Update to latest upstream master

vendor/github.com/buger/gor-pro/LICENSE.txt

@@ -0,0 +1,19 @@
+GoReplay is an Open Source project licensed under the terms of
+the LGPLv3 license.  Please see <http://www.gnu.org/licenses/lgpl-3.0.html>
+for license text.
+
+As a special exception to the GNU Lesser General Public License version 3
+("LGPL3"), the copyright holders of this Library give you permission to
+convey to a third party a Combined Work that links statically or dynamically
+to this Library without providing any Minimal Corresponding Source or
+Minimal Application Code as set out in 4d or providing the installation
+information set out in section 4e, provided that you comply with the other
+provisions of LGPL3 and provided that you meet, for the Application the
+terms and conditions of the license(s) which apply to the Application.
+
+TLDR: You are free to use Gor subpackages like `byteutils` or `proto` in your commercial projects.
+
+
+GoReplay Pro has a commercial-friendly license allowing private forks
+and modifications of GoReplay.  Please see https://goreplay.org/pro.html for
+more detail.  You can find the commercial license terms in COMM-LICENSE.

vendor/github.com/buger/gor-pro/byteutils/byteutils.go

@@ -0,0 +1,43 @@
+// Package byteutils probvides helpers for working with byte slices
+package byteutils
+
+// Cut elements from slice for a given range
+func Cut(a []byte, from, to int) []byte {
+	copy(a[from:], a[to:])
+	a = a[:len(a)-to+from]
+
+	return a
+}
+
+// Insert new slice at specified position
+func Insert(a []byte, i int, b []byte) []byte {
+	a = append(a, make([]byte, len(b))...)
+	copy(a[i+len(b):], a[i:])
+	copy(a[i:i+len(b)], b)
+
+	return a
+}
+
+// Replace function unlike bytes.Replace allows you to specify range
+func Replace(a []byte, from, to int, new []byte) []byte {
+	lenDiff := len(new) - (to - from)
+
+	if lenDiff > 0 {
+		// Extend if new segment bigger
+		a = append(a, make([]byte, lenDiff)...)
+		copy(a[to+lenDiff:], a[to:])
+		copy(a[from:from+len(new)], new)
+
+		return a
+	}
+
+	if lenDiff < 0 {
+		copy(a[from:], new)
+		copy(a[from+len(new):], a[to:])
+		return a[:len(a)+lenDiff]
+	}
+
+	// same size
+	copy(a[from:], new)
+	return a
+}

vendor/github.com/buger/gor-pro/proto/fuzz.go

@@ -0,0 +1,12 @@
+// +build gofuzz
+
+package proto
+
+func Fuzz(data []byte) int {
+
+	ParseHeaders([][]byte{data}, func(header []byte, value []byte) bool {
+		return true
+	})
+
+	return 1
+}

vendor/github.com/buger/gor-pro/proto/proto.go

@@ -0,0 +1,431 @@
+/*
+Package proto provides byte-level interaction with HTTP request payload.
+
+Example of HTTP payload for future references, new line symbols escaped:
+
+	POST /upload HTTP/1.1\r\n
+	User-Agent: Gor\r\n
+	Content-Length: 11\r\n
+	\r\n
+	Hello world
+
+	GET /index.html HTTP/1.1\r\n
+	User-Agent: Gor\r\n
+	\r\n
+	\r\n
+*/
+package proto
+
+import (
+	"bytes"
+
+    "github.com/buger/gor-pro/byteutils"
+)
+
+// In HTTP newline defined by 2 bytes (for both windows and *nix support)
+var CLRF = []byte("\r\n")
+
+// New line acts as separator: end of Headers or Body (in some cases)
+var EmptyLine = []byte("\r\n\r\n")
+
+// Separator for Header line. Header looks like: `HeaderName: value`
+var HeaderDelim = []byte(": ")
+
+// MIMEHeadersEndPos finds end of the Headers section, which should end with empty line.
+func MIMEHeadersEndPos(payload []byte) int {
+	return bytes.Index(payload, EmptyLine) + 4
+}
+
+// MIMEHeadersStartPos finds start of Headers section
+// It just finds position of second line (first contains location and method).
+func MIMEHeadersStartPos(payload []byte) int {
+	return bytes.Index(payload, CLRF) + 2 // Find first line end
+}
+
+func headerIndex(payload []byte, name []byte) int {
+	i := 0
+	for {
+		// we need enough space for at least '\n' and the header name
+		if i >= (len(payload) - len(name) - 1) {
+			return -1
+		}
+
+		if payload[i] == '\n' {
+			i++
+			if bytes.EqualFold(name, payload[i:i+len(name)]) {
+				return i
+			}
+		}
+		i++
+
+	}
+	return -1
+}
+
+// header return value and positions of header/value start/end.
+// If not found, value will be blank, and headerStart will be -1
+// Do not support multi-line headers.
+func header(payload []byte, name []byte) (value []byte, headerStart, headerEnd, valueStart, valueEnd int) {
+	headerStart = headerIndex(payload, name)
+
+	if headerStart == -1 {
+		return
+	}
+
+	valueStart = headerStart + len(name) + 1 // Skip ":" after header name
+	headerEnd = valueStart + bytes.IndexByte(payload[valueStart:], '\n')
+
+	for valueStart < headerEnd { // Ignore empty space after ':'
+		if payload[valueStart] == ' ' {
+			valueStart++
+		} else {
+			break
+		}
+	}
+
+	valueEnd = valueStart + bytes.IndexByte(payload[valueStart:], '\n')
+
+	if payload[headerEnd-1] == '\r' {
+		valueEnd--
+	}
+
+	// ignore empty space at end of header value
+	for valueStart < valueEnd {
+		if payload[valueEnd-1] == ' ' {
+			valueEnd--
+		} else {
+			break
+		}
+	}
+	value = payload[valueStart:valueEnd]
+
+	return
+}
+
+// Works only with ASCII
+func HeadersEqual(h1 []byte, h2 []byte) bool {
+	if len(h1) != len(h2) {
+		return false
+	}
+
+	for i, c1 := range h1 {
+		c2 := h2[i]
+
+		switch int(c1) - int(c2) {
+		case 0, 32, -32:
+		default:
+			return false
+		}
+	}
+
+	return true
+}
+
+// Parsing headers from multiple payloads
+func ParseHeaders(payloads [][]byte, cb func(header []byte, value []byte) bool) {
+	hS := [2]int{0, 0}   // header start
+	hE := [2]int{-1, -1} // header end
+	vS := [2]int{-1, -1} // value start
+	vE := [2]int{-1, -1} // value end
+
+	i := 0
+	pIdx := 0
+	lineBreaks := 0
+	newLineBreak := true
+
+	for {
+		if len(payloads)-1 < pIdx {
+			break
+		}
+
+		p := payloads[pIdx]
+
+		if len(p)-1 < i {
+			pIdx++
+			i = 0
+			continue
+		}
+
+		switch p[i] {
+		case '\r', '\n':
+			newLineBreak = true
+			lineBreaks++
+
+			// End of headers
+			if lineBreaks == 4 {
+				return
+			}
+
+			if lineBreaks > 1 {
+				break
+			}
+
+			vE = [2]int{pIdx, i}
+
+			if vS[1] != -1 && vE[1] != -1 &&
+				hS[1] != -1 && hE[1] != -1 {
+
+				var header, value []byte
+
+				phS, phE, pvS, pvE := payloads[hS[0]], payloads[hE[0]], payloads[vS[0]], payloads[vE[0]]
+
+				// If in same payload
+				if hS[0] == hE[0] {
+					header = phS[hS[1]:hE[1]]
+				} else {
+					header = make([]byte, len(phS)-hS[1]+hE[1])
+					copy(header, phS[hS[1]:])
+					copy(header[len(phS)-hS[1]:], phE[:hE[1]])
+				}
+
+				if vS[0] == vE[0] {
+					value = pvS[vS[1]:vE[1]]
+				} else {
+					value = make([]byte, len(pvS)-vS[1]+vE[1])
+					copy(value, pvS[vS[1]:])
+					copy(value[len(pvS)-vS[1]:], pvE[:vE[1]])
+				}
+
+				if !cb(header, value) {
+					return
+				}
+			}
+
+			// Header found, reset values
+			vS = [2]int{-1, -1}
+			vE = [2]int{-1, -1}
+			hS = [2]int{-1, -1}
+			hE = [2]int{-1, -1}
+		case ':':
+			if newLineBreak {
+				hE = [2]int{pIdx, i}
+				newLineBreak = false
+			}
+			lineBreaks = 0
+		default:
+			lineBreaks = 0
+
+			if hS[1] == -1 {
+				hS = [2]int{pIdx, i}
+				hE = [2]int{-1, -1}
+			} else {
+				if hE[1] == -1 {
+					break
+				}
+
+				if vS[1] == -1 {
+					if p[i] == ' ' {
+						break
+					}
+
+					vS = [2]int{pIdx, i}
+				}
+			}
+		}
+
+		i++
+	}
+
+	return
+}
+
+// Header returns header value, if header not found, value will be blank
+func Header(payload, name []byte) []byte {
+	val, _, _, _, _ := header(payload, name)
+
+	return val
+}
+
+// SetHeader sets header value. If header not found it creates new one.
+// Returns modified request payload
+func SetHeader(payload, name, value []byte) []byte {
+	_, hs, _, vs, ve := header(payload, name)
+
+	if hs != -1 {
+		// If header found we just replace its value
+		return byteutils.Replace(payload, vs, ve, value)
+	}
+
+	return AddHeader(payload, name, value)
+}
+
+// AddHeader takes http payload and appends new header to the start of headers section
+// Returns modified request payload
+func AddHeader(payload, name, value []byte) []byte {
+	header := make([]byte, len(name)+2+len(value)+2)
+	copy(header[0:], name)
+	copy(header[len(name):], HeaderDelim)
+	copy(header[len(name)+2:], value)
+	copy(header[len(header)-2:], CLRF)
+
+	mimeStart := MIMEHeadersStartPos(payload)
+
+	return byteutils.Insert(payload, mimeStart, header)
+}
+
+// DelHeader takes http payload and removes header name from headers section
+// Returns modified request payload
+func DeleteHeader(payload, name []byte) []byte {
+	_, hs, he, _, _ := header(payload, name)
+	if hs != -1 {
+		newHeader := make([]byte, len(payload)-(he-hs)-1)
+		copy(newHeader[:hs], payload[:hs])
+		copy(newHeader[hs:], payload[he+1:])
+		return newHeader
+	}
+	return payload
+}
+
+// Body returns request/response body
+func Body(payload []byte) []byte {
+	// 4 -> len(EMPTY_LINE)
+	if len(payload) < 4 {
+		return []byte{}
+	}
+
+	return payload[MIMEHeadersEndPos(payload):]
+}
+
+// Path takes payload and retuns request path: Split(firstLine, ' ')[1]
+func Path(payload []byte) []byte {
+	start := bytes.IndexByte(payload, ' ') + 1
+	eol := bytes.IndexByte(payload[start:], '\r')
+	end := bytes.IndexByte(payload[start:], ' ')
+
+	if eol > 0 {
+		if end == -1 || eol < end {
+			return payload[start : start+eol]
+		}
+	} else { // support for legacy clients
+		eol = bytes.IndexByte(payload[start:], '\n')
+
+		if eol > 0 && (end == -1 || eol < end) {
+			return payload[start : start+eol]
+		}
+	}
+
+	if end < 0 {
+		return payload[start:len(payload)]
+	}
+
+	return payload[start : start+end]
+}
+
+// SetPath takes payload, sets new path and returns modified payload
+func SetPath(payload, path []byte) []byte {
+	start := bytes.IndexByte(payload, ' ') + 1
+	end := bytes.IndexByte(payload[start:], ' ')
+
+	return byteutils.Replace(payload, start, start+end, path)
+}
+
+// PathParam returns URL query attribute by given name, if no found: valueStart will be -1
+func PathParam(payload, name []byte) (value []byte, valueStart, valueEnd int) {
+	path := Path(payload)
+
+	if paramStart := bytes.Index(path, append(name, '=')); paramStart != -1 {
+		valueStart := paramStart + len(name) + 1
+		paramEnd := bytes.IndexByte(path[valueStart:], '&')
+
+		// Param can end with '&' (another param), or end of line
+		if paramEnd == -1 { // It is final param
+			paramEnd = len(path)
+		} else {
+			paramEnd += valueStart
+		}
+
+		return path[valueStart:paramEnd], valueStart, paramEnd
+	}
+
+	return []byte(""), -1, -1
+}
+
+// SetPathParam takes payload and updates path Query attribute
+// If query param not found, it will append new
+// Returns modified payload
+func SetPathParam(payload, name, value []byte) []byte {
+	path := Path(payload)
+	_, vs, ve := PathParam(payload, name)
+
+	if vs != -1 { // If param found, replace its value and set new Path
+		newPath := make([]byte, len(path))
+		copy(newPath, path)
+		newPath = byteutils.Replace(newPath, vs, ve, value)
+
+		return SetPath(payload, newPath)
+	}
+
+	// if param not found append to end of url
+	// Adding 2 because of '?' or '&' at start, and '=' in middle
+	newParam := make([]byte, len(name)+len(value)+2)
+
+	if bytes.IndexByte(path, '?') == -1 {
+		newParam[0] = '?'
+	} else {
+		newParam[0] = '&'
+	}
+
+	// Copy "param=value" into buffer, after it looks like "?param=value"
+	copy(newParam[1:], name)
+	newParam[1+len(name)] = '='
+	copy(newParam[2+len(name):], value)
+
+	// Append param to the end of path
+	newPath := make([]byte, len(path)+len(newParam))
+	copy(newPath, path)
+	copy(newPath[len(path):], newParam)
+
+	return SetPath(payload, newPath)
+}
+
+// SetHost updates Host header for HTTP/1.1 or updates host in path for HTTP/1.0 or Proxy requests
+// Returns modified payload
+func SetHost(payload, url, host []byte) []byte {
+	// If this is HTTP 1.0 traffic or proxy traffic it may include host right into path variable, so instead of setting Host header we rewrite Path
+	// Fix for https://github.com/buger/gor/issues/156
+	if path := Path(payload); bytes.HasPrefix(path, []byte("http")) {
+		hostStart := bytes.IndexByte(path, ':') // : position "https?:"
+		hostStart += 3                          // Skip 1 ':' and 2 '\'
+		hostEnd := hostStart + bytes.IndexByte(path[hostStart:], '/')
+
+		newPath := make([]byte, len(path))
+		copy(newPath, path)
+		newPath = byteutils.Replace(newPath, 0, hostEnd, url)
+
+		return SetPath(payload, newPath)
+	}
+
+	return SetHeader(payload, []byte("Host"), host)
+}
+
+// Method returns HTTP method
+func Method(payload []byte) []byte {
+	end := bytes.IndexByte(payload, ' ')
+
+	return payload[:end]
+}
+
+// Status returns response status.
+// It happend to be in same position as request payload path
+func Status(payload []byte) []byte {
+	return Path(payload)
+}
+
+var httpMethods []string = []string{
+	"GET ", "OPTI", "HEAD", "POST", "PUT ", "DELE", "TRAC", "CONN", "PATC" /* custom methods */, "BAN ", "PURG", "PROP", "MKCO", "COPY", "MOVE", "LOCK", "UNLO",
+}
+
+func IsHTTPPayload(payload []byte) bool {
+	if len(payload) < 4 {
+		return false
+	}
+
+	method := string(payload[0:4])
+
+	for _, m := range httpMethods {
+		if method == m {
+			return true
+		}
+	}
+	return false
+}

vendor/github.com/buger/gor-pro/raw_socket_listener/listener.go

@@ -0,0 +1,912 @@
+/*
+Package rawSocket provides traffic sniffier using RAW sockets.
+
+Capture traffic from socket using RAW_SOCKET's
+http://en.wikipedia.org/wiki/Raw_socket
+
+RAW_SOCKET allow you listen for traffic on any port (e.g. sniffing) because they operate on IP level.
+
+Ports is TCP feature, same as flow control, reliable transmission and etc.
+
+This package implements own TCP layer: TCP packets is parsed using tcp_packet.go, and flow control is managed by tcp_message.go
+*/
+package rawSocket
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"runtime"
+	"runtime/debug"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/buger/gor-pro/proto"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"github.com/google/gopacket/pcap"
+)
+
+var _ = fmt.Println
+
+type packet struct {
+	srcIP     []byte
+	data      []byte
+	timestamp time.Time
+}
+
+// Listener handle traffic capture
+type Listener struct {
+	mu sync.Mutex
+	// buffer of TCPMessages waiting to be send
+	// ID -> TCPMessage
+	messages map[tcpID]*TCPMessage
+
+	// Expect: 100-continue request is send in 2 tcp messages
+	// We store ACK aliases to merge this packets together
+	ackAliases map[uint32]uint32
+	// To get ACK of second message we need to compute its Seq and wait for them message
+	seqWithData map[uint32]uint32
+
+	// Ack -> Req
+	respAliases map[uint32]*TCPMessage
+
+	// Ack -> ID
+	respWithoutReq map[uint32]tcpID
+
+	// Messages ready to be send to client
+	packetsChan chan *packet
+
+	// Messages ready to be send to client
+	messagesChan chan *TCPMessage
+
+	addr string // IP to listen
+	port uint16 // Port to listen
+
+	trackResponse bool
+	messageExpire time.Duration
+
+	bpfFilter     string
+	timestampType string
+	overrideSnapLen bool
+	immediateMode bool
+
+	bufferSize int
+
+	conn        net.PacketConn
+	pcapHandles []*pcap.Handle
+
+	quit    chan bool
+	readyCh chan bool
+
+	protocol TCPProtocol
+}
+
+type request struct {
+	id    tcpID
+	start time.Time
+	ack   uint32
+}
+
+// Available engines for intercepting traffic
+const (
+	EngineRawSocket = 1 << iota
+	EnginePcap
+	EnginePcapFile
+)
+
+// NewListener creates and initializes new Listener object
+func NewListener(addr string, port string, engine int, trackResponse bool, expire time.Duration, protocol TCPProtocol, bpfFilter string, timestampType string, bufferSize int, overrideSnapLen bool, immediateMode bool) (l *Listener) {
+	l = &Listener{}
+
+	l.packetsChan = make(chan *packet, 10000)
+	l.messagesChan = make(chan *TCPMessage, 10000)
+	l.quit = make(chan bool)
+	l.readyCh = make(chan bool, 1)
+
+	l.messages = make(map[tcpID]*TCPMessage)
+	l.ackAliases = make(map[uint32]uint32)
+	l.seqWithData = make(map[uint32]uint32)
+	l.respAliases = make(map[uint32]*TCPMessage)
+	l.respWithoutReq = make(map[uint32]tcpID)
+	l.trackResponse = trackResponse
+	l.protocol = protocol
+	l.bpfFilter = bpfFilter
+	l.timestampType = timestampType
+	l.immediateMode = immediateMode
+	l.bufferSize = bufferSize
+	l.overrideSnapLen = overrideSnapLen
+
+	l.addr = addr
+	_port, _ := strconv.Atoi(port)
+	l.port = uint16(_port)
+
+	if expire.Nanoseconds() == 0 {
+		expire = 2000 * time.Millisecond
+	}
+
+	l.messageExpire = expire
+
+	go l.listen()
+
+	// Special case for testing
+	if l.port != 0 {
+		switch engine {
+		case EnginePcap:
+			go l.readPcap()
+		case EnginePcapFile:
+			go l.readPcapFile()
+		default:
+			log.Fatal("Unknown traffic interception engine:", engine)
+		}
+	}
+
+	return
+}
+
+func (t *Listener) listen() {
+	gcTicker := time.Tick(t.messageExpire / 2)
+
+	for {
+		select {
+		case <-t.quit:
+			if t.conn != nil {
+				t.conn.Close()
+			}
+			return
+		case packet := <-t.packetsChan:
+			tcpPacket := ParseTCPPacket(packet.srcIP, packet.data, packet.timestamp)
+			t.processTCPPacket(tcpPacket)
+		case <-gcTicker:
+			now := time.Now()
+
+			// Dispatch requests before responses
+			for _, message := range t.messages {
+				if now.Sub(message.End) >= t.messageExpire {
+					t.dispatchMessage(message)
+				}
+			}
+		}
+	}
+}
+
+func (t *Listener) deleteMessage(message *TCPMessage) {
+	delete(t.messages, message.ID())
+	delete(t.ackAliases, message.Ack)
+	if message.DataAck != 0 {
+		delete(t.ackAliases, message.DataAck)
+	}
+	if message.DataSeq != 0 {
+		delete(t.seqWithData, message.DataSeq)
+	}
+
+	delete(t.respAliases, message.ResponseAck)
+}
+
+func (t *Listener) dispatchMessage(message *TCPMessage) {
+	// If already dispatched
+	if _, ok := t.messages[message.ID()]; !ok {
+		return
+	}
+
+	t.deleteMessage(message)
+
+	if t.protocol == ProtocolHTTP && !message.complete {
+		if !message.IsIncoming {
+			delete(t.respAliases, message.Ack)
+			delete(t.respWithoutReq, message.Ack)
+		}
+
+		return
+	}
+
+	if message.IsIncoming {
+		// If there were response before request
+		// log.Println("Looking for Response: ", t.respWithoutReq, message.ResponseAck)
+		if t.trackResponse {
+			if respID, ok := t.respWithoutReq[message.ResponseAck]; ok {
+				if resp, rok := t.messages[respID]; rok {
+					// if resp.AssocMessage == nil {
+					// log.Println("FOUND RESPONSE")
+					resp.setAssocMessage(message)
+					message.setAssocMessage(resp)
+
+					if resp.complete {
+						defer t.dispatchMessage(resp)
+					}
+					// }
+				}
+			}
+
+			if resp, ok := t.messages[message.ResponseID]; ok {
+				resp.setAssocMessage(message)
+			}
+		}
+	} else {
+		if message.AssocMessage == nil {
+			if responseRequest, ok := t.respAliases[message.Ack]; ok {
+				message.setAssocMessage(responseRequest)
+				responseRequest.setAssocMessage(message)
+			}
+		}
+
+		delete(t.respAliases, message.Ack)
+		delete(t.respWithoutReq, message.Ack)
+
+		// Do not track responses which have no associated requests
+		if message.AssocMessage == nil {
+			// log.Println("Can't dispatch resp", message.Seq, message.Ack, string(message.Bytes()))
+			return
+		}
+	}
+
+	t.messagesChan <- message
+}
+
+// DeviceNotFoundError raised if user specified wrong ip
+type DeviceNotFoundError struct {
+	addr string
+}
+
+func (e *DeviceNotFoundError) Error() string {
+	devices, _ := pcap.FindAllDevs()
+
+	if len(devices) == 0 {
+		return "Can't get list of network interfaces, ensure that you running Gor as root user or sudo.\nTo run as non-root users see this docs https://github.com/buger/goreplay/wiki/Running-as-non-root-user"
+	}
+
+	var msg string
+	msg += "Can't find interfaces with addr: " + e.addr + ". Provide available IP for intercepting traffic: \n"
+	for _, device := range devices {
+		msg += "Name: " + device.Name + "\n"
+		if device.Description != "" {
+			msg += "Description: " + device.Description + "\n"
+		}
+		for _, address := range device.Addresses {
+			msg += "- IP address: " + address.IP.String() + "\n"
+		}
+	}
+
+	return msg
+}
+
+func isLoopback(device pcap.Interface) bool {
+	if len(device.Addresses) == 0 {
+		return false
+	}
+
+	switch device.Addresses[0].IP.String() {
+	case "127.0.0.1", "::1":
+		return true
+	}
+
+	return false
+}
+
+func listenAllInterfaces(addr string) bool {
+	switch addr {
+	case "", "0.0.0.0", "[::]", "::":
+		return true
+	default:
+		return false
+	}
+}
+
+func findPcapDevices(addr string) (interfaces []pcap.Interface, err error) {
+	devices, err := pcap.FindAllDevs()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	for _, device := range devices {
+		if listenAllInterfaces(addr) && len(device.Addresses) > 0 || isLoopback(device) {
+			interfaces = append(interfaces, device)
+			continue
+		}
+
+		for _, address := range device.Addresses {
+			if device.Name == addr || address.IP.String() == addr {
+				interfaces = append(interfaces, device)
+				return interfaces, nil
+			}
+		}
+	}
+
+	if len(interfaces) == 0 {
+		return nil, &DeviceNotFoundError{addr}
+	}
+
+	return interfaces, nil
+}
+
+func (t *Listener) readPcap() {
+	devices, err := findPcapDevices(t.addr)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	bpfSupported := true
+	if runtime.GOOS == "darwin" {
+		bpfSupported = false
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(len(devices))
+
+	for _, d := range devices {
+		go func(device pcap.Interface) {
+			inactive, err := pcap.NewInactiveHandle(device.Name)
+			if err != nil {
+				log.Println("Pcap Error while opening device", device.Name, err)
+				wg.Done()
+				return
+			}
+
+			if t.timestampType != "" {
+				if tt, terr := pcap.TimestampSourceFromString(t.timestampType); terr != nil {
+					log.Println("Supported timestamp types: ", inactive.SupportedTimestamps(), device.Name)
+				} else if terr := inactive.SetTimestampSource(tt); terr != nil {
+					log.Println("Supported timestamp types: ", inactive.SupportedTimestamps(), device.Name)
+				}
+			}
+
+			if it, err := net.InterfaceByName(device.Name); err == nil && !t.overrideSnapLen {
+				// Auto-guess max length of packet to capture
+				inactive.SetSnapLen(it.MTU + 68*2)
+			} else {
+				inactive.SetSnapLen(65536)
+			}
+
+			inactive.SetTimeout(t.messageExpire)
+			inactive.SetPromisc(true)
+			inactive.SetImmediateMode(t.immediateMode)
+			if t.immediateMode {
+				log.Println("Setting immediate mode")
+			}
+			if t.bufferSize > 0 {
+				inactive.SetBufferSize(t.bufferSize)
+			}
+
+			handle, herr := inactive.Activate()
+			if herr != nil {
+				log.Println("PCAP Activate error:", herr)
+				wg.Done()
+				return
+			}
+
+			defer handle.Close()
+
+			t.mu.Lock()
+			t.pcapHandles = append(t.pcapHandles, handle)
+
+			var bpfDstHost, bpfSrcHost string
+			var loopback = isLoopback(device)
+
+			if loopback {
+				var allAddr []string
+				for _, dc := range devices {
+					for _, addr := range dc.Addresses {
+						allAddr = append(allAddr, "(dst host "+addr.IP.String()+" and src host "+addr.IP.String()+")")
+					}
+				}
+
+				bpfDstHost = strings.Join(allAddr, " or ")
+				bpfSrcHost = bpfDstHost
+			} else {
+				for i, addr := range device.Addresses {
+					bpfDstHost += "dst host " + addr.IP.String()
+					bpfSrcHost += "src host " + addr.IP.String()
+					if i != len(device.Addresses)-1 {
+						bpfDstHost += " or "
+						bpfSrcHost += " or "
+					}
+				}
+			}
+
+			if bpfSupported {
+				var bpf string
+
+				if t.trackResponse {
+					bpf = "(tcp dst port " + strconv.Itoa(int(t.port)) + " and (" + bpfDstHost + ")) or (" + "tcp src port " + strconv.Itoa(int(t.port)) + " and (" + bpfSrcHost + "))"
+				} else {
+					bpf = "tcp dst port " + strconv.Itoa(int(t.port)) + " and (" + bpfDstHost + ")"
+				}
+
+				if t.bpfFilter != "" {
+					bpf = t.bpfFilter
+				}
+
+				if err := handle.SetBPFFilter(bpf); err != nil {
+					log.Println("BPF filter error:", err, "Device:", device.Name, bpf)
+					wg.Done()
+					return
+				}
+			}
+			t.mu.Unlock()
+
+			var decoder gopacket.Decoder
+
+			// Special case for tunnel interface https://github.com/google/gopacket/issues/99
+			if handle.LinkType() == 12 {
+				decoder = layers.LayerTypeIPv4
+			} else {
+				decoder = handle.LinkType()
+			}
+
+			source := gopacket.NewPacketSource(handle, decoder)
+			source.Lazy = true
+			source.NoCopy = true
+
+			wg.Done()
+
+			var data, srcIP, dstIP []byte
+
+			for {
+				packet, err := source.NextPacket()
+
+				if err == io.EOF {
+					break
+				} else if err != nil {
+					continue
+				}
+
+				// We should remove network layer before parsing TCP/IP data
+				var of int
+				switch decoder {
+				case layers.LinkTypeEthernet:
+					of = 14
+				case layers.LinkTypePPP:
+					of = 1
+				case layers.LinkTypeFDDI:
+					of = 13
+				case layers.LinkTypeNull:
+					of = 4
+				case layers.LinkTypeLoop:
+					of = 4
+				case layers.LinkTypeRaw, layers.LayerTypeIPv4:
+					of = 0
+				case layers.LinkTypeLinuxSLL:
+					of = 16
+				default:
+					log.Println("Unknown packet layer", decoder, packet)
+					break
+				}
+
+				data = packet.Data()[of:]
+
+				version := uint8(data[0]) >> 4
+				ipLength := int(binary.BigEndian.Uint16(data[2:4]))
+
+				if version == 4 {
+					ihl := uint8(data[0]) & 0x0F
+
+					// Truncated IP info
+					if len(data) < int(ihl*4) {
+						continue
+					}
+
+					srcIP = data[12:16]
+					dstIP = data[16:20]
+
+					// Too small IP packet
+					if ipLength < 20 {
+						continue
+					}
+
+					// Invalid length
+					if int(ihl*4) > ipLength {
+						continue
+					}
+
+					if cmp := len(data) - ipLength; cmp > 0 {
+						data = data[:ipLength]
+					} else if cmp < 0 {
+						// Truncated packet
+						continue
+					}
+
+					data = data[ihl*4:]
+				} else {
+					// Truncated IP info
+					if len(data) < 40 {
+						continue
+					}
+
+					srcIP = data[8:24]
+					dstIP = data[24:40]
+
+					data = data[40:]
+				}
+
+				// Truncated TCP info
+				if len(data) <= 13 {
+					continue
+				}
+
+				dataOffset := (data[12] & 0xF0) >> 4
+				isFIN := data[13]&0x01 != 0
+
+				// We need only packets with data inside
+				// Check that the buffer is larger than the size of the TCP header
+				if len(data) > int(dataOffset*4) || isFIN {
+					if !bpfSupported {
+						destPort := binary.BigEndian.Uint16(data[2:4])
+						srcPort := binary.BigEndian.Uint16(data[0:2])
+
+						var addrCheck []byte
+
+						if destPort == t.port {
+							addrCheck = dstIP
+						}
+
+						if t.trackResponse && srcPort == t.port {
+							addrCheck = srcIP
+						}
+
+						if len(addrCheck) == 0 {
+							continue
+						}
+
+						addrMatched := false
+
+						if loopback {
+							for _, dc := range devices {
+								if addrMatched {
+									break
+								}
+								for _, a := range dc.Addresses {
+									if a.IP.Equal(net.IP(addrCheck)) {
+										addrMatched = true
+										break
+									}
+								}
+							}
+							addrMatched = true
+						} else {
+							for _, a := range device.Addresses {
+								if a.IP.Equal(net.IP(addrCheck)) {
+									addrMatched = true
+									break
+								}
+							}
+						}
+
+						if !addrMatched {
+							continue
+						}
+					}
+
+					t.packetsChan <- t.buildPacket(srcIP, data, packet.Metadata().Timestamp)
+				}
+			}
+		}(d)
+	}
+
+	wg.Wait()
+	t.readyCh <- true
+}
+
+func (t *Listener) readPcapFile() {
+	if handle, err := pcap.OpenOffline(t.addr); err != nil {
+		log.Fatal(err)
+	} else {
+		if t.bpfFilter != "" {
+			if err := handle.SetBPFFilter(t.bpfFilter); err != nil {
+				log.Println("BPF filter error:", err)
+				return
+			}
+		}
+
+		t.readyCh <- true
+		packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
+
+		for {
+			packet, err := packetSource.NextPacket()
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				log.Println("Error:", err)
+				continue
+			}
+
+			var addr, data []byte
+
+			if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil {
+				tcp, _ := tcpLayer.(*layers.TCP)
+				data = append(tcp.LayerContents(), tcp.LayerPayload()...)
+
+				if uint16(tcp.DstPort) == t.port {
+					copy(data[0:2], []byte{byte(tcp.SrcPort >> 8), byte(tcp.SrcPort)})
+					copy(data[2:4], []byte{byte(tcp.DstPort >> 8), byte(tcp.DstPort)})
+				} else {
+					copy(data[0:2], []byte{byte(tcp.DstPort >> 8), byte(tcp.DstPort)})
+					copy(data[2:4], []byte{byte(tcp.SrcPort >> 8), byte(tcp.SrcPort)})
+				}
+			} else {
+				continue
+			}
+
+			if ipLayer := packet.Layer(layers.LayerTypeIPv4); ipLayer != nil {
+				ip, _ := ipLayer.(*layers.IPv4)
+				addr = ip.SrcIP
+			} else if ipLayer = packet.Layer(layers.LayerTypeIPv6); ipLayer != nil {
+				ip, _ := ipLayer.(*layers.IPv6)
+				addr = ip.SrcIP
+			} else {
+				// log.Println("Can't find IP layer", packet)
+				continue
+			}
+
+			dataOffset := (data[12] & 0xF0) >> 4
+			isFIN := data[13]&0x01 != 0
+
+			// We need only packets with data inside
+			// Check that the buffer is larger than the size of the TCP header
+			if len(data) <= int(dataOffset*4) && !isFIN {
+				continue
+			}
+
+			t.packetsChan <- t.buildPacket(addr, data, packet.Metadata().Timestamp)
+		}
+	}
+}
+
+func (t *Listener) readRAWSocket() {
+	conn, e := net.ListenPacket("ip:tcp", t.addr)
+	t.conn = conn
+
+	if e != nil {
+		log.Fatal(e)
+	}
+
+	defer t.conn.Close()
+
+	buf := make([]byte, 64*1024) // 64kb
+
+	t.readyCh <- true
+
+	for {
+		// Note: ReadFrom receive messages without IP header
+		n, addr, err := t.conn.ReadFrom(buf)
+
+		if err != nil {
+			if strings.HasSuffix(err.Error(), "closed network connection") {
+				return
+			} else {
+				continue
+			}
+		}
+
+		if n > 0 {
+			if t.isValidPacket(buf[:n]) {
+				t.packetsChan <- t.buildPacket([]byte(addr.(*net.IPAddr).IP), buf[:n], time.Now())
+			}
+		}
+	}
+}
+
+func (t *Listener) buildPacket(packetSrcIP []byte, packetData []byte, timestamp time.Time) *packet {
+	return &packet{
+		srcIP:     packetSrcIP,
+		data:      packetData,
+		timestamp: timestamp,
+	}
+}
+
+func (t *Listener) isValidPacket(buf []byte) bool {
+	// To avoid full packet parsing every time, we manually parsing values needed for packet filtering
+	// http://en.wikipedia.org/wiki/Transmission_Control_Protocol
+	destPort := binary.BigEndian.Uint16(buf[2:4])
+	srcPort := binary.BigEndian.Uint16(buf[0:2])
+
+	// Because RAW_SOCKET can't be bound to port, we have to control it by ourself
+	if destPort == t.port || (t.trackResponse && srcPort == t.port) {
+		// Get the 'data offset' (size of the TCP header in 32-bit words)
+		dataOffset := (buf[12] & 0xF0) >> 4
+
+		// We need only packets with data inside
+		// Check that the buffer is larger than the size of the TCP header
+		if len(buf) > int(dataOffset*4) {
+			// We should create new buffer because go slices is pointers. So buffer data shoud be immutable.
+			return true
+		}
+	}
+
+	return false
+}
+
+// Trying to add packet to existing message or creating new message
+//
+// For TCP message unique id is Acknowledgment number (see tcp_packet.go)
+func (t *Listener) processTCPPacket(packet *TCPPacket) {
+	// Don't exit on panic
+	defer func() {
+		if r := recover(); r != nil {
+			log.Println("PANIC: pkg:", r, packet, string(debug.Stack()))
+		}
+	}()
+
+	var responseRequest *TCPMessage
+	var message *TCPMessage
+
+	isIncoming := packet.DestPort == t.port
+
+	if t.protocol == ProtocolHTTP {
+        if !isIncoming {
+            responseRequest, _ = t.respAliases[packet.Ack]
+        }
+
+        // Seek for 100-expect chunks
+        // `packet.Ack != parentAck` is protection for clients who send data without ignoring server 100-continue response, e.g have data chunks have same Ack
+        if parentAck, ok := t.seqWithData[packet.Seq]; ok && packet.Ack != parentAck {
+            // Skip zero-length chunks https://github.com/buger/goreplay/issues/496
+            if len(packet.Data) == 0 {
+                return
+            }
+
+            // In case if non-first data chunks comes first
+            for _, m := range t.messages {
+                if m.Ack == packet.Ack && bytes.Equal(m.packets[0].Addr, packet.Addr) {
+                    t.deleteMessage(m)
+
+                    if m.AssocMessage != nil {
+                        m.AssocMessage.setAssocMessage(nil)
+                        m.setAssocMessage(nil)
+                    }
+					for _, pkt := range m.packets {
+						// log.Println("Updating ack", parentAck, pkt.Ack)
+						pkt.UpdateAck(parentAck)
+						// Re-queue this packets
+						t.processTCPPacket(pkt)
+					}
+				}
+			}
+
+			t.ackAliases[packet.Ack] = parentAck
+			packet.UpdateAck(parentAck)
+		}
+	}
+
+	if isIncoming && packet.IsFIN {
+		if ma, ok := t.respAliases[packet.Seq]; ok {
+			if ma.packets[0].SrcPort == packet.SrcPort {
+				packet.UpdateAck(ma.Ack)
+			}
+		}
+	}
+
+	if alias, ok := t.ackAliases[packet.Ack]; ok {
+		packet.UpdateAck(alias)
+	}
+
+	message, ok := t.messages[packet.ID]
+
+	if !ok {
+		message = NewTCPMessage(packet.Seq, packet.Ack, isIncoming, t.protocol, packet.timestamp)
+		t.messages[packet.ID] = message
+
+		if !isIncoming {
+			if responseRequest != nil {
+				message.setAssocMessage(responseRequest)
+				responseRequest.setAssocMessage(message)
+			} else {
+				t.respWithoutReq[packet.Ack] = packet.ID
+			}
+		}
+	}
+
+	// Adding packet to message
+	message.AddPacket(packet)
+
+	// Handling Expect: 100-continue requests
+	if t.protocol == ProtocolHTTP && message.expectType == httpExpect100Continue && len(message.packets) == message.headerPacket+1 {
+		seq := packet.Seq + uint32(len(packet.Data))
+		t.seqWithData[seq] = packet.Ack
+
+		message.DataSeq = seq
+		message.complete = false
+
+		// In case if sequence packet came first
+		for _, m := range t.messages {
+			if m.Seq == seq {
+				t.deleteMessage(m)
+				if m.AssocMessage != nil {
+					message.setAssocMessage(m.AssocMessage)
+					m.AssocMessage.setAssocMessage(nil)
+				}
+
+				t.ackAliases[m.Ack] = packet.Ack
+
+				for _, pkt := range m.packets {
+					pkt.UpdateAck(packet.Ack)
+					message.AddPacket(pkt)
+				}
+			}
+		}
+
+		// Removing `Expect: 100-continue` header
+		packet.Data = proto.DeleteHeader(packet.Data, bExpectHeader)
+	}
+
+	// If client do sends Expect: 100-continue but do not respect server response
+	if message.expectType == httpExpect100Continue && (message.headerPacket != -1 && len(message.packets) > message.headerPacket+1) {
+		delete(t.seqWithData, message.DataSeq)
+		seq := packet.Seq + uint32(len(packet.Data))
+		t.seqWithData[seq] = packet.Ack
+		message.DataSeq = seq
+	}
+
+	if isIncoming {
+		// If message have multiple packets, delete previous alias
+		if len(message.packets) > 1 {
+			delete(t.respAliases, message.ResponseAck)
+		}
+
+		message.UpdateResponseAck()
+		t.respAliases[message.ResponseAck] = message
+	}
+
+	// If message contains only single packet immediately dispatch it
+	if message.complete {
+		// log.Println("COMPLETE!", isIncoming, message)
+		if isIncoming {
+			if t.trackResponse {
+				// log.Println("Found response!", message.ResponseID, t.messages)
+
+				if resp, ok := t.messages[message.ResponseID]; ok {
+					if resp.complete {
+						t.dispatchMessage(resp)
+					}
+
+					t.dispatchMessage(message)
+				}
+			} else {
+				t.dispatchMessage(message)
+			}
+		} else {
+			if message.AssocMessage == nil {
+				return
+			}
+
+			if req, ok := t.messages[message.AssocMessage.ID()]; ok {
+				if req.complete {
+					t.dispatchMessage(req)
+					t.dispatchMessage(message)
+				}
+			}
+		}
+	}
+}
+
+func (t *Listener) IsReady() bool {
+	select {
+	case <-t.readyCh:
+		return true
+	case <-time.After(5 * time.Second):
+		return false
+	}
+}
+
+// Receive TCP messages from the listener channel
+func (t *Listener) Receiver() chan *TCPMessage {
+	return t.messagesChan
+}
+
+func (t *Listener) Close() {
+	close(t.quit)
+	if t.conn != nil {
+		t.conn.Close()
+	}
+
+	for _, h := range t.pcapHandles {
+		h.Close()
+	}
+
+	return
+}

vendor/github.com/buger/gor-pro/raw_socket_listener/tcp_message.go

@@ -0,0 +1,520 @@
+package rawSocket
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"encoding/binary"
+	"encoding/hex"
+	"log"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/buger/gor-pro/proto"
+)
+
+var _ = log.Println
+
+type TCPProtocol uint8
+
+const (
+	ProtocolHTTP   TCPProtocol = 0
+	ProtocolBinary TCPProtocol = 1
+)
+
+// TCPMessage ensure that all TCP packets for given request is received, and processed in right sequence
+// Its needed because all TCP message can be fragmented or re-transmitted
+//
+// Each TCP Packet have 2 ids: acknowledgment - message_id, and sequence - packet_id
+// Message can be compiled from unique packets with same message_id which sorted by sequence
+// Message is received if we didn't receive any packets for 2000ms
+type TCPMessage struct {
+	Seq         uint32
+	Ack         uint32
+	ResponseAck uint32
+	ResponseID  tcpID
+	DataAck     uint32
+	DataSeq     uint32
+
+	AssocMessage *TCPMessage
+	Start        time.Time
+	End          time.Time
+	IsIncoming   bool
+
+	packets []*TCPPacket
+
+	delChan chan *TCPMessage
+
+	protocol TCPProtocol
+
+	/* HTTP specific variables */
+	methodType    httpMethodType
+	bodyType      httpBodyType
+	expectType    httpExpectType
+	seqMissing    bool
+	headerPacket  int
+	contentLength int
+	complete      bool
+}
+
+// NewTCPMessage pointer created from a Acknowledgment number and a channel of messages readuy to be deleted
+func NewTCPMessage(Seq, Ack uint32, IsIncoming bool, protocol TCPProtocol, timestamp time.Time) (msg *TCPMessage) {
+	msg = &TCPMessage{Seq: Seq, Ack: Ack, IsIncoming: IsIncoming, protocol: protocol, Start: timestamp}
+	msg.Start = time.Now()
+
+	return
+}
+
+func (t *TCPMessage) packetsData() (d [][]byte) {
+	d = make([][]byte, len(t.packets))
+	for i, p := range t.packets {
+		d[i] = p.Data
+	}
+
+	return
+}
+
+// Bytes return message content
+func (t *TCPMessage) Bytes() (output []byte) {
+	for _, p := range t.packets {
+		output = append(output, p.Data...)
+	}
+
+	return output
+}
+
+// BodySize returns total body size
+func (t *TCPMessage) BodySize() (size int) {
+	if len(t.packets) == 0 || t.headerPacket == -1 {
+		return 0
+	}
+
+	size += len(proto.Body(t.packets[t.headerPacket].Data))
+
+	for _, p := range t.packets[t.headerPacket+1:] {
+		size += len(p.Data)
+	}
+
+	return
+}
+
+// Size returns total size of message
+func (t *TCPMessage) Size() (size int) {
+	if len(t.packets) == 0 {
+		return 0
+	}
+
+	for _, p := range t.packets {
+		size += len(p.Data)
+	}
+
+	return
+}
+
+// AddPacket to the message and ensure packet uniqueness
+// TCP allows that packet can be re-send multiple times
+func (t *TCPMessage) AddPacket(packet *TCPPacket) {
+	for _, pkt := range t.packets {
+		if packet.Seq == pkt.Seq {
+			return
+		}
+	}
+
+	// Packets not always captured in same Seq order, and sometimes we need to prepend
+	if len(t.packets) == 0 || packet.Seq > t.packets[len(t.packets)-1].Seq {
+		t.packets = append(t.packets, packet)
+	} else if packet.Seq < t.packets[0].Seq {
+		t.packets = append([]*TCPPacket{packet}, t.packets...)
+		t.Seq = packet.Seq // Message Seq should indicated starting seq
+	} else { // insert somewhere in the middle...
+		for i, p := range t.packets {
+			if packet.Seq < p.Seq {
+				t.packets = append(t.packets[:i], append([]*TCPPacket{packet}, t.packets[i:]...)...)
+				break
+			}
+		}
+
+        if packet.OrigAck != 0 {
+			t.DataAck = packet.OrigAck
+		}
+
+		if packet.timestamp.Before(t.Start) || t.Start.IsZero() {
+			t.Start = packet.timestamp
+		}
+
+		if packet.timestamp.After(t.End) || t.End.IsZero() {
+			t.End = packet.timestamp
+		}
+	}
+
+	t.checkSeqIntegrity()
+
+	if t.protocol == ProtocolHTTP {
+		t.updateHeadersPacket()
+		t.updateMethodType()
+		t.updateBodyType()
+		t.check100Continue()
+		t.checkIfComplete()
+	}
+}
+
+// Check if there is missing packet
+func (t *TCPMessage) checkSeqIntegrity() {
+	if len(t.packets) == 1 {
+		t.seqMissing = false
+	}
+
+	offset := len(t.packets) - 1
+
+	if t.packets[offset].IsFIN {
+		offset--
+
+		if offset < 0 {
+			return
+		}
+	}
+
+	for i, p := range t.packets[:offset] {
+		if p.IsFIN {
+			continue
+		}
+
+		// If final packet
+		if len(t.packets) == i+1 {
+			t.seqMissing = false
+			return
+		}
+		np := t.packets[i+1]
+
+		nextSeq := p.Seq + uint32(len(p.Data))
+
+		if np.Seq != nextSeq {
+			if t.protocol == ProtocolHTTP && t.expectType == httpExpect100Continue {
+				if np.Seq != nextSeq+22 {
+					t.seqMissing = true
+					return
+				}
+			} else {
+				t.seqMissing = true
+				return
+			}
+		}
+	}
+
+	t.seqMissing = false
+}
+
+var bEmptyLine = []byte("\r\n\r\n")
+var bBR = []byte("\r\n")
+var bChunkEnd = []byte("\r\n0\r\n\r\n")
+
+func (t *TCPMessage) updateHeadersPacket() {
+	if len(t.packets) == 1 {
+		t.headerPacket = -1
+	}
+
+	if t.headerPacket != -1 {
+		return
+	}
+
+	if t.seqMissing {
+		return
+	}
+
+	for i, p := range t.packets {
+		if len(p.Data) >= len(bEmptyLine) {
+			if bytes.LastIndex(p.Data, bEmptyLine) != -1 {
+				t.headerPacket = i
+				return
+			}
+		} else if i > 0 && bytes.Equal(p.Data, bBR) {
+			idx := bytes.LastIndex(t.packets[i-1].Data, bBR)
+			if idx != -1 && idx == len(t.packets[i-1].Data)-len(bBR) {
+				t.headerPacket = i
+				return
+			}
+		}
+	}
+
+	return
+}
+
+// checkIfComplete returns true if all of the packets that compse the message arrived.
+func (t *TCPMessage) checkIfComplete() {
+	if t.seqMissing || t.headerPacket == -1 {
+		// log.Println("Seq missing", t.seqMissing, t.packets)
+		return
+	}
+
+	if t.methodType == httpMethodNotFound {
+		// log.Println("Method missing", t.methodType, t.packets)
+		return
+	}
+
+	// Responses can be emitted only if we found request
+	if !t.IsIncoming && t.AssocMessage == nil {
+		// log.Println("Assoc not found", t)
+		return
+	}
+
+	// log.Println("Found?", t)
+
+	switch t.bodyType {
+	case httpBodyEmpty:
+		t.complete = true
+	case httpBodyContentLength:
+		if t.contentLength == 0 || t.contentLength == t.BodySize() {
+			t.complete = true
+		}
+	case httpBodyChunked:
+		lastPacket := t.packets[len(t.packets)-1]
+		if bytes.LastIndex(lastPacket.Data, bChunkEnd) != -1 {
+			t.complete = true
+		}
+	default:
+		if len(t.packets) == 0 {
+			return
+		}
+
+		last := t.packets[len(t.packets)-1]
+		if last.IsFIN {
+			t.complete = true
+		}
+	}
+}
+
+type httpMethodType uint8
+
+const (
+	httpMethodNotSet   httpMethodType = 0
+	httpMethodKnown    httpMethodType = 1
+	httpMethodNotFound httpMethodType = 2
+)
+
+func (t *TCPMessage) updateMethodType() {
+	// if there is cache
+	if t.methodType != httpMethodNotSet && t.methodType != httpMethodNotFound {
+		return
+	}
+
+	d := t.packets[0].Data
+
+	// Minimum length fo request: GET / HTTP/1.1\r\n
+
+	if len(d) < 16 {
+		t.methodType = httpMethodNotFound
+		return
+	}
+
+	if t.IsIncoming {
+		if mIdx := bytes.IndexByte(d[:8], ' '); mIdx != -1 {
+			// Check that after method we have absolute or relative path
+			switch d[mIdx+1] {
+			case '/', 'h', '*':
+			default:
+				t.methodType = httpMethodNotFound
+				return
+			}
+		} else {
+			t.methodType = httpMethodNotFound
+			return
+		}
+
+		t.methodType = httpMethodKnown
+	} else {
+		if !bytes.Equal(d[:6], []byte("HTTP/1")) {
+			t.methodType = httpMethodNotFound
+			return
+		}
+
+		t.methodType = httpMethodKnown
+	}
+}
+
+type httpBodyType uint8
+
+const (
+	httpBodyNotSet          httpBodyType = 0
+	httpBodyEmpty           httpBodyType = 1
+	httpBodyContentLength   httpBodyType = 2
+	httpBodyChunked         httpBodyType = 3
+	httpBodyConnectionClose httpBodyType = 4
+)
+
+func (t *TCPMessage) updateBodyType() {
+	// if there is cache
+	if t.bodyType != httpBodyNotSet {
+		return
+	}
+
+	// Headers not received
+	if t.headerPacket == -1 {
+		return
+	}
+
+	var lengthB, encB, connB []byte
+
+	proto.ParseHeaders(t.packetsData(), func(header, value []byte) bool {
+		if proto.HeadersEqual(header, []byte("Content-Length")) {
+			lengthB = value
+			return false
+		}
+
+		if proto.HeadersEqual(header, []byte("Transfer-Encoding")) {
+			encB = value
+			return false
+		}
+
+		if proto.HeadersEqual(header, []byte("Connection")) {
+			connB = value
+		}
+
+		return true
+	})
+
+	switch t.methodType {
+	case httpMethodNotFound:
+		return
+	case httpMethodKnown:
+
+		if !t.IsIncoming &&
+			t.AssocMessage != nil &&
+			bytes.IndexByte(t.AssocMessage.Bytes(), ' ') > -1 &&
+			bytes.Equal([]byte("HEAD"), proto.Method(t.AssocMessage.Bytes())) {
+			// Need to check if this is a response to a head request,
+			// in which case the body has to be empty regardless.
+			t.bodyType = httpBodyEmpty
+			return
+		}
+
+		if len(lengthB) > 0 {
+			t.contentLength, _ = strconv.Atoi(string(lengthB))
+			if t.contentLength == 0 {
+				t.bodyType = httpBodyEmpty
+			} else {
+				t.bodyType = httpBodyContentLength
+			}
+			return
+		}
+
+		if len(encB) > 0 {
+			t.bodyType = httpBodyChunked
+			return
+		}
+
+		if len(connB) > 0 && bytes.Equal(connB, []byte("close")) {
+			t.bodyType = httpBodyConnectionClose
+			return
+		}
+	}
+
+	t.bodyType = httpBodyEmpty
+}
+
+type httpExpectType uint8
+
+const (
+	httpExpectNotSet      httpExpectType = 0
+	httpExpectEmpty       httpExpectType = 1
+	httpExpect100Continue httpExpectType = 2
+)
+
+var bExpectHeader = []byte("Expect")
+var bExpect100Value = []byte("100-continue")
+
+func (t *TCPMessage) check100Continue() {
+	if t.expectType != httpExpectNotSet || len(t.packets[0].Data) < 25 {
+		return
+	}
+
+	if t.seqMissing || t.headerPacket == -1 {
+		return
+	}
+
+	last := t.packets[len(t.packets)-1]
+	// reading last 4 bytes for double CRLF
+	if !bytes.HasSuffix(last.Data, bEmptyLine) {
+		return
+	}
+
+	var expectB []byte
+	proto.ParseHeaders(t.packetsData(), func(header, value []byte) bool {
+		if proto.HeadersEqual(header, bExpectHeader) {
+			expectB = value
+			return false
+		}
+
+		return true
+	})
+
+	if len(expectB) > 0 && bytes.Equal(bExpect100Value, expectB) {
+		t.expectType = httpExpect100Continue
+		return
+	}
+
+	t.expectType = httpExpectEmpty
+}
+
+func (t *TCPMessage) setAssocMessage(m *TCPMessage) {
+	t.AssocMessage = m
+	t.checkIfComplete()
+}
+
+// UpdateResponseAck should be called after packet is added
+func (t *TCPMessage) UpdateResponseAck() uint32 {
+	lastPacket := t.packets[len(t.packets)-1]
+	if lastPacket.IsFIN && len(t.packets) > 1 {
+		lastPacket = t.packets[len(t.packets)-2]
+	}
+
+	respAck := lastPacket.Seq + uint32(len(lastPacket.Data))
+
+	if t.ResponseAck != respAck {
+		t.ResponseAck = lastPacket.Seq + uint32(len(lastPacket.Data))
+
+		// We swappwed src and dst port
+		copy(t.ResponseID[:16], lastPacket.Addr)
+		copy(t.ResponseID[16:], lastPacket.Raw[2:4]) // Src port
+		copy(t.ResponseID[18:], lastPacket.Raw[0:2]) // Dest port
+		binary.BigEndian.PutUint32(t.ResponseID[20:24], t.ResponseAck)
+	}
+
+	return t.ResponseAck
+}
+
+func (t *TCPMessage) UUID() []byte {
+	var key []byte
+
+	if t.IsIncoming {
+		// log.Println("UUID:", t.Ack, t.Start.UnixNano())
+		key = strconv.AppendInt(key, t.Start.UnixNano(), 10)
+		key = strconv.AppendUint(key, uint64(t.Ack), 10)
+	} else {
+		// log.Println("RequestMessage:", t.AssocMessage.Ack, t.AssocMessage.Start.UnixNano())
+		key = strconv.AppendInt(key, t.AssocMessage.Start.UnixNano(), 10)
+		key = strconv.AppendUint(key, uint64(t.AssocMessage.Ack), 10)
+	}
+
+	uuid := make([]byte, 40)
+	sha := sha1.Sum(key)
+	hex.Encode(uuid, sha[:20])
+
+	return uuid
+}
+
+func (t *TCPMessage) ID() tcpID {
+	return t.packets[0].ID
+}
+
+func (t *TCPMessage) IP() net.IP {
+	return net.IP(t.packets[0].Addr)
+}
+
+func (t *TCPMessage) String() string {
+	return strings.Join([]string{
+		"Len packets: " + strconv.Itoa(len(t.packets)),
+		"Data size:" + strconv.Itoa(len(t.Bytes())),
+		"Data:" + string(t.Bytes()),
+	}, "\n")
+}

vendor/github.com/buger/gor-pro/raw_socket_listener/tcp_packet.go

@@ -0,0 +1,133 @@
+package rawSocket
+
+import (
+	"encoding/binary"
+	"log"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var _ = log.Println
+
+// TCP Flags
+const (
+	fFIN = 1 << iota
+	fSYN
+	fRST
+	fPSH
+	fACK
+	fURG
+	fECE
+	fCWR
+	fNS
+)
+
+type tcpID [24]byte
+
+// TCPPacket provides tcp packet parser
+// Packet structure: http://en.wikipedia.org/wiki/Transmission_Control_Protocol
+type TCPPacket struct {
+	SrcPort    uint16
+	DestPort   uint16
+	Seq        uint32
+	Ack        uint32
+	OrigAck    uint32
+	DataOffset uint8
+	IsFIN      bool
+
+	Raw       []byte
+	Data      []byte
+	Addr      []byte
+	timestamp time.Time
+	ID        tcpID
+}
+
+// ParseTCPPacket takes address and tcp payload and returns parsed TCPPacket
+func ParseTCPPacket(addr []byte, data []byte, timestamp time.Time) (p *TCPPacket) {
+	p = &TCPPacket{Raw: data}
+	p.ParseBasic()
+	p.Addr = addr
+	p.timestamp = timestamp
+	p.GenID()
+
+	return
+}
+
+func (p *TCPPacket) GenID() {
+	copy(p.ID[:16], p.Addr)
+	copy(p.ID[16:], p.Raw[0:2])  // Src port
+	copy(p.ID[18:], p.Raw[2:4])  // Dest port
+	copy(p.ID[20:], p.Raw[8:12]) // Ack
+}
+
+func (p *TCPPacket) UpdateAck(ack uint32) {
+	p.OrigAck = p.Ack
+	p.Ack = ack
+	binary.BigEndian.PutUint32(p.Raw[8:12], ack)
+	p.GenID()
+}
+
+// ParseBasic set of fields
+func (t *TCPPacket) ParseBasic() {
+	t.DestPort = binary.BigEndian.Uint16(t.Raw[2:4])
+	t.SrcPort = binary.BigEndian.Uint16(t.Raw[0:2])
+	t.Seq = binary.BigEndian.Uint32(t.Raw[4:8])
+	t.Ack = binary.BigEndian.Uint32(t.Raw[8:12])
+	t.DataOffset = (t.Raw[12] & 0xF0) >> 4
+	t.IsFIN = t.Raw[13]&0x01 != 0
+
+	if len(t.Raw) >= int(t.DataOffset*4) {
+		t.Data = t.Raw[t.DataOffset*4:]
+	}
+}
+
+func (t *TCPPacket) dump() *packet {
+
+	packetSrcIP := make([]byte, 16)
+	packetData := make([]byte, len(t.Data)+16)
+
+	copy(packetSrcIP, t.Addr)
+
+	binary.BigEndian.PutUint16(packetData[0:2], t.SrcPort)
+	binary.BigEndian.PutUint16(packetData[2:4], t.DestPort)
+
+	binary.BigEndian.PutUint32(packetData[4:8], t.Seq)
+	binary.BigEndian.PutUint32(packetData[8:12], t.Ack)
+
+	packetData[12] = 64
+
+	if t.IsFIN {
+		packetData[13] = packetData[13] | 0x01
+	}
+
+	copy(packetData[16:], t.Data)
+
+	return &packet{
+		srcIP:     packetSrcIP,
+		data:      packetData,
+		timestamp: t.timestamp,
+	}
+
+}
+
+// String output for a TCP Packet
+func (t *TCPPacket) String() string {
+	maxLen := len(t.Data)
+	if maxLen > 200 {
+		maxLen = 200
+	}
+
+	return strings.Join([]string{
+		"Addr: " + string(t.Addr),
+		"Source port: " + strconv.Itoa(int(t.SrcPort)),
+		"Dest port:" + strconv.Itoa(int(t.DestPort)),
+		"Sequence:" + strconv.Itoa(int(t.Seq)),
+		"Acknowledgment:" + strconv.Itoa(int(t.Ack)),
+		"Header len:" + strconv.Itoa(int(t.DataOffset)),
+		"FIN:" + strconv.FormatBool(t.IsFIN),
+
+		"Data size:" + strconv.Itoa(len(t.Data)),
+		"Data:" + string(t.Data[:maxLen]),
+	}, "\n")
+}