mirror of
https://github.com/kubeshark/kubeshark.git
synced 2025-08-11 05:12:26 +00:00
* Removed policy rules (validation rules) feature * updated test pcap * Remove rules * fix replay in rules Co-authored-by: Roy Island <roy@up9.com> Co-authored-by: RoyUP9 <87927115+RoyUP9@users.noreply.github.com> Co-authored-by: Roee Gadot <roee.gadot@up9.com>
167 lines
4.7 KiB
Go
167 lines
4.7 KiB
Go
package redis
|
|
|
|
import (
|
|
"bufio"
|
|
"encoding/json"
|
|
"fmt"
|
|
"log"
|
|
"time"
|
|
|
|
"github.com/up9inc/mizu/tap/api"
|
|
)
|
|
|
|
var protocol = api.Protocol{
|
|
Name: "redis",
|
|
LongName: "Redis Serialization Protocol",
|
|
Abbreviation: "REDIS",
|
|
Macro: "redis",
|
|
Version: "3.x",
|
|
BackgroundColor: "#a41e11",
|
|
ForegroundColor: "#ffffff",
|
|
FontSize: 11,
|
|
ReferenceLink: "https://redis.io/topics/protocol",
|
|
Ports: []string{"6379"},
|
|
Priority: 3,
|
|
}
|
|
|
|
var protocolsMap = map[string]*api.Protocol{
|
|
fmt.Sprintf("%s/%s/%s", protocol.Name, protocol.Version, protocol.Abbreviation): &protocol,
|
|
}
|
|
|
|
type dissecting string
|
|
|
|
func (d dissecting) Register(extension *api.Extension) {
|
|
extension.Protocol = &protocol
|
|
}
|
|
|
|
func (d dissecting) GetProtocols() map[string]*api.Protocol {
|
|
return protocolsMap
|
|
}
|
|
|
|
func (d dissecting) Ping() {
|
|
log.Printf("pong %s", protocol.Name)
|
|
}
|
|
|
|
func (d dissecting) Dissect(b *bufio.Reader, reader api.TcpReader, options *api.TrafficFilteringOptions) error {
|
|
reqResMatcher := reader.GetReqResMatcher().(*requestResponseMatcher)
|
|
is := &RedisInputStream{
|
|
Reader: b,
|
|
Buf: make([]byte, 8192),
|
|
}
|
|
proto := NewProtocol(is)
|
|
for {
|
|
redisPacket, err := proto.Read()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if reader.GetIsClient() {
|
|
err = handleClientStream(reader.GetReadProgress(), reader.GetParent().GetOrigin(), reader.GetTcpID(), reader.GetCounterPair(), reader.GetCaptureTime(), reader.GetEmitter(), redisPacket, reqResMatcher)
|
|
} else {
|
|
err = handleServerStream(reader.GetReadProgress(), reader.GetParent().GetOrigin(), reader.GetTcpID(), reader.GetCounterPair(), reader.GetCaptureTime(), reader.GetEmitter(), redisPacket, reqResMatcher)
|
|
}
|
|
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
|
|
func (d dissecting) Analyze(item *api.OutputChannelItem, resolvedSource string, resolvedDestination string, namespace string) *api.Entry {
|
|
request := item.Pair.Request.Payload.(map[string]interface{})
|
|
response := item.Pair.Response.Payload.(map[string]interface{})
|
|
reqDetails := request["details"].(map[string]interface{})
|
|
resDetails := response["details"].(map[string]interface{})
|
|
|
|
elapsedTime := item.Pair.Response.CaptureTime.Sub(item.Pair.Request.CaptureTime).Round(time.Millisecond).Milliseconds()
|
|
if elapsedTime < 0 {
|
|
elapsedTime = 0
|
|
}
|
|
return &api.Entry{
|
|
ProtocolId: fmt.Sprintf("%s/%s/%s", protocol.Name, protocol.Version, protocol.Abbreviation),
|
|
Capture: item.Capture,
|
|
Source: &api.TCP{
|
|
Name: resolvedSource,
|
|
IP: item.ConnectionInfo.ClientIP,
|
|
Port: item.ConnectionInfo.ClientPort,
|
|
},
|
|
Destination: &api.TCP{
|
|
Name: resolvedDestination,
|
|
IP: item.ConnectionInfo.ServerIP,
|
|
Port: item.ConnectionInfo.ServerPort,
|
|
},
|
|
Namespace: namespace,
|
|
Outgoing: item.ConnectionInfo.IsOutgoing,
|
|
Request: reqDetails,
|
|
Response: resDetails,
|
|
RequestSize: item.Pair.Request.CaptureSize,
|
|
ResponseSize: item.Pair.Response.CaptureSize,
|
|
Timestamp: item.Timestamp,
|
|
StartTime: item.Pair.Request.CaptureTime,
|
|
ElapsedTime: elapsedTime,
|
|
}
|
|
|
|
}
|
|
|
|
func (d dissecting) Summarize(entry *api.Entry) *api.BaseEntry {
|
|
status := 0
|
|
statusQuery := ""
|
|
|
|
method := ""
|
|
methodQuery := ""
|
|
if entry.Request["command"] != nil {
|
|
method = entry.Request["command"].(string)
|
|
methodQuery = fmt.Sprintf(`request.command == "%s"`, method)
|
|
}
|
|
|
|
summary := ""
|
|
summaryQuery := ""
|
|
if entry.Request["key"] != nil {
|
|
summary = entry.Request["key"].(string)
|
|
summaryQuery = fmt.Sprintf(`request.key == "%s"`, summary)
|
|
}
|
|
|
|
return &api.BaseEntry{
|
|
Id: entry.Id,
|
|
Protocol: *protocolsMap[entry.ProtocolId],
|
|
Capture: entry.Capture,
|
|
Summary: summary,
|
|
SummaryQuery: summaryQuery,
|
|
Status: status,
|
|
StatusQuery: statusQuery,
|
|
Method: method,
|
|
MethodQuery: methodQuery,
|
|
Timestamp: entry.Timestamp,
|
|
Source: entry.Source,
|
|
Destination: entry.Destination,
|
|
IsOutgoing: entry.Outgoing,
|
|
Latency: entry.ElapsedTime,
|
|
}
|
|
}
|
|
|
|
func (d dissecting) Represent(request map[string]interface{}, response map[string]interface{}) (object []byte, err error) {
|
|
representation := make(map[string]interface{})
|
|
repRequest := representGeneric(request, `request.`)
|
|
repResponse := representGeneric(response, `response.`)
|
|
representation["request"] = repRequest
|
|
representation["response"] = repResponse
|
|
object, err = json.Marshal(representation)
|
|
return
|
|
}
|
|
|
|
func (d dissecting) Macros() map[string]string {
|
|
return map[string]string{
|
|
`redis`: fmt.Sprintf(`protocol == "%s/%s/%s"`, protocol.Name, protocol.Version, protocol.Abbreviation),
|
|
}
|
|
}
|
|
|
|
func (d dissecting) NewResponseRequestMatcher() api.RequestResponseMatcher {
|
|
return createResponseRequestMatcher()
|
|
}
|
|
|
|
var Dissector dissecting
|
|
|
|
func NewDissector() api.Dissector {
|
|
return Dissector
|
|
}
|