给libpcap增加一个新的捕包方法

libpcap是一个网络数据包捕获函数库，功能非常强大，提供了系统独立的用户级别网络数据包捕获接口，Libpcap可以在绝大多数类unix 平台下工作。大多数网络监控软件都以它为基础，著名的tcpdump就是以它为基础的。tcpdump是linux下一个非常重要的网络工具，可以将网络 中传送的数据包的“头”完全截获下来提供分析。它支持针对网络层、协议、主机、网络或端口的过滤，并提供and、or、not等逻辑语句来帮助你去掉无用 的信息。很多时候为了提升捕包性能，我们通常使用修改过的驱动或者专用网卡来收包，这样就导致libpcap无法工作了，但我们又需要tcpdump来进 行调试等工作。这样就需要我们修改libpcap，以支持我们的收包方式。比如pfring就是这样处理的。

这是本文在我自己搭建博客的地址 欢迎访问  http://www.itblogs.ga/blog/20150404222832/

为libpcap添加一个捕包方法非常简单，下面代码先实现捕获内存中一个固定包的功能，保证能够工作后，再去支持专有驱动或者专用网卡的收包。以下所涉及的libpcap代码和tcpdump代码，版本分别为libpcap-1.7.2，tcpdump-4.1.1。

首先添加两个文件，编写收包的代码，可以参考的代码还是挺多的，比如pcap-snoop.c、pcap-can-linux.c等。

pcap-ring.h

pcap_t *ring_create(const char *device, char *ebuf, int *is_ours);
int ring_findalldevs(pcap_if_t **alldevsp, char *errbuf);

pcap-ring.c

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include <sys/param.h>	/* optionally get BSD define */
#include <string.h>

#ifdef HAVE_OS_PROTO_H
# include "os-proto.h"
#endif

#include "pcap-int.h"
#include "errno.h"

struct pcap_ring {
	int pad;
};

/* 
 * 192.168.19.105 -> 202.106.4.151 
 * DNS 
 * Name: offlintab.firefoxchina.cn 
 * Type: A
 * Class: IN
 */
char peer0_0[] = {
		0x8c,0x21,0x0a,0x6d,0x72,0x58,0x00,0x26,0xc7,0x35,0x2f,0x58,0x08,0x00,0x45,0x00
		,0x00,0x47,0x72,0x51,0x00,0x00,0x40,0x11,0x3b,0x42,0xc0,0xa8,0x13,0x69,0xca,0x6a
		,0x2e,0x97,0xe5,0x30,0x00,0x35,0x00,0x33,0x5a,0x2e,0x67,0xcb,0x01,0x00,0x00,0x01
		,0x00,0x00,0x00,0x00,0x00,0x00,0x09,0x6f,0x66,0x66,0x6c,0x69,0x6e,0x74,0x61,0x62
		,0x0c,0x66,0x69,0x72,0x65,0x66,0x6f,0x78,0x63,0x68,0x69,0x6e,0x61,0x02,0x63,0x6e
		,0x00,0x00,0x01,0x00,0x01
	};

static int pcap_read_ring(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
	int wirelen = sizeof(peer0_0);
	int caplen  = wirelen;

	if (caplen > p->snapshot) {
		caplen = p->snapshot;
	}

	memcpy(p->buffer, peer0_0, caplen);

	if (bpf_filter(p->fcode.bf_insns, p->buffer, wirelen, caplen)) {
		struct pcap_pkthdr h;

		gettimeofday(&h.ts, NULL);
		h.len    = wirelen;
		h.caplen = caplen;

		(*callback)(user, &h, p->buffer);

		return 1;
	}

	return 0;
}

static int pcap_stats_ring(pcap_t *p, struct pcap_stat *ps)
{
	/* not yet implemented */
	ps->ps_recv = 0;    /* number of packets received */
	ps->ps_drop = 0;    /* number of packets dropped */
	ps->ps_ifdrop = 0;  /* drops by interface -- only supported on some platforms */
	
	return (0);
}

static int pcap_getnonblock_ring(pcap_t *p, char *errbuf)
{
	return (0);
}

static int pcap_setnonblock_ring(pcap_t *p, int nonblock, char *errbuf)
{
	return (0);
}

static int pcap_inject_ring(pcap_t *p, const void *buf _U_, size_t size _U_)
{
	strlcpy(p->errbuf, "Sending packets isn't supported", PCAP_ERRBUF_SIZE);
	return (-1);
}

int pcap_activate_ring(pcap_t *handle)
{
	handle->bufsize  = 2048;
	handle->linktype = DLT_EN10MB;
	handle->selectable_fd = -1;

	handle->read_op   = pcap_read_ring;
	handle->stats_op  = pcap_stats_ring;
	handle->inject_op = pcap_inject_ring;
	handle->setfilter_op    = install_bpf_program;
	handle->setdirection_op = NULL;
	handle->set_datalink_op = NULL;
	handle->getnonblock_op = pcap_getnonblock_fd; //pcap_getnonblock_ring;
	handle->setnonblock_op = pcap_setnonblock_fd;//pcap_setnonblock_ring;

	handle->buffer = (u_char *)malloc(handle->bufsize);
	if (handle->buffer == NULL) {
		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
			"Can't allocate dump buffer: %s", pcap_strerror(errno));
		pcap_cleanup_live_common(handle);

		return (PCAP_ERROR);
	}

	return 0;
}

pcap_t *ring_create(const char *device, char *ebuf, int *is_ours)
{
	pcap_t *p;

	if(strncmp(device, "ring", 4) != 0) {
			*is_ours = 0;
			return NULL;
	}

	*is_ours = 1;

	p = pcap_create_common(device, ebuf, sizeof(struct pcap_ring));
	if (p == NULL) {
		return (NULL);
	}

	p->activate_op = pcap_activate_ring;

	return (p);
}

int ring_findalldevs(pcap_if_t **alldevsp, char *errbuf)
{
	return (0);
}

 修改pcap.c，支持新的收包方式。

pcap.c

#include "pcap-ring.h"

... ...

struct capture_source_type {
    int (*findalldevs_op)(pcap_if_t **, char *);
    pcap_t *(*create_op)(const char *, char *, int *);
} capture_source_types[] = {
#ifdef PCAP_SUPPORT_DBUS
    ... ...
    { dbus_findalldevs, dbus_create },
#endif
    { ring_findalldevs, ring_create },    /* new !!! */
    { NULL, NULL }
};

 

修改  Makefile.in ，将新添加的文件编译进去。

PSRC =  pcap-@V_PCAP@.c @USB_SRC@ @BT_SRC@ @BT_MONITOR_SRC@ \
@CAN_SRC@ @NETFILTER_SRC@ @CANUSB_SRC@ @DBUS_SRC@ pcap-ring.c

接下来可以编译了：

./configure

make

可以看到libpcap.a了。

接下编译tcpdump-4.1.1

./configure

make

运行：

[root@localhost tcpdump-4.1.1]# ./tcpdump  -i ring1 -c 2
tcpdump: WARNING: SIOCGIFADDR: ring1: No such device
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ring1, link-type EN10MB (Ethernet), capture size 65535 bytes
02:17:45.465535 IP localhost.58672 > dialdns.bta.net.cn.domain: 26571+ A? offlintab.firefoxchina.cn. (43)
02:17:45.485310 IP localhost.58672 > dialdns.bta.net.cn.domain: 26571+ A? offlintab.firefoxchina.cn. (43)
2 packets captured
0 packets received by filter
0 packets dropped by kernel

可以看到，tcpdump能拿到包并解析了。

    How to add support for new capture interface.

原文链接：http://www.itblogs.ga/blog/20150404222832/ 转载请注明出处