Class: PacketFu::PcapNG::SHB

Inherits:
Struct
  • Object
show all
Includes:
Block, StructFu
Defined in:
lib/packetfu/pcapng/shb.rb

Overview

PcapngSHB represents a Section Header Block (SHB) of a pcapng file.

PcapngSHB Definition

Int32   :type           Default: 0x0A0D0D0A
Int32   :block_len
Int32   :magic          Default: 0x1A2B3C4D  # :big is 0x4D3C2C1A
Int16   :ver_major      Default: 1
Int16   :ver_minor      Default: 0
Int64   :section_len
String  :options        Default: ''
Int32   :block_len2

Constant Summary collapse

MAGIC_INT32 = 
0x1A2B3C4D
MAGIC_LITTLE = 
[MAGIC_INT32].pack('V')
MAGIC_BIG = 
[MAGIC_INT32].pack('N')
MIN_SIZE = 
7*4
SECTION_LEN_UNDEFINED = 
0xffffffff_ffffffff

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Block

#pad_field, #recalc_block_len

Methods included from StructFu

#body=, #clone, #set_endianness, #sz, #typecast

Methods inherited from Struct

#force_binary

Constructor Details

#initialize(args = {}) ⇒ SHB

Returns a new instance of SHB.



33
34
35
36
37
38
39
40
 
# File 'lib/packetfu/pcapng/shb.rb', line 33

def initialize(args={})
  @endian = set_endianness(args[:endian] || :little)
  @interfaces = []
  @unknown_blocks = []
  init_fields(args)
  super(args[:type], args[:block_len], args[:magic], args[:ver_major],
        args[:ver_minor], args[:section_len], args[:options], args[:block_len2])
end

Instance Attribute Details

#block_len ⇒ Object

Returns the value of attribute block_len

Returns:

  • (Object) —

    the current value of block_len



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def block_len
  @block_len
end

#block_len2 ⇒ Object

Returns the value of attribute block_len2

Returns:

  • (Object) —

    the current value of block_len2



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def block_len2
  @block_len2
end

#endian ⇒ Object

Returns the value of attribute endian.



21
22
23
 
# File 'lib/packetfu/pcapng/shb.rb', line 21

def endian
  @endian
end

#interfaces ⇒ Object (readonly)

Returns the value of attribute interfaces.



22
23
24
 
# File 'lib/packetfu/pcapng/shb.rb', line 22

def interfaces
  @interfaces
end

#magic ⇒ Object

Returns the value of attribute magic

Returns:

  • (Object) —

    the current value of magic



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def magic
  @magic
end

#options ⇒ Object

Returns the value of attribute options

Returns:

  • (Object) —

    the current value of options



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def options
  @options
end

#section_len ⇒ Object

Returns the value of attribute section_len

Returns:

  • (Object) —

    the current value of section_len



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def section_len
  @section_len
end

#type ⇒ Object

Returns the value of attribute type

Returns:

  • (Object) —

    the current value of type



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def type
  @type
end

#unknown_blocks ⇒ Object (readonly)

Get unsupported blocks given in pcapng file as raw data



24
25
26
 
# File 'lib/packetfu/pcapng/shb.rb', line 24

def unknown_blocks
  @unknown_blocks
end

#ver_major ⇒ Object

Returns the value of attribute ver_major

Returns:

  • (Object) —

    the current value of ver_major



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def ver_major
  @ver_major
end

#ver_minor ⇒ Object

Returns the value of attribute ver_minor

Returns:

  • (Object) —

    the current value of ver_minor



17
18
19
 
# File 'lib/packetfu/pcapng/shb.rb', line 17

def ver_minor
  @ver_minor
end

Instance Method Details

#<<(idb) ⇒ Object

Add a IDB to this section



113
114
115
 
# File 'lib/packetfu/pcapng/shb.rb', line 113

def <<(idb)
  @interfaces << idb
end

#has_options? ⇒ Boolean

Returns:

  • (Boolean) 


55
56
57
 
# File 'lib/packetfu/pcapng/shb.rb', line 55

def has_options?
  self[:options].size > 0
end

#init_fields(args = {}) ⇒ Object

Used by #initialize to set the initial fields



43
44
45
46
47
48
49
50
51
52
53
 
# File 'lib/packetfu/pcapng/shb.rb', line 43

def init_fields(args={})
  args[:type]  = @int32.new(args[:type] || PcapNG::SHB_TYPE.to_i)
  args[:block_len] = @int32.new(args[:block_len] || MIN_SIZE)
  args[:magic] = @int32.new(args[:magic] || MAGIC_INT32)
  args[:ver_major] = @int16.new(args[:ver_major] || 1)
  args[:ver_minor] = @int16.new(args[:ver_minor] || 0)
  args[:section_len] = @int64.new(args[:section_len] || SECTION_LEN_UNDEFINED)
  args[:options] = StructFu::String.new(args[:options] || '')
  args[:block_len2] = @int32.new(args[:block_len2] || MIN_SIZE)
  args
end

#read(str_or_io) ⇒ Object

Reads a String or a IO to populate the object



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/packetfu/pcapng/shb.rb', line 60

def read(str_or_io)
  if str_or_io.respond_to? :read
    io = str_or_io
  else
    io = StringIO.new(force_binary(str_or_io.to_s))
  end
  return self if io.eof?

  type_str = io.read(4)
  unless type_str == PcapNG::SHB_TYPE.to_s
    type = type_str.unpack('H*').join
    raise InvalidFileError, "Incorrect type (#{type})for Section Header Block"
  end

  block_len_str = io.read(4)

  magic_str = io.read(4)
  case @endian
  when :little
    case magic_str
    when MAGIC_LITTLE
    when MAGIC_BIG
      force_endianness :big
    else
      raise InvalidFileError, 'Incorrect magic for Section Header Block'
    end
  when :big
    case magic_str
    when MAGIC_BIG
    when MAGIC_LITTLE
      force_endianness :little
    else
      raise InvalidFileError, 'Incorrect magic for Section Header Block'
    end
  end

  self[:type].read type_str
  self[:block_len].read block_len_str
  self[:magic].read magic_str
  self[:ver_major].read io.read(2)
  self[:ver_minor].read io.read(2)
  self[:section_len].read io.read(8)
  self[:options].read io.read(self[:block_len].to_i - MIN_SIZE)
  self[:block_len2].read io.read(4)

  unless self[:block_len].to_i == self[:block_len2].to_i
    raise InvalidFileError, 'Incoherency in Section Header Block'
  end

  self
end

#to_s ⇒ Object

Return the object as a String



118
119
120
121
122
123
124
125
126
 
# File 'lib/packetfu/pcapng/shb.rb', line 118

def to_s
  body = @interfaces.map(&:to_s).join
  unless self[:section_len].to_i == SECTION_LEN_UNDEFINED
    self.section_len.value = body.size
  end
  pad_field :options
  recalc_block_len
  to_a.map(&:to_s).join + body
end