// Sniffer.cpp: implementation of the CSniffer class.
//
//////////////////////////////////////////////////////////////////////

#include "stdafx.h"
#include "Sniffer.h"
#include <winsock2.h>
#include <WS2TCPIP.H>
#include <MSTcpIP.h>

#ifdef _DEBUG
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#endif

//////////////////////////////////////////////////////////////////////
// Construction/Destruction
//////////////////////////////////////////////////////////////////////

CSniffer::CSniffer()
{
	WSADATA wsaData;

	if(WSAStartup(0x202, &wsaData) == 0)
	{
		m_bWSAStartup = TRUE;
	}
	else
	{
		m_bWSAStartup = FALSE;
	}

	//初始化臨界區(qū)對象
	InitializeCriticalSection(&m_ls);


	memset(m_szProto, 0, 16);
	memset(m_strAddr, 0, 64);

	memset(m_szDestPort, 0, 16);
	memset(m_szSourcePort, 0, 16);
	memset(m_szTTL, 0, 16);
	memset(m_szDestIP, 0, 16);
	memset(m_szSourceIP, 0, 16);
	memset(m_szProtocol, 0, 16);

	m_bIsRun = FALSE;
	m_IsAllPort = false;
	m_IsAllIp = TRUE;
	m_IsAllProto = TRUE;
}

CSniffer::~CSniffer()
{
	//銷毀臨界區(qū)對象
	DeleteCriticalSection(&m_ls);
	DelListBuf();
}

BOOL CSniffer::SnifferInit(LPSTR lpStrAddr, UINT uPort)
{
	DWORD	dwThreadID;
	strcpy(m_strAddr, lpStrAddr);
	m_uPort = uPort;
	m_HostIp = GetIp(); //得到本機IP
	//開始監(jiān)聽

	if(!CreateSock()) //建立
	{
		//"WinSock設(shè)置失敗
		return false;
	}
	else
	{
		m_bIsRun = TRUE;
		m_hThread = CreateThread( NULL, NULL, RecvIpPro, (PVOID)this, NULL, &dwThreadID);
	}

	return true;
}

void CSniffer::StopSniffer()
{
	m_bIsRun = FALSE;
	if(m_hThread)
	{
		TerminateThread(m_hThread, 0);
		CloseHandle(m_hThread);
	}

	if(m_RawSock)
		closesocket(m_RawSock);
}

//建立原始套接字
BOOL CSniffer::CreateSock()
{
	char name[56] = {0};
	hostent *pHostent;
	int port = 8310;	//監(jiān)聽端口
	int err;
	SOCKADDR_IN sockaddr;
	
	m_RawSock = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
	if(m_RawSock == INVALID_SOCKET)
	{
		return WSAGetLastError(); //socket創(chuàng)建失敗
	}
	
	err= ::gethostname(name, 56);
	if(err==SOCKET_ERROR)
	{
		return WSAGetLastError(); //取本機用戶名失敗
	}

	pHostent = gethostbyname (name);

	sockaddr.sin_family = AF_INET;
	sockaddr.sin_port = htons(port);
	memcpy(&sockaddr.sin_addr.s_addr, pHostent->h_addr_list[0],
		pHostent->h_length);

	//free(pHostent);
	
	err = bind(m_RawSock,(SOCKADDR *)&sockaddr, sizeof(sockaddr));//綁定
	if(err == SOCKET_ERROR)
	{
		return WSAGetLastError(); //取本機用戶名失敗
	}
	BOOL bOptval = TRUE;

	//設(shè)置套節(jié)字選項
	setsockopt(m_RawSock, SOL_SOCKET,SO_REUSEADDR, (char*)&bOptval, sizeof(bOptval));
	err = setsockopt(m_RawSock, IPPROTO_IP,IP_HDRINCL, (char*)&bOptval, //IP_HDRINCL該選項使之能操作IP頭
		sizeof(bOptval));
	if(err == SOCKET_ERROR)
	{
		return WSAGetLastError(); //設(shè)置套節(jié)字選項失敗
	}

	//把網(wǎng)卡置于混雜模式。獲取IO操作的相關(guān)信息
	DWORD dwBufferLen[10] ;
	DWORD dwBufferInLen = 1 ;
	DWORD dwBytesReturned = 0 ;
	err=WSAIoctl (
		m_RawSock,                                               
		SIO_RCVALL,       //設(shè)置SOCK_RAW為SIO_RCVALL，以便接收所有的IP包                           
		&dwBufferInLen,                                     
		sizeof(dwBufferInLen),                                       
		&dwBufferLen,                                    
		sizeof(dwBufferLen),                                      
		&dwBytesReturned,                              
		NULL,                           
		NULL  
		);//最后兩參數(shù)設(shè)置非阻塞


	if(err == SOCKET_ERROR)
	{
		return WSAGetLastError(); //設(shè)置套節(jié)字選項失敗
	}

	return true;
}

//在線程中不斷接受IP包
DWORD CALLBACK CSniffer::RecvIpPro(LPVOID lpParam)
{
	int err = 0;
	int recvLen;
	CSniffer* pSniffer = (CSniffer*)lpParam;
	char *recvBuf = new char[MAX_PACK_LEN];
	while(pSniffer->m_bIsRun)
	{
		memset(recvBuf, 0, MAX_PACK_LEN);
		recvLen = recv(pSniffer->m_RawSock,recvBuf, MAX_PACK_LEN, 0);//接受數(shù)據(jù)
		
		if(err==SOCKET_ERROR)
		{
			if(WSAGetLastError() == WSAEWOULDBLOCK) //如果錯誤為阻塞那么將繼續(xù)接受
				continue;
			break;
		}
		//處理已經(jīng)接受到的IP包
		EnterCriticalSection(&pSniffer->m_ls);
		pSniffer->SplitIpPack(recvBuf, recvLen); //分解IP包
		//pSniffer->ShowIpInfo(recvBuf,recvLen); //分析并處理IP數(shù)據(jù)包
		LeaveCriticalSection(&pSniffer->m_ls);
	}
	return 0;

}

//分解IP包
void CSniffer::SplitIpPack(char *pData, int len)
{
	IP_HEADER* pIpHead;

	memset(m_szDestPort, 0, 16);
	memset(m_szSourcePort, 0, 16);
	memset(m_szTTL, 0, 16);
	memset(m_szDestIP, 0, 16);
	memset(m_szSourceIP, 0, 16);
	memset(m_szProtocol, 0, 16);

	pIpHead = (IP_HEADER*)pData; //轉(zhuǎn)為IP頭結(jié)構(gòu)
	SOCKADDR_IN saSource, saDest; //中間變量分別為源IP地址結(jié)構(gòu)和目標IP地址結(jié)構(gòu) 

	//得到包中協(xié)議
	int iProtocol;
	iProtocol = pIpHead->proto;
	//得到協(xié)議字符形式表示m_szProtocol
	strncpy(m_szProtocol,CheckProtocol(iProtocol), MAX_PROTO_TEXT_LEN);


	//得到源IP
	saSource.sin_addr.s_addr = pIpHead->sourceIP;
	strncpy(m_szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);

	//得到目標IP
	saDest.sin_addr.s_addr=pIpHead->destIP;
	strncpy(m_szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);

	//得到TTL
	int ttl;
	ttl=pIpHead->ttl;
	wsprintf(m_szTTL, "%d", ttl);

	//得到頭長度
	int ihLen = sizeof(unsigned long)*(pIpHead->h_lenver & 0xf);

	m_ihLen = ihLen;
	unsigned short srcPort = 0, destPort = 0;
	switch(iProtocol) 
	{
	case IPPROTO_TCP:
		{
		
		TCP_HEADER* pTcpHead;
		pTcpHead = (TCP_HEADER*)(pData+ihLen);
		srcPort = ntohs(pTcpHead->th_sport);
		destPort = ntohs(pTcpHead->th_dport);
		wsprintf(m_szSourcePort, "%d", srcPort);
		wsprintf(m_szDestPort, "%d", destPort);
		int nLen = ihLen + sizeof(TCP_HEADER);
		//基于TCP/IP協(xié)議之上的協(xié)議的解析
		TCPProtocolParse(pData + nLen, len - nLen);
		}
		break;
	case IPPROTO_UDP:
		UDP_HEADER* pUdpHead;
		pUdpHead = (UDP_HEADER*)(pData+ihLen);
		srcPort = ntohs(pUdpHead->uh_sport);
		destPort = ntohs(pUdpHead->uh_dport);	
		wsprintf(m_szSourcePort, "%d", srcPort);
		wsprintf(m_szDestPort, "%d",destPort);
		break;
	case IPPROTO_ICMP:
		ICMP_HEADER* pIcmpHead;
		pIcmpHead=(ICMP_HEADER*)(pData + ihLen);
		wsprintf(m_szSourcePort, "%s", "");
		wsprintf(m_szDestPort, "%s", "");
		break;
	default:
		wsprintf(m_szSourcePort, "%s", "");
		wsprintf(m_szDestPort, "%s", "");
	}
		
}

//將IP記錄存放到鏈表中
void CSniffer::ShowIpInfo(char *pData, int len)
{
	if(len<0)
		return;
	char szSourceIP[32] = {0};
	char szDestIP[32] = {0};

	char szSourcePort[16] = {0}; //截取到的源端口
	char szDestPort[16] = {0}; //截取到的目標端口

	char szSourceIPt[32] = {0}; //截取到源IP
	char szDestIPt[32] = {0}; //截取到目標IP
	
	char szWprot[5] = {0}; //取得輸入端口
	char szIP[32] = {0}; //取得輸入IP
	char szProto[16] = {0}; //取得輸入?yún)f(xié)議
	


	if(strcmp(m_HostIp, m_szSourceIP) == 0)
	{
		strcat(szSourceIP, "(本機)");
		strcat(szSourceIP, m_szSourceIP);
	}
	else
		strncpy(szSourceIP, m_szSourceIP, 16);

	if(strcmp(m_HostIp, m_szDestIP) == 0)
	{
		strcat(szDestIP, "(本機)");
		strcat(szDestIP, m_szDestIP);
	}
	else
		strncpy(szDestIP, m_szDestIP, 16);

	strncpy(szSourcePort, m_szSourcePort, 5);
	strncpy(szDestPort, m_szDestPort, 5);
	strncpy(szDestIPt, m_szSourceIP, 32);
	strncpy(szSourceIPt, m_szDestIP, 32);
	strncpy(szProto, m_szProtocol, 16);

	wsprintf(szWprot, "%d", m_uPort);
	//取得輸入IP
	strcpy(szIP, m_strAddr);
	
	BOOL bProt = m_IsAllPort | (strcmp(szSourcePort, szWprot) == 0) |
		(strcmp(szDestPort, szWprot) == 0); //判斷端口規(guī)則
	BOOL bIp = m_IsAllIp | (strcmp(szSourceIPt, szIP) == 0) |
		(strcmp(szDestIPt, szIP) == 0); //判斷IP規(guī)則
	BOOL bProto = m_IsAllProto | (strcmp(szProto, m_szProto) == 0); //判斷協(xié)議規(guī)則
	
	if(bProt && bIp && bProto)
	{
			char sNowTime[18] = {0};
			GetNowTime(sNowTime);

			char str[512] = {0};
			wsprintf(str, "[%s] %s:%s->%s:%s 包大小(頭/總)%d/%d %s", m_szProtocol, szSourceIP,
				m_szSourcePort, szDestIP, m_szDestPort,
				m_ihLen, len, sNowTime);

			int nCount = m_strIPInfoList.size();
			if (nCount >= 1000)
				m_strIPInfoList.clear();
			//放入鏈表
			string strData(str);
			m_strIPInfoList.push_back(strData);
			//綁定數(shù)據(jù)
			IPDATA *pIpData = new IPDATA();
			pIpData->len = len;
			pIpData->buf = new char[len];
			memcpy(pIpData->buf, pData, len);
			m_strIPDataList.push_back((DWORD)pIpData);
	}
}

//清除和ListBox綁定的數(shù)據(jù)和列表
void CSniffer::DelListBuf()
{
}


//格式化顯示IP包
void CSniffer::ShowIpData(char *pData, int len)
{


}

//協(xié)議分析統(tǒng)一在此處理
void CSniffer::TCPProtocolParse(char *pData, int nLen)
{
	for(int i=0; i<nLen; i++)
	{
		if(pData[i] == 0)
			pData[i] = '\n';
	}

		UINT nPort = GetPort();

	m_HttpParse.Perform(pData, nLen, nPort, m_szSourceIP, "",
				 m_szSourcePort, m_szDestIP, "", m_szDestPort);
	
}



void CSniffer::ConfigProtocolParsePack(vector<DWORD> &Parse_List)
{

	int nTelnetLen = Parse_List.size();
	int nLen = sizeof(TELNET_IAC_PACK) * nTelnetLen;
	char *config = new char[nLen];

	
	for (int i = 0; i < nTelnetLen; i++)
	{
		DWORD Node = Parse_List.at(i);

		if (Node != 0)
		{
			TELNET_IAC_PACK* pNode = (TELNET_IAC_PACK*)Node;
			memset(config, 0, nLen + 1);
			wsprintf(config, 
				"[時間]%s\r\n[源IP]%s\r\n[目的IP]%s\r\n[源MAC]%s\r\n[目的MAC]%s\r\n[命令]\r\n%s\r\n[數(shù)據(jù)域]\r\n%s%\r\n",
				pNode->date,
				pNode->src_ip,
				pNode->des_ip,
				pNode->src_mac,
				pNode->des_mac,
				pNode->cmd,
				pNode->data);
		}
	}
		
	

	//存放到文件中去
	char path[1024] ={0};
	//GetCurrentDirectory(1024, path);
	//strcat(path, "\\網(wǎng)絡(luò)抓包日志(Telent).log");

	strcpy(path, "c:\\網(wǎng)絡(luò)抓包日志(Telent).log");
	nLen = strlen(config);
	WriteLogFile(config, nLen, path);
}

//////////////////////////////////////////////////////////////////////////
//將協(xié)議int轉(zhuǎn)為字符串
char* CSniffer::CheckProtocol(int iProtocol)
{
	for(int i=0; i < MAX_PROTO_NUM; i++)
	{
		if(ProtoMap[i].ProtoNum == iProtocol)
		{
			return ProtoMap[i].ProtoText;
		}
	}
		return "";
}

//得到本機IP
char* CSniffer::GetIp()
{
	WORD wVersionRequested;
	WSADATA wsaData;
	char name[255];
	char *ip;
	PHOSTENT hostinfo;
	wVersionRequested = MAKEWORD( 2, 0 );
	if ( WSAStartup( wVersionRequested, &wsaData ) == 0 )
	{
		
		if( gethostname ( name, sizeof(name)) == 0)
		{
			if((hostinfo = gethostbyname(name)) != NULL)
			{
				ip = inet_ntoa (*(struct in_addr *)*hostinfo->h_addr_list);
			}
		}
		
		WSACleanup();
	} 
	return ip;
}

//得到當前時間,格式:%Y-%m-%d %H:%M:%S
void CSniffer::GetNowTime(char *pCurTime)
{
	_SYSTEMTIME Curtime;
	GetSystemTime(&Curtime);
	wsprintf(pCurTime, "%4d-%2d-%2d %2d:%2d:%2d",
		Curtime.wYear,
		Curtime.wMonth,
		Curtime.wDay,
		Curtime.wHour,
		Curtime.wMinute,
		Curtime.wSecond);
}


//寫入日志文件
bool CSniffer::WriteLogFile(char *strInfo, int nBuffer, char *strFileName)
{
	if (lstrlen(strInfo)<1)
		return FALSE;

	int nLen = sizeof(strInfo);
	FILE *lpfile;
	lpfile = fopen(strFileName, "aw+");
	//fseek(lpfile, 0, SEEK_END);

	char *temp =  new char[nBuffer];
	memset(temp, 0, nBuffer);
	strcpy(temp, strInfo);
	strcat(temp, "\r\n");
	fwrite(temp, nBuffer, 1, lpfile);
	fclose(lpfile);
	return true;
}