["version"] = platform.python_version()
        facts["python"]["uname"] = platform.uname()
        try:
            facts["python"]["dist"] = platform.dist()
        except AttributeError:
            # Removed in Python 3.8.
            # https://docs.python.org/2.7/library/platform.html#platform.linux_distribution
            if distro:
                facts["python"]["dist"] = " ".join(distro.linux_distribution())
        facts["python"]["sys_platform"] = sys.platform

return facts

def get_cloud_facts(self):
        facts = {}

# Try Amazon
        try:
            # In order to support instances that require IMDSv2 we need to request a token first
            token = ""
            h = httplib.HTTPConnection("169.254.169.254", timeout=5)
            headers = {"X-aws-ec2-metadata-token-ttl-seconds": str(21600)}
            h.request("PUT", "/latest/api/token", headers=headers)
            r = h.getresponse()
            if r.status == 200:
                token = r.read().decode()
                headers = {"X-aws-ec2-metadata-token": token}
            else:
                headers = None

# The presence of headers indicates IMDSv2 call successful, include it the request.
            # Lack of headers would be a IMDSv1 call would be used instead.
            if headers:
                h.request(
                    "GET", "/latest/dynamic/instance-identity/document", headers=headers
                )
            else:
                h.request("GET", "/latest/dynamic/instance-identity/document")
            r = h.getresponse()
            if r.status == 200:
                data = json.loads(r.read())
                facts["cloud_provider"] = "aws"
                facts["cloud_instance_id"] = data["instanceId"]
                facts["cloud_metadata"] = data
                return facts
        except:
            pass

# Try Google
        try:
            headers = {"Metadata-Flavor": "Google"}
            h = httplib.HTTPConnection("metadata.google.internal", timeout=5)
            h.request(
                "GET", "/computeMetadata/v1/instance/?recursive=true", headers=headers
            )
            r = h.getresponse()
            if r.status == 200:
                data = json.loads(r.read())
                facts["cloud_provider"] = "gcp"
                facts["cloud_instance_id"] = data["id"]

# Strip out sensitive keys
                if "serviceAccounts" in data:
                    del data["serviceAccounts"]

for key, value in data.get("attributes", {}).items():
                    if key in [
                        "/attribute",
                        "/sshkeys",
                        "/vmdnssetting",
                        "/enable-oslogin",
                    ]:
                        data["attributes"].pop(key)
                facts["cloud_metadata"] = data
                try:
                    manifest = self.agent.get_manifest()
                    enabled_gcp_attributes = (
                        manifest.get("agent", "enable_gcp_attributes") == "true"
                    )
                    facts["cloud_metadata"]["enable_gcp_attributes"] = (
                        enabled_gcp_attributes
                    )
                except Exception:
                    log = logging.getLogger(self.__class__.__name__)
                    log.exception(
                        "Unable to parse manifest file to determine gcp attributes actions."
                    )
                return facts
        except:
            pass

# Try Azure
        try:
            headers = {"Metadata": "true"}
            h = httplib.HTTPConnection("169.254.169.254", timeout=5)
            h.request(
                "GET", "/metadata/instance?api-version=2017-04-02", headers=headers
            )
            r = h.getresponse()
            if r.status == 200:
                data = json.loads(r.read())
                facts["cloud_provider"] = "azure"
                facts["cloud_instance_id"] = data["compute"]["vmId"]
                facts["cloud_metadata"] = data
                return facts
        except:
            pass

# No cloud detected
        return {}

def get_process_facts(self):
        facts = {}

if psutil is None:
            return facts

processes = set()
        for proc in psutil.process_iter():
            processes.add(proc.name())

facts["processes"] = list(processes)
        return facts

def get_machine_facts(self):
        md = {}
        if "darwin" != sys.platform:
            return md
        facts = {"machine_description": md}
        try:
            tk = "SPHardwareDataType"
            data = self.query_system_profiler(tk)
            if data:
                info = data[tk][0]
                md["serial"] = info.get("serial_number", "")
                md["model"] = info.get("machine_model", "")
        except:
            facts.clear()
        return facts

def get_wifi_facts(self, wifi_info=None):
        md = {}
        if not wifi_info:
            return md
        facts = {"DEMWifiInfo": md}
        facts.update(wifi_info)
        md["timestamp"] = datetime.utcnow().timestamp()
        return facts

def get_dem_network_facts(self):
        if "darwin" != sys.platform:
            return {}
        md = []
        facts = {"DEMNetworkInterfaceConfigurations": md}
        try:
            tk = "SPNetworkDataType"
            info = self.query_system_profiler(tk)
            if info:
                network_infos = info.get(tk, [])
                for ni in network_infos:
                    router = ni.get("IPv4", {}).get("Router", None)
                    if not router:
                        continue
                    item = {
                        "name": ni.get("_name"),
                        "description": ni.get("hardware"),
                        "dns_servers": [],
                        "gateways": [router],
                    }
                    md.append(item)
                    dns_info = ni.get("DNS", None)
                    if dns_info:
                        for sa in dns_info.get("ServerAddresses", []):
                            item["dns_servers"].append(sa)

except:
            logging.exception("get_dem_network_facts")
            facts.clear()
        return facts

def query_system_profiler(self, info_type):
        try:
            sp = agent_util.which("system_profiler")
            from subprocess import Popen, PIPE

d = Popen([sp, "-json", info_type], stdout=PIPE)
            data = json.loads(d.stdout.read())
            return data
        except:
            logging.exception("query_system_profiler")
            return None