h: xdZddlmZddlZddlZddlmZddlmZddl m Z m Z ddl m Z ddlmZmZmZmZmZmZmZmZmZmZmZdd lmZerdd lmZGd d eZGd deZGddeZ dee dee!ee"efee"efgee ffdZ#GddeZ$dS)z0 Sessions: decode flow of packets when sniffing ) defaultdictNorb)conf) NoPayloadPacket) inet_pton) AnyCallable DefaultDictDictIteratorListOptionalTupleTypecast TYPE_CHECKING)Self) SuperSocketcdeZdZdZd deefdZdedeefdZdd de efd Z dS) DefaultSessionz#Default session: no stream decodingN supersessioncV|rt|ts |}||_dSN) isinstancerr)selfrs R/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/sessions.py__init__zDefaultSession.__init__(s4  * < H H *'<>>L(pktreturncH|jr|j|S|S)z2 Called to pre-process the packet )rprocess)rr!s rr$zDefaultSession.process-s+   2$,,S11 1 r sockrc#tK|}|sdS||}|r|VdSdS)? Will be called by sniff() to ask for a packet N)recvr$rr%r!s rr(zDefaultSession.recv6sRiikk  Fll3  IIIII  r r) __name__ __module__ __qualname____doc__rrrrr$rr(r rrr%s--))Xd^)))) 6hv&6  8F+;      r rc4eZdZdZdZdedeefdZdS) IPSessionzVDefragment IP packets 'on-the-flow'. Usage: >>> sniff(session=IPSession) cbtj|g|Ri|tt|_dSr)rrrlist fragments)rargskwargss rrzIPSession.__init__Is66t666v666$T**r packetr"cTddlm}m}|sdS||vr|S|||jdS)Nr)IP_defrag_ip_pkt)scapy.layers.inetr8r9r3)rr6r8r9s rr$zIPSession.processNsP88888888 4 V  M~fdn55a88r N)r*r+r,r-rrrr$r.r rr0r0BsT +++ 9f9&)9999999r r0creZdZdZdZddedeeddfdZdeddfd Z d Z d Z d Z e Z d ZdZdZdS) StringBufferaWStringBuffer is an object used to re-order data received during a TCP transmission. Each TCP fragment contains a sequence number, which marks (relatively to the first sequence number) the index of the data contained in the fragment. If a TCP fragment is missed, this class will fill the missing space with zeros. cXtd|_d|_d|_g|_dS)Nr r) bytearraycontent content_lennoff incompleters rrzStringBuffer.__init__cs) ~~  r Ndataseqr"c|sdSt|}||j}|dz |jz }|dkrCtd| z|jz|_|xj| z c_|xj|z c_d}||z|jkrG|xjd||jz |zzz c_||z|_t|j|jksJ|t |j|||z<dS)Nr:r)lenrArBr?r@ memoryview)rrErFdata_lens rappendzStringBuffer.appendjs  Ft99 ;"CAg ! 77%W%566EDL   # &   II IIC >D, , , LLGsT-='='HI ILL #X~D t|$$(88888 8< 4<  S8^!3444r icN|j|d|_|xj|zc_dSr)r@rA)rrMs r shiftleftzStringBuffer.shiftlefts.|ABB'  Ar c t|Sr)boolrDs rfullzStringBuffer.fullsDzzr c.|dSr)rrDs rclearzStringBuffer.clears r c*t|jSr)rQrArDs r__bool__zStringBuffer.__bool__sD$%%%r c|jSr)rArDs r__len__zStringBuffer.__len__s r c*t|jSr)bytesr@rDs r __bytes__zStringBuffer.__bytes__sT\"""r cPtt|Sr)rstrr[rDs r__str__zStringBuffer.__str__sC))***r r)r*r+r,r-rrZrintrLrOrRrTrV __nonzero__rXr[r^r.r rr=r=Ws  <<5zstreamcls..s 2Tr )hasattrrc)ras`r streamclsrhs2s$%%3!!32222r ceZdZdZdfd ZddZdedeefdZ dded ee edeeffd Z d d de efd Z xZS) TCPSessiona A Session that reconstructs TCP streams. NOTE: this has the same effect as wrapping a real socket.socket into StreamSocket, but for all concurrent TCP streams (can be used on pcaps or sniffed sessions). NOTE: only protocols that implement a ``tcp_reassemble`` function will be processed by this session. Other protocols will not be reconstructed. DEV: implement a class-function `tcp_reassemble` in your Packet class:: @classmethod def tcp_reassemble(cls, data, metadata, session): # data = the reassembled data from the same request/flow # metadata = empty dictionary, that can be used to store data # during TCP reassembly # session = a dictionary proper to the bidirectional TCP session, # that can be used to store anything [...] # If the packet is available, return it. Otherwise don't. # Whenever you return a packet, the buffer will be discarded. return pkt # Otherwise, maybe store stuff in metadata, and return None, # as you need additional data. return None For more details and a real example, see: https://scapy.readthedocs.io/en/latest/usage.html#how-to-use-tcpsession-to-defragment-tcp-packets :param app: Whether the socket is on application layer = has no TCP layer. This is identical to StreamSocket so only use this if your underlying source of data isn't a socket.socket. Fctt|j|i|||_|r"t |_i|_i|_n.td|_ tt|_ ddl m }||_dS)Nc"tifSr)r=r.r rrfz%TCPSession.__init__..s,r r)TCP)superrjrappr=rEmetadatasessionr tcp_fragsdict tcp_sessionsr;rmstop_dissection_after)rror4r5rm __class__s rrzTCPSession.__init__s(j$($9&999  $DIDMDLL),,DN!,!!D  *)))))%("""r ch|dj}d|vr tjn tj}|rt ||jpd}|rt ||jpd}|r0d}tjd||||j |j z S||ztjd|j |j zS)NrmIPv6r cPtdt||DS)Nc3ZK|]&\}}t|t|z V'dSrr).0abs r z5TCPSession._get_ident..xor..s6CCASVVc!ff_CCCCCCr )rZzip)xys rxorz"TCPSession._get_ident..xors'CCQCCCCCCr z!4sHz!HH) underlayersocketAF_INET6AF_INETr srcdststructpackdportsport)rr!rqrafrrrs r _get_identzTCPSession._get_identsZ* &# V__6>:Yr:>::Ac:Yr:>::Ac  H D D D;vss3}}ci#)6KLL L9v{5#)SYGGG Gr r!r"ct|tjrtt|jS|tj}|(|j!|j`tt|jSdS)zAStrip the packet of any padding, and return the padding. N) rr padding_layerrrZloadgetlayerrpayload)rr!pads r_strip_paddingzTCPSession._strip_paddingsj c4- . . )sx(( (ll4-.. ?s~9&sx(( (tr Nract d}|jrd|jt||t |ts|j}d|jvr|jd}n|t|x|jd<}ndS|jr)|t|j|j|j }|r| |}|rY|j t|jt|z t |tjrdSn|j|j|SdSt!t"||}|dS|}ddlm}m}|sdS||vr|S||j} t | t.tjfr|S| j} ||} |j| \} } |j||d}||j}d| vr|| d<d| vr+|| dkr| | d|z d} | sdS| d}d| vr5||| x| d<}t|x| d<}n| d}| d d}| |d z x}| d <||z }| | |||jj s||jj!rd| d <||jj"rd| d <| r$|| d <| | d<|t| | |}|rMd| vr| d||_| | |}|rn| j#t|z }||z| d <| ||t| | |}|r||z}| |}nn|n| |j| =||jt| z| d<t |tjrdS| j$%||vrd||_ d||_&||z }d|_'|SdS)zzProcess each packet: matches the TCP seq/ack numbers to follow the TCP streams, and orders the fragments. Nrcr)r8rmTrFnext_seq pay_class relative_seqr:tcp_endtcp_pshoriginalident)(rorErLrZrrvrprhrRrqrrOrIrrrTrnrjr$r;r8rmrrrrrrrtrFguess_payload_classgetflagsFRPrArremove_payloadchksumwirelen)rr!rar6rcpadding_pktr8rmpaynew_datarrErp tcp_sessionrFrr full_length sub_packetrvs rr$zTCPSession.processs9  8  I  U3ZZ ( ( ({:c5#9#9{m4=00!%/?!@CLS>>Q ./..ty~~ '$)$$ML  --f55&I''DIW(EFFF!&$*<==$#t$IOO%%% ##%%% 4Z&&..s33 <4C-------- 4 c>>J#h cIt'9: ; ; J<$$.h'T(B(BC #hl  !HUO  ! !cHZ,@&@&@ 4s : ; ;  's3x~/ '"&HY  s8>  '"&HY  99;; #&HZ %HW #^d F '   'C NN   ))&11G *".W= +7++E({++++^$KK j(F"11*==GG *$ N5)#&s8<#h--#?HZ &$"455 t N ) ) + + +Syy"B !%B,CCKJtr r%rc#K||j}|jr"|||}|r|Vd}|n||}|r|VdS)r')ruNr )r(ruror$r)s rr(zTCPSession.recvsiid.HiII 8 /ll3''IIIC /,,s##C  tr )Fr)r*r+r,r-rrrrrZrrr$rr( __classcell__)rvs@rrjrjsB))))))*HHHH & Xe_    /3MMMd6l+M7?7GMMMMMM^8F+;r rj)%r- collectionsrrr scapy.compatr scapy.configr scapy.packetrrscapy.pton_ntopr typingr r r r rrrrrrrrscapy.supersocketrobjectrr0r=rZr]rhrjr.r rrsJ $##### ********%%%%%%                          .------V:99999999*K+K+K+K+K+6K+K+K+\ 34< 3H DcNDcN+ V% 3 3 3 3ssssssssssr