raw_socket

Documentation

Index

• Constants
• type BySeq
  • func (a BySeq) Len() int
  • func (a BySeq) Less(i, j int) bool
  • func (a BySeq) Swap(i, j int)
• type Listener
  • func NewListener(addr string, port string) (rawListener *Listener)
  • func (t *Listener) Receive() *TCPMessage
• type TCPMessage
  • func NewTCPMessage(ID string, c_del chan *TCPMessage) (msg *TCPMessage)
  • func (t *TCPMessage) AddPacket(packet *TCPPacket)
  • func (t *TCPMessage) Bytes() (output []byte)
  • func (t *TCPMessage) Timeout()
• type TCPPacket
  • func ParseTCPPacket(addr net.Addr, b []byte) (p *TCPPacket)
  • func (t *TCPPacket) Parse()
  • func (t *TCPPacket) ParseBasic()
  • func (t *TCPPacket) String() string

Constants

const (
	TCP_FIN = 1 << iota
	TCP_SYN
	TCP_RST
	TCP_PSH
	TCP_ACK
	TCP_URG
	TCP_ECE
	TCP_CWR
	TCP_NS
)

TCP Flags

const MSG_EXPIRE = 2000 * time.Millisecond

Types

type BySeq

type BySeq []*TCPPacket

func (BySeq) Len

func (a BySeq) Len() int

func (BySeq) Less

func (a BySeq) Less(i, j int) bool

func (BySeq) Swap

func (a BySeq) Swap(i, j int)

type Listener

type Listener struct {
	// contains filtered or unexported fields
}

Capture traffic from socket using RAW_SOCKET's http://en.wikipedia.org/wiki/Raw_socket

RAW_SOCKET allow you listen for traffic on any port (e.g. sniffing) because they operate on IP level. Ports is TCP feature, same as flow control, reliable transmission and etc. Since we can't use default TCP libraries RAWTCPLitener implements own TCP layer TCP packets is parsed using tcp_packet.go, and flow control is managed by tcp_message.go

func NewListener

func NewListener(addr string, port string) (rawListener *Listener)

RAWTCPListen creates a listener to capture traffic from RAW_SOCKET

func (*Listener) Receive

func (t *Listener) Receive() *TCPMessage

Receive TCP messages from the listener channel

type TCPMessage

type TCPMessage struct {
	ID string // Message ID
	// contains filtered or unexported fields
}

TCPMessage ensure that all TCP packets for given request is received, and processed in right sequence Its needed because all TCP message can be fragmented or re-transmitted

Each TCP Packet have 2 ids: acknowledgment - message_id, and sequence - packet_id Message can be compiled from unique packets with same message_id which sorted by sequence Message is received if we didn't receive any packets for 2000ms

func NewTCPMessage

func NewTCPMessage(ID string, c_del chan *TCPMessage) (msg *TCPMessage)

NewTCPMessage pointer created from a Acknowledgment number and a channel of messages readuy to be deleted

func (*TCPMessage) AddPacket

func (t *TCPMessage) AddPacket(packet *TCPPacket)

AddPacket to the message and ensure packet uniqueness TCP allows that packet can be re-send multiple times

func (*TCPMessage) Bytes

func (t *TCPMessage) Bytes() (output []byte)

Bytes sorts packets in right orders and return message content

func (*TCPMessage) Timeout

func (t *TCPMessage) Timeout()

Timeout notifies message to stop listening, close channel and message ready to be sent

type TCPPacket

type TCPPacket struct {
	SrcPort    uint16
	DestPort   uint16
	Seq        uint32
	Ack        uint32
	DataOffset uint8
	Flags      uint16
	Window     uint16
	Checksum   uint16
	Urgent     uint16

	Data []byte

	Addr net.Addr
}

Simple TCP packet parser

Packet structure: http://en.wikipedia.org/wiki/Transmission_Control_Protocol

func ParseTCPPacket

func ParseTCPPacket(addr net.Addr, b []byte) (p *TCPPacket)

func (*TCPPacket) Parse

func (t *TCPPacket) Parse()

Parse TCP Packet, inspired by: https://github.com/miekg/pcap/blob/master/packet.go

func (*TCPPacket) ParseBasic

func (t *TCPPacket) ParseBasic()

ParseBasic set of fields

func (*TCPPacket) String

func (t *TCPPacket) String() string

String output for a TCP Packet