aoandon 0.0.1

data/.gitattributes

@@ -0,0 +1,10 @@
+# Set default behaviour, in case users don't have core.autocrlf set.
+* text=auto
+
+# Explicitly declare text files we want to always be normalized and converted 
+# to native line endings on checkout.
+*.rb text
+
+# Denote all files that are truly binary and should not be modified.
+*.png binary
+*.jpg binary

data/.gitignore

@@ -0,0 +1,19 @@
+*.gem
+*.rbc
+.bundle
+.config
+.DS_Store
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+log/*
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.rbenv-version

@@ -0,0 +1 @@
+1.9.3-p194

data/Gemfile

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+
+gemspec
+
+gem 'pcap', '~> 0.7.0'

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2012 Cyril Wack
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,296 @@
+# Aoandon
+
+Aoandon (青行燈) is a minimalist network intrusion detection system (NIDS).
+
+![Blue andon creature](https://raw.github.com/cyril/aoandon/master/blue-andon-creature.jpg)
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'aoandon'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install aoandon
+
+## Usage
+
+Aoandon NIDS is the selective ignoring or alerting of data packets as they pass through its network interface.  The criteria that it uses when inspecting packets are based on the Layer 3 (IPv4 and IPv6) and Layer 4 (TCP, UDP) headers.  The most often used criteria are source and destination address, source and destination port, and protocol.
+
+Rules specify the criteria that a packet must match and the resulting action, either pass or alert, that is taken when a match is found.  Rules are evaluated in sequential order, first to last.  Unless the packet matches a rule containing the `quick` keyword, the packet will be evaluated against all rules before the final action is taken.  The last rule to match is the *winner* and will dictate what action to take on the packet.  There is an implicit pass all at the beginning of a ruleset meaning that if a packet does not match any rule the resulting action will be pass.
+
+Both static and dynamic ruleset can be applied to packets.
+
+### Static ruleset
+
+Aoandon NIDS reads its configuration rules from `config/rules.yml` at boot time.  In order to be able to load rules, this JSON/YAML file must have at least a `rules` key.
+
+#### Rule syntax
+
+The general syntax for static rules is:
+
+1. action
+2. context
+3. options
+
+Where *action* can use as a logger level such as INFO or ERROR that indicate alerts' importance.  Note: the `pass` action will ignore the packet back to the kernel for further processing while any other action will react.
+
+Every *context* params are evaluated for analysis to determine whether a given package matches.
+
+The last part, *options*, can be:
+
+* `log`: specifies that the packet should be logged.
+* `quick`: if a packet matches a rule specifying `quick`, then that rule is considered the last matching rule and the specified action is taken.
+* `msg`: tells the alerting engine the message to print to an alert.
+
+#### Default alert
+
+The recommended practice when setting up a NIDS is to take a "default alert" approach.  That is, to alert everything and then selectively allow certain traffic through the interface.  This approach is recommended because it errs on the side of caution and also makes writing a ruleset easier.
+
+To create a default alert sniffer policy, the first rules should be:
+
+```yaml
+[ info, {}, {log: true, msg: "Suspected packet!"} ]
+```
+
+This will alert all traffic on the given interface in either direction from anywhere to anywhere.
+
+#### The `quick` keyword
+
+As indicated earlier, each packet is evaluated against the sniffer ruleset from top to bottom.  By default, the packet is marked for passage, which can be changed by any rule, and could be changed back and forth several times before the end of the sniffer rules.  The last matching rule *wins*.  There is an exception to this: the `quick` option on a sniffing rule has the effect of canceling any further rule processing and causes the specified action to be taken.  Let's look at a couple examples:
+
+Wrong:
+
+```yaml
+- [ crit, {proto: tcp, to: {port: 22}}, {msg: "...SSH?", log: true} ]
+- [ pass, {} ]
+```
+
+In this case, the alert line may be evaluated, but will never have any effect, as it is then followed by a line which will ignore everything.
+
+Better:
+
+```yaml
+- [ crit, {proto: tcp, to: {port: 22}}, {msg: "...SSH?", log: true, quick: true} ]
+- [ pass, {} ]
+```
+
+These rules are evaluated a little differently.  If the alert line is matched, due to the `quick` option, the packet will be reported, and the rest of the ruleset will be ignored.
+
+#### Ruleset example
+
+```yaml
+hosts:
+  - &honeypots [ 192.168.1.4, 192.168.1.9 ]
+  - &my_station 192.168.1.38
+
+rules:
+  # "default alert" approach
+  - [ info, {}, {log: true, msg: "Suspected packet!"} ]
+
+  # then, selectively ignore certain traffic
+  - [ warn, {to: {addr: *honeypots}}, {msg: "Touché.", quick: true, log: true} ]
+  - [ pass, {from: {addr: *my_station}} ]
+  - [ pass, {to: {addr: *my_station}} ]
+  - [ pass, {to: {addr: '224.0.0.1'}} ]
+```
+
+#### A more complete ruleset example
+
+```yaml
+macros:
+  web_server: &web_server
+    114.21.70.71
+  gateway: &gw
+    192.168.0.1
+
+tables:
+  redzone: &redzone
+    - "81.15.142.23"
+  hacker: &id001
+    - 81.15.142.23
+    - 42.154.25.213
+  blacklist: &blacklist
+    - *id001
+    - *gw
+    - 81.15.142.23
+    - "64.81.240.57"
+  unknown:
+    - any
+  mz: &mz
+    192.168.0.201
+  dmz: &dmz
+    sql_server: &sql_server
+      10.0.0.2
+
+ports:
+  web: &www
+    - 80
+    - 443
+  p2p:
+    - 63192
+
+messages:
+  - &msg001 "ICMP packet from Google to MZ"
+  - &msg002 "MZ intrusion detected!"
+
+rules:
+  # "default alert" approach
+  - [ info, {}, {quick: true, log: true, msg: "Suspected packet!"} ]
+
+  # then, selectively ignore certain traffic
+  - [ pass, {af: inet, from: {addr: any}, to: {addr: any}} ]
+  - [ warn, {proto: tcp, from: {addr: *blacklist}, to: {addr: any, port: *www}, flags: syn} ]
+  - [ warn, {proto: tcp, from: {addr: any, port: 123}, to: {addr: *dmz}} ]
+  - [ crit, {af: inet6, from: {addr: any}, to: {addr: any}}, {log: true} ]
+  - [ pass, {af: inet, proto: tcp, from: {addr: *mz}, to: {addr: *web_server, port: *www}, {quick: true}} ]
+  - [ warn, {proto: udp, from: {addr: *redzone}, to: {addr: 10.1.0.32, port: 21}} ]
+  - [ info, {proto: tcp, from: {addr: 172.16.0.6}, to: {addr: 192.168.0.14, port: 22}} ]
+  - [ crit, {proto: tcp, from: {addr: *blacklist}, to: {addr: *mz}}, {log: true, msg: *msg002} ]
+  - [ info, {proto: tcp, to: {addr: 192.168.0.14, port: 22}} ]
+  - [ pass, {proto: tcp, from: {addr: *id001}, to: {addr: *sql_server, port: 3306}} ]
+  - [ info, {af: inet, proto: icmp, from: {addr: google.com}, to: {addr: *mz}}, {log: true, msg: *msg001} ]
+```
+
+### Dynamic ruleset
+
+Some semantic analysis can also be done through Aoandon NIDS extensions, using modules such as:
+
+```ruby
+# lib/aoandon/dynamic_rule/less1024.rb
+module Aoandon
+  module DynamicRule
+    module Less1024
+      MESSAGE = 'Port numbers < 1024'
+      PROTO_TCP = 6
+      PROTO_UDP = 17
+      WELL_KNOWN_PORTS = (0..1023)
+
+      def self.control?(packet)
+        (tcp?(packet) || (udp?(packet) && different_ports?(packet.sport, packet.dport))) && 
+          less_1024?(packet.sport) && less_1024?(packet.dport)
+      end
+
+      def self.logging?(packet)
+        false
+      end
+
+      private
+
+      def self.different_ports?(src_port, dst_port)
+        src_port != dst_port
+      end
+
+      def self.less_1024?(port)
+        WELL_KNOWN_PORTS.include?(port)
+      end
+
+      def self.tcp?(packet)
+        packet.ip_proto == PROTO_TCP
+      end
+
+      def self.udp?(packet)
+        packet.ip_proto == PROTO_UDP
+      end
+    end
+  end
+end
+```
+
+```ruby
+# lib/aoandon/dynamic_rule/more_fragments.rb
+module Aoandon
+  module DynamicRule
+    module MoreFragments
+      MESSAGE = 'More Fragment bit is set'
+
+      def self.control?(packet)
+        packet.ip_mf?
+      end
+
+      def self.logging?(packet)
+        false
+      end
+    end
+  end
+end
+```
+
+```ruby
+# lib/aoandon/dynamic_rule/same_ip.rb
+module Aoandon
+  module DynamicRule
+    module SameIp
+      LOCALHOST = '127.0.0.1'
+      MESSAGE = 'Same IP'
+
+      def self.control?(packet)
+        packet.ip_src == packet.ip_dst && !loopback?(packet.ip_src)
+      end
+
+      def self.logging?(packet)
+        false
+      end
+
+      private
+
+      def self.loopback?(ip_addr)
+        ip_addr.to_num_s == LOCALHOST
+      end
+    end
+  end
+end
+```
+
+```ruby
+# lib/aoandon/dynamic_rule/syn_flood.rb
+module Aoandon
+  module DynamicRule
+    module SynFlood
+      BUFFER = 20
+      MESSAGE = 'SYN flood attack'
+      PROTO_TCP = 6
+
+      def self.control?(packet)
+        tcp?(packet) && fifo!(packet.tcp_syn?) && packet.tcp_syn? && overflow?
+      end
+
+      def self.logging?(packet)
+        false
+      end
+
+      private
+
+      def self.fifo!(input)
+        stack << input
+        stack.shift
+      end
+
+      def self.overflow?
+        stack == [true] * BUFFER
+      end
+
+      def self.stack
+        @syn_flood_stack ||= [false] * BUFFER
+      end
+
+      def self.tcp?(packet)
+        packet.ip_proto == PROTO_TCP
+      end
+    end
+  end
+end
+```
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request

data/Rakefile

@@ -0,0 +1 @@
+require 'bundler/gem_tasks'

data/aoandon.gemspec

@@ -0,0 +1,22 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'aoandon/version'
+
+Gem::Specification.new do |gem|
+  gem.name          = 'aoandon'
+  gem.version       = Aoandon::VERSION
+  gem.authors       = ['Cyril Wack']
+  gem.email         = ['contact@cyril.io']
+  gem.description   = %q{Aoandon (青行燈) is a minimalist network intrusion detection system (NIDS).}
+  gem.summary       = %q{Minimalist network intrusion detection system (NIDS).}
+  gem.homepage      = 'http://cyril.io'
+  gem.license       = 'MIT'
+
+  gem.bindir        = 'bin'
+
+  gem.files         = `git ls-files`.split($/).reject {|f| f == 'blue-andon-creature.jpg' }
+  gem.executables   = gem.files.grep(%r{^bin/}).map {|f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ['lib', 'config']
+end

data/bin/aoandon

@@ -0,0 +1,10 @@
+#!/usr/bin/env ruby
+
+require 'ipaddr'
+require 'optparse'
+require 'pcap'
+require 'time'
+require 'yaml'
+require_relative '../lib/aoandon'
+
+Aoandon::Nids.new.run

data/config/rules.yml

@@ -0,0 +1,54 @@
+# Aoandon NIDS configuration file
+---
+#macros:
+#  web_server: &web_server
+#    114.21.70.71
+#  gateway: &gw
+#    192.168.0.1
+
+#tables:
+#  redzone: &redzone
+#    - "81.15.142.23"
+#  hacker: &id001
+#    - 81.15.142.23
+#    - 42.154.25.213
+#  blacklist: &blacklist
+#    - *id001
+#    - *gw
+#    - 81.15.142.23
+#    - "64.81.240.57"
+#  unknown:
+#    - any
+#  mz: &mz
+#    192.168.0.201
+#  dmz: &dmz
+#    sql_server: &sql_server
+#      10.0.0.2
+
+#ports:
+#  web: &www
+#    - 80
+#    - 443
+#  p2p:
+#    - 63192
+
+#messages:
+#  - &msg001 "ICMP packet from Google to MZ"
+#  - &msg002 "MZ intrusion detected!"
+
+rules:
+#  # "default alert" approach
+#  - [ info, {}, {quick: true, log: true, msg: "Suspected packet!"} ]
+#
+#  # then, selectively ignore certain traffic
+#  - [ pass, {af: inet, from: {addr: any}, to: {addr: any}} ]
+#  - [ warn, {proto: tcp, from: {addr: *blacklist}, to: {addr: any, port: *www}, flags: syn} ]
+#  - [ warn, {proto: tcp, from: {addr: any, port: 123}, to: {addr: *dmz}} ]
+#  - [ crit, {af: inet6, from: {addr: any}, to: {addr: any}}, {log: true} ]
+#  - [ pass, {af: inet, proto: tcp, from: {addr: *mz}, to: {addr: *web_server, port: *www}, {quick: true}} ]
+#  - [ warn, {proto: udp, from: {addr: *redzone}, to: {addr: 10.1.0.32, port: 21}} ]
+#  - [ info, {proto: tcp, from: {addr: 172.16.0.6}, to: {addr: 192.168.0.14, port: 22}} ]
+#  - [ crit, {proto: tcp, from: {addr: *blacklist}, to: {addr: *mz}}, {log: true, msg: *msg002} ]
+#  - [ info, {proto: tcp, to: {addr: 192.168.0.14, port: 22}} ]
+#  - [ pass, {proto: tcp, from: {addr: *id001}, to: {addr: *sql_server, port: 3306}} ]
+#  - [ info, {af: inet, proto: icmp, from: {addr: google.com}, to: {addr: *mz}}, {log: true, msg: *msg001} ]

data/lib/aoandon.rb

@@ -0,0 +1,64 @@
+require_relative 'aoandon/analysis'
+require_relative 'aoandon/analysis/semantic'
+require_relative 'aoandon/analysis/syntax'
+require_relative 'aoandon/error/not_implemented_error'
+require_relative 'aoandon/log'
+require_relative 'aoandon/static_rule'
+require_relative 'aoandon/version'
+
+Dir['lib/aoandon/dynamic_rule/*.rb'].each do |src|
+  load src
+end
+
+module Aoandon
+  class Nids
+    CONF_PATH = 'config/rules.yml'
+
+    def initialize
+      options = Nids.parse
+      options[:file] = CONF_PATH unless options[:file]
+      options[:interface] = Pcap.lookupdev unless options[:interface]
+      puts "Starting Aoandon NIDS on interface #{options[:interface]}..."
+      log = Log.new(options[:verbose])
+      @syntax = Syntax.new(log, {file: options[:file]})
+      @semantic = Semantic.new(log)
+      @network_interface = Pcap::Capture.open_live(options[:interface])
+    end
+
+    def run
+      puts 'You can stop Aoandon NIDS by pressing Ctrl-C.'
+
+      @network_interface.each_packet do |packet|
+        if packet.ip?
+          @semantic.test(packet)
+          @syntax.test(packet)
+        end
+      end
+
+      @network_interface.close
+    end
+
+    def self.parse
+      options = {}
+
+      OptionParser.new do |opts|
+        opts.banner = "Usage: #$0 [options]"
+        opts.on('-f', '--file <path>', 'Load the rules contained in file <path>.') {|f| options[:file] = f }
+        opts.on('-h', '--help', 'Help.') { puts opts; exit }
+        opts.on('-i', '--interface <if>', 'Sniff on network interface <if>.') {|i| options[:interface] = i }
+        opts.on('-v', '--verbose', 'Produce more verbose output.') { options[:verbose] = true }
+        opts.on('-V', '--version', 'Show the version number and exit.') { version; exit }
+      end.parse!
+
+      options
+    end
+
+    def self.version
+      puts "Aoandon #{VERSION}"
+    end
+
+    trap('INT') { exit }
+    at_exit { print 'Stopping Aoandon NIDS... ' }
+    ObjectSpace.define_finalizer('string', proc { puts 'done.' })
+  end
+end

data/lib/aoandon/analysis.rb

@@ -0,0 +1,11 @@
+module Aoandon
+  class Analysis
+    def initialize(logger, options = {})
+      @logger = logger
+    end
+
+    def update(packet = '')
+      raise NotImplementedError, 'Must subclass me'
+    end
+  end
+end

data/lib/aoandon/analysis/semantic.rb

@@ -0,0 +1,26 @@
+module Aoandon
+  class Semantic < Analysis
+    def initialize(logger, options = {})
+      super(logger, options)
+
+      puts "Modules:  #{DynamicRule.constants.join(', ')}"
+    end
+
+    def test(packet)
+      if defined? DynamicRule
+        DynamicRule.constants.each do |rule|
+          if DynamicRule.const_get(rule).control?(packet)
+            dump = DynamicRule.const_get(rule).logging?(packet) ? packet : nil
+            message = if DynamicRule.const_get(rule).constants.include?(:MESSAGE)
+              DynamicRule.const_get(rule)::MESSAGE
+            else
+              nil
+            end
+
+            @logger.message(packet.time.iso8601, 'SEMANT', rule.downcase, message, dump)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aoandon/analysis/syntax.rb

@@ -0,0 +1,155 @@
+module Aoandon
+  class Syntax < Analysis
+    def initialize(logger, options = {})
+      super(logger, options)
+
+      abort("Configuration file not found: #{options[:file]}") unless File.exist?(options[:file])
+      @rules = Array(YAML::load_file(options[:file])['rules']).map {|rule| StaticRule.new(*rule) }
+
+      puts "Ruleset:  #{File.expand_path(options[:file])}"
+    end
+
+    def test(packet)
+      @rules.each do |rule|
+        if match?(packet, rule.context)
+          break if (@last_rule = rule).options['quick']
+        end
+      end
+
+      if @last_rule && @last_rule.action != 'pass'
+        message = @last_rule.options['msg'] || 'Bad packet detected!'
+        dump = @last_rule.options['log'] ? packet : nil
+        @logger.message(packet.time.iso8601, 'SYNTAX', @last_rule.action, message, dump)
+      end
+    end
+
+    protected
+
+    def match?(packet, network_context)
+      network_context.update({'af' => af2id(packet.ip_ver)}) unless network_context.has_key?('af')
+      match_proto?(packet, network_context) if packet.ip_ver == af(network_context.fetch('af'))
+    end
+
+    def af2id(af)
+      if af == 4
+        'inet'
+      elsif af == 6
+        'inet6'
+      end
+    end
+
+    def af(name)
+      if name.to_sym == :inet
+        4
+      elsif name.to_sym == :inet6
+        6
+      end
+    end
+
+    def match_proto?(packet, network_context)
+      if network_context['proto']
+        if packet.ip_proto == proto(network_context['proto'])
+          if packet.ip_proto == 1
+            match_proto_icmp?(packet, network_context)
+          elsif packet.ip_proto == 6
+            match_proto_tcp?(packet, network_context)
+          elsif packet.ip_proto == 17
+            match_proto_udp?(packet, network_context)
+          elsif packet.ip_proto == 58
+            match_proto_icmp6?(packet, network_context)
+          else
+            match_addr?(packet, network_context)
+          end
+        end
+      else
+        match_addr?(packet, network_context)
+      end
+    end
+
+    def proto(name)
+      if name.to_sym == :icmp
+        1
+      elsif name.to_sym == :icmp6
+        58
+      elsif name.to_sym == :tcp
+        6
+      elsif name.to_sym == :udp
+        17
+      end
+    end
+
+    def match_proto_icmp?(packet, network_context)
+      match_addr?(packet, network_context)
+    end
+
+    def match_proto_icmp6?(packet, network_context)
+      match_proto_icmp?(packet, network_context)
+    end
+
+    def match_addr?(packet, network_context)
+      result = true
+
+      [['from', 'src'], ['to', 'dst']].each do |way, obj|
+        unless network_context[way].fetch('addr') == 'any'
+          result = result && refer2addr?((packet.send(obj)), network_context[way].fetch('addr'))
+        end
+      end
+
+      result
+    end
+
+    def match_port?(packet, network_context)
+      result = true
+
+      [['from', 'sport'], ['to', 'dport']].each do |way, obj|
+        if network_context[way].has_key?('port')
+          result = result && refer2port?((packet.send(obj)).to_i, network_context[way].fetch('port'))
+        end
+      end
+
+      result
+    end
+
+    def match_flag?(packet, network_context)
+      return true unless network_context['flags']
+
+      network_context['flags'].each do |flag|
+        return true if packet.send("tcp_#{flag}?")
+      end
+
+      false
+    end
+
+    def match_proto_tcp?(packet, network_context)
+      match_proto_udp?(packet, network_context) && match_flag?(packet, network_context)
+    end
+
+    def match_proto_udp?(packet, network_context)
+      match_addr?(packet, network_context) && match_port?(packet, network_context)
+    end
+
+    def refer2addr?(addr, pattern)
+      if pattern.is_a? Array
+        pattern.include?(addr.to_num_s) || pattern.include?(addr.hostname)
+      elsif pattern.is_a? Hash
+        pattern.has_key?(addr.to_num_s) || pattern.has_key?(addr.hostname)
+      elsif pattern.is_a? String
+        addr.to_num_s == pattern        || addr.hostname == pattern
+      else
+        false
+      end
+    end
+
+    def refer2port?(number, pattern)
+      if pattern.is_a? Array
+        pattern.include?(number)
+      elsif pattern.is_a? Hash
+        pattern.has_key?(number)
+      elsif pattern.is_a? Fixnum
+        number == pattern
+      else
+        false
+      end
+    end
+  end
+end

data/lib/aoandon/dynamic_rule/less1024.rb

@@ -0,0 +1,37 @@
+module Aoandon
+  module DynamicRule
+    module Less1024
+      MESSAGE = 'Port numbers < 1024'
+      PROTO_TCP = 6
+      PROTO_UDP = 17
+      WELL_KNOWN_PORTS = (0..1023)
+
+      def self.control?(packet)
+        (tcp?(packet) || (udp?(packet) && different_ports?(packet.sport, packet.dport))) && 
+          less_1024?(packet.sport) && less_1024?(packet.dport)
+      end
+
+      def self.logging?(packet)
+        false
+      end
+
+      private
+
+      def self.different_ports?(src_port, dst_port)
+        src_port != dst_port
+      end
+
+      def self.less_1024?(port)
+        WELL_KNOWN_PORTS.include?(port)
+      end
+
+      def self.tcp?(packet)
+        packet.ip_proto == PROTO_TCP
+      end
+
+      def self.udp?(packet)
+        packet.ip_proto == PROTO_UDP
+      end
+    end
+  end
+end

data/lib/aoandon/error/not_implemented_error.rb

@@ -0,0 +1,4 @@
+module Aoandon
+  class NotImplementedError < StandardError
+  end
+end

data/lib/aoandon/log.rb

@@ -0,0 +1,16 @@
+module Aoandon
+  class Log
+    def initialize(verbose = false)
+      @file = File.open('log/aoandon.yml', 'a')
+      @verbose = verbose
+
+      puts "Log file: #{File.expand_path(@file.path)}"
+    end
+
+    def message(*args)
+      puts args.compact.map(&:to_s).join(' | ') if @verbose
+      @file.puts "- #{args.compact.map(&:to_s)}"
+      @file.flush
+    end
+  end
+end

data/lib/aoandon/static_rule.rb

@@ -0,0 +1,16 @@
+module Aoandon
+  class StaticRule < Struct.new(:action, :context, :options)
+    def initialize(*args)
+      super(*args)
+
+      self.context['from'] ||= {'addr' => 'any'}
+      self.context['to'  ] ||= {'addr' => 'any'}
+
+      self.context['from'].update('addr' => 'any') unless self.context['from']['addr']
+      self.context['to'  ].update('addr' => 'any') unless self.context['to'  ]['addr']
+
+      self.options ||= {}
+      self.options.update('log' => false) unless self.options.has_key?('log')
+    end
+  end
+end

data/lib/aoandon/version.rb

@@ -0,0 +1,3 @@
+module Aoandon
+  VERSION = '0.0.1'
+end

metadata

@@ -0,0 +1,67 @@
+--- !ruby/object:Gem::Specification
+name: aoandon
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+  prerelease: 
+platform: ruby
+authors:
+- Cyril Wack
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-09-16 00:00:00.000000000 Z
+dependencies: []
+description: Aoandon (青行燈) is a minimalist network intrusion detection system (NIDS).
+email:
+- contact@cyril.io
+executables:
+- aoandon
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitattributes
+- .gitignore
+- .rbenv-version
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- aoandon.gemspec
+- bin/aoandon
+- config/rules.yml
+- lib/aoandon.rb
+- lib/aoandon/analysis.rb
+- lib/aoandon/analysis/semantic.rb
+- lib/aoandon/analysis/syntax.rb
+- lib/aoandon/dynamic_rule/less1024.rb
+- lib/aoandon/error/not_implemented_error.rb
+- lib/aoandon/log.rb
+- lib/aoandon/static_rule.rb
+- lib/aoandon/version.rb
+homepage: http://cyril.io
+licenses:
+- MIT
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+- config
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.23
+signing_key: 
+specification_version: 3
+summary: Minimalist network intrusion detection system (NIDS).
+test_files: []