Message-Parser/msg_length.cpp at master · L1w-Y/Message-Parser · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
#include "msg_length.h"

int64_t pg_msg_length_decode(Data_stream* stream, bool from_server, pcpp::Packet &parsed_packet, int64_t length_already_read) {
    auto *tcpLayer = parsed_packet.getLayerOfType<pcpp::TcpLayer>();
    auto payload_size = tcpLayer->getLayerPayloadSize();
    auto payload_data = tcpLayer->getLayerPayload();

    if(stream->certification_flag) {
        stream->session_status = 1;
    }
    //初始状态为0，进入正常会话阶段为1，end消息发送完成后置0
    if(stream->session_status == 0) {
        if(is_pg_certification_message(parsed_packet)) {
            stream->certification_flag = true;
        }
    }

    if(stream->is_split_message == 1) {
        return  static_cast<int64_t>(payload_size);
    }

    //表示会话建立阶段消息
     if(stream->session_status == 0) {
         uint32_t messageLength = payload_size;
         return messageLength;
     }
    uint32_t messageLength = ntohl(*(uint32_t *) (payload_data+1+length_already_read))+1;
    return messageLength;

    //1条分为多条 ，其前四个字节表示发送数据总长度

}

int64_t hive_msg_length_decode(Data_stream* stream, bool from_server, pcpp::Packet &parsed_packet, int64_t length_already_read) {
    auto *tcpLayer = parsed_packet.getLayerOfType<pcpp::TcpLayer>();
    auto payload_size = tcpLayer->getLayerPayloadSize();
    auto payload_data = tcpLayer->getLayerPayload();
    if(payload_size == 0) {
        return 0;
    }
    uint32_t messageLength;
    //初始状态为0，进入正常会话阶段为1，end消息发送完成后置0
    if(stream->session_status  == 0) {
        if(is_hive_certification_message(parsed_packet)) {
            stream->certification_flag = true;
        }
        if (stream->certification_flag) {
            stream->session_status = 1;
        }
    }
    //在正常会话阶段且长度为4，代表消息被拆分发送
    if(stream->session_status == 1&&payload_size == 4) {
        messageLength = ntohl(*(uint32_t *) (payload_data + length_already_read));
        stream->is_split_message = 1;
        return messageLength;
    }

    return static_cast<int64_t>(payload_size);
}

int64_t mysql_msg_length_decode(Data_stream* stream, bool from_server, pcpp::Packet &parsed_packet, int64_t length_already_read) {
    auto *tcpLayer = parsed_packet.getLayerOfType<pcpp::TcpLayer>();
    auto payload_data = tcpLayer->getLayerPayload();
    auto payload_size = tcpLayer->getLayerPayloadSize();

    if(payload_size < 3) {
        return static_cast<int64_t>(payload_size);
    }

    uint32_t messageLength = (payload_data[0+length_already_read] << 16) | (payload_data[1+length_already_read] << 8) | payload_data[2+length_already_read];
    messageLength = (ntohl(messageLength) >> 8) + 4;

    return messageLength;
}

bool is_pg_certification_message(const pcpp::Packet &parsed_packet){
    const auto tcpLayer = parsed_packet.getLayerOfType<pcpp::TcpLayer>();
    if (tcpLayer == nullptr) {
        return false;
    }

    auto payloadData = tcpLayer->getLayerPayload();
    auto payloadSize = tcpLayer->getLayerPayloadSize();

    if (payloadSize < 8) {
        return false;
    }
    // 提取协议版本号
    uint32_t protocolVersion = ntohl(*(uint32_t *) (payloadData + 4));
    if (protocolVersion >= 196608 && protocolVersion <= 196614) {
        return true;
    }
    return false;
}

bool is_hive_certification_message(const pcpp::Packet &parsed_packet) {
    const auto tcpLayer = parsed_packet.getLayerOfType<pcpp::TcpLayer>();
    if (tcpLayer == nullptr) {
        return false;
    }

    auto payloadSize = tcpLayer->getLayerPayloadSize();
    auto payload = tcpLayer->getLayerPayload();

    if(payloadSize == 5) {
        const uint8_t target[] = {0x05, 0x00, 0x00, 0x00, 0x00};
        for (size_t i = 0; i < 5 ;++i) {
            if (payload[i] != target[i]) {
                return false; // 不匹配，直接返回
            }
        }
        return true;
    }

    return false;
}