Skip to content

Commit

Permalink
refactoring filename generation & adding docs for reading msg binary
Browse files Browse the repository at this point in the history
  • Loading branch information
twiz718 committed Aug 18, 2024
1 parent 3bfbf1f commit e18b356
Show file tree
Hide file tree
Showing 3 changed files with 29 additions and 22 deletions.
7 changes: 7 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -1,2 +1,9 @@
build:
CGO_ENABLED=1 go build -o sherlock main.go

clean:
rm -f *.bin *.json
rm sherlock

run:
sudo ./sherlock
6 changes: 6 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,3 +97,9 @@ $ cat ANSWER_127.0.0.1_60038_A_cat.com_1723941648.json | jq .
"Extra": null
}
```

-----------

## Looking inside the message binary


38 changes: 16 additions & 22 deletions main.go
Original file line number Diff line number Diff line change
Expand Up @@ -51,10 +51,6 @@ func main() {
}

func handlePacket(packet gopacket.Packet, questions chan *DnsMetadata, answers chan *DnsMetadata) {
// fmt.Printf("----------------------------\n")
// defer func() {
// fmt.Printf("----------------------------\n\n")
// }()
udpLayer := packet.Layer(layers.LayerTypeUDP)
if udpLayer == nil {
return
Expand Down Expand Up @@ -99,23 +95,12 @@ func handlePacket(packet gopacket.Packet, questions chan *DnsMetadata, answers c

// DNS Answer
if hasAnswer {
// fmt.Println("[DNS ANSWERS]")
// j, err := json.MarshalIndent(msg, "", " ")
// if err != nil {
// fmt.Println("err:", err)
// return
// }
// fmt.Println(string(j))
// for _, a := range msg.Answer {
// fmt.Printf("\t%v\n", a.String())
// }
answers <- &DnsMetadata{port: int(udp.DstPort), msg: *msg, srcIP: net.SrcIP.String(), dstIP: net.DstIP.String()}
return
}

// DNS Question
if hasQuestion {
// fmt.Println("[DNS QUESTION]")
// fmt.Printf("\t%v\n", msg.Question[0].String())
questions <- &DnsMetadata{port: int(udp.SrcPort), msg: *msg, srcIP: net.SrcIP.String(), dstIP: net.DstIP.String()}
}

Expand All @@ -124,7 +109,7 @@ func handlePacket(packet gopacket.Packet, questions chan *DnsMetadata, answers c
func processQuestions(questions <-chan *DnsMetadata) {
for {
q := <-questions
msgId := getMsgId("QUESTION", q.port, q.msg.Question[0].Name, dns.TypeToString[q.msg.Question[0].Qtype], q.srcIP)
msgId := getMsgId(q)
fmt.Printf("Processing Question with msg ID [%v]\n", msgId)
err := saveToFile(msgId, q.msg)
if err != nil {
Expand All @@ -139,7 +124,7 @@ func processAnswers(answers <-chan *DnsMetadata) {
a := <-answers
// fmt.Println("Hey look an Answer arrived!")
// fmt.Printf("%+v\n", a)
msgId := getMsgId("ANSWER", a.port, a.msg.Question[0].Name, dns.TypeToString[a.msg.Question[0].Qtype], a.dstIP)
msgId := getMsgId(a)
fmt.Printf("Processing Answer with msg ID [%v]\n", msgId)
err := saveToFile(msgId, a.msg)
if err != nil {
Expand All @@ -148,11 +133,20 @@ func processAnswers(answers <-chan *DnsMetadata) {
}
}

func getMsgId(questionOrAnswer string, port int, qName string, qTypeStr string, srcIP string) string {
return fmt.Sprintf("%v_%v_%v_%v_%v_%v",
func getMsgId(dmd *DnsMetadata) string {
questionOrAnswer := "QUESTION"
ip := dmd.srcIP
if dmd.msg.Response {
questionOrAnswer = "ANSWER"
ip = dmd.dstIP
}
qTypeStr := dns.TypeToString[dmd.msg.Question[0].Qtype]
qName := dmd.msg.Question[0].Name
return fmt.Sprintf("%v_%v_%v_%v_%v_%v_%v",
questionOrAnswer,
srcIP,
strconv.Itoa(port),
ip,
"msgid-"+strconv.FormatUint(uint64(dmd.msg.Id), 10),
"port-"+strconv.Itoa(dmd.port),
qTypeStr,
qName[:len(qName)-1],
strconv.FormatInt(time.Now().UTC().Unix(), 10))
Expand Down

0 comments on commit e18b356

Please sign in to comment.