Net-Inspect

 view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

0.330 2018/02/19
- L7::HTTP::Request::InspectChain
  - support for brotli if IO::Uncompress::Brotli is installed
  - better documentation
- Flow: deal with changes to the attached flows from inside an executed method
  (happens together with GuessProtocol)
0.329 2017/11/22
- L4::Tcp::pktin - fix merging of data into next packet if data were not
  handled in the upper layer yet (merging was done with last unhandled packet
  instead of next one).
0.328 2017/06/11
- L7::SMTP - call new_connection from upper flow to initialize it

META.yml  view on Meta::CPAN

meta-spec:
  url: http://module-build.sourceforge.net/META-spec-v1.4.html
  version: '1.4'
name: Net-Inspect
no_index:
  directory:
    - t
    - inc
requires:
  Digest::SHA: '0'
  HTTP::Request: '0'
  HTTP::Response: '0'
  Net::Pcap: '0'
  Scalar::Util: '0'
resources:
  repository: https://github.com/noxxi/p5-net-inspect
version: '0.330'

Makefile.PL  view on Meta::CPAN

use ExtUtils::MakeMaker;
require 5.10.0;
WriteMakefile(
    NAME => 'Net::Inspect',
    VERSION_FROM => 'lib/Net/Inspect.pm',
    PREREQ_PM => {
	'Net::Pcap' => 0,
	'Scalar::Util' => 0,
	'HTTP::Request' => 0,
	'HTTP::Response' => 0,
	'Digest::SHA' => 0,
    },
    LICENSE => 'perl',
    META_MERGE => {
        resources => {
            repository => 'https://github.com/noxxi/p5-net-inspect',
        },
    },
);

lib/Net/Inspect.pm  view on Meta::CPAN

Net::Inspect - library for inspection of data on various network layers

=head1 SYNOPSIS

    use Net::Pcap 'pcap_loop';
    use Net::Inspect::L2::Pcap;
    use Net::Inspect::L3::IP;
    use Net::Inspect::L4::TCP;
    use Net::Inspect::L7::HTTP;
    use Net::Inspect::L7::HTTP::Request::InspectChain;
    use Net::Inspect::Debug;

    my $pcap = Net::Pcap->new...
    ...
    my $l7 = Net::Inspect::L7::HTTP->new;
    my $l4 = Net::Inspect::L4::TCP->new($l7);
    my $l3 = Net::Inspect::L3::IP->new($l4);
    my $l2 = Net::Inspect::L2::Pcap->new($pcap,$l3);

    pcap_loop($pcap,-1,sub {

lib/Net/Inspect/L7/HTTP.pm  view on Meta::CPAN

1;

__END__

=head1 NAME

Net::Inspect::L7::HTTP - guesses and handles HTTP traffic

=head1 SYNOPSIS

 my $req = Net::Inspect::L7::HTTP::Request::Simple->new(..);
 my $http = Net::Inspect::L7::HTTP->new($req);
 my $guess = Net::Inspect::L5::GuessProtocol->new;
 $guess->attach($http);
 ...

=head1 DESCRIPTION

This class extracts HTTP requests from TCP connections.
It provides all hooks required for C<Net::Inspect::L4::TCP> and is usually used
together with it.
It provides the C<guess_protocol> hook so it can be used with
C<Net::Inspect::L5::GuessProtocol>.

Attached flow is usually a C<Net::Inspect::L7::HTTP::Request::*> object.

Hooks provided:

=over 4

=item guess_protocol($guess,$dir,$data,$eof,$time,$meta)

=item new_connection($meta,%args)

This returns an object for the connection.

lib/Net/Inspect/L7/HTTP/Request/InspectChain.pm  view on Meta::CPAN

############################################################################
# deep inspection into HTTP response
# umcompresses, updates response header and provides hooks to manipulate
# request and response header and body
############################################################################

use strict;
use warnings;
package Net::Inspect::L7::HTTP::Request::InspectChain;
use base 'Net::Inspect::Flow';
use fields qw(conn meta rqhdr rphdr hooks info);
use Hash::Util 'lock_keys';
use Carp;
use HTTP::Request;
use HTTP::Response;
use Compress::Raw::Zlib;
use Net::Inspect::Debug qw(debug trace $DEBUG);
use Scalar::Util 'weaken';

my ($can_brotli,$ce_rx);
BEGIN {
    if (eval { require IO::Uncompress::Brotli; 1 }) {
	$can_brotli = 1;
	$ce_rx = qr{(?:x-)(?<ce> gzip|deflate) | (?<ce> br)}xi;

lib/Net/Inspect/L7/HTTP/Request/Simple.pm  view on Meta::CPAN

############################################################################
# simple HTTP Request class - everything gets per default put into sub in
# which then can be redefined by subclass
############################################################################
use strict;
use warnings;
package Net::Inspect::L7::HTTP::Request::Simple;
use base 'Net::Inspect::Flow';
use fields qw(conn meta chunked);
use Net::Inspect::Debug qw($DEBUG debug trace);
use Scalar::Util 'weaken';
use Carp 'croak';

sub new_request {
    my ($self,$meta,$conn) = @_;
    my $obj = $self->new;
    $obj->{meta} = $meta;

tools/httpflow/privHTTPRequest.pm  view on Meta::CPAN

# ----------------------------------------------------------------------------
# request object derived from HTTP::Request::InspectChain
# handles saving of request data into files or writing of request
# information to stdout
# ----------------------------------------------------------------------------

use strict;
use warnings;

package privHTTPRequest;
use base 'Net::Inspect::L7::HTTP::Request::InspectChain';
use fields qw(writer outdir fcache infosub flowid flowreqid chunked stat);
use Net::Inspect::Debug;

sub new {
    my ($class,%args) = @_;
    my $self = $class->SUPER::new;
    $self->{infosub} = $args{info}   || ref($class) && $class->{infosub};
    $self->{writer}  = $args{writer} || ref($class) && $class->{writer};
    $self->{outdir}  = $args{dir}    || ref($class) && $class->{outdir};
    $self->{fcache}  = $args{fcache} || ref($class) && $class->{fcache};

tools/live-http-headers.pl  view on Meta::CPAN

pcap_loop($pcap,-1,sub {
    my (undef,$hdr,$data) = @_;
    if ( ! $time || $hdr->{tv_sec}-$time>10 ) {
	$tcp->expire($time = $hdr->{tv_sec});
    }
    return $pc->pktin($data,$hdr);
},undef);

# ------------------------------------------------------------------------ 
package myReq;
use base 'Net::Inspect::L7::HTTP::Request::Simple';
sub in_response_header {
    my ($self,$hdr,$time) = @_;
    print ">>>>>>>\n$hdr\n";
}
sub in_request_header {
    my ($self,$hdr,$time) = @_;
    print "<<<<<<<\n$hdr\n";
}

 view all matches for this distribution
 view release on metacpan -  search on metacpan