ffi-pcap 0.2.0 → 0.2.1

data/gemspec.yml

@@ -0,0 +1,23 @@
+name: ffi-pcap
+version: 0.2.1
+summary: FFI bindings for libpcap
+description: Bindings to libpcap via FFI interface in Ruby.
+license: MIT
+authors:
+ - Postmodern
+ - Dakrone
+ - Eric Monti
+email: postmodern.mod3@gmail.com
+homepage: https://github.com/sophsec/ffi-pcap
+has_yard: true
+
+requirements: libpcap >= 1.0.0
+
+dependencies:
+  ffi: ~> 1.0
+  ffi_dry: ~> 0.1.12
+
+development_dependencies:
+  rubygems-tasks: ~> 0.2
+  rspec: ~> 2.0
+  yard: ~> 0.8

data/lib/ffi/pcap.rb

@@ -1,22 +1,16 @@
-begin; require 'rubygems'; rescue LoadError; end
-
 require 'ffi_dry'
 
 module FFI
-module PCap
-  extend FFI::Library
+  module PCap
+    extend FFI::Library
 
-  begin
-    ffi_lib "wpcap"
-  rescue LoadError
-    ffi_lib "pcap"
+    ffi_lib ['pcap', 'libpcap.so.1', 'wpcap']
   end
-end
+
+  Pcap = PCap
 end
 
 require 'ffi/pcap/crt'
-
-require 'ffi/pcap/version'
 require 'ffi/pcap/exceptions'
 
 # FFI typedefs, pointer wrappers, and struct
@@ -28,7 +22,8 @@ require 'ffi/pcap/file_header'
 require 'ffi/pcap/time_val'
 require 'ffi/pcap/packet_header'
 require 'ffi/pcap/stat'
-require 'ffi/pcap/bpf'
+require 'ffi/pcap/bpf_instruction'
+require 'ffi/pcap/bpf_program'
 require 'ffi/pcap/dumper'
 
 # Ruby FFI function bindings, sugar, and misc wrappers
@@ -39,4 +34,3 @@ require 'ffi/pcap/packet'
 require 'ffi/pcap/live'
 require 'ffi/pcap/offline'
 require 'ffi/pcap/dead'
-

data/lib/ffi/pcap/addr.rb

@@ -1,21 +1,22 @@
-
 module FFI
-module PCap
+  module PCap
+    #
+    # Representation of an interface address.
+    #
+    # See pcap_addr struct in `pcap.h`
+    #
+    class Addr < FFI::Struct
 
-  # Representation of an interface address.
-  #
-  # See pcap_addr struct in pcap.h
-  class Addr < FFI::Struct
-    include FFI::DRY::StructHelper
+      include FFI::DRY::StructHelper
 
-    dsl_layout do
-      p_struct :next,       ::FFI::PCap::Addr
-      p_struct :addr,       ::FFI::PCap::SockAddr, :desc => 'address'
-      p_struct :netmask,    ::FFI::PCap::SockAddr, :desc => 'netmask of the address'
-      p_struct :broadcast,  ::FFI::PCap::SockAddr, :desc => 'broadcast for the address'
-      p_struct :dest_addr,  ::FFI::PCap::SockAddr, :desc => 'p2p destination for address'
-    end
+      dsl_layout do
+        p_struct :next,       ::FFI::PCap::Addr
+        p_struct :addr,       ::FFI::PCap::SockAddr, :desc => 'address'
+        p_struct :netmask,    ::FFI::PCap::SockAddr, :desc => 'netmask of the address'
+        p_struct :broadcast,  ::FFI::PCap::SockAddr, :desc => 'broadcast for the address'
+        p_struct :dest_addr,  ::FFI::PCap::SockAddr, :desc => 'p2p destination for address'
+      end
 
+    end
   end
 end
-end

data/lib/ffi/pcap/bpf_instruction.rb

@@ -0,0 +1,25 @@
+require 'ffi/pcap/typedefs'
+
+module FFI
+  module PCap
+    #
+    # Includes structures defined in `pcap-bpf.h`
+    #
+    # Berkeley Packet Filter instruction data structure.
+    #
+    # See bpf_insn struct in `pcap-bpf.h`
+    #
+    class BPFInstruction < FFI::Struct
+
+      include FFI::DRY::StructHelper
+
+      dsl_layout do
+        field :code,  :ushort
+        field :jt,    :uchar
+        field :jf,    :uchar
+        field :k,     :bpf_int32
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bpf_program.rb

@@ -0,0 +1,85 @@
+require 'ffi/pcap/bpf_instruction'
+require 'ffi/pcap/data_link'
+
+module FFI
+  module PCap
+    #
+    # Structure for `pcap_compile()`, `pcap_setfilter()`, etc.
+    #
+    # See bpf_program struct in `pcap-bpf.h`
+    #
+    class BPFProgram < FFI::Struct
+
+      include FFI::DRY::StructHelper
+
+      dsl_layout do
+        field    :bf_len,  :uint
+        field    :bf_insn, :pointer
+      end
+
+      def instructions
+        i = 0
+        sz = BPFInstruction.size
+
+        Array.new(self.bf_len) do 
+          ins = BPFInstruction.new( self[:bf_insn] + i )
+          i += sz
+          ins
+        end
+      end
+
+      def free!
+        unless @closed
+          @freed = true
+          PCap.pcap_freecode(self)
+        end
+      end
+
+      def freed?
+        @freed == true
+      end
+
+      #
+      # Compiles a bpf filter without a pcap device being open. Downside is
+      # no error messages are available, whereas they are when you use 
+      # open_dead() and use compile() on the resulting Dead.
+      #
+      # @param [Hash] opts
+      #   Additional options for compile
+      #
+      # @option opts [optional, DataLink, Integer, String, Symbol] :datalink
+      #   DataLink layer type. The argument type will be resolved to a
+      #   DataLink value if possible. Defaults to data-link layer type NULL.
+      #
+      # @option opts [optional, Integer] :snaplen
+      #   The snapshot length for the filter. Defaults to SNAPLEN
+      #
+      # @option opts [optional, Integer] :optimize
+      #   Optimization flag. 0 means don't optimize. Defaults to 1.
+      #
+      # @option opts [optional, Integer] :netmask
+      #   A 32-bit number representing the IPv4 netmask of the network on
+      #   which packets are being captured. It is only used when checking
+      #   for IPv4 broadcast addresses in the filter program.
+      #   Default: 0 (unspecified netmask)
+      #
+      # @return [BPFProgram]
+      #   If no errors occur, a compiled BPFProgram is returned.
+      #
+      def self.compile(expr, opts={})
+        datalink = (opts[:datalink] || 1)
+        dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink)
+        slen     = (opts[:snaplen] || DEFAULT_SNAPLEN)
+        optimize = (opts[:optimize] || 1)
+        mask     = (opts[:netmask] || 0)
+
+        code = new()
+        r = PCap.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask)
+
+        raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0
+        return code
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bsd.rb

@@ -1,98 +1,9 @@
-# Here's where various BSD sockets typedefs and structures go
-# ... good to have around
-# cribbed from dnet-ffi - EM
-
-require 'socket'
-
-module FFI
-module PCap
-  typedef :uint8, :sa_family_t
-  typedef :uint32, :in_addr_t
-  typedef :uint16, :in_port_t
-
-  # contains AF_* constants culled from Ruby's ::Socket
-  module AF
-    include ::FFI::DRY::ConstMap
-    slurp_constants(::Socket, "AF_")
-    def self.list; @@list ||= super() ; end
-  end
-
-  # Common abstract superclass for all sockaddr struct classes
-  #
-  class SockAddrFamily < ::FFI::Struct
-    include ::FFI::DRY::StructHelper
-    
-    # returns an address family name for the :family struct member value
-    def lookup_family
-      AF[ self[:family] ]
-    end
-  end
-
-  # generic sockaddr, always good to have around
-  #
-  class SockAddr < SockAddrFamily
-    dsl_layout do
-      field :len,    :uint8,        :desc => 'total length of struct'
-      field :family, :sa_family_t,  :desc => 'address family (AF_*)'
-      field :data,   :char,         :desc => 'variable length bound by :len'
-    end
-  end
-
-
-  # Used to represent a 32-bit IPv4 address in a sock_addr_in structure
-  # 
-  class InAddr < ::FFI::Struct
-    include ::FFI::DRY::StructHelper
-    dsl_layout { field :in_addr,  :in_addr_t, :desc => 'inet address' }
-  end
-
-  # sockaddr inet, always good to have around
-  #
-  class SockAddrIn < SockAddrFamily
-    dsl_layout do
-      field :len,    :uint8,        :desc => 'length of structure (16)'
-      field :family, :sa_family_t,  :desc => 'address family (AF_INET)'
-      field :port,   :in_port_t,    :desc => '16-bit TCP or UDP port number'
-      field :addr,   :in_addr_t,    :desc => '32-bit IPv4 address'
-      array :_sa_zero, [:uint8,8],  :desc => 'unused'
-    end
-  end
-
-  # Used to represent an IPv6 address in a sock_addr_in6 structure
-  #
-  class In6Addr < ::FFI::Struct
-    include ::FFI::DRY::StructHelper
-    dsl_layout { array :s6_addr, [:uint8, 16], :desc => 'IPv6 address' }
-  end
-
-  # IPv6 socket address
-  #
-  class SockAddrIn6 < SockAddrFamily
-    dsl_layout do
-      field :len,      :uint8,       :desc => 'length of structure(24)'
-      field :family,   :sa_family_t, :desc => 'address family (AF_INET6)'
-      field :port,     :in_port_t,   :desc => 'transport layer port'
-      field :flowinfo, :uint32,      :desc => 'priority & flow label'
-      struct :addr,    ::FFI::PCap::In6Addr,     :desc => 'IPv6 address'
-    end
-  end
-
-
-  # data-link socket address
-  #
-  class SockAddrDl < SockAddrFamily
-    dsl_layout do
-      field :len,       :uint8,   :desc => 'length of structure(variable)'
-      field :family, :sa_family_t, :desc => 'address family (AF_LINK)'
-      field :sdl_index, :uint16,  :desc => 'system assigned index, if > 0'
-      field :dltype,    :uint8,   :desc => 'IFT_ETHER, etc. from net/if_types.h'
-      field :nlen,      :uint8,   :desc => 'name length, from :_data'
-      field :alen,      :uint8,   :desc => 'link-layer addres-length'
-      field :slen,      :uint8,   :desc => 'link-layer selector length'
-      field :_data,     :char,    :desc => 'minimum work area=12, can be larger'
-    end
-  end
-
-end
-end
-
+require 'ffi/pcap/bsd/typedefs'
+require 'ffi/pcap/bsd/af'
+require 'ffi/pcap/bsd/in_addr'
+require 'ffi/pcap/bsd/sock_addr'
+require 'ffi/pcap/bsd/sock_addr_family'
+require 'ffi/pcap/bsd/sock_addr_in'
+require 'ffi/pcap/bsd/sock_addr_dl'
+require 'ffi/pcap/bsd/in6_addr'
+require 'ffi/pcap/bsd/sock_addr_in6'

data/lib/ffi/pcap/bsd/af.rb

@@ -0,0 +1,18 @@
+require 'socket'
+
+module FFI
+  module PCap
+    #
+    # Contains `AF_*` constants culled from Ruby's ::Socket
+    #
+    module AF
+      include ::FFI::DRY::ConstMap
+
+      slurp_constants(::Socket, "AF_")
+
+      def self.list
+        @@list ||= super()
+      end
+    end
+  end
+end

data/lib/ffi/pcap/bsd/in6_addr.rb

@@ -0,0 +1,16 @@
+module FFI
+  module PCap
+    #
+    # Used to represent an IPv6 address in a sock_addr_in6 structure
+    #
+    class In6Addr < ::FFI::Struct
+
+      include ::FFI::DRY::StructHelper
+
+      dsl_layout do
+        array :s6_addr, [:uint8, 16], :desc => 'IPv6 address'
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bsd/in_addr.rb

@@ -0,0 +1,18 @@
+require 'ffi/pcap/bsd/typedefs'
+
+module FFI
+  module PCap
+    #
+    # Used to represent a 32-bit IPv4 address in a sock_addr_in structure
+    # 
+    class InAddr < ::FFI::Struct
+
+      include ::FFI::DRY::StructHelper
+
+      dsl_layout do
+        field :in_addr,  :in_addr_t, :desc => 'inet address'
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bsd/sock_addr.rb

@@ -0,0 +1,19 @@
+require 'ffi/pcap/bsd/typedefs'
+require 'ffi/pcap/bsd/sock_addr_family'
+
+module FFI
+  module PCap
+    #
+    # generic sockaddr, always good to have around
+    #
+    class SockAddr < SockAddrFamily
+
+      dsl_layout do
+        field :len,    :uint8,        :desc => 'total length of struct'
+        field :family, :sa_family_t,  :desc => 'address family (AF_*)'
+        field :data,   :char,         :desc => 'variable length bound by :len'
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bsd/sock_addr_dl.rb

@@ -0,0 +1,24 @@
+require 'ffi/pcap/bsd/typedefs'
+require 'ffi/pcap/bsd/sock_addr_family'
+
+module FFI
+  module PCap
+    #
+    # data-link socket address
+    #
+    class SockAddrDl < SockAddrFamily
+
+      dsl_layout do
+        field :len,       :uint8,   :desc => 'length of structure(variable)'
+        field :family,    :sa_family_t, :desc => 'address family (AF_LINK)'
+        field :sdl_index, :uint16,  :desc => 'system assigned index, if > 0'
+        field :dltype,    :uint8,   :desc => 'IFT_ETHER, etc. from net/if_types.h'
+        field :nlen,      :uint8,   :desc => 'name length, from :_data'
+        field :alen,      :uint8,   :desc => 'link-layer addres-length'
+        field :slen,      :uint8,   :desc => 'link-layer selector length'
+        field :_data,     :char,    :desc => 'minimum work area=12, can be larger'
+      end
+
+    end
+  end
+end

data/lib/ffi/pcap/bsd/sock_addr_family.rb

@@ -0,0 +1,19 @@
+require 'ffi/pcap/bsd/af'
+
+module FFI
+  module PCap
+    #
+    # Common abstract superclass for all sockaddr struct classes
+    #
+    class SockAddrFamily < ::FFI::Struct
+
+      include ::FFI::DRY::StructHelper
+
+      # returns an address family name for the :family struct member value
+      def lookup_family
+        AF[self[:family]]
+      end
+
+    end
+  end
+end