redhound 1.0.1 → 2.0.0.rc2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (232) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +51 -0
  3. data/README.md +97 -31
  4. data/docs/API.md +104 -0
  5. data/docs/FILTERS.md +37 -0
  6. data/docs/MIGRATION.md +23 -0
  7. data/docs/PROTOCOLS.md +54 -0
  8. data/docs/USAGE.md +86 -0
  9. data/docs/VALIDATION.md +175 -0
  10. data/docs/json-schema.json +64 -0
  11. data/exe/redhound +2 -1
  12. data/lib/redhound/analysis/flow_key.rb +59 -0
  13. data/lib/redhound/analysis/flow_table.rb +124 -0
  14. data/lib/redhound/analysis/ip_reassembler.rb +209 -0
  15. data/lib/redhound/analysis/stats.rb +150 -0
  16. data/lib/redhound/analysis/tcp_analysis.rb +43 -0
  17. data/lib/redhound/analysis/tcp_reassembler.rb +176 -0
  18. data/lib/redhound/analysis/tcp_stream.rb +156 -0
  19. data/lib/redhound/analysis.rb +157 -0
  20. data/lib/redhound/capture/bsd/bpf_device.rb +155 -0
  21. data/lib/redhound/capture/bsd/constants.rb +29 -0
  22. data/lib/redhound/capture/bsd/ifreq.rb +41 -0
  23. data/lib/redhound/capture/file_source.rb +214 -0
  24. data/lib/redhound/capture/interface.rb +70 -0
  25. data/lib/redhound/capture/linktype.rb +30 -0
  26. data/lib/redhound/capture/linux/constants.rb +37 -0
  27. data/lib/redhound/capture/linux/cooked.rb +18 -0
  28. data/lib/redhound/capture/linux/ifreq.rb +42 -0
  29. data/lib/redhound/capture/linux/packet_socket.rb +224 -0
  30. data/lib/redhound/capture/linux/sockaddr_ll.rb +33 -0
  31. data/lib/redhound/capture/linux/tpacket_v3.rb +137 -0
  32. data/lib/redhound/capture/source.rb +79 -0
  33. data/lib/redhound/capture/stats.rb +22 -0
  34. data/lib/redhound/capture.rb +70 -0
  35. data/lib/redhound/cli/command.rb +42 -0
  36. data/lib/redhound/cli/options.rb +133 -0
  37. data/lib/redhound/cli/privileges.rb +29 -0
  38. data/lib/redhound/cli/runner.rb +129 -0
  39. data/lib/redhound/context.rb +20 -0
  40. data/lib/redhound/cursor.rb +69 -0
  41. data/lib/redhound/diagnostic.rb +7 -0
  42. data/lib/redhound/dissector.rb +152 -0
  43. data/lib/redhound/engine.rb +69 -0
  44. data/lib/redhound/errors.rb +38 -0
  45. data/lib/redhound/field.rb +62 -0
  46. data/lib/redhound/file/format.rb +63 -0
  47. data/lib/redhound/file/pcap_reader.rb +43 -0
  48. data/lib/redhound/file/pcap_writer.rb +79 -0
  49. data/lib/redhound/file/pcapng_reader.rb +221 -0
  50. data/lib/redhound/file/pcapng_writer.rb +151 -0
  51. data/lib/redhound/file/rotating_writer.rb +98 -0
  52. data/lib/redhound/filter/analyzer.rb +197 -0
  53. data/lib/redhound/filter/bpf/assembler.rb +121 -0
  54. data/lib/redhound/filter/bpf/disassembler.rb +58 -0
  55. data/lib/redhound/filter/bpf/validator.rb +77 -0
  56. data/lib/redhound/filter/bpf/vm.rb +109 -0
  57. data/lib/redhound/filter/codegen.rb +413 -0
  58. data/lib/redhound/filter/lexer.rb +46 -0
  59. data/lib/redhound/filter/parser.rb +206 -0
  60. data/lib/redhound/filter/program.rb +55 -0
  61. data/lib/redhound/filter.rb +30 -0
  62. data/lib/redhound/layer.rb +75 -0
  63. data/lib/redhound/output/fields.rb +20 -0
  64. data/lib/redhound/output/follow.rb +64 -0
  65. data/lib/redhound/output/hexdump.rb +29 -0
  66. data/lib/redhound/output/json.rb +32 -0
  67. data/lib/redhound/output/summary.rb +84 -0
  68. data/lib/redhound/output/timestamp.rb +34 -0
  69. data/lib/redhound/output/tree.rb +25 -0
  70. data/lib/redhound/packet.rb +77 -0
  71. data/lib/redhound/protocols/arp.rb +39 -0
  72. data/lib/redhound/protocols/checksum.rb +38 -0
  73. data/lib/redhound/protocols/data.rb +23 -0
  74. data/lib/redhound/protocols/dhcp.rb +140 -0
  75. data/lib/redhound/protocols/dns.rb +268 -0
  76. data/lib/redhound/protocols/ethernet.rb +24 -0
  77. data/lib/redhound/protocols/http.rb +185 -0
  78. data/lib/redhound/protocols/icmp.rb +205 -0
  79. data/lib/redhound/protocols/ipv4.rb +56 -0
  80. data/lib/redhound/protocols/ipv6.rb +68 -0
  81. data/lib/redhound/protocols/link.rb +70 -0
  82. data/lib/redhound/protocols/llc.rb +37 -0
  83. data/lib/redhound/protocols/ntp.rb +45 -0
  84. data/lib/redhound/protocols/tcp.rb +88 -0
  85. data/lib/redhound/protocols/tls.rb +218 -0
  86. data/lib/redhound/protocols/tunnel.rb +48 -0
  87. data/lib/redhound/protocols/udp.rb +32 -0
  88. data/lib/redhound/protocols/vlan.rb +23 -0
  89. data/lib/redhound/reader.rb +8 -0
  90. data/lib/redhound/registry.rb +64 -0
  91. data/lib/redhound/stream_dissector.rb +168 -0
  92. data/lib/redhound/util/seq.rb +21 -0
  93. data/lib/redhound/version.rb +2 -1
  94. data/lib/redhound/writer.rb +25 -43
  95. data/lib/redhound.rb +81 -9
  96. data/sig/generated/redhound/analysis/flow_key.rbs +15 -0
  97. data/sig/generated/redhound/analysis/flow_table.rbs +102 -0
  98. data/sig/generated/redhound/analysis/ip_reassembler.rbs +52 -0
  99. data/sig/generated/redhound/analysis/stats.rbs +80 -0
  100. data/sig/generated/redhound/analysis/tcp_analysis.rbs +15 -0
  101. data/sig/generated/redhound/analysis/tcp_reassembler.rbs +39 -0
  102. data/sig/generated/redhound/analysis/tcp_stream.rbs +60 -0
  103. data/sig/generated/redhound/analysis.rbs +38 -0
  104. data/sig/generated/redhound/capture/bsd/bpf_device.rbs +39 -0
  105. data/sig/generated/redhound/capture/bsd/constants.rbs +40 -0
  106. data/sig/generated/redhound/capture/bsd/ifreq.rbs +15 -0
  107. data/sig/generated/redhound/capture/file_source.rbs +67 -0
  108. data/sig/generated/redhound/capture/interface.rbs +53 -0
  109. data/sig/generated/redhound/capture/linktype.rbs +20 -0
  110. data/sig/generated/redhound/capture/linux/constants.rbs +58 -0
  111. data/sig/generated/redhound/capture/linux/cooked.rbs +15 -0
  112. data/sig/generated/redhound/capture/linux/ifreq.rbs +18 -0
  113. data/sig/generated/redhound/capture/linux/packet_socket.rbs +64 -0
  114. data/sig/generated/redhound/capture/linux/sockaddr_ll.rbs +31 -0
  115. data/sig/generated/redhound/capture/linux/tpacket_v3.rbs +35 -0
  116. data/sig/generated/redhound/capture/source.rbs +44 -0
  117. data/sig/generated/redhound/capture/stats.rbs +25 -0
  118. data/sig/generated/redhound/capture.rbs +14 -0
  119. data/sig/generated/redhound/cli/command.rbs +12 -0
  120. data/sig/generated/redhound/cli/options.rbs +25 -0
  121. data/sig/generated/redhound/cli/privileges.rbs +12 -0
  122. data/sig/generated/redhound/cli/runner.rbs +27 -0
  123. data/sig/generated/redhound/context.rbs +27 -0
  124. data/sig/generated/redhound/cursor.rbs +59 -0
  125. data/sig/generated/redhound/diagnostic.rbs +21 -0
  126. data/sig/generated/redhound/dissector.rbs +117 -0
  127. data/sig/generated/redhound/engine.rbs +23 -0
  128. data/sig/generated/redhound/errors.rbs +56 -0
  129. data/sig/generated/redhound/field.rbs +74 -0
  130. data/sig/generated/redhound/file/format.rbs +39 -0
  131. data/sig/generated/redhound/file/pcap_reader.rbs +19 -0
  132. data/sig/generated/redhound/file/pcap_writer.rbs +38 -0
  133. data/sig/generated/redhound/file/pcapng_reader.rbs +54 -0
  134. data/sig/generated/redhound/file/pcapng_writer.rbs +50 -0
  135. data/sig/generated/redhound/file/rotating_writer.rbs +42 -0
  136. data/sig/generated/redhound/filter/analyzer.rbs +42 -0
  137. data/sig/generated/redhound/filter/bpf/assembler.rbs +39 -0
  138. data/sig/generated/redhound/filter/bpf/disassembler.rbs +18 -0
  139. data/sig/generated/redhound/filter/bpf/validator.rbs +30 -0
  140. data/sig/generated/redhound/filter/bpf/vm.rbs +28 -0
  141. data/sig/generated/redhound/filter/codegen.rbs +101 -0
  142. data/sig/generated/redhound/filter/lexer.rbs +15 -0
  143. data/sig/generated/redhound/filter/parser.rbs +65 -0
  144. data/sig/generated/redhound/filter/program.rbs +48 -0
  145. data/sig/generated/redhound/filter.rbs +10 -0
  146. data/sig/generated/redhound/layer.rbs +81 -0
  147. data/sig/generated/redhound/output/fields.rbs +15 -0
  148. data/sig/generated/redhound/output/follow.rbs +21 -0
  149. data/sig/generated/redhound/output/hexdump.rbs +15 -0
  150. data/sig/generated/redhound/output/json.rbs +18 -0
  151. data/sig/generated/redhound/output/summary.rbs +21 -0
  152. data/sig/generated/redhound/output/timestamp.rbs +21 -0
  153. data/sig/generated/redhound/output/tree.rbs +15 -0
  154. data/sig/generated/redhound/packet.rbs +82 -0
  155. data/sig/generated/redhound/protocols/arp.rbs +15 -0
  156. data/sig/generated/redhound/protocols/checksum.rbs +15 -0
  157. data/sig/generated/redhound/protocols/data.rbs +17 -0
  158. data/sig/generated/redhound/protocols/dhcp.rbs +31 -0
  159. data/sig/generated/redhound/protocols/dns.rbs +42 -0
  160. data/sig/generated/redhound/protocols/ethernet.rbs +15 -0
  161. data/sig/generated/redhound/protocols/http.rbs +36 -0
  162. data/sig/generated/redhound/protocols/icmp.rbs +41 -0
  163. data/sig/generated/redhound/protocols/ipv4.rbs +15 -0
  164. data/sig/generated/redhound/protocols/ipv6.rbs +24 -0
  165. data/sig/generated/redhound/protocols/link.rbs +33 -0
  166. data/sig/generated/redhound/protocols/llc.rbs +15 -0
  167. data/sig/generated/redhound/protocols/ntp.rbs +17 -0
  168. data/sig/generated/redhound/protocols/tcp.rbs +25 -0
  169. data/sig/generated/redhound/protocols/tls.rbs +51 -0
  170. data/sig/generated/redhound/protocols/tunnel.rbs +24 -0
  171. data/sig/generated/redhound/protocols/udp.rbs +18 -0
  172. data/sig/generated/redhound/protocols/vlan.rbs +12 -0
  173. data/sig/generated/redhound/reader.rbs +7 -0
  174. data/sig/generated/redhound/registry.rbs +45 -0
  175. data/sig/generated/redhound/stream_dissector.rbs +44 -0
  176. data/sig/generated/redhound/util/seq.rbs +20 -0
  177. data/sig/generated/redhound/version.rbs +1 -0
  178. data/sig/generated/redhound/writer.rbs +6 -19
  179. data/sig/generated/redhound.rbs +18 -0
  180. data/sig/shims/io.rbs +7 -0
  181. data/sig/shims/process.rbs +3 -0
  182. metadata +177 -55
  183. data/CODE_OF_CONDUCT.md +0 -132
  184. data/Dockerfile +0 -7
  185. data/Rakefile +0 -15
  186. data/Steepfile +0 -4
  187. data/docker-compose.yml +0 -9
  188. data/lib/redhound/analyzer.rb +0 -34
  189. data/lib/redhound/builder/packet_mreq.rb +0 -56
  190. data/lib/redhound/builder/socket.rb +0 -35
  191. data/lib/redhound/builder.rb +0 -4
  192. data/lib/redhound/command.rb +0 -67
  193. data/lib/redhound/l2/ether.rb +0 -68
  194. data/lib/redhound/l2/protocol.rb +0 -33
  195. data/lib/redhound/l2.rb +0 -4
  196. data/lib/redhound/l3/arp.rb +0 -114
  197. data/lib/redhound/l3/base.rb +0 -49
  198. data/lib/redhound/l3/ipv4.rb +0 -95
  199. data/lib/redhound/l3/ipv6.rb +0 -69
  200. data/lib/redhound/l3/protocol.rb +0 -173
  201. data/lib/redhound/l3/resolver.rb +0 -30
  202. data/lib/redhound/l3.rb +0 -9
  203. data/lib/redhound/l4/base.rb +0 -31
  204. data/lib/redhound/l4/icmp.rb +0 -71
  205. data/lib/redhound/l4/resolver.rb +0 -28
  206. data/lib/redhound/l4/udp.rb +0 -63
  207. data/lib/redhound/l4.rb +0 -6
  208. data/lib/redhound/receiver.rb +0 -45
  209. data/lib/redhound/resolver.rb +0 -22
  210. data/lib/redhound/source/socket.rb +0 -18
  211. data/lib/redhound/source.rb +0 -3
  212. data/rbs_collection.lock.yaml +0 -20
  213. data/rbs_collection.yaml +0 -17
  214. data/sig/generated/redhound/analyzer.rbs +0 -14
  215. data/sig/generated/redhound/builder/packet_mreq.rbs +0 -39
  216. data/sig/generated/redhound/builder/socket.rbs +0 -24
  217. data/sig/generated/redhound/command.rbs +0 -19
  218. data/sig/generated/redhound/l2/ether.rbs +0 -41
  219. data/sig/generated/redhound/l2/protocol.rbs +0 -15
  220. data/sig/generated/redhound/l3/arp.rbs +0 -57
  221. data/sig/generated/redhound/l3/base.rbs +0 -28
  222. data/sig/generated/redhound/l3/ipv4.rbs +0 -53
  223. data/sig/generated/redhound/l3/ipv6.rbs +0 -38
  224. data/sig/generated/redhound/l3/protocol.rbs +0 -16
  225. data/sig/generated/redhound/l3/resolver.rbs +0 -16
  226. data/sig/generated/redhound/l4/base.rbs +0 -19
  227. data/sig/generated/redhound/l4/icmp.rbs +0 -33
  228. data/sig/generated/redhound/l4/resolver.rbs +0 -16
  229. data/sig/generated/redhound/l4/udp.rbs +0 -36
  230. data/sig/generated/redhound/receiver.rbs +0 -19
  231. data/sig/generated/redhound/resolver.rbs +0 -11
  232. data/sig/generated/redhound/source/socket.rbs +0 -13
@@ -0,0 +1,101 @@
1
+ # Generated from lib/redhound/filter/codegen.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ class CodeGen
8
+ LINKTYPES: untyped
9
+
10
+ LAYOUTS: untyped
11
+
12
+ ALU: untyped
13
+
14
+ # @rbs (Integer linktype, Integer snaplen, bool live, String expression) -> void
15
+ def initialize: (Integer linktype, Integer snaplen, bool live, String expression) -> void
16
+
17
+ # @rbs (untyped ast) -> Program
18
+ def compile: (untyped ast) -> Program
19
+
20
+ private
21
+
22
+ # @rbs (untyped ast) -> bool
23
+ def includes_vlan?: (untyped ast) -> bool
24
+
25
+ # @rbs (untyped node, Symbol yes, Symbol no) -> void
26
+ def emit: (untyped node, Symbol yes, Symbol no) -> void
27
+
28
+ # @rbs (untyped node) -> untyped
29
+ def primitive: (untyped node) -> untyped
30
+
31
+ # @rbs (String name) -> untyped
32
+ def family: (String name) -> untyped
33
+
34
+ # @rbs (Integer number, Array[Integer] versions) -> untyped
35
+ def protocol: (Integer number, Array[Integer] versions) -> untyped
36
+
37
+ # @rbs (Integer version, Integer number) -> untyped
38
+ def next_protocol: (Integer version, Integer number) -> untyped
39
+
40
+ # @rbs () -> untyped
41
+ def fragment_guard: () -> untyped
42
+
43
+ # @rbs () -> Integer
44
+ def network: () -> Integer
45
+
46
+ # @rbs (Integer offset, Integer size, Symbol operation, Integer value, ?Symbol? mode) -> untyped
47
+ def test: (Integer offset, Integer size, Symbol operation, Integer value, ?Symbol? mode) -> untyped
48
+
49
+ # @rbs (*untyped nodes) -> untyped
50
+ def conjunction: (*untyped nodes) -> untyped
51
+
52
+ # @rbs (*untyped nodes) -> untyped
53
+ def disjunction: (*untyped nodes) -> untyped
54
+
55
+ # @rbs (Symbol direction, untyped src, untyped dst) -> untyped
56
+ def directional: (Symbol direction, untyped src, untyped dst) -> untyped
57
+
58
+ # @rbs (untyped values, String? proto, Symbol direction) -> untyped
59
+ def addresses: (untyped values, String? proto, Symbol direction) -> untyped
60
+
61
+ # @rbs (Integer offset, Integer version, Integer address, Integer mask) -> untyped
62
+ def address_test: (Integer offset, Integer version, Integer address, Integer mask) -> untyped
63
+
64
+ # @rbs (String mac, Symbol direction, Integer position) -> untyped
65
+ def ethernet_host: (String mac, Symbol direction, Integer position) -> untyped
66
+
67
+ # @rbs (untyped ranges, Symbol direction) -> untyped
68
+ def ports: (untyped ranges, Symbol direction) -> untyped
69
+
70
+ # @rbs (Integer version, Integer offset, [Integer, Integer] limits) -> untyped
71
+ def port_test: (Integer version, Integer offset, [ Integer, Integer ] limits) -> untyped
72
+
73
+ # @rbs (String? proto, Symbol type, Integer position) -> untyped
74
+ def broadcast: (String? proto, Symbol type, Integer position) -> untyped
75
+
76
+ # @rbs (Integer? id, Symbol yes, Symbol no) -> void
77
+ def vlan: (Integer? id, Symbol yes, Symbol no) -> void
78
+
79
+ # @rbs (Integer offset, Integer size, Symbol? mode) -> void
80
+ def load: (Integer offset, Integer size, Symbol? mode) -> void
81
+
82
+ # @rbs () -> void
83
+ def transport_index: () -> void
84
+
85
+ # @rbs (untyped operation, Integer value, Symbol yes, Symbol no, ?bool from_x) -> void
86
+ def compare: (untyped operation, Integer value, Symbol yes, Symbol no, ?bool from_x) -> void
87
+
88
+ # @rbs (untyped node) -> Array[String]
89
+ def access_protocols: (untyped node) -> Array[String]
90
+
91
+ # @rbs (untyped node, Integer depth) -> void
92
+ def arithmetic: (untyped node, Integer depth) -> void
93
+
94
+ # @rbs (untyped node, Integer depth) -> void
95
+ def accessor: (untyped node, Integer depth) -> void
96
+
97
+ # @rbs (String message, Integer position) -> bot
98
+ def error: (String message, Integer position) -> bot
99
+ end
100
+ end
101
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/filter/lexer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ class Lexer
8
+ # @rbs (String expression) -> void
9
+ def initialize: (String expression) -> void
10
+
11
+ # @rbs () -> Array[[String, Integer]]
12
+ def tokens: () -> Array[[ String, Integer ]]
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,65 @@
1
+ # Generated from lib/redhound/filter/parser.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # ASTs stay private; primitive operands are resolved before code generation.
7
+ # @api private
8
+ class Parser
9
+ PROTOCOLS: untyped
10
+
11
+ TYPES: untyped
12
+
13
+ COMPARISONS: untyped
14
+
15
+ PRECEDENCE: untyped
16
+
17
+ CONSTANTS: untyped
18
+
19
+ # @rbs (String expression) -> void
20
+ def initialize: (String expression) -> void
21
+
22
+ # @rbs () -> untyped
23
+ def parse: () -> untyped
24
+
25
+ private
26
+
27
+ # libpcap gives AND and OR the same precedence, left associative.
28
+ # @rbs () -> untyped
29
+ def expression: () -> untyped
30
+
31
+ # @rbs () -> untyped
32
+ def unary: () -> untyped
33
+
34
+ # @rbs () -> untyped
35
+ def primitive: () -> untyped
36
+
37
+ # @rbs () -> untyped
38
+ def relation: () -> untyped
39
+
40
+ # @rbs (?Integer minimum) -> untyped
41
+ def arithmetic: (?Integer minimum) -> untyped
42
+
43
+ # @rbs (String value) -> bool
44
+ def numeric?: (String value) -> bool
45
+
46
+ # @rbs (String value) -> Integer
47
+ def integer: (String value) -> Integer
48
+
49
+ # @rbs () -> Integer
50
+ def number: () -> Integer
51
+
52
+ # @rbs () -> String
53
+ def peek: () -> String
54
+
55
+ # @rbs () -> String
56
+ def take: () -> String
57
+
58
+ # @rbs (String value) -> void
59
+ def expect: (String value) -> void
60
+
61
+ # @rbs (String message, ?Integer? position) -> bot
62
+ def error: (String message, ?Integer? position) -> bot
63
+ end
64
+ end
65
+ end
@@ -0,0 +1,48 @@
1
+ # Generated from lib/redhound/filter/program.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # @api private
7
+ class Program
8
+ class KernelPacket < Struct[untyped]
9
+ attr_accessor data(): untyped
10
+
11
+ attr_accessor original_length(): untyped
12
+
13
+ attr_accessor meta(): untyped
14
+
15
+ def self.new: (?untyped data, ?untyped original_length, ?untyped meta) -> instance
16
+ | (?data: untyped, ?original_length: untyped, ?meta: untyped) -> instance
17
+ end
18
+
19
+ attr_reader instructions: untyped
20
+
21
+ attr_reader linktype: untyped
22
+
23
+ # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions, ?linktype: Integer?, ?cooked_live: bool) -> void
24
+ def initialize: (Array[[ Integer, Integer, Integer, Integer ]] instructions, ?linktype: Integer?, ?cooked_live: bool) -> void
25
+
26
+ # @rbs (untyped packet) -> Integer
27
+ def evaluate: (untyped packet) -> Integer
28
+
29
+ # @rbs (untyped packet) -> bool
30
+ def match?: (untyped packet) -> bool
31
+
32
+ # Native struct sock_filter / struct bpf_insn bytes.
33
+ # @rbs () -> String
34
+ def packed: () -> String
35
+
36
+ alias serialize packed
37
+
38
+ alias to_binary packed
39
+
40
+ # @rbs (?format: Symbol) -> String
41
+ def disassemble: (?format: Symbol) -> String
42
+
43
+ # Includes a String reference retained by pack('P') until setsockopt/ioctl finishes.
44
+ # @rbs () -> String
45
+ def sock_fprog: () -> String
46
+ end
47
+ end
48
+ end
@@ -0,0 +1,10 @@
1
+ # Generated from lib/redhound/filter.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Filter
6
+ # Compiles a pcap-filter subset without libpcap or external commands.
7
+ # @rbs (String expression, ?linktype: Symbol | Integer, ?snaplen: Integer, ?live: bool) -> Program
8
+ def self.compile: (String expression, ?linktype: Symbol | Integer, ?snaplen: Integer, ?live: bool) -> Program
9
+ end
10
+ end
@@ -0,0 +1,81 @@
1
+ # Generated from lib/redhound/layer.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # One decoded protocol header and its payload bounds, fields and diagnostics.
5
+ class Layer
6
+ # Protocol identity, captured offset, decoded values and diagnostics.
7
+ attr_reader protocol: untyped
8
+
9
+ # Protocol identity, captured offset, decoded values and diagnostics.
10
+ attr_reader offset: untyped
11
+
12
+ # Protocol identity, captured offset, decoded values and diagnostics.
13
+ attr_reader diagnostics: untyped
14
+
15
+ # Protocol identity, captured offset, decoded values and diagnostics.
16
+ attr_reader definitions: untyped
17
+
18
+ # Protocol identity, captured offset, decoded values and diagnostics.
19
+ attr_reader values: untyped
20
+
21
+ # Protocol identity, captured offset, decoded values and diagnostics.
22
+ attr_reader embedded: untyped
23
+
24
+ # Header size and absolute payload bounds used by child dissectors.
25
+ attr_accessor header_length: untyped
26
+
27
+ # Header size and absolute payload bounds used by child dissectors.
28
+ attr_accessor payload_offset: untyped
29
+
30
+ # Header size and absolute payload bounds used by child dissectors.
31
+ attr_accessor payload_end: untyped
32
+
33
+ # @rbs (Symbol protocol, Integer offset, Integer length, Integer limit, ?definitions: Array[untyped], ?values: Hash[Symbol, untyped], ?embedded: bool) -> void
34
+ # Create a bounded header with optional fixed field definitions and values.
35
+ def initialize: (Symbol protocol, Integer offset, Integer length, Integer limit, ?definitions: Array[untyped], ?values: Hash[Symbol, untyped], ?embedded: bool) -> void
36
+
37
+ # @rbs (Symbol key) -> untyped
38
+ # Read the raw value identified by a symbolic field key.
39
+ def []: (Symbol key) -> untyped
40
+
41
+ # @rbs () -> Integer
42
+ # Decoded header length in bytes.
43
+ def length: () -> Integer
44
+
45
+ # @rbs () -> bool
46
+ # Whether no bytes remain for a child protocol.
47
+ def payload_empty?: () -> bool
48
+
49
+ # @rbs () -> bool
50
+ # Whether an error or truncation stops the protocol chain.
51
+ def error?: () -> bool
52
+
53
+ # @rbs (Symbol severity, Symbol code, ?String message, ?String? field) -> Layer
54
+ # Append a structured diagnostic and return this layer.
55
+ def diagnose: (Symbol severity, Symbol code, ?String message, ?String? field) -> Layer
56
+
57
+ # @rbs (Symbol key, String name, untyped value, ?type: Symbol, ?offset: Integer, ?length: Integer, ?format: Symbol?, ?enum: untyped) -> Layer
58
+ # Append a dynamic field with its value, representation and location.
59
+ def add: (Symbol key, String name, untyped value, ?type: Symbol, ?offset: Integer, ?length: Integer, ?format: Symbol?, ?enum: untyped) -> Layer
60
+
61
+ # @rbs () -> Array[Field]
62
+ # Return Field objects for all fixed and dynamic definitions.
63
+ def fields: () -> Array[Field]
64
+
65
+ # @rbs (Symbol key) -> String
66
+ # Return escaped text for a single symbolic field.
67
+ def display: (Symbol key) -> String
68
+
69
+ # @rbs (String name) -> untyped
70
+ # Read the first decoded value with this dotted field name.
71
+ def field_value: (String name) -> untyped
72
+
73
+ # @rbs (String name) -> Array[untyped]
74
+ # Read the first decoded value with this dotted field name.
75
+ def field_values: (String name) -> Array[untyped]
76
+
77
+ # @rbs () -> Hash[Symbol, untyped]
78
+ # Return JSON fields, grouping repeated names into arrays.
79
+ def to_h: () -> Hash[Symbol, untyped]
80
+ end
81
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/output/fields.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Fields
8
+ # @rbs (Array[String] names) -> void
9
+ def initialize: (Array[String] names) -> void
10
+
11
+ # @rbs (Packet packet, untyped io) -> void
12
+ def format: (Packet packet, untyped io) -> void
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,21 @@
1
+ # Generated from lib/redhound/output/follow.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Follow
8
+ # @rbs (String specification) -> void
9
+ def initialize: (String specification) -> void
10
+
11
+ # @rbs (Analysis::Flow flow, Integer direction, String data) -> void
12
+ def write: (Analysis::Flow flow, Integer direction, String data) -> void
13
+
14
+ # @rbs (untyped io) -> void
15
+ def format: (untyped io) -> void
16
+
17
+ # @rbs () -> void
18
+ def close: () -> void
19
+ end
20
+ end
21
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/output/hexdump.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Hexdump
8
+ # @rbs (?ascii: bool, ?link_layer: bool) -> void
9
+ def initialize: (?ascii: bool, ?link_layer: bool) -> void
10
+
11
+ # @rbs (Packet packet, untyped io) -> void
12
+ def format: (Packet packet, untyped io) -> void
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,18 @@
1
+ # Generated from lib/redhound/output/json.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Json
8
+ # @rbs (?ndjson: bool) -> void
9
+ def initialize: (?ndjson: bool) -> void
10
+
11
+ # @rbs (Packet packet, untyped io) -> void
12
+ def format: (Packet packet, untyped io) -> void
13
+
14
+ # @rbs (untyped io) -> void
15
+ def finish: (untyped io) -> void
16
+ end
17
+ end
18
+ end
@@ -0,0 +1,21 @@
1
+ # Generated from lib/redhound/output/summary.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Summary
8
+ # @rbs (?timestamp: Symbol, ?precision: Symbol, ?link_layer: bool, ?quick: bool, ?verbosity: Integer, ?resolve_names: bool) -> void
9
+ def initialize: (?timestamp: Symbol, ?precision: Symbol, ?link_layer: bool, ?quick: bool, ?verbosity: Integer, ?resolve_names: bool) -> void
10
+
11
+ # @rbs (Packet packet) -> String
12
+ def line: (Packet packet) -> String
13
+
14
+ # @rbs (Packet packet, untyped io) -> void
15
+ def format: (Packet packet, untyped io) -> void
16
+
17
+ # @rbs (String ip) -> String
18
+ def address: (String ip) -> String
19
+ end
20
+ end
21
+ end
@@ -0,0 +1,21 @@
1
+ # Generated from lib/redhound/output/timestamp.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Timestamp
8
+ # @rbs (?style: Symbol, ?precision: Symbol) -> void
9
+ def initialize: (?style: Symbol, ?precision: Symbol) -> void
10
+
11
+ # @rbs (Packet packet) -> String
12
+ def format: (Packet packet) -> String
13
+
14
+ # @rbs (Integer ns) -> String
15
+ def fraction: (Integer ns) -> String
16
+
17
+ # @rbs (Integer ns) -> String
18
+ def seconds: (Integer ns) -> String
19
+ end
20
+ end
21
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/output/tree.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Output
6
+ # @api private
7
+ class Tree
8
+ # @rbs (Packet packet, untyped io) -> void
9
+ def format: (Packet packet, untyped io) -> void
10
+
11
+ # @rbs (String text) -> String
12
+ def safe: (String text) -> String
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,82 @@
1
+ # Generated from lib/redhound/packet.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # Captured immutable bytes, metadata, and lazily decoded protocol layers.
5
+ class Packet
6
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
7
+ attr_reader data: untyped
8
+
9
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
10
+ attr_reader timestamp_ns: untyped
11
+
12
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
13
+ attr_reader original_length: untyped
14
+
15
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
16
+ attr_reader linktype: untyped
17
+
18
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
19
+ attr_reader interface: untyped
20
+
21
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
22
+ attr_reader direction: untyped
23
+
24
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
25
+ attr_reader number: untyped
26
+
27
+ # Capture bytes and metadata; timestamp_ns and lengths preserve kernel/file values.
28
+ attr_reader meta: untyped
29
+
30
+ # Override the dissection engine before accessing layers.
31
+ attr_accessor engine: untyped
32
+
33
+ # @rbs (String data, ?timestamp_ns: Integer, ?original_length: Integer?, ?linktype: (Integer | Symbol), ?interface: untyped, ?direction: Symbol?, ?number: Integer, ?meta: Hash[Symbol, untyped]) -> void
34
+ # Copy binary data and preserve capture metadata; reject impossible original lengths.
35
+ def initialize: (String data, ?timestamp_ns: Integer, ?original_length: Integer?, ?linktype: Integer | Symbol, ?interface: untyped, ?direction: Symbol?, ?number: Integer, ?meta: Hash[Symbol, untyped]) -> void
36
+
37
+ # @rbs () -> Integer
38
+ # Number of captured bytes.
39
+ def caplen: () -> Integer
40
+
41
+ # @rbs () -> bool
42
+ # Whether capture omitted bytes from the original packet.
43
+ def truncated?: () -> bool
44
+
45
+ # @rbs () -> Time
46
+ # Capture timestamp as a nanosecond-precision Time.
47
+ def time: () -> Time
48
+
49
+ # @rbs () -> Array[Layer]
50
+ # Decode the protocol chain once and return its Layers.
51
+ def layers: () -> Array[Layer]
52
+
53
+ # @rbs ((Symbol | String) key) -> untyped
54
+ # Select the first layer by symbol or decoded field by dotted name.
55
+ def []: (Symbol | String key) -> untyped
56
+
57
+ # @rbs (Symbol protocol) -> Array[Layer]
58
+ # Decode the protocol chain once and return its Layers.
59
+ def layers_of: (Symbol protocol) -> Array[Layer]
60
+
61
+ # @rbs (Symbol protocol) -> Layer?
62
+ # Return the last matching layer in the protocol chain.
63
+ def innermost: (Symbol protocol) -> Layer?
64
+
65
+ # @rbs (String name) -> Array[untyped]
66
+ # Return every decoded value of a repeated field.
67
+ def field_values: (String name) -> Array[untyped]
68
+
69
+ # @rbs () -> String
70
+ # Format a numeric one-line packet summary.
71
+ def summary: () -> String
72
+
73
+ # @rbs () -> Hash[Symbol, untyped]
74
+ # Return a JSON-compatible packet matching docs/json-schema.json.
75
+ def to_h: () -> Hash[Symbol, untyped]
76
+
77
+ private
78
+
79
+ # @rbs (String? text) -> String?
80
+ def json_text: (String? text) -> String?
81
+ end
82
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/protocols/arp.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Protocols
6
+ # @api private
7
+ class Arp < Dissector
8
+ # @rbs (Context ctx, Layer layer) -> void
9
+ def dissect: (Context ctx, Layer layer) -> void
10
+
11
+ # @rbs (Layer layer) -> String
12
+ def summary: (Layer layer) -> String
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,15 @@
1
+ # Generated from lib/redhound/protocols/checksum.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Protocols
6
+ # @api private
7
+ module Checksum
8
+ # @rbs (String bytes) -> Integer
9
+ def self.value: (String bytes) -> Integer
10
+
11
+ # @rbs (Context ctx, Layer layer, String bytes, ?Integer? proto) -> void
12
+ def self.verify: (Context ctx, Layer layer, String bytes, ?Integer? proto) -> void
13
+ end
14
+ end
15
+ end
@@ -0,0 +1,17 @@
1
+ # Generated from lib/redhound/protocols/data.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Protocols
6
+ # @api private
7
+ class Data < Dissector
8
+ LENGTH_FIELD: untyped
9
+
10
+ # @rbs (Context ctx, Layer layer) -> void
11
+ def dissect: (Context ctx, Layer layer) -> void
12
+
13
+ # @rbs (Layer layer) -> String
14
+ def summary: (Layer layer) -> String
15
+ end
16
+ end
17
+ end
@@ -0,0 +1,31 @@
1
+ # Generated from lib/redhound/protocols/dhcp.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Protocols
6
+ # @api private
7
+ class Dhcp < Dissector
8
+ MESSAGE_TYPES: untyped
9
+
10
+ ADDRESS_OPTIONS: untyped
11
+
12
+ # @rbs (Context ctx, Layer layer) -> void
13
+ def dissect: (Context ctx, Layer layer) -> void
14
+
15
+ # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, untyped options) -> void
16
+ def read_options: (Cursor cursor, Layer layer, Integer pos, Integer ending, untyped options) -> void
17
+
18
+ # @rbs (Layer layer, Integer code, String value, untyped entries) -> void
19
+ def decode_option: (Layer layer, Integer code, String value, untyped entries) -> void
20
+
21
+ # @rbs (untyped entries, Integer logical) -> Integer
22
+ def wire_offset: (untyped entries, Integer logical) -> Integer
23
+
24
+ # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
25
+ def put: (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length, ?untyped entries) -> void
26
+
27
+ # @rbs (Layer layer) -> String
28
+ def summary: (Layer layer) -> String
29
+ end
30
+ end
31
+ end
@@ -0,0 +1,42 @@
1
+ # Generated from lib/redhound/protocols/dns.rb with RBS::Inline
2
+
3
+ module Redhound
4
+ # @api private
5
+ module Protocols
6
+ # @api private
7
+ class Dns < StreamDissector
8
+ # @api private
9
+ class Malformed < StandardError
10
+ end
11
+
12
+ TYPES: untyped
13
+
14
+ # @rbs (Context ctx, Layer layer) -> void
15
+ def dissect: (Context ctx, Layer layer) -> void
16
+
17
+ # @rbs (Cursor cursor, Layer layer, Symbol variant) -> void
18
+ def message: (Cursor cursor, Layer layer, Symbol variant) -> void
19
+
20
+ # @rbs (Cursor cursor, Integer pos, ?Integer? limit, ?bool compression) -> [String, Integer]
21
+ def read_name: (Cursor cursor, Integer pos, ?Integer? limit, ?bool compression) -> [ String, Integer ]
22
+
23
+ # @rbs (Cursor cursor, Layer layer, Integer pos, Integer base, Symbol variant) -> Integer
24
+ def record: (Cursor cursor, Layer layer, Integer pos, Integer base, Symbol variant) -> Integer
25
+
26
+ # @rbs (Cursor cursor, Layer layer, Integer type, Integer pos, Integer ending, Integer base) -> void
27
+ def rdata: (Cursor cursor, Layer layer, Integer type, Integer pos, Integer ending, Integer base) -> void
28
+
29
+ # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
30
+ def service_binding: (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
31
+
32
+ # @rbs (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
33
+ def edns: (Cursor cursor, Layer layer, Integer pos, Integer ending, Integer base) -> void
34
+
35
+ # @rbs (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
36
+ def put: (Layer layer, String name, untyped value, Symbol type, Integer offset, Integer length) -> void
37
+
38
+ # @rbs (Layer layer) -> String
39
+ def summary: (Layer layer) -> String
40
+ end
41
+ end
42
+ end