🚀 go-pugleaf

"Jnimo" <Jimmy.nimo@gmail.com> writes:
> [...]
> my problem? well, in theory when i printf the payload, it have to print
> the package data  (no the header, but the real data), and he dont, by
> example, if it a tcp html package it have to print all the data of a
> package, but print only garbage

It seems to me that the problem you have is that you use a constant
offset to the payload.  IP headers are not fixed size.  You must
compute the real payload offset from the data found in the ip header.

Of course, if it's not an IP packet, the "payload" is something else
found somewhere else.  So you'd better dump the payload from the
protocol specific functions rather than from do_pcap.


Me parece que tu problema es que usas un offset fijo en lugar de tomar 
en cuenta el heco que el encabezamiento IP es de tama�o variable.


Cuidado, cuando se converte entre little endian y big endian, la
transformaci�n simetrica es la misma, pero por otros ordenes de
octetos, la transformaci�n puede no ser simetrica.  Luego, no hay que
confundir ntohs vs. htons:
    htons(tcp->th_sport), htons(tcp->th_dport),
no es correcto, hay que escribir:
    ntohs(tcp->th_sport), ntohs(tcp->th_dport),
(Network to Host short).


No deberias copiar el buffer.  Es m�s simple y m�s rapido pasar
simplemente un puntero:
   memcpy(buffer, pkt + ETHER_HDR_LEN, length - ETHER_HDR_LEN);
mejor escribir:
   char* payload=pkt+ETHER_HDR_LEN;
   int   payload_length=length-ETHER_HDR_LEN;


Proba con este patch:

diff -Naurtwb orig/sniffer2.c src/sniffer2.c
--- orig/sniffer2.c	2005-05-17 21:00:02.000000000 +0200
+++ src/sniffer2.c	2005-05-17 21:41:39.000000000 +0200
@@ -88,11 +88,22 @@
   printf("paquete!!!!\n");
   printf("Tiempo: %d %d\n",hdr->ts.tv_sec,hdr->ts.tv_usec);
   do_ethernet(pkt, hdr->caplen);
-  payload = (u_char *)(pkt + size_ethernet + size_ip + size_tcp);//HERE
-  //IS THE PROBLEM
-  printf("%s\n",payload); //HERE IS THE PROBLEM
 }
 
+void dump(const char* title,const char* buffer,int length,short ascii){
+    int i;
+    printf("Dump of %s:\n",title);
+    for(i=0;i<length;){
+        int l=i+16;
+        int j=i;
+        printf("%04x: ",i);
+        for(;(i<length)&&(i<l);i++){ printf("%02x ",(unsigned char)buffer[i]); }
+        for(;(i<l);i++){ printf("   "); }
+        if(ascii){
+            for(;(j<length)&&(j<l);j++){
+                printf("%c",isgraph(buffer[j])?buffer[j]:'_'); }}
+        printf("\n"); }}
+
 int do_ethernet(const u_char * pkt, int length)
 {
   char buffer[PCAP_SNAPLEN];
@@ -103,7 +114,6 @@
   int size_ethernet=sizeof(struct ether_header);
   int size_ip=sizeof(struct ip);
   int size_tcp=sizeof(struct tcphdr);
-  payload = (u_char *)(pkt + size_ethernet + size_ip + size_tcp);
   if(ether_type==ETHERTYPE_ARP)
   {
     printf("CAPA 3 ARP");
@@ -131,6 +141,8 @@
   }while(--i>0);
   printf(" tipo:0x %x\n", ntohs(eth->ether_type));
 
+  dump("Ethernet payload",buffer,length - ETHER_HDR_LEN,0);
+
   return do_ip((struct ip*)buffer, length - ETHER_HDR_LEN,pkt);
 
 }
@@ -147,6 +159,7 @@
   printf("protocolo %d\n", ip->ip_p);
 
   memcpy(buffer, (void*)ip + offset, length - offset);
+  dump("IP payload",buffer,length-offset,0);
 
   switch(ip->ip_p) {
   case IPPROTO_TCP:
@@ -182,7 +195,8 @@
     if (flags & TH_ECE) printf(" ECE");
     if (flags & TH_CWR) printf(" CWR");
   }
-  printf("\n\nTamano:  Payload %s\n\n",payload);
+  dump("TCP payload",((const char*)tcp)+((tcp->th_off)<<2),
+       length-((tcp->th_off)<<2),1);
   return 1;
 }
 
@@ -191,6 +205,7 @@
 {
   printf("CAPA 4 UDP-> puerto fuente:%d puerto destino: %d\n\n",
 htons(udp->uh_sport), htons(udp->uh_dport));
+  dump("UDP payload",((const char*)udp)+8,(ntohs(udp->uh_ulen)-8),1);
   return 1;
 }

-- 
__Pascal Bourguignon__                     http://www.informatimago.com/
Until real software engineering is developed, the next best practice
is to develop with a dynamic system that has extreme late binding in
all aspects. The first system to really do this in an important way
is Lisp. -- Alan Kay