Exemple #1
0
 def __init__(self, filename, fdesc, magic):
     RawPcapReader.__init__(self, filename, fdesc, magic)
     try:
         self.LLcls = conf.l2types[self.linktype]
     except KeyError:
         warning("PcapReader: unknown LL type [%i]/[%#x]. Using Raw packets" % (self.linktype,self.linktype))
         self.LLcls = conf.raw_layer
Exemple #2
0
    def process(self):
        """Entry point of SelectableSelector"""
        if WINDOWS:
            select_inputs = []
            for i in self.inputs:
                if not isinstance(i, SelectableObject):
                    warning("Unknown ignored object type: %s", type(i))
                elif i.__selectable_force_select__:
                    # Then use select.select
                    select_inputs.append(i)
                elif not self.remain and i.check_recv():
                    self.results.append(i)
                else:
                    i.wait_return(self._exit_door)
            if select_inputs:
                # Use default select function
                self.results.extend(select(select_inputs, [], [], self.remain)[0])  # noqa: E501
            if not self.remain:
                return self.results

            threading.Thread(target=self._timeout_thread, args=(self.remain,)).start()  # noqa: E501
            if not self._ended:
                self.available_lock.acquire()
            return self.results
        else:
            r, _, _ = select(self.inputs, [], [], self.remain)
            return r
Exemple #3
0
 def get_if_raw_addr(ifname):
     i = dnet.intf()
     try:
         return i.get(ifname)["addr"].data
     except OSError:
         warning("No MAC address found on %s !" % ifname)
         return b"\0\0\0\0"
Exemple #4
0
 def m2i(self, pkt, s):
     family = None
     if pkt.type == 1: # A
         family = socket.AF_INET
     elif pkt.type == 12: # PTR
         l = orb(s[0])
         if l & 0xc0 and hasattr(pkt, "_orig_s") and pkt._orig_s: # Compression detected
             p = ((l & ~0xc0) << 8) + orb(s[1]) - 12
             s = DNSgetstr(pkt._orig_s, p)[0]
         else: # No compression / Cannot decompress
             if hasattr(pkt, "_orig_s") and pkt._orig_s:
                 s = DNSgetstr(pkt._orig_s, pkt._orig_p)[0]
             else:
                 s = DNSgetstr(s, 0)[0]
     elif pkt.type == 16: # TXT
         ret_s = b""
         tmp_s = s
         # RDATA contains a list of strings, each are prepended with
         # a byte containing the size of the following string.
         while tmp_s:
             tmp_len = orb(tmp_s[0]) + 1
             if tmp_len > len(tmp_s):
               warning("DNS RR TXT prematured end of character-string (size=%i, remaining bytes=%i)" % (tmp_len, len(tmp_s)))
             ret_s += tmp_s[1:tmp_len]
             tmp_s = tmp_s[tmp_len:]
         s = ret_s
     elif pkt.type == 28: # AAAA
         family = socket.AF_INET6
     if family is not None:
         s = inet_ntop(family, s)
     return s
Exemple #5
0
 def lazy_init(self):
     try:
         f=open(self.filename)
     except IOError:
         warning("Can't open base %s" % self.filename)
         return
     try:
         self.base = []
         for l in f:
             if l[0] in ["#","\n"]:
                 continue
             l = tuple(l.split(":"))
             if len(l) < 8:
                 continue
             def a2i(x):
                 if x.isdigit():
                     return int(x)
                 return x
             li = [ a2i(i) for i in l[1:4] ]
             #if li[0] not in self.ttl_range:
             #    self.ttl_range.append(li[0])
             #    self.ttl_range.sort()
             self.base.append((l[0], li[0], li[1], li[2], l[4], l[5], l[6], l[7][:-1]))
     except:
         warning("Can't parse p0f database (new p0f version ?)")
         self.base = None
     f.close()
Exemple #6
0
    def tls_session_update(self, msg_str):
        super(SSLv2ClientMasterKey, self).tls_session_update(msg_str)

        s = self.tls_session
        cs_val = self.cipher
        if cs_val not in _tls_cipher_suites_cls:
            warning("Unknown cipher suite %d from ClientMasterKey" % cs_val)
        else:
            cs_cls = _tls_cipher_suites_cls[cs_val]

        tls_version = s.tls_version
        connection_end = s.connection_end
        wcs_seq_num = s.wcs.seq_num
        s.pwcs = writeConnState(ciphersuite=cs_cls,
                                            connection_end=connection_end,
                                            seq_num=wcs_seq_num,
                                            tls_version=tls_version)
        rcs_seq_num = s.rcs.seq_num
        s.prcs = readConnState(ciphersuite=cs_cls,
                                           connection_end=connection_end,
                                           seq_num=rcs_seq_num,
                                           tls_version=tls_version)

        if self.decryptedkey is not None:
            s.master_secret = self.clearkey + self.decryptedkey
            s.compute_sslv2_km_and_derive_keys()

            if s.pwcs.cipher.type == "block":
                s.pwcs.cipher.iv = self.keyarg
            if s.prcs.cipher.type == "block":
                s.prcs.cipher.iv = self.keyarg

            s.triggered_prcs_commit = True
            s.triggered_pwcs_commit = True
Exemple #7
0
 def start(self):
     if self.thread_lock.acquire(0):
         _t = Thread(target=self.run)
         _t.start()
         self.threadid = _t.ident
     else:
         warning("Pipe engine already running")
Exemple #8
0
 def guess_payload_class(self, payload):
     if self.type == TZSP.TYPE_KEEPALIVE:
         if len(payload):
             warning('payload (%i bytes) in KEEPALIVE/NULL packet' % len(payload))  # noqa: E501
         return Raw
     else:
         return _tzsp_guess_next_tag(payload)
Exemple #9
0
    def fill_and_store(self, modulus=None, modulusLen=None, pubExp=None,
                             prime1=None, prime2=None, coefficient=None,
                             exponent1=None, exponent2=None, privExp=None):
        pubExp = pubExp or 65537
        if None in [modulus, prime1, prime2, coefficient, privExp,
                    exponent1, exponent2]:
            # note that the library requires every parameter
            # in order to call RSAPrivateNumbers(...)
            # if one of these is missing, we generate a whole new key
            real_modulusLen = modulusLen or 2048
            self.key = rsa.generate_private_key(public_exponent=pubExp,
                                                key_size=real_modulusLen,
                                                backend=default_backend())
            self.pubkey = self.key.public_key()
        else:
            real_modulusLen = len(binrepr(modulus))
            if modulusLen and real_modulusLen != modulusLen:
                warning("modulus and modulusLen do not match!")
            pubNum = rsa.RSAPublicNumbers(n=modulus, e=pubExp)
            privNum = rsa.RSAPrivateNumbers(p=prime1, q=prime2,
                                            dmp1=exponent1, dmq1=exponent2,
                                            iqmp=coefficient, d=privExp,
                                            public_numbers=pubNum)
            self.key = privNum.private_key(default_backend())
            self.pubkey = self.key.public_key()

        # Lines below are only useful for the legacy part of pkcs1.py
        pubNum = self.pubkey.public_numbers()
        self._modulusLen = real_modulusLen
        self._modulus = pubNum.n
        self._pubExp = pubNum.e
Exemple #10
0
    def compute_tls13_handshake_secrets(self):
        """
        Ciphers key and IV are updated accordingly for Handshake data.
        self.handshake_messages should be ClientHello...ServerHello.
        """
        if self.tls13_early_secret is None:
            warning("No early secret. This is abnormal.")

        hkdf = self.prcs.hkdf

        self.tls13_handshake_secret = hkdf.extract(self.tls13_early_secret,
                                                   self.tls13_dhe_secret)

        chts = hkdf.derive_secret(self.tls13_handshake_secret,
                                  "client handshake traffic secret",
                                  "".join(self.handshake_messages))
        self.tls13_derived_secrets["client_handshake_traffic_secret"] = chts

        shts = hkdf.derive_secret(self.tls13_handshake_secret,
                                  "server handshake traffic secret",
                                  "".join(self.handshake_messages))
        self.tls13_derived_secrets["server_handshake_traffic_secret"] = shts

        if self.connection_end == "server":
            self.prcs.tls13_derive_keys(chts)
            self.pwcs.tls13_derive_keys(shts)
        elif self.connection_end == "client":
            self.pwcs.tls13_derive_keys(chts)
            self.prcs.tls13_derive_keys(shts)
Exemple #11
0
 def __init__(self, iface = None, type = ETH_P_ALL, filter=None, nofilter=0):
     if iface is None:
         iface = conf.iface
     self.ins = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(type))
     self.ins.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 0)
     _flush_fd(self.ins)
     if not nofilter: 
         if conf.except_filter:
             if filter:
                 filter = "(%s) e nao (%s)" % (filter, conf.except_filter)
             else:
                 filter = "nao (%s)" % conf.except_filter
         if filter is not None:
             attach_filter(self.ins, filter)
     self.ins.bind((iface, type))
     self.ins.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2**30)
     self.outs = self.ins
     self.outs.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 2**30)
     sa_ll = self.outs.getsockname()
     if sa_ll[3] in conf.l2types:
         self.LL = conf.l2types[sa_ll[3]]
     elif sa_ll[1] in conf.l3types:
         self.LL = conf.l3types[sa_ll[1]]
     else:
         self.LL = conf.default_l2
         warning("Impossivel saber o tipo (interface=%s protocol=%#x familia=%i). Usando %s" % (sa_ll[0],sa_ll[1],sa_ll[3],self.LL.name))
Exemple #12
0
    def recv(self, x=MTU):
        pkt, sa_ll = self.ins.recvfrom(x)
        if sa_ll[2] == socket.PACKET_OUTGOING:
            return None
        if sa_ll[3] in conf.l2types:
            cls = conf.l2types[sa_ll[3]]
            lvl = 2
        elif sa_ll[1] in conf.l3types:
            cls = conf.l3types[sa_ll[1]]
            lvl = 3
        else:
            cls = conf.default_l2
            warning(" Impossivel saber o tipo (interface=%s protocol=%#x familia=%i). Usando %s" % (sa_ll[0],sa_ll[1],sa_ll[3],cls.name))
            lvl = 2

        try:
            pkt = cls(pkt)
        except KeyboardInterrupt:
            raise
        except:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(pkt)
        if lvl == 2:
            pkt = pkt.payload
            
        if pkt is not None:
            pkt.time = get_last_packet_timestamp(self.ins)
        return pkt
Exemple #13
0
def _ssl_PRF(secret, seed, req_len):
    """
    Provides the implementation of SSLv3 PRF function:

     SSLv3-PRF(secret, seed) =
        MD5(secret || SHA-1("A" || secret || seed)) ||
        MD5(secret || SHA-1("BB" || secret || seed)) ||
        MD5(secret || SHA-1("CCC" || secret || seed)) || ...

    req_len should not be more than  26 x 16 = 416.

    """
    if req_len > 416:
        warning("_ssl_PRF() is not expected to provide more than 416 bytes")
        return ""

    d = ["A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M",
         "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"]
    res = ""
    hash_md5 = tls_hash_algs["MD5"]
    rounds = (req_len + hash_md5.hash_len - 1) / hash_md5.hash_len

    for i in range(rounds):
        label = d[i] * (i+1)
        tmp = tls_hash_algs["SHA"]().digest(label + secret + seed)
        res += tls_hash_algs["MD5"]().digest(secret + tmp)

    return res[:req_len]
Exemple #14
0
def set_iface_monitor(iface, monitor):
    """Sets the monitor mode (or remove it) from an interface.
    params:
     - iface: the iwconfig interface
     - monitor: True if the interface should be set in monitor mode,
                False if it should be in managed mode
    """
    mode = get_iface_mode(iface)
    if mode == "unknown":
        warning("Could not parse iwconfig !")
    current_monitor = mode == "monitor"
    if monitor == current_monitor:
        # Already correct
        return True
    s_mode = "monitor" if monitor else "managed"

    def _check_call(commands):
        p = subprocess.Popen(commands,
                             stderr=subprocess.PIPE,
                             stdout=subprocess.PIPE)
        stdout, stderr = p.communicate()
        if p.returncode != 0:
            warning("%s failed !" % " ".join(commands))
            return False
        return True
    try:
        assert _check_call(["ifconfig", iface, "down"])
        assert _check_call(["iwconfig", iface, "mode", s_mode])
        assert _check_call(["ifconfig", iface, "up"])
        return True
    except AssertionError:
        return False
Exemple #15
0
    def decompressSourceAddr(self, packet):
        try:
            tmp_ip = inet_pton(socket.AF_INET6, self.sourceAddr)
        except socket.error:
            tmp_ip = b"\x00" * 16

        if self.sac == 0:
            if self.sam == 0x0:
                pass
            elif self.sam == 0x1:
                tmp_ip = LINK_LOCAL_PREFIX[0:8] + tmp_ip[16 - source_addr_mode2(self):16]  # noqa: E501
            elif self.sam == 0x2:
                tmp = LINK_LOCAL_PREFIX[0:8] + b"\x00\x00\x00\xff\xfe\x00"
                tmp_ip = tmp + tmp_ip[16 - source_addr_mode2(self):16]
            elif self.sam == 0x3:  # EXTRACT ADDRESS FROM Dot15d4
                tmp_ip = _extract_dot15d4address(self, source=True)
            else:
                warning("Unknown source address compression mode !")
        else:  # self.sac == 1:
            if self.sam == 0x0:
                pass
            elif self.sam == 0x2:
                # TODO: take context IID
                tmp = LINK_LOCAL_PREFIX[0:8] + b"\x00\x00\x00\xff\xfe\x00"
                tmp_ip = tmp + tmp_ip[16 - source_addr_mode2(self):16]
            elif self.sam == 0x3:
                tmp_ip = LINK_LOCAL_PREFIX[0:8] + b"\x00" * 8  # TODO: CONTEXT ID  # noqa: E501
            else:
                raise Exception('Unimplemented')
        self.sourceAddr = inet_ntop(socket.AF_INET6, tmp_ip)
        return self.sourceAddr
Exemple #16
0
 def m2i(self, pkt, m):
     # I try to ensure that we don't read off the end of our packet based
     # on bad length fields we're provided in the packet. There are still
     # conditions where struct.unpack() may not get enough packet data, but
     # worst case that should result in broken attributes (which would
     # be expected). (wam)
     lst = []
     while len(m) >= 4:
         trans_type, = struct.unpack("!H", m[:2])
         is_tlv = not (trans_type & 0x8000)
         if is_tlv:
             # We should probably check to make sure the attribute type we
             # are looking at is allowed to have a TLV format and issue a 
             # warning if we're given an TLV on a basic attribute.
             value_len, = struct.unpack("!H", m[2:4])
             if value_len+4 > len(m):
                 warning("Bad length for ISAKMP tranform type=%#6x" % trans_type)
             value = m[4:4+value_len]
             value = reduce(lambda x,y: (x<<8)|y, struct.unpack("!%s" % ("B"*len(value),), value),0)
         else:
             trans_type &= 0x7fff
             value_len=0
             value, = struct.unpack("!H", m[2:4])
         m=m[4+value_len:]
         lst.append(self.num2type(trans_type, value))
     if len(m) > 0:
         warning("Extra bytes after ISAKMP transform dissection [%r]" % m)
     return lst
Exemple #17
0
    def pre_dissect(self, m):
        s = self.tls_session
        tbd = m
        if s.tls_version >= 0x0301:
            if len(m) < 2:      # Should not happen
                return m
            l = struct.unpack("!H", m[:2])[0]
            if len(m) != l + 2:
                err = "TLS 1.0+, but RSA Encrypted PMS with no explicit length"
                warning(err)
            else:
                tbd = m[2:]
        if s.server_tmp_rsa_key is not None:
            # priority is given to the tmp_key, if there is one
            decrypted = s.server_tmp_rsa_key.decrypt(tbd)
            pms = decrypted[-48:]
        elif s.server_rsa_key is not None:
            decrypted = s.server_rsa_key.decrypt(tbd)
            pms = decrypted[-48:]
        else:
            # the dispatch_hook is supposed to prevent this case
            pms = b"\x00" * 48
            err = "No server RSA key to decrypt Pre Master Secret. Skipping."
            warning(err)

        s.pre_master_secret = pms
        s.compute_ms_and_derive_keys()

        return pms
Exemple #18
0
 def __new__(cls, name, bases, dct):
     c = super(BERcodec_metaclass, cls).__new__(cls, name, bases, dct)
     try:
         c.tag.register(c.codec, c)
     except:
         warning("Error registering %r for %r" % (c.tag, c.codec))
     return c
Exemple #19
0
def _ssl_PRF(secret, seed, req_len):
    """
    Provides the implementation of SSLv3 PRF function:

     SSLv3-PRF(secret, seed) =
        MD5(secret || SHA-1("A" || secret || seed)) ||
        MD5(secret || SHA-1("BB" || secret || seed)) ||
        MD5(secret || SHA-1("CCC" || secret || seed)) || ...

    req_len should not be more than  26 x 16 = 416.
    """
    if req_len > 416:
        warning("_ssl_PRF() is not expected to provide more than 416 bytes")
        return ""

    d = [b"A", b"B", b"C", b"D", b"E", b"F", b"G", b"H", b"I", b"J", b"K", b"L",  # noqa: E501
         b"M", b"N", b"O", b"P", b"Q", b"R", b"S", b"T", b"U", b"V", b"W", b"X",  # noqa: E501
         b"Y", b"Z"]
    res = b""
    hash_sha1 = _tls_hash_algs["SHA"]()
    hash_md5 = _tls_hash_algs["MD5"]()
    rounds = (req_len + hash_md5.hash_len - 1) // hash_md5.hash_len

    for i in range(rounds):
        label = d[i] * (i + 1)
        tmp = hash_sha1.digest(label + secret + seed)
        res += hash_md5.digest(secret + tmp)

    return res[:req_len]
Exemple #20
0
    def recv(self, x=MTU):
        pkt, sa_ll = self.ins.recvfrom(x)
        if sa_ll[2] == socket.PACKET_OUTGOING:
            return None
        if sa_ll[3] in conf.l2types:
            cls = conf.l2types[sa_ll[3]]
            lvl = 2
        elif sa_ll[1] in conf.l3types:
            cls = conf.l3types[sa_ll[1]]
            lvl = 3
        else:
            cls = conf.default_l2
            warning("Unable to guess type (interface=%s protocol=%#x family=%i). Using %s", sa_ll[0], sa_ll[1], sa_ll[3], cls.name)  # noqa: E501
            lvl = 3

        try:
            pkt = cls(pkt)
        except KeyboardInterrupt:
            raise
        except Exception:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(pkt)
        if lvl == 2:
            pkt = pkt.payload

        if pkt is not None:
            from scapy.arch import get_last_packet_timestamp
            pkt.time = get_last_packet_timestamp(self.ins)
        return pkt
 def lazy_init(self):
     try:
         f = open(self.filename)
     except IOError:
         return
     self.base = {}
     p = None
     name = ""
     try:
         for l in f:
             l = l.strip()
             if not l or l[0] == ';':
                 continue
             if l[0] == '*':
                 if p is not None:
                     p[""] = name
                 name = l[1:].strip()
                 p = self.base
                 continue
             if l[0] not in list("0123456"):
                 continue
             res = l[2:].split()
             res[-1] = quesoTCPflags(res[-1])
             res = " ".join(res)
             if not p.has_key(res):
                 p[res] = {}
             p = p[res]
         if p is not None:
             p[""] = name
     except:
         self.base = None
         warning("Can't load queso base [%s]", self.filename)
     f.close()
Exemple #22
0
      def recv(self, x=MTU):
          ll = self.ins.datalink()
          if ll in conf.l2types:
              cls = conf.l2types[ll]
          else:
              cls = conf.default_l2
              warning("Unable to guess datalink type (interface=%s linktype=%i). Using %s" % (self.iface, ll, cls.name))

          pkt = None
          while pkt is None:
              pkt = self.ins.next()
              if pkt is not None:
                  ts,pkt = pkt
              if scapy.arch.WINDOWS and pkt is None:
                  raise PcapTimeoutElapsed
          try:
              pkt = cls(pkt)
          except KeyboardInterrupt:
              raise
          except:
              if conf.debug_dissector:
                  raise
              pkt = conf.raw_layer(pkt)
          pkt.time = ts
          return pkt
 def __init__(self, iface=None):
     if issubclass(type(iface), can_BusABC):
         self.iface = iface
         self.ins = None
         self.outs = None
     else:
         warning("Provide a python-can interface")
Exemple #24
0
 def m2i(self, pkt, s):
     family = None
     if pkt.type == 1:  # A
         family = socket.AF_INET
     elif pkt.type in [2, 5, 12]:  # NS, CNAME, PTR
         if hasattr(pkt, "_orig_s") and pkt._orig_s:
             if orb(s[0]) & 0xc0:
                 s = dns_get_str(s, 0, pkt)[0]
             else:
                 s = dns_get_str(pkt._orig_s, pkt._orig_p, _internal=True)[0]  # noqa: E501
         else:
             s = dns_get_str(s, 0)[0]
     elif pkt.type == 16:  # TXT
         ret_s = list()
         tmp_s = s
         # RDATA contains a list of strings, each are prepended with
         # a byte containing the size of the following string.
         while tmp_s:
             tmp_len = orb(tmp_s[0]) + 1
             if tmp_len > len(tmp_s):
                 warning("DNS RR TXT prematured end of character-string (size=%i, remaining bytes=%i)" % (tmp_len, len(tmp_s)))  # noqa: E501
             ret_s.append(tmp_s[1:tmp_len])
             tmp_s = tmp_s[tmp_len:]
         s = ret_s
     elif pkt.type == 28:  # AAAA
         family = socket.AF_INET6
     if family is not None:
         s = inet_ntop(family, s)
     return s
Exemple #25
0
def nmap_sig(target, oport=80, cport=81, ucport=1):
    res = {}

    tcpopt = [("WScale", 10),
              ("NOP", None),
              ("MSS", 256),
              ("Timestamp", (123, 0))]
    tests = [
        IP(dst=target, id=1) /
        TCP(seq=1, sport=5001 + i, dport=oport if i < 4 else cport,
            options=tcpopt, flags=flags)
        for i, flags in enumerate(["CS", "", "SFUP", "A", "S", "A", "FPU"])
    ]
    tests.append(IP(dst=target) / UDP(sport=5008, dport=ucport) / (300 * "i"))

    ans, unans = sr(tests, timeout=2)
    ans.extend((x, None) for x in unans)

    for snd, rcv in ans:
        if snd.sport == 5008:
            res["PU"] = (snd, rcv)
        else:
            test = "T%i" % (snd.sport - 5000)
            if rcv is not None and ICMP in rcv:
                warning("Test %s answered by an ICMP", test)
                rcv = None
            res[test] = rcv

    return nmap_probes2sig(res)
Exemple #26
0
 def __init__(self, iface=None, type=ETH_P_ALL, promisc=None, filter=None, nofilter=0):  # noqa: E501
     self.iface = conf.iface if iface is None else iface
     self.ins = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(type))  # noqa: E501
     self.ins.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 0)
     if not nofilter:
         if conf.except_filter:
             if filter:
                 filter = "(%s) and not (%s)" % (filter, conf.except_filter)
             else:
                 filter = "not (%s)" % conf.except_filter
         if filter is not None:
             attach_filter(self.ins, filter, iface)
     self.promisc = conf.sniff_promisc if promisc is None else promisc
     if self.promisc:
         set_promisc(self.ins, self.iface)
     self.ins.bind((self.iface, type))
     _flush_fd(self.ins)
     self.ins.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2**30)
     self.outs = self.ins
     self.outs.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 2**30)
     sa_ll = self.outs.getsockname()
     if sa_ll[3] in conf.l2types:
         self.LL = conf.l2types[sa_ll[3]]
     elif sa_ll[1] in conf.l3types:
         self.LL = conf.l3types[sa_ll[1]]
     else:
         self.LL = conf.default_l2
         warning("Unable to guess type (interface=%s protocol=%#x family=%i). Using %s", sa_ll[0], sa_ll[1], sa_ll[3], self.LL.name)  # noqa: E501
Exemple #27
0
    def lazy_init(self):
        try:
            fdesc = open(conf.nmap_base
                         if self.filename is None else
                         self.filename, "rb")
        except (IOError, TypeError):
            warning("Cannot open nmap database [%s]", self.filename)
            self.filename = None
            return

        self.base = []
        name = None
        sig = {}
        for line in fdesc:
            line = plain_str(line)
            line = line.split('#', 1)[0].strip()
            if not line:
                continue
            if line.startswith("Fingerprint "):
                if name is not None:
                    self.base.append((name, sig))
                name = line[12:].strip()
                sig = {}
                continue
            if line.startswith("Class "):
                continue
            line = _NMAP_LINE.search(line)
            if line is None:
                continue
            test, values = line.groups()
            sig[test] = dict(val.split('=', 1) for val in
                             (values.split('%') if values else []))
        if name is not None:
            self.base.append((name, sig))
        fdesc.close()
Exemple #28
0
    def read_packet(self, size=MTU):
        """Read blocks until it reaches either EOF or a packet, and
        returns None or (packet, (linktype, sec, usec, wirelen)),
        where packet is a string.

        """
        while True:
            try:
                blocktype, blocklen = struct.unpack(self.endian + "2I",
                                                    self.f.read(8))
            except struct.error:
                return None
            block = self.f.read(blocklen - 12)
            if blocklen % 4:
                pad = self.f.read(4 - (blocklen % 4))
                warning("PcapNg: bad blocklen %d (MUST be a multiple of 4. "
                        "Ignored padding %r" % (blocklen, pad))
            try:
                if (blocklen,) != struct.unpack(self.endian + 'I',
                                                self.f.read(4)):
                    warning("PcapNg: Invalid pcapng block (bad blocklen)")
            except struct.error:
                return None
            res = self.blocktypes.get(blocktype,
                                      lambda block, size: None)(block, size)
            if res is not None:
                return res
Exemple #29
0
    def i2m(self, pkt, x):
        if isinstance(x, str):
            return x
        s = ""
        for o in x:
            if isinstance(o, tuple) and len(o) >= 2:
                name = o[0]
                lval = o[1:]

                if isinstance(name, int):
                    onum, oval = name, "".join(lval)
                elif name in DHCPRevOptions:
                    onum, f = DHCPRevOptions[name]
                    if  f is not None:
                        lval = [f.addfield(pkt,"",f.any2i(pkt,val)) for val in lval]
                    oval = "".join(lval)
                else:
                    warning("Unknown field option %s" % name)
                    continue

                s += chr(onum)
                s += chr(len(oval))
                s += oval

            elif (isinstance(o, str) and o in DHCPRevOptions and 
                  DHCPRevOptions[o][1] == None):
                s += chr(DHCPRevOptions[o][0])
            elif isinstance(o, int):
                s += chr(o)+b"\0"
            elif isinstance(o, str):
                s += o
            else:
                warning("Malformed option %s" % o)
        return s
Exemple #30
0
 def __new__(cls, name, bases, dct):
     c = super(ASN1_Object_metaclass, cls).__new__(cls, name, bases, dct)
     try:
         c.tag.register_asn1_object(c)
     except:
         warning("Error registering %r for %r" % (c.tag, c.codec))
     return c
Exemple #31
0
 def _winreset(self):
     if ctypes.windll.kernel32.ResetEvent(
             ctypes.c_void_p(self._fd)) == 0:
         warning(ctypes.FormatError())