ffi-pcap 0.2.0 → 0.2.1
Sign up to get free protection for your applications and to get access to all the features.
- data/.gitignore +2 -1
- data/.pkg_ignore +25 -0
- data/.rspec +1 -0
- data/.specopts +1 -0
- data/.yardopts +1 -0
- data/{ChangeLog.rdoc → ChangeLog.md} +15 -5
- data/LICENSE.txt +1 -4
- data/README.md +92 -0
- data/Rakefile +30 -20
- data/examples/em_selectable_pcap.rb +38 -0
- data/examples/em_timer.rb +26 -0
- data/examples/ipfw_divert.rb +28 -8
- data/examples/print_bytes.rb +5 -1
- data/examples/replay.rb +11 -0
- data/examples/selectable_pcap.rb +29 -0
- data/ffi-pcap.gemspec +60 -0
- data/gemspec.yml +23 -0
- data/lib/ffi/pcap.rb +7 -13
- data/lib/ffi/pcap/addr.rb +16 -15
- data/lib/ffi/pcap/bpf_instruction.rb +25 -0
- data/lib/ffi/pcap/bpf_program.rb +85 -0
- data/lib/ffi/pcap/bsd.rb +9 -98
- data/lib/ffi/pcap/bsd/af.rb +18 -0
- data/lib/ffi/pcap/bsd/in6_addr.rb +16 -0
- data/lib/ffi/pcap/bsd/in_addr.rb +18 -0
- data/lib/ffi/pcap/bsd/sock_addr.rb +19 -0
- data/lib/ffi/pcap/bsd/sock_addr_dl.rb +24 -0
- data/lib/ffi/pcap/bsd/sock_addr_family.rb +19 -0
- data/lib/ffi/pcap/bsd/sock_addr_in.rb +21 -0
- data/lib/ffi/pcap/bsd/sock_addr_in6.rb +20 -0
- data/lib/ffi/pcap/bsd/typedefs.rb +7 -0
- data/lib/ffi/pcap/capture_wrapper.rb +296 -256
- data/lib/ffi/pcap/common_wrapper.rb +152 -127
- data/lib/ffi/pcap/copy_handler.rb +32 -32
- data/lib/ffi/pcap/crt.rb +7 -10
- data/lib/ffi/pcap/data_link.rb +178 -153
- data/lib/ffi/pcap/dead.rb +42 -29
- data/lib/ffi/pcap/dumper.rb +39 -41
- data/lib/ffi/pcap/error_buffer.rb +21 -36
- data/lib/ffi/pcap/exceptions.rb +21 -15
- data/lib/ffi/pcap/file_header.rb +24 -18
- data/lib/ffi/pcap/in_addr.rb +4 -4
- data/lib/ffi/pcap/interface.rb +22 -20
- data/lib/ffi/pcap/live.rb +296 -252
- data/lib/ffi/pcap/offline.rb +50 -43
- data/lib/ffi/pcap/packet.rb +186 -143
- data/lib/ffi/pcap/packet_header.rb +20 -18
- data/lib/ffi/pcap/pcap.rb +269 -212
- data/lib/ffi/pcap/stat.rb +19 -49
- data/lib/ffi/pcap/stat_ex.rb +42 -0
- data/lib/ffi/pcap/time_val.rb +52 -38
- data/lib/ffi/pcap/typedefs.rb +16 -20
- data/spec/data_link_spec.rb +39 -35
- data/spec/dead_spec.rb +0 -4
- data/spec/error_buffer_spec.rb +7 -9
- data/spec/file_header_spec.rb +17 -14
- data/spec/live_spec.rb +12 -5
- data/spec/offline_spec.rb +10 -11
- data/spec/packet_behaviors.rb +20 -6
- data/spec/packet_injection_spec.rb +9 -8
- data/spec/packet_spec.rb +22 -26
- data/spec/pcap_spec.rb +52 -40
- data/spec/spec_helper.rb +16 -5
- data/spec/wrapper_behaviors.rb +0 -3
- data/tasks/doc.rake +69 -0
- data/tasks/gem.rake +200 -0
- data/tasks/git.rake +40 -0
- data/tasks/post_load.rake +34 -0
- data/tasks/rubyforge.rake +55 -0
- data/tasks/setup.rb +286 -0
- data/tasks/spec.rake +54 -0
- data/tasks/svn.rake +47 -0
- data/tasks/test.rake +40 -0
- metadata +142 -92
- data/README.rdoc +0 -30
- data/VERSION +0 -1
- data/lib/ffi/pcap/bpf.rb +0 -106
- data/lib/ffi/pcap/version.rb +0 -6
- data/tasks/rcov.rb +0 -6
- data/tasks/rdoc.rb +0 -17
- data/tasks/spec.rb +0 -9
- data/tasks/yard.rb +0 -21
data/README.rdoc
DELETED
@@ -1,30 +0,0 @@
|
|
1
|
-
= ffi-pcap
|
2
|
-
|
3
|
-
* [github.com/sophsec/ffi-pcap](http://github.com/sophsec/ffi-pcap/)
|
4
|
-
* [github.com/sophsec/ffi-pcap/issues](http://github.com/sophsec/ffi-pcap/issues)
|
5
|
-
* Postmodern (postmodern.mod3 at gmail.com)
|
6
|
-
* Eric Monti (esmonti at gmail.com)
|
7
|
-
|
8
|
-
== Description
|
9
|
-
|
10
|
-
Ruby FFI bindings for libpcap.
|
11
|
-
|
12
|
-
== Features
|
13
|
-
|
14
|
-
== Examples
|
15
|
-
|
16
|
-
== Requirements
|
17
|
-
|
18
|
-
* [libpcap](http://www.tcpdump.org/) or [winpcap](http://winpcap.org/)
|
19
|
-
* [ffi](http://github.com/ffi/ffi) >= 0.5.0
|
20
|
-
* [ffi_dry](http://github.com/emonti/ffi_dry) >= 0.1.9
|
21
|
-
|
22
|
-
== Install
|
23
|
-
|
24
|
-
$ sudo gem install ffi-pcap
|
25
|
-
|
26
|
-
== License
|
27
|
-
|
28
|
-
See {file:LICENSE.txt} for license information.
|
29
|
-
|
30
|
-
|
data/VERSION
DELETED
@@ -1 +0,0 @@
|
|
1
|
-
0.2.0
|
data/lib/ffi/pcap/bpf.rb
DELETED
@@ -1,106 +0,0 @@
|
|
1
|
-
|
2
|
-
module FFI
|
3
|
-
module PCap
|
4
|
-
|
5
|
-
# Includes structures defined in pcap-bpf.h
|
6
|
-
|
7
|
-
# Berkeley Packet Filter instruction data structure.
|
8
|
-
#
|
9
|
-
# See bpf_insn struct in pcap-bpf.h
|
10
|
-
class BPFInstruction < FFI::Struct
|
11
|
-
include FFI::DRY::StructHelper
|
12
|
-
|
13
|
-
dsl_layout do
|
14
|
-
field :code, :ushort
|
15
|
-
field :jt, :uchar
|
16
|
-
field :jf, :uchar
|
17
|
-
field :k, :bpf_int32
|
18
|
-
end
|
19
|
-
|
20
|
-
end
|
21
|
-
|
22
|
-
# Structure for pcap_compile(), pcap_setfilter(), etc.
|
23
|
-
#
|
24
|
-
# See bpf_program struct in pcap-bpf.h
|
25
|
-
class BPFProgram < FFI::Struct
|
26
|
-
include FFI::DRY::StructHelper
|
27
|
-
|
28
|
-
dsl_layout do
|
29
|
-
field :bf_len, :uint
|
30
|
-
field :bf_insn, :pointer
|
31
|
-
end
|
32
|
-
|
33
|
-
def instructions
|
34
|
-
i = 0
|
35
|
-
sz = BPFInstruction.size()
|
36
|
-
Array.new(self.bf_len) do
|
37
|
-
ins = BPFInstruction.new( self[:bf_insn] + i )
|
38
|
-
i += sz
|
39
|
-
ins
|
40
|
-
end
|
41
|
-
end
|
42
|
-
|
43
|
-
def free!
|
44
|
-
unless @closed
|
45
|
-
@freed = true
|
46
|
-
FFI::PCap.pcap_freecode(self)
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
def freed?
|
51
|
-
return @freed == true
|
52
|
-
end
|
53
|
-
|
54
|
-
# Compiles a bpf filter without a pcap device being open. Downside is
|
55
|
-
# no error messages are available, whereas they are when you use
|
56
|
-
# open_dead() and use compile() on the resulting Dead.
|
57
|
-
#
|
58
|
-
# @param [Hash] opts
|
59
|
-
# Additional options for compile
|
60
|
-
#
|
61
|
-
# @option opts [optional, DataLink, Integer, String, Symbol] :datalink
|
62
|
-
# DataLink layer type. The argument type will be resolved to a DataLink
|
63
|
-
# value if possible. Defaults to data-link layer type NULL.
|
64
|
-
#
|
65
|
-
# @option opts [optional, Integer] :snaplen
|
66
|
-
# The snapshot length for the filter. Defaults to SNAPLEN
|
67
|
-
#
|
68
|
-
# @option opts [optional, Integer] :optimize
|
69
|
-
# Optimization flag. 0 means don't optimize. Defaults to 1.
|
70
|
-
#
|
71
|
-
# @option opts [optional, Integer] :netmask
|
72
|
-
# A 32-bit number representing the IPv4 netmask of the network on which
|
73
|
-
# packets are being captured. It is only used when checking for IPv4
|
74
|
-
# broadcast addresses in the filter program. Default: 0 (unspecified
|
75
|
-
# netmask)
|
76
|
-
#
|
77
|
-
# @return [BPFProgram]
|
78
|
-
# If no errors occur, a compiled BPFProgram is returned.
|
79
|
-
#
|
80
|
-
def self.compile(expr, opts={})
|
81
|
-
datalink = (opts[:datalink] || 1)
|
82
|
-
dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink)
|
83
|
-
slen = (opts[:snaplen] || DEFAULT_SNAPLEN)
|
84
|
-
optimize = (opts[:optimize] || 1)
|
85
|
-
mask = (opts[:netmask] || 0)
|
86
|
-
code = BPFProgram.new()
|
87
|
-
r = FFI::PCap.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask)
|
88
|
-
raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0
|
89
|
-
return code
|
90
|
-
end
|
91
|
-
|
92
|
-
end
|
93
|
-
|
94
|
-
|
95
|
-
attach_function :pcap_compile_nopcap, [:int, :int, BPFProgram, :string, :int, :bpf_uint32], :int
|
96
|
-
|
97
|
-
attach_function :bpf_filter, [BPFInstruction, :pointer, :uint, :uint], :uint
|
98
|
-
attach_function :bpf_validate, [BPFInstruction, :int], :int
|
99
|
-
attach_function :bpf_image, [BPFInstruction, :int], :string
|
100
|
-
attach_function :bpf_dump, [BPFProgram, :int], :void
|
101
|
-
attach_function :pcap_freecode, [BPFProgram], :void
|
102
|
-
|
103
|
-
end
|
104
|
-
end
|
105
|
-
|
106
|
-
|
data/lib/ffi/pcap/version.rb
DELETED
data/tasks/rcov.rb
DELETED
data/tasks/rdoc.rb
DELETED
@@ -1,17 +0,0 @@
|
|
1
|
-
|
2
|
-
require 'rake/rdoctask'
|
3
|
-
|
4
|
-
Rake::RDocTask.new do |rdoc|
|
5
|
-
if File.exist?('VERSION')
|
6
|
-
version = "- #{File.read('VERSION')}"
|
7
|
-
else
|
8
|
-
version = ""
|
9
|
-
end
|
10
|
-
|
11
|
-
rdoc.rdoc_dir = 'rdoc'
|
12
|
-
rdoc.title = "FFI PCap Documentation #{version}"
|
13
|
-
rdoc.rdoc_files.include('README*')
|
14
|
-
rdoc.rdoc_files.include('ChangeLog*')
|
15
|
-
rdoc.rdoc_files.include('lib/**/*.rb')
|
16
|
-
end
|
17
|
-
|
data/tasks/spec.rb
DELETED
data/tasks/yard.rb
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
begin
|
2
|
-
require 'yard'
|
3
|
-
|
4
|
-
YARD::Rake::YardocTask.new do |t|
|
5
|
-
if File.exist?('VERSION')
|
6
|
-
version = "- #{File.read('VERSION')}"
|
7
|
-
else
|
8
|
-
version = ""
|
9
|
-
end
|
10
|
-
|
11
|
-
t.files = ['ChangeLog*','LICENSE*','lib/**/*.rb']
|
12
|
-
t.options = [
|
13
|
-
'--title',"FFI PCap Documentation #{version}",
|
14
|
-
'--protected',
|
15
|
-
]
|
16
|
-
end
|
17
|
-
|
18
|
-
task :docs => :yard
|
19
|
-
rescue LoadError
|
20
|
-
end
|
21
|
-
|