redhound 1.0.1 → 2.0.0.rc2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +51 -0
- data/README.md +97 -31
- data/docs/API.md +104 -0
- data/docs/FILTERS.md +37 -0
- data/docs/MIGRATION.md +23 -0
- data/docs/PROTOCOLS.md +54 -0
- data/docs/USAGE.md +86 -0
- data/docs/VALIDATION.md +175 -0
- data/docs/json-schema.json +64 -0
- data/exe/redhound +2 -1
- data/lib/redhound/analysis/flow_key.rb +59 -0
- data/lib/redhound/analysis/flow_table.rb +124 -0
- data/lib/redhound/analysis/ip_reassembler.rb +209 -0
- data/lib/redhound/analysis/stats.rb +150 -0
- data/lib/redhound/analysis/tcp_analysis.rb +43 -0
- data/lib/redhound/analysis/tcp_reassembler.rb +176 -0
- data/lib/redhound/analysis/tcp_stream.rb +156 -0
- data/lib/redhound/analysis.rb +157 -0
- data/lib/redhound/capture/bsd/bpf_device.rb +155 -0
- data/lib/redhound/capture/bsd/constants.rb +29 -0
- data/lib/redhound/capture/bsd/ifreq.rb +41 -0
- data/lib/redhound/capture/file_source.rb +214 -0
- data/lib/redhound/capture/interface.rb +70 -0
- data/lib/redhound/capture/linktype.rb +30 -0
- data/lib/redhound/capture/linux/constants.rb +37 -0
- data/lib/redhound/capture/linux/cooked.rb +18 -0
- data/lib/redhound/capture/linux/ifreq.rb +42 -0
- data/lib/redhound/capture/linux/packet_socket.rb +224 -0
- data/lib/redhound/capture/linux/sockaddr_ll.rb +33 -0
- data/lib/redhound/capture/linux/tpacket_v3.rb +137 -0
- data/lib/redhound/capture/source.rb +79 -0
- data/lib/redhound/capture/stats.rb +22 -0
- data/lib/redhound/capture.rb +70 -0
- data/lib/redhound/cli/command.rb +42 -0
- data/lib/redhound/cli/options.rb +133 -0
- data/lib/redhound/cli/privileges.rb +29 -0
- data/lib/redhound/cli/runner.rb +129 -0
- data/lib/redhound/context.rb +20 -0
- data/lib/redhound/cursor.rb +69 -0
- data/lib/redhound/diagnostic.rb +7 -0
- data/lib/redhound/dissector.rb +152 -0
- data/lib/redhound/engine.rb +69 -0
- data/lib/redhound/errors.rb +38 -0
- data/lib/redhound/field.rb +62 -0
- data/lib/redhound/file/format.rb +63 -0
- data/lib/redhound/file/pcap_reader.rb +43 -0
- data/lib/redhound/file/pcap_writer.rb +79 -0
- data/lib/redhound/file/pcapng_reader.rb +221 -0
- data/lib/redhound/file/pcapng_writer.rb +151 -0
- data/lib/redhound/file/rotating_writer.rb +98 -0
- data/lib/redhound/filter/analyzer.rb +197 -0
- data/lib/redhound/filter/bpf/assembler.rb +121 -0
- data/lib/redhound/filter/bpf/disassembler.rb +58 -0
- data/lib/redhound/filter/bpf/validator.rb +77 -0
- data/lib/redhound/filter/bpf/vm.rb +109 -0
- data/lib/redhound/filter/codegen.rb +413 -0
- data/lib/redhound/filter/lexer.rb +46 -0
- data/lib/redhound/filter/parser.rb +206 -0
- data/lib/redhound/filter/program.rb +55 -0
- data/lib/redhound/filter.rb +30 -0
- data/lib/redhound/layer.rb +75 -0
- data/lib/redhound/output/fields.rb +20 -0
- data/lib/redhound/output/follow.rb +64 -0
- data/lib/redhound/output/hexdump.rb +29 -0
- data/lib/redhound/output/json.rb +32 -0
- data/lib/redhound/output/summary.rb +84 -0
- data/lib/redhound/output/timestamp.rb +34 -0
- data/lib/redhound/output/tree.rb +25 -0
- data/lib/redhound/packet.rb +77 -0
- data/lib/redhound/protocols/arp.rb +39 -0
- data/lib/redhound/protocols/checksum.rb +38 -0
- data/lib/redhound/protocols/data.rb +23 -0
- data/lib/redhound/protocols/dhcp.rb +140 -0
- data/lib/redhound/protocols/dns.rb +268 -0
- data/lib/redhound/protocols/ethernet.rb +24 -0
- data/lib/redhound/protocols/http.rb +185 -0
- data/lib/redhound/protocols/icmp.rb +205 -0
- data/lib/redhound/protocols/ipv4.rb +56 -0
- data/lib/redhound/protocols/ipv6.rb +68 -0
- data/lib/redhound/protocols/link.rb +70 -0
- data/lib/redhound/protocols/llc.rb +37 -0
- data/lib/redhound/protocols/ntp.rb +45 -0
- data/lib/redhound/protocols/tcp.rb +88 -0
- data/lib/redhound/protocols/tls.rb +218 -0
- data/lib/redhound/protocols/tunnel.rb +48 -0
- data/lib/redhound/protocols/udp.rb +32 -0
- data/lib/redhound/protocols/vlan.rb +23 -0
- data/lib/redhound/reader.rb +8 -0
- data/lib/redhound/registry.rb +64 -0
- data/lib/redhound/stream_dissector.rb +168 -0
- data/lib/redhound/util/seq.rb +21 -0
- data/lib/redhound/version.rb +2 -1
- data/lib/redhound/writer.rb +25 -43
- data/lib/redhound.rb +81 -9
- data/sig/generated/redhound/analysis/flow_key.rbs +15 -0
- data/sig/generated/redhound/analysis/flow_table.rbs +102 -0
- data/sig/generated/redhound/analysis/ip_reassembler.rbs +52 -0
- data/sig/generated/redhound/analysis/stats.rbs +80 -0
- data/sig/generated/redhound/analysis/tcp_analysis.rbs +15 -0
- data/sig/generated/redhound/analysis/tcp_reassembler.rbs +39 -0
- data/sig/generated/redhound/analysis/tcp_stream.rbs +60 -0
- data/sig/generated/redhound/analysis.rbs +38 -0
- data/sig/generated/redhound/capture/bsd/bpf_device.rbs +39 -0
- data/sig/generated/redhound/capture/bsd/constants.rbs +40 -0
- data/sig/generated/redhound/capture/bsd/ifreq.rbs +15 -0
- data/sig/generated/redhound/capture/file_source.rbs +67 -0
- data/sig/generated/redhound/capture/interface.rbs +53 -0
- data/sig/generated/redhound/capture/linktype.rbs +20 -0
- data/sig/generated/redhound/capture/linux/constants.rbs +58 -0
- data/sig/generated/redhound/capture/linux/cooked.rbs +15 -0
- data/sig/generated/redhound/capture/linux/ifreq.rbs +18 -0
- data/sig/generated/redhound/capture/linux/packet_socket.rbs +64 -0
- data/sig/generated/redhound/capture/linux/sockaddr_ll.rbs +31 -0
- data/sig/generated/redhound/capture/linux/tpacket_v3.rbs +35 -0
- data/sig/generated/redhound/capture/source.rbs +44 -0
- data/sig/generated/redhound/capture/stats.rbs +25 -0
- data/sig/generated/redhound/capture.rbs +14 -0
- data/sig/generated/redhound/cli/command.rbs +12 -0
- data/sig/generated/redhound/cli/options.rbs +25 -0
- data/sig/generated/redhound/cli/privileges.rbs +12 -0
- data/sig/generated/redhound/cli/runner.rbs +27 -0
- data/sig/generated/redhound/context.rbs +27 -0
- data/sig/generated/redhound/cursor.rbs +59 -0
- data/sig/generated/redhound/diagnostic.rbs +21 -0
- data/sig/generated/redhound/dissector.rbs +117 -0
- data/sig/generated/redhound/engine.rbs +23 -0
- data/sig/generated/redhound/errors.rbs +56 -0
- data/sig/generated/redhound/field.rbs +74 -0
- data/sig/generated/redhound/file/format.rbs +39 -0
- data/sig/generated/redhound/file/pcap_reader.rbs +19 -0
- data/sig/generated/redhound/file/pcap_writer.rbs +38 -0
- data/sig/generated/redhound/file/pcapng_reader.rbs +54 -0
- data/sig/generated/redhound/file/pcapng_writer.rbs +50 -0
- data/sig/generated/redhound/file/rotating_writer.rbs +42 -0
- data/sig/generated/redhound/filter/analyzer.rbs +42 -0
- data/sig/generated/redhound/filter/bpf/assembler.rbs +39 -0
- data/sig/generated/redhound/filter/bpf/disassembler.rbs +18 -0
- data/sig/generated/redhound/filter/bpf/validator.rbs +30 -0
- data/sig/generated/redhound/filter/bpf/vm.rbs +28 -0
- data/sig/generated/redhound/filter/codegen.rbs +101 -0
- data/sig/generated/redhound/filter/lexer.rbs +15 -0
- data/sig/generated/redhound/filter/parser.rbs +65 -0
- data/sig/generated/redhound/filter/program.rbs +48 -0
- data/sig/generated/redhound/filter.rbs +10 -0
- data/sig/generated/redhound/layer.rbs +81 -0
- data/sig/generated/redhound/output/fields.rbs +15 -0
- data/sig/generated/redhound/output/follow.rbs +21 -0
- data/sig/generated/redhound/output/hexdump.rbs +15 -0
- data/sig/generated/redhound/output/json.rbs +18 -0
- data/sig/generated/redhound/output/summary.rbs +21 -0
- data/sig/generated/redhound/output/timestamp.rbs +21 -0
- data/sig/generated/redhound/output/tree.rbs +15 -0
- data/sig/generated/redhound/packet.rbs +82 -0
- data/sig/generated/redhound/protocols/arp.rbs +15 -0
- data/sig/generated/redhound/protocols/checksum.rbs +15 -0
- data/sig/generated/redhound/protocols/data.rbs +17 -0
- data/sig/generated/redhound/protocols/dhcp.rbs +31 -0
- data/sig/generated/redhound/protocols/dns.rbs +42 -0
- data/sig/generated/redhound/protocols/ethernet.rbs +15 -0
- data/sig/generated/redhound/protocols/http.rbs +36 -0
- data/sig/generated/redhound/protocols/icmp.rbs +41 -0
- data/sig/generated/redhound/protocols/ipv4.rbs +15 -0
- data/sig/generated/redhound/protocols/ipv6.rbs +24 -0
- data/sig/generated/redhound/protocols/link.rbs +33 -0
- data/sig/generated/redhound/protocols/llc.rbs +15 -0
- data/sig/generated/redhound/protocols/ntp.rbs +17 -0
- data/sig/generated/redhound/protocols/tcp.rbs +25 -0
- data/sig/generated/redhound/protocols/tls.rbs +51 -0
- data/sig/generated/redhound/protocols/tunnel.rbs +24 -0
- data/sig/generated/redhound/protocols/udp.rbs +18 -0
- data/sig/generated/redhound/protocols/vlan.rbs +12 -0
- data/sig/generated/redhound/reader.rbs +7 -0
- data/sig/generated/redhound/registry.rbs +45 -0
- data/sig/generated/redhound/stream_dissector.rbs +44 -0
- data/sig/generated/redhound/util/seq.rbs +20 -0
- data/sig/generated/redhound/version.rbs +1 -0
- data/sig/generated/redhound/writer.rbs +6 -19
- data/sig/generated/redhound.rbs +18 -0
- data/sig/shims/io.rbs +7 -0
- data/sig/shims/process.rbs +3 -0
- metadata +177 -55
- data/CODE_OF_CONDUCT.md +0 -132
- data/Dockerfile +0 -7
- data/Rakefile +0 -15
- data/Steepfile +0 -4
- data/docker-compose.yml +0 -9
- data/lib/redhound/analyzer.rb +0 -34
- data/lib/redhound/builder/packet_mreq.rb +0 -56
- data/lib/redhound/builder/socket.rb +0 -35
- data/lib/redhound/builder.rb +0 -4
- data/lib/redhound/command.rb +0 -67
- data/lib/redhound/l2/ether.rb +0 -68
- data/lib/redhound/l2/protocol.rb +0 -33
- data/lib/redhound/l2.rb +0 -4
- data/lib/redhound/l3/arp.rb +0 -114
- data/lib/redhound/l3/base.rb +0 -49
- data/lib/redhound/l3/ipv4.rb +0 -95
- data/lib/redhound/l3/ipv6.rb +0 -69
- data/lib/redhound/l3/protocol.rb +0 -173
- data/lib/redhound/l3/resolver.rb +0 -30
- data/lib/redhound/l3.rb +0 -9
- data/lib/redhound/l4/base.rb +0 -31
- data/lib/redhound/l4/icmp.rb +0 -71
- data/lib/redhound/l4/resolver.rb +0 -28
- data/lib/redhound/l4/udp.rb +0 -63
- data/lib/redhound/l4.rb +0 -6
- data/lib/redhound/receiver.rb +0 -45
- data/lib/redhound/resolver.rb +0 -22
- data/lib/redhound/source/socket.rb +0 -18
- data/lib/redhound/source.rb +0 -3
- data/rbs_collection.lock.yaml +0 -20
- data/rbs_collection.yaml +0 -17
- data/sig/generated/redhound/analyzer.rbs +0 -14
- data/sig/generated/redhound/builder/packet_mreq.rbs +0 -39
- data/sig/generated/redhound/builder/socket.rbs +0 -24
- data/sig/generated/redhound/command.rbs +0 -19
- data/sig/generated/redhound/l2/ether.rbs +0 -41
- data/sig/generated/redhound/l2/protocol.rbs +0 -15
- data/sig/generated/redhound/l3/arp.rbs +0 -57
- data/sig/generated/redhound/l3/base.rbs +0 -28
- data/sig/generated/redhound/l3/ipv4.rbs +0 -53
- data/sig/generated/redhound/l3/ipv6.rbs +0 -38
- data/sig/generated/redhound/l3/protocol.rbs +0 -16
- data/sig/generated/redhound/l3/resolver.rbs +0 -16
- data/sig/generated/redhound/l4/base.rbs +0 -19
- data/sig/generated/redhound/l4/icmp.rbs +0 -33
- data/sig/generated/redhound/l4/resolver.rbs +0 -16
- data/sig/generated/redhound/l4/udp.rbs +0 -36
- data/sig/generated/redhound/receiver.rbs +0 -19
- data/sig/generated/redhound/resolver.rbs +0 -11
- data/sig/generated/redhound/source/socket.rbs +0 -13
data/lib/redhound/l2/ether.rb
DELETED
|
@@ -1,68 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L2
|
|
6
|
-
class Ether
|
|
7
|
-
attr_reader :type #: Protocol
|
|
8
|
-
|
|
9
|
-
class << self
|
|
10
|
-
# @rbs (bytes: Array[Integer], count: Integer) -> Redhound::L2::Ether
|
|
11
|
-
def generate(bytes:, count:)
|
|
12
|
-
new(bytes:, count:).generate
|
|
13
|
-
end
|
|
14
|
-
end
|
|
15
|
-
|
|
16
|
-
# @rbs (bytes: Array[Integer], count: Integer) -> void
|
|
17
|
-
def initialize(bytes:, count:)
|
|
18
|
-
raise ArgumentError, "bytes must be #{size} bytes" unless bytes.size >= size
|
|
19
|
-
|
|
20
|
-
@bytes = bytes
|
|
21
|
-
@count = count
|
|
22
|
-
end
|
|
23
|
-
|
|
24
|
-
# @rbs () -> Integer
|
|
25
|
-
def size = 14
|
|
26
|
-
|
|
27
|
-
# @rbs () -> Redhound::L2::Ether
|
|
28
|
-
def generate
|
|
29
|
-
@dhost = @bytes[0..5]
|
|
30
|
-
@shost = @bytes[6..11]
|
|
31
|
-
@type = Protocol.new(protocol: hex_type(@bytes[12..13]))
|
|
32
|
-
self
|
|
33
|
-
end
|
|
34
|
-
|
|
35
|
-
# @rbs () -> void
|
|
36
|
-
def dump
|
|
37
|
-
puts self
|
|
38
|
-
end
|
|
39
|
-
|
|
40
|
-
# @rbs () -> String
|
|
41
|
-
def to_s
|
|
42
|
-
"[#{@count}] Ethernet Dst: #{dhost} Src: #{shost} Type: #{@type}"
|
|
43
|
-
end
|
|
44
|
-
|
|
45
|
-
# @rbs () -> bool
|
|
46
|
-
def supported_type?
|
|
47
|
-
@type.ipv4? || @type.ipv6? || @type.arp? # steep:ignore
|
|
48
|
-
end
|
|
49
|
-
|
|
50
|
-
private
|
|
51
|
-
|
|
52
|
-
# @rbs () -> String
|
|
53
|
-
def dhost
|
|
54
|
-
@dhost.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
55
|
-
end
|
|
56
|
-
|
|
57
|
-
# @rbs () -> String
|
|
58
|
-
def shost
|
|
59
|
-
@shost.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
60
|
-
end
|
|
61
|
-
|
|
62
|
-
# @rbs (Array[Integer] type) -> Integer
|
|
63
|
-
def hex_type(type)
|
|
64
|
-
type.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
65
|
-
end
|
|
66
|
-
end
|
|
67
|
-
end
|
|
68
|
-
end
|
data/lib/redhound/l2/protocol.rb
DELETED
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L2
|
|
6
|
-
class Protocol
|
|
7
|
-
PROTO_TABLE = {
|
|
8
|
-
0x0060 => 'Loopback',
|
|
9
|
-
0x0800 => 'IPv4',
|
|
10
|
-
0x0806 => 'ARP',
|
|
11
|
-
0x86DD => 'IPv6',
|
|
12
|
-
0x8100 => 'VLAN',
|
|
13
|
-
}
|
|
14
|
-
|
|
15
|
-
# @rbs (protocol: Integer) -> void
|
|
16
|
-
def initialize(protocol:)
|
|
17
|
-
@protocol = protocol
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
# @rbs () -> String
|
|
21
|
-
def to_s
|
|
22
|
-
PROTO_TABLE[@protocol] || 'Unknown'
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
PROTO_TABLE.each do |id, name|
|
|
26
|
-
method_name = name.downcase.gsub(/[ \-]/, '_') + '?'
|
|
27
|
-
define_method(method_name) do
|
|
28
|
-
@protocol == id
|
|
29
|
-
end
|
|
30
|
-
end
|
|
31
|
-
end
|
|
32
|
-
end
|
|
33
|
-
end
|
data/lib/redhound/l2.rb
DELETED
data/lib/redhound/l3/arp.rb
DELETED
|
@@ -1,114 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Arp < Base
|
|
7
|
-
class << self
|
|
8
|
-
# @rbs (bytes: Array[Integer]) -> Redhound::L3::Arp
|
|
9
|
-
def generate(bytes:)
|
|
10
|
-
new(bytes:).generate
|
|
11
|
-
end
|
|
12
|
-
end
|
|
13
|
-
|
|
14
|
-
# @rbs (bytes: Array[Integer]) -> void
|
|
15
|
-
def initialize(bytes:)
|
|
16
|
-
raise ArgumentError, "bytes must be bigger than #{arp_size} bytes" unless bytes.size >= arp_size
|
|
17
|
-
|
|
18
|
-
@bytes = bytes
|
|
19
|
-
end
|
|
20
|
-
|
|
21
|
-
# @rbs () -> Redhound::L3::Arp
|
|
22
|
-
def generate
|
|
23
|
-
@htype = @bytes[0..1]
|
|
24
|
-
@ptype = @bytes[2..3]
|
|
25
|
-
@hlen = @bytes[4]
|
|
26
|
-
@plen = @bytes[5]
|
|
27
|
-
@oper = @bytes[6..7]
|
|
28
|
-
@sha = @bytes[8..13]
|
|
29
|
-
@spa = @bytes[14..17]
|
|
30
|
-
@tha = @bytes[18..23]
|
|
31
|
-
@tpa = @bytes[24..27]
|
|
32
|
-
@type = Redhound::L2::Protocol.new(protocol: ptype)
|
|
33
|
-
@l3 = generate_l3
|
|
34
|
-
self
|
|
35
|
-
end
|
|
36
|
-
|
|
37
|
-
# @rbs () -> Integer
|
|
38
|
-
def arp_size = 28
|
|
39
|
-
|
|
40
|
-
# @rbs () -> Integer
|
|
41
|
-
def size
|
|
42
|
-
if @l3.nil?
|
|
43
|
-
arp_size
|
|
44
|
-
else
|
|
45
|
-
arp_size + @l3.size
|
|
46
|
-
end
|
|
47
|
-
end
|
|
48
|
-
|
|
49
|
-
# @rbs () -> String
|
|
50
|
-
def to_s
|
|
51
|
-
" └─ ARP HType: #{htype} PType: #{ptype} HLen: #{@hlen} PLen: #{@plen} Oper: #{oper} SHA: #{sha} SPA: #{spa} THA: #{tha} TPA: #{tpa}"
|
|
52
|
-
end
|
|
53
|
-
|
|
54
|
-
# @rbs () -> bool
|
|
55
|
-
def supported_protocol?
|
|
56
|
-
return false if @l3.nil?
|
|
57
|
-
@l3.supported_protocol?
|
|
58
|
-
end
|
|
59
|
-
|
|
60
|
-
# @rbs () -> String?
|
|
61
|
-
def protocol
|
|
62
|
-
@l3.protocol if @l3
|
|
63
|
-
end
|
|
64
|
-
|
|
65
|
-
private
|
|
66
|
-
|
|
67
|
-
# @rbs () -> Integer
|
|
68
|
-
def htype
|
|
69
|
-
@htype.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
70
|
-
end
|
|
71
|
-
|
|
72
|
-
# @rbs () -> Integer
|
|
73
|
-
def ptype
|
|
74
|
-
@ptype.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
75
|
-
end
|
|
76
|
-
|
|
77
|
-
# @rbs () -> Integer
|
|
78
|
-
def oper
|
|
79
|
-
@oper.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
80
|
-
end
|
|
81
|
-
|
|
82
|
-
# @rbs () -> String
|
|
83
|
-
def sha
|
|
84
|
-
@sha.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
85
|
-
end
|
|
86
|
-
|
|
87
|
-
# @rbs () -> String
|
|
88
|
-
def spa
|
|
89
|
-
@spa.map { |b| b.to_s(16).rjust(2, '0') }.join('.')
|
|
90
|
-
end
|
|
91
|
-
|
|
92
|
-
# @rbs () -> String
|
|
93
|
-
def tha
|
|
94
|
-
@tha.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
95
|
-
end
|
|
96
|
-
|
|
97
|
-
# @rbs () -> String
|
|
98
|
-
def tpa
|
|
99
|
-
@tpa.map { |b| b.to_s(16).rjust(2, '0') }.join('.')
|
|
100
|
-
end
|
|
101
|
-
|
|
102
|
-
# @rbs () -> Redhound::L3::Base?
|
|
103
|
-
def generate_l3
|
|
104
|
-
return if @bytes.size == arp_size
|
|
105
|
-
|
|
106
|
-
if @type.ipv4?
|
|
107
|
-
Ipv4.generate(bytes: @bytes[arp_size..])
|
|
108
|
-
elsif @type.ipv6?
|
|
109
|
-
Ipv6.generate(bytes: @bytes[arp_size..])
|
|
110
|
-
end
|
|
111
|
-
end
|
|
112
|
-
end
|
|
113
|
-
end
|
|
114
|
-
end
|
data/lib/redhound/l3/base.rb
DELETED
|
@@ -1,49 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Base
|
|
7
|
-
class << self
|
|
8
|
-
# @rbs (bytes: Array[Integer]) -> Redhound::L3::Base
|
|
9
|
-
def generate(bytes:)
|
|
10
|
-
new(bytes:).generate
|
|
11
|
-
end
|
|
12
|
-
end
|
|
13
|
-
|
|
14
|
-
# @rbs (bytes: Array[Integer]) -> void
|
|
15
|
-
def initialize(bytes:)
|
|
16
|
-
warn 'initialize method must be implemented'
|
|
17
|
-
end
|
|
18
|
-
|
|
19
|
-
# @rbs () -> Redhound::L3::Base
|
|
20
|
-
def generate
|
|
21
|
-
warn 'generate method must be implemented'
|
|
22
|
-
self
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
# @rbs () -> void
|
|
26
|
-
def dump
|
|
27
|
-
puts self
|
|
28
|
-
end
|
|
29
|
-
|
|
30
|
-
# @rbs () -> Integer
|
|
31
|
-
def size
|
|
32
|
-
warn 'size method must be implemented'
|
|
33
|
-
0
|
|
34
|
-
end
|
|
35
|
-
|
|
36
|
-
# @rbs () -> bool
|
|
37
|
-
def supported_protocol?
|
|
38
|
-
warn 'supported_protocol? method must be implemented'
|
|
39
|
-
false
|
|
40
|
-
end
|
|
41
|
-
|
|
42
|
-
# @rbs () -> Protocol
|
|
43
|
-
def protocol
|
|
44
|
-
warn 'protocol method must be implemented'
|
|
45
|
-
Protocol.new(protocol: 0)
|
|
46
|
-
end
|
|
47
|
-
end
|
|
48
|
-
end
|
|
49
|
-
end
|
data/lib/redhound/l3/ipv4.rb
DELETED
|
@@ -1,95 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Ipv4 < Base
|
|
7
|
-
class << self
|
|
8
|
-
# @rbs (bytes: Array[Integer]) -> Redhound::L3::Ipv4
|
|
9
|
-
def generate(bytes:)
|
|
10
|
-
new(bytes:).generate
|
|
11
|
-
end
|
|
12
|
-
end
|
|
13
|
-
|
|
14
|
-
attr_reader :protocol #: Protocol
|
|
15
|
-
|
|
16
|
-
# @rbs (bytes: Array[Integer]) -> void
|
|
17
|
-
def initialize(bytes:)
|
|
18
|
-
raise ArgumentError, "bytes must be #{size} bytes" unless bytes.size >= size
|
|
19
|
-
|
|
20
|
-
@bytes = bytes
|
|
21
|
-
end
|
|
22
|
-
|
|
23
|
-
# @rbs () -> Redhound::L3::Ipv4
|
|
24
|
-
def generate
|
|
25
|
-
@version = @bytes[0]
|
|
26
|
-
@ihl = @bytes[0]
|
|
27
|
-
@tos = @bytes[1]
|
|
28
|
-
@tot_len = @bytes[2..3]
|
|
29
|
-
@id = @bytes[4..5]
|
|
30
|
-
@frag_off = @bytes[6..7]
|
|
31
|
-
@ttl = @bytes[8]
|
|
32
|
-
@protocol = Protocol.new(protocol: @bytes[9])
|
|
33
|
-
@check = @bytes[10..11]
|
|
34
|
-
@saddr = @bytes[12..15]
|
|
35
|
-
@daddr = @bytes[16..19]
|
|
36
|
-
self
|
|
37
|
-
end
|
|
38
|
-
|
|
39
|
-
# @rbs () -> Integer
|
|
40
|
-
def size = 20
|
|
41
|
-
|
|
42
|
-
# @rbs () -> String
|
|
43
|
-
def to_s
|
|
44
|
-
" └─ IPv4 Ver: #{version} IHL: #{ihl} TOS: #{@tos} Total Length: #{tot_len} ID: #{id} Offset: #{frag_off} TTL: #{@ttl} Protocol: #{@protocol} Checksum: #{check} Src: #{saddr} Dst: #{daddr}"
|
|
45
|
-
end
|
|
46
|
-
|
|
47
|
-
# @rbs () -> bool
|
|
48
|
-
def supported_protocol?
|
|
49
|
-
@protocol.udp? || @protocol.icmp? # steep:ignore
|
|
50
|
-
end
|
|
51
|
-
|
|
52
|
-
private
|
|
53
|
-
|
|
54
|
-
# @rbs () -> Integer
|
|
55
|
-
def version
|
|
56
|
-
@version & 0xF0
|
|
57
|
-
end
|
|
58
|
-
|
|
59
|
-
# @rbs () -> Integer
|
|
60
|
-
def ihl
|
|
61
|
-
@ihl & 0x0F
|
|
62
|
-
end
|
|
63
|
-
|
|
64
|
-
# @rbs () -> Integer
|
|
65
|
-
def tot_len
|
|
66
|
-
@tot_len.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
67
|
-
end
|
|
68
|
-
|
|
69
|
-
# @rbs () -> Integer
|
|
70
|
-
def id
|
|
71
|
-
@id.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
72
|
-
end
|
|
73
|
-
|
|
74
|
-
# @rbs () -> Integer
|
|
75
|
-
def frag_off
|
|
76
|
-
@frag_off.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16) & 0x1FFF
|
|
77
|
-
end
|
|
78
|
-
|
|
79
|
-
# @rbs () -> Integer
|
|
80
|
-
def check
|
|
81
|
-
@check.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
82
|
-
end
|
|
83
|
-
|
|
84
|
-
# @rbs () -> String
|
|
85
|
-
def saddr
|
|
86
|
-
@saddr.join('.')
|
|
87
|
-
end
|
|
88
|
-
|
|
89
|
-
# @rbs () -> String
|
|
90
|
-
def daddr
|
|
91
|
-
@daddr.join('.')
|
|
92
|
-
end
|
|
93
|
-
end
|
|
94
|
-
end
|
|
95
|
-
end
|
data/lib/redhound/l3/ipv6.rb
DELETED
|
@@ -1,69 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Ipv6 < Base
|
|
7
|
-
class << self
|
|
8
|
-
# @rbs (bytes: Array[Integer]) -> Redhound::L3::Ipv6
|
|
9
|
-
def generate(bytes:)
|
|
10
|
-
new(bytes:).generate
|
|
11
|
-
end
|
|
12
|
-
end
|
|
13
|
-
|
|
14
|
-
attr_reader :protocol #: Protocol
|
|
15
|
-
|
|
16
|
-
# @rbs (bytes: Array[Integer]) -> void
|
|
17
|
-
def initialize(bytes:)
|
|
18
|
-
raise ArgumentError, "bytes must be bigger than #{size} bytes" unless bytes.size >= size
|
|
19
|
-
|
|
20
|
-
@bytes = bytes
|
|
21
|
-
end
|
|
22
|
-
|
|
23
|
-
# @rbs () -> Integer
|
|
24
|
-
def size = 40
|
|
25
|
-
|
|
26
|
-
# @rbs () -> Redhound::L3::Ipv6
|
|
27
|
-
def generate
|
|
28
|
-
version_traffic_flow = @bytes[0..3].join.to_i(16)
|
|
29
|
-
@version = (version_traffic_flow >> 28) & 0xF
|
|
30
|
-
@traffic_class = (version_traffic_flow >> 20) & 0xFF
|
|
31
|
-
@flow_label = version_traffic_flow & 0xFFFFF
|
|
32
|
-
@payload_length = @bytes[4..5]
|
|
33
|
-
@next_header = @bytes[6]
|
|
34
|
-
@hop_limit = @bytes[7]
|
|
35
|
-
@saddr = @bytes[8..23]
|
|
36
|
-
@daddr = @bytes[24..39]
|
|
37
|
-
@protocol = Protocol.new(protocol: @next_header)
|
|
38
|
-
self
|
|
39
|
-
end
|
|
40
|
-
|
|
41
|
-
# @rbs () -> String
|
|
42
|
-
def to_s
|
|
43
|
-
" └─ IPv6 Ver: #{@version} Traffic Class: #{@traffic_class} Flow Label: #{@flow_label} Payload Length: #{payload_length} Next Header: #{@protocol} Hop Limit: #{@hop_limit} Src: #{saddr} Dst: #{daddr}"
|
|
44
|
-
end
|
|
45
|
-
|
|
46
|
-
# @rbs () -> bool
|
|
47
|
-
def supported_protocol?
|
|
48
|
-
@protocol.udp? # steep:ignore
|
|
49
|
-
end
|
|
50
|
-
|
|
51
|
-
private
|
|
52
|
-
|
|
53
|
-
# @rbs () -> Integer
|
|
54
|
-
def payload_length
|
|
55
|
-
@payload_length.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
|
|
56
|
-
end
|
|
57
|
-
|
|
58
|
-
# @rbs () -> Integer
|
|
59
|
-
def saddr
|
|
60
|
-
@saddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
61
|
-
end
|
|
62
|
-
|
|
63
|
-
# @rbs () -> Integer
|
|
64
|
-
def daddr
|
|
65
|
-
@daddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
|
|
66
|
-
end
|
|
67
|
-
end
|
|
68
|
-
end
|
|
69
|
-
end
|
data/lib/redhound/l3/protocol.rb
DELETED
|
@@ -1,173 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Protocol
|
|
7
|
-
# refs: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml#protocol-numbers-1
|
|
8
|
-
PROTO_TABLE = {
|
|
9
|
-
0 => 'HOPOPT',
|
|
10
|
-
1 => 'ICMP',
|
|
11
|
-
2 => 'IGMP',
|
|
12
|
-
3 => 'GGP',
|
|
13
|
-
4 => 'IP-in-IP',
|
|
14
|
-
5 => 'ST',
|
|
15
|
-
6 => 'TCP',
|
|
16
|
-
7 => 'CBT',
|
|
17
|
-
8 => 'EGP',
|
|
18
|
-
9 => 'IGP',
|
|
19
|
-
10 => 'BBN-RCC-MON',
|
|
20
|
-
11 => 'NVP-II',
|
|
21
|
-
12 => 'PUP',
|
|
22
|
-
13 => 'ARGUS',
|
|
23
|
-
14 => 'EMCON',
|
|
24
|
-
15 => 'XNET',
|
|
25
|
-
16 => 'CHAOS',
|
|
26
|
-
17 => 'UDP',
|
|
27
|
-
18 => 'MUX',
|
|
28
|
-
19 => 'DCN-MEAS',
|
|
29
|
-
20 => 'HMP',
|
|
30
|
-
21 => 'PRM',
|
|
31
|
-
22 => 'XNS-IDP',
|
|
32
|
-
23 => 'TRUNK-1',
|
|
33
|
-
24 => 'TRUNK-2',
|
|
34
|
-
25 => 'LEAF-1',
|
|
35
|
-
26 => 'LEAF-2',
|
|
36
|
-
27 => 'RDP',
|
|
37
|
-
28 => 'IRTP',
|
|
38
|
-
29 => 'ISO-TP4',
|
|
39
|
-
30 => 'NETBLT',
|
|
40
|
-
31 => 'MFE-NSP',
|
|
41
|
-
32 => 'MERIT-INP',
|
|
42
|
-
33 => 'DCCP',
|
|
43
|
-
34 => '3PC',
|
|
44
|
-
35 => 'IDPR',
|
|
45
|
-
36 => 'XTP',
|
|
46
|
-
37 => 'DDP',
|
|
47
|
-
38 => 'IDPR-CMTP',
|
|
48
|
-
39 => 'TP++',
|
|
49
|
-
40 => 'IL',
|
|
50
|
-
41 => 'IPv6',
|
|
51
|
-
42 => 'SDRP',
|
|
52
|
-
43 => 'IPv6-Route',
|
|
53
|
-
44 => 'IPv6-Frag',
|
|
54
|
-
45 => 'IDRP',
|
|
55
|
-
46 => 'RSVP',
|
|
56
|
-
47 => 'GRE',
|
|
57
|
-
48 => 'DSR',
|
|
58
|
-
49 => 'BNA',
|
|
59
|
-
50 => 'ESP',
|
|
60
|
-
51 => 'AH',
|
|
61
|
-
52 => 'I-NLSP',
|
|
62
|
-
53 => 'SWIPE',
|
|
63
|
-
54 => 'NARP',
|
|
64
|
-
55 => 'MOBILE',
|
|
65
|
-
56 => 'TLSP',
|
|
66
|
-
57 => 'SKIP',
|
|
67
|
-
58 => 'IPv6-ICMP',
|
|
68
|
-
59 => 'IPv6-NoNxt',
|
|
69
|
-
60 => 'IPv6-Opts',
|
|
70
|
-
61 => 'Any host internal protocol',
|
|
71
|
-
62 => 'CFTP',
|
|
72
|
-
63 => 'Any local network',
|
|
73
|
-
64 => 'SAT-EXPAK',
|
|
74
|
-
65 => 'KRYPTOLAN',
|
|
75
|
-
66 => 'RVD',
|
|
76
|
-
67 => 'IPPC',
|
|
77
|
-
68 => 'Any distributed file system',
|
|
78
|
-
69 => 'SAT-MON',
|
|
79
|
-
70 => 'VISA',
|
|
80
|
-
71 => 'IPCV',
|
|
81
|
-
72 => 'CPNX',
|
|
82
|
-
73 => 'CPHB',
|
|
83
|
-
74 => 'WSN',
|
|
84
|
-
75 => 'PVP',
|
|
85
|
-
76 => 'BR-SAT-MON',
|
|
86
|
-
77 => 'SUN-ND',
|
|
87
|
-
78 => 'WB-MON',
|
|
88
|
-
79 => 'WB-EXPAK',
|
|
89
|
-
80 => 'ISO-IP',
|
|
90
|
-
81 => 'VMTP',
|
|
91
|
-
82 => 'SECURE-VMTP',
|
|
92
|
-
83 => 'VINES',
|
|
93
|
-
84 => 'TTP',
|
|
94
|
-
85 => 'NSFNET-IGP',
|
|
95
|
-
86 => 'DGP',
|
|
96
|
-
87 => 'TCF',
|
|
97
|
-
88 => 'EIGRP',
|
|
98
|
-
89 => 'OSPFIGP',
|
|
99
|
-
90 => 'Sprite-RPC',
|
|
100
|
-
91 => 'LARP',
|
|
101
|
-
92 => 'MTP',
|
|
102
|
-
93 => 'AX.25',
|
|
103
|
-
94 => 'IPIP',
|
|
104
|
-
95 => 'MICP',
|
|
105
|
-
96 => 'SCC-SP',
|
|
106
|
-
97 => 'ETHERIP',
|
|
107
|
-
98 => 'ENCAP',
|
|
108
|
-
99 => 'Any private encryption scheme',
|
|
109
|
-
100 => 'GMTP',
|
|
110
|
-
101 => 'IFMP',
|
|
111
|
-
102 => 'PNNI',
|
|
112
|
-
103 => 'PIM',
|
|
113
|
-
104 => 'ARIS',
|
|
114
|
-
105 => 'SCPS',
|
|
115
|
-
106 => 'QNX',
|
|
116
|
-
107 => 'A/N',
|
|
117
|
-
108 => 'IPComp',
|
|
118
|
-
109 => 'SNP',
|
|
119
|
-
110 => 'Compaq-Peer',
|
|
120
|
-
111 => 'IPX-in-IP',
|
|
121
|
-
112 => 'VRRP',
|
|
122
|
-
113 => 'PGM',
|
|
123
|
-
114 => 'Any 0-hop protocol',
|
|
124
|
-
115 => 'L2TP',
|
|
125
|
-
116 => 'DDX',
|
|
126
|
-
117 => 'IATP',
|
|
127
|
-
118 => 'STP',
|
|
128
|
-
119 => 'SRP',
|
|
129
|
-
120 => 'UTI',
|
|
130
|
-
121 => 'SMP',
|
|
131
|
-
122 => 'SM',
|
|
132
|
-
123 => 'PTP',
|
|
133
|
-
124 => 'IS-IS over IPv4',
|
|
134
|
-
125 => 'FIRE',
|
|
135
|
-
126 => 'CRTP',
|
|
136
|
-
127 => 'CRUDP',
|
|
137
|
-
128 => 'SSCOPMCE',
|
|
138
|
-
129 => 'IPLT',
|
|
139
|
-
130 => 'SPS',
|
|
140
|
-
131 => 'PIPE',
|
|
141
|
-
132 => 'SCTP',
|
|
142
|
-
133 => 'FC',
|
|
143
|
-
134 => 'RSVP-E2E-IGNORE',
|
|
144
|
-
135 => 'Mobility Header',
|
|
145
|
-
136 => 'UDPLite',
|
|
146
|
-
137 => 'MPLS-in-IP',
|
|
147
|
-
138 => 'manet',
|
|
148
|
-
139 => 'HIP',
|
|
149
|
-
140 => 'Shim6',
|
|
150
|
-
141 => 'WESP',
|
|
151
|
-
142 => 'ROHC',
|
|
152
|
-
255 => 'Reserved'
|
|
153
|
-
}.freeze
|
|
154
|
-
|
|
155
|
-
# @rbs (protocol: Integer) -> void
|
|
156
|
-
def initialize(protocol:)
|
|
157
|
-
@protocol = protocol
|
|
158
|
-
end
|
|
159
|
-
|
|
160
|
-
# @rbs () -> String
|
|
161
|
-
def to_s
|
|
162
|
-
PROTO_TABLE[@protocol] || 'Unknown'
|
|
163
|
-
end
|
|
164
|
-
|
|
165
|
-
PROTO_TABLE.each do |code, name|
|
|
166
|
-
method_name = name.downcase.gsub(/[ \-]/, '_') + '?'
|
|
167
|
-
define_method(method_name) do
|
|
168
|
-
@protocol == code
|
|
169
|
-
end
|
|
170
|
-
end
|
|
171
|
-
end
|
|
172
|
-
end
|
|
173
|
-
end
|
data/lib/redhound/l3/resolver.rb
DELETED
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L3
|
|
6
|
-
class Resolver
|
|
7
|
-
# @rbs (bytes: Array[Integer], l2: Redhound::L2::Ether) -> Redhound::L3::Base?
|
|
8
|
-
def self.resolve(bytes:, l2:)
|
|
9
|
-
new(bytes:, l2:).resolve
|
|
10
|
-
end
|
|
11
|
-
|
|
12
|
-
# @rbs (bytes: Array[Integer], l2: Redhound::L2::Ether) -> void
|
|
13
|
-
def initialize(bytes:, l2:)
|
|
14
|
-
@bytes = bytes
|
|
15
|
-
@l2 = l2
|
|
16
|
-
end
|
|
17
|
-
|
|
18
|
-
# @rbs () -> Redhound::L3::Base?
|
|
19
|
-
def resolve
|
|
20
|
-
if @l2.type.ipv4?
|
|
21
|
-
Ipv4.generate(bytes: @bytes)
|
|
22
|
-
elsif @l2.type.ipv6?
|
|
23
|
-
Ipv6.generate(bytes: @bytes)
|
|
24
|
-
elsif @l2.type.arp?
|
|
25
|
-
Arp.generate(bytes: @bytes)
|
|
26
|
-
end
|
|
27
|
-
end
|
|
28
|
-
end
|
|
29
|
-
end
|
|
30
|
-
end
|
data/lib/redhound/l3.rb
DELETED
data/lib/redhound/l4/base.rb
DELETED
|
@@ -1,31 +0,0 @@
|
|
|
1
|
-
# rbs_inline: enabled
|
|
2
|
-
# frozen_string_literal: true
|
|
3
|
-
|
|
4
|
-
module Redhound
|
|
5
|
-
class L4
|
|
6
|
-
class Base
|
|
7
|
-
class << self
|
|
8
|
-
# @rbs (bytes: Array[Integer]) -> Redhound::L4::Base
|
|
9
|
-
def generate(bytes:)
|
|
10
|
-
new(bytes:).generate
|
|
11
|
-
end
|
|
12
|
-
end
|
|
13
|
-
|
|
14
|
-
# @rbs (bytes: Array[Integer]) -> void
|
|
15
|
-
def initialize(bytes:)
|
|
16
|
-
warn 'initialize method must be implemented'
|
|
17
|
-
end
|
|
18
|
-
|
|
19
|
-
# @rbs () -> Redhound::L4::Base
|
|
20
|
-
def generate
|
|
21
|
-
warn 'generate method must be implemented'
|
|
22
|
-
self
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
# @rbs () -> void
|
|
26
|
-
def dump
|
|
27
|
-
puts self
|
|
28
|
-
end
|
|
29
|
-
end
|
|
30
|
-
end
|
|
31
|
-
end
|