-
Notifications
You must be signed in to change notification settings - Fork 1
/
net_packet_ipv6.go
81 lines (66 loc) · 1.72 KB
/
net_packet_ipv6.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
package derive
import (
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/nextlinux/tracee/pkg/events"
"github.com/nextlinux/tracee/types/trace"
)
func NetPacketIPv6() DeriveFunction {
return deriveSingleEvent(events.NetPacketIPv6, deriveNetPacketIPv6Args())
}
func deriveNetPacketIPv6Args() deriveArgsFunction {
return func(event trace.Event) ([]interface{}, error) {
var ok bool
var payload []byte
// event retval encodes layer 3 protocol type
if event.ReturnValue&familyIpv6 != familyIpv6 {
return nil, nil
}
// sanity checks
payloadArg := events.GetArg(&event, "payload")
if payloadArg == nil {
return nil, noPayloadError()
}
if payload, ok = payloadArg.Value.([]byte); !ok {
return nil, nonByteArgError()
}
payloadSize := len(payload)
if payloadSize < 1 {
return nil, emptyPayloadError()
}
// parse packet
packet := gopacket.NewPacket(
payload,
layers.LayerTypeIPv6,
gopacket.Default,
)
if packet == nil {
return []interface{}{}, parsePacketError()
}
layer3 := packet.NetworkLayer()
switch l3 := layer3.(type) {
case (*layers.IPv6):
var ipv6 trace.ProtoIPv6
copyIPv6ToProtoIPv6(l3, &ipv6)
return []interface{}{
l3.SrcIP.String(),
l3.DstIP.String(),
ipv6,
}, nil
}
return nil, notProtoPacketError("IPv6")
}
}
//
// IPv6 protocol type conversion (from gopacket layer to trace type)
//
func copyIPv6ToProtoIPv6(l3 *layers.IPv6, proto *trace.ProtoIPv6) {
proto.Version = l3.Version
proto.TrafficClass = l3.TrafficClass
proto.FlowLabel = l3.FlowLabel
proto.Length = l3.Length
proto.NextHeader = l3.NextHeader.String()
proto.HopLimit = l3.HopLimit
proto.SrcIP = l3.SrcIP.String()
proto.DstIP = l3.DstIP.String()
}