Overview of GOREPLAY source code analysis

GOREPLAY is an application for network traffic forwarding. The previous name was GOR. The author on GITHUB introduced it. More precisely, it should be HTTP traffic forwarding. The author's goal should be the forwarding of WEB-type applications on the intranet, because HTTP is an application It has a wide range of protocols and is standard, so forwarding applications written from this perspective can be used in most scenarios. This will also bring certain problems. Suppose we want to forward other protocol types. At this time, we need to encode and identify the boundary of the protocol before forwarding.
GOREPLAY is written in GO language and uses a series of GO tools, such as operating pcap, kafka, etc. The premise of running goreplay also needs to install tools such as pcap, and you need to be rooted to open the promiscuous mode of the network card and monitor all tcp packets on the specified port. The workflow of GOREPLAY:
1. Use the go interface of pcap, use bpf (Berkeley Packet Filter) to set the filter expression of the specified port, bpf can refer to the expression of the tcpdump tool, and bpf is also used behind the tcpdump command.
2. After intercepting the tcp message, assemble the message according to the network quintuple (another noun, <source IP, source port, destination IP, destination port, protocol>, the protocol field is not used in the actual program) as the key. Because HTTP is based on the TCP protocol, the integrity of a call packet is identified according to the ACK and SEQ in the TCP protocol. If you want to understand the code, you need to have a certain understanding of the TCP protocol message format and the HTTP protocol format. In addition to ordinary HTTP protocol messages, you also need to understand the relatively rare messages such as CHUNKED.
3. After assembling one or more TCP packets of an HTTP call, if it is recognized that the HTTP protocol packets have ended, you can enter the forwarding stage. After forwarding, the data segments in these packets are assembled, and the data is directly sent to the command line. The specified port sends TCP packets to complete the forwarding.