基于gopacket的極簡http抓包

代碼修改來自 gopacket 的example

// Copyright 2012 Google, Inc. All rights reserved.
//
// Use of this source code is governed by a BSD-style license
// that can be found in the LICENSE file in the root of the source
// tree.

// This binary provides sample code for using the gopacket TCP assembler and TCP
// stream reader.  It reads packets off the wire and reconstructs HTTP requests
// it sees, logging them.
package main

import (
    "bufio"
    "flag"
    "io"
    "log"
    "net/http"
    "time"
    "fmt"

    "github.com/google/gopacket"
    "github.com/google/gopacket/examples/util"
    "github.com/google/gopacket/layers"
    "github.com/google/gopacket/pcap"
    "github.com/google/gopacket/tcpassembly"
    "github.com/google/gopacket/tcpassembly/tcpreader"
)

var iface = flag.String("i", "en0", "Interface to get packets from")
var fname = flag.String("r", "", "Filename to read from, overrides -i")
var snaplen = flag.Int("s", 1600, "SnapLen for pcap packet capture")
var filter = flag.String("f", "tcp and port 80", "BPF filter for pcap")
var logAllPackets = flag.Bool("v", false, "Logs every packet in great detail")

// Build a simple HTTP request parser using tcpassembly.StreamFactory and tcpassembly.Stream interfaces

// httpStreamFactory implements tcpassembly.StreamFactory
type httpStreamFactory struct{}

// httpStream will handle the actual decoding of http requests.
type httpStream struct {
    net, transport gopacket.Flow
    r              tcpreader.ReaderStream
}

func (h *httpStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
    hstream := &httpStream{
        net:       net,
        transport: transport,
        r:         tcpreader.NewReaderStream(),
    }


    src,_ := transport.Endpoints()  
    if fmt.Sprintf("%v",src) == "80" {
        go hstream.runResponse() // Important... we must guarantee that data from the reader stream is read.
    } else {
        go hstream.runRequest() // Important... we must guarantee that data from the reader stream is read.
    }

    // ReaderStream implements tcpassembly.Stream, so we can return a pointer to it.
    return &hstream.r
}

func (h *httpStream) runResponse() {

    buf := bufio.NewReader(&h.r)
    defer tcpreader.DiscardBytesToEOF(buf)
    for {
        resp, err := http.ReadResponse(buf,nil)
        if err == io.EOF || err == io.ErrUnexpectedEOF {
            // We must read until we see an EOF... very important!
            return
        } else if err != nil {
            log.Println("Error reading stream", h.net, h.transport, ":", err)
            return 
        } else {
            bodyBytes := tcpreader.DiscardBytesToEOF(resp.Body)
            resp.Body.Close()
            printResponse(resp,h,bodyBytes)
            // log.Println("Received response from stream", h.net, h.transport, ":", resp, "with", bodyBytes, "bytes in response body")
        }
    }
}
func (h *httpStream) runRequest() {

    buf := bufio.NewReader(&h.r)
    defer tcpreader.DiscardBytesToEOF(buf)
    for {
        req, err := http.ReadRequest(buf)
        if err == io.EOF || err == io.ErrUnexpectedEOF {
            // We must read until we see an EOF... very important!
            return
        } else if err != nil {
            log.Println("Error reading stream", h.net, h.transport, ":", err)
        } else {
            bodyBytes := tcpreader.DiscardBytesToEOF(req.Body)
            req.Body.Close()
            printRequest(req,h,bodyBytes)
            // log.Println("Received request from stream", h.net, h.transport, ":", req, "with", bodyBytes, "bytes in request body")
        }
    }
}

func printHeader(h http.Header){
    for k,v := range h{
        fmt.Println(k,v)
    }
}

func printRequest(req *http.Request,h *httpStream,bodyBytes int){

    fmt.Println("\n\r\n\r")
    fmt.Println(h.net,h.transport)
    fmt.Println("\n\r")
    fmt.Println(req.Method, req.RequestURI, req.Proto)
    printHeader(req.Header)

}

func printResponse(resp *http.Response,h *httpStream,bodyBytes int){

    fmt.Println("\n\r")
    fmt.Println(resp.Proto, resp.Status)
    printHeader(resp.Header)
}


func main() {
    defer util.Run()()
    var handle *pcap.Handle
    var err error

    // Set up pcap packet capture
    if *fname != "" {
        log.Printf("Reading from pcap dump %q", *fname)
        handle, err = pcap.OpenOffline(*fname)
    } else {
        log.Printf("Starting capture on interface %q", *iface)
        handle, err = pcap.OpenLive(*iface, int32(*snaplen), true, pcap.BlockForever)
    }
    if err != nil {
        log.Fatal(err)
    }

    if err := handle.SetBPFFilter(*filter); err != nil {
        log.Fatal(err)
    }

    // Set up assembly
    streamFactory := &httpStreamFactory{}
    streamPool := tcpassembly.NewStreamPool(streamFactory)
    assembler := tcpassembly.NewAssembler(streamPool)

    log.Println("reading in packets")
    // Read in packets, pass to assembler.
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
    packets := packetSource.Packets()
    ticker := time.Tick(time.Minute)
    for {
        select {
        case packet := <-packets:
            // A nil packet indicates the end of a pcap file.
            if packet == nil {
                return
            }
            if *logAllPackets {
                log.Println(packet)
            }
            if packet.NetworkLayer() == nil || packet.TransportLayer() == nil || packet.TransportLayer().LayerType() != layers.LayerTypeTCP {
                log.Println("Unusable packet")
                continue
            }
            tcp := packet.TransportLayer().(*layers.TCP)
            assembler.AssembleWithTimestamp(packet.NetworkLayer().NetworkFlow(), tcp, packet.Metadata().Timestamp)
        case <-ticker:
            // Every minute, flush connections that haven't seen activity in the past 2 minutes.
            assembler.FlushOlderThan(time.Now().Add(time.Minute * -2))
        }
    }
}

源代碼可以編譯執(zhí)行。

結(jié)果：

192.168.1.104->198.13.57.90 65063->80


GET /http/ HTTP/1.1
Accept-Language [zh-CN,zh;q=0.9]
If-None-Match [W/"5ba2f652-c155"]
If-Modified-Since [Thu, 20 Sep 2018 01:22:26 GMT]
Upgrade-Insecure-Requests [1]
User-Agent [Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3528.4 Safari/537.36]
Accept [text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8]
Referer [http://go.xiulian.net.cn/url/]
Accept-Encoding [gzip, deflate]
Connection [keep-alive]


HTTP/1.1 304 Not Modified
Date [Thu, 20 Sep 2018 01:25:37 GMT]
Last-Modified [Thu, 20 Sep 2018 01:22:26 GMT]
Connection [keep-alive]
Etag ["5ba2f652-c155"]
Server [nginx/1.14.0 (Ubuntu)]

代碼片段

    streamFactory := &httpStreamFactory{}
    streamPool := tcpassembly.NewStreamPool(streamFactory)
    assembler := tcpassembly.NewAssembler(streamPool)

這部分主要是，通過tcpassembly 分析包，每一個包處理后，將調(diào)用streamFactory.new

func (h *httpStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
        hstream := &httpStream{
                net:       net,
                transport: transport,
                r:         tcpreader.NewReaderStream(),
        }


        src,_ := transport.Endpoints()
        if fmt.Sprintf("%v",src) == "80" {
                go hstream.runResponse() // Important... we must guarantee that data from the reader stream is read.
        } else {
                go hstream.runRequest() // Important... we must guarantee that data from the reader stream is read.
        }

        // ReaderStream implements tcpassembly.Stream, so we can return a pointer to it.
        return &hstream.r
}

在new函數(shù)里面，通過src判斷是request還是response。
request是指client給server發(fā)送請求。
response是指server返回數(shù)據(jù)給client。

func (h *httpStream) runResponse() {

        buf := bufio.NewReader(&h.r)
        defer tcpreader.DiscardBytesToEOF(buf)
        for {
                resp, err := http.ReadResponse(buf,nil)
                if err == io.EOF || err == io.ErrUnexpectedEOF {
                        // We must read until we see an EOF... very important!
                        return
                } else if err != nil {
                        log.Println("Error reading stream", h.net, h.transport, ":", err)
                        return
                } else {
                        bodyBytes := tcpreader.DiscardBytesToEOF(resp.Body)
                        resp.Body.Close()
                        printResponse(resp,h,bodyBytes)
                        // log.Println("Received response from stream", h.net, h.transport, ":", resp, "with", bodyBytes, "bytes in response body")
                }
        }
}
func (h *httpStream) runRequest() {

        buf := bufio.NewReader(&h.r)
        defer tcpreader.DiscardBytesToEOF(buf)
        for {
                req, err := http.ReadRequest(buf)
                if err == io.EOF || err == io.ErrUnexpectedEOF {
                        // We must read until we see an EOF... very important!
                        return
                } else if err != nil {
                        log.Println("Error reading stream", h.net, h.transport, ":", err)
                } else {
                        bodyBytes := tcpreader.DiscardBytesToEOF(req.Body)
                        req.Body.Close()
                        printRequest(req,h,bodyBytes)
                        // log.Println("Received request from stream", h.net, h.transport, ":", req, "with", bodyBytes, "bytes in request body")
                }
        }
}

使用http庫分析包，
分析的結(jié)果通過 printRequest,printReponse打印出來。

源代碼在 https://github.com/asmcos/goexample/blob/master/examples/httpassembly.go

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結(jié)合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點，簡書系信息發(fā)布平臺，僅提供信息存儲服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

  • Spring Cloud為開發(fā)人員提供了快速構(gòu)建分布式系統(tǒng)中一些常見模式的工具（例如配置管理，服務(wù)發(fā)現(xiàn)，斷路器，智...
    卡卡羅2017閱讀 136,569評論 19贊 139
  • 國家電網(wǎng)公司企業(yè)標(biāo)準(zhǔn)（Q/GDW）- 面向?qū)ο蟮挠秒娦畔?shù)據(jù)交換協(xié)議 - 報批稿：20170802 前言： 排版 ...
    庭說閱讀 12,425評論 6贊 13
  • 原文https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html...
    梁行之閱讀 1,379評論 0贊 0
  • 比如將原來托管在github上面的倉庫同時托管到osc（碼云）上面 1，首先在osc上面創(chuàng)建一個新的空倉庫，但是不...
    ArleyDu閱讀 926評論 1贊 0
  • 2018.5.20日貼 有一種喜悅，就是休憶春風(fēng)說舊事，緣花而坐，逢了知己！ ——麥琪的禮物
    迷鹿mirror閱讀 173評論 0贊 0

友情鏈接更多精彩內(nèi)容