Merge d65e9295ff into c9248d507a

README.md

@@ -1,7 +1,7 @@
 
 # go-sniffer
 
-> Capture mysql,redis,http,mongodb etc protocol...
+> Capture mysql,mssql,redis,http,mongodb etc protocol...
 > 抓包截取项目中的数据库请求并解析成相应的语句，如mysql协议会解析为sql语句,便于调试。
 > 不要修改代码，直接嗅探项目中的数据请求。
 
@@ -14,6 +14,7 @@
 - [Redis](#redis)
 - [Http](#http)
 - [Mongodb](#mongodb)
+- [mssql](#mssql)
 - Kafka (developing)
 - ...
 
@@ -104,6 +105,8 @@ $ go-sniffer lo0 mysql
 $ go-sniffer en0 redis 
 $ go-sniffer eth0 http -p 8080
 $ go-sniffer eth1 mongodb
+$ go-sniffer eth0 mssql 
+
 ```
 ## License:
 [MIT](http://opensource.org/licenses/MIT)

core/cmd.go

@@ -1,11 +1,11 @@
 package core
 
 import (
-	"os"
-	"strings"
 	"fmt"
 	"net"
+	"os"
 	"strconv"
+	"strings"
 )
 
 const InternalCmdPrefix = "--"
@@ -85,6 +85,7 @@ func (cm *Cmd) printHelpMessage()  {
 	fmt.Println("    [exp]")
 	fmt.Println("          go-sniffer en0 redis          Capture redis packet")
 	fmt.Println("          go-sniffer en0 mysql -p 3306  Capture mysql packet")
+	fmt.Println("          go-sniffer en0 mssql -p 1433  Capture mssql packet")
 	fmt.Println()
 	fmt.Println("    go-sniffer --[commend]")
 	fmt.Println("               --help \"this page\"")
@@ -139,7 +140,3 @@ func (cm *Cmd) parsePlugCmd()  {
 	plugParams := os.Args[3:]
 	cm.plugHandle.SetOption(plugName, plugParams)
 }
-
-
-
-

core/plug.go

@@ -1,21 +1,22 @@
 package core
 
 import (
-	"io/ioutil"
+	"fmt"
-	"plugin"
-	"github.com/google/gopacket"
 	"io"
-	mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
+	"io/ioutil"
-	redis "github.com/40t/go-sniffer/plugSrc/redis/build"
+	"path"
+	"path/filepath"
+	"plugin"
+
 	hp "github.com/40t/go-sniffer/plugSrc/http/build"
 	mongodb "github.com/40t/go-sniffer/plugSrc/mongodb/build"
-	"path/filepath"
+	mssql "github.com/40t/go-sniffer/plugSrc/mssql/build"
-	"fmt"
+	mysql "github.com/40t/go-sniffer/plugSrc/mysql/build"
-	"path"
+	redis "github.com/40t/go-sniffer/plugSrc/redis/build"
+	"github.com/google/gopacket"
 )
 
 type Plug struct {
-
 	dir           string
 	ResolveStream func(net gopacket.Flow, transport gopacket.Flow, r io.Reader)
 	BPF           string
@@ -71,6 +72,8 @@ func (p *Plug) LoadInternalPlugList() {
 	//Http
 	list["http"] = hp.NewInstance()
 
+	list["mssql"] = mssql.NewInstance()
+
 	p.InternalPlugList = list
 }
 
@@ -145,6 +148,8 @@ func (p *Plug) PrintList() {
 
 func (p *Plug) SetOption(plugName string, plugParams []string) {
 
+	fmt.Println("internalPlug", plugName)
+
 	//Load Internal Plug
 	if internalPlug, ok := p.InternalPlugList[plugName]; ok {
 

plugSrc/http/build/entry.go

@@ -1,14 +1,15 @@
 package build
 
 import (
-	"github.com/google/gopacket"
-	"io"
-	"log"
-	"strconv"
-	"fmt"
-	"os"
 	"bufio"
+	"fmt"
+	"io"
 	"net/http"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/google/gopacket"
 )
 
 const (
@@ -58,15 +59,15 @@ func (m *H) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
 			msg += req.Form.Encode()
 			msg += "]"
 
-			log.Println(msg)
+			fmt.Println(time.Now().Format("2006-01-02 15:04:05.000") + " | " + msg)
-
+			// log.Println()
 			req.Body.Close()
 		}
 	}
 }
 
 func (m *H) BPFFilter() string {
-	return "tcp and port "+strconv.Itoa(m.port);
+	return "tcp and port " + strconv.Itoa(m.port)
 }
 
 func (m *H) Version() string {
@@ -90,7 +91,7 @@ func (m *H) SetFlag(flg []string)  {
 
 		switch key {
 		case CmdPort:
-			port, err := strconv.Atoi(val);
+			port, err := strconv.Atoi(val)
 			m.port = port
 			if err != nil {
 				panic("ERR : port")

plugSrc/mssql/build/entry.go

@@ -0,0 +1,301 @@
+package build
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"unicode/utf16"
+
+	"github.com/google/gopacket"
+)
+
+const (
+	Port    = 1433
+	Version = "0.1"
+	CmdPort = "-p"
+)
+
+type Mssql struct {
+	port    int
+	version string
+	source  map[string]*stream
+}
+
+type stream struct {
+	packets chan *packet
+}
+
+type packet struct {
+	isClientFlow bool
+	status       int
+	packetType   int
+	length       int
+	payload      []byte
+}
+
+// packet types
+// https://msdn.microsoft.com/en-us/library/dd304214.aspx
+const (
+	packSQLBatch   = 1
+	packRPCRequest = 3
+	packReply      = 4
+	packAttention  = 6
+
+	packBulkLoadBCP = 7
+	packTransMgrReq = 14
+	packNormal      = 15
+	packLogin7      = 16
+	packSSPIMessage = 17
+	packPrelogin    = 18
+)
+
+var mssql *Mssql
+var once sync.Once
+
+func NewInstance() *Mssql {
+
+	once.Do(func() {
+		mssql = &Mssql{
+			port:    Port,
+			version: Version,
+			source:  make(map[string]*stream),
+		}
+	})
+	return mssql
+}
+
+func (m *Mssql) Version() string {
+	return m.version
+}
+
+func (m *Mssql) BPFFilter() string {
+	return "tcp and port " + strconv.Itoa(m.port)
+}
+
+func (m *Mssql) SetFlag(flg []string) {
+	c := len(flg)
+
+	if c == 0 {
+		return
+	}
+
+	if c>>1 == 0 {
+		fmt.Println("ERR : Mssql Number of parameters")
+		os.Exit(1)
+	}
+
+	for i := 0; i < c; i = i + 2 {
+		key := flg[i]
+		val := flg[i+1]
+
+		switch key {
+		case CmdPort:
+			port, err := strconv.Atoi(val)
+			m.port = port
+			if err != nil {
+				panic("ERR : port")
+			}
+			if port < 0 || port > 65535 {
+				panic("ERR : port(0-65535)")
+			}
+			break
+		default:
+			panic("ERR : mssql's params")
+
+		}
+
+	}
+}
+
+// ResolveStream ...
+func (m *Mssql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
+	//uuid
+	uuid := fmt.Sprintf("%v:%v", net.FastHash(), transport.FastHash())
+
+	// log.Println(uuid)
+
+	if _, ok := m.source[uuid]; !ok {
+		var newStream = &stream{
+			packets: make(chan *packet, 100),
+		}
+		m.source[uuid] = newStream
+		go newStream.resolve()
+	}
+
+	for {
+
+		// log.Println("ssss")
+
+		newPacket := m.newPacket(net, transport, buf)
+		if newPacket == nil {
+			return
+		}
+		m.source[uuid].packets <- newPacket
+
+	}
+	// log.Println('ddd')
+}
+
+func (m *Mssql) newPacket(net, transport gopacket.Flow, r io.Reader) *packet {
+	// read packet
+	var packet *packet
+	var err error
+	packet, err = readStream(r)
+
+	//stream close
+	if err == io.EOF {
+		fmt.Println(net, transport, " close")
+		return nil
+	} else if err != nil {
+		fmt.Println("ERR : Unknown stream", net, transport, ":", err)
+		return nil
+	}
+
+	//set flow direction
+	if transport.Src().String() == strconv.Itoa(m.port) {
+		packet.isClientFlow = false
+	} else {
+		packet.isClientFlow = true
+	}
+	return packet
+}
+
+func (m *stream) resolve() {
+	for {
+		select {
+		case packet := <-m.packets:
+			if packet.isClientFlow {
+				m.resolveClientPacket(packet)
+			} else {
+				m.resolveServerPacket(packet)
+			}
+		}
+	}
+}
+
+func readStream(r io.Reader) (*packet, error) {
+
+	var buffer bytes.Buffer
+
+	header := make([]byte, 8)
+	p := &packet{}
+	if _, err := io.ReadFull(r, header); err != nil {
+		return nil, err
+	}
+
+	p.packetType = int(uint32(header[0]))
+	p.status = int(uint32(header[1]))
+	p.length = int(binary.BigEndian.Uint16(header[2:4]))
+
+	if p.length > 0 {
+		io.CopyN(&buffer, r, int64(p.length-8))
+	}
+	p.payload = buffer.Bytes()
+	return p, nil
+}
+
+func ucs22str(s []byte) (string, error) {
+	if len(s)%2 != 0 {
+		return "", fmt.Errorf("Illegal UCS2 string length: %d", len(s))
+	}
+	buf := make([]uint16, len(s)/2)
+	for i := 0; i < len(s); i += 2 {
+		buf[i/2] = binary.LittleEndian.Uint16(s[i:])
+	}
+	return string(utf16.Decode(buf)), nil
+}
+
+func (m *stream) resolveClientPacket(p *packet) {
+
+	var msg string
+
+	switch p.packetType {
+	case 1:
+		headerLength := int(binary.LittleEndian.Uint32(p.payload[0:4]))
+		// fmt.Printf("headers %x %d\n %x \n", p.payload[0:4], headerLength, p.payload)
+		if headerLength > 22 {
+			//not exists headers
+			msg = fmt.Sprintf("【query】 %s", string(p.payload))
+
+		} else {
+			//tds 7.2+
+			msg = fmt.Sprintf("【query】 %s", string(p.payload[headerLength:]))
+		}
+	case 3:
+		// 4 byte
+		pos := 0
+		headerLength := int(binary.LittleEndian.Uint32(p.payload[0:4]))
+		// fmt.Printf("rpc headers %x %d\n \n", p.payload[0:4], headerLength)
+		pos += headerLength
+
+		//rpc name length
+		rpcLength := int(binary.LittleEndian.Uint16(p.payload[pos : pos+2]))
+
+		rpcLength = rpcLength * 2
+
+		pos += 2
+
+		rpcName, _ := ucs22str(p.payload[pos : pos+rpcLength])
+
+		// fmt.Printf("rpc name %s %d %x", rpcName, rpcLength, p.payload[pos:pos+rpcLength])
+
+		pos += rpcLength
+
+		if strings.Compare(rpcName, `sp_executesql`) != 0 {
+			return
+		}
+		//OPTIONS Flags 2byte
+
+		pos += 2
+
+		//name length 1byte
+		nameLength := int(p.payload[pos])
+		// fmt.Printf("parameter nameLength %d", nameLength)
+
+		pos = pos + 1 + nameLength*2
+
+		//STATUS FLAGS 1byte
+		pos += 1
+
+		typeNvarchar := p.payload[pos]
+		// fmt.Printf("typeNvarchar %x ", typeNvarchar)
+		if typeNvarchar == 0xe7 {
+			pos += 7
+
+			//value
+			valueLength := int(binary.LittleEndian.Uint16(p.payload[pos+1 : pos+3]))
+			pos += 2
+
+			msg = fmt.Sprintf("【query】%s", string(p.payload[pos:pos+valueLength]))
+
+		}
+		// ParameterData
+
+	case 4:
+		msg = fmt.Sprintf("【query】 %s", "Tabular result")
+
+	}
+
+	fmt.Println(GetNowStr(true), msg)
+}
+
+func (m *stream) resolveServerPacket(p *packet) {
+
+	var msg string
+	switch p.packetType {
+	case 4: //response
+		rows, errMsg := parseToken(p.payload)
+		if rows == 0 && len(errMsg) != 0 {
+			msg = fmt.Sprintf("【Err】Effect Rows:%d, message: %s", rows, errMsg)
+		} else {
+			msg = fmt.Sprintf("【OK】Effect Rows:%d", rows)
+		}
+	}
+
+	fmt.Println(GetNowStr(false), msg)
+}

plugSrc/mssql/build/token.go

@@ -0,0 +1,590 @@
+package build
+
+import (
+	"encoding/binary"
+)
+
+type token byte
+
+// token ids
+const (
+	tokenReturnStatus token = 121 // 0x79
+	tokenColMetadata  token = 129 // 0x81
+	tokenOrder        token = 169 // 0xA9
+	tokenError        token = 170 // 0xAA
+	tokenInfo         token = 171 // 0xAB
+	tokenReturnValue  token = 0xAC
+	tokenLoginAck     token = 173 // 0xad
+	tokenRow          token = 209 // 0xd1
+	tokenNbcRow       token = 210 // 0xd2
+	tokenEnvChange    token = 227 // 0xE3
+	tokenSSPI         token = 237 // 0xED
+	tokenDone         token = 253 // 0xFD
+	tokenDoneProc     token = 254
+	tokenDoneInProc   token = 255
+)
+
+// fixed-length data types
+// http://msdn.microsoft.com/en-us/library/dd341171.aspx
+const (
+	typeNull     = 0x1f
+	typeInt1     = 0x30
+	typeBit      = 0x32
+	typeInt2     = 0x34
+	typeInt4     = 0x38
+	typeDateTim4 = 0x3a
+	typeFlt4     = 0x3b
+	typeMoney    = 0x3c
+	typeDateTime = 0x3d
+	typeFlt8     = 0x3e
+	typeMoney4   = 0x7a
+	typeInt8     = 0x7f
+)
+
+const _PLP_NULL = 0xFFFFFFFFFFFFFFFF
+const _UNKNOWN_PLP_LEN = 0xFFFFFFFFFFFFFFFE
+const _PLP_TERMINATOR = 0x00000000
+
+// variable-length data types
+// http://msdn.microsoft.com/en-us/library/dd358341.aspx
+const (
+	// byte len types
+	typeGuid            = 0x24
+	typeIntN            = 0x26
+	typeDecimal         = 0x37 // legacy
+	typeNumeric         = 0x3f // legacy
+	typeBitN            = 0x68
+	typeDecimalN        = 0x6a
+	typeNumericN        = 0x6c
+	typeFltN            = 0x6d
+	typeMoneyN          = 0x6e
+	typeDateTimeN       = 0x6f
+	typeDateN           = 0x28
+	typeTimeN           = 0x29
+	typeDateTime2N      = 0x2a
+	typeDateTimeOffsetN = 0x2b
+	typeChar            = 0x2f // legacy
+	typeVarChar         = 0x27 // legacy
+	typeBinary          = 0x2d // legacy
+	typeVarBinary       = 0x25 // legacy
+
+	// short length types
+	typeBigVarBin  = 0xa5
+	typeBigVarChar = 0xa7
+	typeBigBinary  = 0xad
+	typeBigChar    = 0xaf
+	typeNVarChar   = 0xe7
+	typeNChar      = 0xef
+	typeXml        = 0xf1
+	typeUdt        = 0xf0
+	typeTvp        = 0xf3
+
+	// long length types
+	typeText    = 0x23
+	typeImage   = 0x22
+	typeNText   = 0x63
+	typeVariant = 0x62
+)
+
+type columnStruct struct {
+	UserType uint32
+	Flags    uint16
+	ColName  string
+	Size     int
+	TypeId   int
+	Reader   func(column *columnStruct, buf []byte) int
+}
+
+func readTypeInfo(pos int, buf []byte, column *columnStruct) (count int) {
+	typeId := buf[pos]
+
+	count = 1
+	pos++
+	column.TypeId = int(typeId)
+	// fmt.Printf("column TypeId %x %x\n", column.TypeId, buf)
+
+	switch typeId {
+	case typeNull, typeInt1, typeBit, typeInt2, typeInt4, typeDateTim4,
+		typeFlt4, typeMoney, typeDateTime, typeFlt8, typeMoney4, typeInt8:
+		count += 0
+		switch typeId {
+		case typeNull:
+			column.Size = 0
+		case typeInt1, typeBit:
+			column.Size = 1
+		case typeInt2:
+			column.Size = 2
+		case typeInt4, typeDateTim4, typeFlt4, typeMoney4:
+			column.Size = 4
+		case typeMoney, typeDateTime, typeFlt8, typeInt8:
+			column.Size = 8
+		}
+
+		column.Reader = readFixedType
+		// those are fixed length types
+	default: // all others are VARLENTYPE
+		count += readVarLen(int(typeId), pos, buf, column)
+	}
+	return count
+}
+
+func readFixedType(column *columnStruct, buf []byte) int {
+	return column.Size
+}
+
+func readByteLenType(column *columnStruct, buf []byte) int {
+	size := int(buf[0])
+	return 1 + size
+}
+
+// partially length prefixed stream
+// http://msdn.microsoft.com/en-us/library/dd340469.aspx
+func readPLPType(column *columnStruct, buf []byte) int {
+	size := binary.LittleEndian.Uint64(buf[0:8])
+	valueLength := 0
+	switch size {
+	case _PLP_NULL:
+		valueLength = 0
+	case _UNKNOWN_PLP_LEN:
+		valueLength = 1000
+	default:
+		valueLength = int(size)
+	}
+	return valueLength + 8
+}
+
+func readShortLenType(column *columnStruct, buf []byte) int {
+	size := int(binary.LittleEndian.Uint16(buf[0:2]))
+
+	return 2 + size
+}
+
+func readLongLenType(column *columnStruct, buf []byte) int {
+	count := 1
+	textptrsize := int(buf[0]) //textptrsize
+	if textptrsize == 0 {
+		return 1
+	}
+
+	count = textptrsize + 8 + 1
+	//timestamp 8
+
+	size := int(binary.LittleEndian.Uint32(buf[count : count+4]))
+	if size == -1 {
+		return count + 4
+	}
+	return count + 4 + size
+
+}
+
+// reads variant value
+// http://msdn.microsoft.com/en-us/library/dd303302.aspx
+func readVariantType(column *columnStruct, buf []byte) int {
+	count := 0
+	size := int(binary.LittleEndian.Uint32(buf[count : count+4]))
+	count = 4
+	if size == 0 {
+		return count
+	}
+	vartype := int(buf[count])
+	count += 1
+	propbytes := int(buf[count])
+	switch vartype {
+	case typeGuid:
+
+		count = count + size - 2 - propbytes
+	case typeBit:
+		count += 1
+	case typeInt1:
+		count += 1
+	case typeInt2:
+		count += 2
+	case typeInt4:
+		count += 4
+	case typeInt8:
+		count += 8
+	case typeDateTime:
+		count = count + size - 2 - propbytes
+
+	case typeDateTim4:
+		count = count + size - 2 - propbytes
+
+	case typeFlt4:
+		count = count + 4
+	case typeFlt8:
+		count = count + 8
+	case typeMoney4:
+		count = count + size - 2 - propbytes
+
+	case typeMoney:
+		count = count + size - 2 - propbytes
+
+	case typeDateN:
+		count = count + size - 2 - propbytes
+
+	case typeTimeN:
+		count += 1
+		count = count + size - 2 - propbytes
+	case typeDateTime2N:
+		count += 1
+		count = count + size - 2 - propbytes
+	case typeDateTimeOffsetN:
+		count += 1
+		count = count + size - 2 - propbytes
+	case typeBigVarBin, typeBigBinary:
+		count += 2
+		count = count + size - 2 - propbytes
+	case typeDecimalN, typeNumericN:
+		count += 2
+		count = count + size - 2 - propbytes
+	case typeBigVarChar, typeBigChar:
+		count += 5
+		count += 2 // max length, ignoring
+		count = count + size - 2 - propbytes
+
+	case typeNVarChar, typeNChar:
+		count += 5
+		count += 2 // max length, ignoring
+		count = count + size - 2 - propbytes
+	default:
+		panic("Invalid variant typeid")
+	}
+	return count
+}
+
+func readVarLen(typeId int, pos int, buf []byte, column *columnStruct) (count int) {
+	count = 0
+	switch typeId {
+	case typeDateN:
+		column.Size = 3
+		column.Reader = readByteLenType
+	case typeTimeN, typeDateTime2N, typeDateTimeOffsetN:
+
+		pos += 1 //Scale
+		count += 1
+
+		scale := buf[pos]
+
+		switch scale {
+		case 0, 1, 2:
+			column.Size = 3
+		case 3, 4:
+			column.Size = 4
+		case 5, 6, 7:
+			column.Size = 5
+		}
+
+		switch typeId {
+		case typeDateTime2N:
+			column.Size += 3
+		case typeDateTimeOffsetN:
+			column.Size += 5
+		}
+
+		column.Reader = readByteLenType
+
+	case typeGuid, typeIntN, typeDecimal, typeNumeric,
+		typeBitN, typeDecimalN, typeNumericN, typeFltN,
+		typeMoneyN, typeDateTimeN, typeChar,
+		typeVarChar, typeBinary, typeVarBinary:
+		// byle len types
+
+		pos += 1 //byle len types
+		count += 1
+
+		column.Size = int(buf[pos]) //size
+		switch typeId {
+		case typeDecimal, typeNumeric, typeDecimalN, typeNumericN:
+			pos += 2 //byle len types
+			count += 2
+		}
+		column.Reader = readByteLenType
+	case typeXml:
+		pos += 1 //byle len types
+		count += 1
+		schemaPresent := buf[pos]
+
+		if schemaPresent != 0 {
+			pos += 1 //byle len types
+			count += 1
+			l := int(buf[pos]) // dbname
+			count += l
+			pos += l
+
+			pos += 1 // owning schema
+			count += 1
+			l = int(buf[pos]) // owning schema
+			count += l
+			pos += l
+
+			// xml schema collection
+			pos += 1
+			l = int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+			pos += 1
+			count += 2
+			pos += l * 2
+			count += l * 2
+		}
+		column.Reader = readPLPType
+	case typeUdt:
+		pos += 1
+		l := int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+		pos += 1
+		count += 2
+		//ti.Size
+		column.Size = l
+
+		//DBName
+		pos += 1 // owning schema
+		count += 1
+		l = int(buf[pos])
+		count += l
+		pos += l
+
+		//SchemaName
+		pos += 1 // owning schema
+		count += 1
+		l = int(buf[pos])
+		count += l
+		pos += l
+
+		//TypeName
+		pos += 1 // owning schema
+		count += 1
+		l = int(buf[pos])
+		count += l
+		pos += l
+
+		//AssemblyQualifiedName
+		pos += 1
+		l = int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+		pos += 1
+		count += 2
+		pos += l * 2
+		count += l * 2
+
+		column.Reader = readPLPType
+	case typeBigVarBin, typeBigVarChar, typeBigBinary, typeBigChar,
+		typeNVarChar, typeNChar:
+		// short len types
+		pos += 1
+		l := int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+		pos += 1
+		count += 2
+
+		column.Size = l
+
+		switch typeId {
+		case typeBigVarChar, typeBigChar, typeNVarChar, typeNChar:
+			pos += 5
+			count += 5
+		}
+
+		if column.Size == 0xffff {
+			column.Reader = readPLPType
+		} else {
+			column.Reader = readShortLenType
+		}
+
+	case typeText, typeImage, typeNText, typeVariant:
+		// LONGLEN_TYPE
+
+		l := int(binary.LittleEndian.Uint16(buf[pos+1 : pos+5]))
+		column.Size = l
+
+		pos += 4
+		count += 4
+
+		switch typeId {
+		case typeText, typeNText:
+			pos += 6
+			count += 6
+			// ignore tablenames
+			numparts := int(buf[pos])
+			for i := 0; i < numparts; i++ {
+				pos += 1
+				l := int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+				pos += 1
+				count += 2
+				pos += l
+				count += l
+			}
+			column.Reader = readLongLenType
+		case typeImage:
+			// ignore tablenames
+			pos++
+			count++
+			numparts := int(buf[pos])
+			for i := 0; i < numparts; i++ {
+				pos += 1
+				l := int(binary.LittleEndian.Uint16(buf[pos : pos+2]))
+				pos += 1
+				count += 2
+				pos += l
+				count += l
+			}
+			column.Reader = readLongLenType
+
+		case typeVariant:
+			column.Reader = readVariantType
+
+		}
+	default:
+		count += 0
+	}
+	return count
+}
+
+func parseToken(buf []byte) (rowCount int, msg string) {
+
+	var pos = 0
+	length := 0
+	rowCount = 0
+	msg = ""
+
+	var columns []columnStruct
+
+	defer func() {
+		if r := recover(); r != nil {
+			msg = "parse tds result error"
+		}
+	}()
+
+	currentBuf := buf[:]
+
+	// fmt.Printf("buf len %x", currentBuf)
+	for {
+
+		if len(currentBuf) == 0 {
+			break
+		}
+
+		token := token(currentBuf[0])
+		// fmt.Printf("item... %x %d\n", currentBuf[0], currentBuf[0])
+		currentBuf = currentBuf[1:]
+
+		switch token {
+		case tokenSSPI:
+			length = int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[length+2:]
+		case tokenReturnStatus:
+			currentBuf = currentBuf[4:]
+
+		case tokenLoginAck:
+			length = int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[length+2:]
+
+		case tokenOrder:
+			length = int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			//col ColIds
+			currentBuf = currentBuf[2+2*length:] //ColIds data
+
+		case tokenDoneInProc:
+			currentBuf = currentBuf[4:]
+			rowCount = int(binary.LittleEndian.Uint64(currentBuf[0:8]))
+			currentBuf = currentBuf[8:]
+		case tokenDone, tokenDoneProc:
+			currentBuf = currentBuf[4:]
+			rowCount = int(binary.LittleEndian.Uint64(currentBuf[0:8]))
+			currentBuf = currentBuf[8:]
+
+		case tokenError:
+			currentBuf = currentBuf[8:] //length2+Number4+State1+Class1
+			//message length
+			msgLength := int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[2:]
+			msgLength = msgLength * 2
+
+			msg, _ = ucs22str(currentBuf[0:msgLength])
+			return
+		case tokenColMetadata:
+
+			//http://msdn.microsoft.com/en-us/library/dd357363.aspx
+			count := int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[2:]
+
+			if count == 0xffff {
+				break
+			}
+			columns = make([]columnStruct, count)
+
+			if count > 0 {
+				for i := 0; i < count; i++ {
+
+					// fmt.Printf("colums %d %d", i, count)
+					column := &columns[i]
+					// x := pos
+
+					currentBuf = currentBuf[6:]
+
+					pos = readTypeInfo(0, currentBuf, column)
+
+					currentBuf = currentBuf[pos:]
+
+					//ColName
+					l := int(currentBuf[0])
+
+					currentBuf = currentBuf[1:]
+					//name
+					currentBuf = currentBuf[l*2:]
+				}
+
+				// fmt.Printf("tokenRow %x\n", currentBuf)
+
+			}
+		case tokenRow:
+			count := 0
+
+			for _, column := range columns {
+
+				count = column.Reader(&column, currentBuf)
+				currentBuf = currentBuf[count:]
+
+			}
+		case tokenNbcRow:
+			bitlen := (len(columns) + 7) / 8
+
+			pres := currentBuf[0:bitlen]
+			currentBuf = currentBuf[bitlen:]
+			count := 0
+
+			for i, column := range columns {
+				if pres[i/8]&(1<<(uint(i)%8)) != 0 {
+					continue
+				}
+				count = column.Reader(&column, currentBuf)
+				currentBuf = currentBuf[count:]
+
+				// fmt.Printf("tokenNbcRow %d %x \n", i, currentBuf)
+
+			}
+		case tokenEnvChange:
+			// http://msdn.microsoft.com/en-us/library/dd303449.aspx
+			length = int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[2+length:]
+		case tokenInfo:
+			// http://msdn.microsoft.com/en-us/library/dd304156.aspx
+			length = int(binary.LittleEndian.Uint16(currentBuf[0:2]))
+			currentBuf = currentBuf[2+length:]
+		case tokenReturnValue:
+			// https://msdn.microsoft.com/en-us/library/dd303881.aspx
+			currentBuf = currentBuf[2:]
+			nameLength := int(currentBuf[0])
+			currentBuf = currentBuf[1:]
+			currentBuf = currentBuf[nameLength*2:]
+			currentBuf = currentBuf[7:] //1byte + 4 byte+2 byt
+			col := columnStruct{}
+			count := readTypeInfo(0, currentBuf, &col)
+			currentBuf = currentBuf[count:] //readTypeInfo
+
+			count = col.Reader(&col, currentBuf)
+			currentBuf = currentBuf[count:] //column value
+
+		default:
+			// fmt.Printf("tokenNbcRow %x \n", currentBuf[0])
+			return rowCount, "parse result error"
+		}
+
+	}
+	return rowCount, msg
+}

plugSrc/mssql/build/util.go

@@ -0,0 +1,14 @@
+package build
+
+import "time"
+
+func GetNowStr(isClient bool) string {
+	var msg string
+	msg += time.Now().Format("2006-01-02 15:04:05.000")
+	if isClient {
+		msg += "| cli -> ser |"
+	} else {
+		msg += "| ser -> cli |"
+	}
+	return msg
+}

plugSrc/mysql/build/entry.go

@@ -1,18 +1,19 @@
 package build
 
 import (
-	"github.com/google/gopacket"
-	"io"
 	"bytes"
+	"encoding/binary"
 	"errors"
+	"fmt"
+	"io"
 	"log"
+	"os"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
-	"fmt"
+
-	"encoding/binary"
+	"github.com/google/gopacket"
-	"strings"
-	"os"
 )
 
 const (
@@ -41,6 +42,7 @@ type packet struct {
 
 var mysql *Mysql
 var once sync.Once
+
 func NewInstance() *Mysql {
 
 	once.Do(func() {
@@ -86,7 +88,7 @@ func (m *Mysql) ResolveStream(net, transport gopacket.Flow, buf io.Reader) {
 }
 
 func (m *Mysql) BPFFilter() string {
-	return "tcp and port "+strconv.Itoa(m.port);
+	return "tcp and port " + strconv.Itoa(m.port)
 }
 
 func (m *Mysql) Version() string {
@@ -110,7 +112,7 @@ func (m *Mysql) SetFlag(flg []string)  {
 
 		switch key {
 		case CmdPort:
-			port, err := strconv.Atoi(val);
+			port, err := strconv.Atoi(val)
 			m.port = port
 			if err != nil {
 				panic("ERR : port")
@@ -351,4 +353,3 @@ func (stm *stream) resolveClientPacket(payload []byte, seq int) {
 
 	fmt.Println(GetNowStr(true) + msg)
 }
-

plugSrc/mysql/build/util.go

@@ -9,7 +9,7 @@ import (
 
 func GetNowStr(isClient bool) string {
 	var msg string
-	msg += time.Now().Format("2006-01-02 15:04:05")
+	msg += time.Now().Format("2006-01-02 15:04:05.000")
 	if isClient {
 		msg += "| cli -> ser |"
 	} else {

plugSrc/redis/build/entry.go

@@ -1,12 +1,14 @@
 package build
 
 import (
-	"github.com/google/gopacket"
-	"io"
-	"strings"
-	"fmt"
-	"strconv"
 	"bufio"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/gopacket"
 )
 
 type Redis struct {
@@ -70,7 +72,7 @@ func (red Redis) ResolveStream(net, transport gopacket.Flow, r io.Reader) {
 			}
 			cmd += " " + string(c)
 		}
-		fmt.Println(cmd)
+		fmt.Println(time.Now().Format("2006-01-02 15:04:05.000") + " | " + cmd)
 	}
 }
 
@@ -91,7 +93,7 @@ func (red *Redis) SetFlag(flg []string)  {
 
 		switch key {
 		case CmdPort:
-			port, err := strconv.Atoi(val);
+			port, err := strconv.Atoi(val)
 			redis.port = port
 			if err != nil {
 				panic("ERR : Port error")
@@ -119,4 +121,3 @@ func (red *Redis) BPFFilter() string {
 func (red *Redis) Version() string {
 	return red.version
 }
-