packetfu 1.1.2 → 1.1.3

data/test/all_tests.rb

@@ -0,0 +1,41 @@
+#!/usr/bin/env ruby
+#
+# Tested on:
+#
+#   ruby-1.9.3-head [ x86_64 ]  
+#   ruby-1.9.1-p378 [ x86_64 ]  
+#   ruby-1.8.6-p399 [ x86_64 ]  
+#   ruby-1.8.7-p334 [ x86_64 ] 
+#   ruby-1.9.2-p180 [ x86_64 ] 
+
+# Okay so the regular test/unit stuff screws up some of my
+# meta magic. I need to move these over to spec and see
+# if they're any better. In the meantime, behold my
+# ghetto test exec()'er. It all passes with this,
+# so I'm just going to go ahead and assume the testing
+# methodolgy is flawed. TODO: rewrite all this for spec
+# and incidentally get the gem to test like it's supposed
+# to.
+
+$:.unshift File.expand_path(File.dirname(__FILE__) + "/../lib/")
+require 'packetfu'
+puts "Testing PacketFu v#{PacketFu::VERSION}"
+dir = Dir.new(File.dirname(__FILE__))
+
+dir.each { |file|
+	next unless File.file? file
+	next unless file[/^test_.*rb$/]
+	next if file == $0
+	puts "Running #{file}..."
+	cmd = %x{ruby #{file}}
+	if cmd[/ 0 failures/] && cmd[/ 0 errors/] 
+		puts "#{file}: All passed"
+	else
+		puts "File: #{file} had failures or errors:"
+		puts "-" * 80
+		puts cmd
+		puts "-" * 80
+	end
+}
+
+# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby

data/test/ethpacket_spec.rb

@@ -0,0 +1,74 @@
+$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
+require 'packetfu'
+
+include PacketFu
+
+describe EthPacket, "when read from a pcap file" do
+
+	before :all do
+		parsed_packets = PcapFile.read_packets(File.join(".","sample.pcap"))
+		@eth_packet = parsed_packets.first
+	end
+
+	context "is a regular ethernet packet" do
+
+		subject { @eth_packet }
+
+		it "should be an EthPacket kind of packet" do
+			subject.should be_kind_of EthPacket
+		end
+
+		it "should have a dest mac address" do
+			subject.eth_daddr.should == "00:03:2f:1a:74:de"
+		end
+
+		it "should have a source mac address" do
+			subject.eth_saddr.should == "00:1b:11:51:b7:ce"
+		end
+
+		its(:size) { should == 78 }
+
+		it "should have a payload in its first header" do
+			subject.headers.first.body.should_not be_nil
+		end
+
+		context "an EthPacket's first header" do
+
+			subject { @eth_packet.headers.first }
+
+			it "should be 64 bytes" do
+				subject.body.sz.should == 64
+			end
+
+			context "EthHeader struct members" do
+				if RUBY_VERSION =~ /^1\.8/
+					its(:members) { should include :eth_dst.to_s }
+					its(:members) { should include :eth_src.to_s }
+					its(:members) { should include :eth_proto.to_s }
+					its(:members) { should include :body.to_s }
+				else
+					its(:members) { should include :eth_dst }
+					its(:members) { should include :eth_src }
+					its(:members) { should include :eth_proto }
+					its(:members) { should include :body }
+				end
+			end
+
+		end
+
+	end
+
+	context "isn't a regular Ethernet packet" do
+
+		subject {
+			parsed_packets = PcapFile.read_packets(File.join(".","vlan-pcapr.cap"))
+			parsed_packets.first
+		}
+
+		it "should not be an EthPacket" do
+			subject.should_not be_kind_of EthPacket
+		end
+
+	end
+
+end

data/test/packet_spec.rb

@@ -0,0 +1,73 @@
+$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
+require 'packetfu'
+
+describe PacketFu::Packet, "abstract packet class behavior" do
+
+	before(:all) do
+		class PacketFu::FooPacket < PacketFu::Packet; end
+		class PacketFu::BarPacket < PacketFu::Packet; end
+	end
+
+	it "should not be instantiated" do
+		expect { PacketFu::Packet.new }.to raise_error(NoMethodError)
+	end
+
+	it "should allow subclasses to instantiate" do
+		expect { PacketFu::FooPacket.new }. to be
+		PacketFu.packet_classes.include?(PacketFu::FooPacket).should be_true
+	end
+
+	it "should register packet classes with PacketFu" do
+		PacketFu.packet_classes {should include(FooPacket) }
+		PacketFu.packet_classes {should include(BarPacket) }
+	end
+
+	it "should disallow badly named subclasses" do
+		expect { 
+			class PacketFu::PacketNot < PacketFu::Packet
+			end 
+		}.to raise_error
+		PacketFu.packet_classes.include?(PacketFu::PacketNot).should be_false
+		PacketFu.packet_classes {should_not include(PacketNot) }
+	end
+
+	before(:each) do
+		@tcp_packet = PacketFu::TCPPacket.new
+		@tcp_packet.ip_saddr = "10.10.10.10"
+	end
+
+	it "should shallow copy with dup()" do
+		p2 = @tcp_packet.dup
+		p2.ip_saddr = "20.20.20.20"
+		p2.ip_saddr.should == @tcp_packet.ip_saddr
+		p2.headers[1].object_id.should == @tcp_packet.headers[1].object_id
+	end
+
+	it "should deep copy with clone()" do
+		p3 = @tcp_packet.clone
+		p3.ip_saddr = "30.30.30.30"
+		p3.ip_saddr.should_not == @tcp_packet.ip_saddr
+		p3.headers[1].object_id.should_not == @tcp_packet.headers[1].object_id
+	end
+
+	it "should have senisble equality" do
+		p4 = @tcp_packet.dup
+		p4.should == @tcp_packet
+		p5 = @tcp_packet.clone
+		p5.should == @tcp_packet
+	end
+
+	# It's actually kinda hard to manually create identical TCP packets
+	it "should be possible to manually create identical packets" do
+		p6 = @tcp_packet.clone
+		p6.should == @tcp_packet
+		p7 = PacketFu::TCPPacket.new
+		p7.ip_saddr = p6.ip_saddr
+		p7.ip_id = p6.ip_id
+		p7.tcp_seq = p6.tcp_seq
+		p7.tcp_src = p6.tcp_src
+		p7.tcp_sum = p6.tcp_sum
+		p7.should == p6
+	end
+
+end

data/test/packet_subclasses_spec.rb

@@ -0,0 +1,13 @@
+$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
+require 'packetfu'
+
+PacketFu.packet_classes.each do |pclass|
+	describe pclass, "peek format" do
+		it "will display sensible peek information" do
+			p = pclass.new
+			p.respond_to?(:peek).should be_true
+			p.peek.size.should be_<=(80), p.peek.inspect
+			p.peek.should match(/^[A-Z0-9?]../)
+		end
+	end
+end

data/test/packetfu_spec.rb

@@ -0,0 +1,90 @@
+$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
+require 'packetfu'
+
+unless %x{#{$0} --version} =~ /^2\.6/
+	puts "PacketFu needs rspec 2.6 or so."
+	exit 1
+end
+
+describe PacketFu, "version information" do
+	it "reports a version number" do
+		PacketFu::VERSION.should match /^1\.[0-9]\.[0-9]$/
+	end
+	its(:version) {should eq PacketFu::VERSION} 
+
+	it "can compare version strings" do
+		PacketFu.binarize_version("1.2.3").should == 0x010203
+		PacketFu.binarize_version("3.0").should == 0x030000
+		PacketFu.at_least?("1.0").should be_true
+		PacketFu.at_least?("4.0").should be_false
+		PacketFu.older_than?("4.0").should be_true
+		PacketFu.newer_than?("1.0").should be_true
+	end
+
+	it "can handle .pre versions" do
+		PacketFu.binarize_version("1.7.6.pre").should == 0x010706
+		PacketFu.at_least?("0.9.0.pre").should be_true
+	end
+end
+
+describe PacketFu, "instance variables" do
+	it "should have a bunch of instance variables" do
+		PacketFu.instance_variable_get(:@byte_order).should == :little
+		PacketFu.instance_variable_get(:@pcaprub_loaded).should_not be_nil
+	end
+end
+
+describe PacketFu, "pcaprub deps" do
+	it "should check for pcaprub" do
+		begin
+			has_pcap = false
+			require 'pcaprub'
+			has_pcap = true
+		rescue LoadError
+		end
+		if has_pcap
+			PacketFu.instance_variable_get(:@pcaprub_loaded).should be_true
+		else
+			PacketFu.instance_variable_get(:@pcaprub_loaded).should be_false
+		end
+	end
+end
+
+describe PacketFu, "protocol requires" do
+	it "should have some protocols defined" do
+		PacketFu::EthPacket.should_not be_nil
+		PacketFu::IPPacket.should_not be_nil
+		PacketFu::TCPPacket.should_not be_nil
+		expect { PacketFu::FakePacket }.to raise_error
+	end
+end
+
+describe PacketFu, "packet class list management" do
+
+	before(:all) do
+		class PacketFu::FooPacket < PacketFu::Packet; end
+		class PacketFu::BarPacket < PacketFu::Packet; end
+		class PacketFu::PacketBaz; end
+	end
+
+	it "should allow packet class registration" do
+		PacketFu.add_packet_class(PacketFu::FooPacket).should be_kind_of Array
+		PacketFu.add_packet_class(PacketFu::BarPacket).should be_kind_of Array
+	end
+
+	its(:packet_classes) {should include(PacketFu::FooPacket)}
+
+	it "should disallow non-classes as packet classes" do
+		expect { PacketFu.add_packet_class("A String") }.to raise_error
+	end
+
+	its(:packet_prefixes) {should include("bar")}
+
+	# Don't really have much utility for this right now.
+	it "should allow packet class deregistration" do
+		PacketFu.remove_packet_class(PacketFu::BarPacket)
+		PacketFu.packet_prefixes.should_not include("bar")
+		PacketFu.add_packet_class(PacketFu::BarPacket)
+	end
+
+end

data/test/ptest.rb

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+$:.unshift File.expand_path(File.dirname(__FILE__) + "/../lib/")
+require 'pcaprub'
+require 'packetfu'
+include PacketFu
+
+if Process.euid.zero? 
+	puts ">> Interface: " << Pcap.lookupdev
+else
+	puts ">> No interface access"
+end	
+puts ">> Version: " << PacketFu.version
+
+# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby
+
+

data/test/structfu_spec.rb

@@ -0,0 +1,335 @@
+$:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
+require 'packetfu'
+
+describe StructFu, "mixin methods" do
+
+	before :each do
+		class StructClass
+			include StructFu
+		end
+		@sc = StructClass.new
+	end
+
+	it "should provide the basic StructFu methods" do
+		@sc.respond_to?(:sz).should be_true
+		@sc.respond_to?(:len).should be_true
+		@sc.respond_to?(:typecast).should be_true
+		@sc.respond_to?(:body=).should be_true
+	end
+end	
+
+describe StructFu::Int, "basic Int class" do
+
+	before :each do
+		@int = StructFu::Int.new(8)
+	end
+
+	it "should have an initial state" do
+		new_int = StructFu::Int.new
+		new_int.value.should be_nil
+		new_int.endian.should be_nil
+		new_int.width.should be_nil
+		new_int.default.should == 0
+	end
+
+	it "should raise when to_s'ed directly" do
+		expect { @int.to_s}.to raise_error
+	end
+
+	it "should have a value of 8" do
+		@int.value.should == 8
+		@int.to_i.should == 8
+		@int.to_f.to_s.should == "8.0"
+	end
+
+	it "should read an integer" do
+		@int.read(7)
+		@int.to_i.should == 7
+	end
+
+end
+
+describe StructFu::Int8, "one byte value" do
+
+	before :each do
+		@int = StructFu::Int8.new(11)
+	end
+
+	it "should have an initial state" do
+		new_int = StructFu::Int8.new
+		new_int.value.should be_nil
+		new_int.endian.should be_nil
+		new_int.width.should == 1
+		new_int.default.should == 0
+	end
+
+	it "should print a one character packed string" do
+		@int.to_s.should == "\x0b"
+	end
+
+	it "should have a value of 11" do
+		@int.value.should == 11
+		@int.to_i.should == 11
+		@int.to_f.to_s.should == "11.0"
+	end
+
+	it "should reset with a new integer" do
+		@int.read(2)
+		@int.to_i.should == 2
+		@int.to_s.should == "\x02"
+		@int.read(254)
+		@int.to_i.should == 254
+		@int.to_s.should == "\xfe"
+	end
+
+end
+
+describe StructFu::Int16, "two byte value" do
+
+	before :each do
+		@int = StructFu::Int16.new(11)
+	end
+
+	it "should have an initial state" do
+		new_int = StructFu::Int16.new
+		new_int.value.should be_nil
+		new_int.endian.should == :big
+		new_int.width.should == 2
+		new_int.default.should == 0
+	end
+
+	it "should print a two character packed string" do
+		@int.to_s.should == "\x00\x0b"
+	end
+
+	it "should have a value of 11" do
+		@int.value.should == 11
+		@int.to_i.should == 11
+		@int.to_f.to_s.should == "11.0"
+	end
+
+	it "should reset with a new integer" do
+		@int.read(2)
+		@int.to_i.should == 2
+		@int.to_s.should == "\x00\x02"
+		@int.read(254)
+		@int.to_i.should == 254
+		@int.to_s.should == "\x00\xfe"
+	end
+
+	it "should be able to set endianness" do
+		int_be = StructFu::Int16.new(11,:big)
+		int_be.to_s.should == "\x00\x0b"
+		int_le = StructFu::Int16.new(11,:little)
+		int_le.to_s.should == "\x0b\x00"
+	end
+
+	it "should be able to switch endianness" do
+		@int.endian.should == :big
+		@int.to_s.should == "\x00\x0b"
+		@int.endian = :little
+		@int.endian.should == :little
+		@int.read(11)
+		@int.to_s.should == "\x0b\x00"
+	end
+
+end
+
+describe StructFu::Int16le, "2 byte little-endian value" do
+
+	before :each do
+		@int = StructFu::Int16le.new(11)
+	end
+
+	it "should behave pretty much like any other 16 bit int" do
+		@int.to_s.should == "\x0b\x00"
+	end
+
+	it "should raise when you try to change endianness" do
+		expect { @int.endian = :big }.to raise_error
+		expect { @int.endian = :little }.to raise_error
+	end
+
+end
+
+describe StructFu::Int16be, "2 byte big-endian value" do
+
+	before :each do
+		@int = StructFu::Int16be.new(11)
+	end
+
+	it "should behave pretty much like any other 16 bit int" do
+		@int.to_s.should == "\x00\x0b"
+	end
+
+	it "should raise when you try to change endianness" do
+		expect { @int.endian = :big }.to raise_error
+		expect { @int.endian = :little }.to raise_error
+	end
+
+end
+
+describe StructFu::Int32, "four byte value" do
+
+	before :each do
+		@int = StructFu::Int32.new(11)
+	end
+
+	it "should have an initial state" do
+		new_int = StructFu::Int32.new
+		new_int.value.should be_nil
+		new_int.endian.should == :big
+		new_int.width.should == 4
+		new_int.default.should == 0
+	end
+
+	it "should print a four character packed string" do
+		@int.to_s.should == "\x00\x00\x00\x0b"
+	end
+
+	it "should have a value of 11" do
+		@int.value.should == 11
+		@int.to_i.should == 11
+		@int.to_f.to_s.should == "11.0"
+	end
+
+	it "should reset with a new integer" do
+		@int.read(2)
+		@int.to_i.should == 2
+		@int.to_s.should == "\x00\x00\x00\x02"
+		@int.read(254)
+		@int.to_i.should == 254
+		@int.to_s.should == "\x00\x00\x00\xfe"
+	end
+
+	it "should be able to set endianness" do
+		int_be = StructFu::Int32.new(11,:big)
+		int_be.to_s.should == "\x00\x00\x00\x0b"
+		int_le = StructFu::Int32.new(11,:little)
+		int_le.to_s.should == "\x0b\x00\x00\x00"
+	end
+
+	it "should be able to switch endianness" do
+		@int.endian.should == :big
+		@int.to_s.should == "\x00\x00\x00\x0b"
+		@int.endian = :little
+		@int.endian.should == :little
+		@int.read(11)
+		@int.to_s.should == "\x0b\x00\x00\x00"
+	end
+
+end
+
+describe StructFu::Int32le, "4 byte little-endian value" do
+
+	before :each do
+		@int = StructFu::Int32le.new(11)
+	end
+
+	it "should behave pretty much like any other 32 bit int" do
+		@int.to_s.should == "\x0b\x00\x00\x00"
+	end
+
+	it "should raise when you try to change endianness" do
+		expect { @int.endian = :big }.to raise_error
+		expect { @int.endian = :little }.to raise_error
+	end
+
+end
+
+describe StructFu::Int32be, "4 byte big-endian value" do
+
+	before :each do
+		@int = StructFu::Int32be.new(11)
+	end
+
+	it "should behave pretty much like any other 32 bit int" do
+		@int.to_s.should == "\x00\x00\x00\x0b"
+	end
+
+	it "should raise when you try to change endianness" do
+		expect { @int.endian = :big }.to raise_error
+		expect { @int.endian = :little }.to raise_error
+	end
+
+end
+
+describe StructFu::String, "a sligtly more special String" do
+
+	before :each do
+		@str = StructFu::String.new("Oi, a string")
+	end
+
+	it "should behave pretty much like a string" do
+		@str.should be_kind_of(String)
+	end
+
+	it "should have a read method" do
+		@str.should respond_to(:read)
+	end
+
+	it "should read data like other StructFu things" do
+		@str.read("hello")
+		@str.should == "hello"
+	end
+
+end
+
+describe StructFu::IntString do
+
+	it "should be" do
+		StructFu::IntString.should be
+	end
+
+	it "should have a length and value" do
+		istr = StructFu::IntString.new("Avast!")
+		istr.to_s.should == "\x06Avast!"
+	end
+
+	it "should have a 16-bit length and a value" do
+		istr = StructFu::IntString.new("Avast!",StructFu::Int16)
+		istr.to_s.should == "\x00\x06Avast!"
+	end
+
+	it "should have a 32-bit length and a value" do
+		istr = StructFu::IntString.new("Avast!",StructFu::Int32)
+		istr.to_s.should == "\x00\x00\x00\x06Avast!"
+	end
+
+	before :each do
+		@istr = StructFu::IntString.new("Avast!",StructFu::Int32)
+	end
+
+	it "should report the correct length with a new string" do
+		@istr.to_s.should == "\x00\x00\x00\x06Avast!"
+		@istr.string = "Ahoy!"
+		@istr.to_s.should == "\x00\x00\x00\x05Ahoy!"
+	end
+
+	it "should report the correct length with a new string" do
+		@istr.string = "Ahoy!"
+		@istr.to_s.should == "\x00\x00\x00\x05Ahoy!"
+	end
+
+	it "should keep the old length with a new string" do
+		@istr[:string] = "Ahoy!"
+		@istr.to_s.should == "\x00\x00\x00\x06Ahoy!"
+	end
+
+	it "should allow for adjusting the length manually" do
+		@istr.len = 16
+		@istr.to_s.should == "\x00\x00\x00\x10Avast!"
+	end
+
+	it "should read in an expected string" do
+		data = "\x00\x00\x00\x09Yo ho ho!"
+		@istr.read(data)
+		@istr.to_s.should == data
+	end
+
+	it "should raise when a string is too short" do
+		data = "\x01A"
+		expect { @istr.read(data) }.to raise_error
+	end
+
+end