def read_ip_pac(link_packet, link_layer_parser):
    # ip header
    n_protocol, ip_packet = link_layer_parser(link_packet)

    if n_protocol == NetworkProtocol.IP or n_protocol == NetworkProtocol.PPP_IP:
        src_mac = ":".join("{:02x}".format(ord(c)) for c in link_packet[6:12])
        ip_base_header_len = 20
        ip_header = ip_packet[0:ip_base_header_len]
        (ip_info, ip_length, protocol) = struct.unpack(b'!BxH5xB10x', ip_header)
        # real ip header len.
        ip_header_len = (ip_info & 0xF) * 4
        ip_version = (ip_info >> 4) & 0xF

        # skip all extra header fields.
        if ip_header_len > ip_base_header_len:
            pass

        # not tcp, skip.
        if protocol != TransferProtocol.TCP:
            return 0, None, None, None, None

        source = socket.inet_ntoa(ip_header[12:16])
        dest = socket.inet_ntoa(ip_header[16:])

        return 1, source, dest, ip_packet[ip_header_len:ip_length], src_mac
    elif n_protocol == NetworkProtocol.IPV6:
        # TODO: deal with ipv6 package
        return 0, None, None, None, None
    else:
        # skip
        return 0, None, None, None, None

def domainsandips(pcappath, allips=False):
    domains = set([])
    ips = set([])

    pcap = Reader(file(pcappath, 'rb'))
    for _, data in pcap:
        eth = Ethernet(data)
        ip = eth.data
        trans = ip.data

        try:
            if type(trans) == dpkt.tcp.TCP:
                ips.add(socket.inet_ntoa(ip.src))
                ips.add(socket.inet_ntoa(ip.dst))

            if type(trans) == dpkt.udp.UDP and \
                    (trans.sport == 53 or trans.dport == 53):
                dns = dpkt.dns.DNS(ip.data.data)
                for query in dns.qd:
                    # asciify is the standard for normalizing domains
                    # to ascii. Also we don't want any tab characters to
                    # fuck up our R script.
                    domains.add(asciify(query.name).replace('\t', ''))
                if allips:
                    for answer in dns.an:
                        try:
                            ips.add(socket.inet_ntoa(answer.rdata))
                        except socket.error as e:
                            pass
        except Exception as e:
            pass

    return (domains, ips)

 def handleDpMessage(self, msgType, data):
     """
     Handles messages from the OFX data path component.
     struct FlowEntryNoHash{
         struct FlowKey key;
         uint32_t permission;
         uint32_t added; // Has the rule been added?
         uint32_t byteCt; // how many bytes have we seen?
     };
     """
     if msgType == FLOWSTATS:
         flowCt = len(data)/24
         idx = 0
         ptr = 0
         while idx<flowCt:
             ptr = idx * (24)
             src = socket.inet_ntoa(data[ptr:ptr+4])
             dst = socket.inet_ntoa(data[ptr+4:ptr+8])
             sport,dport = struct.unpack("!HH", data[ptr+8:ptr+12])
             permission,added,byteCt = struct.unpack("!III",data[ptr+12:ptr+24])
             # print ("DP AGENT flow %s: %s (%s) --> %s (%s) -- %s bytes"%(idx, src, sport, dst, dport, byteCt))
             key = (src,dst,sport,dport)
             if key not in self.flowStatsOFX:
                 self.flowStatsOFX[key] = 0
             self.flowStatsOFX[key] =byteCt
             idx += 1
     else:
         print ("DDoS module: unknown message type.")

def from_raw_message(raw_message):
	message_type = 0
	options_raw = ''
	if len(raw_message) < DHCP_HEADER_LENGTH: return None
	dhcp_header = __dhcp_struct__.unpack(raw_message[:DHCP_HEADER_LENGTH])

	# Bypass Magic Cookie
	if raw_message[DHCP_HEADER_LENGTH:DHCP_HEADER_LENGTH+4] == MAGIC_COOKIE:
		options_raw = raw_message[DHCP_HEADER_LENGTH+4:]
	else:
		options_raw = raw_message[DHCP_HEADER_LENGTH:]

	# parse raw options
	options = _parse_raw_options(options_raw)

	for option in options:
		if option[0]==__OPTION_MESSAGE_TYPE__:
			break
	if not option: raise Exception("No Message Type Specified in Packet")
	else: message_type = option[1]

	return dhcp_packet(message_type=message_type, htype=dhcp_header[1],
					hlen=dhcp_header[2], hops=dhcp_header[3],
					xid=dhcp_header[4], secs=dhcp_header[5], broadcast=True if dhcp_header[6]==1<<15 else False,
					ciaddr=socket.inet_ntoa(dhcp_header[7]),
					yiaddr=socket.inet_ntoa(dhcp_header[8]),
					siaddr=socket.inet_ntoa(dhcp_header[9]),
					giaddr=socket.inet_ntoa(dhcp_header[10]),
					mac=dhcp_header[11][0:6].encode('hex'), sname=dhcp_header[12], file=dhcp_header[13], options=options)

    def report_detail(self, ioc, type, result):
        events = self.cb.process_events(result["id"], result["segment_id"])
        proc = events["process"]

        if type == "domain" and proc.has_key("netconn_complete"):
            for netconn in proc["netconn_complete"]:
                ts, ip, port, proto, domain, dir = netconn.split("|")
                if ioc in domain:
                    str_ip = socket.inet_ntoa(struct.pack("!i", int(ip)))
                    print "%s\t%s (%s:%s)" % (ts, domain, str_ip, port)

        elif type == "ipaddr" and proc.has_key("netconn_complete"):
            for netconn in proc["netconn_complete"]:
                ts, ip, port, proto, domain, direction = netconn.split("|")
                packed_ip = struct.unpack("!i", socket.inet_aton(ioc))[0]
                #import code; code.interact(local=locals())
                if packed_ip == int(ip):
                    str_ip = socket.inet_ntoa(struct.pack("!i", int(ip)))
                    print "%s\t%s (%s:%s)" % (ts, domain, str_ip, port)

        elif type == "md5" and proc.has_key("modload_complete"):
            for modload in proc["modload_complete"]:
                ts, md5, path = modload.split("|")
                if ioc in md5:
                    print "%s\t%s %s" % (ts, md5, path)

            if result["process_md5"] == ioc:
                print "%s\t%s %s" % (result["start"], result["process_md5"], result["path"])

 def unpack(self, packet):
     _ip = layer()
     _ip.ihl = (ord(packet[0]) & 0xf) * 4
     iph = struct.unpack("!BBHHHBBH4s4s", packet[:_ip.ihl])
     _ip.ver = iph[0] >> 4
     _ip.tos = iph[1]
     _ip.length = iph[2]
     _ip.ids = iph[3]
     _ip.flags = iph[4] >> 13
     _ip.offset = iph[4] & 0x1FFF
     _ip.ttl = iph[5]
     _ip.protocol = iph[6]
     _ip.checksum = hex(iph[7])
     _ip.src = socket.inet_ntoa(iph[8])
     _ip.dst = socket.inet_ntoa(iph[9])
     _ip.list = [
         _ip.ihl,
         _ip.ver,
         _ip.tos,
         _ip.length,
         _ip.ids,
         _ip.flags,
         _ip.offset,
         _ip.ttl,
         _ip.protocol,
         _ip.src,
         _ip.dst]
     return _ip

def recv_sequence_number_packets(destination):
 #create an INET, raw socket
 neg_ack=set()
 s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))
 first_packet=0
 last_packet=time.time()
 while True:
    now=time.time()	
    if (now-last_packet>4 and first_packet==1):
		print "Breaking ",now-last_packet
		break
    packet = s.recvfrom(65565)
    packet = packet[0]
    ip_header = packet[14:34]
    iph = unpack('!BBHHHBBH4s4s' , ip_header)
    version_ihl = iph[0]
    version = version_ihl >> 4
    ihl = version_ihl & 0xF
    iph_length = ihl * 4
    ttl = iph[5]
    protocol = iph[6]
    s_addr = socket.inet_ntoa(iph[8]);
    d_addr = socket.inet_ntoa(iph[9]);
    seq_number="" 
    if (s_addr==destination):
		first_packet=1
	        last_packet=time.time()
		write_a=packet[42:]
		if ',' in write_a:	
			write_a=write_a.split(',')
			for item in write_a:
				item=int(item.strip('\0'))
				neg_ack.add(item)
 s.close()
 return list(neg_ack)

def get_IP_header(pkt):
    fmt = "!6H4s4s"
    
    (vit, total_len, id, ffo, ttl_proto, checksum, raw_src, raw_dst) = struct.unpack(fmt, pkt[:20])

    #vit has version, IHL, and TOS
    ver = vit >> 12
    ihl = (vit >> 8) & 0xf
    tos = vit & 0xff

    #ffo has flags and fragment offset
    flags = ffo >> 13
    f_offest = ffo & 0x1fff

    #ttl_proto has ttl and protocol
    ttl = ttl_proto >> 8
    protocol = ttl_proto & 0xff

    #format the src and dst with socket
    src_adr = socket.inet_ntoa(raw_src)
    dst_adr = socket.inet_ntoa(raw_dst)

    if protocol == 6:
        next_proto = "TCP"
    elif protocol == 17:
        next_proto = "UDP"
    else:
        next_proto = "Other"

    paPrint.print_ip_head(src_adr, dst_adr, protocol, next_proto)

    return pkt[20:], next_proto

 def migrate_routes(self, device):
     '''
     Sample output of /proc/net/route :
     Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT
     p4p1    00000000        FED8CC0A        0003    0       0       0       00000000        0       0       0
     '''
     temp_dir_name = self._temp_dir_name
     cfg_file = '/etc/sysconfig/network-scripts/route-vhost0'
     tmp_file = '%s/route-vhost0'%(temp_dir_name)
     with open(tmp_file, 'w') as route_cfg_file:
         for route in open('/proc/net/route', 'r').readlines():
             if route.startswith(device):
                 route_fields = route.split()
                 destination = int(route_fields[1], 16)
                 gateway = int(route_fields[2], 16)
                 flags = int(route_fields[3], 16)
                 mask = int(route_fields[7], 16)
                 if flags & 0x2:
                     if destination != 0:
                         route_cfg_file.write(socket.inet_ntoa(struct.pack('I', destination)))
                         route_cfg_file.write('/' + str(bin(mask).count('1')) + ' ')
                         route_cfg_file.write('via ')
                         route_cfg_file.write(socket.inet_ntoa(struct.pack('I', gateway)) + ' ')
                         route_cfg_file.write('dev vhost0')
                     #end if detination...
                 #end if flags &...
             #end if route.startswith...
         #end for route...
     #end with open...
     local("sudo mv -f %s %s" %(tmp_file, cfg_file))
     #delete the route-dev file
     if os.path.isfile('/etc/sysconfig/network-scripts/route-%s'%device):
         os.unlink('/etc/sysconfig/network-scripts/route-%s'%device)

def IP_preview(packet):
            
            ipHeader = packet[0:20]
            #unpack the data found in the ip datagram, there are 10 items
            ipDatagram = unpack("!BBHHHBBH4s4s",ipHeader)
            version_IPHeaderLength = ipDatagram[0]
            ipVer = version_IPHeaderLength >> 4
            #0xF is 15 and the '&' operand copies a bit to the result if it exists
            #in both operands            
            ipHeaderLength = version_IPHeaderLength & 0xF
            #
            iphl = ipHeaderLength * 4
            totalLength = ipDatagram[2]            
            #transport protocol
            protocol = ipDatagram[6]
            sourceIP = socket.inet_ntoa(ipDatagram[8])
            destinationIP = socket.inet_ntoa(ipDatagram[9])
            
            print "\n\nVersion: \t\t" + str(ipVer)
            print "Length:\t\t\t" + str(totalLength)
            print "Protocol:\t\t" + getProtocol(protocol)
            #print "SourceIP:\t\t" + sourceIP
            #print "DestinationIP:\t\t" + destinationIP
            
            #this will be used to find the max and average size of the packets captured
            return totalLength

 def __init__(self, data):
   self.age = mkNetInt(data[0:2])
   self.options = ord(data[2])
   self.type = ord(data[3])
   self.lsid = netaddr.IPAddress(socket.inet_ntoa(data[4:8]))
   self.advrouter = netaddr.IPAddress(socket.inet_ntoa(data[8:12]))
   self.seq = mkNetInt(data[12:16])

    def get_details(self, packet):
        '''
           Description : Assigns values to the IP header class 
                         attributes from the details present 
                         in the given packet
           
           input_param : packet - packet received in the interface
           input_type : bytes array
           
        '''

        iph = unpack('!BBHHHBBH4s4s' , packet)
        version_ihl = iph[0]
        version = version_ihl >> 4
        ihl = version_ihl & 0xF
    
        iph_length = ihl * 4
    
        ttl = iph[5]
        protocol = iph[6]
        s_addr = socket.inet_ntoa(iph[8]);
        d_addr = socket.inet_ntoa(iph[9]);
     
        self.version = version
        self.hdr_length = iph_length
        self.ttl = ttl
        self.proto = protocol
        self.src_addr = s_addr
        self.dst_addr= d_addr

def log(q, ip, r, i1, i2, tss, ts, key):
    if q:
        cip = q[0]
        sip = q[1]
        did = q[2]
        try:
            rtype = QTYPE[r.a.rtype]
        except:
            rtype = "UNK"
        syslog.syslog('type=QR, cip=' + cip + ', sip=' + sip + ', did=' + did
            + ', qtype=' + q[4] + ', q=' + q[3] + ', r=' + str(r.a.rdata)
            + ', rtype=' + rtype + ', qlen=' + str(len(q[3])) + ', rlen='
            + str(len(str(r.a.rdata))))
        tss.remove(i2[key])
        i1.pop(i2.pop(key))
    else:
        cip = socket.inet_ntoa(ip.dst)
        sip = socket.inet_ntoa(ip.src)
        did = str(dns.header.id)
        try:
            rtype = QTYPE[dns.a.rtype]
        except:
            rtype = "UNK"
        syslog.syslog('type=R, cip=' + cip + ', sip=' + sip + ', did=' + did
            + ', q=' + str(dns.a.rname) + ', r=' + str(dns.a.rdata) + 'rtype='
            + rtype + ', qlen=' + str(len(str(dns.a.rname))) + ', rlen'
            + str(len(str(dns.a.rdata))))
    for i in r.rr[1:]: #Log any additional responses
        try:
            rtype = QTYPE[i.rtype]
        except:
            rtype = 'UNK'
        syslog.syslog('type=AR, cip=' + cip + ', sip=' + sip + ', did=' + did
            + ', q=' + str(i.rname) + ', r=' + str(i.rdata) + ', rtype=' + rtype
            + ', qlen=' + str(len(str(i.rname))) + ', rlen=' + str(len(str(i.rdata))))

def _decodeIPFrame(buf):
    ip_header = buf[0:20]
    iph = unpack("!BBHHHBBH4s4s", ip_header)

    version_ihl = iph[0]
    version = (version_ihl >> 4) & 0xF
    ihl = version_ihl & 0xF

    iph_length = ihl * 4

    ttl = iph[5]
    protocol = iph[6]
    s_addr = socket.inet_ntoa(iph[8])
    d_addr = socket.inet_ntoa(iph[9])

    payload = buf[iph_length:]

    ip_meta = {
        "version": version,
        "length": str(ihl),
        "TTL": ttl,
        "protocol": protocol,
        "src": str(s_addr),
        "dst": str(d_addr),
    }
    return ip_meta, payload

def parsetcp(connections):
    conn = sqlite3.connect('connections.db')
    c = conn.cursor()
    for connection in connections:
        connection = connection.strip()
        connection = connection.split()
        if connection[1] != '00000000:0000' and connection[2] != '00000000:0000':
            print connection
            sourceip = connection[1].split(':')[0]
            sourceport = connection[1].split(':')[1]
            sourceip = int(sourceip,16)
            sourceip = struct.pack('<L',sourceip)
            sourceip = socket.inet_ntoa(sourceip)
            sourceport = int(sourceport,16)
            destip = connection[2].split(':')[0]
            destport = connection[2].split(':')[1]
            destip = int(destip,16)
            destip = struct.pack('<L',destip)
            destip = socket.inet_ntoa(destip)
            destport = int(destport,16)
            retrans = connection[6]
            print sourceip, sourceport, destip, destport, retrans
            query = 'SELECT * FROM conns WHERE sourceip = \"{sip}\" AND sourceport = \"{spo}\" AND destip = \"{dip}\" AND destport = \"{dpo}\"'.format(retr=int(retrans), sip=str(sourceip), spo=str(sourceport), dip=str(destip), dpo=str(destport))
            print query
            c.execute(query)
            print(c.fetchall())
            query = 'UPDATE conns SET retrans = {retr} WHERE sourceip = \"{sip}\" AND sourceport = \"{spo}\" AND destip = \"{dip}\" AND destport = \"{dpo}\"'.format(retr=int(retrans), sip=str(sourceip), spo=str(sourceport), dip=str(destip), dpo=str(destport))
            print query
            c.execute(query)
            conn.commit()
            c.execute('SELECT * FROM conns')
            print(c.fetchall())
    conn.close()

def handle_time_exceeded(ip_packet):
    global MAX_TTL_TO_GFW
    global MIN_TTL_TO_GFW
    global RANGE_OF_TTL_TO_GFW
    time_exceed = ip_packet.icmp.data
    if not isinstance(time_exceed.data, dpkt.ip.IP):
        return
    te_ip_packet = time_exceed.data
    dst_ip = socket.inet_ntoa(te_ip_packet.dst)
    if dst_ip in to_gfw_ttls:
        return
    if not isinstance(te_ip_packet.data, dpkt.icmp.ICMP):
        return
    te_icmp_packet = te_ip_packet.data
    if not isinstance(te_icmp_packet.data, dpkt.icmp.ICMP.Echo):
        return
    te_icmp_echo = te_icmp_packet.data
    ttl = te_icmp_echo.id
    router_ip = socket.inet_ntoa(ip_packet.src)
    is_china_router = fqsocks.china_ip.is_china_ip(router_ip)
    probe_result = probe_results.get(dst_ip)
    if not probe_result:
        return
    probe_result.routers[ttl] = (router_ip, is_china_router)
    ttl_to_gfw = probe_result.analyze_ttl_to_gfw()
    if not ttl_to_gfw:
        return
    LOGGER.info('found ttl to gfw: %s %s' % (dst_ip, ttl_to_gfw))
    to_gfw_ttls[dst_ip] = ttl_to_gfw
    probe_results.pop(dst_ip, None)
    if ttl_to_gfw == MAX_TTL_TO_GFW:
        MIN_TTL_TO_GFW += 2
        MAX_TTL_TO_GFW += 2
        LOGGER.info('slide ttl range to [%s ~ %s]' % (MIN_TTL_TO_GFW, MAX_TTL_TO_GFW))
        RANGE_OF_TTL_TO_GFW = range(MIN_TTL_TO_GFW, MAX_TTL_TO_GFW + 1)

def migrate_routes(device):
    '''
    Sample output of /proc/net/route :
    Iface   Destination     Gateway         Flags   RefCnt  Use     Metric \
    Mask            MTU     Window  IRTT
    p4p1    00000000        FED8CC0A        0003    0       0       0      \
    00000000        0       0       0
    '''
    with open('/etc/sysconfig/network-scripts/route-vhost0',
              'w') as route_cfg_file:
        for route in open('/proc/net/route', 'r').readlines():
            if route.startswith(device):
                route_fields = route.split()
                destination = int(route_fields[1], 16)
                gateway = int(route_fields[2], 16)
                flags = int(route_fields[3], 16)
                mask = int(route_fields[7], 16)
                if flags & 0x2:
                    if destination != 0:
                        route_cfg_file.write(
                            socket.inet_ntoa(struct.pack('I', destination)))
                        route_cfg_file.write(
                            '/' + str(bin(mask).count('1')) + ' ')
                        route_cfg_file.write('via ')
                        route_cfg_file.write(
                            socket.inet_ntoa(struct.pack('I', gateway)) + ' ')
                        route_cfg_file.write('dev vhost0')

def findCommon(pcap):
    remote_ip_list=[]
    remote_size_list=[]
    for (ts,buf) in pcap:
        try:
            eth = dpkt.ethernet.Ethernet(buf)
            ip = eth.data
            src = socket.inet_ntoa(ip.src)
            dst = socket.inet_ntoa(ip.dst)
            if (type(ip.data) != UDP):
                continue
            if src != '192.168.100.110':
                continue
            if dst == '255.255.255.255':
                continue
            if dst in remote_ip_list:
                continue
            remote_ip_list.append(dst)
            content_bytes = ip.data.data
            print type(content_bytes)
            udpResultData = ZeroDecrypt(content_bytes[0:44])
            print udpResultData.encode('hex')[0:87]
            #print udpResultData
            #print content_bytes.encode('hex')[0:21]
            #print 'Src ' + src + ' --> Dst '+dst
            #print len(content_bytes)
            remote_size_list.append(len(content_bytes))
        except:
            raise

	def _generate_subnet_config(self):
		dns = self.get_dns_servers()

		masked_ip = ""
		for i in range(4):
			masked_ip += chr(ord(self.netconf.ip4_address[i]) & ord(self.netconf.ip4_mask[i]))
		
		start = self.netconf.ip4_address[:3] + chr(ord(self.netconf.ip4_address[3])+1)
		end = self.netconf.ip4_address[:3] + "\xfe" #.254

		subnet = "#### BLUEMAN AUTOMAGIC SUBNET ####\n"
		subnet += "# Everything inside this section is destroyed after config change\n"
		subnet += """subnet %(ip_mask)s netmask %(netmask)s {
				option domain-name-servers %(dns)s;
				option subnet-mask %(netmask)s;
				option routers %(rtr)s;
				range %(start)s %(end)s;
				}\n""" % {"ip_mask": socket.inet_ntoa(masked_ip),
						  "netmask": socket.inet_ntoa(self.netconf.ip4_mask),
						  "dns": dns,
						  "rtr": socket.inet_ntoa(self.netconf.ip4_address),
						  "start": socket.inet_ntoa(start),
						  "end": socket.inet_ntoa(end)
						 }
		subnet += "#### END BLUEMAN AUTOMAGIC SUBNET ####\n"
		
		return subnet

def netmask_recon(ifname):

        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        int_ip =  socket.inet_ntoa(fcntl.ioctl(s.fileno(),0x8915, struct.pack('256s', ifname[:15]))[20:24])
        netmask = socket.inet_ntoa(fcntl.ioctl(socket.socket(socket.AF_INET, socket.SOCK_DGRAM), 35099, struct.pack('256s', ifname))[20:24])

        return netmask