pcaprub 0.6.2 → 0.8.0

data/README.rdoc

@@ -9,3 +9,18 @@ PacketRub project (http://packetrub.rubyforge.org).
 
 Requirements:
   libpcap - http://www.tcpdump.org
+
+== Other Repositories
+
+The latest community svn version can be obtained from Subversion:
+  svn checkout http://pcaprub.rubyforge.org/svn/trunk/
+
+The Metasploit Project also provides a Subversion repository:
+  svn checkout http://metasploit.com/svn/framework3/trunk/external/pcaprub/
+
+(credits: github.com/dxoigmn/pcaprub)
+
+== Current Repository for Gemcutter source
+
+The Git Repo on Github @shadowbq is forked from the Metasploit SVN repo
+  git clone git://github.com/shadowbq/pcaprub.git

data/VERSION

@@ -1 +1 @@
-0.6.2
+0.8.0

data/ext/pcaprub/extconf.rb

@@ -1,7 +1,19 @@
 require 'mkmf'
-
 extension_name = 'pcaprub'
-have_library("pcap", "pcap_open_live")
+
+if /i386-mswin32/ =~ RUBY_PLATFORM
+  pcap_dir        = with_config("pcap-dir", "C:\WpdPack")
+  pcap_includedir = with_config("pcap-includedir", pcap_dir + "\\include")
+  pcap_libdir     = with_config("pcap-libdir", pcap_dir + "\\lib")
+
+  $CFLAGS  = "-DWIN32 -I#{pcap_includedir}"
+  $LDFLAGS = "/link /LIBPATH:#{pcap_libdir}"
+  have_library("wpcap", "pcap_open_live")
+	have_library("wpcap", "pcap_setnonblock")
+else
+  have_library("pcap", "pcap_open_live")
+	have_library("pcap", "pcap_setnonblock")
+end
+
 dir_config(extension_name)
- #$CPPFLAGS += " -DRUBY_19" if RUBY_VERSION =~ /1.9/
 create_makefile(extension_name)

data/ext/pcaprub/mkmf.log

@@ -22,3 +22,27 @@ checked program was:
 
 --------------------
 
+have_library: checking for pcap_setnonblock() in -lpcap... -------------------- yes
+
+"cc -o conftest -I. -I/usr/local/lib/ruby/1.8/i386-freebsd7 -I.   -O2 -fno-strict-aliasing -pipe   -fPIC conftest.c  -L. -L/usr/local/lib -Wl,-R/usr/local/lib -L.  -rdynamic    -lpcap  -lruby18-static -lpcap -lpcap  -lcrypt -lm  -rpath=/usr/lib:/usr/local/lib -pthread  -lc"
+conftest.c: In function 't':
+conftest.c:3: error: 'pcap_setnonblock' undeclared (first use in this function)
+conftest.c:3: error: (Each undeclared identifier is reported only once
+conftest.c:3: error: for each function it appears in.)
+checked program was:
+/* begin */
+1: /*top*/
+2: int main() { return 0; }
+3: int t() { void ((*volatile p)()); p = (void ((*)()))pcap_setnonblock; return 0; }
+/* end */
+
+"cc -o conftest -I. -I/usr/local/lib/ruby/1.8/i386-freebsd7 -I.   -O2 -fno-strict-aliasing -pipe   -fPIC conftest.c  -L. -L/usr/local/lib -Wl,-R/usr/local/lib -L.  -rdynamic    -lpcap  -lruby18-static -lpcap -lpcap  -lcrypt -lm  -rpath=/usr/lib:/usr/local/lib -pthread  -lc"
+checked program was:
+/* begin */
+1: /*top*/
+2: int main() { return 0; }
+3: int t() { pcap_setnonblock(); return 0; }
+/* end */
+
+--------------------
+

data/ext/pcaprub/pcaprub.c

@@ -3,8 +3,15 @@
 
 #include <pcap.h>
 
+#if !defined(WIN32)
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
+#endif
+
 static VALUE rb_cPcap;
 
+#define PCAPRUB_VERSION "0.8-dev"
+
 #define OFFLINE 1
 #define LIVE 2
 
@@ -14,6 +21,97 @@ typedef struct rbpcap {
     char type;
 } rbpcap_t;
 
+
+typedef struct rbpcapjob {
+	struct pcap_pkthdr hdr;
+    char *pkt;
+	int wtf;
+} rbpcapjob_t;
+
+static VALUE
+rbpcap_s_version(VALUE class)
+{
+    return rb_str_new2(PCAPRUB_VERSION);	
+}
+
+
+static VALUE
+rbpcap_s_lookupdev(VALUE self)
+{
+    char *dev = NULL;
+    char eb[PCAP_ERRBUF_SIZE];
+    VALUE ret_dev;  /* device string to return */
+#if defined(WIN32)  /* pcap_lookupdev is broken on windows */    
+    pcap_if_t *alldevs;
+    pcap_if_t *d;
+
+    /* Retrieve the device list from the local machine */
+    if (pcap_findalldevs(&alldevs,eb) == -1) {
+        rb_raise(rb_eRuntimeError,"%s",eb);
+    }
+
+    /* Find the first interface with an address and not loopback */
+    for(d = alldevs; d != NULL; d= d->next)  {
+        if(d->name && d->addresses && !(d->flags & PCAP_IF_LOOPBACK)) {
+            dev=d->name;
+            break;
+        }
+    }
+    
+    if (dev == NULL) {
+        rb_raise(rb_eRuntimeError,"%s","No valid interfaces found, Make sure WinPcap is installed.\n");
+    }
+    ret_dev = rb_str_new2(dev);
+    /* We don't need any more the device list. Free it */
+    pcap_freealldevs(alldevs);
+#else
+    dev = pcap_lookupdev(eb);
+    if (dev == NULL) {
+		rb_raise(rb_eRuntimeError, "%s", eb);
+    }
+    ret_dev = rb_str_new2(dev);
+#endif
+    return ret_dev;
+}
+
+static VALUE
+rbpcap_s_lookupnet(VALUE self, VALUE dev)
+{
+    bpf_u_int32 net, mask, m;
+    struct in_addr addr;
+    char eb[PCAP_ERRBUF_SIZE];
+	VALUE list;
+	
+    Check_Type(dev, T_STRING);
+    if (pcap_lookupnet(STR2CSTR(dev), &net, &mask, eb) == -1) {
+		rb_raise(rb_eRuntimeError, "%s", eb);
+    }
+
+    addr.s_addr = net;
+    m = ntohl(mask);
+    list = rb_ary_new();
+	rb_ary_push(list, rb_str_new2((char *) inet_ntoa(addr)));
+	rb_ary_push(list, UINT2NUM(m));
+	return(list);
+}
+
+
+static int rbpcap_ready(rbpcap_t *rbp) {
+	if(! rbp->pd) {
+		rb_raise(rb_eArgError, "a device or pcap file must be opened first");
+		return 0;
+	}
+	return 1;
+}
+
+static void rbpcap_close(rbpcap_t *rbp) {
+	if (rbp->pd)
+		pcap_close(rbp->pd);
+
+	rbp->pd = NULL;
+	free(rbp);
+}
+
 static VALUE
 rbpcap_new_s(VALUE class)
 {
@@ -21,101 +119,103 @@ rbpcap_new_s(VALUE class)
     rbpcap_t *rbp;
 
     // need to make destructor do a pcap_close later
-    self = Data_Make_Struct(class, rbpcap_t, 0, free, rbp);
+    self = Data_Make_Struct(class, rbpcap_t, 0, rbpcap_close, rbp);
     rb_obj_call_init(self, 0, 0);
 
     memset(rbp, 0, sizeof(rbpcap_t));
-
+	
     return self;
 }
 
 static VALUE
 rbpcap_setfilter(VALUE self, VALUE filter)
 {
-    char  eb[1024];
+    char eb[PCAP_ERRBUF_SIZE];
     rbpcap_t *rbp;
     u_int32_t mask = 0, netid = 0;
     struct bpf_program bpf;
 
     Data_Get_Struct(self, rbpcap_t, rbp);
 
-	if(TYPE(filter) != T_STRING)
-		rb_raise(rb_eArgError, "filter must be a string");
+    if(TYPE(filter) != T_STRING)
+    	rb_raise(rb_eArgError, "filter must be a string");
 
+	if(! rbpcap_ready(rbp)) return self; 
+	
     if(rbp->type == LIVE)
-        if(pcap_lookupnet(rbp->iface, &netid, &mask, eb) < 0)
-            rb_raise(rb_eRuntimeError, "%s", eb);
+    	if(pcap_lookupnet(rbp->iface, &netid, &mask, eb) < 0)
+    		rb_raise(rb_eRuntimeError, "%s", eb);
 
     if(pcap_compile(rbp->pd, &bpf, RSTRING(filter)->ptr, 0, mask) < 0)
-        rb_raise(rb_eRuntimeError, "invalid bpf filter");
+    	rb_raise(rb_eRuntimeError, "invalid bpf filter");
 
     if(pcap_setfilter(rbp->pd, &bpf) < 0)
-        rb_raise(rb_eRuntimeError, "unable to set bpf filter");
+    	rb_raise(rb_eRuntimeError, "unable to set bpf filter");
 
     return self;
 }
 
+
 static VALUE
-rbpcap_open_live(VALUE self, VALUE interface, VALUE snaplen, VALUE promisc, VALUE timeout)
+rbpcap_open_live(VALUE self, VALUE iface,VALUE snaplen,VALUE promisc, VALUE timeout)
 {
-    char eb[1024];
+    char eb[PCAP_ERRBUF_SIZE];
     rbpcap_t *rbp;
     int promisc_value = 0;
 
-	if(TYPE(interface) != T_STRING)
-		rb_raise(rb_eArgError, "interface must be a string");
-	if(TYPE(snaplen) != T_FIXNUM)
-		rb_raise(rb_eArgError, "snaplen must be a fixnum");
-	if(TYPE(timeout) != T_FIXNUM)
-		rb_raise(rb_eArgError, "timeout must be a fixnum");
+    if(TYPE(iface) != T_STRING)
+    	rb_raise(rb_eArgError, "interface must be a string");
+    if(TYPE(snaplen) != T_FIXNUM)
+    	rb_raise(rb_eArgError, "snaplen must be a fixnum");
+    if(TYPE(timeout) != T_FIXNUM)
+    	rb_raise(rb_eArgError, "timeout must be a fixnum");
 
     switch(promisc) {
-        case Qtrue:
-            promisc_value = 1;
-            break;
-        case Qfalse:
-            promisc_value = 0;
-            break;
-        default:
-            rb_raise(rb_eTypeError, "Argument not boolean");
+    	case Qtrue:
+    		promisc_value = 1;
+    		break;
+    	case Qfalse:
+    		promisc_value = 0;
+    		break;
+    	default:
+    		rb_raise(rb_eTypeError, "Argument not boolean");
     }
 
     Data_Get_Struct(self, rbpcap_t, rbp);
 
     rbp->type = LIVE;
     memset(rbp->iface, 0, sizeof(rbp->iface));
-    strncpy(rbp->iface, RSTRING(interface)->ptr, sizeof(rbp->iface) - 1);
+    strncpy(rbp->iface, RSTRING(iface)->ptr, sizeof(rbp->iface) - 1);
 
     rbp->pd = pcap_open_live(
-        RSTRING(interface)->ptr,
-        NUM2INT(snaplen),
-        promisc_value,
-        NUM2INT(timeout),
-        eb
+    	RSTRING(iface)->ptr,
+    	NUM2INT(snaplen),
+    	promisc_value,
+    	NUM2INT(timeout),
+    	eb
     );
 
     if(!rbp->pd)
-        rb_raise(rb_eRuntimeError, "%s", eb);
+    	rb_raise(rb_eRuntimeError, "%s", eb);
 
     return self;
 }
 
 static VALUE
-rbpcap_open_live_s(VALUE class, VALUE interface, VALUE snaplen, VALUE promisc, VALUE timeout)
+rbpcap_open_live_s(VALUE class, VALUE iface, VALUE snaplen, VALUE promisc, VALUE timeout)
 {
     VALUE iPcap = rb_funcall(rb_cPcap, rb_intern("new"), 0);
-
-    return rbpcap_open_live(iPcap, interface, snaplen, promisc, timeout);
+    return rbpcap_open_live(iPcap, iface, snaplen, promisc, timeout);
 }
 
 static VALUE
 rbpcap_open_offline(VALUE self, VALUE filename)
 {
-    char eb[1024];
+    char eb[PCAP_ERRBUF_SIZE];
     rbpcap_t *rbp;
 
-	if(TYPE(filename) != T_STRING)
-		rb_raise(rb_eArgError, "filename must be a string");
+    if(TYPE(filename) != T_STRING)
+    	rb_raise(rb_eArgError, "filename must be a string");
 
     Data_Get_Struct(self, rbpcap_t, rbp);
 
@@ -123,12 +223,12 @@ rbpcap_open_offline(VALUE self, VALUE filename)
     rbp->type = OFFLINE;
 
     rbp->pd = pcap_open_offline(
-        RSTRING(filename)->ptr,
-        eb
+    	RSTRING(filename)->ptr,
+    	eb
     );
 
     if(!rbp->pd)
-        rb_raise(rb_eRuntimeError, "%s", eb);
+    	rb_raise(rb_eRuntimeError, "%s", eb);
 
     return self;
 }
@@ -147,32 +247,56 @@ rbpcap_inject(VALUE self, VALUE payload)
 {
     rbpcap_t *rbp;
 
-	if(TYPE(payload) != T_STRING)
-		rb_raise(rb_eArgError, "payload must be a string");
+    if(TYPE(payload) != T_STRING)
+    	rb_raise(rb_eArgError, "payload must be a string");
 
     Data_Get_Struct(self, rbpcap_t, rbp);
 
+	if(! rbpcap_ready(rbp)) return self; 
+#if defined(WIN32)   
+    /* WinPcap does not have a pcap_inject call we use pcap_sendpacket, if it suceedes 
+     * we simply return the amount of packets request to inject, else we fail.
+     */
+    if(pcap_sendpacket(rbp->pd, RSTRING(payload)->ptr, RSTRING(payload)->len) != 0) {
+    	rb_raise(rb_eRuntimeError, "%s", pcap_geterr(rbp->pd));
+    }
+    return INT2NUM(RSTRING(payload)->len);
+#else
     return INT2NUM(pcap_inject(rbp->pd, RSTRING(payload)->ptr, RSTRING(payload)->len));
+#endif
+}
+
+
+static void rbpcap_handler(rbpcapjob_t *job, struct pcap_pkthdr *hdr, u_char *pkt){
+	job->pkt = pkt;
+	job->hdr = *hdr;
 }
 
 static VALUE
 rbpcap_next(VALUE self)
 {
-    int ret;
-    char *pkt;
     rbpcap_t *rbp;
-    struct pcap_pkthdr pkthdr;
-
+	rbpcapjob_t job;
+	char eb[PCAP_ERRBUF_SIZE];
+	int ret;	
+	
     Data_Get_Struct(self, rbpcap_t, rbp);
-
-	memset(&pkthdr, 0, sizeof(pkthdr));
+	if(! rbpcap_ready(rbp)) return self; 
+	pcap_setnonblock(rbp->pd, 1, eb);
 
     TRAP_BEG;
-    pkt = (char *)pcap_next(rbp->pd, &pkthdr);
+	
+	while(! (ret = pcap_dispatch(rbp->pd, 1, (pcap_handler) rbpcap_handler, (u_char *)&job))) {
+		if(rbp->type == OFFLINE) break;
+		rb_thread_schedule();
+	}
+    
     TRAP_END;
 
-    if(pkthdr.caplen > 0)
-        return rb_str_new(pkt, pkthdr.caplen);
+	if(rbp->type = OFFLINE && ret <= 0) return Qnil;
+
+    if(job.hdr.caplen > 0)
+    	return rb_str_new(job.pkt, job.hdr.caplen);
 
     return Qnil;
 }
@@ -180,22 +304,21 @@ rbpcap_next(VALUE self)
 static VALUE
 rbpcap_capture(VALUE self)
 {
-    int ret;
-    char *pkt;
     rbpcap_t *rbp;
-    struct pcap_pkthdr pkthdr;
 
     Data_Get_Struct(self, rbpcap_t, rbp);
 
+	if(! rbpcap_ready(rbp)) return self; 
+	
     for(;;) {
 
-		VALUE packet = rbpcap_next(self);
+    	VALUE packet = rbpcap_next(self);
 
-        if(packet == Qnil && rbp->type == OFFLINE)
-            break;
+    	if(packet == Qnil && rbp->type == OFFLINE)
+    		break;
 
-        if(packet != Qnil)
-            rb_yield(packet);
+    	if(packet != Qnil)
+    		rb_yield(packet);
     }
 
     return self;
@@ -208,16 +331,54 @@ rbpcap_datalink(VALUE self)
     rbpcap_t *rbp;
 
     Data_Get_Struct(self, rbpcap_t, rbp);
-
+	
+	if(! rbpcap_ready(rbp)) return self;
+	
     return INT2NUM(pcap_datalink(rbp->pd));
 }
 
+static VALUE
+rbpcap_snapshot(VALUE self)
+{
+    rbpcap_t *rbp;
+
+    Data_Get_Struct(self, rbpcap_t, rbp);
+
+	if(! rbpcap_ready(rbp)) return self;
+	
+    return INT2NUM(pcap_snapshot(rbp->pd));
+}
+
+static VALUE
+rbpcap_stats(VALUE self)
+{
+    rbpcap_t *rbp;
+    struct pcap_stat stat;
+    VALUE hash;
+    
+    Data_Get_Struct(self, rbpcap_t, rbp);
+
+	if(! rbpcap_ready(rbp)) return self;
+		
+    if (pcap_stats(rbp->pd, &stat) == -1)
+    	return Qnil;
+    	
+    hash = rb_hash_new();
+    rb_hash_aset(hash, rb_str_new2("recv"), UINT2NUM(stat.ps_recv));
+    rb_hash_aset(hash, rb_str_new2("drop"), UINT2NUM(stat.ps_drop));
+    rb_hash_aset(hash, rb_str_new2("idrop"), UINT2NUM(stat.ps_ifdrop));
+    return hash;
+}
+
 void
 Init_pcaprub()
 {
     // Pcap
     rb_cPcap = rb_define_class("Pcap", rb_cObject);
-
+    rb_define_module_function(rb_cPcap, "version", rbpcap_s_version, 0);
+    rb_define_module_function(rb_cPcap, "lookupdev", rbpcap_s_lookupdev, 0);
+    rb_define_module_function(rb_cPcap, "lookupnet", rbpcap_s_lookupnet, 1);
+		
     rb_define_const(rb_cPcap, "DLT_NULL",   INT2NUM(DLT_NULL));
     rb_define_const(rb_cPcap, "DLT_EN10MB", INT2NUM(DLT_EN10MB));
     rb_define_const(rb_cPcap, "DLT_EN3MB", INT2NUM(DLT_EN3MB));
@@ -230,7 +391,15 @@ Init_pcaprub()
     rb_define_const(rb_cPcap, "DLT_PPP", INT2NUM(DLT_PPP));
     rb_define_const(rb_cPcap, "DLT_FDDI", INT2NUM(DLT_FDDI));
     rb_define_const(rb_cPcap, "DLT_ATM_RFC1483", INT2NUM(DLT_ATM_RFC1483));
-
+    rb_define_const(rb_cPcap, "DLT_RAW", INT2NUM(DLT_RAW));
+    rb_define_const(rb_cPcap, "DLT_SLIP_BSDOS", INT2NUM(DLT_SLIP_BSDOS));
+    rb_define_const(rb_cPcap, "DLT_PPP_BSDOS", INT2NUM(DLT_PPP_BSDOS));
+    rb_define_const(rb_cPcap, "DLT_IEEE802_11", INT2NUM(DLT_IEEE802_11));
+    rb_define_const(rb_cPcap, "DLT_IEEE802_11_RADIO", INT2NUM(DLT_IEEE802_11_RADIO));
+    rb_define_const(rb_cPcap, "DLT_IEEE802_11_RADIO_AVS", INT2NUM(DLT_IEEE802_11_RADIO_AVS));
+    rb_define_const(rb_cPcap, "DLT_LINUX_SLL", INT2NUM(DLT_LINUX_SLL));
+    rb_define_const(rb_cPcap, "DLT_PRISM_HEADER", INT2NUM(DLT_PRISM_HEADER));
+    rb_define_const(rb_cPcap, "DLT_AIRONET_HEADER", INT2NUM(DLT_AIRONET_HEADER));
 
     rb_define_singleton_method(rb_cPcap, "new", rbpcap_new_s, 0);
 
@@ -242,5 +411,9 @@ Init_pcaprub()
     rb_define_method(rb_cPcap, "setfilter", rbpcap_setfilter, 1);
     rb_define_method(rb_cPcap, "inject", rbpcap_inject, 1);
     rb_define_method(rb_cPcap, "datalink", rbpcap_datalink, 0);
-
+    
+    rb_define_method(rb_cPcap, "snapshot", rbpcap_snapshot, 0);
+    rb_define_method(rb_cPcap, "snaplen", rbpcap_snapshot, 0);
+    rb_define_method(rb_cPcap, "stats", rbpcap_stats, 0);
 }
+

data/pcaprub.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{pcaprub}
-  s.version = "0.6.2"
+  s.version = "0.8.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["shadowbq"]
-  s.date = %q{2010-02-06}
+  s.date = %q{2010-02-08}
   s.description = %q{libpcap bindings for ruby}
   s.email = %q{shadowbq@gmail.com}
   s.extensions = ["ext/pcaprub/extconf.rb"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: pcaprub
 version: !ruby/object:Gem::Version 
-  version: 0.6.2
+  version: 0.8.0
 platform: ruby
 authors: 
 - shadowbq
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-02-06 00:00:00 -05:00
+date: 2010-02-08 00:00:00 -05:00
 default_executable: 
 dependencies: []