File Coverage

blib/lib/Net/SinFP3/Ext/IP.pm

Criterion	Covered	Total	%
statement	9	42	21.4
branch	0	16	0.0
condition	0	9	0.0
subroutine	3	8	37.5
pod			n/a
total	12	75	16.0

#
# $Id: IP.pm 2234 2014-04-08 13:05:14Z gomor $
#
package Net::SinFP3::Ext::IP;
use strict;
use warnings;

use base qw(Class::Gomor::Array);
__PACKAGE__->cgBuildIndices;

# This is to verify that RST packets are generated from the target with
# the same TTL as a SYN|ACK packet. We accept a difference of 3 hops, but
# if this is greater, we consider to not be the same generated TTL
# Example: SunOS 5.9 generates a TTL of 60 in a SYN|ACK from our probe,
#          but a TTL of 64 for a RST from our probe. So, $ttl = 0.
sub __analyzeIpTtl {
   my $self = shift;
   my ($p, $p2) = @_;
   return 1 if ! $p2 || ! $p2->reply;
   my $ttlSrc = $self->getResponseIpTtl($p2);
   my $ttlDst = $self->getResponseIpTtl($p);
   my $ttl = 1;
   $ttl = 0 if (($ttlSrc > $ttlDst) && ($ttlSrc - $ttlDst > 3));
   $ttl = 0 if (($ttlDst > $ttlSrc) && ($ttlDst - $ttlSrc > 3));
   return $ttl;
}

sub __analyzeIpDfBit {
   my $self = shift;
   my ($p) = @_;
   return $self->getResponseIpDfBit($p) ? '1' : '0';
}

sub __analyzeIpIdPassive {
   my $self = shift;
   my ($p) = @_;
   return $self->getResponseIpId($p) ? '1' : '0';
}

sub __analyzeIpId {
   my $self = shift;
   my ($p) = @_;
   my $reqId = $self->getProbeIpId($p);
   my $repId = $self->getResponseIpId($p);
   my $flag  = 1;
   if    ($repId == 0)        { $flag = 0 }
   elsif ($repId == $reqId)   { $flag = 2 }
   elsif ($repId == ++$reqId) { $flag = 3 } # There is no reason for that, but
                                            # anyway, we have nothing to loose
   return $flag;
}

sub _analyzeBinary {
   my $self = shift;
   my ($p, $p2) = @_;
   my $flagTtl = $self->__analyzeIpTtl($p, $p2);
   my $flagId  = $self->__analyzeIpId($p);
   my $flagDf  = $self->__analyzeIpDfBit($p);
   my $flagSeq = $self->_tcp->__analyzeTcpSeq($p);
   my $flagAck = $self->_tcp->__analyzeTcpAck($p);
   return 'B'.$flagTtl.$flagId.$flagDf.$flagSeq.$flagAck;
}

1;

__END__