Chinaunix首页 | 论坛 | 博客

wangcong02345wangcong02345.blog.chinaunix.net

首页　| 　博文目录　| 　关于我

wangcong02345

  • 博客访问： 2151573
  • 博文数量： 438
  • 博客积分： 3871
  • 博客等级： 中校
  • 技术积分： 6075
  • 用 户 组： 普通用户
  • 注册时间： 2011-09-10 00:11
个人简介

邮箱: wangcong02345@163.com

文章分类

全部博文（438）

文章存档

2017年（15）

2016年（119）

2015年（91）

2014年（62）

2013年（56）

2012年（79）

2011年（16）

我的朋友
最近访客
推荐博文
相关博文
busybox分析--6.arping

分类： LINUX

2015-07-01 11:33:10

1. 向指定的IP地址发送ARP请求
  1. cong@msi:/work/busybox$ sudo ./_install/busybox arping 192.168.4.1
  2. arping: interface eth0 not found: No such device

  4. cong@msi:/work/busybox$ sudo ./_install/busybox arping -I eth2 192.168.4.1
  5. ARPING to 192.168.4.1 from 192.168.4.68 via eth2
  6. Unicast reply from 192.168.4.1 [10:d:f:1:2f:d0] 0.765ms
  7. Unicast reply from 192.168.4.1 [10:d:f:1:2f:d0] 0.623ms
  8. Unicast reply from 192.168.4.1 [10:d:f:1:2f:d0] 0.738ms
  9. ^CSent 3 probe(s) (1 broadcast(s))
  10. Received 3 reply (0 request(s), 0 broadcast(s))
2. 源码
  1. cong@msi:/work/test/busytest/3arping$ cat arping.c
  2. #define _GNU_SOURCE /* See feature_test_macros(7) */
  3. #include "utils.h"
  4. #include <net/if.h>
  5. #include <linux/sockios.h>
  6. #include <linux/if_packet.h>
  7. #include <linux/if_ether.h>
  8. #include <net/if_arp.h>
  9. #include <string.h>
  10. #include <net/ethernet.h>
  11. #include <netinet/ether.h>
  12. # define move_from_unaligned32(v, u32p) (memcpy(&(v), (u32p), 4))

  14. static int recv_pack(unsigned char *buf, int len, struct sockaddr_ll *FROM, struct in_addr src,struct in_addr dst ,struct sockaddr_ll me, struct sockaddr_ll he)
  15. {
  16.     //该函数对接收到的packet进行解析
  17.     struct arphdr *ah = (struct arphdr *) buf;
  18.     unsigned char *p = (unsigned char *) (ah + 1);
  19.     struct in_addr src_ip, dst_ip;
  20.     /* moves below assume in_addr is 4 bytes big, ensure that */
  21.     struct BUG_in_addr_must_be_4 {
  22.         char BUG_in_addr_must_be_4[
  23.             sizeof(struct in_addr) == 4 ? 1 : -1
  24.             ];
  25.         char BUG_s_addr_must_be_4[
  26.             sizeof(src_ip.s_addr) == 4 ? 1 : -1
  27.             ];
  28.     };
  29.     /* Filter out wild packets */
  30.     if (FROM->sll_pkttype != PACKET_HOST
  31.             && FROM->sll_pkttype != PACKET_BROADCAST
  32.             && FROM->sll_pkttype != PACKET_MULTICAST)
  33.         return -1;

  35.     //检查回复类型,此处应当是REPLY
  36.     if (ah->ar_op != htons(ARPOP_REQUEST) && ah->ar_op != htons(ARPOP_REPLY))
  37.         return -1;

  39.     /* ARPHRD check and this darned FDDI hack here :-( */
  40.     if (ah->ar_hrd != htons(FROM->sll_hatype)
  41.             && (FROM->sll_hatype != ARPHRD_FDDI || ah->ar_hrd != htons(ARPHRD_ETHER)))
  42.         return -1;
  43.     //检查协议类型:必须是IP
  44.     if (ah->ar_pro != htons(ETH_P_IP)
  45.             || (ah->ar_pln != 4)
  46.             || (ah->ar_hln != me.sll_halen)
  47.             || (len < (int)(sizeof(*ah) + 2 * (4 + ah->ar_hln))))
  48.         return -1;

  50.     move_from_unaligned32(src_ip.s_addr, p + ah->ar_hln);
  51.     move_from_unaligned32(dst_ip.s_addr, p + ah->ar_hln + 4 + ah->ar_hln);

  53.     if (dst.s_addr != src_ip.s_addr)
  54.         return -1;
  55.     if ((src.s_addr != dst_ip.s_addr)
  56.             || (memcmp(p + ah->ar_hln + 4, &me.sll_addr, ah->ar_hln)))
  57.         return -1;

  59.     int s_printed = 0;

  61.     printf("%scast re%s from %s [%s]",
  62.             FROM->sll_pkttype == PACKET_HOST ? "Uni" : "Broad",
  63.             ah->ar_op == htons(ARPOP_REPLY) ? "ply" : "quest",
  64.             inet_ntoa(src_ip),
  65.             ether_ntoa((struct ether_addr *) p));
  66.     if (dst_ip.s_addr != src.s_addr) {
  67.         printf("for %s ", inet_ntoa(dst_ip));
  68.         s_printed = 1;
  69.     }
  70.     if (memcmp(p + ah->ar_hln + 4, me.sll_addr, ah->ar_hln)) {
  71.         if (!s_printed)
  72.             printf("for ");
  73.         printf("[%s]",
  74.                 ether_ntoa((struct ether_addr *) p + ah->ar_hln + 4));
  75.     }
  76.     printf("\n");

  78.     memcpy(he.sll_addr, p, me.sll_halen);
  79.     return 0;
  80. }

  82. static int send_pack(int sock_fd, struct in_addr *src_addr,
  83.         struct in_addr *dst_addr, struct sockaddr_ll *ME,
  84.         struct sockaddr_ll *HE)
  85. {
  86.     int err;
  87.     unsigned char buf[256];
  88.     struct arphdr *ah = (struct arphdr *) buf;
  89.     unsigned char *p = (unsigned char *) (ah + 1);
  90.     //以下的字符都是按照抓包的顺序填充的
  91.     //但是没有ARP字样，是不是跟bind有关？
  92.     ah->ar_hrd = htons(ARPHRD_ETHER);   //00 01 :Ethernet
  93.     ah->ar_pro = htons(ETH_P_IP);       //0800  :IP
  94.     ah->ar_hln = ME->sll_halen;
  95.     ah->ar_pln = 4;
  96.     ah->ar_op = htons(ARPOP_REQUEST);

  98.     p = mempcpy(p, &ME->sll_addr, ah->ar_hln);
  99.     p = mempcpy(p, src_addr, 4);

  101.     p = mempcpy(p, &HE->sll_addr, ah->ar_hln);
  102.     p = mempcpy(p, dst_addr, 4);

  104.     err = sendto(sock_fd, buf, p-buf, 0, (struct sockaddr *)HE, sizeof(*HE));
  105.     if(err<0)
  106.     {
  107.         dbmsg("%s",strerror(errno));
  108.         return -1;
  109.     }
  110.     return err;
  111. }

  113. int get_local_ipaddr(const char* iface, struct in_addr* inaddr)
  114. {
  115.     int probe_fd;
  116.     int ret;
  117.     struct ifreq ifr;
  118.     if( (probe_fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
  119.     {
  120.         dbmsg("%s",strerror(errno));
  121.         return -1;
  122.     }
  123.     strncpy(ifr.ifr_name, iface, strlen(iface)+1);
  124.     if(ioctl(probe_fd, SIOCGIFADDR, &ifr))
  125.     {
  126.         dbmsg("%s",strerror(errno));
  127.         return -1;
  128.     }
  129.     //dbmsg("%s", inet_ntoa(((struct sockaddr_in*)&(ifr.ifr_addr))->sin_addr));
  130.     mempcpy(inaddr, &(((struct sockaddr_in*)&(ifr.ifr_addr))->sin_addr), sizeof(struct in_addr));
  131.     close(probe_fd);
  132.     return 0;
  133. }

  135. int main ( int argc, char *argv[] )
  136. {
  137.     char packet[4096];
  138.     int sockfd, ret;
  139.     struct ifreq ifr;
  140.     struct in_addr src,dst;
  141.     const char *device = "eth2";
  142.     struct sockaddr_ll me, he;
  143.     if(argc < 2)
  144.     {
  145.         dbmsg("usage: arping ");
  146.         return -1;
  147.     }
  148.     //1. create socket
  149.     if( (sockfd = socket(AF_PACKET, SOCK_DGRAM, 0)) < 0)
  150.     {
  151.         dbmsg("%s",strerror(errno));
  152.         return -1;
  153.     }
  154.     //2. check if eth2 exist, get eth2 index
  155.     memset(&ifr, 0, sizeof(ifr));
  156.     strncpy(ifr.ifr_name, device, strlen(device)+1);
  157.     if( (ret = ioctl(sockfd, SIOCGIFINDEX, &ifr)) < 0)
  158.     {
  159.         dbmsg("%s",strerror(errno));
  160.         return -1;
  161.     }
  162.     me.sll_ifindex = ifr.ifr_ifindex;    //获取本机eth2的index,此处是2

  164.     ioctl(sockfd, SIOCGIFFLAGS, (char*)&ifr);
  165.     if(!(ifr.ifr_flags & IFF_UP))       //检查eth2是否是UP状态,DOWN的话就没法玩了
  166.     {
  167.         dbmsg("%s is down",device);
  168.         return -1;
  169.     }
  170.     if(ifr.ifr_flags & (IFF_NOARP|IFF_LOOPBACK)) //检查eth2是不是可以发送ARP
  171.     {
  172.         dbmsg("%s is not ARPable",device);
  173.         return -1;
  174.     }

  176.     //3. get local IP addr
  177.     get_local_ipaddr(device, &src);    //获取本机eth2的ip地址
  178.     inet_aton(argv[1], &dst);          //argv[1]是dst的ip地址
  179.     dbmsg("src=%s", inet_ntoa(src));
  180.     dbmsg("dst=%s", inet_ntoa(dst));

  182.     //4. send packet to dst
  183.     me.sll_family = AF_PACKET;
  184.     me.sll_protocol = htons(ETH_P_ARP);
  185.     bind(sockfd, (struct sockaddr*)&me, sizeof(me));     //这儿bind的作用可能很重要，不过没有太明白
  186.     socklen_t alen = sizeof(me);
  187.     getsockname(sockfd, (struct sockaddr *) &me, &alen);
  188.     if(me.sll_halen == 0)
  189.     {
  190.         dbmsg("not ARPable");
  191.         return -1;
  192.     }
  193.     he = me;
  194.     memset(he.sll_addr, -1, he.sll_halen);     //dst的mac地址是ff:ff:ff:ff:ff,广播地址
  195.     send_pack(sockfd, &src, &dst, &me, &he);


  198.     //5. recv packet from dst
  199.     struct sockaddr_ll from;
  200.     alen = sizeof(from);
  201.     ret = recvfrom(sockfd, packet, 4096, 0, (struct sockaddr*)&from, &alen);
  202.     recv_pack(packet, ret, &from, src, dst, me, he);

  204.     return EXIT_SUCCESS;
  205. }
3.运行结果:
  1. cong@msi:/work/test/busytest/3arping$ sudo ./arping 192.168.4.5
  2. arping.c:main[182]: src=192.168.4.112
  3. arping.c:main[183]: dst=192.168.4.5
  4. Unicast reply from 192.168.4.5 [12:9f:1c:d5:33:ac]
4.数据包解析
a.发送:
  1. send: 1.818515000    Micro-St_99:f6:d8    Broadcast    ARP    42    Who has 192.168.4.5? Tell 192.168.4.112

  3. ff ff ff ff ff ff 44 8a 5b 99 f6 d8 08 06 00 01
  4. 08 00 06 04 00 01 44 8a 5b 99 f6 d8 c0 a8 04 70
  5. ff ff ff ff ff ff c0 a8 04 05

  7. ff ff ff ff ff ff     --> dest broadcast
  8. 44 8a 5b 99 f6 d8     --> src mac
  9. 08 06                 --> ARP
  10. 00 01                 --> Ethernet
  11. 08 00                 --> Protocol type: IP
  12. 06                    --> hardware size
  13. 04                    --> protocol size
  14. 00 01                 --> opcode request: 1-->request
  15. 44 8a 5b 99 f6 d8     --> sender mac address
  16. c0 a8 04 70           --> sender IP address 192.168.4.112
  17. ff ff ff ff ff ff     --> target mac address
  18. c0 a8 04 05           --> target IP address
b.接收:
  1. recv: 1.819112000 12:9f:1c:d5:33:ac Micro-St_99:f6:d8 ARP 60 192.168.4.5 is at 12:9f:1c:d5:33:ac
  2. 0000 44 8a 5b 99 f6 d8 12 9f 1c d5 33 ac 08 06 00 01
  3. 0010 08 00 06 04 00 02 12 9f 1c d5 33 ac c0 a8 04 05
  4. 0020 44 8a 5b 99 f6 d8 c0 a8 04 70 00 00 00 00 00 00
  5. 0030 00 00 00 00 00 00 00 00 00 00 00 00

  7. 44 8a 5b 99 f6 d8   -->dst mac
  8. 12 9f 1c d5 33 ac   -->src mac
  9. 08 06               --> ARP
  10. 00 01               --> Ethernet
  11. 08 00               --> Protocol type: IP
  12. 06                  --> hardware size
  13. 04                  --> protocol size
  14. 00 02               --> opcode request: 2-->reply
  15. 12 9f 1c d5 33 ac   --> sender mac address
  16. c0 a8 04 05         --> sender IP address 192.168.4.112
  17. 44 8a 5b 99 f6 d8   --> target mac address
  18. c0 a8 04 70         --> target IP address
  19. 00 00 ...           --> padding
5.源码
3arping.rar (下载后改名为3arping.tar.gz)
6.补充
LINUX内核中有一个叫PF_PACKET的协议簇，它允许应用程序直接利用网络驱动程序发送和接收报文，避免了原来的协议栈处理过程。
在这种情况下，所有SOCKET发送的报文直接送到以太网卡接口，而接收到的任何报文将直接送到应用程序。

PF_PACKET协议簇的两个socket类型:
SOCK_DGRAM --> 让内核处理添加或者去除以太网报文头部工作
SOCK_RAW   --> 让应用程序对以太网报文头部有完全的控制

阅读(2134) | 评论(0) | 转发(0) |
0

上一篇：busybox分析--5.getopt32

下一篇：linux demo---1.汇总

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6