详解Go程序添加远程调用tcpdump功能

timeout 30 tcpdump -i eth0 host 9.123.123.111 and port 6651 -w /tmp/log.cap

// TcpDump 执行tcpdump命令，并返回抓到的包数
func TcpDump(sudo bool, timeout int, eth string, host string, port int) (caps int, err error) {
	portStr := ""
	if port != 0 {
		portStr = fmt.Sprintf("and port %v", port)
	}
	tcpdumpCmd := fmt.Sprintf("timeout %v tcpdump -i %v host %v %v -w /tmp/log.cap",
		timeout, eth, host, portStr)
	if sudo {
		tcpdumpCmd = "sudo " + tcpdumpCmd
	}
	logrus.Infof("call %v", tcpdumpCmd)
	cmd := exec.Command("sh", "-c", tcpdumpCmd)
	var outb, errb bytes.Buffer
	cmd.Stderr = &errb
	err = cmd.Run()
	if err != nil {
		if !errors.Is(err, &exec.ExitError{}) {
			logrus.Infof("out:%s ; %s", outb.Bytes(), errb.Bytes())
			return getPacs(errb.String()), nil
		}
		return
	}
	return 0,fmt.Errorf("unknown error")
}
func getPacs(input string) int {
	end := strings.Index(input, "packets captured")
	pos := end
	for {
		pos -= 1
		if pos <= 0 {
			return 0
		}
		if input[pos] == '\n' {
			break
		}
	}
	// logrus.Infof("captured:%s", input[pos+1:end-1])
	v, err := strconv.Atoi(input[pos+1 : end-1])
	if err != nil {
		return 0
	}
	return v
}

listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes\n56 packets captured\n56 packets received by filter\n0 packets dropped by kernel\n

import "github.com/gogf/gf/v2/encoding/gjson"
// ErrJson，写入一个error json，形如：
//{
//    "err": code,
//    "err_msg": msg
//}
func ErrJson(w http.ResponseWriter, errCode int, errStr string) error {
	w.Header().Set("Content-Type", "application/json")
	js := make(map[string]interface{})
	js["err"] = errCode
	js["err_msg"] = errStr
	jsBts, _ := json.Marshal(js)
	_, err := w.Write(jsBts)
	return err
}
/* TcpDumpHandler
req:{
	"sudo":  true,
	"eth": "eth0",
	"host": "10.99.17.135",
	"port": 0
}
rsp:{
	"err": 0,
	"caps": 14
}
*/
func TcpDumpHandler(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	ret, err := ioutil.ReadAll(r.Body)
	if err != nil {
		ErrJson(w, 1, "数据错误")
		return
	}
	js := gjson.New(ret)
	sudo := js.Get("sudo").Bool()
	eth := js.Get("eth").String()
	if eth == "" {
		ErrJson(w, 1, "数据错误, eth不存在")
		return
	}
	host := js.Get("host").String()
	if host == "" {
		ErrJson(w, 1, "数据错误, host不存在")
		return
	}
	port := js.Get("port").Int()
	timeout := js.Get("timeout").Int()
	if timeout == 0 {
		ErrJson(w, 1, "数据错误, timeout为0或不存在")
		return
	}
	go func() {
		chatKey := config.GlobalConfigObj.Global.ChatKey
		botKey := config.GlobalConfigObj.Global.BotKey
		
		// 这里直接利用了公司的一个消息系统，如果贵公司没有这样的系统，就变通一下
		msgSender := msg.NewNiuBiMsg(chatKey, botKey)
		caps, err := TcpDump(sudo, timeout, eth, host, port)
		if err != nil {
			return
		}
		if caps > 0 {
			// 这里直接利用了公司的一个消息系统，向企业IM发一条消息
			msgSender.Send(fmt.Sprintf("tcpdump agent_ip:%v host:%v eth:%v port:%v, captured:%v",
				config.GlobalLocalConfig.LocalIP, host, eth, port, caps))
			bts, err := ioutil.ReadFile("/tmp/log.cap")
			if err != nil {
				return
			}
			b64Caps := base64.StdEncoding.EncodeToString(bts)
			// 把抓包的文件通过这个消息系统也发到企业IM中
			msgSender.File(fmt.Sprintf("pacs_%v.cap", config.GlobalLocalConfig.LocalIP), b64Caps)
		}
	}()
}

func runHttp() {
	mux := http.NewServeMux()
	server :=
		http.Server{
			Addr:         fmt.Sprintf(":%d", 3527),
			Handler:      mux,
			ReadTimeout:  3 * time.Second,
			WriteTimeout: 5 * time.Second,
		}
	// 开始添加路由
	mux.HandleFunc("/tcpdump", tcpdumpsvc.TcpDumpHandler)
	logrus.Infof("run http:%v", 3527)
	logrus.Info(server.ListenAndServe())
}

curl --header "Content-Type: application/json" --request GET --data '{"sudo":false,"eth":"eth0","host":"100.xxx.xxx.10","port":0,"timeout":5}' http://0.0.0.0:3527/tcpdump