libpcap是一个网络数据包捕获函数库，功能非常强大，提供了系统独立的用户级别网络数据包捕获接口，Libpcap可以在绝大多数类unix 平台下工作。大多数网络监控软件都以它为基础，著名的tcpdump就是以它为基础的。tcpdump是linux下一个非常重要的网络工具，可以将网络 中传送的数据包的“头”完全截获下来提供分析。它支持针对网络层、协议、主机、网络或端口的过滤，并提供and、or、not等逻辑语句来帮助你去掉无用 的信息。很多时候为了提升捕包性能，我们通常使用修改过的驱动或者专用网卡来收包，这样就导致libpcap无法工作了，但我们又需要tcpdump来进 行调试等工作。这样就需要我们修改libpcap，以支持我们的收包方式。比如pfring就是这样处理的。
这是本文在我自己搭建博客的地址 欢迎访问 http://www.itblogs.ga/blog/20150404222832/
为libpcap添加一个捕包方法非常简单，下面代码先实现捕获内存中一个固定包的功能，保证能够工作后，再去支持专有驱动或者专用网卡的收包。以下所涉及的libpcap代码和tcpdump代码，版本分别为libpcap-1.7.2，tcpdump-4.1.1。
首先添加两个文件，编写收包的代码，可以参考的代码还是挺多的，比如pcap-snoop.c、pcap-can-linux.c等。
pcap-ring.h
pcap_t *ring_create(const char *device, char *ebuf, int *is_ours); int ring_findalldevs(pcap_if_t **alldevsp, char *errbuf);
pcap-ring.c
#ifdef HAVE_CONFIG_H
# include "config.h"
#endif
#include <sys/param.h> /* optionally get BSD define */
#include <string.h>
#ifdef HAVE_OS_PROTO_H
# include "os-proto.h"
#endif
#include "pcap-int.h"
#include "errno.h"
struct pcap_ring {
int pad;
};
/*
* 192.168.19.105 -> 202.106.4.151
* DNS
* Name: offlintab.firefoxchina.cn
* Type: A
* Class: IN
*/
char peer0_0[] = {
0x8c,0x21,0x0a,0x6d,0x72,0x58,0x00,0x26,0xc7,0x35,0x2f,0x58,0x08,0x00,0x45,0x00
,0x00,0x47,0x72,0x51,0x00,0x00,0x40,0x11,0x3b,0x42,0xc0,0xa8,0x13,0x69,0xca,0x6a
,0x2e,0x97,0xe5,0x30,0x00,0x35,0x00,0x33,0x5a,0x2e,0x67,0xcb,0x01,0x00,0x00,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0x09,0x6f,0x66,0x66,0x6c,0x69,0x6e,0x74,0x61,0x62
,0x0c,0x66,0x69,0x72,0x65,0x66,0x6f,0x78,0x63,0x68,0x69,0x6e,0x61,0x02,0x63,0x6e
,0x00,0x00,0x01,0x00,0x01
};
static int pcap_read_ring(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
int wirelen = sizeof(peer0_0);
int caplen = wirelen;
if (caplen > p->snapshot) {
caplen = p->snapshot;
}
memcpy(p->buffer, peer0_0, caplen);
if (bpf_filter(p->fcode.bf_insns, p->buffer, wirelen, caplen)) {
struct pcap_pkthdr h;
gettimeofday(&h.ts, NULL);
h.len = wirelen;
h.caplen = caplen;
(*callback)(user, &h, p->buffer);
return 1;
}
return 0;
}
static int pcap_stats_ring(pcap_t *p, struct pcap_stat *ps)
{
/* not yet implemented */
ps->ps_recv = 0; /* number of packets received */
ps->ps_drop = 0; /* number of packets dropped */
ps->ps_ifdrop = 0; /* drops by interface -- only supported on some platforms */
return (0);
}
static int pcap_getnonblock_ring(pcap_t *p, char *errbuf)
{
return (0);
}
static int pcap_setnonblock_ring(pcap_t *p, int nonblock, char *errbuf)
{
return (0);
}
static int pcap_inject_ring(pcap_t *p, const void *buf _U_, size_t size _U_)
{
strlcpy(p->errbuf, "Sending packets isn‘t supported", PCAP_ERRBUF_SIZE);
return (-1);
}
int pcap_activate_ring(pcap_t *handle)
{
handle->bufsize = 2048;
handle->linktype = DLT_EN10MB;
handle->selectable_fd = -1;
handle->read_op = pcap_read_ring;
handle->stats_op = pcap_stats_ring;
handle->inject_op = pcap_inject_ring;
handle->setfilter_op = install_bpf_program;
handle->setdirection_op = NULL;
handle->set_datalink_op = NULL;
handle->getnonblock_op = pcap_getnonblock_fd; //pcap_getnonblock_ring;
handle->setnonblock_op = pcap_setnonblock_fd;//pcap_setnonblock_ring;
handle->buffer = (u_char *)malloc(handle->bufsize);
if (handle->buffer == NULL) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can‘t allocate dump buffer: %s", pcap_strerror(errno));
pcap_cleanup_live_common(handle);
return (PCAP_ERROR);
}
return 0;
}
pcap_t *ring_create(const char *device, char *ebuf, int *is_ours)
{
pcap_t *p;
if(strncmp(device, "ring", 4) != 0) {
*is_ours = 0;
return NULL;
}
*is_ours = 1;
p = pcap_create_common(device, ebuf, sizeof(struct pcap_ring));
if (p == NULL) {
return (NULL);
}
p->activate_op = pcap_activate_ring;
return (p);
}
int ring_findalldevs(pcap_if_t **alldevsp, char *errbuf)
{
return (0);
}
修改pcap.c，支持新的收包方式。
pcap.c
#include "pcap-ring.h"
... ...
struct capture_source_type {
int (*findalldevs_op)(pcap_if_t **, char *);
pcap_t *(*create_op)(const char *, char *, int *);
} capture_source_types[] = {
#ifdef PCAP_SUPPORT_DBUS
... ...
{ dbus_findalldevs, dbus_create },
#endif
{ ring_findalldevs, ring_create }, /* new !!! */
{ NULL, NULL }
};
修改 Makefile.in ，将新添加的文件编译进去。
PSRC = [email protected][email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] pcap-ring.c
接下来可以编译了：
./configure
make
可以看到libpcap.a了。
接下编译tcpdump-4.1.1
./configure
make
运行：
[[email protected] tcpdump-4.1.1]# ./tcpdump -i ring1 -c 2 tcpdump: WARNING: SIOCGIFADDR: ring1: No such device tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ring1, link-type EN10MB (Ethernet), capture size 65535 bytes 02:17:45.465535 IP localhost.58672 > dialdns.bta.net.cn.domain: 26571+ A? offlintab.firefoxchina.cn. (43) 02:17:45.485310 IP localhost.58672 > dialdns.bta.net.cn.domain: 26571+ A? offlintab.firefoxchina.cn. (43) 2 packets captured 0 packets received by filter 0 packets dropped by kernel
可以看到，tcpdump能拿到包并解析了。
How to add support for new capture interface.
原文链接：http://www.itblogs.ga/blog/20150404222832/ 转载请注明出处
时间： 2024-11-05 16:26:40