[golang] 抓包注入分析

import ( "fmt" "github.com/google/gopacket/pcap" ) func main() { // 获取 libpcap 的版本 version := pcap.Version() fmt.Println(version) // 获取网卡列表 var devices []pcap.Interface devices, _ := pcap.FindAllDevs() }

type Interface struct { Name string Description string Address []InterfaceAddress }

type InterfaceAddress struct { IP net.IP Netmask net.IPMask }

handle, _ := pcap.OpenLive( "eth0", // device int32(65535), // snapshot length false, // promiscuous mode? -1 * time.Second, // timeout 负数表示不缓存，直接输出 ) defer handle.Close()

handle, _ := pcap.OpenOffline("dump.pcap") defer handle.Close()

packetSource := gopacket.NewPacketSource( handle, handle.LinkType() )

packet, _ := packetSource.NextPacket() fmt.Println(packet)

for packet := range packetSource.Packets() { fmt.Println(packet) }

handle.SetBPFFilter("tcp and port 80")

dumpFile, _ := os.Create("dump.pcap") defer dumpFile.Close() // 准备好写入的 Writer packetWriter := pcapgo.NewWriter(dumpFile) packetWriter.WriteFileHeader( 65535, // Snapshot length layers.LinkTypeEthernet, ) // 写入包 for packet := range packetSource.Packets() { packetWriter.WritePacket( packet.Metadata().CaptureInfo, packet.Data(), ) }

for _, layer := range packet.Layers() { fmt.Println(layer.LayerType()) }

ipLayer := packet.Layer(layers.LayerTypeIPv4) if ipLayer != nil { ip, _ := ipLayer.(*layers.IPv4) fmt.Println(ip.SrcIP, ip.DstIP) fmt.Println(ip.Protocol) }

tcpLayer := packet.Layer(layers.LayerTypeTCP) if tcpLayer != nil { tcp, _ := tcpLayer.(*layers.TCP) fmt.Println(tcp.SrcPort) fmt.Println(tcp.DstPort) }

// 解析 ethernet 层 ethernetPacket := gopacket.NewPacket( packet, layers.LayerTypeEthernet, gopacket.Default) // 复制一份包 // 解析 IP 层 ipPacket := gopacket.NewPacket( packet, layers.LayerTypeIPv6, gopacket.NoCopy) // 不复制，所以不要修改 // 解析 TCP 层 tcpPacket := gopacket.NewPacket( packet, layers.LayerTypeTCP, gopacket.Lazy) // 等修改的时候再复制（不是thread safe） )

// 创建所有所需的变量 var eth layers.Ethernet var ip4 layers.IPv4 var tcp layers.TCP parser := gopacket.NewDecodingLayerParser( layers.LayerTypeEthernet, &eth, &ip4, &tcp) decodedLayers := []gopacket.LayerType{} // 解析 for packet := range packetSource.Packets() { parser.DecodeLayers(packet, &decodedLayers) for _, layerType := range decodedLayers { fmt.Println(layerType) } }

// 注册自定义的层 var MyLayerType = gopacket.RegisterLayerType( 12345, // 唯一的 ID "MyLayerType", // 唯一的名字 gopacket.DecodeFunc(decodeMyLayer), // 解析函数（稍后定义） ) // 定义层的内容 type MyLayer struct { Header []byte payload []byte } // 定义解析函数 func decodeMyLayer(data []byte, p gopacket.PacketBuilder) error { p.AddLayer(&MyLayer{data[:4], data[4:]}) return p.NextDecoder(layers.LayerTypeEthernet) } // 定义一些解析包所需的接口 func (m MyLayer) LayerType() LayerType { return MyLayerType } func (m MyLayer) LayerContents() []byte { return m.Header } func (m MyLayer) LayerPayload() []byte { return m.payload } // 然后就可以像其它内置层一样解析这个自定义的包了 decodedPacket := gopacket.NewPacket( data, MyLayerType, gopacket.Default, )

buffer = gopacket.NewSerializeBuffer() options := gopacket.SerializeOptions{} gopacket.SerializeLayers(buffer, options, &layers.Ethernet{}, &layers.IPv4{}, &layers.TCP{}, gopacket.Payload([]byte{65, 66, 67}), )

handle.WritePacketData(buffer.Bytes())

someFlow := gopacket.NewFlow( layers.NewUDPPortEndpoint(1000), layers.NewUDPPortEndpoint(500)) t := packet.NetworkLayer() // Check nil if t.TransportFlow() == someFlow { fmt.Println("UDP 1000 -> 500 found.") }