📄 httpparser.c

📁 Linux下面截获以态网数据包！是在内核态下面运行的驱动程序
💻 C
📖 第 1 页 / 共 5 页
字号:
上一页 1 2 3 45
							pHttpHashHead->pSHead = &(pItem->doubleListItem);
							pItem->doubleListItem.pPre = NULL;
							pItem->doubleListItem.pNext = pOldPacket->doubleListItem.pNext;
							if( pOldPacket->doubleListItem.pNext )
								((PDOUBLE_LIST_PACKET)pOldPacket->doubleListItem.pNext)->doubleListItem.pPre = &(pItem->doubleListItem);
							 else
							 	pHttpHashHead->pSTail = &(pItem->doubleListItem);
							
							InitializeDoubleListItem( &(pOldPacket->doubleListItem) );
							_InsertTailListNonLock( pFree, &(pOldPacket->doubleListItem) );
							
							pListPacket = pItem;
							while( pListPacket && pListPacket->doubleListItem.pNext )
							{
								pOldPacket = (PDOUBLE_LIST_PACKET)pListPacket->doubleListItem.pNext;
								pIPHeader2 = (struct iphdr*)(((UCHAR *)pOldPacket->packet.buf) + ETHER_HDR_LEN );
								pTCPHeader2 = (struct tcphdr *)( (UCHAR *)pIPHeader2 + (pIPHeader2->ihl)*4 );
								if( ntohl( pTCPHeader2->seq ) < pListPacket->packet.nextSeqNumber )
								{
									
									pListPacket->doubleListItem.pNext = pOldPacket->doubleListItem.pNext;
									if( pOldPacket->doubleListItem.pNext )
									{
										pOldPacket->doubleListItem.pNext->pPre = &(pListPacket->doubleListItem);
										InitializeDoubleListItem( &(pOldPacket->doubleListItem) );
										_InsertTailListNonLock( pFree, &(pOldPacket->doubleListItem) );
										pHttpHashHead->iNumber--;
									}
									else
									{
										pHttpHashHead->pSTail = &(pListPacket->doubleListItem);
										InitializeDoubleListItem( &(pOldPacket->doubleListItem) );
										_InsertTailListNonLock( pFree, &(pOldPacket->doubleListItem) );
										pHttpHashHead->iNumber--;
										break;
									}
								}
								else
									break;
							}
							return true;
							
						}
						return false;
					}
					
					pItem->doubleListItem.pNext = pHttpHashHead->pSHead;
					pItem->doubleListItem.pPre = NULL;
					pHttpHashHead->pSHead->pPre = &(pItem->doubleListItem);
					pHttpHashHead->pSHead = &(pItem->doubleListItem);
					pHttpHashHead->iNumber++;
					
					pListPacket = pItem;
					while( pListPacket && pListPacket->doubleListItem.pNext )
					{
						pOldPacket = (PDOUBLE_LIST_PACKET)pListPacket->doubleListItem.pNext;
						pIPHeader2 = (struct iphdr*)(((UCHAR *)pOldPacket->packet.buf) + ETHER_HDR_LEN );
						pTCPHeader2 = (struct tcphdr *)( (UCHAR *)pIPHeader2 + (pIPHeader2->ihl)*4 );
						if( ntohl( pTCPHeader2->seq ) < pListPacket->packet.nextSeqNumber )
						{
							
							pListPacket->doubleListItem.pNext = pOldPacket->doubleListItem.pNext;
							if( pOldPacket->doubleListItem.pNext )
							{
								pOldPacket->doubleListItem.pNext->pPre = &(pListPacket->doubleListItem);
								InitializeDoubleListItem( &(pOldPacket->doubleListItem) );
								_InsertTailListNonLock( pFree, &(pOldPacket->doubleListItem) );
								pHttpHashHead->iNumber--;
							}
							else
							{
								pHttpHashHead->pSTail = &(pListPacket->doubleListItem);
								InitializeDoubleListItem( &(pOldPacket->doubleListItem) );
								_InsertTailListNonLock( pFree, &(pOldPacket->doubleListItem) );
								pHttpHashHead->iNumber--;
								break;
							}
						}
						else
							break;
					}
				}
										
			}
		}		
	}
		
			
	return true;
}

 char IsSortPacket(PSMTP_HASH_HEAD pHttpHashHead ,PDOUBLE_LIST_PACKET pItem)
{
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	
	

	pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
	pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
			
	if( pHttpHashHead->nextSeqNumber == 0 )
	{
		pHttpHashHead->nextSeqNumber = pItem->packet.nextSeqNumber;	
		return true;
	}
	if( IS_FROM_CLIENT( pItem->packet.type ) )
	{
		if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSeqNumber )
			return true;
		
	}
	else
	{
		if( pHttpHashHead->nextSSeqNumber == 0 )
		{
			pHttpHashHead->nextSSeqNumber = pItem->packet.nextSeqNumber;
			return true;
		}
		if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSSeqNumber )
			return true;	
	}
		
			
	return false;
}


 void ReSortPacket(PSMTP_HASH_HEAD pHttpHashHead ,PDOUBLE_LIST_PACKET pItem)
{
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	
	

	pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
	pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
		
	if( pItem )
	{	
		
		if( IS_FROM_CLIENT( pItem->packet.type ) )
		{
			pHttpHashHead->nextSeqNumber = pItem->packet.nextSeqNumber;
			if( pHttpHashHead->pHead == NULL )
				return;
			pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ETHER_HDR_LEN );
			pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );				
			if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSeqNumber )
				pHttpHashHead->pSeq = pHttpHashHead->pHead;
			
		}
		else
		{
			pHttpHashHead->nextSSeqNumber = pItem->packet.nextSeqNumber;
			if( pHttpHashHead->pSHead == NULL )
				return;
			pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pSHead)->packet.buf + ETHER_HDR_LEN );
			pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );				
			if( ntohl( pTCPHeader->seq )== pHttpHashHead->nextSSeqNumber )
				pHttpHashHead->pSSeq = pHttpHashHead->pSHead;
		}
	}

}

char IsSSortPacket(PSMTP_HASH_HEAD pHttpHashHead )
{
	if( pHttpHashHead->pSSeq )
		return true;
	return false;
}

char IsCSortPacket(PSMTP_HASH_HEAD pHttpHashHead )
{
	if( pHttpHashHead->pSeq )
		return true;
	return false;
}



char IsSSortPacketEx(PSMTP_HASH_HEAD pHttpHashHead )
{
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	
	if( pHttpHashHead->pSHead )
	{
		pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pSHead)->packet.buf + ETHER_HDR_LEN );
		pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );	
		if( ntohl(pTCPHeader->seq) <= pHttpHashHead->nextSSeqNumber )
			return true;
	}
	return false;
}

char IsCSortPacketEx(PSMTP_HASH_HEAD pHttpHashHead )
{
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	
	if( pHttpHashHead->pHead )
	{
		pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ETHER_HDR_LEN );
		pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );	
		if( ntohl(pTCPHeader->seq) <= pHttpHashHead->nextSeqNumber )
			return true;
	}
	return false;
}


char HandleReceiveMail(PSMTP_HASH_HEAD pHttpHashHead ,PDOUBLE_LIST_PACKET pItem,
	PDOUBLE_LIST_HEAD pOutPut, PDOUBLE_LIST_HEAD pFree)
{
	struct iphdr           	*pIPHeader;    // See ip.h
	struct tcphdr	     	*pTCPHeader;   // See tcp.h
	PSMTP_HASH_HEAD       	pSmtpHashHead;
	PSMTP_HASH_HEAD     	pOKHashHead = NULL;
	struct timeval  		zero;
	char 			*pHttp = NULL;
	UCHAR			uChar;
	USHORT			webMailType = 0;
	char			bReturn = true;
	
	


	
	if( pItem )
	{
		pIPHeader = (struct iphdr*)(pItem->packet.buf + ETHER_HDR_LEN );
		pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );
		pHttp = pItem->packet.buf + pItem->packet.dataOffset;
		uChar = *(pHttp+pItem->packet.dataLen);
		*(pHttp+pItem->packet.dataLen) = '\0';	
		
		if( IS_FROM_CLIENT( pItem->packet.type ) )
		{
			if( pHttpHashHead->nextSSeqNumber == 0 )
			{
				pHttpHashHead->nextSeqNumber = pItem->packet.nextSeqNumber;
				//输出
				
				//printk("%s\r\n", pHttp);
			}
			if( pHttpHashHead->nextSSeqNumber > ntohl( pTCPHeader->ack_seq ) )
			{
				pHttpHashHead->webMailType = 0;
				if(kstristr( pHttp, pItem->packet.pConfig->scflag, 2 ))
				{
					pItem->packet.type |= WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_CON);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pItem->packet.pConfig->saflag, 2 ))
				{
					pItem->packet.type |= WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_ATTACH);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pItem->packet.pConfig->scflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_CON);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pItem->packet.pConfig->saflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_ATTACH);
					//输出
					//printk("%s\r\n", pHttp);
				}	
				else
				{
					if( !(pHttpHashHead->webMailType & WEBMAIL_RECEIVE) )
					{
						//回收，不是收发邮件包
						pHttpHashHead->webMailType = WEBMAIL_INIT;
						_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
					}
						
				}
			}
			if( bReturn )
			{
				_InsertTailListNonLock( pOutPut, &(pItem->doubleListItem) );
				pHttpHashHead->nextSeqNumber = pItem->packet.nextSeqNumber;
				if( pHttpHashHead->pHead )
				{
					pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ETHER_HDR_LEN );
					pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );	
					if( ntohl(pTCPHeader->seq) == pHttpHashHead->nextSeqNumber )
						pHttpHashHead->pSeq = pHttpHashHead->pHead;
					else
						pHttpHashHead->pSeq = NULL;
				}
			}
			else
				_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
		}
		else
		{
			if( pHttpHashHead->webMailType != WEBMAIL_INIT )
			{
				if(kstristr( pHttp, "HTTP", 2 ))
				{
					if( pHttpHashHead->nextSeqNumber == ntohl( pTCPHeader->ack_seq ) )
					{
						////输出
						//printk("%s\r\n", pHttp);
					}
					else if( pHttpHashHead->nextSeqNumber < ntohl( pTCPHeader->ack_seq ) )
					{
						//丢弃
						_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
					}
					else
					{
						//等待排序
						bReturn = false;
					}
				}
				else
				{
					//输出
					//printk("%s\r\n", pHttp);
				}
			
				if( bReturn )
				{
					_InsertTailListNonLock( pOutPut, &(pItem->doubleListItem) );
					pHttpHashHead->nextSSeqNumber = pItem->packet.nextSeqNumber;
					if( pHttpHashHead->pSHead )
					{
						pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pSHead)->packet.buf + ETHER_HDR_LEN );
						pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );	
						if( ntohl(pTCPHeader->seq) == pHttpHashHead->nextSSeqNumber )
							pHttpHashHead->pSSeq = pHttpHashHead->pSHead;
						else
							pHttpHashHead->pSSeq = NULL;
					}
				}
				else
					_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
			}
			else
				_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
		}
	}
	else 
	{
	
		if( IsCSortPacket(pHttpHashHead) )
		{
			pIPHeader = (struct iphdr*)(((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ETHER_HDR_LEN );
			pTCPHeader = (struct tcphdr *)( (UCHAR *)pIPHeader + (pIPHeader->ihl)*4 );	
			pHttp = ((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.buf + ((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.dataOffset;
			uChar = *(pHttp+((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.dataLen);
			*(pHttp+((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.dataLen) = '\0';	
			if( pHttpHashHead->nextSeqNumber > ntohl( pTCPHeader->ack_seq ) )
			{
				pHttpHashHead->webMailType = 0;
				if(kstristr( pHttp, pHttpHashHead->pConfig->scflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_CON);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pHttpHashHead->pConfig->saflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_ATTACH);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pHttpHashHead->pConfig->scflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_CON);
					//输出
					//printk("%s\r\n", pHttp);
				}
				else if(kstristr( pHttp, pHttpHashHead->pConfig->saflag, 2 ))
				{
					pItem->packet.type = WEB_MAIL_BEGIN_PACKET;
					pHttpHashHead->webMailType = (WEBMAIL_SEND|WEBMAIL_ATTACH);
					//输出
					//printk("%s\r\n", pHttp);
				}	
				else
				{
					if( !(pHttpHashHead->webMailType & WEBMAIL_RECEIVE) )
					{
						pHttpHashHead->webMailType = WEBMAIL_INIT;
						//回收，不是收发邮件包
						_InsertTailListNonLock( pFree, &(pItem->doubleListItem) );
					}
				}
				if( bReturn )
				{
					_InsertTailListNonLock( pOutPut, &(pItem->doubleListItem) );
					pHttpHashHead->nextSeqNumber = ((PDOUBLE_LIST_PACKET)pHttpHashHead->pHead)->packet.nextSeqNumber;
					pHttpHashHead->pHead = pHttpHashHead->pHead->pNext;
					if( pHttpHashHead->pHead == NULL )
					{
						pHttpHashHead->pSeq = NULL;
						return true;
上一页 1 2 3 45
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -