ipmondlg.cpp

局域网来访者IP监视以及文件修改监视： 1.监听常用的局域网访问工具

									pTCPHead=(struct TCPPacketHead *)(buf+HdrLen);
									sourport = ntohs(pTCPHead->SourPort);
									destport = ntohs(pTCPHead->DestPort);
									//strL4.Format(" sour port:%d,dest port:%d",sourport,destport);
									strSourPort.Format("%d",sourport);
									strDestPort.Format("%d",destport);
									HdrLen = (pTCPHead->HLen)>>4;  //in fact only 4 bits
									HdrLen *= 4;
									pdata=((BYTE *)pTCPHead)+HdrLen;
									totallen -= HdrLen;
									break;
								}
							case IPPROTO_UDP:
								{
									pUDPHead=(struct UDPPacketHead *)(buf+HdrLen);
									sourport = ntohs(pUDPHead->SourPort);
									destport = ntohs(pUDPHead->DestPort);
									//strL4.Format(" sour port:%d,dest port:%d",sourport,destport);
									strSourPort.Format("%d",sourport);
									strDestPort.Format("%d",destport);
									pdata=((BYTE *)pUDPHead)+UDP_HEAD_LEN;
									totallen -= UDP_HEAD_LEN;
									break;
								}
							}

							if(pIpHeader->proto == IPPROTO_ICMP)
								strData.Format("type:%d code:%d data:%s",pICMPHead->Type,pICMPHead->Code,pdata);
							else strData.Format("  %s",pdata);
							
							strSize.Format("%d",totallen);
							
							int nDestPort = atoi(strDestPort);
							if (nDestPort == 139 || 
								nDestPort == 445 || 
								nDestPort == 6129 ||
								nDestPort == 5800 ||
								nDestPort == 5900 ||
								nDestPort == 3389 ||
								nDestPort == 5632 ) 
							{
								if (nDestPort == 139 || nDestPort == 445 ) {
									strAccessType = "(一般网络访问)";
								}
								if (nDestPort == 6129 ) {
									strAccessType = "(DameWare访问)";
								}
								if (nDestPort == 5800 || nDestPort == 5900 ) {
									strAccessType = "(VNC访问)";
								}
								if (nDestPort == 3389 ) {
									strAccessType = "(远端桌面访问)";
								}
								if (nDestPort == 5632) {
									strAccessType = "(pcanywhere访问)";
								}
								strCurTime = GetNowTime();
							//	pDlg->AddData(strCurTime,strAccessType,strProto,szSource,strSourPort,szDest,strDestPort,strSize,strData);
								pDlg->AddData(strCurTime,strAccessType,szSource);
							}				
						if( iLen < iRet )
						{
							iRet -= iLen ;
							bufwork  += iLen ;
        					pIpHeader = (IPHEADER *)bufwork ;
						}
						else
							break ; // pIpHeader->total_len == iRet and go out
					}
					else
					{ // read last part of buf. I wrote it , but always recv() read exactly 
                      // the lenght of the packet
						int iLast = iLen - iRet ;
						pLastBuf = new char [ iLen ] ;
						int iReaden = iRet ;
						memcpy( pLastBuf , bufwork , iReaden ) ;
						iRet = 	recv( pDlg->m_s , pLastBuf + iReaden , iLast , 0 ) ;
						if( iRet == SOCKET_ERROR )
						{
							dwErr = WSAGetLastError() ;
							sprintf( szErr , "Error recv() = %ld " , dwErr ) ;
							break ;
						}
						else
						{
							bufwork = pLastBuf ;	
       						pIpHeader = (IPHEADER *)bufwork ;
							if( iRet == iLast )
								iRet = iLen ;
							else
							{ // read all last data
								iReaden += iRet ;
								iLast -= iRet ;
								while( TRUE )
								{
									iRet = recv( pDlg->m_s , pLastBuf +iReaden , iLast , 0 ) ;
									if( iRet == SOCKET_ERROR )
									{
										dwErr = WSAGetLastError() ;
										sprintf( szErr , "Error recv() = %ld " , dwErr ) ;
										break ;
									}
									else
									{
								        iReaden += iRet ;
								        iLast -= iRet ;
									    if( iLast <= 0 ) 
										    break ;
									}	
								} // while
							}
						}
					}	
				}   // while
				if( pLastBuf )
					delete [ ] pLastBuf ;
			}
			else
			{
				AfxMessageBox( "No data on network" ) ;
				continue ;
			}
	}

	return TRUE ;
}

void CIpmonDlg::OnLookUp() 
{
	// TODO: Add your control notification handler code here
	char        szErr [ 50 ] , szHostName[MAX_PATH];
	DWORD       dwErr ;
    SOCKADDR_IN sa;

	gethostname(szHostName, sizeof(szHostName)) ;
	m_iphostsource = m_ipsource ;
    

 	m_ipcheckedhost = ntohl(m_iphost) ;


		if( 0 == m_threadID )
		{
			SetDlgItemText(IDC_LOOKUP,"停止监听!" );
		}
		else
		{
			if( m_threadID )
			{
 	            PostThreadMessage(m_threadID,WM_CLOSE,0,0) ;
		        SetDlgItemText(IDC_LOOKUP,"开始监听!");
				m_start.EnableWindow(FALSE) ;
			}
			return ;
		}
    	DWORD dwBufferLen[10] ;
		DWORD dwBufferInLen= 1 ;
		DWORD dwBytesReturned = 0 ;
		m_s = socket( AF_INET , SOCK_RAW , IPPROTO_IP ) ;
		if( INVALID_SOCKET == m_s )
		{
			dwErr = WSAGetLastError() ;
			sprintf( szErr , "Error socket() = %ld " , dwErr ) ;
			AfxMessageBox( szErr ) ;
			closesocket( m_s ) ;
			return ;

		}
		int rcvtimeo = 5000 ; 
        if( setsockopt( m_s , SOL_SOCKET , SO_RCVTIMEO , (const char *)&rcvtimeo , sizeof(rcvtimeo) ) == SOCKET_ERROR)
		{
			dwErr = WSAGetLastError() ;
			sprintf( szErr , "Error WSAIoctl = %ld " , dwErr ) ;
			AfxMessageBox( szErr ) ;
			closesocket( m_s ) ;
			return ;
		}
		sa.sin_family = AF_INET;
 		sa.sin_port = htons(7000);
		sa.sin_addr.s_addr= m_iphostsource;
        if (bind(m_s,(PSOCKADDR)&sa, sizeof(sa)) == SOCKET_ERROR)
		{
			dwErr = WSAGetLastError() ;
			sprintf( szErr , "Error bind() = %ld " , dwErr ) ;
			AfxMessageBox( szErr ) ;
			closesocket( m_s ) ;
			return ;
		} 
        if( SOCKET_ERROR != WSAIoctl( m_s, SIO_RCVALL , &dwBufferInLen, sizeof(dwBufferInLen),             
                                      &dwBufferLen, sizeof(dwBufferLen),
									  &dwBytesReturned , NULL , NULL ) )
            AfxBeginThread( threadFunc , (LPVOID)this );
		else
		{
			dwErr = WSAGetLastError() ;
			sprintf( szErr , "Error WSAIoctl = %ld " , dwErr ) ;
			AfxMessageBox( szErr ) ;
			closesocket( m_s ) ;
			return ;
		}
}




void CIpmonDlg::OnOK() 
{
	// TODO: Add extra validation here
	if( NULL != m_threadID )
 	    PostThreadMessage(m_threadID,WM_CLOSE,0,0) ;
	if( m_IPArr.GetSize() )
	    m_IPArr.RemoveAll() ;
	CDialog::OnOK();
}

//void CIpmonDlg::AddData(CString s0,CString s1, CString s2, CString s3, CString s4, CString s5, CString s6,CString s7,CString s8)
void CIpmonDlg::AddData(CString s0, CString s1, CString s2)
{
	int index;

	index = m_ctrList.InsertItem(0,s0);
	m_ctrList.SetItem(index,1,LVIF_TEXT,s1, 0, 0, 0,0);
	m_ctrList.SetItem(index,2,LVIF_TEXT,s2, 0, 0, 0,0);
//	m_ctrList.SetItem(index,3,LVIF_TEXT,s3, 0, 0, 0,0);
//	m_ctrList.SetItem(index,4,LVIF_TEXT,s4, 0, 0, 0,0);
//	m_ctrList.SetItem(index,5,LVIF_TEXT,s5, 0, 0, 0,0);
//	m_ctrList.SetItem(index,6,LVIF_TEXT,s6, 0, 0, 0,0);
//	m_ctrList.SetItem(index,7,LVIF_TEXT,s7, 0, 0, 0,0);
//	m_ctrList.SetItem(index,8,LVIF_TEXT,s8, 0, 0, 0,0);
}

CString GetNowTime()
{
	CTime time;
	CString str;
	time = CTime::GetCurrentTime();	
	str = time.Format("%Y-%m-%d %H:%M:%S");
	return str;
}



void CIpmonDlg::OnBtnMonitor() 
{
	// TODO: Add your control notification handler code here
	DWORD dwChangeFilter = GetChangeFlags1();
	BOOL bWatchSubDir = TRUE;//(BOOL)(IsDlgButtonChecked(IDC_CHECK_SUBDIR1) == BST_CHECKED);
	
	if( dwChangeFilter == 0 ){
		MessageBox(_T("You must select one or more change filters in order to monitor a directory"));
		return;
	}
	if( m_DirWatcher.IsWatchingDirectory( m_strDirectoryToMonitor) )
		m_DirWatcher.UnwatchDirectory( m_strDirectoryToMonitor );

	GetDlgItemText(IDC_EDIT_DIR_TO_MONITOR, m_strDirectoryToMonitor);
/*	if( m_DirWatcher.GetFilterFlags() & CDirectoryChangeWatcher::FILTERS_DONT_USE_FILTERS )
	{
		m_strIncludeFilter1.Empty();
		m_strExcludeFilter1.Empty();
	}
	else
	{
		GetDlgItemText(IDC_EDIT_INCLUDE_FILTER1, m_strIncludeFilter1);
		GetDlgItemText(IDC_EDIT_EXCLUDE_FILTER1, m_strExcludeFilter1);

		if( m_strIncludeFilter1 == _T("*.*") )
		{
			MessageBox(_T("For performance reasons, don't use *.* as the include filter. An empty string means the same thing."));
			SetDlgItemText(IDC_EDIT_INCLUDE_FILTER1, _T(""));
			m_strIncludeFilter1.Empty();
		}
	}
	
*/
	DWORD dwWatch = 0;
	if( ERROR_SUCCESS != (dwWatch = m_DirWatcher.WatchDirectory(m_strDirectoryToMonitor, 
													dwChangeFilter,
													&m_DirChangeHandler,
													bWatchSubDir,
													/*m_strIncludeFilter1*/NULL,
													/*m_strExcludeFilter1*/NULL)) )
	{
		MessageBox(_T("Failed to start watch:\n") + GetLastErrorMessageString( dwWatch ) );
	}
	
}
typedef struct {
	UINT nCtrlId;
	UINT nFlag;
} FLAG_INFO;

DWORD CIpmonDlg::GetChangeFlags1()
{

	DWORD dwChangeNotifyFlags = 0UL;
	CButton* pButton = (CButton*)GetDlgItem(IDC_CHECK1);
	pButton->SetCheck(1);
	FLAG_INFO arFlagInfo[]={
		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_FILE_NAME},
//		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_DIR_NAME},
		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_LAST_WRITE},
//		{IDC_CHECK1,	FILE_NOTIFY_CHANGE_LAST_ACCESS},
//		{IDC_CHECK1,			FILE_NOTIFY_CHANGE_SIZE},
//		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_ATTRIBUTES},
//		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_LAST_WRITE},
//		{IDC_CHECK1,	FILE_NOTIFY_CHANGE_LAST_ACCESS},
		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_CREATION},
//		{IDC_CHECK1,		FILE_NOTIFY_CHANGE_SECURITY}
	};

	for(int i = 0; i < sizeof(arFlagInfo)/sizeof(arFlagInfo[0]); ++i)
	{
		dwChangeNotifyFlags |= (IsDlgButtonChecked(arFlagInfo[i].nCtrlId) == BST_CHECKED)? arFlagInfo[i].nFlag : 0;
	}

	return dwChangeNotifyFlags;
}

void CIpmonDlg::OnBtnBrowse1() 
{
	GetDlgItemText(IDC_EDIT_DIR_TO_MONITOR, m_strDirectoryToMonitor);

	CFolderDialog dlg(_T("选择要监视的目录..."), m_strDirectoryToMonitor, this);

	if( dlg.DoModal() == IDOK )
	{
		SetDlgItemText(IDC_EDIT_DIR_TO_MONITOR, dlg.GetFolderPath());
	}	// TODO: Add your control notification handler code here
	
}

void CIpmonDlg::OnBtnMonitor2() 
{
	// TODO: Add your control notification handler code here
	DWORD dwChangeFilter = GetChangeFlags1();
	BOOL bWatchSubDir = TRUE;
	
	if( dwChangeFilter == 0 ){
		MessageBox(_T("You must select one or more change filters in order to monitor a directory"));
		return;
	}
	if( m_DirWatcher.IsWatchingDirectory( m_strDirectoryToMonitor2) )
		m_DirWatcher.UnwatchDirectory( m_strDirectoryToMonitor2 );
	GetDlgItemText(IDC_EDIT_DIR_TO_MONITOR2, m_strDirectoryToMonitor2);


	//
	//	This demonstrates that the CDirectoryChangeHandler objects are 
	//	reference counted(reference count is incremented/decremented by CDirecotryChangeWatcher)
	//	and that they will be automatically deleted
	//	when the directory is unwatched.
	//

//	CDirectoryChangeHandler_ListBox * pHandler = new CDirectoryChangeHandler_ListBox(m_lstChanges);

	DWORD dwWatch;
	if( ERROR_SUCCESS != (dwWatch = m_DirWatcher.WatchDirectory(m_strDirectoryToMonitor2, 
													dwChangeFilter,
												//	pHandler,
												&m_DirChangeHandler,
													bWatchSubDir,
													NULL,
													NULL)) )
	{
		MessageBox(_T("Failed to start watch:\n") + GetLastErrorMessageString( dwWatch ));
	}

//	if( pHandler )
//		pHandler->Release();
	
}

void CIpmonDlg::OnBtnBrowse2() 
{
	// TODO: Add your control notification handler code here
	GetDlgItemText(IDC_EDIT_DIR_TO_MONITOR2, m_strDirectoryToMonitor2);
	
	CFolderDialog dlg(_T("选择要监视的目录..."), m_strDirectoryToMonitor2, this);

	if( dlg.DoModal() == IDOK )
	{
		SetDlgItemText(IDC_EDIT_DIR_TO_MONITOR2, dlg.GetFolderPath());
	}	
}

void CIpmonDlg::OnBtnClearip() 
{
	// TODO: Add your control notification handler code here
	m_ctrList.DeleteAllItems();
	
}

void CIpmonDlg::OnBtnClearlistfile() 
{
	// TODO: Add your control notification handler code here
	m_lstChanges.DeleteAllItems();
}

void CIpmonDlg::OnClose() 
{
	// TODO: Add your message handler code here and/or call default
	if( NULL != m_threadID )
	    PostThreadMessage(m_threadID,WM_CLOSE,0,0) ;
	if( m_IPArr.GetSize() )
	    m_IPArr.RemoveAll() ;	
	CDialog::OnClose();
}