Python email.Email类代码示例

def indicator_from_header_field(request, email_id):
    """
    Create an indicator from a header field. Should be an AJAX POST.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to get the header from.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """

    if request.method == "POST" and request.is_ajax():
        if "type" in request.POST:
            header_field = request.POST["type"]
            analyst = request.user.username
            sources = user_sources(analyst)
            email = Email.objects(id=email_id, source__name__in=sources).first()
            if not email:
                result = {"success": False, "message": "Could not find email."}
            else:
                if header_field in ("from_address, sender, reply_to"):
                    ind_type = "Address - e-mail"
                elif header_field in ("originating_ip", "x_originating_ip"):
                    ind_type = "Address - ipv4-addr"
                else:
                    ind_type = "String"
                result = create_indicator_from_header_field(email, header_field, ind_type, analyst, request)
        else:
            result = {"success": False, "message": "Type is a required value."}
        return HttpResponse(json.dumps(result), mimetype="application/json")
    else:
        return render_to_response("error.html", {"error": "Expected AJAX POST"}, RequestContext(request))

def get_campaign_targets(campaign, user):
    """
    Get targets related to a specific campaign.

    :param campaign: The campaign to search for.
    :type campaign: str
    :param user: The user requesting this information.
    :type user: str
    :returns: list
    """

    # Searching for campaign targets
    sourcefilt = user_sources(user)

    # Get addresses from the 'to' field of emails attributed to this campaign
    emails = Email.objects(source__name__in=sourcefilt,
                           campaign__name=campaign).only('to')
    addresses = {}
    for email in emails:
        for to in email['to']:
            addresses[to.strip().lower()] = 1 # add the way it should be
            addresses[to] = 1 # also add the way it is in the Email

    # Get addresses of Targets attributed to this campaign
    targets = Target.objects(campaign__name=campaign).only('email_address')
    for target in targets:
        addresses[target.email_address] = 1

    uniq_addrs = addresses.keys()
    return uniq_addrs

def target_user_stats():
    """
    Generate targets from email To/CC fields, then generate divisions from
    targets list.
    No cleanup or logic is being done on the To/CC fields. If they are not
    valid email addresses ([email protected]), they do not get added as a target.
    """

    mapcode = """
        function () {
            try {
                this.to.forEach(function(z) {
                    emit(z.toLowerCase(), {count: 1});
                });
            } catch(err) {}
        }
    """
    reducecode = """
        function(k,v) {
            var count = 0;
            v.forEach(function(v) {
                count += v["count"];
            });
            return {count: count};
        }
    """
    m = Code(mapcode)
    r = Code(reducecode)
    results = Email.objects(to__exists=True).map_reduce(m, r, 'inline')
    for result in results:
        try:
            targs = Target.objects(email_address__iexact=result.key)
            if not targs:
                targs = [Target()]
                targs[0].email_address = result.key.strip().lower()

            for targ in targs:
                targ.email_count = result.value['count']
                targ.save()
        except:
            pass
    mapcode = """
        function() {
            if ("division" in this) {
                emit(this.division, {count: this.email_count})
            }
        }
    """
    m = Code(mapcode)
    try:
        results = Target.objects().map_reduce(m, r, 'inline')
        for result in results:
            div = Division.objects(division__iexact=result.key).first()
            if not div:
                div = Division()
                div.division = result.key
            div.email_count = result.value['count']
            div.save()
    except:
        raise

def get_campaign_targets(campaign,user):
    """
    Get targets related to a specific campaign.

    :param campaign: The campaign to search for.
    :type campaign: str
    :param user: The user requesting this information.
    :type user: str
    :returns: list
    """

    # Searching for campaign targets
    sourcefilt = user_sources(user)
    emails = Email.objects(source__name__in=sourcefilt,
                           campaign__name=campaign).only('to')
    addresses = {}
    for email in emails:
        for to in email['to']:

            # This might be a slow operation since we're looking up all "to"
            # targets, could possibly bulk search this.
            target = Target.objects(email_address__iexact=to).first()

            if target is not None:
                addresses[target.email_address] = 1
            else:
                addresses[to] = 1
    uniq_addrs = addresses.keys()
    return uniq_addrs

def execute_anb_campaign(cid, sources):
    data = {'emails': '', 'samples': '', 'objects': ''}

    email_list = Email.objects(campaign__name=cid, source__name__in=sources)
    if not email_list:
        return data

    md5_list = []

    for email in email_list:
        md5_list = get_sample_rels(email.relationships, str(email.id), sources)
        email.sanitize_sources(sources=sources)

        data['emails'] += "%s,%s,%s,%s,%s,%s,%s,%s\r\n" % (
            email.id,
            email.isodate,
            email.sender,
            email.subject,
            email.x_originating_ip,
            email.x_mailer,
            email.source[0].name,
            email.campaign[0].name)

        for m in md5_list:
            data['samples'] += "%s,%s,%s,%s,%s\r\n" % (
                m['email_id'],
                m['md5'],
                m['mimetype'],
                m['backdoor'],
                m['filename'])
            for o in m.get('objects', []):
                data['objects'] += "%s,%s\r\n" % (m['md5'], o)

    return data

def upload_attach(request, email_id):
    """
    Upload an attachment for an email.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to upload attachment for.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """

    if request.method == 'POST':
        form = UploadFileForm(request.user, request.POST, request.FILES)
        if form.is_valid():
            cleaned_data = form.cleaned_data
            analyst = request.user.username
            users_sources = user_sources(analyst)
            method = cleaned_data['method'] or "Add to Email"
            bucket_list = cleaned_data.get(form_consts.Common.BUCKET_LIST_VARIABLE_NAME)
            ticket = cleaned_data.get(form_consts.Common.TICKET_VARIABLE_NAME)
            email_addr = None
            if request.POST.get('email'):
                email_addr = request.user.email
            email = Email.objects(id=email_id, source__name__in=users_sources).first()
            if not email:
                return render_to_response('file_upload_response.html',
                                          {'response': json.dumps({'success': False,
                                                                   'message': "Could not find email."})},
                                          RequestContext(request))
            result = create_email_attachment(email,
                                             cleaned_data,
                                             analyst,
                                             cleaned_data['source'],
                                             method,
                                             cleaned_data['reference'],
                                             cleaned_data['campaign'],
                                             cleaned_data['confidence'],
                                             bucket_list,
                                             ticket,
                                             request.FILES.get('filedata',None),
                                             request.POST.get('filename', None),
                                             request.POST.get('md5', None),
                                             email_addr,
                                             cleaned_data['inherit_sources'])

            # If successful, tell the browser to redirect back to this email.
            if result['success']:
                result['redirect_url'] = reverse('crits.emails.views.email_detail', args=[email_id])
            return render_to_response('file_upload_response.html',
                                      {'response': json.dumps(result)},
                                      RequestContext(request))
        else:
            form.fields['related_md5'].widget = forms.HiddenInput() #hide field so it doesn't reappear
            return render_to_response('file_upload_response.html',
                                      {'response': json.dumps({'success': False,
                                                               'form': form.as_table()})},
                                      RequestContext(request))
    else:
        return HttpResponseRedirect(reverse('crits.emails.views.email_detail',
                                            args=[email_id]))

def upload_attach(request, email_id):
    """
    Upload an attachment for an email.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to upload attachment for.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """

    analyst = request.user.username
    sources = user_sources(analyst)
    email = Email.objects(id=email_id, source__name__in=sources).first()
    if not email:
        error = "Could not find email."
        return render_to_response("error.html",
                                    {"error": error},
                                    RequestContext(request))
    if request.method == 'POST':
        form = EmailAttachForm(request.user.username,
                               request.POST,
                               request.FILES)
        if form.is_valid():
            cleaned_data = form.cleaned_data
            reference = cleaned_data['source_reference']
            campaign = cleaned_data['campaign']
            confidence = cleaned_data['confidence']
            source = cleaned_data['source']
            bucket_list = cleaned_data.get(form_consts.Common.BUCKET_LIST_VARIABLE_NAME)
            ticket = cleaned_data.get(form_consts.Common.TICKET_VARIABLE_NAME)

            if request.FILES or 'filename' in request.POST and 'md5' in request.POST:
                result = create_email_attachment(email,
                                                 cleaned_data,
                                                 reference,
                                                 source,
                                                 analyst,
                                                 campaign=campaign,
                                                 confidence=confidence,
                                                 bucket_list=bucket_list,
                                                 ticket=ticket,
                                                 files=request.FILES.get('filedata',None),
                                                 filename=request.POST.get('filename', None),
                                                 md5=request.POST.get('md5', None))
                if not result['success']:
                    return render_to_response("error.html",
                                            {"error": result['message'] },
                                            RequestContext(request))
            return HttpResponseRedirect(reverse('crits.emails.views.email_detail',
                                                args=[email_id]))
        else:
            return render_to_response("error.html",
                                      {"error": '%s' % form.errors },
                                      RequestContext(request))
    else:
        return HttpResponseRedirect(reverse('crits.emails.views.email_detail',
                                            args=[email_id]))

def class_from_value(type_, value):
    """
    Return an instantiated class object.

    :param type_: The CRITs top-level object type.
    :type type_: str
    :param value: The value to search for.
    :type value: str
    :returns: class which inherits from
              :class:`crits.core.crits_mongoengine.CritsBaseAttributes`
    """

    # doing this to avoid circular imports
    from crits.campaigns.campaign import Campaign
    from crits.certificates.certificate import Certificate
    from crits.comments.comment import Comment
    from crits.domains.domain import Domain
    from crits.emails.email import Email
    from crits.events.event import Event
    from crits.indicators.indicator import Indicator
    from crits.ips.ip import IP
    from crits.pcaps.pcap import PCAP
    from crits.raw_data.raw_data import RawData
    from crits.samples.sample import Sample
    from crits.screenshots.screenshot import Screenshot
    from crits.targets.target import Target

    if type_ == 'Campaign':
        return Campaign.objects(name=value).first()
    elif type_ == 'Certificate':
        return Certificate.objects(md5=value).first()
    elif type_ == 'Comment':
        return Comment.objects(id=value).first()
    elif type_ == 'Domain':
        return Domain.objects(domain=value).first()
    elif type_ == 'Email':
        return Email.objects(id=value).first()
    elif type_ == 'Event':
        return Event.objects(id=value).first()
    elif type_ == 'Indicator':
        return Indicator.objects(id=value).first()
    elif type_ == 'IP':
        return IP.objects(ip=value).first()
    elif type_ == 'PCAP':
        return PCAP.objects(md5=value).first()
    elif type_ == 'RawData':
        return RawData.objects(md5=value).first()
    elif type_ == 'Sample':
        return Sample.objects(md5=value).first()
    elif type_ == 'Screenshot':
        return Screenshot.objects(id=value).first()
    elif type_ == 'Target':
        return Target.objects(email_address=value).first()
    else:
        return None

    def handle(self, *args, **options):
        """
        Script Execution.
        """

        self.is_delete = options.get('is_delete')

        mapcode = """
            function () {
                try {
                    this.to.forEach(function(z) {
                        emit(z.toLowerCase(), {count: 1});
                    });
                } catch(err) {}
            }
        """
        reducecode = """
            function(k,v) {
                var count = 0;
                v.forEach(function(v) {
                    count += v["count"];
                });
                return {count: count};
            }
        """
        m = Code(mapcode)
        r = Code(reducecode)
        results = Email.objects(to__exists=True).map_reduce(m, r, 'inline')
        for result in results:
            try:
                targets = Target.objects(email_address__iexact=result.key)
                targ_dup_count = targets.count()

                if targ_dup_count > 1:
                    print str(result.key) + " [" + str(targ_dup_count) + "]"

                    for target in targets:
                        print target.to_json()

                    if self.is_delete:
                        delete_up_to = targets.count() - 1
                        for target in targets[:delete_up_to]:
                            print "Deleting target: " + str(target.id)
                            target.delete()

            except Exception, e:
                print e
                pass

def email_del(request, email_id):
    """
    Delete an email.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to delete.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """

    email = Email.objects(id=email_id).first()
    if email:
        email.delete(username=request.user.username)
        return HttpResponseRedirect(reverse("crits.emails.views.emails_listing"))
    else:
        return render_to_response("error.html", {"error": "Could not delete email."}, RequestContext(request))

def get_campaign_targets(campaign, user):
    """
    Get targets related to a specific campaign.

    :param campaign: The campaign to search for.
    :type campaign: str
    :param user: The user requesting this information.
    :type user: str
    :returns: list
    """

    # Searching for campaign targets
    sourcefilt = user_sources(user)
    emails = Email.objects(source__name__in=sourcefilt, campaign__name=campaign).only("to")
    addresses = {}
    for email in emails:
        for to in email["to"]:
            addresses[to] = 1
    uniq_addrs = addresses.keys()
    return uniq_addrs

def indicator_from_header_field(request, email_id):
    """
    Create an indicator from a header field. Should be an AJAX POST.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to get the header from.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """

    if request.method == "POST" and request.is_ajax():
        if 'type' in request.POST:
            header_field = request.POST.get('field')
            header_type = request.POST.get('type')
            analyst = request.user.username
            sources = user_sources(analyst)
            email = Email.objects(id=email_id,
                                  source__name__in=sources).first()
            if not email:
                result = {
                    'success':  False,
                    'message':  "Could not find email."
                }
            else:
                result = create_indicator_from_header_field(email,
                                                            header_field,
                                                            header_type,
                                                            analyst,
                                                            request)
        else:
            result = {
                'success':  False,
                'message':  "Type is a required value."
            }
        return HttpResponse(json.dumps(result),
                            content_type="application/json")
    else:
        return render_to_response('error.html',
                                  {'error': "Expected AJAX POST"},
                                  RequestContext(request))

def email_del(request, email_id):
    """
    Delete an email.

    :param request: Django request object (Required)
    :type request: :class:`django.http.HttpRequest`
    :param email_id: The ObjectId of the email to delete.
    :type email_id: str
    :returns: :class:`django.http.HttpResponse`
    """
    user = request.user

    email = Email.objects(id=email_id).first()
    if not user.has_access_to(EmailACL.DELETE):
        return render(request, 'error.html',
                                  {'error':'User does not have permission to delete email.'})
    if not email:
        return render(request, 'error.html', {'error': "Could not delete email."})

    email.delete(username=request.user.username)
    return HttpResponseRedirect(reverse('crits-emails-views-emails_listing'))

def class_from_id(type_, _id):
    """
    Return an instantiated class object.

    :param type_: The CRITs top-level object type.
    :type type_: str
    :param _id: The ObjectId to search for.
    :type _id: str
    :returns: class which inherits from
              :class:`crits.core.crits_mongoengine.CritsBaseAttributes`
    """

    # Quick fail
    if not _id or not type_:
        return None

    # doing this to avoid circular imports
    from crits.actors.actor import ActorThreatIdentifier, Actor
    from crits.backdoors.backdoor import Backdoor
    from crits.campaigns.campaign import Campaign
    from crits.certificates.certificate import Certificate
    from crits.comments.comment import Comment
    from crits.core.crits_mongoengine import Action
    from crits.core.source_access import SourceAccess
    from crits.core.user_role import UserRole
    from crits.domains.domain import Domain
    from crits.emails.email import Email
    from crits.events.event import Event
    from crits.exploits.exploit import Exploit
    from crits.indicators.indicator import Indicator
    from crits.ips.ip import IP
    from crits.pcaps.pcap import PCAP
    from crits.raw_data.raw_data import RawData, RawDataType
    from crits.samples.sample import Sample
    from crits.screenshots.screenshot import Screenshot
    from crits.signatures.signature import Signature, SignatureType, SignatureDependency
    from crits.targets.target import Target

    # make sure it's a string
    _id = str(_id)

    # Use bson.ObjectId to make sure this is a valid ObjectId, otherwise
    # the queries below will raise a ValidationError exception.
    if not ObjectId.is_valid(_id.decode("utf8")):
        return None

    if type_ == "Actor":
        return Actor.objects(id=_id).first()
    elif type_ == "Backdoor":
        return Backdoor.objects(id=_id).first()
    elif type_ == "ActorThreatIdentifier":
        return ActorThreatIdentifier.objects(id=_id).first()
    elif type_ == "Campaign":
        return Campaign.objects(id=_id).first()
    elif type_ == "Certificate":
        return Certificate.objects(id=_id).first()
    elif type_ == "Comment":
        return Comment.objects(id=_id).first()
    elif type_ == "Domain":
        return Domain.objects(id=_id).first()
    elif type_ == "Email":
        return Email.objects(id=_id).first()
    elif type_ == "Event":
        return Event.objects(id=_id).first()
    elif type_ == "Exploit":
        return Exploit.objects(id=_id).first()
    elif type_ == "Indicator":
        return Indicator.objects(id=_id).first()
    elif type_ == "Action":
        return Action.objects(id=_id).first()
    elif type_ == "IP":
        return IP.objects(id=_id).first()
    elif type_ == "PCAP":
        return PCAP.objects(id=_id).first()
    elif type_ == "RawData":
        return RawData.objects(id=_id).first()
    elif type_ == "RawDataType":
        return RawDataType.objects(id=_id).first()
    elif type_ == "Sample":
        return Sample.objects(id=_id).first()
    elif type_ == "Signature":
        return Signature.objects(id=_id).first()
    elif type_ == "SignatureType":
        return SignatureType.objects(id=_id).first()
    elif type_ == "SignatureDependency":
        return SignatureDependency.objects(id=_id).first()
    elif type_ == "SourceAccess":
        return SourceAccess.objects(id=_id).first()
    elif type_ == "Screenshot":
        return Screenshot.objects(id=_id).first()
    elif type_ == "Target":
        return Target.objects(id=_id).first()
    elif type_ == "UserRole":
        return UserRole.objects(id=_id).first()
    else:
        return None

def campaign_heatmap(request):
    campaigns = Campaign.objects().only('name', 'aliases', 'locations')
    events = Event.objects().only('title', 'created', 'locations', 'campaign')
    emails = Email.objects().only('created', 'locations', 'campaign')

    # list of countries in alphabetical order. set 0 for the amount of campaign
    # associated with this country for the next step.
    country_list = []
    for c in campaigns:
        if len(c.locations):
            for l in c.locations:
                if [l.location,0] not in country_list:
                    country_list.append([l.location,0])
    country_list.sort()
    # For those campaigns with no location assigned, have an Unknown location.
    country_list.append(['Unknown', 0])

    # list of campaigns in order of country, then alphabetical by name
    campaign_list = []
    # for each country we build a tmp list, find all campaigns for that country,
    # sort the list, then append it to the campaign list. bump the count so we
    # know how many columns to span.
    for c in country_list:
        tmp = []
        for cam in campaigns:
            if len(cam.locations):
                for l in cam.locations:
                    if l.location == c[0]:
                        c[1] += 1
                        if cam.name not in tmp:
                            tmp.append(cam.name)
                        break
            else:
                # Assuming we are checking the Unknown location, if this
                # campaign has no location assigned, add it to Unknown.
                if c[0] == 'Unknown':
                    c[1] += 1
                    if cam.name not in tmp:
                        tmp.append(cam.name)
        # If we haven't added a campaign to this location, show "No Campaigns".
        # This also prevents a left-shift in the counting and header rows.
        if len(tmp) == 0:
            tmp.append("No Campaigns")
        tmp.sort()
        campaign_list += tmp

    # list of the months going back in history and the activity of each campaign
    # during that month
    month_list = []
    # for each campaign, find associated events and emails. For each event and
    # email, use the created date to put it into the appropriate list.
    month_d = {}
    idx = 0
    # this is a default row in the heatmap with all values set to 0.
    pad_list = [0 for _ in range(len(campaign_list))]
    for c in campaign_list:
        build_month_d(pad_list, month_d, c, idx, events)
        build_month_d(pad_list, month_d, c, idx, emails)
        idx += 1

    # sort the months in reverse order for descending display.
    for key in sorted(month_d, reverse=True):
        month_list.append([key, month_d[key]])

    final_data = {
        'country_list': country_list,
        'campaign_list': campaign_list,
        'month_list': month_list,
    }

    return final_data