Add ARP header support and refactor protocol handling in analyzer

Author: ydah

lib/redhound/analyzer.rb

@@ -18,11 +18,13 @@ def analyze
 
       l3 = layer3_header(l2, l2.size)
       l3.dump
+      return if @msg.bytes.size <= l2.size + l3.size
       unless l3.supported_protocol?
         puts "    └─ Unsupported protocol #{l3.protocol}"
         return
       end
 
+
       layer4_header(l3, l2.size + l3.size).dump
     end
 
@@ -31,6 +33,8 @@ def layer3_header(l2, offset)
         Header::Ipv4.generate(bytes: @msg.bytes[offset..])
       elsif l2.type.ipv6?
         Header::Ipv6.generate(bytes: @msg.bytes[offset..])
+      elsif l2.type.arp?
+        Header::Arp.generate(bytes: @msg.bytes[offset..])
       end
     end
 

lib/redhound/header.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'header/arp'
 require_relative 'header/ether'
 require_relative 'header/ethernet_protocol'
 require_relative 'header/icmp'

lib/redhound/header/arp.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+module Redhound
+  class Header
+    class Arp
+      class << self
+        def generate(bytes:)
+          new(bytes:).generate
+        end
+      end
+
+      def initialize(bytes:)
+        raise ArgumentError, "bytes must be bigger than #{arp_size} bytes" unless bytes.size >= arp_size
+
+        @bytes = bytes
+      end
+
+      def generate
+        @htype = @bytes[0..1]
+        @ptype = @bytes[2..3]
+        @hlen = @bytes[4]
+        @plen = @bytes[5]
+        @oper = @bytes[6..7]
+        @sha = @bytes[8..13]
+        @spa = @bytes[14..17]
+        @tha = @bytes[18..23]
+        @tpa = @bytes[24..27]
+        @type = EthernetProtocol.new(protocol: ptype)
+        @l3 = generate_l3
+        self
+      end
+
+      def arp_size = 28
+
+      def size
+        if @l3.nil?
+          arp_size
+        else
+          arp_size + @l3.size
+        end
+      end
+
+      def dump
+        puts self
+      end
+
+      def to_s
+        "    └─ ARP HType: #{htype} PType: #{ptype} HLen: #{@hlen} PLen: #{@plen} Oper: #{oper} SHA: #{sha} SPA: #{spa} THA: #{tha} TPA: #{tpa}"
+      end
+
+      def supported_protocol?
+        @l3.supported_protocol? if @l3
+      end
+
+      def protocol
+        @l3.protocol if @l3
+      end
+
+      private
+
+      def htype
+        @htype.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
+      end
+
+      def ptype
+        @ptype.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
+      end
+
+      def oper
+        @oper.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
+      end
+
+      def sha
+        @sha.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
+      end
+
+      def spa
+        @spa.map { |b| b.to_s(16).rjust(2, '0') }.join('.')
+      end
+
+      def tha
+        @tha.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
+      end
+
+      def tpa
+        @tpa.map { |b| b.to_s(16).rjust(2, '0') }.join('.')
+      end
+
+      def generate_l3
+        return if @bytes.size == arp_size
+
+        if @type.ipv4?
+          Header::Ipv4.generate(bytes: @bytes[arp_size..])
+        elsif @type.ipv6?
+          Header::Ipv6.generate(bytes: @bytes[arp_size..])
+        end
+      end
+    end
+  end
+end

lib/redhound/header/ether.rb

@@ -44,7 +44,7 @@ def shost
       end
 
       def supported_type?
-        @type.ipv4? || @type.ipv6?
+        @type.ipv4? || @type.ipv6? || @type.arp?
       end
 
       private

lib/redhound/header/ipv6.rb

@@ -7,53 +7,53 @@ class << self
         def generate(bytes:)
           new(bytes:).generate
         end
+      end
 
-        attr_reader :protocol
+      attr_reader :protocol
 
-        def initialize(bytes:)
-          raise ArgumentError, "bytes must be bigger than #{header_size} bytes" unless bytes.size >= header_size
+      def initialize(bytes:)
+        raise ArgumentError, "bytes must be bigger than #{size} bytes" unless bytes.size >= size
 
-          @bytes = bytes
-        end
+        @bytes = bytes
+      end
 
-        def size = 40
-
-        def generate
-          version_traffic_flow = @bytes[0..3].unpack('N')
-          @version = (version_traffic_flow >> 28) & 0xF
-          @traffic_class = (version_traffic_flow >> 20) & 0xFF
-          @flow_label = version_traffic_flow & 0xFFFFF
-          @payload_length = @bytes[4..5]
-          @next_header = @bytes[6]
-          @hop_limit = @bytes[7]
-          @saddr = @bytes[8..23]
-          @daddr = @bytes[24..39]
-          @protocol = InternetProtocol.new(protocol: @next_header)
-        end
+      def size = 40
+
+      def generate
+        version_traffic_flow = @bytes[0..3].unpack('N')
+        @version = (version_traffic_flow >> 28) & 0xF
+        @traffic_class = (version_traffic_flow >> 20) & 0xFF
+        @flow_label = version_traffic_flow & 0xFFFFF
+        @payload_length = @bytes[4..5]
+        @next_header = @bytes[6]
+        @hop_limit = @bytes[7]
+        @saddr = @bytes[8..23]
+        @daddr = @bytes[24..39]
+        @protocol = InternetProtocol.new(protocol: @next_header)
+      end
 
-        def dump
-          puts self
-        end
+      def dump
+        puts self
+      end
 
-        def to_s
-          " └─ IPv6 Ver: #{version} Traffic Class: #{traffic_class} Flow Label: #{flow_label} Payload Length: #{payload_length} Next Header: #{@protocol} Hop Limit: #{hop_limit} Src: #{saddr} Dst: #{daddr}"
-        end
+      def to_s
+        " └─ IPv6 Ver: #{version} Traffic Class: #{traffic_class} Flow Label: #{flow_label} Payload Length: #{payload_length} Next Header: #{@protocol} Hop Limit: #{hop_limit} Src: #{saddr} Dst: #{daddr}"
+      end
 
-        def supported_protocol?
-          @protocol.udp?
-        end
+      def supported_protocol?
+        @protocol.udp?
+      end
 
-        def payload_length
-          @payload_length.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
-        end
+      def payload_length
+        @payload_length.map { |b| b.to_s(16).rjust(2, '0') }.join.to_i(16)
+      end
 
-        def saddr
-          @saddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
-        end
+      def saddr
+        @saddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
+      end
 
-        def daddr
-          @daddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
-        end
+      def daddr
+        @daddr.map { |b| b.to_s(16).rjust(2, '0') }.join(':')
       end
     end
   end