httpparse.cpp

监听分析流量中的http流量

				return false;

			//进行APP包中的数据搜索
			HTTP_APP_PACK *pAppPack = pSession->AppPackList.at(nAppPackSize - 1);

			char *pAppEcho = NULL;
			//在这里获取服务器应答
			if(!HttpServerRecv((char*)pInput, &pAppEcho))
			{
				return false;
			}
			
			if (pAppEcho) 
			{
				*pEcho = (unsigned char*)pAppEcho;
				pAppPack->echo = (unsigned char *)pAppEcho;

				return true;
			}

		}
		catch (...)
		{
			cout<<"崩了"<<endl;
		}

		//cout<<"搜索成功\r\n"<<*pEcho<<endl<<pAppPack->pNetAddr<<endl<<endl;

		return true;
				
	}
	catch(...)
	{
		DWORD err = GetLastError();
		printf("for chatch....\r\n");
	}	

	return false;

}

//功能：将网页网址存入栈中
bool CHttpParse::AddRawPackList_NetAddr(char *pInput, int nBuffLen, char *src_ip, char *des_ip, char *src_port, char *des_port, char *src_mac, char *des_mac)
{
	try
	{
		if (!pInput)
		{
			printf("AddRawPackList_NetAddr()中的pInput参数没有指向一个有效的地址");
			return false;
		}

		int nLen = strlen(pInput);
		if (nLen <= 0)
			return false;

		HTTP_RAW_PACK *pRawPack = new HTTP_RAW_PACK;
		//命令消息(用于Client)
		pRawPack->cmd = NULL;
		//回显消息(用于Server)
		pRawPack->data = NULL;	
		//会话ID
		wsprintf(pRawPack->id, "%d", m_CurSession);
		//标志, 标识是源消息还是客户消息
		pRawPack->type = true;
		
		memset(pRawPack->date, 0, TIME_MAXLEN);
		memset(pRawPack->src_ip, 0, IPADDR_LEN);
		memset(pRawPack->des_ip, 0, IPADDR_LEN);
		memset(pRawPack->src_mac, 0, MAC_LEN);
		memset(pRawPack->des_mac, 0, MAC_LEN);

		pRawPack->cmd = NULL;
		pRawPack->nLenCmd = 0;


		//网址的解析和获取
		char *pDomainName = NULL;
		HttpDomainName(pInput, &pDomainName);

		pRawPack->netaddr = new char[MIN_BUFFER_LEN];
		memset(pRawPack->netaddr, 0, MIN_BUFFER_LEN);
		
		if (pDomainName)
		{
			strcpy(pRawPack->netaddr, pDomainName);

			pRawPack->nLenaddr = strlen(pDomainName);
		}
		else
		{
			delete [] pRawPack->netaddr;
			pRawPack->netaddr = NULL;

			delete pRawPack;
			pRawPack = NULL;

			return false;
		}		
		
		if (pDomainName)
		{
			int nLen = strlen(pDomainName);
			//printf((char *)pRawPack->netaddr);
			//printf(pDomainName);
			//printf("\r\n");
			delete [] pDomainName;
		}

		SetNowTime(pRawPack->date);
		strcpy(pRawPack->src_ip, src_ip);
		strcpy(pRawPack->des_ip, des_ip);
		strcpy(pRawPack->src_mac, "0");
		strcpy(pRawPack->des_mac, "0");

		m_Http_Session_List.at(m_CurSession)->RawPackList.push_back(pRawPack);

		//判断是否超出记录最大数???
		if (m_Http_Session_List.at(m_CurSession)->RawPackList.size() >= HTTP_MAX_PACK)
		{
			//如果超出了记录的最大限制，则返回真， 进入组装模块
			return true;
		}
	}
	catch(...)
	{
		DWORD err = GetLastError();
		printf("AddRawPackList_NetAddr chatch....\r\n");
	}
	
	return false;
}

// int nHeadLen用来标识命令和网页数据的分界点, 服务器回传的命令和网页数据同时存在, 两者都要赋值
bool CHttpParse::AddRawPackList_Echo(char *pInput, int nBuffLen, char *src_ip, char *des_ip, char *src_port, char *des_port, char *src_mac, char *des_mac)
{
	try
	{
		if (!pInput)
		{
			printf("AddRawPackList_Echo()中的pInput参数没有指向一个有效的地址");
			return false;
		}


		HTTP_RAW_PACK *pRawPack = new HTTP_RAW_PACK;

		pRawPack->cmd = NULL;	//命令消息(用于Client)
		pRawPack->data = NULL;	//回显消息(用于Server)
		wsprintf(pRawPack->id, "%d", m_CurSession);		//会话ID
		pRawPack->type = false;	//标志,标识是源消息还是客户消息,pRawPack->type为false就是server
		memset(pRawPack->date, 0, TIME_MAXLEN);
		memset(pRawPack->src_ip, 0, IPADDR_LEN);
		memset(pRawPack->des_ip, 0, IPADDR_LEN);
		memset(pRawPack->src_mac, 0, MAC_LEN);
		memset(pRawPack->des_mac, 0, MAC_LEN);

		
		pRawPack->data = new char[nBuffLen + 1];
		pRawPack->nLenEcho = nBuffLen + 1;
		memset(pRawPack->data, 0, nBuffLen + 1);

		//网址的解析和获取
		char *pServerRecv = NULL;
		HttpServerRecv(pInput, &pServerRecv);

		pRawPack->data = new char[MIN_BUFFER_LEN];
		memset(pRawPack->data, 0, MIN_BUFFER_LEN);
		
		if (pServerRecv)
		{
			strcpy((char *)pRawPack->data, pServerRecv);

			pRawPack->nLenEcho = strlen(pServerRecv);
		}
		else
		{
			delete [] pRawPack->data;
			pRawPack->netaddr = NULL;

			delete pRawPack;
			pRawPack = NULL;

			return false;
		}		
		
		if (pServerRecv)
		{
			int nLen = strlen(pServerRecv);
			delete [] pServerRecv;
		}

		SetNowTime(pRawPack->date);
		strcpy(pRawPack->src_ip, src_ip);
		strcpy(pRawPack->des_ip, des_ip);
		strcpy(pRawPack->src_mac, "0");
		strcpy(pRawPack->des_mac, "0");

		m_Http_Session_List.at(m_CurSession)->RawPackList.push_back(pRawPack);

		//???
		if (m_Http_Session_List.at(m_CurSession)->RawPackList.size() >= HTTP_MAX_PACK)
		{
			//PrintReult(m_Http_Session_List.at(m_CurSession)->RawPackList);
			;
		}
	}
	catch(...)
	{
		printf("AddRawPackList_Echo chatch....\r\n");
	}
	return true;
}

//用来组装命令和回显数据, Parse_List:会话链表, nCurSession:当前的会话索引, pConfig:会话输出
bool CHttpParse::ConfigSessionRecord(vector<HTTP_SESSION*> &Parse_List, int nCurSession, int nLen)
{

	HTTP_SESSION* pSession = Parse_List.at(nCurSession); 
	int nSize = pSession->AppPackList.size();

	char *pBuff = new char[MAX_BUFFER_LEN];
	printf("Access ConfigSessionRecord() for loop\r\n");
	for (int i = 0; i < nSize; i++)
	{
		HTTP_APP_PACK *pAppPack = pSession->AppPackList.at(i);
		if (pAppPack)
		{
			memset(pBuff, 0, MAX_BUFFER_LEN);

			if (pAppPack->pNetAddr)
			{
				if (pAppPack->nLenAddr <= 0)
				{
					continue;
				}

				if (pAppPack->echo && pAppPack->pNetAddr) 
				{
					wsprintf(pBuff, "%s\r\n%s\r\n end", (char *)pAppPack->pNetAddr, (char*)pAppPack->echo);
					//cout<<pBuff<<endl<<endl;
				}
				else if(pAppPack->pNetAddr)
				{
					wsprintf(pBuff, "%s\r\n", (char *)pAppPack->pNetAddr);
				}
				else if (pAppPack->echo)
				{
					wsprintf(pBuff, "%s\r\n", (char *)pAppPack->echo);
				}
				
			}

			cout<<pBuff<<endl<<endl;
			SaveLog(pBuff, "netaddr.txt");
		}
	}
	printf("exit ConfigSessionRecord() for loop\r\n");
	if (pBuff)
	{
		delete [] pBuff;
		pBuff = NULL;
	}
		
	return true;
}

//用于获取域名, 实现原理就是将 host 或 post 和 URI 中的内容组合到一起来
bool CHttpParse::HttpDomainName(char *pInput, char **pDomainName)
{
	assert(pInput || pDomainName);

	if (!pInput || !pDomainName) 
	{
		return false;
	}

	char *pBuff = NULL;
	char *ptemp = new char[MIN_BUFFER_LEN];	//ptemp 用来保存网址

	pBuff = strstr(pInput, "Host:");
	if (pBuff)
	{
		pBuff += sizeof("Host:");
	}
	else
	{
		return false;
	}


	char *pBuff2 = strstr(pBuff, "\r\n");
	int nLenHost = pBuff2 - pBuff;
	memset(ptemp, 0, MIN_BUFFER_LEN);
	memcpy(ptemp, pBuff, nLenHost);




	pBuff = strstr(pInput, "GET");
	if (!pBuff)
	{
		pBuff = strstr(pInput, "POST");
		pBuff += sizeof("POST");
	}
	else
	{
		pBuff += sizeof("GET");
	}	

	pBuff2 = strstr(pBuff, " ");	//用来搜索GET方法中的URI相对网址
	int nLenURI = pBuff2 - pBuff;
	strncpy(ptemp + nLenHost, pBuff, nLenURI + 1);

	*pDomainName = ptemp;

	return true;

}

//函数功能:保存服务器传回的应答消息HTTP方法
bool CHttpParse::HttpServerRecv(char *pInput, char **pServerRecv)
{
	assert(pInput || pServerRecv);

	if (!pInput || !pServerRecv) 
	{
		return false;
	}

	char *pBuff = NULL;
	char *ptemp = new char[MIN_BUFFER_LEN];	//ptemp 用来保存网址

	pBuff = strstr(pInput, "HTTP/");

	if (!pBuff)
	{
		return false;
	}

	char *pBuff2 = strstr(pBuff, "\r\n");
	int nLenHost = pBuff2 - pBuff;
	memset(ptemp, 0, MIN_BUFFER_LEN);
	memcpy(ptemp, pBuff, nLenHost);

	//cout<<ptemp<<endl<<endl;

	*pServerRecv = ptemp;

	return true;
}

//组装文件路径
bool CHttpParse::ConfigFileDirectory(vector<HTTP_SESSION*> &Parse_List, int nCurSession, char *strPath, char *strFileName)
{
	assert(strFileName || strPath);

	if (!strPath)
	{
		return false;
	}

	char sPath[512] = {0};

	HTTP_SESSION *pHttpSession = Parse_List.at(nCurSession);
	strcpy(sPath, "C:\\");
	strcat(sPath, (char *)pHttpSession->client_ip);
	strcat(sPath, "\\");
	strcat(sPath, (char *)pHttpSession->server_ip);
	strcat(sPath, "\\");
	strcat(sPath, strFileName);			//注意这里要判断是否有保存东西, 否则程序容易崩溃

	//strcat(sPath, ".html");
	strcpy(strPath, sPath);

	return true;
	
}

/*------------------------------------------------------------------------------------------------------------------*/
/*											      组装命令字和回显(end)								               */
/*------------------------------------------------------------------------------------------------------------------*/


/*******************************************************************************************************************/
/*                       清除堆内存模块(begin)																	    */
/*********************************************************************************************************************/
//这在这个类中是非常重要的一个模块,它决定这个程序是否有内存泄漏和未释放的内存堆栈
//清除和m_Http_Session_List绑定的数据和列表
void CHttpParse::DelHttpSessionList()
{
	int nSize = m_Http_Session_List.size();	
	for (int i = 0; i < nSize; i++)
	{
		HTTP_SESSION* pSession = m_Http_Session_List.at(i);
		if(!pSession)
			continue;

		ClearSessionRawPack(i);
		ClearSessionAppPack(i);
			
		delete pSession;
		pSession = NULL;
	}
	//删除链表中的这个会话
	m_Http_Session_List.clear();
}

//清除和IPDatadataList绑定的数据和列表, 注意, 并不是把m_Http_Session_List也给清了
void CHttpParse::ClearSessionRawPack(int iSession)
{

	HTTP_SESSION* pSession = m_Http_Session_List.at(iSession);
	int nSize = pSession->RawPackList.size();

	if (pSession > 0)
	{		
		for(int i = 0; i < nSize; i++)
		{
			
			HTTP_RAW_PACK *pRawPack = pSession->RawPackList.at(i);				
			if (pRawPack)
			{
				if (pRawPack->cmd)
				{
					delete [] pRawPack->cmd;	//清除堆内存
					pRawPack->cmd = NULL;
				}
				
				if (pRawPack->data)
				{
					delete [] pRawPack->data;	//清除堆内存
					pRawPack->data = NULL;
				}

				if (pRawPack->netaddr)
				{
					delete [] pRawPack->netaddr;
					pRawPack->netaddr = NULL;
				}
				
				delete pRawPack;		//清除堆内存
				pRawPack = NULL;
			}
		}

		pSession->RawPackList.clear();
	}
}

//清除应用会话
void CHttpParse::ClearSessionAppPack(int iSession)
{

	HTTP_SESSION* pSession = m_Http_Session_List.at(iSession);
	int nSize = pSession->AppPackList.size();

	if (pSession > 0)
	{		
		for(int i = 0; i < nSize; i++)
		{
			
			HTTP_APP_PACK *pAppPack = pSession->AppPackList.at(i);				
			if (pAppPack)
			{
				if (pAppPack->echo)
				{
					delete [] pAppPack->echo;	//清除堆内存
					pAppPack->echo = NULL;
				}

				if (pAppPack->pNetAddr)
				{
					delete [] pAppPack->pNetAddr;
					pAppPack->pNetAddr = NULL;
				}
				
				delete pAppPack;		//清除堆内存
				pAppPack = NULL;
			}
		}

		pSession->AppPackList.clear();
	}
}



/*-------------------------------------------------------------------------------------------------------------------*/
/*											       清除堆内存模块(end)					                             */
/*-------------------------------------------------------------------------------------------------------------------*/


/*********************************************************************************************************************/
/*												   辅助函数模块(begin)					                             */
/*********************************************************************************************************************/

//得到当前时间,格式:%Y-%m-%d %H:%M:%S
bool CHttpParse::SetNowTime(char *pCurTime)
{
	if (!pCurTime)
	{
		return false;
	}

	_SYSTEMTIME Curtime;
	GetSystemTime(&Curtime);
	wsprintf(pCurTime, "%4d-%2d-%2d %2d:%2d:%2d",
		Curtime.wYear,
		Curtime.wMonth,
		Curtime.wDay,
		Curtime.wHour,
		Curtime.wMinute,
		Curtime.wSecond);

	return true;
}


bool CHttpParse::SaveLog(char *pBuff, char *pFileName)
{
	CWriteLog file;
	char strPath[512] = {0};
	try
	{
		ConfigFileDirectory(m_Http_Session_List, m_CurSession, strPath, pFileName);

		file.CheckTarPath(strPath);
		int nLen = strlen(pBuff);
		file.WriteLogFile(strPath, pBuff, nLen);
		//cout<<pBuff<<endl<<endl<<"SaveLog succeed"<<endl<<endl;
		
	}
	catch(...)
	{
		DWORD nErro = ::GetLastError();
		printf("\r\n写日志出错:%d",nErro);
	}

	return TRUE;
}

/*********************************************************************************************************************/
/*												  辅助函数模块(end)						                             */
/*********************************************************************************************************************/