Class: Dap::Filter::FilterDecodePortmapperReply

Inherits:
Object
  • Object
show all
Includes:
BaseDecoder
Defined in:
lib/dap/filter/udp.rb

Constant Summary collapse

ID_TO_PROTOCOL = 
{
    0=>"ip",           1=>"icmp",        2=>"igmp",              3=>"ggp",
    4=>"ipencap",      5=>"st",          6=>"tcp",               8=>"egp",
    9=>"igp",          12=>"pup",        17=>"udp",              20=>"hmp",
    22=>"xns-idp",     27=>"rdp",        29=>"iso-tp4",          33=>"dccp",
    36=>"xtp",         37=>"ddp",        38=>"idpr-cmtp",        41=>"ipv6",
    43=>"ipv6-route",  44=>"ipv6-frag",  45=>"idrp",             46=>"rsvp",
    47=>"gre",         50=>"esp",        51=>"ah",               57=>"skip",
    58=>"ipv6-icmp",   59=>"ipv6-nonxt", 60=>"ipv6-opts",        73=>"rspf",
    81=>"vmtp",        88=>"eigrp",      89=>"ospf",             93=>"ax.25",
    94=>"ipip",        97=>"etherip",    98=>"encap",            103=>"pim",
    108=>"ipcomp",     112=>"vrrp",      115=>"l2tp",            124=>"isis",
    132=>"sctp",       133=>"fc",        135=>"mobility-header", 136=>"udplite",
    137=>"mpls-in-ip", 138=>"manet",     139=>"hip",             140=>"shim6",
    141=>"wesp",       142=>"rohc"
}

Instance Attribute Summary

Attributes included from Base

#name, #opts

Instance Method Summary collapse

Methods included from BaseDecoder

#process

Methods included from Base

#initialize, #process

Instance Method Details

#decode(data) ⇒ Object 



602
603
604
 
# File 'lib/dap/filter/udp.rb', line 602

def decode(data)
  { 'rpc_services'=>parse_data(data) }
end

#parse_data(data) ⇒ Object

returns array of program-version-protocol-port strings for each rpc service



578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
 
# File 'lib/dap/filter/udp.rb', line 578

def parse_data(data)
  ret = []
  # Skip past header that contains no rpc services
  stripped = data[8..-1]
  curr_pos = 0
  has_next = ( !stripped.nil? && stripped.length >= 8 ? stripped[curr_pos,8].to_i(16) : 0 )
  curr_pos +=8
  while has_next > 0
    # See if enough data present for next set of reads.
    if data.length > curr_pos+40
      prog_id = stripped[curr_pos,8].to_i(16); curr_pos+=8
      version = stripped[curr_pos,8].to_i(16); curr_pos += 8
      proto_id = stripped[curr_pos,8].to_i(16); curr_pos+=8
      protocol = ID_TO_PROTOCOL[ proto_id ] || "proto-#{proto_id}"
      port = stripped[curr_pos,8].to_i(16); curr_pos += 8
      ret << "#{prog_id}-v#{version}-#{protocol}-#{port}" if prog_id > 0
      has_next = stripped[curr_pos,8].to_i(16); curr_pos += 8
    else
      break
    end
  end
  ret
end