packetfu 1.1.10 → 1.1.11

data/examples/dissect_thinger.rb

@@ -14,10 +14,10 @@ include PacketFu
 
 packets = PcapFile.file_to_array fname
 packets.each do |packet|
-	puts "_" * 75
-	puts packet.inspect
-	puts "_" * 75
-	pkt = Packet.parse(packet)
-	puts pkt.dissect
-	sleep sleep_interval
+  puts "_" * 75
+  puts packet.inspect
+  puts "_" * 75
+  pkt = Packet.parse(packet)
+  puts pkt.dissect
+  sleep sleep_interval
 end

data/examples/new-simple-stats.rb

@@ -13,38 +13,38 @@ require './examples' # For path setting slight-of-hand
 require 'packetfu'
 
 def print_results(stats)
-	stats.each_pair { |k,v| puts "%-12s: %10d" % [k,v] }
+  stats.each_pair { |k,v| puts "%-12s: %10d" % [k,v] }
 end
 
 # Takes a file name, parses the packets, and records the packet
 # type based on its PacketFu class.
 def count_packet_types(file)
-	stats = {}
-	count = 0
-	elapsed = 0
-	start_time = Time.now
-	PacketFu::PcapFile.read_packets(file) do |pkt|
-		kind = pkt.proto.last.to_sym
-		stats[kind] ? stats[kind] += 1 : stats[kind] = 1
-		count += 1
-		elapsed = (Time.now - start_time).to_i
-		if count % 5_000 == 0
-			puts "After #{count} packets (#{elapsed} seconds elapsed):"
-			print_results(stats)
-		end
-	end
-	puts "Final results for #{count} packets (#{elapsed} seconds elapsed):"
-	print_results(stats)
+  stats = {}
+  count = 0
+  elapsed = 0
+  start_time = Time.now
+  PacketFu::PcapFile.read_packets(file) do |pkt|
+    kind = pkt.proto.last.to_sym
+    stats[kind] ? stats[kind] += 1 : stats[kind] = 1
+    count += 1
+    elapsed = (Time.now - start_time).to_i
+    if count % 5_000 == 0
+      puts "After #{count} packets (#{elapsed} seconds elapsed):"
+      print_results(stats)
+    end
+  end
+  puts "Final results for #{count} packets (#{elapsed} seconds elapsed):"
+  print_results(stats)
 end
 
 if File.readable?(infile = (ARGV[0] || 'in.pcap'))
-	title = "Packets by packet type in '#{infile}'"
-	puts "-" * title.size
-	puts title
-	puts "-" * title.size
-	count_packet_types(infile)
+  title = "Packets by packet type in '#{infile}'"
+  puts "-" * title.size
+  puts title
+  puts "-" * title.size
+  count_packet_types(infile)
 else
-	raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
+  raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
 end
 
 

data/examples/packetfu-shell.rb

@@ -49,12 +49,12 @@ require './examples'
 require 'packetfu'
 
 module PacketFu
-	def whoami?(args={})
-		Utils.whoami?(args)
-	end
-	def arp(arg)
-		Utils.arp(arg)
-	end
+  def whoami?(args={})
+    Utils.whoami?(args)
+  end
+  def arp(arg)
+    Utils.arp(arg)
+  end
 end
 
 include PacketFu
@@ -64,7 +64,7 @@ include PacketFu
 # http://jisho.org/words?jap=+%E3%83%91%E3%82%B1%E3%83%83%E3%83%88%E3%83%95&eng=&dict=edict
 #
 def packetfu_ascii_art
-	puts <<EOM
+  puts <<EOM
  _______  _______  _______  _        _______ _________ _______          
 (  ____ )(  ___  )(  ____ \\| \\    /\\(  ____ \\\\__   __/(  ____ \\|\\     /|
 | (    )|| (   ) || (    \\/|  \\  / /| (    \\/   ) (   | (    \\/| )   ( |
@@ -82,33 +82,33 @@ def packetfu_ascii_art
              a mid-level packet manipulation library for ruby
 
 EOM
-	end
+  end
 
 @pcaprub_loaded = PacketFu.pcaprub_loaded?
 # Displays a helpful banner.
 def banner
-	packetfu_ascii_art
-	puts ">>> PacketFu Shell #{PacketFu.version}."
-	if Process.euid.zero? && @pcaprub_loaded
-		puts ">>> Use $packetfu_default.config for salient networking details."
-		print "IP:  %-15s Mac: %s" % [$packetfu_default.ip_saddr, $packetfu_default.eth_saddr]
-		puts "   Gateway: %s" % $packetfu_default.eth_daddr
-		print "Net: %-15s" % [Pcap.lookupnet($packetfu_default.iface)][0]
-		print "  " * 13 
-		puts "Iface:   %s" % [($packetfu_default.iface)]
-		puts ">>> Packet capturing/injecting enabled."
-	else
-		print ">>> Packet capturing/injecting disabled. "
-		puts Process.euid.zero? ? "(no PcapRub)" : "(not root)"
-	end
-	puts "<>" * 36
+  packetfu_ascii_art
+  puts ">>> PacketFu Shell #{PacketFu.version}."
+  if Process.euid.zero? && @pcaprub_loaded
+    puts ">>> Use $packetfu_default.config for salient networking details."
+    print "IP:  %-15s Mac: %s" % [$packetfu_default.ip_saddr, $packetfu_default.eth_saddr]
+    puts "   Gateway: %s" % $packetfu_default.eth_daddr
+    print "Net: %-15s" % [Pcap.lookupnet($packetfu_default.iface)][0]
+    print "  " * 13 
+    puts "Iface:   %s" % [($packetfu_default.iface)]
+    puts ">>> Packet capturing/injecting enabled."
+  else
+    print ">>> Packet capturing/injecting disabled. "
+    puts Process.euid.zero? ? "(no PcapRub)" : "(not root)"
+  end
+  puts "<>" * 36
 end
 
 # Silly wlan0 workaround
 begin
-	$packetfu_default = PacketFu::Config.new(Utils.whoami?) if(@pcaprub_loaded && Process.euid.zero?)
+  $packetfu_default = PacketFu::Config.new(Utils.whoami?) if(@pcaprub_loaded && Process.euid.zero?)
 rescue RuntimeError
-	$packetfu_default = PacketFu::Config.new(Utils.whoami?(:iface => 'wlan0')) if(@pcaprub_loaded && Process.euid.zero?)
+  $packetfu_default = PacketFu::Config.new(Utils.whoami?(:iface => 'wlan0')) if(@pcaprub_loaded && Process.euid.zero?)
 end
 
 banner

data/examples/simple-sniffer.rb

@@ -8,15 +8,15 @@ include PacketFu
 iface = ARGV[0] || "eth0"
 
 def sniff(iface)
-	cap = Capture.new(:iface => iface, :start => true)
-	cap.stream.each do |p|
-		pkt = Packet.parse p
-		if pkt.is_ip?
-			next if pkt.ip_saddr == Utils.ifconfig(iface)[:ip_saddr]
-			packet_info = [pkt.ip_saddr, pkt.ip_daddr, pkt.size, pkt.proto.last]
-			puts "%-15s -> %-15s %-4d %s" % packet_info
-		end
-	end
+  cap = Capture.new(:iface => iface, :start => true)
+  cap.stream.each do |p|
+    pkt = Packet.parse p
+    if pkt.is_ip?
+      next if pkt.ip_saddr == Utils.ifconfig(iface)[:ip_saddr]
+      packet_info = [pkt.ip_saddr, pkt.ip_daddr, pkt.size, pkt.proto.last]
+      puts "%-15s -> %-15s %-4d %s" % packet_info
+    end
+  end
 end
 
 sniff(iface)

data/examples/simple-stats.rb

@@ -16,33 +16,33 @@ require 'packetfu'
 # Takes a file name, parses the packets, and records the packet
 # type based on its PacketFu class.
 def count_packet_types(file)
-	file = File.open(file) {|f| f.read}
-	stats = {}
-	count = 0
-	pcapfile = PacketFu::PcapPackets.new
-	pcapfile.read(file)
-	pcapfile.each do |p|
-		# Now it's a PacketFu packet struct.
-		pkt = PacketFu::Packet.parse(p.data) 
-		kind = pkt.class.to_s.split("::").last
-		if stats[kind]
-			stats[kind] += 1
-		else
-			stats[kind] = 0
-		end
-		count += 1
-		break if count >= 1_000
-	end
-	stats.each_pair { |k,v| puts "%-12s: %4d" % [k,v] }
+  file = File.open(file) {|f| f.read}
+  stats = {}
+  count = 0
+  pcapfile = PacketFu::PcapPackets.new
+  pcapfile.read(file)
+  pcapfile.each do |p|
+    # Now it's a PacketFu packet struct.
+    pkt = PacketFu::Packet.parse(p.data) 
+    kind = pkt.class.to_s.split("::").last
+    if stats[kind]
+      stats[kind] += 1
+    else
+      stats[kind] = 0
+    end
+    count += 1
+    break if count >= 1_000
+  end
+  stats.each_pair { |k,v| puts "%-12s: %4d" % [k,v] }
 end
 
 if File.readable?(infile = (ARGV[0] || 'in.pcap'))
-	title = "Packets by packet type in '#{infile}'"
-	puts title
-	puts "-" * title.size
-	count_packet_types(infile)
+  title = "Packets by packet type in '#{infile}'"
+  puts title
+  puts "-" * title.size
+  count_packet_types(infile)
 else
-	raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
+  raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
 end
 
 

data/examples/slammer.rb

@@ -14,7 +14,7 @@ include PacketFu
 slammer = "\004\001\001\001\001\001\001" + "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001" + "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001" + "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001" + "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\334\311\260B\353\016" + "\001\001\001\001\001\001\001p\256B\001p\256B\220\220\220\220\220\220\220\220h\334\311\260B\270\001\001" + "\001\0011\311\261\030P\342\3755\001\001\001\005P\211\345Qh.dllhel32hkernQhounthickChGetTf" + "\271llQh32.dhws2_f\271etQhsockf\271toQhsend\276\030\020\256B\215E\324P\377\026P\215E\340P\215E\360P\377" + "\026P\276\020\020\256B\213\036\213\003=U\213\354Qt\005\276\034\020\256B\377\026\377\3201\311QQP\201\361" + "\003\001\004\233\201\361\001\001\001\001Q\215E\314P\213E\300P\377\026j\021j\002j\002\377\320P\215E\304P" + "\213E\300P\377\026\211\306\t\333\201\363<a\331\377\213E\264\215\f@\215\024\210\301\342\004\001\302\301" + "\342\b)\302\215\004\220\001\330\211E\264j\020\215E\260P1\311Qf\201\361x\001Q\215E\003P\213E\254P\377\326" + "\353\312"
 
 def rand_source_ip
-	[rand(0xffffffff)].pack("N")
+  [rand(0xffffffff)].pack("N")
 end
 
 kill_packet = UDPPacket.new
@@ -26,9 +26,9 @@ kill_packet.recalc
 kill_packet.payload = slammer
 
 if action == 'file'.downcase
-	puts kill_packet.to_f
+  puts kill_packet.to_f
 else
-	puts kill_packet.to_w(action.downcase)
+  puts kill_packet.to_w(action.downcase)
 end
 
 

data/gem-public_cert.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbDCCAlSgAwIBAgIBATANBgkqhkiG9w0BAQUFADA+MQ0wCwYDVQQDDAR0b2Ri
+MRgwFgYKCZImiZPyLGQBGRYIcGFja2V0ZnUxEzARBgoJkiaJk/IsZAEZFgNjb20w
+HhcNMTUwODI1MTQ1MzQ2WhcNMTYwODI0MTQ1MzQ2WjA+MQ0wCwYDVQQDDAR0b2Ri
+MRgwFgYKCZImiZPyLGQBGRYIcGFja2V0ZnUxEzARBgoJkiaJk/IsZAEZFgNjb20w
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDl/jdqB/u4WnnAV7ds6U7r
+kffHRJCMc1+s0lvjnWMnZuegjJkuElm0jNQnkUzNqhJGI2NVDc1COoT6VHsEPRi8
+uD8po+7pisLwqUHIyx8PFu+pGSRGawEgAPT5DfEf9MwGTob1G9vm1Hv7rTMN+S1X
+nMIxpFwiMilhLKdoTEZAo0moFbWEVK4ZuEaNkPXGxFKEdnpyb8Fi+/akzwWtwRp1
+ByJktlF3YIZgAimvY/PtV0V1n+Mktoz+706EUDe/ZnD8M+o6orzqryCiQrqdzJyk
+cPv7u1RuG1VPC8mK5TmB9lqlMPi/hxbjC4LfhJsZYoO1AF6baZ8HzqCISInBLwyd
+AgMBAAGjdTBzMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBS/B6/d
+CN84yx061Q/xqilGxY4qqTAcBgNVHREEFTATgRF0b2RiQHBhY2tldGZ1LmNvbTAc
+BgNVHRIEFTATgRF0b2RiQHBhY2tldGZ1LmNvbTANBgkqhkiG9w0BAQUFAAOCAQEA
+Oz/R618bt2/QxwL1wM6bP/yb+xNd/DR8aOUeKZwarfWuo6zhVY03qiydlElHU0YJ
+Rl0/JGQIHNVUzIr3J/QXv225LUECYTejPKC8LcELdfjSfUwzTd75zrGisL0//a4m
++Zcv8PSfdOCug3jj5EDMVZe/sX7G4vEqM81SaQaUYFltKGk2YUrlYJsNGW6Yp4As
+c4y7lD0Rc4OsaoWT5ozhFBJv1qSuoL1y1qySsVazbc0jYjxm6HkVWqOd1cO5zO74
+AFvBtuFFTUDdrs3M/q6ktx295osXr2XpaygJmhkMLj81xoIX9G8eEjPc/XQWDlI1
+ma/kCj5vaQ3hma/0DsajCg==
+-----END CERTIFICATE-----

data/lib/packetfu.rb

@@ -13,133 +13,155 @@ require 'rubygems' if RUBY_VERSION =~ /^1\.[0-8]/
 
 module PacketFu
 
-	# Picks up all the protocols defined in the protos subdirectory
-	def self.require_protos(cwd)
-		protos_dir = File.join(cwd, "packetfu", "protos")
-		Dir.new(protos_dir).each do |fname|
-			next unless fname[/\.rb$/]
-			begin 
-				require File.join(protos_dir,fname)
-			rescue
-				warn "Warning: Could not load `#{fname}'. Skipping."
-			end
-		end
-	end
-
-	# Deal with Ruby's encoding by ignoring it.
-	def self.force_binary(str)
-		str.force_encoding Encoding::BINARY if str.respond_to? :force_encoding
-	end
-
-	# Sets the expected byte order for a pcap file. See PacketFu::Read.set_byte_order
-	@byte_order = :little
-
-	# Checks if pcaprub is loaded correctly.
-	@pcaprub_loaded = false
-
-	# PacketFu works best with Pcaprub version 0.8-dev (at least)
-	# The current (Aug 01, 2010) pcaprub gem is 0.9, so should be fine.
-	def self.pcaprub_platform_require
-		begin
-			require 'pcaprub'
-		rescue LoadError
-			return false
-		end
-		@pcaprub_loaded = true 
-	end
-
-	pcaprub_platform_require
-
-	if @pcaprub_loaded
-		pcaprub_regex = /[0-9]\.([8-9]|[1-7][0-9])(-dev)?/ # Regex for 0.8 and beyond.
-		if Pcap.version !~ pcaprub_regex 
-			@pcaprub_loaded = false # Don't bother with broken versions
-			raise LoadError, "PcapRub not at a minimum version of 0.8-dev"
-		end
-		require "packetfu/capture" 
-		require "packetfu/inject"
-	end
-
-	# Returns the status of pcaprub
-	def self.pcaprub_loaded?
-		@pcaprub_loaded
-	end
-
-	# Returns an array of classes defined in PacketFu
-	def self.classes
-		constants.map { |const| const_get(const) if const_get(const).kind_of? Class}.compact
-	end
-
-	# Adds the class to PacketFu's list of packet classes -- used in packet parsing.
-	def self.add_packet_class(klass)
-		raise "Need a class" unless klass.kind_of? Class
-		if klass.name !~ /[A-Za-z0-9]Packet/
-			raise "Packet classes should be named 'ProtoPacket'"
-		end
-		@packet_classes ||= []
-		@packet_classes << klass
-		@packet_classes_dirty = true
-		@packet_classes.sort! {|x,y| x.name <=> y.name}
-	end
-
-	# Presumably, there may be a time where you'd like to remove a packet class.
-	def self.remove_packet_class(klass)
-		raise "Need a class" unless klass.kind_of? Class
-		@packet_classes ||= []
-		@packet_classes.delete klass
-		@packet_classes_dirty = true
-		@packet_classes 
-	end
-
-	# Returns an array of packet classes
-	def self.packet_classes
-		@packet_classes || []
-	end
-
-	# Returns an array of packet types by packet prefix.
-	def self.packet_prefixes
-		return [] if @packet_classes.nil?
-		return @packet_class_prefixes if @packet_classes_dirty == false
-		@packet_classes_dirty = false
-		@packet_class_prefixes = @packet_classes.map {|p| p.to_s.split("::").last.to_s.downcase.gsub(/packet$/,"")}
-		return @packet_class_prefixes
-	end
-
-	# The current inspect style. One of :hex, :dissect, or :default
-	# Note that :default means Ruby's default, which is usually
-	# far too long to be useful.
-	def self.inspect_style
-		@inspect_style ||= :dissect
-	end
-
-	# Setter for PacketFu's @inspect_style
-	def self.inspect_style=(arg)
-		@inspect_style = case arg
-			when :hex, :pretty
-				:hex
-			when :dissect, :verbose
-				:dissect
-			when :default, :ugly
-				:default
-			else
-				:dissect
-			end
-	end
-
-	# Switches inspect styles in a round-robin fashion between 
-	# :dissect, :default, and :hex
-	def toggle_inspect
-		case @inspect_style
-		when :hex, :pretty
-			@inspect_style = :dissect
-		when :dissect, :verbose
-			@inspect_style = :default
-		when :default, :ugly
-			@inspect_style = :hex
-		else
-			@inspect_style = :dissect
-		end
-	end
+  # Picks up all the protocols defined in the protos subdirectory
+  def self.require_protos(cwd)
+    protos_dir = File.join(cwd, "packetfu", "protos")
+    Dir.new(protos_dir).each do |fname|
+      next unless fname[/\.rb$/]
+      begin 
+        require File.join(protos_dir,fname)
+      rescue
+        warn "Warning: Could not load `#{fname}'. Skipping."
+      end
+    end
+  end
+
+  # Deal with Ruby's encoding by ignoring it.
+  def self.force_binary(str)
+    str.force_encoding Encoding::BINARY if str.respond_to? :force_encoding
+  end
+
+  # Sets the expected byte order for a pcap file. See PacketFu::Read.set_byte_order
+  @byte_order = :little
+
+  # Checks if pcaprub is loaded correctly.
+  @pcaprub_loaded = false
+
+  # PacketFu works best with Pcaprub version 0.8-dev (at least)
+  # The current (Aug 01, 2010) pcaprub gem is 0.9, so should be fine.
+  def self.pcaprub_platform_require
+    begin
+      require 'pcaprub'
+    rescue LoadError
+      return false
+    end
+    @pcaprub_loaded = true 
+  end
+
+  pcaprub_platform_require
+
+  if @pcaprub_loaded
+    pcaprub_regex = /[0-9]\.([8-9]|[1-7][0-9])(-dev)?/ # Regex for 0.8 and beyond.
+    if Pcap.version !~ pcaprub_regex 
+      @pcaprub_loaded = false # Don't bother with broken versions
+      raise LoadError, "PcapRub not at a minimum version of 0.8-dev"
+    end
+    require "packetfu/capture" 
+    require "packetfu/inject"
+  end
+
+  # Returns the status of pcaprub
+  def self.pcaprub_loaded?
+    @pcaprub_loaded
+  end
+
+  # Returns an array of classes defined in PacketFu
+  def self.classes
+    constants.map { |const| const_get(const) if const_get(const).kind_of? Class}.compact
+  end
+
+  # Adds the class to PacketFu's list of packet classes -- used in packet parsing.
+  def self.add_packet_class(klass)
+    raise "Need a class" unless klass.kind_of? Class
+    if klass.name !~ /[A-Za-z0-9]Packet/
+      raise "Packet classes should be named 'ProtoPacket'"
+    end
+    @packet_classes ||= []
+    @packet_classes << klass
+    self.clear_packet_groups
+    @packet_classes.sort_by! { |x| x.name }
+  end
+
+  # Presumably, there may be a time where you'd like to remove a packet class.
+  def self.remove_packet_class(klass)
+    raise "Need a class" unless klass.kind_of? Class
+    @packet_classes ||= []
+    @packet_classes.delete klass
+    self.clear_packet_groups
+    @packet_classes 
+  end
+
+  # Returns an array of packet classes
+  def self.packet_classes
+    @packet_classes || []
+  end
+
+  # Returns an array of packet types by packet prefix.
+  def self.packet_prefixes
+    return [] if @packet_classes.nil?
+    self.reset_packet_groups unless @packet_class_prefixes
+    @packet_class_prefixes
+  end
+  
+  def self.packet_classes_by_layer
+    return [] if @packet_classes.nil?
+    self.reset_packet_groups unless @packet_classes_by_layer
+    @packet_classes_by_layer
+  end
+  
+  def self.packet_classes_by_layer_without_application
+    return [] if @packet_classes.nil?
+    self.reset_packet_groups unless @packet_classes_by_layer_without_application
+    @packet_classes_by_layer_without_application
+  end
+  
+  def self.clear_packet_groups
+    @packet_class_prefixes = nil
+    @packet_classes_by_layer = nil
+    @packet_classes_by_layer_without_application = nil
+  end		
+
+  def self.reset_packet_groups
+ 		@packet_class_prefixes = @packet_classes.map {|p| p.to_s.split("::").last.to_s.downcase.gsub(/packet$/,"")}
+    @packet_classes_by_layer = @packet_classes.sort_by { |pclass| pclass.layer }.reverse
+    @packet_classes_by_layer_without_application = @packet_classes_by_layer.reject { |pclass| pclass.layer_symbol == :application }
+  end
+
+  # The current inspect style. One of :hex, :dissect, or :default
+  # Note that :default means Ruby's default, which is usually
+  # far too long to be useful.
+  def self.inspect_style
+    @inspect_style ||= :dissect
+  end
+
+  # Setter for PacketFu's @inspect_style
+  def self.inspect_style=(arg)
+    @inspect_style = case arg
+      when :hex, :pretty
+        :hex
+      when :dissect, :verbose
+        :dissect
+      when :default, :ugly
+        :default
+      else
+        :dissect
+      end
+  end
+
+  # Switches inspect styles in a round-robin fashion between 
+  # :dissect, :default, and :hex
+  def toggle_inspect
+    case @inspect_style
+    when :hex, :pretty
+      @inspect_style = :dissect
+    when :dissect, :verbose
+      @inspect_style = :default
+    when :default, :ugly
+      @inspect_style = :hex
+    else
+      @inspect_style = :dissect
+    end
+  end
 
 
 end