[완료] libipq를 이용한 패킷 캡쳐 질문입니다.

int main(int argc, char **argv)
{
        int status;
        unsigned char dump_payload = 0;
        unsigned char inbuf[BUFSIZE];
        struct ipq_handle *h;
        int verdict = NF_ACCEPT;
 
        h = ipq_create_handle(0, PF_INET);
        if (!h) die(h);
        status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
        if (status < 0) die(h);
        do  {
                status = ipq_read(h, inbuf, BUFSIZE, 0);
                if (status < 0) die(h);
                switch (ipq_message_type(inbuf)) {
                case NLMSG_ERROR:
                        fprintf(stderr, "Received error message %d\n", ipq_get_msgerr(inbuf));
                        break;
                case IPQM_PACKET: {
                        unsigned char *packet = NULL;
                        unsigned char *tcppacket = NULL;
                        struct iphdr *iph = NULL;
                        struct tcphdr *tcph = NULL;
                        char *httpData = NULL;
                        struct iphdr *ip = NULL;
                        struct tcphdr *tcp = NULL;
                        char *http = NULL;
 
                        ipq_packet_msg_t *m = ipq_get_packet(inbuf);
 
                        if (!m) break;
                        if (m->data_len >= sizeof(struct iphdr)) {
                                packet = (unsigned char *)m + sizeof(*m);
                        }
                        fprintf(stderr, "Sending verdict %d on packet %lX\n", verdict, m->packet_id);
                        iph = (struct iphdr *)packet;
                        tcppacket = (unsigned char *)iph + sizeof(struct iphdr);
                        tcph = (struct tcphdr *)tcppacket;
 
                        httpData = (char *)tcph + sizeof(struct tcphdr);
 
                        ip = (struct iphdr *)malloc(sizeof(struct iphdr));
                        tcp = (struct tcphdr *)malloc(sizeof(struct tcphdr));
                        http = (char *)malloc(strlen(httpData));
 
                        if (ip == NULL || tcp == NULL || http == NULL){
                                fprintf(stderr, "out of memory\n");
                                exit(0);
                        }
 
                        memcpy(ip, iph, sizeof(struct iphdr));
                        memcpy(tcp, tcph, sizeof(struct tcphdr));
                        memcpy(http, httpData, strlen(httpData));
 
                        dump_iphdr((char *)ip);
 
                        fprintf(stderr, "httpData :%s\n", http);
 
                        free(ip);
                        free(tcp);
                        free(http);
 
                        status = ipq_set_verdict(h, m->packet_id, verdict, m->data_len, packet);
                        if (status < 0) die(h);
 
                        break;
                }
                default:
                        fprintf(stderr, "Unknown message!\n");
                        break;
                }
                if (dump_payload) write(1, inbuf, status);
        } while (1);
        ipq_destroy_handle(h);
 
        return 0;
}