代码修改来自 gopacket 的example
// Copyright 2012 Google, Inc. All rights reserved.
//
// Use of this source code is governed by a BSD-style license
// that can be found in the LICENSE file in the root of the source
// tree.
// This binary provides sample code for using the gopacket TCP assembler and TCP
// stream reader. It reads packets off the wire and reconstructs HTTP requests
// it sees, logging them.
package main
import (
"bufio"
"flag"
"io"
"log"
"net/http"
"time"
"fmt"
"github.com/google/gopacket"
"github.com/google/gopacket/examples/util"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"github.com/google/gopacket/tcpassembly"
"github.com/google/gopacket/tcpassembly/tcpreader"
)
var iface = flag.String("i", "en0", "Interface to get packets from")
var fname = flag.String("r", "", "Filename to read from, overrides -i")
var snaplen = flag.Int("s", 1600, "SnapLen for pcap packet capture")
var filter = flag.String("f", "tcp and port 80", "BPF filter for pcap")
var logAllPackets = flag.Bool("v", false, "Logs every packet in great detail")
// Build a simple HTTP request parser using tcpassembly.StreamFactory and tcpassembly.Stream interfaces
// httpStreamFactory implements tcpassembly.StreamFactory
type httpStreamFactory struct{}
// httpStream will handle the actual decoding of http requests.
type httpStream struct {
net, transport gopacket.Flow
r tcpreader.ReaderStream
}
func (h *httpStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
hstream := &httpStream{
net: net,
transport: transport,
r: tcpreader.NewReaderStream(),
}
src,_ := transport.Endpoints()
if fmt.Sprintf("%v",src) == "80" {
go hstream.runResponse() // Important... we must guarantee that data from the reader stream is read.
} else {
go hstream.runRequest() // Important... we must guarantee that data from the reader stream is read.
}
// ReaderStream implements tcpassembly.Stream, so we can return a pointer to it.
return &hstream.r
}
func (h *httpStream) runResponse() {
buf := bufio.NewReader(&h.r)
defer tcpreader.DiscardBytesToEOF(buf)
for {
resp, err := http.ReadResponse(buf,nil)
if err == io.EOF || err == io.ErrUnexpectedEOF {
// We must read until we see an EOF... very important!
return
} else if err != nil {
log.Println("Error reading stream", h.net, h.transport, ":", err)
return
} else {
bodyBytes := tcpreader.DiscardBytesToEOF(resp.Body)
resp.Body.Close()
printResponse(resp,h,bodyBytes)
// log.Println("Received response from stream", h.net, h.transport, ":", resp, "with", bodyBytes, "bytes in response body")
}
}
}
func (h *httpStream) runRequest() {
buf := bufio.NewReader(&h.r)
defer tcpreader.DiscardBytesToEOF(buf)
for {
req, err := http.ReadRequest(buf)
if err == io.EOF || err == io.ErrUnexpectedEOF {
// We must read until we see an EOF... very important!
return
} else if err != nil {
log.Println("Error reading stream", h.net, h.transport, ":", err)
} else {
bodyBytes := tcpreader.DiscardBytesToEOF(req.Body)
req.Body.Close()
printRequest(req,h,bodyBytes)
// log.Println("Received request from stream", h.net, h.transport, ":", req, "with", bodyBytes, "bytes in request body")
}
}
}
func printHeader(h http.Header){
for k,v := range h{
fmt.Println(k,v)
}
}
func printRequest(req *http.Request,h *httpStream,bodyBytes int){
fmt.Println("\n\r\n\r")
fmt.Println(h.net,h.transport)
fmt.Println("\n\r")
fmt.Println(req.Method, req.RequestURI, req.Proto)
printHeader(req.Header)
}
func printResponse(resp *http.Response,h *httpStream,bodyBytes int){
fmt.Println("\n\r")
fmt.Println(resp.Proto, resp.Status)
printHeader(resp.Header)
}
func main() {
defer util.Run()()
var handle *pcap.Handle
var err error
// Set up pcap packet capture
if *fname != "" {
log.Printf("Reading from pcap dump %q", *fname)
handle, err = pcap.OpenOffline(*fname)
} else {
log.Printf("Starting capture on interface %q", *iface)
handle, err = pcap.OpenLive(*iface, int32(*snaplen), true, pcap.BlockForever)
}
if err != nil {
log.Fatal(err)
}
if err := handle.SetBPFFilter(*filter); err != nil {
log.Fatal(err)
}
// Set up assembly
streamFactory := &httpStreamFactory{}
streamPool := tcpassembly.NewStreamPool(streamFactory)
assembler := tcpassembly.NewAssembler(streamPool)
log.Println("reading in packets")
// Read in packets, pass to assembler.
packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
packets := packetSource.Packets()
ticker := time.Tick(time.Minute)
for {
select {
case packet := <-packets:
// A nil packet indicates the end of a pcap file.
if packet == nil {
return
}
if *logAllPackets {
log.Println(packet)
}
if packet.NetworkLayer() == nil || packet.TransportLayer() == nil || packet.TransportLayer().LayerType() != layers.LayerTypeTCP {
log.Println("Unusable packet")
continue
}
tcp := packet.TransportLayer().(*layers.TCP)
assembler.AssembleWithTimestamp(packet.NetworkLayer().NetworkFlow(), tcp, packet.Metadata().Timestamp)
case <-ticker:
// Every minute, flush connections that haven't seen activity in the past 2 minutes.
assembler.FlushOlderThan(time.Now().Add(time.Minute * -2))
}
}
}
源代码可以编译执行。
结果：
192.168.1.104->198.13.57.90 65063->80
GET /http/ HTTP/1.1
Accept-Language [zh-CN,zh;q=0.9]
If-None-Match [W/"5ba2f652-c155"]
If-Modified-Since [Thu, 20 Sep 2018 01:22:26 GMT]
Upgrade-Insecure-Requests [1]
User-Agent [Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3528.4 Safari/537.36]
Accept [text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8]
Referer [http://go.xiulian.net.cn/url/]
Accept-Encoding [gzip, deflate]
Connection [keep-alive]
HTTP/1.1 304 Not Modified
Date [Thu, 20 Sep 2018 01:25:37 GMT]
Last-Modified [Thu, 20 Sep 2018 01:22:26 GMT]
Connection [keep-alive]
Etag ["5ba2f652-c155"]
Server [nginx/1.14.0 (Ubuntu)]
代码片段
streamFactory := &httpStreamFactory{}
streamPool := tcpassembly.NewStreamPool(streamFactory)
assembler := tcpassembly.NewAssembler(streamPool)
这部分主要是，通过tcpassembly 分析包，每一个包处理后，将调用streamFactory.new
func (h *httpStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
hstream := &httpStream{
net: net,
transport: transport,
r: tcpreader.NewReaderStream(),
}
src,_ := transport.Endpoints()
if fmt.Sprintf("%v",src) == "80" {
go hstream.runResponse() // Important... we must guarantee that data from the reader stream is read.
} else {
go hstream.runRequest() // Important... we must guarantee that data from the reader stream is read.
}
// ReaderStream implements tcpassembly.Stream, so we can return a pointer to it.
return &hstream.r
}
在new函数里面，通过src判断是request还是response。
request是指client给server发送请求。
response是指server返回数据给client。
func (h *httpStream) runResponse() {
buf := bufio.NewReader(&h.r)
defer tcpreader.DiscardBytesToEOF(buf)
for {
resp, err := http.ReadResponse(buf,nil)
if err == io.EOF || err == io.ErrUnexpectedEOF {
// We must read until we see an EOF... very important!
return
} else if err != nil {
log.Println("Error reading stream", h.net, h.transport, ":", err)
return
} else {
bodyBytes := tcpreader.DiscardBytesToEOF(resp.Body)
resp.Body.Close()
printResponse(resp,h,bodyBytes)
// log.Println("Received response from stream", h.net, h.transport, ":", resp, "with", bodyBytes, "bytes in response body")
}
}
}
func (h *httpStream) runRequest() {
buf := bufio.NewReader(&h.r)
defer tcpreader.DiscardBytesToEOF(buf)
for {
req, err := http.ReadRequest(buf)
if err == io.EOF || err == io.ErrUnexpectedEOF {
// We must read until we see an EOF... very important!
return
} else if err != nil {
log.Println("Error reading stream", h.net, h.transport, ":", err)
} else {
bodyBytes := tcpreader.DiscardBytesToEOF(req.Body)
req.Body.Close()
printRequest(req,h,bodyBytes)
// log.Println("Received request from stream", h.net, h.transport, ":", req, "with", bodyBytes, "bytes in request body")
}
}
}
使用http库分析包，
分析的结果通过 printRequest,printReponse打印出来。
源代码在 https://github.com/asmcos/goexample/blob/master/examples/httpassembly.go