#!/usr/bin/env python

# $Id: appsnarf.py 17349 2007-06-13 21:11:47Z tyardley $

import base64, time
import dsniff
import appid
import sys

class APPSnarf(dsniff.Handler):
    def setup(self):
        self.subscribe('flow', '', self.recv_flow)

    def recv_flow(self, f):
        if f.state == dsniff.FLOW_START:
            print >>sys.stderr, 'app started'
            for half in f.half.itervalues():
                half.save['_appid'] = appid.appid()
                half.save['_appid_buf'] = half.data or ''
        elif f.state == dsniff.FLOW_CLIENT_DATA:
            print >>sys.stderr, 'app data received'
        app = (-1, 0)
        for half in f.half.itervalues():
            if half.data:
                half.save['_appid_buf'] += half.data
                print >>sys.stderr, 'appid about to process p:%s s:%s d:%s' % (>
                app = half.save['_appid'].process(f.p, f.sport or 0, f.dport or>
                print >>sys.stderr, 'appid returned %s' % (app,)
                if app[0] != 0: # APPID_CONTINUE
                    break
        if app[0] not in (65535, -1, 0): # XXX: 65535 is because application is>
            event = appid.app_to_name(app[0]).lower()
            print >>sys.stderr, 'appid match:', event
            for half in f.half.itervalues():
                del half.save['_appid_buf']
                del half.save['_appid']
            f.unregister(self.recv_flow)


if __name__ == '__main__':
    dsniff.main()