def _fle_message_from_packet(self, packet): src, dst = self._parse_packet_src_dst(packet) data = get_ip_packet(packet.load).data.data message = FLE.Message.from_payload(data, '%s:%d' % (src[0], src[1]), '%s:%d' % (dst[0], dst[1]), time.time()) return message
def _parse_packet_src_dst(self, packet): assert isinstance(packet, Packet) ip_p = get_ip_packet(packet.load) src = (get_ip(ip_p, ip_p.src), ip_p.data.sport) dst = (get_ip(ip_p, ip_p.dst), ip_p.data.dport) ret = (src, dst) return ret
def _is_packet_fle_initial(self, packet): data = get_ip_packet(packet.load).data.data proto, offset = read_long(data, 0) if proto != FLE.Initial.PROTO_VER: return False server_id, offset = read_long(data, offset) if server_id < 0: return False election_addr, offset = read_string(data, offset) if election_addr.count(":") != 1: return False expected_len = 8 + 8 + 4 + len(election_addr) if len(data) != expected_len: return False return True
def _message_from_packet(self, packet): """ :returns: Returns an instance of Message :raises: :exc:`BadPacket` if the packet is of an unknown type :exc:`DeserializationError` if deserialization failed :exc:`struct.error` if deserialization failed """ ip_p = get_ip_packet(packet.load, 0, self._port) if ip_p.data.sport != self._port and ip_p.data.dport != self._port: raise BadPacket("Wrong port") return self._msg_cls.from_payload( ip_p.data.data, intern("%s:%s" % (get_ip(ip_p, ip_p.src), ip_p.data.sport)), intern("%s:%s" % (get_ip(ip_p, ip_p.dst), ip_p.data.dport)), packet.time)
def _message_from_packet(self, packet): """ :returns: Returns an instance of Message :raises: :exc:`BadPacket` if the packet is of an unknown type :exc:`DeserializationError` if deserialization failed :exc:`struct.error` if deserialization failed """ ip_p = get_ip_packet(packet.load, 0, self._port) if ip_p.data.sport != self._port and ip_p.data.dport != self._port: raise BadPacket("Wrong port") return self._msg_cls.from_payload( ip_p.data.data, intern("%s:%s" % (get_ip(ip_p, ip_p.src), ip_p.data.sport)), intern("%s:%s" % (get_ip(ip_p, ip_p.dst), ip_p.data.dport)), packet.time )
def _check_packet(self, packet): """ check tcp seq duplicates NOTE: TX/RX duplicate happens on loopback interfaces :param packet: :return: None """ src, dst = self._parse_packet_src_dst(packet) tcp = get_ip_packet(packet.load).data if tcp.flags & dpkt.tcp.TH_RST: if (src, dst) in self._last_tcp_seq: del self._last_tcp_seq[(src, dst)] else: if not tcp.data: raise BadPacket("no payload") if (src, dst) in self._last_tcp_seq: last_seq = self._last_tcp_seq[(src, dst)] if tcp.seq <= last_seq: # this exception eliminates dups raise BadPacket("This sequence(%d<=%d) seen before" % (tcp.seq, last_seq)) self._last_tcp_seq[(src, dst)] = tcp.seq