7x31/go-sniffer
1
0
Fork 0
mirror of https://github.com/40t/go-sniffer.git synced 2025-08-21 12:21:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

A: go.mod

Browse Source
This commit is contained in:
Shuo
2020-03-01 15:58:57 +08:00
parent e209ea8ccc
commit 4f174b3415
21 changed files with 394 additions and 386 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
core/assembly.go
View File

@@ -191,28 +191,28 @@ func (p *StreamPool) connections() []*connection {
return conns
}
//FlushOlderThan finds any streams waiting for packets older than the given
//time, and pushes through the data they have (IE: tells them to stop waiting
//and skip the data they're waiting for).
//
//Each Stream maintains a list of zero or more sets of bytes it has received
//out-of-order. For example, if it has processed up through sequence number
//10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of
//bytes also has the timestamp it was originally viewed. A flush call will
//look at the smallest subsequent set of bytes, in this case [15-20), and if
//its timestamp is older than the passed-in time, it will push it and all
//contiguous byte-sets out to the Stream's Reassembled function. In this case,
//it will push [15-20), but also [20-25), since that's contiguous. It will
//only push [30-50) if its timestamp is also older than the passed-in time,
//otherwise it will wait until the next FlushOlderThan to see if bytes [25-30)
//come in.
//
//If it pushes all bytes (or there were no sets of bytes to begin with) AND the
//connection has not received any bytes since the passed-in time, the
//connection will be closed.
//
//Returns the number of connections flushed, and of those, the number closed
//because of the flush.
// FlushOlderThan finds any streams waiting for packets older than the given
// time, and pushes through the data they have (IE: tells them to stop waiting
// and skip the data they're waiting for).
//
// Each Stream maintains a list of zero or more sets of bytes it has received
// out-of-order. For example, if it has processed up through sequence number
// 10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of
// bytes also has the timestamp it was originally viewed. A flush call will
// look at the smallest subsequent set of bytes, in this case [15-20), and if
// its timestamp is older than the passed-in time, it will push it and all
// contiguous byte-sets out to the Stream's Reassembled function. In this case,
// it will push [15-20), but also [20-25), since that's contiguous. It will
// only push [30-50) if its timestamp is also older than the passed-in time,
// otherwise it will wait until the next FlushOlderThan to see if bytes [25-30)
// come in.
//
// If it pushes all bytes (or there were no sets of bytes to begin with) AND the
// connection has not received any bytes since the passed-in time, the
// connection will be closed.
//
// Returns the number of connections flushed, and of those, the number closed
// because of the flush.
func (a *Assembler) FlushOlderThan(t time.Time) (flushed, closed int) {
conns := a.connPool.connections()
closes := 0

78
core/cmd.go
View File

@@ -1,11 +1,11 @@
package core
import (
"os"
"strings"
"fmt"
"net"
"os"
"strconv"
"strings"
)
const InternalCmdPrefix = "--"
@@ -18,27 +18,27 @@ const (
)
type Cmd struct {
Device string
Device string
plugHandle *Plug
}
func NewCmd(p *Plug) *Cmd {
return &Cmd{
plugHandle:p,
plugHandle: p,
}
}
//start
// start
func (cm *Cmd) Run() {
//print help
// print help
if len(os.Args) <= 1 {
cm.printHelpMessage()
os.Exit(1)
}
//parse command
// parse command
firstArg := string(os.Args[1])
if strings.HasPrefix(firstArg, InternalCmdPrefix) {
cm.parseInternalCmd()
@@ -47,35 +47,35 @@ func (cm *Cmd) Run() {
}
}
//parse internal commend
//like --help, --env, --device
// parse internal commend
// like --help, --env, --device
func (cm *Cmd) parseInternalCmd() {
arg := string(os.Args[1])
cmd := strings.Trim(arg, InternalCmdPrefix)
switch cmd {
case InternalCmdHelp:
cm.printHelpMessage()
break
case InternalCmdEnv:
fmt.Println("External plug-in path : "+cm.plugHandle.dir)
break
case InternalCmdList:
cm.plugHandle.PrintList()
break
case InternalCmdVer:
fmt.Println(cxt.Version)
break
case InternalDevice:
cm.printDevice()
break
case InternalCmdHelp:
cm.printHelpMessage()
break
case InternalCmdEnv:
fmt.Println("External plug-in path : " + cm.plugHandle.dir)
break
case InternalCmdList:
cm.plugHandle.PrintList()
break
case InternalCmdVer:
fmt.Println(cxt.Version)
break
case InternalDevice:
cm.printDevice()
break
}
os.Exit(1)
}
//usage
func (cm *Cmd) printHelpMessage() {
// usage
func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================")
fmt.Println("[Usage]")
@@ -100,33 +100,33 @@ func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================")
}
//print plug-in list
// print plug-in list
func (cm *Cmd) printPlugList() {
l := len(cm.plugHandle.InternalPlugList)
l += len(cm.plugHandle.ExternalPlugList)
fmt.Println("# Number of plug-ins : "+strconv.Itoa(l))
fmt.Println("# Number of plug-ins : " + strconv.Itoa(l))
}
//print device
// print device
func (cm *Cmd) printDevice() {
ifaces, err:= net.Interfaces()
ifaces, err := net.Interfaces()
if err != nil {
panic(err)
}
for _, iface := range ifaces {
addrs, _ := iface.Addrs()
for _,a:=range addrs {
for _, a := range addrs {
if ipnet, ok := a.(*net.IPNet); ok {
if ip4 := ipnet.IP.To4(); ip4 != nil {
fmt.Println("[device] : "+iface.Name+" : "+iface.HardwareAddr.String()+" "+ip4.String())
fmt.Println("[device] : " + iface.Name + " : " + iface.HardwareAddr.String() + " " + ip4.String())
}
}
}
}
}
//Parameters needed for plug-ins
func (cm *Cmd) parsePlugCmd() {
// Parameters needed for plug-ins
func (cm *Cmd) parsePlugCmd() {
if len(os.Args) < 3 {
fmt.Println("not found [Plug-in name]")
@@ -134,12 +134,8 @@ func (cm *Cmd) parsePlugCmd() {
os.Exit(1)
}
cm.Device = os.Args[1]
plugName := os.Args[2]
plugParams:= os.Args[3:]
cm.Device = os.Args[1]
plugName := os.Args[2]
plugParams := os.Args[3:]
cm.plugHandle.SetOption(plugName, plugParams)
}

12
core/core.go
View File

@@ -1,6 +1,6 @@
package core
type Core struct{
type Core struct {
Version string
}
@@ -13,15 +13,15 @@ func New() Core {
return cxt
}
func (c *Core) Run() {
func (c *Core) Run() {
//new plugin
// new plugin
plug := NewPlug()
//parse commend
// parse commend
cmd := NewCmd(plug)
cmd.Run()
//dispatch
// dispatch
NewDispatch(plug, cmd).Capture()
}
}

43
core/dispatch.go
View File

@@ -2,57 +2,58 @@ package core
import (
"fmt"
"log"
"time"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"github.com/google/gopacket/tcpassembly"
"github.com/google/gopacket/tcpassembly/tcpreader"
"log"
"time"
)
type Dispatch struct {
device string
device string
payload []byte
Plug *Plug
Plug *Plug
}
func NewDispatch(plug *Plug, cmd *Cmd) *Dispatch {
return &Dispatch {
Plug: plug,
device:cmd.Device,
return &Dispatch{
Plug: plug,
device: cmd.Device,
}
}
func (d *Dispatch) Capture() {
//init device
// init device
handle, err := pcap.OpenLive(d.device, 65535, false, pcap.BlockForever)
if err != nil {
log.Fatal(err)
return
}
//set filter
// set filter
fmt.Println(d.Plug.BPF)
err = handle.SetBPFFilter(d.Plug.BPF)
if err != nil {
log.Fatal(err)
}
//capture
src := gopacket.NewPacketSource(handle, handle.LinkType())
// capture
src := gopacket.NewPacketSource(handle, handle.LinkType())
packets := src.Packets()
//set up assembly
// set up assembly
streamFactory := &ProtocolStreamFactory{
dispatch:d,
dispatch: d,
}
streamPool := NewStreamPool(streamFactory)
assembler := NewAssembler(streamPool)
ticker := time.Tick(time.Minute)
assembler := NewAssembler(streamPool)
ticker := time.Tick(time.Minute)
//loop until ctrl+z
// loop until ctrl+z
for {
select {
case packet := <-packets:
@@ -84,18 +85,18 @@ type ProtocolStream struct {
func (m *ProtocolStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
//init stream struct
stm := &ProtocolStream {
// init stream struct
stm := &ProtocolStream{
net: net,
transport: transport,
r: tcpreader.NewReaderStream(),
}
//new stream
// new stream
fmt.Println("# Start new stream:", net, transport)
//decode packet
// decode packet
go m.dispatch.Plug.ResolveStream(net, transport, &(stm.r))
return &(stm.r)
}
}

76
core/plug.go
View File

@@ -1,24 +1,24 @@
package core
import (
"io/ioutil"
"plugin"
"github.com/google/gopacket"
"fmt"
"io"
mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
redis "github.com/40t/go-sniffer/plugSrc/redis/build"
"io/ioutil"
"path"
"path/filepath"
"plugin"
hp "github.com/40t/go-sniffer/plugSrc/http/build"
mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build"
"path/filepath"
"fmt"
"path"
mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
redis "github.com/40t/go-sniffer/plugSrc/redis/build"
"github.com/google/gopacket"
)
type Plug struct {
dir string
dir string
ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)
BPF string
BPF string
InternalPlugList map[string]PlugInterface
ExternalPlugList map[string]ExternalPlug
@@ -48,7 +48,7 @@ func NewPlug() *Plug {
var p Plug
p.dir, _ = filepath.Abs( "./plug/")
p.dir, _ = filepath.Abs("./plug/")
p.LoadInternalPlugList()
p.LoadExternalPlugList()
@@ -59,17 +59,17 @@ func (p *Plug) LoadInternalPlugList() {
list := make(map[string]PlugInterface)
//Mysql
list["mysql"] = mysql.NewInstance()
// Mysql
list["mysql"] = mysql.NewInstance()
//Mongodb
list["mongodb"] = mongodb.NewInstance()
// Mongodb
list["mongodb"] = mongodb.NewInstance()
//Redis
list["redis"] = redis.NewInstance()
// Redis
list["redis"] = redis.NewInstance()
//Http
list["http"] = hp.NewInstance()
// Http
list["http"] = hp.NewInstance()
p.InternalPlugList = list
}
@@ -87,7 +87,7 @@ func (p *Plug) LoadExternalPlugList() {
continue
}
plug, err := plugin.Open(p.dir+"/"+fi.Name())
plug, err := plugin.Open(p.dir + "/" + fi.Name())
if err != nil {
panic(err)
}
@@ -113,12 +113,12 @@ func (p *Plug) LoadExternalPlugList() {
}
version := versionFunc.(func() string)()
p.ExternalPlugList[fi.Name()] = ExternalPlug {
ResolvePacket:ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)),
SetFlag:setFlagFunc.(func([]string)),
BPFFilter:BPFFilterFunc.(func() string),
Version:version,
Name:fi.Name(),
p.ExternalPlugList[fi.Name()] = ExternalPlug{
ResolvePacket: ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)),
SetFlag: setFlagFunc.(func([]string)),
BPFFilter: BPFFilterFunc.(func() string),
Version: version,
Name: fi.Name(),
}
}
}
@@ -129,34 +129,34 @@ func (p *Plug) ChangePath(dir string) {
func (p *Plug) PrintList() {
//Print Internal Plug
// Print Internal Plug
for inPlugName, _ := range p.InternalPlugList {
fmt.Println("internal plug : "+inPlugName)
fmt.Println("internal plug : " + inPlugName)
}
//split
// split
fmt.Println("-- --- --")
//print External Plug
// print External Plug
for exPlugName, _ := range p.ExternalPlugList {
fmt.Println("external plug : "+exPlugName)
fmt.Println("external plug : " + exPlugName)
}
}
func (p *Plug) SetOption(plugName string, plugParams []string) {
//Load Internal Plug
// Load Internal Plug
if internalPlug, ok := p.InternalPlugList[plugName]; ok {
p.ResolveStream = internalPlug.ResolveStream
internalPlug.SetFlag(plugParams)
p.BPF = internalPlug.BPFFilter()
p.BPF = internalPlug.BPFFilter()
return
}
//Load External Plug
plug, err := plugin.Open("./plug/"+ plugName)
// Load External Plug
plug, err := plugin.Open("./plug/" + plugName)
if err != nil {
panic(err)
}
@@ -174,5 +174,5 @@ func (p *Plug) SetOption(plugName string, plugParams []string) {
}
p.ResolveStream = resolvePacket.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader))
setFlag.(func([]string))(plugParams)
p.BPF = BPFFilter.(func()string)()
}
p.BPF = BPFFilter.(func() string)()
}