C:/work/RevealedSystems/EyeSpy-RS/eyespy/src/objects/logic/process/extXportTableDict.py

Go to the documentation of this file.

# Copyright (C) 2008-2009  Mark Hanegraaff
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import ExtendedXportTable
from threading import  RLock
from objects.logic.common.logger import logger


PROCESS_RUNNING       = "PROCESS_RUNNING"
PROCESS_TERMINATED    = "PROCESS_TERMINATED"



## This extXportTableDict class is a singleton which knows how to return the one and only instance of the __xportImpl class.
# All access to the __xportImpl is transparent, in that extXportTableDict will use __getattr__ and __setattr__ to delegate the actual method calls.
class extXportTableDict():
    
    __instance = None
    
    def __init__(self):
        if extXportTableDict.__instance is None:
            extXportTableDict.__instance = extXportTableDict.__xportImpl()
        
        # todo, what effect does this have?
        self.__dict__['_extXportTableDict__instance'] = extXportTableDict.__instance

    
            
    ##
    #  Delegate access to implementation 
    def __getattr__(self, attr):
        return getattr(self.__instance, attr)

    ##
    #  Delegate access to implementation 
    def __setattr__(self, attr, value):
        return setattr(self.__instance, attr, value)
        
        
        
    ## Actual implementation class for extXportTableDict.
    # This needs to be alive for the duration of the application for a number of reasons.
    # For starters this class (or its single instance) will keep running Dictionaries of all processes (past or present) on
    # the system, as well as information pertaining to them.
    # For additonal information, see the included extendedTCPTableLib C/SWIG wrapper module
    class __xportImpl():
                
        def __init__(self):
            self.lck = RLock()
            
            # dictionary of all active connections 
            # (i.e. anything contained in the current TCP Table) 
            #
            # {SourcePort: {processDict}}
            self.activeTCPDict = dict()
            
            # dictionary of all connections, active or inactive.
            # this dictionary will continually grow during the 
            # application lifetime
            #
            # {SourcePort: {processDict}}
            self.globalTCPDict = dict()
            
            # simple dictionary of all distinct process names
            # {procName: 1}
            self.procNameDict  = dict()
            
        
        
        ## Returns the process Dictionary associated with the supplied source port
        # @param srcPort Integer
        # @return Dictionary
        def getXportTableInfo(self, srcPort):
    
            nodeInfo, processState = self.__findInCache(srcPort)
            
            # look in cache first
            if (nodeInfo == None):            
                self.updateAllDicts();
            else:
                # if not found, load TCP and UPD table again
                return nodeInfo, processState
            
            # return anything found
            return self.__findInCache(srcPort)
                
            
        
        ## Checks the "active process dictionary" (as in latest TCP table dump) and the "global process dictionary"
        # (as in all processes seed thus far) for the process Dictionary matching the supplied source port.
        # This is a helper function to the getXportTableInfo method. 
        # @param srcPort Integer
        # @return Dictionary     
        def __findInCache(self, srcPort):
            
            k = srcPort
            
            # first check the active dictionary
            self.lck.acquire(1)
            try:                
                try:
                    # first check the active dictionary
                    return self.activeTCPDict[k], PROCESS_RUNNING
                except KeyError:
                    try:
                        return self.globalTCPDict[k], PROCESS_TERMINATED
                    except KeyError:
                        #print "Not Found in cache"
                        return None, None
                
            except Exception, err:
    
                logger.log(__name__ + ": There was an exception finding process information: ")
                logger.log(__name__ + str(err) )
    
            finally:
                self.lck.release()
        
        ## Takes a snapshot of the current TCP table, and updates all internal dictionaries.
        def updateAllDicts(self):        
            # now update the various dictionaries
            self.lck.acquire(1)
            
            try:
                #get latest extended TCP table.
                ExtendedXportTable.updateV4Tables()
                tableSize = ExtendedXportTable.getV4TableSize()
            
                #clear the active TCP dictionary
                self.activeTCPDict.clear()
                for i in range(0, tableSize):
                    # get the dictionary key
                    srcPort = ExtendedXportTable.getV4SrcPort(i)
                    
                    key = srcPort
                    
                    # now generated its value
                    nodeInfo = dict()
                    nodeInfo["Pid"]             =  ExtendedXportTable.getV4Pid(i)
                    nodeInfo["ProcessName"]     =  ExtendedXportTable.getV4ProcessName(i)                
                    nodeInfo["SourcePort"]      =  ExtendedXportTable.getV4SrcPort(i)
                    nodeInfo["Transport"]       =  ExtendedXportTable.getV4Transport(i)
                    
                    self.activeTCPDict[key] = nodeInfo
                    self.globalTCPDict[key] = nodeInfo
                    
                    self.procNameDict[nodeInfo["ProcessName"].lower()] = 1
                    
            except Exception, err:
                
                logger.log(__name__ + "There was error populating TCP Table Dictionaries")
                logger.log(__name__ + str(err))
                
                # do something here
            finally:
                self.lck.release()
                
        """
            static methods
        """
        
        
        ## Returns a dictionary containing all distinct process names (lower case)
        # and whether they are currently running or not.
        def getEnrichedProcessDict(self):
            
            self.lck.acquire(1)
            
            try:                
                # this dictionary is only used to avoid duplicates
                procDict = dict()
                
                #get latest extended TCP table.
                ExtendedXportTable.updateV4Tables()
                tableSize = ExtendedXportTable.getV4TableSize()
                
                # get a snapshot of current processes.
                for i in range(0, tableSize):
                    procName = ExtendedXportTable.getV4ProcessName(i)
                    if procName != "UNKNOWN" and procName != "unknown":
                        procDict[procName.lower()] = "Yes"
                        
                # now add all processes which were currently accrued
                for key, val in self.procNameDict.iteritems():
                    if not procDict.has_key(key.lower()):
                        if key != "UNKNOWN" and key != "unknown":
                            procDict[key.lower()] = "No"
                
                return procDict
                
                        
                
            except Exception, err:
                
                logger.log(__name__ + "There was error populating TCP Table Dictionaries")
                logger.log(__name__ + str(err))
                
                raise Exception, err
                
            finally:
                self.lck.release()
                
        """
            Various helped Functions
        """
        
        ## Converts an Integer into dotted IP Address string
        # @param n Integer representing IP Address
        # @return String
        def __IPnumToString(self, n):
            d = 256 * 256 * 256
            q = []
            while d > 0:
                m,n = divmod(n,d)
                q.append(str(m))
                d = d/256
        
            return '.'.join(q)

    
        
        

---