-
-
Notifications
You must be signed in to change notification settings - Fork 81
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adds protocol handler for MongoDB #179
Conversation
@glaslos If there are any changes required, I'm ready to modify my implementation. |
f61aa61
to
b86d95d
Compare
b86d95d
to
401d6a1
Compare
@glaslos I've rebased my branch onto the latest main to keep the commit history linear. The PR should now be cleaner and ready for review. Let me know if I need to make any changes. Thanks. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Added a consideration which isn't relevant for your PR. Your PR is a great demonstration of understanding the existing handlers. Thank you for your contribution.
messageLength := binary.LittleEndian.Uint32(snip) | ||
if messageLength > 0 && messageLength <= 48*1024*1024 { | ||
moreSample, bufConn, err := Peek(bufConn, 16) | ||
if err != nil { | ||
if err := conn.Close(); err != nil { | ||
log.Error("failed to close connection", producer.ErrAttr(err)) | ||
} | ||
log.Debug("failed to peek connection", producer.ErrAttr(err)) | ||
return nil | ||
} | ||
if len(moreSample) == 16 { | ||
opCode := binary.LittleEndian.Uint32(moreSample[12:16]) | ||
validOpCodes := map[uint32]bool{ | ||
1: true, // OP_REPLY | ||
2001: true, // OP_UPDATE | ||
2002: true, // OP_INSERT | ||
2004: true, // OP_QUERY | ||
2005: true, // OP_GET_MORE | ||
2006: true, // OP_DELETE | ||
2007: true, // OP_KILL_CURSORS | ||
2012: true, // OP_COMPRESSED | ||
2013: true, // OP_MSG | ||
} | ||
if _, ok := validOpCodes[opCode]; ok { | ||
return tcp.HandleMongoDB(ctx, bufConn, md, log, h) | ||
} | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should move this somewhere else. But it is not important right now.
* [feat] adds protocol handler for MongoDB * [refactor] makes mongo message header private
Fixes #160
This PR adds support for detecting and responding to MongoDB connection attempts.
Changes:
protocols/tcp/mongodb.go
)protocols/tcp/mongodb_test.go
)protocols/protocols.go
config/rules.yaml
I have referred to the MongoDB Wire Protocol from their documentation which can be found here. I've taken the message header format and the Opcodes from here.
The implementation includes unit tests for both the response creation function and the handler itself with mocked dependencies. The tests verify that the handler correctly processes Mongo protocol messages and generates valid responses.
The handler in action:
on running
mongo --host localhost --port 5000