filterfile.c

一文件过滤与加密,系统监视以及控制的东东,自己看

/******************************************************************/
/*                                                                */
/*  Winpooch : Windows Watchdog                                   */
/*  Copyright (C) 2004-2006  Benoit Blanchon                      */
/*                                                                */
/*  This program is free software; you can redistribute it        */
/*  and/or modify it under the terms of the GNU General Public    */
/*  License as published by the Free Software Foundation; either  */
/*  version 2 of the License, or (at your option) any later       */
/*  version.                                                      */
/*                                                                */
/*  This program is distributed in the hope that it will be       */
/*  useful, but WITHOUT ANY WARRANTY; without even the implied    */
/*  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR       */
/*  PURPOSE.  See the GNU General Public License for more         */
/*  details.                                                      */
/*                                                                */
/*  You should have received a copy of the GNU General Public     */
/*  License along with this program; if not, write to the Free    */
/*  Software Foundation, Inc.,                                    */
/*  675 Mass Ave, Cambridge, MA 02139, USA.                       */
/*                                                                */
/******************************************************************/


/******************************************************************/
/* Build configuration                                            */
/******************************************************************/

#define TRACE_LEVEL	2	// warning level


/******************************************************************/
/* Includes                                                       */
/******************************************************************/

// module's interface
#include "FilterFile.h"

// standard headers
#include <ctype.h>
#include <stdio.h>
#include <tchar.h>

// project's headers
#include "Assert.h"
#include "FilterTools.h"
#include "ProjectInfo.h"
#include "Strlcpy.h"
#include "Trace.h"


/******************************************************************/
/* Internal constants                                             */
/******************************************************************/

#define FF_CURRENT_VERSION	4

#define MAX_VALUE	512
#define MAX_LINE	512
#define MAX_ERROR	128


typedef enum {
  LT_ERROR,
  LT_COMMENT,
  LT_OPENBRACE,
  LT_CLOSEBRACE,
  LT_VERSION,
  LT_APPLICATION,
  LT_PROGRAM,
  LT_PATH,
  LT_HOOK,
  LT_RULE,
  LT_REASON,
  LT_PARAM, 
  LT_REACTION,
  LT_VERBOSITY,
  LT_OPTION,
  _LT_COUNT //< has to stay last
} LINETYPE ;

LPCTSTR aKeyWords[_LT_COUNT] = {
  NULL,
  TEXT("#"),
  TEXT("{"),
  TEXT("}"),
  TEXT("Version"),
  TEXT("Application"),
  TEXT("Program"),
  TEXT("Path"),
  TEXT("Hook"),
  TEXT("Rule"),
  TEXT("Reason"),
  TEXT("Param"),
  TEXT("Reaction"),
  TEXT("Verbosity"),
  TEXT("Option")
} ;

typedef enum {
  ST_ROOT,
  ST_WAITPROGRAM,
  ST_WAITRULE,
  ST_PROGRAM,
  ST_RULE,
} STATE ;


/******************************************************************/
/* Internal data                                                  */
/******************************************************************/

TCHAR	g_szError[MAX_ERROR] ;


/******************************************************************/
/* Internal functions                                             */
/******************************************************************/

LINETYPE _FilterFile_ReadLine (LPCTSTR szLine, LPTSTR szValue, int nMaxValue) ;

BOOL _FilterFile_EnumFiltersCallback (LPVOID pContext, HFILTER hFilter) ;

VOID _FilterFile_EnumRulesCallback (LPVOID pContext, PFILTRULE pRule) ;


/******************************************************************/
/* Exported function : GetLastError                               */
/******************************************************************/

LPCTSTR FilterFile_GetErrorString () 
{
  return g_szError ;
}


/******************************************************************/
/* Exported function : Read                                       */
/******************************************************************/

HFILTERSET FilterFile_Read (LPCTSTR szFilename) 
{
  FILE		*fp ;
  TCHAR		szValue[MAX_VALUE] ;
  TCHAR		szLine[MAX_LINE] ;
  int		nLine ;
  LINETYPE	nLineType ;
  STATE		nState = ST_ROOT ;
  UINT		nVersion ;
  HFILTERSET	hFilterSet ;
  HFILTER	hCurFilter ;
  FILTRULE	*pCurRule ;
  FILTCOND	*pCurCond ;
  FILTPARAM	*pCurParam ;
  
  // open file
  fp = _tfopen (szFilename, TEXT("rt")) ;

  // open failed ?
  if( ! fp ) {
    wsprintf (g_szError, TEXT("Can't open file %s"), szFilename) ;
    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
    return NULL ;
  }

  // create filter set
  hFilterSet = FilterSet_Create (128) ;

  // for each line (begin)
  for( nLine=1 ; _fgetts(szLine,MAX_LINE,fp) ; nLine++ )
    {
      // read line in file
      nLineType = _FilterFile_ReadLine (szLine, szValue, MAX_VALUE) ;
      
      // error ?
      if( nLineType==LT_ERROR )
	{
	  wsprintf (g_szError, TEXT("On line %d :\nInvalid line format."), nLine) ;
	  TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	  goto failed ;
	}
      
      // comment ?
      if( nLineType==LT_COMMENT ) continue ;
      
      // waiting for a { ?
      if( (nState==ST_WAITPROGRAM || nState==ST_WAITRULE )
	  && nLineType!=LT_OPENBRACE )
	{
	  wsprintf (g_szError, TEXT("On line %d :\nMissing a '{'."), nLine) ;
	  TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	  goto failed ;	
	}

      switch( nLineType )
	{
	case LT_OPENBRACE:

	  switch( nState )
	    {
	    case ST_WAITPROGRAM:
	      TRACE_INFO (TEXT("Enter in program section\n")) ;
	      nState = ST_PROGRAM ;
	      hCurFilter = Filter_Create (NULL) ;
	      break ;
	      
	    case ST_WAITRULE:
	      
	      TRACE_INFO (TEXT("Enter in rule section\n"))  ;

	      nState = ST_RULE ;

	      pCurRule = (FILTRULE*) calloc (1, sizeof(FILTRULE)) ;
	      
	      // set pointer to the current condition
	      pCurCond = &pCurRule->condition ;

	      break ;

	    default:
	      wsprintf (g_szError, TEXT("On line %d :\nUnexpected '{'."), nLine) ;
	      TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	      goto failed ;	
	    }
	    
	  break ; // case LT_OPENBRACE:

	case LT_CLOSEBRACE:
	  
	  switch( nState )
	    {
	    case ST_PROGRAM:
	      TRACE_INFO (TEXT("Leave program section\n")) ;
	      nState = ST_ROOT ;	      
	      FilterSet_AddFilter (hFilterSet, hCurFilter) ;
	      hCurFilter = NULL ;
	      break ;
	      
	    case ST_RULE:

	      TRACE_INFO (TEXT("Leave rule section\n")) ;

	      if( pCurCond->nReason==FILTREASON_UNDEFINED )	{
		wsprintf (g_szError, TEXT("On line %d :\nNo reason specified."), nLine) ;
		TRACE_ERROR (TEXT("%s\n"), g_szError) ;
		goto failed ;	
	      }
	      
	      nState = ST_PROGRAM ;

	      Filter_AddRule (hCurFilter, pCurRule) ;
	      pCurRule = NULL ;

	      break ;

	    default:
	      wsprintf (g_szError, TEXT("On line %d :\nUnexpected '}'."), nLine) ;
	      TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	      goto failed ;	
	    } 
	  
	  break ; // case LT_CLOSEBRACE:

	case LT_VERSION:

	  nVersion = _ttoi (szValue) ;

	  if( nVersion>FF_CURRENT_VERSION ) {
	    wsprintf (g_szError, TEXT("This file has been created for a newer version.\n"
				      "It can't be read by this program, please update.")) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;		      
	  }
	  
	  TRACE_INFO (TEXT("File version is OK\n")) ;
	  
	  break ; // case LT_VERSION:
	  
	case LT_APPLICATION:
	  
	  break ;

	case LT_PROGRAM:

	  if( nState!=ST_ROOT ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  TRACE_INFO (TEXT("Wait for a program section\n")) ;

	  nState = ST_WAITPROGRAM ;
	  
	  break ; // case LT_PROGRAM:

	case LT_PATH:

	  if( nState!=ST_PROGRAM ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  if( Filter_GetProgram(hCurFilter)[0] ) {
	    wsprintf (g_szError, TEXT("On line %d :\nPath already set to :\n%s."), 
		      nLine, Filter_GetProgram(hCurFilter)) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;   
	  }

	  TRACE_INFO (TEXT("Set path to %s\n"), szValue) ;

	  Filter_SetProgram (hCurFilter, szValue) ;

	  break ; // case LT_PATH:

	case LT_HOOK:

	  if( nState!=ST_PROGRAM ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  if( !_tcsicmp(TEXT("Enabled"),szValue) ) 
	    Filter_EnableHook (hCurFilter, TRUE) ;
	  else if( !_tcsicmp(TEXT("Disabled"),szValue) ) 
	    Filter_EnableHook (hCurFilter, FALSE) ;
	  else {
	    wsprintf (g_szError, TEXT("On line %d :\nUnknown value '%s'."), 
		      nLine, szValue) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  TRACE_INFO (TEXT("Hook set to %s\n"), szValue) ;

	  break ; // case LT_HOOK:

	case LT_RULE:

	  if( nState!=ST_PROGRAM ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  TRACE_INFO (TEXT("Wait for a rule section\n")) ;
	  nState = ST_WAITRULE ;

	  break ; // case LT_RULE:

	case LT_REASON:

	  if( nState!=ST_RULE ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  if( pCurCond->nReason != FILTREASON_UNDEFINED ) {
	    wsprintf (g_szError, TEXT("On line %d :\nReasion already set to : %s."), 
		      nLine, FiltReason_GetName(pCurCond->nReason)) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;   	    
	  }

	  pCurCond->nReason = FiltReason_GetId (szValue) ;

	  if( pCurCond->nReason==FILTREASON_UNDEFINED ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnknown reason : '%s'."), 
		      nLine, szValue) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;   
	  }

	  TRACE_INFO (TEXT("Reason set to %s\n"), szValue) ;

	  break ; // case LT_REASON:	 

	case LT_PARAM:

	  if( nState!=ST_RULE ) {
	    wsprintf (g_szError, TEXT("On line %d :\nUnexpected keyword '%s'."), 
		      nLine, aKeyWords[nLineType]) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;
	  }

	  if( pCurCond->nParams>=MAX_PARAMS ) {
	    wsprintf (g_szError, TEXT("On line %d :\nMaximum param count already reached."), 
		      nLine) ;
	    TRACE_ERROR (TEXT("%s\n"), g_szError) ;
	    goto failed ;	    
	  }

	  pCurParam = &pCurCond->aParams[pCurCond->nParams++] ;

	  if( !_tcsicmp(TEXT("Any"), szValue) )
	    {	            
	      pCurParam->nType = FILTPARAM_ANY ;	    
	      TRACE_INFO (TEXT("Param set to ANY\n")) ;
	    }
	  else if( !_tcsnicmp(TEXT("Integer:"), szValue, 8) ) 
	    {
	      pCurParam->nType = FILTPARAM_UINT ;
	      pCurParam->nValue = _ttoi(szValue+8) ;
	      TRACE_INFO (TEXT("Param set to UINT : %d\n"), pCurParam->nValue) ;
	    }
	  else if( !_tcsnicmp(TEXT("String:"), szValue, 7) ) 
	    {
	      pCurParam->nType = FILTPARAM_STRING ;
	      pCurParam->szValue = malloc (_tcslen(szValue)*sizeof(TCHAR)) ;
	      _tcscpy (pCurParam->szValue, szValue+7) ;
	      TRACE_INFO (TEXT("Param type set to STRING : %s\n"), pCurParam->szValue) ;
	    }
	  else if( !_tcsnicmp(TEXT("Wildcards:"), szValue, 10) ) 
	    {
	      pCurParam->nType = FILTPARAM_WILDCARDS ;
	      pCurParam->szValue = malloc (_tcslen(szValue)*sizeof(TCHAR)) ;
	      _tcscpy (pCurParam->szValue, szValue+10) ;
	      TRACE_INFO (TEXT("Param type set to WILDCARDS : %s\n"), pCurParam->szValue) ;
	    }
	  else if( !_tcsnicmp(TEXT("Path:"), szValue, 5) ) 
	    {
	      pCurParam->nType = FILTPARAM_PATH ;
	      pCurParam->szValue = malloc (_tcslen(szValue)*sizeof(TCHAR)) ;
	      _tcscpy (pCurParam->szValue, szValue+5) ;
	      TRACE_INFO (TEXT("Param type set to PATH : %s\n"), pCurParam->szValue) ;
	    }
	  else
	    {
	      wsprintf (g_szError, TEXT("On line %d :\nUnknown type for param : '%s'."), 
			nLine, szValue) ;
	      TRACE_ERROR (TEXT("%s\n"), g_szError) ;