通过netlink实时监控ARP缓存变更

通过netlink监控arp实时变更

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <errno.h>
#include <sys/types.h>
#include <asm/types.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/route.h>
#include <sys/stat.h>
#include <dirent.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <libconfig.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <syslog.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>

#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/sockios.h>

#define BIT_IP(x)    ((unsigned char*)&(x))
#define STR_IP(x)    BIT_IP(x)[0], BIT_IP(x)[1], BIT_IP(x)[2], BIT_IP(x)[3]
#define STR_IPH(x)    BIT_IP(x)[3], BIT_IP(x)[2], BIT_IP(x)[1], BIT_IP(x)[0]
#define FMT_IP        "%d.%d.%d.%d"

#ifndef NDA_RTA
#define NDA_RTA(r) \
    ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct ndmsg))))
#endif
#ifndef NDA_PAYLOAD
#define NDA_PAYLOAD(n)    NLMSG_PAYLOAD(n,sizeof(struct ndmsg))
#endif

void arp_parse_rattr(struct rtattr **tb, int max, struct rtattr *rta, int len)
{
    memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
    while (RTA_OK(rta, len)) {
        if ((rta->rta_type <= max) && (!tb[rta->rta_type]))
            tb[rta->rta_type] = rta;
        rta = RTA_NEXT(rta,len);
    }
    if (len)
        fprintf(stderr, "!!!Deficit %d, rta_len=%d\n", len, rta->rta_len);

    return;
}

const char *addr_to_mac(unsigned char *addr, int alen, char *buf, ssize_t blen)
{
    int i;
    int l;

    l = 0;
    for (i = 0; i < alen; i++) {
        if (i==0) {
            snprintf(buf+l, blen, "%02x", addr[i]);
            blen -= 2;
            l += 2;
        } else {
            snprintf(buf+l, blen, ":%02x", addr[i]);
            blen -= 3;
            l += 3;
        }
    }
    return buf;
}

static void read_netlink_message(int fd)
{
    char buff[128 * 1024] = {0};
    char *buf[1024] = {0};
    struct nlmsghdr *nh;
    struct ndmsg *ndmsg;
    int read_size;
    int len = 0;
    struct rtattr *tb[NDA_MAX + 1];

    read_size = read(fd, buff, sizeof(buff));
    if (read_size < 0) {
        return;
    }

    for (nh = (struct nlmsghdr*)buff; NLMSG_OK(nh, read_size);
        nh = NLMSG_NEXT(nh, read_size)) {
        switch (nh->nlmsg_type) {
        case RTM_NEWNEIGH:
            printf("add new arp cache\n");
            ndmsg = NLMSG_DATA(nh);
            if (ndmsg->ndm_family == AF_INET) {
                len = nh->nlmsg_len - NLMSG_SPACE(sizeof(struct ndmsg));
                arp_parse_rattr(tb, NDA_MAX, NDA_RTA(ndmsg), len);
                    if (tb[NDA_DST]) {
                        printf(""FMT_IP" %d\n", STR_IP(*(RTA_DATA(tb[NDA_DST]))), RTA_PAYLOAD(tb[NDA_DST]));
                    }
                    if (tb[NDA_LLADDR]) {
                        printf("%s %d\n", addr_to_mac(RTA_DATA(tb[NDA_LLADDR]),
                            RTA_PAYLOAD(tb[NDA_LLADDR]), buf, sizeof(buf)), RTA_PAYLOAD(tb[NDA_LLADDR]));
                    }
            }
            break;
        default:
            break;
        }
    }

    return;
}

int main(void)
{
    int fd;
    struct sockaddr_nl sa;
    fd_set rd_set;
    int ret;

    fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);

    bzero(&sa, sizeof(sa));

    sa.nl_family = AF_NETLINK;
    sa.nl_groups = RTM_NEWNEIGH | RTM_DELNEIGH;

    if ((bind(fd, (struct sockaddr *)&sa, sizeof(sa))) != 0) {
        perror("bind");
        return -1;
    }

    while (1) {
        FD_ZERO(&rd_set);
        FD_SET(fd, &rd_set);
        ret = select(fd + 1, &rd_set, NULL, NULL, NULL);
        if (ret < 0) {
            printf("select error\n");
            break;
        } else if (ret > 0) {
            if (FD_ISSET(fd, &rd_set)) {
                read_netlink_message(fd);
            }
        }
    }

    close(fd);
    return 0;
}