netshovel

Network Archaeology library for Go
git clone https://git.woozle.org/neale/netshovel.git

commit
3a6c629
parent
b9f0241
author
Neale Pickett
date
2020-09-24 20:23:43 -0600 MDT
Fix loss of state, and a thorough test
4 files changed,  +31, -23
M examples/simple/simple.go
+5, -4
 1@@ -2,13 +2,14 @@ package main
 2 
 3 import (
 4 	"fmt"
 5-	"github.com/dirtbags/netshovel"
 6-	"github.com/google/gopacket"
 7-	"github.com/google/gopacket/tcpassembly"
 8 	"io"
 9 	"log"
10 	"strings"
11 	"sync"
12+
13+	"github.com/dirtbags/netshovel"
14+	"github.com/google/gopacket"
15+	"github.com/google/gopacket/tcpassembly"
16 )
17 
18 var wg sync.WaitGroup
19@@ -17,7 +18,7 @@ type SimpleStreamFactory struct {
20 }
21 
22 type SimpleStream struct {
23-	netshovel.Stream
24+	*netshovel.Stream
25 }
26 
27 type SimplePacket struct {
M netshovel.go
+23, -16
 1@@ -31,23 +31,30 @@ func Shovel(factory tcpassembly.StreamFactory) {
 2 	assembler := tcpassembly.NewAssembler(streamPool)
 3 
 4 	for _, fn := range flag.Args() {
 5-		handle, err := pcap.OpenOffline(fn)
 6-		if err != nil {
 7-			log.Fatal(err)
 8-		}
 9+		ShovelFile(fn, assembler)
10+	}
11+
12+	assembler.FlushAll()
13+}
14 
15-		packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
16-		packets := packetSource.Packets()
17-		for packet := range packets {
18-			if packet == nil {
19-				break
20-			}
21-			if packet.NetworkLayer() == nil || packet.TransportLayer() == nil || packet.TransportLayer().LayerType() != layers.LayerTypeTCP {
22-				continue
23-			}
24-			tcp := packet.TransportLayer().(*layers.TCP)
25-			assembler.AssembleWithTimestamp(packet.NetworkLayer().NetworkFlow(), tcp, packet.Metadata().Timestamp)
26+// ShovelFile shovels a single file.
27+// You must call assembler.FlushAll() at the end of this!
28+func ShovelFile(filename string, assembler *tcpassembly.Assembler) {
29+	handle, err := pcap.OpenOffline(filename)
30+	if err != nil {
31+		log.Fatal(err)
32+	}
33+
34+	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
35+	packets := packetSource.Packets()
36+	for packet := range packets {
37+		if packet == nil {
38+			break
39 		}
40+		if packet.NetworkLayer() == nil || packet.TransportLayer() == nil || packet.TransportLayer().LayerType() != layers.LayerTypeTCP {
41+			continue
42+		}
43+		tcp := packet.TransportLayer().(*layers.TCP)
44+		assembler.AssembleWithTimestamp(packet.NetworkLayer().NetworkFlow(), tcp, packet.Metadata().Timestamp)
45 	}
46-	assembler.FlushAll()
47 }
M packet_test.go
+1, -1
1@@ -36,7 +36,7 @@ func TestHeaders(t *testing.T) {
2 		t.Error("Uint8", fnord)
3 	}
4 
5-	biggun, err := pkt.Uint32LE("biggun")
6+	biggun, err := pkt.Uint32BE("biggun")
7 	if err != nil {
8 		t.Error(err)
9 	}
M stream.go
+2, -2
 1@@ -43,8 +43,8 @@ type Stream struct {
 2 //
 3 // You should embed Stream into your own Application protocol stream struct.
 4 // Use this to initialize the internal stuff netshovel needs.
 5-func NewStream(net, transport gopacket.Flow) Stream {
 6-	return Stream{
 7+func NewStream(net, transport gopacket.Flow) *Stream {
 8+	return &Stream{
 9 		Net:          net,
10 		Transport:    transport,
11 		conversation: make(chan Utterance, 100),