|
|
|
@ -21,14 +21,6 @@ const (
|
|
|
|
|
TCPSynAck = TCPSyn | TCPAck
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
var (
|
|
|
|
|
get16 = binary.BigEndian.Uint16
|
|
|
|
|
get32 = binary.BigEndian.Uint32
|
|
|
|
|
|
|
|
|
|
put16 = binary.BigEndian.PutUint16
|
|
|
|
|
put32 = binary.BigEndian.PutUint32
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
// Parsed is a minimal decoding of a packet suitable for use in filters.
|
|
|
|
|
//
|
|
|
|
|
// In general, it only supports IPv4. The IPv6 parsing is very minimal.
|
|
|
|
@ -114,7 +106,7 @@ func ipChecksum(b []byte) uint16 {
|
|
|
|
|
i := 0
|
|
|
|
|
n := len(b)
|
|
|
|
|
for n >= 2 {
|
|
|
|
|
ac += uint32(get16(b[i : i+2]))
|
|
|
|
|
ac += uint32(binary.BigEndian.Uint16(b[i : i+2]))
|
|
|
|
|
n -= 2
|
|
|
|
|
i += 2
|
|
|
|
|
}
|
|
|
|
@ -161,7 +153,7 @@ func (q *Parsed) decode4(b []byte) {
|
|
|
|
|
|
|
|
|
|
// Check that it's IPv4.
|
|
|
|
|
q.IPProto = IPProto(b[9])
|
|
|
|
|
q.length = int(get16(b[2:4]))
|
|
|
|
|
q.length = int(binary.BigEndian.Uint16(b[2:4]))
|
|
|
|
|
if len(b) < q.length {
|
|
|
|
|
// Packet was cut off before full IPv4 length.
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
@ -169,8 +161,8 @@ func (q *Parsed) decode4(b []byte) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// If it's valid IPv4, then the IP addresses are valid
|
|
|
|
|
q.SrcIP4 = IP4(get32(b[12:16]))
|
|
|
|
|
q.DstIP4 = IP4(get32(b[16:20]))
|
|
|
|
|
q.SrcIP4 = IP4(binary.BigEndian.Uint32(b[12:16]))
|
|
|
|
|
q.DstIP4 = IP4(binary.BigEndian.Uint32(b[16:20]))
|
|
|
|
|
|
|
|
|
|
q.subofs = int((b[0] & 0x0F) << 2)
|
|
|
|
|
sub := b[q.subofs:]
|
|
|
|
@ -187,7 +179,7 @@ func (q *Parsed) decode4(b []byte) {
|
|
|
|
|
// zero reason to send such a short first fragment, so we can treat
|
|
|
|
|
// it as Unknown. We can also treat any subsequent fragment that starts
|
|
|
|
|
// at such a low offset as Unknown.
|
|
|
|
|
fragFlags := get16(b[6:8])
|
|
|
|
|
fragFlags := binary.BigEndian.Uint16(b[6:8])
|
|
|
|
|
moreFrags := (fragFlags & 0x20) != 0
|
|
|
|
|
fragOfs := fragFlags & 0x1FFF
|
|
|
|
|
if fragOfs == 0 {
|
|
|
|
@ -215,8 +207,8 @@ func (q *Parsed) decode4(b []byte) {
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
q.SrcPort = get16(sub[0:2])
|
|
|
|
|
q.DstPort = get16(sub[2:4])
|
|
|
|
|
q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
|
|
|
|
|
q.DstPort = binary.BigEndian.Uint16(sub[2:4])
|
|
|
|
|
q.TCPFlags = sub[13] & 0x3F
|
|
|
|
|
headerLength := (sub[12] & 0xF0) >> 2
|
|
|
|
|
q.dataofs = q.subofs + int(headerLength)
|
|
|
|
@ -226,8 +218,8 @@ func (q *Parsed) decode4(b []byte) {
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
q.SrcPort = get16(sub[0:2])
|
|
|
|
|
q.DstPort = get16(sub[2:4])
|
|
|
|
|
q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
|
|
|
|
|
q.DstPort = binary.BigEndian.Uint16(sub[2:4])
|
|
|
|
|
q.dataofs = q.subofs + udpHeaderLength
|
|
|
|
|
return
|
|
|
|
|
default:
|
|
|
|
@ -261,7 +253,7 @@ func (q *Parsed) decode6(b []byte) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
q.IPProto = IPProto(b[6])
|
|
|
|
|
q.length = int(get16(b[4:6])) + ip6HeaderLength
|
|
|
|
|
q.length = int(binary.BigEndian.Uint16(b[4:6])) + ip6HeaderLength
|
|
|
|
|
if len(b) < q.length {
|
|
|
|
|
// Packet was cut off before the full IPv6 length.
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
@ -300,8 +292,8 @@ func (q *Parsed) decode6(b []byte) {
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
q.SrcPort = get16(sub[0:2])
|
|
|
|
|
q.DstPort = get16(sub[2:4])
|
|
|
|
|
q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
|
|
|
|
|
q.DstPort = binary.BigEndian.Uint16(sub[2:4])
|
|
|
|
|
q.TCPFlags = sub[13] & 0x3F
|
|
|
|
|
headerLength := (sub[12] & 0xF0) >> 2
|
|
|
|
|
q.dataofs = q.subofs + int(headerLength)
|
|
|
|
@ -311,8 +303,8 @@ func (q *Parsed) decode6(b []byte) {
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
q.SrcPort = get16(sub[0:2])
|
|
|
|
|
q.DstPort = get16(sub[2:4])
|
|
|
|
|
q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
|
|
|
|
|
q.DstPort = binary.BigEndian.Uint16(sub[2:4])
|
|
|
|
|
q.dataofs = q.subofs + udpHeaderLength
|
|
|
|
|
default:
|
|
|
|
|
q.IPProto = Unknown
|
|
|
|
@ -324,7 +316,7 @@ func (q *Parsed) IP4Header() IP4Header {
|
|
|
|
|
if q.IPVersion != 4 {
|
|
|
|
|
panic("IP4Header called on non-IPv4 Parsed")
|
|
|
|
|
}
|
|
|
|
|
ipid := get16(q.b[4:6])
|
|
|
|
|
ipid := binary.BigEndian.Uint16(q.b[4:6])
|
|
|
|
|
return IP4Header{
|
|
|
|
|
IPID: ipid,
|
|
|
|
|
IPProto: q.IPProto,
|
|
|
|
|