Python pyflag.FlagFramework类代码示例

def start_workers():
    print "%s: starting workers" % os.getpid()
    global job_pipe, keepalive, write_keepalive

    children = []

    ## These pipes control the worker. If the master exits, the pipes
    ## will be closed which will notify the worker immediately. It
    ## will then exit.

    if not keepalive:
        keepalive, write_keepalive = os.pipe()

    ## Start up as many children as needed
    for i in range(config.WORKERS):
        pid = os.fork()
        if pid:
            children.append(pid)

        else:
            os.close(write_keepalive)

            ## Initialise the worker
            worker_run(keepalive)
            sys.exit(0)
            
    ## The process which called this function is a master
    FlagFramework.post_event("startup")

    ## The master is responsible for ensuring its child is running -
    ## if the child quits, we restart it.
    signal.signal(signal.SIGCHLD, handler)

def drop_table(case, name):
    """ Drops the log table tablename """
    if not name: return
    
    dbh = DB.DBO(case)
    pyflaglog.log(pyflaglog.DEBUG, "Dropping log table %s in case %s" % (name, case))

    dbh.execute("select * from log_tables where table_name = %r limit 1" , name)
    row = dbh.fetch()

    ## Table not found
    if not row:
        return
    
    preset = row['preset']

    ## Get the driver for this table:
    log = load_preset(case, preset)
    log.drop(name)
    
    ## Ask the driver to remove its table:
    dbh.delete("log_tables",
               where= DB.expand("table_name = %r ", name));

    ## Make sure that the reports get all reset
    FlagFramework.reset_all(family='Load Data', report="Load Preset Log File",
                                       table = name, case=case)

            def right(path, result):
                case = self.defaults.get('case',None)
                dbh = DB.DBO(case)
                tablename = dbh.get_temp()
                dbh.execute("""create table %s (
                `filename` varchar(250) NOT NULL default '.',
                `timestamp` timestamp NOT NULL,
                `size` bigint(11) not null
                )""", tablename)

                ## populate the table:
                full_path=FlagFramework.sane_join(config.UPLOADDIR,path)

                dbh.mass_insert_start(tablename)
                ## List all the files in the directory:
                try:
                    for d in os.listdir(full_path):
                        filename = FlagFramework.sane_join(path,d)
                        full_filename = FlagFramework.sane_join(config.UPLOADDIR, filename)
                        try:
                            if not os.path.isdir(full_filename):
                                s = os.stat(full_filename)
                                dbh.mass_insert(filename = filename,
                                                _timestamp = "from_unixtime(%d)" % s.st_mtime,
                                                size = s.st_size)
                        except OSError:
                            pass
                    dbh.mass_insert_commit()
                except OSError,e:
                    pass

    def search_next_text_region(self, query, result):
        """ searches for the next text region and updates query['period_number'] """
        ## Open all the disks
        filenames = query.getarray('filename') 
        fds = [ IO.open_URL(f) for f in filenames ]
        if query.get('ismissing',False):
            fds.append(ParityFD(copy.deepcopy(filenames)))
        period_number = int(query.get('period_number',0)) + 1
        blocksize = FlagFramework.calculate_offset_suffix(query['blocksize'])
        period = FlagFramework.calculate_offset_suffix(query['period'])

        p=0
        while 1:
            offset = blocksize  * (p + period_number * period)
            for fd in fds:
                fd.seek(offset)
                ## We classify a text region as one with 20 chars at
                ## the start of the period
                data = fd.read(20)
                if not data:
                    result.heading("Error")
                    result.para("Unable to read data from %r" % fd)
                    return
                
                m = self.text_re.match(data)
                if m:
                    period_number = period_number + p / period
                    query.set('period_number',period_number)
                    result.refresh(0, query, 'parent')
                    return

                p += 1

    def navbar(self,query=None,next=None,previous=None,pageno=None):
        """ Returns the HTML for the navigation bar. """
        if query==None: query=FlagFramework.query_type(())
        
        if not query.has_key('family'):
            query['family']=''
            
        if next:
            #Make a link
            q=query.clone()
            q.FillQueryTarget(next)
            next = '<a href="f?%s"><img height=25 src="/images/forward.png" border="0"></a>' % (str(q))
        else:
            next = '<img src="/images/arrow_right_grey.gif" height=25 border="0">'

        if previous<0:
            previous =  '<img src="/images/arrow_left_grey.gif" height=25 border="0">'
        else:
            q=query.clone()
            q.FillQueryTarget(previous)
            previous = '<a href="f?%s"><img height=25 src="/images/back.png"  border="0"></a>' %  (str(q))

        bar = {'family': Theme.propegate(query,FlagFramework.query_type()),'back': previous,'case': query['case'],'pageno':  pageno,'next': next,'reset': str(query)+'&reset=1','stop': str(query)+'&stop=1'}

        toolbar = '''<table><tr>
        <td valign="bottom"><a href="%(family)s"><img height=25 src="/images/home_grey.png" border="0"></a></td><td valign="bottom">%(back)s</td><td>%(case)s - page %(pageno)s</td><td valign="bottom">%(next)s</td> <td valign="bottom">
        <td valign="bottom"><a href="flag?%(reset)s"><img height=25 src="/images/reset_grey.png" border="0"></a></td></tr></table>''' % bar

        return toolbar

 def display(self, query, result):
     result.heading("Uploaded FS Image from IO Source %s to case %s" % (query["iosource"], query["case"]))
     result.link(
         "Analyse this data",
         FlagFramework.query_type((), case=query["case"], family="Disk Forensics", report="BrowseFS"),
     )
     result.refresh(0, FlagFramework.query_type((), case=query["case"], family="Disk Forensics", report="BrowseFS"))

    def test01types(self):
        query = FlagFramework.query_type(family='Disk Forensics', report='Browse Types',
                                         case=self.test_case)
        self.gui_test(query)

        query = FlagFramework.query_type(family='Network Forensics', report='Browse HTTP Requests',
                                         case=self.test_case)
        self.gui_test(query)

    def error_popup(self,e):
        """ Draw the text in an error message box

        @arg e: The exception object to print
        """
        result=GTKUI.GTKUI(server=main,ftoolbar=main.ftoolbar)
        FlagFramework.get_traceback(e,result)    
        self.create_window(result.display(),gtk.STOCK_DIALOG_ERROR)

 def display(self,query,result):
     try:
         FlagFramework.delete_case(query['remove_case'])
     except DB.DBError:
         pass
     result.heading("Deleted case")
     result.para("Case %s has been deleted" % query['remove_case'])
     return result

    def create(self, name,case, query):
        offset = FlagFramework.calculate_offset_suffix(query.get('offset','0'))
        filenames = self.glob_filenames(query.getarray('filename'))

        ## Open the io sources here
        fds = [ IO.open_URL(f) for f in filenames ]
        blocksize = FlagFramework.calculate_offset_suffix(query.get('blocksize','32k'))
        period = int(query.get('period',3))
        return RAIDFD(fds, blocksize, query['map'], offset, period)

            def add_inodes(path, root_item):
                for item in pst_file.listitems(root_item):
                    properties = item.properties()

                    item_inode = "%s|P%s" % (self.fd.inode, item.get_id())
                    new_path = FlagFramework.normpath(
                        "%s/%s" % (path, item.__str__().replace('/','_'))
                        )

                    ## This is a little optimization - we save the
                    ## cache copy of the property list so the File
                    ## driver does not need to do anything:
                    property_data = format_properties(properties)

                    ## These are the inode properties:
                    args = dict(size = len(property_data))

                    try:
                        args['_ctime'] = properties.get('create_date',
                                                       properties['arrival_date'])
                    except: pass

                    try:
                        args['_mtime'] = properties.get('modify_date',
                                                       properties['sent_date'])
                    except: pass
                    
                    self.ddfs.VFSCreate(None, item_inode, new_path, **args)

                    ## Make sure we can scan it:
                    fd = self.ddfs.open(inode = item_inode)
                    Scanner.scanfile(self.ddfs, fd, self.factories)

                    ## If its an email we create VFS nodes for its
                    ## attachments:
                    try:
                        for i in range(len(properties['_attachments'])):
                            att = properties['_attachments'][i]
                            
                            attachment_path = FlagFramework.normpath(
                                "%s/%s" % (new_path, att['filename1'].replace('/','_')))

                            args['size'] = len(att['body'])
                                        
                            attach_inode = "%s:%s" % (item_inode,i)
                            self.ddfs.VFSCreate(None, attach_inode,
                                                attachment_path, **args)
                            
                            ## Make sure we scan it:
                            fd = self.ddfs.open(inode = attach_inode)
                            Scanner.scanfile(self.ddfs, fd, self.factories)
                    except KeyError:
                        pass

                    ## Recursively add the next inode:
                    add_inodes(new_path, item)

    def display(self,query,result):
        dbh = self.DBO(query['case'])
        graph = GraphViz(query['prog'],result)

        ##What conditions did the user ask to see?
        conditions = "description='%s'" % "' or description='".join(query.getarray('deductions'))

        ## If the user didnt ask to see disconnected nodes, we create a temporary knowledge table, else we use the original table
        if query.has_key('show_disc'):
            knowledge = 'knowledge'
        else:
            knowledge = dbh.get_temp()
            ## This gives us those nodes that appear in transitive links meeting the conditions
            dbh.execute("create table %s select * from knowledge as a where a.link='transitive' and (%s)",(knowledge,conditions))

        def find_root_node(name,type):
            """ Follows node named by name up the kb tree to find the node denoted by type

            @arg name: Name of node to start searching from
            @arg type: When a node of this type is found it is returned.
            @return: A node of the given type which is up the tree from the named node
            """
            dbh2 = self.DBO(query['case'])
            while 1:
                dbh2.execute('select type from knowledge_node where name = %r',name)
                rs = dbh2.fetch()
                if rs['type'] == type: return name
                dbh2.execute('select pname from knowledge where name = %r and link="no"' ,(name))
                rs = dbh2.fetch()
                if not rs: return None
                name = rs['pname']

        ## We follow each node up the tree to reach the root as defined by query['type']
        dbh.execute('select a.name,a.pname,description from %s as a,knowledge_node as b where a.name=b.name and a.link="transitive"',knowledge)
        for row in dbh:
            from_node = find_root_node(row['pname'],query['type'])
            to_node = find_root_node(row['name'],query['type'])

            new_query = FlagFramework.query_type((),
                                                 family=query['family'],
                                                 report='DisplayObject',
                                                 object_name=from_node,
                                                 case=query['case']
                                                 )
            graph.node(from_node,label=from_node,URL="f?%s" % new_query)

            new_query = FlagFramework.query_type((),
                                                 family=query['family'],
                                                 report='DisplayObject',
                                                 object_name=to_node,
                                                 case=query['case']
                                                 )
            graph.node(to_node,label=to_node,URL="f?%s" % new_query)
            graph.edge(from_node,to_node,label=row['description'])
            
        graph.draw()

 def display(self,query,result):
     ## Try to delete the old cases:
     try:
         dbh = DB.DBO()
         dbh.execute("select * from meta where property='flag_db'")
         for row in dbh:
             pyflaglog.log(pyflaglog.INFO, "Deleting case %s due to an upgrade" % row['value'])
             FlagFramework.delete_case(row['value'])
     except DB.DBError,e:
         pass

 def execute(self):
     try:
         case=self.args[0]
         dbh = DB.DBO(case)
         FlagFramework.delete_case(case)
         yield "Deleted case %r" %(case)
     except Exception,e:
         ## Should we just return here or report an error?
         return
         raise RuntimeError("Unable to delete case %s (%s)" %(case,e))

    def execute(self):
        try:
            dbh = DB.DBO()
        except:
            dbh = DB.DBO('mysql')
            dbh.execute("create database `%s`" % config.FLAGDB)
            dbh = DB.DBO()

        FlagFramework.post_event("init_default_db", None)
        yield "Done"