Question

我正在构建NKE（网络内核扩展），用于动态过滤和修改数据包。 myipfilter_output_redirect 回调提供 mbuf_t 指针，并根据研究的知识获得与网络呼叫相关的所有信息。我想从此mbuf_t中读取html，然后将一个 css / html 注入其中。我该如何实现？

static errno_t myipfilter_output(void* cookie, mbuf_t* data, ipf_pktopts_t options) {
    if (data)
        log_ip_packet(data, kMyFiltDirOut);
    return 0;
}

static errno_t myipfilter_input(void* cookie, mbuf_t* data, int offset, u_int8_t protocol) {
    if (data)
        log_ip_packet(data, kMyFiltDirIn);
    return 0;
}

static void myipfilter_detach(void* cookie) {
    /* cookie isn't dynamically allocated, no need to free in this case */
    struct myfilter_stats* stats = (struct myfilter_stats*)cookie;
    printf("UDP_IN %lu UDP OUT: %lu TCP_IN: %lu TCP_OUT: %lu ICMP_IN: %lu ICMP OUT: %lu OTHER_IN: %lu OTHER_OUT: %lu\n",
           stats->udp_packets[kMyFiltDirIn],
           stats->udp_packets[kMyFiltDirOut],
           stats->tcp_packets[kMyFiltDirIn],
           stats->tcp_packets[kMyFiltDirOut],
           stats->icmp_packets[kMyFiltDirIn],
           stats->icmp_packets[kMyFiltDirOut],
           stats->other_packets[kMyFiltDirIn],
           stats->other_packets[kMyFiltDirOut]);
    g_filter_detached = TRUE;
}

static struct ipf_filter g_my_ip_filter = {
    &g_filter_stats,
    "com.xxx.NetworKext",
    myipfilter_input,
    myipfilter_output_redirect,  //    myipfilter_output,
    myipfilter_detach
};

kern_return_t MyIPFilter_start () {
    printf("MyIPFilter_start called");
    int result;
    result = ipf_addv4(&g_my_ip_filter, &g_filter_ref);
    return result;
}

kern_return_t MyIPFilter_stop () {
    printf("MyIPFilter_stop called");
    ipf_remove(g_filter_ref);
    return KERN_SUCCESS;
}


static errno_t myipfilter_output_redirect(void* cookie, mbuf_t* data, ipf_pktopts_t options)
{
    // not printing all html and css tags
    printf("myipfilter_output_redirect called");
    unsigned char* dataString = NULL;
    for (mbuf_t mb = *data; mb; mb = mbuf_next(mb))
    {
        dataString = mbuf_data(mb);
        size_t len = mbuf_len(mb);
        for (size_t i = 0; i < len; i++)
        {
            printf("%c", dataString[i]);
        }
    }

    printf("dataString: %s", dataString);
}

如果您能在此处提供任何帮助，我已经制作了一个示例存储库。

Answer 1

您应该选择套接字过滤器，并且为了检索HTML有效负载，您应该使用mbuf_t数据读取mbuf_t。下面的方法从头开始打印每个字节，因此将其放入您的sf_data_in_func回调中。

print_mbuf_data（* data）;

这对您有用。

static void print_mbuf_data(mbuf_t mb){
    //    unsigned char *tmp_buffer = (unsigned char *) mbuf_datastart(mb);
        unsigned char *tmp_buffer = (unsigned char *) mbuf_data(mb);
        unsigned long line = 0, index = 0, character = 0, hex_length = 0x80; // hex_length has limit of 64 decimal
        unsigned long length = mbuf_len(mb);
        unsigned char hex_temp [0x80]; // buffer has limit of 64 decimal

    for (index = 0; index < length; index += 0x80)
    {
        memset(hex_temp, 0, hex_length);
        line = length - index > 0x80 ? 0x80 : length - index;
        for (character = 0; character < line; character++)
        {
            snprintf(((char *) hex_temp + strlen((char *) hex_temp)),
                     hex_length - strlen((char *) hex_temp), "%c", tmp_buffer[index + character]);
        }
        printf("%s", hex_temp);
    }
}

使用网络核心扩展监视网络数据包

1 个答案: