协议栈数据组成格式

用户层：用户数据
传输层：8个字节udp头+用户层
网络层：20个字节的ip头 + 传输层
链路层：14个字节的以太网头 + 网络层
网卡（在链路层和物理层之间）：将链路层数据经过DA转换，变成电信号/光信号

以太网头

在这里插入图片描述

#pragma pack(1)

#define ETH_ADDR_LENGTH 6

// 以太网的头
struct ethhdr{
    unsigned char h_dst[ETH_ADDR_LENGTH];
    unsigned char h_src[ETH_ADDR_LENGTH];
    unsigned short h_proto;
};

ip头

在这里插入图片描述

// ip头
struct iphdr{
    unsigned char hdrlen:4,
                  version:4;

    unsigned char tos;

    unsigned short totlen;

    unsigned short id;

    unsigned short flag_offest;

    unsigned char ttl;          // 初始值为64， 经过一个网关-1，为0不可用

    unsigned char type;

    unsigned short check;

    unsigned int sip;
    unsigned int dip;
};

udp协议头

在这里插入图片描述

// udp协议头
struct udphdr{
    unsigned short sport;
    unsigned short dport;

    unsigned short length;
    unsigned short check;
};

udp数据包

struct udppkt{
    ethhdr eh;
    iphdr ip;
    udphdr udp;

    // 0长数组(柔性数组)作为一个标签
    // 使用场景：
    // 1、不关心长度，长度定义在头中
    // 2、数据长度提前分配好，不会出现数组越界 
    unsigned char data[0];  
};

ARP协议

1、发送请求
??本机通过路由器，广播给局域网内所有的机器，找ip为xxx.xxx.xxx.xxx的机器，对应ip的机器收到广播后将自己的mac地址返回给本机
??ARP攻击：不管谁发送什么ip，都响应随便返回一个mac，会导致局域网内的电脑都没法上网，因为连网关的mac都不对。
2、接受请求，注册ip与mac的映射关系到ARP表中

ARP协议格式

在这里插入图片描述

代码实现

netmap可以从github上面clone



#include <stdio.h>

#include <sys/poll.h>
#include <arpa/inet.h>

#define NETMAP_WITH_LIBS

#include <net/netmap_user.h>

#pragma pack(1)


#define ETH_ADDR_LENGTH		6

#define PROTO_IP			0x0800
#define PROTO_ARP			0x0806
#define PROTO_UDP			17
#define PROTO_ICMP			1


struct ethhdr {
	unsigned char h_dst[ETH_ADDR_LENGTH];
	unsigned char h_src[ETH_ADDR_LENGTH];
	unsigned short h_proto;
	
}; // 14


struct iphdr {

	unsigned char hdrlen:4,
				  version:4; // 0x45
				  

	unsigned char tos;

	unsigned short totlen;
	
	unsigned short id;

	unsigned short flag_offset; //

	unsigned char ttl; //time to live
	// 0x1234// htons

	unsigned char type;

	unsigned short check;

	unsigned int sip;
	unsigned int dip;

}; // 20



struct udphdr {

	unsigned short sport;
	unsigned short dport;

	unsigned short length;
	unsigned short check;

}; // 8


struct udppkt {

	struct ethhdr eh; // 14
	struct iphdr ip;  // 20 
	struct udphdr udp; // 8

	unsigned char data[0];

}; // sizeof(struct udppkt) == 


struct arphdr {

	unsigned short h_type;
	unsigned short h_proto;

	unsigned char h_addrlen;
	unsigned char h_protolen;

	unsigned short oper;

	unsigned char smac[ETH_ADDR_LENGTH];
	unsigned int sip;

	unsigned char dmac[ETH_ADDR_LENGTH];
	unsigned int dip;
};

struct arppkt {

	struct ethhdr eh;
	struct arphdr arp;

};



int str2mac(char *mac, char *str) {

	char *p = str;
	unsigned char value = 0x0;
	int i = 0;

	while (p != '\0') {
		
		if (*p == ':') {
			mac[i++] = value;
			value = 0x0;
		} else {
			
			unsigned char temp = *p;
			if (temp <= '9' && temp >= '0') {
				temp -= '0';
			} else if (temp <= 'f' && temp >= 'a') {
				temp -= 'a';
				temp += 10;
			} else if (temp <= 'F' && temp >= 'A') {
				temp -= 'A';
				temp += 10;
			} else {	
				break;
			}
			value <<= 4;
			value |= temp;
		}
		p ++;
	}

	mac[i] = value;

	return 0;
}



void echo_arp_pkt(struct arppkt *arp, struct arppkt *arp_rt, char *mac) {

	memcpy(arp_rt, arp, sizeof(struct arppkt));

	memcpy(arp_rt->eh.h_dst, arp->eh.h_src, ETH_ADDR_LENGTH);
	str2mac(arp_rt->eh.h_src, mac);
	arp_rt->eh.h_proto = arp->eh.h_proto;

	arp_rt->arp.h_addrlen = 6;
	arp_rt->arp.h_protolen = 4;
	arp_rt->arp.oper = htons(2);
	
	str2mac(arp_rt->arp.smac, mac);
	arp_rt->arp.sip = arp->arp.dip;
	
	memcpy(arp_rt->arp.dmac, arp->arp.smac, ETH_ADDR_LENGTH);
	arp_rt->arp.dip = arp->arp.sip;

}

//
int main() {

	struct nm_pkthdr h;
	struct nm_desc *nmr = nm_open("netmap:eth0", NULL, 0, NULL);
	if (nmr == NULL) return -1;

	struct pollfd pfd = {0};
	pfd.fd = nmr->fd;
	pfd.events = POLLIN;

	while (1) {

		int ret = poll(&pfd, 1, -1);
		if (ret < 0) continue;

		if (pfd.revents & POLLIN) {

			unsigned char *stream = nm_nextpkt(nmr, &h);

			struct ethhdr *eh = (struct ethhdr *)stream;
			if (ntohs(eh->h_proto) ==  PROTO_IP) {

				struct udppkt *udp = (struct udppkt *)stream;

				if (udp->ip.type == PROTO_UDP) { //

					int udplength = ntohs(udp->udp.length);

					udp->data[udplength-8] = '\0';

					printf("udp --> %s\n", udp->data);

				} else if (udp->ip.type == PROTO_ICMP) {

					

				}
				

			} else if (ntohs(eh->h_proto) ==  PROTO_ARP) {

				struct arppkt *arp = (struct arppkt *)stream;

				struct arppkt arp_rt;

				if (arp->arp.dip == inet_addr("192.168.0.123")) { //

					echo_arp_pkt(arp, &arp_rt, "00:50:56:33:1c:ca");

					nm_inject(nmr, &arp_rt, sizeof(arp_rt));

					printf("arp ret\n");
				
				}

			}

		}

	}
	
	

}