httpparser.c

Linux下面截获以态网数据包！是在内核态下面运行的驱动程序

	struct iphdr	*pIPHeader;    // See ip.h
	struct tcphdr	*pTCPHeader;   // See tcp.h
	UINT			iHash;
	char			bReturn = false;

	
	pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
	pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
	
	
	if( IS_FROM_CLIENT( pItem->packet.type ) )
		iHash = ( pIPHeader->saddr - pTCPHeader->source ) % _MAX_HTTP_HASH_BUCKET;
	else
		iHash = ( pIPHeader->daddr - pTCPHeader->dest ) % _MAX_HTTP_HASH_BUCKET;
		
	if( gVar.pHttpHash[ iHash ] == NULL )
	{
		printk("Not find the hash bucket: gVar.pSmtpHash[%d]\r\n", iHash);
		return bReturn;
	}
	
	bReturn = HttpHashHeadOp( gVar.pHttpHash[ iHash ], pItem );
		
	return bReturn;
}

char HttpHashHeadOp( PDOUBLE_LIST_HEAD pSmtpHashBucket, PDOUBLE_LIST_PACKET pItem )
{
	UINT					iFind;
	UINT					MmLen;
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	PSMTP_HASH_HEAD       	pSmtpHashHead;
	PSMTP_HASH_HEAD     	pOKHashHead = NULL;
	PSMTP_HASH_HEAD     	pFreeHashHead = NULL;
	UINT			  		zero;
	char 					*pHttp = NULL;
	UCHAR					uChar;
	USHORT					webMailType = 0;
	DOUBLE_LIST_HEAD 		OutPutItem ;
	DOUBLE_LIST_HEAD 		FreeItem ;
	PDOUBLE_LIST_PACKET 	pTemp;
	USHORT					handleType = 0;
	UINT					i =0;
	
	_InitializeList( &OutPutItem );
	_InitializeList( &FreeItem );
	MmLen = sizeof(SMTP_HASH_HEAD);
	pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
	pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );

	down( &pSmtpHashBucket->fastMutex );
	pSmtpHashHead = (PSMTP_HASH_HEAD)pSmtpHashBucket->pHead;
	if( IS_FROM_CLIENT( pItem->packet.type ) )
	{
		while( pSmtpHashHead )
		{	
			if( pTCPHeader->source == pSmtpHashHead->sPort && pIPHeader->saddr == pSmtpHashHead->sIP )
				break;
			pSmtpHashHead = (PSMTP_HASH_HEAD)pSmtpHashHead->item.pNext;
		}
			
		if( pSmtpHashHead == NULL )
		{
			if( pItem->packet.dataLen < 10 )
			{
				up( &pSmtpHashBucket->fastMutex );
				return false;
			}
			
			pHttp = pItem->packet.buf + pItem->packet.dataOffset;
			uChar = *(pHttp+pItem->packet.dataLen);
			*(pHttp+pItem->packet.dataLen) = '\0';	
			if( kstristr( pHttp, pItem->packet.pConfig->rcflag, 150) )
			{
				webMailType = WEBMAIL_RECEIVE | WEBMAIL_CON;
			}
			else if( kstristr( pHttp, pItem->packet.pConfig->rccontinue, 150 ) )
			{
				webMailType = WEBMAIL_RECEIVE | WEBMAIL_CON;
			}
			else if( kstristr( pHttp, pItem->packet.pConfig->raflag, 150 ) )
			{
				webMailType = (WEBMAIL_RECEIVE|WEBMAIL_ATTACH);
			}
			else if(kstristr( pHttp, pItem->packet.pConfig->scflag, 150 ))
			{
				webMailType = (WEBMAIL_SEND|WEBMAIL_CON);
			}
			else if(kstristr( pHttp, pItem->packet.pConfig->saflag, 150 ))
			{
				webMailType = (WEBMAIL_SEND|WEBMAIL_ATTACH);
			}
			else if( kstristr( pHttp, pItem->packet.pConfig->addlist, 150 ) )
			{
				kPrint(("addlist:%s\r\n", pItem->packet.pConfig->addlist));
				webMailType = WEBMAIL_ADDLIST;
			}
			
			if( webMailType != 0 )	
			{
				//the hash bucket begin here
				pSmtpHashHead = ALLOCATE_HASHHEAD(  GFP_ATOMIC, MmLen);
				if( pSmtpHashHead == NULL )
				{
					printk("Allocate pSmtpHashHead fail\r\n");
					*(pHttp+pItem->packet.dataLen) = uChar;
					up( &pSmtpHashBucket->fastMutex );
					return false;
				}
				
				InitializeSmtpHashHead( pSmtpHashHead );
				pSmtpHashHead->sIP = pIPHeader->saddr;
				pSmtpHashHead->dIP = pIPHeader->daddr;
				pSmtpHashHead->sPort = pTCPHeader->source;
				pSmtpHashHead->timeStamp = gVar.gSysCurTime;
				pSmtpHashHead->timelast = pSmtpHashHead->timeStamp;
				pSmtpHashHead->webMailType = webMailType;
				pSmtpHashHead->pConfig = pItem->packet.pConfig;
				
				if( ++gVar.iWebMailPath >= gVar.WebMailPathNumber )
					gVar.iWebMailPath = 0;
				
				pSmtpHashHead->iFilePath = gVar.iWebMailPath;
				pItem->packet.type |= WEB_MAIL_BEGIN_PACKET;
				
				_InsertHeadListNonLock( pSmtpHashBucket, &pSmtpHashHead->item );
			}
			else
			{
				*(pHttp+pItem->packet.dataLen) = uChar;

				up( &pSmtpHashBucket->fastMutex );
				return false;
			}
			*(pHttp+pItem->packet.dataLen) = uChar;
		}
	}
	else
	{
		while( pSmtpHashHead )
		{	
			if( pTCPHeader->dest == pSmtpHashHead->sPort 
				&& pIPHeader->daddr == pSmtpHashHead->sIP )
				break;
			pSmtpHashHead = (PSMTP_HASH_HEAD)pSmtpHashHead->item.pNext;
		}
			
		if( pSmtpHashHead == NULL )
		{
			up( &pSmtpHashBucket->fastMutex );
			return false;	
		}		
	}

	if(pItem->packet.ruleID != 0 && pSmtpHashHead->ruleID == 0 )
		pSmtpHashHead->ruleID = pItem->packet.ruleID;
	
	pSmtpHashHead->timelast = gVar.gSysCurTime;
	if( !SortPacketEx( pSmtpHashHead, pItem , &FreeItem) )
	{
		_InsertTailListNonLock( &FreeItem, &(pItem->doubleListItem) );
		up( &pSmtpHashBucket->fastMutex );
		goto FreeQuit;		
	}

	while( IsSSortPacketEx( pSmtpHashHead ) || IsCSortPacketEx( pSmtpHashHead ) )
	{
		handleType = HandleMailEx(pSmtpHashHead , &OutPutItem, &FreeItem);
		if( handleType == HANDLE_TYPE_WAITE )
		{
			break;
		}
		else if( handleType == HANDLE_TYPE_CONNECTION_CLOSE) 
		{
			pFreeHashHead = pSmtpHashHead;
			_RemoveItemNonLock( pSmtpHashBucket, &pSmtpHashHead->item);
			break;
		}
		if( i++ > 1000 )
		{
			WriteLogFile("In HttpParser.h HttpHashOp() have a dead while,i=1000\r\n");
			printk("i:%u\r\n", i);
			break;
		}		
	}
	
	if( OutPutItem.pHead )
		pOKHashHead = CopyHashHead( pSmtpHashHead, &OutPutItem );
	
	up( &pSmtpHashBucket->fastMutex );
		
	if( pOKHashHead && pItem->packet.pConfig->IPType & IP_TYPE_BBS )
	{
		InitializeDoubleListItem( &pOKHashHead->item );
		_InsertHeadList( gVar.pBBSFileQueque, &pOKHashHead->item);	
	}
	else if( pOKHashHead )
	{
		InitializeDoubleListItem( &pOKHashHead->item );
		_InsertHeadList( gVar.pWebMailFileQueque, &pOKHashHead->item);
	}
	else if( OutPutItem.pHead)
	{
		gVar.CtrlThreadCtx.bReady = false;
		pTemp = (PDOUBLE_LIST_PACKET)_RemoveTailListNonLock(&OutPutItem);
		while( pTemp )
		{
			PutPacketPool( pTemp );
			pTemp = (PDOUBLE_LIST_PACKET)_RemoveTailListNonLock(&OutPutItem);
		}
	}

	if( pFreeHashHead )
	{
		_InsertTailListFromSmtpHashHeadByLong( pFreeHashHead );
		FREE_HASHHEAD( pFreeHashHead );
	}	
FreeQuit:	
	if( FreeItem.pHead )
	{
		pTemp = (PDOUBLE_LIST_PACKET)_RemoveTailListNonLock(&FreeItem);
		while( pTemp )
		{
			PutPacketPool( pTemp );
			pTemp = (PDOUBLE_LIST_PACKET)_RemoveTailListNonLock(&FreeItem);
		}
	}
	
	return true;
}




void DbgSeq(PSMTP_HASH_HEAD pHttpHashHead )
{
	struct iphdr	*pIPHeader;    // See ip.h
	struct tcphdr	*pTCPHeader;   // See tcp.h
	PDOUBLE_LIST_PACKET pItem;
	pItem = (PDOUBLE_LIST_PACKET)pHttpHashHead->pHead;
	printk("Client -----------------------------------------------\r\n");
	printk("client nextSeqNumber: %u,cAck:%u\r\n", pHttpHashHead->nextSeqNumber, pHttpHashHead->cAck );
	while( pItem )
	{
		pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
		pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
		printk( "%u, %u, ack:%u\r\n",  ntohl( pTCPHeader->seq), 
			pItem->packet.nextSeqNumber, ntohl( pTCPHeader->ack_seq) );
		pItem = (PDOUBLE_LIST_PACKET)pItem->doubleListItem.pNext;
		
	}
	pItem = (PDOUBLE_LIST_PACKET)pHttpHashHead->pSHead;
	printk("Server -----------------------------------------------\r\n");
	printk("server nextSSeqNumber: %u, sAck:%u\r\n", pHttpHashHead->nextSSeqNumber, pHttpHashHead->sAck );
	while( pItem )
	{
		pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
		pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
		printk("%u, %u, ack:%u\r\n", ntohl( pTCPHeader->seq), pItem->packet.nextSeqNumber,ntohl( pTCPHeader->ack_seq));
		pItem = (PDOUBLE_LIST_PACKET)pItem->doubleListItem.pNext;
	}	
}

char SortPacket( PSMTP_HASH_HEAD pHttpHashHead , PDOUBLE_LIST_PACKET pItem )
{
	struct iphdr    *pIPHeader;    // See ip.h
	struct tcphdr	*pTCPHeader;   // See tcp.h
	struct iphdr    *pIPHeader2;    // See ip.h
	struct tcphdr	*pTCPHeader2;   // See tcp.h
	PSMTP_HASH_HEAD pSmtpHashHead;
	PSMTP_HASH_HEAD pOKHashHead = NULL;
	UINT			zero;
	char 			*pHttp = NULL;
	UCHAR			uChar;
	USHORT			webMailType = 0;
	char			bReturn = false;
	PPACKET_DATA 		pPrePacket;
	PDOUBLE_LIST_PACKET 	pListPacket;

	zero = 0;
	pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
	pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
	
	InitializeDoubleListItem( &pItem->doubleListItem );
		
	if( IS_FROM_CLIENT( pItem->packet.type ) )
	{
		//client the first node
		if( pHttpHashHead->nextSeqNumber == 0 )
		{
			pHttpHashHead->nextSeqNumber = ntohl( pTCPHeader->seq );
			pHttpHashHead->pHead = pHttpHashHead->pTail = pHttpHashHead->pSeq = &pItem->doubleListItem;
			return true;
		}
		
		if( ntohl( pTCPHeader->seq )< pHttpHashHead->nextSeqNumber )
			return false;
			
		if( pHttpHashHead->pTail == NULL )
		{
			//the first node
			pHttpHashHead->pTail = pHttpHashHead->pHead = &pItem->doubleListItem;
			if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSeqNumber )
				pHttpHashHead->pSeq = pHttpHashHead->pTail;
		}
		else
		{
			pPrePacket = &(((PDOUBLE_LIST_PACKET)(pHttpHashHead->pTail))->packet);
			if( ntohl( pTCPHeader->seq ) >= pPrePacket->nextSeqNumber )
			{
				//add tail
				InitializeDoubleListItem( &pItem->doubleListItem );
				pItem->doubleListItem.pPre = pHttpHashHead->pTail;
				pHttpHashHead->pTail->pNext = &pItem->doubleListItem;
				pHttpHashHead->pTail = &pItem->doubleListItem;
							
			}
			else
			{
				pListPacket = (PDOUBLE_LIST_PACKET)(pHttpHashHead->pTail)->pPre;
		
				while( pListPacket )
				{
					if( ntohl(pTCPHeader->seq) >= pListPacket->packet.nextSeqNumber )
					{
						break;
					}
					pListPacket = (PDOUBLE_LIST_PACKET)pListPacket->doubleListItem.pPre;
					
				}
				if( pListPacket )
				{
					//Handle the same packet
					pIPHeader2 = (struct iphdr*)((UCHAR *)(((PDOUBLE_LIST_PACKET)pListPacket->doubleListItem.pNext)->packet.buf) + ETHER_HDR_LEN );
					pTCPHeader2 = (struct tcphdr *)( (UCHAR *)pIPHeader2 + (pIPHeader2->ihl)*4 );
					if( pTCPHeader->seq == pTCPHeader2->seq )
					{
						//same packet, 
						//reclaim the packet to the pLeisurePool
		//				printk("same packet\r\n");;
						return false;
					}
					//add middle
					//printk("Add Middle\r\n");
					pItem->doubleListItem.pNext = pListPacket->doubleListItem.pNext;
					pItem->doubleListItem.pPre = &pListPacket->doubleListItem;
					
					pListPacket->doubleListItem.pNext->pPre = &(pItem->doubleListItem);
					pListPacket->doubleListItem.pNext = &(pItem->doubleListItem);
				}
				else
				{
					//add head
					//printk("Add Head\r\n");
					pIPHeader2 = (struct iphdr*)((UCHAR *)((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ETHER_HDR_LEN );
					pTCPHeader2 = (struct tcphdr *)( (UCHAR *)pIPHeader2 + (pIPHeader2->ihl)*4 );
					if( pTCPHeader->seq == pTCPHeader2->seq )
					{
						//same packet, 
						//reclaim the packet to the pLeisurePool
		//				printk("Add Head same packet\r\n");
						return false;
					}
					pItem->doubleListItem.pNext = pHttpHashHead->pHead;
					pItem->doubleListItem.pPre = NULL;
					pHttpHashHead->pHead->pPre = &(pItem->doubleListItem);
					pHttpHashHead->pHead = &(pItem->doubleListItem);
					if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSeqNumber )
						pHttpHashHead->pSeq = pHttpHashHead->pHead;
					else
						pHttpHashHead->pSeq = NULL;
				}
										
			}
		}
		
	}
	else
	{
		
		if( pHttpHashHead->nextSSeqNumber == 0 )
		{
			//SERVER the first node
			if( ntohl( pTCPHeader->ack_seq) < pHttpHashHead->nextSeqNumber)
			{
				if( pItem->packet.dataLen > 10 )
				{
					pHttp = pItem->packet.buf + pItem->packet.dataOffset;
					uChar = *(pHttp+pItem->packet.dataLen);
					*(pHttp+pItem->packet.dataLen) = '\0';	
					if( kstristr( pHttp, "HTTP", 2 ) )
					{
						pHttpHashHead->nextSSeqNumber = ntohl( pTCPHeader->seq );
						pHttpHashHead->pSHead = pHttpHashHead->pSTail =pHttpHashHead->pSSeq = &pItem->doubleListItem;
						*(pHttp+pItem->packet.dataLen) = uChar;
						return true;
					}
					else
					{
						*(pHttp+pItem->packet.dataLen) = uChar;
						return false;
					}
				}
				else
					return false;
			}
			else
			{
				pHttpHashHead->nextSSeqNumber = ntohl( pTCPHeader->seq );
				pItem->doubleListItem.pNext = pHttpHashHead->pSHead;
				pHttpHashHead->pSHead = pHttpHashHead->pSTail =pHttpHashHead->pSSeq = &pItem->doubleListItem;
				return true;
				
			}