net_packet_http.go

package derive

import (
	"bufio"
	"bytes"
	"net/http"

	"github.com/nextlinux/tracee/pkg/errfmt"
	"github.com/nextlinux/tracee/pkg/events"
	"github.com/nextlinux/tracee/types/trace"
)

const httpMinLen int = 7 // longest http command is "DELETE "

//
// NetPacketHTTP
//

func NetPacketHTTP() DeriveFunction {
	return deriveSingleEvent(events.NetPacketHTTP, deriveHTTP())
}

func deriveHTTP() deriveArgsFunction {
	return deriveHTTPEvents
}

func deriveHTTPEvents(event trace.Event) ([]interface{}, error) {
	net, h, err := eventToProtoHTTP(&event)
	if err != nil {
		return nil, errfmt.WrapError(err)
	}
	if h == nil {
		return nil, nil // connection related packets
	}
	if net == nil {
		return nil, parsePacketError()
	}

	return []interface{}{
		net.srcIP,
		net.dstIP,
		net.srcPort,
		net.dstPort,
		h,
	}, nil
}

//
// NetPacketHTTPRequest
//

func NetPacketHTTPRequest() DeriveFunction {
	return deriveSingleEvent(events.NetPacketHTTPRequest, deriveHTTPRequest())
}

func deriveHTTPRequest() deriveArgsFunction {
	return deriveHTTPRequestEvents
}

func deriveHTTPRequestEvents(event trace.Event) ([]interface{}, error) {
	net, h, err := eventToProtoHTTPRequest(&event)
	if err != nil {
		return nil, errfmt.WrapError(err)
	}
	if h == nil {
		return nil, nil // not a request
	}
	if net == nil {
		return nil, errfmt.WrapError(err)
	}

	meta := convertNetPairToPktMeta(net)

	return []interface{}{
		*meta,
		h,
	}, nil
}

//
// NetPacketHTTPResponse
//

func NetPacketHTTPResponse() DeriveFunction {
	return deriveSingleEvent(events.NetPacketHTTPResponse, deriveHTTPResponse())
}

func deriveHTTPResponse() deriveArgsFunction {
	return deriveHTTPResponseEvents
}

func deriveHTTPResponseEvents(event trace.Event) ([]interface{}, error) {
	net, h, err := eventToProtoHTTPResponse(&event)
	if err != nil {
		return nil, errfmt.WrapError(err)
	}
	if h == nil {
		return nil, nil // // not a response
	}
	if net == nil {
		return nil, errfmt.WrapError(err)
	}

	meta := convertNetPairToPktMeta(net)

	return []interface{}{
		*meta,
		h,
	}, nil
}

func eventToProtoHTTP(event *trace.Event) (*netPair, *trace.ProtoHTTP, error) {
	var httpNetPair netPair

	layer7, err := parseUntilLayer7(event, &httpNetPair)
	if err != nil {
		return nil, nil, errfmt.WrapError(err)
	}
	if layer7 == nil {
		return nil, nil, nil
	}
	layer7Payload := layer7.Payload()

	if len(layer7Payload) > httpMinLen {
		var httpReq *http.Request
		var httpRes *http.Response
		var protoHttp trace.ProtoHTTP

		reader := bufio.NewReader(bytes.NewReader(layer7Payload))

		// event retval encodes HTTP direction
		if event.ReturnValue&protoHttpRequest == protoHttpRequest {
			httpReq, err = http.ReadRequest(reader)
			if err != nil {
				return nil, nil, errfmt.WrapError(err)
			}

			copyHTTPReqToProtoHTTP(httpReq, &protoHttp)
		} else if event.ReturnValue&protoHttpResponse == protoHttpResponse {
			httpRes, err = http.ReadResponse(reader, nil)
			if err != nil {
				return nil, nil, errfmt.WrapError(err)
			}

			copyHTTPResToProtoHTTP(httpRes, &protoHttp)
		} else {
			return &httpNetPair, nil, errfmt.Errorf("unspecified direction for HTTP packet")
		}

		return &httpNetPair, &protoHttp, nil
	}

	return &httpNetPair, nil, notProtoPacketError("HTTP")
}

func eventToProtoHTTPRequest(event *trace.Event) (*netPair, *trace.ProtoHTTPRequest, error) {
	var httpNetPair netPair

	layer7, err := parseUntilLayer7(event, &httpNetPair)
	if err != nil {
		return nil, nil, errfmt.WrapError(err)
	}
	if layer7 == nil {
		return nil, nil, nil
	}
	layer7Payload := layer7.Payload()

	if len(layer7Payload) > httpMinLen {
		// event retval encodes HTTP direction
		if event.ReturnValue&protoHttpRequest != protoHttpRequest {
			return nil, nil, nil
		}

		reader := bufio.NewReader(bytes.NewReader(layer7Payload))

		httpReq, err := http.ReadRequest(reader)
		if err != nil {
			return nil, nil, errfmt.WrapError(err)
		}

		var httpRequest trace.ProtoHTTPRequest

		copyHTTPReqToProtoHTTPRequest(httpReq, &httpRequest)

		return &httpNetPair, &httpRequest, nil
	}

	return &httpNetPair, nil, notProtoPacketError("HTTP")
}

func eventToProtoHTTPResponse(event *trace.Event) (*netPair, *trace.ProtoHTTPResponse, error) {
	var httpNetPair netPair

	layer7, err := parseUntilLayer7(event, &httpNetPair)
	if err != nil {
		return nil, nil, errfmt.WrapError(err)
	}
	if layer7 == nil {
		return nil, nil, nil
	}
	layer7Payload := layer7.Payload()

	if len(layer7Payload) > httpMinLen {
		// event retval encodes HTTP direction
		if event.ReturnValue&protoHttpResponse != protoHttpResponse {
			return nil, nil, nil
		}

		reader := bufio.NewReader(bytes.NewReader(layer7Payload))

		httpRes, err := http.ReadResponse(reader, nil)
		if err != nil {
			return nil, nil, errfmt.WrapError(err)
		}

		var httpResponse trace.ProtoHTTPResponse

		copyHTTPResToProtoHTTPResponse(httpRes, &httpResponse)

		return &httpNetPair, &httpResponse, nil
	}

	return &httpNetPair, nil, notProtoPacketError("HTTP")
}

func copyHTTPReqToProtoHTTP(httpReq *http.Request, proto *trace.ProtoHTTP) {
	proto.Direction = "request"
	proto.Method = httpReq.Method
	proto.Protocol = httpReq.Proto
	proto.Host = httpReq.Host
	proto.URIPath = httpReq.URL.Path
	proto.Headers = httpReq.Header
	proto.ContentLength = httpReq.ContentLength
}

func copyHTTPResToProtoHTTP(httpRes *http.Response, proto *trace.ProtoHTTP) {
	proto.Direction = "response"
	proto.Status = httpRes.Status
	proto.StatusCode = httpRes.StatusCode
	proto.Protocol = httpRes.Proto
	proto.Headers = httpRes.Header
	proto.ContentLength = httpRes.ContentLength
}

func copyHTTPReqToProtoHTTPRequest(httpReq *http.Request, proto *trace.ProtoHTTPRequest) {
	proto.Method = httpReq.Method
	proto.Protocol = httpReq.Proto
	proto.Host = httpReq.Host
	proto.URIPath = httpReq.URL.Path
	proto.Headers = httpReq.Header
	proto.ContentLength = httpReq.ContentLength
}

func copyHTTPResToProtoHTTPResponse(httpRes *http.Response, proto *trace.ProtoHTTPResponse) {
	proto.Status = httpRes.Status
	proto.StatusCode = httpRes.StatusCode
	proto.Protocol = httpRes.Proto
	proto.Headers = httpRes.Header
	proto.ContentLength = httpRes.ContentLength
}