#ifndef __QQ_FILE_ENTRY_H__ #define __QQ_FILE_ENTRY_H__ #include #include #define CONF_FILENAME "./conf/qq_file_trans.conf" #define QQ_DEBUG_FILEPATH "./qq_files" #define MODULE_NAME "QQ_FILE" #define MAX_QQ_FEATURE_NUM 16 #define MAX_AND_RULE 32 #define PACKET_MIN_LEN_QQNUM 16 #define PACKET_MIN_LEN_TCPNAME 551 #define PACKET_MIN_LEN_UDPNAME 535 #define TCPFILE_START_CHAR04 0x04 #define TCPFILE_END_CHAR04 0x03 #define TCPFILE_HDR_LEN04 53 #define TCPFILE_START_CHAR0c 0x0c #define TCPFILE_HDR_LEN0c 22 typedef enum __QQ_PACKET_TYPE { QQ_PACKET_NOT=0, QQ_PACKET_QQNUM, QQ_PACKET_TCPFILE, QQ_PACKET_TCPFILENAME, QQ_PACKET_UDPFILE, QQ_PACKET_UDPFILE_END, QQ_PACKET_UDPFILENAME, QQ_PACKET_OTHER, }QQ_PACKET_TYPE_t; typedef enum __QQ_STATE { QQ_STATE_INIT=0, QQ_STATE_QQNUM, QQ_STATE_FNAME, QQ_STATE_FCONT_START, QQ_STATE_FCONT, QQ_STATE_FCONT_END, }QQ_STATE_t; typedef enum __FEATURE_INDEX { FINDEX_TCPPROT=0, FINDEX_TCPNUM, FINDEX_TCPNAME, FINDEX_TCPFILE, FINDEX_TCPFILE_END, FINDEX_UDPPROT, FINDEX_UDPNUM, FINDEX_UDPNAME, FINDEX_UDPFILE, FINDEX_UDPFILE_END, FINDEX_NUM, }FEATURE_INDEX_T; enum __FIELD_STAT_ID { STAT_ID_NEW_SESSION, STAT_ID_DEL_SESSION, STAT_ID_SESSION_NUM, STAT_ID_NUM, }; typedef struct __trans_file_info { char *buf; unsigned int len; unsigned int max_len; long long prot_flag; int block_seq; //数据包的序号,发现有时候重传,针对UDP unsigned short block_len; //一个小块的大小,并不一定是一个包的大小,针对TCP unsigned short file_seq; //一个小块的大小,并不一定是一个包的大小,针对TCP }trans_file_info_t; typedef struct __qq_proto_pme { void *connector_hdl; char filename[512]; int filename_len; QQ_STATE_t qq_state; unsigned int qqnum[2]; unsigned int qqnum_from; unsigned int qqnum_to; trans_file_info_t fileinfo; int thread_id; unsigned int file_dir; unsigned int total_file_len; unsigned int curr_file_len; char pending_flag; char end_flag; char compress_flag; char tcp_flag; unsigned int random; }qq_proto_pme_t; typedef struct __qq_global_info { void *runtime_log; void *stat_handle; docanalyze_instance_t instanse; char *feature[FINDEX_NUM][MAX_QQ_FEATURE_NUM][MAX_AND_RULE]; unsigned int ftlen[FINDEX_NUM][MAX_QQ_FEATURE_NUM][MAX_AND_RULE]; unsigned int ftoff[FINDEX_NUM][MAX_QQ_FEATURE_NUM][MAX_AND_RULE]; unsigned int rulenum[FINDEX_NUM][MAX_QQ_FEATURE_NUM]; //每一个规则内部的与规则个数 unsigned int fnum[FINDEX_NUM]; int project_id; int stat_trig; int stat_id[STAT_ID_NUM]; int debug_sw; }qq_global_info_t; #endif