module PacketFu

Constants

VERSION: Check the repo's for version release histories

Public Class Methods

add_packet_class(klass) click to toggle source

Adds the class to PacketFu's list of packet classes – used in packet parsing.

# File lib/packetfu.rb, line 73
def self.add_packet_class(klass)
  raise "Need a class" unless klass.kind_of? Class
  if klass.name !~ /[A-Za-z0-9]Packet/
    raise "Packet classes should be named 'ProtoPacket'"
  end
  @packet_classes ||= []
  @packet_classes << klass
  self.clear_packet_groups
  @packet_classes.sort_by! { |x| x.name }
end

at_least?(str) click to toggle source

Returns true if the version is equal to or greater than the compare version. If the current version of PacketFu is “0.3.1” for example:

PacketFu.at_least? "0"     # => true 
PacketFu.at_least? "0.2.9" # => true 
PacketFu.at_least? "0.3"   # => true 
PacketFu.at_least? "1"     # => true after 1.0's release
PacketFu.at_least? "1.12"  # => false
PacketFu.at_least? "2"     # => false

# File lib/packetfu/version.rb, line 30
def self.at_least?(str)
  this_version = binarize_version(self.version)
  ask_version = binarize_version(str)
  this_version >= ask_version
end

binarize_version(str) click to toggle source

Returns a version string in a binary format for easy comparisons.

# File lib/packetfu/version.rb, line 12
def self.binarize_version(str)
  if(str.respond_to?(:split) && str =~ /^[0-9]+(\.([0-9]+)(\.[0-9]+)?)?\..+$/)
    bin_major,bin_minor,bin_teeny = str.split(/\x2e/).map {|x| x.to_i}
    bin_version = (bin_major.to_i << 16) + (bin_minor.to_i << 8) + bin_teeny.to_i
  else
    raise ArgumentError, "Compare version malformed. Should be \x22x.y.z\x22"
  end
end

classes() click to toggle source

Returns an array of classes defined in PacketFu

# File lib/packetfu.rb, line 68
def self.classes
  constants.map { |const| const_get(const) if const_get(const).kind_of? Class}.compact
end

clear_packet_groups() click to toggle source

# File lib/packetfu.rb, line 117
def self.clear_packet_groups
  @packet_class_prefixes = nil
  @packet_classes_by_layer = nil
  @packet_classes_by_layer_without_application = nil
end

force_binary(str) click to toggle source

Deal with Ruby's encoding by ignoring it.

# File lib/packetfu.rb, line 29
def self.force_binary(str)
  str.force_encoding Encoding::BINARY if str.respond_to? :force_encoding
end

inspect_style() click to toggle source

The current inspect style. One of :hex, :dissect, or :default Note that :default means Ruby's default, which is usually far too long to be useful.

# File lib/packetfu.rb, line 132
def self.inspect_style
  @inspect_style ||= :dissect
end

inspect_style=(arg) click to toggle source

Setter for PacketFu's @inspect_style

# File lib/packetfu.rb, line 137
def self.inspect_style=(arg)
  @inspect_style = case arg
    when :hex, :pretty
      :hex
    when :dissect, :verbose
      :dissect
    when :default, :ugly
      :default
    else
      :dissect
    end
end

newer_than?(str) click to toggle source

Returns true if the current version is newer than the compare version.

# File lib/packetfu/version.rb, line 45
def self.newer_than?(str)
  return false if str == self.version
  !self.older_than?(str)
end

older_than?(str) click to toggle source

Returns true if the current version is older than the compare version.

# File lib/packetfu/version.rb, line 37
def self.older_than?(str)
  return false if str == self.version
  this_version = binarize_version(self.version)
  ask_version = binarize_version(str)
  this_version < ask_version
end

packet_classes() click to toggle source

Returns an array of packet classes

# File lib/packetfu.rb, line 94
def self.packet_classes
  @packet_classes || []
end

packet_classes_by_layer() click to toggle source

# File lib/packetfu.rb, line 105
def self.packet_classes_by_layer
  return [] if @packet_classes.nil?
  self.reset_packet_groups unless @packet_classes_by_layer
  @packet_classes_by_layer
end

packet_classes_by_layer_without_application() click to toggle source

# File lib/packetfu.rb, line 111
def self.packet_classes_by_layer_without_application
  return [] if @packet_classes.nil?
  self.reset_packet_groups unless @packet_classes_by_layer_without_application
  @packet_classes_by_layer_without_application
end

packet_prefixes() click to toggle source

Returns an array of packet types by packet prefix.

# File lib/packetfu.rb, line 99
def self.packet_prefixes
  return [] if @packet_classes.nil?
  self.reset_packet_groups unless @packet_class_prefixes
  @packet_class_prefixes
end

pcaprub_loaded?() click to toggle source

Returns the status of pcaprub

# File lib/packetfu.rb, line 63
def self.pcaprub_loaded?
  @pcaprub_loaded
end

pcaprub_platform_require() click to toggle source

PacketFu works best with Pcaprub version 0.8-dev (at least) The current (Aug 01, 2010) pcaprub gem is 0.9, so should be fine.

# File lib/packetfu.rb, line 41
def self.pcaprub_platform_require
  begin
    require 'pcaprub'
  rescue LoadError
    return false
  end
  @pcaprub_loaded = true 
end

remove_packet_class(klass) click to toggle source

Presumably, there may be a time where you'd like to remove a packet class.

# File lib/packetfu.rb, line 85
def self.remove_packet_class(klass)
  raise "Need a class" unless klass.kind_of? Class
  @packet_classes ||= []
  @packet_classes.delete klass
  self.clear_packet_groups
  @packet_classes 
end

require_protos(cwd) click to toggle source

Picks up all the protocols defined in the protos subdirectory

# File lib/packetfu.rb, line 16
def self.require_protos(cwd)
  protos_dir = File.join(cwd, "packetfu", "protos")
  Dir.new(protos_dir).each do |fname|
    next unless fname[/\.rb$/]
    begin 
      require File.join(protos_dir,fname)
    rescue
      warn "Warning: Could not load `#{fname}'. Skipping."
    end
  end
end

reset_packet_groups() click to toggle source

# File lib/packetfu.rb, line 123
def self.reset_packet_groups
              @packet_class_prefixes = @packet_classes.map {|p| p.to_s.split("::").last.to_s.downcase.gsub(/packet$/,"")}
  @packet_classes_by_layer = @packet_classes.sort_by { |pclass| pclass.layer }.reverse
  @packet_classes_by_layer_without_application = @packet_classes_by_layer.reject { |pclass| pclass.layer_symbol == :application }
end

version() click to toggle source

Returns PacketFu::VERSION

# File lib/packetfu/version.rb, line 7
def self.version
  VERSION
end

Public Instance Methods

toggle_inspect() click to toggle source

Switches inspect styles in a round-robin fashion between :dissect, :default, and :hex

# File lib/packetfu.rb, line 152
def toggle_inspect
  case @inspect_style
  when :hex, :pretty
    @inspect_style = :dissect
  when :dissect, :verbose
    @inspect_style = :default
  when :default, :ugly
    @inspect_style = :hex
  else
    @inspect_style = :dissect
  end
end