Get rid of LinkType-style branching: different LinkTypes may use the same Protocol modules.

protocol/arp/arp.go

@@ -0,0 +1,152 @@
+package arp
+
+import (
+	"fmt"
+	"git.darknebu.la/maride/pancap/common"
+	"git.darknebu.la/maride/pancap/output"
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"log"
+	"net"
+)
+
+var (
+	arpStatsList []arpStats
+	devices []arpDevice
+)
+
+type Protocol struct {}
+
+// Checks if the given packet is an ARP packet we can process
+func (p *Protocol) CanAnalyze(packet gopacket.Packet) bool {
+	return packet.Layer(layers.LayerTypeARP) != nil
+}
+
+// Analyzes the given ARP packet
+func (p *Protocol) Analyze(packet gopacket.Packet) error {
+	var arppacket layers.ARP
+
+	// Decode raw packet into ARP
+	decodeErr := arppacket.DecodeFromBytes(packet.Layer(layers.LayerTypeARP).LayerContents(), gopacket.NilDecodeFeedback)
+	if decodeErr != nil {
+		// Encountered an error during decoding, most likely a broken packet
+		return decodeErr
+	}
+
+	// Convert MAC address byte array to string
+	sourceAddr := net.HardwareAddr(arppacket.SourceHwAddress).String()
+	participant := p.getStatOrCreate(sourceAddr)
+
+	// Raise stats
+	if arppacket.Operation == layers.ARPRequest {
+		// Request packet
+		participant.asked++
+		participant.askedList = common.AppendIfUnique(net.IP(arppacket.DstProtAddress).String(), participant.askedList)
+
+		// Add device entry
+		p.addDeviceEntry(sourceAddr, net.IP(arppacket.SourceProtAddress).String())
+	} else {
+		// Response packet
+		participant.answered++
+		participant.answeredList = common.AppendIfUnique(net.IP(arppacket.SourceProtAddress).String(), participant.answeredList)
+
+		// Add device entry
+		p.addDeviceEntry(sourceAddr, net.IP(arppacket.SourceProtAddress).String())
+	}
+
+	return nil
+}
+
+// Print a summary after all packets are processed
+func (p *Protocol) PrintSummary() {
+	output.PrintBlock("ARP traffic summary", p.generateTrafficStats())
+	output.PrintBlock("ARP LAN overview", p.generateLANOverview())
+}
+
+// Generates an answer regarding the ARP traffic
+func (p *Protocol) generateTrafficStats() string {
+	var tmparr []string
+
+	// Iterate over all participants
+	for _, p := range arpStatsList {
+		// produce a meaningful output
+		if p.asked > 0 {
+			// device asked at least for one IP
+			if p.answered > 0 {
+				// and also answered requests
+				tmparr = append(tmparr, fmt.Sprintf("%s asked for %d addresses and answered %d requests", p.macaddr, p.asked, p.answered))
+			} else {
+				// only asked, never answered
+				tmparr = append(tmparr, fmt.Sprintf("%s asked for %d addresses", p.macaddr, p.asked))
+			}
+		} else {
+			// Answered, but never asked for any addresses
+			tmparr = append(tmparr, fmt.Sprintf("%s answered %d requests", p.macaddr, p.answered))
+		}
+	}
+
+	// And print it as a tree
+	return common.GenerateTree(tmparr)
+}
+
+// Generates an overview over all connected devices in the LAN
+func (p *Protocol) generateLANOverview() string {
+	var tmparr []string
+
+	// iterate over all devices
+	for _, d := range devices {
+		tmparr = append(tmparr, fmt.Sprintf("%s got address %s", d.macaddr, d.ipaddr))
+	}
+
+	// And print it as a tree
+	return common.GenerateTree(tmparr)
+}
+
+// Returns the arpStats object for the given MAC address, or creates a new one
+func (p *Protocol) getStatOrCreate(macaddr string) *arpStats {
+	// Try to find the given macaddr
+	for i := 0; i < len(arpStatsList); i++ {
+		if arpStatsList[i].macaddr == macaddr {
+			// Found, return it
+			return &arpStatsList[i]
+		}
+	}
+
+	// None found yet, we need to create a new one
+	arpStatsList = append(arpStatsList, arpStats{
+		macaddr:  macaddr,
+	})
+
+	// And return it
+	return &arpStatsList[len(arpStatsList)-1]
+}
+
+// Adds a new entry to the devices array, checking if there may be a collision (=ARP Spoofing)
+func (p *Protocol) addDeviceEntry(macaddr string, ipaddr string) {
+	if ipaddr == "0.0.0.0" {
+		// Possible ARP request if sender doesn't have an IP address yet. Ignore.
+		return
+	}
+
+	for i := 0; i < len(devices); i++ {
+		// check if we found a collision (possible ARP spoofing)
+		if (devices[i].macaddr == macaddr) != (devices[i].ipaddr == ipaddr) {
+			// this operation is practically XOR (which golang doesn't provide e.g. with ^)
+			log.Printf("Found possible ARP spoofing! Old: (MAC=%s, IP=%s), New: (MAC=%s, IP=%s). Overriding...", devices[i].macaddr, devices[i].ipaddr, macaddr, ipaddr)
+			devices[i].macaddr = macaddr
+			devices[i].ipaddr = ipaddr
+			return
+		}
+
+		if devices[i].macaddr == macaddr && devices[i].ipaddr == ipaddr {
+			// Found collision, but no ARP spoofing (both values are identical)
+			return
+		}
+	}
+
+	// No device found, add a new entry
+	devices = append(devices, arpDevice{
+		macaddr: macaddr,
+		ipaddr:  ipaddr,
+	})
+}

protocol/arp/arpDevice.go

@@ -0,0 +1,6 @@
+package arp
+
+type arpDevice struct {
+	macaddr string
+	ipaddr string
+}

protocol/arp/arpStats.go

@@ -0,0 +1,9 @@
+package arp
+
+type arpStats struct {
+	macaddr string
+	asked int
+	answered int
+	askedList []string
+	answeredList []string
+}