|
|
|
|
|
|
|
|
// SNF MDaemon Plugin
|
|
|
// SNF MDaemon Plugin
|
|
|
// Copyright (C) 2007-2008, ARM Research Labs, LLC.
|
|
|
// Copyright (C) 2007-2008, ARM Research Labs, LLC.
|
|
|
|
|
|
|
|
|
|
|
|
#include <wx/app.h>
|
|
|
|
|
|
#include <wx/window.h>
|
|
|
|
|
|
#include <wx/dialog.h>
|
|
|
|
|
|
#include <wx/toplevel.h>
|
|
|
|
|
|
#include "dialogapp.h"
|
|
|
|
|
|
#include "configdialog.h"
|
|
|
|
|
|
#include <winsock2.h>
|
|
|
#include <windows.h>
|
|
|
#include <windows.h>
|
|
|
#include "mdconfiguration.hpp"
|
|
|
#include "mdconfiguration.hpp"
|
|
|
#include "../SNF_Service/SNFMulti.hpp"
|
|
|
|
|
|
#define DLL_EXPORT __declspec(dllexport)
|
|
|
|
|
|
|
|
|
#include "SNFMulti/SNFMulti.hpp"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#ifndef _UNICODE
|
|
|
|
|
|
#define _UNICODE
|
|
|
|
|
|
#endif
|
|
|
|
|
|
#ifndef UNICODE
|
|
|
|
|
|
#define UNICODE
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#define GX_STANDARD_CALL __attribute__((stdcall))
|
|
|
|
|
|
#define _stdcall __attribute__((stdcall))
|
|
|
|
|
|
|
|
|
|
|
|
//IMPLEMENT_APP_NO_MAIN(dialogapp);
|
|
|
|
|
|
//IMPLEMENT_WX_THEME_SUPPORT;
|
|
|
|
|
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
// Constants And Tweaks
|
|
|
// Constants And Tweaks
|
|
|
|
|
|
|
|
|
const int MDPLUGIN_MSG = 22000;
|
|
|
const int MDPLUGIN_MSG = 22000;
|
|
|
const int MDPLUGIN_DISPLAY = 22001;
|
|
|
const int MDPLUGIN_DISPLAY = 22001;
|
|
|
|
|
|
|
|
|
const char* PLUGIN_VERSION_INFO = "SNF MDaemon Plugin Version 3.0 Build: " __DATE__ " " __TIME__;
|
|
|
|
|
|
|
|
|
const char* PLUGIN_VERSION_INFO = "SNF MDaemon Plugin Version 4.0 Build: " __DATE__ " " __TIME__;
|
|
|
|
|
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
// SNF MDaemon Plugin DLL Interface Setup.
|
|
|
// SNF MDaemon Plugin DLL Interface Setup.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extern "C" { // All of these "C" functions for export.
|
|
|
extern "C" { // All of these "C" functions for export.
|
|
|
|
|
|
|
|
|
BOOL WINAPI DllMain ( HINSTANCE hInst, DWORD wDataSeg, LPVOID lpvReserved ); // The DllMain starup/shutdown function.
|
|
|
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall Startup(HWND Parent); // Startup Function.
|
|
|
|
|
|
DLL_EXPORT void _stdcall ConfigFunc(HWND Parent); // Configuration function.
|
|
|
|
|
|
DLL_EXPORT void _stdcall MessageFunc(HWND Parent, const char* File); // Message Scan Function.
|
|
|
|
|
|
DLL_EXPORT void _stdcall MessageIPFunc(HWND Parent, const char* File); // IP Scan Function.
|
|
|
|
|
|
DLL_EXPORT void _stdcall Shutdown(HWND Parent); // Shutdown Function.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
BOOL APIENTRY DllMain ( HINSTANCE hInst, DWORD wDataSeg, LPVOID lpvReserved ); // The DllMain starup/shutdown function.
|
|
|
|
|
|
|
|
|
|
|
|
void _stdcall StartupFunc(HWND Parent); // Startup Function.
|
|
|
|
|
|
void _stdcall ConfigFunc(HWND Parent); // Configuration function.
|
|
|
|
|
|
void _stdcall PreMessageFunc(HWND Parent, const char* File); // Message Scan Function.
|
|
|
|
|
|
void _stdcall SMTPMessageFunc(HWND Parent, const char* File); // IP Scan Function.
|
|
|
|
|
|
void _stdcall ShutdownFunc(HWND Parent); // Shutdown Function.
|
|
|
|
|
|
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { // Thread attach/detach functions.
|
|
|
|
|
|
|
|
|
BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { // Thread attach/detach functions.
|
|
|
switch (fdwReason) { // Switch on the reason for the call.
|
|
|
switch (fdwReason) { // Switch on the reason for the call.
|
|
|
case DLL_PROCESS_ATTACH: // Attach to process.
|
|
|
case DLL_PROCESS_ATTACH: // Attach to process.
|
|
|
/*** Startup function moved to API ***/
|
|
|
/*** Startup function moved to API ***/
|
|
|
|
|
|
|
|
|
}
|
|
|
}
|
|
|
return true; // Be happy by default.
|
|
|
return true; // Be happy by default.
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
// SNF MDaemon Plugin Engine Code
|
|
|
// SNF MDaemon Plugin Engine Code
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
MessageBox ( // Use a message box.
|
|
|
MessageBox ( // Use a message box.
|
|
|
GetFocus(), // Take the user's focus.
|
|
|
GetFocus(), // Take the user's focus.
|
|
|
StuffToSay.c_str(), // This is what to say.
|
|
|
|
|
|
"Message Sniffer Plug-In", // This is how to title the box.
|
|
|
|
|
|
|
|
|
(LPCWSTR) StuffToSay.c_str(), // This is what to say.
|
|
|
|
|
|
(LPCWSTR) "Message Sniffer Plug-In", // This is how to title the box.
|
|
|
MB_OK|MB_SYSTEMMODAL ); // This makes it modal with a button.
|
|
|
MB_OK|MB_SYSTEMMODAL ); // This makes it modal with a button.
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// from snf_engine.xml. If we don't get what we want then we return nothing.
|
|
|
// from snf_engine.xml. If we don't get what we want then we return nothing.
|
|
|
|
|
|
|
|
|
string ConfigurationFilePath() { // Get the config file path.
|
|
|
string ConfigurationFilePath() { // Get the config file path.
|
|
|
char data[256]; // Create a buffer.
|
|
|
|
|
|
DWORD dwType = 0; // Type holder.
|
|
|
|
|
|
DWORD dwCount = sizeof(data); // Data counter.
|
|
|
|
|
|
HKEY rkey; // Key handle.
|
|
|
|
|
|
|
|
|
|
|
|
string KeyLocation("SOFTWARE\\Alt-N Technologies\\MDaemon"); // Key location.
|
|
|
|
|
|
string KeyValueName("AppPath"); // Value name.
|
|
|
|
|
|
|
|
|
|
|
|
// Open the key and if successful read it's value.
|
|
|
|
|
|
|
|
|
|
|
|
string ReadValue = ""; // We'll put the answer here.
|
|
|
|
|
|
|
|
|
|
|
|
if(ERROR_SUCCESS == // Try to open the registry
|
|
|
|
|
|
RegOpenKeyEx(HKEY_LOCAL_MACHINE, KeyLocation.c_str(), 0, KEY_READ, &rkey)
|
|
|
|
|
|
) { // If it opened successfully:
|
|
|
|
|
|
|
|
|
|
|
|
RegQueryValueEx( // Read the MDaemon AppPath key.
|
|
|
|
|
|
rkey,
|
|
|
|
|
|
KeyValueName.c_str(),
|
|
|
|
|
|
NULL,
|
|
|
|
|
|
&dwType,
|
|
|
|
|
|
(LPBYTE)&data,
|
|
|
|
|
|
&dwCount
|
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
|
|
ReadValue = data; // Convert the results to a string.
|
|
|
|
|
|
RegCloseKey(rkey); // Close the registry key.
|
|
|
|
|
|
|
|
|
std::wstring install_pathW;
|
|
|
|
|
|
HKEY hKey;
|
|
|
|
|
|
WCHAR szBuffer[512];
|
|
|
|
|
|
DWORD dwBufferSize = sizeof(szBuffer);
|
|
|
|
|
|
std::wstring regValue = L"";
|
|
|
|
|
|
|
|
|
|
|
|
if (ERROR_SUCCESS == RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Alt-N Technologies\\MDaemon", 0, KEY_READ, &hKey)){
|
|
|
|
|
|
if(ERROR_SUCCESS == RegQueryValueEx(hKey, (LPCWSTR) L"AppPath", NULL, NULL, (LPBYTE) &szBuffer, &dwBufferSize)){
|
|
|
|
|
|
RegCloseKey(hKey);
|
|
|
|
|
|
regValue = std::wstring(szBuffer);
|
|
|
|
|
|
std::wstring termCheck;
|
|
|
|
|
|
for(auto val: regValue){
|
|
|
|
|
|
if(val != L'\0'){
|
|
|
|
|
|
termCheck += val;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
if(termCheck.size() == 512){
|
|
|
|
|
|
regValue = L""; // RegValue wasn't null terminated
|
|
|
|
|
|
}
|
|
|
|
|
|
else{
|
|
|
|
|
|
int PathEnd = regValue.length(); // Grab the length.
|
|
|
|
|
|
if(PathEnd > 0) { regValue.erase(PathEnd-1,1); } // Eat the stroke at the end.
|
|
|
|
|
|
PathEnd = regValue.find_last_of(L"\\"); // Find the next stroke in.
|
|
|
|
|
|
int PathLength = regValue.length(); // Grab the path length.
|
|
|
|
|
|
int EraseSpan = PathLength - (PathEnd+1); // Calculate the amount to erase.
|
|
|
|
|
|
regValue.erase(PathEnd+1,EraseSpan); // Erase it to get the root path.
|
|
|
|
|
|
regValue.append(L"SNF\\snfmdplugin.xml");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
// Now we must convert the APP path to our SNFMDPlugin path.
|
|
|
|
|
|
|
|
|
//convert wstring to utf8
|
|
|
|
|
|
size_t buffer_size = WideCharToMultiByte(CP_UTF8, 0, ®Value[0], (int)regValue.size(), NULL, 0, NULL, NULL);
|
|
|
|
|
|
std::string strFilePath(buffer_size, '\0');
|
|
|
|
|
|
WideCharToMultiByte(CP_UTF8, 0, ®Value[0], (int)regValue.size(), &strFilePath[0], buffer_size, NULL, NULL);
|
|
|
|
|
|
|
|
|
int PathEnd = ReadValue.length(); // Grab the length.
|
|
|
|
|
|
if(PathEnd > 0) { ReadValue.erase(PathEnd-1,1); } // Eat the stroke at the end.
|
|
|
|
|
|
PathEnd = ReadValue.find_last_of("\\"); // Find the next stroke in.
|
|
|
|
|
|
int PathLength = ReadValue.length(); // Grab the path length.
|
|
|
|
|
|
int EraseSpan = PathLength - (PathEnd+1); // Calculate the amount to erase.
|
|
|
|
|
|
ReadValue.erase(PathEnd+1,EraseSpan); // Erase it to get the root path.
|
|
|
|
|
|
ReadValue.append("SNF\\SNFMDPlugin.xml");
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
// Return either the empty string or the configuration file path.
|
|
|
// Return either the empty string or the configuration file path.
|
|
|
return ReadValue; // Return what we have.
|
|
|
|
|
|
|
|
|
return strFilePath; // Return what we have.
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
// Here are out engine components, startup, and shutdown logic. The actual
|
|
|
// Here are out engine components, startup, and shutdown logic. The actual
|
|
|
|
|
|
|
|
|
string Configuration; // Configuration file path.
|
|
|
string Configuration; // Configuration file path.
|
|
|
MDConfiguration* PlatformConfig = 0; // Platform config interpreter.
|
|
|
MDConfiguration* PlatformConfig = 0; // Platform config interpreter.
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall Startup(HWND Parent) { // How to get all this started.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extern "C" void _stdcall StartupFunc(HWND Parent){ // How to get all this started.
|
|
|
LatestParent = Parent;
|
|
|
LatestParent = Parent;
|
|
|
EngineIsGood = false; // Start off pessimistically.
|
|
|
EngineIsGood = false; // Start off pessimistically.
|
|
|
try { // Be sure to catch any exceptions.
|
|
|
try { // Be sure to catch any exceptions.
|
|
|
|
|
|
|
|
|
***** deadlocking on their stop() functions (join()).
|
|
|
***** deadlocking on their stop() functions (join()).
|
|
|
****/
|
|
|
****/
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall Shutdown(HWND Parent) { // How to get all this stopped.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extern "C" void _stdcall ShutdownFunc(HWND Parent){ // How to get all this stopped.
|
|
|
LatestParent = Parent;
|
|
|
LatestParent = Parent;
|
|
|
if(EngineIsGood) { // If the engine is good:
|
|
|
if(EngineIsGood) { // If the engine is good:
|
|
|
try {
|
|
|
try {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 20080311 _M Adjusted ConfigFunc to use Platform Configuration Parameters.
|
|
|
// 20080311 _M Adjusted ConfigFunc to use Platform Configuration Parameters.
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall ConfigFunc(HWND Parent) { // Configuration function.
|
|
|
|
|
|
LatestParent = Parent; // Capture the parent for logging.
|
|
|
|
|
|
string ConfiguratorString = PlatformConfig->ConfiguratorCommand(); // Get Configurator launch command.
|
|
|
|
|
|
if(0 < ConfiguratorString.length()) system(ConfiguratorString.c_str()); // If we have a launch command use it.
|
|
|
|
|
|
|
|
|
//DLL_EXPORT void __stdcall ConfigFunc(HWND Parent) { // Configuration function.
|
|
|
|
|
|
extern "C" void _stdcall ConfigFunc(HWND Parent) {
|
|
|
|
|
|
// Initialize application.
|
|
|
|
|
|
wxApp::SetInstance(new dialogapp());
|
|
|
|
|
|
wxEntryStart(0, NULL);
|
|
|
|
|
|
wxTheApp->CallOnInit();
|
|
|
|
|
|
wxTheApp->OnRun();
|
|
|
|
|
|
wxTheApp->OnExit();
|
|
|
|
|
|
wxEntryCleanup();
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
// MessageFunc() scans a message file and injects headers.
|
|
|
// MessageFunc() scans a message file and injects headers.
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall MessageFunc(HWND Parent, const char* File) { // Message Scan Function.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extern "C" void _stdcall PreMessageFunc(HWND Parent, const char* File){ // Message Scan Function.
|
|
|
LatestParent = Parent; // Capture the parent for logging.
|
|
|
LatestParent = Parent; // Capture the parent for logging.
|
|
|
string LogMessage = "SNF MessageScan: "; // Start a plugin log entry.
|
|
|
string LogMessage = "SNF MessageScan: "; // Start a plugin log entry.
|
|
|
LogMessage.append(File); // add the file name.
|
|
|
LogMessage.append(File); // add the file name.
|
|
|
|
|
|
|
|
|
// MessageIPFunc() looks at the control file for a message, extracts the
|
|
|
// MessageIPFunc() looks at the control file for a message, extracts the
|
|
|
// source IP, and deletes the message if the IP is in the truncate range.
|
|
|
// source IP, and deletes the message if the IP is in the truncate range.
|
|
|
|
|
|
|
|
|
DLL_EXPORT void _stdcall MessageIPFunc(HWND Parent, const char* File) { // IP Scan Function.
|
|
|
|
|
|
|
|
|
extern "C" void _stdcall SMTPMessageFunc(HWND Parent, const char* File){ // IP Scan Function.
|
|
|
LatestParent = Parent; // Capture the parent for logging.
|
|
|
LatestParent = Parent; // Capture the parent for logging.
|
|
|
if(false == PlatformConfig->MessageIPFuncOn()) { // If the IP func is off:
|
|
|
if(false == PlatformConfig->MessageIPFuncOn()) { // If the IP func is off:
|
|
|
return; // We're done.
|
|
|
return; // We're done.
|
|
|
|
|
|
|
|
|
<< "c=" << IPAnalysis.G.Confidence() << ", ";
|
|
|
<< "c=" << IPAnalysis.G.Confidence() << ", ";
|
|
|
|
|
|
|
|
|
switch(IPAnalysis.R) { // The Range analysis.
|
|
|
switch(IPAnalysis.R) { // The Range analysis.
|
|
|
case Unknown: { Happy << " Unknown}"; break; } // Unknown - not defined.
|
|
|
|
|
|
case White: { Happy << " White}"; break; } // This is a good guy.
|
|
|
|
|
|
case Normal: { Happy << " Normal}"; break; } // Benefit of the doubt.
|
|
|
|
|
|
case New: { Happy << " New}"; break; } // It is new to us.
|
|
|
|
|
|
case Caution: { Happy << " Caution}"; break; } // This is suspicious.
|
|
|
|
|
|
case Black: { Happy << " Black}"; break; } // This is bad.
|
|
|
|
|
|
case Truncate: { Happy << " Truncate}"; break; } // This is bad unless we ignore it.
|
|
|
|
|
|
|
|
|
case snfIPRange::Unknown: { Happy << " Unknown}"; break; } // Unknown - not defined.
|
|
|
|
|
|
case snfIPRange::White: { Happy << " White}"; break; } // This is a good guy.
|
|
|
|
|
|
case snfIPRange::Normal: { Happy << " Normal}"; break; } // Benefit of the doubt.
|
|
|
|
|
|
case snfIPRange::New: { Happy << " New}"; break; } // It is new to us.
|
|
|
|
|
|
case snfIPRange::Caution: { Happy << " Caution}"; break; } // This is suspicious.
|
|
|
|
|
|
case snfIPRange::Black: { Happy << " Black}"; break; } // This is bad.
|
|
|
|
|
|
case snfIPRange::Truncate: { Happy << " Truncate}"; break; } // This is bad unless we ignore it.
|
|
|
}
|
|
|
}
|
|
|
|
|
|
|
|
|
string WhatWeDid; // So, what do we do?
|
|
|
string WhatWeDid; // So, what do we do?
|
|
|
if( // Are we in Truncate land?
|
|
|
if( // Are we in Truncate land?
|
|
|
(Truncate == IPAnalysis.R && Ugly == IPAnalysis.G.Flag()) || // If the IP is Truncate & Ugly, or
|
|
|
|
|
|
|
|
|
(snfIPRange::Truncate == IPAnalysis.R && Ugly == IPAnalysis.G.Flag()) || // If the IP is Truncate & Ugly, or
|
|
|
Bad == IPAnalysis.G.Flag() // If the IP is just plain bad then
|
|
|
Bad == IPAnalysis.G.Flag() // If the IP is just plain bad then
|
|
|
) { // we are in truncate land so we
|
|
|
) { // we are in truncate land so we
|
|
|
Happy << " Rejected!"; WhatWeDid = "Rejected"; // mark the message Rejected! and
|
|
|
Happy << " Rejected!"; WhatWeDid = "Rejected"; // mark the message Rejected! and
|