dealpacket.c

Linux环境下mail监控程序的源代码

#include<sys/types.h>
#include<sys/stat.h>
#include<fcntl.h>

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include "dealpacket.h"
#include "logUtil.h"


static pthread_mutex_t smtp_mutex = PTHREAD_MUTEX_INITIALIZER;

int create_smtp_thread(pthread_t *pid)
{
	SMTP_THREAD_STATUS = 1;

	if (pthread_create(pid, NULL, (void *)smtp_thread, NULL))
	{
		//#ifdef _TEST_DEBUG_		
			doLog(0, "        deal_packet() 创建smtp_thread线程失败,退出!\n");
			return FAIL;
		//#endif
	}
	return SUCCESS;
}

int close_smtp_thread(pthread_t pid)
{
	SMTP_THREAD_STATUS = 0;

	if (pthread_join(pid, NULL))
	{
		doLog(0, "the smtp deal thread exit error\n");
		return FAIL;
	}
	//doLog(0, "the smtp deal thread exit SUCCESS\n");
	return SUCCESS;
}

char * create_sql(tcp_stream_node *stream_node)
{
	char *sql=NULL;
	int sql_len = 256 + PATH_MAXLEN;
	if (stream_node->subject!=NULL)
		sql_len += strlen(stream_node->subject);
	if (stream_node->to!=NULL)
		sql_len += strlen(stream_node->to);
	
	if (stream_node->cc!=NULL)
		sql_len += strlen(stream_node->cc);
	if (stream_node->bcc!=NULL)
		sql_len += strlen(stream_node->bcc);
	struct tm *tm_stime = localtime(&stream_node->stime);
	
	sql = (char *)malloc(sql_len);
	memset(sql, 0, sql_len);
	sprintf(sql, "insert  into %s values( default,", DB_MAIL_TABLE_NAME);
	sprintf(sql, "%s '%4d-%02d-%02d %02d:%02d:%02d',",
				 sql, tm_stime->tm_year+1900, tm_stime->tm_mon+1, tm_stime->tm_mday, 
		              tm_stime->tm_hour, tm_stime->tm_min, tm_stime->tm_sec
		    );
	sprintf(sql, "%s '%s',", sql, inet_ntoa(*(struct in_addr*)&stream_node->saddr));
	sprintf(sql, "%s %u,"  , sql, stream_node->req_stream.source);
	sprintf(sql, "%s '%02X%02X%02X%02X%02X%02X',", 
				 sql, stream_node->smac[0], stream_node->smac[1], stream_node->smac[2],
					  stream_node->smac[3], stream_node->smac[4], stream_node->smac[5]
			);
	sprintf(sql, "%s '%s',", sql, inet_ntoa(*(struct in_addr*)&stream_node->daddr));
	sprintf(sql, "%s %u,"  , sql, stream_node->req_stream.dest);
	sprintf(sql, "%s '%02X%02X%02X%02X%02X%02X',", 
				 sql, stream_node->dmac[0], stream_node->dmac[1], stream_node->dmac[2],
					  stream_node->dmac[3], stream_node->dmac[4], stream_node->dmac[5]
			);
	sprintf(sql, "%s '%s',", sql, "SMTP");
	sprintf(sql, "%s '%s',", sql, stream_node->from);
	sprintf(sql, "%s '%s',", sql, stream_node->to==NULL?"":stream_node->to);
	sprintf(sql, "%s '%s',", sql, stream_node->cc==NULL?"":stream_node->cc);
	sprintf(sql, "%s '%s',", sql, stream_node->bcc==NULL?"":stream_node->bcc);
	sprintf(sql, "%s '%s',", sql, stream_node->subject==NULL?"":stream_node->subject);
	sprintf(sql, "%s %u,"  , sql, stream_node->mail_len);
	sprintf(sql, "%s '%s',", sql, stream_node->req_stream.path);
	sprintf(sql, "%s '');", sql);
	return sql;
}


void write_database(tcp_stream_node *stream_node)
{
	char *sql=NULL;
	sql = create_sql(stream_node);

	if (dao_mysql_connect())
	{
		doLog(0, "database error:%s\n", dao_mysql_getError());
	}
	else if (dao_mysql_executeSql(sql))
	{
		doLog(0, "sql:%s\n", sql);
		doLog(0, "database error:%s\n", dao_mysql_getError());
		dao_mysql_close();
	}
	else
	{
		dao_mysql_close();
	}

	free(sql);
	return;
}


void analysis_smtp(tcp_stream_node *stream_node)
{
	FILE    *fp;
	char *readStr=NULL;
	char *temp=NULL;
	char *l_temp=NULL;
	char *r_temp=NULL;
	char *temp_to=NULL;
	char *temp_cc=NULL;
	int i = 1, len=0, find_from=0, find_to=0, find_subject=0, find_cc=0;
	u_int32_t size= 0;

	if( ( fp = fopen(stream_node->req_stream.path, "r") ) == NULL )	//文件不存在
		return ;
	//doLog(0, "begin analysis_smtp()--------------------------\n");
	
	while (!feof(fp))
	{
		size = i*MAIL_LINE;
		readStr = (char *)malloc(size);
		memset(readStr, 0, size);
		fgets( readStr, MAIL_LINE, fp ); 

		if (memcmp(readStr, "", strlen(readStr))==0)
		{
			free(readStr);
			i = 1; 
			continue;
		}

		if (strlen(readStr)==2 && memcmp(readStr, "\r\n", 2)==0)
		{
			//doLog(0, "find 邮件头和邮件体的分隔符 \\r\\n\n");
			free(readStr);

			//doLog(0, "MAIL FROM: %s\n", stream_node->from);
			//doLog(0, "To: %s\n", stream_node->to);
			//doLog(0, "Subject :%s\n", stream_node->subject);
			//if (stream_node->cc!=NULL)
				//doLog(0, "CC: %s\n", stream_node->cc);
			break;
		}

		if (strstr(readStr, "\r\n")==0)
		{
			//doLog(0, "no find \\r\\n\n");
			free(readStr);
			i+=1;
			continue;
		}
		else
		{
			//doLog(0, "find \\r\\n\n");
			temp = NULL;
			l_temp = NULL;
			r_temp = NULL;
			len = 0;
			if (find_from==0 && (temp=strstr(readStr, "From: "))!=0)
			{
				//doLog(0, "find FROM\n");
				l_temp = strchr(temp, '<');
				r_temp = strchr(temp, '>');
				//doLog(0, "l_temp = %s\n", l_temp);
				//doLog(0, "strlen(l_temp) = %u\n", strlen(l_temp));
				//doLog(0, "r_temp = %s\n", r_temp);
				//doLog(0, "strlen(r_temp) = %u\n", strlen(r_temp));
				memset(stream_node->from, 0, MAIL_FROM_LEN);
				memcpy(stream_node->from, l_temp, strlen(l_temp)-strlen(r_temp)+1);
				find_from = 1;
				
				free(readStr);
				i = 1; 
				continue;
			}
			else if (find_to==0 && (temp=strstr(readStr, "To: "))!=0)
			{
				l_temp = strchr(temp, '<');
				r_temp = strchr(temp, '>');
				
				len = strlen(l_temp)-strlen(r_temp)+1+1;
				
				temp_to = (char *)malloc(len);
				memset(temp_to, 0, len);
				memcpy(temp_to, l_temp, len - 1);
				stream_node->to = temp_to;
				temp_to = NULL;
				if (strchr(r_temp, ',')==0)
					find_to = 1;
				else
					find_to = 2;
				
				free(readStr);
				i = 1; 
				continue;
				
			}
			else if (find_to==2  && (temp=strchr(readStr, '<'))!=0)
			{
				l_temp = temp;
				r_temp = strchr(temp, '>');

				len = strlen(stream_node->to)+1+strlen(l_temp)-strlen(r_temp)+1+1;

				temp_to = (char *)malloc(len);
				memset(temp_to, 0, len);
				
				strcpy(temp_to, stream_node->to);
				strcat(temp_to, ",");
				memcpy(temp_to+strlen(stream_node->to)+1, l_temp, strlen(l_temp)-strlen(r_temp)+1);

				free(stream_node->to);
				stream_node->to = temp_to;
				temp_to = NULL;
				
				if (strchr(r_temp, ',')==0)
					find_to = 1;
				else
					find_to = 2;

				free(readStr);
				i = 1; 
				continue;

			}
			else if (find_cc==0 && (temp=strstr(readStr, "Cc: "))!=0)
			{
				l_temp = strchr(temp, '<');
				r_temp = strchr(temp, '>');
				
				len = strlen(l_temp)-strlen(r_temp)+1+1;
				
				temp_cc = (char *)malloc(len);
				memset(temp_cc, 0, len);
				memcpy(temp_cc, l_temp, len - 1);
				stream_node->cc = temp_cc;
				temp_cc = NULL;
				if (strchr(r_temp, ',')==0)
					find_cc = 1;
				else
					find_cc = 2;
				
				free(readStr);
				i = 1; 
				continue;
			}
			else if (find_cc==2  && (temp=strchr(readStr, '<'))!=0)
			{
				l_temp = temp;
				r_temp = strchr(temp, '>');

				len = strlen(stream_node->cc)+1+strlen(l_temp)-strlen(r_temp)+1+1;

				temp_cc = (char *)malloc(len);
				memset(temp_cc, 0, len);
				
				strcpy(temp_cc, stream_node->cc);
				strcat(temp_cc, ",");
				memcpy(temp_cc+strlen(stream_node->cc)+1, l_temp, strlen(l_temp)-strlen(r_temp)+1);

				free(stream_node->cc);
				stream_node->cc = temp_cc;
				temp_cc = NULL;
				
				if (strchr(r_temp, ',')==0)
					find_cc = 1;
				else
					find_cc = 2;

				free(readStr);
				i = 1; 
				continue;

			}
			else if (find_subject==0 && (temp=strstr(readStr, "Subject: "))!=0)
			{
				//memset(stream_node->subject, 0, MAIL_SUBJECT_LEN);
				stream_node->subject = (char *)malloc(strlen(temp+9)+1);
				memset(stream_node->subject, 0, strlen(temp+9)+1);
				strcpy(stream_node->subject, temp+9);
				find_subject = 1;

				free(readStr);
				i = 1; 
				continue;
			}
			
			free(readStr);

			if (find_from == 1 && find_to == 1 && find_subject == 1 && find_cc == 1)
			{
				//doLog(0, "MAIL FROM: %s\n", stream_node->from);
				//doLog(0, "To: %s\n", stream_node->to);
				//doLog(0, "Subject: %s\n", stream_node->subject);
				//doLog(0, "CC: %s\n", stream_node->cc);
				break;
			}
		}
	}

	//doLog(0, "end analysis_smtp()--------------------------\n");
	fclose(fp);
	
	


	analysis_subject(&stream_node->subject);

	find_mail_bcc(stream_node);
	return;
}

void analysis_subject(char **subject)
{
	char *temp_to_utf8=NULL;
	struct_decode my_decode;

	if (*subject!=NULL)
	{
		//doLog(0, "subject: %s\n", *subject);
		memset(&my_decode, 0, sizeof(struct_decode));
		if(analysis_encode_string(&my_decode, *subject)==1)
		{
			if (my_decode.dest!=NULL && my_decode.d_len>0)
			{
				temp_to_utf8 = NULL;

				if (strcasecmp(my_decode.charset, "gb2312")==0)
				{
					//doLog(0, "my_decode.charset is GB2312!\n");
					temp_to_utf8 = g2u((char *)my_decode.dest);
				}
				else if (strcasecmp(my_decode.charset, "gbk")==0)
				{
					//doLog(0, "my_decode.charset is GBK!\n");
					temp_to_utf8 = gbk2u((char *)my_decode.dest);
				}
				//else
				//{
					//doLog(0, "my_decode.charset is %s!\n",my_decode.charset);
				//}
				
				if (temp_to_utf8 == NULL)
				{
					free(*subject);
					*subject = (char *)malloc(strlen((char *)my_decode.dest)+1);
					memset(*subject, 0, strlen((char *)my_decode.dest)+1);
					memcpy(*subject, my_decode.dest, strlen((char *)my_decode.dest));
				}
				else
				{
					//doLog(0, "temp_to_utf8 not NULL!\n");
					free(*subject);
					*subject = (char *)malloc(strlen(temp_to_utf8)+1);
					memset(*subject, 0, strlen(temp_to_utf8)+1);
					memcpy(*subject, temp_to_utf8, strlen(temp_to_utf8));
					free(temp_to_utf8);
					temp_to_utf8=NULL;
				}

				//doLog(0, "decode subject: %s\n", *subject);
			}
			free_struct_decode(&my_decode);
		}
		//else
			//doLog(0, "subject no encoded!\n");
	}
	return;
}

void find_mail_bcc(tcp_stream_node *stream_node)
{
	u_int32_t bcc_len=0, to_len=0, cc_len=0, rcpt_to_len=0;
	
	if (stream_node->rcpt_to==NULL)
		return;

	if (stream_node->to!=NULL)
		to_len = strlen(stream_node->to);
	if (stream_node->cc!=NULL)
		cc_len = strlen(stream_node->cc);
	
	rcpt_to_len = strlen(stream_node->rcpt_to);
	
	if (to_len == 0)//没有TO
	{
		if (cc_len == 0)//没有CC
		{
			bcc_len = rcpt_to_len;
			stream_node->bcc = (char *)malloc(bcc_len+1);
			memset(stream_node->bcc, 0, bcc_len+1);
			strcpy(stream_node->bcc, stream_node->rcpt_to);
			//doLog(0, "BCC: %s\n", stream_node->bcc);
			return;
		}
		else//有CC
		{
			if (cc_len == rcpt_to_len)//没有BCC
				return;
			bcc_len = rcpt_to_len - cc_len - 1;
			stream_node->bcc = (char *)malloc(bcc_len+1);
			memset(stream_node->bcc, 0, bcc_len+1);
			memcpy(stream_node->bcc, stream_node->rcpt_to+cc_len+1, bcc_len);
			//doLog(0, "BCC: %s\n", stream_node->bcc);
			return;
		}
	}
	else
	{
		if (cc_len == 0)//没有CC
		{
			if (rcpt_to_len == to_len)//没有BCC
				return;
			bcc_len = rcpt_to_len - to_len - 1;
			stream_node->bcc = (char *)malloc(bcc_len+1);
			memset(stream_node->bcc, 0, bcc_len+1);
			memcpy(stream_node->bcc, stream_node->rcpt_to+to_len+1, bcc_len);
			//doLog(0, "BCC: %s\n", stream_node->bcc);
			return;
		}
		else//有CC
		{
			if (to_len+1+cc_len == rcpt_to_len)//没有BCC
				return;
			bcc_len = rcpt_to_len - to_len - 1 - cc_len - 1;
			stream_node->bcc = (char *)malloc(bcc_len+1);
			memset(stream_node->bcc, 0, bcc_len+1);
			memcpy(stream_node->bcc, stream_node->rcpt_to+to_len+1+cc_len+1, bcc_len);
			//doLog(0, "BCC: %s\n", stream_node->bcc);
			return;
		}
	}
	
	return;
}


void free_stream_node(tcp_stream_node *stream_node)
{
	if (stream_node==NULL)
		return;
	else
	{
		if (stream_node->rcpt_to!=NULL)
			free(stream_node->rcpt_to);
		if (stream_node->to!=NULL)
			free(stream_node->to);
		if (stream_node->cc!=NULL)
			free(stream_node->cc);