forked from elastic/beats
-
Notifications
You must be signed in to change notification settings - Fork 0
/
tuples.go
105 lines (85 loc) · 2.68 KB
/
tuples.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
package main
import (
"fmt"
"net"
)
// In order for the IpPortTuple and the TcpTuple to be used as
// hashtable keys, they need to have a fixed size. This means the
// net.IP is problematic because it's internally represented as a slice.
// We're introducing the HashableIpPortTuple and the HashableTcpTuple
// types which are internally simple byte arrays.
const MaxIpPortTupleRawSize = 16 + 16 + 2 + 2
type HashableIpPortTuple [MaxIpPortTupleRawSize]byte
type IpPortTuple struct {
ip_length int
Src_ip, Dst_ip net.IP
Src_port, Dst_port uint16
raw HashableIpPortTuple // Src_ip:Src_port:Dst_ip:Dst_port
revRaw HashableIpPortTuple // Dst_ip:Dst_port:Src_ip:Src_port
}
func NewIpPortTuple(ip_length int, src_ip net.IP, src_port uint16,
dst_ip net.IP, dst_port uint16) IpPortTuple {
tuple := IpPortTuple{
ip_length: ip_length,
Src_ip: src_ip,
Dst_ip: dst_ip,
Src_port: src_port,
Dst_port: dst_port,
}
tuple.ComputeHashebles()
return tuple
}
func (t *IpPortTuple) ComputeHashebles() {
copy(t.raw[0:16], t.Src_ip)
copy(t.raw[16:18], []byte{byte(t.Src_port >> 8), byte(t.Src_port)})
copy(t.raw[18:34], t.Dst_ip)
copy(t.raw[34:36], []byte{byte(t.Dst_port >> 8), byte(t.Dst_port)})
copy(t.revRaw[0:16], t.Dst_ip)
copy(t.revRaw[16:18], []byte{byte(t.Dst_port >> 8), byte(t.Dst_port)})
copy(t.revRaw[18:34], t.Src_ip)
copy(t.revRaw[34:36], []byte{byte(t.Src_port >> 8), byte(t.Src_port)})
}
func (t *IpPortTuple) String() string {
return fmt.Sprintf("IpPortTuple src[%s:%d] dst[%s:%d]",
t.Src_ip.String(),
t.Src_port,
t.Dst_ip.String(),
t.Dst_port)
}
const MaxTcpTupleRawSize = 16 + 16 + 2 + 2 + 4
type HashableTcpTuple [MaxTcpTupleRawSize]byte
type TcpTuple struct {
ip_length int
Src_ip, Dst_ip net.IP
Src_port, Dst_port uint16
stream_id uint32
raw HashableTcpTuple // Src_ip:Src_port:Dst_ip:Dst_port:stream_id
}
func TcpTupleFromIpPort(t *IpPortTuple, tcp_id uint32) TcpTuple {
tuple := TcpTuple{
ip_length: t.ip_length,
Src_ip: t.Src_ip,
Dst_ip: t.Dst_ip,
Src_port: t.Src_port,
Dst_port: t.Dst_port,
stream_id: tcp_id,
}
tuple.ComputeHashebles()
return tuple
}
func (t *TcpTuple) ComputeHashebles() {
copy(t.raw[0:16], t.Src_ip)
copy(t.raw[16:18], []byte{byte(t.Src_port >> 8), byte(t.Src_port)})
copy(t.raw[18:34], t.Dst_ip)
copy(t.raw[34:36], []byte{byte(t.Dst_port >> 8), byte(t.Dst_port)})
copy(t.raw[36:40], []byte{byte(t.stream_id >> 24), byte(t.stream_id >> 16),
byte(t.stream_id >> 8), byte(t.stream_id)})
}
func (t TcpTuple) String() string {
return fmt.Sprintf("TcpTuple src[%s:%d] dst[%s:%d] stream_id[%d]",
t.Src_ip.String(),
t.Src_port,
t.Dst_ip.String(),
t.Dst_port,
t.stream_id)
}