Package lib :: Package cuckoo :: Package common :: Module irc
[hide private]
[frames] | no frames]

Source Code for Module lib.cuckoo.common.irc

  1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
  2  # Copyright (C) 2012 JoseMi Holguin (@j0sm1) 
  3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
  4  # See the file 'docs/LICENSE' for copying permission. 
  5   
  6  """IRC Protocol""" 
  7   
  8  import cStringIO 
  9  import re 
 10  import logging 
 11   
 12  from lib.cuckoo.common.utils import convert_to_printable 
 13   
 14  log = logging.getLogger("Processing.Pcap.irc.protocol") 
 15   
 16   
17 -class ircMessage(object):
18 """IRC Protocol Request.""" 19 20 # Client commands 21 __methods_client = dict.fromkeys(( "PASS", "JOIN", "USER", "OPER", "MODE", "SERVICE", "QUIT", "SQUIT", 22 "PART", "TOPIC", "NAMES", "LIST", "INVITE", 23 "KICK", "PRIVMSG", "NOTICE", "MOTD", "LUSERS", "VERSION", "STATS", "LINKS", "TIME", "CONNECT", 24 "TRACE", "ADMIN", "INFO", "SERVLIST", 25 "SQUERY", "WHO", "WHOIS", "WHOWAS", "KILL", "PING", "PONG", "ERROR", "AWAY", "REHASH", "DIE", "RESTART", 26 "SUMMON", "USERS", "WALLOPS", 27 "USERHOST", "NICK", "ISON" 28 )) 29
30 - def __init__(self):
31 self._messages = [] 32 # Server commandis : prefix - command - params 33 self._sc = {} 34 # Client commands : command - params 35 self._cc = {}
36
37 - def _unpack(self, buf):
38 """Extract into a list irc messages of a tcp streams. 39 @buf: tcp stream data 40 """ 41 try: 42 f = cStringIO.StringIO(buf) 43 lines = f.readlines() 44 except Exception: 45 log.error("Failed reading tcp stream buffer") 46 return False 47 48 for element in lines: 49 if not re.match("^:", element) is None: 50 command = "([a-zA-Z]+|[0-9]{3})" 51 params = "(\x20.+)" 52 irc_server_msg = re.findall("(^:[\w+.{}!@|()]+\x20)"+command+params,element) 53 if irc_server_msg: 54 self._sc["prefix"] = convert_to_printable(irc_server_msg[0][0].strip()) 55 self._sc["command"] = convert_to_printable(irc_server_msg[0][1].strip()) 56 self._sc["params"] = convert_to_printable(irc_server_msg[0][2].strip()) 57 self._sc["type"] = "server" 58 self._messages.append(dict(self._sc)) 59 else: 60 irc_client_msg = re.findall("([a-zA-Z]+\x20)(.+[\x0a\0x0d])",element) 61 if irc_client_msg and irc_client_msg[0][0].strip() in self.__methods_client: 62 self._cc["command"] = convert_to_printable(irc_client_msg[0][0].strip()) 63 self._cc["params"] = convert_to_printable(irc_client_msg[0][1].strip()) 64 self._cc["type"] = "client" 65 self._messages.append(dict(self._cc))
66
67 - def getClientMessages(self, buf):
68 """Get irc client commands of tcp streams. 69 @buf: list of messages 70 @return: dictionary of the client messages 71 """ 72 73 try: 74 self._unpack(buf) 75 except Exception: 76 return None 77 78 entry_cc = [] 79 for msg in self._messages: 80 if msg["type"] == "client": 81 entry_cc.append(msg) 82 83 return entry_cc
84
85 - def getClientMessagesFilter(self, buf, filters):
86 """Get irc client commands of tcp streams. 87 @buf: list of messages 88 @return: dictionary of the client messages filtered 89 """ 90 try: 91 self._unpack(buf) 92 except Exception: 93 return None 94 95 entry_cc = [] 96 97 for msg in self._messages: 98 if msg["type"] == "client" and msg["command"] not in filters: 99 entry_cc.append(msg) 100 101 return entry_cc
102
103 - def getServerMessages(self, buf):
104 """Get irc server commands of tcp streams. 105 @buf: list of messages 106 @return: dictionary of server messages 107 """ 108 109 try: 110 self._unpack(buf) 111 except Exception: 112 return None 113 114 entry_sc = [] 115 116 for msg in self._messages: 117 if msg["type"] == "server": 118 entry_sc.append(msg) 119 120 return entry_sc
121
122 - def getServerMessagesFilter(self, buf, filters):
123 """Get irc server commands of tcp streams. 124 @buf: list of messages 125 @return: dictionary of server messages filtered 126 """ 127 try: 128 self._unpack(buf) 129 except Exception: 130 return None 131 132 entry_sc = [] 133 for msg in self._messages: 134 if msg["type"] == "server" and msg["command"] not in filters: 135 entry_sc.append(msg) 136 137 return entry_sc
138
139 - def isthereIRC(self, buf):
140 """Check if there is irc messages in a stream TCP. 141 @buf: stream data 142 @return: boolean result 143 """ 144 145 try: 146 self._unpack(buf) 147 if self._messages: 148 return True 149 else: 150 return False 151 except Exception: 152 return False
153