A: go.mod

This commit is contained in:
Shuo
2020-03-01 15:58:57 +08:00
parent e209ea8ccc
commit 4f174b3415
21 changed files with 394 additions and 386 deletions

View File

@@ -191,28 +191,28 @@ func (p *StreamPool) connections() []*connection {
return conns return conns
} }
//FlushOlderThan finds any streams waiting for packets older than the given // FlushOlderThan finds any streams waiting for packets older than the given
//time, and pushes through the data they have (IE: tells them to stop waiting // time, and pushes through the data they have (IE: tells them to stop waiting
//and skip the data they're waiting for). // and skip the data they're waiting for).
// //
//Each Stream maintains a list of zero or more sets of bytes it has received // Each Stream maintains a list of zero or more sets of bytes it has received
//out-of-order. For example, if it has processed up through sequence number // out-of-order. For example, if it has processed up through sequence number
//10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of // 10, it might have bytes [15-20), [20-25), [30,50) in its list. Each set of
//bytes also has the timestamp it was originally viewed. A flush call will // bytes also has the timestamp it was originally viewed. A flush call will
//look at the smallest subsequent set of bytes, in this case [15-20), and if // look at the smallest subsequent set of bytes, in this case [15-20), and if
//its timestamp is older than the passed-in time, it will push it and all // its timestamp is older than the passed-in time, it will push it and all
//contiguous byte-sets out to the Stream's Reassembled function. In this case, // contiguous byte-sets out to the Stream's Reassembled function. In this case,
//it will push [15-20), but also [20-25), since that's contiguous. It will // it will push [15-20), but also [20-25), since that's contiguous. It will
//only push [30-50) if its timestamp is also older than the passed-in time, // only push [30-50) if its timestamp is also older than the passed-in time,
//otherwise it will wait until the next FlushOlderThan to see if bytes [25-30) // otherwise it will wait until the next FlushOlderThan to see if bytes [25-30)
//come in. // come in.
// //
//If it pushes all bytes (or there were no sets of bytes to begin with) AND the // If it pushes all bytes (or there were no sets of bytes to begin with) AND the
//connection has not received any bytes since the passed-in time, the // connection has not received any bytes since the passed-in time, the
//connection will be closed. // connection will be closed.
// //
//Returns the number of connections flushed, and of those, the number closed // Returns the number of connections flushed, and of those, the number closed
//because of the flush. // because of the flush.
func (a *Assembler) FlushOlderThan(t time.Time) (flushed, closed int) { func (a *Assembler) FlushOlderThan(t time.Time) (flushed, closed int) {
conns := a.connPool.connections() conns := a.connPool.connections()
closes := 0 closes := 0

View File

@@ -1,11 +1,11 @@
package core package core
import ( import (
"os"
"strings"
"fmt" "fmt"
"net" "net"
"os"
"strconv" "strconv"
"strings"
) )
const InternalCmdPrefix = "--" const InternalCmdPrefix = "--"
@@ -25,20 +25,20 @@ type Cmd struct {
func NewCmd(p *Plug) *Cmd { func NewCmd(p *Plug) *Cmd {
return &Cmd{ return &Cmd{
plugHandle:p, plugHandle: p,
} }
} }
//start // start
func (cm *Cmd) Run() { func (cm *Cmd) Run() {
//print help // print help
if len(os.Args) <= 1 { if len(os.Args) <= 1 {
cm.printHelpMessage() cm.printHelpMessage()
os.Exit(1) os.Exit(1)
} }
//parse command // parse command
firstArg := string(os.Args[1]) firstArg := string(os.Args[1])
if strings.HasPrefix(firstArg, InternalCmdPrefix) { if strings.HasPrefix(firstArg, InternalCmdPrefix) {
cm.parseInternalCmd() cm.parseInternalCmd()
@@ -47,8 +47,8 @@ func (cm *Cmd) Run() {
} }
} }
//parse internal commend // parse internal commend
//like --help, --env, --device // like --help, --env, --device
func (cm *Cmd) parseInternalCmd() { func (cm *Cmd) parseInternalCmd() {
arg := string(os.Args[1]) arg := string(os.Args[1])
@@ -59,7 +59,7 @@ func (cm *Cmd) parseInternalCmd() {
cm.printHelpMessage() cm.printHelpMessage()
break break
case InternalCmdEnv: case InternalCmdEnv:
fmt.Println("External plug-in path : "+cm.plugHandle.dir) fmt.Println("External plug-in path : " + cm.plugHandle.dir)
break break
case InternalCmdList: case InternalCmdList:
cm.plugHandle.PrintList() cm.plugHandle.PrintList()
@@ -74,7 +74,7 @@ func (cm *Cmd) parseInternalCmd() {
os.Exit(1) os.Exit(1)
} }
//usage // usage
func (cm *Cmd) printHelpMessage() { func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================") fmt.Println("==================================================================================")
@@ -100,32 +100,32 @@ func (cm *Cmd) printHelpMessage() {
fmt.Println("==================================================================================") fmt.Println("==================================================================================")
} }
//print plug-in list // print plug-in list
func (cm *Cmd) printPlugList() { func (cm *Cmd) printPlugList() {
l := len(cm.plugHandle.InternalPlugList) l := len(cm.plugHandle.InternalPlugList)
l += len(cm.plugHandle.ExternalPlugList) l += len(cm.plugHandle.ExternalPlugList)
fmt.Println("# Number of plug-ins : "+strconv.Itoa(l)) fmt.Println("# Number of plug-ins : " + strconv.Itoa(l))
} }
//print device // print device
func (cm *Cmd) printDevice() { func (cm *Cmd) printDevice() {
ifaces, err:= net.Interfaces() ifaces, err := net.Interfaces()
if err != nil { if err != nil {
panic(err) panic(err)
} }
for _, iface := range ifaces { for _, iface := range ifaces {
addrs, _ := iface.Addrs() addrs, _ := iface.Addrs()
for _,a:=range addrs { for _, a := range addrs {
if ipnet, ok := a.(*net.IPNet); ok { if ipnet, ok := a.(*net.IPNet); ok {
if ip4 := ipnet.IP.To4(); ip4 != nil { if ip4 := ipnet.IP.To4(); ip4 != nil {
fmt.Println("[device] : "+iface.Name+" : "+iface.HardwareAddr.String()+" "+ip4.String()) fmt.Println("[device] : " + iface.Name + " : " + iface.HardwareAddr.String() + " " + ip4.String())
} }
} }
} }
} }
} }
//Parameters needed for plug-ins // Parameters needed for plug-ins
func (cm *Cmd) parsePlugCmd() { func (cm *Cmd) parsePlugCmd() {
if len(os.Args) < 3 { if len(os.Args) < 3 {
@@ -136,10 +136,6 @@ func (cm *Cmd) parsePlugCmd() {
cm.Device = os.Args[1] cm.Device = os.Args[1]
plugName := os.Args[2] plugName := os.Args[2]
plugParams:= os.Args[3:] plugParams := os.Args[3:]
cm.plugHandle.SetOption(plugName, plugParams) cm.plugHandle.SetOption(plugName, plugParams)
} }

View File

@@ -1,6 +1,6 @@
package core package core
type Core struct{ type Core struct {
Version string Version string
} }
@@ -15,13 +15,13 @@ func New() Core {
func (c *Core) Run() { func (c *Core) Run() {
//new plugin // new plugin
plug := NewPlug() plug := NewPlug()
//parse commend // parse commend
cmd := NewCmd(plug) cmd := NewCmd(plug)
cmd.Run() cmd.Run()
//dispatch // dispatch
NewDispatch(plug, cmd).Capture() NewDispatch(plug, cmd).Capture()
} }

View File

@@ -2,13 +2,14 @@ package core
import ( import (
"fmt" "fmt"
"log"
"time"
"github.com/google/gopacket" "github.com/google/gopacket"
"github.com/google/gopacket/layers" "github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap" "github.com/google/gopacket/pcap"
"github.com/google/gopacket/tcpassembly" "github.com/google/gopacket/tcpassembly"
"github.com/google/gopacket/tcpassembly/tcpreader" "github.com/google/gopacket/tcpassembly/tcpreader"
"log"
"time"
) )
type Dispatch struct { type Dispatch struct {
@@ -18,41 +19,41 @@ type Dispatch struct {
} }
func NewDispatch(plug *Plug, cmd *Cmd) *Dispatch { func NewDispatch(plug *Plug, cmd *Cmd) *Dispatch {
return &Dispatch { return &Dispatch{
Plug: plug, Plug: plug,
device:cmd.Device, device: cmd.Device,
} }
} }
func (d *Dispatch) Capture() { func (d *Dispatch) Capture() {
//init device // init device
handle, err := pcap.OpenLive(d.device, 65535, false, pcap.BlockForever) handle, err := pcap.OpenLive(d.device, 65535, false, pcap.BlockForever)
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
return return
} }
//set filter // set filter
fmt.Println(d.Plug.BPF) fmt.Println(d.Plug.BPF)
err = handle.SetBPFFilter(d.Plug.BPF) err = handle.SetBPFFilter(d.Plug.BPF)
if err != nil { if err != nil {
log.Fatal(err) log.Fatal(err)
} }
//capture // capture
src := gopacket.NewPacketSource(handle, handle.LinkType()) src := gopacket.NewPacketSource(handle, handle.LinkType())
packets := src.Packets() packets := src.Packets()
//set up assembly // set up assembly
streamFactory := &ProtocolStreamFactory{ streamFactory := &ProtocolStreamFactory{
dispatch:d, dispatch: d,
} }
streamPool := NewStreamPool(streamFactory) streamPool := NewStreamPool(streamFactory)
assembler := NewAssembler(streamPool) assembler := NewAssembler(streamPool)
ticker := time.Tick(time.Minute) ticker := time.Tick(time.Minute)
//loop until ctrl+z // loop until ctrl+z
for { for {
select { select {
case packet := <-packets: case packet := <-packets:
@@ -84,17 +85,17 @@ type ProtocolStream struct {
func (m *ProtocolStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream { func (m *ProtocolStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream {
//init stream struct // init stream struct
stm := &ProtocolStream { stm := &ProtocolStream{
net: net, net: net,
transport: transport, transport: transport,
r: tcpreader.NewReaderStream(), r: tcpreader.NewReaderStream(),
} }
//new stream // new stream
fmt.Println("# Start new stream:", net, transport) fmt.Println("# Start new stream:", net, transport)
//decode packet // decode packet
go m.dispatch.Plug.ResolveStream(net, transport, &(stm.r)) go m.dispatch.Plug.ResolveStream(net, transport, &(stm.r))
return &(stm.r) return &(stm.r)

View File

@@ -1,21 +1,21 @@
package core package core
import ( import (
"io/ioutil" "fmt"
"plugin"
"github.com/google/gopacket"
"io" "io"
mysql "github.com/40t/go-sniffer/plugSrc/mysql/build" "io/ioutil"
redis "github.com/40t/go-sniffer/plugSrc/redis/build" "path"
"path/filepath"
"plugin"
hp "github.com/40t/go-sniffer/plugSrc/http/build" hp "github.com/40t/go-sniffer/plugSrc/http/build"
mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build" mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build"
"path/filepath" mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
"fmt" redis "github.com/40t/go-sniffer/plugSrc/redis/build"
"path" "github.com/google/gopacket"
) )
type Plug struct { type Plug struct {
dir string dir string
ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader) ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)
BPF string BPF string
@@ -48,7 +48,7 @@ func NewPlug() *Plug {
var p Plug var p Plug
p.dir, _ = filepath.Abs( "./plug/") p.dir, _ = filepath.Abs("./plug/")
p.LoadInternalPlugList() p.LoadInternalPlugList()
p.LoadExternalPlugList() p.LoadExternalPlugList()
@@ -59,16 +59,16 @@ func (p *Plug) LoadInternalPlugList() {
list := make(map[string]PlugInterface) list := make(map[string]PlugInterface)
//Mysql // Mysql
list["mysql"] = mysql.NewInstance() list["mysql"] = mysql.NewInstance()
//Mongodb // Mongodb
list["mongodb"] = mongodb.NewInstance() list["mongodb"] = mongodb.NewInstance()
//Redis // Redis
list["redis"] = redis.NewInstance() list["redis"] = redis.NewInstance()
//Http // Http
list["http"] = hp.NewInstance() list["http"] = hp.NewInstance()
p.InternalPlugList = list p.InternalPlugList = list
@@ -87,7 +87,7 @@ func (p *Plug) LoadExternalPlugList() {
continue continue
} }
plug, err := plugin.Open(p.dir+"/"+fi.Name()) plug, err := plugin.Open(p.dir + "/" + fi.Name())
if err != nil { if err != nil {
panic(err) panic(err)
} }
@@ -113,12 +113,12 @@ func (p *Plug) LoadExternalPlugList() {
} }
version := versionFunc.(func() string)() version := versionFunc.(func() string)()
p.ExternalPlugList[fi.Name()] = ExternalPlug { p.ExternalPlugList[fi.Name()] = ExternalPlug{
ResolvePacket:ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)), ResolvePacket: ResolvePacketFunc.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)),
SetFlag:setFlagFunc.(func([]string)), SetFlag: setFlagFunc.(func([]string)),
BPFFilter:BPFFilterFunc.(func() string), BPFFilter: BPFFilterFunc.(func() string),
Version:version, Version: version,
Name:fi.Name(), Name: fi.Name(),
} }
} }
} }
@@ -129,23 +129,23 @@ func (p *Plug) ChangePath(dir string) {
func (p *Plug) PrintList() { func (p *Plug) PrintList() {
//Print Internal Plug // Print Internal Plug
for inPlugName, _ := range p.InternalPlugList { for inPlugName, _ := range p.InternalPlugList {
fmt.Println("internal plug : "+inPlugName) fmt.Println("internal plug : " + inPlugName)
} }
//split // split
fmt.Println("-- --- --") fmt.Println("-- --- --")
//print External Plug // print External Plug
for exPlugName, _ := range p.ExternalPlugList { for exPlugName, _ := range p.ExternalPlugList {
fmt.Println("external plug : "+exPlugName) fmt.Println("external plug : " + exPlugName)
} }
} }
func (p *Plug) SetOption(plugName string, plugParams []string) { func (p *Plug) SetOption(plugName string, plugParams []string) {
//Load Internal Plug // Load Internal Plug
if internalPlug, ok := p.InternalPlugList[plugName]; ok { if internalPlug, ok := p.InternalPlugList[plugName]; ok {
p.ResolveStream = internalPlug.ResolveStream p.ResolveStream = internalPlug.ResolveStream
@@ -155,8 +155,8 @@ func (p *Plug) SetOption(plugName string, plugParams []string) {
return return
} }
//Load External Plug // Load External Plug
plug, err := plugin.Open("./plug/"+ plugName) plug, err := plugin.Open("./plug/" + plugName)
if err != nil { if err != nil {
panic(err) panic(err)
} }
@@ -174,5 +174,5 @@ func (p *Plug) SetOption(plugName string, plugParams []string) {
} }
p.ResolveStream = resolvePacket.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)) p.ResolveStream = resolvePacket.(func(net gopacket.Flow, transport gopacket.Flow, r io.Reader))
setFlag.(func([]string))(plugParams) setFlag.(func([]string))(plugParams)
p.BPF = BPFFilter.(func()string)() p.BPF = BPFFilter.(func() string)()
} }

5
go.mod Normal file
View File

@@ -0,0 +1,5 @@
module github.com/40t/go-sniffer
go 1.13
require github.com/google/gopacket v1.1.17

9
go.sum Normal file
View File

@@ -0,0 +1,9 @@
github.com/google/gopacket v1.1.17 h1:rMrlX2ZY2UbvT+sdz3+6J+pp2z+msCq9MxTU6ymxbBY=
github.com/google/gopacket v1.1.17/go.mod h1:UdDNZ1OO62aGYVnPhxT1U6aI7ukYtA/kB8vaU0diBUM=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67 h1:1Fzlr8kkDLQwqMP8GxrhptBLqZG/EDpiATneiZHY998=
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

View File

@@ -1,14 +1,15 @@
package build package build
import ( import (
"github.com/google/gopacket" "bufio"
"fmt"
"io" "io"
"log" "log"
"strconv"
"fmt"
"os"
"bufio"
"net/http" "net/http"
"os"
"strconv"
"github.com/google/gopacket"
) )
const ( const (
@@ -30,8 +31,8 @@ var hp *H
func NewInstance() *H { func NewInstance() *H {
if hp == nil { if hp == nil {
hp = &H{ hp = &H{
port :Port, port: Port,
version:Version, version: Version,
} }
} }
return hp return hp
@@ -66,7 +67,7 @@ func (m *H) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
} }
func (m *H) BPFFilter() string { func (m *H) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *H) Version() string { func (m *H) Version() string {
@@ -80,17 +81,17 @@ func (m *H) SetFlag(flg []string) {
if c == 0 { if c == 0 {
return return
} }
if c >> 1 == 0 { if c>>1 == 0 {
fmt.Println("ERR : Http Number of parameters") fmt.Println("ERR : Http Number of parameters")
os.Exit(1) os.Exit(1)
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
m.port = port m.port = port
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")

View File

@@ -58,7 +58,7 @@ func (d Decimal128) String() string {
// Bits: 1*sign 2*ignored 14*exponent 111*significand. // Bits: 1*sign 2*ignored 14*exponent 111*significand.
// Implicit 0b100 prefix in significand. // Implicit 0b100 prefix in significand.
e = int(d.h>>47&(1<<14-1)) - 6176 e = int(d.h>>47&(1<<14-1)) - 6176
//h = 4<<47 | d.h&(1<<47-1) // h = 4<<47 | d.h&(1<<47-1)
// Spec says all of these values are out of range. // Spec says all of these values are out of range.
h, l = 0, 0 h, l = 0, 0
} else { } else {

View File

@@ -4,9 +4,10 @@ import (
"bytes" "bytes"
"encoding/base64" "encoding/base64"
"fmt" "fmt"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/internal/json"
"strconv" "strconv"
"time" "time"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/internal/json"
) )
// UnmarshalJSON unmarshals a JSON value that may hold non-standard // UnmarshalJSON unmarshals a JSON value that may hold non-standard

View File

@@ -1,17 +1,17 @@
package build package build
const ( const (
OP_REPLY = 1 //Reply to a client request. responseTo is set. OP_REPLY = 1 // Reply to a client request. responseTo is set.
OP_UPDATE = 2001 //Update document. OP_UPDATE = 2001 // Update document.
OP_INSERT = 2002 //Insert new document. OP_INSERT = 2002 // Insert new document.
RESERVED = 2003 //Formerly used for OP_GET_BY_OID. RESERVED = 2003 // Formerly used for OP_GET_BY_OID.
OP_QUERY = 2004 //Query a collection. OP_QUERY = 2004 // Query a collection.
OP_GET_MORE = 2005 //Get more data from a query. See Cursors. OP_GET_MORE = 2005 // Get more data from a query. See Cursors.
OP_DELETE = 2006 //Delete documents. OP_DELETE = 2006 // Delete documents.
OP_KILL_CURSORS = 2007 //Notify database that the client has finished with the cursor. OP_KILL_CURSORS = 2007 // Notify database that the client has finished with the cursor.
OP_COMMAND = 2010 //Cluster internal protocol representing a command request. OP_COMMAND = 2010 // Cluster internal protocol representing a command request.
OP_COMMANDREPLY = 2011 //Cluster internal protocol representing a reply to an OP_COMMAND. OP_COMMANDREPLY = 2011 // Cluster internal protocol representing a reply to an OP_COMMAND.
OP_MSG = 2013 //Send a message using the format introduced in MongoDB 3.6. OP_MSG = 2013 // Send a message using the format introduced in MongoDB 3.6.
) )

View File

@@ -4,9 +4,10 @@ import (
"bytes" "bytes"
"encoding/binary" "encoding/binary"
"fmt" "fmt"
"github.com/google/gopacket"
"io" "io"
"strconv" "strconv"
"github.com/google/gopacket"
) )
const ( const (
@@ -26,13 +27,12 @@ type stream struct {
} }
type packet struct { type packet struct {
isClientFlow bool // client->server
isClientFlow bool //client->server
messageLength int messageLength int
requestID int requestID int
responseTo int responseTo int
opCode int //request type opCode int // request type
payload io.Reader payload io.Reader
} }
@@ -42,8 +42,8 @@ var mongodbInstance *Mongodb
func NewInstance() *Mongodb { func NewInstance() *Mongodb {
if mongodbInstance == nil { if mongodbInstance == nil {
mongodbInstance = &Mongodb{ mongodbInstance = &Mongodb{
port :Port, port: Port,
version:Version, version: Version,
source: make(map[string]*stream), source: make(map[string]*stream),
} }
} }
@@ -55,16 +55,16 @@ func (m *Mongodb) SetFlag(flg []string) {
if c == 0 { if c == 0 {
return return
} }
if c >> 1 != 1 { if c>>1 != 1 {
panic("ERR : Mongodb Number of parameters") panic("ERR : Mongodb Number of parameters")
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
p, err := strconv.Atoi(val); p, err := strconv.Atoi(val)
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")
} }
@@ -80,7 +80,7 @@ func (m *Mongodb) SetFlag(flg []string) {
} }
func (m *Mongodb) BPFFilter() string { func (m *Mongodb) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *Mongodb) Version() string { func (m *Mongodb) Version() string {
@@ -89,22 +89,22 @@ func (m *Mongodb) Version() string {
func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) { func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
//uuid // uuid
uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash()) uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash())
//resolve packet // resolve packet
if _, ok := m.source[uuid]; !ok { if _, ok := m.source[uuid]; !ok {
var newStream = stream { var newStream = stream{
packets:make(chan *packet, 100), packets: make(chan *packet, 100),
} }
m.source[uuid] = &newStream m.source[uuid] = &newStream
go newStream.resolve() go newStream.resolve()
} }
//read bi-directional packet // read bi-directional packet
//server -> client || client -> server // server -> client || client -> server
for { for {
newPacket := m.newPacket(net, transport, buf) newPacket := m.newPacket(net, transport, buf)
@@ -118,12 +118,12 @@ func (m *Mongodb) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet { func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
//read packet // read packet
var packet *packet var packet *packet
var err error var err error
packet, err = readStream(r) packet, err = readStream(r)
//stream close // stream close
if err == io.EOF { if err == io.EOF {
fmt.Println(net, transport, " close") fmt.Println(net, transport, " close")
return nil return nil
@@ -132,10 +132,10 @@ func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
return nil return nil
} }
//set flow direction // set flow direction
if transport.Src().String() == strconv.Itoa(m.port) { if transport.Src().String() == strconv.Itoa(m.port) {
packet.isClientFlow = false packet.isClientFlow = false
}else{ } else {
packet.isClientFlow = true packet.isClientFlow = true
} }
@@ -145,7 +145,7 @@ func (m *Mongodb) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
func (stm *stream) resolve() { func (stm *stream) resolve() {
for { for {
select { select {
case packet := <- stm.packets: case packet := <-stm.packets:
if packet.isClientFlow { if packet.isClientFlow {
stm.resolveClientPacket(packet) stm.resolveClientPacket(packet)
} else { } else {
@@ -263,10 +263,10 @@ func readStream(r io.Reader) (*packet, error) {
var buf bytes.Buffer var buf bytes.Buffer
p := &packet{} p := &packet{}
//header // header
header := make([]byte, 16) header := make([]byte, 16)
if _, err := io.ReadFull(r, header); err != nil { if _, err := io.ReadFull(r, header); err != nil {
return nil,err return nil, err
} }
// message length // message length

View File

@@ -773,7 +773,7 @@ func (d *decodeState) isNull(off int) bool {
// name consumes a const or function from d.data[d.off-1:], decoding into the value v. // name consumes a const or function from d.data[d.off-1:], decoding into the value v.
// the first byte of the function name has been read already. // the first byte of the function name has been read already.
func (d *decodeState) name(v reflect.Value) { func (d *decodeState) name(v reflect.Value) {
if d.isNull(d.off-1) { if d.isNull(d.off - 1) {
d.literal(v) d.literal(v)
return return
} }
@@ -859,7 +859,7 @@ func (d *decodeState) name(v reflect.Value) {
} }
// TODO Fix case of func field as map. // TODO Fix case of func field as map.
//topv := v // topv := v
// Figure out field corresponding to function. // Figure out field corresponding to function.
key := []byte(funcData.key) key := []byte(funcData.key)
@@ -1173,7 +1173,7 @@ var numberType = reflect.TypeOf(Number(""))
func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) { func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) {
// Check for unmarshaler. // Check for unmarshaler.
if len(item) == 0 { if len(item) == 0 {
//Empty string given // Empty string given
d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())) d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
return return
} }

View File

@@ -4,8 +4,9 @@ import (
"encoding/binary" "encoding/binary"
"encoding/json" "encoding/json"
"fmt" "fmt"
"time"
"io" "io"
"time"
"github.com/40t/go-sniffer/plugSrc/mongodb/build/bson" "github.com/40t/go-sniffer/plugSrc/mongodb/build/bson"
) )
@@ -15,7 +16,7 @@ func GetNowStr(isClient bool) string {
msg += time.Now().Format(layout) msg += time.Now().Format(layout)
if isClient { if isClient {
msg += "| cli -> ser |" msg += "| cli -> ser |"
}else{ } else {
msg += "| ser -> cli |" msg += "| ser -> cli |"
} }
return msg return msg
@@ -54,33 +55,32 @@ func ReadString(r io.Reader) string {
return string(result) return string(result)
} }
func ReadBson2Json(r io.Reader) (string) { func ReadBson2Json(r io.Reader) string {
//read len // read len
docLen := ReadInt32(r) docLen := ReadInt32(r)
if docLen == 0 { if docLen == 0 {
return "" return ""
} }
//document []byte // document []byte
docBytes := make([]byte, int(docLen)) docBytes := make([]byte, int(docLen))
binary.LittleEndian.PutUint32(docBytes, uint32(docLen)) binary.LittleEndian.PutUint32(docBytes, uint32(docLen))
if _, err := io.ReadFull(r, docBytes[4:]); err != nil { if _, err := io.ReadFull(r, docBytes[4:]); err != nil {
panic(err) panic(err)
} }
//resolve document // resolve document
var bsn bson.M var bsn bson.M
err := bson.Unmarshal(docBytes, &bsn) err := bson.Unmarshal(docBytes, &bsn)
if err != nil { if err != nil {
panic(err) panic(err)
} }
//format to Json // format to Json
jsonStr, err := json.Marshal(bsn) jsonStr, err := json.Marshal(bsn)
if err != nil { if err != nil {
return fmt.Sprintf("{\"error\":%s}", err.Error()) return fmt.Sprintf("{\"error\":%s}", err.Error())
} }
return string(jsonStr) return string(jsonStr)
} }

View File

@@ -1,18 +1,19 @@
package build package build
import ( import (
"github.com/google/gopacket"
"io"
"bytes" "bytes"
"encoding/binary"
"errors" "errors"
"fmt"
"io"
"log" "log"
"os"
"strconv" "strconv"
"strings"
"sync" "sync"
"time" "time"
"fmt"
"encoding/binary" "github.com/google/gopacket"
"strings"
"os"
) )
const ( const (
@@ -41,12 +42,13 @@ type packet struct {
var mysql *Mysql var mysql *Mysql
var once sync.Once var once sync.Once
func NewInstance() *Mysql { func NewInstance() *Mysql {
once.Do(func() { once.Do(func() {
mysql = &Mysql{ mysql = &Mysql{
port :Port, port: Port,
version:Version, version: Version,
source: make(map[string]*stream), source: make(map[string]*stream),
} }
}) })
@@ -56,23 +58,23 @@ func NewInstance() *Mysql {
func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) { func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
//uuid // uuid
uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash()) uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash())
//generate resolve's stream // generate resolve's stream
if _, ok := m.source[uuid]; !ok { if _, ok := m.source[uuid]; !ok {
var newStream = stream{ var newStream = stream{
packets:make(chan *packet, 100), packets: make(chan *packet, 100),
stmtMap:make(map[uint32]*Stmt), stmtMap: make(map[uint32]*Stmt),
} }
m.source[uuid] = &newStream m.source[uuid] = &newStream
go newStream.resolve() go newStream.resolve()
} }
//read bi-directional packet // read bi-directional packet
//server -> client || client -> server // server -> client || client -> server
for { for {
newPacket := m.newPacket(net, transport, buf) newPacket := m.newPacket(net, transport, buf)
@@ -86,7 +88,7 @@ func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
} }
func (m *Mysql) BPFFilter() string { func (m *Mysql) BPFFilter() string {
return "tcp and port "+strconv.Itoa(m.port); return "tcp and port " + strconv.Itoa(m.port)
} }
func (m *Mysql) Version() string { func (m *Mysql) Version() string {
@@ -100,17 +102,17 @@ func (m *Mysql) SetFlag(flg []string) {
if c == 0 { if c == 0 {
return return
} }
if c >> 1 == 0 { if c>>1 == 0 {
fmt.Println("ERR : Mysql Number of parameters") fmt.Println("ERR : Mysql Number of parameters")
os.Exit(1) os.Exit(1)
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
m.port = port m.port = port
if err != nil { if err != nil {
panic("ERR : port") panic("ERR : port")
@@ -127,7 +129,7 @@ func (m *Mysql) SetFlag(flg []string) {
func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet { func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
//read packet // read packet
var payload bytes.Buffer var payload bytes.Buffer
var seq uint8 var seq uint8
var err error var err error
@@ -135,7 +137,7 @@ func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
return nil return nil
} }
//close stream // close stream
if err == io.EOF { if err == io.EOF {
fmt.Println(net, transport, " close") fmt.Println(net, transport, " close")
return nil return nil
@@ -143,15 +145,15 @@ func (m *Mysql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
fmt.Println("ERR : Unknown stream", net, transport, ":", err) fmt.Println("ERR : Unknown stream", net, transport, ":", err)
} }
//generate new packet // generate new packet
var pk = packet{ var pk = packet{
seq: int(seq), seq: int(seq),
length:payload.Len(), length: payload.Len(),
payload:payload.Bytes(), payload: payload.Bytes(),
} }
if transport.Src().String() == strconv.Itoa(Port) { if transport.Src().String() == strconv.Itoa(Port) {
pk.isClientFlow = false pk.isClientFlow = false
}else{ } else {
pk.isClientFlow = true pk.isClientFlow = true
} }
@@ -187,7 +189,7 @@ func (m *Mysql) resolvePacketTo(r io.Reader, w io.Writer) (uint8, error) {
func (stm *stream) resolve() { func (stm *stream) resolve() {
for { for {
select { select {
case packet := <- stm.packets: case packet := <-stm.packets:
if packet.length != 0 { if packet.length != 0 {
if packet.isClientFlow { if packet.isClientFlow {
stm.resolveClientPacket(packet.payload, packet.seq) stm.resolveClientPacket(packet.payload, packet.seq)
@@ -199,10 +201,10 @@ func (stm *stream) resolve() {
} }
} }
func (stm *stream) findStmtPacket (srv chan *packet, seq int) *packet { func (stm *stream) findStmtPacket(srv chan *packet, seq int) *packet {
for { for {
select { select {
case packet, ok := <- stm.packets: case packet, ok := <-stm.packets:
if !ok { if !ok {
return nil return nil
} }
@@ -225,17 +227,17 @@ func (stm *stream) resolveServerPacket(payload []byte, seq int) {
case 0xff: case 0xff:
errorCode := int(binary.LittleEndian.Uint16(payload[1:3])) errorCode := int(binary.LittleEndian.Uint16(payload[1:3]))
errorMsg,_ := ReadStringFromByte(payload[4:]) errorMsg, _ := ReadStringFromByte(payload[4:])
msg = GetNowStr(false)+"%s Err code:%s,Err msg:%s" msg = GetNowStr(false) + "%s Err code:%s,Err msg:%s"
msg = fmt.Sprintf(msg, ErrorPacket, strconv.Itoa(errorCode), strings.TrimSpace(errorMsg)) msg = fmt.Sprintf(msg, ErrorPacket, strconv.Itoa(errorCode), strings.TrimSpace(errorMsg))
case 0x00: case 0x00:
var pos = 1 var pos = 1
l,_ := LengthBinary(payload[pos:]) l, _ := LengthBinary(payload[pos:])
affectedRows := int(l) affectedRows := int(l)
msg += GetNowStr(false)+"%s Effect Row:%s" msg += GetNowStr(false) + "%s Effect Row:%s"
msg = fmt.Sprintf(msg, OkPacket, strconv.Itoa(affectedRows)) msg = fmt.Sprintf(msg, OkPacket, strconv.Itoa(affectedRows))
default: default:
@@ -268,20 +270,20 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
return return
} }
//fetch stm id // fetch stm id
stmtID := binary.LittleEndian.Uint32(serverPacket.payload[1:5]) stmtID := binary.LittleEndian.Uint32(serverPacket.payload[1:5])
stmt := &Stmt{ stmt := &Stmt{
ID: stmtID, ID: stmtID,
Query: string(payload[1:]), Query: string(payload[1:]),
} }
//record stm sql // record stm sql
stm.stmtMap[stmtID] = stmt stm.stmtMap[stmtID] = stmt
stmt.FieldCount = binary.LittleEndian.Uint16(serverPacket.payload[5:7]) stmt.FieldCount = binary.LittleEndian.Uint16(serverPacket.payload[5:7])
stmt.ParamCount = binary.LittleEndian.Uint16(serverPacket.payload[7:9]) stmt.ParamCount = binary.LittleEndian.Uint16(serverPacket.payload[7:9])
stmt.Args = make([]interface{}, stmt.ParamCount) stmt.Args = make([]interface{}, stmt.ParamCount)
msg = PreparePacket+stmt.Query msg = PreparePacket + stmt.Query
case COM_STMT_SEND_LONG_DATA: case COM_STMT_SEND_LONG_DATA:
stmtID := binary.LittleEndian.Uint32(payload[1:5]) stmtID := binary.LittleEndian.Uint32(payload[1:5])
@@ -300,7 +302,7 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
case COM_STMT_RESET: case COM_STMT_RESET:
stmtID := binary.LittleEndian.Uint32(payload[1:5]) stmtID := binary.LittleEndian.Uint32(payload[1:5])
stmt, _:= stm.stmtMap[stmtID] stmt, _ := stm.stmtMap[stmtID]
stmt.Args = make([]interface{}, stmt.ParamCount) stmt.Args = make([]interface{}, stmt.ParamCount)
return return
case COM_STMT_EXECUTE: case COM_STMT_EXECUTE:
@@ -315,16 +317,16 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
return return
} }
//params // params
pos += 5 pos += 5
if stmt.ParamCount > 0 { if stmt.ParamCount > 0 {
//Null-Bitmaplen = (paramsCount + 7) / 8 byte // Null-Bitmaplen = (paramsCount + 7) / 8 byte
step := int((stmt.ParamCount + 7) / 8) step := int((stmt.ParamCount + 7) / 8)
nullBitmap := payload[pos : pos+step] nullBitmap := payload[pos : pos+step]
pos += step pos += step
//Parameter separator // Parameter separator
flag := payload[pos] flag := payload[pos]
pos++ pos++
@@ -332,15 +334,15 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
var pTypes []byte var pTypes []byte
var pValues []byte var pValues []byte
//if flag == 1 // if flag == 1
//n len = paramsCount * 2 byte // n len = paramsCount * 2 byte
if flag == 1 { if flag == 1 {
pTypes = payload[pos : pos+int(stmt.ParamCount)*2] pTypes = payload[pos : pos+int(stmt.ParamCount)*2]
pos += int(stmt.ParamCount) * 2 pos += int(stmt.ParamCount) * 2
pValues = payload[pos:] pValues = payload[pos:]
} }
//bind params // bind params
err := stmt.BindArgs(nullBitmap, pTypes, pValues) err := stmt.BindArgs(nullBitmap, pTypes, pValues)
if err != nil { if err != nil {
log.Println("ERR : Could not bind params", err) log.Println("ERR : Could not bind params", err)
@@ -353,4 +355,3 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
fmt.Println(GetNowStr(true) + msg) fmt.Println(GetNowStr(true) + msg)
} }

View File

@@ -3,10 +3,10 @@ package build
import ( import (
"bytes" "bytes"
"encoding/binary" "encoding/binary"
"errors"
"fmt" "fmt"
"math" "math"
"strings" "strings"
"errors"
) )
type Stmt struct { type Stmt struct {

View File

@@ -12,13 +12,13 @@ func GetNowStr(isClient bool) string {
msg += time.Now().Format("2006-01-02 15:04:05") msg += time.Now().Format("2006-01-02 15:04:05")
if isClient { if isClient {
msg += "| cli -> ser |" msg += "| cli -> ser |"
}else{ } else {
msg += "| ser -> cli |" msg += "| ser -> cli |"
} }
return msg return msg
} }
func ReadStringFromByte(b []byte) (string,int) { func ReadStringFromByte(b []byte) (string, int) {
var l int var l int
l = bytes.IndexByte(b, 0x00) l = bytes.IndexByte(b, 0x00)
@@ -35,18 +35,18 @@ func LengthBinary(b []byte) (uint32, int) {
return uint32(first), 1 return uint32(first), 1
} }
if first == 251 { if first == 251 {
return 0,1 return 0, 1
} }
if first == 252 { if first == 252 {
return binary.LittleEndian.Uint32(b[1:2]),1 return binary.LittleEndian.Uint32(b[1:2]), 1
} }
if first == 253 { if first == 253 {
return binary.LittleEndian.Uint32(b[1:4]),3 return binary.LittleEndian.Uint32(b[1:4]), 3
} }
if first == 254 { if first == 254 {
return binary.LittleEndian.Uint32(b[1:9]),8 return binary.LittleEndian.Uint32(b[1:9]), 8
} }
return 0,0 return 0, 0
} }
func LengthEncodedInt(input []byte) (num uint64, isNull bool, n int) { func LengthEncodedInt(input []byte) (num uint64, isNull bool, n int) {

View File

@@ -1,12 +1,13 @@
package build package build
import ( import (
"github.com/google/gopacket"
"io"
"strings"
"fmt"
"strconv"
"bufio" "bufio"
"fmt"
"io"
"strconv"
"strings"
"github.com/google/gopacket"
) )
type Redis struct { type Redis struct {
@@ -22,12 +23,12 @@ const (
CmdPort string = "-p" CmdPort string = "-p"
) )
var redis = &Redis { var redis = &Redis{
port:Port, port: Port,
version:Version, version: Version,
} }
func NewInstance() *Redis{ func NewInstance() *Redis {
return redis return redis
} }
@@ -49,23 +50,23 @@ func (red Redis) ResolveStream(net, transport gopacket.Flow, r io.Reader) {
} }
} }
//Filtering useless data // Filtering useless data
if !strings.HasPrefix(string(line), "*") { if !strings.HasPrefix(string(line), "*") {
continue continue
} }
//Do not display // Do not display
if strings.EqualFold(transport.Src().String(), strconv.Itoa(red.port)) == true { if strings.EqualFold(transport.Src().String(), strconv.Itoa(red.port)) == true {
continue continue
} }
//run // run
l := string(line[1]) l := string(line[1])
cmdCount, _ = strconv.Atoi(l) cmdCount, _ = strconv.Atoi(l)
cmd = "" cmd = ""
for j := 0; j < cmdCount * 2; j++ { for j := 0; j < cmdCount*2; j++ {
c, _, _ := buf.ReadLine() c, _, _ := buf.ReadLine()
if j & 1 == 0 { if j&1 == 0 {
continue continue
} }
cmd += " " + string(c) cmd += " " + string(c)
@@ -74,24 +75,22 @@ func (red Redis) ResolveStream(net, transport gopacket.Flow, r io.Reader) {
} }
} }
/** // SetOption
SetOption
*/
func (red *Redis) SetFlag(flg []string) { func (red *Redis) SetFlag(flg []string) {
c := len(flg) c := len(flg)
if c == 0 { if c == 0 {
return return
} }
if c >> 1 != 1 { if c>>1 != 1 {
panic("ERR : Redis num of params") panic("ERR : Redis num of params")
} }
for i:=0;i<c;i=i+2 { for i := 0; i < c; i = i + 2 {
key := flg[i] key := flg[i]
val := flg[i+1] val := flg[i+1]
switch key { switch key {
case CmdPort: case CmdPort:
port, err := strconv.Atoi(val); port, err := strconv.Atoi(val)
redis.port = port redis.port = port
if err != nil { if err != nil {
panic("ERR : Port error") panic("ERR : Port error")
@@ -106,17 +105,12 @@ func (red *Redis) SetFlag(flg []string) {
} }
} }
/** // BPFFilter
BPFFilter
*/
func (red *Redis) BPFFilter() string { func (red *Redis) BPFFilter() string {
return "tcp and port "+strconv.Itoa(redis.port) return "tcp and port " + strconv.Itoa(redis.port)
} }
/** // Version
Version
*/
func (red *Redis) Version() string { func (red *Redis) Version() string {
return red.version return red.version
} }