packetfu 1.1.9 → 1.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/bench/octets.rb +9 -9
- data/examples/100kpackets.rb +12 -12
- data/examples/ackscan.rb +16 -16
- data/examples/arp.rb +35 -35
- data/examples/arphood.rb +36 -36
- data/examples/dissect_thinger.rb +6 -6
- data/examples/new-simple-stats.rb +23 -23
- data/examples/packetfu-shell.rb +25 -25
- data/examples/simple-sniffer.rb +9 -9
- data/examples/simple-stats.rb +23 -23
- data/examples/slammer.rb +3 -3
- data/lib/packetfu.rb +127 -127
- data/lib/packetfu/capture.rb +169 -169
- data/lib/packetfu/config.rb +52 -52
- data/lib/packetfu/inject.rb +56 -56
- data/lib/packetfu/packet.rb +528 -528
- data/lib/packetfu/pcap.rb +579 -579
- data/lib/packetfu/protos/arp.rb +90 -90
- data/lib/packetfu/protos/arp/header.rb +158 -158
- data/lib/packetfu/protos/arp/mixin.rb +36 -36
- data/lib/packetfu/protos/eth.rb +44 -44
- data/lib/packetfu/protos/eth/header.rb +243 -243
- data/lib/packetfu/protos/eth/mixin.rb +3 -3
- data/lib/packetfu/protos/hsrp.rb +69 -69
- data/lib/packetfu/protos/hsrp/header.rb +107 -107
- data/lib/packetfu/protos/hsrp/mixin.rb +29 -29
- data/lib/packetfu/protos/icmp.rb +71 -71
- data/lib/packetfu/protos/icmp/header.rb +82 -82
- data/lib/packetfu/protos/icmp/mixin.rb +14 -14
- data/lib/packetfu/protos/invalid.rb +49 -49
- data/lib/packetfu/protos/ip.rb +69 -69
- data/lib/packetfu/protos/ip/header.rb +291 -291
- data/lib/packetfu/protos/ip/mixin.rb +40 -40
- data/lib/packetfu/protos/ipv6.rb +50 -50
- data/lib/packetfu/protos/ipv6/header.rb +188 -188
- data/lib/packetfu/protos/ipv6/mixin.rb +29 -29
- data/lib/packetfu/protos/tcp.rb +176 -176
- data/lib/packetfu/protos/tcp/ecn.rb +35 -35
- data/lib/packetfu/protos/tcp/flags.rb +74 -74
- data/lib/packetfu/protos/tcp/header.rb +268 -268
- data/lib/packetfu/protos/tcp/hlen.rb +32 -32
- data/lib/packetfu/protos/tcp/mixin.rb +46 -46
- data/lib/packetfu/protos/tcp/option.rb +321 -321
- data/lib/packetfu/protos/tcp/options.rb +95 -95
- data/lib/packetfu/protos/tcp/reserved.rb +35 -35
- data/lib/packetfu/protos/udp.rb +116 -116
- data/lib/packetfu/protos/udp/header.rb +91 -91
- data/lib/packetfu/protos/udp/mixin.rb +3 -3
- data/lib/packetfu/structfu.rb +280 -280
- data/lib/packetfu/utils.rb +226 -217
- data/lib/packetfu/version.rb +41 -41
- data/packetfu.gemspec +2 -1
- data/spec/ethpacket_spec.rb +48 -48
- data/spec/packet_spec.rb +57 -57
- data/spec/packet_subclasses_spec.rb +8 -8
- data/spec/packetfu_spec.rb +59 -59
- data/spec/structfu_spec.rb +268 -268
- data/spec/tcp_spec.rb +75 -75
- data/test/all_tests.rb +13 -13
- data/test/func_lldp.rb +3 -3
- data/test/ptest.rb +2 -2
- data/test/test_arp.rb +116 -116
- data/test/test_capture.rb +45 -45
- data/test/test_eth.rb +68 -68
- data/test/test_hsrp.rb +9 -9
- data/test/test_icmp.rb +52 -52
- data/test/test_inject.rb +18 -18
- data/test/test_invalid.rb +16 -16
- data/test/test_ip.rb +36 -36
- data/test/test_ip6.rb +48 -48
- data/test/test_octets.rb +21 -21
- data/test/test_packet.rb +154 -154
- data/test/test_pcap.rb +170 -170
- data/test/test_structfu.rb +97 -97
- data/test/test_tcp.rb +320 -320
- data/test/test_udp.rb +76 -76
- metadata +4 -3
data/test/test_capture.rb
CHANGED
@@ -6,51 +6,51 @@ require 'packetfu'
|
|
6
6
|
|
7
7
|
class CaptureTest < Test::Unit::TestCase
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
9
|
+
def test_cap
|
10
|
+
assert_nothing_raised { PacketFu::Capture }
|
11
|
+
end
|
12
|
+
|
13
|
+
def test_whoami
|
14
|
+
assert_nothing_raised { PacketFu::Utils.whoami?(:iface => (ENV['IFACE'] || 'lo')) }
|
15
|
+
end
|
16
|
+
|
17
|
+
def test_new
|
18
|
+
cap = PacketFu::Capture.new
|
19
|
+
assert_kind_of PacketFu::Capture, cap
|
20
|
+
cap = PacketFu::Capture.new(
|
21
|
+
:filter => 'tcp and dst host 1.2.3.4'
|
22
|
+
)
|
23
|
+
end
|
24
|
+
|
25
|
+
def test_filter
|
26
|
+
daddr = PacketFu::Utils.rand_routable_daddr.to_s
|
27
|
+
cap = PacketFu::Capture.new( :filter => "icmp and dst host #{daddr}")
|
28
|
+
cap.start
|
29
|
+
%x{ping -c 1 #{daddr}}
|
30
|
+
sleep 1
|
31
|
+
cap.save
|
32
|
+
assert cap.array.size == 1
|
33
|
+
pkt = PacketFu::Packet.parse(cap.array.first)
|
34
|
+
assert pkt.ip_daddr == daddr
|
35
|
+
end
|
36
|
+
|
37
|
+
def test_no_filter
|
38
|
+
daddr = PacketFu::Utils.rand_routable_daddr.to_s
|
39
|
+
daddr2 = PacketFu::Utils.rand_routable_daddr.to_s
|
40
|
+
cap = PacketFu::Capture.new
|
41
|
+
cap.start
|
42
|
+
%x{ping -c 1 #{daddr}}
|
43
|
+
%x{ping -c 1 #{daddr2}}
|
44
|
+
sleep 1
|
45
|
+
cap.save
|
46
|
+
assert cap.array.size > 1
|
47
|
+
end
|
48
|
+
|
49
|
+
def test_bpf_alias
|
50
|
+
daddr = PacketFu::Utils.rand_routable_daddr.to_s
|
51
|
+
cap = PacketFu::Capture.new( :filter => "icmp and dst host #{daddr}")
|
52
|
+
assert cap.filter.object_id == cap.bpf.object_id
|
53
|
+
end
|
54
54
|
|
55
55
|
end
|
56
56
|
|
data/test/test_eth.rb
CHANGED
@@ -6,85 +6,85 @@ puts "Testing #{PacketFu.version}: #{$0}"
|
|
6
6
|
|
7
7
|
class EthTest < Test::Unit::TestCase
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
9
|
+
def test_ethmac
|
10
|
+
dst = "\x00\x03\x2f\x1a\x74\xde"
|
11
|
+
e = PacketFu::EthMac.new
|
12
|
+
e.read dst
|
13
|
+
assert_equal(dst, e.to_s)
|
14
|
+
assert_equal(0x32f, e.oui.oui)
|
15
|
+
assert_equal("\x1a\x74\xde", e.nic.to_s)
|
16
|
+
assert_equal(222, e.nic.n2)
|
17
|
+
end
|
18
18
|
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
19
|
+
def test_ethmac_ipad
|
20
|
+
dst = "\x7c\x6d\x62\x01\x02\x03"
|
21
|
+
e = PacketFu::EthMac.new
|
22
|
+
e.read dst
|
23
|
+
assert_equal(dst, e.to_s)
|
24
|
+
assert_equal(0x6d62, e.oui.oui)
|
25
|
+
end
|
26
26
|
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
27
|
+
def test_ethmac_class
|
28
|
+
src = "\x00\x1b\x11\x51\xb7\xce"
|
29
|
+
e = PacketFu::EthMac.new
|
30
|
+
e.read src
|
31
|
+
assert_instance_of(PacketFu::EthMac, e)
|
32
|
+
end
|
33
33
|
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
34
|
+
def test_eth
|
35
|
+
header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
|
36
|
+
src = "\x00\x1b\x11\x51\xb7\xce"
|
37
|
+
dst = "\x00\x03\x2f\x1a\x74\xde"
|
38
|
+
e = PacketFu::EthHeader.new
|
39
|
+
e.eth_dst = dst
|
40
|
+
e.eth_src = src
|
41
|
+
e.eth_proto = "\x08\x00"
|
42
|
+
assert_equal(header, e.to_s)
|
43
|
+
assert_equal(header, PacketFu::EthHeader.new.read(header).to_s)
|
44
|
+
end
|
45
45
|
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
46
|
+
def test_macaddr
|
47
|
+
dst = "\x00\x03\x2f\x1a\x74\xde"
|
48
|
+
dstmac = "00:03:2f:1a:74:de"
|
49
|
+
assert_equal(dstmac,PacketFu::EthHeader.str2mac(dst))
|
50
|
+
assert_equal(dst, PacketFu::EthHeader.mac2str(dstmac))
|
51
|
+
end
|
52
52
|
|
53
53
|
end
|
54
54
|
|
55
55
|
class EthPacketTest < Test::Unit::TestCase
|
56
|
-
|
56
|
+
include PacketFu
|
57
57
|
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
-
|
70
|
-
|
58
|
+
def test_eth_create
|
59
|
+
sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[0]
|
60
|
+
e = EthPacket.new
|
61
|
+
header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
|
62
|
+
assert_kind_of EthPacket, e
|
63
|
+
assert_kind_of EthHeader, e.headers[0]
|
64
|
+
assert e.is_eth?
|
65
|
+
assert !e.is_tcp?
|
66
|
+
e.eth_dst = "\x00\x03\x2f\x1a\x74\xde"
|
67
|
+
e.eth_src = "\x00\x1b\x11\x51\xb7\xce"
|
68
|
+
e.eth_proto = 0x0800
|
69
|
+
assert_equal header, e.to_s[0,14]
|
70
|
+
end
|
71
71
|
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
72
|
+
def test_eth_new
|
73
|
+
p = EthPacket.new(
|
74
|
+
:eth_dst => "\x00\x03\x2f\x1a\x74\xde",
|
75
|
+
:eth_src => "\x00\x1b\x11\x51\xb7\xce",
|
76
|
+
:eth_proto => 0x0800)
|
77
|
+
header = "00032f1a74de001b1151b7ce0800".scan(/../).map { |x| x.to_i(16) }.pack("C*")
|
78
|
+
assert_equal header, p.to_s[0,14]
|
79
|
+
end
|
80
80
|
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
81
|
+
def test_eth_write
|
82
|
+
p = EthPacket.new(
|
83
|
+
:eth_dst => "\x00\x03\x2f\x1a\x74\xde",
|
84
|
+
:eth_src => "\x00\x1b\x11\x51\xb7\xce",
|
85
|
+
:eth_proto => 0x0800)
|
86
|
+
p.to_f('eth_test.pcap')
|
87
|
+
end
|
88
88
|
|
89
89
|
end
|
90
90
|
|
data/test/test_hsrp.rb
CHANGED
@@ -4,16 +4,16 @@ $:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
|
|
4
4
|
require 'packetfu'
|
5
5
|
|
6
6
|
class HSRPTest < Test::Unit::TestCase
|
7
|
-
|
7
|
+
include PacketFu
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
9
|
+
def test_hsrp_read
|
10
|
+
sample_packet = PcapFile.new.file_to_array(:f => 'sample_hsrp_pcapr.cap')[0]
|
11
|
+
pkt = Packet.parse(sample_packet)
|
12
|
+
assert pkt.is_hsrp?
|
13
|
+
assert pkt.is_udp?
|
14
|
+
assert_equal(0x2d8d, pkt.udp_sum.to_i)
|
15
|
+
# pkt.to_f('udp_test.pcap','a')
|
16
|
+
end
|
17
17
|
|
18
18
|
end
|
19
19
|
|
data/test/test_icmp.rb
CHANGED
@@ -4,58 +4,58 @@ $:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
|
|
4
4
|
require 'packetfu'
|
5
5
|
|
6
6
|
class ICMPTest < Test::Unit::TestCase
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
7
|
+
include PacketFu
|
8
|
+
|
9
|
+
def test_icmp_header_new
|
10
|
+
i = ICMPHeader.new
|
11
|
+
assert_kind_of ICMPHeader, i
|
12
|
+
assert_equal("\x00\x00\xff\xff", i.to_s)
|
13
|
+
i.icmp_type = 1
|
14
|
+
i.icmp_recalc :icmp_sum
|
15
|
+
assert_equal("\x01\x00\xfe\xff", i.to_s)
|
16
|
+
end
|
17
|
+
|
18
|
+
def test_icmp_peek
|
19
|
+
i = ICMPPacket.new
|
20
|
+
i.ip_saddr = "10.20.30.40"
|
21
|
+
i.ip_daddr = "50.60.70.80"
|
22
|
+
i.payload = "abcdefghijklmnopqrstuvwxyz"
|
23
|
+
i.recalc
|
24
|
+
puts "\n"
|
25
|
+
puts "ICMP Peek format: "
|
26
|
+
puts i.peek
|
27
|
+
assert (i.peek.size <= 80)
|
28
|
+
end
|
29
|
+
|
30
|
+
def test_icmp_pcap
|
31
|
+
i = ICMPPacket.new
|
32
|
+
assert_kind_of ICMPPacket, i
|
33
|
+
i.recalc
|
34
|
+
i.to_f('icmp_test.pcap')
|
35
|
+
i.ip_saddr = "10.20.30.40"
|
36
|
+
i.ip_daddr = "50.60.70.80"
|
37
|
+
i.payload = "\x00\x01\x00\01abcdefghijklmnopqrstuvwxyz"
|
38
|
+
i.icmp_code = 8
|
39
|
+
i.recalc
|
40
|
+
i.to_f('icmp_test.pcap','a')
|
41
|
+
assert File.exists?('icmp_test.pcap')
|
42
|
+
end
|
43
|
+
|
44
|
+
def test_icmp_read
|
45
|
+
sample_packet = PcapFile.new.file_to_array(:f => 'sample.pcap')[2]
|
46
|
+
pkt = Packet.parse(sample_packet)
|
47
|
+
assert pkt.is_icmp?
|
48
|
+
assert_kind_of ICMPPacket, pkt
|
49
|
+
assert_equal(0x4d58, pkt.icmp_sum.to_i)
|
50
|
+
assert_equal(8, pkt.icmp_type.to_i)
|
51
|
+
end
|
52
|
+
|
53
|
+
def test_icmp_reread
|
54
|
+
sample_packet = PacketFu::ICMPPacket.new
|
55
|
+
pkt = Packet.parse(sample_packet.to_s)
|
56
|
+
assert sample_packet.is_icmp?
|
57
|
+
assert pkt.is_icmp?
|
58
|
+
end
|
59
59
|
|
60
60
|
end
|
61
61
|
|
data/test/test_inject.rb
CHANGED
@@ -6,24 +6,24 @@ require 'packetfu'
|
|
6
6
|
|
7
7
|
class InjectTest < Test::Unit::TestCase
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
9
|
+
def test_cap
|
10
|
+
assert_nothing_raised { PacketFu::Capture }
|
11
|
+
end
|
12
|
+
|
13
|
+
def test_whoami
|
14
|
+
assert_nothing_raised { PacketFu::Utils.whoami?(:iface => (ENV['IFACE'] || 'lo')) }
|
15
|
+
end
|
16
|
+
|
17
|
+
def test_to_w
|
18
|
+
assert_equal(Process.euid, 0, "TEST FAIL: This test must be run as root")
|
19
|
+
conf = PacketFu::Utils.whoami?(:iface => (ENV['IFACE'] || 'lo'))
|
20
|
+
p = PacketFu::UDPPacket.new(:config => conf)
|
21
|
+
p.udp_dport = 12345
|
22
|
+
p.udp_sport = 12345
|
23
|
+
p.payload = "PacketFu test packet"
|
24
|
+
p.recalc
|
25
|
+
assert p.to_w
|
26
|
+
end
|
27
27
|
|
28
28
|
end
|
29
29
|
|
data/test/test_invalid.rb
CHANGED
@@ -4,24 +4,24 @@ $:.unshift File.join(File.expand_path(File.dirname(__FILE__)), "..", "lib")
|
|
4
4
|
require 'packetfu'
|
5
5
|
|
6
6
|
class InvalidTest < Test::Unit::TestCase
|
7
|
-
|
7
|
+
include PacketFu
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
9
|
+
def test_create_invalid
|
10
|
+
p = InvalidPacket.new
|
11
|
+
assert_kind_of InvalidPacket, p
|
12
|
+
assert_kind_of Packet, p
|
13
|
+
assert p.is_invalid?
|
14
|
+
assert_equal false, p.is_eth?
|
15
|
+
assert_not_equal EthPacket, p.class
|
16
|
+
end
|
17
17
|
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
18
|
+
# Sadly, the only way to generate an "InvalidPacket" is
|
19
|
+
# to read a packet that's less than 14 bytes. Otherwise,
|
20
|
+
# it's presumed to be an EthPacket. TODO: Fix this assumption!
|
21
|
+
def test_parse_invalid
|
22
|
+
p = Packet.parse("A" * 13)
|
23
|
+
assert_kind_of InvalidPacket, p
|
24
|
+
end
|
25
25
|
|
26
26
|
end
|
27
27
|
|