7x31
/
go-sniffer
mirror of https://github.com/40t/go-sniffer.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge 1c1d868730 into e209ea8ccc

This commit is contained in:
Shuo 2020-03-01 16:11:32 +08:00 committed by GitHub
parent e209ea8ccc 1c1d868730
commit 20d3738518
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
22 changed files with 410 additions and 386 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
.gitignore vendored Normal file
View File

@ -0,0 +1,16 @@
# Binaries for programs and plugins
*.exe
*.exe~
*.dll
*.so
*.dylib
# Test binary, built with `go test -c`
*.test
# Output of the go coverage tool, specifically when used with LiteIDE
*.out
# Dependency directories (remove the comment below to include it)
# vendor/

44
core/assembly.go
View File

@ -191,28 +191,28 @@ func (p *StreamPool) connections() []*connection {
return conns return conns
} }
//FlushOlderThan finds any streams waiting for packets older than the given // FlushOlderThan finds any streams waiting for packets older than the given
//time, and pushes through the data they have (IE: tells them to stop waiting // time, and pushes through the data they have (IE: tells them to stop waiting
//and skip the data they're waiting for). // and skip the data they're waiting for).
// //
//Each Stream maintains a list of zero or more sets of bytes it has received // Each Stream maintains a list of zero or more sets of bytes it has received
//out-of-order. For example, if it has processed up through sequence number // out-of-order. For example, if it has processed up through sequence number
//10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of // 10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of
//bytes also has the timestamp it was originally viewed. A flush call will // bytes also has the timestamp it was originally viewed. A flush call will
//look at the smallest subsequent set of bytes, in this case [15-20), and if // look at the smallest subsequent set of bytes, in this case [15-20), and if
//its timestamp is older than the passed-in time, it will push it and all // its timestamp is older than the passed-in time, it will push it and all
//contiguous byte-sets out to the Stream's Reassembled function. In this case, // contiguous byte-sets out to the Stream's Reassembled function. In this case,
//it will push [15-20), but also [20-25), since that's contiguous. It will // it will push [15-20), but also [20-25), since that's contiguous. It will
//only push [30-50) if its timestamp is also older than the passed-in time, // only push [30-50) if its timestamp is also older than the passed-in time,
//otherwise it will wait until the next FlushOlderThan to see if bytes [25-30) // otherwise it will wait until the next FlushOlderThan to see if bytes [25-30)
//come in. // come in.
// //
//If it pushes all bytes (or there were no sets of bytes to begin with) AND the // If it pushes all bytes (or there were no sets of bytes to begin with) AND the
//connection has not received any bytes since the passed-in time, the // connection has not received any bytes since the passed-in time, the
//connection will be closed. // connection will be closed.
// //
//Returns the number of connections flushed, and of those, the number closed // Returns the number of connections flushed, and of those, the number closed
//because of the flush. // because of the flush.
func (a *Assembler) FlushOlderThan(t time.Time) (flushed, closed int) { func (a *Assembler) FlushOlderThan(t time.Time) (flushed, closed int) {
conns := a.connPool.connections() conns := a.connPool.connections()
closes := 0 closes := 0

78
core/cmd.go
View File

@ -1,11 +1,11 @@
package core package core
import ( import (
"os"
"strings"
"fmt" "fmt"
"net" "net"
"os"
"strconv" "strconv"
"strings"
) )
const InternalCmdPrefix = "--" const InternalCmdPrefix = "--"
@ -18,27 +18,27 @@ const (
) )
type Cmd struct { type Cmd struct {
Device string Device string
plugHandle *Plug plugHandle *Plug
} }
func NewCmd(p *Plug) *Cmd { func NewCmd(p *Plug) *Cmd {
return &Cmd{ return &Cmd{
plugHandle:p, plugHandle: p,
} }
} }
//start // start
func (cm *Cmd) Run() { func (cm *Cmd) Run() {
//print help // print help
if len(os.Args) <= 1 { if len(os.Args) <= 1 {
cm.printHelpMessage() cm.printHelpMessage()
os.Exit(1) os.Exit(1)
} }
//parse command // parse command
firstArg := string(os.Args[1]) firstArg := string(os.Args[1])
if strings.HasPrefix(firstArg, InternalCmdPrefix) { if strings.HasPrefix(firstArg, InternalCmdPrefix) {
cm.parseInternalCmd() cm.parseInternalCmd()
@ -47,35 +47,35 @@ func (cm *Cmd) Run() {
} }
} }
//parse internal commend // parse internal commend
//like --help, --env, --device // like --help, --env, --device
func (cm *Cmd) parseInternalCmd() { func (cm *Cmd) parseInternalCmd() {
arg := string(os.Args[1]) arg := string(os.Args[1])
cmd := strings.Trim(arg, InternalCmdPrefix) cmd := strings.Trim(arg, InternalCmdPrefix)
switch cmd { switch cmd {
case InternalCmdHelp: case InternalCmdHelp:
cm.printHelpMessage() cm.printHelpMessage()
break break
case InternalCmdEnv: case InternalCmdEnv:
fmt.Println("External plug-in path : "+cm.plugHandle.dir) fmt.Println("External plug-in path : " + cm.plugHandle.dir)
break break
case InternalCmdList: case InternalCmdList:
cm.plugHandle.PrintList() cm.plugHandle.PrintList()
break break
case InternalCmdVer: case InternalCmdVer:
fmt.Println(cxt.Version) fmt.Println(cxt.Version)
break break
case InternalDevice: case InternalDevice:
cm.printDevice() cm.printDevice()
break break
} }
os.Exit(1) os.Exit(1)
} }
//usage // usage
func (cm *Cmd) printHelpMessage() { func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================") fmt.Println("==================================================================================")
fmt.Println("[Usage]") fmt.Println("[Usage]")
@ -100,33 +100,33 @@ func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================") fmt.Println("==================================================================================")
} }
//print plug-in list // print plug-in list
func (cm *Cmd) printPlugList() { func (cm *Cmd) printPlugList() {
l := len(cm.plugHandle.InternalPlugList) l := len(cm.plugHandle.InternalPlugList)
l += len(cm.plugHandle.ExternalPlugList) l += len(cm.plugHandle.ExternalPlugList)
fmt.Println("# Number of plug-ins : "+strconv.Itoa(l)) fmt.Println("# Number of plug-ins : " + strconv.Itoa(l))
} }
//print device // print device
func (cm *Cmd) printDevice() { func (cm *Cmd) printDevice() {
ifaces, err:= net.Interfaces() ifaces, err := net.Interfaces()
if err != nil { if err != nil {
panic(err) panic(err)
} }
for _, iface := range ifaces { for _, iface := range ifaces {
addrs, _ := iface.Addrs() addrs, _ := iface.Addrs()
for _,a:=range addrs { for _, a := range addrs {
if ipnet, ok := a.(*net.IPNet); ok { if ipnet, ok := a.(*net.IPNet); ok {
if ip4 := ipnet.IP.To4(); ip4 != nil { if ip4 := ipnet.IP.To4(); ip4 != nil {
fmt.Println("[device] : "+iface.Name+" : "+iface.HardwareAddr.String()+" "+ip4.String()) fmt.Println("[device] : " + iface.Name + " : " + iface.HardwareAddr.String() + " " + ip4.String())
} }
} }
} }
} }
} }
//Parameters needed for plug-ins // Parameters needed for plug-ins
func (cm *Cmd) parsePlugCmd() { func (cm *Cmd) parsePlugCmd() {
if len(os.Args) < 3 { if len(os.Args) < 3 {
fmt.Println("not found [Plug-in name]") fmt.Println("not found [Plug-in name]")
@ -134,12 +134,8 @@ func (cm *Cmd) parsePlugCmd() {
os.Exit(1) os.Exit(1)
} }
cm.Device = os.Args[1] cm.Device = os.Args[1]
plugName := os.Args[2] plugName := os.Args[2]
plugParams:= os.Args[3:] plugParams := os.Args[3:]
cm.plugHandle.SetOption(plugName, plugParams) cm.plugHandle.SetOption(plugName, plugParams)
} }

12
core/core.go
View File

@ -1,6 +1,6 @@
package core package core
type Core struct{ type Core struct {
Version string Version string
} }
@ -13,15 +13,15 @@ func New() Core {
return cxt return cxt
} }
func (c *Core) Run() { func (c *Core) Run() {
//new plugin // new plugin
plug := NewPlug() plug := NewPlug()
//parse commend // parse commend
cmd := NewCmd(plug) cmd := NewCmd(plug)
cmd.Run() cmd.Run()
//dispatch // dispatch
NewDispatch(plug, cmd).Capture() NewDispatch(plug, cmd).Capture()
} }

43
core/dispatch.go
View File

@ -2,57 +2,58 @@ package core
import ( import (
"fmt" "fmt"
"log"
"time"
"github.com/google/gopacket" "github.com/google/gopacket"
"github.com/google/gopacket/layers" "github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap" "github.com/google/gopacket/pcap"
"github.com/google/gopacket/tcpassembly" "github.com/google/gopacket/tcpassembly"
"github.com/google/gopacket/tcpassembly/tcpreader" "github.com/google/gopacket/tcpassembly/tcpreader"
"log"
"time"
) )
type Dispatch struct { type Dispatch struct {
device string device string
payload []byte payload []byte
Plug *Plug Plug *Plug
} }
func NewDispatch(plug *Plug, cmd *Cmd) *Dispatch { func NewDispatch(plug *Plug, cmd *Cmd) *Dispatch {
return &Dispatch { return &Dispatch{
Plug: plug, Plug: plug,
device:cmd.Device, device: cmd.Device,
} }
} }
func (d *Dispatch) Capture() { func (d *Dispatch) Capture() {
//init device // init device
handle, err := pcap.OpenLive(d.device, 65535, false, pcap.BlockForever) handle, err := pcap.OpenLive(d.device, 65535, false, pcap.BlockForever)
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
return return
} }
//set filter // set filter
fmt.Println(d.Plug.BPF) fmt.Println(d.Plug.BPF)
err = handle.SetBPFFilter(d.Plug.BPF) err = handle.SetBPFFilter(d.Plug.BPF)
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
} }
//capture // capture
src := gopacket.NewPacketSource(handle, handle.LinkType()) src := gopacket.NewPacketSource(handle, handle.LinkType())
packets := src.Packets() packets := src.Packets()
//set up assembly // set up assembly
streamFactory := &ProtocolStreamFactory{ streamFactory := &ProtocolStreamFactory{
dispatch:d, dispatch: d,
} }
streamPool := NewStreamPool(streamFactory) streamPool := NewStreamPool(streamFactory)
assembler := NewAssembler(streamPool) assembler := NewAssembler(streamPool)
ticker := time.Tick(time.Minute) ticker := time.Tick(time.Minute)
//loop until ctrl+z // loop until ctrl+z
for { for {
select { select {
case packet := <-packets: case packet := <-packets:
@ -84,18 +85,18 @@ type ProtocolStream struct {
func (m *ProtocolStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream { func (m *ProtocolStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
//init stream struct // init stream struct
stm := &ProtocolStream { stm := &ProtocolStream{
net: net, net: net,
transport: transport, transport: transport,
r: tcpreader.NewReaderStream(), r: tcpreader.NewReaderStream(),
} }
//new stream // new stream
fmt.Println("# Start new stream:", net, transport) fmt.Println("# Start new stream:", net, transport)
//decode packet // decode packet
go m.dispatch.Plug.ResolveStream(net, transport, &(stm.r)) go m.dispatch.Plug.ResolveStream(net, transport, &(stm.r))
return &(stm.r) return &(stm.r)
} }

76
core/plug.go
View File

@ -1,24 +1,24 @@
package core package core
import ( import (
"io/ioutil" "fmt"
"plugin"
"github.com/google/gopacket"
"io" "io"
mysql "github.com/40t/go-sniffer/plugSrc/mysql/build" "io/ioutil"
redis "github.com/40t/go-sniffer/plugSrc/redis/build" "path"
"path/filepath"
"plugin"
hp "github.com/40t/go-sniffer/plugSrc/http/build" hp "github.com/40t/go-sniffer/plugSrc/http/build"
mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build" mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build"
"path/filepath" mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
"fmt" redis "github.com/40t/go-sniffer/plugSrc/redis/build"
"path" "github.com/google/gopacket"
) )
type Plug struct { type Plug struct {
dir string
dir string
ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader) ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)
BPF string BPF string
InternalPlugList map[string]PlugInterface InternalPlugList map[string]PlugInterface
ExternalPlugList map[string]ExternalPlug ExternalPlugList map[string]ExternalPlug
@ -48,7 +48,7 @@ func NewPlug() *Plug {
var p Plug var p Plug
p.dir, _ = filepath.Abs( "./plug/") p.dir, _ = filepath.Abs("./plug/")
p.LoadInternalPlugList() p.LoadInternalPlugList()
p.LoadExternalPlugList() p.LoadExternalPlugList()
@ -59,17 +59,17 @@ func (p *Plug) LoadInternalPlugList() {
list := make(map[string]PlugInterface) list := make(map[string]PlugInterface)
//Mysql // Mysql
list["mysql"] = mysql.NewInstance() list["mysql"] = mysql.NewInstance()
//Mongodb // Mongodb
list["mongodb"] = mongodb.NewInstance() list["mongodb"] = mongodb.NewInstance()
//Redis // Redis
list["redis"] = redis.NewInstance() list["redis"] = redis.NewInstance()
//Http // Http
list["http"] = hp.NewInstance() list["http"] = hp.NewInstance()
p.InternalPlugList = list p.InternalPlugList = list
} }
@ -87,7 +87,7 @@ func (p *Plug) LoadExternalPlugList() {
continue continue
} }
plug, err := plugin.Open(p.dir+"/"+fi.Name()) plug, err := plugin.Open(p.dir + "/" + fi.Name())
if err != nil { if err != nil {
panic(err) panic(err)
} }
@ -113,12 +113,12 @@ func (p *Plug) LoadExternalPlugList() {
} }
version := versionFunc.(func() string)() version := versionFunc.(func() string)()
p.ExternalPlugList[fi.Name()] = ExternalPlug { p.ExternalPlugList[fi.Name()] = ExternalPlug{
ResolvePacket:ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)), ResolvePacket: ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)),
SetFlag:setFlagFunc.(func([]string)), SetFlag: setFlagFunc.(func([]string)),
BPFFilter:BPFFilterFunc.(func() string), BPFFilter: BPFFilterFunc.(func() string),
Version:version, Version: version,
Name:fi.Name(), Name: fi.Name(),
} }
} }
} }
@ -129,34 +129,34 @@ func (p *Plug) ChangePath(dir string) {
func (p *Plug) PrintList() { func (p *Plug) PrintList() {
//Print Internal Plug // Print Internal Plug
for inPlugName, _ := range p.InternalPlugList { for inPlugName, _ := range p.InternalPlugList {
fmt.Println("internal plug : "+inPlugName) fmt.Println("internal plug : " + inPlugName)
} }
//split // split
fmt.Println("-- --- --") fmt.Println("-- --- --")
//print External Plug // print External Plug
for exPlugName, _ := range p.ExternalPlugList { for exPlugName, _ := range p.ExternalPlugList {
fmt.Println("external plug : "+exPlugName) fmt.Println("external plug : " + exPlugName)
} }
} }
func (p *Plug) SetOption(plugName string, plugParams []string) { func (p *Plug) SetOption(plugName string, plugParams []string) {
//Load Internal Plug // Load Internal Plug
if internalPlug, ok := p.InternalPlugList[plugName]; ok { if internalPlug, ok := p.InternalPlugList[plugName]; ok {
p.ResolveStream = internalPlug.ResolveStream p.ResolveStream = internalPlug.ResolveStream
internalPlug.SetFlag(plugParams) internalPlug.SetFlag(plugParams)
p.BPF = internalPlug.BPFFilter() p.BPF = internalPlug.BPFFilter()
return return
} }
//Load External Plug // Load External Plug
plug, err := plugin.Open("./plug/"+ plugName) plug, err := plugin.Open("./plug/" + plugName)
if err != nil { if err != nil {
panic(err) panic(err)
} }
@ -174,5 +174,5 @@ func (p *Plug) SetOption(plugName string, plugParams []string) {
} }
p.ResolveStream = resolvePacket.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)) p.ResolveStream = resolvePacket.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader))
setFlag.(func([]string))(plugParams) setFlag.(func([]string))(plugParams)
p.BPF = BPFFilter.(func()string)() p.BPF = BPFFilter.(func() string)()
} }

5
go.mod Normal file
View File

@ -0,0 +1,5 @@
module github.com/40t/go-sniffer
go 1.12
require github.com/google/gopacket v1.1.17

9
go.sum Normal file
View File

@ -0,0 +1,9 @@
github.com/google/gopacket v1.1.17 h1:rMrlX2ZY2UbvT+sdz3+6J+pp2z+msCq9MxTU6ymxbBY=
github.com/google/gopacket v1.1.17/go.mod h1:UdDNZ1OO62aGYVnPhxT1U6aI7ukYtA/kB8vaU0diBUM=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67 h1:1Fzlr8kkDLQwqMP8GxrhptBLqZG/EDpiATneiZHY998=
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

2
main.go
View File

@ -7,4 +7,4 @@ import (
func main() { func main() {
core := core.New() core := core.New()
core.Run() core.Run()
} }

37
plugSrc/http/build/entry.go
View File

@ -1,28 +1,29 @@
package build package build
import ( import (
"github.com/google/gopacket" "bufio"
"fmt"
"io" "io"
"log" "log"
"strconv"
"fmt"
"os"
"bufio"
"net/http" "net/http"
"os"
"strconv"
"github.com/google/gopacket"
) )
const ( const (
Port = 80 Port = 80
Version = "0.1" Version = "0.1"
) )
const ( const (
CmdPort = "-p" CmdPort = "-p"
) )
type H struct { type H struct {
port int port int
version string version string
} }
var hp *H var hp *H
@ -30,8 +31,8 @@ var hp *H
func NewInstance() *H { func NewInstance() *H {
if hp == nil { if hp == nil {
hp = &H{ hp = &H{
port :Port, port: Port,
version:Version, version: Version,
} }
} }
return hp return hp
@ -66,31 +67,31 @@ func (m *H) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
} }
func (m *H) BPFFilter() string { func (m *H) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *H) Version() string { func (m *H) Version() string {
return Version return Version
} }
func (m *H) SetFlag(flg []string) { func (m *H) SetFlag(flg []string) {
c := len(flg) c := len(flg)
if c == 0 { if c == 0 {
return return
} }
if c >> 1 == 0 { if c>>1 == 0 {
fmt.Println("ERR : Http Number of parameters") fmt.Println("ERR : Http Number of parameters")
os.Exit(1) os.Exit(1)
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
m.port = port m.port = port
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")
@ -103,4 +104,4 @@ func (m *H) SetFlag(flg []string) {
panic("ERR : mysql's params") panic("ERR : mysql's params")
} }
} }
} }

2
plugSrc/mongodb/build/bson/bson.go
View File

@ -279,7 +279,7 @@ var nullBytes = []byte("null")
func (id *ObjectId) UnmarshalJSON(data []byte) error { func (id *ObjectId) UnmarshalJSON(data []byte) error {
if len(data) > 0 && (data[0] == '{' || data[0] == 'O') { if len(data) > 0 && (data[0] == '{' || data[0] == 'O') {
var v struct { var v struct {
Id json.RawMessage `json:"$oid"` Id json.RawMessage `json:"$oid"`
Func struct { Func struct {
Id json.RawMessage Id json.RawMessage
} `json:"$oidFunc"` } `json:"$oidFunc"`

2
plugSrc/mongodb/build/bson/decimal.go
View File

@ -58,7 +58,7 @@ func (d Decimal128) String() string {
// Bits: 1*sign 2*ignored 14*exponent 111*significand. // Bits: 1*sign 2*ignored 14*exponent 111*significand.
// Implicit 0b100 prefix in significand. // Implicit 0b100 prefix in significand.
e = int(d.h>>47&(1<<14-1)) - 6176 e = int(d.h>>47&(1<<14-1)) - 6176
//h = 4<<47 | d.h&(1<<47-1) // h = 4<<47 | d.h&(1<<47-1)
// Spec says all of these values are out of range. // Spec says all of these values are out of range.
h, l = 0, 0 h, l = 0, 0
} else { } else {

3
plugSrc/mongodb/build/bson/json.go
View File

@ -4,9 +4,10 @@ import (
"bytes" "bytes"
"encoding/base64" "encoding/base64"
"fmt" "fmt"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/internal/json"
"strconv" "strconv"
"time" "time"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/internal/json"
) )
// UnmarshalJSON unmarshals a JSON value that may hold non-standard // UnmarshalJSON unmarshals a JSON value that may hold non-standard

24
plugSrc/mongodb/build/const.go
View File

@ -1,17 +1,17 @@
package build package build
const ( const (
OP_REPLY = 1 //Reply to a client request. responseTo is set. OP_REPLY = 1 // Reply to a client request. responseTo is set.
OP_UPDATE = 2001 //Update document. OP_UPDATE = 2001 // Update document.
OP_INSERT = 2002 //Insert new document. OP_INSERT = 2002 // Insert new document.
RESERVED = 2003 //Formerly used for OP_GET_BY_OID. RESERVED = 2003 // Formerly used for OP_GET_BY_OID.
OP_QUERY = 2004 //Query a collection. OP_QUERY = 2004 // Query a collection.
OP_GET_MORE = 2005 //Get more data from a query. See Cursors. OP_GET_MORE = 2005 // Get more data from a query. See Cursors.
OP_DELETE = 2006 //Delete documents. OP_DELETE = 2006 // Delete documents.
OP_KILL_CURSORS = 2007 //Notify database that the client has finished with the cursor. OP_KILL_CURSORS = 2007 // Notify database that the client has finished with the cursor.
OP_COMMAND = 2010 //Cluster internal protocol representing a command request. OP_COMMAND = 2010 // Cluster internal protocol representing a command request.
OP_COMMANDREPLY = 2011 //Cluster internal protocol representing a reply to an OP_COMMAND. OP_COMMANDREPLY = 2011 // Cluster internal protocol representing a reply to an OP_COMMAND.
OP_MSG = 2013 //Send a message using the format introduced in MongoDB 3.6. OP_MSG = 2013 // Send a message using the format introduced in MongoDB 3.6.
) )

98
plugSrc/mongodb/build/entry.go
View File

@ -4,13 +4,14 @@ import (
"bytes" "bytes"
"encoding/binary" "encoding/binary"
"fmt" "fmt"
"github.com/google/gopacket"
"io" "io"
"strconv" "strconv"
"github.com/google/gopacket"
) )
const ( const (
Port = 27017 Port = 27017
Version = "0.1" Version = "0.1"
CmdPort = "-p" CmdPort = "-p"
) )
@ -26,15 +27,14 @@ type stream struct {
} }
type packet struct { type packet struct {
isClientFlow bool // client->server
isClientFlow bool //client->server
messageLength int messageLength int
requestID int requestID int
responseTo int responseTo int
opCode int //request type opCode int // request type
payload io.Reader payload io.Reader
} }
var mongodbInstance *Mongodb var mongodbInstance *Mongodb
@ -42,29 +42,29 @@ var mongodbInstance *Mongodb
func NewInstance() *Mongodb { func NewInstance() *Mongodb {
if mongodbInstance == nil { if mongodbInstance == nil {
mongodbInstance = &Mongodb{ mongodbInstance = &Mongodb{
port :Port, port: Port,
version:Version, version: Version,
source: make(map[string]*stream), source: make(map[string]*stream),
} }
} }
return mongodbInstance return mongodbInstance
} }
func (m *Mongodb) SetFlag(flg []string) { func (m *Mongodb) SetFlag(flg []string) {
c := len(flg) c := len(flg)
if c == 0 { if c == 0 {
return return
} }
if c >> 1 != 1 { if c>>1 != 1 {
panic("ERR : Mongodb Number of parameters") panic("ERR : Mongodb Number of parameters")
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
p, err := strconv.Atoi(val); p, err := strconv.Atoi(val)
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")
} }
@ -80,7 +80,7 @@ func (m *Mongodb) SetFlag(flg []string) {
} }
func (m *Mongodb) BPFFilter() string { func (m *Mongodb) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *Mongodb) Version() string { func (m *Mongodb) Version() string {
@ -89,22 +89,22 @@ func (m *Mongodb) Version() string {
func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) { func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
//uuid // uuid
uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash()) uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash())
//resolve packet // resolve packet
if _, ok := m.source[uuid]; !ok { if _, ok := m.source[uuid]; !ok {
var newStream = stream { var newStream = stream{
packets:make(chan *packet, 100), packets: make(chan *packet, 100),
} }
m.source[uuid] = &newStream m.source[uuid] = &newStream
go newStream.resolve() go newStream.resolve()
} }
//read bi-directional packet // read bi-directional packet
//server -> client || client -> server // server -> client || client -> server
for { for {
newPacket := m.newPacket(net, transport, buf) newPacket := m.newPacket(net, transport, buf)
@ -118,12 +118,12 @@ func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet { func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
//read packet // read packet
var packet *packet var packet *packet
var err error var err error
packet, err = readStream(r) packet, err = readStream(r)
//stream close // stream close
if err == io.EOF { if err == io.EOF {
fmt.Println(net, transport, " close") fmt.Println(net, transport, " close")
return nil return nil
@ -132,10 +132,10 @@ func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
return nil return nil
} }
//set flow direction // set flow direction
if transport.Src().String() == strconv.Itoa(m.port) { if transport.Src().String() == strconv.Itoa(m.port) {
packet.isClientFlow = false packet.isClientFlow = false
}else{ } else {
packet.isClientFlow = true packet.isClientFlow = true
} }
@ -145,7 +145,7 @@ func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
func (stm *stream) resolve() { func (stm *stream) resolve() {
for { for {
select { select {
case packet := <- stm.packets: case packet := <-stm.packets:
if packet.isClientFlow { if packet.isClientFlow {
stm.resolveClientPacket(packet) stm.resolveClientPacket(packet)
} else { } else {
@ -165,11 +165,11 @@ func (stm *stream) resolveClientPacket(pk *packet) {
switch pk.opCode { switch pk.opCode {
case OP_UPDATE: case OP_UPDATE:
zero := ReadInt32(pk.payload) zero := ReadInt32(pk.payload)
fullCollectionName := ReadString(pk.payload) fullCollectionName := ReadString(pk.payload)
flags := ReadInt32(pk.payload) flags := ReadInt32(pk.payload)
selector := ReadBson2Json(pk.payload) selector := ReadBson2Json(pk.payload)
update := ReadBson2Json(pk.payload) update := ReadBson2Json(pk.payload)
_ = zero _ = zero
_ = flags _ = flags
@ -180,9 +180,9 @@ func (stm *stream) resolveClientPacket(pk *packet) {
) )
case OP_INSERT: case OP_INSERT:
flags := ReadInt32(pk.payload) flags := ReadInt32(pk.payload)
fullCollectionName := ReadString(pk.payload) fullCollectionName := ReadString(pk.payload)
command := ReadBson2Json(pk.payload) command := ReadBson2Json(pk.payload)
_ = flags _ = flags
msg = fmt.Sprintf(" [Insert] [coll:%s] %v", msg = fmt.Sprintf(" [Insert] [coll:%s] %v",
@ -191,16 +191,16 @@ func (stm *stream) resolveClientPacket(pk *packet) {
) )
case OP_QUERY: case OP_QUERY:
flags := ReadInt32(pk.payload) flags := ReadInt32(pk.payload)
fullCollectionName := ReadString(pk.payload) fullCollectionName := ReadString(pk.payload)
numberToSkip := ReadInt32(pk.payload) numberToSkip := ReadInt32(pk.payload)
numberToReturn := ReadInt32(pk.payload) numberToReturn := ReadInt32(pk.payload)
_ = flags _ = flags
_ = numberToSkip _ = numberToSkip
_ = numberToReturn _ = numberToReturn
command := ReadBson2Json(pk.payload) command := ReadBson2Json(pk.payload)
selector := ReadBson2Json(pk.payload) selector := ReadBson2Json(pk.payload)
msg = fmt.Sprintf(" [Query] [coll:%s] %v %v", msg = fmt.Sprintf(" [Query] [coll:%s] %v %v",
fullCollectionName, fullCollectionName,
@ -209,11 +209,11 @@ func (stm *stream) resolveClientPacket(pk *packet) {
) )
case OP_COMMAND: case OP_COMMAND:
database := ReadString(pk.payload) database := ReadString(pk.payload)
commandName := ReadString(pk.payload) commandName := ReadString(pk.payload)
metaData := ReadBson2Json(pk.payload) metaData := ReadBson2Json(pk.payload)
commandArgs := ReadBson2Json(pk.payload) commandArgs := ReadBson2Json(pk.payload)
inputDocs := ReadBson2Json(pk.payload) inputDocs := ReadBson2Json(pk.payload)
msg = fmt.Sprintf(" [Commend] [DB:%s] [Cmd:%s] %v %v %v", msg = fmt.Sprintf(" [Commend] [DB:%s] [Cmd:%s] %v %v %v",
database, database,
@ -224,10 +224,10 @@ func (stm *stream) resolveClientPacket(pk *packet) {
) )
case OP_GET_MORE: case OP_GET_MORE:
zero := ReadInt32(pk.payload) zero := ReadInt32(pk.payload)
fullCollectionName := ReadString(pk.payload) fullCollectionName := ReadString(pk.payload)
numberToReturn := ReadInt32(pk.payload) numberToReturn := ReadInt32(pk.payload)
cursorId := ReadInt64(pk.payload) cursorId := ReadInt64(pk.payload)
_ = zero _ = zero
msg = fmt.Sprintf(" [Query more] [coll:%s] [num of reply:%v] [cursor:%v]", msg = fmt.Sprintf(" [Query more] [coll:%s] [num of reply:%v] [cursor:%v]",
@ -237,10 +237,10 @@ func (stm *stream) resolveClientPacket(pk *packet) {
) )
case OP_DELETE: case OP_DELETE:
zero := ReadInt32(pk.payload) zero := ReadInt32(pk.payload)
fullCollectionName := ReadString(pk.payload) fullCollectionName := ReadString(pk.payload)
flags := ReadInt32(pk.payload) flags := ReadInt32(pk.payload)
selector := ReadBson2Json(pk.payload) selector := ReadBson2Json(pk.payload)
_ = zero _ = zero
_ = flags _ = flags
@ -263,10 +263,10 @@ func readStream(r io.Reader) (*packet, error) {
var buf bytes.Buffer var buf bytes.Buffer
p := &packet{} p := &packet{}
//header // header
header := make([]byte, 16) header := make([]byte, 16)
if _, err := io.ReadFull(r, header); err != nil { if _, err := io.ReadFull(r, header); err != nil {
return nil,err return nil, err
} }
// message length // message length

10
plugSrc/mongodb/build/internal/json/decode.go
View File

@ -773,7 +773,7 @@ func (d *decodeState) isNull(off int) bool {
// name consumes a const or function from d.data[d.off-1:], decoding into the value v. // name consumes a const or function from d.data[d.off-1:], decoding into the value v.
// the first byte of the function name has been read already. // the first byte of the function name has been read already.
func (d *decodeState) name(v reflect.Value) { func (d *decodeState) name(v reflect.Value) {
if d.isNull(d.off-1) { if d.isNull(d.off - 1) {
d.literal(v) d.literal(v)
return return
} }
@ -859,7 +859,7 @@ func (d *decodeState) name(v reflect.Value) {
} }
// TODO Fix case of func field as map. // TODO Fix case of func field as map.
//topv := v // topv := v
// Figure out field corresponding to function. // Figure out field corresponding to function.
key := []byte(funcData.key) key := []byte(funcData.key)
@ -1076,9 +1076,9 @@ func (d *decodeState) storeKeyed(v reflect.Value) bool {
} }
var ( var (
trueBytes = []byte("true") trueBytes = []byte("true")
falseBytes = []byte("false") falseBytes = []byte("false")
nullBytes = []byte("null") nullBytes = []byte("null")
) )
func (d *decodeState) storeValue(v reflect.Value, from interface{}) { func (d *decodeState) storeValue(v reflect.Value, from interface{}) {
@ -1173,7 +1173,7 @@ var numberType = reflect.TypeOf(Number(""))
func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) { func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) {
// Check for unmarshaler. // Check for unmarshaler.
if len(item) == 0 { if len(item) == 0 {
//Empty string given // Empty string given
d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())) d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
return return
} }

16
plugSrc/mongodb/build/util.go
View File

@ -4,8 +4,9 @@ import (
"encoding/binary" "encoding/binary"
"encoding/json" "encoding/json"
"fmt" "fmt"
"time"
"io" "io"
"time"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/bson" "github.com/40t/go-sniffer/plugSrc/mongodb/build/bson"
) )
@ -15,7 +16,7 @@ func GetNowStr(isClient bool) string {
msg += time.Now().Format(layout) msg += time.Now().Format(layout)
if isClient { if isClient {
msg += "| cli -> ser |" msg += "| cli -> ser |"
}else{ } else {
msg += "| ser -> cli |" msg += "| ser -> cli |"
} }
return msg return msg
@ -54,33 +55,32 @@ func ReadString(r io.Reader) string {
return string(result) return string(result)
} }
func ReadBson2Json(r io.Reader) (string) { func ReadBson2Json(r io.Reader) string {
//read len // read len
docLen := ReadInt32(r) docLen := ReadInt32(r)
if docLen == 0 { if docLen == 0 {
return "" return ""
} }
//document []byte // document []byte
docBytes := make([]byte, int(docLen)) docBytes := make([]byte, int(docLen))
binary.LittleEndian.PutUint32(docBytes, uint32(docLen)) binary.LittleEndian.PutUint32(docBytes, uint32(docLen))
if _, err := io.ReadFull(r, docBytes[4:]); err != nil { if _, err := io.ReadFull(r, docBytes[4:]); err != nil {
panic(err) panic(err)
} }
//resolve document // resolve document
var bsn bson.M var bsn bson.M
err := bson.Unmarshal(docBytes, &bsn) err := bson.Unmarshal(docBytes, &bsn)
if err != nil { if err != nil {
panic(err) panic(err)
} }
//format to Json // format to Json
jsonStr, err := json.Marshal(bsn) jsonStr, err := json.Marshal(bsn)
if err != nil { if err != nil {
return fmt.Sprintf("{\"error\":%s}", err.Error()) return fmt.Sprintf("{\"error\":%s}", err.Error())
} }
return string(jsonStr) return string(jsonStr)
} }

106
plugSrc/mysql/build/const.go
View File

@ -1,67 +1,67 @@
package build package build
const ( const (
ComQueryRequestPacket string = "【Query】" ComQueryRequestPacket string = "【Query】"
OkPacket string = "【Ok】" OkPacket string = "【Ok】"
ErrorPacket string = "【Err】" ErrorPacket string = "【Err】"
PreparePacket string = "【Pretreatment】" PreparePacket string = "【Pretreatment】"
SendClientHandshakePacket string = "【User Auth】" SendClientHandshakePacket string = "【User Auth】"
SendServerHandshakePacket string = "【Login】" SendServerHandshakePacket string = "【Login】"
) )
const ( const (
COM_SLEEP byte = 0 COM_SLEEP byte = 0
COM_QUIT = 1 COM_QUIT = 1
COM_INIT_DB = 2 COM_INIT_DB = 2
COM_QUERY = 3 COM_QUERY = 3
COM_FIELD_LIST = 4 COM_FIELD_LIST = 4
COM_CREATE_DB = 5 COM_CREATE_DB = 5
COM_DROP_DB = 6 COM_DROP_DB = 6
COM_REFRESH = 7 COM_REFRESH = 7
COM_SHUTDOWN = 8 COM_SHUTDOWN = 8
COM_STATISTICS = 9 COM_STATISTICS = 9
COM_PROCESS_INFO = 10 COM_PROCESS_INFO = 10
COM_CONNECT = 11 COM_CONNECT = 11
COM_PROCESS_KILL = 12 COM_PROCESS_KILL = 12
COM_DEBUG = 13 COM_DEBUG = 13
COM_PING = 14 COM_PING = 14
COM_TIME = 15 COM_TIME = 15
COM_DELAYED_INSERT = 16 COM_DELAYED_INSERT = 16
COM_CHANGE_USER = 17 COM_CHANGE_USER = 17
COM_BINLOG_DUMP = 18 COM_BINLOG_DUMP = 18
COM_TABLE_DUMP = 19 COM_TABLE_DUMP = 19
COM_CONNECT_OUT = 20 COM_CONNECT_OUT = 20
COM_REGISTER_SLAVE = 21 COM_REGISTER_SLAVE = 21
COM_STMT_PREPARE = 22 COM_STMT_PREPARE = 22
COM_STMT_EXECUTE = 23 COM_STMT_EXECUTE = 23
COM_STMT_SEND_LONG_DATA = 24 COM_STMT_SEND_LONG_DATA = 24
COM_STMT_CLOSE = 25 COM_STMT_CLOSE = 25
COM_STMT_RESET = 26 COM_STMT_RESET = 26
COM_SET_OPTION = 27 COM_SET_OPTION = 27
COM_STMT_FETCH = 28 COM_STMT_FETCH = 28
COM_DAEMON = 29 COM_DAEMON = 29
COM_BINLOG_DUMP_GTID = 30 COM_BINLOG_DUMP_GTID = 30
COM_RESET_CONNECTION = 31 COM_RESET_CONNECTION = 31
) )
const ( const (
MYSQL_TYPE_DECIMAL byte = 0 MYSQL_TYPE_DECIMAL byte = 0
MYSQL_TYPE_TINY = 1 MYSQL_TYPE_TINY = 1
MYSQL_TYPE_SHORT = 2 MYSQL_TYPE_SHORT = 2
MYSQL_TYPE_LONG = 3 MYSQL_TYPE_LONG = 3
MYSQL_TYPE_FLOAT = 4 MYSQL_TYPE_FLOAT = 4
MYSQL_TYPE_DOUBLE = 5 MYSQL_TYPE_DOUBLE = 5
MYSQL_TYPE_NULL = 6 MYSQL_TYPE_NULL = 6
MYSQL_TYPE_TIMESTAMP = 7 MYSQL_TYPE_TIMESTAMP = 7
MYSQL_TYPE_LONGLONG = 8 MYSQL_TYPE_LONGLONG = 8
MYSQL_TYPE_INT24 = 9 MYSQL_TYPE_INT24 = 9
MYSQL_TYPE_DATE = 10 MYSQL_TYPE_DATE = 10
MYSQL_TYPE_TIME = 11 MYSQL_TYPE_TIME = 11
MYSQL_TYPE_DATETIME = 12 MYSQL_TYPE_DATETIME = 12
MYSQL_TYPE_YEAR = 13 MYSQL_TYPE_YEAR = 13
MYSQL_TYPE_NEWDATE = 14 MYSQL_TYPE_NEWDATE = 14
MYSQL_TYPE_VARCHAR = 15 MYSQL_TYPE_VARCHAR = 15
MYSQL_TYPE_BIT = 16 MYSQL_TYPE_BIT = 16
) )
const ( const (

137
plugSrc/mysql/build/entry.go
View File

@ -1,30 +1,31 @@
package build package build
import ( import (
"github.com/google/gopacket"
"io"
"bytes" "bytes"
"encoding/binary"
"errors" "errors"
"fmt"
"io"
"log" "log"
"os"
"strconv" "strconv"
"strings"
"sync" "sync"
"time" "time"
"fmt"
"encoding/binary" "github.com/google/gopacket"
"strings"
"os"
) )
const ( const (
Port = 3306 Port = 3306
Version = "0.1" Version = "0.1"
CmdPort = "-p" CmdPort = "-p"
) )
type Mysql struct { type Mysql struct {
port int port int
version string version string
source map[string]*stream source map[string]*stream
} }
type stream struct { type stream struct {
@ -34,20 +35,21 @@ type stream struct {
type packet struct { type packet struct {
isClientFlow bool isClientFlow bool
seq int seq int
length int length int
payload []byte payload []byte
} }
var mysql *Mysql var mysql *Mysql
var once sync.Once var once sync.Once
func NewInstance() *Mysql { func NewInstance() *Mysql {
once.Do(func() { once.Do(func() {
mysql = &Mysql{ mysql = &Mysql{
port :Port, port: Port,
version:Version, version: Version,
source: make(map[string]*stream), source: make(map[string]*stream),
} }
}) })
@ -56,23 +58,23 @@ func NewInstance() *Mysql {
func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) { func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
//uuid // uuid
uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash()) uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash())
//generate resolve's stream // generate resolve's stream
if _, ok := m.source[uuid]; !ok { if _, ok := m.source[uuid]; !ok {
var newStream = stream{ var newStream = stream{
packets:make(chan *packet, 100), packets: make(chan *packet, 100),
stmtMap:make(map[uint32]*Stmt), stmtMap: make(map[uint32]*Stmt),
} }
m.source[uuid] = &newStream m.source[uuid] = &newStream
go newStream.resolve() go newStream.resolve()
} }
//read bi-directional packet // read bi-directional packet
//server -> client || client -> server // server -> client || client -> server
for { for {
newPacket := m.newPacket(net, transport, buf) newPacket := m.newPacket(net, transport, buf)
@ -86,31 +88,31 @@ func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
} }
func (m *Mysql) BPFFilter() string { func (m *Mysql) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *Mysql) Version() string { func (m *Mysql) Version() string {
return Version return Version
} }
func (m *Mysql) SetFlag(flg []string) { func (m *Mysql) SetFlag(flg []string) {
c := len(flg) c := len(flg)
if c == 0 { if c == 0 {
return return
} }
if c >> 1 == 0 { if c>>1 == 0 {
fmt.Println("ERR : Mysql Number of parameters") fmt.Println("ERR : Mysql Number of parameters")
os.Exit(1) os.Exit(1)
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
m.port = port m.port = port
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")
@ -127,7 +129,7 @@ func (m *Mysql) SetFlag(flg []string) {
func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet { func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
//read packet // read packet
var payload bytes.Buffer var payload bytes.Buffer
var seq uint8 var seq uint8
var err error var err error
@ -135,7 +137,7 @@ func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
return nil return nil
} }
//close stream // close stream
if err == io.EOF { if err == io.EOF {
fmt.Println(net, transport, " close") fmt.Println(net, transport, " close")
return nil return nil
@ -143,15 +145,15 @@ func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
fmt.Println("ERR : Unknown stream", net, transport, ":", err) fmt.Println("ERR : Unknown stream", net, transport, ":", err)
} }
//generate new packet // generate new packet
var pk = packet{ var pk = packet{
seq: int(seq), seq: int(seq),
length:payload.Len(), length: payload.Len(),
payload:payload.Bytes(), payload: payload.Bytes(),
} }
if transport.Src().String() == strconv.Itoa(Port) { if transport.Src().String() == strconv.Itoa(Port) {
pk.isClientFlow = false pk.isClientFlow = false
}else{ } else {
pk.isClientFlow = true pk.isClientFlow = true
} }
@ -187,7 +189,7 @@ func (m *Mysql) resolvePacketTo(r io.Reader, w io.Writer) (uint8, error) {
func (stm *stream) resolve() { func (stm *stream) resolve() {
for { for {
select { select {
case packet := <- stm.packets: case packet := <-stm.packets:
if packet.length != 0 { if packet.length != 0 {
if packet.isClientFlow { if packet.isClientFlow {
stm.resolveClientPacket(packet.payload, packet.seq) stm.resolveClientPacket(packet.payload, packet.seq)
@ -199,10 +201,10 @@ func (stm *stream) resolve() {
} }
} }
func (stm *stream) findStmtPacket (srv chan *packet, seq int) *packet { func (stm *stream) findStmtPacket(srv chan *packet, seq int) *packet {
for { for {
select { select {
case packet, ok := <- stm.packets: case packet, ok := <-stm.packets:
if !ok { if !ok {
return nil return nil
} }
@ -223,23 +225,23 @@ func (stm *stream) resolveServerPacket(payload []byte, seq int) {
} }
switch payload[0] { switch payload[0] {
case 0xff: case 0xff:
errorCode := int(binary.LittleEndian.Uint16(payload[1:3])) errorCode := int(binary.LittleEndian.Uint16(payload[1:3]))
errorMsg,_ := ReadStringFromByte(payload[4:]) errorMsg, _ := ReadStringFromByte(payload[4:])
msg = GetNowStr(false)+"%s Err code:%s,Err msg:%s" msg = GetNowStr(false) + "%s Err code:%s,Err msg:%s"
msg = fmt.Sprintf(msg, ErrorPacket, strconv.Itoa(errorCode), strings.TrimSpace(errorMsg)) msg = fmt.Sprintf(msg, ErrorPacket, strconv.Itoa(errorCode), strings.TrimSpace(errorMsg))
case 0x00: case 0x00:
var pos = 1 var pos = 1
l,_ := LengthBinary(payload[pos:]) l, _ := LengthBinary(payload[pos:])
affectedRows := int(l) affectedRows := int(l)
msg += GetNowStr(false)+"%s Effect Row:%s" msg += GetNowStr(false) + "%s Effect Row:%s"
msg = fmt.Sprintf(msg, OkPacket, strconv.Itoa(affectedRows)) msg = fmt.Sprintf(msg, OkPacket, strconv.Itoa(affectedRows))
default: default:
return return
} }
fmt.Println(msg) fmt.Println(msg)
@ -268,25 +270,25 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
return return
} }
//fetch stm id // fetch stm id
stmtID := binary.LittleEndian.Uint32(serverPacket.payload[1:5]) stmtID := binary.LittleEndian.Uint32(serverPacket.payload[1:5])
stmt := &Stmt{ stmt := &Stmt{
ID: stmtID, ID: stmtID,
Query: string(payload[1:]), Query: string(payload[1:]),
} }
//record stm sql // record stm sql
stm.stmtMap[stmtID] = stmt stm.stmtMap[stmtID] = stmt
stmt.FieldCount = binary.LittleEndian.Uint16(serverPacket.payload[5:7]) stmt.FieldCount = binary.LittleEndian.Uint16(serverPacket.payload[5:7])
stmt.ParamCount = binary.LittleEndian.Uint16(serverPacket.payload[7:9]) stmt.ParamCount = binary.LittleEndian.Uint16(serverPacket.payload[7:9])
stmt.Args = make([]interface{}, stmt.ParamCount) stmt.Args = make([]interface{}, stmt.ParamCount)
msg = PreparePacket+stmt.Query msg = PreparePacket + stmt.Query
case COM_STMT_SEND_LONG_DATA: case COM_STMT_SEND_LONG_DATA:
stmtID := binary.LittleEndian.Uint32(payload[1:5]) stmtID := binary.LittleEndian.Uint32(payload[1:5])
paramId := binary.LittleEndian.Uint16(payload[5:7]) paramId := binary.LittleEndian.Uint16(payload[5:7])
stmt, _ := stm.stmtMap[stmtID] stmt, _ := stm.stmtMap[stmtID]
if stmt.Args[paramId] == nil { if stmt.Args[paramId] == nil {
stmt.Args[paramId] = payload[7:] stmt.Args[paramId] = payload[7:]
@ -300,7 +302,7 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
case COM_STMT_RESET: case COM_STMT_RESET:
stmtID := binary.LittleEndian.Uint32(payload[1:5]) stmtID := binary.LittleEndian.Uint32(payload[1:5])
stmt, _:= stm.stmtMap[stmtID] stmt, _ := stm.stmtMap[stmtID]
stmt.Args = make([]interface{}, stmt.ParamCount) stmt.Args = make([]interface{}, stmt.ParamCount)
return return
case COM_STMT_EXECUTE: case COM_STMT_EXECUTE:
@ -315,32 +317,32 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
return return
} }
//params // params
pos += 5 pos += 5
if stmt.ParamCount > 0 { if stmt.ParamCount > 0 {
//（Null-Bitmap，len = (paramsCount + 7) / 8 byte） // （Null-Bitmap，len = (paramsCount + 7) / 8 byte）
step := int((stmt.ParamCount + 7) / 8) step := int((stmt.ParamCount + 7) / 8)
nullBitmap := payload[pos : pos+step] nullBitmap := payload[pos : pos+step]
pos += step pos += step
//Parameter separator // Parameter separator
flag := payload[pos] flag := payload[pos]
pos++ pos++
var pTypes []byte var pTypes []byte
var pValues []byte var pValues []byte
//if flag == 1 // if flag == 1
//n （len = paramsCount * 2 byte） // n （len = paramsCount * 2 byte）
if flag == 1 { if flag == 1 {
pTypes = payload[pos : pos+int(stmt.ParamCount)*2] pTypes = payload[pos : pos+int(stmt.ParamCount)*2]
pos += int(stmt.ParamCount) * 2 pos += int(stmt.ParamCount) * 2
pValues = payload[pos:] pValues = payload[pos:]
} }
//bind params // bind params
err := stmt.BindArgs(nullBitmap, pTypes, pValues) err := stmt.BindArgs(nullBitmap, pTypes, pValues)
if err != nil { if err != nil {
log.Println("ERR : Could not bind params", err) log.Println("ERR : Could not bind params", err)
@ -353,4 +355,3 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
fmt.Println(GetNowStr(true) + msg) fmt.Println(GetNowStr(true) + msg)
} }

2
plugSrc/mysql/build/stmt.go
View File

@ -3,10 +3,10 @@ package build
import ( import (
"bytes" "bytes"
"encoding/binary" "encoding/binary"
"errors"
"fmt" "fmt"
"math" "math"
"strings" "strings"
"errors"
) )
type Stmt struct { type Stmt struct {

14
plugSrc/mysql/build/util.go
View File

@ -12,13 +12,13 @@ func GetNowStr(isClient bool) string {
msg += time.Now().Format("2006-01-02 15:04:05") msg += time.Now().Format("2006-01-02 15:04:05")
if isClient { if isClient {
msg += "| cli -> ser |" msg += "| cli -> ser |"
}else{ } else {
msg += "| ser -> cli |" msg += "| ser -> cli |"
} }
return msg return msg
} }
func ReadStringFromByte(b []byte) (string,int) { func ReadStringFromByte(b []byte) (string, int) {
var l int var l int
l = bytes.IndexByte(b, 0x00) l = bytes.IndexByte(b, 0x00)
@ -35,18 +35,18 @@ func LengthBinary(b []byte) (uint32, int) {
return uint32(first), 1 return uint32(first), 1
} }
if first == 251 { if first == 251 {
return 0,1 return 0, 1
} }
if first == 252 { if first == 252 {
return binary.LittleEndian.Uint32(b[1:2]),1 return binary.LittleEndian.Uint32(b[1:2]), 1
} }
if first == 253 { if first == 253 {
return binary.LittleEndian.Uint32(b[1:4]),3 return binary.LittleEndian.Uint32(b[1:4]), 3
} }
if first == 254 { if first == 254 {
return binary.LittleEndian.Uint32(b[1:9]),8 return binary.LittleEndian.Uint32(b[1:9]), 8
} }
return 0,0 return 0, 0
} }
func LengthEncodedInt(input []byte) (num uint64, isNull bool, n int) { func LengthEncodedInt(input []byte) (num uint64, isNull bool, n int) {

60
plugSrc/redis/build/entry.go
View File

@ -1,33 +1,34 @@
package build package build
import ( import (
"github.com/google/gopacket"
"io"
"strings"
"fmt"
"strconv"
"bufio" "bufio"
"fmt"
"io"
"strconv"
"strings"
"github.com/google/gopacket"
) )
type Redis struct { type Redis struct {
port int port int
version string version string
cmd chan string cmd chan string
done chan bool done chan bool
} }
const ( const (
Port int = 6379 Port int = 6379
Version string = "0.1" Version string = "0.1"
CmdPort string = "-p" CmdPort string = "-p"
) )
var redis = &Redis { var redis = &Redis{
port:Port, port: Port,
version:Version, version: Version,
} }
func NewInstance() *Redis{ func NewInstance() *Redis {
return redis return redis
} }
@ -49,23 +50,23 @@ func (red Redis) ResolveStream(net, transport gopacket.Flow, r io.Reader) {
} }
} }
//Filtering useless data // Filtering useless data
if !strings.HasPrefix(string(line), "*") { if !strings.HasPrefix(string(line), "*") {
continue continue
} }
//Do not display // Do not display
if strings.EqualFold(transport.Src().String(), strconv.Itoa(red.port)) == true { if strings.EqualFold(transport.Src().String(), strconv.Itoa(red.port)) == true {
continue continue
} }
//run // run
l := string(line[1]) l := string(line[1])
cmdCount, _ = strconv.Atoi(l) cmdCount, _ = strconv.Atoi(l)
cmd = "" cmd = ""
for j := 0; j < cmdCount * 2; j++ { for j := 0; j < cmdCount*2; j++ {
c, _, _ := buf.ReadLine() c, _, _ := buf.ReadLine()
if j & 1 == 0 { if j&1 == 0 {
continue continue
} }
cmd += " " + string(c) cmd += " " + string(c)
@ -74,24 +75,22 @@ func (red Redis) ResolveStream(net, transport gopacket.Flow, r io.Reader) {
} }
} }
/** // SetOption
SetOption func (red *Redis) SetFlag(flg []string) {
*/
func (red *Redis) SetFlag(flg []string) {
c := len(flg) c := len(flg)
if c == 0 { if c == 0 {
return return
} }
if c >> 1 != 1 { if c>>1 != 1 {
panic("ERR : Redis num of params") panic("ERR : Redis num of params")
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
redis.port = port redis.port = port
if err != nil { if err != nil {
panic("ERR : Port error") panic("ERR : Port error")
@ -106,17 +105,12 @@ func (red *Redis) SetFlag(flg []string) {
} }
} }
/** // BPFFilter
BPFFilter
*/
func (red *Redis) BPFFilter() string { func (red *Redis) BPFFilter() string {
return "tcp and port "+strconv.Itoa(redis.port) return "tcp and port " + strconv.Itoa(redis.port)
} }
/** // Version
Version
*/
func (red *Redis) Version() string { func (red *Redis) Version() string {
return red.version return red.version
} }