private void ParseLocations(HttpDatagram dgram)
{
ClearLocations();
string location = dgram.Headers.Get("Location");
if (!String.IsNullOrEmpty(location))
{
AddLocation(location);
}
string [] als = dgram.Headers.GetValues("AL");
if (als != null)
{
foreach (string al in als)
{
AddLocation(al);
}
}
if (LocationCount == 0)
{
throw new ApplicationException("No Location/AL found in header");
}
}
private static void TestHttpRequest(string httpString, string expectedMethodString = null, string expectedUri = null, HttpVersion expectedVersion = null, HttpHeader expectedHeader = null, string expectedBodyString = null)
{
Datagram expectedBody = expectedBodyString == null ? null : new Datagram(Encoding.ASCII.GetBytes(expectedBodyString));
HttpRequestMethod expectedMethod = expectedMethodString == null ? null : new HttpRequestMethod(expectedMethodString);
Packet packet = BuildPacket(httpString);
// HTTP
HttpDatagram http = packet.Ethernet.IpV4.Tcp.Http;
Assert.IsTrue(http.IsRequest, "IsRequest " + httpString);
Assert.IsFalse(http.IsResponse, "IsResponse " + httpString);
Assert.AreEqual(expectedVersion, http.Version, "Version " + httpString);
Assert.AreEqual(expectedHeader, http.Header, "Header " + httpString);
if (expectedHeader != null)
{
Assert.AreEqual(expectedHeader.ToString(), http.Header.ToString(), "Header " + httpString);
}
HttpRequestDatagram request = (HttpRequestDatagram)http;
Assert.AreEqual(expectedMethod, request.Method, "Method " + httpString);
Assert.AreEqual(expectedUri, request.Uri, "Uri " + httpString);
Assert.AreEqual(expectedBody, request.Body, "Body " + httpString);
}
private void PrintHttp(PPacket ppacket)
{
HttpDatagram http = ppacket.Packet.Ethernet.IpV4.Tcp.Http;
//ReadOnlyCollection<HttpDatagram> httpCollection = ppacket.Packet.Ethernet.IpV4.Tcp.HttpCollection;
WriteTitle("[http]");
WriteValues(0, "version", http.Version != null ? http.Version.ToString() : "null");
WriteValues(0, "is request", http.IsRequest);
WriteValues(0, "is response", http.IsResponse);
WriteValues(0, "header", http.Header != null ? http.Header.ToString() : "null");
}
private static void CompareHttpFirstLine(XElement httpFirstLineElement, HttpDatagram httpDatagram)
{
foreach (var field in httpFirstLineElement.Fields())
{
field.AssertNoFields();
switch (field.Name())
{
case "http.request.method":
Assert.IsTrue(httpDatagram.IsRequest, field.Name() + " IsRequest");
field.AssertShow(((HttpRequestDatagram)httpDatagram).Method.Method);
break;
case "http.request.uri":
Assert.IsTrue(httpDatagram.IsRequest, field.Name() + " IsRequest");
field.AssertShow(((HttpRequestDatagram)httpDatagram).Uri.ToWiresharkLiteral());
break;
case "http.request.version":
if (httpDatagram.Version == null)
{
if (field.Show() != string.Empty)
{
Assert.IsTrue(field.Show().Contains(" ") || field.Show().Length < 8);
}
}
else
{
field.AssertShow(httpDatagram.Version.ToString());
}
break;
case "http.response.code":
Assert.IsTrue(httpDatagram.IsResponse, field.Name() + " IsResponse");
field.AssertShowDecimal(IsBadHttp(httpDatagram) ? 0 : ((HttpResponseDatagram)httpDatagram).StatusCode.Value);
break;
case "http.response.phrase":
Datagram reasonPhrase = ((HttpResponseDatagram)httpDatagram).ReasonPhrase;
if (reasonPhrase == null)
{
Assert.IsTrue(IsBadHttp(httpDatagram));
}
else
{
field.AssertValue(reasonPhrase);
}
break;
default:
throw new InvalidOperationException("Invalid HTTP first line field " + field.Name());
}
}
}
public void HandlePacket(IPacketProducer source, Packet packet)
{
HttpDatagram http = packet.Ethernet.IpV4.Tcp.Http;
if (http.IsValid && http.IsRequest)
{
var req = (HttpRequestDatagram)http;
if (req.Method?.KnownMethod == HttpRequestKnownMethod.Get)
{
// Compulsory fields for establishing a WebSocket connection
string host = null;
string upgrade = null;
string connection = null;
string secWebsocketKey = null;
string secWebsocketVersion = null;
foreach (HttpField field in req.Header)
{
if (field.Name.Equals("Host", StringComparison.OrdinalIgnoreCase))
{
host = field.ValueString;
}
if (field.Name.Equals("Upgrade", StringComparison.OrdinalIgnoreCase))
{
upgrade = field.ValueString;
}
if (field.Name.Equals("Connection", StringComparison.OrdinalIgnoreCase))
{
connection = field.ValueString;
}
if (field.Name.Equals("Sec-WebSocket-Key", StringComparison.OrdinalIgnoreCase))
{
secWebsocketKey = field.ValueString;
}
if (field.Name.Equals("Sec-WebSocket-Version", StringComparison.OrdinalIgnoreCase))
{
secWebsocketVersion = field.ValueString;
}
//Console.WriteLine($"{field.Name}: {field.ValueString}");
}
if (host != null && upgrade != null && connection != null && secWebsocketKey != null && secWebsocketVersion != null)
{
Console.WriteLine("Starting Recording");
var recorder = new WebSocketRecorder(packet.Ethernet.IpV4);
recorder.HandlePacket(source, packet);
source.AddConsumer(recorder);
}
//WriteLine($"Http Get Detected {host} {upgrade} {connection} {secWebsocketKey} {secWebsocketVersion}");
}
}
}
private void ParseExpiration(HttpDatagram dgram)
{
// Prefer the "Cache-Control: max-age=SECONDS" directive
string cc_max_age = dgram.Headers.Get("Cache-Control");
if (!String.IsNullOrEmpty(cc_max_age))
{
if (cc_max_age_regex == null)
{
cc_max_age_regex = new Regex(@"max-age\s*=\s*([0-9]+)", RegexOptions.IgnoreCase);
}
Match match = cc_max_age_regex.Match(cc_max_age);
if (match.Success && match.Groups.Count == 2)
{
ushort expire = 0;
if (UInt16.TryParse(match.Groups[1].Value, out expire))
{
Expiration = DateTime.Now + TimeSpan.FromSeconds(expire);
return;
}
}
}
// Fall back to possible Expires header
string expires = dgram.Headers.Get("Expires");
if (String.IsNullOrEmpty(expires))
{
DateTime expire_date;
if (DateTime.TryParse(expires, out expire_date))
{
DateTime now = DateTime.Now;
if (expire_date <= now || expire_date >= now.AddYears(1))
{
Expiration = expire_date;
return;
}
}
}
if (Client.StrictProtocol)
{
throw new ApplicationException("Service does not specifiy a cache expiration");
}
// Fall back to the default expiration value
Expiration = DateTime.Now + TimeSpan.FromSeconds(Protocol.DefaultMaxAge);
}
internal void Update(HttpDatagram dgram, bool isGena)
{
if (isGena)
{
ServiceType = dgram.Headers.Get("NT");
if (Client.StrictProtocol && String.IsNullOrEmpty(dgram.Headers.Get("Host")))
{
throw new ApplicationException("Service did not send Host header");
}
}
else
{
ServiceType = dgram.Headers.Get("ST");
if (Client.StrictProtocol && dgram.Headers.Get("Ext") == null)
{
throw new ApplicationException("Service did not send an Ext header " +
"acknowledging 'Man: \"ssdp:discover\"' in request");
}
}
if (String.IsNullOrEmpty(ServiceType))
{
throw new ApplicationException(String.Format("Service did not send {0} header",
isGena ? "NT" : "ST"));
}
Usn = dgram.Headers.Get("USN");
if (String.IsNullOrEmpty(Usn))
{
throw new ApplicationException("Service did not send USN header");
}
if (Client.StrictProtocol)
{
if (String.IsNullOrEmpty(dgram.Headers.Get("Server")))
{
throw new ApplicationException("Service did not send Server header");
}
if (String.IsNullOrEmpty(dgram.Headers.Get("Server")))
{
throw new ApplicationException("Service did not send Server header");
}
}
ParseExpiration(dgram);
ParseLocations(dgram);
}
// Callback function invoked by Pcap.Net for ps4 tcp messages
private void PacketHandlerTcp(Packet packet)
{
IpV4Datagram ip = packet.Ethernet.IpV4;
IpV4Protocol protocol = ip.Protocol;
if (protocol == IpV4Protocol.Tcp)
{
TcpDatagram tcpDatagram = ip.Tcp;
HttpDatagram httpDatagram = tcpDatagram.Http;
if (httpDatagram.Length > 0 && httpDatagram.Header != null)
{
string httpPacket = httpDatagram.Decode(Encoding.UTF8);
if (httpPacket.StartsWith("GET /sce/rp/session HTTP/1.1\r\n"))
{
Dictionary <string, string> header = HttpUtils.SplitHttpResponse(httpPacket);
header.TryGetValue("RP-Registkey", out var registKey);
this.textBoxPcapLogOutput.Invoke(new MethodInvoker(() => AppendLogOutputToPcapLogTextBox("RP-Registkey: " + registKey)));
_livePcapContext.LivePcapState = LivePcapState.SESSION_REQUEST;
_livePcapContext.Session = null;
}
else if (httpDatagram.IsResponse && httpPacket.StartsWith("HTTP/1.1 200 OK\r\n") && _livePcapContext.LivePcapState == LivePcapState.SESSION_REQUEST)
{
Dictionary <string, string> header = HttpUtils.SplitHttpResponse(httpPacket);
header.TryGetValue("RP-Nonce", out var rpNonce);
if (rpNonce == null)
{
return;
}
byte[] rpKeyBuffer = HexUtil.Unhexlify(_settingManager.GetRemotePlayData().RemotePlay.RpKey);
byte[] rpNonceDecoded = Convert.FromBase64String(rpNonce);
this.textBoxPcapLogOutput.Invoke(new MethodInvoker(() => AppendLogOutputToPcapLogTextBox("RP-Nonce from \"/sce/rp/session\" response: " + HexUtil.Hexlify(rpNonceDecoded))));
string controlAesKey = HexUtil.Hexlify(CryptoService.GetSessionAesKeyForControl(rpKeyBuffer, rpNonceDecoded));
string controlNonce = HexUtil.Hexlify(CryptoService.GetSessionNonceValueForControl(rpNonceDecoded));
this.textBoxPcapLogOutput.Invoke(new MethodInvoker(() => AppendLogOutputToPcapLogTextBox("!!! Control AES Key: " + controlAesKey)));
this.textBoxPcapLogOutput.Invoke(new MethodInvoker(() => AppendLogOutputToPcapLogTextBox("!!! Control AES Nonce: " + controlNonce + Environment.NewLine)));
_livePcapContext.LivePcapState = LivePcapState.SESSION_RESPONSE;
_livePcapContext.Session = CryptoService.GetSessionForControl(rpKeyBuffer, rpNonceDecoded);
}
}
}
}
internal override bool OnAsyncResultReceived(AsyncReceiveBuffer result)
{
try {
HttpDatagram dgram = HttpDatagram.Parse(result.Buffer);
if (dgram == null)
{
return(true);
}
try {
client.ServiceCache.Add(new BrowseService(dgram, false));
} catch (Exception e) {
Log.Exception("Invalid browse response", e);
}
} catch (Exception e) {
Log.Exception("Invalid HTTPU datagram", e);
}
return(true);
}
private static bool IsBadHttp(HttpDatagram httpDatagram)
{
if (httpDatagram.IsResponse)
{
HttpResponseDatagram httpResponseDatagram = (HttpResponseDatagram)httpDatagram;
if (httpResponseDatagram.StatusCode == null)
{
Assert.IsNull(httpResponseDatagram.Header);
return(true);
}
}
else
{
HttpRequestDatagram httpRequestDatagram = (HttpRequestDatagram)httpDatagram;
if (httpRequestDatagram.Version == null)
{
return(true);
}
}
return(false);
}
private static void TestHttpResponse(string httpString, HttpVersion expectedVersion = null, uint?expectedStatusCode = null, string expectedReasonPhrase = null, HttpHeader expectedHeader = null, string expectedBodyString = null)
{
Datagram expectedBody = expectedBodyString == null ? null : new Datagram(Encoding.ASCII.GetBytes(expectedBodyString));
Packet packet = BuildPacket(httpString);
// HTTP
HttpDatagram http = packet.Ethernet.IpV4.Tcp.Http;
Assert.IsFalse(http.IsRequest, "IsRequest " + httpString);
Assert.IsTrue(http.IsResponse, "IsResponse " + httpString);
Assert.AreEqual(expectedVersion, http.Version, "Version " + httpString);
Assert.AreEqual(expectedHeader, http.Header, "Header " + httpString);
if (expectedHeader != null)
{
Assert.IsNotNull(http.Header.ToString());
}
HttpResponseDatagram response = (HttpResponseDatagram)http;
Assert.AreEqual(expectedStatusCode, response.StatusCode, "StatusCode " + httpString);
Assert.AreEqual(expectedReasonPhrase == null ? null : new Datagram(Encoding.ASCII.GetBytes(expectedReasonPhrase)), response.ReasonPhrase, "ReasonPhrase " + httpString);
Assert.AreEqual(expectedBody, response.Body, "Body " + httpString);
}
private void PacketHandler(Packet packet)
{
this.count = ""; this.time = ""; this.source = ""; this.destination = ""; this.protocol = ""; this.length = "";
paqueter = packet;
EthernetDatagram eth = packet.Ethernet;
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
UdpDatagram udp = ip.Udp;
HttpDatagram httpPacket = null;
if (ip.Protocol.ToString().Equals("Tcp"))
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = eth.Length.ToString();
protocol = ip.Protocol.ToString();
}
else
{
if ((ip.Protocol.ToString().Equals("Udp")))
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = eth.Length.ToString();
protocol = ip.Protocol.ToString();
}
}
if (ip.Protocol.ToString().Equals("Tcp") && (save.Checked))
{
int _source = tcp.SourcePort;
int _destination = tcp.DestinationPort;
if (tcp.PayloadLength != 0)
{
payload = new byte[tcp.PayloadLength];
tcp.Payload.ToMemoryStream().Read(payload, 0, tcp.PayloadLength);
if (_destination == 80)
{
Packet1 packet1 = new Packet1();
int i = Array.IndexOf(payload, (byte)32, 6);
byte[] t = new byte[i - 5];
Array.Copy(payload, 5, t, 0, i - 5);
packet1.Name = System.Text.ASCIIEncoding.ASCII.GetString(t);
if (!packets.ContainsKey(_source))
{
packets.Add(_source, packet1);
}
}
else
if (_source == 80)
{
if (packets.ContainsKey(_destination))
{
Packet1 packet1 = packets[_destination];
if (packet1.Data == null)
{
if ((httpPacket.Header != null) && (httpPacket.Header.ContentLength != null))
{
packet1.Data = new byte[(uint)httpPacket.Header.ContentLength.ContentLength];
Array.Copy(httpPacket.Body.ToMemoryStream().ToArray(), packet1.Data, httpPacket.Body.Length);
packet1.Order = (uint)(tcp.SequenceNumber + payload.Length - httpPacket.Body.Length);
packet1.Data_Length = httpPacket.Body.Length;
for (int i = 0; i < packet1.TempPackets.Count; i++)
{
Temp tempPacket = packet1.TempPackets[i];
Array.Copy(tempPacket.data, 0, packet1.Data, tempPacket.tempSeqNo - packet1.Order, tempPacket.data.Length);
packet1.Data_Length += tempPacket.data.Length;
}
}
else
{
Temp tempPacket = new Temp();
tempPacket.tempSeqNo = (uint)tcp.SequenceNumber;
tempPacket.data = new byte[payload.Length];
Array.Copy(payload, tempPacket.data, payload.Length);
packet1.TempPackets.Add(tempPacket);
}
}
else if (packet1.Data_Length != packet1.Data.Length)
{
Array.Copy(payload, 0, packet1.Data, tcp.SequenceNumber - packet1.Order, payload.Length);
packet1.Data_Length += payload.Length;
}
if (packet1.Data != null)
{
if (packet1.Data_Length == packet1.Data.Length)
{
using (BinaryWriter writer = new BinaryWriter(File.Open(fullpath + Directory.CreateDirectory(Path.GetFileName(packet1.Name)), FileMode.Create)))
{
writer.Write(packet1.Data);
}
packets.Remove(_destination);
}
}
}
}
}
}
}
protected override bool CompareField(XElement field, Datagram datagram)
{
HttpDatagram httpDatagram = (HttpDatagram)datagram;
if (field.Name() == "data" || field.Name() == "data.data")
{
if (field.Name() == "data")
{
field.AssertNoShow();
}
MoreAssert.AreSequenceEqual(httpDatagram.Subsegment(0, _data.Length / 2), HexEncoding.Instance.GetBytes(_data.ToString()));
// TODO: Uncomment once https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10707 is fixed.
// field.AssertValue(httpDatagram.Subsegment(_data.Length / 2 + 2, httpDatagram.Length - _data.Length / 2 - 2));
return(false);
}
string fieldShow = field.Show();
string httpFieldName;
switch (field.Name())
{
case "http.request":
field.AssertShowDecimal(httpDatagram.IsRequest);
break;
case "http.response":
field.AssertShowDecimal(httpDatagram.IsResponse);
break;
case "":
if (fieldShow == "HTTP chunked response")
{
throw new InvalidOperationException("HTTP chunked response");
}
if (fieldShow == @"\r\n" || fieldShow == "HTTP response 1/1" || fieldShow == "HTTP request 1/1")
{
break;
}
_data.Append(field.Value());
if (_isFirstEmptyName)
{
CompareHttpFirstLine(field, httpDatagram);
_isFirstEmptyName = false;
}
else if (fieldShow.StartsWith("Content-encoded entity body"))
{
break;
}
else
{
fieldShow = EncodingExtensions.Iso88591.GetString(HexEncoding.Instance.GetBytes(field.Value()));
fieldShow = fieldShow.Substring(0, fieldShow.Length - 2);
int colonIndex = fieldShow.IndexOf(':');
MoreAssert.IsBiggerOrEqual(0, colonIndex, "Can't find colon in field with empty name");
if (httpDatagram.Header == null)
{
if (httpDatagram.IsRequest)
{
Assert.IsNull(httpDatagram.Version);
}
else
{
Assert.IsTrue(IsBadHttp(httpDatagram));
}
break;
}
httpFieldName = fieldShow.Substring(0, colonIndex);
if (!field.Value().EndsWith("0d0a"))
{
Assert.IsNull(httpDatagram.Header[httpFieldName]);
}
else
{
string fieldValue = fieldShow.Substring(colonIndex + 1).SkipWhile(c => c == ' ').TakeWhile(c => c != '\\').SequenceToString();
string expectedFieldValue = httpDatagram.Header[httpFieldName].ValueString;
Assert.IsTrue(expectedFieldValue.Contains(fieldValue),
string.Format("{0} <{1}> doesn't contain <{2}>", field.Name(), expectedFieldValue, fieldValue));
}
}
break;
case "data.len":
field.AssertShowDecimal(httpDatagram.Length - _data.Length / 2);
break;
case "http.host":
case "http.user_agent":
case "http.accept":
case "http.accept_language":
case "http.accept_encoding":
case "http.connection":
case "http.cookie":
case "http.cache_control":
case "http.content_encoding":
case "http.date":
case "http.referer":
case "http.last_modified":
case "http.server":
case "http.set_cookie":
case "http.location":
_data.Append(field.Value());
httpFieldName = field.Name().Substring(5).Replace('_', '-');
HttpField httpField = httpDatagram.Header[httpFieldName];
if (!field.Value().EndsWith("0d0a"))
{
Assert.IsNull(httpField);
}
else
{
string fieldValue = field.Show().Replace("\\\"", "\"");
string expectedFieldValue = httpField.ValueString;
Assert.IsTrue(expectedFieldValue.Contains(fieldValue),
string.Format("{0} <{1}> doesn't contain <{2}>", field.Name(), expectedFieldValue, fieldValue));
}
break;
case "http.content_length_header":
_data.Append(field.Value());
if (!IsBadHttp(httpDatagram))
{
if (!field.Value().EndsWith("0d0a"))
{
Assert.IsNull(httpDatagram.Header.ContentLength);
}
else
{
field.AssertShowDecimal(httpDatagram.Header.ContentLength.ContentLength.Value);
}
}
break;
case "http.content_type":
_data.Append(field.Value());
string[] mediaType = fieldShow.Split(new[] { ';', ' ', '/' }, StringSplitOptions.RemoveEmptyEntries);
if (!IsBadHttp(httpDatagram))
{
if (!field.Value().EndsWith("0d0a"))
{
Assert.IsNull(httpDatagram.Header.ContentType);
}
else
{
Assert.AreEqual(httpDatagram.Header.ContentType.MediaType, mediaType[0]);
Assert.AreEqual(httpDatagram.Header.ContentType.MediaSubtype, mediaType[1]);
int fieldShowParametersStart = fieldShow.IndexOf(';');
if (fieldShowParametersStart == -1)
{
Assert.IsFalse(httpDatagram.Header.ContentType.Parameters.Any());
}
else
{
string expected =
httpDatagram.Header.ContentType.Parameters.Select(pair => pair.Key + '=' + pair.Value.ToWiresharkLiteral()).
SequenceToString(';');
Assert.AreEqual(expected, fieldShow.Substring(fieldShowParametersStart + 1));
}
}
}
break;
case "http.request.line":
case "http.response.line":
if (_data.ToString().EndsWith(field.Value()))
{
break;
}
{
_data.Append(field.Value());
}
break;
case "http.transfer_encoding":
if (!IsBadHttp(httpDatagram))
{
Assert.AreEqual(fieldShow.ToWiresharkLowerLiteral(),
httpDatagram.Header.TransferEncoding.TransferCodings.SequenceToString(',').ToLowerInvariant().ToWiresharkLiteral());
}
break;
case "http.request.full_uri":
// TODO: Uncomment when https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10681 is fixed.
// Assert.AreEqual(fieldShow, ("http://" + httpDatagram.Header["Host"].ValueString + ((HttpRequestDatagram)httpDatagram).Uri).ToWiresharkLiteral());
break;
default:
throw new InvalidOperationException("Invalid HTTP field " + field.Name());
}
return(true);
}
protected override bool Ignore(Datagram datagram)
{
HttpDatagram httpDatagram = (HttpDatagram)datagram;
return(httpDatagram.Header != null && httpDatagram.Header.ContentLength != null && httpDatagram.Header.TransferEncoding != null);
}
internal BrowseService(HttpDatagram dgram, IPEndPoint serverEndpoint, bool isGena)
{
SourceAddress = serverEndpoint.Address.ToString();
Update(dgram, isGena);
}
private void PacketHandler(Packet packet)
{
this.count = String.Empty; this.time = String.Empty; this.source = String.Empty; this.destination = String.Empty; this.s_port = String.Empty; this.d_port = String.Empty; this.protocol = String.Empty; this.length = String.Empty;
this.tcpack = String.Empty; this.tcpsec = String.Empty; this.tcpnsec = String.Empty; this.tcpsrc = String.Empty; this.tcpdes = String.Empty; this.udpscr = String.Empty;
this.udpdes = String.Empty; this.httpheader = String.Empty; this.httpver = String.Empty; this.httpayload = String.Empty; this.reqres = String.Empty; this.httpbody = String.Empty; payload = String.Empty;
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
UdpDatagram udp = ip.Udp;
HttpDatagram http = null;
try
{
if (ip.Protocol.ToString().Equals("Tcp"))
{
http = tcp.Http;
if (http.Header != null)
{
protocol = "Http";
httpheader = http.Header.ToString();
httpver = http.Version.ToString();
httpayload = http.Length.ToString();
httpbody = http.Body.ToString();
if (http.IsRequest)
{
reqres = "Request";
}
else
{
reqres = "Response";
}
}
else
{
protocol = ip.Protocol.ToString();
s_port = tcp.SourcePort.ToString();
d_port = tcp.DestinationPort.ToString();
tcpack = tcp.AcknowledgmentNumber.ToString();
tcpsec = tcp.SequenceNumber.ToString();
tcpnsec = tcp.NextSequenceNumber.ToString();
payload = ", data:" + tcp.Payload.Length.ToString();
}
}
else if ((ip.Protocol.ToString().Equals("Udp")))
{
protocol = ip.Protocol.ToString();
s_port = udp.SourcePort.ToString();
d_port = udp.DestinationPort.ToString();
payload = ", data:" + udp.Payload.Length.ToString();
}
else
{
protocol = ip.Protocol.ToString();
}
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
payload = ", data:" + ip.Payload.Length.ToString();
}
catch { }
}
public void RandomHttpTest()
{
int seed = new Random().Next();
Console.WriteLine("Seed: " + seed);
Random random = new Random(seed);
for (int i = 0; i != 200; ++i)
{
EthernetLayer ethernetLayer = random.NextEthernetLayer(EthernetType.None);
IpV4Layer ipV4Layer = random.NextIpV4Layer(null);
ipV4Layer.HeaderChecksum = null;
Layer ipLayer = random.NextBool() ? (Layer)ipV4Layer : random.NextIpV6Layer(true);
TcpLayer tcpLayer = random.NextTcpLayer();
tcpLayer.Checksum = null;
HttpLayer httpLayer = random.NextHttpLayer();
Packet packet = PacketBuilder.Build(DateTime.Now, ethernetLayer, ipLayer, tcpLayer, httpLayer);
Assert.IsTrue(packet.IsValid, "IsValid");
HttpDatagram httpDatagram = packet.Ethernet.Ip.Tcp.Http;
Assert.AreEqual(httpLayer.Version, httpDatagram.Version);
if (httpLayer.Version != null)
{
Assert.AreEqual(httpLayer.Version.GetHashCode(), httpDatagram.Version.GetHashCode());
}
if (httpLayer is HttpRequestLayer)
{
Assert.IsTrue(httpDatagram.IsRequest);
Assert.IsTrue(httpLayer.IsRequest);
Assert.IsFalse(httpDatagram.IsResponse);
Assert.IsFalse(httpLayer.IsResponse);
HttpRequestLayer httpRequestLayer = (HttpRequestLayer)httpLayer;
HttpRequestDatagram httpRequestDatagram = (HttpRequestDatagram)httpDatagram;
Assert.AreEqual(httpRequestLayer.Method, httpRequestDatagram.Method);
if (httpRequestLayer.Method != null)
{
Assert.AreEqual(httpRequestLayer.Method.GetHashCode(), httpRequestDatagram.Method.GetHashCode());
Assert.AreEqual(httpRequestLayer.Method.KnownMethod, httpRequestDatagram.Method.KnownMethod);
}
Assert.AreEqual(httpRequestLayer.Uri, httpRequestDatagram.Uri);
}
else
{
Assert.IsFalse(httpDatagram.IsRequest);
Assert.IsFalse(httpLayer.IsRequest);
Assert.IsTrue(httpDatagram.IsResponse);
Assert.IsTrue(httpLayer.IsResponse);
HttpResponseLayer httpResponseLayer = (HttpResponseLayer)httpLayer;
HttpResponseDatagram httpResponseDatagram = (HttpResponseDatagram)httpDatagram;
Assert.AreEqual(httpResponseLayer.StatusCode, httpResponseDatagram.StatusCode);
Assert.AreEqual(httpResponseLayer.ReasonPhrase, httpResponseDatagram.ReasonPhrase);
}
Assert.AreEqual(httpLayer.Header, httpDatagram.Header);
if (httpLayer.Header != null)
{
Assert.AreEqual(httpLayer.Header.GetHashCode(), httpDatagram.Header.GetHashCode());
if (!httpDatagram.IsRequest || ((HttpRequestDatagram)httpDatagram).Uri != "")
{
Assert.IsTrue(httpDatagram.IsValidStart, "IsValidStart");
}
foreach (var field in httpLayer.Header)
{
Assert.IsFalse(field.Equals("abc"));
}
foreach (var field in (IEnumerable)httpLayer.Header)
{
Assert.IsFalse(field.Equals("abc"));
}
MoreAssert.AreSequenceEqual(httpLayer.Header.Select(field => field.GetHashCode()), httpDatagram.Header.Select(field => field.GetHashCode()));
if (httpLayer.Header.ContentType != null)
{
var parameters = httpLayer.Header.ContentType.Parameters;
Assert.IsNotNull(((IEnumerable)parameters).GetEnumerator());
Assert.AreEqual <object>(parameters, httpDatagram.Header.ContentType.Parameters);
Assert.AreEqual(parameters.GetHashCode(), httpDatagram.Header.ContentType.Parameters.GetHashCode());
Assert.AreEqual(parameters.Count, httpDatagram.Header.ContentType.Parameters.Count);
int maxParameterNameLength = parameters.Any() ? parameters.Max(pair => pair.Key.Length) : 0;
Assert.IsNull(parameters[new string('a', maxParameterNameLength + 1)]);
}
}
Assert.AreEqual(httpLayer.Body, httpDatagram.Body);
Assert.AreEqual(httpLayer, httpDatagram.ExtractLayer(), "HTTP Layer");
Assert.AreEqual(httpLayer.Length, httpDatagram.Length);
}
}
//ham xu ly offlive
private void DispatcherHandler(Packet packet)
{
this.count = ""; this.time = ""; this.source = ""; this.destination = ""; this.protocol = ""; this.length = "";
this.tcpack = ""; this.tcpsec = ""; this.tcpnsec = ""; this.tcpsrc = ""; this.tcpdes = ""; this.udpscr = "";
this.udpdes = ""; this.httpheader = ""; this.httpver = ""; this.httplen = ""; this.reqres = ""; this.httpbody = "";
this.infor = "";
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
UdpDatagram udp = ip.Udp;
HttpDatagram httpPacket = null;
IcmpDatagram icmp = ip.Icmp;
if (ip.Protocol.ToString().Equals("Tcp"))
{
httpPacket = tcp.Http;//Initialize http variable only if the packet was tcp
if ((httpPacket.Header != null) /* && (!_tcp.Checked)*/)
{
protocol = "Http";
httpheader = httpPacket.Header.ToString();
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
httpver = httpPacket.Version.ToString();
httplen = httpPacket.Length.ToString();
if ((httpPacket.Body != null) /* && (!_tcp.Checked)*/)
{
httpbody = httpPacket.Body.ToString();
}
if (httpPacket.IsRequest)
{
reqres = "Request";
}
else
{
reqres = "Response";
}
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
tcpsrc = tcp.SourcePort.ToString();
tcpdes = tcp.DestinationPort.ToString();
tcpack = tcp.AcknowledgmentNumber.ToString();
tcpsec = tcp.SequenceNumber.ToString();
tcpnsec = tcp.NextSequenceNumber.ToString();
tcpwin = tcp.Window.ToString();
tcplen = tcp.Length.ToString();
tcp.Length.ToString();
infor = tcpsrc + "->" + tcpdes + " Seq=" + tcpsec + " win=" + tcpwin + " Ack= " + tcpack + " LEN= " + tcplen;
}
}
else
{
if (ip.Protocol.ToString().Equals("Udp"))
{
if (udp.DestinationPort.ToString().Equals(53))
{
protocol = "dns";
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
udpscr = udp.SourcePort.ToString();
udpdes = udp.DestinationPort.ToString();
}
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
}
}
if (!count.Equals(""))
{
no++;
ListViewItem item = new ListViewItem(no.ToString());
item.SubItems.Add(time);
item.SubItems.Add(source);
item.SubItems.Add(destination);
item.SubItems.Add(protocol);
item.SubItems.Add(length);
item.SubItems.Add(infor);
item.Tag = packet;
SetText(item);
}
}
//public static string GetTcpStreamPacketString1(IndexedTcpConnection tcpConnection, PPacket ppacket, TcpDirection direction, bool printData)
public static string GetTcpStreamPacketString1(PPacket ppacket, TcpDirection direction, bool printData)
{
IpV4Datagram ip = ppacket.Ipv4;
TcpDatagram tcp = ppacket.Tcp;
string saddr = null;
string daddr = null;
string mf = null;
string offset = null;
string id = null;
if (ip != null)
{
saddr = ip.Source.ToString();
daddr = ip.Destination.ToString();
if (tcp != null)
{
saddr += ":" + tcp.SourcePort.ToString();
daddr += ":" + tcp.DestinationPort.ToString();
}
//mf = ip.MoreFragment.ToString();
mf = (ip.Fragmentation.Options == IpV4FragmentationOptions.MoreFragments).ToString();
offset = ip.Fragmentation.Offset.zToHex();
id = ip.Identification.zToHex();
}
StringBuilder sb = new StringBuilder();
//direction
string dir = null;
//if (direction != null)
//{
if (direction == TcpDirection.SourceToDestination)
{
dir = "--> ";
}
else
{
dir = "<-- ";
string addr = saddr;
saddr = daddr;
daddr = addr;
}
//}
//sb.Append(string.Format("{0,5} {1,5} {2,10:0.000000} {3,-21} {4}{5,-21} {6,-7}", packet.gGroupNumber, packet.PacketNumber, packet.RelativeTime.TotalSeconds, saddr, dir, daddr, packet.ProtocolCode));
sb.Append(string.Format("{0,5} {1,5} {2,10:0.000000} {3,-21} {4}{5,-21} {6,-7}",
ppacket.GetTcpConnection().Index, ppacket.PacketNumber, ppacket.RelativeTime.TotalSeconds, saddr, dir, daddr, ppacket.IpProtocolCode));
string align = "";
if (tcp != null)
{
string next_seq;
if (tcp.PayloadLength > 0)
{
next_seq = "0x" + (tcp.SequenceNumber + (uint)tcp.PayloadLength).zToHex();
}
else if (tcp.IsSynchronize)
{
next_seq = "0x" + (tcp.SequenceNumber + 1).zToHex();
}
else
{
next_seq = " ";
}
string dataLength;
if (tcp.PayloadLength > 0)
{
dataLength = "0x" + ((ushort)tcp.PayloadLength).zToHex();
}
else
{
dataLength = " ";
}
string ack_seq;
if (tcp.AcknowledgmentNumber != 0)
{
ack_seq = "0x" + tcp.AcknowledgmentNumber.zToHex();
}
else
{
ack_seq = " ";
}
string urg_ptr = null;
if (tcp.UrgentPointer != 0)
{
urg_ptr = " 0x" + tcp.UrgentPointer.zToHex();
}
else
{
align += " ";
}
//TCPFlags(tcp)
//tcp.GetFlagsString()
sb.Append(string.Format(" {0,-20} {1} 0x{2} {3} {4} 0x{5}{6}", ppacket.GetTcpFlagsString(), dataLength, tcp.SequenceNumber.zToHex(), next_seq, ack_seq, tcp.Window.zToHex(), urg_ptr));
}
else
{
align += " ";
}
sb.Append(align + " ");
HttpDatagram http = tcp.Http;
if (http != null)
{
sb.Append("http ");
if (http.IsRequest)
{
sb.Append("request");
}
else if (http.IsResponse)
{
sb.Append("reply ");
}
else
{
sb.Append("???? ");
}
//sb.Append(http.Version.ToString());
}
else
{
sb.Append(" ");
}
if (printData && tcp != null && tcp.PayloadLength > 0)
{
//sb.Append(align + " ");
//byte[] data = tcp.Payload;
int i = 0;
//int maxDataChar = 100;
int maxDataChar = 50;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
{
break;
}
sb.Append(" ");
sb.Append(b.zToHex());
}
sb.Append(" ");
i = 0;
foreach (byte b in tcp.Payload)
{
if (++i > maxDataChar)
{
break;
}
if (b >= 32 && b <= 126)
{
sb.Append((char)b);
}
else
{
sb.Append('.');
}
}
}
return(sb.ToString());
}
private void PacketHandler(Packet packet)
{
this.count = "";
this.time = "";
this.source = "";
this.destination = "";
this.protocol = "";
this.length = "";
this.tcpack = "";
this.tcpsec = "";
this.tcpnsec = "";
this.tcpsrc = "";
this.tcpdes = "";
this.tcpheader = "";
this.udpscr = "";
this.udpdes = "";
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
UdpDatagram udp = ip.Udp;
HttpDatagram TcpPacket = null;
if (ip.Protocol.ToString().Equals("Tcp"))
{
TcpPacket = tcp.Http;//Initialize http variable only if the packet was tcp
if ((TcpPacket.Header != null) && (!_tcp.Checked))
{
protocol = "tcp";
tcppheader = TcpPacket.Header.ToString();
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
httpver = TcpPacket.Version.ToString();
httplen = TcpPacket.Length.ToString();
httpbody = TcpPacket.Body.ToString();
if (TcpPacket.IsRequest)
{
reqres = "Request";
}
else
{
reqres = "Response";
}
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
tcpsrc = tcp.SourcePort.ToString();
tcpdes = tcp.DestinationPort.ToString();
tcpack = tcp.AcknowledgmentNumber.ToString();
tcpsec = tcp.SequenceNumber.ToString();
tcpnsec = tcp.NextSequenceNumber.ToString();
}
}
else
{
if ((ip.Protocol.ToString().Equals("Udp")))
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
udpscr = udp.SourcePort.ToString();
udpdes = udp.DestinationPort.ToString();
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
}
}
if (ip.Protocol.ToString().Equals("Tcp") && (save.Checked))
{
int _source = tcp.SourcePort;
int _destination = tcp.DestinationPort;
if (tcp.PayloadLength != 0) //not syn or ack
{
payload = new byte[tcp.PayloadLength];
tcp.Payload.ToMemoryStream().Read(payload, 0, tcp.PayloadLength); // read payload from 0 to length
if (_destination == 80) // request from server
{
Packet1 packet1 = new Packet1();
int i = Array.IndexOf(payload, (byte)32, 6);
byte[] t = new byte[i - 5];
Array.Copy(payload, 5, t, 0, i - 5);
packet1.Name = System.Text.ASCIIEncoding.ASCII.GetString(t);
if (!packets.ContainsKey(_source))
{
packets.Add(_source, packet1);
}
}
else
if (_source == 80)
{
if (packets.ContainsKey(_destination))
{
Packet1 packet1 = packets[_destination];
if (packet1.Data == null)
{
if ((TcpPacket.Header != null) && (TcpPacket.Header.ContentLength != null))
{
packet1.Data = new byte[(uint)TcpPacket.Header.ContentLength.ContentLength];
Array.Copy(TcpPacket.Body.ToMemoryStream().ToArray(), packet1.Data, TcpPacket.Body.Length);
packet1.Order = (uint)(tcp.SequenceNumber + payload.Length - TcpPacket.Body.Length);
packet1.Data_Length = TcpPacket.Body.Length;
for (int i = 0; i < packet1.TempPackets.Count; i++)
{
Temp tempPacket = packet1.TempPackets[i];
Array.Copy(tempPacket.data, 0, packet1.Data, tempPacket.tempSeqNo - packet1.Order, tempPacket.data.Length);
packet1.Data_Length += tempPacket.data.Length;
}
}
else
{
Temp tempPacket = new Temp();
tempPacket.tempSeqNo = (uint)tcp.SequenceNumber;
tempPacket.data = new byte[payload.Length];
Array.Copy(payload, tempPacket.data, payload.Length);
packet1.TempPackets.Add(tempPacket);
}
}
else if (packet1.Data_Length != packet1.Data.Length)
{
Array.Copy(payload, 0, packet1.Data, tcp.SequenceNumber - packet1.Order, payload.Length);
packet1.Data_Length += payload.Length;
}
if (packet1.Data != null)
{
if (packet1.Data_Length == packet1.Data.Length)
{
using (BinaryWriter writer = new BinaryWriter(File.Open(@"E:\networks final\" + Directory.CreateDirectory(Path.GetFileName(packet1.Name)), FileMode.Create)))
{
writer.Write(packet1.Data);
}
packets.Remove(_destination);
}
}
}
}
}
}
}
//hàm xử lý live
private void PacketHandler(Packet packet)
{
this.count = ""; this.time = ""; this.source = ""; this.destination = ""; this.protocol = ""; this.length = "";
this.tcpack = ""; this.tcpsec = ""; this.tcpnsec = ""; this.tcpsrc = ""; this.tcpdes = ""; this.udpscr = "";
this.udpdes = ""; this.httpheader = ""; this.httpver = ""; this.httplen = ""; this.reqres = ""; this.httpbody = "";
this.infor = "";
if (no == 0)
{
InformationPacket(packet);
}
IpV4Datagram ip = packet.Ethernet.IpV4;
TcpDatagram tcp = ip.Tcp;
UdpDatagram udp = ip.Udp;
HttpDatagram httpPacket = null;
IcmpDatagram icmp = ip.Icmp;
protocol = ip.Protocol.ToString();
if (ip.Protocol.ToString().Equals("Tcp"))
{
httpPacket = tcp.Http;
if ((httpPacket.Header != null))
{
protocol = "Http";
httpheader = httpPacket.Header.ToString();
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
httpver = httpPacket.Version.ToString();
httplen = httpPacket.Length.ToString();
if ((httpPacket.Body != null) /* && (!_tcp.Checked)*/)
{
httpbody = httpPacket.Body.ToString();
}
if (httpPacket.IsRequest)
{
reqres = "Request";
}
else
{
reqres = "Response";
}
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
tcpsrc = tcp.SourcePort.ToString();
tcpdes = tcp.DestinationPort.ToString();
tcpack = tcp.AcknowledgmentNumber.ToString();
tcpsec = tcp.SequenceNumber.ToString();
tcpnsec = tcp.NextSequenceNumber.ToString();
tcpwin = tcp.Window.ToString();
tcplen = tcp.Length.ToString();
tcp.Length.ToString();
infor = tcpsrc + "->" + tcpdes + " Seq=" + tcpsec + " win=" + tcpwin + " Ack= " + tcpack + " LEN= " + tcplen;
}
}
else
{
if (ip.Protocol.ToString().Equals("Udp"))
{
if (udp.DestinationPort.ToString().Equals(53))
{
protocol = "dns";
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
udpscr = udp.SourcePort.ToString();
udpdes = udp.DestinationPort.ToString();
}
}
else
{
count = packet.Count.ToString();
time = packet.Timestamp.ToString();
this.source = ip.Source.ToString();
this.destination = ip.Destination.ToString();
length = ip.Length.ToString();
protocol = ip.Protocol.ToString();
}
}
if (ip.Protocol.ToString().Equals("Tcp") /*&& (save.Checked)*/)
{
int _source = tcp.SourcePort;
int _destination = tcp.DestinationPort;
if (tcp.PayloadLength != 0) //not syn or ack
{
payload = new byte[tcp.PayloadLength];
tcp.Payload.ToMemoryStream().Read(payload, 0, tcp.PayloadLength); // read payload from 0 to length
if (_destination == 80) // request from server
{
Packet1 packet1 = new Packet1();
if (payload.Count() > 1)
{
int i = Array.IndexOf(payload, (byte)32, 6);
byte[] t = new byte[i - 5];
Array.Copy(payload, 5, t, 0, i - 5);
packet1.Name = System.Text.ASCIIEncoding.ASCII.GetString(t);
if (!packets.ContainsKey(_source))
{
packets.Add(_source, packet1);
}
}
}
else
if (_source == 80)
{
if (packets.ContainsKey(_destination))
{
Packet1 packet1 = packets[_destination];
if (packet1.Data == null)
{
if ((httpPacket.Header != null) && (httpPacket.Header.ContentLength != null))
{
packet1.Data = new byte[(uint)httpPacket.Header.ContentLength.ContentLength];
Array.Copy(httpPacket.Body.ToMemoryStream().ToArray(), packet1.Data, httpPacket.Body.Length);
packet1.Order = (uint)(tcp.SequenceNumber + payload.Length - httpPacket.Body.Length);
packet1.Data_Length = httpPacket.Body.Length;
for (int i = 0; i < packet1.TempPackets.Count; i++)
{
Temp tempPacket = packet1.TempPackets[i];
Array.Copy(tempPacket.data, 0, packet1.Data, tempPacket.tempSeqNo - packet1.Order, tempPacket.data.Length);
packet1.Data_Length += tempPacket.data.Length;
}
}
else
{
Temp tempPacket = new Temp();
tempPacket.tempSeqNo = (uint)tcp.SequenceNumber;
tempPacket.data = new byte[payload.Length];
Array.Copy(payload, tempPacket.data, payload.Length);
packet1.TempPackets.Add(tempPacket);
}
}
else if (packet1.Data_Length != packet1.Data.Length)
{
Array.Copy(payload, 0, packet1.Data, tcp.SequenceNumber - packet1.Order, payload.Length);
packet1.Data_Length += payload.Length;
}
//if (packet1.Data != null)
// if (packet1.Data_Length == packet1.Data.Length)
// {
// using (BinaryWriter writer = new BinaryWriter(File.Open(@"D:\captured\" + Directory.CreateDirectory(Path.GetFileName(packet1.Name)), FileMode.Create)))
// {
// writer.Write(packet1.Data);
// }
// packets.Remove(_destination);
// }
}
}
}
}
if (!count.Equals(""))
{
no++;
ListViewItem item = new ListViewItem(no.ToString());
item.SubItems.Add(time);
item.SubItems.Add(source);
item.SubItems.Add(destination);
item.SubItems.Add(protocol);
item.SubItems.Add(length);
item.SubItems.Add(infor);
item.Tag = packet;
SetText(item);
}
}
internal BrowseService(HttpDatagram dgram, bool isGena)
{
Update(dgram, isGena);
}
