class Capra::Engine

Attributes

interface[RW]
rules[RW]

Public Class Methods

new(file: nil, &block) click to toggle source
# File lib/capra/engine.rb, line 6
def initialize(file: nil, &block)
  default_interface
  @rules = {}
  if file
    instance_eval File.read(file)
  else
    instance_eval &block
  end
  start!
end

Public Instance Methods

alert(mesg) click to toggle source
# File lib/capra/engine.rb, line 45
def alert(mesg)
  puts mesg
end
debug!() click to toggle source
# File lib/capra/engine.rb, line 33
def debug!
  binding.pry
end
default_interface() click to toggle source
# File lib/capra/engine.rb, line 21
def default_interface
  @interface = Interfacez.default
end
email(recpt) click to toggle source
# File lib/capra/engine.rb, line 49
def email(recpt)
  puts "Sending email!"
end
pcap(file) click to toggle source
# File lib/capra/engine.rb, line 25
def pcap(file)
  @pcap = file
end
rule(type, description: nil, reference: nil, &block) click to toggle source
# File lib/capra/engine.rb, line 37
def rule(type, description: nil, reference: nil, &block)
  if @rules[type]
    @rules[type] << block
  else
    @rules[type] = [block]
  end
end
save(packet) click to toggle source
# File lib/capra/engine.rb, line 53
def save(packet)
  @save_to = "capra-save-"+Time.now.utc.to_s.split(" ").join("-")+".pcapng" if @save_to.nil?

  pf = PacketGen::PcapNG::File.new
  pf.array_to_file [packet]
  pf.to_f(@save_to, append: true)
end
save_to(file) click to toggle source
# File lib/capra/engine.rb, line 29
def save_to(file)
  @save_to = file
end
start!() click to toggle source
# File lib/capra/engine.rb, line 61
def start!
  if @pcap
    read_pcap_file(@pcap) do |packet|
      @rules.each do |header, blocks|
        if header == 'ANY' || packet.is?(header)
          blocks.each do |block|
            block.call(packet)
          end
        end
      end
    end
  else
    PacketGen.capture(iface: @interface) do |packet|
      @rules.each do |header, blocks|
        if header == 'ANY' || packet.is?(header)
          blocks.each do |block|
            block.call(packet)
          end
        end
      end
    end
  end
end

Private Instance Methods

read_pcap_file(filename) { |packet| ... } click to toggle source
# File lib/capra/engine.rb, line 87
def read_pcap_file(filename)
  PcapNG::File.new.read_packets(filename) do |packet|
    yield packet
  end
rescue StandardError => e
  PCAPRUB::Pcap.open_offline(filename).each_packet do |packet|
    next unless (packet = PacketGen.parse(packet.to_s))

    yield packet
  end
end