使用 libpcap 在路由上捕捉 http 请求网址 自制 SWF

最近研究 kernel netfilter BPF 又想起来以前用 tcpdump 抓包的快乐时光。

就想着做一个，抓包软件名称想好了，就是大名鼎鼎的，哥WF 现在有正名了叫《数据安全网关》，所以取名为 SWF 即，简易版哥WF。

首先是基础知识，这些很有用，其实使用原始的 BPF 也能很方便的抓取数据包，但是语法怪怪的，使用 libpcap 能简化开发。

OSI参考模型
7层模型
应用层
表示层
会话层
传输层
网络层
数据链路层
物理层

5层模型
应用层 --》 对应7层前3层 ->> HTTP FTP
传输层 ->> TCP
网络层 ->> IP ICMP IGMP RIP
数据链路层 ->> ARP RARP IEEE802.3 PPP CSMA/CD
物理层 ->> FE 自协商 Manchester MLT-3 4A PAM5

使用 wireshark 抓包一个普通的 http 包

1，配置过波规则 tcp.dstport == 80

2，使用 curl http://www.baidu.com 发出请求

Frame 33: 141 bytes on wire (1128 bits), 141 bytes captured (1128 bits) on interface 0 -------------> 以太网 链路层 总长度
Ethernet II, Src: Vmware_b0:f1:9c (00:0c:29:b0:f1:9c), Dst: Vmware_fe:94:1d (00:50:56:fe:94:1d) ------> 发送接收 MAC 和 帧类型 长度 14
Internet Protocol Version 4, Src: 192.168.80.129, Dst: 35.232.111.17 ------> IP 长度 20
Transmission Control Protocol, Src Port: 39266, Dst Port: 80, Seq: 1, Ack: 1, Len: 87 ------> TCP
Hypertext Transfer Protocol ------> HTTP 真实数据

IP 中保存 发送长度 减去 TCP 头大小后，即真实数据

但 TCP 头部大小会变化，例：握手连接时

Frame 7: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: Vmware_b0:f1:9c (00:0c:29:b0:f1:9c), Dst: Vmware_fe:94:1d (00:50:56:fe:94:1d)
Internet Protocol Version 4, Src: 192.168.80.129, Dst: 182.61.200.7
Transmission Control Protocol, Src Port: 45486, Dst Port: 80, Seq: 0, Len: 0
Source Port: 45486
Destination Port: 80
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
[Next sequence number: 0 (relative sequence number)]
Acknowledgment number: 0
1010 .... = Header Length: 40 bytes (10) --------------> 40Byte
Flags: 0x002 (SYN)
Window size value: 64240
[Calculated window size: 64240]
Checksum: 0xadd3 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
[Timestamps]

Frame 9: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0
Ethernet II, Src: Vmware_b0:f1:9c (00:0c:29:b0:f1:9c), Dst: Vmware_fe:94:1d (00:50:56:fe:94:1d)
Internet Protocol Version 4, Src: 192.168.80.129, Dst: 182.61.200.7
Transmission Control Protocol, Src Port: 45486, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
Source Port: 45486
Destination Port: 80
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 1 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
0101 .... = Header Length: 20 bytes (5) ------------> 20Byte
Flags: 0x010 (ACK)
Window size value: 64240
[Calculated window size: 64240]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0x1526 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[Timestamps]

先是 以太网帧，然后是 ip 帧，然后是 tcp 头，然后是数据。

下面是实现代码：

/**
 * soft: smple WF
 * author: nejidev
 * date: 2021-12-11 21:19
 */
#define _GNU_SOURCE         /* See feature_test_macros(7) */
#include <stdio.h>
#include <string.h>
#include <time.h>

#include <arpa/inet.h>
#include <net/ethernet.h>
#include <linux/ip.h>
#include <linux/tcp.h>

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include <pcap/pcap.h>

//ubuntu 18.0.4 sudo apt-get install libpcap-dev
//gcc pcap_test.c -lpcap -o pcap_test
//sudo ./pcap_test

#define HTTP_HOST_FILE "http_host.txt"

#define LOG_D(fmt, ...) printf("[D: fun:%s line:%d] " fmt "\n", __func__, __LINE__, ##__VA_ARGS__);
#define LOG_I(fmt, ...) printf("[I: fun:%s line:%d] " fmt "\n", __func__, __LINE__, ##__VA_ARGS__);

static void write_date(FILE *file)
{
    time_t now_time;
    struct tm *tm;
    char now_date[32] = {0};

    time (&now_time);
    tm = gmtime(&now_time);

    snprintf(now_date, sizeof(now_date), "\n%d-%d-%d %d:%d:%d ",
        1900 + tm->tm_year,
        1 + tm->tm_mon,
        tm->tm_mday,
        8 + tm->tm_hour,
        tm->tm_min,
        tm->tm_sec
    );
    fwrite(now_date, 1, strlen(now_date), file);
}

void capture_one_test()
{
    char error_buf[PCAP_ERRBUF_SIZE] = {0};
    int  ret           = 0;
    char *net_dev      = NULL;
    FILE *file         = NULL;
    unsigned char *mac = NULL;
    //保存接收到的数据包
    const unsigned char *packet_content    = NULL; 
    struct pcap_pkthdr protocol_header     = {0};
    // 分析以太网中的 源mac、目的mac  
    struct ether_header *ethernet_protocol = NULL;

    net_dev = pcap_lookupdev(error_buf);

    LOG_D("default net_dev:%s", net_dev);

    /*
    device：网络接口的名字，为第一步获取的网络接口字符串（pcap_lookupdev() 的返回值 ），也可人为指定，如“eth0”。
    snaplen：捕获数据包的长度，长度不能大于 65535 个字节。
    promise：“1” 代表混杂模式，其它非混杂模式。什么为混杂模式，请看《原始套接字编程》。
    to_ms：指定需要等待的毫秒数，超过这个数值后，获取数据包的函数就会立即返回（这个函数不会阻塞，后面的抓包函数才会阻塞）。
           0 表示一直等待直到有数据包到来。
    ebuf：存储错误信息。
    */
    pcap_t *pcap_handle = pcap_open_live(net_dev, 65535, 1, 0, error_buf);

    if (! pcap_handle)
    {
        LOG_I("pcap_open_live failed");
        return ;
    }

    LOG_D("wait capture");

    packet_content = pcap_next(pcap_handle, &protocol_header);

    //数据包的实际长度
    LOG_D("protocol_header.len:%d", protocol_header.len);

    //以太网帧头部
    ethernet_protocol = (struct ether_header *)packet_content;

    //获取源mac
    mac = (unsigned char *)ethernet_protocol->ether_shost;  
    LOG_D("Mac Source Address is %02x:%02x:%02x:%02x:%02x:%02x",
        *(mac+0),*(mac+1),*(mac+2),*(mac+3),*(mac+4),*(mac+5));

    //获取目的mac
    mac = (unsigned char *)ethernet_protocol->ether_dhost;  
    LOG_D("Mac Destination Address is %02x:%02x:%02x:%02x:%02x:%02x",
        *(mac+0),*(mac+1),*(mac+2),*(mac+3),*(mac+4),*(mac+5));

    //save to file
    file = fopen("test_once.pcap", "w");
    fwrite(packet_content, 1, protocol_header.len, file);
    fclose(file);

    pcap_close(pcap_handle);
}

void ethernet_protocol_callback(unsigned char *argument, const struct pcap_pkthdr *packet_heaher,
                                const unsigned char *packet_content) 
{
    int offset = 0;
    unsigned char *mac = NULL;
    char *host         = NULL;
    char *host_end     = NULL;
    int   host_len     = 0;
    FILE *cap_file     = NULL;
    //以太网帧头部 分析以太网中的 源mac、目的mac  
    struct ether_header *ethernet_protocol = NULL;
    //以太网类型
    unsigned short ethernet_type           = 0;
    //IP
    struct iphdr *ip_header                = NULL;
    //socket ip
    struct in_addr addr                    = {0};
    //TCP
    struct tcphdr *tcp_header              = NULL;

    LOG_I("new package len:%d", packet_heaher->len);

    LOG_D("pkthdr len:%ld", sizeof(struct pcap_pkthdr)); //24
    LOG_D("ip len:%ld",     sizeof(struct iphdr)); //20
    LOG_D("tcp len:%ld",    sizeof(struct tcphdr)); //20 ?

    ethernet_protocol = (struct ether_header *)packet_content;

    //获取源mac
    mac = (unsigned char *)ethernet_protocol->ether_shost;
    LOG_D("Mac Source Address is %02x:%02x:%02x:%02x:%02x:%02x\n",*(mac+0),*(mac+1),*(mac+2),
                                        *(mac+3),*(mac+4),*(mac+5));

    //获取目的mac
    mac = (unsigned char *)ethernet_protocol->ether_dhost; 
    LOG_D("Mac Destination Address is %02x:%02x:%02x:%02x:%02x:%02x\n",*(mac+0),*(mac+1),*(mac+2),
                                        *(mac+3),*(mac+4),*(mac+5));

    //获得以太网的类型 
    ethernet_type = ntohs(ethernet_protocol->ether_type);

    LOG_D("Ethernet type is :%04x\n", ethernet_type);

    switch(ethernet_type)
    {
        case 0x0800: LOG_D("IP protocol");  break;
        case 0x0806: LOG_D("ARP protocol"); break;
        case 0x0835: LOG_D("RARP protocol"); break;
        default: break;
    }

    if (0x0800 != ethernet_type)
    {
        return;
    }

    ip_header = (struct iphdr *)(packet_content + sizeof(struct ether_header));

    addr.s_addr  = ip_header->saddr;
    LOG_D("ip saddr:%s", inet_ntoa(addr));

    addr.s_addr  = ip_header->daddr;
    LOG_D("ip daddr:%s", inet_ntoa(addr));

    switch (ip_header->protocol)
    {
        case 1: LOG_D("ICMP protocol"); break;
        case 2: LOG_D("ICMP protocol"); break;
        case 6: LOG_D("TCP protocol");  break;
        case 17: LOG_D("UDP protocol"); break;
    }

    if (6 != ip_header->protocol)
    {
        return ;
    }

    tcp_header = (struct tcphdr *)(packet_content + sizeof(struct ether_header) + sizeof(struct iphdr));

    LOG_D("tcp source port:%d", ntohs(tcp_header->source));
    LOG_D("tcp dest port:%d", ntohs(tcp_header->dest));
    LOG_D("tcp header size:%ld", (tcp_header->doff)*sizeof(int));

    offset += sizeof(struct pcap_pkthdr);
    offset += sizeof(struct iphdr);
    offset += (tcp_header->doff)*sizeof(int);

    LOG_D("package offset:%d", offset);
    LOG_D("package data:%s", packet_content + offset);

    host = strcasestr((const char *)packet_content + offset, "host");

    if (host)
    {
        host += strlen("host:");

        LOG_I("capture host:%s", host);

        host_end = strstr(host, "\n");
        //host_end--;
        host_len = host_end - host;

        LOG_D("host_len:%d", host_len);

        //eat space
        while (' ' == *host)
        {
            host++;
            host_len--;
        }

        //save to file
        cap_file = fopen(HTTP_HOST_FILE, "a");
        write_date(cap_file);
        fwrite(host, 1, host_len, cap_file);
        fclose(cap_file);
    }
}

void capture_all_test()
{
    char error_buf[PCAP_ERRBUF_SIZE] = {0};
    int  ret                         = 0;
    char *net_dev                    = NULL;
    pcap_t *pcap_handle              = NULL;
    struct bpf_program filter        = {0};
    FILE *cap_file                   = NULL;

    net_dev = pcap_lookupdev(error_buf);

    LOG_D("default net_dev:%s", net_dev);

    pcap_handle = pcap_open_live(net_dev, 65535, 1, 0, error_buf);

    if (! pcap_handle)
    {
        LOG_I("pcap_open_live failed");
        return ;
    }

    cap_file = fopen(HTTP_HOST_FILE, "w");
    fclose(cap_file);

    //wireshark tcp.dstport == 80
    pcap_compile(pcap_handle, &filter, "dst port 80", 1, 0);  
    pcap_setfilter(pcap_handle, &filter);

    if (0 > pcap_loop(pcap_handle, -1, ethernet_protocol_callback, NULL))
    {
        LOG_I("pcap_loop failed");
        return ;
    }

    LOG_I("wait loop exit");
}

int main(int argc, char **argv)
{
    //capture_one_test();
    capture_all_test();
    return 0;
}

测试环境：ubuntu 18.0.4 sudo apt-get install libpcap-dev
编译：gcc pcap_test.c -lpcap -o pcap_test
运行：sudo ./pcap_test

使用 curl 或 firefox 随便上，http 的网站，然后就会被记录下来。

capture_one_test(); 这个能抓包原始数据，经过对比和 Wireshark 中一致。