packetfu 1.1.8 → 1.1.9

data/README.rdoc

@@ -12,13 +12,9 @@ PacketFu is rdoc-compatible, which means it's sdoc compatible. In the same direc
 
 PcapRub: 
 
-$ svn co http://www.metasploit.com/svn/framework3/trunk/external/pcaprub
-
-or
-
 $ rvm gem install pcaprub
 
-Marshall Beddoe's PcapRub is required only for packet reading and writing from a network interfaces (which is a pretty big only). PcapRub itself relies on libpcap 0.9.8 or later for packet injection. PcapRub also requires root privilieges to access the interface directly. 
+Marshall Beddoe's PcapRub is required only for packet reading and writing from a network interfaces (which is a pretty big only). PcapRub itself relies on libpcap 0.9.8 or later for packet injection. PcapRub also requires root privileges to access the interface directly. 
 
 === Platforms
 
@@ -31,6 +27,16 @@ I tend to test with the following (with bash):
     rvmsudo ./all_tests.rb >> /tmp/tests.txt; rspec . >> /tmp/tests.txt
     done
 
+==== Problem Platforms
+
+* 1.8.6-p420 -- Has problems with pcaprub and capture/inject. Technically, these are pcaprub problems and not PacketFu problems, but PacketFu should at least fail better at them.
+
+* 1.9.1-p431 -- Has problems with loading gems in general, see http://redmine.ruby-lang.org/issues/2404
+
+* 2.0.0-p0   -- Has problems with binary encoding of strings that do not manifest in 1.9.x See https://github.com/todb/packetfu/issues/28
+
+
+
 ==== Passing Platforms
 
 * 1.9.1-p378
@@ -38,14 +44,7 @@ I tend to test with the following (with bash):
 * 1.9.2-p180 (suggested version)
 * 1.9.3-head
 
-==== Problem Platforms
-
-* 1.8.6-p420 -- Has problems with pcaprub and capture/inject
-* 1.9.1-p431 -- Has problems with loading gems in general, see http://redmine.ruby-lang.org/issues/2404
-
-Technically, these are pcaprub problems and not PacketFu problems, but PacketFu should at least fail better at them.
 
-Incidentally, I suspect these Ruby problems are the crux of the Mac OSX problems that people report. Try a different Ruby build and please let me know what works for you.
 
 
 == Examples

data/bench/octets.rb

@@ -8,15 +8,15 @@ IPV4_STR = "1.2.3.4"
 
 iters = 50_000
 Benchmark.bm do |bm|
-	bm.report("Octets.new.read(...)         ") {iters.times {PacketFu::Octets.new.read(IPV4_RAW)}}
-	bm.report("Octets.new.read_quad(...)    ") {iters.times {PacketFu::Octets.new.read_quad(IPV4_STR)}}
+  bm.report("Octets.new.read(...)         ") {iters.times {PacketFu::Octets.new.read(IPV4_RAW)}}
+  bm.report("Octets.new.read_quad(...)    ") {iters.times {PacketFu::Octets.new.read_quad(IPV4_STR)}}
 
-	octets = PacketFu::Octets.new
-	bm.report("octets#read(...)             ") {iters.times {octets.read(IPV4_RAW)}}
-	bm.report("octets#read_quad(...)        ") {iters.times {octets.read_quad(IPV4_STR)}}
+  octets = PacketFu::Octets.new
+  bm.report("octets#read(...)             ") {iters.times {octets.read(IPV4_RAW)}}
+  bm.report("octets#read_quad(...)        ") {iters.times {octets.read_quad(IPV4_STR)}}
 
-	octets.read(IPV4_RAW)
-	bm.report("octets#to_x()                ") {iters.times {octets.to_x}}
-	bm.report("octets#to_i()                ") {iters.times {octets.to_i}}
-	bm.report("octets#to_s()                ") {iters.times {octets.to_s}}
+  octets.read(IPV4_RAW)
+  bm.report("octets#to_x()                ") {iters.times {octets.to_x}}
+  bm.report("octets#to_i()                ") {iters.times {octets.to_i}}
+  bm.report("octets#to_s()                ") {iters.times {octets.to_s}}
 end

data/examples/100kpackets.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 # Used mainly to test for memory leaks and to demo the preferred ways of
 # reading and writing packets to and from pcap files.
@@ -13,18 +14,18 @@ start_time = Time.now.utc
 count = 0
 
 100.times do
-	@pcaps = []
-	1000.times do 
-		u = UDPPacket.new
-		u.ip_src = [rand(2**32-1)].pack("N")
-		u.ip_dst = [rand(2**32-1)].pack("N")
-		u.recalc
-		@pcaps << u
-	end
-	pfile = PcapFile.new
-	res = pfile.array_to_file(:filename => "/tmp/out.pcap", :array => @pcaps, :append => true)
-	count += res.last
-	puts "Wrote #{count} packets in #{Time.now.utc - start_time} seconds"
+  @pcaps = []
+  1000.times do 
+    u = UDPPacket.new
+    u.ip_src = [rand(2**32-1)].pack("N")
+    u.ip_dst = [rand(2**32-1)].pack("N")
+    u.recalc
+    @pcaps << u
+  end
+  pfile = PcapFile.new
+  res = pfile.array_to_file(:filename => "/tmp/out.pcap", :array => @pcaps, :append => true)
+  count += res.last
+  puts "Wrote #{count} packets in #{Time.now.utc - start_time} seconds"
 end
 
 read_bytes_start = Time.now.utc

data/examples/ackscan.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 require 'packetfu'
 # Portscanning!
 # Run this on one machine
@@ -9,25 +10,25 @@ require 'packetfu'
 #cap = Capture.new(:iface=>'wlan0') # or whatever your interface is
 # Run this on the third
 def do_scan
-	puts "Generating packets..."
-	pkt_array = gen_packets.sort_by {rand}
-	puts "Dumping them on the wire..."
-	inj = PacketFu::Inject.new(:iface => ARGV[0])
-	inj.array_to_wire(:array=>pkt_array)
-	puts "Done!"
+  puts "Generating packets..."
+  pkt_array = gen_packets.sort_by {rand}
+  puts "Dumping them on the wire..."
+  inj = PacketFu::Inject.new(:iface => ARGV[0])
+  inj.array_to_wire(:array=>pkt_array)
+  puts "Done!"
 end
 
 def gen_packets
-	config = PacketFu::Utils.whoami?(:iface=>ARGV[0])
-	pkt = PacketFu::TCPPacket.new(:config=>config, :flavor=>"Windows")
-	pkt.payload ="all I wanna do is ACK ACK ACK and a RST and take your money"
-	pkt.ip_daddr="209.85.165.0"	# One of Google's networks
-	pkt.tcp_flags.ack=1
-	pkt.tcp_dst=81
-	pkt_array = []
-	256.times do |i|
-	 pkt.ip_dst.o4=i
-	 pkt.tcp_src = rand(5000 - 1025) + 1025
+  config = PacketFu::Utils.whoami?(:iface=>ARGV[0])
+  pkt = PacketFu::TCPPacket.new(:config=>config, :flavor=>"Windows")
+  pkt.payload ="all I wanna do is ACK ACK ACK and a RST and take your money"
+  pkt.ip_daddr="209.85.165.0"	# One of Google's networks
+  pkt.tcp_flags.ack=1
+  pkt.tcp_dst=81
+  pkt_array = []
+  256.times do |i|
+   pkt.ip_dst.o4=i
+   pkt.tcp_src = rand(5000 - 1025) + 1025
  	 pkt.recalc
  	 pkt_array << pkt.to_s
  	end

data/examples/arp.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # This is a somewhat contrived and verbose demonstration of how to implement ARP manually.
 #
 # It's contrived because this is really how PacketFu::Utils got born; something similiar
@@ -8,11 +9,11 @@ require './examples' # For path setting slight-of-hand
 require 'packetfu'
 
 def usage
-	if ARGV[0].nil?
-		raise ArgumentError, "You need an IP address to start with."
-	elsif !Process.euid.zero?
-		raise SecurityError, "You need to be root to run this."
-	end
+  if ARGV[0].nil?
+    raise ArgumentError, "You need an IP address to start with."
+  elsif !Process.euid.zero?
+    raise SecurityError, "You need to be root to run this."
+  end
 end
 
 usage unless target_ip = ARGV[0]		# Need a target IP.
@@ -23,36 +24,36 @@ $packetfu_default = PacketFu::Config.new(PacketFu::Utils.whoami?).config
 
 def arp(target_ip)
 
-	arp_pkt = PacketFu::ARPPacket.new(:flavor => "Windows")
-	arp_pkt.eth_saddr = arp_pkt.arp_saddr_mac = $packetfu_default[:eth_saddr]
-	arp_pkt.eth_daddr = "ff:ff:ff:ff:ff:ff"
-	arp_pkt.arp_daddr_mac = "00:00:00:00:00:00"
-
-	arp_pkt.arp_saddr_ip = $packetfu_default[:ip_saddr]
-	arp_pkt.arp_daddr_ip = target_ip 
-
-	# Stick the Capture object in its own thread.
-
-	cap_thread = Thread.new do
-		cap = PacketFu::Capture.new(:start => true, 
-																:filter => "arp src #{target_ip} and ether dst #{arp_pkt.eth_saddr}")
-		arp_pkt.to_w # Shorthand for sending single packets to the default interface.
-		target_mac = nil
-		while target_mac.nil?
-			if cap.save > 0
-				arp_response = PacketFu::Packet.parse(cap.array[0])
-				target_mac = arp_response.arp_saddr_mac if arp_response.arp_saddr_ip = target_ip
-			end
-			sleep 0.1 # Check for a response ten times per second.
-		end
-		puts "#{target_ip} is-at #{target_mac}"
-		# That's all we need.
-		exit 0
-	end
-
-	# Timeout for cap_thread
-	sleep 3; puts "Oh noes! Couldn't get an arp out of #{target_ip}. Maybe it's not here."
-	exit 1
+  arp_pkt = PacketFu::ARPPacket.new(:flavor => "Windows")
+  arp_pkt.eth_saddr = arp_pkt.arp_saddr_mac = $packetfu_default[:eth_saddr]
+  arp_pkt.eth_daddr = "ff:ff:ff:ff:ff:ff"
+  arp_pkt.arp_daddr_mac = "00:00:00:00:00:00"
+
+  arp_pkt.arp_saddr_ip = $packetfu_default[:ip_saddr]
+  arp_pkt.arp_daddr_ip = target_ip 
+
+  # Stick the Capture object in its own thread.
+
+  cap_thread = Thread.new do
+    cap = PacketFu::Capture.new(:start => true, 
+                                :filter => "arp src #{target_ip} and ether dst #{arp_pkt.eth_saddr}")
+    arp_pkt.to_w # Shorthand for sending single packets to the default interface.
+    target_mac = nil
+    while target_mac.nil?
+      if cap.save > 0
+        arp_response = PacketFu::Packet.parse(cap.array[0])
+        target_mac = arp_response.arp_saddr_mac if arp_response.arp_saddr_ip = target_ip
+      end
+      sleep 0.1 # Check for a response ten times per second.
+    end
+    puts "#{target_ip} is-at #{target_mac}"
+    # That's all we need.
+    exit 0
+  end
+
+  # Timeout for cap_thread
+  sleep 3; puts "Oh noes! Couldn't get an arp out of #{target_ip}. Maybe it's not here."
+  exit 1
 end
 
 arp(target_ip)

data/examples/arphood.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 # A simple local network fingerprinter. Uses the OUI list.
 # Usage: rvmsudo ./arphood.rb [iface] [network] <oui.txt>
@@ -10,20 +11,20 @@ require 'open-uri'
 $oui_prefixes = {}
 $arp_results = []
 def build_oui_list
-	if ARGV[2].nil?
-		puts "Fetching the oui.txt from IEEE, it'll be a second. Avoid this with #{$0} [iface] [network] <filename>."
-	oui_file = open("http://standards.ieee.org/regauth/oui/oui.txt")
-	else
-	oui_file =	File.open(ARGV[2], "rb")
-	end
-	oui_file.each do |oui_line|
-		maybe_oui = oui_line.scan(/^[0-9a-f]{2}\-[0-9a-f]{2}\-[0-9a-f]{2}/i)[0]
-		unless maybe_oui.nil?
-			oui_value = maybe_oui
-			oui_vendor = oui_line.split(/\(hex\)\s*/n)[1] || "PRIVATE"
-			$oui_prefixes[oui_value] = oui_vendor.chomp
-		end
-	end
+  if ARGV[2].nil?
+    puts "Fetching the oui.txt from IEEE, it'll be a second. Avoid this with #{$0} [iface] [network] <filename>."
+  oui_file = open("http://standards.ieee.org/regauth/oui/oui.txt")
+  else
+  oui_file =	File.open(ARGV[2], "rb")
+  end
+  oui_file.each do |oui_line|
+    maybe_oui = oui_line.scan(/^[0-9a-f]{2}\-[0-9a-f]{2}\-[0-9a-f]{2}/i)[0]
+    unless maybe_oui.nil?
+      oui_value = maybe_oui
+      oui_vendor = oui_line.split(/\(hex\)\s*/n)[1] || "PRIVATE"
+      $oui_prefixes[oui_value] = oui_vendor.chomp
+    end
+  end
 end
 
 build_oui_list
@@ -31,30 +32,30 @@ build_oui_list
 $root_ok = true if Process.euid.zero?
 
 def arp_everyone
-	my_net = PacketFu::Config.new(PacketFu::Utils.whoami?(:iface =>(ARGV[0] || 'wlan0')))
-	threads = []
-	network = ARGV[1] || "192.168.2"
-	print "Arping around..."
-	253.times do |i|
-		threads[i] = Thread.new do
-			this_host = network + ".#{i+1}"
-			print "." 
-			colon_mac = PacketFu::Utils.arp(this_host,my_net.config)
-			unless colon_mac.nil?
-				hyphen_mac = colon_mac.tr(':','-').upcase[0,8]
-			else
-				hyphen_mac = colon_mac = "NOTHERE"
-			end
-			$arp_results <<  "%s : %s / %s" % [this_host,colon_mac,$oui_prefixes[hyphen_mac]]
-		end
-	end
-	threads.each {|thr| thr.join}
+  my_net = PacketFu::Config.new(PacketFu::Utils.whoami?(:iface =>(ARGV[0] || 'wlan0')))
+  threads = []
+  network = ARGV[1] || "192.168.2"
+  print "Arping around..."
+  253.times do |i|
+    threads[i] = Thread.new do
+      this_host = network + ".#{i+1}"
+      print "." 
+      colon_mac = PacketFu::Utils.arp(this_host,my_net.config)
+      unless colon_mac.nil?
+        hyphen_mac = colon_mac.tr(':','-').upcase[0,8]
+      else
+        hyphen_mac = colon_mac = "NOTHERE"
+      end
+      $arp_results <<  "%s : %s / %s" % [this_host,colon_mac,$oui_prefixes[hyphen_mac]]
+    end
+  end
+  threads.each {|thr| thr.join}
 end
 
 if $root_ok
-	arp_everyone
-	puts "\n"
-	sleep 3
-	$arp_results.sort.each {|a| puts a unless a =~ /NOTHERE/}
+  arp_everyone
+  puts "\n"
+  sleep 3
+  $arp_results.sort.each {|a| puts a unless a =~ /NOTHERE/}
 end
 

data/examples/dissect_thinger.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 # This just allows you to eyeball the dissection stuff to make sure it's all right.
 # Some day, there will be a proper test for it.
 
@@ -13,10 +14,10 @@ include PacketFu
 
 packets = PcapFile.file_to_array fname
 packets.each do |packet|
-	puts "_" * 75
-	puts packet.inspect
-	puts "_" * 75
-	pkt = Packet.parse(packet)
-	puts pkt.dissect
-	sleep sleep_interval
+  puts "_" * 75
+  puts packet.inspect
+  puts "_" * 75
+  pkt = Packet.parse(packet)
+  puts pkt.dissect
+  sleep sleep_interval
 end

data/examples/ethernet.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 
 require './examples' # For path setting slight-of-hand
 require 'packetfu'

data/examples/examples.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Sets the path appropriately when examples is adjacent to the real lib.
 
 $:.unshift(File.expand_path(File.dirname(__FILE__) + "/../lib/"))

data/examples/ifconfig.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 $:.unshift(File.expand_path(File.dirname(__FILE__) + "/../lib/"))
 require 'packetfu'
 

data/examples/new-simple-stats.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 # new-simple-stats.rb demonstrates the performance difference
 # between the old and busted way to parse pcap files and the
@@ -12,38 +13,38 @@ require './examples' # For path setting slight-of-hand
 require 'packetfu'
 
 def print_results(stats)
-	stats.each_pair { |k,v| puts "%-12s: %10d" % [k,v] }
+  stats.each_pair { |k,v| puts "%-12s: %10d" % [k,v] }
 end
 
 # Takes a file name, parses the packets, and records the packet
 # type based on its PacketFu class.
 def count_packet_types(file)
-	stats = {}
-	count = 0
-	elapsed = 0
-	start_time = Time.now
-	PacketFu::PcapFile.read_packets(file) do |pkt|
-		kind = pkt.proto.last.to_sym
-		stats[kind] ? stats[kind] += 1 : stats[kind] = 1
-		count += 1
-		elapsed = (Time.now - start_time).to_i
-		if count % 5_000 == 0
-			puts "After #{count} packets (#{elapsed} seconds elapsed):"
-			print_results(stats)
-		end
-	end
-	puts "Final results for #{count} packets (#{elapsed} seconds elapsed):"
-	print_results(stats)
+  stats = {}
+  count = 0
+  elapsed = 0
+  start_time = Time.now
+  PacketFu::PcapFile.read_packets(file) do |pkt|
+    kind = pkt.proto.last.to_sym
+    stats[kind] ? stats[kind] += 1 : stats[kind] = 1
+    count += 1
+    elapsed = (Time.now - start_time).to_i
+    if count % 5_000 == 0
+      puts "After #{count} packets (#{elapsed} seconds elapsed):"
+      print_results(stats)
+    end
+  end
+  puts "Final results for #{count} packets (#{elapsed} seconds elapsed):"
+  print_results(stats)
 end
 
 if File.readable?(infile = (ARGV[0] || 'in.pcap'))
-	title = "Packets by packet type in '#{infile}'"
-	puts "-" * title.size
-	puts title
-	puts "-" * title.size
-	count_packet_types(infile)
+  title = "Packets by packet type in '#{infile}'"
+  puts "-" * title.size
+  puts title
+  puts "-" * title.size
+  count_packet_types(infile)
 else
-	raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
+  raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
 end