pstream 0.2.4 → 0.2.5
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/bin/pstream +4 -7
- data/lib/pstream.rb +49 -46
- data/lib/pstream/cipher_negotiation.rb +14 -9
- data/lib/pstream/stream.rb +23 -18
- metadata +7 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b4c84b815a88508509a869a3336d6ae0826dc0cc
|
4
|
+
data.tar.gz: 496049f3b1b1468d57ddd275a5ff8b4254722034
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5226da6802ac5545c3f3c7316eb06422e111111a256d7cf807f5e4f459c5d90964174a9e2e267b7582a3087f50d3f012a285ecaabb975cd4f8e1037f7524042b
|
7
|
+
data.tar.gz: 4789cdf032ede02e64fc0286986d38b7ef1c76f46d2cbf09bd5938d2a338ba6b9097004e32ad8c57132caee0fd66e8bb6390d6648c832cc0ead96305881e896b
|
data/bin/pstream
CHANGED
@@ -1,6 +1,6 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
|
-
require "
|
3
|
+
require "hilighter"
|
4
4
|
require "io/wait"
|
5
5
|
require "optparse"
|
6
6
|
require "pstream"
|
@@ -32,7 +32,7 @@ def parse(args)
|
|
32
32
|
|
33
33
|
opts.on("", "DESCRIPTION")
|
34
34
|
|
35
|
-
info.scan(/\S.{0
|
35
|
+
info.scan(/\S.{0,76}\S(?=\s|$)|\S+/).each do |line|
|
36
36
|
opts.on(" #{line}")
|
37
37
|
end
|
38
38
|
|
@@ -52,7 +52,7 @@ def parse(args)
|
|
52
52
|
end
|
53
53
|
|
54
54
|
opts.on("--nocolor", "Disable colorized output") do
|
55
|
-
|
55
|
+
Hilighter.disable
|
56
56
|
end
|
57
57
|
|
58
58
|
opts.on("-s", "--stream=NUM", "Show specified stream") do |s|
|
@@ -104,10 +104,7 @@ end
|
|
104
104
|
options = parse(ARGV)
|
105
105
|
|
106
106
|
begin
|
107
|
-
pstream = PStream.new(
|
108
|
-
options["pcap"],
|
109
|
-
!String.disable_colorization
|
110
|
-
)
|
107
|
+
pstream = PStream.new(options["pcap"], !Hilighter.disable?)
|
111
108
|
|
112
109
|
if (options["stream"])
|
113
110
|
puts pstream.get_stream(
|
data/lib/pstream.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
require "hilighter"
|
1
2
|
require "pathname"
|
2
3
|
require "scoobydoo"
|
3
4
|
|
@@ -77,46 +78,6 @@ class PStream
|
|
77
78
|
return negotiations.values
|
78
79
|
end
|
79
80
|
|
80
|
-
def self.colorize?
|
81
|
-
@@colorize ||= false
|
82
|
-
return @@colorize
|
83
|
-
end
|
84
|
-
|
85
|
-
def colorize_cipher_suite(suite)
|
86
|
-
return suite if (!@@colorize)
|
87
|
-
|
88
|
-
case suite
|
89
|
-
when /Unknown/
|
90
|
-
# Unknown
|
91
|
-
return suite.light_yellow
|
92
|
-
when /NULL|MD5|RC4|anon/
|
93
|
-
# Bad cipher suites
|
94
|
-
return suite.light_red
|
95
|
-
when /E?(EC)?DHE?|AES_256/
|
96
|
-
# Great cipher suites
|
97
|
-
return suite.light_green
|
98
|
-
else
|
99
|
-
# Maybe OK
|
100
|
-
return suite.light_white
|
101
|
-
end
|
102
|
-
end
|
103
|
-
|
104
|
-
def colorize_header(header)
|
105
|
-
return header if (!@@colorize)
|
106
|
-
return header.light_cyan
|
107
|
-
end
|
108
|
-
|
109
|
-
def colorize_stream(stream)
|
110
|
-
if (!@@colorize)
|
111
|
-
return "#{stream.id} | #{stream.desc} | #{stream.frames}"
|
112
|
-
end
|
113
|
-
return [
|
114
|
-
"#{stream.id}".light_blue,
|
115
|
-
stream.desc.light_green,
|
116
|
-
stream.frames.light_white
|
117
|
-
].join(" | ")
|
118
|
-
end
|
119
|
-
|
120
81
|
def get_stream(stream, prot = "tcp")
|
121
82
|
case prot
|
122
83
|
when /^tcp$/i
|
@@ -172,12 +133,54 @@ class PStream
|
|
172
133
|
end
|
173
134
|
private :get_streams
|
174
135
|
|
175
|
-
def
|
136
|
+
def self.hilight?
|
137
|
+
@@hilight ||= false
|
138
|
+
return @@hilight
|
139
|
+
end
|
140
|
+
|
141
|
+
def hilight_cipher_suite(suite)
|
142
|
+
return suite if (!@@hilight)
|
143
|
+
|
144
|
+
case suite
|
145
|
+
when /Unknown/
|
146
|
+
# Unknown
|
147
|
+
return suite.light_yellow
|
148
|
+
when /NULL|MD5|RC4|anon/
|
149
|
+
# Bad cipher suites
|
150
|
+
return suite.light_red
|
151
|
+
when /E?(EC)?DHE?|AES_256/
|
152
|
+
# Great cipher suites
|
153
|
+
return suite.light_green
|
154
|
+
else
|
155
|
+
# Maybe OK
|
156
|
+
return suite.light_white
|
157
|
+
end
|
158
|
+
end
|
159
|
+
|
160
|
+
def hilight_header(header)
|
161
|
+
return header if (!@@hilight)
|
162
|
+
return header.light_cyan
|
163
|
+
end
|
164
|
+
private :hilight_header
|
165
|
+
|
166
|
+
def hilight_stream(stream)
|
167
|
+
if (!@@hilight)
|
168
|
+
return "#{stream.id} | #{stream.desc} | #{stream.frames}"
|
169
|
+
end
|
170
|
+
return [
|
171
|
+
"#{stream.id}".light_blue,
|
172
|
+
stream.desc.light_green,
|
173
|
+
stream.frames.light_white
|
174
|
+
].join(" | ")
|
175
|
+
end
|
176
|
+
private :hilight_stream
|
177
|
+
|
178
|
+
def initialize(pcap, hilight = false)
|
176
179
|
if (ScoobyDoo.where_are_you("tshark").nil?)
|
177
180
|
raise PStream::Error::TsharkNotFound.new
|
178
181
|
end
|
179
182
|
|
180
|
-
@@
|
183
|
+
@@hilight = hilight
|
181
184
|
@pcap = Pathname.new(pcap).expand_path
|
182
185
|
|
183
186
|
if (!@pcap.exist?)
|
@@ -197,19 +200,19 @@ class PStream
|
|
197
200
|
|
198
201
|
# List streams
|
199
202
|
["tcp", "udp"].each do |prot|
|
200
|
-
ret.push(
|
203
|
+
ret.push(hilight_header("#{prot.upcase} streams:"))
|
201
204
|
@streams[prot].each do |stream|
|
202
|
-
ret.push(
|
205
|
+
ret.push(hilight_stream(stream))
|
203
206
|
end
|
204
207
|
ret.push("")
|
205
208
|
end
|
206
209
|
|
207
210
|
# List ciphers that were actually selected
|
208
|
-
ret.push(
|
211
|
+
ret.push(hilight_header("Ciphers in use:"))
|
209
212
|
cipher_negotiations.map do |negotiation|
|
210
213
|
negotiation.suite
|
211
214
|
end.uniq.each do |suite|
|
212
|
-
ret.push(
|
215
|
+
ret.push(hilight_cipher_suite(suite))
|
213
216
|
end
|
214
217
|
|
215
218
|
return ret.join("\n")
|
@@ -1,3 +1,5 @@
|
|
1
|
+
require "hilighter"
|
2
|
+
|
1
3
|
class PStream::CipherNegotiation
|
2
4
|
attr_accessor :length
|
3
5
|
attr_accessor :suite
|
@@ -8,23 +10,26 @@ class PStream::CipherNegotiation
|
|
8
10
|
attr_reader :pstream
|
9
11
|
attr_reader :src
|
10
12
|
|
11
|
-
def
|
12
|
-
return "#{src} <-> #{dst}" if (!PStream.
|
13
|
+
def hilight_hosts(src, dst)
|
14
|
+
return "#{src} <-> #{dst}" if (!PStream.hilight?)
|
13
15
|
return "#{src} <-> #{dst}".light_cyan
|
14
16
|
end
|
17
|
+
private :hilight_hosts
|
15
18
|
|
16
|
-
def
|
17
|
-
return "IPv#{ipv}" if (!PStream.
|
19
|
+
def hilight_ipv(ipv)
|
20
|
+
return "IPv#{ipv}" if (!PStream.hilight?)
|
18
21
|
return "IPv#{ipv}".light_cyan
|
19
22
|
end
|
23
|
+
private :hilight_ipv
|
20
24
|
|
21
|
-
def
|
25
|
+
def hilight_selected_suite(suite)
|
22
26
|
return [
|
23
27
|
"Selected".light_blue,
|
24
|
-
@pstream.
|
28
|
+
@pstream.hilight_cipher_suite(suite),
|
25
29
|
"from:".light_blue
|
26
30
|
].join(" ")
|
27
31
|
end
|
32
|
+
private :hilight_selected_suite
|
28
33
|
|
29
34
|
def initialize(pstream, ipv, src, dst)
|
30
35
|
@dst = dst
|
@@ -39,11 +44,11 @@ class PStream::CipherNegotiation
|
|
39
44
|
def summary
|
40
45
|
ret = Array.new
|
41
46
|
ret.push(
|
42
|
-
"#{
|
47
|
+
"#{hilight_ipv(@ipv)} #{hilight_hosts(@src, @dst)}"
|
43
48
|
)
|
44
|
-
ret.push(" #{
|
49
|
+
ret.push(" #{hilight_selected_suite(@suite)}") if (@suite)
|
45
50
|
@suites.each do |suite|
|
46
|
-
ret.push(" #{@pstream.
|
51
|
+
ret.push(" #{@pstream.hilight_cipher_suite(suite)}")
|
47
52
|
end
|
48
53
|
|
49
54
|
return ret.join("\n")
|
data/lib/pstream/stream.rb
CHANGED
@@ -1,23 +1,10 @@
|
|
1
|
+
require "hilighter"
|
2
|
+
|
1
3
|
class PStream::Stream
|
2
4
|
attr_reader :desc
|
3
5
|
attr_reader :frames
|
4
6
|
attr_reader :id
|
5
7
|
|
6
|
-
def colorize_address(address)
|
7
|
-
return address if (!PStream.colorize?)
|
8
|
-
return address.light_blue
|
9
|
-
end
|
10
|
-
|
11
|
-
def colorize_ascii(ascii)
|
12
|
-
return ascii if (!PStream.colorize?)
|
13
|
-
return ascii.light_white
|
14
|
-
end
|
15
|
-
|
16
|
-
def colorize_hex(hex)
|
17
|
-
return hex if (!PStream.colorize?)
|
18
|
-
return hex.light_green
|
19
|
-
end
|
20
|
-
|
21
8
|
def contents
|
22
9
|
case @prot
|
23
10
|
when /^tcp$/i
|
@@ -36,9 +23,9 @@ class PStream::Stream
|
|
36
23
|
m = line.match(/([0-9A-Fa-f]{8}) (.*) (.{17})/)
|
37
24
|
ret.push(
|
38
25
|
[
|
39
|
-
|
40
|
-
|
41
|
-
|
26
|
+
hilight_address(m[1]),
|
27
|
+
hilight_hex(m[2]),
|
28
|
+
hilight_ascii(m[3])
|
42
29
|
].join(" ")
|
43
30
|
)
|
44
31
|
end
|
@@ -46,6 +33,24 @@ class PStream::Stream
|
|
46
33
|
return ret.join("\n")
|
47
34
|
end
|
48
35
|
|
36
|
+
def hilight_address(address)
|
37
|
+
return address if (!PStream.hilight?)
|
38
|
+
return address.light_blue
|
39
|
+
end
|
40
|
+
private :hilight_address
|
41
|
+
|
42
|
+
def hilight_ascii(ascii)
|
43
|
+
return ascii if (!PStream.hilight?)
|
44
|
+
return ascii.light_white
|
45
|
+
end
|
46
|
+
private :hilight_ascii
|
47
|
+
|
48
|
+
def hilight_hex(hex)
|
49
|
+
return hex if (!PStream.hilight?)
|
50
|
+
return hex.light_green
|
51
|
+
end
|
52
|
+
private :hilight_hex
|
53
|
+
|
49
54
|
def initialize(pcap, prot, id, desc, frames)
|
50
55
|
@desc = desc
|
51
56
|
@frames = frames
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: pstream
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Miles Whittaker
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-04-24 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: rake
|
@@ -31,25 +31,25 @@ dependencies:
|
|
31
31
|
- !ruby/object:Gem::Version
|
32
32
|
version: 10.5.0
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
|
-
name:
|
34
|
+
name: hilighter
|
35
35
|
requirement: !ruby/object:Gem::Requirement
|
36
36
|
requirements:
|
37
37
|
- - "~>"
|
38
38
|
- !ruby/object:Gem::Version
|
39
|
-
version: '0.
|
39
|
+
version: '0.1'
|
40
40
|
- - ">="
|
41
41
|
- !ruby/object:Gem::Version
|
42
|
-
version: 0.
|
42
|
+
version: 0.1.0
|
43
43
|
type: :runtime
|
44
44
|
prerelease: false
|
45
45
|
version_requirements: !ruby/object:Gem::Requirement
|
46
46
|
requirements:
|
47
47
|
- - "~>"
|
48
48
|
- !ruby/object:Gem::Version
|
49
|
-
version: '0.
|
49
|
+
version: '0.1'
|
50
50
|
- - ">="
|
51
51
|
- !ruby/object:Gem::Version
|
52
|
-
version: 0.
|
52
|
+
version: 0.1.0
|
53
53
|
- !ruby/object:Gem::Dependency
|
54
54
|
name: scoobydoo
|
55
55
|
requirement: !ruby/object:Gem::Requirement
|