cuckoobox/cuckoo — pull request #75 by Locker537 (2013-02-26 21:35:43+00:00)
Title: Physical machine manager using Fog

Included you will find a new machine manager, `fog.py`, related `fog.conf`, and a few changes to `agent.py` and `guest.py` to support working with fog.

Imaging a sandbox to a clean state occurs completely outside of cuckoo. At the end of an analysis task, the machine manager instructs the agent to reboot via the guest manager. Upon reboot, a sandbox phones home to fog, discovers a waiting imaging task, images itself, and boots into a clean state. For a vanilla Windows XP SP3 install, the entire reboot, image, reboot into a clean image process takes on the order of 3-5 minutes on a commodity machine. I've been testing against 5-6 year old Dell Optiplex boxes, for what it is worth.

Documentation for setting up fog to work in this scenario will be inbound in another pull request. Essentially, fog is configured to blindly create an imaging task every few minutes, ensuring there is a task waiting for the sandbox when it reboots. A future version of the fog machine manager will most likely be more tightly integrated with fog itself, programmatically creating fog imaging tasks for the appropriate sandbox on the fly instead of relying on fog's "scheduled imaging tasks" feature.

This code has been tested against the cuckoo `development` branch.