Add hpfeeds, structured logging

.gitignore

@@ -7,3 +7,17 @@ README.md~
 dist/*
 build/*
 rdpy.egg-info/*
+
+.idea/modules.xml
+
+.idea/rdpy.iml
+
+.idea/vcs.xml
+
+.idea/workspace.xml
+
+1
+
+2
+
+3

bin/rdpy-rdphoneypot.py

@@ -22,13 +22,14 @@
 RDP Honey pot use Rss scenario file to simulate RDP server
 """
 
-import sys, os, getopt, time
+import sys, os, getopt, time, datetime
 
-from rdpy.core import log, error, rss
+from rdpy.core import log, error, rss, hpfeedslog
 from rdpy.protocol.rdp import rdp
 from twisted.internet import reactor
 
 log._LOG_LEVEL = log.Level.INFO
+hpfeedslog._LOG_LEVEL = hpfeedslog.Level.INFO
 
 class HoneyPotServer(rdp.RDPServerObserver):
     def __init__(self, controller, rssFileSizeList):
@@ -55,16 +56,13 @@ def onReady(self):
             size = width * height
             rssFilePath = sorted(self._rssFileSizeList, key = lambda x: abs(x[0][0] * x[0][1] - size))[0][1]
             log.info("select file (%s, %s) -> %s"%(width, height, rssFilePath))
+            hpfeedslog.info("select file (%s, %s) -> %s"%(width, height, rssFilePath))
             self._rssFile = rss.createReader(rssFilePath)
 
         domain, username, password = self._controller.getCredentials()
         hostname = self._controller.getHostname()
-        log.info("""Credentials:
-        \tdomain : %s
-        \tusername : %s
-        \tpassword : %s
-        \thostname : %s
-        """%(domain, username, password, hostname));
+        log.info("\n%s,domain:%s,username:%s,password:%s,hostname:%s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), domain, username, password, hostname));
+        hpfeedslog.info("%s, domain:%s, username:%s, password:%s, hostname:%s "%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), domain, username, password, hostname));
         self.start()
 
     def onClose(self):
@@ -125,7 +123,8 @@ def buildObserver(self, controller, addr):
         @param addr: destination address
         @see: rdp.ServerFactory.buildObserver
         """
-        log.info("Connection from %s:%s"%(addr.host, addr.port))
+        log.info("\n%s,Connection from %s:%s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), addr.host, addr.port))
+        hpfeedslog.info("%s, Connection from %s:%s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), addr.host, addr.port))
         return HoneyPotServer(controller, self._rssFileSizeList)
 
 def readSize(filePath):
@@ -150,6 +149,9 @@ def help():
             [-l listen_port default 3389] 
             [-k private_key_file_path (mandatory for SSL)] 
             [-c certificate_file_path (mandatory for SSL)] 
+
+    Set the following env variables for hpfeeds-logging
+            HPFEEDS_SERVER, HPFEEDS_IDENT, HPFEEDS_SECRET, HPFEEDS_PORT, SERVERID, HPFEEDS_CHANNEL
     """
 
 if __name__ == '__main__':
@@ -175,10 +177,13 @@ def help():
 
     #build size map
     log.info("Build size map")
+    #hpfeedslog.info("Build size map")
+
     for arg in args:
         size = readSize(arg)
         rssFileSizeList.append((size, arg))
         log.info("(%s, %s) -> %s"%(size[0], size[1], arg))
-
+        #hpfeedslog.info("(%s, %s) -> %s"%(size[0], size[1], arg))
+
     reactor.listenTCP(int(listen), HoneyPotServerFactory(rssFileSizeList, privateKeyFilePath, certificateFilePath))
-    reactor.run()
+    reactor.run()

rdpy/core/hpfeedslog.py

@@ -0,0 +1,97 @@
+#
+# Copyright (c) 2014-2015 Sylvain Peyrefitte
+#
+# This file is part of rdpy.
+#
+# rdpy is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+import hpfeeds
+import os
+
+"""
+hpfeeds log engine in RDPY
+Only logs messages
+"""
+
+class Level(object):
+    """
+    @summary: Level log
+    """
+    DEBUG = 0
+    INFO = 1
+    WARNING = 2
+    ERROR = 3
+    NONE = 4
+
+_LOG_LEVEL = Level.DEBUG
+serverid=os.environ.get('SERVERID')
+hpc=None
+
+if (os.environ.get('HPFEEDS_SERVER') and os.environ.get('HPFEEDS_SECRET') and os.environ.get(
+        'HPFEEDS_IDENT') and os.environ.get('HPFEEDS_PORT') and os.environ.get('HPFEEDS_CHANNEL') and os.environ.get('SERVERID')):
+    try:
+        hpc = hpfeeds.new(os.environ.get('HPFEEDS_SERVER'), int(os.environ.get('HPFEEDS_PORT')), os.environ.get('HPFEEDS_IDENT'), os.environ.get('HPFEEDS_SECRET'))
+    except (hpfeeds.FeedException, socket.error, hpfeeds.Disconnect), e:
+        print "hpfeeds connection not successful"
+        print 'Exception while connecting: {0}'.format(e)
+
+def log(message):
+    """
+    @summary: Main log function
+    @param message: string to print
+    """
+    send_hpfeeds("Log: %s "%message)
+
+def error(message):
+    """
+    @summary: Log error message
+    @param message: string to print as error log
+    """
+    if _LOG_LEVEL > Level.ERROR:
+        return
+    send_hpfeeds("Error: %s "%message)
+
+
+def warning(message):
+    """
+    @summary: Log warning message
+    @param message: string to print as warning log
+    """
+    if _LOG_LEVEL > Level.WARNING:
+        return
+    send_hpfeeds("Warning: %s "%message)
+
+def info(message):
+    """
+    @summary: Log info message
+    @param message: string to print as info log
+    """
+    if _LOG_LEVEL > Level.INFO:
+        return
+    send_hpfeeds("Info: %s "%message)
+
+def debug(message):
+    """
+    @summary: Log debug message
+    @param message: string to print as debug log
+    """
+    if _LOG_LEVEL > Level.DEBUG:
+        return
+    send_hpfeeds("Debug: %s "%message)
+
+def send_hpfeeds(message):
+    if hpc:
+        hpfchannel = os.environ.get('HPFEEDS_CHANNEL')
+        hpc.publish(hpfchannel, "["+serverid+"] " +message)

setup.py

@@ -43,5 +43,6 @@
           	'qt4reactor',
           	'rsa',
           	'pyasn1',
+			'hpfeeds'
 	  	],
 )