class PacketFu::PcapNG::SHB

PcapngSHB represents a Section Header Block (SHB) of a pcapng file.

PcapngSHB Definition

Int32   :type           Default: 0x0A0D0D0A
Int32   :block_len
Int32   :magic          Default: 0x1A2B3C4D  # :big is 0x4D3C2C1A
Int16   :ver_major      Default: 1
Int16   :ver_minor      Default: 0
Int64   :section_len
String  :options        Default: ''
Int32   :block_len2

Constants

MAGIC_BIG
MAGIC_INT32
MAGIC_LITTLE
MIN_SIZE
SECTION_LEN_UNDEFINED

Attributes

endian[RW]
interfaces[R]
unknown_blocks[R]

Get unsupported blocks given in pcapng file as raw data

Public Class Methods

new(args={}) click to toggle source
Calls superclass method
# File lib/packetfu/pcapng/shb.rb, line 33
def initialize(args={})
  @endian = set_endianness(args[:endian] || :little)
  @interfaces = []
  @unknown_blocks = []
  init_fields(args)
  super(args[:type], args[:block_len], args[:magic], args[:ver_major],
        args[:ver_minor], args[:section_len], args[:options], args[:block_len2])
end

Public Instance Methods

<<(idb) click to toggle source

Add a IDB to this section

# File lib/packetfu/pcapng/shb.rb, line 113
def <<(idb)
  @interfaces << idb
end
has_options?() click to toggle source
# File lib/packetfu/pcapng/shb.rb, line 55
def has_options?
  self[:options].size > 0
end
init_fields(args={}) click to toggle source

Used by initialize to set the initial fields

# File lib/packetfu/pcapng/shb.rb, line 43
def init_fields(args={})
  args[:type]  = @int32.new(args[:type] || PcapNG::SHB_TYPE.to_i)
  args[:block_len] = @int32.new(args[:block_len] || MIN_SIZE)
  args[:magic] = @int32.new(args[:magic] || MAGIC_INT32)
  args[:ver_major] = @int16.new(args[:ver_major] || 1)
  args[:ver_minor] = @int16.new(args[:ver_minor] || 0)
  args[:section_len] = @int64.new(args[:section_len] || SECTION_LEN_UNDEFINED)
  args[:options] = StructFu::String.new(args[:options] || '')
  args[:block_len2] = @int32.new(args[:block_len2] || MIN_SIZE)
  args
end
read(str_or_io) click to toggle source

Reads a String or a IO to populate the object

# File lib/packetfu/pcapng/shb.rb, line 60
def read(str_or_io)
  if str_or_io.respond_to? :read
    io = str_or_io
  else
    io = StringIO.new(force_binary(str_or_io.to_s))
  end
  return self if io.eof?

  type_str = io.read(4)
  unless type_str == PcapNG::SHB_TYPE.to_s
    type = type_str.unpack('H*').join
    raise InvalidFileError, "Incorrect type (#{type})for Section Header Block"
  end

  block_len_str = io.read(4)

  magic_str = io.read(4)
  case @endian
  when :little
    case magic_str
    when MAGIC_LITTLE
    when MAGIC_BIG
      force_endianness :big
    else
      raise InvalidFileError, 'Incorrect magic for Section Header Block'
    end
  when :big
    case magic_str
    when MAGIC_BIG
    when MAGIC_LITTLE
      force_endianness :little
    else
      raise InvalidFileError, 'Incorrect magic for Section Header Block'
    end
  end

  self[:type].read type_str
  self[:block_len].read block_len_str
  self[:magic].read magic_str
  self[:ver_major].read io.read(2)
  self[:ver_minor].read io.read(2)
  self[:section_len].read io.read(8)
  self[:options].read io.read(self[:block_len].to_i - MIN_SIZE)
  self[:block_len2].read io.read(4)

  unless self[:block_len].to_i == self[:block_len2].to_i
    raise InvalidFileError, 'Incoherency in Section Header Block'
  end

  self
end
to_s() click to toggle source

Return the object as a String

# File lib/packetfu/pcapng/shb.rb, line 118
def to_s
  body = @interfaces.map(&:to_s).join
  unless self[:section_len].to_i == SECTION_LEN_UNDEFINED
    self.section_len.value = body.size
  end
  pad_field :options
  recalc_block_len
  to_a.map(&:to_s).join + body
end

Private Instance Methods

force_endianness(endian) click to toggle source
# File lib/packetfu/pcapng/shb.rb, line 131
def force_endianness(endian)
  set_endianness endian
  @endian = endian
  self[:type]  = @int32.new(self[:type].to_i)
  self[:block_len] = @int32.new(self[:block_len].to_i)
  self[:magic] = @int32.new(self[:magic].to_i)
  self[:ver_major] = @int16.new(self[:ver_major].to_i)
  self[:ver_minor] = @int16.new(self[:ver_minor].to_i)
  self[:section_len] = @int64.new(self[:section_len].to_i)
  self[:block_len2] = @int32.new(self[:block_len2].to_i)
end