Esempio n. 1
0
 public DnsRecordEventArgs(Packets.DnsPacket.IDnsResponseInfo record, NetworkHost dnsServer, NetworkHost dnsClient, Packets.IIPPacket ipPakcet, Packets.ITransportLayerPacket transportLayerPacket)
 {
     this.Record               = record;
     this.DnsServer            = dnsServer;
     this.DnsClient            = dnsClient;
     this.IpPacket             = ipPakcet;
     this.TransportLayerPacket = transportLayerPacket;
 }
        public void ExtractData(ref NetworkHost sourceHost, NetworkHost destinationHost, IEnumerable <Packets.AbstractPacket> packetList)
        {
            //Packets.IIPPacket ipPacket = null;
            Packets.ITransportLayerPacket transportLayerPacket = null;

            foreach (Packets.AbstractPacket p in packetList)
            {
                if (p.GetType() == typeof(Packets.NetBiosNameServicePacket))
                {
                    ExtractData((Packets.NetBiosNameServicePacket)p, sourceHost, destinationHost, transportLayerPacket);
                }

                /*else if (p is Packets.IIPPacket)
                *   ipPacket = (Packets.IIPPacket)p;*/
                else if (p is Packets.ITransportLayerPacket tlp)
                {
                    transportLayerPacket = tlp;
                }
            }
        }
Esempio n. 3
0
        public void ExtractData(ref NetworkHost sourceHost, NetworkHost destinationHost, IEnumerable <Packets.AbstractPacket> packetList)
        {
            Packets.DnsPacket             dnsPacket            = null;
            Packets.IIPPacket             ipPacket             = null;
            Packets.ITransportLayerPacket transportLayerPacket = null;

            foreach (Packets.AbstractPacket p in packetList)
            {
                if (p.GetType() == typeof(Packets.DnsPacket))
                {
                    dnsPacket = (Packets.DnsPacket)p;
                }
                else if (p is Packets.IIPPacket)
                {
                    ipPacket = (Packets.IIPPacket)p;
                }

                /*else if(p.GetType()==typeof(Packets.IPv6Packet))
                 *  ipv6Packet=(Packets.IPv6Packet)p;*/
                else if (p is Packets.ITransportLayerPacket tlp)
                {
                    transportLayerPacket = tlp;
                }
            }

            if (dnsPacket != null)
            {
                //ExtractDnsData(dnsPacket);
                if (dnsPacket.Flags.Response)
                {
                    System.Collections.Specialized.NameValueCollection cNamePointers = new System.Collections.Specialized.NameValueCollection();
                    if (dnsPacket.AnswerRecords != null && dnsPacket.AnswerRecords.Length > 0)
                    {
                        foreach (Packets.DnsPacket.ResourceRecord r in dnsPacket.AnswerRecords)
                        {
                            if (r.IP != null)
                            {
                                if (!base.MainPacketHandler.NetworkHostList.ContainsIP(r.IP))
                                {
                                    NetworkHost host = new NetworkHost(r.IP);
                                    host.AddHostName(r.DNS, dnsPacket.PacketTypeDescription);
                                    lock (base.MainPacketHandler.NetworkHostList)
                                        base.MainPacketHandler.NetworkHostList.Add(host);
                                    MainPacketHandler.OnNetworkHostDetected(new Events.NetworkHostEventArgs(host));
                                    //base.MainPacketHandler.ParentForm.ShowDetectedHost(host);
                                }
                                else
                                {
                                    base.MainPacketHandler.NetworkHostList.GetNetworkHost(r.IP).AddHostName(r.DNS, dnsPacket.PacketTypeDescription);
                                }
                                if (cNamePointers[r.DNS] != null)
                                {
                                    base.MainPacketHandler.NetworkHostList.GetNetworkHost(r.IP).AddHostName(cNamePointers[r.DNS], dnsPacket.PacketTypeDescription);
                                }
                            }
                            else if (r.Type == (ushort)Packets.DnsPacket.RRTypes.CNAME)
                            {
                                cNamePointers.Add(r.PrimaryName, r.DNS);
                            }


                            MainPacketHandler.OnDnsRecordDetected(new Events.DnsRecordEventArgs(r, sourceHost, destinationHost, ipPacket, transportLayerPacket));
                            //base.MainPacketHandler.ParentForm.ShowDnsRecord(r, sourceHost, destinationHost, ipPakcet, udpPacket);
                        }
                    }
                    else
                    {
                        //display the flags instead
                        //TODO : MainPacketHandler.OnDnsRecordDetected(new Events.DnsRecordEventArgs(
                        if (dnsPacket.QueriedDnsName != null && dnsPacket.QueriedDnsName.Length > 0)
                        {
                            MainPacketHandler.OnDnsRecordDetected(new Events.DnsRecordEventArgs(new Packets.DnsPacket.ResponseWithErrorCode(dnsPacket), sourceHost, destinationHost, ipPacket, transportLayerPacket));
                        }
                    }
                }
                else  //DNS request
                {
                    if (dnsPacket.QueriedDnsName != null && dnsPacket.QueriedDnsName.Length > 0)
                    {
                        sourceHost.AddQueriedDnsName(dnsPacket.QueriedDnsName);
                    }
                }
            }
        }
        public int ExtractData(NetworkHost sourceHost, NetworkHost destinationHost, IEnumerable <PacketParser.Packets.AbstractPacket> packetList)
        {
            int parsedBytes = 0;

            Packets.ITransportLayerPacket transportLayerPacket = null;


            foreach (Packets.AbstractPacket p in packetList)
            {
                if (p is ITransportLayerPacket)
                {
                    transportLayerPacket = p as ITransportLayerPacket;
                }
                if (p.GetType() == typeof(Packets.KerberosPacket))
                {
                    Packets.KerberosPacket kerberosPacket = (Packets.KerberosPacket)p;

                    //TicketPrimitives sessionTicketPrimitives = null;
                    System.Collections.Specialized.NameValueCollection parameters = new System.Collections.Specialized.NameValueCollection();

                    string sessionSalt = this.GetKrbErrorSalt(kerberosPacket);//returns null in none found
                    if (sessionSalt != null)
                    {
                        parameters.Add("Kerberos Salt", sessionSalt);
                    }
                    int hostPairHash = sourceHost.IPAddress.GetHashCode() ^ destinationHost.IPAddress.GetHashCode();
                    if (this.saltList.ContainsKey(hostPairHash))
                    {
                        if (sessionSalt == null)
                        {
                            sessionSalt = this.saltList[hostPairHash];
                        }
                        else
                        {
                            this.saltList[hostPairHash] = sessionSalt;
                        }
                    }
                    else if (sessionSalt != null)
                    {
                        this.saltList.Add(hostPairHash, sessionSalt);
                    }



                    //parameters.Add("Kerberos message type", Enum.GetName(typeof(KerberosPacket.MessageType), kerberosPacket.MsgType) + " ("+((int)kerberosPacket.MsgType).ToString()+")");


                    List <uint> packetIntegers = new List <uint>();
                    byte        encryptionType = 0;
                    //uint lastInteger = 0;
                    //List<string> spnParts = new List<string>();
                    List <(string username, string hash)> kerberosHashes = new List <(string username, string hash)>();
                    //string username, realm;
                    (string username, string realm) = this.GetUserAndRealm(kerberosPacket, sourceHost, destinationHost);
                    if (!string.IsNullOrEmpty(username))
                    {
                        parameters.Add("Kerberos Username", username);
                    }
                    if (!string.IsNullOrEmpty(realm))
                    {
                        parameters.Add("Kerberos Realm", realm);
                    }

                    foreach (var item in kerberosPacket.AsnData)
                    {
                        if (item.Item2 == Utils.ByteConverter.Asn1TypeTag.Integer)
                        {
                            //lastInteger = Utils.ByteConverter.ToUInt32(item.Item3);
                            uint number = Utils.ByteConverter.ToUInt32(item.Item3);
                            packetIntegers.Add(number);
                            if (kerberosPacket.MsgType == KerberosPacket.MessageType.krb_tgs_rep && item.Item1.Equals("6d.30.a5.61.30.a3.30.a0"))
                            {
                                encryptionType = (byte)number;
                            }
                            else if (kerberosPacket.MsgType == KerberosPacket.MessageType.krb_as_rep)
                            {
                                if (item.Item1.Equals("6b.30.a5.61.30.a3.30.a0") || item.Item1.Equals("6b.30.a6.30.a0"))
                                {
                                    encryptionType = (byte)number;
                                }
                            }
                        }
                        else if (item.Item2 == Utils.ByteConverter.Asn1TypeTag.OctetString)
                        {
                            //string hexValue = Utils.ByteConverter.ReadHexString(item.Item3, item.Item3.Length, true);
                            if (kerberosPacket.MsgType == KerberosPacket.MessageType.krb_as_req)
                            {
                                if (item.Item1 == "6a.30.a3.30.30.a2" && packetIntegers.Last() == (ushort)KerberosPacket.PADataType.ENC_TIMESTAMP)
                                {
                                    foreach (var encTimestampItem in Utils.ByteConverter.GetAsn1Data(item.Item3))
                                    {
                                        if (encTimestampItem.Item2 == Utils.ByteConverter.Asn1TypeTag.Integer && encTimestampItem.Item1 == "30.a0" && encTimestampItem.Item3.Length == 1)
                                        {
                                            encryptionType = encTimestampItem.Item3.First();
                                        }
                                        else if (encTimestampItem.Item2 == Utils.ByteConverter.Asn1TypeTag.OctetString && encTimestampItem.Item1 == "30.a2")
                                        {
                                            //sessionTicketPrimitives.Data = Utils.ByteConverter.ReadHexString(encTimestampItem.Item3, encTimestampItem.Item3.Length, true);
                                            //if (sessionTicketPrimitives.TryGetTicketHash(kerberosPacket.MsgType, encryptionType, encTimestampItem.Item3, out string hash))
                                            //    kerberosHashes.Add(hash);
                                            byte[] data = encTimestampItem.Item3;
                                            //krb5pa

                                            //user:$krb5pa$etype$user$realm$salt$HexTimestampHexChecksum

                                            //des:$krb5pa$23$des$DENYDC$$32d396a914a4d0a78e979ba75d4ff53c1db7294141760fee05e434c12ecf8d5b9aa5839e09a2244893aff5f384f79c37883f154a
                                            //des:$krb5pa$3$des$DENYDC$DENYDC.COMdes$233b4272aa93727221facfdbdcc9d1d9a0c43a2798c810600310c0daf48fb969c26cb47d69f575a65e00163845f68811f9c5266271cc0f91
                                            //u5:$krb5pa$23$u5$DENYDC$DENYDC.COMdes$daf324dccec73739f6e49ef8fde60a9f9dfff50551ff5a7e969c6e395f18b842fb17c3b503df3025ab5a9dfc3031e893c4002008
                                            //u5:$krb5pa$23$u5$DENYDC$DENYDC.COMdes$addbe67ccf9dd3c3da9e233612816c5720447ae202cfe7a84a719e1ef70b93bcef49786f71319a93d60531fcb443f7e96039f540

                                            StringBuilder sb = new StringBuilder();
                                            //sb.Append(username);
                                            //sb.Append(":$krb5pa$");
                                            sb.Append("$krb5pa$");
                                            sb.Append(encryptionType);
                                            sb.Append("$");
                                            sb.Append(username);
                                            sb.Append("$");
                                            sb.Append(realm);
                                            sb.Append("$");
                                            sb.Append(sessionSalt);
                                            sb.Append("$");
                                            if (encryptionType == 23)
                                            {
                                                //string checksum = Data.Substring(0, 32);
                                                string checksum = Utils.ByteConverter.ReadHexString(data, 16, 0, true);
                                                //string encTimestamp = Data.Substring(32);
                                                string encTimestamp = Utils.ByteConverter.ReadHexString(data, data.Length - 16, 16, true);
                                                //"%s:$krb5pa$%s$%s$%s$%s$%s%s\n" % (user, etype, user, realm, salt, enc_timestamp, checksum)
                                                sb.Append(encTimestamp);
                                                sb.Append(checksum);
                                            }
                                            else //"%s:$krb5pa$%s$%s$%s$%s$%s\n" % (user, etype, user, realm, salt, PA_DATA_ENC_TIMESTAMP)
                                            {
                                                sb.Append(Utils.ByteConverter.ReadHexString(data, data.Length, true));
                                            }
                                            kerberosHashes.Add((username, sb.ToString()));
                                        }
                                    }
                                }
                            }
                            else if (kerberosPacket.MsgType == KerberosPacket.MessageType.krb_tgs_rep)
                            {
                                if (item.Item1 == "6d.30.a5.61.30.a3.30.a2" &&
                                    encryptionType == 23 &&
                                    packetIntegers.Count > 2 && packetIntegers.Skip(packetIntegers.Count - 2).First() == 23)
                                {
                                    byte[] data = item.Item3;
                                    //sessionTicketPrimitives.Username = string.Join("/", spnParts);
                                    //if (sessionTicketPrimitives.TryGetTicketHash(kerberosPacket.MsgType, encryptionType, item.Item3, out string hash))
                                    //    kerberosHashes.Add(hash);
                                    //$krb5tgs$<ENCRYPTION_TYPE>$*<USERNAME>$<REALM>$<SPN>*$<FIRST_16_BYTES_TICKET>$<REMAINING_TICKET_BYTES>
                                    //"%s:$krb5tgs$%s$%s$%s\n" % (spn, etype, data[:32], data[32:])
                                    StringBuilder sb = new StringBuilder();
                                    //sb.Append(username);
                                    //sb.Append(":$krb5tgs$");
                                    sb.Append("$krb5tgs$");
                                    sb.Append(encryptionType);
                                    sb.Append("$");
                                    string encPart1 = Utils.ByteConverter.ReadHexString(data, 16, 0, true);
                                    string encPart2 = Utils.ByteConverter.ReadHexString(data, data.Length - 16, 16, true);
                                    sb.Append(encPart1);
                                    sb.Append("$");
                                    sb.Append(encPart2);
                                    kerberosHashes.Add((username, sb.ToString()));
                                    //sessionTicketPrimitives.Data = Utils.ByteConverter.ReadHexString(item.Item3, item.Item3.Length, true);
                                }
                            }
                            else if (kerberosPacket.MsgType == KerberosPacket.MessageType.krb_as_rep)
                            {
                                if (krbAsRepTicketPaths.Contains(item.Item1))
                                {
                                    byte[] data = item.Item3;
                                    //TODO: create kerberosHash
                                    StringBuilder sb = new StringBuilder();

                                    sb.Append("$krb5asrep$");
                                    sb.Append(encryptionType);
                                    sb.Append("$");
                                    if (string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(sessionSalt))
                                    {
                                        username = sessionSalt;
                                    }
                                    if (encryptionType == 23)
                                    {
                                        //sys.stdout.write("$krb5asrep$%s$%s$%s\n" % (etype, data[0:32], data[32:]))
                                        string encPart1 = Utils.ByteConverter.ReadHexString(data, 16, 0, true);
                                        string encPart2 = Utils.ByteConverter.ReadHexString(data, data.Length - 16, 16, true);
                                        sb.Append(encPart1);
                                        sb.Append("$");
                                        sb.Append(encPart2);
                                        kerberosHashes.Add((username, sb.ToString()));
                                    }
                                    else if (!string.IsNullOrEmpty(sessionSalt))
                                    {
                                        //if etype != "23":
                                        //sys.stdout.write("$krb5asrep$%s$%s$%s$%s\n" % (etype, salt, data[0:-24], data[-24:]))
                                        sb.Append(sessionSalt);
                                        sb.Append("$");
                                        string encPart1 = Utils.ByteConverter.ReadHexString(data, 12, 0, true);
                                        string encPart2 = Utils.ByteConverter.ReadHexString(data, data.Length - 12, 12, true);
                                        sb.Append(encPart1);
                                        sb.Append("$");
                                        sb.Append(encPart2);
                                        kerberosHashes.Add((username, sb.ToString()));
                                    }
                                }
                            }
                        }
                    }
                    foreach (var h in kerberosHashes)
                    {
                        string hashUser = h.username;
                        //string hashUser = hash.Split(new char[] { ':', '$' }).First();
                        if (string.IsNullOrEmpty(hashUser))
                        {
                            if (!string.IsNullOrEmpty(username))
                            {
                                hashUser = username;
                            }
                            else if (!string.IsNullOrEmpty(sessionSalt))
                            {
                                hashUser = sessionSalt;
                            }
                            else
                            {
                                hashUser = "******";
                            }
                        }

                        if (kerberosPacket.IsRequest)
                        {
                            base.MainPacketHandler.AddCredential(new NetworkCredential(sourceHost, destinationHost, "Kerberos", hashUser, h.hash, kerberosPacket.ParentFrame.Timestamp));
                        }
                        else
                        {
                            base.MainPacketHandler.AddCredential(new NetworkCredential(destinationHost, sourceHost, "Kerberos", hashUser, h.hash, kerberosPacket.ParentFrame.Timestamp));
                        }
                    }

                    /*
                     * string krbHash = sessionTicketPrimitives.GetTicketHash(kerberosPacket.MsgType);
                     * if (krbHash != null)
                     *  base.MainPacketHandler.AddCredential(new NetworkCredential(sourceHost, destinationHost, "Kerberos", sessionTicketPrimitives.Username, krbHash, kerberosPacket.ParentFrame.Timestamp, sessionTicketPrimitives.Realm));
                     */
                    base.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(kerberosPacket.ParentFrame.FrameNumber, sourceHost, destinationHost, transportLayerPacket.TransportProtocol, transportLayerPacket.SourcePort, transportLayerPacket.DestinationPort, parameters, kerberosPacket.ParentFrame.Timestamp, "Kerberos " + Enum.GetName(typeof(KerberosPacket.MessageType), kerberosPacket.MsgType)));
                    parsedBytes += kerberosPacket.PacketLength;
                }
            }
            return(parsedBytes);
        }
        private void ExtractData(Packets.NetBiosNameServicePacket netBiosNameServicePacket, NetworkHost sourceHost, NetworkHost destinationHost, Packets.ITransportLayerPacket transportLayerPacket)
        {
            System.Collections.Specialized.NameValueCollection parameters = new System.Collections.Specialized.NameValueCollection();
            if (netBiosNameServicePacket.QueriedNetBiosName != null)
            {
                sourceHost.AddQueriedNetBiosName(netBiosNameServicePacket.QueriedNetBiosName);
                parameters.Add("NetBIOS Query", netBiosNameServicePacket.QueriedNetBiosName);
            }

            /*
             * if(netBiosNameServicePacket.AnsweredNetBiosName!=null) {
             *  parameters.Add(netBiosNameServicePacket.AnsweredNetBiosName, netBiosNameServicePacket.AnsweredIpAddress.ToString());
             *  if (base.MainPacketHandler.NetworkHostList.ContainsIP(netBiosNameServicePacket.AnsweredIpAddress))
             *      base.MainPacketHandler.NetworkHostList.GetNetworkHost(netBiosNameServicePacket.AnsweredIpAddress).AddHostName(netBiosNameServicePacket.AnsweredNetBiosName);
             * }
             */
            foreach (Packets.NetBiosNameServicePacket.ResourceRecord answer in netBiosNameServicePacket.AnswerResourceRecords)
            {
                UInt16 flags   = Utils.ByteConverter.ToUInt16(answer.Data.Array, answer.Data.Offset);
                byte[] ipBytes = new byte[4];//IP4...
                Array.Copy(answer.Data.Array, answer.Data.Offset + 2, ipBytes, 0, ipBytes.Length);
                System.Net.IPAddress answeredIpAddress = new System.Net.IPAddress(ipBytes);

                parameters.Add(answer.Name, answeredIpAddress.ToString());
                if (base.MainPacketHandler.NetworkHostList.ContainsIP(answeredIpAddress))
                {
                    base.MainPacketHandler.NetworkHostList.GetNetworkHost(answeredIpAddress).AddHostName(answer.NameTrimmed);
                }
            }
            foreach (Packets.NetBiosNameServicePacket.ResourceRecord additional in netBiosNameServicePacket.AdditionalResourceRecords)
            {
                UInt16 flags = Utils.ByteConverter.ToUInt16(additional.Data.Array, additional.Data.Offset);
                if (additional.Type == 32 && additional.Class == 1 && (flags & 0x8000) == 0 && (additional.Name.EndsWith("<00>") || additional.Name.EndsWith("<20>")))
                {
                    //https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-brws/0c773bdd-78e2-4d8b-8b3d-b7506849847b
                    //unique name with IP
                    byte[] ipBytes = new byte[4];//IP4...
                    Array.Copy(additional.Data.Array, additional.Data.Offset + 2, ipBytes, 0, ipBytes.Length);
                    System.Net.IPAddress answeredIpAddress = new System.Net.IPAddress(ipBytes);

                    parameters.Add(additional.Name, answeredIpAddress.ToString());
                    if (base.MainPacketHandler.NetworkHostList.ContainsIP(answeredIpAddress))
                    {
                        base.MainPacketHandler.NetworkHostList.GetNetworkHost(answeredIpAddress).AddHostName(additional.NameTrimmed);
                    }
                }
            }
            if (parameters.Count > 0 && transportLayerPacket != null)
            {
                if (netBiosNameServicePacket.Flags.Response)
                {
                    base.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(netBiosNameServicePacket.ParentFrame.FrameNumber, sourceHost, destinationHost, transportLayerPacket.TransportProtocol, transportLayerPacket.SourcePort, transportLayerPacket.DestinationPort, parameters, netBiosNameServicePacket.ParentFrame.Timestamp, "NBNS Response"));
                }
                else if (netBiosNameServicePacket.Flags.OperationCode == (byte)Packets.NetBiosNameServicePacket.HeaderFlags.OperationCodes.registration)
                {
                    base.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(netBiosNameServicePacket.ParentFrame.FrameNumber, sourceHost, destinationHost, transportLayerPacket.TransportProtocol, transportLayerPacket.SourcePort, transportLayerPacket.DestinationPort, parameters, netBiosNameServicePacket.ParentFrame.Timestamp, "NBNS Registration"));
                }
                else if (netBiosNameServicePacket.Flags.OperationCode == (byte)Packets.NetBiosNameServicePacket.HeaderFlags.OperationCodes.query)
                {
                    base.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(netBiosNameServicePacket.ParentFrame.FrameNumber, sourceHost, destinationHost, transportLayerPacket.TransportProtocol, transportLayerPacket.SourcePort, transportLayerPacket.DestinationPort, parameters, netBiosNameServicePacket.ParentFrame.Timestamp, "NBNS Query"));
                }
                else
                {
                    base.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(netBiosNameServicePacket.ParentFrame.FrameNumber, sourceHost, destinationHost, transportLayerPacket.TransportProtocol, transportLayerPacket.SourcePort, transportLayerPacket.DestinationPort, parameters, netBiosNameServicePacket.ParentFrame.Timestamp, "NBNS Message"));
                }
            }
        }
        public int ExtractData(NetworkHost sourceHost, NetworkHost destinationHost, IEnumerable <PacketParser.Packets.AbstractPacket> packetList)
        {
            //Packets.UdpPacket udpPacket = null;
            int parsedBytes = 0;

            Packets.ITransportLayerPacket transportLayerPacket = null;
            FiveTuple ft = null;

            foreach (Packets.AbstractPacket p in packetList)
            {
                if (p is Packets.ITransportLayerPacket)
                {
                    transportLayerPacket = (Packets.ITransportLayerPacket)p;
                    if (transportLayerPacket is Packets.UdpPacket)
                    {
                        ft = new FiveTuple(sourceHost, transportLayerPacket.SourcePort, destinationHost, transportLayerPacket.DestinationPort, FiveTuple.TransportProtocol.UDP);
                    }
                    else if (transportLayerPacket is Packets.TcpPacket)
                    {
                        ft = new FiveTuple(sourceHost, transportLayerPacket.SourcePort, destinationHost, transportLayerPacket.DestinationPort, FiveTuple.TransportProtocol.TCP);
                    }
                }
                if (p.GetType() == typeof(Packets.SipPacket))
                {
                    Packets.SipPacket sipPacket = (Packets.SipPacket)p;
                    if (sipPacket.MessageLine.StartsWith(INVITE))
                    {
                        string to   = null;
                        string from = null;
                        if (sipPacket.To != null && sipPacket.To.Length > 0)
                        {
                            to = sipPacket.To;
                            if (to.Contains(";"))
                            {
                                to = to.Substring(0, to.IndexOf(';'));
                            }
                            destinationHost.AddNumberedExtraDetail("SIP User", to);
                            //destinationHost.ExtraDetailsList["SIP User"]=to;
                        }
                        if (sipPacket.From != null && sipPacket.From.Length > 0)
                        {
                            from = sipPacket.From;
                            if (from.Contains(";"))
                            {
                                from = from.Substring(0, from.IndexOf(';'));
                            }
                            //destinationHost.AddNumberedExtraDetail("SIP User", from);
                            sourceHost.AddNumberedExtraDetail("SIP User", from);
                            //sourceHost.ExtraDetailsList["SIP User"]=from;
                        }
                        if (ft != null && to != null && from != null && !String.IsNullOrEmpty(sipPacket.CallID))
                        {
                            System.Collections.Specialized.NameValueCollection nvc = new System.Collections.Specialized.NameValueCollection {
                                { "From", sipPacket.From },
                                { "To", sipPacket.To },
                                { "Call-ID", sipPacket.CallID }
                            };
                            this.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(sipPacket.ParentFrame.FrameNumber, ft, true, nvc, sipPacket.ParentFrame.Timestamp, "SIP session " + ft.ToString()));
                        }
                    }
                    if (!String.IsNullOrEmpty(sipPacket.UserAgent))
                    {
                        sourceHost.AddHttpUserAgentBanner(sipPacket.UserAgent);
                    }
                    if (sipPacket.SDP != null)
                    {
                        if (sipPacket.SDP.Port != null && sipPacket.SDP.IP != null && sipPacket.CallID != null && ft != null)
                        {
                            lock (callEndPoints) {
                                Tuple <System.Net.IPAddress, ushort, FiveTuple> endPoint = new Tuple <System.Net.IPAddress, ushort, FiveTuple>(sipPacket.SDP.IP, sipPacket.SDP.Port.Value, ft);
                                if (this.callEndPoints.ContainsKey(sipPacket.CallID))
                                {
                                    Tuple <System.Net.IPAddress, ushort, FiveTuple> matchedTuple = null;
                                    foreach (var previousEndPoint in this.callEndPoints[sipPacket.CallID])
                                    {
                                        if (previousEndPoint.Item3.EqualsIgnoreDirection(ft))
                                        {
                                            //Tuple<System.Net.IPAddress, ushort, FiveTuple> previousEndPoint = ;
                                            if (!(previousEndPoint.Item1.Equals(endPoint.Item1) && previousEndPoint.Item2.Equals(endPoint.Item2)))
                                            {
                                                //this.callEndPoints.Remove(sipPacket.CallID);
                                                matchedTuple = previousEndPoint;
                                                if (sipPacket.From != null && sipPacket.To != null)
                                                {
                                                    this.MainPacketHandler.OnVoipCallDetected(sipPacket.SDP.IP, sipPacket.SDP.Port.Value, previousEndPoint.Item1, previousEndPoint.Item2, sipPacket.CallID, sipPacket.From, sipPacket.To);

                                                    if (ft != null)
                                                    {
                                                    }
                                                }
                                                break;
                                            }
                                        }
                                    }
                                    if (matchedTuple == null)
                                    {
                                        this.callEndPoints[sipPacket.CallID].Add(endPoint);
                                    }
                                    if (matchedTuple != null)
                                    {
                                        this.callEndPoints[sipPacket.CallID].Remove(matchedTuple);
                                    }
                                }
                                else
                                {
                                    this.callEndPoints.Add(sipPacket.CallID, new List <Tuple <System.Net.IPAddress, ushort, FiveTuple> >()
                                    {
                                        endPoint
                                    });
                                }
                            }
                        }
                    }
                    parsedBytes += sipPacket.PacketLength;
                }
            }
            return(parsedBytes);
        }
Esempio n. 7
0
        public void ExtractData(ref NetworkHost sourceHost, NetworkHost destinationHost, IEnumerable <PacketParser.Packets.AbstractPacket> packetList)
        {
            //Packets.UdpPacket udpPacket = null;
            Packets.ITransportLayerPacket transportLayerPacket = null;
            FiveTuple ft = null;

            foreach (Packets.AbstractPacket p in packetList)
            {
                /*
                 * Packets.IIPPacket ipPacket;
                 * if (p is Packets.IIPPacket) {
                 *  ipPacket = p as Packets.IIPPacket;
                 * }
                 */

                if (p is Packets.ITransportLayerPacket)
                {
                    transportLayerPacket = (Packets.ITransportLayerPacket)p;
                    if (transportLayerPacket is Packets.UdpPacket)
                    {
                        ft = new FiveTuple(sourceHost, transportLayerPacket.SourcePort, destinationHost, transportLayerPacket.DestinationPort, FiveTuple.TransportProtocol.UDP);
                    }
                    else if (transportLayerPacket is Packets.TcpPacket)
                    {
                        ft = new FiveTuple(sourceHost, transportLayerPacket.SourcePort, destinationHost, transportLayerPacket.DestinationPort, FiveTuple.TransportProtocol.TCP);
                    }
                }
                if (p.GetType() == typeof(Packets.SipPacket))
                {
                    Packets.SipPacket sipPacket = (Packets.SipPacket)p;
                    if (sipPacket.MessageLine.StartsWith(INVITE))
                    {
                        string to   = null;
                        string from = null;
                        if (sipPacket.To != null && sipPacket.To.Length > 0)
                        {
                            to = sipPacket.To;
                            if (to.Contains(";"))
                            {
                                to = to.Substring(0, to.IndexOf(';'));
                            }
                            destinationHost.AddNumberedExtraDetail("SIP User", to);
                            //destinationHost.ExtraDetailsList["SIP User"]=to;
                        }
                        if (sipPacket.From != null && sipPacket.From.Length > 0)
                        {
                            from = sipPacket.From;
                            if (from.Contains(";"))
                            {
                                from = from.Substring(0, from.IndexOf(';'));
                            }
                            //destinationHost.AddNumberedExtraDetail("SIP User", from);
                            sourceHost.AddNumberedExtraDetail("SIP User", from);
                            //sourceHost.ExtraDetailsList["SIP User"]=from;
                        }
                        if (ft != null && to != null && from != null && !String.IsNullOrEmpty(sipPacket.CallID))
                        {
                            System.Collections.Specialized.NameValueCollection nvc = new System.Collections.Specialized.NameValueCollection {
                                { "From", sipPacket.From },
                                { "To", sipPacket.To },
                                { "Call-ID", sipPacket.CallID }
                            };
                            this.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(sipPacket.ParentFrame.FrameNumber, ft, true, nvc, sipPacket.ParentFrame.Timestamp, "SIP session " + ft.ToString()));
                        }
                    }
                    if (!String.IsNullOrEmpty(sipPacket.UserAgent))
                    {
                        sourceHost.AddHttpUserAgentBanner(sipPacket.UserAgent);
                    }
                    if (sipPacket.SDP != null)
                    {
                        if (sipPacket.SDP.Port != null && sipPacket.SDP.IP != null && sipPacket.CallID != null && ft != null)
                        {
                            lock (callEndPoints) {
                                Tuple <System.Net.IPAddress, ushort, FiveTuple> endPoint = new Tuple <System.Net.IPAddress, ushort, FiveTuple>(sipPacket.SDP.IP, sipPacket.SDP.Port.Value, ft);
                                if (this.callEndPoints.ContainsKey(sipPacket.CallID))
                                {
                                    Tuple <System.Net.IPAddress, ushort, FiveTuple> matchedTuple = null;
                                    foreach (var previousEndPoint in this.callEndPoints[sipPacket.CallID])
                                    {
                                        if (previousEndPoint.Item3.EqualsIgnoreDirection(ft))
                                        {
                                            //Tuple<System.Net.IPAddress, ushort, FiveTuple> previousEndPoint = ;
                                            if (!(previousEndPoint.Item1.Equals(endPoint.Item1) && previousEndPoint.Item2.Equals(endPoint.Item2)))
                                            {
                                                //this.callEndPoints.Remove(sipPacket.CallID);
                                                matchedTuple = previousEndPoint;
                                                if (sipPacket.From != null && sipPacket.To != null)
                                                {
                                                    this.MainPacketHandler.OnVoipCallDetected(sipPacket.SDP.IP, sipPacket.SDP.Port.Value, previousEndPoint.Item1, previousEndPoint.Item2, sipPacket.CallID, sipPacket.From, sipPacket.To);

                                                    if (ft != null)
                                                    {
                                                    }
                                                }
                                                break;
                                            }
                                        }
                                    }
                                    if (matchedTuple == null)
                                    {
                                        this.callEndPoints[sipPacket.CallID].Add(endPoint);
                                    }
                                    if (matchedTuple != null)
                                    {
                                        this.callEndPoints[sipPacket.CallID].Remove(matchedTuple);
                                    }
                                }
                                else
                                {
                                    this.callEndPoints.Add(sipPacket.CallID, new List <Tuple <System.Net.IPAddress, ushort, FiveTuple> >()
                                    {
                                        endPoint
                                    });
                                }
                            }

                            /*
                             * //check if we have a reverse tuple
                             * Tuple<System.Net.IPAddress, System.Net.IPAddress> reverseIpPair = new Tuple<System.Net.IPAddress, System.Net.IPAddress>(destinationHost.IPAddress, sourceHost.IPAddress);
                             *
                             * TODO: Använd CALL ID istället som unik nyckel!
                             *
                             * lock (this.endPointCandidates) {
                             *  if (this.endPointCandidates.ContainsKey(reverseIpPair)) {
                             *      ushort reversePort = this.endPointCandidates[reverseIpPair];
                             *      this.endPointCandidates.Remove(reverseIpPair);
                             *
                             *      if (this.udpPayloadProtocolFinder != null && !String.IsNullOrEmpty(sipPacket.SDP.Protocol) && sipPacket.SDP.Protocol.StartsWith("RTP", StringComparison.InvariantCultureIgnoreCase))
                             *          this.udpPayloadProtocolFinder.SetPayload(sourceHost.IPAddress, sipPacket.SDP.Port.Value, destinationHost.IPAddress, reversePort, ApplicationLayerProtocol.Rtp);//this might come in too late because the UDP packet has probably already been parsed by now.
                             *      if(sipPacket.From != null && sipPacket.To != null) {
                             *          FiveTuple fiveTuple = new FiveTuple(sourceHost, sipPacket.SDP.Port.Value, destinationHost, reversePort, FiveTuple.TransportProtocol.UDP);
                             *          this.MainPacketHandler.OnVoipCallDetected(fiveTuple, sipPacket.From, sipPacket.To);
                             *          System.Collections.Specialized.NameValueCollection nvc = new System.Collections.Specialized.NameValueCollection();
                             *          nvc.Add("From", sipPacket.From);
                             *          nvc.Add("To", sipPacket.To);
                             *          this.MainPacketHandler.OnParametersDetected(new Events.ParametersEventArgs(sipPacket.ParentFrame.FrameNumber, fiveTuple, true, nvc, sipPacket.ParentFrame.Timestamp, "SIP setup of call " + fiveTuple.ToString()));
                             *      }
                             *
                             *  }
                             *  else {
                             *      Tuple<System.Net.IPAddress, System.Net.IPAddress> ipPair = new Tuple<System.Net.IPAddress, System.Net.IPAddress>(sourceHost.IPAddress, destinationHost.IPAddress);
                             *      if (this.endPointCandidates.ContainsKey(ipPair))
                             *          this.endPointCandidates[ipPair] = sipPacket.SDP.Port.Value;
                             *      else
                             *          this.endPointCandidates.Add(ipPair, sipPacket.SDP.Port.Value);
                             *  }
                             * }
                             */
                        }

                        //rtpPacketHandler.NewRtpEndPoints.Enqueue(new Tuple<System.Net.IPAddress, System.Net.IPAddress, ushort>(destinationHost.IPAddress, sourceHost.IPAddress, sipPacket.SDP.Port.Value));
                    }
                }
            }
        }