a k#dw@sdZddlmZddlmZddlZddlmZddlmZddl m Z ddl m Z m Z mZmZmZdd lmZmZmZmZmZmZdd lmZddlmmZdd lmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*dd l+m,Z,e*rdd l-m.Z.e$dde,fde,fgZ/e(de,e/Z0e1eGddde!e0Z2Gddde2e,e e,eZ3e)e#e,e,ee,e2e,fZ4Gddde2e/e e/eZ5dS)zH PacketList: holds several packets and allows to do operations on them. )absolute_import)print_functionN) defaultdict)lambda_tuple_converter)conf) BasePacketBasePacketListPacketList_metaclassSetGen_CanvasDumpExtended)do_graphhexdump make_tablemake_lined_tablemake_tex_table issubtypereduce)AnyCallable DefaultDictDictGenericIteratorList NamedTupleOptionalTupleTypeTypeVarUnion TYPE_CHECKING)Packet)Line2D QueryAnswerqueryZanswer_Innerc@sDeZdZgdZdJddZddZdd Zd d Zd d ZddZ ddZ ddZ ddZ ddZ ddZedddZddZdKddZdLd d!Zd"d#Zd$d%Zd&d'Zd(d)Zd*d+ZdMd-d.ZdNd0d1ZdOd2d3Zd4d5ZdPd6d7ZdQd8d9ZdRd:d;ZdSdd?Z!dUd@dAZ"dBdCZ#dVdDdEZ$dFdGZ%dWdHdIZ&dS)X _PacketList)statsreslistnameN PacketListcCsH|durtj}||_|dur$g|_nt|tr8|j|_n||_||_dS)zcreate a packet list from a list of packets res: the list of packets stats: a list of classes that will appear in the stats (defaults to [TCP,UDP,ICMP])N)rZstats_classic_protocolsr(r) isinstancer'r*selfr)namer(r0B/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/plist.py__init__Es   z_PacketList.__init__cCs t|jSN)lenr)r.r0r0r1__len__Ysz_PacketList.__len__cCs|Sr3r0r.eltr0r0r1_elt2pkt]sz_PacketList._elt2pktcCs|Sr3summaryr7r0r0r1_elt2sumasz_PacketList._elt2sumcCs ||Sr3)r<r7r0r0r1 _elt2showesz_PacketList._elt2showc Csdd|jD}d}|jD]F}d}|D],}|||r&||d7<d}qTq&|s|d7}qd}tj}|jD].}|d||j|d| ||f7}qr|d|d|d| |f7}d |d | |j |d||d fS) NcSsi|] }|dqS)rr0.0xr0r0r1 kz(_PacketList.__repr__..rz %s%s%s:Otherz %s%s%s%s%s<>) r(r)r9haslayerr color_themeZpacketlist_proto_namepunctZpacketlist_valueZpacketlist_namer*)r.r(otherrfpsctr0r0r1__repr__is8       z_PacketList.__repr__cCs|j|j|jd}|S)z Creates a basic representation of the instance, used in conjunction with __setstate__() e.g. by pickle :returns: dict representing this instance r)r(r*rTr.stater0r0r1 __getstate__s z_PacketList.__getstate__cCs"|d|_|d|_|d|_dS)z Sets instance attributes to values given by state, used in conjunction with __getstate__() e.g. by pickle :param state: dict representing this instance r)r(r*NrTrUr0r0r1 __setstate__s  z_PacketList.__setstate__cCs |jSr3)r)__iter__r5r0r0r1rYsz_PacketList.__iter__cCs t|j|Sr3)getattrr))r.attrr0r0r1 __getattr__sz_PacketList.__getattr__cshttr6jfddjDdjjfdSttr\jjdjdSjS)Ncsg|]}|vr|qSr0)r9r>itemr.r0r1 rBz+_PacketList.__getitem__..z %s from %sr/zmod %s) rr __class__r)__name__r*r,slice __getitem__)r.r^r0r]r1rds  z_PacketList.__getitem___T SndRcvListcCs"|j|j|jd|j|jfdS)Nz%s+%sr`)rar)r*)r.rMr0r0r1__add__s z_PacketList.__add__cCsf|durt|}|dur t|}|jD]:}|dur<||sfuncr0r1r_rBz&_PacketList.filter..z filtered %sr`)rrar)r*)r.ryr0rxr1filtersz_PacketList.filtercOst|jg|Ri|S)zPrints a table using a function that returns for each packet its head column value, head row value and displayed value # noqa: E501 ex: p.make_table(lambda x:(x[IP].dst, x[TCP].dport, x[TCP].sprintf("%flags%")) )rr)rtr0r0r1r sz_PacketList.make_tablecOst|jg|Ri|S)z0Same as make_table, but print a table with lines)rr)rtr0r0r1rsz_PacketList.make_lined_tablecOst|jg|Ri|S)z7Same as make_table, but print a table with LaTeX syntax)rr)rtr0r0r1rsz_PacketList.make_tex_tableFc  sddlm}m}m}tdur,tdurJfdd|jD}nfdd|jD}|ikrl|}|r|jt|i|} n|j|fi|} |s|| S)zApplies a function to each packet to get a value that will be plotted with matplotlib. A list of matplotlib.lines.Line2D is returned. lfilter: a truth function that decides whether a packet must be plotted rpltMATPLOTLIB_INLINEDMATPLOTLIB_DEFAULT_PLOT_KARGSNcsg|] }|qSr0r0r?erOr0r1r_4rBz$_PacketList.plot..csg|]}|r|qSr0r0rrOrjr0r1r_6rB) scapy.libs.matplotr|r}r~rr)plotziprw) r.rOrjplot_xyrvr|r}r~lst_pktslinesr0rr1rsz_PacketList.plotrCc  sddlm}m}m}dur@fddttj|D}n$fddttj|D}|ikrp|}|j|fi|} |s|| S)zdiffplot(f, delay=1, lfilter=None) Applies a function to couples (l[i],l[i+delay]) A list of matplotlib.lines.Line2D is returned. rr{Ncs&g|]}j|j|dqSrCr)r?rr)rOr.r0r1r_\sz(_PacketList.diffplot..cs4g|],}j|rj|j|dqSrrrrOrjr.r0r1r__s) rr|r}r~ranger4r)rrw) r.rOdelayrjrvr|r}r~rrr0rr1diffplotFs z_PacketList.diffplotc  sddlmm}m}tdur,tdurJfdd|jD}nfdd|jD}i}|D]\} } || g| qhs||rfddt |D} nfd dt |D} j d d d |s | S) zUses a function that returns a label and a value for this label, then plots all the values label by label. A list of matplotlib.lines.Line2D is returned. rr{Nc3s|]}|VqdSr3r0rrr0r1 rBz(_PacketList.multiplot..c3s|]}|r|VqdSr3r0rrr0r1rrBc s,g|]$\}}jt|it|dqS)label)rrdictr?kplrvr|r0r1r_sz)_PacketList.multiplot..c s*g|]"\}}j|fit|dqSr)rrrrr0r1r_sz center right)g?g?)locZbbox_to_anchor) rr|r}r~rr) setdefaultappendsix iteritemsZlegendrw) r.rOrjrrvr}r~rdrvrr0)rOrvrjr|r1 multiplotns.   z_PacketList.multiplotcCs|D]}t||qdS)z5Prints an hexadecimal dump of each packet in the listN)r r9)r.rPr0r0r1 rawhexdumpsz_PacketList.rawhexdumpcCs|t|jD]l\}}||}|dur.||s.q tdtjj|dd|d||f| tj r t | tj j q dS)zSame as nsummary(), except that if a packet has a Raw layer, it will be hexdumped # noqa: E501 lfilter: a truth function that decides whether a packet must be displayedN%s %s %srkrl%.time%)rpr)r9rhrrJrqsprintfr<rIZ raw_layerr getlayerloadr.rjrrr)rPr0r0r1hexraws  z_PacketList.hexrawcCsft|jD]V\}}||}|dur.||s.q tdtjj|dd|d||ft |q dS)zSame as nsummary(), except that packets are also hexdumped lfilter: a truth function that decides whether a packet must be displayedNrrkrlr) rpr)r9rhrrJrqrr<r rr0r0r1r s z_PacketList.hexdumpcCszt|jD]j\}}||}|tjr |dus8||r tdtjj|dd| d| |ft | tjj q dS)z#Same as hexraw(), for Padding layerNrrkrlr)rpr)r9rIr padding_layerrhrJrqrr<r rrrr0r0r1paddings   z_PacketList.paddingcCst|jD]\}}||}|tjr |tjj}||ddt|krPq |dus`||r t dtj j |dd| d| |ft|tjjq dS)z+Same as padding() but only non null paddingNrCrrkrlr)rpr)r9rIrrrrr4rhrJrqrr<r )r.rjrrr)rPpadr0r0r1 nzpaddings   z_PacketList.nzpaddingc Ks|durdd}|}i}|jD]t}||}z ||}WntyNYqYn0t|dkr~||ddt|dq||dd||<qd}t |D]<\\}} } |d || t | trd d d | Dn| f7}q|d 7}t |fi|S)amGraphes a conversations between sources and destinations and display it (using graphviz and imagemagick) :param getsrcdst: a function that takes an element of the list and returns the source, the destination and optionally a label. By default, returns the IP source and destination from IP and ARP layers :param type: output type (svg, ps, gif, jpg, etc.), passed to dot's "-T" option :param target: filename or redirect. Defaults pipe to Imagemagick's display program :param prog: which graphviz program to use NcSs^d|vr|dj|djfSd|vr8|dj|djfSd|vrT|dj|djfStdS)zExtract src and dst addressesIPIPv6ARPN)srcdstZpsrcZpdst TypeError)Zpktr0r0r1 _getsrcdstsz-_PacketList.conversations.._getsrcdstrrCzdigraph "conv" { z "%s" -> "%s" [label="%s"] z, css|]}t|VqdSr3)strr>r0r0r1rrBz,_PacketList.conversations..z} ) r)r9 Exceptionr4rsetaddgetrrr,joinr ) r.Z getsrcdstrvrconvrPcgrrQrlr0r0r1 conversationss(       "$ z_PacketList.conversationsc Ks|durdd}|dur dd}|dur0dd}i}i}i}|jD]}z||||||} } } | |vr|| \} } | d7} | | vr| | | | f|| <nd| gf|| <| |vr|| \} } | d7} | | vr| | | | f|| <nd| gf|| <|| dd|| <WqBty&YqBYqB0qBdd }|d d t|D\}}|d d t|D\}}|t|\}}d }|d7}|D]F} || \} }dt| |||} |dt| t| | | f7}q|d7}|D]F} || \} }dt| |||} |dt| t| | | f7}q|D]B} || } dt| |||} |dt| t| | | f7}q,|d7}|D]6} || \} }|D]} |dt| t| f7}qq||D]6} || \} }|D]} |dt| t| f7}q̐q|d7}t|fi|S)zExperimental clone attempt of http://sourceforge.net/projects/afterglow each datum is reduced as src -> event -> dst and the data are graphed. by default we have IP.src -> IP.dport -> IP.dstNcWs|ddjSNrr)rr@r0r0r1%rBz'_PacketList.afterglow..cWs|ddjSr)dportrr0r0r1r'rBcWs|ddjSr)rrr0r0r1r)rBrCrcSs<tdddd|D\}}||kr(d}|dkr4d}||fS)NcSs$t|d|dt|d|dfS)NrrC)minmax)abr0r0r1rFrBz7_PacketList.afterglow..minmax..css|]}||fVqdSr3r0)r?rr0r0r1rGrBz8_PacketList.afterglow..minmax..rrCr)r@mMr0r0r1minmaxDs z%_PacketList.afterglow..minmaxcss|]\}}|VqdSr3r0r?r@_r0r0r1rNrBz(_PacketList.afterglow..css|]\}}|VqdSr3r0rr0r0r1rOrBz'digraph "afterglow" { edge [len=2.5]; z # src nodes zl"src.%s" [label = "%s", shape=box, fillcolor="#FF0000", style=filled, fixedsize=1, height=%.2f,width=%.2f]; z# event nodes zp"evt.%s" [label = "%s", shape=circle, fillcolor="#00FFFF", style=filled, fixedsize=1, height=%.2f, width=%.2f]; zr"dst.%s" [label = "%s", shape=triangle, fillcolor="#0000ff", style=filled, fixedsize=1, height=%.2f, width=%.2f]; z### z "src.%s" -> "evt.%s"; z "evt.%s" -> "dst.%s"; }) r)rrrr itervaluesfloatreprr )r.reventrrvsleldlrrrQrrnlstrZminsZmaxsZmineZmaxeZmindZmaxdrrZlst1Zlst2r0r0r1 afterglowsv                 z_PacketList.afterglowc Ksddl}|j}t|j}t|jD]\}}||jfi|}|}|| | dd||f|jj j gt jdkrtdd||jj||jjjd|jjddq&|S)NrrCz+\font\cmssfont=cmss12\cmssfont{Frame %i/%i}r.) paperformatmarginZ fittosize)pyxZdocumentr4r)rpr9 canvas_dumpZbboxtextlefttopsizeZLARGErverboswriterpagerZA4unitZt_cm) r.rvrrZlen_resrrr)rZcbbr0r0r1rps  ,    z_PacketList.canvas_dumpcCsN|durdd}|}t|j}|jD] }|||}|||q$t|S)NcSsd|vrd|vsd|vrd}d}||f}d|vr6d}n {}:%r,TCP.dport%ZUDPz'UDP {}:%r,UDP.sport% > {}:%r,UDP.dport%ZICMPz?ICMP {} > {} type=%r,ICMP.type% code=%r,ICMP.code% id=%ICMP.id%ZICMPv6z8ICMPv6 {} > {} type=%r,ICMPv6.type% code=%r,ICMPv6.code%zIPv6 {} > {} nh=%IPv6.nh%zIP {} > {} proto=%IP.proto%rzARP %ARP.psrc% > %ARP.pdst%zEthernet type=%04xr,Ether.type%rF)rformat)rPZ ip_src_fmtZ ip_dst_fmtZaddr_fmtrmr0r0r1_session_extractors*  z0_PacketList.sessions.._session_extractor)rrar)r9rr)r.Zsession_extractorrsessionsrPsessr0r0r1rs  z_PacketList.sessionsc Os|dd}td|jd}t|dts0|f}|jD]}||}d}|D]~}|d} |d} |d} | jD]Z} | |vrnt|dks||  | j | krn|s| }|r| d }t || | j | qnqL||q6|S) aN lst.replace(,[,]) lst.replace( (fld,[ov],nv),(fld,[ov,]nv),...) if ov is None, all values are replaced ex: lst.replace( IP.src, "192.168.1.1", "10.0.0.1" ) lst.replace( IP.ttl, 64 ) lst.replace( (IP.ttl, 64), (TCP.sport, 666, 777), ) delete_checksumsFz Replaced %sr`rrCrT)rr+r*r,tupler)r9Zownersr4Z getfieldvalr/copyrsetattrr) r.rurvrr@_prPcopiedschemeZfldoldnewor0r0r1replaces,      z_PacketList.replacecs||durdj|j}|dur&j}i|dur<||d<|durT|d<tddfddjDD||S) aReturns the packet list from a given layer. See ``Packet.getlayer`` for more info. :param cls: search for a layer that is an instance of ``cls`` :type cls: Type[scapy.packet.Packet] :param nb: return the nb^th layer that is an instance of ``cls`` :type nb: Optional[int] :param flt: filter parameters for ``Packet.getlayer`` :type flt: Optional[Dict[str, Any]] :param name: optional name for the new PacketList :type name: Optional[str] :param stats: optional list of protocols to give stats on; if not specified, inherits from this PacketList. :type stats: Optional[List[Type[scapy.packet.Packet]]] :rtype: scapy.plist.PacketList Nz {} layer {}clsnbcSsg|]}|dur|qSr3r0)r?Zpcr0r0r1r_sz(_PacketList.getlayer..c3s$|]}|jfiVqdSr3)r9r)r?rPZ getlayer_argr.r0r1rsz'_PacketList.getlayer..)rr*rbr(updater+r))r.rrZfltr/r(r0rr1rs"  z_PacketList.getlayer)Nr+N)NN)NN)NF)rCN)NF)N)N)N)N)N)NNN)N)NNNN)'rb __module__ __qualname__ __slots__r2r6r9r<r=rSrWrXrYr\rdrrergr;rsrwrzrrrrrrrrr rrrrrrrrr0r0r0r1r'Asr        / * 6    7 V +#r'c@seZdZdddZdS)r+FNc Cs|jdd}g}d}|dus&|dkr.t|}|t|kr||}|}|t||t|dkr|d7}||}||rF|t|||rd||_d||_qF||=||=|d8}qqF|d7}q.|rdd|D}t|t|fS)ag Matches packets in the list :param multi: True if a packet can have multiple answers :param lookahead: Maximum number of packets between packet and answer. If 0 or None, full remaining list is scanned for answers :return: ( (matched couples), (unmatched packets) ) NrrCrcSsg|]}t|ds|qS) _answered)hasattrr>r0r0r1r_#rBz!PacketList.sr..) r)r4rZanswersrr$rrfr+) r.multiZ lookaheadZremainsrrrrQjrNr0r0r1rs2      z PacketList.sr)FN)rbrrrr0r0r0r1r+sr+cs2eZdZgZd fdd ZddZddZZS) rfNResultscstt||||dSr3)superrfr2r-rar0r1r24szSndRcvList.__init__cCs|dS)NrCr0r7r0r0r1r9<szSndRcvList._elt2pktcCsd|d|dfS)Nz %s ==> %srrCr:r7r0r0r1r<@szSndRcvList._elt2sum)NrN)rbrrrr2r9r< __classcell__r0r0rr1rf/srf)6__doc__ __future__rrr collectionsrZ scapy.compatrZ scapy.configrZscapy.base_classesrrr r r Z scapy.utilsr r rrrr functoolsrZscapy.libs.sixZlibsrrrrrrrrrrrrrr r!Z scapy.packetr"rr#r$r& add_metaclassr'r+Z_PacketIterablerfr0r0r0r1sR       @   A)