diff --git a/AppDelegate.h b/AppDelegate.h index d274d20..203a0e2 100755 --- a/AppDelegate.h +++ b/AppDelegate.h @@ -6,28 +6,24 @@ // Copyright (c) 2015 Objective-See. All rights reserved. // -#import "Binary.h" -#import "ItemBase.h" - -#import "Filter.h" -#import "VirusTotal.h" -#import "TaskTableController.h" - -#import "AboutWindowController.h" -#import "PrefsWindowController.h" -#import "FlaggedItems.h" -#import "ResultsWindowController.h" -#import "RequestRootWindowController.h" -#import "SearchWindowController.h" -#import "CustomTextField.h" - +#import #import "Task.h" +#import "Filter.h" +#import "Binary.h" +#import "ItemBase.h" +#import "VirusTotal.h" #import "TaskEnumerator.h" +#import "CustomTextField.h" +#import "TaskTableController.h" +#import "AboutWindowController.h" +#import "PrefsWindowController.h" +#import "SearchWindowController.h" +#import "ResultsWindowController.h" +#import "FlaggedItemWindowController.h" +#import "RequestRootWindowController.h" -#import - @interface AppDelegate : NSObject { diff --git a/Filter.m b/Filter.m index 499fbf2..10924e2 100644 --- a/Filter.m +++ b/Filter.m @@ -311,6 +311,17 @@ NSString * const BINARY_KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#un continue; } + //check DNS name + if( (nil != item.remoteName) && + (NSNotFound != [item.remoteName rangeOfString:filterText options:NSCaseInsensitiveSearch].location) ) + { + //save match + [results addObject:item]; + + //next + continue; + } + }//all connections }//sync diff --git a/FlaggedItems.h b/FlaggedItemWindowController.h similarity index 100% rename from FlaggedItems.h rename to FlaggedItemWindowController.h diff --git a/FlaggedItems.m b/FlaggedItemWindowController.m similarity index 93% rename from FlaggedItems.m rename to FlaggedItemWindowController.m index 71b1276..7165be4 100644 --- a/FlaggedItems.m +++ b/FlaggedItemWindowController.m @@ -6,11 +6,11 @@ // Copyright (c) 2015 Objective-See. All rights reserved. // -#import "AppDelegate.h" -#import "FlaggedItems.h" -#import "ItemView.h" #import "KKRow.h" +#import "ItemView.h" #import "Utilities.h" +#import "AppDelegate.h" +#import "FlaggedItemWindowController.h" @interface FlaggedItems () @@ -200,8 +200,11 @@ bail: // ->launch browser and browse to virus total's page -(void)showVTInfo:(id)sender { + //item + id item = nil; + //binary - Binary* item = nil; + Binary* binary = nil; //row NSInteger itemRow = 0; @@ -221,8 +224,30 @@ bail: //extract item for row item = self.flaggedItems[itemRow]; + //tasks + // ->grab binary + if(YES == [item isKindOfClass:[Task class]]) + { + //get binary + binary = ((Task*)item).binary; + } + //binaries + // ->can use as is + else if(YES == [item isKindOfClass:[Binary class]]) + { + //set + binary = item; + } + + //sanity check + if(nil == binary) + { + //bail + goto bail; + } + //alloc/init info window - vtWindowController = [[VTInfoWindowController alloc] initWithItem:item]; + vtWindowController = [[VTInfoWindowController alloc] initWithItem:binary]; //show it [self.vtWindowController.windowController showWindow:self]; diff --git a/Items/Connection.h b/Items/Connection.h index b5280e6..bacf3cd 100644 --- a/Items/Connection.h +++ b/Items/Connection.h @@ -26,6 +26,9 @@ //remote port @property(nonatomic, retain)NSNumber* remotePort; +//remote name (url) +@property(nonatomic, retain)NSString* remoteName; + //socket type @property(nonatomic, retain)NSString* type; diff --git a/Items/Connection.m b/Items/Connection.m index e0b444f..cb570f6 100644 --- a/Items/Connection.m +++ b/Items/Connection.m @@ -13,6 +13,7 @@ @implementation Connection @synthesize endpoints; +@synthesize remoteName; //init method -(id)initWithParams:(NSDictionary*)params @@ -52,8 +53,18 @@ //set icon [self setConnectionIcon]; + //resolve in background + //dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0), ^{ + + //resolve + [self addressesForHost]; + + //build/set connection string [self setConnectionString]; + + //}); + } @@ -79,8 +90,28 @@ //set self.icon = [NSImage imageNamed:@"connectedIcon"]; } + //wait related states + else if( (YES == [self.state isEqualToString:@"close/wait"]) || + (YES == [self.state isEqualToString:@"in wait 1"]) || + (YES == [self.state isEqualToString:@"closing"]) || + (YES == [self.state isEqualToString:@"last act"]) || + (YES == [self.state isEqualToString:@"fin wait 2"]) || + (YES == [self.state isEqualToString:@"time wait"]) ) + { + //set + self.icon = [NSImage imageNamed:@"closeWait"]; + } + + //closed + else if(YES == [self.state isEqualToString:@"closed"]) + { + //set + self.icon = [NSImage imageNamed:@"closedIcon"]; + } //TODO: set other icon? + //YES: close-wait!!! + } //set icon for UDP sockets @@ -97,32 +128,23 @@ //resolve a remote IP address to nice DNS name // ->uses address and port, which are passed to getaddrinfo -// note: get thread to call this, cuz it can be slow!! +// note: call from bg thread, cuz it can be slow due to DNS resolution(s) -(void)addressesForHost { - /* - struct addrinfo hints = {.ai_family=PF_UNSPEC;.ai_socktype=SOCK_STREAM;.ai_protocol=IPPROTO_TCP}; - struct addrinfo *res; - int gai_error = getaddrinfo(host.UTF8String, port.stringValue.UTF8String, &hints, &res); - if (gai_error) { - if (outError) *outError = [NSError errorWithDomain:@"MyDomain" code:gai_error userInfo:@{NSLocalizedDescriptionKey:@(gai_strerror(gai_error))}]; - return nil; - } - NSMutableArray *addresses = [NSMutableArray array]; - struct addrinfo *ai = res; - do { - NSData *address = [NSData dataWithBytes:ai->ai_addr length:ai->ai_addrlen]; - [addresses addObject:address]; - } while (ai = ai->ai_next); - freeaddrinfo(res); - return [addresses copy]; - */ + //host + NSHost* host = nil; + + //init host + host = [NSHost hostWithAddress:self.remoteIPAddr]; + + //extract/save name + self.remoteName = host.name; + + return; } - - -//build nice string +//build printable connection string -(void)setConnectionString { //add local addr/port to endpoint string @@ -133,8 +155,15 @@ if( (nil != self.remoteIPAddr) && (nil != self.remotePort) ) { - //add remote endpoint + //add remote IP:port [self.endpoints appendString:[NSString stringWithFormat:@" -> %@:%d", self.remoteIPAddr, [self.remotePort unsignedShortValue]]]; + + //add DNS name + if(nil != self.remoteName) + { + //add + [self.endpoints appendString:[NSString stringWithFormat:@" (%@)", self.remoteName]]; + } } return; diff --git a/TaskTableController.m b/TaskTableController.m index 4f3c674..ce9067b 100644 --- a/TaskTableController.m +++ b/TaskTableController.m @@ -607,32 +607,33 @@ bail: { //item // ->task, dylib, file, etc - Binary* item = nil; + Binary* binary = nil; //for top pane - // ->get task + // ->get binary from task if(YES != self.isBottomPane) { - //get task - item = [(Task*)[self taskForRow:sender] binary]; + //get task's binary + binary = [(Task*)[self taskForRow:sender] binary]; } //bottom pane + // ->straight assign else { //get item - item = (Binary*)[self itemForRow:sender]; + binary = (Binary*)[self itemForRow:sender]; } - //bail on nil items - if(nil == item) + //bail on nil binaries + if(nil == binary) { //bail goto bail; } //alloc/init info window - vtWindowController = [[VTInfoWindowController alloc] initWithItem:item]; + vtWindowController = [[VTInfoWindowController alloc] initWithItem:binary]; //show it [self.vtWindowController.windowController showWindow:self]; diff --git a/UI/FlaggedItems.xib b/UI/FlaggedItems.xib index fd25648..6631e4b 100644 --- a/UI/FlaggedItems.xib +++ b/UI/FlaggedItems.xib @@ -1,8 +1,8 @@ - + - + @@ -70,7 +70,7 @@ - + @@ -160,26 +160,15 @@ - - - - - - - - - - - + - - + diff --git a/remoteTaskService/remoteTaskService.m b/remoteTaskService/remoteTaskService.m index 45a69de..edfe719 100644 --- a/remoteTaskService/remoteTaskService.m +++ b/remoteTaskService/remoteTaskService.m @@ -568,7 +568,7 @@ bail: //number of handle int numberOfProcFDs = 0; - //socket handle struct + //socket info struct struct socket_fdinfo socketInfo = {0}; //socket local addr