diff --git a/.gitignore b/.gitignore index a3fff0945362c1be757831723bb78a5b6b0bf875..873cb0404716cea333464ee83a1dd03dee24c0af 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,4 @@ gocanary +cert.key +cert.pem + diff --git a/alert/alert.go b/alert/alert.go index 4ba3f8154f0778328913f7ed09c5a5083a8d8b6d..4841efb815496b7a9de5d9550f91a56df2523aed 100644 --- a/alert/alert.go +++ b/alert/alert.go @@ -26,12 +26,15 @@ type Canary struct { Tag string Level string Type string + Time string } type HTTPCanary struct { Canary - RemoteAddr string - LocalAddr string + RemoteIP string + RemotePort uint16 + LocalIP string + LocalPort uint16 UserAgent string FullUrl string Referer string @@ -39,8 +42,10 @@ type HTTPCanary struct { type DNSCanary struct { Canary - RemoteAddr string - LocalAddr string + RemoteIP string + RemotePort uint16 + LocalIP string + LocalPort uint16 Proto string } @@ -111,8 +116,10 @@ func HTTPAlert(canaryinfo HTTPCanary, alertType string) { "Level", canaryinfo.Canary.Level, "FullUrl", canaryinfo.FullUrl, "UserAgent", canaryinfo.UserAgent, - "RemoteAddr", canaryinfo.RemoteAddr, - "LocalAddr", canaryinfo.LocalAddr, + "RemoteIP", canaryinfo.RemoteIP, + "RemotePort", canaryinfo.RemotePort, + "LocalIP", canaryinfo.LocalIP, + "LocalPort", canaryinfo.LocalPort, "Referer", canaryinfo.Referer, "Type", "token-http", ) @@ -135,8 +142,10 @@ func DNSAlert(canaryinfo DNSCanary, alertType string) { "Key", canaryinfo.Canary.Key, "Tag", canaryinfo.Canary.Tag, "Level", canaryinfo.Canary.Level, - "RemoteAddr", canaryinfo.RemoteAddr, - "LocalAddr", canaryinfo.LocalAddr, + "RemoteIP", canaryinfo.RemoteIP, + "RemotePort", canaryinfo.RemotePort, + "LocalIP", canaryinfo.LocalIP, + "LocalPort", canaryinfo.LocalPort, "Type", "token-dns", ) } diff --git a/server/dns/dns.go b/server/dns/dns.go index 90b511fbf3e9592ff7d26f8ce246f1d34cc51c0d..56186e25aee0300117ac8d4b0242d6a13e701062 100644 --- a/server/dns/dns.go +++ b/server/dns/dns.go @@ -4,8 +4,11 @@ import ( "fmt" "log" "log/slog" + "net" "slices" + "strconv" "strings" + "time" "github.com/miekg/dns" "gitlab.cern.ch/ComputerSecurity/gocanary/alert" @@ -22,15 +25,31 @@ type DNSServerConfig struct { var serverConfig DNSServerConfig func getCanaryInfo(t tokens.CanaryRecord, w dns.ResponseWriter) alert.DNSCanary { + + rIP, rPortStr, err := net.SplitHostPort(w.RemoteAddr().String()) + if err != nil { + rIP = w.RemoteAddr().String() + } + rPort, _ := strconv.Atoi(rPortStr) + + lIP, lPortStr, err := net.SplitHostPort(w.LocalAddr().String()) + if err != nil { + lIP = w.LocalAddr().String() + } + lPort, _ := strconv.Atoi(lPortStr) + return alert.DNSCanary{ Canary: alert.Canary{ Key: t.Key, Tag: t.Tag, Level: t.Level, Type: "token-dns", + Time: time.Now().Format(time.RFC3339), }, - RemoteAddr: w.RemoteAddr().String(), - LocalAddr: w.LocalAddr().String(), + RemoteIP: rIP, + RemotePort: uint16(rPort), + LocalIP: lIP, + LocalPort: uint16(lPort), Proto: w.RemoteAddr().Network(), } } @@ -52,10 +71,15 @@ func checkAndAlert(q dns.Question, w dns.ResponseWriter, r *dns.Msg) bool { } func logRequest(q dns.Question, w dns.ResponseWriter) { + rIP, rPortStr, err := net.SplitHostPort(w.RemoteAddr().String()) + if err != nil { + rIP = w.RemoteAddr().String() + } slog.Info("dns-request", "Type", "dns-request", "Query", q.Name, - "RemoteAddr", w.RemoteAddr().String(), + "RemoteIP", rIP, + "RemotePort", rPortStr, ) } diff --git a/server/http/http.go b/server/http/http.go index 3bf1a09e8fea8206f11575b1d9bb4eb5866616ad..0c00381e787e1ba7b5cd65b1d4b3e8392e661fc4 100644 --- a/server/http/http.go +++ b/server/http/http.go @@ -9,6 +9,7 @@ import ( "net/http" "path" "slices" + "strconv" "strings" "time" @@ -43,23 +44,40 @@ func getSchema(r *http.Request) string { // Returns full URL of request, including schema func getFullUrl(r *http.Request) string { - return fmt.Sprintf("%s://%s%s", getSchema(r), r.Host, r.URL.Path) + return fmt.Sprintf("%s://%s%s", getSchema(r), r.Host, r.URL.EscapedPath()) } // Builds the canary alert info func getCanaryInfo(t tokens.CanaryRecord, r *http.Request) alert.HTTPCanary { + + rIP, rPortStr, err := net.SplitHostPort(r.RemoteAddr) + if err != nil { + rIP = r.RemoteAddr + } + rPort, _ := strconv.Atoi(rPortStr) + + lAddr := r.Context().Value(http.LocalAddrContextKey).(net.Addr).String() + lIP, lPortStr, err := net.SplitHostPort(lAddr) + if err != nil { + lIP = lAddr + } + lPort, _ := strconv.Atoi(lPortStr) + return alert.HTTPCanary{ Canary: alert.Canary{ Key: t.Key, Tag: t.Tag, Level: t.Level, Type: "token-http", + Time: time.Now().Format(time.RFC3339), }, UserAgent: r.UserAgent(), FullUrl: getFullUrl(r), Referer: r.Header.Get("Referer"), - RemoteAddr: r.RemoteAddr, - LocalAddr: r.Context().Value(http.LocalAddrContextKey).(net.Addr).String(), + RemoteIP: rIP, + RemotePort: uint16(rPort), + LocalIP: lIP, + LocalPort: uint16(lPort), } } @@ -81,6 +99,10 @@ func getNormalizedHostDomain(rHost string) (string, string) { // Log all requests func logRequest(r *http.Request) { + rIP, rPortStr, err := net.SplitHostPort(r.RemoteAddr) + if err != nil { + rIP = r.RemoteAddr + } slog.Info("http-request", "Type", "http-request", "Uri", r.RequestURI, @@ -88,7 +110,8 @@ func logRequest(r *http.Request) { "Method", r.Method, "Host", r.Host, "UserAgent", r.UserAgent(), - "RemoteAddr", r.RemoteAddr, + "RemoteIP", rIP, + "RemotePort", rPortStr, "Referer", r.Header.Get("Referer"), ) }