probe

Documentation

Overview

Package probe classifies the packets into stream according to network flow and transport flow.

                      stream(network1:transport1)\
                    /                              \
/ hash(transport flow)- stream(network2:transport1)- \

packet-> hash(network flow) messages

\ hash(transport flow)- stream(network3:transport2)- /
                    \                              /
                      stream(network4:transport2)/
 |               tcp assembly                   |

Index

• func GenerateSourceQuery(node sqlparser.SQLNode) (string, map[string]string)
• func GenerateTemplateQuery(node sqlparser.SQLNode) (string, map[string]string)
• type Assembly
  • func (a *Assembly) Assemble(packet gopacket.Packet)
  • func (a *Assembly) CloseOlderThan(t time.Time) int
• type IsRequest
• type Key
  • func (k Key) String() string
• type MysqlBasePacket
  • func (p *MysqlBasePacket) DecodeFromBytes(data []byte) (int, error)
  • func (p *MysqlBasePacket) Length() int
  • func (p *MysqlBasePacket) ParseRequestPacket(packet *MysqlRequestPacket) error
  • func (p *MysqlBasePacket) ParseResponsePacket(reqType byte, packet *MysqlResponsePacket) (err error)
  • func (p *MysqlBasePacket) Seq() byte
• type MysqlRequestPacket
  • func (p *MysqlRequestPacket) CMD() byte
  • func (p *MysqlRequestPacket) SQL() string
  • func (p *MysqlRequestPacket) Seq() uint8
  • func (p *MysqlRequestPacket) Stmt() sqlparser.Statement
  • func (p *MysqlRequestPacket) StmtID() uint32
• type MysqlResponsePacket
• type MysqlStream
• type Probe
  • func NewProbe(device string, snapLen int32, port uint16, workerNum int, ...) *Probe
  • func (p *Probe) Init() error
  • func (p *Probe) IsRequest(dstIP string, dstPort uint16) bool
  • func (p *Probe) Run()
  • func (p *Probe) String() string
• type Worker
  • func NewProbeWorker(probe *Probe, id int) *Worker
  • func (w *Worker) Run()

Functions

func GenerateSourceQuery

func GenerateSourceQuery(node sqlparser.SQLNode) (string, map[string]string)

GenerateSourceQuery rebuild the query by AST

func GenerateTemplateQuery

func GenerateTemplateQuery(node sqlparser.SQLNode) (string, map[string]string)

GenerateTemplateQuery generate a template according to the AST

Types

type Assembly

type Assembly struct {
	// contains filtered or unexported fields
}

Assembly dispatchs packet according to net flow and tcp flow

func (*Assembly) Assemble

func (a *Assembly) Assemble(packet gopacket.Packet)

Assemble send the packet to specify stream

func (*Assembly) CloseOlderThan

func (a *Assembly) CloseOlderThan(t time.Time) int

CloseOlderThan remove those streams expired and return the number of them

type IsRequest

type IsRequest func(netFlow, tcpFlow gopacket.Flow) bool

IsRequest is a callback set by user to distinguish flow direction.

type Key

type Key struct {
	// contains filtered or unexported fields
}

Key is the pair of networker and transport Flow

func (Key) String

func (k Key) String() string

type MysqlBasePacket

type MysqlBasePacket struct {
	Header []byte // header
	Data   []byte // body
}

MysqlBasePacket is the complete packet with header and payload

func (*MysqlBasePacket) DecodeFromBytes

func (p *MysqlBasePacket) DecodeFromBytes(data []byte) (int, error)

DecodeFromBytes try to decode the first packet from bytes

func (*MysqlBasePacket) Length

func (p *MysqlBasePacket) Length() int

Length retrun the body length

func (*MysqlBasePacket) ParseRequestPacket

func (p *MysqlBasePacket) ParseRequestPacket(packet *MysqlRequestPacket) error

ParseRequestPacket filter out the query packet

func (*MysqlBasePacket) ParseResponsePacket

func (p *MysqlBasePacket) ParseResponsePacket(reqType byte, packet *MysqlResponsePacket) (err error)

ParseResponsePacket distinguish OK packet, Err packet and Result set Packet

func (*MysqlBasePacket) Seq

func (p *MysqlBasePacket) Seq() byte

Seq return the Sequence id

type MysqlRequestPacket

type MysqlRequestPacket struct {
	// contains filtered or unexported fields
}

MysqlRequestPacket retains the infomation of query packet

func (*MysqlRequestPacket) CMD

func (p *MysqlRequestPacket) CMD() byte

CMD return the request command flag

func (*MysqlRequestPacket) SQL

func (p *MysqlRequestPacket) SQL() string

SQL return the sql in query packet

func (*MysqlRequestPacket) Seq

func (p *MysqlRequestPacket) Seq() uint8

Seq return the sequence id in head

func (*MysqlRequestPacket) Stmt

func (p *MysqlRequestPacket) Stmt() sqlparser.Statement

Stmt return the AST of the sql in query packet

func (*MysqlRequestPacket) StmtID

func (p *MysqlRequestPacket) StmtID() uint32

StmtID return the statement id of a execution request

type MysqlResponsePacket

type MysqlResponsePacket struct {
	// contains filtered or unexported fields
}

MysqlResponsePacket retains the infomation about the response packet of query

type MysqlStream

type MysqlStream struct {
	// contains filtered or unexported fields
}

MysqlStream is a tcp assembly stream wrapper of ReaderStream

type Probe

type Probe struct {
	// contains filtered or unexported fields
}

Probe need to deloyed at server side.

func NewProbe

func NewProbe(device string, snapLen int32, port uint16, workerNum int, out chan<- *message.Message, watcher *util.ConnectionWatcher) *Probe

NewProbe create a probe to collect and parse packets

func (*Probe) Init

func (p *Probe) Init() error

Init is the preprocess before the probe starts

func (*Probe) IsRequest

func (p *Probe) IsRequest(dstIP string, dstPort uint16) bool

IsRequest distinguish if is a inbound request

func (*Probe) Run

func (p *Probe) Run()

Run starts the probe after inited

func (*Probe) String

func (p *Probe) String() string

type Worker

type Worker struct {
	// contains filtered or unexported fields
}

Worker assembles the data from tcp connection dispatched by Probe

func NewProbeWorker

func NewProbeWorker(probe *Probe, id int) *Worker

NewProbeWorker create a new woker to assemble tcp packets

func (*Worker) Run

func (w *Worker) Run()

Run initilizes and starts the assembly