func serialize(ipLayer *layers.IPv4) ([]byte, error) {
/*Write the IPv4 header into a gopacket buffer*/
buf := gopacket.NewSerializeBuffer()
err := ipLayer.SerializeTo(buf, gopacket.SerializeOptions{FixLengths: false, ComputeChecksums: true})
if err != nil {
return nil, err
}
/*Write the gopacket buffer and the payload into a byte buffer, concatenating
the entire packet together.*/
var buf2 bytes.Buffer
buf2.Write(buf.Bytes())
buf2.Write(ipLayer.Payload)
return buf2.Bytes(), nil
}
func TestnotFrag(t *testing.T) {
ip := layers.IPv4{
Version: 4,
TTL: 220,
SrcIP: net.IPv4(1, 1, 1, 1),
DstIP: net.IPv4(2, 2, 2, 2),
Flags: layers.IPv4DontFragment,
}
v4defragger := ip4defrag.NewIPv4Defragmenter()
b := gopacket.NewSerializeBuffer()
ops := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
ip.SerializeTo(b, ops)
pack := gopacket.NewPacket(b.Bytes(), layers.LinkTypeIPv4, gopacket.Default)
_, err := v4defragger.DefragIPv4(pack.Layer(layers.LayerTypeIPv4).(*layers.IPv4))
if err != nil {
t.Errorf("v4defrag do not return err when no frag pack is in")
}
}
func TestnotFrag(t *testing.T) {
ip := layers.IPv4{
Version: 4,
TTL: 220,
SrcIP: net.IPv4(1, 1, 1, 1),
DstIP: net.IPv4(2, 2, 2, 2),
Flags: layers.IPv4DontFragment,
}
nomalPack := make(chan gopacket.Packet, 5)
fragV4Pack := make(chan gopacket.Packet, 5)
b := gopacket.NewSerializeBuffer()
ops := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
ip.SerializeTo(b, ops)
pack := gopacket.NewPacket(b.Bytes(), layers.LinkTypeIPv4, gopacket.Default)
fragV4Pack <- pack
err := v4Defrag(fragV4Pack, nomalPack)
if err != nil {
t.Errorf("v4defrag do not return err when no frag pack is in")
}
}
// Given an EvePacket, convert the payload to a PCAP faking out the
// headers as best we can.
//
// A buffer containing the 1 packet pcap file will be returned.
func EvePayloadToPcap(event *EveEvent) ([]byte, error) {
buffer := gopacket.NewSerializeBuffer()
options := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
payloadLayer := gopacket.Payload(event.Payload.Bytes())
payloadLayer.SerializeTo(buffer, options)
srcIp := net.ParseIP(event.SrcIP)
if srcIp == nil {
return nil, fmt.Errorf("Failed to parse IP address %s.", event.SrcIP)
}
dstIp := net.ParseIP(event.DstIP)
if dstIp == nil {
return nil, fmt.Errorf("Failed to parse IP address %s.", event.DstIP)
}
proto, err := ProtoNumber(event.Proto)
if err != nil {
return nil, err
}
switch proto {
case layers.IPProtocolTCP:
// Could probably fake up a better TCP layer here.
tcpLayer := layers.TCP{
SrcPort: layers.TCPPort(event.SrcPort),
DstPort: layers.TCPPort(event.DstPort),
}
tcpLayer.SerializeTo(buffer, options)
break
case layers.IPProtocolUDP:
udpLayer := layers.UDP{
SrcPort: layers.UDPPort(event.SrcPort),
DstPort: layers.UDPPort(event.DstPort),
}
udpLayer.SerializeTo(buffer, options)
break
case layers.IPProtocolICMPv4:
icmpLayer := layers.ICMPv4{
TypeCode: layers.CreateICMPv4TypeCode(
event.IcmpType, event.IcmpCode),
Id: 0,
Seq: 0,
}
icmpLayer.SerializeTo(buffer, options)
break
case layers.IPProtocolICMPv6:
icmp6Layer := layers.ICMPv6{
TypeCode: layers.CreateICMPv6TypeCode(
event.IcmpType, event.IcmpCode),
}
icmp6Layer.SerializeTo(buffer, options)
break
default:
return nil, fmt.Errorf("Unsupported protocol %d.", proto)
}
isIp6 := dstIp.To4() == nil
if !isIp6 {
ipLayer := layers.IPv4{
SrcIP: srcIp,
DstIP: dstIp,
Version: 4,
Protocol: proto,
TTL: 64,
}
ipLayer.SerializeTo(buffer, options)
} else {
ip6Layer := layers.IPv6{
Version: 6,
SrcIP: srcIp,
DstIP: dstIp,
}
ip6Layer.SerializeTo(buffer, options)
}
return pcap.CreatePcap(event.Timestamp.Time,
buffer.Bytes(), layers.LinkTypeRaw)
}
func (h *dnsStream) creatPacket(msg_buf []byte, nomalPack chan gopacket.Packet) {
var sourcePort, DesPort int16
//read the port from tranport flow
b_buf := bytes.NewBuffer(h.transport.Src().Raw())
binary.Read(b_buf, binary.BigEndian, &sourcePort)
b_buf = bytes.NewBuffer(h.transport.Dst().Raw())
binary.Read(b_buf, binary.BigEndian, &DesPort)
//new a UDP layer
udpLayer := layers.UDP{
BaseLayer: layers.BaseLayer{
Contents: []byte{},
Payload: msg_buf,
},
SrcPort: layers.UDPPort(sourcePort),
DstPort: layers.UDPPort(DesPort),
Length: 1024,
Checksum: 30026,
}
UDPNewSerializBuffer := gopacket.NewSerializeBuffer() // this buffer could be used as a payload of IP layer
udpBuffer, _ := UDPNewSerializBuffer.PrependBytes(len(msg_buf))
copy(udpBuffer, msg_buf)
ops := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
if h.net.EndpointType() == layers.EndpointIPv4 {
ip_checksum := layers.IPv4{}
ip_checksum.Version = 4
ip_checksum.TTL = 0
ip_checksum.SrcIP = h.net.Src().Raw()
ip_checksum.DstIP = h.net.Dst().Raw()
udpLayer.SetNetworkLayerForChecksum(&ip_checksum)
} else {
ip6_checksum := layers.IPv6{}
ip6_checksum.Version = 6
ip6_checksum.NextHeader = layers.IPProtocolNoNextHeader
ip6_checksum.HopLimit = 0
ip6_checksum.SrcIP = h.net.Src().Raw()
ip6_checksum.DstIP = h.net.Dst().Raw()
udpLayer.SetNetworkLayerForChecksum(&ip6_checksum)
}
err := udpLayer.SerializeTo(UDPNewSerializBuffer, ops)
if err != nil {
fmt.Print("error in create udp Layer")
return
//err = nil
// need err handle there
}
fmt.Println("finished creat udplayer, the length is ", udpLayer.Length)
if h.net.EndpointType() == layers.EndpointIPv4 { // if it is from ipv4, construct a ipv4 layer
ip := layers.IPv4{
BaseLayer: layers.BaseLayer{
Contents: []byte{},
Payload: UDPNewSerializBuffer.Bytes(),
},
Version: 4,
IHL: 0,
TOS: 0,
Length: 0,
Id: 0,
Flags: 0,
FragOffset: 0,
TTL: 0,
Protocol: layers.IPProtocolUDP,
Checksum: 0,
SrcIP: h.net.Src().Raw(),
DstIP: h.net.Dst().Raw(),
Options: []layers.IPv4Option{},
Padding: []byte{},
}
//serialize it and use the serilize buffer to new packet
IPserializeBuffer := gopacket.NewSerializeBuffer()
ipBuffer, _ := IPserializeBuffer.PrependBytes(len(UDPNewSerializBuffer.Bytes()))
copy(ipBuffer, UDPNewSerializBuffer.Bytes())
err = ip.SerializeTo(IPserializeBuffer, ops)
if err != nil {
fmt.Print("error in create ipv4 Layer")
return
//err = nil
// need err handle there
}
fmt.Println("finished creat ip, the length is ", ip.Length)
resultPack := gopacket.NewPacket(IPserializeBuffer.Bytes(), layers.LayerTypeIPv4, gopacket.Default)
resultPack.Metadata().CaptureLength = len(resultPack.Data())
resultPack.Metadata().Length = len(resultPack.Data())
//seems the capture length is 0 so the pcapwrite cannot write it, try to give them a write value
nomalPack <- resultPack
return
} else if h.net.EndpointType() == layers.EndpointIPv6 {
// if it is in IPV6 contruct ipv6 packet
ip := layers.IPv6{
BaseLayer: layers.BaseLayer{
Contents: []byte{},
Payload: UDPNewSerializBuffer.Bytes(),
},
Version: 6,
TrafficClass: 0,
FlowLabel: 0,
Length: 0,
NextHeader: layers.IPProtocolNoNextHeader, //no sure what next header should be used there
HopLimit: 0,
SrcIP: h.net.Src().Raw(),
DstIP: h.net.Dst().Raw(),
HopByHop: nil,
// hbh will be pointed to by HopByHop if that layer exists.
}
IPserializeBuffer := gopacket.NewSerializeBuffer()
err := ip.SerializeTo(IPserializeBuffer, ops)
if err != nil {
fmt.Printf("error in creat IPV6 Layer")
return
}
fmt.Println("finished creat ip, the length is ", ip.Length)
resultPack := gopacket.NewPacket(IPserializeBuffer.Bytes(), layers.LayerTypeIPv6, gopacket.Default)
resultPack.Metadata().CaptureLength = len(resultPack.Data())
resultPack.Metadata().Length = len(resultPack.Data())
//seems the capture length is 0 so the pcapwrite cannot write it, try to give them a write value
nomalPack <- resultPack
return
} else {
return //unknown network just return?
}
}
//sendPacket generates & sends a packet of arbitrary size to a specific destination.
//The size specified should be larger then 40bytes.
func sendPacket(sourceIP string, destinationIP string, size int, message string, appID int, chanID int, icmpType layers.ICMPv4TypeCode) []byte {
var payloadSize int
if size < 28 {
//Unable to create smaller packets.
payloadSize = 0
} else {
payloadSize = size - 28
}
//Convert IP to 4bit representation
srcIP := net.ParseIP(sourceIP).To4()
dstIP := net.ParseIP(destinationIP).To4()
//IP Layer
ip := layers.IPv4{
SrcIP: srcIP,
DstIP: dstIP,
Version: 4,
TTL: 64,
Protocol: layers.IPProtocolICMPv4,
}
icmp := layers.ICMPv4{
TypeCode: icmpType,
}
opts := gopacket.SerializeOptions{
FixLengths: true,
ComputeChecksums: true,
}
ipHeaderBuf := gopacket.NewSerializeBuffer()
err := ip.SerializeTo(ipHeaderBuf, opts)
if err != nil {
panic(err)
}
//Set "Don't Fragment"-Flag in Header
ipHeader, err := ipv4.ParseHeader(ipHeaderBuf.Bytes())
ipHeader.Flags |= ipv4.DontFragment
if err != nil {
panic(err)
}
payloadBuf := gopacket.NewSerializeBuffer()
//Influence the payload size
payload := gopacket.Payload(generatePayload(payloadSize, ","+strconv.Itoa(appID)+","+strconv.Itoa(chanID)+","+message+","))
err = gopacket.SerializeLayers(payloadBuf, opts, &icmp, payload)
if err != nil {
panic(err)
}
//Send packet
var packetConn net.PacketConn
var rawConn *ipv4.RawConn
packetConn, err = net.ListenPacket("ip4:icmp", srcIP.String())
if err != nil {
panic(err)
}
rawConn, err = ipv4.NewRawConn(packetConn)
if err != nil {
panic(err)
}
err = rawConn.WriteTo(ipHeader, payloadBuf.Bytes(), nil)
return append(ipHeaderBuf.Bytes(), payloadBuf.Bytes()...)
}