Reverse Engineering Internet MIBs J urgen Sch onw alder Computer - PowerPoint PPT Presentation

Reverse Engineering Internet MIBs J¨ urgen Sch¨ onw¨ alder Computer Science Department Technical University Braunschweig B¨ ultenweg 74/75 38106 Braunschweig Germany Tel.: +49 531 391 3289 Email: <schoenw@ibr.cs.tu-bs.de> Web: <http://www.ibr.cs.tu-bs.de/˜schoenw/> J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 1

MIB Engineering Process Explicit conceptual models... Requirements • improve consistency (important when authors change) Conceptual Model • simplify quality assurance processes (MIB police) • enable more efficient and extensible applications Data Model • reduce long-term software maintenance costs MIB compiler • are generally useful for educational purposes Implementation • simplify integration into more comprehensive models J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 2

Reality is not always nice... Brainstorming Conceptual Model Data Model MIB compiler Implementation J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 3

Reality is not always nice... Brainstorming • Is it possible to reverse engineer conceptual models? Conceptual Model • Can this reverse engineering process be automated? semi automatic Data Model • What is the best way to represent conceptual models? MIB compiler Implementation J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 4

Representation of Conceptual MIB Models with UML 1. UML classes representing MIB definitions use the ≪ smi mib class ≫ stereotype. 2. MIB table rows are represented as UML classes. 3. Scalars that are logically bound to MIB tables are shown as class attributes. 4. Unbound scalars are shown as class attributes of additional auxiliary classes. 5. Notifications are assigned to classes and shown as private operations. 6. Class attributes that identify a class instance are marked with the { index } UML property. 7. SMI access modes are mapped to standard UML visibility attributes. J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 5

Conceptual Model of the IF-MIB (RFC 2863, RFC 2864) «smi mib class» ifStackEntry +ifStackLastChange: TimeTicks -ifStackHigherLayer: InterfaceIndexOrZero {index} -ifStackLowerLayer: InterfaceIndexOrZero {index} +ifStackStatus: RowStatus 1 is stacked on reorders 1 lower layer «smi mib class» 0..1 ifInvStackEntry higher layer «smi mib class» ifEntry 0..1 -ifStackLowerLayer: InterfaceIndexOrZero {index} -ifStackHigherLayer: InterfaceIndexOrZero {index} +ifNumber: Integer32 +ifInvStackStatus: RowStatus +ifLastChange: TimeTicks +ifIndex: InterfaceIndex {index} +ifDescr: DisplayString augments +ifType: IANAifType +ifMtu: Integer32 +ifSpeed: Gauge32 «smi mib class» ifXEntry +ifPhysAddress: PhysAddress +ifAdminStatus: Enumeration -ifIndex: InterfaceIndex {index} +ifOperStatus: Enumeration +ifName: DisplayString +ifLastChange: TimeTicks +ifInMulticastPkts: Counter32 +ifInOctets: Counter32 +ifInBroadcastPkts: Counter32 +ifInUcastPkts: Counter32 +ifOutMulticastPkts: Counter32 +ifInDiscards: Counter32 +ifOutBroadcastPkts: Counter32 +ifInErrors: Counter32 +ifHCInOctets: Counter64 +ifInUnknownProtos: Counter32 +ifHCInUcastPkts: Counter64 +ifOutOctets: Counter32 +ifHCInMulticastPkts: Counter64 +ifOutUcastPkts: Counter32 +ifHCInBroadcastPkts: Counter64 +ifOutDiscards: Counter32 +ifHCOutOctets: Counter64 +ifOutErrors: Counter32 +ifHCOutUcastPkts: Counter64 -linkDown(ifIndex,ifAdminStatus,ifOperStatus) +ifHCOutMulticastPkts: Counter64 -linkUp(ifIndex,ifAdminStatus,ifOperStatus) +ifHCOutBroadcastPkts: Counter64 1 +ifLinkUpDownTrapEnable: Enumeration expands +ifHighSpeed: Gauge32 +ifPromiscuousMode: TruthValue +ifConnectorPresent: TruthValue 0..* +ifAlias: DisplayString «smi mib class» ifRcvAddressEntry +ifCounterDiscontinuityTime: TimeStamp -ifIndex: InterfaceIndex {index} -ifRcvAddressAddress: PhysAddress {index} +ifRcvAddressStatus: RowStatus +ifRcvAddressType: Enumeration J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 6

Conceptual Model of the HOST-RESOURCES-MIB (RFC 2790) «smi mib class» «smi mib class» hrSystem hrSWInstalledEntry +hrSystemUptime: TimeTicks +hrSWInstalledLastChange: TimeTicks +hrSystemDate: DateAndTime +hrSWInstalledLastUpdateTime: TimeTicks +hrSystemInitialLoadDevice: Integer32 +hrSWInstalledIndex: Integer32 {index} +hrSystemInitialLoadParameters: InternationalDisplayString +hrSWInstalledName: InternationalDisplayString +hrSystemNumUsers: Gauge32 +hrSWInstalledID: ProductID +hrSystemProcesses: Gauge32 +hrSWInstalledType: Enumeration +hrSystemMaxProcesses: Integer32 +hrSWInstalledDate: DateAndTime +hrMemorySize: KBytes «smi mib class» «smi mib class» hrSWRunEntry hrSWRunPerfEntry augments +hrSWOSIndex: Integer32 +hrSWRunIndex: Integer32 {index} +hrSWRunIndex: Integer32 {index} +hrSWRunPerfCPU: Integer32 +hrSWRunName: InternationalDisplayString +hrSWRunPerfMem: KBytes +hrSWRunID: ProductID +hrSWRunPath: InternationalDisplayString +hrSWRunParameters: InternationalDisplayString +hrSWRunType: Enumeration +hrSWRunStatus: Enumeration «smi mib class» extends hrProcessorEntry +hrDeviceIndex: Integer32 {index} +hrProcessorFrwID: ProductID +hrProcessorLoad: Integer32 «smi mib class» hrDeviceEntry extends +hrDeviceIndex: Integer32 {index} +hrDeviceType: AutonomousType «smi mib class» hrNetworkEntry +hrDeviceDescr: DisplayString 0..1 implements +hrDeviceID: ProductID +hrDeviceIndex: Integer32 {index} 0..1 +hrDeviceStatus: Enumeration +hrNetworkIfIndex: InterfaceIndexOrZero «smi mib class» +hrDeviceErrors: Counter32 IF-MIB::ifEntry 1 extends «smi mib class» hrPrinterEntry +hrDeviceIndex: Integer32 {index} +hrPrinterStatus: Enumeration +hrPrinterDetectedErrorState: OctetString exists on 0..* extends «smi mib class» hrPartitionEntry «smi mib class» hrDiskStorageEntry +hrDeviceIndex: Integer32 {index} +hrPartitionIndex: Integer32 {index} +hrDeviceIndex: Integer32 {index} +hrPartitionLabel: InternationalDisplayString +hrDiskStorageAccess: Enumeration +hrPartitionID: OctetString +hrDiskStorageMedia: Enumeration +hrPartitionSize: KBytes +hrDiskStorageRemoveble: TruthValue +hrPartitionFSIndex: Integer32 +hrDiskStorageCapacity: KBytes 0..* 0..1 «smi mib class» «smi mib class» resides on 0..1 hrFSEntry hrStorageEntry 0..* +hrFSIndex: Integer32 {index} +hrStorageIndex: Integer32 {index} +hrFSMountPoint: InternationalDisplayString +hrStorageType: AutonomousType +hrFSRemoteMountPoint: InternationalDisplayString +hrStorageDescr: DisplayString +hrFSType: AutonomousType +hrStorageAllocationUnits: Integer32 +hrFSAccess: Enumeration +hrStorageSize: Integer32 +hrFSBootable: TruthValue +hrStorageUsed: Integer32 +hrFSStorageIndex: Integer32 +hrStorageAllocationFailures: Counter32 +hrFSLastFullBackupDate: DateAndTime +hrFSLastPartialBackupDate: DateAndTime J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 7

Outline of the Reverse Engineering Algorithm 1. Create nodes for all tables and scalars. 2. Create edges for all existence relationships. 3. Reorder edges based on the commonality of normalized names. 4. Create edges for reference relationships by analyzing the usage of index types. 5. Create edges between tables based on common name prefixes. 6. Assign scalars to tables based on the commonality of normalized names. 7. Group nodes representing scalars with a common parent. 8. Create edges representing dependency relationships for tables which only contain “sup- porting objects” ( RowStatus , StorageType ). 9. Create edges for reference relationships by analyzing object names (*Index, *Pointer). 10. Assign notifications to nodes based on the mandatory objects. J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 8

Implementation • Implemented in C on top of the libsmi and integrated into the smidump MIB compiler. • Produces input for the dia UML editor. editing MIB module • Simple layout algorithm which usually requires reading smilint manual cleanup. Actor errors & warnings • Note that layout contains semantics and is hard viewing to automate. smidump -f xm-dia XML dia file • Probably need ways to tweak the heuristics. J. Sch¨ onw¨ alder Reverse Engineering Internet MIBs 16 May 2001, Slide 9