1
2
3
4
5
6 """IRC Protocol"""
7
8 import cStringIO
9 import re
10 import logging
11
12 from lib.cuckoo.common.utils import convert_to_printable
13
14 log = logging.getLogger("Processing.Pcap.irc.protocol")
15
16
18 """IRC Protocol Request."""
19
20
21 __methods_client = dict.fromkeys(( "PASS", "JOIN", "USER", "OPER", "MODE", "SERVICE", "QUIT", "SQUIT",
22 "PART", "TOPIC", "NAMES", "LIST", "INVITE",
23 "KICK", "PRIVMSG", "NOTICE", "MOTD", "LUSERS", "VERSION", "STATS", "LINKS", "TIME", "CONNECT",
24 "TRACE", "ADMIN", "INFO", "SERVLIST",
25 "SQUERY", "WHO", "WHOIS", "WHOWAS", "KILL", "PING", "PONG", "ERROR", "AWAY", "REHASH", "DIE", "RESTART",
26 "SUMMON", "USERS", "WALLOPS",
27 "USERHOST", "NICK", "ISON"
28 ))
29
31 self._messages = []
32
33 self._sc = {}
34
35 self._cc = {}
36
38 """Extract into a list irc messages of a tcp streams.
39 @buf: tcp stream data
40 """
41 try:
42 f = cStringIO.StringIO(buf)
43 lines = f.readlines()
44 except Exception:
45 log.error("Failed reading tcp stream buffer")
46 return False
47
48 for element in lines:
49 if not re.match("^:", element) is None:
50 command = "([a-zA-Z]+|[0-9]{3})"
51 params = "(\x20.+)"
52 irc_server_msg = re.findall("(^:[\w+.{}!@|()]+\x20)"+command+params,element)
53 if irc_server_msg:
54 self._sc["prefix"] = convert_to_printable(irc_server_msg[0][0].strip())
55 self._sc["command"] = convert_to_printable(irc_server_msg[0][1].strip())
56 self._sc["params"] = convert_to_printable(irc_server_msg[0][2].strip())
57 self._sc["type"] = "server"
58 self._messages.append(dict(self._sc))
59 else:
60 irc_client_msg = re.findall("([a-zA-Z]+\x20)(.+[\x0a\0x0d])",element)
61 if irc_client_msg and irc_client_msg[0][0].strip() in self.__methods_client:
62 self._cc["command"] = convert_to_printable(irc_client_msg[0][0].strip())
63 self._cc["params"] = convert_to_printable(irc_client_msg[0][1].strip())
64 self._cc["type"] = "client"
65 self._messages.append(dict(self._cc))
66
68 """Get irc client commands of tcp streams.
69 @buf: list of messages
70 @return: dictionary of the client messages
71 """
72
73 try:
74 self._unpack(buf)
75 except Exception:
76 return None
77
78 entry_cc = []
79 for msg in self._messages:
80 if msg["type"] == "client":
81 entry_cc.append(msg)
82
83 return entry_cc
84
86 """Get irc client commands of tcp streams.
87 @buf: list of messages
88 @return: dictionary of the client messages filtered
89 """
90 try:
91 self._unpack(buf)
92 except Exception:
93 return None
94
95 entry_cc = []
96
97 for msg in self._messages:
98 if msg["type"] == "client" and msg["command"] not in filters:
99 entry_cc.append(msg)
100
101 return entry_cc
102
104 """Get irc server commands of tcp streams.
105 @buf: list of messages
106 @return: dictionary of server messages
107 """
108
109 try:
110 self._unpack(buf)
111 except Exception:
112 return None
113
114 entry_sc = []
115
116 for msg in self._messages:
117 if msg["type"] == "server":
118 entry_sc.append(msg)
119
120 return entry_sc
121
123 """Get irc server commands of tcp streams.
124 @buf: list of messages
125 @return: dictionary of server messages filtered
126 """
127 try:
128 self._unpack(buf)
129 except Exception:
130 return None
131
132 entry_sc = []
133 for msg in self._messages:
134 if msg["type"] == "server" and msg["command"] not in filters:
135 entry_sc.append(msg)
136
137 return entry_sc
138
140 """Check if there is irc messages in a stream TCP.
141 @buf: stream data
142 @return: boolean result
143 """
144
145 try:
146 self._unpack(buf)
147 if self._messages:
148 return True
149 else:
150 return False
151 except Exception:
152 return False
153