ffi-pcap 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/.gitignore +2 -1
- data/.pkg_ignore +25 -0
- data/.rspec +1 -0
- data/.specopts +1 -0
- data/.yardopts +1 -0
- data/{ChangeLog.rdoc → ChangeLog.md} +15 -5
- data/LICENSE.txt +1 -4
- data/README.md +92 -0
- data/Rakefile +30 -20
- data/examples/em_selectable_pcap.rb +38 -0
- data/examples/em_timer.rb +26 -0
- data/examples/ipfw_divert.rb +28 -8
- data/examples/print_bytes.rb +5 -1
- data/examples/replay.rb +11 -0
- data/examples/selectable_pcap.rb +29 -0
- data/ffi-pcap.gemspec +60 -0
- data/gemspec.yml +23 -0
- data/lib/ffi/pcap.rb +7 -13
- data/lib/ffi/pcap/addr.rb +16 -15
- data/lib/ffi/pcap/bpf_instruction.rb +25 -0
- data/lib/ffi/pcap/bpf_program.rb +85 -0
- data/lib/ffi/pcap/bsd.rb +9 -98
- data/lib/ffi/pcap/bsd/af.rb +18 -0
- data/lib/ffi/pcap/bsd/in6_addr.rb +16 -0
- data/lib/ffi/pcap/bsd/in_addr.rb +18 -0
- data/lib/ffi/pcap/bsd/sock_addr.rb +19 -0
- data/lib/ffi/pcap/bsd/sock_addr_dl.rb +24 -0
- data/lib/ffi/pcap/bsd/sock_addr_family.rb +19 -0
- data/lib/ffi/pcap/bsd/sock_addr_in.rb +21 -0
- data/lib/ffi/pcap/bsd/sock_addr_in6.rb +20 -0
- data/lib/ffi/pcap/bsd/typedefs.rb +7 -0
- data/lib/ffi/pcap/capture_wrapper.rb +296 -256
- data/lib/ffi/pcap/common_wrapper.rb +152 -127
- data/lib/ffi/pcap/copy_handler.rb +32 -32
- data/lib/ffi/pcap/crt.rb +7 -10
- data/lib/ffi/pcap/data_link.rb +178 -153
- data/lib/ffi/pcap/dead.rb +42 -29
- data/lib/ffi/pcap/dumper.rb +39 -41
- data/lib/ffi/pcap/error_buffer.rb +21 -36
- data/lib/ffi/pcap/exceptions.rb +21 -15
- data/lib/ffi/pcap/file_header.rb +24 -18
- data/lib/ffi/pcap/in_addr.rb +4 -4
- data/lib/ffi/pcap/interface.rb +22 -20
- data/lib/ffi/pcap/live.rb +296 -252
- data/lib/ffi/pcap/offline.rb +50 -43
- data/lib/ffi/pcap/packet.rb +186 -143
- data/lib/ffi/pcap/packet_header.rb +20 -18
- data/lib/ffi/pcap/pcap.rb +269 -212
- data/lib/ffi/pcap/stat.rb +19 -49
- data/lib/ffi/pcap/stat_ex.rb +42 -0
- data/lib/ffi/pcap/time_val.rb +52 -38
- data/lib/ffi/pcap/typedefs.rb +16 -20
- data/spec/data_link_spec.rb +39 -35
- data/spec/dead_spec.rb +0 -4
- data/spec/error_buffer_spec.rb +7 -9
- data/spec/file_header_spec.rb +17 -14
- data/spec/live_spec.rb +12 -5
- data/spec/offline_spec.rb +10 -11
- data/spec/packet_behaviors.rb +20 -6
- data/spec/packet_injection_spec.rb +9 -8
- data/spec/packet_spec.rb +22 -26
- data/spec/pcap_spec.rb +52 -40
- data/spec/spec_helper.rb +16 -5
- data/spec/wrapper_behaviors.rb +0 -3
- data/tasks/doc.rake +69 -0
- data/tasks/gem.rake +200 -0
- data/tasks/git.rake +40 -0
- data/tasks/post_load.rake +34 -0
- data/tasks/rubyforge.rake +55 -0
- data/tasks/setup.rb +286 -0
- data/tasks/spec.rake +54 -0
- data/tasks/svn.rake +47 -0
- data/tasks/test.rake +40 -0
- metadata +142 -92
- data/README.rdoc +0 -30
- data/VERSION +0 -1
- data/lib/ffi/pcap/bpf.rb +0 -106
- data/lib/ffi/pcap/version.rb +0 -6
- data/tasks/rcov.rb +0 -6
- data/tasks/rdoc.rb +0 -17
- data/tasks/spec.rb +0 -9
- data/tasks/yard.rb +0 -21
data/README.rdoc
DELETED
@@ -1,30 +0,0 @@
|
|
1
|
-
= ffi-pcap
|
2
|
-
|
3
|
-
* [github.com/sophsec/ffi-pcap](http://github.com/sophsec/ffi-pcap/)
|
4
|
-
* [github.com/sophsec/ffi-pcap/issues](http://github.com/sophsec/ffi-pcap/issues)
|
5
|
-
* Postmodern (postmodern.mod3 at gmail.com)
|
6
|
-
* Eric Monti (esmonti at gmail.com)
|
7
|
-
|
8
|
-
== Description
|
9
|
-
|
10
|
-
Ruby FFI bindings for libpcap.
|
11
|
-
|
12
|
-
== Features
|
13
|
-
|
14
|
-
== Examples
|
15
|
-
|
16
|
-
== Requirements
|
17
|
-
|
18
|
-
* [libpcap](http://www.tcpdump.org/) or [winpcap](http://winpcap.org/)
|
19
|
-
* [ffi](http://github.com/ffi/ffi) >= 0.5.0
|
20
|
-
* [ffi_dry](http://github.com/emonti/ffi_dry) >= 0.1.9
|
21
|
-
|
22
|
-
== Install
|
23
|
-
|
24
|
-
$ sudo gem install ffi-pcap
|
25
|
-
|
26
|
-
== License
|
27
|
-
|
28
|
-
See {file:LICENSE.txt} for license information.
|
29
|
-
|
30
|
-
|
data/VERSION
DELETED
@@ -1 +0,0 @@
|
|
1
|
-
0.2.0
|
data/lib/ffi/pcap/bpf.rb
DELETED
@@ -1,106 +0,0 @@
|
|
1
|
-
|
2
|
-
module FFI
|
3
|
-
module PCap
|
4
|
-
|
5
|
-
# Includes structures defined in pcap-bpf.h
|
6
|
-
|
7
|
-
# Berkeley Packet Filter instruction data structure.
|
8
|
-
#
|
9
|
-
# See bpf_insn struct in pcap-bpf.h
|
10
|
-
class BPFInstruction < FFI::Struct
|
11
|
-
include FFI::DRY::StructHelper
|
12
|
-
|
13
|
-
dsl_layout do
|
14
|
-
field :code, :ushort
|
15
|
-
field :jt, :uchar
|
16
|
-
field :jf, :uchar
|
17
|
-
field :k, :bpf_int32
|
18
|
-
end
|
19
|
-
|
20
|
-
end
|
21
|
-
|
22
|
-
# Structure for pcap_compile(), pcap_setfilter(), etc.
|
23
|
-
#
|
24
|
-
# See bpf_program struct in pcap-bpf.h
|
25
|
-
class BPFProgram < FFI::Struct
|
26
|
-
include FFI::DRY::StructHelper
|
27
|
-
|
28
|
-
dsl_layout do
|
29
|
-
field :bf_len, :uint
|
30
|
-
field :bf_insn, :pointer
|
31
|
-
end
|
32
|
-
|
33
|
-
def instructions
|
34
|
-
i = 0
|
35
|
-
sz = BPFInstruction.size()
|
36
|
-
Array.new(self.bf_len) do
|
37
|
-
ins = BPFInstruction.new( self[:bf_insn] + i )
|
38
|
-
i += sz
|
39
|
-
ins
|
40
|
-
end
|
41
|
-
end
|
42
|
-
|
43
|
-
def free!
|
44
|
-
unless @closed
|
45
|
-
@freed = true
|
46
|
-
FFI::PCap.pcap_freecode(self)
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
def freed?
|
51
|
-
return @freed == true
|
52
|
-
end
|
53
|
-
|
54
|
-
# Compiles a bpf filter without a pcap device being open. Downside is
|
55
|
-
# no error messages are available, whereas they are when you use
|
56
|
-
# open_dead() and use compile() on the resulting Dead.
|
57
|
-
#
|
58
|
-
# @param [Hash] opts
|
59
|
-
# Additional options for compile
|
60
|
-
#
|
61
|
-
# @option opts [optional, DataLink, Integer, String, Symbol] :datalink
|
62
|
-
# DataLink layer type. The argument type will be resolved to a DataLink
|
63
|
-
# value if possible. Defaults to data-link layer type NULL.
|
64
|
-
#
|
65
|
-
# @option opts [optional, Integer] :snaplen
|
66
|
-
# The snapshot length for the filter. Defaults to SNAPLEN
|
67
|
-
#
|
68
|
-
# @option opts [optional, Integer] :optimize
|
69
|
-
# Optimization flag. 0 means don't optimize. Defaults to 1.
|
70
|
-
#
|
71
|
-
# @option opts [optional, Integer] :netmask
|
72
|
-
# A 32-bit number representing the IPv4 netmask of the network on which
|
73
|
-
# packets are being captured. It is only used when checking for IPv4
|
74
|
-
# broadcast addresses in the filter program. Default: 0 (unspecified
|
75
|
-
# netmask)
|
76
|
-
#
|
77
|
-
# @return [BPFProgram]
|
78
|
-
# If no errors occur, a compiled BPFProgram is returned.
|
79
|
-
#
|
80
|
-
def self.compile(expr, opts={})
|
81
|
-
datalink = (opts[:datalink] || 1)
|
82
|
-
dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink)
|
83
|
-
slen = (opts[:snaplen] || DEFAULT_SNAPLEN)
|
84
|
-
optimize = (opts[:optimize] || 1)
|
85
|
-
mask = (opts[:netmask] || 0)
|
86
|
-
code = BPFProgram.new()
|
87
|
-
r = FFI::PCap.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask)
|
88
|
-
raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0
|
89
|
-
return code
|
90
|
-
end
|
91
|
-
|
92
|
-
end
|
93
|
-
|
94
|
-
|
95
|
-
attach_function :pcap_compile_nopcap, [:int, :int, BPFProgram, :string, :int, :bpf_uint32], :int
|
96
|
-
|
97
|
-
attach_function :bpf_filter, [BPFInstruction, :pointer, :uint, :uint], :uint
|
98
|
-
attach_function :bpf_validate, [BPFInstruction, :int], :int
|
99
|
-
attach_function :bpf_image, [BPFInstruction, :int], :string
|
100
|
-
attach_function :bpf_dump, [BPFProgram, :int], :void
|
101
|
-
attach_function :pcap_freecode, [BPFProgram], :void
|
102
|
-
|
103
|
-
end
|
104
|
-
end
|
105
|
-
|
106
|
-
|
data/lib/ffi/pcap/version.rb
DELETED
data/tasks/rcov.rb
DELETED
data/tasks/rdoc.rb
DELETED
@@ -1,17 +0,0 @@
|
|
1
|
-
|
2
|
-
require 'rake/rdoctask'
|
3
|
-
|
4
|
-
Rake::RDocTask.new do |rdoc|
|
5
|
-
if File.exist?('VERSION')
|
6
|
-
version = "- #{File.read('VERSION')}"
|
7
|
-
else
|
8
|
-
version = ""
|
9
|
-
end
|
10
|
-
|
11
|
-
rdoc.rdoc_dir = 'rdoc'
|
12
|
-
rdoc.title = "FFI PCap Documentation #{version}"
|
13
|
-
rdoc.rdoc_files.include('README*')
|
14
|
-
rdoc.rdoc_files.include('ChangeLog*')
|
15
|
-
rdoc.rdoc_files.include('lib/**/*.rb')
|
16
|
-
end
|
17
|
-
|
data/tasks/spec.rb
DELETED
data/tasks/yard.rb
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
begin
|
2
|
-
require 'yard'
|
3
|
-
|
4
|
-
YARD::Rake::YardocTask.new do |t|
|
5
|
-
if File.exist?('VERSION')
|
6
|
-
version = "- #{File.read('VERSION')}"
|
7
|
-
else
|
8
|
-
version = ""
|
9
|
-
end
|
10
|
-
|
11
|
-
t.files = ['ChangeLog*','LICENSE*','lib/**/*.rb']
|
12
|
-
t.options = [
|
13
|
-
'--title',"FFI PCap Documentation #{version}",
|
14
|
-
'--protected',
|
15
|
-
]
|
16
|
-
end
|
17
|
-
|
18
|
-
task :docs => :yard
|
19
|
-
rescue LoadError
|
20
|
-
end
|
21
|
-
|