http://www.jackxiang.com/index.php zh-cn http://www.jackxiang.com/post// jack <xdy108@126.com> Fri, 07 Feb 2014 10:13:10 +0000 http://www.jackxiang.com/post// 附录：
pcap 的过滤器是以已声明的谓词语法为基础的。过滤器是一个 ASCII 字符串，它包含了一个过滤 表达式。pcap_compile()把这个表达式编译成内核级的包过滤器。 这个表达式会选择那些数据包将会被堆存。摘自： http://wenku.baidu.com/link?url=Q-pBW07zxVTcuZFDljeezTVy2B6MMgpwncTtM8v-yd4CmV69FNXq2gBr2w-g4FDv3Jf720Ks4-LMXqh7qAhI7vIkO71w2X_GwLlnw4F2hd7
简单的C代码如下：

regexp.c
#include <stdio.h> #include <sys/types.h> #include <regex.h> /* 取子串的函数 */ static char* substr(const char*str, unsigned start, unsigned end) {     unsigned n = end - start;     static char stbuf[256];     strncpy(stbuf, str + start, n);     stbuf[n] = 0;     return stbuf; } /* 主程序 */ int main(int argc, char** argv) {     char * pattern;     int x, z, lno = 0, cflags = 0;     char ebuf[128], lbuf[256];     regex_t reg;     regmatch_t pm[10];     const size_t nmatch = 10;     /* 编译正则表达式*/     pattern = argv[1];     z = regcomp(&reg, pattern, cflags);     if (z != 0){         regerror(z, &reg, ebuf, sizeof(ebuf));         fprintf(stderr, "%s: pattern '%s' \n", ebuf, pattern);         return 1;     }     /*  逐行处理输入的数据 */     while(fgets(lbuf, sizeof(lbuf), stdin)) {         ++lno;         if ((z = strlen(lbuf)) > 0 && lbuf[z-1] == '\n')             lbuf[z - 1] = 0;         /* 对每一行应用正则表达式进行匹配 */         z = regexec(&reg, lbuf, nmatch, pm, 0);         if (z == REG_NOMATCH) continue;         else if (z != 0) {             regerror(z, &reg, ebuf, sizeof(ebuf));             fprintf(stderr, "%s: regcom('%s')\n", ebuf, lbuf);             return 2;         }         /* 输出处理结果 */         for (x = 0; x < nmatch && pm[x].rm_so != -1; ++ x) {             if (!x) printf("%04d: %s\n", lno, lbuf);             printf("  $%d='%s'\n", x, substr(lbuf, pm[x].rm_so, pm[x].rm_eo));         }     }     /* 释放正则表达式  */     regfree(&reg);     return 0; }
编译上面的C代码如下，make.sh
gcc regexp.c -o regexp

对代码进行实践，匹配到正则的情况如下：
[root@test c_rege_codes]# ./regexp  'regex[a-z]*' < regexp.c 0003: #include <regex.h>   $0='regex' 0020:     regex_t reg;   $0='regex' 0037:         z = regexec(&reg, lbuf, nmatch, pm, 0);   $0='regexec'

实践来源：http://tech.ccidnet.com/art/302/20040319/97027_1.html
多次摘抄的，一样的代码其给转意或变成别的了都编译不过，出现乱码，上面这个可以编译通过，不容易啊。

于是，试着仿照写一个，改动调试了解如下：

#include <stdio.h> #include <string.h> #include <sys/types.h> #include <regex.h> /* 取子串的函数 */ static char* substr(const char*str, unsigned start, unsigned end) {     unsigned n = end - start;     static char stbuf[256];     strncpy(stbuf, str + start, n);     stbuf[n] = 0;     return stbuf; } /* 主程序 */ int main(int argc, char** argv) {     char * pattern;     int x, z, lno = 0, cflags = 0;     char ebuf[128], lbuf[256];     regex_t reg;     regmatch_t pm[10];     const size_t nmatch = 10;     /* 编译正则表达式*/     pattern = "GET.*\\.js";     printf("pattern=%s\n",pattern);     z = regcomp(&reg, pattern, cflags);     if (z != 0){         regerror(z, &reg, ebuf, sizeof(ebuf));         fprintf(stderr, "%s: pattern '%s' \n", ebuf, pattern);         return 1;     }     char *lbufInStr = "abc \n GET /themes/zh/js/xy.js?ver=2.006 HTTP/1.0 def123\n";     strncpy(lbuf,lbufInStr,strlen(lbufInStr));     printf("lbuf=%s\n",lbuf);     ++lno;     if ((z = strlen(lbuf)) > 0 && lbuf[z-1] == '\n')         lbuf[z - 1] = 0;     z = regexec(&reg, lbuf, nmatch, pm, 0);     if (z == REG_NOMATCH) {         printf("not match \n");         return 0;     } else if (z != 0) {         regerror(z, &reg, ebuf, sizeof(ebuf));         fprintf(stderr, "%s: regcom('%s')\n", ebuf, lbuf);         return 2;     }     /* 输出处理结果 */     for (x = 0; x < nmatch && pm[x].rm_so != -1; ++ x) {         if (!x) printf("%04d: %s\n", lno, lbuf);         printf("  $%d='%s'\n", x, substr(lbuf, pm[x].rm_so, pm[x].rm_eo));     }     /* 释放正则表达式  */     regfree(&reg);     return 0; }

编译：
gcc regexp4pcap.c -o regexp4pcap

执行：
[root@test c_rege_codes]# ./regexp4pcap
pattern=GET.*\.js
lbuf=abc
GET /themes/zh/js/xy.js?ver=2.006 HTTP/1.0 def123
0001: abc
GET /themes/zh/js/xy.js?ver=2.006 HTTP/1.0 def123
  $0='GET /themes/zh/js/xy.js'

注意：这里的.js里的点得转意，否则匹配不到哟：http://bbs.csdn.net/topics/340040294
\\s忘记了转义 ]]> http://www.jackxiang.com/post//#blogcomment <user@domain.com> Thu, 01 Jan 1970 00:00:00 +0000 http://www.jackxiang.com/post//#blogcomment