u_filter.pas

linux program to read packet data

(*
 * One Way Network Sniffer (OWNS)
 * Copyright (C) 2001-2002 OWNS
 *
 * http://owns.sourceforge.net/
 * http://www.owns.st
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *)

(*
 * $Id: u_Filter.pas,v 1.6 2002/11/02 14:05:37 owns Exp $
 * g_Filtre is the filter for the capture
 * You can choose what you want to capture
 *)

unit u_Filter;
interface
uses
  sysUtils,
  u_IPPacket,u_Statistics, u_MimeTypes, u_FilterHttp;


type
  TFilterPop3Nntp = record
    SaveFiles : Boolean;
    SaveTCPStream : Boolean;
  end;

  TFilterOthers = record
    SaveTCPStream : Boolean;
  end;

  TFilePathConfig =
            (Ext_Id,                    // \files\jpg\Id265-0.jpg
             Ext_IPDest_PortDest_Id,    // \files\jpg\192.56.45.46 4562 Id265-0.jpg
             IPDest_Ext_Id,             // \files\192.56.45.46\jpg\Id265-0.jpg
             Mime_IpDest_PortDest_Id);  // \files\image\jpg\192.56.45.46 4562 Id265-0.jpg

  TFilter = class
  private
    FSaveHttp                : boolean;
    FFilterHttp              : TFilterHttp;
    FOutputDir               : String;

    function getSavePop3 : boolean;
    function getSaveNntp : boolean;
  public
    FilterPop3   : TFilterPop3Nntp;
    FilterNntp   : TFilterPop3Nntp;
    FilterOthers : TFilterOthers;
    FFilePathConfig : TFilePathConfig;
    constructor create;
    destructor destroy; override;
    function getFilePath(p_UniqueId : String; p_MimeType : TMimeType;
                           p_IpSource : PIP_ADDR;p_SourcePort : Word;
                           p_IpDest : PIP_ADDR;p_DestPort : Word) : String;

    property SaveHttp : boolean read FSaveHttp write FSaveHttp;
    property SavePop3 : boolean read getSavePop3;
    property SaveNntp : boolean read getSaveNntp;
    property FilePathConfig : TFilePathConfig read FFilePathConfig write FFilePathConfig;
    property FilterHttp : TFilterHttp read FFilterHttp;
    property OutputDir : String read FOutputDir write FOutputDir;
  end;

var
  g_Filter : TFilter;

implementation

//
// TFilter
////////////////////////////////////////////////////////////////////////////////

constructor TFilter.create;
begin
  FFilterHttp := TFilterHttp.create;

  FFilePathConfig := Ext_IPDest_PortDest_Id;
  FSaveHttp := true;

  FilterPop3.SaveFiles := true;
  FilterPop3.SaveTCPStream := false;

  FilterNntp.SaveFiles := true;
  FilterNntp.SaveTCPStream := false;

  FilterOthers.SaveTCPStream := false;

  FOutputDir := './files';
end;

destructor TFilter.destroy;
begin
  FFilterHttp.free;
end;


// lorsque isAccepted = true, cette fonction est utilis閑 pour savoir o