redhound 1.0.1 → 2.0.0.rc2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (232) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +51 -0
  3. data/README.md +97 -31
  4. data/docs/API.md +104 -0
  5. data/docs/FILTERS.md +37 -0
  6. data/docs/MIGRATION.md +23 -0
  7. data/docs/PROTOCOLS.md +54 -0
  8. data/docs/USAGE.md +86 -0
  9. data/docs/VALIDATION.md +175 -0
  10. data/docs/json-schema.json +64 -0
  11. data/exe/redhound +2 -1
  12. data/lib/redhound/analysis/flow_key.rb +59 -0
  13. data/lib/redhound/analysis/flow_table.rb +124 -0
  14. data/lib/redhound/analysis/ip_reassembler.rb +209 -0
  15. data/lib/redhound/analysis/stats.rb +150 -0
  16. data/lib/redhound/analysis/tcp_analysis.rb +43 -0
  17. data/lib/redhound/analysis/tcp_reassembler.rb +176 -0
  18. data/lib/redhound/analysis/tcp_stream.rb +156 -0
  19. data/lib/redhound/analysis.rb +157 -0
  20. data/lib/redhound/capture/bsd/bpf_device.rb +155 -0
  21. data/lib/redhound/capture/bsd/constants.rb +29 -0
  22. data/lib/redhound/capture/bsd/ifreq.rb +41 -0
  23. data/lib/redhound/capture/file_source.rb +214 -0
  24. data/lib/redhound/capture/interface.rb +70 -0
  25. data/lib/redhound/capture/linktype.rb +30 -0
  26. data/lib/redhound/capture/linux/constants.rb +37 -0
  27. data/lib/redhound/capture/linux/cooked.rb +18 -0
  28. data/lib/redhound/capture/linux/ifreq.rb +42 -0
  29. data/lib/redhound/capture/linux/packet_socket.rb +224 -0
  30. data/lib/redhound/capture/linux/sockaddr_ll.rb +33 -0
  31. data/lib/redhound/capture/linux/tpacket_v3.rb +137 -0
  32. data/lib/redhound/capture/source.rb +79 -0
  33. data/lib/redhound/capture/stats.rb +22 -0
  34. data/lib/redhound/capture.rb +70 -0
  35. data/lib/redhound/cli/command.rb +42 -0
  36. data/lib/redhound/cli/options.rb +133 -0
  37. data/lib/redhound/cli/privileges.rb +29 -0
  38. data/lib/redhound/cli/runner.rb +129 -0
  39. data/lib/redhound/context.rb +20 -0
  40. data/lib/redhound/cursor.rb +69 -0
  41. data/lib/redhound/diagnostic.rb +7 -0
  42. data/lib/redhound/dissector.rb +152 -0
  43. data/lib/redhound/engine.rb +69 -0
  44. data/lib/redhound/errors.rb +38 -0
  45. data/lib/redhound/field.rb +62 -0
  46. data/lib/redhound/file/format.rb +63 -0
  47. data/lib/redhound/file/pcap_reader.rb +43 -0
  48. data/lib/redhound/file/pcap_writer.rb +79 -0
  49. data/lib/redhound/file/pcapng_reader.rb +221 -0
  50. data/lib/redhound/file/pcapng_writer.rb +151 -0
  51. data/lib/redhound/file/rotating_writer.rb +98 -0
  52. data/lib/redhound/filter/analyzer.rb +197 -0
  53. data/lib/redhound/filter/bpf/assembler.rb +121 -0
  54. data/lib/redhound/filter/bpf/disassembler.rb +58 -0
  55. data/lib/redhound/filter/bpf/validator.rb +77 -0
  56. data/lib/redhound/filter/bpf/vm.rb +109 -0
  57. data/lib/redhound/filter/codegen.rb +413 -0
  58. data/lib/redhound/filter/lexer.rb +46 -0
  59. data/lib/redhound/filter/parser.rb +206 -0
  60. data/lib/redhound/filter/program.rb +55 -0
  61. data/lib/redhound/filter.rb +30 -0
  62. data/lib/redhound/layer.rb +75 -0
  63. data/lib/redhound/output/fields.rb +20 -0
  64. data/lib/redhound/output/follow.rb +64 -0
  65. data/lib/redhound/output/hexdump.rb +29 -0
  66. data/lib/redhound/output/json.rb +32 -0
  67. data/lib/redhound/output/summary.rb +84 -0
  68. data/lib/redhound/output/timestamp.rb +34 -0
  69. data/lib/redhound/output/tree.rb +25 -0
  70. data/lib/redhound/packet.rb +77 -0
  71. data/lib/redhound/protocols/arp.rb +39 -0
  72. data/lib/redhound/protocols/checksum.rb +38 -0
  73. data/lib/redhound/protocols/data.rb +23 -0
  74. data/lib/redhound/protocols/dhcp.rb +140 -0
  75. data/lib/redhound/protocols/dns.rb +268 -0
  76. data/lib/redhound/protocols/ethernet.rb +24 -0
  77. data/lib/redhound/protocols/http.rb +185 -0
  78. data/lib/redhound/protocols/icmp.rb +205 -0
  79. data/lib/redhound/protocols/ipv4.rb +56 -0
  80. data/lib/redhound/protocols/ipv6.rb +68 -0
  81. data/lib/redhound/protocols/link.rb +70 -0
  82. data/lib/redhound/protocols/llc.rb +37 -0
  83. data/lib/redhound/protocols/ntp.rb +45 -0
  84. data/lib/redhound/protocols/tcp.rb +88 -0
  85. data/lib/redhound/protocols/tls.rb +218 -0
  86. data/lib/redhound/protocols/tunnel.rb +48 -0
  87. data/lib/redhound/protocols/udp.rb +32 -0
  88. data/lib/redhound/protocols/vlan.rb +23 -0
  89. data/lib/redhound/reader.rb +8 -0
  90. data/lib/redhound/registry.rb +64 -0
  91. data/lib/redhound/stream_dissector.rb +168 -0
  92. data/lib/redhound/util/seq.rb +21 -0
  93. data/lib/redhound/version.rb +2 -1
  94. data/lib/redhound/writer.rb +25 -43
  95. data/lib/redhound.rb +81 -9
  96. data/sig/generated/redhound/analysis/flow_key.rbs +15 -0
  97. data/sig/generated/redhound/analysis/flow_table.rbs +102 -0
  98. data/sig/generated/redhound/analysis/ip_reassembler.rbs +52 -0
  99. data/sig/generated/redhound/analysis/stats.rbs +80 -0
  100. data/sig/generated/redhound/analysis/tcp_analysis.rbs +15 -0
  101. data/sig/generated/redhound/analysis/tcp_reassembler.rbs +39 -0
  102. data/sig/generated/redhound/analysis/tcp_stream.rbs +60 -0
  103. data/sig/generated/redhound/analysis.rbs +38 -0
  104. data/sig/generated/redhound/capture/bsd/bpf_device.rbs +39 -0
  105. data/sig/generated/redhound/capture/bsd/constants.rbs +40 -0
  106. data/sig/generated/redhound/capture/bsd/ifreq.rbs +15 -0
  107. data/sig/generated/redhound/capture/file_source.rbs +67 -0
  108. data/sig/generated/redhound/capture/interface.rbs +53 -0
  109. data/sig/generated/redhound/capture/linktype.rbs +20 -0
  110. data/sig/generated/redhound/capture/linux/constants.rbs +58 -0
  111. data/sig/generated/redhound/capture/linux/cooked.rbs +15 -0
  112. data/sig/generated/redhound/capture/linux/ifreq.rbs +18 -0
  113. data/sig/generated/redhound/capture/linux/packet_socket.rbs +64 -0
  114. data/sig/generated/redhound/capture/linux/sockaddr_ll.rbs +31 -0
  115. data/sig/generated/redhound/capture/linux/tpacket_v3.rbs +35 -0
  116. data/sig/generated/redhound/capture/source.rbs +44 -0
  117. data/sig/generated/redhound/capture/stats.rbs +25 -0
  118. data/sig/generated/redhound/capture.rbs +14 -0
  119. data/sig/generated/redhound/cli/command.rbs +12 -0
  120. data/sig/generated/redhound/cli/options.rbs +25 -0
  121. data/sig/generated/redhound/cli/privileges.rbs +12 -0
  122. data/sig/generated/redhound/cli/runner.rbs +27 -0
  123. data/sig/generated/redhound/context.rbs +27 -0
  124. data/sig/generated/redhound/cursor.rbs +59 -0
  125. data/sig/generated/redhound/diagnostic.rbs +21 -0
  126. data/sig/generated/redhound/dissector.rbs +117 -0
  127. data/sig/generated/redhound/engine.rbs +23 -0
  128. data/sig/generated/redhound/errors.rbs +56 -0
  129. data/sig/generated/redhound/field.rbs +74 -0
  130. data/sig/generated/redhound/file/format.rbs +39 -0
  131. data/sig/generated/redhound/file/pcap_reader.rbs +19 -0
  132. data/sig/generated/redhound/file/pcap_writer.rbs +38 -0
  133. data/sig/generated/redhound/file/pcapng_reader.rbs +54 -0
  134. data/sig/generated/redhound/file/pcapng_writer.rbs +50 -0
  135. data/sig/generated/redhound/file/rotating_writer.rbs +42 -0
  136. data/sig/generated/redhound/filter/analyzer.rbs +42 -0
  137. data/sig/generated/redhound/filter/bpf/assembler.rbs +39 -0
  138. data/sig/generated/redhound/filter/bpf/disassembler.rbs +18 -0
  139. data/sig/generated/redhound/filter/bpf/validator.rbs +30 -0
  140. data/sig/generated/redhound/filter/bpf/vm.rbs +28 -0
  141. data/sig/generated/redhound/filter/codegen.rbs +101 -0
  142. data/sig/generated/redhound/filter/lexer.rbs +15 -0
  143. data/sig/generated/redhound/filter/parser.rbs +65 -0
  144. data/sig/generated/redhound/filter/program.rbs +48 -0
  145. data/sig/generated/redhound/filter.rbs +10 -0
  146. data/sig/generated/redhound/layer.rbs +81 -0
  147. data/sig/generated/redhound/output/fields.rbs +15 -0
  148. data/sig/generated/redhound/output/follow.rbs +21 -0
  149. data/sig/generated/redhound/output/hexdump.rbs +15 -0
  150. data/sig/generated/redhound/output/json.rbs +18 -0
  151. data/sig/generated/redhound/output/summary.rbs +21 -0
  152. data/sig/generated/redhound/output/timestamp.rbs +21 -0
  153. data/sig/generated/redhound/output/tree.rbs +15 -0
  154. data/sig/generated/redhound/packet.rbs +82 -0
  155. data/sig/generated/redhound/protocols/arp.rbs +15 -0
  156. data/sig/generated/redhound/protocols/checksum.rbs +15 -0
  157. data/sig/generated/redhound/protocols/data.rbs +17 -0
  158. data/sig/generated/redhound/protocols/dhcp.rbs +31 -0
  159. data/sig/generated/redhound/protocols/dns.rbs +42 -0
  160. data/sig/generated/redhound/protocols/ethernet.rbs +15 -0
  161. data/sig/generated/redhound/protocols/http.rbs +36 -0
  162. data/sig/generated/redhound/protocols/icmp.rbs +41 -0
  163. data/sig/generated/redhound/protocols/ipv4.rbs +15 -0
  164. data/sig/generated/redhound/protocols/ipv6.rbs +24 -0
  165. data/sig/generated/redhound/protocols/link.rbs +33 -0
  166. data/sig/generated/redhound/protocols/llc.rbs +15 -0
  167. data/sig/generated/redhound/protocols/ntp.rbs +17 -0
  168. data/sig/generated/redhound/protocols/tcp.rbs +25 -0
  169. data/sig/generated/redhound/protocols/tls.rbs +51 -0
  170. data/sig/generated/redhound/protocols/tunnel.rbs +24 -0
  171. data/sig/generated/redhound/protocols/udp.rbs +18 -0
  172. data/sig/generated/redhound/protocols/vlan.rbs +12 -0
  173. data/sig/generated/redhound/reader.rbs +7 -0
  174. data/sig/generated/redhound/registry.rbs +45 -0
  175. data/sig/generated/redhound/stream_dissector.rbs +44 -0
  176. data/sig/generated/redhound/util/seq.rbs +20 -0
  177. data/sig/generated/redhound/version.rbs +1 -0
  178. data/sig/generated/redhound/writer.rbs +6 -19
  179. data/sig/generated/redhound.rbs +18 -0
  180. data/sig/shims/io.rbs +7 -0
  181. data/sig/shims/process.rbs +3 -0
  182. metadata +177 -55
  183. data/CODE_OF_CONDUCT.md +0 -132
  184. data/Dockerfile +0 -7
  185. data/Rakefile +0 -15
  186. data/Steepfile +0 -4
  187. data/docker-compose.yml +0 -9
  188. data/lib/redhound/analyzer.rb +0 -34
  189. data/lib/redhound/builder/packet_mreq.rb +0 -56
  190. data/lib/redhound/builder/socket.rb +0 -35
  191. data/lib/redhound/builder.rb +0 -4
  192. data/lib/redhound/command.rb +0 -67
  193. data/lib/redhound/l2/ether.rb +0 -68
  194. data/lib/redhound/l2/protocol.rb +0 -33
  195. data/lib/redhound/l2.rb +0 -4
  196. data/lib/redhound/l3/arp.rb +0 -114
  197. data/lib/redhound/l3/base.rb +0 -49
  198. data/lib/redhound/l3/ipv4.rb +0 -95
  199. data/lib/redhound/l3/ipv6.rb +0 -69
  200. data/lib/redhound/l3/protocol.rb +0 -173
  201. data/lib/redhound/l3/resolver.rb +0 -30
  202. data/lib/redhound/l3.rb +0 -9
  203. data/lib/redhound/l4/base.rb +0 -31
  204. data/lib/redhound/l4/icmp.rb +0 -71
  205. data/lib/redhound/l4/resolver.rb +0 -28
  206. data/lib/redhound/l4/udp.rb +0 -63
  207. data/lib/redhound/l4.rb +0 -6
  208. data/lib/redhound/receiver.rb +0 -45
  209. data/lib/redhound/resolver.rb +0 -22
  210. data/lib/redhound/source/socket.rb +0 -18
  211. data/lib/redhound/source.rb +0 -3
  212. data/rbs_collection.lock.yaml +0 -20
  213. data/rbs_collection.yaml +0 -17
  214. data/sig/generated/redhound/analyzer.rbs +0 -14
  215. data/sig/generated/redhound/builder/packet_mreq.rbs +0 -39
  216. data/sig/generated/redhound/builder/socket.rbs +0 -24
  217. data/sig/generated/redhound/command.rbs +0 -19
  218. data/sig/generated/redhound/l2/ether.rbs +0 -41
  219. data/sig/generated/redhound/l2/protocol.rbs +0 -15
  220. data/sig/generated/redhound/l3/arp.rbs +0 -57
  221. data/sig/generated/redhound/l3/base.rbs +0 -28
  222. data/sig/generated/redhound/l3/ipv4.rbs +0 -53
  223. data/sig/generated/redhound/l3/ipv6.rbs +0 -38
  224. data/sig/generated/redhound/l3/protocol.rbs +0 -16
  225. data/sig/generated/redhound/l3/resolver.rbs +0 -16
  226. data/sig/generated/redhound/l4/base.rbs +0 -19
  227. data/sig/generated/redhound/l4/icmp.rbs +0 -33
  228. data/sig/generated/redhound/l4/resolver.rbs +0 -16
  229. data/sig/generated/redhound/l4/udp.rbs +0 -36
  230. data/sig/generated/redhound/receiver.rbs +0 -19
  231. data/sig/generated/redhound/resolver.rbs +0 -11
  232. data/sig/generated/redhound/source/socket.rbs +0 -13
@@ -0,0 +1,117 @@
1
+ # Generated from lib/redhound/dissector.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # Base class and declarative fixed-header DSL for custom protocols.
5
+ class Dissector
6
+ # Unpack formats and byte lengths supported by the header DSL.
7
+ TYPES: untyped
8
+
9
+ # Build a single unpack template and its field descriptions.
10
+ class Header
11
+ # Compiled unpack template, header byte length and field definitions.
12
+ attr_reader template: untyped
13
+
14
+ # Compiled unpack template, header byte length and field definitions.
15
+ attr_reader length: untyped
16
+
17
+ # Compiled unpack template, header byte length and field definitions.
18
+ attr_reader definitions: untyped
19
+
20
+ # @rbs () -> void
21
+ # Start an empty fixed-header definition.
22
+ def initialize: () -> void
23
+
24
+ # @rbs (Symbol type, Symbol key, String name, **untyped opts) -> void
25
+ # Append a typed fixed-width field with optional format/enum metadata.
26
+ def field: (Symbol type, Symbol key, String name, **untyped opts) -> void
27
+
28
+ # @rbs (Symbol key, String name, **untyped opts) -> void
29
+ # Append a signed 8-bit field.
30
+ def int8: (Symbol key, String name, **untyped opts) -> void
31
+
32
+ # @rbs (Symbol key, String name, **untyped opts) -> void
33
+ # Append an unsigned 8-bit field.
34
+ def uint8: (Symbol key, String name, **untyped opts) -> void
35
+
36
+ # @rbs (Symbol key, String name, **untyped opts) -> void
37
+ # Append a network-order unsigned 16-bit field.
38
+ def uint16: (Symbol key, String name, **untyped opts) -> void
39
+
40
+ # @rbs (Symbol key, String name, **untyped opts) -> void
41
+ # Append a network-order unsigned 32-bit field.
42
+ def uint32: (Symbol key, String name, **untyped opts) -> void
43
+
44
+ # @rbs (Symbol key, String name, **untyped opts) -> void
45
+ # Append a network-order unsigned 64-bit field.
46
+ def uint64: (Symbol key, String name, **untyped opts) -> void
47
+
48
+ # @rbs (Symbol key, String name, **untyped opts) -> void
49
+ # Append a six-byte MAC address.
50
+ def mac: (Symbol key, String name, **untyped opts) -> void
51
+
52
+ # @rbs (Symbol key, String name, **untyped opts) -> void
53
+ # Append a four-byte IPv4 address.
54
+ def ipv4: (Symbol key, String name, **untyped opts) -> void
55
+
56
+ # @rbs (Symbol key, String name, **untyped opts) -> void
57
+ # Append a sixteen-byte IPv6 address.
58
+ def ipv6: (Symbol key, String name, **untyped opts) -> void
59
+
60
+ # @rbs (Integer width) { (Header) [self: Header] -> void } -> void
61
+ # Define bit fields filling an 8/16/32/64-bit network-order word.
62
+ def bits: (Integer width) { (Header) [self: Header] -> void } -> void
63
+
64
+ # @rbs (Symbol key, String name, Integer width, **untyped opts) -> void
65
+ # Append a bit field inside bits, optionally scaled/formatted.
66
+ def bit: (Symbol key, String name, Integer width, **untyped opts) -> void
67
+ end
68
+
69
+ # @rbs () -> Symbol
70
+ # Registered protocol symbol.
71
+ def self.protocol_id: () -> Symbol
72
+
73
+ # @rbs () -> String
74
+ # Human-readable protocol name.
75
+ def self.protocol_name: () -> String
76
+
77
+ # @rbs () -> String
78
+ # Short output label.
79
+ def self.short_name: () -> String
80
+
81
+ # @rbs () -> untyped
82
+ # Compiled header definition, if one was declared.
83
+ def self.compiled_header: () -> untyped
84
+
85
+ # @rbs (Symbol id, name: String, short: String) -> void
86
+ # Declare protocol identity and register the dissector.
87
+ def self.protocol: (Symbol id, name: String, short: String) -> void
88
+
89
+ # @rbs (String key, *Integer values) -> void
90
+ # Register this protocol under one or more dispatch values.
91
+ def self.dissects_on: (String key, *Integer values) -> void
92
+
93
+ # @rbs () { (Header) [self: Header] -> void } -> void
94
+ # Compile a fixed header from the DSL block.
95
+ def self.header: () { (Header) [self: Header] -> void } -> void
96
+
97
+ # @rbs () -> String
98
+ # Compiled unpack template, or an empty template.
99
+ def self.header_template: () -> String
100
+
101
+ # @rbs (Context ctx, Cursor cursor) -> Layer
102
+ # Decode fixed fields then invoke the variable-header hook.
103
+ def parse: (Context ctx, Cursor cursor) -> Layer
104
+
105
+ # @rbs (Context ctx, Layer layer) -> void
106
+ # Override to parse variable fields using the bounded Context cursor.
107
+ def dissect: (Context ctx, Layer layer) -> void
108
+
109
+ # @rbs (Context ctx, Layer layer) -> untyped
110
+ # Override to return the next protocol class or nil.
111
+ def next_dissector: (Context ctx, Layer layer) -> untyped
112
+
113
+ # @rbs (Layer layer) -> String
114
+ # Override to format the layer summary.
115
+ def summary: (Layer layer) -> String
116
+ end
117
+ end
@@ -0,0 +1,23 @@
1
+ # Generated from lib/redhound/engine.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ class Engine
6
+ MAX_DEPTH: ::Integer
7
+
8
+ # @rbs () -> Engine
9
+ def self.default: () -> Engine
10
+
11
+ # @rbs (?registry: Registry, ?verify_checksums: bool) -> void
12
+ def initialize: (?registry: Registry, ?verify_checksums: bool) -> void
13
+
14
+ # @rbs (Packet packet) -> Array[Layer]
15
+ def dissect: (Packet packet) -> Array[Layer]
16
+
17
+ # @rbs (untyped klass, Context ctx, Layer layer) -> untyped
18
+ def next_dissector: (untyped klass, Context ctx, Layer layer) -> untyped
19
+
20
+ # @rbs (untyped klass, Context ctx, Cursor cursor) -> Layer
21
+ def safely: (untyped klass, Context ctx, Cursor cursor) -> Layer
22
+ end
23
+ end
@@ -0,0 +1,56 @@
1
+ # Generated from lib/redhound/errors.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # Base exception for Redhound operational and configuration errors.
5
+ class Error < StandardError
6
+ end
7
+
8
+ # Capture-device or live-operation failure.
9
+ class CaptureError < Error
10
+ end
11
+
12
+ # @api private
13
+ class RotationComplete < CaptureError
14
+ end
15
+
16
+ # Insufficient permission to access the capture device.
17
+ class PermissionDenied < CaptureError
18
+ end
19
+
20
+ # Requested capture interface does not exist.
21
+ class InterfaceNotFound < CaptureError
22
+ end
23
+
24
+ # Requested platform or capture capability is unavailable.
25
+ class UnsupportedPlatform < CaptureError
26
+ end
27
+
28
+ # Malformed or unsupported capture-file structure.
29
+ class FileFormatError < Error
30
+ end
31
+
32
+ # Invalid command-line or library configuration.
33
+ class ConfigurationError < Error
34
+ end
35
+
36
+ # Invalid cBPF program or unsupported filter operation.
37
+ class FilterError < Error
38
+ end
39
+
40
+ # Filter exceeds the target platform instruction limit.
41
+ class FilterTooLarge < FilterError
42
+ end
43
+
44
+ # Capture-filter syntax error with original expression and byte position.
45
+ class FilterSyntaxError < FilterError
46
+ # Original filter expression and zero-based error position.
47
+ attr_reader expression: untyped
48
+
49
+ # Original filter expression and zero-based error position.
50
+ attr_reader position: untyped
51
+
52
+ # @rbs (String message, ?expression: String?, ?position: Integer?) -> void
53
+ # Create a syntax diagnostic suitable for a caret display.
54
+ def initialize: (String message, ?expression: String?, ?position: Integer?) -> void
55
+ end
56
+ end
@@ -0,0 +1,74 @@
1
+ # Generated from lib/redhound/field.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # Immutable description of a field location, type and display metadata.
5
+ class FieldDefinition < Data
6
+ attr_reader key(): untyped
7
+
8
+ attr_reader name(): untyped
9
+
10
+ attr_reader type(): untyped
11
+
12
+ attr_reader offset(): untyped
13
+
14
+ attr_reader length(): untyped
15
+
16
+ attr_reader index(): untyped
17
+
18
+ attr_reader shift(): untyped
19
+
20
+ attr_reader mask(): untyped
21
+
22
+ attr_reader scale(): untyped
23
+
24
+ attr_reader format(): untyped
25
+
26
+ attr_reader enum(): untyped
27
+
28
+ def self.new: (untyped key, untyped name, untyped type, untyped offset, untyped length, untyped index, untyped shift, untyped mask, untyped scale, untyped format, untyped enum) -> instance
29
+ | (key: untyped, name: untyped, type: untyped, offset: untyped, length: untyped, index: untyped, shift: untyped, mask: untyped, scale: untyped, format: untyped, enum: untyped) -> instance
30
+
31
+ def self.members: () -> [ :key, :name, :type, :offset, :length, :index, :shift, :mask, :scale, :format, :enum ]
32
+
33
+ def members: () -> [ :key, :name, :type, :offset, :length, :index, :shift, :mask, :scale, :format, :enum ]
34
+ end
35
+
36
+ # A decoded field with its definition, raw value and absolute location.
37
+ class Field
38
+ # Definition, raw decoded value and capture location.
39
+ attr_reader definition: untyped
40
+
41
+ # Definition, raw decoded value and capture location.
42
+ attr_reader raw_value: untyped
43
+
44
+ # Definition, raw decoded value and capture location.
45
+ attr_reader offset: untyped
46
+
47
+ # Definition, raw decoded value and capture location.
48
+ attr_reader length: untyped
49
+
50
+ # @rbs (untyped definition, untyped value, Integer base) -> void
51
+ # Bind a field definition to its value and layer base offset.
52
+ def initialize: (untyped definition, untyped value, Integer base) -> void
53
+
54
+ # @rbs () -> String
55
+ # Stable dotted field name.
56
+ def name: () -> String
57
+
58
+ # @rbs () -> Symbol
59
+ # Declared field representation.
60
+ def type: () -> Symbol
61
+
62
+ # @rbs () -> untyped
63
+ # Decoded value; addresses are returned in human-readable text.
64
+ def value: () -> untyped
65
+
66
+ # @rbs () -> untyped
67
+ # JSON-safe value; opaque bytes and invalid text are encoded in hexadecimal.
68
+ def json_value: () -> untyped
69
+
70
+ # @rbs () -> String
71
+ # Terminal-safe field text with escaped control and non-ASCII bytes.
72
+ def display: () -> String
73
+ end
74
+ end
@@ -0,0 +1,39 @@
1
+ # Generated from lib/redhound/file/format.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ module Format
8
+ MAX_RECORD: untyped
9
+
10
+ MAX_INTERFACES: ::Integer
11
+
12
+ MAX_INTERFACE_METADATA: untyped
13
+
14
+ MAX_OPTIONS: ::Integer
15
+
16
+ PCAP_MAGICS: untyped
17
+
18
+ PCAPNG_MAGIC: untyped
19
+
20
+ # @rbs (untyped io, Integer length, ?eof: false) -> String
21
+ # @rbs (untyped io, Integer length, eof: true) -> String?
22
+ def self.read_exact: (untyped io, Integer length, ?eof: false) -> String
23
+ | (untyped io, Integer length, eof: true) -> String?
24
+
25
+ # @rbs (Integer length) -> Integer
26
+ def self.padded: (Integer length) -> Integer
27
+
28
+ # @rbs (String data) -> String
29
+ def self.pad: (String data) -> String
30
+
31
+ # NULL carries a host-order address family; libpcap also normalizes it on read.
32
+ # @rbs (String data, Integer linktype, String integer_format) -> String
33
+ def self.normalize_null: (String data, Integer linktype, String integer_format) -> String
34
+
35
+ # @rbs (Integer caplen, Integer original_length, Integer snaplen) -> void
36
+ def self.check_lengths: (Integer caplen, Integer original_length, Integer snaplen) -> void
37
+ end
38
+ end
39
+ end
@@ -0,0 +1,19 @@
1
+ # Generated from lib/redhound/file/pcap_reader.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ class PcapReader
8
+ attr_reader interfaces: untyped
9
+
10
+ attr_reader linktype: untyped
11
+
12
+ # @rbs (untyped io, String magic) -> void
13
+ def initialize: (untyped io, String magic) -> void
14
+
15
+ # @rbs () -> Packet?
16
+ def next_packet: () -> Packet?
17
+ end
18
+ end
19
+ end
@@ -0,0 +1,38 @@
1
+ # Generated from lib/redhound/file/pcap_writer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ class PcapWriter
8
+ attr_reader bytes_written: untyped
9
+
10
+ attr_reader path: untyped
11
+
12
+ # @rbs (untyped output, ?linktype: Integer | Symbol | String, ?snaplen: Integer, ?precision: Symbol, ?packet_buffered: bool, **untyped) -> void
13
+ def initialize: (untyped output, ?linktype: Integer | Symbol | String, ?snaplen: Integer, ?precision: Symbol, ?packet_buffered: bool, **untyped) -> void
14
+
15
+ # @rbs (Packet packet) -> self
16
+ def write: (Packet packet) -> self
17
+
18
+ alias << write
19
+
20
+ # @rbs (Packet packet) -> Integer
21
+ def record_size: (Packet packet) -> Integer
22
+
23
+ # @rbs (Capture::Stats stats, ?interface: Capture::Interface?) -> void
24
+ def write_stats: (Capture::Stats stats, ?interface: Capture::Interface?) -> void
25
+
26
+ # @rbs () -> void
27
+ def flush: () -> void
28
+
29
+ # @rbs () -> void
30
+ def close: () -> void
31
+
32
+ private
33
+
34
+ # @rbs (String bytes) -> void
35
+ def write_bytes: (String bytes) -> void
36
+ end
37
+ end
38
+ end
@@ -0,0 +1,54 @@
1
+ # Generated from lib/redhound/file/pcapng_reader.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ class PcapngReader
8
+ attr_reader interfaces: untyped
9
+
10
+ attr_reader stats: untyped
11
+
12
+ # @rbs (untyped io, String magic) -> void
13
+ def initialize: (untyped io, String magic) -> void
14
+
15
+ # @rbs () -> Integer
16
+ def linktype: () -> Integer
17
+
18
+ # @rbs () -> bool
19
+ def statistics?: () -> bool
20
+
21
+ # @rbs () -> Packet?
22
+ def next_packet: () -> Packet?
23
+
24
+ private
25
+
26
+ # @rbs () -> [Integer, String]?
27
+ def read_block: () -> [ Integer, String ]?
28
+
29
+ # @rbs (String body) -> void
30
+ def read_interface: (String body) -> void
31
+
32
+ # @rbs (String body) -> Packet
33
+ def read_enhanced: (String body) -> Packet
34
+
35
+ # @rbs (String body) -> Packet
36
+ def read_simple: (String body) -> Packet
37
+
38
+ # @rbs (String body) -> void
39
+ def read_statistics: (String body) -> void
40
+
41
+ # @rbs (String data, Capture::Interface interface, Integer original_length, Integer timestamp_ns, Symbol? direction, Hash[Symbol, untyped] meta) -> Packet
42
+ def make_packet: (String data, Capture::Interface interface, Integer original_length, Integer timestamp_ns, Symbol? direction, Hash[Symbol, untyped] meta) -> Packet
43
+
44
+ # @rbs (Integer index) -> Capture::Interface
45
+ def interface_at: (Integer index) -> Capture::Interface
46
+
47
+ # @rbs (String body, Integer offset, Array[Integer] allowed) -> Hash[Integer, Array[String]]
48
+ def options: (String body, Integer offset, Array[Integer] allowed) -> Hash[Integer, Array[String]]
49
+
50
+ # @rbs (String body, Integer size) -> void
51
+ def require_size: (String body, Integer size) -> void
52
+ end
53
+ end
54
+ end
@@ -0,0 +1,50 @@
1
+ # Generated from lib/redhound/file/pcapng_writer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ class PcapngWriter
8
+ attr_reader bytes_written: untyped
9
+
10
+ attr_reader path: untyped
11
+
12
+ # @rbs (untyped output, ?linktype: Integer | Symbol | String, ?snaplen: Integer, ?precision: Symbol, ?packet_buffered: bool, ?filter: String?, ?comment: String?, **untyped) -> void
13
+ def initialize: (untyped output, ?linktype: Integer | Symbol | String, ?snaplen: Integer, ?precision: Symbol, ?packet_buffered: bool, ?filter: String?, ?comment: String?, **untyped) -> void
14
+
15
+ # @rbs (Packet packet) -> self
16
+ def write: (Packet packet) -> self
17
+
18
+ alias << write
19
+
20
+ # @rbs (Packet packet) -> Integer
21
+ def record_size: (Packet packet) -> Integer
22
+
23
+ # @rbs (Capture::Stats stats, ?interface: Capture::Interface?) -> void
24
+ def write_stats: (Capture::Stats stats, ?interface: Capture::Interface?) -> void
25
+
26
+ # @rbs () -> void
27
+ def flush: () -> void
28
+
29
+ # @rbs () -> void
30
+ def close: () -> void
31
+
32
+ private
33
+
34
+ # @rbs (Packet packet) -> Integer
35
+ def ensure_interface: (Packet packet) -> Integer
36
+
37
+ # @rbs (Packet packet) -> Integer
38
+ def packet_flags: (Packet packet) -> Integer
39
+
40
+ # @rbs (Integer timestamp) -> String
41
+ def timestamp_words: (Integer timestamp) -> String
42
+
43
+ # @rbs (Hash[Integer, String] values) -> String
44
+ def options: (Hash[Integer, String] values) -> String
45
+
46
+ # @rbs (Integer type, String body) -> void
47
+ def write_block: (Integer type, String body) -> void
48
+ end
49
+ end
50
+ end
@@ -0,0 +1,42 @@
1
+ # Generated from lib/redhound/file/rotating_writer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module File
6
+ # @api private
7
+ class RotatingWriter
8
+ attr_reader path: untyped
9
+
10
+ # @rbs (String path, ?max_bytes: Integer?, ?interval: Numeric?, ?file_count: Integer?, ?post_rotate_command: String?, **untyped options) -> void
11
+ def initialize: (String path, ?max_bytes: Integer?, ?interval: Numeric?, ?file_count: Integer?, ?post_rotate_command: String?, **untyped options) -> void
12
+
13
+ # @rbs (Packet packet) -> self
14
+ def write: (Packet packet) -> self
15
+
16
+ alias << write
17
+
18
+ # @rbs (Capture::Stats stats, ?interface: Capture::Interface?) -> void
19
+ def write_stats: (Capture::Stats stats, ?interface: Capture::Interface?) -> void
20
+
21
+ # @rbs () -> Integer
22
+ def bytes_written: () -> Integer
23
+
24
+ # @rbs () -> void
25
+ def flush: () -> void
26
+
27
+ # @rbs () -> void
28
+ def close: () -> void
29
+
30
+ private
31
+
32
+ # @rbs () -> void
33
+ def rotate: () -> void
34
+
35
+ # @rbs () -> void
36
+ def open_next: () -> void
37
+
38
+ # @rbs () -> void
39
+ def run_command: () -> void
40
+ end
41
+ end
42
+ end
@@ -0,0 +1,42 @@
1
+ # Generated from lib/redhound/filter/analyzer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ class Analyzer
8
+ PROTOCOL_NUMBERS: untyped
9
+
10
+ ETHER_TYPES: untyped
11
+
12
+ # @rbs (String expression) -> void
13
+ def initialize: (String expression) -> void
14
+
15
+ # @rbs (untyped node) -> untyped
16
+ def analyze: (untyped node) -> untyped
17
+
18
+ private
19
+
20
+ # @rbs (untyped node) -> untyped
21
+ def primitive: (untyped node) -> untyped
22
+
23
+ # @rbs (untyped node) -> untyped
24
+ def arithmetic: (untyped node) -> untyped
25
+
26
+ # @rbs (String value, String? proto, Symbol type, Integer position) -> untyped
27
+ def ports: (String value, String? proto, Symbol type, Integer position) -> untyped
28
+
29
+ # @rbs (String value, Symbol type, Integer position) -> untyped
30
+ def addresses: (String value, Symbol type, Integer position) -> untyped
31
+
32
+ # @rbs (String value, Hash[String, Integer] names, Integer position) -> Integer
33
+ def integer_or_name: (String value, Hash[String, Integer] names, Integer position) -> Integer
34
+
35
+ # @rbs () -> Hash[String, Integer]
36
+ def protocol_numbers: () -> Hash[String, Integer]
37
+
38
+ # @rbs (String message, Integer position) -> bot
39
+ def error: (String message, Integer position) -> bot
40
+ end
41
+ end
42
+ end
@@ -0,0 +1,39 @@
1
+ # Generated from lib/redhound/filter/bpf/assembler.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ module BPF
8
+ # @api private
9
+ class Assembler
10
+ # @rbs () -> void
11
+ def initialize: () -> void
12
+
13
+ # @rbs () -> Symbol
14
+ def label: () -> Symbol
15
+
16
+ # @rbs (Symbol label) -> void
17
+ def mark: (Symbol label) -> void
18
+
19
+ # @rbs (Integer code, ?Integer k) -> void
20
+ def emit: (Integer code, ?Integer k) -> void
21
+
22
+ # @rbs (Symbol target) -> void
23
+ def jump: (Symbol target) -> void
24
+
25
+ # @rbs (Integer code, Integer k, Symbol yes, Symbol no) -> void
26
+ def branch: (Integer code, Integer k, Symbol yes, Symbol no) -> void
27
+
28
+ # @rbs () -> Array[[Integer, Integer, Integer, Integer]]
29
+ def assemble: () -> Array[[ Integer, Integer, Integer, Integer ]]
30
+
31
+ private
32
+
33
+ # Remove unreachable blocks and thread jumps through unconditional jumps.
34
+ # @rbs () -> void
35
+ def compact!: () -> void
36
+ end
37
+ end
38
+ end
39
+ end
@@ -0,0 +1,18 @@
1
+ # Generated from lib/redhound/filter/bpf/disassembler.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ module BPF
8
+ # @api private
9
+ module Disassembler
10
+ # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions, ?format: Symbol) -> String
11
+ def self.disassemble: (Array[[ Integer, Integer, Integer, Integer ]] instructions, ?format: Symbol) -> String
12
+
13
+ # @rbs (Integer code, Integer k) -> String
14
+ def self.instruction: (Integer code, Integer k) -> String
15
+ end
16
+ end
17
+ end
18
+ end
@@ -0,0 +1,30 @@
1
+ # Generated from lib/redhound/filter/bpf/validator.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ module BPF
8
+ # Validates the portable cBPF ISA and Linux VLAN ancillary loads.
9
+ # @api private
10
+ module Validator
11
+ LOADS: untyped
12
+
13
+ ALU: untyped
14
+
15
+ JUMPS: untyped
16
+
17
+ OPCODES: untyped
18
+
19
+ # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> bool
20
+ def self.validate!: (Array[[ Integer, Integer, Integer, Integer ]] instructions) -> bool
21
+
22
+ # @rbs (Integer code, Integer jt, Integer jf, Integer k, Integer index) -> Array[Integer]
23
+ def self.successors: (Integer code, Integer jt, Integer jf, Integer k, Integer index) -> Array[Integer]
24
+
25
+ # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
26
+ def self.validate_memory!: (Array[[ Integer, Integer, Integer, Integer ]] instructions) -> void
27
+ end
28
+ end
29
+ end
30
+ end
@@ -0,0 +1,28 @@
1
+ # Generated from lib/redhound/filter/bpf/vm.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ module BPF
8
+ # @api private
9
+ class VM
10
+ LOAD_FORMATS: untyped
11
+
12
+ # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
13
+ def initialize: (Array[[ Integer, Integer, Integer, Integer ]] instructions) -> void
14
+
15
+ # @rbs (untyped packet) -> Integer
16
+ def evaluate: (untyped packet) -> Integer
17
+
18
+ private
19
+
20
+ # @rbs (Integer operation, Integer a, Integer operand) -> Integer
21
+ def arithmetic: (Integer operation, Integer a, Integer operand) -> Integer
22
+
23
+ # @rbs (Integer offset, untyped meta) -> Integer
24
+ def ancillary: (Integer offset, untyped meta) -> Integer
25
+ end
26
+ end
27
+ end
28
+ end