C:/work/RevealedSystems/EyeSpy-RS/eyespy/src/objects/logic/entity/entityManager.py

Go to the documentation of this file.

# Copyright (C) 2008-2009  Mark Hanegraaff
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import socket
from objects.logic.common.exception import exception
from objects.logic.entity.networkEntity import networkEntity
from objects.logic.entity.entityStatistics import entityStatistics
from objects.logic.common.logger import logger

from objects.logic.process.extXportTableDict import extXportTableDict
from objects.logic.network.packetDecoder import packetDecoder
from objects.logic.common.globalStrings import globalStrings
from objects.logic.common.observerInterface import observerInterface

from threading import  RLock
import win32com.client
import pyproj, sys, os
import time

import copy


## The entityManager class maintains two dictionaries of entities in the form of:
#
# {[ip,dstPort]: networkEntity} and  
# {(lon, lat): networkEntityList()}.
#
# The first dictionary is optimized for fast lookup of an individual networkEntiry, since the dictionary is a 1-1 match.
# The second dictionary is optimized for the map Drawing cycle.
# Both dictionaries are built on the fly for performance reasons.
# The entityManager class is also one of the consumers of the networkMonitor objects, building the dictionary as it is fed new packets. 
class entityManager(observerInterface):
    def __init__(self):
        
        #{[destIP,destPost]: entity}
        self.entityCollection = dict()
        self.stats            = entityStatistics()
        
        # a filtered dictionary, by its primary key        
        self.filteredColl         = dict()
        # a filtered dictionary, by location
        self.filteredCollByLoc    = dict()
        
        self.currentIPAddress = None
        self.selfIPList       = None
        self.selfIPAddress    = None
        
        self.lck              = RLock()
        
        self.geoIP            = None
        
        self.getHostIPList()  
        self.intializeIPDatabase()
        
        self.xportTableDict = extXportTableDict()
        
        self.decoder = packetDecoder()
        self.decoder.setDefaultReader()
        
        self.cnt = 0
    
    
    ## Clears the internal networkEntity dictionaries 
    def removeAllEntities(self):
        self.lck.acquire(1)                    
        try:
            self.entityCollection     = dict() 
            self.filteredColl         = dict()        
            self.filteredCollByLoc    = dict()              
        finally:
            self.lck.release()
    
    def getEntityCollectionSize(self):
        return len(self.entityCollection)
    
    
    ## Initialize the MaxMind GEO IP Database.    
    # TODO -- handle exceptions caused by the DLL not being properly installed
    # DLL is installted by copying GeoIpComEx.dll to the windows/system32 folder (or windows/syswow64 for 64 bit version of windows) and
    # then registering it.
    def intializeIPDatabase(self):        
        self.geoIP = win32com.client.Dispatch("GeoIPCOMEx.GeoIPEx")        
        geoIPDBLocation = os.sep.join([os.path.dirname(__file__), globalStrings.geoIPDBLocation()])
        
        
        print geoIPDBLocation
        self.geoIP.set_db_path(geoIPDBLocation)
        
    def getSafeEntityCollectionByPK(self):        
        newDict = None
        # lock the object
        self.lck.acquire(1)                    
        try:
            newDict =  self.entityCollection.copy()                
        finally:
            self.lck.release()
        
        return newDict

    
    ## Returns a subset of the "master" networkEntity Dictionary filtered by the supplied "filter" object.
    # If "filter" is None, then just return a copy of the previously filtered collection.
    # This is done to reduce the nummber of filtering operations, since this can become time consuming if the Dictionary becomes large.
    # Since The entity collection is indexed by its primary key, so each
    # dictionary key has exactly one element.
    # @param filter baseFilter derived filter object
    # @return Dictionary in the form of: {[ip,dstPort]: networkEntity}.
    def getSafeFilteredEntityCollectionByPK(self, filter):
        
        start = time.time()
          
        if filter == None:
            return self.filteredColl.copy() 
        
        else:        
            # lock the object
            self.lck.acquire(1)
            try:                
                self.filteredDict.clear()
                
                for key, netEnt in self.entityCollection.iteritems():
                    if filter.shouldDisplayEntity(netEnt):                    
                        self.filteredColl[key] = netEnt                
            finally:
                self.lck.release()
        
        end = time.time()
        msg = "getSafeFilteredEntityCollectionByPK: %3.4f to process %d Items" % (end - start, len(self.entityCollection))
        #print msg
        
        return self.filteredColl.copy()    
                        
    
    
    ## Returns a subset of the networkEntity dictionary keyed by Geographical location. 
    # This is done to keep track of of multiple entities at distinct locations 
    # which facilitate the main Map redraw cycle. This list will essentially contain
    # the same information as a filtered entity collection, but it will
    # be keyed by location rather than its primary key. 
    #    
    # The key of the dictionary is the longitude/latitude pair.
    # the value is an small list of all entities at that
    # particular location.
    # @param filter baseFilter derived filter object
    # @return Dictionary in the form of: {(lon, lat): entityList() }
    def getSafeFilteredEntityCollectionByGeoLoc(self, filter):
        
        start = time.time()
        
        insertIntoList = True
          
        if filter == None:
            return copy.copy(self.filteredCollByLoc)
        
        else:        
            # lock the object
            self.lck.acquire(1)
            try:
                self.filteredCollByLoc.clear()
                
                for key, netEnt in self.entityCollection.iteritems():
                        if filter.shouldDisplayEntity(netEnt):
                            
                            lon = netEnt.foreignLongitude
                            lat = netEnt.foreignLatitude
                                                        
                            newKey = (lon, lat)
                            if not self.filteredCollByLoc.has_key(newKey):                                
                                self.filteredCollByLoc[newKey] = list()  
                                 
                            self.filteredCollByLoc[newKey].append(netEnt)
                                    
                                         
            finally:
                self.lck.release()
                
            end = time.time()
            msg = "getSafeFilteredEntityCollectionByGeoLoc: %3.4f to process %d Items" % (end - start, len(self.entityCollection))
            #print msg
                        
            return copy.copy(self.filteredCollByLoc)
    
    
    def __getattr__(self, name):    
        if name == 'geoIP':
            return self.geoIP
        
        logger.log(__name__ + ": Cannot get [" + name + "] attribute")
        raise AttributeError, name
        
    
    ## Pcapy lacks the ability to derive any meaningful information (like an IP address) from a NPF device name.
    # This functions will retrieve all IP addresses allocated by the system.
    # This list will then be used to "guess" to source IP (as the this Computer's IP) by looking at the rest of the IP traffic.    
    def getHostIPList(self):
        hostnameInfo = socket.gethostbyname_ex(socket.gethostname())
                
        self.hostIPList = hostnameInfo[2] 
        print self.hostIPList
        
    ## Implementation of observer method. this class is an observer of the networkMonitor class
    def update(self, header, data):    
        
        #self.cnt += 1
        #print "%d" % (self.cnt)  
          
        decodedPacketDict = self.decoder.decodePacket(header, data)
        
        if decodedPacketDict == None:
            logger.log(__name__ + "Will not process packet because could not decode")
            return
        
        # in case of an ICMP packet, only Ping type requests should be allowed to
        # be displayed as entities
        if self.decoder.getXportProtocolString(decodedPacketDict['transportProtocol']) == 'ICMP':
            if not self.decoder.isPing(decodedPacketDict['networkHeader'], decodedPacketDict['transportHeader']):
                return    
        try:
            self.processDataPacket(decodedPacketDict);
        except exception, ex:
            pass

        
    
    ## Looks at decoded packet Dictionary, and tried to guess which IP address is the one assigned to the current PC.
    # @param decodedPackeDict Dictionary
    # @return Either the source or destination IP Address. Whichever is the "Self" Address.
    def extractSelfIPAddress(self, decodedPackeDict):
        if decodedPackeDict['sourceIP'] in self.hostIPList:
            return decodedPackeDict['sourceIP']
        
        if decodedPackeDict['destIP'] in self.hostIPList:
            return decodedPackeDict['destIP']
        
        raise exception("Could not identify the IP Address of this device.", True)
    
    
    
    ## processes a single decoded packet Dictionary.
    # @param decodedPacketDict Decoded packet Dictionary
    def processDataPacket(self, decodedPacketDict): 
                       
        if self.selfIPAddress == None:
            self.selfIPAddress = self.extractSelfIPAddress(decodedPacketDict)
            logger.log(__name__ + ":" + self.selfIPAddress)
        
        # lock the object
        self.lck.acquire(1)
        
        try:
            # create a list used as s key for the entity dictionary        
            key = list()

            if self.selfIPAddress == decodedPacketDict['sourceIP']:
                NodeInfo, procState = self.xportTableDict.getXportTableInfo(decodedPacketDict['sourcePort'])
                
                if NodeInfo == None:
                    Pid = "0"
                else:
                    Pid = "%d" % NodeInfo["Pid"]
        
                key = (decodedPacketDict['destIP'], Pid)                            
            else:
                NodeInfo, procState = self.xportTableDict.getXportTableInfo(decodedPacketDict['destPort'])
                
                if NodeInfo == None:
                    Pid = "0"
                else:
                    Pid = "%d" % NodeInfo["Pid"]
            
                key = (decodedPacketDict['sourceIP'], Pid)
            
            if not self.entityCollection.has_key(key):            
                self.entityCollection[key] = networkEntity(self.selfIPAddress, decodedPacketDict, self.geoIP, self.xportTableDict)
            
            # process the packet 
            self.entityCollection[key].computeStatistics(decodedPacketDict)
            
        except Exception, ex:
                logger.log(__name__ + ": There was an exception processing decoded packet")
                logger.log(ex)
        finally:
            self.lck.release()
                

---