BinaryCookieReader.java

Go to the documentation of this file.

/*
 *
 * Autopsy Forensic Browser
 *
 * Copyright 2019 Basis Technology Corp.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.recentactivity;

import java.io.DataInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Iterator;
import java.util.NoSuchElementException;
import java.util.logging.Level;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.recentactivity.BinaryCookieReader.Cookie;

public final class BinaryCookieReader implements Iterable<Cookie> {

    private static final int MAGIC_SIZE = 4;
    private static final int SIZEOF_INT_BYTES = 4;
    private static final int PAGE_HEADER_VALUE = 256;

    private static final String COOKIE_MAGIC = "cook"; //NON-NLS

    private static final int MAC_EPOC_FIX = 978307200;

    private final int[] pageSizeArray;
    private final File cookieFile;

    private static final Logger LOG = Logger.getLogger(BinaryCookieReader.class.getName());

    private BinaryCookieReader(File cookieFile, int[] pageSizeArray) {
        this.cookieFile = cookieFile;
        this.pageSizeArray = pageSizeArray;
    }

    public static BinaryCookieReader initalizeReader(File cookieFile) throws FileNotFoundException, IOException {
        BinaryCookieReader reader = null;
        try (DataInputStream dataStream = new DataInputStream(new FileInputStream(cookieFile))) {

            byte[] magic = new byte[MAGIC_SIZE];
            if (dataStream.read(magic) != MAGIC_SIZE) {
                throw new IOException("Failed to read header, invalid file size (" + cookieFile.getName() + ")"); //NON-NLS
            }

            if (!(new String(magic)).equals(COOKIE_MAGIC)) {
                throw new IOException(cookieFile.getName() + " is not a cookie file"); //NON-NLS
            }

            int[] sizeArray = null;
            int pageCount = dataStream.readInt();
            if (pageCount != 0) {
                sizeArray = new int[pageCount];

                for (int cnt = 0; cnt < pageCount; cnt++) {
                    sizeArray[cnt] = dataStream.readInt();
                }
                
                LOG.log(Level.INFO, "No cookies found in {0}", cookieFile.getName()); //NON-NLS
            }

            reader = new BinaryCookieReader(cookieFile, sizeArray);
        }

        return reader;
    }

    @Override
    public Iterator<Cookie> iterator() {
        return new CookiePageIterator();
    }

    private class CookiePageIterator implements Iterator<Cookie> {

        int pageIndex = 0;
        CookiePage currentPage = null;
        Iterator<Cookie> currentIterator = null;
        DataInputStream dataStream = null;

        CookiePageIterator() {
            if(pageSizeArray == null || pageSizeArray.length == 0) {
                return;
            }
            
            try {
                dataStream = new DataInputStream(new FileInputStream(cookieFile));
                // skip to the first page
                dataStream.skipBytes((2 * SIZEOF_INT_BYTES) + (pageSizeArray.length * SIZEOF_INT_BYTES));
            } catch (IOException ex) {
                
                String errorMessage = String.format("An error occurred creating an input stream for %s", cookieFile.getName());
                LOG.log(Level.WARNING, errorMessage, ex); //NON-NLS
                closeStream(); // Just incase the error was from skip
            }
        }

        @Override
        public boolean hasNext() {

            if (dataStream == null) {
                return false;
            }
            
            if (currentIterator == null || !currentIterator.hasNext()) {
                try {

                    if (pageIndex < pageSizeArray.length) {
                        byte[] nextPage = new byte[pageSizeArray[pageIndex]];
                        dataStream.read(nextPage);

                        currentPage = new CookiePage(nextPage);
                        currentIterator = currentPage.iterator();
                    } else {
                        closeStream();
                        return false;
                    }

                    pageIndex++;
                } catch (IOException ex) {
                    closeStream();
                    String errorMessage = String.format("A read error occured for file %s (pageIndex = %d)", cookieFile.getName(), pageIndex);
                    LOG.log(Level.WARNING, errorMessage, ex); //NON-NLS
                    return false;
                }
            }

            return currentIterator.hasNext();
        }

        @Override
        public Cookie next() {
            // Just in case someone uses next without hasNext, this check will
            // make sure there are more elements and that we iterate properly 
            // through the pages.
            if (!hasNext()) {
                throw new NoSuchElementException();
            }
            return currentIterator.next();
        }

        private void closeStream() {
            if (dataStream != null) {
                try {
                    dataStream.close();
                    dataStream = null;
                } catch (IOException ex) {
                    String errorMessage = String.format("An error occurred trying to close stream for file %s", cookieFile.getName());
                    LOG.log(Level.WARNING, errorMessage, ex); //NON-NLS
                }
            }
        }
    }

    private class CookiePage implements Iterable<Cookie> {

        int[] cookieOffSets;
        ByteBuffer pageBuffer;

        CookiePage(byte[] page) throws IOException {
            if (page == null || page.length == 0) {
                throw new IllegalArgumentException("Invalid value for page passed to CookiePage constructor"); //NON-NLS
            }

            pageBuffer = ByteBuffer.wrap(page);

            if (pageBuffer.getInt() != PAGE_HEADER_VALUE) {
                pageBuffer = null;
                throw new IOException("Invalid file format, bad page head value found"); //NON-NLS
            }

            pageBuffer.order(ByteOrder.LITTLE_ENDIAN);
            int count = pageBuffer.getInt();
            cookieOffSets = new int[count];

            for (int cnt = 0; cnt < count; cnt++) {
                cookieOffSets[cnt] = pageBuffer.getInt();
            }

            pageBuffer.getInt(); // All 0, not needed
        }

        @Override
        public Iterator<Cookie> iterator() {
            return new CookieIterator();
        }

        private class CookieIterator implements Iterator<Cookie> {

            int index = 0;

            @Override
            public boolean hasNext() {
                if (pageBuffer == null) {
                    return false;
                }

                return index < cookieOffSets.length;
            }

            @Override
            public Cookie next() {
                if (!hasNext()) {
                    throw new NoSuchElementException();
                }

                int offset = cookieOffSets[index];
                int size = pageBuffer.getInt(offset);
                byte[] cookieBytes = new byte[size];
                pageBuffer.get(cookieBytes, 0, size);
                index++;

                return new Cookie(cookieBytes);
            }
        }
    }

    public class Cookie {

        private final static int COOKIE_HEAD_SKIP = 16;

        private final double expirationDate;
        private final double creationDate;

        private final String name;
        private final String url;
        private final String path;
        private final String value;

        protected Cookie(byte[] cookieBytes) {
            if (cookieBytes == null || cookieBytes.length == 0) {
                throw new IllegalArgumentException("Invalid value for cookieBytes passed to Cookie constructor"); //NON-NLS
            }

            ByteBuffer byteBuffer = ByteBuffer.wrap(cookieBytes);
            byteBuffer.order(ByteOrder.LITTLE_ENDIAN);

            // Skip past the four int values that we are not interested in
            byteBuffer.position(byteBuffer.position() + COOKIE_HEAD_SKIP);

            int urlOffset = byteBuffer.getInt();
            int nameOffset = byteBuffer.getInt();
            int pathOffset = byteBuffer.getInt();
            int valueOffset = byteBuffer.getInt();
            byteBuffer.getLong(); // 8 bytes of not needed

            expirationDate = byteBuffer.getDouble();
            creationDate = byteBuffer.getDouble();

            url = decodeString(cookieBytes, urlOffset);
            name = decodeString(cookieBytes, nameOffset);
            path = decodeString(cookieBytes, pathOffset);
            value = decodeString(cookieBytes, valueOffset);
        }

        public final Long getExpirationDate() {
            return ((long)expirationDate) + MAC_EPOC_FIX;
        }

        public final Long getCreationDate() {
            return ((long)creationDate) + MAC_EPOC_FIX;
        }

        public final String getURL() {
            return url;
        }

        public final String getName() {
            return name;
        }

        public final String getPath() {
            return path;
        }

        public final String getValue() {
            return value;
        }

        private String decodeString(byte[] byteArray, int offset) {
            byte[] stringBytes = new byte[byteArray.length - offset];
            for (int index = 0; index < stringBytes.length; index++) {
                byte nibble = byteArray[offset + index];
                if (nibble != '\0') { //NON-NLS
                    stringBytes[index] = nibble;
                } else {
                    break;
                }
            }

            return new String(stringBytes);
        }
    }
}