-
Notifications
You must be signed in to change notification settings - Fork 160
/
icmpv6.go
128 lines (104 loc) · 3.38 KB
/
icmpv6.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
/*
* NETCAP - Traffic Analysis Framework
* Copyright (c) 2017-2020 Philipp Mieden <dreadl0ck [at] protonicmp [dot] ch>
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
package maltego
import (
"errors"
"fmt"
"io"
"log"
"os"
"path/filepath"
"strings"
"github.com/gogo/protobuf/proto"
"github.com/dreadl0ck/maltego"
"github.com/dreadl0ck/netcap/defaults"
"github.com/dreadl0ck/netcap/types"
)
// ICMPv6CountFunc is a function that counts something over multiple ICMPv6 audit records.
//goland:noinspection GoUnnecessarilyExportedIdentifiers
type ICMPv6CountFunc func()
// ICMPv6TransformationFunc is a transformation over ICMPv6 audit records.
//goland:noinspection GoUnnecessarilyExportedIdentifiers
type ICMPv6TransformationFunc = func(lt maltego.LocalTransform, trx *maltego.Transform, icmp *types.ICMPv6, min, max uint64, path string, ip string)
// ICMPv6Transform applies a maltego transformation over ICMPv6 audit records.
func ICMPv6Transform(count ICMPv6CountFunc, transform ICMPv6TransformationFunc) {
var (
lt = maltego.ParseLocalArguments(os.Args[3:])
path = lt.Values["path"]
ipaddr = lt.Values[PropertyIpAddr]
dir = filepath.Dir(path)
icmpAuditRecords = filepath.Join(dir, "ICMPv6.ncap.gz")
trx = maltego.Transform{}
)
f, path := openFile(icmpAuditRecords)
// check if its an audit record file
if !strings.HasSuffix(f.Name(), defaults.FileExtensionCompressed) && !strings.HasSuffix(f.Name(), defaults.FileExtension) {
maltego.Die(errUnexpectedFileType, f.Name())
}
r := openNetcapArchive(path)
// read netcap header
header, errFileHeader := r.ReadHeader()
if errFileHeader != nil {
maltego.Die("failed to read file header", errFileHeader.Error())
}
if header.Type != types.Type_NC_ICMPv6 {
maltego.Die("file does not contain ICMPv6 records", header.Type.String())
}
var (
icmp = new(types.ICMPv6)
pm proto.Message
ok bool
)
pm = icmp
if _, ok = pm.(types.AuditRecord); !ok {
panic("type does not implement types.AuditRecord interface")
}
var (
min uint64 = 10000000
max uint64 = 0
err error
)
if count != nil {
for {
err = r.Next(icmp)
if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
break
} else if err != nil {
maltego.Die(err.Error(), errUnexpectedReadFailure)
}
count()
}
err = r.Close()
if err != nil {
log.Println("failed to close audit record file: ", err)
}
}
r = openNetcapArchive(path)
// read netcap header - ignore err as it has been checked before
_, _ = r.ReadHeader()
for {
err = r.Next(icmp)
if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
break
} else if err != nil {
panic(err)
}
transform(lt, &trx, icmp, min, max, path, ipaddr)
}
err = r.Close()
if err != nil {
log.Println("failed to close audit record file: ", err)
}
trx.AddUIMessage("completed!", maltego.UIMessageInform)
fmt.Println(trx.ReturnOutput())
}