1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
# -*- coding: binary -*-
require 'packetfu/protos/eth/header'
require 'packetfu/protos/eth/mixin'
require 'packetfu/protos/ip/header'
require 'packetfu/protos/ip/mixin'
require 'packetfu/protos/udp/header'
require 'packetfu/protos/udp/mixin'
require 'packetfu/protos/hsrp/header'
require 'packetfu/protos/hsrp/mixin'
module PacketFu
# HSRPPacket is used to construct HSRP Packets. They contain an EthHeader, an IPHeader, and a UDPHeader.
#
# == Example
#
# hsrp_pkt.new
# hsrp_pkt.hsrp_opcode = 0
# hsrp_pkt.hsrp_state = 16
# hsrp_pkt.hsrp_priority = 254
# hsrp_pkt.hsrp_group = 1
# hsrp_pkt.hsrp_vip = 10.100.100.254
# hsrp_pkt.recalc
# hsrp_pkt.to_f('/tmp/hsrp.pcap')
#
# == Parameters
#
# :eth
# A pre-generated EthHeader object.
# :ip
# A pre-generated IPHeader object.
# :udp
# A pre-generated UDPHeader object.
# :flavor
# TODO: HSRP packets don't tend have any flavor.
# :config
# A hash of return address details, often the output of Utils.whoami?
class HSRPPacket < Packet
include ::PacketFu::EthHeaderMixin
include ::PacketFu::IPHeaderMixin
include ::PacketFu::UDPHeaderMixin
include ::PacketFu::HSRPHeaderMixin
attr_accessor :eth_header, :ip_header, :udp_header, :hsrp_header
def self.can_parse?(str)
return false unless str.size >= 54
return false unless EthPacket.can_parse? str
return false unless IPPacket.can_parse? str
return false unless UDPPacket.can_parse? str
temp_packet = UDPPacket.new
temp_packet.read(str)
if temp_packet.ip_ttl == 1 and [temp_packet.udp_sport,temp_packet.udp_dport] == [1985,1985]
return true
else
return false
end
end
def initialize(args={})
@eth_header = EthHeader.new(args).read(args[:eth])
@ip_header = IPHeader.new(args).read(args[:ip])
@ip_header.ip_proto = 0x11
@udp_header = UDPHeader.new(args).read(args[:udp])
@hsrp_header = HSRPHeader.new(args).read(args[:hsrp])
@udp_header.body = @hsrp_header
@ip_header.body = @udp_header
@eth_header.body = @ip_header
@headers = [@eth_header, @ip_header, @udp_header, @hsrp_header]
super
end
# Peek provides summary data on packet contents.
def peek_format
peek_data = ["UH "]
peek_data << "%-5d" % self.to_s.size
peek_data << "%-16s" % self.hsrp_addr
peek_data << "%-4d" % self.hsrp_group
peek_data << "%-35s" % self.hsrp_password_readable
peek_data << "%-15s" % self.ip_saddr
peek_data.join
end
end
end
# vim: nowrap sw=2 sts=0 ts=2 ff=unix ft=ruby
|
