-
Notifications
You must be signed in to change notification settings - Fork 39
/
sniffer.go
207 lines (181 loc) · 5.3 KB
/
sniffer.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
/*
* HoneyBadger core library for detecting TCP injection attacks
*
* Copyright (C) 2014 David Stainton
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package HoneyBadger
import (
"fmt"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"io"
"log"
"github.com/david415/HoneyBadger/drivers"
"github.com/david415/HoneyBadger/types"
)
// Sniffer sets up the connection pool and is an abstraction layer for dealing
// with incoming packets weather they be from a pcap file or directly off the wire.
type Sniffer struct {
options *types.SnifferDriverOptions
supervisor types.Supervisor
dispatcher PacketDispatcher
packetDataSource types.PacketDataSourceCloser
isStopped bool
decodePacketChan chan TimedRawPacket
stopDecodeChan chan bool
}
// NewSniffer creates a new Sniffer struct
func NewSniffer(options *types.SnifferDriverOptions, dispatcher PacketDispatcher) types.PacketSource {
i := Sniffer{
dispatcher: dispatcher,
options: options,
decodePacketChan: make(chan TimedRawPacket),
stopDecodeChan: make(chan bool),
}
return &i
}
func (i *Sniffer) SetSupervisor(supervisor types.Supervisor) {
i.supervisor = supervisor
}
func (i *Sniffer) GetStartedChan() chan bool {
return make(chan bool)
}
// Start... starts the TCP attack inquisition!
func (i *Sniffer) Start() {
// XXX
i.setupHandle()
go i.capturePackets()
go i.decodePackets()
}
func (i *Sniffer) Stop() {
log.Print("sniffer: sending stopCapureChan signal")
i.isStopped = true
i.stopDecodeChan <- true
}
func (i *Sniffer) Close() {
if i.packetDataSource != nil {
log.Print("closing packet capture socket")
i.packetDataSource.Close()
}
log.Print("stopping the sniffer decode loop")
i.isStopped = true
log.Print("done.")
}
func (i *Sniffer) setupHandle() {
var err error
var what string
factory, ok := drivers.Drivers[i.options.DAQ]
if !ok {
log.Fatal(fmt.Sprintf("%s Sniffer not supported on this system", i.options.DAQ))
}
i.packetDataSource, err = factory(i.options)
if err != nil {
if i.options.Filename != "" {
log.Printf("failed to read file %s", i.options.Filename)
}
panic(fmt.Sprintf("Failed to acquire DataAcQuisition source: %s", err))
}
if i.options.Filename != "" {
what = fmt.Sprintf("file %s", i.options.Filename)
} else {
what = fmt.Sprintf("interface %s", i.options.Device)
}
log.Printf("Starting %s packet capture on %s", i.options.DAQ, what)
}
func (i *Sniffer) capturePackets() {
for {
rawPacket, captureInfo, err := i.packetDataSource.ReadPacketData()
if err == io.EOF {
log.Print("ReadPacketData got EOF\n")
i.Close()
i.Stop()
i.dispatcher.Stop()
i.supervisor.Stopped()
return
}
if err != nil {
//log.Printf("packet capure read error: %s", err)
continue
}
timedPacket := TimedRawPacket{
Timestamp: captureInfo.Timestamp,
}
timedPacket.RawPacket = make([]byte, len(rawPacket))
copy(timedPacket.RawPacket, rawPacket)
i.decodePacketChan <- timedPacket
if i.isStopped {
break
}
}
}
func (i *Sniffer) decodePackets() {
var eth layers.Ethernet
var ip4 layers.IPv4
var ip6 layers.IPv6
var tcp layers.TCP
var payload gopacket.Payload
parser := gopacket.NewDecodingLayerParser(layers.LayerTypeEthernet, ð, &ip4, &ip6, &tcp, &payload)
decoded := make([]gopacket.LayerType, 0, 4)
for {
select {
case <-i.stopDecodeChan:
return
case timedRawPacket := <-i.decodePacketChan:
newPayload := new(gopacket.Payload)
payload = *newPayload
err := parser.DecodeLayers(timedRawPacket.RawPacket, &decoded)
if err != nil {
continue
}
packetManifest := types.PacketManifest{
Timestamp: timedRawPacket.Timestamp,
Payload: payload,
IPv6: &layers.IPv6{},
IPv4: &layers.IPv4{},
TCP: &layers.TCP{},
}
foundNetLayer := false
for _, typ := range decoded {
switch typ {
case layers.LayerTypeIPv4:
*packetManifest.IPv4 = ip4
foundNetLayer = true
case layers.LayerTypeIPv6:
*packetManifest.IPv6 = ip6
foundNetLayer = true
case layers.LayerTypeTCP:
if foundNetLayer {
flow := types.TcpIpFlow{}
if packetManifest.IPv4.Version == 4 {
// IPv4 case
flow = types.NewTcpIpFlowFromFlows(ip4.NetworkFlow(), tcp.TransportFlow())
} else if packetManifest.IPv6.Version == 6 {
// IPv6 case
flow = types.NewTcpIpFlowFromFlows(ip6.NetworkFlow(), tcp.TransportFlow())
} else {
panic("wtf")
}
packetManifest.Flow = &flow
*packetManifest.TCP = tcp
i.dispatcher.ReceivePacket(&packetManifest)
} else {
log.Println("could not find IPv4 or IPv6 layer, inoring")
}
} // switch
} // for
} // select
} // for
}