pcapr-local 0.1.10

data/test/mu/pcap/tc_ethernet.rb

@@ -0,0 +1,71 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class Ethernet
+
+class Test < Mu::TestCase
+    def test_basics
+        ethernet = Ethernet.new
+        ethernet.dst = '00:01:01:00:00:02'
+        ethernet.src = '00:01:01:00:00:01'
+        ethernet.type = 0x1234
+        ethernet.payload = ''
+        
+        bytes = "\0\1\1\0\0\2" + "\0\1\1\0\0\1" + "\x12\x34"
+        ethernet_in = Ethernet.from_bytes bytes
+        assert_equal ethernet, ethernet_in
+    end
+
+    def test_vlan
+        ethernet = Ethernet.new
+        ethernet.dst = '00:01:01:00:00:02'
+        ethernet.src = '00:01:01:00:00:01'
+        ethernet.type = 0x1234
+        ethernet.payload = 'hi'
+        ethernet.payload_raw = 'hi'
+        
+        # Strip out VLAN tag
+        vlan = "\x81\00" + "\x00\x01"
+        bytes = "\0\1\1\0\0\2" + "\0\1\1\0\0\1" + vlan + "\x12\x34hi" 
+        ethernet_in = Ethernet.from_bytes bytes
+        assert_equal ethernet, ethernet_in
+
+        # Strip out multiple VLAN tags
+        bytes = "\0\1\1\0\0\2" + "\0\1\1\0\0\1" + vlan*10 + "\x12\x34hi" 
+        ethernet_in = Ethernet.from_bytes bytes
+        assert_equal ethernet, ethernet_in
+    end
+
+    def test_pppoe
+        ethernet = Ethernet.new
+        ethernet.dst = '00:01:01:00:00:02'
+        ethernet.src = '00:01:01:00:00:01'
+        ethernet.type = ETHERTYPE_IP
+        ethernet.payload = IPv4.new '127.0.0.1', '127.0.0.2'
+        ethernet.payload_raw = ethernet.payload.to_bytes
+
+        ipv4 = IPv4.new '127.0.0.1', '127.0.0.2'
+        bytes = "\0\1\1\0\0\2" + "\0\1\1\0\0\1" + "\x88\x64" +
+            # PPPoE
+            "\x11" + # version 1, type 1
+            "\x00" + # code
+            "\x00\x01" + # session ID
+            "\x00\x14" + # length
+            # PPP
+            "\x00\x21" + # IP
+            # IPv4
+            ipv4.to_bytes
+        ethernet_in = Ethernet.from_bytes bytes
+        assert_equal ethernet, ethernet_in
+    end
+end
+
+end
+end
+end

data/test/mu/pcap/tc_header.rb

@@ -0,0 +1,56 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class Header
+
+class Test < Mu::TestCase
+    def test_basics
+        header = Header.new
+        header.magic = BIG_ENDIAN
+        header.version_major = 2
+        header.version_minor = 4
+        header.thiszone = 0
+        header.sigfigs = 0
+        header.snaplen = 1500
+        header.linktype = 1
+
+        # Big endian
+        bytes = "\xa1\xb2\xc3\xd4" + "\x00\x02" +  "\x00\x04" +
+            "\x00\x00\x00\x00" + "\x00\x00\x00\x00" +
+            "\x00\x00\x05\xdc" + "\x00\x00\x00\x01"
+        header_in = Header.read StringIO.new(bytes)
+        assert_equal header, header_in
+
+        # Little endian
+        header.magic = LITTLE_ENDIAN
+        bytes = "\xd4\xc3\xb2\xa1" + "\x02\x00" +  "\x04\x00" +
+            "\x00\x00\x00\x00" + "\x00\x00\x00\x00" +
+            "\xdc\x05\x00\x00" + "\x01\x00\x00\x00"
+        header_in = Header.read StringIO.new(bytes)
+        assert_equal header, header_in
+    end
+
+
+    def test_decode_null
+        ethernet = Ethernet.new
+        ethernet.src = '00:01:01:00:00:01'
+        ethernet.dst = '00:01:01:00:00:02'
+        ethernet.type = Ethernet::ETHERTYPE_IP
+        ethernet.payload = ethernet.payload_raw = 'hello'
+        bytes = nil
+        with_no_stderr do # supress warning about malformed IPv4
+            bytes = Pkthdr.decode_null BIG_ENDIAN, "\0\0\0\2hello"
+        end
+        assert_equal ethernet, bytes
+    end
+end
+
+end
+end
+end

data/test/mu/pcap/tc_ipv4.rb

@@ -0,0 +1,103 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class IPv4
+
+class Test < Mu::TestCase
+    def test_basics
+        bytes = 
+            "\x47"+                    # version, header length
+            "\x00" +                   # TOS
+            "\x00\x1c" +               # length
+            "\x4c\xb7" +               # ID
+            "\x00\x00" +               # offset
+            "\x40" +                   # TTL
+            "\x01" +                   # protocol
+            "\x99\x2a" +               # checksum
+            "\x0a\x01\x02\x03" +       # src-ip
+            "\x0a\x02\x03\x04" +       # dst-ip
+            "\x94\x04\x00\x00\x00\x00" + "\x00\x00" # options
+
+        ipv4 = IPv4.new
+        ipv4.ip_id = 19639
+        ipv4.ttl = 64
+        ipv4.proto = 1
+        ipv4.src = '10.1.2.3'
+        ipv4.dst = '10.2.3.4'
+        ipv4.payload = ''
+
+        ipv4_in = nil
+        with_no_stderr do # supress warning about options
+            ipv4_in = IPv4.from_bytes bytes
+        end
+        assert_equal ipv4, ipv4_in
+    end
+
+    def test_reassemble
+        # empty stream
+        assert_equal [], IPv4.reassemble([])
+
+        # one packet
+        ip = ip 0, "A" * 10
+        assert_equal [ip], IPv4.reassemble([ip])
+
+        # three packets
+        ip1 = ip IP_MF | 0, "A" * 16
+        ip2 = ip IP_MF | 2, "B" * 16
+        ip3 = ip         4, "C" * 16
+        ipo = ip IP_MF | 3, "B" * 8 + "C" * 8 # overlap
+        ipe = ip IP_MF | 1,  ""                # empty
+        ip  = ip         0, "A" * 16 + "B" * 16 + "C" * 16
+        [[ip1, ip2, ip3],
+         [ip1, ip3, ip2],
+         [ip2, ip1, ip3],
+         [ip2, ip3, ip1],
+         [ip3, ip1, ip2],
+         [ip3, ip2, ip1]].each do |ips|
+            with_no_stderr do
+                assert_equal [ip], IPv4.reassemble(ips)
+            end
+            # test with overlapping fragment
+            0.upto(ips.length-1) do |i|
+                ips.insert i, ipo
+                with_no_stderr do
+                    assert_equal [ip], IPv4.reassemble(ips)
+                end
+                ips.delete_at i
+            end
+            # test with empty fragment
+            0.upto(ips.length-1) do |i|
+                ips.insert i, ipe
+                with_no_stderr do
+                    assert_equal [ip], IPv4.reassemble(ips)
+                end
+                ips.delete_at i
+            end
+        end
+    end
+
+    def ip offset, payload
+        ipv4 = IPv4.new
+        ethernet = Ethernet.new
+        ethernet.src = '00:01:00:00:00:01'
+        ethernet.dst = '00:01:00:00:00:02'
+        ipv4.src = '10.0.0.1'
+        ipv4.dst = '10.0.0.2'
+        ipv4.proto = IPv4::IPPROTO_TCP
+        ipv4.offset = offset
+        ipv4.payload = payload
+        ethernet.type = Ethernet::ETHERTYPE_IP
+        ethernet.payload = ipv4
+        return ethernet
+    end
+end
+
+end
+end
+end

data/test/mu/pcap/tc_ipv6.rb

@@ -0,0 +1,83 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class IPv6
+
+class Test < Mu::TestCase
+    def test_basics
+        bytes =
+            "60000000"                         + # version, class, label
+            "0005"                             + # length
+            "59"                               + # next header
+            "40"                               + # hop limit
+            "00000000000000000000000000000001" + # source
+            "ff020000000000000000000000000005"   # destination
+        bytes = bytes.from_hex + 'hello'
+
+        ipv6 = IPv6.new
+        ipv6.next_header = 0x59
+        ipv6.hop_limit = 64
+        ipv6.src = '::1'
+        ipv6.dst = 'ff02::5'
+        ipv6.payload = 'hello'
+        ipv6.payload_raw = 'hello'
+
+        ipv6_in = nil
+        with_no_stderr do # supress warning about options
+            ipv6_in = IPv6.from_bytes bytes
+        end
+        assert_equal ipv6, ipv6_in
+    end
+
+    def test_headers
+        packet =
+            "60000000"                         + # version, class, label
+            "%04x"                             + # length
+            "%02x"                             + # next header
+            "40"                               + # hop limit
+            "00000000000000000000000000000001" + # source
+            "ff020000000000000000000000000005"   # destination
+
+        # No next header
+        bytes = (packet % [0, IP::IPPROTO_NONE]).from_hex
+        ipv6 = IPv6.from_bytes bytes
+        assert_equal IP::IPPROTO_NONE, ipv6.next_header
+        assert_equal '', ipv6.payload
+
+        # Hop-by-hop options
+        bytes = (packet % [8, IP::IPPROTO_HOPOPTS]).from_hex +
+            [IP::IPPROTO_NONE, 0, "\0\0\0\0\0\0"].pack('CCa6')
+        ipv6 = IPv6.from_bytes bytes
+        assert_equal IP::IPPROTO_NONE, ipv6.next_header
+
+        # Routing header options
+        bytes = (packet % [8, IP::IPPROTO_ROUTING]).from_hex +
+            [IP::IPPROTO_NONE, 0, "\0\0\0\0\0\0"].pack('CCa6')
+        ipv6 = IPv6.from_bytes bytes
+        assert_equal IP::IPPROTO_NONE, ipv6.next_header
+
+        # Destination options
+        bytes = (packet % [8, IP::IPPROTO_DSTOPTS]).from_hex +
+            [IP::IPPROTO_NONE, 0, "\0\0\0\0\0\0"].pack('CCa6')
+        ipv6 = IPv6.from_bytes bytes
+        assert_equal IP::IPPROTO_NONE, ipv6.next_header
+
+        # Fragment (not supported)
+        bytes = (packet % [8, IP::IPPROTO_FRAGMENT]).from_hex +
+            [IP::IPPROTO_NONE, 0, 0, 0].pack('CCnN')
+        with_no_stderr do
+            ipv6 = IPv6.from_bytes bytes
+        end
+        assert_equal IP::IPPROTO_FRAGMENT, ipv6.next_header
+    end
+end
+
+end
+end
+end

data/test/mu/pcap/tc_packet.rb

@@ -0,0 +1,44 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class Packet
+
+class Test < Mu::TestCase
+    def test_isolate_l7
+        # Empty
+        assert_equal [], Packet.isolate_l7([])
+
+        # Ethernet
+        ethernet = Ethernet.new
+        assert_equal [ethernet], Packet.isolate_l7([ethernet])
+
+        # UDP packet
+        udp = Ethernet.new
+        udp.payload = IPv4.new
+        udp.payload.payload = UDP.new
+        udp.payload.payload.src_port = 1000
+        assert_equal [udp], Packet.isolate_l7([udp])
+
+        # UDP packet and Ethernet
+        assert_equal [udp], Packet.isolate_l7([udp, ethernet])
+        assert_equal [udp], Packet.isolate_l7([ethernet, udp])
+
+        # UDP packet and DNS
+        dns = Ethernet.new
+        dns.payload = IPv4.new
+        dns.payload.payload = UDP.new
+        dns.payload.payload.src_port = 53
+        assert_equal [udp], Packet.isolate_l7([udp, dns])
+        assert_equal [udp], Packet.isolate_l7([dns, udp])
+    end
+end
+
+end
+end
+end

data/test/mu/pcap/tc_pair.rb

@@ -0,0 +1,58 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap/io_pair'
+
+module Mu
+class Pcap
+class IOPair
+class Test < Mu::TestCase
+
+    def test_stream
+        io1, io2 = IOPair.stream_pair
+
+        # send
+        assert_equal 3, io1.write("foo")
+        assert_equal "foo", io2.read(3)
+
+        # another
+        assert_equal 3, io1.write("bar")
+        assert_equal "bar", io2.read(0xffff)
+
+        # reverse
+        assert_equal 3, io2.write("baz")
+        assert_equal "baz", io1.read(0xffff)
+
+        # 2 sends, 1 receive
+        assert_equal 3, io1.write("one")
+        assert_equal 3, io1.write("two")
+        assert_equal "onetwo", io2.read(6)
+    end
+
+    def test_packet
+        io1, io2 = IOPair.packet_pair
+
+        # send
+        assert_equal 3, io1.write("foo")
+        assert_equal "foo", io2.read
+
+        # another
+        assert_equal 3, io1.write("bar")
+        assert_equal "bar", io2.read
+
+        # reverse
+        assert_equal 3, io2.write("baz")
+        assert_equal "baz", io1.read
+
+        # 2 sends, 2 receives
+        assert_equal 3, io1.write("one")
+        assert_equal 3, io1.write("two")
+        assert_equal "one", io2.read
+        assert_equal "two", io2.read
+    end
+end
+end
+end
+end

data/test/mu/pcap/tc_pkthdr.rb

@@ -0,0 +1,33 @@
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/testcase'
+require 'mu/pcap'
+
+module Mu
+class Pcap
+class Pkthdr
+
+class Test < Mu::TestCase
+    def test_basics
+        pkthdr = Pkthdr.new
+        pkthdr.endian = LITTLE_ENDIAN
+        pkthdr.ts_sec = 1191265036
+        pkthdr.ts_usec = 73432
+        pkthdr.caplen = 73
+        pkthdr.len = 73
+        pkthdr.pkt = 'X' * 73
+
+        bytes = "\x0c\x43\x01\x47" + "\xd8\x1e\x01\x00" + 
+            "\x49\x00\x00\x00" + "\x49\x00\x00\x00" + ("X" * 73)
+        pkthdr_in = Pkthdr.read StringIO.new(bytes), LITTLE_ENDIAN
+        assert_equal pkthdr, pkthdr_in
+    end
+end
+
+end
+end
+end
+
+