woolen_common 0.0.1

data/lib/woolen_common/pcap/mu/fixnum_ext.rb

@@ -0,0 +1,8 @@
+# -*- encoding : utf-8 -*-
+if RUBY_VERSION == '1.8.6'
+    class Fixnum
+        def ord
+            self
+        end
+    end
+end

data/lib/woolen_common/pcap/mu/pcap/ethernet.rb

@@ -0,0 +1,164 @@
+# -*- encoding : utf-8 -*-
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+module Mu
+    class Pcap
+
+        class Ethernet < Packet
+            attr_accessor :src, :dst, :type
+
+            ETHERTYPE_IP = 0x0800
+            ETHERTYPE_IP6 = 0x86dd
+            ETHERTYPE_ARP = 0x0806
+            ETHERTYPE_PPPOE_SESSION = 0x8864
+            ETHERTYPE_802_1Q = 0X8100
+
+            PPP_IP = 0x0021
+            PPP_IPV6 = 0x0057
+
+            def initialize src=nil, dst=nil, type=0
+                super()
+                @src = src
+                @dst = dst
+                @type = type
+                @vlan = false
+            end
+
+            attr_accessor :vlan
+
+            def vlan?
+                vlan
+            end
+
+            def flow_id
+                if not @payload or @payload.is_a? String
+                    return [:ethernet, @src, @dst, @type]
+                else
+                    return @payload.flow_id
+                end
+            end
+
+            FMT_MAC = "C6"
+            FMT_n = 'n'
+            MAC_TEMPLATE = '%02x:%02x:%02x:%02x:%02x:%02x'
+
+            def self.from_bytes bytes
+                if bytes.length < 14
+                    raise ParseError, "Truncated Ethernet header: expected 14 bytes, got #{bytes.length} bytes"
+                end
+
+                dst = bytes.slice!(0, 6).unpack FMT_MAC
+                dst = MAC_TEMPLATE % dst
+                src = bytes.slice!(0, 6).unpack FMT_MAC
+                src = MAC_TEMPLATE % src
+                type = bytes.slice!(0, 2).unpack(FMT_n)[0]
+                if type == ETHERTYPE_802_1Q
+                    @vlan = true
+                else
+                    @vlan = false
+                end
+                while (type == ETHERTYPE_802_1Q)
+                    # Skip 4 bytes for 802.1q vlan tag field
+                    bytes.slice!(0, 2)
+                    type = bytes.slice!(0, 2).unpack(FMT_n)[0]
+                end
+                ethernet = Ethernet.new src, dst, type
+                ethernet.vlan = @vlan
+                ethernet.payload = bytes
+                ethernet.payload_raw = bytes
+                begin
+                    case type
+                        when ETHERTYPE_IP
+                            ethernet.payload = IPv4.from_bytes bytes
+                        when ETHERTYPE_IP6
+                            ethernet.payload = IPv6.from_bytes bytes
+                        when ETHERTYPE_PPPOE_SESSION
+                            # Remove PPPoE/PPP session layer
+                            ethernet.payload = bytes
+                            ethernet.remove_pppoe!
+                        else
+                            ethernet.payload = bytes
+                    end
+                rescue ParseError => e
+                    Pcap.warning e
+                end
+                return ethernet
+            end
+
+            def ip?
+                return payload.is_a?(IP)
+            end
+
+            ADDR_TO_BYTES = {}
+            FMT_HEADER = 'a6a6n'
+
+            def write io
+                dst_mac = ADDR_TO_BYTES[@dst] ||= @dst.split(':').inject('') { |m, b| m << b.to_i(16).chr }
+                src_mac = ADDR_TO_BYTES[@src] ||= @src.split(':').inject('') { |m, b| m << b.to_i(16).chr }
+                bytes = [dst_mac, src_mac, @type].pack(FMT_HEADER)
+                io.write bytes
+                if @payload.is_a? String
+                    io.write @payload
+                else
+                    @payload.write io
+                end
+            end
+
+            # Remove the PPPoE and PPP headers.  PPPoE is documented in RFC 2516.
+            def remove_pppoe!
+                bytes = self.payload_raw
+
+                # Remove PPPoE header
+                Pcap.assert bytes.length >= 6, 'Truncated PPPoE header: ' +
+                    "expected at least 6 bytes, got #{bytes.length} bytes"
+                version_type, code, session_id, length = bytes.unpack 'CCnn'
+                version = version_type >> 4 & 0b1111
+                type = version_type & 0b1111
+                Pcap.assert version == 1, "Unknown PPPoE version: #{version}"
+                Pcap.assert type == 1, "Unknown PPPoE type: #{type}"
+                Pcap.assert code == 0, "Unknown PPPoE code: #{code}"
+                bytes = bytes[6..-1]
+                Pcap.assert bytes.length >= length, 'Truncated PPoE packet: ' +
+                    "expected #{length} bytes, got #{bytes.length} bytes"
+
+                # Remove PPP header
+                Pcap.assert bytes.length >= 2, 'Truncated PPP packet: ' +
+                    "expected at least bytes, got #{bytes.length} bytes"
+                protocol_id, = bytes.unpack 'n'
+                bytes = bytes[2..-1]
+                case protocol_id
+                    when PPP_IP
+                        self.payload = IPv4.from_bytes bytes
+                        self.payload_raw = bytes
+                        self.type = ETHERTYPE_IP
+                    when PPP_IPV6
+                        self.payload = IPv6.from_bytes bytes
+                        self.payload_raw = bytes
+                        self.type = ETHERTYPE_IP6
+                    else
+                        # Failed.  Don't update payload or type.
+                        raise ParseError, "Unknown PPP protocol: 0x#{'%04x' % protocol_id}"
+                end
+            end
+
+            def to_s
+                if @payload.is_a? String
+                    payload = @payload.inspect
+                else
+                    payload = @payload.to_s
+                end
+                return "ethernet(%s, %s, %d, %s)" % [@src, @dst, @type, payload]
+            end
+
+            def == other
+                return super &&
+                    self.src == other.src &&
+                    self.dst == other.dst &&
+                    self.type == other.type
+            end
+        end
+
+    end
+end

data/lib/woolen_common/pcap/mu/pcap/header.rb

@@ -0,0 +1,76 @@
+# -*- encoding : utf-8 -*-
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+module Mu
+    class Pcap
+
+        class Header
+            attr_accessor :magic, :version_major, :version_minor, :thiszone, :sigfigs,
+                          :snaplen, :linktype
+
+            BIG_ENDIAN_FORMAT = 'nnNNNN'
+            LITTLE_ENDIAN_FORMAT = 'vvVVVV'
+
+            UNSUPPORTED_FORMATS = {
+                0x474D4255 => "NetMon", # "GMBU"
+                0x5452534E => "NA Sniffer (DOS)" # Starts with "TRSNIFF data"
+            }
+
+            def initialize
+                @magic = BIG_ENDIAN
+                @version_major = 2
+                @version_minor = 4
+                @thiszone = 0
+                @sigfigs = 0
+                @snaplen = 1500
+                @linktype = DLT_NULL
+            end
+
+            def self.read ios
+                header = Header.new
+                bytes = ios.read 24
+                Pcap.assert bytes, 'PCAP header missing'
+                Pcap.assert bytes.length == 24, 'Truncated PCAP header: ' +
+                    "expected 24 bytes, got #{bytes.length} bytes"
+                header.magic, _ = bytes[0, 4].unpack 'N'
+                if header.magic == BIG_ENDIAN
+                    format = BIG_ENDIAN_FORMAT
+                elsif header.magic == LITTLE_ENDIAN
+                    format = LITTLE_ENDIAN_FORMAT
+                else
+                    format = UNSUPPORTED_FORMATS[header.magic]
+                    if format.nil?
+                        err = "Unsupported packet capture format. "
+                    else
+                        err = "#{format} capture files are not supported. "
+                    end
+                    raise ParseError, err
+                end
+                header.version_major, header.version_minor, header.thiszone,
+                    header.sigfigs, header.snaplen, header.linktype =
+                    bytes[4..-1].unpack format
+                return header
+            end
+
+            def write io
+                bytes = [BIG_ENDIAN, @version_major, @version_minor, @thiszone,
+                         @sigfigs, @snaplen, DLT_EN10MB].pack('N' + BIG_ENDIAN_FORMAT)
+                io.write bytes
+            end
+
+            def == other
+                return self.class == other.class &&
+                    self.magic == other.magic &&
+                    self.version_major == other.version_major &&
+                    self.version_minor == other.version_minor &&
+                    self.thiszone == other.thiszone &&
+                    self.sigfigs == other.sigfigs &&
+                    self.snaplen == other.snaplen &&
+                    self.linktype == other.linktype
+            end
+        end
+
+    end
+end

data/lib/woolen_common/pcap/mu/pcap/io_pair.rb

@@ -0,0 +1,68 @@
+# -*- encoding : utf-8 -*-
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+module Mu
+    class Pcap
+
+# For emulating of a pair of connected sockets. Bytes written 
+# with #write to one side are returned by a subsequent #read on 
+# the other side.
+#
+# Use Pair.stream_pair to get a pair with stream semantics.
+# Use Pair.packet_pair to get a pair with packet semantics.
+        class IOPair
+            attr_reader :read_queue
+            attr_accessor :other
+
+            def initialize
+                raise NotImplementedError
+            end
+
+            def self.stream_pair
+                io1 = Stream.new
+                io2 = Stream.new
+                io1.other = io2
+                io2.other = io1
+                return io1, io2
+            end
+
+            def self.packet_pair
+                io1 = Packet.new
+                io2 = Packet.new
+                io1.other = io2
+                io2.other = io1
+                return io1, io2
+            end
+
+            def write bytes
+                @other.read_queue << bytes
+                bytes.size
+            end
+
+            class Stream < IOPair
+                def initialize
+                    @read_queue = ""
+                end
+
+                def read n=nil
+                    n ||= @read_queue.size
+                    @read_queue.slice!(0, n)
+                end
+            end
+
+            class Packet < IOPair
+                def initialize
+                    @read_queue = []
+                end
+
+                def read
+                    @read_queue.shift
+                end
+            end
+
+        end
+    end
+end
+

data/lib/woolen_common/pcap/mu/pcap/io_wrapper.rb

@@ -0,0 +1,77 @@
+# -*- encoding : utf-8 -*-
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+require 'mu/pcap/io_pair'
+
+module Mu
+    class Pcap
+        class IOWrapper
+            attr_reader :ios, :unread, :state
+
+            def initialize ios, reader
+                @ios = ios
+                @reader = reader
+                # parse state for reader
+                @state = {}
+                # read off of underlying io but not yet processed by @reader
+                @unread = ""
+            end
+
+            # Impose upper limit to protect against memory exhaustion.
+            MAX_RECEIVE_SIZE = 1048576 # 1MB
+
+            # Returns next higher level protocol message.
+            def read
+                until message = @reader.read_message!(@unread, @state)
+                    bytes = @ios.read
+                    if bytes and not bytes.empty?
+                        @unread << bytes
+                    else
+                        return nil
+                    end
+                    if @unread.size > MAX_RECEIVE_SIZE
+                        raise "Maximum message size (#{MAX_RECEIVE_SIZE}) exceeded"
+                    end
+                end
+
+                return message
+            end
+
+            # Parser may need to see requests to understand responses.
+            def record_write bytes
+                @reader.record_write bytes, @state
+            end
+
+            def write bytes, *args
+                w = @ios.write bytes, *args
+                record_write bytes
+                w
+            end
+
+            def write_to bytes, *args
+                w = @ios.write_to bytes, *args
+                record_write bytes
+                w
+            end
+
+            def open
+                if block_given?
+                    @ios.open { yield }
+                else
+                    @ios.open
+                end
+            end
+
+            def open?
+                @ios.open?
+            end
+
+            def close
+                @ios.close
+            end
+
+        end
+    end
+end

data/lib/woolen_common/pcap/mu/pcap/ip.rb

@@ -0,0 +1,62 @@
+# -*- encoding : utf-8 -*-
+# http://www.mudynamics.com
+# http://labs.mudynamics.com
+# http://www.pcapr.net
+
+module Mu
+    class Pcap
+
+        class IP < Packet
+            IPPROTO_TCP = 6
+            IPPROTO_UDP = 17
+            IPPROTO_HOPOPTS = 0
+            IPPROTO_ROUTING = 43
+            IPPROTO_FRAGMENT = 44
+            IPPROTO_AH = 51
+            IPPROTO_NONE = 59
+            IPPROTO_DSTOPTS = 60
+            IPPROTO_SCTP = 132
+
+            attr_accessor :src, :dst
+
+            def initialize src=nil, dst=nil
+                super()
+                @src = src
+                @dst = dst
+            end
+
+            def v4?
+                return false
+            end
+
+            def v6?
+                return false
+            end
+
+            def proto
+                raise NotImplementedError
+            end
+
+            def pseudo_header payload_length
+                raise NotImplementedError
+            end
+
+            def == other
+                return super &&
+                    self.src == other.src &&
+                    self.dst == other.dst
+            end
+
+            def self.checksum bytes
+                if bytes.size & 1 == 1
+                    bytes = bytes + "\0"
+                end
+                sum = 0
+                bytes.unpack("n*").each { |n| sum += n }
+                sum = (sum & 0xffff) + (sum >> 16 & 0xffff)
+                ~sum & 0xffff
+            end
+        end
+
+    end
+end