aoandon 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d60b2d838c6206b56aae170861b9d40aebd5b2c4d5f857b0d53f7ef5fdce5ca9
-  data.tar.gz: 119c1e89887f10c8ec64554357f9e0e74f1c82e6b8c3703450c29fc81da9c3b0
+  metadata.gz: 0b404ee00be509e8bb241c123cf12145e43028c9ea4e8bd8e3e85e83ab310633
+  data.tar.gz: b755263c90d97d880e36c86a85b654bf8f421889296c3bec01bc03e8a61a8e0e
 SHA512:
-  metadata.gz: 562da47deae49df1c8b8d9ddf41647fc902e67235e4876ea29479d136dafd9d6e303b8280dfca90266365916c37800f768f2371d470571b4f1b8ed9e368fe0c2
-  data.tar.gz: b5b623f88e1af383901b7ae3c85a7d91876076537a9bc09bd82a4471adc51ca390c7b5d68c481d4743a525b95a6ce476bb8182f62d98736d3261ad1e412c6b62
+  metadata.gz: 35a6d37a43a59c56ee946c2dc440565473bc8d0b1dfece934433c1b6f583de42cc91363374166e5fd8af146f32670fbe5b06e65b109ddef36069ab0903e277b4
+  data.tar.gz: 92c55e993652ef9afa7ceb415ff54864a173717aff11a571cf2558e91380b4aae7a2cbcf872ffd5e6a0a254ff7252a750b93447d5a7c45a3dc7eec260ab16cea

data/README.md

@@ -28,7 +28,7 @@ bundle
 Or install it yourself as:
 
 ```sh
-gem install accept_language
+gem install aoandon
 ```
 
 ## Getting started
@@ -215,10 +215,10 @@ Some semantic analysis can also be done through Aoandon NIDS extensions, using m
 module Aoandon
   module DynamicRule
     module Less1024
-      MESSAGE = "Port numbers < 1024"
+      MESSAGE = "Port numbers < 1024".freeze
       PROTO_TCP = 6
       PROTO_UDP = 17
-      WELL_KNOWN_PORTS = (0..1023)
+      WELL_KNOWN_PORTS = (0..1023).freeze
 
       def self.control?(packet)
         (tcp?(packet) || (udp?(packet) && different_ports?(packet.sport, packet.dport))) &&
@@ -256,7 +256,7 @@ end
 module Aoandon
   module DynamicRule
     module MoreFragments
-      MESSAGE = "More Fragment bit is set"
+      MESSAGE = "More Fragment bit is set".freeze
 
       def self.control?(packet)
         packet.ip_mf?
@@ -275,8 +275,8 @@ end
 module Aoandon
   module DynamicRule
     module SameIp
-      LOCALHOST = "127.0.0.1"
-      MESSAGE = "Same IP"
+      LOCALHOST = "127.0.0.1".freeze
+      MESSAGE = "Same IP".freeze
 
       def self.control?(packet)
         packet.ip_src == packet.ip_dst && !loopback?(packet.ip_src)
@@ -302,7 +302,7 @@ module Aoandon
   module DynamicRule
     module SynFlood
       BUFFER = 20
-      MESSAGE = "SYN flood attack"
+      MESSAGE = "SYN flood attack".freeze
       PROTO_TCP = 6
 
       def self.control?(packet)

data/lib/aoandon.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: false
 
+require "bundler/setup"
 require "ipaddr"
 require "optparse"
 require "pcap"
@@ -11,6 +12,7 @@ require_relative "aoandon/analysis/semantic"
 require_relative "aoandon/analysis/syntax"
 require_relative "aoandon/log"
 require_relative "aoandon/static_rule"
+require_relative "aoandon/version"
 
 Dir["lib/aoandon/dynamic_rule/*.rb"].each do |src|
   load src
@@ -18,10 +20,10 @@ end
 
 module Aoandon
   class Nids
-    CONF_PATH = "config/rules.yml"
+    CONF_PATH = "config/rules.yml".freeze
 
     def initialize
-      options = Nids.parse
+      options = self.class.parse
       options[:file] = CONF_PATH unless options[:file]
       options[:interface] = Pcap.lookupdev unless options[:interface]
       puts "Starting Aoandon NIDS on interface #{options[:interface]}..."
@@ -48,7 +50,7 @@ module Aoandon
       options = {}
 
       OptionParser.new do |opts|
-        opts.banner = "Usage: #{$0} [options]"
+        opts.banner = "Usage: #{$PROGRAM_NAME} [options]"
         opts.on("-f", "--file <path>", "Load the rules contained in file <path>.") { |f| options[:file] = f }
         opts.on("-h", "--help", "Help.") { puts opts; exit }
         opts.on("-i", "--interface <if>", "Sniff on network interface <if>.") { |i| options[:interface] = i }

data/lib/aoandon/analysis/syntax.rb

@@ -26,22 +26,24 @@ module Aoandon
     protected
 
     def match?(packet, network_context)
-      network_context.update({ "af" => af2id(packet.ip_ver) }) unless network_context.has_key?("af")
+      network_context.update({ "af" => af2id(packet.ip_ver) }) unless network_context.key?("af")
       match_proto?(packet, network_context) if packet.ip_ver == af(network_context.fetch("af"))
     end
 
     def af2id(af)
-      if af == 4
+      case af
+      when 4
         "inet"
-      elsif af == 6
+      when 6
         "inet6"
       end
     end
 
     def af(name)
-      if name.to_sym == :inet
+      case name.to_sym
+      when :inet
         4
-      elsif name.to_sym == :inet6
+      when :inet6
         6
       end
     end
@@ -49,13 +51,14 @@ module Aoandon
     def match_proto?(packet, network_context)
       if network_context["proto"]
         if packet.ip_proto == proto(network_context["proto"])
-          if packet.ip_proto == 1
+          case packet.ip_proto
+          when 1
             match_proto_icmp?(packet, network_context)
-          elsif packet.ip_proto == 6
+          when 6
             match_proto_tcp?(packet, network_context)
-          elsif packet.ip_proto == 17
+          when 17
             match_proto_udp?(packet, network_context)
-          elsif packet.ip_proto == 58
+          when 58
             match_proto_icmp6?(packet, network_context)
           else
             match_addr?(packet, network_context)
@@ -67,13 +70,14 @@ module Aoandon
     end
 
     def proto(name)
-      if name.to_sym == :icmp
+      case name.to_sym
+      when :icmp
         1
-      elsif name.to_sym == :icmp6
+      when :icmp6
         58
-      elsif name.to_sym == :tcp
+      when :tcp
         6
-      elsif name.to_sym == :udp
+      when :udp
         17
       end
     end
@@ -102,7 +106,7 @@ module Aoandon
       result = true
 
       [%w[from sport], %w[to dport]].each do |way, obj|
-        if network_context[way].has_key?("port")
+        if network_context[way].key?("port")
           result &&= refer2port?(packet.send(obj).to_i, network_context[way].fetch("port"))
         end
       end
@@ -129,23 +133,25 @@ module Aoandon
     end
 
     def refer2addr?(addr, pattern)
-      if pattern.is_a? Array
+      case pattern
+      when Array
         pattern.include?(addr.to_num_s) || pattern.include?(addr.hostname)
-      elsif pattern.is_a? Hash
-        pattern.has_key?(addr.to_num_s) || pattern.has_key?(addr.hostname)
-      elsif pattern.is_a? String
-        addr.to_num_s == pattern        || addr.hostname == pattern
+      when Hash
+        pattern.key?(addr.to_num_s) || pattern.key?(addr.hostname)
+      when String
+        addr.to_num_s == pattern || addr.hostname == pattern
       else
         false
       end
     end
 
     def refer2port?(number, pattern)
-      if pattern.is_a? Array
+      case pattern
+      when Array
         pattern.include?(number)
-      elsif pattern.is_a? Hash
-        pattern.has_key?(number)
-      elsif pattern.is_a? Integer
+      when Hash
+        pattern.key?(number)
+      when Integer
         number == pattern
       else
         false

data/lib/aoandon/dynamic_rule/less1024.rb

@@ -6,7 +6,7 @@ module Aoandon
       MESSAGE = "Port numbers < 1024"
       PROTO_TCP = 6
       PROTO_UDP = 17
-      WELL_KNOWN_PORTS = (0..1023)
+      WELL_KNOWN_PORTS = (0..1023).freeze
 
       def self.control?(packet)
         (tcp?(packet) || (udp?(packet) && different_ports?(packet.sport, packet.dport))) &&

data/lib/aoandon/log.rb

@@ -2,16 +2,20 @@
 
 module Aoandon
   class Log
+    LOCAL_PATH = "log/aoandon.yml"
+    GLOBAL_PATH = "/var/log/aoandon.yml"
+
     def initialize(verbose = false)
-      @file = if File.exist?("log/aoandon.yml")
-                File.open("log/aoandon.yml", "a")
-              else
-                File.open("/var/log/aoandon.yml", "a")
-              end
+      file_path = if File.exist?(LOCAL_PATH)
+                    LOCAL_PATH
+                  else
+                    GLOBAL_PATH
+                  end
 
+      @file = ::File.open(file_path, "a")
       @verbose = verbose
 
-      puts "Log file: #{File.expand_path(@file.path)}"
+      puts "Log file: #{::File.expand_path(@file.path)}"
     end
 
     def message(*args)

data/lib/aoandon/static_rule.rb

@@ -12,7 +12,7 @@ module Aoandon
       context["to"].update("addr" => "any") unless context["to"]["addr"]
 
       self.options ||= {}
-      self.options.update("log" => false) unless self.options.has_key?("log")
+      self.options.update("log" => false) unless self.options.key?("log")
     end
   end
 end

data/lib/aoandon/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: false
+
+module Aoandon
+  VERSION = ::Gem.loaded_specs[name.downcase].version.to_s
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aoandon
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Cyril Kato
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-21 00:00:00.000000000 Z
+date: 2021-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby-pcap
@@ -152,6 +152,7 @@ files:
 - lib/aoandon/dynamic_rule/less1024.rb
 - lib/aoandon/log.rb
 - lib/aoandon/static_rule.rb
+- lib/aoandon/version.rb
 homepage: https://github.com/cyril/aoandon.rb
 licenses:
 - MIT