Get rid of LinkType-style branching: different LinkTypes may use the same Protocol modules.

protocol/dns/answer.go

@@ -0,0 +1,92 @@
+package dns
+
+import (
+	"fmt"
+	"git.darknebu.la/maride/pancap/common"
+	"github.com/google/gopacket/layers"
+	"golang.org/x/net/publicsuffix"
+	"log"
+)
+
+var (
+	numAnswers int
+	answerDomains []string
+	answerBaseDomains []string
+	answerPrivateDomains []string
+	answerType = make(map[layers.DNSType]int)
+	answerPublicIPv4 []string
+	answerPrivateIPv4 []string
+)
+
+// Called on every DNS packet to process response(s)
+func (p *Protocol) processDNSAnswer(answers []layers.DNSResourceRecord) {
+	for _, answer := range answers {
+		// Raise stats
+		numAnswers++
+
+		// Add answer to answers array
+		name := string(answer.Name)
+		basename, basenameErr := publicsuffix.EffectiveTLDPlusOne(name)
+
+		if basenameErr != nil {
+			// Encountered error while checking for the basename
+			log.Printf("Encountered error while checking '%s' domain for its basename: %s", name, basenameErr.Error())
+			continue
+		}
+
+		// Process type answers
+		p.processType(answerType, answer.Type)
+
+		// Append full domain and base domain
+		answerDomains = common.AppendIfUnique(name, answerDomains)
+
+		// Check if we need to add the base name to the private list
+		_, icannManaged := publicsuffix.PublicSuffix(name)
+		if icannManaged {
+			// TLD is managed by ICANN, add to the base list
+			answerBaseDomains = common.AppendIfUnique(basename, answerBaseDomains)
+		} else {
+			// it's not managed by ICANN, so it's private - add it to the private list
+			answerPrivateDomains = common.AppendIfUnique(name, answerPrivateDomains)
+		}
+
+		// Check if we got an A record answer
+		if answer.Type == layers.DNSTypeA {
+			// A record, check IP for being private
+			if ipIsPrivate(answer.IP) {
+				answerPrivateIPv4 = common.AppendIfUnique(answer.IP.String(), answerPrivateIPv4)
+			} else {
+				answerPublicIPv4 = common.AppendIfUnique(answer.IP.String(), answerPublicIPv4)
+			}
+		}
+	}
+}
+
+// Generates a summary of all DNS answers
+func (p *Protocol) generateDNSAnswerSummary() string {
+	summary := ""
+
+	// Overall question stats
+	summary = fmt.Sprintf("%s%d DNS answers in total\n", summary, numAnswers)
+	summary = fmt.Sprintf("%s%s records\n", summary, p.generateDNSTypeSummary(answerType))
+	summary = fmt.Sprintf("%s%d unique domains of %d base domains, of which are %d private (non-ICANN) TLDs.\n", summary, len(answerDomains), len(answerBaseDomains), len(answerPrivateDomains))
+
+	// Output base domains answered with
+	if len(answerBaseDomains) > 0 {
+		summary = fmt.Sprintf("Answered with these base domains:\n%s", common.GenerateTree(answerBaseDomains))
+	}
+
+	// Output private domains
+	if len(answerPrivateDomains) > 0 {
+		summary = fmt.Sprintf("%sAnswered with these private (non-ICANN managed) domains:\n%s", summary, common.GenerateTree(answerPrivateDomains))
+	}
+
+	// Check for public and private IPs
+	summary = fmt.Sprintf("%sAnswered with %d public IP addresses and %d private IP addresses\n", summary, len(answerPublicIPv4), len(answerPrivateIPv4))
+	if len(answerPrivateIPv4) > 0 {
+		summary = fmt.Sprintf("%sPrivate IP addresses in answer:\n%s", summary, common.GenerateTree(answerPrivateIPv4))
+	}
+
+	// Return summary
+	return summary
+}

protocol/dns/common.go

@@ -0,0 +1,71 @@
+package dns
+
+import (
+	"fmt"
+	"github.com/google/gopacket/layers"
+	"net"
+)
+
+var (
+	privateBlocks = []net.IPNet{
+		{net.IPv4(10, 0, 0, 0), net.IPv4Mask(255, 0, 0, 0)}, 	  // 10.0.0.0/8
+		{net.IPv4(172, 16, 0, 0), net.IPv4Mask(255, 240, 0, 0)},  // 172.16.0.0/12
+		{net.IPv4(192, 168, 0, 0), net.IPv4Mask(255, 255, 0, 0)}, // 192.168.0.0/24
+		{net.IPv4(100, 64, 0, 0), net.IPv4Mask(255, 192, 0, 0)},  // 100.64.0.0/10
+		{net.IPv4(169, 254, 0, 0), net.IPv4Mask(255, 255, 0, 0)}, // 169.254.0.0/16
+	}
+)
+
+// Processes the given dnstype and raises its stats in the given array
+func (p *Protocol) processType(typearr map[layers.DNSType]int, dnstype layers.DNSType) {
+	typearr[dnstype]++
+}
+
+// Checks if the given IP is in a private range or not
+func ipIsPrivate(ip net.IP) bool {
+	// check every private IP block for our IP
+	for _, block := range privateBlocks {
+		if block.Contains(ip) {
+			// found, is a private IP
+			return true
+		}
+	}
+
+	// Not in any of the private blocks, not private
+	return false
+}
+
+// Generates a summary string for DNS types in the given array
+func (p *Protocol) generateDNSTypeSummary(typearr map[layers.DNSType]int) string {
+	var answerarr []string
+
+	// Iterate over all possible DNS types
+	for iter, typeelem := range typearr {
+		// Read amount of type hits for this type
+		answerarr = append(answerarr, fmt.Sprintf("%d %s", typeelem, iter.String()))
+	}
+
+	// Check if we even processed a single type
+	if len(answerarr) == 0 {
+		// we didn't, strange.
+		return "(no types encountered)"
+	}
+
+	// now, glue all array elements together
+	answerstr := ""
+	for iter, elem := range answerarr {
+		// Check if we need to apply to proper sentence rules
+		if iter == 0 {
+			// We don't need to append yet
+			answerstr = elem
+		} else if iter == len(answerarr) - 1 {
+			// Last element, use "and" instead of a comma
+			answerstr = fmt.Sprintf("%s and %s", answerstr, elem)
+		} else {
+			// Some entry, just add it with a comma
+			answerstr = fmt.Sprintf("%s, %s", answerstr, elem)
+		}
+	}
+
+	return answerstr
+}

protocol/dns/dns.go

@@ -0,0 +1,38 @@
+package dns
+
+import (
+	"git.darknebu.la/maride/pancap/output"
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+type Protocol struct {}
+
+func (p *Protocol) CanAnalyze(packet gopacket.Packet) bool {
+	return packet.Layer(layers.LayerTypeDNS) != nil
+}
+
+// Analyzes the given DHCP packet
+func (p *Protocol) Analyze(packet gopacket.Packet) error {
+	var dnspacket layers.DNS
+
+	// Decode raw packet into DNS
+	decodeErr := dnspacket.DecodeFromBytes(packet.ApplicationLayer().LayerContents(), gopacket.NilDecodeFeedback)
+	if decodeErr != nil {
+		// Encountered an error during decoding, most likely a broken packet
+		return decodeErr
+	}
+
+	// Further process the packet
+	p.processDNSQuestion(dnspacket.Questions)
+	p.processDNSAnswer(dnspacket.Answers)
+
+	// No error encountered, return clean
+	return nil
+}
+
+// Print a summary after all DNS packets were processed
+func (p *Protocol) PrintSummary() {
+	output.PrintBlock("DNS Request Summary", p.generateDNSQuestionSummary())
+	output.PrintBlock("DNS Response Summary", p.generateDNSAnswerSummary())
+}

protocol/dns/question.go

@@ -0,0 +1,75 @@
+package dns
+
+import (
+	"fmt"
+	"git.darknebu.la/maride/pancap/common"
+	"github.com/google/gopacket/layers"
+	"golang.org/x/net/publicsuffix"
+	"log"
+)
+
+var (
+	numQuestions int
+	questionDomains []string
+	questionBaseDomains []string
+	questionPrivateDomains []string
+	questionType = make(map[layers.DNSType]int)
+)
+
+// Called on every DNS packet to process questions
+func (p *Protocol) processDNSQuestion(questions []layers.DNSQuestion) {
+	// Iterate over all questions
+	for _, question := range questions {
+		// Raise stats
+		numQuestions++
+
+		// Add question to questions array
+		name := string(question.Name)
+		basename, basenameErr := publicsuffix.EffectiveTLDPlusOne(name)
+
+		if basenameErr != nil {
+			// Encountered error while checking for the basename
+			log.Printf("Encountered error while checking '%s' domain for its basename: %s", name, basenameErr.Error())
+			continue
+		}
+
+		// Process type questions
+		p.processType(questionType, question.Type)
+
+		// Append full domain and base domain
+		questionDomains = common.AppendIfUnique(name, questionDomains)
+
+		// Check if we need to add the base name to the private list
+		_, icannManaged := publicsuffix.PublicSuffix(name)
+		if icannManaged {
+			// TLD is managed by ICANN, add to the base list
+			questionBaseDomains = common.AppendIfUnique(basename, questionBaseDomains)
+		} else {
+			// it's not managed by ICANN, so it's private - add it to the private list
+			questionPrivateDomains = common.AppendIfUnique(name, questionPrivateDomains)
+		}
+	}
+}
+
+// Generates a summary of all DNS questions
+func (p *Protocol) generateDNSQuestionSummary() string {
+	summary := ""
+
+	// Overall question stats
+	summary = fmt.Sprintf("%s%d DNS questions in total\n", summary, numQuestions)
+	summary = fmt.Sprintf("%s%s records\n", summary, p.generateDNSTypeSummary(questionType))
+	summary = fmt.Sprintf("%s%d unique domains of %d base domains, of which are %d private (non-ICANN) TLDs.\n", summary, len(questionDomains), len(questionBaseDomains), len(questionPrivateDomains))
+
+	// Output base domains asked for
+	if len(questionBaseDomains) > 0 {
+		summary = fmt.Sprintf("%sAsked for these base domains:\n%s", summary, common.GenerateTree(questionBaseDomains))
+	}
+
+	// Output private domains
+	if len(questionPrivateDomains) > 0 {
+		summary = fmt.Sprintf("%sAsked for these private (non-ICANN managed) domains:\n%s", summary, common.GenerateTree(questionPrivateDomains))
+	}
+
+	// And return summary
+	return summary
+}