parser

Documentation

Index

• Constants
• Variables
• func UpdateLabels(label Label)
• type Label
  • func (l *Label) CheckApply(session TCPSession) bool
• type LabelType
• type OwnerType
• type Packet
• type Parser
  • func (p *Parser) Parse()
• type TCPSession

Constants

const (
	InfoColor    = "\033[1;34m%s\033[0m"
	NoticeColor  = "\033[1;36m%s\033[0m"
	WarningColor = "\033[1;33m%s\033[0m"
	ErrorColor   = "\033[1;31m%s\033[0m"
	DebugColor   = "\033[0;36m%s\033[0m"
)

const (
	Client = OwnerType("Client")
	Server = OwnerType("Server")
)

const (
	PacketIN  = LabelType("in")
	PacketOUT = LabelType("out")
)

const WAIT_TIMEOUT = 1

Variables

var DBClient *mongo.Client

var DBClientForUpdater *mongo.Client

var LabelTypeToOwnerType = map[LabelType]OwnerType{
	PacketIN:  Client,
	PacketOUT: Server,
}

var Labels = struct {
	sync.Mutex
	L []Label
}{L: []Label{
	{
		Name:      "ASDF label",
		Type:      PacketIN,
		Regexp:    regexp.MustCompile("asdf"),
		RawRegexp: "YXNkZg==",
		Color:     "#ffffff",
	},
	{
		Name:      "SQL quotes",
		Type:      PacketIN,
		Regexp:    regexp.MustCompile(`('(''|[^'])*')`),
		RawRegexp: "KCcoJyd8W14nXSkqJykK",
		Color:     "#ffffff",
	},
	{
		Name:      "SQL commands",
		Type:      PacketIN,
		Regexp:    regexp.MustCompile(`(\b(ALTER|CREATE|DELETE|DROP|EXEC(UTE){0,1}|INSERT( +INTO){0,1}|MERGE|SELECT|UPDATE|UNION( +ALL){0,1})\b)`),
		RawRegexp: "KCcoJyd8W14nXSkqJyl8KFxiKEFMVEVSfENSRUFURXxERUxFVEV8RFJPUHxFWEVDKFVURSl7MCwxfXxJTlNFUlQoICtJTlRPKXswLDF9fE1FUkdFfFNFTEVDVHxVUERBVEV8VU5JT04oICtBTEwpezAsMX0pXGIp",
		Color:     "#ffffff",
	},
}}

Functions

func UpdateLabels

func UpdateLabels(label Label)

Types

type Label

type Label struct {
	Name      string
	Type      LabelType
	Color     string
	Regexp    *regexp.Regexp
	RawRegexp string
}

Label uses for traffic clustering.

func (*Label) CheckApply

func (l *Label) CheckApply(session TCPSession) bool

type LabelType

type LabelType string

LabelType is marker for applying regexp: for IN or for OUT

type OwnerType

type OwnerType string

type Packet

type Packet struct {
	Owner OwnerType
	Data  string
}

type Parser

type Parser struct {
	Source *gopacket.PacketSource
	sync.Mutex
	// contains filtered or unexported fields
}

func (*Parser) Parse

func (p *Parser) Parse()

type TCPSession

type TCPSession struct {
	ServerAddr     string
	ClientAddr     string
	ServerPort     uint16
	ClientPort     uint16
	SequenceNumber uint32
	Packets        []Packet
	Labels         []Label
	LastUpdate     int64
}