vanken 0.1.0

data/lib/vanken/ui/selection.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Vanken
+  module UI
+    module Selection
+      def select_packet(number)
+        doc = document
+        return unless doc && number.is_a?(Integer) && number.between?(1, doc.count)
+        @selection_generation += 1
+        generation = @selection_generation
+        @app.executor.background do
+          nodes = doc.details(number)
+          bytes = doc.store.read(number).bytes
+          @app.executor.post do
+            next unless generation == @selection_generation && document.equal?(doc)
+            update { |state| state.merge!(number: number, node: nil, details: nodes, bytes: bytes) }
+            @tree.replace(nodes)
+            @hex.bytes = bytes
+          end
+        rescue StandardError => error
+          @app.executor.post { show_error(error) if generation == @selection_generation }
+        end
+      end
+      def select_detail(node)
+        return unless node.is_a?(Core::DetailNode)
+        update { |state| state[:node] = node }
+        @hex.highlights = if node.source == :frame && node.offset && node.length.positive?
+          finish = [node.offset + node.length, selected_bytes.bytesize].min
+          layer = detail_nodes.drop(1).find { |item| item.source == :frame && item.children.any? && item.descendants.include?(node) }
+          highlights = []
+          if layer&.offset && layer.length.positive?
+            highlights << {range: layer.offset...[layer.offset + layer.length, selected_bytes.bytesize].min, tone: :secondary}
+          end
+          highlights << {range: node.offset...finish, tone: :primary} if finish > node.offset
+          highlights
+        else
+          []
+        end
+        @hex.scroll_to_offset(node.offset) if node.offset && node.offset < selected_bytes.bytesize && node.source == :frame
+      end
+      def select_bytes(range)
+        matches = detail_nodes.flat_map(&:descendants).select { |node| node.source == :frame && node.offset && node.length.positive? && range.begin.between?(node.offset, node.offset + node.length - 1) }
+        node = matches.min_by { |item| [item.length, item.field ? 0 : 1] }
+        return unless node
+        select_detail(node)
+        parent = detail_nodes.find { |item| item.descendants.include?(node) }
+        @tree.expand(parent.id) if parent
+        @tree.select_id(node.id)
+      end
+      def navigate(delta)
+        return unless document && document.displayed_count.positive?
+        current = document.display_numbers.index(selected_number) || 0
+        index = (current + delta).clamp(0, document.displayed_count - 1)
+        @table.select(index)
+        @table.scroll_to(index, align: :nearest)
+      end
+      def first_packet
+        return unless document&.displayed_count&.positive?
+        @table.select(0)
+        @table.scroll_to(0)
+      end
+      def last_packet
+        return unless document&.displayed_count&.positive?
+        @table.select(document.displayed_count - 1)
+        @table.scroll_to(document.displayed_count - 1)
+      end
+      def go_to_packet
+        path_dialog("パケットへ移動") do |value|
+          number = Integer(value, 10)
+          index = document&.display_numbers&.index(number)
+          raise Vanken::Error, "指定したパケットは表示されていません" unless index
+          @table.select(index)
+          @table.scroll_to(index, align: :center)
+          dismiss_dialog
+        end
+      end
+      def copy_bytes(format = :hex)
+        range = @hex.selection || (0...selected_bytes.bytesize)
+        range = 0...selected_bytes.bytesize if range.size.zero?
+        bytes = selected_bytes.byteslice(range) || "".b
+        text = case format
+        when :text then bytes.dup.force_encoding(Encoding::UTF_8).scrub
+        when :escaped then bytes.bytes.map { |byte| byte.between?(32, 126) && ![34, 92].include?(byte) ? byte.chr : Kernel.format("\\x%02x", byte) }.join
+        when :dump then bytes.bytes.each_slice(16).with_index.map { |row, index| Kernel.format("%04x  %s", range.begin + (index * 16), row.map { |byte| Kernel.format("%02x", byte) }.join(" ")) }.join("\n")
+        else bytes.unpack1("H*").scan(/../).join(" ")
+        end
+        copy_text(text)
+      end
+    end
+  end
+end

data/lib/vanken/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Vanken
+  VERSION = "0.1.0"
+end

data/lib/vanken.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative "vanken/version"
+
+require_relative "vanken/errors"
+
+require "time"
+require_relative "vanken/core/frame"
+require_relative "vanken/core/frame_store"
+require_relative "vanken/core/stores"
+require_relative "vanken/config/preferences"
+require_relative "vanken/gateway/dissector"
+require_relative "vanken/gateway/file_reader"
+require_relative "vanken/gateway/file_writer"
+require_relative "vanken/gateway/detail_builder"
+require_relative "vanken/app/document"
+require_relative "vanken/cli"

data/packaging/README.md

@@ -0,0 +1,33 @@
+# Live capture permissions
+
+The application runs as your normal user. The capture helper opens the capture device, drops supplementary groups and both real and effective group/user IDs, and writes pcapng to stdout. The interpreter, helper, libraries, gems, and every parent directory of the privileged wrapper must be owned by root and must not be writable by group or other users.
+
+On macOS, grant the intended capture group access to `/dev/bpf*` using an administrator-managed startup configuration. Once `vanken-capture --check --interface lo0` reports `"direct":true`, Vanken can capture without sudo. Device permissions may need to be restored after a reboot.
+
+For Linux, an administrator can install an isolated Ruby runtime and the required redhound gem under a root-owned prefix, copy `lib/` and `exe/vanken-capture` into `/usr/local/libexec/vanken/`, and install this fixed-path wrapper. Replace the runtime and gem paths below with the actual root-owned installation paths:
+
+```sh
+#!/bin/sh
+exec /usr/bin/env -i PATH=/usr/bin:/bin \
+  GEM_HOME=/opt/vanken-ruby/gems GEM_PATH=/opt/vanken-ruby/gems \
+  /opt/vanken-ruby/bin/ruby -I /usr/local/libexec/vanken/lib \
+  /usr/local/libexec/vanken/helper "$@"
+```
+
+Save it as `/usr/local/libexec/vanken/vanken-capture`, owned by root with mode `0755`. The executable saved as `helper` is the packaged `exe/vanken-capture`; `lib/` is the packaged Ruby library directory. Install redhound `2.0.0.rc2` and the runtime's standard-library gems in the isolated gem directory. Keep this tree separate from development checkouts, user gem homes, rbenv installations owned by users, and plugins.
+
+An administrator may grant a dedicated capture group access through sudoers:
+
+```sudoers
+%vanken ALL=(root) NOPASSWD: /usr/local/libexec/vanken/vanken-capture
+```
+
+Validate the rule with `visudo`. Members of this group can capture network traffic. Vanken supplies `--drop-to UID:GID` for the invoking user and only invokes the fixed wrapper through sudo or pkexec. A polkit policy must likewise allow that fixed path; an optional askpass helper must meet the same ownership requirements. Vanken rejects elevation of a development checkout and does not grant capabilities to a general-purpose Ruby interpreter.
+
+`vanken-capture --list-interfaces` lists interfaces without elevated privileges. `vanken-capture --check --interface IF` checks direct device access. A helper invoked manually with sudo needs `--drop-to` because the wrapper clears the environment:
+
+```sh
+sudo /usr/local/libexec/vanken/vanken-capture -i eth0 --drop-to "$(id -u):$(id -g)" > capture.pcapng
+```
+
+For the isolated Linux integration check, run `script/capture-ci.sh` with Docker available. It creates a disposable privileged container, installs root-owned Ruby/gems and the fixed helper wrapper, creates the `vanken-test` namespace and a veth pair, then runs the tests as an unprivileged user. The tests verify UID dropping, packet capture, statistics, and clean shutdown. The nightly `Live capture` workflow runs this same command.

data/sig/generated/vanken/app/capture_controller.rbs

@@ -0,0 +1,58 @@
+# Generated from lib/vanken/app/capture_controller.rb with RBS::Inline
+
+module Vanken
+  module App
+    class CaptureController
+      class Error < Vanken::CaptureError
+        attr_reader code: untyped
+
+        def initialize: (untyped message, ?code: untyped) -> untyped
+      end
+
+      def initialize: (?launcher: untyped, ?preferences: untyped, ?on_update: untyped, ?on_document: untyped) -> untyped
+
+      def state: () -> untyped
+
+      def stats: () -> untyped
+
+      def error: () -> untyped
+
+      def warning: () -> untyped
+
+      def document: () -> untyped
+
+      def options: () -> untyped
+
+      def capturing?: () -> untyped
+
+      def running?: () -> untyped
+
+      def snapshot: () -> untyped
+
+      def start: (untyped options) -> untyped
+
+      def stop: () -> untyped
+
+      def wait: (?untyped timeout, **untyped options) -> untyped
+
+      alias await wait
+
+      def close: () -> untyped
+
+      private
+
+      def run: () -> untyped
+
+      def consume_control: (untyped io) -> untyped
+
+      # Called under @mutex; the helper stop runs separately so UI callbacks never wait for it.
+      def stop_helper: () -> untyped
+
+      def fail_capture: (untyped error, ?replace: untyped) -> untyped
+
+      def thread: () ?{ (?) -> untyped } -> untyped
+
+      def notify: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/document.rbs

@@ -0,0 +1,117 @@
+# Generated from lib/vanken/app/document.rb with RBS::Inline
+
+module Vanken
+  module App
+    class Document
+      include DocumentJobs
+
+      attr_reader store: untyped
+
+      attr_reader columns: untyped
+
+      attr_reader annotations: untyped
+
+      attr_reader error: untyped
+
+      attr_reader path: untyped
+
+      attr_reader source: untyped
+
+      attr_reader progress: untyped
+
+      attr_reader filter: untyped
+
+      attr_reader marked: untyped
+
+      attr_reader ignored: untyped
+
+      attr_reader time_references: untyped
+
+      attr_reader catalog: untyped
+
+      attr_reader analysis_options: untyped
+
+      attr_accessor frame_latency: untyped
+
+      attr_accessor scanner: untyped
+
+      def initialize: (?on_update: untyped, ?preferences: untyped, ?store: untyped, ?scanner: untyped, ?process_analysis: untyped) -> untyped
+
+      def open: (untyped path) -> untyped
+
+      def ingest: (untyped source, ?live: untyped) -> untyped
+
+      def count: () -> untyped
+
+      def displayed_count: () -> untyped
+
+      def number_at: (untyped index) -> untyped
+
+      def display_numbers: () -> untyped
+
+      def dirty?: () -> untyped
+
+      def loading?: () -> untyped
+
+      def cancelled?: () -> untyped
+
+      def received?: () -> untyped
+
+      def complete?: () -> untyped
+
+      def closing?: () -> untyped
+
+      def stream_frames: (untyped stream) -> untyped
+
+      def packet: (untyped number) -> untyped
+
+      # @rbs (Integer number) -> Gateway::PacketSnapshot?
+      def packet_snapshot: (Integer number) -> Gateway::PacketSnapshot?
+
+      def view: (untyped number, ?packet: untyped, ?snapshot: untyped) -> untyped
+
+      def row: (untyped number) -> untyped
+
+      def details: (untyped number) -> untyped
+
+      def publish: (untyped number, untyped packet) -> untyped
+
+      def publish_failure: (untyped number, untyped error) -> untyped
+
+      # Only immutable context for this unpublished range crosses the worker pipe.
+      def analysis_configuration: (untyped first, untyped last) -> untyped
+
+      def publish_analysis_batch: (untyped batch, untyped analyzer, untyped generation, ?context_token: untyped) -> untyped
+
+      def receiving_done: () -> untyped
+
+      def analyzing_done: () -> untyped
+
+      def signal: () -> untyped
+
+      def wait_for_frames: () -> untyped
+
+      def fail: (untyped error) -> untyped
+
+      def time_value: (untyped number, ?untyped format, ?references: untyped) -> untyped
+
+      def cancel: () -> untyped
+
+      def wait: (?untyped timeout) -> untyped
+
+      def close: () -> untyped
+
+      private
+
+      def persisted_summary: (untyped number) -> untyped
+
+      def persisted_details: (untyped number) -> untyped
+
+      def thread: () ?{ (?) -> untyped } -> untyped
+
+      def notify: (?force: untyped) -> untyped
+
+      def restore_nodes: (untyped nodes) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/document_jobs.rbs

@@ -0,0 +1,27 @@
+# Generated from lib/vanken/app/document_jobs.rb with RBS::Inline
+
+module Vanken
+  module App
+    module DocumentJobs
+      def apply_filter: (untyped expression) -> untyped
+
+      def cancel_scan: () -> untyped
+
+      def filter_payload: (untyped first, untyped last, ?expression: untyped, ?snapshot: untyped) -> untyped
+
+      def displayed_predecessor: (untyped number, untyped snapshot) -> untyped
+
+      def sort: (untyped key, ?untyped direction) -> untyped
+
+      def save: (untyped path, ?format: untyped, ?numbers: untyped) -> untyped
+
+      def wait_for_save: (?untyped timeout) -> untyped
+
+      private
+
+      def stale_job?: (untyped generation) -> untyped
+
+      def filter_snapshot: (?displayed_delta: untyped) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/analyzer.rbs

@@ -0,0 +1,11 @@
+# Generated from lib/vanken/capture/analyzer.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class Analyzer
+      def initialize: (untyped document, untyped dissector) -> untyped
+
+      def run: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/analyzer_process.rbs

@@ -0,0 +1,17 @@
+# Generated from lib/vanken/capture/analyzer_process.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class AnalyzerProcess
+      attr_reader pid: untyped
+
+      def initialize: (untyped document, ?verify_checksums: untyped) -> untyped
+
+      def run: () -> untyped
+
+      def request: (untyped value) -> untyped
+
+      def shutdown: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/analyzer_wire.rbs

@@ -0,0 +1,19 @@
+# Generated from lib/vanken/capture/analyzer_wire.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    # These pipes are private to the same-user worker. Marshal.load only receives
+    # protocol messages serialized by our child, never an external serialized object.
+    module AnalyzerWire
+      VERSION: ::Integer
+
+      MAX_BYTES: untyped
+
+      def self.write: (untyped io, untyped value) -> untyped
+
+      def self.read: (untyped io, ?cancelled: untyped) -> untyped
+
+      def self.exact: (untyped io, untyped length, untyped cancelled) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/analyzer_worker.rbs

@@ -0,0 +1,45 @@
+# Generated from lib/vanken/capture/analyzer_worker.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class AnalyzerWorker
+      class Reader
+        attr_accessor limit: untyped
+
+        attr_accessor interfaces: untyped
+
+        def initialize: (untyped directory) -> untyped
+
+        def metadata: (untyped number) -> untyped
+
+        def read: (untyped number) -> untyped
+
+        def close: () -> untyped
+
+        private
+
+        def read_at: (untyped io, untyped size, untyped offset) -> untyped
+      end
+
+      class Context
+        attr_reader store: untyped
+
+        def initialize: (untyped store) -> untyped
+
+        def time_value: (untyped number, untyped _format, references: untyped) -> untyped
+
+        def displayed_predecessor: (untyped number, untyped snapshot) -> untyped
+      end
+
+      def initialize: (untyped request) -> untyped
+
+      def analyze: (untyped request) -> untyped
+
+      def matches: (untyped request) -> untyped
+
+      def close: () -> untyped
+
+      def self.run: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/control_protocol.rbs

@@ -0,0 +1,17 @@
+# Generated from lib/vanken/capture/control_protocol.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class ControlProtocol
+      TYPES: untyped
+
+      MAX_LINE_BYTES: ::Integer
+
+      def initialize: (untyped io) -> untyped
+
+      def write: (untyped type, **untyped fields) -> untyped
+
+      def self.parse: (untyped line) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/filter_worker.rbs

@@ -0,0 +1,51 @@
+# Generated from lib/vanken/capture/filter_worker.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class FilterWorker
+      class Reader
+        attr_reader count: untyped
+
+        def initialize: (untyped directory, untyped annotations_json) -> untyped
+
+        def metadata: (untyped number) -> untyped
+
+        def frame: (untyped number) -> untyped
+
+        def annotation: (untyped number) -> untyped
+
+        def packet_snapshot: (untyped number) -> untyped
+
+        def close: () -> untyped
+
+        private
+
+        def open_file: (untyped path) -> untyped
+
+        def read_exact: (untyped io, untyped length, untyped offset) -> untyped
+      end
+
+      class View
+        def initialize: (untyped reader, untyped number, untyped dissector, untyped context) -> untyped
+
+        def layer?: (untyped name) -> untyped
+
+        def field_type: (untyped name) -> untyped
+
+        def values: (untyped name) -> untyped
+
+        private
+
+        def packet: () -> untyped
+
+        def annotation: () -> untyped
+
+        def delta: (untyped previous) -> untyped
+      end
+
+      def self.call: (untyped payload) -> untyped
+
+      def self.validate: (untyped payload) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/helper_main.rbs

@@ -0,0 +1,23 @@
+# Generated from lib/vanken/capture/helper_main.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class HelperMain
+      def initialize: (?stdin: untyped, ?stdout: untyped, ?stderr: untyped, ?env: untyped) -> untyped
+
+      def run: (untyped argv) -> untyped
+
+      private
+
+      def capture: (untyped options) -> untyped
+
+      def check: (untyped options) -> untyped
+
+      def drop_target: () -> untyped
+
+      def failure: (untyped code, untyped message, untyped exit_code) -> untyped
+
+      def monotonic: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/helper_options.rbs

@@ -0,0 +1,27 @@
+# Generated from lib/vanken/capture/helper_options.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class HelperOptions
+      attr_reader command: untyped
+
+      attr_reader capture: untyped
+
+      attr_reader drop_to: untyped
+
+      attr_reader stats_interval: untyped
+
+      attr_reader flush_interval: untyped
+
+      def self.parse: (untyped argv) -> untyped
+
+      def initialize: () -> untyped
+
+      def parse: (untyped argv) -> untyped
+
+      private
+
+      def bounded: (untyped value, untyped range, untyped name) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/launcher.rbs

@@ -0,0 +1,60 @@
+# Generated from lib/vanken/capture/launcher.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class Launcher
+      class Unavailable < StandardError
+      end
+
+      WRAPPER: ::String
+
+      SAFE_ENV: untyped
+
+      class Handle
+        attr_reader pid: untyped
+
+        attr_reader stdin: untyped
+
+        attr_reader stdout: untyped
+
+        attr_reader stderr: untyped
+
+        attr_reader status: untyped
+
+        def initialize: (untyped pid, untyped stdin, untyped stdout, untyped stderr) -> untyped
+
+        def wait: (?timeout: untyped) -> untyped
+
+        def stop: (?timeout: untyped) -> untyped
+
+        def close: () -> untyped
+
+        private
+
+        def signal: (untyped signal) -> untyped
+
+        def monotonic: () -> untyped
+      end
+
+      def initialize: (?strategy: untyped, ?wrapper: untyped, ?direct_command: untyped, ?askpass: untyped, ?env: untyped) -> untyped
+
+      def launch: (?untyped options, ?strategy: untyped) -> untyped
+
+      def command_for: (untyped strategy, untyped args) -> untyped
+
+      def self.trusted_path?: (untyped path) -> untyped
+
+      private
+
+      def spawn: (untyped command, ?untyped extra_env) -> untyped
+
+      def automatic_strategy: (untyped args) -> untyped
+
+      def trusted_path!: (untyped path) -> untyped
+
+      def executable: (untyped name) -> untyped
+
+      def capture_argv: (untyped options) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/privileges.rbs

@@ -0,0 +1,12 @@
+# Generated from lib/vanken/capture/privileges.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    module Privileges
+      class Error < StandardError
+      end
+
+      def self.drop!: (untyped uid, untyped gid) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/receiver.rbs

@@ -0,0 +1,15 @@
+# Generated from lib/vanken/capture/receiver.rb with RBS::Inline
+
+module Vanken
+  module Capture
+    class Receiver
+      def initialize: (untyped document, untyped source) -> untyped
+
+      def run: () -> untyped
+
+      private
+
+      def each_frame: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/cli.rbs

@@ -0,0 +1,9 @@
+# Generated from lib/vanken/cli.rb with RBS::Inline
+
+module Vanken
+  module CLI
+    def self.start: (untyped argv, ?out: untyped, ?err: untyped) -> untyped
+
+    def self.print_columns: (untyped options, untyped out) -> untyped
+  end
+end

data/sig/generated/vanken/config/log.rbs

@@ -0,0 +1,9 @@
+# Generated from lib/vanken/config/log.rb with RBS::Inline
+
+module Vanken
+  module Config
+    module Log
+      def self.open: (?debug: untyped, ?directory: untyped) -> untyped
+    end
+  end
+end