Linux下通过虚拟网卡实现局域网 转发tcp/udp流量

linux下有tun/tap,可以虚拟出来一张网卡.

以下为个人理解:

比如你的网卡ip为192.169.8.138,当你的程序在监听192.169.8.138:55555端口时,流量就会从这个网卡经过.

经过是什么意思呢,tcp会有三次握手,那么握手的包便是走在这个网卡上,当你使用tcpdump -i tun111 -vvv -e -X 这个命令去抓tun111网卡的时候,就可以看到三次显示.这三次显示实际上是IP包,IP包内是TCP协议.   

而linux把所有设备都当成是一个文件,也就是说可以把这个网卡当成一个文件来读写,可以取得它的fd,类似的,socket也可以取得fd读写.当把一个IP包直接写入到网卡的fd时,网卡会认为这是一个新收到的报文,和通过网线进来的报文一样.

那么要构造一个,实际上要做的工作就是:把虚拟出来的网卡上的流量,转发(写入)到另一台机器的网卡上.

于是,可以通过一个通道,将网络两端的机器:

我们通过select监控本端的网卡的fd和连接两台机器的tcp socket的net_fd(连接建立后两端都会各自有这个fd,至于为什么是tcp?其实tcp over tcp并不好)

假设A端的虚拟网卡的ip上,我们新建一个tcp socket连接B,要发出握手的报文,那么在此时A的网卡上会被系统写入一个IP包,

通过select我们获取到这个信息,将它读取出来,通过net_fd发到对端B的socket上,B收到后再将它转而写入B自己的网卡,

那么在B的虚拟网卡上listen的socket就会获得这次握手. (注意分清连接两台机器的socket和我们测试握手的socket哦)

关于tun/tap的使用可以参考:

https://backreference.org/2010/03/26/tuntap-interface-tutorial/ 

那么,下面是实现.

步骤1.虚拟网卡:  A端作为主机,设置一张虚拟网卡和ip,运行程序(看后面代码)

ip tuntap add tun111 mode tun
ip addr add 192.168.8.138/24 dev tun111
ip link set dev tun111 up
./simple_ip  -i tun111 -s -d

B端,作为客户端

ip tuntap add tun111 mode tun
ip addr add 192.168.8.139/24 dev tun111
ip link set dev tun111 up
./simple_ip -i tun111 -c 35.240.237.210(对端的ip)

 

此时,A端会收到连接请求

那么,可以测试一下,在A端搭个服务器python -m SimpleHTTPServer 8000

B端访问192.168.138:8000即可下载其中文件

代码:在原文代码上做了修改,直接通过ip包头记录的报文长度读取整个报文.可以考虑加入多机的支持,需要增加对ip目的地址是否需要转发的判断

编译:g++ simple_ip.cc -o simple_ip

/**************************************************************************
 * simpletun.c                                                            *
 *                                                                        *
 * A simplistic, simple-minded, naive tunnelling program using tun/tap    *
 * interfaces and TCP. DO NOT USE THIS PROGRAM FOR SERIOUS PURPOSES.      *
 *                                                                        *
 * You have been warned.                                                  *
 *                                                                        *
 * (C) 2010 Davide Brini.                                                 *
 *                                                                        *
 * DISCLAIMER AND WARNING: this is all work in progress. The code is      *
 * ugly, the algorithms are naive, error checking and input validation    *
 * are very basic, and of course there can be bugs. If that's not enough, *
 * the program has not been thoroughly tested, so it might even fail at   *
 * the few simple things it should be supposed to do right.               *
 * Needless to say, I take no responsibility whatsoever for what the      *
 * program might do. The program has been written mostly for learning     *
 * purposes, and can be used in the hope that is useful, but everything   *
 * is to be taken "as is" and without any kind of warranty, implicit or   *
 * explicit. See the file LICENSE for further details.                    *
 *************************************************************************/ 

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include  
#include 
#include 
#include 
#include 
#include 
/* buffer for reading from tun/tap interface, must be >= 1500 */
#define BUFSIZE 2000   
#define CLIENT 0
#define SERVER 1
#define PORT 55559
typedef unsigned char       BYTE;
typedef unsigned short      WORD;
typedef unsigned long       DWORD;
using namespace std;
typedef struct tIPPackHead
{
 
	BYTE ver_hlen;      //IP协议版本和IP首部长度。高4位为版本，低4位为首部的长度(单位为4bytes)
	BYTE byTOS;       //服务类型
	WORD wPacketLen; //IP包总长度。包括首部，单位为byte。[Big endian]
	WORD wSequence;    //标识，一般每个IP包的序号递增。[Big endian]
 
	union
	{
		WORD Flags; //标志
		WORD FragOf;//分段偏移
	};
	BYTE byTTL;         //生存时间 
	BYTE byProtocolType; //协议类型，见PROTOCOL_TYPE定义
	WORD wHeadCheckSum;    //IP首部校验和[Big endian]
	DWORD dwIPSrc;         //源地址
	DWORD dwIPDes;         //目的地址
	//BYTE Options;          //选项
} IP_HEAD;


int debug;
char *progname;
int cnt;


int DecodeIP(char *buf, int len)
{
	int n = len;
	if (n >= sizeof(IP_HEAD))
	{
		IP_HEAD iphead;
		iphead = *(IP_HEAD*)buf;
 
		cout << "第 "<> 4) << endl;
		cout << "首部长度:" << ((iphead.ver_hlen & 0x0F) << 2) << endl;//单位为4字节
		cout << "服务类型:Priority: " << (iphead.byTOS >> 5) << ",Service: " << ((iphead.byTOS >> 1) & 0x0f) << endl;
		cout << "IP包总长度:" << ntohs(iphead.wPacketLen) << endl; //网络字节序转为主机字节序
		cout << "标识:" << ntohs(iphead.wSequence) << endl;
		cout << "标志位:" << "DF=" << ((iphead.Flags >> 14) & 0x01) << ",MF=" << ((iphead.Flags >> 13) & 0x01) << endl;
		cout << "片偏移:" << (iphead.FragOf & 0x1fff) << endl;
		cout << "生存周期:" << (int)iphead.byTTL << endl;
		cout << "协议类型:" << int(iphead.byProtocolType) << endl;
		cout << "首部校验和:" << ntohs(iphead.wHeadCheckSum) << endl;
		cout << "源地址:" << inet_ntoa(*(in_addr*)&iphead.dwIPSrc) << endl;
		cout << "目的地址:" << inet_ntoa(*(in_addr*)&iphead.dwIPDes) << endl;
 
		cout << "==============================================================" << endl << endl;
	}else{
        cout << "***包长不足：" << n << " < " << sizeof(IP_HEAD) << endl;
    }
    
	return 0;
}

/**************************************************************************
 * tun_alloc: allocates or reconnects to a tun/tap device. The caller     *
 *            must reserve enough space in *dev.                          *
 **************************************************************************/
int tun_alloc(char *dev, int flags) {

  struct ifreq ifr;
  int fd, err;
  char *clonedev = "/dev/net/tun";

  if( (fd = open(clonedev , O_RDWR)) < 0 ) {
    perror("Opening /dev/net/tun");
    return fd;
  }

  memset(&ifr, 0, sizeof(ifr));

  ifr.ifr_flags = flags;

  if (*dev) {
    strncpy(ifr.ifr_name, dev, IFNAMSIZ);
  }

  if( (err = ioctl(fd, TUNSETIFF, (void *)&ifr)) < 0 ) {
    perror("ioctl(TUNSETIFF)");
    close(fd);
    return err;
  }

  strcpy(dev, ifr.ifr_name);

  return fd;
}

/**************************************************************************
 * cread: read routine that checks for errors and exits if an error is    *
 *        returned.                                                       *
 **************************************************************************/
int cread(int fd, char *buf, int n){
  int nread;
  
  if((nread=read(fd, buf, n)) < 0){
    perror("Reading data");
    exit(1);
  }
  //DecodeIP(buf, nread);
  

  printf("read len:%d -> ", nread);
  for(int i = 0;i < nread;i++){
    printf("%x",buf[i]);
  }
  printf("\n");
  return nread;
}

/**************************************************************************
 * cwrite: write routine that checks for errors and exits if an error is  *
 *         returned.                                                      *
 **************************************************************************/
int cwrite(int fd, char *buf, int n){
  
  int nwrite;
  if((nwrite=write(fd, buf, n)) < 0){
    perror("Writing data");
    exit(1);
  }

  printf("write: ");
  for(int i = 0;i < n;i++){
  	printf("%x",buf[i]);
  }
  printf("\n");
  return nwrite;
}

/**************************************************************************
 * read_n: ensures we read exactly n bytes, and puts them into "buf".     *
 *         (unless EOF, of course)                                        *
 **************************************************************************/


int read_n(int fd, char *buf, int n) {

  int nread, left = n;

  while(left > 0) {
    if ((nread = cread(fd, buf, left)) == 0){
      return 0 ;      
    }else {
      left -= nread;
      buf += nread;
    }
  }
  return n;  
}

// 读取ipv4包头，获得需要继续读的长度
int read_ipv4_len_left(int fd ,char *buf){
    cout << "==read_ipv4_len_left==" << endl;
    int nread;
    nread = read_n(fd, buf, sizeof(IP_HEAD));
    cout << "==read_ipv4_len_left== -> read_n" << nread << endl;
    if (nread = 0){
        cout << "read_ipv4_len_left get 0." << endl;
        return 0;
    }
    
    IP_HEAD iphead;
    iphead = *(IP_HEAD*)buf;
    DecodeIP(buf, nread);
    int len_to_read = ntohs(iphead.wPacketLen) - sizeof(IP_HEAD);
    cout << "此IP包总长度:    " << ntohs(iphead.wPacketLen) << endl;
    cout << "剩余要读取的长度:" << len_to_read << endl;
    return len_to_read;
} 
/**************************************************************************
 * do_debug: prints debugging stuff (doh!)                                *
 **************************************************************************/
void do_debug(char *msg, ...){
  
  va_list argp;
  
  if(debug) {
	va_start(argp, msg);
	vfprintf(stderr, msg, argp);
	va_end(argp);
  }
}

/**************************************************************************
 * my_err: prints custom error messages on stderr.                        *
 **************************************************************************/
void my_err(char *msg, ...) {

  va_list argp;
  
  va_start(argp, msg);
  vfprintf(stderr, msg, argp);
  va_end(argp);
}

/**************************************************************************
 * usage: prints usage and exits.                                         *
 **************************************************************************/
void usage(void) {
  fprintf(stderr, "Usage:\n");
  fprintf(stderr, "%s -i  [-s|-c ] [-p ] [-u|-a] [-d]\n", progname);
  fprintf(stderr, "%s -h\n", progname);
  fprintf(stderr, "\n");
  fprintf(stderr, "-i : Name of interface to use (mandatory)\n");
  fprintf(stderr, "-s|-c : run in server mode (-s), or specify server address (-c ) (mandatory)\n");
  fprintf(stderr, "-p : port to listen on (if run in server mode) or to connect to (in client mode), default 55555\n");
  fprintf(stderr, "-u|-a: use TUN (-u, default) or TAP (-a)\n");
  fprintf(stderr, "-d: outputs debug information while running\n");
  fprintf(stderr, "-h: prints this help text\n");
  exit(1);
}

int main(int argc, char *argv[]) {
  cout << "ip 包头:" << sizeof(IP_HEAD) << endl;
  int tap_fd, option;
  int flags = IFF_TUN;
  char if_name[IFNAMSIZ] = "";
  int maxfd;
  uint16_t nread, nwrite, plength;
  char buffer[BUFSIZE];
  struct sockaddr_in local, remote;
  char remote_ip[16] = "";            /* dotted quad IP string */
  unsigned short int port = PORT;
  int sock_fd, net_fd, optval = 1;
  socklen_t remotelen;
  int cliserv = -1;    /* must be specified on cmd line */
  unsigned long int tap2net = 0, net2tap = 0;

  progname = argv[0];
  
  /* Check command line options */
  while((option = getopt(argc, argv, "i:sc:p:uahd")) > 0) {
    switch(option) {
      case 'd':
        debug = 1;
        break;
      case 'h':
        usage();
        break;
      case 'i':
        strncpy(if_name,optarg, IFNAMSIZ-1);
        break;
      case 's':
        cliserv = SERVER;
        break;
      case 'c':
        cliserv = CLIENT;
        strncpy(remote_ip,optarg,15);
        break;
      case 'p':
        port = atoi(optarg);
        break;
      case 'u':
        flags = IFF_TUN;
        break;
      case 'a':
        flags = IFF_TAP;
        break;
      default:
        my_err("Unknown option %c\n", option);
        usage();
    }
  }

  argv += optind;
  argc -= optind;

  if(argc > 0) {
    my_err("Too many options!\n");
    usage();
  }

  if(*if_name == '\0') {
    my_err("Must specify interface name!\n");
    usage();
  } else if(cliserv < 0) {
    my_err("Must specify client or server mode!\n");
    usage();
  } else if((cliserv == CLIENT)&&(*remote_ip == '\0')) {
    my_err("Must specify server address!\n");
    usage();
  }

  /* initialize tun/tap interface */
  if ( (tap_fd = tun_alloc(if_name, flags | IFF_NO_PI)) < 0 ) {
    my_err("Error connecting to tun/tap interface %s!\n", if_name);
    exit(1);
  }

  do_debug("Successfully connected to interface %s\n", if_name);

  if ( (sock_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
    perror("socket()");
    exit(1);
  }

  if(cliserv == CLIENT) {
    /* Client, try to connect to server */

    /* assign the destination address */
    memset(&remote, 0, sizeof(remote));
    remote.sin_family = AF_INET;
    remote.sin_addr.s_addr = inet_addr(remote_ip);
    remote.sin_port = htons(port);

    /* connection request */
    if (connect(sock_fd, (struct sockaddr*) &remote, sizeof(remote)) < 0) {
      perror("connect()");
      exit(1);
    }

    net_fd = sock_fd;
    do_debug("CLIENT: Connected to server %s\n", inet_ntoa(remote.sin_addr));
    
  } else {
    /* Server, wait for connections */

    /* avoid EADDRINUSE error on bind() */
    if(setsockopt(sock_fd, SOL_SOCKET, SO_REUSEADDR, (char *)&optval, sizeof(optval)) < 0) {
      perror("setsockopt()");
      exit(1);
    }
    
    memset(&local, 0, sizeof(local));
    local.sin_family = AF_INET;
    local.sin_addr.s_addr = htonl(INADDR_ANY);
    local.sin_port = htons(port);
    if (bind(sock_fd, (struct sockaddr*) &local, sizeof(local)) < 0) {
      perror("bind()");
      exit(1);
    }
    
    if (listen(sock_fd, 5) < 0) {
      perror("listen()");
      exit(1);
    }
    
    /* wait for connection request */
    remotelen = sizeof(remote);
    memset(&remote, 0, remotelen);
    if ((net_fd = accept(sock_fd, (struct sockaddr*)&remote, &remotelen)) < 0) {
      perror("accept()");
      exit(1);
    }

    do_debug("SERVER: Client connected from %s\n", inet_ntoa(remote.sin_addr));
  }
  
  /* use select() to handle two descriptors at once */
  maxfd = (tap_fd > net_fd)?tap_fd:net_fd;

  while(1) {
    int ret;
    fd_set rd_set;

    FD_ZERO(&rd_set);
    FD_SET(tap_fd, &rd_set); FD_SET(net_fd, &rd_set);

    ret = select(maxfd + 1, &rd_set, NULL, NULL, NULL);

    if (ret < 0 && errno == EINTR){
      continue;
    }

    if (ret < 0) {
      perror("select()");
      exit(1);
    }

    if(FD_ISSET(tap_fd, &rd_set)) {
      /* data from tun/tap: just read it and write it to the network */
      
      nread = cread(tap_fd, buffer, BUFSIZE);   // BUFSIZE 2000，一般不会超过ip包最长长度
      printf("tap recv ip packet ver：%x", (char)(*buffer));  
      if((char)(*buffer) == 0x45){ 
          tap2net++;
          do_debug("TAP2NET %lu: Read %d bytes from the tap interface\n", tap2net, nread);

          
          nwrite = cwrite(net_fd, buffer, nread);
          
          do_debug("TAP2NET %lu: Written %d bytes to the network\n", tap2net, nwrite);
          
      }else{
          printf("Not ipv4 packet, drop this.");
      }
      
    }

    if(FD_ISSET(net_fd, &rd_set)) {
      /* data from the network: read it, and write it to the tun/tap interface. 
       * We need to read the length first, and then the packet */

      /* Read length */      
      nread = read_ipv4_len_left(net_fd, (char *)buffer);
      if(nread == 0) {
          /* ctrl-c at the other end */
          cout << "get nread==0, break." << endl;
          break;
      }else{
          
      }
      net2tap++;
      
      char *whole_packet = (char *) malloc(sizeof(IP_HEAD) + nread);
      
      memcpy(whole_packet, buffer, sizeof(IP_HEAD));
      
      /* read packet */
      nread = read_n(net_fd, buffer, nread);
      memcpy(whole_packet + sizeof(IP_HEAD), buffer, nread);
      do_debug("NET2TAP %lu: Read %d bytes from the network\n", net2tap, nread);
      
      /* now buffer[] contains a full packet or frame, write it into the tun/tap interface */ 
      nwrite = cwrite(tap_fd, (char*)whole_packet, sizeof(IP_HEAD) + nread);
      do_debug("NET2TAP %lu: Written %d bytes to the tap interface\n", net2tap, nwrite);
    }
  }
  
  return(0);
}