packetfu 1.1.11 → 1.1.12.pre

data/test/func_lldp.rb

@@ -1,25 +0,0 @@
-#!/usr/bin/ruby
-
-# Functional test script contributed by @dmaciejak
-# Still need a real test set.
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-def lldp_pcap
-  fname = "./sample_lldp.pcap"
-  fname if File.readable? fname
-end
-
-def lldp_test()
-  raise RuntimeError, "Need a sample_lldp.pcap to check!" unless lldp_pcap
-  cap = PacketFu::PcapFile.new.file_to_array(:filename => lldp_pcap)
-  cap.each do |p|
-        pkt = PacketFu::Packet.parse p
-        if pkt.is_lldp?
-          packet_info = [pkt.proto.last, pkt.lldp_capabilty, pkt.lldp_address_type_readable, pkt.lldp_address, pkt.lldp_interface_type, pkt.lldp_interface]
-          puts "%s | %15s | %15s | %15s | %15s | %15s |" % packet_info
-        end
-  end
-end
-
-lldp_test()

data/test/ptest.rb

@@ -1,16 +0,0 @@
-#!/usr/bin/env ruby
-$:.unshift File.expand_path(File.dirname(__FILE__) + "/../lib/")
-require 'pcaprub'
-require 'packetfu'
-include PacketFu
-
-if Process.euid.zero? 
-  puts ">> Interface: " << Pcap.lookupdev
-else
-  puts ">> No interface access"
-end	
-puts ">> Version: " << PacketFu.version
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby
-
-

data/test/test_eth.rb

@@ -1,93 +0,0 @@
-#!/usr/bin/env ruby
-# -*- coding: binary -*-
-
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-puts "Testing #{PacketFu.version}: #{$0}"
-
-class EthTest < Test::Unit::TestCase
-
-  def test_ethmac
-    dst = "\x00\x03\x2f\x1a\x74\xde"
-    e = PacketFu::EthMac.new
-    e.read dst
-    assert_equal(dst, e.to_s)
-    assert_equal(0x32f, e.oui.oui)
-    assert_equal("\x1a\x74\xde", e.nic.to_s)
-    assert_equal(222, e.nic.n2)
-  end
-
-  def test_ethmac_ipad
-    dst = "\x7c\x6d\x62\x01\x02\x03"
-    e = PacketFu::EthMac.new
-    e.read dst
-    assert_equal(dst, e.to_s)
-    assert_equal(0x6d62, e.oui.oui)
-  end
-
-  def test_ethmac_class
-    src = "\x00\x1b\x11\x51\xb7\xce"
-    e = PacketFu::EthMac.new
-    e.read src
-    assert_instance_of(PacketFu::EthMac, e)
-  end
-
-  def test_eth
-    header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
-    src = "\x00\x1b\x11\x51\xb7\xce"
-    dst = "\x00\x03\x2f\x1a\x74\xde"
-    e = PacketFu::EthHeader.new
-    e.eth_dst = dst
-    e.eth_src = src
-    e.eth_proto = "\x08\x00"
-    assert_equal(header, e.to_s)
-    assert_equal(header, PacketFu::EthHeader.new.read(header).to_s)
-  end
-
-  def test_macaddr
-    dst = "\x00\x03\x2f\x1a\x74\xde"
-    dstmac = "00:03:2f:1a:74:de"
-    assert_equal(dstmac,PacketFu::EthHeader.str2mac(dst))
-    assert_equal(dst, PacketFu::EthHeader.mac2str(dstmac))
-  end
-
-end
-
-class EthPacketTest < Test::Unit::TestCase
-  include PacketFu
-
-  def test_eth_create
-    sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[0]
-    e = EthPacket.new
-    header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
-    assert_kind_of EthPacket, e
-    assert_kind_of EthHeader, e.headers[0]
-    assert e.is_eth?
-    assert !e.is_tcp?
-    e.eth_dst = "\x00\x03\x2f\x1a\x74\xde"
-    e.eth_src = "\x00\x1b\x11\x51\xb7\xce"
-    e.eth_proto = 0x0800
-    assert_equal header, e.to_s[0,14]
-  end
-
-  def test_eth_new
-    p = EthPacket.new(
-    :eth_dst => "\x00\x03\x2f\x1a\x74\xde",
-    :eth_src => "\x00\x1b\x11\x51\xb7\xce",
-    :eth_proto => 0x0800)
-    header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
-    assert_equal header, p.to_s[0,14]
-  end
-
-  def test_eth_write
-    p = EthPacket.new(
-    :eth_dst => "\x00\x03\x2f\x1a\x74\xde",
-    :eth_src => "\x00\x1b\x11\x51\xb7\xce",
-    :eth_proto => 0x0800)
-    p.to_f('eth_test.pcap')
-  end
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/test_hsrp.rb

@@ -1,20 +0,0 @@
-#!/usr/bin/env ruby
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-class HSRPTest < Test::Unit::TestCase
-  include PacketFu
-
-  def test_hsrp_read
-    sample_packet = PcapFile.new.file_to_array(:f => 'sample_hsrp_pcapr.cap')[0]
-    pkt = Packet.parse(sample_packet)
-    assert pkt.is_hsrp?
-    assert pkt.is_udp?
-    assert_equal(0x2d8d, pkt.udp_sum.to_i)
-    # pkt.to_f('udp_test.pcap','a')
-  end
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/test_invalid.rb

@@ -1,28 +0,0 @@
-#!/usr/bin/env ruby
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-class InvalidTest < Test::Unit::TestCase
-  include PacketFu
-
-  def test_create_invalid
-    p = InvalidPacket.new
-    assert_kind_of InvalidPacket, p
-    assert_kind_of Packet, p
-    assert p.is_invalid?
-    assert_equal false, p.is_eth?
-    assert_not_equal EthPacket, p.class
-  end
-
-  # Sadly, the only way to generate an "InvalidPacket" is
-  # to read a packet that's less than 14 bytes. Otherwise,
-  # it's presumed to be an EthPacket. TODO: Fix this assumption!
-  def test_parse_invalid
-    p = Packet.parse("A" * 13)
-    assert_kind_of InvalidPacket, p
-  end
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/test_octets.rb

@@ -1,36 +0,0 @@
-#!/usr/bin/env ruby
-# -*- coding: binary -*-
-
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-class OctetsTest < Test::Unit::TestCase
-  include PacketFu
-
-  def test_octets_read
-    o = Octets.new
-    o.read("\x04\x03\x02\x01")
-    assert_equal("4.3.2.1", o.to_x)
-  end
-
-  def test_octets_read_quad
-    o = Octets.new
-    o.read_quad("1.2.3.4")
-    assert_equal("1.2.3.4", o.to_x)
-    assert_equal("\x01\x02\x03\x04", o.to_s)
-    assert_equal(0x01020304, o.to_i)
-  end
-
-  def test_octets_single_octet
-    o = Octets.new
-    o.read("ABCD")
-    assert_equal(o.o1, 0x41)
-    assert_equal(o.o2, 0x42)
-    assert_equal(o.o3, 0x43)
-    assert_equal(o.o4, 0x44)
-  end
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/test_pcap.rb

@@ -1,211 +0,0 @@
-#!/usr/bin/env ruby
-# -*- coding: binary -*-
-
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-class PcapHeaderTest < Test::Unit::TestCase
-  include PacketFu
-  def setup
-    @file = File.open('sample.pcap') {|f| f.read}
-    @file.force_encoding "binary" if @file.respond_to? :force_encoding
-    @file_magic = @file[0,4]
-    @file_header = @file[0,24]
-  end
-
-  def test_header_size
-    assert_equal(24, PcapHeader.new.sz)
-    assert_equal(24, PcapHeader.new.sz)
-  end
-
-  # If this fails, the rest is pretty much for naught.
-  def test_read_file
-    assert_equal("\xd4\xc3\xb2\xa1", @file_magic) # yep, it's libpcap.
-  end
-
-  def test_endian_magic
-    p = PcapHeader.new # usual case
-    assert_equal(@file_magic, p.to_s[0,4]) 
-    p = PcapHeader.new(:endian => :big)
-    assert_equal("\xa1\xb2\xc3\xd4", p.to_s[0,4])
-  end
-
-  def test_header
-    p = PcapHeader.new
-    assert_equal(@file_header, p.to_s[0,24])
-    p = PcapHeader.new(:endian => :big)
-    assert_not_equal(@file_header, p.to_s[0,24])
-    # We want to ensure our endianness is little or big.
-    assert_raise(ArgumentError) {PcapHeader.new(:endian => :just_right)}
-  end
-
-  def test_header_read
-    p = PcapHeader.new
-    p.read @file
-    assert_equal(@file_header,p.to_s)
-  end
-
-end
-
-class TimestampTest < Test::Unit::TestCase
-  include PacketFu
-  def setup
-    @file = File.open('sample.pcap') {|f| f.read}
-    @ts = @file[24,8]
-  end
-
-  def test_timestamp_size
-    assert_equal(3, Timestamp.new.size) # Number of elements
-    assert_equal(8, Timestamp.new.sz) # Length of the string (in PacketFu)
-  end
-
-  def test_timestamp_read
-    t = Timestamp.new
-    t.read(@ts)
-    assert_equal(@ts, t.to_s)
-  end
-end
-
-class PcapPacketTest < Test::Unit::TestCase
-  include PacketFu
-  def setup
-    @file = File.open('sample.pcap') {|f| f.read}
-    @file.force_encoding "binary" if @file.respond_to? :force_encoding
-    @header = @file[0,24]
-    @packet = @file[24,100] # pkt is 78 bytes + 16 bytes pcap hdr == 94
-  end
-
-  def test_pcappacket_read
-    p = PcapPacket.new :endian => :little
-    p.read(@packet)
-    assert_equal(78,@packet[8,4].unpack("V").first)
-    assert_equal(@packet[8,4].unpack("V").first,p[:incl_len].to_i)
-    assert_equal(@packet[0,94],p.to_s)
-  end
-
-end
-
-class PcapPacketsTest < Test::Unit::TestCase
-
-  include PacketFu
-  def setup
-    @file = File.open('sample.pcap') {|f| f.read}
-  end
-
-  def test_pcappackets_read
-    p = PcapPackets.new
-    p.read @file
-    assert_equal(11,p.size)
-    assert_equal(@file[24,@file.size],p.to_s)
-  end
-
-end
-
-class PcapFileTest < Test::Unit::TestCase
-  require 'digest/md5'
-
-  include PacketFu
-  def setup
-    @file = File.open('sample.pcap') {|f| f.read}
-    @md5 = '1be3b5082bb135c6f22de8801feb3495'
-  end
-
-  def test_pcapfile_read
-    p = PcapFile.new
-    p.read @file
-    assert_equal(3,p.size)
-    assert_equal(@file.size, p.sz)
-    assert_equal(@file, p.to_s)
-  end
-
-  def test_pcapfile_file_to_array
-    p = PcapFile.new.file_to_array(:filename => 'sample.pcap')
-    assert_equal(@md5.downcase, Digest::MD5.hexdigest(@file).downcase)
-    assert_instance_of(Array, p)
-    assert_instance_of(String, p[0])
-    assert_equal(11,p.size)
-    assert_equal(78,p[0].size)
-    assert_equal(94,p[1].size)
-    assert_equal(74,p[10].size)
-  end
-
-  def test_pcapfile_read_and_write
-    File.unlink('out.pcap') if File.exists? 'out.pcap'
-    p = PcapFile.new
-    p.read @file
-    p.to_file(:filename => 'out.pcap')
-    @newfile = File.open('out.pcap') {|f| f.read(f.stat.size)}
-    @newfile.force_encoding "binary" if @newfile.respond_to? :force_encoding
-    assert_equal(@file, @newfile)
-    p.to_file(:filename => 'out.pcap', :append => true)
-    packet_array = PcapFile.new.f2a(:filename => 'out.pcap')
-    assert_equal(22, packet_array.size)
-  end
-
-  def test_pcapfile_write_after_recalc
-    File.unlink('out.pcap') if File.exists? 'out.pcap'
-    pcaps = PcapFile.new.file_to_array(:filename => 'sample.pcap')
-    pcaps.each {|pkt|
-      p = Packet.parse pkt
-      p.recalc
-      p.to_f('out.pcap','a')
-    }
-    packet_array = PcapFile.new.f2a(:filename => 'out.pcap')
-    assert_equal(11, packet_array.size)
-    File.unlink('out.pcap')
-  end
-
-  def test_pcapfile_read_and_write_timestamps
-    File.unlink('out.pcap') if File.exists? 'out.pcap'
-    pf = PcapFile.new
-    arr = pf.file_to_array(:filename => 'sample.pcap')
-    assert_equal(11, arr.size)
-    pf = PcapFile.new
-    pf.a2f(:array => arr, :f => 'out.pcap', :ts_inc => 4, 
-           :timestamp => Time.now.to_i - 1_000_000)
-    diff_time = pf.body[0].timestamp.sec.to_i - pf.body[1].timestamp.sec.to_i
-    assert_equal(-4, diff_time)
-    File.unlink('out.pcap')
-  end
-
-end
-  
-# Test the legacy Read objects.
-class ReadTest < Test::Unit::TestCase
-
-  include PacketFu
-
-  def test_read_string
-    pkts = Read.file_to_array(:file => 'sample.pcap')
-    assert_kind_of Array, pkts
-    assert_equal 11, pkts.size
-    this_packet = Packet.parse pkts[0]
-    assert_kind_of UDPPacket, this_packet
-    that_packet = Packet.parse pkts[3]
-    assert_kind_of ICMPPacket, that_packet
-  end
-
-  def test_read_hash
-    pkts = Read.file_to_array(:file => 'sample.pcap', :ts => true)
-    assert_kind_of Array, pkts
-    assert_equal 11, pkts.size
-    this_packet = Packet.parse pkts[0].values.first
-    assert_kind_of UDPPacket, this_packet
-    that_packet = Packet.parse pkts[3].values.first
-    assert_kind_of ICMPPacket, that_packet
-  end
-
-end
-
-class WriteTest < Test::Unit::TestCase
-
-  include PacketFu
-
-  def test_write
-
-  end
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/test_udp.rb

@@ -1,100 +0,0 @@
-#!/usr/bin/env ruby
-# -*- coding: binary -*-
-
-require 'test/unit'
-$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
-require 'packetfu'
-
-class String
-  def bin
-    self.scan(/../).map {|x| x.to_i(16).chr}.join
-  end
-end
-
-class UDPTest < Test::Unit::TestCase
-  include PacketFu
-
-  def test_udp_header_new
-    u = UDPHeader.new
-    assert_kind_of UDPHeader, u
-    assert_equal(8, u.to_s.size)
-    assert_equal("\x00\x00\x00\x00\x00\x08\x00\x00", u.to_s)
-  end
-
-  def test_udp_peek
-    u = UDPPacket.new
-    u.ip_saddr = "10.20.30.40"
-    u.ip_daddr = "50.60.70.80"
-    u.udp_src = 53
-    u.udp_dport = 1305
-    u.payload = "abcdefghijklmnopqrstuvwxyz"
-    u.recalc
-    puts "\n"
-    puts "UDP Peek format: "
-    puts u.peek
-    assert (u.peek.size <= 80)
-  end
-
-  def test_udp_pcap
-    u = UDPPacket.new
-    assert_kind_of UDPPacket, u
-    u.recalc
-    u.to_f('udp_test.pcap','a')
-    u.ip_saddr = "10.20.30.40"
-    u.ip_daddr = "50.60.70.80"
-    u.payload = "+some fakey-fake udp packet"
-    u.udp_src = 1205
-    u.udp_dst = 13013
-    u.recalc
-    u.to_f('udp_test.pcap','a')
-  end
-
-  def test_udp_read
-    sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[0]
-    pkt = Packet.parse(sample_packet)
-    assert_kind_of UDPPacket, pkt
-    assert_equal(0x8bf8, pkt.udp_sum.to_i)
-    pkt.to_f('udp_test.pcap','a')
-  end
-
-  def test_udp_checksum
-    sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[0]
-    pkt = Packet.parse(sample_packet)
-    assert_kind_of UDPPacket, pkt
-    pkt.recalc
-    assert_equal(0x8bf8, pkt.udp_sum.to_i)
-    pkt.to_f('udp_test.pcap','a')
-  end
-
-  def test_udp_read_strip
-    str = "01005e7ffffa100ba9eb63400800450000a12d7c0000011159b446a5fb7ceffffffacdf3076c008d516e4d2d534541524348202a20485454502f312e310d0a486f73743a3233392e3235352e3235352e3235303a313930300d0a53543a75726e3a736368656d61732d75706e702d6f72673a6465766963653a496e7465726e6574476174657761794465766963653a310d0a4d616e3a22737364703a646973636f766572220d0a4d583a330d0a0d0a".bin
-    str << "0102".bin # Tacking on a couple extra bites tht we'll strip off.
-    not_stripped = UDPPacket.new
-    not_stripped.read(str)
-    assert_equal 135, not_stripped.udp_header.body.length
-    stripped = UDPPacket.new
-    stripped.read(str, :strip => true)
-    assert_equal 133, stripped.udp_header.body.length
-  end
-
-  def test_udp_alter
-    sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[0]
-    pkt = Packet.parse(sample_packet)
-    assert_kind_of UDPPacket, pkt
-    pkt.payload = pkt.payload.gsub(/metasploit/,"MeatPistol")
-    pkt.recalc
-    assert_equal(0x8341, pkt.udp_sum)
-    pkt.to_f('udp_test.pcap','a')
-  end
-
-  def test_udp_reread
-    sample_packet = PacketFu::UDPPacket.new
-    pkt = Packet.parse(sample_packet.to_s)
-    assert sample_packet.is_udp?
-    assert pkt.is_udp?
-  end
-
-
-end
-
-# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby