modusox.bas

入侵检测是近几年发展起来的新型网络安全策略

    AF_UNKNOWN1 = 20                '/* Somebody is using this! */
    AF_BAN = 21                     '/* Banyan */
    AF_ATM = 22                     '/* Native ATM Services */
    AF_INET6 = 23                   '/* Internetwork Version 6 */
    AF_CLUSTER = 24                 '/* Microsoft Wolfpack */
    AF_12844 = 25                   '/* IEEE 1284.4 WG AF */
    AF_MAX = 26
End Enum
Public Const PF_UNSPEC              As Long = AF_UNSPEC
Public Const PF_UNIX                As Long = AF_UNIX
Public Const PF_INET                As Long = AF_INET
Public Const PF_IMPLINK             As Long = AF_IMPLINK
Public Const PF_PUP                 As Long = AF_PUP
Public Const PF_CHAOS               As Long = AF_CHAOS
Public Const PF_NS                  As Long = AF_NS
Public Const PF_IPX                 As Long = AF_IPX
Public Const PF_ISO                 As Long = AF_ISO
Public Const PF_OSI                 As Long = AF_OSI
Public Const PF_ECMA                As Long = AF_ECMA
Public Const PF_DATAKIT             As Long = AF_DATAKIT
Public Const PF_CCITT               As Long = AF_CCITT
Public Const PF_SNA                 As Long = AF_SNA
Public Const PF_DECnet              As Long = AF_DECnet
Public Const PF_DLI                 As Long = AF_DLI
Public Const PF_LAT                 As Long = AF_LAT
Public Const PF_HYLINK              As Long = AF_HYLINK
Public Const PF_APPLETALK           As Long = AF_APPLETALK
Public Const PF_VOICEVIEW           As Long = AF_VOICEVIEW
Public Const PF_FIREFOX             As Long = AF_FIREFOX
Public Const PF_UNKNOWN1            As Long = AF_UNKNOWN1
Public Const PF_BAN                 As Long = AF_BAN
Public Const PF_MAX                 As Long = AF_MAX
Public Enum SocketProtocol
    IPPROTO_IP = 0                  '/* dummy for IP */
    IPPROTO_ICMP = 1                '/* control message protocol */
    IPPROTO_IGMP = 2                '/* internet group management protocol */
    IPPROTO_GGP = 3                 '/* gateway^2 (deprecated) */
    IPPROTO_TCP = 6                 '/* tcp */
    IPPROTO_PUP = 12                '/* pup */
    IPPROTO_UDP = 17                '/* user datagram protocol */
    IPPROTO_IDP = 22                '/* xns idp */
    IPPROTO_ND = 77                 '/* UNOFFICIAL net disk proto */
    IPPROTO_RAW = 255               '/* raw IP packet */
    IPPROTO_MAX = 256
End Enum
Public Type HOSTENT
    hName                           As Long
    hAliases                        As Long
    hAddrType                       As Integer
    hLength                         As Integer
    hAddrList                       As Long
End Type
Public Declare Function gethostbyaddr Lib "ws2_32.dll" (addr As Long, ByVal addr_len As Long, ByVal addr_type As Long) As Long
Public Declare Function gethostbyname Lib "ws2_32.dll" (ByVal host_name As String) As Long
Public Declare Function gethostname Lib "ws2_32.dll" (ByVal host_name As String, ByVal namelen As Long) As Long
Public Declare Function getservbyname Lib "ws2_32.dll" (ByVal serv_name As String, ByVal proto As String) As Long
Public Declare Function getprotobynumber Lib "ws2_32.dll" (ByVal proto As Long) As Long
Public Declare Function getprotobyname Lib "ws2_32.dll" (ByVal proto_name As String) As Long
Public Declare Function getservbyport Lib "ws2_32.dll" (ByVal Port As Integer, ByVal proto As Long) As Long
Public Declare Function inet_addr Lib "ws2_32.dll" (ByVal cp As String) As Long
Public Declare Function inet_ntoa Lib "ws2_32.dll" (ByVal inn As Long) As Long
Public Declare Function htons Lib "ws2_32.dll" (ByVal hostshort As Integer) As Integer
Public Declare Function htonl Lib "ws2_32.dll" (ByVal hostlong As Long) As Long
Public Declare Function ntohl Lib "ws2_32.dll" (ByVal netlong As Long) As Long
Public Declare Function ntohs Lib "ws2_32.dll" (ByVal netshort As Integer) As Integer
Public Declare Function api_socket Lib "ws2_32.dll" Alias "socket" (ByVal af As Long, ByVal s_type As Long, ByVal Protocol As Long) As Long
Public Declare Function api_closesocket Lib "ws2_32.dll" Alias "closesocket" (ByVal s As Long) As Long
Public Declare Function api_connect Lib "ws2_32.dll" Alias "connect" (ByVal s As Long, ByRef Name As sockaddr_in, ByVal namelen As Long) As Long
Public Declare Function getsockname Lib "ws2_32.dll" (ByVal s As Long, ByRef Name As sockaddr_in, ByRef namelen As Long) As Long
Public Declare Function getpeername Lib "ws2_32.dll" (ByVal s As Long, ByRef Name As sockaddr_in, ByRef namelen As Long) As Long
Public Declare Function api_bind Lib "ws2_32.dll" Alias "bind" (ByVal s As Long, ByRef Name As sockaddr_in, ByRef namelen As Long) As Long
Public Declare Function api_select Lib "ws2_32.dll" Alias "select" (ByVal nfds As Long, ByRef readfds As Any, ByRef writefds As Any, ByRef exceptfds As Any, ByRef Timeout As Long) As Long
Public Declare Function recv Lib "ws2_32.dll" (ByVal s As Long, ByRef buf As Any, ByVal buflen As Long, ByVal Flags As Long) As Long
Public Declare Function send Lib "ws2_32.dll" (ByVal s As Long, ByRef buf As Any, ByVal buflen As Long, ByVal Flags As Long) As Long
Public Declare Function shutdown Lib "ws2_32.dll" (ByVal s As Long, ByVal how As Long) As Long
Public Declare Function api_listen Lib "ws2_32.dll" Alias "listen" (ByVal s As Long, ByVal backlog As Long) As Long
Public Declare Function api_accept Lib "ws2_32.dll" Alias "accept" (ByVal s As Long, ByRef addr As sockaddr_in, ByRef addrlen As Long) As Long
Public Declare Function setsockopt Lib "ws2_32.dll" (ByVal s As Long, ByVal level As Long, ByVal optname As Long, optval As Any, ByVal optlen As Long) As Long
Public Declare Function getsockopt Lib "ws2_32.dll" (ByVal s As Long, ByVal level As Long, ByVal optname As Long, optval As Any, optlen As Long) As Long
Public Declare Function sendto Lib "ws2_32.dll" (ByVal s As Long, ByRef buf As Any, ByVal buflen As Long, ByVal Flags As Long, ByRef toaddr As sockaddr_in, ByVal tolen As Long) As Long
Public Declare Function socket Lib "ws2_32.dll" (ByVal af As Long, ByVal s_type As Long, ByVal Protocol As Long) As Long
Public Declare Function Bind Lib "ws2_32.dll" Alias "bind" (ByVal s As Long, ByRef Name As sockaddr_in, ByRef namelen As Long) As Long
Public Declare Function CloseSocket Lib "ws2_32.dll" Alias "closesocket" (ByVal s As Long) As Long
Public Declare Function recvfrom Lib "ws2_32.dll" (ByVal s As Long, ByRef buf As Any, ByVal buflen As Long, ByVal Flags As Long, ByRef from As sockaddr_in, ByRef fromlen As Long) As Long
Public Declare Function WSAAsyncSelect Lib "ws2_32.dll" (ByVal s As Long, ByVal hwnd As Long, ByVal wMsg As Long, ByVal lEvent As Long) As Long
Public Declare Function WSAAsyncGetHostByAddr Lib "ws2_32.dll" (ByVal hwnd As Long, ByVal wMsg As Long, ByRef lngAddr As Long, ByVal lngLenght As Long, ByVal lngType As Long, buf As Any, ByVal lngBufLen As Long) As Long
Public Declare Function WSAAsyncGetHostByName Lib "ws2_32.dll" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal strHostName As String, buf As Any, ByVal buflen As Long) As Long
Public Declare Function WSAStartup Lib "ws2_32.dll" (ByVal wVR As Long, lpWSAD As WSAData) As Long
Public Declare Function WSACleanup Lib "ws2_32.dll" () As Long
Private Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Private Declare Function CreateWindowEx Lib "user32" Alias "CreateWindowExA" (ByVal dwExStyle As Long, ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As Long, ByVal X As Long, ByVal Y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hWndParent As Long, ByVal hMenu As Long, ByVal hInstance As Long, lpParam As Any) As Long
Private Declare Function DestroyWindow Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function RegisterWindowMessage Lib "user32" Alias "RegisterWindowMessageA" (ByVal lpString As String) As Long
Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc&, ByVal hwnd&, ByVal Msg&, ByVal wParam&, ByVal lParam&) As Long
Private Declare Function lstrcpy Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
Private Declare Function lstrlen Lib "kernel32" Alias "lstrlenA" (ByVal lpString As Any) As Long
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)
Private Declare Sub RtlMoveMemory Lib "kernel32" (hpvDest As Any, ByVal hpvSource As Long, ByVal cbCopy As Long)
Public Declare Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long
Public Declare Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare Function GlobalLock Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare Function GlobalUnlock Lib "kernel32" (ByVal hMem As Long) As Long
Public Declare Function WSAIoctl Lib "ws2_32.dll" (ByVal s As Long, ByVal dwIoControlCode As Long, lpvInBuffer As Any, ByVal cbInBuffer As Long, lpvOutBuffer As Any, ByVal cbOutBuffer As Long, lpcbBytesReturned As Long, lpOverlapped As Long, lpCompletionRoutine As Long) As Long
Private Const GWL_WNDPROC           As Long = -4
Public Const GMEM_FIXED             As Long = &H0
Public Const GMEM_MOVEABLE          As Long = &H2
Public p_lngWindowHandle            As Long
Private m_colSockets                As Collection
Private m_colResolvers              As Collection
Private m_colMemoryBlocks           As Collection
Private m_lngPreviousValue          As Long
Private m_blnGetHostRecv            As Boolean
Private m_blnWinsockInit            As Boolean
Private m_lngMaxMsgSize             As Long
Private Const WM_USER               As Long = &H400
Private m_lngResolveMessage         As Long 'Added: 04-MAR-2002
Public p_lngWinsockMessage          As Long
Private Const OFFSET_4              As Double = 4294967296#
Private Const MAXINT_4              As Double = 2147483647
Private Const OFFSET_2              As Double = 65536
Private Const MAXINT_2              As Double = 32767
Public saZero                       As sockaddr_in
Public WinsockMessage               As Long
Private Function WindowProc(ByVal hwnd As Long, ByVal uMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
    'This the callback function of the window created to hook
    'messages sent by the Winsock service. It handles only two
    'types of messages - network events for the sockets the
    'WSAAsyncSelect fucntion was called for, and the messages
    'sent in response to the WSAAsyncGetHostByName and
    'WSAAsyncGetHostByAddress Winsock API functions.
    '
    'Then the message is received, this function creates illegal
    'reference to the instance of the CSocket class and calls
    'either the PostSocketEvent or PostGetHostEvent method of the
    'class to pass that message to the class.
    Dim objSocket                   As clsSocket 'the illegal reference to an instance of the CSocket class
    Dim lngObjPointer               As Long     'pointer to the existing instance of the CSocket class
    Dim lngEventID                  As Long     'network event
    Dim lngErrorCode                As Long     'code of the error message
    Dim lngMemoryHandle             As Long     'descriptor of the allocated memory object
    Dim lngMemoryPointer            As Long     'pointer to the allocated memory
    Dim lngHostAddress              As Long     '32-bit host address
    Dim strHostName                 As String   'a host hame
    Dim udtHost                     As HOSTENT  'structure of the data in the allocated memory block
    Dim lngIpAddrPtr                As Long     'pointer to the IP address string
    On Error GoTo ERORR_HANDLER
    If uMsg = p_lngWinsockMessage Then
        'All the pointers to the existing instances of the CSocket class
        'are stored in the m_colSockets collection. Key of the collection's
        'item contains a value of the socket handle, and a value of the
        'collection item is the Long value that is a pointer the object,
        'instance of the CSocket class. Since the wParam argument of the
        'callback function contains a value of the socket handle the
        'function has received the network event message for, we can use
        'that value to get the object's pointer. With the pointer value
        'we can create the illegal reference to the object to be able to
        'call any Public or Friend subroutine of that object.
        Set objSocket = SocketObjectFromPointer(CLng(m_colSockets("S" & wParam)))
        'Retrieve the network event ID
        lngEventID = LoWord(lParam)
        'Retrieve the error code
        lngErrorCode = HiWord(lParam)
        'Forward the message to the instance of the CSocket class
        objSocket.PostSocketEvent lngEventID, lngErrorCode
    ElseIf uMsg = m_lngResolveMessage Then
        'A message has been received in response to the call of
        'the WSAAsyncGetHostByName or WSAAsyncGetHostByAddress.
        'Retrieve the error code
        lngErrorCode = HiWord(lParam)
        'The wParam parameter of the callback function contains
        'the task handle returned by the original function call
        '(see the ResolveHost function for more info). This value
        'is used as a key of the m_colResolvers collection item.
        'The item of that collection contains a pointer to the
        'instance of the CSocket class. So, if we know a value
        'of the task handle, we can find out the pointer to the
        'object which called the ResolveHost function in this module.
        'Get the object pointer by the task handle value
        lngObjPointer = CLng(m_colResolvers("R" & wParam))
        'A value of the pointer to the instance of the CSocket class
        'is used also as a key for the m_colMemoryBlocks collection
        'item that contains a handle of the allocated memory block
        'object. That memory block is the buffer where the
        'WSAAsyncGetHostByName and WSAAsyncGetHostByAddress functions
        'store the result HOSTENT structure.
        'Get the handle of the allocated memory block object by the
        'pointer to the instance of the CSocket class.
        lngMemoryHandle = CLng(m_colMemoryBlocks("S" & lngObjPointer))
        'Lock the memory block and get address of the buffer where
        'the HOSTENT structure data is stored.
        lngMemoryPointer = GlobalLock(lngMemoryHandle)
        'Create an illegal reference to the instance of the
        'CSocket class
        Set objSocket = SocketObjectFromPointer(lngObjPointer)
        'Now we can forward the message to that instance.
        If lngErrorCode <> 0 Then
            'If the host was not resolved, pass the error code value
            objSocket.PostGetHostEvent 0, 0, "", lngErrorCode
        Else
            'Move data from the allocated memory block to the
            'HOSTENT structure - udtHost
            CopyMemory udtHost, ByVal lngMemoryPointer, Len(udtHost)
            'Get a 32-bit host address
            CopyMemory lngIpAddrPtr, ByVal udtHost.hAddrList, 4
            CopyMemory lngHostAddress, ByVal lngIpAddrPtr, 4
            'Get a host name
            strHostName = StringFromPointer(udtHost.hName)
            'Call the PostGetHostEvent friend method of the objSocket
            'to forward the retrieved information.
            objSocket.PostGetHostEvent wParam, lngHostAddress, strHostName
        End If
        'The task to resolve the host name is completed, thus we don't
        'need the allocated memory block anymore and corresponding items
        'in the m_colMemoryBlocks and m_colResolvers collections as well.
        'Unlock the memory block
        Call GlobalUnlock(lngMemoryHandle)
        'Free that memory
        Call GlobalFree(lngMemoryHandle)
        'Rremove the items from the collections
        m_colMemoryBlocks.Remove "S" & lngObjPointer
        m_colResolvers.Remove "R" & wParam
        'If there are no more resolving tasks in progress,
        'destroy the collection objects to free resources.