initial commit

satta · Aug 20, 2019 · ee3b048 · ee3b048
commit ee3b048
Show file tree

Hide file tree

Showing 9 changed files with 556 additions and 0 deletions.
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+Copyright 2019 Sascha Steinbiss <[email protected]>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation files
+(the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of the Software,
+and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/cmd/gid.go b/cmd/gid.go
@@ -0,0 +1,92 @@
+package main
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/satta/gommunityid"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"github.com/google/gopacket/pcap"
+)
+
+func tupleLessThan(addr1, addr2 []byte, port1, port2 uint16) bool {
+	return bytes.Compare(addr1, addr2) == -1 || (bytes.Equal(addr1, addr2) && port1 < port2)
+}
+
+func main() {
+	cid := gommunityid.CommunityIDv1{
+		Seed: 0,
+	}
+	if handle, err := pcap.OpenOffline(os.Args[1]); err != nil {
+		panic(err)
+	} else {
+		packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
+		for packet := range packetSource.Packets() {
+			var netLayer gopacket.NetworkLayer
+			if netLayer = packet.NetworkLayer(); netLayer == nil {
+				continue
+			}
+			var proto uint8
+			switch netLayer.LayerType() {
+			case layers.LayerTypeIPv4:
+				proto = uint8(netLayer.(*layers.IPv4).Protocol)
+			case layers.LayerTypeIPv6:
+				proto = uint8(netLayer.(*layers.IPv6).NextLayerType())
+			case layers.LayerTypeICMPv4:
+				proto = 1
+			case layers.LayerTypeICMPv6:
+				proto = 58
+			}
+			src, dst := netLayer.NetworkFlow().Endpoints()
+
+			ft := gommunityid.FlowTuple{
+				Proto: proto,
+				Srcip: net.IP(src.Raw()),
+				Dstip: net.IP(dst.Raw()),
+			}
+
+			var transLayer gopacket.TransportLayer
+			var srcP, dstP uint16
+			if transLayer = packet.TransportLayer(); transLayer == nil {
+				if got, ok := packet.Layer(layers.LayerTypeICMPv6).(*layers.ICMPv6); ok {
+					var oneway bool
+					srcP, dstP, oneway = gommunityid.GetICMPv6PortEquivalents(got.TypeCode.Type(), got.TypeCode.Code())
+					ft.Srcport, ft.Dstport = srcP, dstP
+					if !oneway && !tupleLessThan(ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport) {
+						ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport = ft.Dstip, ft.Srcip, ft.Dstport, ft.Srcport
+					}
+
+				}
+				if got, ok := packet.Layer(layers.LayerTypeICMPv4).(*layers.ICMPv4); ok {
+					var oneway bool
+					srcP, dstP, oneway = gommunityid.GetICMPv4PortEquivalents(got.TypeCode.Type(), got.TypeCode.Code())
+					ft.Srcport, ft.Dstport = srcP, dstP
+					if !oneway && !tupleLessThan(ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport) {
+						ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport = ft.Dstip, ft.Srcip, ft.Dstport, ft.Srcport
+					}
+				}
+			} else {
+				_srcP, _dstP := transLayer.TransportFlow().Endpoints()
+				srcP, dstP = binary.BigEndian.Uint16(_srcP.Raw()), binary.BigEndian.Uint16(_dstP.Raw())
+				ft.Srcport, ft.Dstport = srcP, dstP
+				if !tupleLessThan(ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport) {
+					ft.Srcip, ft.Dstip, ft.Srcport, ft.Dstport = ft.Dstip, ft.Srcip, ft.Dstport, ft.Srcport
+				}
+			}
+
+			communityid := cid.CalcBase64(ft)
+			fmt.Printf("%d%s | %s | %s %s %d %d %d\n",
+				packet.Metadata().Timestamp.Unix(),
+				packet.Metadata().Timestamp.Format(".000000"),
+				communityid,
+				src, dst,
+				proto,
+				srcP, dstP)
+		}
+	}
+}
diff --git a/communityid.go b/communityid.go
@@ -0,0 +1,15 @@
+package gommunityid
+
+import (
+	"hash"
+)
+
+type CommunityID interface {
+	Calc(FlowTuple) []byte
+	CalcHex(FlowTuple) string
+	CalcBase64(FlowTuple) string
+	Hash(FlowTuple) hash.Hash
+	Render(hash.Hash) []byte
+	RenderHex(hash.Hash) string
+	RenderBase64(hash.Hash) string
+}
diff --git a/communityid_v1.go b/communityid_v1.go
@@ -0,0 +1,59 @@
+package gommunityid
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"hash"
+)
+
+type CommunityIDv1 struct {
+	Seed uint16
+}
+
+func (cid CommunityIDv1) Calc(ft FlowTuple) []byte {
+	ft = ft.InOrder()
+	return cid.Render(cid.Hash(ft))
+}
+
+func (cid CommunityIDv1) CalcHex(ft FlowTuple) string {
+	ft = ft.InOrder()
+	return cid.RenderHex(cid.Hash(ft))
+}
+
+func (cid CommunityIDv1) CalcBase64(ft FlowTuple) string {
+	ft = ft.InOrder()
+	return cid.RenderBase64(cid.Hash(ft))
+}
+
+func (cid CommunityIDv1) Hash(ft FlowTuple) hash.Hash {
+	h := sha1.New()
+	binary.Write(h, binary.BigEndian, cid.Seed)
+	if ft.Srcip.To4() != nil {
+		binary.Write(h, binary.BigEndian, ft.Srcip.To4())
+	} else if ft.Srcip.To16() != nil {
+		binary.Write(h, binary.BigEndian, ft.Srcip.To16())
+	}
+	if ft.Dstip.To4() != nil {
+		binary.Write(h, binary.BigEndian, ft.Dstip.To4())
+	} else if ft.Dstip.To16() != nil {
+		binary.Write(h, binary.BigEndian, ft.Dstip.To16())
+	}
+	h.Write([]byte{ft.Proto, 0})
+	binary.Write(h, binary.BigEndian, ft.Srcport)
+	binary.Write(h, binary.BigEndian, ft.Dstport)
+	return h
+}
+
+func (cid CommunityIDv1) Render(h hash.Hash) []byte {
+	return h.Sum(nil)
+}
+
+func (cid CommunityIDv1) RenderBase64(h hash.Hash) string {
+	return "1:" + base64.StdEncoding.EncodeToString(cid.Render(h))
+}
+
+func (cid CommunityIDv1) RenderHex(h hash.Hash) string {
+	return fmt.Sprintf("1:%x", cid.Render(h))
+}
diff --git a/communityid_v1_test.go b/communityid_v1_test.go
@@ -0,0 +1,200 @@
+package gommunityid
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type testSet struct {
+	Srcip       net.IP
+	Dstip       net.IP
+	Srcport     uint16
+	Dstport     uint16
+	Base64Seed0 string
+	HexSeed0    string
+	Base64Seed1 string
+}
+
+type makeFunc func(net.IP, net.IP, uint16, uint16) FlowTuple
+
+func verifyTuples(t *testing.T, ts []testSet, mf makeFunc) {
+	cid0 := CommunityIDv1{
+		Seed: 0,
+	}
+	cid1 := CommunityIDv1{
+		Seed: 1,
+	}
+	for _, tset := range ts {
+		ft := mf(tset.Srcip, tset.Dstip, tset.Srcport, tset.Dstport)
+		assert.Equal(t, tset.Base64Seed0, cid0.CalcBase64(ft))
+		assert.Equal(t, tset.HexSeed0, cid0.CalcHex(ft))
+		assert.Equal(t, tset.Base64Seed1, cid1.CalcBase64(ft))
+	}
+}
+
+func TestCommunityIDv1ICMP(t *testing.T) {
+	verifyTuples(t, []testSet{
+		testSet{
+			Srcip:       net.IPv4(192, 168, 0, 89),
+			Dstip:       net.IPv4(192, 168, 0, 1),
+			Srcport:     8,
+			Dstport:     0,
+			Base64Seed0: "1:X0snYXpgwiv9TZtqg64sgzUn6Dk=",
+			HexSeed0:    "1:5f4b27617a60c22bfd4d9b6a83ae2c833527e839",
+			Base64Seed1: "1:03g6IloqVBdcZlPyX8r0hgoE7kA=",
+		},
+		testSet{
+			Srcip:       net.IPv4(192, 168, 0, 1),
+			Dstip:       net.IPv4(192, 168, 0, 89),
+			Srcport:     0,
+			Dstport:     8,
+			Base64Seed0: "1:X0snYXpgwiv9TZtqg64sgzUn6Dk=",
+			HexSeed0:    "1:5f4b27617a60c22bfd4d9b6a83ae2c833527e839",
+			Base64Seed1: "1:03g6IloqVBdcZlPyX8r0hgoE7kA=",
+		},
+		testSet{
+			Srcip:       net.IPv4(192, 168, 0, 89),
+			Dstip:       net.IPv4(192, 168, 0, 1),
+			Srcport:     20,
+			Dstport:     0,
+			Base64Seed0: "1:3o2RFccXzUgjl7zDpqmY7yJi8rI=",
+			HexSeed0:    "1:de8d9115c717cd482397bcc3a6a998ef2262f2b2",
+			Base64Seed1: "1:lCXHHxavE1Vq3oX9NH5ladQg02o=",
+		},
+		testSet{
+			Srcip:       net.IPv4(192, 168, 0, 89),
+			Dstip:       net.IPv4(192, 168, 0, 1),
+			Srcport:     20,
+			Dstport:     1,
+			Base64Seed0: "1:tz/fHIDUHs19NkixVVoOZywde+I=",
+			HexSeed0:    "1:b73fdf1c80d41ecd7d3648b1555a0e672c1d7be2",
+			Base64Seed1: "1:Ie3wmFyxiEyikbsbcO03d2nh+PM=",
+		},
+		testSet{
+			Srcip:       net.IPv4(192, 168, 0, 1),
+			Dstip:       net.IPv4(192, 168, 0, 89),
+			Srcport:     0,
+			Dstport:     20,
+			Base64Seed0: "1:X0snYXpgwiv9TZtqg64sgzUn6Dk=",
+			HexSeed0:    "1:5f4b27617a60c22bfd4d9b6a83ae2c833527e839",
+			Base64Seed1: "1:03g6IloqVBdcZlPyX8r0hgoE7kA=",
+		},
+	},
+		MakeFlowTupleICMP)
+}
+
+func TestCommunityIDv1ICMP6(t *testing.T) {
+	verifyTuples(t, []testSet{
+		testSet{
+			Srcip:       net.ParseIP("fe80::200:86ff:fe05:80da"),
+			Dstip:       net.ParseIP("fe80::260:97ff:fe07:69ea"),
+			Srcport:     135,
+			Dstport:     0,
+			Base64Seed0: "1:dGHyGvjMfljg6Bppwm3bg0LO8TY=",
+			HexSeed0:    "1:7461f21af8cc7e58e0e81a69c26ddb8342cef136",
+			Base64Seed1: "1:kHa1FhMYIT6Ym2Vm2AOtoOARDzY=",
+		},
+		testSet{
+			Srcip:       net.ParseIP("fe80::260:97ff:fe07:69ea"),
+			Dstip:       net.ParseIP("fe80::200:86ff:fe05:80da"),
+			Srcport:     136,
+			Dstport:     0,
+			Base64Seed0: "1:dGHyGvjMfljg6Bppwm3bg0LO8TY=",
+			HexSeed0:    "1:7461f21af8cc7e58e0e81a69c26ddb8342cef136",
+			Base64Seed1: "1:kHa1FhMYIT6Ym2Vm2AOtoOARDzY=",
+		},
+		testSet{
+			Srcip:       net.ParseIP("3ffe:507:0:1:260:97ff:fe07:69ea"),
+			Dstip:       net.ParseIP("3ffe:507:0:1:200:86ff:fe05:80da"),
+			Srcport:     3,
+			Dstport:     0,
+			Base64Seed0: "1:NdobDX8PQNJbAyfkWxhtL2Pqp5w=",
+			HexSeed0:    "1:35da1b0d7f0f40d25b0327e45b186d2f63eaa79c",
+			Base64Seed1: "1:OlOWx9psIbBFi7lOCw/4MhlKR9M=",
+		},
+		testSet{
+			Srcip:       net.ParseIP("3ffe:507:0:1:200:86ff:fe05:80da"),
+			Dstip:       net.ParseIP("3ffe:507:0:1:260:97ff:fe07:69ea"),
+			Srcport:     3,
+			Dstport:     0,
+			Base64Seed0: "1:/OGBt9BN1ofenrmSPWYicpij2Vc=",
+			HexSeed0:    "1:fce181b7d04dd687de9eb9923d66227298a3d957",
+			Base64Seed1: "1:Ij4ZxnC87/MXzhOjvH2vHu7LRmE=",
+		},
+	},
+		MakeFlowTupleICMP6)
+}
+
+func TestCommunityIDv1SCTP(t *testing.T) {
+	verifyTuples(t, []testSet{
+		testSet{
+			Srcip:       net.IPv4(192, 168, 170, 8),
+			Dstip:       net.IPv4(192, 168, 170, 56),
+			Srcport:     7,
+			Dstport:     80,
+			Base64Seed0: "1:jQgCxbku+pNGw8WPbEc/TS/uTpQ=",
+			HexSeed0:    "1:8d0802c5b92efa9346c3c58f6c473f4d2fee4e94",
+			Base64Seed1: "1:Y1/0jQg6e+I3ZwZZ9LP65DNbTXU=",
+		},
+		testSet{
+			Srcip:       net.IPv4(192, 168, 170, 56),
+			Dstip:       net.IPv4(192, 168, 170, 8),
+			Srcport:     80,
+			Dstport:     7,
+			Base64Seed0: "1:jQgCxbku+pNGw8WPbEc/TS/uTpQ=",
+			HexSeed0:    "1:8d0802c5b92efa9346c3c58f6c473f4d2fee4e94",
+			Base64Seed1: "1:Y1/0jQg6e+I3ZwZZ9LP65DNbTXU=",
+		},
+	},
+		MakeFlowTupleSCTP)
+}
+
+func TestCommunityIDv1TCP(t *testing.T) {
+	verifyTuples(t, []testSet{
+		testSet{
+			Srcip:       net.IPv4(128, 232, 110, 120),
+			Dstip:       net.IPv4(66, 35, 250, 204),
+			Srcport:     34855,
+			Dstport:     80,
+			Base64Seed0: "1:LQU9qZlK+B5F3KDmev6m5PMibrg=",
+			HexSeed0:    "1:2d053da9994af81e45dca0e67afea6e4f3226eb8",
+			Base64Seed1: "1:3V71V58M3Ksw/yuFALMcW0LAHvc=",
+		},
+		testSet{
+			Srcip:       net.IPv4(66, 35, 250, 204),
+			Dstip:       net.IPv4(128, 232, 110, 120),
+			Srcport:     80,
+			Dstport:     34855,
+			Base64Seed0: "1:LQU9qZlK+B5F3KDmev6m5PMibrg=",
+			HexSeed0:    "1:2d053da9994af81e45dca0e67afea6e4f3226eb8",
+			Base64Seed1: "1:3V71V58M3Ksw/yuFALMcW0LAHvc=",
+		},
+	},
+		MakeFlowTupleTCP)
+}
+
+func TestCommunityIDv1UDP(t *testing.T) {
+	verifyTuples(t, []testSet{
+		testSet{
+			Srcip:       net.IPv4(192, 168, 1, 52),
+			Dstip:       net.IPv4(8, 8, 8, 8),
+			Srcport:     54585,
+			Dstport:     53,
+			Base64Seed0: "1:d/FP5EW3wiY1vCndhwleRRKHowQ=",
+			HexSeed0:    "1:77f14fe445b7c22635bc29dd87095e451287a304",
+			Base64Seed1: "1:Q9We8WO3piVF8yEQBNJF4uiSVrI=",
+		},
+		testSet{
+			Srcip:       net.IPv4(8, 8, 8, 8),
+			Dstip:       net.IPv4(192, 168, 1, 52),
+			Srcport:     53,
+			Dstport:     54585,
+			Base64Seed0: "1:d/FP5EW3wiY1vCndhwleRRKHowQ=",
+			HexSeed0:    "1:77f14fe445b7c22635bc29dd87095e451287a304",
+			Base64Seed1: "1:Q9We8WO3piVF8yEQBNJF4uiSVrI=",
+		},
+	},
+		MakeFlowTupleUDP)
+}