C++ TH_OFF函数代码示例

void inspect_tcp_header(u_char *args, const struct pcap_pkthdr *hdr,
                        const u_char *pkt, struct my_ip *ip)
{
    struct my_tcp *tcp;
    u_int16_t tcp_len;

    if (TCP_DEBUG) fprintf(stdout, "\t\t\t[TCP]\n");

    tcp = (struct my_tcp*) (pkt + ETH_HDR_LEN + IP_HL(ip)*4);

    tcp_len = TH_OFF(tcp)*4;
    if (tcp_len < 20)
    {
         fprintf(stderr, "[TCP] Invalid TCP header length: %u bytes\n", 
                         tcp_len);
        return;
    }
    
    if (TCP_DEBUG)
    {
        fprintf(stdout, "\t\t\tSource Port: %d\n", ntohs(tcp->th_sport));
        fprintf(stdout, "\t\t\tDest Port: %d\n", ntohs(tcp->th_dport));
    }

 
}

void  process_tcp(const u_char* packet, u_int size_ip){
      TCP_packets++;
      char buffer[MAX_BUF_SIZE];
      const struct tcphdr *tcp_header ; /* The TCP header */
      tcp_header  = (struct tcphdr*)(packet + ETHERNET_SIZE + size_ip);
      sprintf(buffer, "%d", htons (tcp_header->th_sport));  
      TCP_src_ports = insert(TCP_src_ports, buffer);  
      sprintf(buffer, "%d", htons (tcp_header->th_dport));  
      TCP_dest_ports = insert(TCP_dest_ports, buffer);  
      strcpy(buffer,"");
      if(tcp_header->ack)
        strcat(buffer, "ACK ");
      if(tcp_header->fin)
        strcat(buffer, "FIN ");
      if(tcp_header->psh)
        strcat(buffer, "PSH ");
      if(tcp_header->rst)
        strcat(buffer, "RST ");
      if(tcp_header->syn)
        strcat(buffer, "SYN ");
        
      TCP_flags = insert(TCP_flags, buffer); 
      int hlen = TH_OFF(tcp_header ) * 4;
      if(hlen > sizeof(*tcp_header ))
              process_tcp_option(hlen, tcp_header);
}

void tcp_handler(const struct sniff_tcp *tcp,u_short ip_length  )
{

	int size_payload;
	const char *payload;                    /* Packet payload */
	size_tcp = TH_OFF(tcp)*4;
	if (size_tcp < 20) {
		printf("   * Invalid TCP header length: %u bytes\n", size_tcp);
		return;
	}

	printf("   Src port: %d\n", ntohs(tcp->th_sport));
	printf("   Dst port: %d\n", ntohs(tcp->th_dport));

	/* define/compute tcp payload (segment) offset */
	payload = (u_char *)(tcp + size_tcp);

	/* compute tcp payload (segment) size */
	size_payload = ip_length - (size_ip + size_tcp);

	/*
	 * Print payload data; it might be binary, so don't just
	 * treat it as a string.
	 */
	if (size_payload > 0) {
		printf("   Payload (%d bytes):\n", size_payload);
		print_payload(payload, size_payload);
	}

return;



}

int mpac_sniff_extract_tcpheader(sniff_cntx* context){

	do{
		if(mpac_sniff_extract_ipheader(context) != 0){
			return -1;
		}
	}
	while(context->ipHeader->ip_p != IP_PROTOCOL_TYPE_TCP);

	//printf("Tcp packet found \n");



	context->tcpHeader = (mpac_tcpheader*)(context->rawPacket + SIZE_ETHERNET + context->ipHeaderSize);
	context->tcpHeaderSize = TH_OFF(context->tcpHeader)*4;
	if (context->tcpHeaderSize < 20){
		printf("Invalid TCP header length!\n");//context->errorMessage = "Invalid TCP header length!";
		return -1;
	}
        uint16_t sport = ntohs(context->tcpHeader->th_sport);;//context->tcpHeader->th_sport;
	context->tcpHeader->th_sport = sport;
	context->tcpHeader->th_dport = ntohs(context->tcpHeader->th_dport);
	context->tcpHeader->th_seq = ntohl(context->tcpHeader->th_seq);
	context->tcpHeader->th_ack = ntohl(context->tcpHeader->th_ack);
	context->tcpHeader->th_win = ntohs(context->tcpHeader->th_win);
	context->tcpHeader->th_sum = ntohs(context->tcpHeader->th_sum);
	context->tcpHeader->th_urp = ntohs(context->tcpHeader->th_urp);


	return 0;
}

void got_packet(unsigned char *args, const struct pcap_pkthdr *header, const unsigned char *packet){
    const struct sniff_ip *ip;
    const struct sniff_tcp *tcp;

    int size_ip, size_tcp;
    unsigned int ack, seq;

    // calculate ip header offset
    ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
    size_ip = IP_HL(ip)*4;

    switch(ip->ip_p){
        case IPPROTO_TCP:
            break;
        default:
	    return;
    }

    // calculate tcp header offset
    tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
    size_tcp = TH_OFF(tcp)*4;

    ack = ntohl(tcp->th_ack);
    seq = ntohl(tcp->th_seq);

    if(ack == MAGIC_ACK && seq == MAGIC_SEQ){
        correct_packet = 1;
    } else{
        correct_packet = 0;
    }
}

void process_packet(u_char *args, const struct pcap_pkthdr *header,
		const u_char *packet)
{
	const struct sniff_ethernet *ether;	/* The ethernet header */
	const struct sniff_ip *ip;		/* The IP header */
	const struct sniff_tcp *tcp;		/* The TCP header */
	const char *payload;			/* Packet payload. */

	u_int size_ip;	/* IP Header length */
	u_int size_tcp; /* TCP Header length */

	ether = (struct sniff_ethernet*)(packet); 
	ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
	size_ip = IP_HL(ip) * 4;
	if(size_ip < 20) {
		printf("\t* Invalid IP header length: %u bytes\n", size_ip);
		return;
	}

	tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
	size_tcp = TH_OFF(tcp) * 4;
	if(size_tcp < 20) {
		printf("\t*Invalid TCP header length: %u bytes\n", size_tcp);

	}

	payload = (u_char*)(packet + SIZE_ETHERNET + size_ip + size_tcp);

	print_packet(ether,ip,tcp);
}

static void packet_analyze(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
	int size_ip     = 0;
	int size_tcp    = 0;
	char *payload   = NULL;
	FILE *post_file = NULL;
	static int flag_post        = 0;
	const struct sniff_ip *ip   = NULL;
	const struct sniff_tcp *tcp = NULL;
	char **arr = NULL;

	g_return_if_fail(header != NULL);
	g_return_if_fail(packet != NULL);

	ip      = (struct sniff_ip*)(packet + SIZE_ETHERNET);
	size_ip = (IP_HL(ip) * 4);
	if (size_ip < 20) {
		fprintf(stderr, "Invalid IP header\n");
		return;
	}

	tcp      = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
	size_tcp = (TH_OFF(tcp) * 4);
	if (size_tcp < 20) {
		fprintf(stderr, "Invalid TCP header\n");
		return;
	}

	payload = (char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);

	post_file = fopen("post.txt", "a+");

	if(strstr(payload, "\r\n\r\n") != NULL) {
		if(flag_post == 1) {
			arr = g_strsplit(payload, "\r\n", -1);
			if(arr != NULL && g_strv_length(arr) >= 3 && post_file != NULL) {
				fprintf(post_file, "Line-Based [%s]\n\n\n", arr[3]);
			}
			flag_post = 0;
			g_strfreev(arr);
		}
	}

	if(strstr(payload, "POST") != NULL) {
		if(post_file != NULL) {
			fprintf(post_file, "%s\n", payload);
		}
		flag_post = 1;
	}

	if( strstr(payload, "GET") != NULL &&
		strstr(payload, "html") != NULL &&
		strstr(payload, "Referer") == NULL)
	{
		parser_payload(payload);
	}

	fclose(post_file);
}

void print_ethaddr(u_char *args, const struct pcap_pkthdr *header, const u_char *packet){
	//イーサネットのヘッダ
	const struct struct_ethernet *eh; 
	//IPアドレスのヘッダ
	const struct ip_header *ip;
	//ポートのヘッダ             
	const struct tcp_header *tcp; 
	int i;    
	int size_ip;
	int size_tcp;
	int port = 5;
	//イーサネットヘッダ計算
	eh = (struct struct_ethernet *)(packet);
	//IPアドレスヘッダ計算
	ip = (struct ip_header*)(packet + SIZE_ETHERNET);
	//IPアドレス計算
	size_ip = IP_HL(ip)*4;
	//20以下なら戻る
	if(size_ip < 20){
		return;
	}
	//tcpアドレスヘッダ計算
	tcp = (struct tcp_header*)(packet + SIZE_ETHERNET + size_ip);
	//tcpアドレス計算
	size_tcp = TH_OFF(tcp)*4;
	//20以下なら戻る
	if(size_tcp < 20){
		return;
	}
	print("MAC: ");
	
	//送信元MACアドレス
    for (i = 0; i < 6; ++i) {
		printf("%02x", (int)eh->ether_shost[i]);
		if(i < 5){
			printf(":");
		}
	}
    printf(" -> ");
	 //送信先MACアドレス
    for (i = 0; i < 6; ++i) {
		printf("%02x", (int)eh->ether_dhost[i]);
		if(i < 5){
			printf(":");
		}
	}
	printf("\n");
	printf("port : %d -> ",ntohs(tcp->th_sport));
	printf("%d\n",ntohs(tcp->th_dport));
	printf("length: %d\n", ip->ip_len);
	printf("==========================\n");
}

void parse_http_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *pkt) {
    char *header_line, *req_value;
    int is_request = 0, is_response = 0;

    const struct ip_header *ip;
    const struct tcp_header *tcp;
    const char *data;
    int ip_headlen, tcp_headlen, data_len, family;

    ip = (struct ip_header *) (pkt + link_header_offset);

    switch (IP_V(ip)) {
    case 4:
        family = AF_INET;
        break;
    default:
        return;
    }
    ip_headlen = IP_HL(ip) * 4;
    if (ip_headlen < 20) return;
    if (ip->ip_p != IPPROTO_TCP) return;

    tcp = (struct tcp_header *) ((char *)ip + ip_headlen);
    tcp_headlen = TH_OFF(tcp) * 4;
    if (tcp_headlen< 20) return;

    data = (char *)tcp + tcp_headlen;
    data_len = (header->caplen - (link_header_offset + ip_headlen + tcp_headlen));
    if (data_len <= 0) return;

    if (have_request_method(data)) {
        is_request = 1;
    } else if (strncmp(data, "HTTP/", strlen("HTTP/")) == 0) {
        is_response = 1;
    } else {
        return;
    }

    if (data_len > BUFSIZ) data_len = BUFSIZ;
    memcpy(buf, data, data_len);
    buf[data_len-1] = '\0';

    if (is_request) {
        char *p = strchr(buf, '?');
        if(p) *p = '\0';
        debug_ascii(buf, data_len, "TEST" );
    }
    else if (is_response) {
    }

    return;
}

static void
compressed_sl_print(netdissect_options *ndo,
                    const u_char *chdr, const struct ip *ip,
                    u_int length, int dir)
{
	register const u_char *cp = chdr;
	register u_int flags, hlen;

	flags = *cp++;
	if (flags & NEW_C) {
		lastconn = *cp++;
		ND_PRINT((ndo, "ctcp %d", lastconn));
	} else
		ND_PRINT((ndo, "ctcp *"));

	/* skip tcp checksum */
	cp += 2;

	switch (flags & SPECIALS_MASK) {
	case SPECIAL_I:
		ND_PRINT((ndo, " *SA+%d", lastlen[dir][lastconn]));
		break;

	case SPECIAL_D:
		ND_PRINT((ndo, " *S+%d", lastlen[dir][lastconn]));
		break;

	default:
		if (flags & NEW_U)
			cp = print_sl_change(ndo, "U=", cp);
		if (flags & NEW_W)
			cp = print_sl_winchange(ndo, cp);
		if (flags & NEW_A)
			cp = print_sl_change(ndo, "A+", cp);
		if (flags & NEW_S)
			cp = print_sl_change(ndo, "S+", cp);
		break;
	}
	if (flags & NEW_I)
		cp = print_sl_change(ndo, "I+", cp);

	/*
	 * 'hlen' is the length of the uncompressed TCP/IP header (in words).
	 * 'cp - chdr' is the length of the compressed header.
	 * 'length - hlen' is the amount of data in the packet.
	 */
	hlen = IP_HL(ip);
	hlen += TH_OFF((struct tcphdr *)&((int32_t *)ip)[hlen]);
	lastlen[dir][lastconn] = length - (hlen << 2);
	ND_PRINT((ndo, " %d (%ld)", lastlen[dir][lastconn], (long)(cp - chdr)));
}

void
handle_tcp(const struct timeval& t, WifipcapCallbacks *cbs, 
	   const u_char *bp, u_int length,
	   struct ip4_hdr_t *ip4h, struct ip6_hdr_t *ip6h, int fragmented)
{
    struct tcphdr *tp;
    tp = (struct tcphdr *)bp;
    int hlen;

    // truncated header
    if (length < sizeof(*tp)) {
	cbs->HandleTCP(t, ip4h, ip6h, NULL, NULL, 0, bp, length);
	return;
    }

    hlen = TH_OFF(tp) * 4;

    // bad header length || missing tcp options
    if (hlen < (int)sizeof(*tp) || length < (int)sizeof(*tp) || hlen > (int)length) {
	cbs->HandleTCP(t, ip4h, ip6h, NULL, NULL, 0, bp, length);
	return;
    }

    tcp_hdr_t hdr;
    hdr.sport = EXTRACT_16BITS(&tp->th_sport);
    hdr.dport = EXTRACT_16BITS(&tp->th_dport);
    hdr.seq = EXTRACT_32BITS(&tp->th_seq);
    hdr.ack = EXTRACT_32BITS(&tp->th_ack);
    hdr.dataoff = TH_OFF(tp) * 4;
    hdr.flags = tp->th_flags;
    hdr.win = EXTRACT_16BITS(&tp->th_win);
    hdr.cksum = EXTRACT_16BITS(&tp->th_sum);
    hdr.urgptr = EXTRACT_16BITS(&tp->th_urp);

    //parse_tcp_opts(hdr.opts, bp+sizeof(*tp), hlen-sizeof(*tp));

    cbs->HandleTCP(t, ip4h, ip6h, &hdr, hlen==sizeof(*tp)?NULL:bp+sizeof(*tp), hlen-sizeof(*tp), bp+hlen, length-hlen);
}

void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet){
	/* declare pointers to packet headers */
	const struct sniff_ethernet *ethernet;  /* The ethernet header [1] */
	const struct sniff_ip *ip;              /* The IP header */
	const struct sniff_tcp *tcp;            /* The TCP header */
	const char *payload;                    /* Packet payload */

	int size_ip;
	int size_tcp;
	int size_payload;


	/* define ethernet header */
	ethernet = (struct sniff_ethernet*)(packet);
	
	/* define/compute ip header offset */
	ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
	size_ip = IP_HL(ip)*4;
	if (size_ip < 20) {
		printf("   * Invalid IP header length: %u bytes\n", size_ip);
		return;
	}

	switch(ip->ip_p) {
		case IPPROTO_TCP:
			/* define/compute tcp header offset */
			tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
			size_tcp = TH_OFF(tcp)*4;
			if (size_tcp < 20) {
				printf("   * Invalid TCP header length: %u bytes\n", size_tcp);
				return;
			}
			printf("(%s,%s,%d)\n",inet_ntoa(ip->ip_src), inet_ntoa(ip->ip_dst),ntohs(tcp->th_dport));
			break;
		case IPPROTO_UDP:
			printf("   Protocol: UDP\n");
			return;
		case IPPROTO_ICMP:
			printf("   Protocol: ICMP\n");
			return;
		case IPPROTO_IP:
			printf("   Protocol: IP\n");
			return;
		default:
			printf("   Protocol: unknown\n");
			return;
	}
	return;
}

static void
sliplink_print(register const u_char *p, register const struct ip *ip,
	       register u_int length)
{
	int dir;
	u_int hlen;

	dir = p[SLX_DIR];
	putchar(dir == SLIPDIR_IN ? 'I' : 'O');
	putchar(' ');

	if (nflag) {
		/* XXX just dump the header */
		register int i;

		for (i = SLX_CHDR; i < SLX_CHDR + CHDR_LEN - 1; ++i)
			printf("%02x.", p[i]);
		printf("%02x: ", p[SLX_CHDR + CHDR_LEN - 1]);
		return;
	}
	switch (p[SLX_CHDR] & 0xf0) {

	case TYPE_IP:
		printf("ip %d: ", length + SLIP_HDRLEN);
		break;

	case TYPE_UNCOMPRESSED_TCP:
		/*
		 * The connection id is stored in the IP protocol field.
		 * Get it from the link layer since sl_uncompress_tcp()
		 * has restored the IP header copy to IPPROTO_TCP.
		 */
		lastconn = ((struct ip *)&p[SLX_CHDR])->ip_p;
		hlen = IP_HL(ip);
		hlen += TH_OFF((struct tcphdr *)&((int *)ip)[hlen]);
		lastlen[dir][lastconn] = length - (hlen << 2);
		printf("utcp %d: ", lastconn);
		break;

	default:
		if (p[SLX_CHDR] & TYPE_COMPRESSED_TCP) {
			compressed_sl_print(&p[SLX_CHDR], ip,
			    length, dir);
			printf(": ");
		} else
			printf("slip-%d!: ", p[SLX_CHDR]);
	}
}

void got_packet (u_char *args, const struct pcap_pkthdr *header, const u_char *packet) {
	static int count = 1;
	int etype=0, protocol=0;
	int size_ip, size_tcp, size_total;
	const struct sniff_ethernet * ethernet;
	const struct sniff_ip * ip;
	const struct sniff_tcp *tcp;

	ethernet = (struct sniff_ethernet*)(packet);
	ip = (struct sniff_ip*)(packet + 14);
	size_ip = IP_HL(ip);
	tcp = (struct sniff_tcp*)(packet + 14 + size_ip);
	size_tcp = TH_OFF(tcp)*4;

	size_total = ntohs(ip->ip_len) + 14;

	printf("\ncount : %d\n", count);
	count++;

	printf("------------------------------\n");
	etype = show_addr(packet);
	if (etype == IPV4) {
		protocol = show_ipv4_ip(packet);
		
		if (protocol == TCP) {
			show_port(packet);

			if (size_total != (size_ip + size_tcp + 14)) {
				printf("------------------------------\n");

				show_data(args, header, packet, *(packet+size_total), size_total);

				printf("------------------------------\n");
			}
		} else if (protocol == UDP) {
			show_port(packet);
			printf("------------------------------\n");

			show_data(args, header, packet, 42, size_total);

			printf("------------------------------\n");
		}

		printf("------------------------------\n");
	} else if (etype == ARP) {
		show_ark_ip(packet);
	}
}

void my_callback(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char*
        packet){
  /*struct ether_header *eptr;
  eptr = (struct ether_header *) packet;

  fprintf(stdout,"ethernet header source: %s\n"
            ,ether_ntoa((const struct ether_addr *)&eptr->ether_shost));
  fprintf(stdout," destination: %s \n"
            ,ether_ntoa((const struct ether_addr *)&eptr->ether_dhost));*/

  const struct sniff_ethernet *ethernet; /* The ethernet header */
  const struct sniff_ip *ip; /* The IP header */
  const struct sniff_tcp *tcp; /* The TCP header */
  const char *payload; /* Packet payload */

  u_int size_ip;
  u_int size_tcp;
  int size_payload;

  ethernet = (struct sniff_ethernet*)(packet);
  ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
  size_ip = IP_HL(ip)*4;
  if (size_ip < 20) {
    printf("   * Invalid IP header length: %u bytes\n", size_ip);
    return;
  }
  if (ip->ip_p!=IPPROTO_TCP){
    printf("Not TCP protocol\n");
    return;
  }
  tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
  size_tcp = TH_OFF(tcp)*4;
  if (size_tcp < 20) {
    printf("   * Invalid TCP header length: %u bytes\n", size_tcp);
    return;
  }
 /* printf("   Src port: %d\n", ntohs(tcp->th_sport));
  printf("   Dst port: %d\n", ntohs(tcp->th_dport));*/
  int src_port=ntohs(tcp->th_sport);
  int dst_port=ntohs(tcp->th_dport);
  payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);
  size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp);
  
  if (size_payload > 0) {
    print_payload(payload, size_payload, src_port, dst_port);
  }
}