使用libpcap获取http报文

在上一篇博客中简单对libpcap库基本函数及基本工作流程做了些简单说明，

今天我们先了解一下pcap_loop(）及pcap_dispatch()函数的功能及作用：

（1）pcap_loop()循环进行数据包的抓取：

函数原型如下：

       typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
                                   const u_char *bytes);

       int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user);
       /*参数说明：
            功能：循环捕获数据包,不会响应pcap_open_live()函数设置的超时时间
            参数 pcap_t *p: p是嗅探器会话句柄
            参数 cnt：cnt用于设置所捕获数据包的个数，负数的cnt表示pcap_loop永远循环抓包，直到出现错误。
            参数callback：是个回调函数指针，它的原型如下：
            typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
                                   const u_char *bytes);
            参数 user：用来给回调函数传递参数的，在callback函数当中只有第一个user指针是可以留给用户使用的，
            如果你想给callback传递自己参数，那就只能通过pcap_loop的最后一个参数user来实现了*/
            
            struct pcap_pkthdr {
                struct timeval ts;  /* time stamp */ 
                bpf_u_int32 caplen; /* length of portion present */
                bpf_u_int32 len;    /* length this packet (off wire) */
            };
            //ts——时间戳
            //caplen——真正实际捕获的包的长度
            //len——这个包的长度

    /*因为在某些情况下你不能保证捕获的包是完整的，例如一个包长1480，但是你捕获到1000的时候，
可能因为某些原因就中止捕获了，所以caplen是记录实际捕获的包长，也就是1000，而len就是1480。*/

（2）pcap_dispatch()这个函数和pcap_loop()非常类似，只是在超过to_ms毫秒后就会返回(to_ms是pcap_open_live()的第4个参数)

下面是函数原型：

       int pcap_dispatch(pcap_t *p, int cnt,
               pcap_handler callback, u_char *user);

说完两个函数的作用，下面我们开始自制我们自己的sniffer，改程序的功能是循环抓取以太网报文并获取其中的http报文，解析并显示其相应的url及长度

下面直接贴出代码：

#include <stdio.h>  
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <pcap.h>  
#include <time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>

#define DEVICE            "enp0s3"
#define URL_MAX_LEN        2048
#define MAX_HOST_LEN    1024
#define MAX_GET_LEN        2048

#define get_u_int8_t(X,O)  (*(uint8_t *)(((uint8_t *)X) + O))
#define get_u_int16_t(X,O)  (*(uint16_t *)(((uint8_t *)X) + O))
#define get_u_int32_t(X,O)  (*(uint32_t *)(((uint8_t *)X) + O))
#define get_u_int64_t(X,O)  (*(uint64_t *)(((uint8_t *)X) + O))

/*Display Ethernet Header*/
void show_ethhdr(struct ethhdr *eth)
{
    printf("----------------eth---------------------
");
    printf("destination eth addr: %02x:%02x:%02x:%02x:%02x:%02x
",
        eth->h_dest[0], eth->h_dest[1],
        eth->h_dest[2], eth->h_dest[3],
        eth->h_dest[4], eth->h_dest[5]);
    printf("source eth addr: %02x:%02x:%02x:%02x:%02x:%02x
",
        eth->h_source[0], eth->h_source[1],
        eth->h_source[2], eth->h_source[3],
        eth->h_source[4], eth->h_source[5]);
    printf("protocol is: %04x
", ntohs(eth->h_proto));
}

/*Display IP Header*/
void show_iphdr(struct iphdr *ip)
{
    struct in_addr addr;

    printf("----------------ip----------------------
");
    printf("version: %d
", ip->version);
    printf("head len: %d
", ip->ihl * 4);
    printf("total len: %d
", ntohs(ip->tot_len));
    printf("ttl: %d
", ip->ttl);
    printf("protocol: %d
", ip->protocol);
    printf("check: %x
", ip->check);
    addr.s_addr = ip->saddr;
    printf("saddr: %s
", inet_ntoa(addr));
    addr.s_addr = ip->daddr;
    printf("daddr: %s
", inet_ntoa(addr));
}

/*Display TCP Header*/
void show_tcphdr(struct tcphdr *tcp)
{
    printf("----------------tcp---------------------
");
    printf("tcp len: %d
", sizeof(struct tcphdr));
    printf("tcp->doff: %d
", tcp->doff * 4);
    printf("source port: %d
", ntohs(tcp->source));
    printf("dest port: %d
", ntohs(tcp->dest));
    printf("sequence number: %d
", ntohs(tcp->seq));
    printf("ack sequence: %d
", ntohs(tcp->ack_seq));
}

int parse_http_head(const u_char *payload, int payload_len, char *url)
{
    int line_len, offset;
    int ustrlen;
    int hstrlen; //"host: " 
    int hostlen;
    int getlen; 
    char host[MAX_HOST_LEN];
    char get[MAX_GET_LEN]; 
    int a, b;
    
    /*filter get packet*/
    if(memcmp(payload, "GET ", 4)) {
        return 0;
    }

    for(a = 0, b = 0; a < payload_len - 1; a++) {
        if (get_u_int16_t(payload, a) == ntohs(0x0d0a)) {
            line_len = (u_int16_t)(((unsigned long) &payload[a]) - ((unsigned long)&payload[b]));
    
            if (line_len >= (9 + 4)
                && memcmp(&payload[line_len - 9], " HTTP/1.", 8) == 0) {
                memcpy(get, payload + 4, line_len - 13); //"GET  HTTP/1.x" 13bit
                getlen = line_len - 13;
            }   
            /*get url host of pcaket*/
            if (line_len > 6 
                && memcmp(&payload[b], "Host:", 5) == 0) {
                if(*(payload + b + 5) == ' ') {
                    hstrlen = b + 6;
                } else {
                    hstrlen = b + 5;
                }
                hostlen = a - hstrlen;   
                memcpy(host, payload + hstrlen, (a - hstrlen));
            }   
            b = a + 2;
        }   
    }
    offset =  7;
    memcpy(url, "http://", offset);
    memcpy(url + offset, host, hostlen);
    offset += hostlen;
    memcpy(url + offset, get, getlen);

    return strlen(url);
}

void packet_http_handle(const u_char *tcp_payload, int payload_len)
{    
    int url_len;
    char url[URL_MAX_LEN];
    
    url_len = parse_http_head(tcp_payload, payload_len, url);
    if (url_len <= 7) {
        return;    
    }
    printf("----------------HTTP---------------------
");
    printf("url_len: %d
", url_len);
    printf("url: %s
", url);
}

int prase_packet(const u_char *buf,  int caplen)
{
    uint16_t e_type;
    uint32_t offset;
    int payload_len;
    const u_char *tcp_payload;
    
    /* ether header */
    struct ethhdr *eth = NULL;
    eth = (struct ethhdr *)buf;
    e_type = ntohs(eth->h_proto);
    offset = sizeof(struct ethhdr);
    show_ethhdr(eth);

    /*vlan 802.1q*/    
    while(e_type == ETH_P_8021Q) {
        e_type = (buf[offset+2] << 8) + buf[offset+3];
        offset += 4;
    }  
    if (e_type != ETH_P_IP) {
        return -1;
    }   

    /* ip header */    
    struct iphdr *ip = (struct iphdr *)(buf + offset);
    e_type = ntohs(ip->protocol);
    offset += sizeof(struct iphdr);
    show_iphdr(ip);
     
    if(ip->protocol != IPPROTO_TCP) {
        return -1;
    }

    /*tcp header*/
    struct tcphdr *tcp = (struct tcphdr *)(buf + offset);
    offset += (tcp->doff << 2);
    payload_len = caplen - offset;
    tcp_payload = (buf + offset);
    show_tcphdr(tcp);

    /*prase http header*/
    packet_http_handle(tcp_payload, payload_len);
    
    return 0;
}

void get_packet(u_char *user, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
    static int count = 0;
    printf("
----------------------------------------
");
    printf("		packet %d
", count);
    printf("----------------------------------------
");
    printf("Packet id: %d
", count);
    printf("Packet length: %d
", pkthdr->len);  
    printf("Number of bytes: %d
", pkthdr->caplen);  
      printf("Recieved time: %s
", ctime((const time_t *)&pkthdr->ts.tv_sec));

    prase_packet(packet, pkthdr->len);
    count++;
}

int main()  
{  
    char errBuf[PCAP_ERRBUF_SIZE]; /*error Buff*/
    struct pcap_pkthdr packet;  /*The header that pcap gives us*/
    pcap_t *dev; /*network interface*/
    bpf_u_int32 netp, maskp; 
    char *net, *mask;
    struct in_addr addr;
    int ret;

    /*look up device network addr and mask*/
    if(pcap_lookupnet(DEVICE, &netp, &maskp, errBuf)) {
        printf("get net failure
");
        exit(1);
    }
    addr.s_addr = netp;
    net = inet_ntoa(addr);
    printf("network: %s
", net);
    
    addr.s_addr = maskp;
    mask = inet_ntoa(addr);
    printf("mask: %s
", mask);

    /*open network device for packet capture*/
    dev = pcap_open_live(DEVICE, 65536, 1, 0, errBuf);
    if(NULL == dev) {
        printf("open %s failure
", DEVICE);
        exit(1);
    }
    
    /*process packets from a live capture or savefile*/
    pcap_loop(dev, 0, get_packet, NULL);
    
    /*close device*/
    pcap_close(dev);

    return 0; 
} 
      

下面是运行结果：

----------------------------------------
                packet 3667
----------------------------------------
Packet id: 3667
Packet length: 198
Number of bytes: 198
Recieved time: Mon Aug 15 04:07:20 2016

----------------eth---------------------
destination eth addr: 00:90:0b:12:58:2b
source eth addr: 08:00:27:25:e7:52
protocol is: 0800
----------------ip----------------------
version: 4
head len: 20
total len: 184
ttl: 64
protocol: 6
check: f793
saddr: 192.168.16.125
daddr: 119.84.70.22
----------------tcp---------------------
tcp len: 20
tcp->doff: 20
source port: 55420
dest port: 80
sequence number: 12053
ack sequence: 5286
----------------HTTP---------------------
url_len: 54
url: http://cc.stream.qqmusic.qq.com/C200003a0iyj2fOc6y.m4a