Make the distinction of outbound and inbound ports

This commit is contained in:
M. Mert Yildiran 2021-08-17 13:40:15 +03:00
parent b384b62ac5
commit 611c92a6d4
No known key found for this signature in database
GPG Key ID: D42ADB236521BF7A
6 changed files with 35 additions and 10 deletions

View File

@ -6,11 +6,12 @@ import (
) )
type Extension struct { type Extension struct {
Name string Name string
Path string Path string
Plug *plugin.Plugin Plug *plugin.Plugin
Ports []string InboundPorts []string
Dissector Dissector OutboundPorts []string
Dissector Dissector
} }
type Dissector interface { type Dissector interface {

View File

@ -15,7 +15,8 @@ type dissecting string
func (g dissecting) Register(extension *api.Extension) { func (g dissecting) Register(extension *api.Extension) {
extension.Name = "amqp" extension.Name = "amqp"
extension.Ports = []string{"5671", "5672"} extension.OutboundPorts = []string{"5671", "5672"}
extension.InboundPorts = []string{}
} }
func (g dissecting) Ping() { func (g dissecting) Ping() {

View File

@ -19,7 +19,8 @@ type dissecting string
func (g dissecting) Register(extension *api.Extension) { func (g dissecting) Register(extension *api.Extension) {
extension.Name = "http" extension.Name = "http"
extension.Ports = []string{"80", "8080", "443"} extension.OutboundPorts = []string{"80", "8080", "443"}
extension.InboundPorts = []string{}
} }
func (g dissecting) Ping() { func (g dissecting) Ping() {

View File

@ -15,7 +15,8 @@ type dissecting string
func (g dissecting) Register(extension *api.Extension) { func (g dissecting) Register(extension *api.Extension) {
extension.Name = "kafka" extension.Name = "kafka"
extension.Ports = []string{"9092"} extension.OutboundPorts = []string{"9092"}
extension.InboundPorts = []string{}
} }
func (g dissecting) Ping() { func (g dissecting) Ping() {

View File

@ -125,6 +125,8 @@ var nErrors uint
var ownIps []string // global var ownIps []string // global
var hostMode bool // global var hostMode bool // global
var extensions []*api.Extension // global var extensions []*api.Extension // global
var allOutboundPorts []string // global
var allInboundPorts []string // global
type OutputChannelItem struct { type OutputChannelItem struct {
} }
@ -240,6 +242,21 @@ func startMemoryProfiler() {
}() }()
} }
func MergeUnique(slice []string, merge []string) []string {
for _, i := range merge {
add := true
for _, ele := range slice {
if ele == i {
add = false
}
}
if add {
slice = append(slice, i)
}
}
return slice
}
func loadExtensions() { func loadExtensions() {
dir, _ := filepath.Abs(filepath.Dir(os.Args[0])) dir, _ := filepath.Abs(filepath.Dir(os.Args[0]))
extensionsDir := path.Join(dir, "./extensions/") extensionsDir := path.Join(dir, "./extensions/")
@ -265,7 +282,11 @@ func loadExtensions() {
extension.Dissector = dissector extension.Dissector = dissector
log.Printf("Extension Properties: %+v\n", extension) log.Printf("Extension Properties: %+v\n", extension)
extensions[i] = extension extensions[i] = extension
allOutboundPorts = MergeUnique(allOutboundPorts, extension.OutboundPorts)
allInboundPorts = MergeUnique(allInboundPorts, extension.InboundPorts)
} }
log.Printf("allOutboundPorts: %v\n", allOutboundPorts)
log.Printf("allInboundPorts: %v\n", allInboundPorts)
} }
func startPassiveTapper(outboundLinkWriter *OutboundLinkWriter) { func startPassiveTapper(outboundLinkWriter *OutboundLinkWriter) {

View File

@ -32,7 +32,7 @@ func containsPort(ports []string, port string) bool {
func (h *tcpStream) run() { func (h *tcpStream) run() {
b := bufio.NewReader(&h.r) b := bufio.NewReader(&h.r)
for _, extension := range extensions { for _, extension := range extensions {
if containsPort(extension.Ports, h.transport.Dst().String()) { if containsPort(extension.OutboundPorts, h.transport.Dst().String()) {
extension.Dissector.Ping() extension.Dissector.Ping()
extension.Dissector.Dissect(b) extension.Dissector.Dissect(b)
} }
@ -46,7 +46,7 @@ func (h *tcpStreamFactory) New(net, transport gopacket.Flow) tcpassembly.Stream
transport: transport, transport: transport,
r: tcpreader.NewReaderStream(), r: tcpreader.NewReaderStream(),
} }
if transport.Dst().String() == "80" { if containsPort(allOutboundPorts, transport.Dst().String()) {
go stream.run() go stream.run()
} }
return &stream.r return &stream.r