Subject: [ruby-ffi] Having trouble with a struct |
From: Qwerty |
Date: 11/1/10 9:01 PM |
To: ruby-ffi |
I am getting weird issues with a struct. The struct is the IPv4 header. All but the last item(destination address) gives the correct data(after some endian manipulation. class IP4_header < FFI::Struct layout :eth_offset, :uchar, 14],:version,:uchar,:tos,:uchar,:len,:ushort,:id,:ushort,:frag_offset,:ushort,:ttl,:uchar,:proto,:uchar, :checksum,:ushort,:src_addr,:uint,:dest_addr,:uint IP_RF=8 IP_DF=4 IP_MF=2 OFFMASK='ff1f'.to_i 16 end The first field eth_offset is just to get past the ethernet header, probably the wrong way to do that. src_addr returns 2831155968, which is the hex value A8C00300 which is correct, after an endian adjustment: 192.168.0.3. The actual value before the adjustment is 168.192.3.0. dest_addr returns 3636658432 which is the hex value D8C30100 which is completely incorrect. The next 4 bytes were expected to be read, but the two bytes right after src_addr were skipped. If that is not bad enough it is being read incorrectly. The returned value corresponds to 216.195.1.0. The bytes, according to wireshark, right after src_addr is: C0 A8 00 01 C3 D8. The first 4 bytes is the dest_addr and the last two are the first two bytes in the UDP header. So dest_addr is skipping two bytes AND reading it incorrectly. Given if it just skipped the two bytes, the read bytes should be 01 00 d8 c3.