PcapAddressOperations.py 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209
  1. from random import choice
  2. from Core import Statistics
  3. from ID2TLib.IPv4 import IPAddress
  4. is_ipv4 = IPAddress.is_ipv4
  5. class PcapAddressOperations():
  6. def __init__(self, statistics: Statistics, uncertain_ip_mult: int=3):
  7. """
  8. Initializes a pcap information extractor that uses the provided statistics for its operations.
  9. :param statistics: The statistics of the pcap file
  10. :param uncertain_ip_mult: the mutliplier to create new address space when the remaining observed space has been drained
  11. """
  12. self.statistics = statistics
  13. self.UNCERTAIN_IPSPACE_MULTIPLIER = uncertain_ip_mult
  14. stat_result = self.statistics.process_db_query("most_used(macAddress)", print_results=False)
  15. if isinstance(stat_result, list):
  16. self.probable_router_mac = choice(stat_result)
  17. else:
  18. self.probable_router_mac = stat_result
  19. self._init_ipaddress_ops()
  20. def get_probable_router_mac(self):
  21. """
  22. Returns the most probable router MAC address based on the most used MAC address in the statistics.
  23. :return: the MAC address
  24. """
  25. return self.probable_router_mac
  26. def pcap_contains_priv_ips(self):
  27. """
  28. Returns if the provided traffic contains private IPs.
  29. :return: True if the provided traffic contains private IPs, otherwise False
  30. """
  31. return self.contains_priv_ips
  32. def get_local_address_range(self):
  33. """
  34. Returns a tuple with the start and end of the observed local IP range.
  35. :return: The IP range as tuple
  36. """
  37. return str(self.min_local_ip), str(self.max_local_ip)
  38. def get_count_rem_local_ips(self):
  39. """
  40. Returns the number of local IPs in the pcap file that have not aldready been returned by get_existing_local_ips.
  41. :return: the not yet assigned local IPs
  42. """
  43. return len(self.remaining_local_ips)
  44. def get_existing_local_ips(self, count: int=1):
  45. """
  46. Returns the given number of local IPs that are existent in the pcap file.
  47. :param count: the number of local IPs to return
  48. :return: the chosen local IPs
  49. """
  50. if count > len(self.remaining_local_ips):
  51. print("Warning: There are no more {} local IPs in the .pcap file. Returning all remaining local IPs.".format(count))
  52. total = min(len(self.remaining_local_ips), count)
  53. retr_local_ips = []
  54. local_ips = self.remaining_local_ips
  55. for _ in range(0, total):
  56. random_local_ip = choice(sorted(local_ips))
  57. retr_local_ips.append(str(random_local_ip))
  58. local_ips.remove(random_local_ip)
  59. return retr_local_ips
  60. def get_new_local_ips(self, count: int=1):
  61. """
  62. Returns in the pcap not existent local IPs that are in proximity of the observed local IPs. IPs can be returned
  63. that are either between the minimum and maximum observed IP and are therefore considered certain
  64. or that are above the observed maximum address, are more likely to not belong to the local network
  65. and are therefore considered uncertain.
  66. :param count: the number of new local IPs to return
  67. :return: the newly created local IP addresses
  68. """
  69. unused_local_ips = self.unused_local_ips
  70. uncertain_local_ips = self.uncertain_local_ips
  71. count_certain = min(count, len(unused_local_ips))
  72. retr_local_ips = []
  73. for _ in range(0, count_certain):
  74. random_local_ip = choice(sorted(unused_local_ips))
  75. retr_local_ips.append(str(random_local_ip))
  76. unused_local_ips.remove(random_local_ip)
  77. # retrieve uncertain local ips
  78. if count_certain < count:
  79. count_uncertain = count - count_certain
  80. # check if new uncertain IPs have to be created
  81. if len(uncertain_local_ips) < count_uncertain:
  82. ipspace_multiplier = self.UNCERTAIN_IPSPACE_MULTIPLIER
  83. max_new_ip = self.max_uncertain_local_ip.to_int() + ipspace_multiplier * count_uncertain
  84. count_new_ips = max_new_ip - self.max_uncertain_local_ip.to_int()
  85. # create ipspace_multiplier * count_uncertain new uncertain local IP addresses
  86. last_gen_ip = None
  87. for i in range(1, count_new_ips + 1):
  88. ip = IPAddress.from_int(self.max_uncertain_local_ip.to_int() + i)
  89. # exclude the definite broadcast address
  90. if self.priv_ip_segment:
  91. if ip.to_int() >= self.priv_ip_segment.last_address().to_int():
  92. break
  93. uncertain_local_ips.add(ip)
  94. last_gen_ip = ip
  95. self.max_uncertain_local_ip = last_gen_ip
  96. # choose the uncertain IPs to return
  97. total_uncertain = min(count_uncertain, len(uncertain_local_ips))
  98. for _ in range(0, total_uncertain):
  99. random_local_ip = choice(sorted(uncertain_local_ips))
  100. retr_local_ips.append(str(random_local_ip))
  101. uncertain_local_ips.remove(random_local_ip)
  102. return retr_local_ips
  103. def get_existing_external_ips(self, count: int=1):
  104. """
  105. Returns the given number of external IPs that are existent in the pcap file.
  106. :param count: the number of external IPs to return
  107. :return: the chosen external IPs
  108. """
  109. if not (len(self.external_ips) > 0):
  110. print("Warning: .pcap does not contain any external ips.")
  111. return []
  112. total = min(len(self.remaining_external_ips), count)
  113. retr_external_ips = []
  114. external_ips = self.remaining_external_ips
  115. for _ in range(0, total):
  116. random_external_ip = choice(sorted(external_ips))
  117. retr_external_ips.append(str(random_external_ip))
  118. external_ips.remove(random_external_ip)
  119. return retr_external_ips
  120. def _init_ipaddress_ops(self):
  121. """
  122. Load and process data needed to perform functions on the IP addresses contained in the statistics
  123. """
  124. # retrieve local and external IPs
  125. all_ips_str = set(self.statistics.process_db_query("all(ipAddress)", print_results=False))
  126. external_ips_str = set(self.statistics.process_db_query("ipAddress(macAddress=%s)" % self.get_probable_router_mac(), print_results=False)) # including router
  127. local_ips_str = all_ips_str - external_ips_str
  128. external_ips = set()
  129. local_ips = set()
  130. self.contains_priv_ips = False
  131. self.priv_ip_segment = None
  132. # convert local IP strings to IPv4.IPAddress representation
  133. for ip in local_ips_str:
  134. if is_ipv4(ip):
  135. ip = IPAddress.parse(ip)
  136. if ip.is_private() and not self.contains_priv_ips:
  137. self.contains_priv_ips = True
  138. self.priv_ip_segment = ip.get_private_segment()
  139. # exclude local broadcast address and other special addresses
  140. if (not str(ip) == "255.255.255.255") and (not ip.is_localhost()) and (not ip.is_multicast()) and (not ip.is_reserved()) and (not ip.is_zero_conf()):
  141. local_ips.add(ip)
  142. # convert external IP strings to IPv4.IPAddress representation
  143. for ip in external_ips_str:
  144. if is_ipv4(ip):
  145. ip = IPAddress.parse(ip)
  146. # if router MAC can definitely be mapped to local/private IP, add it to local_ips (because at first it is stored in external_ips, see above)
  147. # this depends on whether the local network is identified by a private IP address range or not.
  148. if ip.is_private():
  149. local_ips.add(ip)
  150. # exclude local broadcast address and other special addresses
  151. elif (not str(ip) == "255.255.255.255") and (not ip.is_localhost()) and (not ip.is_multicast()) and (not ip.is_reserved()) and (not ip.is_zero_conf()):
  152. external_ips.add(ip)
  153. min_local_ip, max_local_ip = min(local_ips), max(local_ips)
  154. # save the certain unused local IPs of the network
  155. unused_local_ips = set()
  156. for i in range(min_local_ip.to_int() + 1, max_local_ip.to_int()):
  157. ip = IPAddress.from_int(i)
  158. if not ip in local_ips:
  159. unused_local_ips.add(ip)
  160. # save the gathered information for efficient later use
  161. self.external_ips = frozenset(external_ips)
  162. self.remaining_external_ips = external_ips
  163. self.min_local_ip, self.max_local_ip = min_local_ip, max_local_ip
  164. self.max_uncertain_local_ip = max_local_ip
  165. self.local_ips = frozenset(local_ips)
  166. self.remaining_local_ips = local_ips
  167. self.unused_local_ips = unused_local_ips
  168. self.uncertain_local_ips = set()