Sniff HTTP packets using NKE

Question

I'm trying to read http requests and responses by making a KEXT using NKE. I registered a socket filter, whenever I'm getting data I'm printing mbuf using a code like this:

unsigned char *dataString = mbuf_data(*data);
for (size_t i = 0; i < mbuf_len(*data); i++)
{
    printf("%c", dataString[i]);
}
printf("\n-------------\n");

I can read http requests and some responses data from logs but can't see any HTML content. I was wondering if I'm not correctly reading mbuf or is it some other problem?

Answer 1

mbufs are actually linked lists of memory buffers, so if you're only inspecting the head of the list, that could be why you can't see all the data. You want to do something like this:

for (mbuf_t mb = *data; mb; mb = mbuf_next(mb))
{
  unsigned char* dataString = mbuf_data(mb);
  size_t len = mbuf_len(mb);
  for (size_t i = 0; i < len; i++)
  {
    printf("%c", dataString[i]);
  }
}
printf("\n-------------\n");