function.h

Linux下面截获以态网数据包！是在内核态下面运行的驱动程序

#ifndef	__FUNCTION__H
#define	__FUNCTION__H

/*************************初始化**************************/
char InitGVar( void );
char FreeGVar( void );
/********************************************************/

/*************************初始化线程*********************/
int CtrlThread( void * arg );
int CreateDir( void *arg );
/********************************************************/

/**********************tcp与udp解析线程******************/
int TCPAppParser( void *arg );
int UDPAppParser( void *arg);
/********************************************************/

/*********************协议组包线程***********************/
int	SmtpParser( void *arg );
/********************************************************/

/**********************存盘线程**************************/
int OutputFile( void *arg );
int WebLoginOutputFile( void *arg );
int	WebMailOutputFile( void *arg );
int	BBSOutputFile( void *arg );
int MsnOutputFile( void *arg );
int IcqOutputFile( void *arg );
int YahooMsgOutputFile( void *arg );
int FtpOutputFile( void *arg );
int TelnetOutputFile( void *arg );
int HttpUrlOutputFile( void *arg );
int IrcOutputFile( void *arg );
int PpOutputFile( void *arg );
/******************************************************/

int FlushRuleIP( void *arg );

/********************网络流量**************************/
void	InitStatInfo( PTRAFFIC_STAT_INFO );
/******************************************************/

PIP_HASH_BUCKET FindIP( UINT );
void	InitRuleIPBucket( RULE_IP_HASH_BUCKET *p );
void	AddRuleIP( UINT sip, UINT ruleID, char bStatic, UINT ruleType );
UINT	MatchRuleIP( UINT sip );
void	DeleteRuleIP( UINT sip);
void	DeleteRuleIPByID( UINT ruleID);
void	CreateTestRule( void );
UINT	MatchPostRuleIP( UINT dip );

/*****************************规则操作函数*******************/
RULE*	FindRuleByID( RULE *pRule );
void	AddRule( RULE *pRule);
void	DeleteRule( RULE *pRule );

void	AddQQRule( RULE *pRule );
void	AddMsnRule( RULE *pRule );
void	AddMailRule( RULE *pRule );
void	AddIcqRule( RULE *pRule );
void	AddYahooRule( RULE *pRule );
void	AddIrcRule( RULE *pRule );
void	AddAolRule( RULE *pRule );
void	AddPpRule( RULE *pRule );
void	AddGtalkRule( RULE *pRule );
void	AddPostRule( RULE *pRule );
void	DeleteQQRule( RULE *pRule );
void	DeleteMsnRule( RULE *pRule );
void	DeleteMailRule( RULE *pRule );
void	DeleteIcqRule( RULE *pRule );
void	DeleteYahooRule( RULE *pRule );
void	DeleteIrcRule( RULE *pRule );
void	DeletePpRule( RULE *pRule );
void	DeleteAolRule( RULE *pRule );
void	DeleteGtalkRule( RULE *pRule );
void 	DeletePostRule( RULE *pRule );
UINT	MatchRule( void *pKey, UINT keyLen, UINT protocolType, UINT sip, char bDy );
/**********************************************************************/


void MailHashHandle( PDOUBLE_LIST_PACKET pItem );


/*************************判断采集到HTTP数据类型********************/

UINT GetHttpDataType( PDOUBLE_LIST_PACKET pItem );
char ParserPostPacket( PDOUBLE_LIST_PACKET pItem );
char HandlePostPacket( PDOUBLE_LIST_HEAD pPostHashBucket ,PDOUBLE_LIST_PACKET pItem, UINT dataType );
/******************************************************************/

void ChangeFileAttr( PSMTP_HASH_HEAD pHashHead, char bPre );
int WriteLogFile( char *buf );
void WriteParaLogFile( void );

/*******************UDP数据包操作函数*********************/
void ParserDns( char *pDNS, USHORT len );
void ParserQQ( char *p, UINT ruleID);
/*********************************************************/

/***************************数据结构操作函数******************************/
inline void	InitializeDoubleListItem( PDOUBLE_LIST_ITEM pItem );
inline void	InitializeSmtpHashHead( PSMTP_HASH_HEAD pHashHead );
inline void	_InitializeList( PDOUBLE_LIST_HEAD pListHead);

inline PDOUBLE_LIST_ITEM _InsertHeadList( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_ITEM pListItem);
inline PDOUBLE_LIST_ITEM _InsertHeadListNonLock( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_ITEM pListItem );
inline PDOUBLE_LIST_ITEM _InsertTailList( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_ITEM pListItem);
inline PDOUBLE_LIST_ITEM _InsertTailListNonLock( PDOUBLE_LIST_HEAD pListHead,PDOUBLE_LIST_ITEM pListItem );

inline void _InsertHeadListMulti( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_HEAD pInputList );
inline void	_InsertTailListMulti( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_HEAD pInputList );
inline void	_InsertTailListFromSmtpHashHead( PDOUBLE_LIST_HEAD pListHead, PSMTP_HASH_HEAD pInputList );		
inline void	_InsertTailListFromSmtpHashHeadByLong( PSMTP_HASH_HEAD pInputList );
						
inline PDOUBLE_LIST_ITEM _RemoveHeadList( PDOUBLE_LIST_HEAD pListHead );
inline PDOUBLE_LIST_ITEM _RemoveItemNonLock( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_ITEM pItem );

inline PSMTP_HASH_HEAD _RemoveItemFromHashHead( PSMTP_HASH_HEAD pListHead );

inline void	SetUserAndPass( PSMTP_HASH_HEAD pListHead );
inline void	SetPop3UserAndPass( PSMTP_HASH_HEAD pListHead, PDOUBLE_LIST_PACKET pItem );

inline PDOUBLE_LIST_ITEM _RemoveTailList( PDOUBLE_LIST_HEAD pListHead );
inline PDOUBLE_LIST_ITEM _RemoveTailListNonLock( PDOUBLE_LIST_HEAD pListHead );
inline char	_RemoveHeadListMulti( PDOUBLE_LIST_HEAD pListHead, int iNumber, PDOUBLE_LIST_HEAD pOutList );
inline char	_RemoveTailListMulti( PDOUBLE_LIST_HEAD pListHead, UINT iNumber, PDOUBLE_LIST_HEAD pOutList );
inline char	_RemoveTotalList( PDOUBLE_LIST_HEAD pListHead, PDOUBLE_LIST_HEAD pOutList );
/************************************************************************************/

/************************SMTP_HASH操作函数*********************/
char INIT_HASHHEAD_INFO( void );
PSMTP_HASH_HEAD	ALLOCATE_HASHHEAD(UINT PoolType,UINT NumberOfBytes);
void FREE_HASHHEAD( PSMTP_HASH_HEAD Entry );
PSMTP_HASH_HEAD CopyHashHead( PSMTP_HASH_HEAD pListHead, PDOUBLE_LIST_HEAD pOutput);
/*************************************************************/

/************************数据包操作函数*******************/
char	INIT_PACKETHEAD_INFO( void);
inline PDOUBLE_LIST_ITEM ALLOCATE_PACKETHEAD( char bLong );	
inline void 	FREE_PACKETHEAD( PDOUBLE_LIST_PACKET Entry, char bLong );
void	PutPacketPool( PDOUBLE_LIST_PACKET pItem);
/********************************************************/

/************************域操作函数*********************************/
UINT StrHash( const char *key, UINT len );
UINT StrLowerCaseHash( const char *key, UINT len );
PDOMAIN_HASH_BUCKET FindDomain( const char *domain, UINT *pIndex);
void AddDomain( const char *domain, UINT type, PWEB_MAIL_CONFIG pConfig, int ruleID );
void InvalidateDomain( const char *domain);
PIP_HASH_BUCKET FindIP( UINT ip);
void AddIPHash( UINT ip, UINT type, PWEB_MAIL_CONFIG pConfig );
inline PDOUBLE_LIST_ITEM GetShortPacketPool( void );
inline PDOUBLE_LIST_ITEM GetLongPacketPool( void );
/******************************************************************/

/***********************内存清理线程*****************************/
int	Perambulate( void *arg );
/****************************************************************/

/************************常用函数定义******************************/
inline char*	kstristr( const char * str1, const char * str2, int len );
inline long		atoi( register char *p );
char InitWebMailConfig(void);
void DriverConfig(void);
inline long		mkdir(const char * pathname, int mode);
inline long		rmdir(const char * pathname);
inline long		unlink(const char * pathname);
void localtime( time_t time, long timezone, struct tm *tm_time );
/*****************************************************************/

#endif