a k#d4@sdZddlmZddlZddlZddlmZmZddlm Z ddl m Z m Z ddl mZddlmZdd lmZmZmZmZmZmZmZmZGd d d eZGd d d eZGdddeZGdddeZdS)z0 Sessions: decode flow of packets when sniffing ) defaultdictN)raworb)conf) NoPayloadPacket) PacketList) inet_pton)AnyCallable DefaultDictDictListOptionalTuplecastc@sjeZdZdZdddZeddZejddZed d Zejd d Zed d Z ddZ ddZ dS)DefaultSessionz#Default session: no stream decodingNFcOsH||_||_g|_d|_||_|jrD|j|j_|j|j_d|_d|_dS)NrF)_DefaultSession__prn_DefaultSession__storelst_DefaultSession__count _supersessionprnstore)selfrrZ supersessionargsZkargrE/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/sessions.py__init__#s   zDefaultSession.__init__cCs|jSN)rrrrrr7szDefaultSession.storecCs|jr||j_n||_dSr)rrr)rvalrrrr<s cCs|jSr)rr rrrrDszDefaultSession.prncCs|jr||j_n||_dSr)rrr)rfrrrrIs cCs|jr|jjS|jSdSr)rcountrr rrrr#QszDefaultSession.countcCs$|jrt|jjdSt|jdSdS)NZSniffed)rrrr rrr toPacketListYszDefaultSession.toPacketListcCs^|sdSt|tstd|jd7_|jr:|j||jrZ||}|durZt|dS)zpDEV: entry point. Will be called by sniff() for each received packet (that passes the filters). NzOnly provide a Packet.) isinstancer TypeErrorrrrappendrprint)rpktresultrrron_packet_received`s   z!DefaultSession.on_packet_received)NFN) __name__ __module__ __qualname____doc__rpropertyrsetterrr#r$r,rrrrr s"      rcs0eZdZdZddZddZfddZZS) IPSessionzVDefragment IP packets 'on-the-flow'. Usage: >>> sniff(session=IPSession) cOs&tj|g|Ri|tt|_dSr)rrrlist fragments)rrkwargsrrrryszIPSession.__init__cCsddlm}m}||vr|S||}d|_|jdks<|jjr|j|j|j |j f}|j | ||jjszb|j |djdkrg}||j ||g|d}| t|}|j|_|W|j |=SW|j |=n |j |=0dS|SdS)Nr) _defrag_listIP)scapy.layers.inetr7r8Z _defrag_posfragflagsZMFidsrcdstprotor5r( __class__rtime)rpacketr7r8ipZuniqdefragZdefragmented_packetrrr_ip_process_packet~s0zIPSession._ip_process_packetcs"|sdStt|||dSr)superr3r,rErr*r@rrr,szIPSession.on_packet_received)r-r.r/r0rrEr, __classcell__rrrHrr3rsr3c@sTeZdZdZddZddZddZdd Zd d ZeZ d d Z ddZ ddZ dS) StringBufferaWStringBuffer is an object used to re-order data received during a TCP transmission. Each TCP fragment contains a sequence number, which marks (relatively to the first sequence number) the index of the data contained in the fragment. If a TCP fragment is missed, this class will fill the missing space with zeros. cCstd|_d|_g|_dS)Nr) bytearraycontent content_len incompleter rrrrs zStringBuffer.__init__cCst|}|d}|||jkrj|jd||j|7_|j|j|f|||_t|j|jksjJ|t|j|||<dS)Nr%)lenrNrMrOr( memoryview)rdataseqdata_lenrrrr(s zStringBuffer.appendcCsdS)NTrr rrrfullszStringBuffer.fullcCs |dSr)rr rrrclearszStringBuffer.clearcCs t|jSr)boolrNr rrr__bool__szStringBuffer.__bool__cCs|jSr)rNr rrr__len__szStringBuffer.__len__cCs t|jSr)bytesrMr rrr __bytes__szStringBuffer.__bytes__cCstt|Sr)rstrr\r rrr__str__szStringBuffer.__str__N) r-r.r/r0rr(rVrWrY __nonzero__rZr\r^rrrrrJs rJcs<eZdZdZd fdd Zd ddZddZd d ZZS) TCPSessionaA Session that matches seq/ack packets together to dissect special protocols, such as HTTP. DEV: implement a class-function `tcp_reassemble` in your Packet class:: @classmethod def tcp_reassemble(cls, data, metadata, session): # data = the reassembled data from the same request/flow # metadata = empty dictionary, that can be used to store data # during TCP reassembly # session = a dictionary proper to the bidirectional TCP session, # that can be used to store anything [...] # If the packet is available, return it. Otherwise don't. # Whenever you return a packet, the buffer will be discarded. return pkt # Otherwise, maybe store stuff in metadata, and return None, # as you need additional data. return None For more details and a real example, see: https://scapy.readthedocs.io/en/latest/usage.html#how-to-use-tcpsession-to-defragment-tcp-packets :param app: Whether the socket is on application layer = has no TCP layer. This is used for instance if you are using a native TCP socket. Default to False FcsPtt|j|i|||_|r4d|_i|_i|_ntdd|_tt |_ dS)NrKcSs tifSr)rJrrrrrKz%TCPSession.__init__..) rFr`rapprSmetadatasessionr tcp_fragsdict tcp_sessions)rrbrr6rHrrrszTCPSession.__init__cCs|dj}d|vrtjntj}|r.t||jp0d}|rBt||jpDd}|rndd}td||||j |j AS||td|j |j SdS)NTCPZIPv6rKcSstddt||DS)Ncss"|]\}}t|t|AVqdSr)r).0abrrr rKz5TCPSession._get_ident..xor..)r[zip)xyrrrxorsz"TCPSession._get_ident..xorz!4sHz!HH) underlayersocketAF_INET6AF_INETr r=r>structpackdportZsport)rr*rdrqafr=r>rprrr _get_idents zTCPSession._get_identcCs(|jrX|j}t|ds|S|jt|7_||j|j|j}|rTd|_i|_|SdSddlm }m }|rt||vrx|S||j }t |t tjfr|S|j}||j}||}|j|\} } |j||d} d| vr|j}t|dr|j} n|S|| d<| | d<n| d} d| vr"|| d<| d d} | durH|d } | d <|| }| ||||jjsx||jjrd| d <||jjrd| d <d}| r| t| | | }|r$d| vr| d||_| | |j|=|j||vrd||_d||_ ||}d|_!|SdS) zzProcess each packet: matches the TCP seq/ack numbers to follow the TCP streams, and orders the fragments. tcp_reassemblerKNr)r8rhT pay_classrT relative_seqr%Ztcp_endZtcp_psh)"rbr@hasattrrSr[rzrcrdr9r8rhpayloadr&rrZ padding_layeroriginalrTryrerggetr(r;FRPrVrWrqZremove_payloadrQchksumZwirelen)rr*r{r8rhZpayZnew_datarTidentrSrcZ tcp_sessionrzr|rBrrr_process_packetst                  zTCPSession._process_packetcCs4|sdS||}|sdS||}t||dS)zHook to the Sessions API: entry point of the dissection. This will defragment IP if necessary, then process to TCP reassembly. N)rErrr,rGrrrr,vs  zTCPSession.on_packet_received)F)F) r-r.r/r0rryrr,rIrrrHrr`s  Xr`)r0 collectionsrrrruZ scapy.compatrrZ scapy.configrZ scapy.packetrrZ scapy.plistrZscapy.pton_ntopr r r r r rrrrobjectrr3rJr`rrrrs    ( R/>