libpcap试玩

libpcap驱动了tcpdump,和wireshark这类抓包工具.提供了高度灵活的包过滤语言. 据wikipedia,高性能的包过滤最早是在bsd上作为一个问题被解决,被称为bpf,在内核实现了一个解释器,进行包匹配,用户态提供一个字符设备, linux作为后来者,支持与bsd基本相同的packet filter,称为lpf,不同的是,linux是通过在一个raw socket来支持包过滤的,通过setsockopt来SO_ATTACH_FILTER,挂载过滤器. strace 可知,libpcap实际上进行了如下syscall:

socket(PF_PACKET, SOCK_RAW, 768) = 59 
setsockopt(59, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\0\0\0\0\0\0\250\327Vc\375\177\0\0", 16) = 0

参考资料
#

libpcap的api文档和demo代码可以参见

实现
#

参考文档了demo,我写了一个小的sniffer,

如下:

class Sniffer{
public:
    Sniffer():handle(NULL),cap_exp(""),net_if("any"),exp_compiled(false){}
    ~Sniffer(){
        if(handle){
            pcap_freecode(&filter_code);
        }
        if(exp_compiled){
            pcap_close(handle);
        }
    }

    string help(){
        string h("avaliable net_interface:");
        pcap_if_t* alldev=NULL;
        if(0==pcap_findalldevs(&alldev, errbuf)){
            for(pcap_if_t * dev =alldev;NULL!=dev;dev=dev->next){
                h+=dev->name;
                h+=" ";
            }
            pcap_freealldevs(alldev);
        }
        char * default_if=pcap_lookupdev(errbuf);
        if(default_if){
            h+=" default interface:";
            h+=default_if;
        }
        return h;
    }

    string err(){
        return pcap_geterr(handle);
    }

    bool configure(const string & net_interface,const string & exp){
        if(net_interface!="")
            net_if=net_interface;
        cap_exp=exp;

        if(0!=pcap_lookupnet(net_if.data(),&netp,&maskp,errbuf)){
            return false;
        }

        handle=pcap_create(net_if.data(),errbuf);
        if(NULL==handle){
            return false;
        }
        if(0!=pcap_activate(handle)){
            return false;
        }
        //ignore:?
        //pcap_set_snaplen
        //pcap_set_promisc
        //pcap_set_rfmon
        //pcap_set_timeout
        //pcap_set_buffer_size
        //pcap_set_tstamp_type

        //only cap ethernet packet
        if(DLT_EN10MB!=pcap_datalink(handle)){
            return false;
        }

        if (0!=pcap_compile(handle, &filter_code, cap_exp.data(), 0, maskp)) {
            return false;
        }
        exp_compiled=true;

        if (0!=pcap_setfilter(handle, &filter_code)) {
            return false;
        }
    }

    bool loop(int pkg_num=-1){
        typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
                const u_char *bytes);
        pcap_loop(handle,pkg_num,&(Sniffer::pcap_callback),(u_char*)this);
    }

    static void pcap_callback(u_char *user, const struct pcap_pkthdr *h,
        const u_char *bytes){
    Sniffer * p_this=(Sniffer*) user;
    p_this->dispatch(h,bytes);
    }

private:

    void dispatch(const struct pcap_pkthdr *h, const u_char *bytes){
        got_packet(NULL,h,bytes);
    }


    private:
    pcap_t *handle;             // packet capture handle 
    string net_if; //e.g. "eth0"
    string cap_exp; //e.g "tcp and dst port 80"
    bool exp_compiled;
    struct bpf_program filter_code;         // compiled filter program (expression) 
    bpf_u_int32 netp;
    bpf_u_int32 maskp;
    char errbuf[PCAP_ERRBUF_SIZE];
};

参考资料#

实现#

参考资料
#

实现
#