wizspy.c

Linux 上的socket嗅探器

    // ource ether addr
    sprintf(itemsg[4],"%02X%02X%02X%02X%02X%02X",
                ethhdr.h_source[0],ethhdr.h_source[1],ethhdr.h_source[2],
                ethhdr.h_source[3],ethhdr.h_source[4],ethhdr.h_source[5]);


    sprintf(itemsg[5],"[%d]",ethhdr.h_proto);
    for(freei=0;freei<MAX_ETHER_TYPE_NUM;freei++)
    {
        if(ethhdr.h_proto==eth_p_type[freei].type)
        {
             sprintf(itemsg[5],"%s [%d]",eth_p_type[freei].info,ethhdr.h_proto);
             break;
        }
    }

    if(areae_ethrownum>=200)
    {
        gtk_clist_remove(GTK_CLIST(spyareae_ethlist.ctrl),areae_ethrownum-1);
        areae_ethrownum=areae_ethrownum-1;
    }

    index=gtk_clist_insert(GTK_CLIST(spyareae_ethlist.ctrl),0,areae_ethlist_defaulttitle);
    for(freei=0;freei<6;freei++)
        gtk_clist_set_text(GTK_CLIST(spyareae_ethlist.ctrl),index,freei,(gchar *)itemsg[freei]);
    gtk_clist_set_row_data (GTK_CLIST(spyareae_ethlist.ctrl), index	,(gpointer)lpkt);
    areae_ethrownum++;

/*----------------------  add ip packet to list---------------------------*/
    if(lpkt->dlen<ETH_HLEN+20||ethhdr.h_proto!=ETH_P_IP)
        return ;

    BufGetIPhdr(&iphdr,(unsigned char *)(lpkt->data+ETH_HLEN));
    
    /* ID */
    sprintf(itemsg[0],"%ld",lpkt->ID);
    /* time */
    sprintf(itemsg[1],"%d-%02d-%02d %02d:%02d:%02d",
        lpkt->recvtm.year,lpkt->recvtm.month,lpkt->recvtm.day,
        lpkt->recvtm.hour,lpkt->recvtm.minute,lpkt->recvtm.second);
    /* Version  */     
    sprintf(itemsg[2],"%d",iphdr.version);

    /* Protocol */
    sprintf(itemsg[3],"%d",iphdr.protocol);
    for(freei=0;freei<MAX_IPPROTOCOL_NUM;freei++)
    {
       if(iphdr.protocol==ip_p_type[freei].type)
       {
            sprintf(itemsg[3],"%s",ip_p_type[freei].name);
            break;
       }
    }

    /* Source IP */
    sprintf(itemsg[4],"%d.%d.%d.%d",
        (int)((iphdr.sourceIP>>24)&0xFF),
        (int)((iphdr.sourceIP>>16)&0xFF),
        (int)((iphdr.sourceIP>>8)&0xFF),
        (int)((iphdr.sourceIP)&0xFF)
        );
     /* Dest IP */
     sprintf(itemsg[5],"%d.%d.%d.%d",
         (int)((iphdr.destIP>>24)&0xFF),
         (int)((iphdr.destIP>>16)&0xFF),
         (int)((iphdr.destIP>>8)&0xFF),
         (int)((iphdr.destIP)&0xFF)
         ); 
    
    /* IHL */
    sprintf(itemsg[6],"%d",iphdr.head_len*4);
    /* Type of service */
    sprintf(itemsg[7],"%d",iphdr.tos);
    /* Total Length */
    sprintf(itemsg[8],"%d",iphdr.packet_len);
    /* Identification */
    sprintf(itemsg[9],"%d",iphdr.ip_id);

    /* fragment offset field */
    sprintf(itemsg[10],"%d", iphdr.frag_off);
    /* Time to Live */
    sprintf(itemsg[11],"%d",iphdr.ttl);
    /* Header Checksum */
    sprintf(itemsg[12],"%d",iphdr.checksum);


    if(areae_iprownum>=200)
    {
        gtk_clist_remove(GTK_CLIST(spyareae_iplist.ctrl),areae_iprownum-1);
        areae_iprownum=areae_iprownum-1;
    }

    index=gtk_clist_insert(GTK_CLIST(spyareae_iplist.ctrl),0,areae_iplist_defaulttitle);
    gtk_clist_set_row_data (GTK_CLIST(spyareae_iplist.ctrl), index	,(gpointer)lpkt);

    for(freei=0;freei<13;freei++)
        gtk_clist_set_text(GTK_CLIST(spyareae_iplist.ctrl),index,freei,(gchar *)itemsg[freei]);
    areae_iprownum++;
         
}


/*   set packet receive option   */

#include <stdarg.h>

void wizspy_DlgOnDebugMessage( char *pszMsg, ... )
{
    static gulong count=0;
    static char pszErr[ 1024 ];
    char *msgstart=NULL;
    sprintf(pszErr,"%06ld:",++count);
    msgstart=pszErr+strlen(pszErr); 
    va_list args;
    va_start( args, pszMsg );
    vsprintf( msgstart, pszMsg, args );  pszErr[ 1023 ] = '\0';
    va_end( args );
    if(count%120==0)
        wizspy_areaa_settext(pszErr);
    else
        wizspy_areaa_addtext(pszErr);
    uWait(50);
}


gint wiz_spy_checkpacket(SPYLIST * lpkt)
{
    static ETHHDR ethhdr;
    static IPHDR iphdr; 
    gint freei,found;
    
    // check ether type
    found=0;
    memset(&ethhdr,0,sizeof(ETHHDR));    
    BufGetETHhdr(&ethhdr,(unsigned char *)(lpkt->data));
    for(freei=0;freei<MAX_ETHER_TYPE_NUM;freei++)
    {
        if(ether_packettype_used[freei].itemdata==ethhdr.h_proto
            &&ether_packettype_used[freei].itemname[0]!=0)
        {
            found = freei+1;
            break;
        }
    }

    if(!found)return 0;
    else if(ethhdr.h_proto!=ETH_P_IP)
        return found;
    // check ip protocal
    found=0;
    memset(&iphdr,0,sizeof(IPHDR));
    BufGetIPhdr(&iphdr,(unsigned char *)(lpkt->data+ETH_HLEN));

    for(freei=0;freei<MAX_IPPROTOCOL_NUM;freei++)
    {
        if(iptype_used[freei].itemdata==iphdr.protocol
            &&iptype_used[freei].itemname[0]!=0)
        {
            found = freei+1;
            break;
        }
    }
    if(!found)return 0;

    // check source ip
    found=0;
    for(freei=0;freei<MAX_NOUSEIPNUM;freei++)
    {
        if(wizspy_areab4_srcip[freei].itemdata==iphdr.sourceIP
            &&wizspy_areab4_srcip[freei].itemname[0]!=0)
        {
            found = freei+1;
            break;
        }
    }
    
    if(ifsrcenableall)
        found=!found;
    if(!found)return 0;

    // check dest ip
    found=0;
    for(freei=0;freei<MAX_NOUSEIPNUM;freei++)
    {
        if(wizspy_areab4_destip[freei].itemdata==iphdr.destIP
            &&wizspy_areab4_destip[freei].itemname[0]!=0)
        {
            found = freei+1;
            break;
        }
    }
    if(ifdestenableall)
        found=!found;
    if(!found)return 0;
    
    return found;
}


int wizspy_DlgOnDelPacket(SPYLIST * lpkt)
{
    /* del packet from area E */
    if(lpkt!=NULL)
    {
        int row=0;
        row=gtk_clist_find_row_from_data (GTK_CLIST(spyareae_ethlist.ctrl),(gpointer)lpkt);
        if(row>=0)
            gtk_clist_remove(GTK_CLIST(spyareae_ethlist.ctrl),row);
         row=gtk_clist_find_row_from_data (GTK_CLIST(spyareae_iplist.ctrl),(gpointer)lpkt);
        if(row>=0)
            gtk_clist_remove(GTK_CLIST(spyareae_iplist.ctrl),row);

    }


    uWait(50);
    return 1;
}

int wizspy_DlgOnGetPacket(SPYLIST * lpkt)
{
     /* add this packet to area E */        
     if(lpkt!=NULL&&lpkt->dlen>=ETH_HLEN)
     {         
         if(wiz_spy_checkpacket(lpkt))
         {
              wizspy_DlgOnDebugMessage("Receive data..");
              wizspy_areae_addpacket(lpkt);
         }
     }

    uWait(50);
    return 1;
}


/*           main    dialogs       */
void wizspy_dialog_destroy( GtkWidget *window, gpointer fundata)
{
    /* we must close spy, and free all memmory alloced */

    SpySetState(SPY_CLOSE);   
}

GtkWidget* get_wizspy_dialog( GtkWidget *window)
{
    GtkWidget *areaA, *areaC, *areaD, *areaE;
    GtkWidget *span_ha, *span_hb, *span_va, *frame;
    gint freei;
    /*   --------- init setting data ------------ */
    memset(ether_packettype_used,0,sizeof(GtkListBoxItemData)*MAX_ETHER_TYPE_NUM);
    memset(ether_packettype_unused,0,sizeof(GtkListBoxItemData)*MAX_ETHER_TYPE_NUM); 
    memset(iptype_used,0,sizeof(GtkListBoxItemData)*MAX_IPPROTOCOL_NUM);
    memset(iptype_unused,0,sizeof(GtkListBoxItemData)*MAX_IPPROTOCOL_NUM);     
    memset(wizspy_areab4_srcip,0,sizeof(GtkListBoxItemData)*MAX_NOUSEIPNUM);
    memset(wizspy_areab4_destip,0,sizeof(GtkListBoxItemData)*MAX_NOUSEIPNUM);                                                  
    ifsrcenableall=0;
    ifdestenableall=0;
    // ethtype
    for(freei=0;freei<MAX_ETHER_TYPE_NUM;freei++)
    {
        ether_packettype_unused[freei].itemdata=eth_p_type[freei].type;
        strcpy(ether_packettype_unused[freei].itemname,eth_p_type[freei].name);
    }
    // ip protocal
    for(freei=0;freei<MAX_IPPROTOCOL_NUM;freei++)
    {
        iptype_unused[freei].itemdata=ip_p_type[freei].type;
        strcpy(iptype_unused[freei].itemname,ip_p_type[freei].name);
    }     

// ip address invald
    
/*             init setting end              */

    
/*
   va          span_va    return
   |+ha        span_ha
   | |-A       area A,    message list [text area]
   | |-E       area E,    packet list, [clist]
   |+hb        span_hb
     |-C       area C,    packet tree, [tree view]
     |-D       area D,    frame show,  [draw area]      
*/

    /* create and link span */
    span_va = gtk_vpaned_new ();
    span_ha = gtk_hpaned_new ();
    span_hb = gtk_hpaned_new ();

    gtk_paned_add1 (GTK_PANED (span_va), span_ha);
    gtk_paned_add2 (GTK_PANED (span_va), span_hb);
    /* span_ha.1 = area A */
    areaA= textarea_createlist(NULL,&spytext_areaa);
    gtk_widget_set_size_request (GTK_WIDGET (areaA), 300, 240);
    frame=gtk_frame_new("Message log:");
    gtk_container_add (GTK_CONTAINER (frame), areaA);
    gtk_paned_add1 (GTK_PANED (span_ha), frame);
    /* span_vb.1 = area E */
    areaE= wizspy_areae_create(NULL);
    gtk_widget_set_size_request (GTK_WIDGET (areaE), 500, 240);
    frame=gtk_frame_new("Packet list:");
    gtk_container_add (GTK_CONTAINER (frame), areaE);
    gtk_paned_add2 (GTK_PANED (span_ha), frame);
    /* span_hb.1 = area C */
    areaC= wizspy_areac_create(NULL);
    gtk_widget_set_size_request (GTK_WIDGET (areaC), 300, 240);
    frame=gtk_frame_new("Packet content tree:");
    gtk_container_add (GTK_CONTAINER (frame), areaC);
    gtk_paned_add1 (GTK_PANED (span_hb), frame);
    /* span_hb.2 = area D */
    areaD= wizspy_aread_create(NULL);
    gtk_widget_set_size_request (GTK_WIDGET (areaD), 500, 240);
    frame=gtk_frame_new("Packet data :");
    gtk_container_add (GTK_CONTAINER (frame), areaD);
    gtk_paned_add2 (GTK_PANED (span_hb), frame);

    if(window!=NULL)
    {
        gtk_container_add (GTK_CONTAINER (window), span_va);
        gtk_widget_show (span_va);
    }

    /* Here we connect the "destroy" event to a signal handler */
    g_signal_connect (G_OBJECT (span_va), "destroy", G_CALLBACK (wizspy_dialog_destroy), NULL);
                                 
    SpySetFunction(wizspy_DlgOnGetPacket,wizspy_DlgOnDelPacket,wizspy_DlgOnDebugMessage);
    

    return span_va;
}