OsAccounts.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2021 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.datamodel;

import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.lang.ref.WeakReference;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.EnumSet;
import java.util.List;
import java.util.Optional;
import java.util.logging.Level;
import java.util.stream.Collectors;
import javax.swing.Action;
import javax.swing.SwingUtilities;
import org.apache.commons.lang3.StringUtils;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle.Messages;
import org.openide.util.WeakListeners;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.events.OsAccountsUpdatedEvent;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.TimeZoneUtils;
import static org.sleuthkit.autopsy.datamodel.AbstractContentNode.backgroundTasksPool;
import org.sleuthkit.autopsy.events.AutopsyEvent;
import org.sleuthkit.datamodel.Host;
import org.sleuthkit.datamodel.OsAccount;
import org.sleuthkit.datamodel.OsAccountRealm;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.Tag;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskDataException;

public final class OsAccounts implements AutopsyVisitableItem {

    private static final Logger logger = Logger.getLogger(OsAccounts.class.getName());
    private static final String ICON_PATH = "org/sleuthkit/autopsy/images/os-account.png";
    private static final SimpleDateFormat DATE_FORMATTER = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss z");
    private static final String OS_ACCOUNT_DATA_AVAILABLE_EVENT = "OS_ACCOUNT_DATA_AVAILABLE_EVENT";
    private static final String LIST_NAME = Bundle.OsAccount_listNode_name();

    private SleuthkitCase skCase;
    private final long filteringDSObjId;

    public static String getListName() {
        return LIST_NAME;
    }

    public OsAccounts(SleuthkitCase skCase) {
        this(skCase, 0);
    }

    public OsAccounts(SleuthkitCase skCase, long objId) {
        this.skCase = skCase;
        this.filteringDSObjId = objId;
    }

    @Override
    public <T> T accept(AutopsyItemVisitor<T> visitor) {
        return visitor.visit(this);
    }

    @Messages({
        "OsAccount_listNode_name=OS Accounts"
    })
    public final class OsAccountListNode extends DisplayableItemNode {

        public OsAccountListNode() {
            super(Children.create(new OsAccountNodeFactory(), true));
            setName(LIST_NAME);
            setDisplayName(LIST_NAME);
            setIconBaseWithExtension("org/sleuthkit/autopsy/images/os-account.png");
        }

        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
            return visitor.visit(this);
        }

        @Override
        public boolean isLeafTypeNode() {
            return true;
        }

        @Override
        public String getItemType() {
            return getClass().getName();
        }
    }

    private final class OsAccountNodeFactory extends ChildFactory.Detachable<OsAccount> {

        private final PropertyChangeListener listener = new PropertyChangeListener() {
            @Override
            public void propertyChange(PropertyChangeEvent evt) {
                String eventType = evt.getPropertyName();
                if (eventType.equals(Case.Events.OS_ACCOUNTS_ADDED.toString())
                        || eventType.equals(Case.Events.OS_ACCOUNTS_DELETED.toString())) {
                    refresh(true);
                } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
                    // case was closed. Remove listeners so that we don't get called with a stale case handle
                    if (evt.getNewValue() == null) {
                        removeNotify();
                        skCase = null;
                    }
                }
            }
        };

        private final PropertyChangeListener weakPcl = WeakListeners.propertyChange(listener, null);

        @Override
        protected void finalize() throws Throwable {
            super.finalize();
            Case.removeEventTypeSubscriber(Collections.singleton(Case.Events.OS_ACCOUNTS_ADDED), weakPcl);
            Case.removeEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), weakPcl);
        }

        @Override
        protected void addNotify() {
            Case.addEventTypeSubscriber(EnumSet.of(Case.Events.OS_ACCOUNTS_ADDED, Case.Events.OS_ACCOUNTS_DELETED), listener);
            Case.addEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), listener);
        }

        @Override
        protected boolean createKeys(List<OsAccount> list) {
            if (skCase != null) {
                try {
                    if (filteringDSObjId == 0) {
                        list.addAll(skCase.getOsAccountManager().getOsAccounts());
                    } else {
                        Host host = skCase.getHostManager().getHostByDataSource(skCase.getDataSource(filteringDSObjId));
                        list.addAll(skCase.getOsAccountManager().getOsAccounts(host));
                    }
                } catch (TskCoreException | TskDataException ex) {
                    logger.log(Level.SEVERE, "Unable to retrieve list of OsAccounts for case", ex);
                    return false;
                }
            }
            return true;
        }

        @Override
        protected Node createNodeForKey(OsAccount key) {
            return new OsAccountNode(key);
        }
    }

    public static final class OsAccountNode extends AbstractContentNode<OsAccount> {

        private OsAccount account;

        private final PropertyChangeListener listener = new PropertyChangeListener() {
            @Override
            public void propertyChange(PropertyChangeEvent evt) {
                if (evt.getPropertyName().equals(Case.Events.OS_ACCOUNTS_UPDATED.name())) {
                    OsAccountsUpdatedEvent updateEvent = (OsAccountsUpdatedEvent) evt;
                    for (OsAccount acct : updateEvent.getOsAccounts()) {
                        if (acct.getId() == account.getId()) {
                            account = acct;
                            updateSheet();
                            break;
                        }
                    }
                } else if (evt.getPropertyName().equals(OS_ACCOUNT_DATA_AVAILABLE_EVENT)
                        && evt.getNewValue() instanceof AsynchOsAcctData
                        && ((AsynchOsAcctData) evt.getNewValue()).getOsAccountId() == account.getId()) {

                    List<NodeProperty<?>> propertiesToUpdate = new ArrayList<>();

                    AsynchOsAcctData osAcctData = (AsynchOsAcctData) evt.getNewValue();

                    List<String> realmNames = osAcctData.getOsAcctRealm().getRealmNames();
                    if (!realmNames.isEmpty()) {
                        String realmNamesStr = realmNames.stream()
                                .map(String::trim)
                                .distinct()
                                .sorted((a, b) -> a.compareToIgnoreCase(b))
                                .collect(Collectors.joining(", "));

                        propertiesToUpdate.add(new NodeProperty<>(
                                Bundle.OsAccounts_accountRealmNameProperty_name(),
                                Bundle.OsAccounts_accountRealmNameProperty_displayName(),
                                Bundle.OsAccounts_accountRealmNameProperty_desc(),
                                realmNamesStr));
                    }

                    String scopeName = osAcctData.getOsAcctRealm().getScope().getName();
                    if (StringUtils.isNotBlank(scopeName)) {
                        propertiesToUpdate.add(new NodeProperty<>(
                                Bundle.OsAccounts_accountScopeNameProperty_name(),
                                Bundle.OsAccounts_accountScopeNameProperty_displayName(),
                                Bundle.OsAccounts_accountScopeNameProperty_desc(),
                                scopeName));
                    }

                    List<Host> hosts = osAcctData.getHosts();
                    if (!hosts.isEmpty()) {
                        String hostsString = hosts.stream()
                                .map(h -> h.getName().trim())
                                .distinct()
                                .sorted((a, b) -> a.compareToIgnoreCase(b))
                                .collect(Collectors.joining(", "));

                        propertiesToUpdate.add(new NodeProperty<>(
                                Bundle.OsAccounts_accountHostNameProperty_name(),
                                Bundle.OsAccounts_accountHostNameProperty_displayName(),
                                Bundle.OsAccounts_accountHostNameProperty_desc(),
                                hostsString));
                    }

                    SwingUtilities.invokeLater(() -> 
                            updateSheet(propertiesToUpdate.toArray(new NodeProperty<?>[propertiesToUpdate.size()])));
                }
            }
        };

        private final PropertyChangeListener weakListener = WeakListeners.propertyChange(listener, null);

        OsAccountNode(OsAccount account) {
            super(account);
            this.account = account;

            setName(account.getName());
            setDisplayName(account.getName());
            setIconBaseWithExtension(ICON_PATH);

            Case.addEventTypeSubscriber(Collections.singleton(Case.Events.OS_ACCOUNTS_UPDATED), weakListener);
        }

        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
            return visitor.visit(this);
        }

        @Override
        public boolean isLeafTypeNode() {
            return true;
        }

        @Override
        public String getItemType() {
            return getClass().getName();
        }

        OsAccount getOsAccount() {
            return account;
        }

        @Messages({
            "OsAccounts_accountNameProperty_name=Name",
            "OsAccounts_accountNameProperty_displayName=Name",
            "OsAccounts_accountNameProperty_desc=Os Account name",
            "OsAccounts_accountRealmNameProperty_name=RealmName",
            "OsAccounts_accountRealmNameProperty_displayName=Realm Name",
            "OsAccounts_accountRealmNameProperty_desc=OS Account Realm Name",
            "OsAccounts_accountHostNameProperty_name=HostName",
            "OsAccounts_accountHostNameProperty_displayName=Host",
            "OsAccounts_accountHostNameProperty_desc=OS Account Host Name",
            "OsAccounts_accountScopeNameProperty_name=ScopeName",
            "OsAccounts_accountScopeNameProperty_displayName=Scope",
            "OsAccounts_accountScopeNameProperty_desc=OS Account Scope Name",
            "OsAccounts_createdTimeProperty_name=creationTime",
            "OsAccounts_createdTimeProperty_displayName=Creation Time",
            "OsAccounts_createdTimeProperty_desc=OS Account Creation Time",
            "OsAccounts_loginNameProperty_name=loginName",
            "OsAccounts_loginNameProperty_displayName=Login Name",
            "OsAccounts_loginNameProperty_desc=Os Account login name"
        })

        void updateSheet() {
            this.setSheet(createSheet());
        }

        @Override
        protected Sheet createSheet() {
            Sheet sheet = super.createSheet();
            Sheet.Set propertiesSet = sheet.get(Sheet.PROPERTIES);
            if (propertiesSet == null) {
                propertiesSet = Sheet.createPropertiesSet();
                sheet.put(propertiesSet);
            }

            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_accountNameProperty_name(),
                    Bundle.OsAccounts_accountNameProperty_displayName(),
                    Bundle.OsAccounts_accountNameProperty_desc(),
                    account.getName() != null ? account.getName() : ""));

            Optional<String> optional = account.getLoginName();
            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_loginNameProperty_name(),
                    Bundle.OsAccounts_loginNameProperty_displayName(),
                    Bundle.OsAccounts_loginNameProperty_desc(),
                    optional.isPresent() ? optional.get() : ""));

            // Fill with empty string, fetch on background task.
            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_accountHostNameProperty_name(),
                    Bundle.OsAccounts_accountHostNameProperty_displayName(),
                    Bundle.OsAccounts_accountHostNameProperty_desc(),
                    ""));

            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_accountScopeNameProperty_name(),
                    Bundle.OsAccounts_accountScopeNameProperty_displayName(),
                    Bundle.OsAccounts_accountScopeNameProperty_desc(),
                    ""));

            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_accountRealmNameProperty_name(),
                    Bundle.OsAccounts_accountRealmNameProperty_displayName(),
                    Bundle.OsAccounts_accountRealmNameProperty_desc(),
                    ""));

            Optional<Long> creationTimeValue = account.getCreationTime();
            String timeDisplayStr
                    = creationTimeValue.isPresent() ? TimeZoneUtils.getFormattedTime(creationTimeValue.get()) : "";

            propertiesSet.put(new NodeProperty<>(
                    Bundle.OsAccounts_createdTimeProperty_name(),
                    Bundle.OsAccounts_createdTimeProperty_displayName(),
                    Bundle.OsAccounts_createdTimeProperty_desc(),
                    timeDisplayStr));

            backgroundTasksPool.submit(new GetOsAccountRealmTask(new WeakReference<>(this), weakListener));

            return sheet;
        }

        @Override
        public Action[] getActions(boolean popup) {
            List<Action> actionsList = new ArrayList<>();
            actionsList.addAll(Arrays.asList(super.getActions(popup)));
            actionsList.addAll(DataModelActionsFactory.getActions(account));

            return actionsList.toArray(new Action[actionsList.size()]);
        }

        @Override
        protected List<Tag> getAllTagsFromDatabase() {
            throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates.
        }

        @Override
        public <T> T accept(ContentNodeVisitor<T> visitor) {
            return visitor.visit(this);
        }

        static class GetOsAccountRealmTask implements Runnable {

            private final WeakReference<OsAccountNode> weakNodeRef;
            private final PropertyChangeListener listener;

            GetOsAccountRealmTask(WeakReference<OsAccountNode> weakContentRef, PropertyChangeListener listener) {
                this.weakNodeRef = weakContentRef;
                this.listener = listener;
            }

            @Override
            public void run() {
                OsAccountNode node = weakNodeRef.get();
                if (node == null) {
                    return;
                }

                try {
                    SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
                    OsAccount osAcct = node.getOsAccount();
                    long realmId = osAcct.getRealmId();
                    OsAccountRealm realm = skCase.getOsAccountRealmManager().getRealmByRealmId(realmId);

                    List<Host> hosts = skCase.getOsAccountManager().getHosts(osAcct);

                    AsynchOsAcctData evtData = new AsynchOsAcctData(osAcct.getId(), realm, hosts);

                    if (listener != null && realm != null) {
                        listener.propertyChange(new PropertyChangeEvent(
                                AutopsyEvent.SourceType.LOCAL.toString(),
                                OS_ACCOUNT_DATA_AVAILABLE_EVENT,
                                null, evtData));
                    }

                } catch (TskCoreException ex) {
                    Exceptions.printStackTrace(ex);
                }
            }
        }

        private static class AsynchOsAcctData {

            private final long osAccountId;
            private final OsAccountRealm osAcctRealm;
            private final List<Host> hosts;

            AsynchOsAcctData(long osAccountId, OsAccountRealm osAcctRealm, List<Host> hosts) {
                this.osAccountId = osAccountId;
                this.osAcctRealm = osAcctRealm;
                this.hosts = hosts;
            }

            long getOsAccountId() {
                return osAccountId;
            }

            OsAccountRealm getOsAcctRealm() {
                return osAcctRealm;
            }

            List<Host> getHosts() {
                return hosts;
            }
        }
    }
}