ffi-pcap 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (82) hide show
  1. data/.gitignore +2 -1
  2. data/.pkg_ignore +25 -0
  3. data/.rspec +1 -0
  4. data/.specopts +1 -0
  5. data/.yardopts +1 -0
  6. data/{ChangeLog.rdoc → ChangeLog.md} +15 -5
  7. data/LICENSE.txt +1 -4
  8. data/README.md +92 -0
  9. data/Rakefile +30 -20
  10. data/examples/em_selectable_pcap.rb +38 -0
  11. data/examples/em_timer.rb +26 -0
  12. data/examples/ipfw_divert.rb +28 -8
  13. data/examples/print_bytes.rb +5 -1
  14. data/examples/replay.rb +11 -0
  15. data/examples/selectable_pcap.rb +29 -0
  16. data/ffi-pcap.gemspec +60 -0
  17. data/gemspec.yml +23 -0
  18. data/lib/ffi/pcap.rb +7 -13
  19. data/lib/ffi/pcap/addr.rb +16 -15
  20. data/lib/ffi/pcap/bpf_instruction.rb +25 -0
  21. data/lib/ffi/pcap/bpf_program.rb +85 -0
  22. data/lib/ffi/pcap/bsd.rb +9 -98
  23. data/lib/ffi/pcap/bsd/af.rb +18 -0
  24. data/lib/ffi/pcap/bsd/in6_addr.rb +16 -0
  25. data/lib/ffi/pcap/bsd/in_addr.rb +18 -0
  26. data/lib/ffi/pcap/bsd/sock_addr.rb +19 -0
  27. data/lib/ffi/pcap/bsd/sock_addr_dl.rb +24 -0
  28. data/lib/ffi/pcap/bsd/sock_addr_family.rb +19 -0
  29. data/lib/ffi/pcap/bsd/sock_addr_in.rb +21 -0
  30. data/lib/ffi/pcap/bsd/sock_addr_in6.rb +20 -0
  31. data/lib/ffi/pcap/bsd/typedefs.rb +7 -0
  32. data/lib/ffi/pcap/capture_wrapper.rb +296 -256
  33. data/lib/ffi/pcap/common_wrapper.rb +152 -127
  34. data/lib/ffi/pcap/copy_handler.rb +32 -32
  35. data/lib/ffi/pcap/crt.rb +7 -10
  36. data/lib/ffi/pcap/data_link.rb +178 -153
  37. data/lib/ffi/pcap/dead.rb +42 -29
  38. data/lib/ffi/pcap/dumper.rb +39 -41
  39. data/lib/ffi/pcap/error_buffer.rb +21 -36
  40. data/lib/ffi/pcap/exceptions.rb +21 -15
  41. data/lib/ffi/pcap/file_header.rb +24 -18
  42. data/lib/ffi/pcap/in_addr.rb +4 -4
  43. data/lib/ffi/pcap/interface.rb +22 -20
  44. data/lib/ffi/pcap/live.rb +296 -252
  45. data/lib/ffi/pcap/offline.rb +50 -43
  46. data/lib/ffi/pcap/packet.rb +186 -143
  47. data/lib/ffi/pcap/packet_header.rb +20 -18
  48. data/lib/ffi/pcap/pcap.rb +269 -212
  49. data/lib/ffi/pcap/stat.rb +19 -49
  50. data/lib/ffi/pcap/stat_ex.rb +42 -0
  51. data/lib/ffi/pcap/time_val.rb +52 -38
  52. data/lib/ffi/pcap/typedefs.rb +16 -20
  53. data/spec/data_link_spec.rb +39 -35
  54. data/spec/dead_spec.rb +0 -4
  55. data/spec/error_buffer_spec.rb +7 -9
  56. data/spec/file_header_spec.rb +17 -14
  57. data/spec/live_spec.rb +12 -5
  58. data/spec/offline_spec.rb +10 -11
  59. data/spec/packet_behaviors.rb +20 -6
  60. data/spec/packet_injection_spec.rb +9 -8
  61. data/spec/packet_spec.rb +22 -26
  62. data/spec/pcap_spec.rb +52 -40
  63. data/spec/spec_helper.rb +16 -5
  64. data/spec/wrapper_behaviors.rb +0 -3
  65. data/tasks/doc.rake +69 -0
  66. data/tasks/gem.rake +200 -0
  67. data/tasks/git.rake +40 -0
  68. data/tasks/post_load.rake +34 -0
  69. data/tasks/rubyforge.rake +55 -0
  70. data/tasks/setup.rb +286 -0
  71. data/tasks/spec.rake +54 -0
  72. data/tasks/svn.rake +47 -0
  73. data/tasks/test.rake +40 -0
  74. metadata +142 -92
  75. data/README.rdoc +0 -30
  76. data/VERSION +0 -1
  77. data/lib/ffi/pcap/bpf.rb +0 -106
  78. data/lib/ffi/pcap/version.rb +0 -6
  79. data/tasks/rcov.rb +0 -6
  80. data/tasks/rdoc.rb +0 -17
  81. data/tasks/spec.rb +0 -9
  82. data/tasks/yard.rb +0 -21
@@ -1,30 +0,0 @@
1
- = ffi-pcap
2
-
3
- * [github.com/sophsec/ffi-pcap](http://github.com/sophsec/ffi-pcap/)
4
- * [github.com/sophsec/ffi-pcap/issues](http://github.com/sophsec/ffi-pcap/issues)
5
- * Postmodern (postmodern.mod3 at gmail.com)
6
- * Eric Monti (esmonti at gmail.com)
7
-
8
- == Description
9
-
10
- Ruby FFI bindings for libpcap.
11
-
12
- == Features
13
-
14
- == Examples
15
-
16
- == Requirements
17
-
18
- * [libpcap](http://www.tcpdump.org/) or [winpcap](http://winpcap.org/)
19
- * [ffi](http://github.com/ffi/ffi) >= 0.5.0
20
- * [ffi_dry](http://github.com/emonti/ffi_dry) >= 0.1.9
21
-
22
- == Install
23
-
24
- $ sudo gem install ffi-pcap
25
-
26
- == License
27
-
28
- See {file:LICENSE.txt} for license information.
29
-
30
-
data/VERSION DELETED
@@ -1 +0,0 @@
1
- 0.2.0
@@ -1,106 +0,0 @@
1
-
2
- module FFI
3
- module PCap
4
-
5
- # Includes structures defined in pcap-bpf.h
6
-
7
- # Berkeley Packet Filter instruction data structure.
8
- #
9
- # See bpf_insn struct in pcap-bpf.h
10
- class BPFInstruction < FFI::Struct
11
- include FFI::DRY::StructHelper
12
-
13
- dsl_layout do
14
- field :code, :ushort
15
- field :jt, :uchar
16
- field :jf, :uchar
17
- field :k, :bpf_int32
18
- end
19
-
20
- end
21
-
22
- # Structure for pcap_compile(), pcap_setfilter(), etc.
23
- #
24
- # See bpf_program struct in pcap-bpf.h
25
- class BPFProgram < FFI::Struct
26
- include FFI::DRY::StructHelper
27
-
28
- dsl_layout do
29
- field :bf_len, :uint
30
- field :bf_insn, :pointer
31
- end
32
-
33
- def instructions
34
- i = 0
35
- sz = BPFInstruction.size()
36
- Array.new(self.bf_len) do
37
- ins = BPFInstruction.new( self[:bf_insn] + i )
38
- i += sz
39
- ins
40
- end
41
- end
42
-
43
- def free!
44
- unless @closed
45
- @freed = true
46
- FFI::PCap.pcap_freecode(self)
47
- end
48
- end
49
-
50
- def freed?
51
- return @freed == true
52
- end
53
-
54
- # Compiles a bpf filter without a pcap device being open. Downside is
55
- # no error messages are available, whereas they are when you use
56
- # open_dead() and use compile() on the resulting Dead.
57
- #
58
- # @param [Hash] opts
59
- # Additional options for compile
60
- #
61
- # @option opts [optional, DataLink, Integer, String, Symbol] :datalink
62
- # DataLink layer type. The argument type will be resolved to a DataLink
63
- # value if possible. Defaults to data-link layer type NULL.
64
- #
65
- # @option opts [optional, Integer] :snaplen
66
- # The snapshot length for the filter. Defaults to SNAPLEN
67
- #
68
- # @option opts [optional, Integer] :optimize
69
- # Optimization flag. 0 means don't optimize. Defaults to 1.
70
- #
71
- # @option opts [optional, Integer] :netmask
72
- # A 32-bit number representing the IPv4 netmask of the network on which
73
- # packets are being captured. It is only used when checking for IPv4
74
- # broadcast addresses in the filter program. Default: 0 (unspecified
75
- # netmask)
76
- #
77
- # @return [BPFProgram]
78
- # If no errors occur, a compiled BPFProgram is returned.
79
- #
80
- def self.compile(expr, opts={})
81
- datalink = (opts[:datalink] || 1)
82
- dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink)
83
- slen = (opts[:snaplen] || DEFAULT_SNAPLEN)
84
- optimize = (opts[:optimize] || 1)
85
- mask = (opts[:netmask] || 0)
86
- code = BPFProgram.new()
87
- r = FFI::PCap.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask)
88
- raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0
89
- return code
90
- end
91
-
92
- end
93
-
94
-
95
- attach_function :pcap_compile_nopcap, [:int, :int, BPFProgram, :string, :int, :bpf_uint32], :int
96
-
97
- attach_function :bpf_filter, [BPFInstruction, :pointer, :uint, :uint], :uint
98
- attach_function :bpf_validate, [BPFInstruction, :int], :int
99
- attach_function :bpf_image, [BPFInstruction, :int], :string
100
- attach_function :bpf_dump, [BPFProgram, :int], :void
101
- attach_function :pcap_freecode, [BPFProgram], :void
102
-
103
- end
104
- end
105
-
106
-
@@ -1,6 +0,0 @@
1
- module FFI
2
- module PCap
3
- # ffi/pcap version
4
- VERSION = '0.1.2'
5
- end
6
- end
@@ -1,6 +0,0 @@
1
- require 'spec/rake/spectask'
2
- Spec::Rake::SpecTask.new(:rcov) do |spec|
3
- spec.libs << 'lib' << 'spec'
4
- spec.pattern = 'spec/**/*_spec.rb'
5
- spec.rcov = true
6
- end
@@ -1,17 +0,0 @@
1
-
2
- require 'rake/rdoctask'
3
-
4
- Rake::RDocTask.new do |rdoc|
5
- if File.exist?('VERSION')
6
- version = "- #{File.read('VERSION')}"
7
- else
8
- version = ""
9
- end
10
-
11
- rdoc.rdoc_dir = 'rdoc'
12
- rdoc.title = "FFI PCap Documentation #{version}"
13
- rdoc.rdoc_files.include('README*')
14
- rdoc.rdoc_files.include('ChangeLog*')
15
- rdoc.rdoc_files.include('lib/**/*.rb')
16
- end
17
-
@@ -1,9 +0,0 @@
1
- require 'spec/rake/spectask'
2
-
3
- desc "Run all specifications"
4
- Spec::Rake::SpecTask.new(:spec) do |t|
5
- t.libs += ['lib', 'spec']
6
- t.spec_opts = ['--colour', '--format', 'specdoc']
7
- end
8
-
9
- task :default => :spec
@@ -1,21 +0,0 @@
1
- begin
2
- require 'yard'
3
-
4
- YARD::Rake::YardocTask.new do |t|
5
- if File.exist?('VERSION')
6
- version = "- #{File.read('VERSION')}"
7
- else
8
- version = ""
9
- end
10
-
11
- t.files = ['ChangeLog*','LICENSE*','lib/**/*.rb']
12
- t.options = [
13
- '--title',"FFI PCap Documentation #{version}",
14
- '--protected',
15
- ]
16
- end
17
-
18
- task :docs => :yard
19
- rescue LoadError
20
- end
21
-