hg  dZddlmZddlmZddlmZddlmZddl Z ddl Z ddl Z ddl Z ddlZddl Z ddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddl m!Z!ddl"m#Z#m$Z$m%Z%dd l&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,m-Z-m.Z.m/Z/dd l0m1Z1m2Z2m3Z3m4Z4dd l5m6Z6dd l7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEddl*mFZFmGZGeArddlHmIZIddlJmKZKmLZLddlMmNZNddlOZOeDe=ePejQfZRdZSeDeeTfZUGddeZVeEdZWeEddZWddZWddZXdeBeYe9ffdZZdde9deYde=ePfd Z[dd!Z\e!j]j^d"Z_d#Z`e!j]j^dd$Zae!j]j^dd%Zbe!j]j^dd&Zce!j]j^dd'Zdd(Zee!j]j^ dd)eDd*e:fd+eDd*e:fd,e@eYd-efddf d.Zgejhd/d0d1krd2Zind3Zid4Zjd5Zke!j]j^d6Zle!j]j^d7Zmd8Znd9Zod:Zpd;Zqd<Zrd=Zsd>Ztd?ZuddAZv ejwdBejwZwn#ejx$rdCZwYnwxYwejyZydDZzdEZ{dFZ|dGZ}dHZ~dIZdJZdKZdLZdMZdNZdOZdPZdQZdRZdSZGdTdUeZGdVdWeZ ddXZdYdZd[d\d]d^d_d`dadbdcdddedf ZdgZdhZddjZdkZdlZGdmdnZGdodpeZdqZddrZdsZdtZe!j]j^ddvZe!j]j^ddwZe!j]j^dxZe!j]j^dyZe!j]j^dd{ZGd|d}eZGd~deZGddeZGddeZGddeeZGddeZGddeZGddeZGddeZGddeZGddeZe!j]j^ddZGddeZGddeeZe!j]j^dZGddeZe!j]j^ddZe!j]j^ddZe!j]j^ ddZdZdZe!j]j^ ddZe!j]j^dZdZ ddZddZ ddZdZdZdZdZGddZdeFddfdZGddejZGddeZdS)z General utility functions. )Decimal)StringIO) zip_longest)UUIDN)conf)DARWINOPENBSDWINDOWS)MTU DLT_EN10MBDLT_RAW)orb plain_strchb hex_bytes bytes_encode)log_interactive log_runtimeScapy_Exceptionwarning) inet_pton)castAnyAnyStrCallableDictIOIteratorListOptional TYPE_CHECKINGTupleTypeUnionoverload)DecoratorCallableLiteral)Packet)_PacketIterable PacketList) SuperSocketct|tr|d|jDvSt|trt ||rdSdS)zissubtype(C, B) -> bool Return whether C is a class and if it is a subclass of class B. When using a tuple as the second argument issubtype(X, (A, B, ...)), is a shortcut for issubtype(X, A) or issubtype(X, B) or ... (etc.). c3$K|] }|jV dSN)__name__).0zs O/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/utils.py zissubtype..is$55AQZ555555TF) isinstancestr __bases__type issubclass)xts r2 issubtyper<^s_!S65555555!Tz!Q//t 5r4cxeZdZdZddZdZdZdZdZdZ d Z d Z d Z d Z d ZddZfdZfdZxZS)EDecimalznExtended Decimal This implements arithmetic and comparison with float for backward compatibility Nc`ttj|t|Sr.r>r__add__)selfothercontexts r2rAzEDecimal.__add__y"genn==>>>r4c`ttj|t|Sr.r@rBrCs r2__radd__zEDecimal.__radd__}rEr4c`ttj|t|Sr.)r>r__sub__rGs r2rJzEDecimal.__sub__rEr4c`ttj|t|Sr.)r>r__rsub__rGs r2rLzEDecimal.__rsub__#(wu~~>>???r4c`ttj|t|Sr.r>r__mul__rGs r2rPzEDecimal.__mul__rEr4c`ttj|t|Sr.rOrGs r2__rmul__zEDecimal.__rmul__rEr4c`ttj|t|Sr.)r>r __truediv__rGs r2rTzEDecimal.__truediv__s#+D'%..AABBBr4c`ttj|t|Sr.)r>r __floordiv__rGs r2rVzEDecimal.__floordiv__s#,T75>>BBCCCr4ctj|t|}t|dt|dfS)Nr)r __divmod__r>)rBrCrs r2rYzEDecimal.__divmod__s9  tWU^^ 4 4!~~x!~~--r4c`ttj|t|Sr.)r>r__mod__rGs r2r\zEDecimal.__mod__rEr4c`ttj|t|Sr.)r>r__rmod__rGs r2r^zEDecimal.__rmod__rMr4cbttj|t||Sr.)r>r__pow__)rBrCmodulos r2r`zEDecimal.__pow__s$gennfEEFFFr4ct|tr(tt||St t ||kSr.)r5rsuperr>__eq__boolfloat)rBrC __class__s r2rdzEDecimal.__eq__sL eW % % .4((//66 6d u,-- -r4ctj5}||_tt t||cdddS#1swxYwYdSr.)decimal localcontextprecr>rc normalize)rB precisionctxrgs r2rlzEDecimal.normalizes  ! # # Bs CHE(D11;;C@@AA B B B B B B B B B B B B B B B B B Bsr>rs2 ??????????@@@??????CCCDDD... ???@@@GGGG.....BBBBBBBBBr4r>cdSr.keepautoextfds r2 get_temp_filerz  Dr4FcdSr.rurvs r2rzrzr{r4ctjd|d}|s$tj|j|r|S||jS)a=Creates a temporary file. :param keep: If False, automatically delete the file when Scapy exits. :param autoext: Suffix to add to the generated file name. :param fd: If True, this returns a file-like object with the temporary file opened. If False (default), this returns a file path. scapyF)prefixsuffixdelete)tempfileNamedTemporaryFiler temp_filesappendnameclose)rwrxryfs r2rzrzse #77+0 2 2 2A ' qv&&&   v r4crtjd}|stj||S)zCreates a temporary file, and returns its name. :param keep: If False (default), the directory will be recursively deleted when Scapy exits. :return: A full path to a temporary directory. r)r)rmkdtemprrr)rwdnames r2 get_temp_dirrs:  G , , ,E & u%%% Lr4returnctrddlm}|St}t j|t j|||fS)zCreates a temporary fifo. You must then use open_fifo() on the server_fd once the client is connected to use it. :returns: (client_file, server_fd) r) _get_win_fifo)r scapy.arch.windows.structuresrrzosunlinkmkfifo)rrs r2 _create_fiforsV??????} OO !  ! !t r4rbrymodecRtrddlm}||St||S)z)Open the server_fd (see create_fifo) r)_win_fifo_open)r rropen)ryrrs r2 _open_fifors<@@@@@@~b!!!B~~r4cd}|D]Z}t|}|dks|dkr+|r#|tjdz }B|dz }H|t |z }[|S)Nr| .)rr color_theme not_printablechr)r:colorrZijs r2sanersx A  FF FFS T%33C888S QKAA Hr4ctjr/tjt jdstdtr]d} tj t j gt jz}tj |n#tj |wxYwtj t j t j gt jzdS)zRestarts scapyrz"Scapy was not started from consolerXN)r interactiverpathisfilesysargvOSErrorr subprocesscall executable_exitexecv)res_codes r2restartrs  <27>>#(1+#>#><:;;; !'7#('BCCH HX    BHX    HS^cn-899999s ,BB,cddlm}t||rt|St|trt |St|t r"ddd|DzSt|tr"ddd|DzSt|S)Nr) VolatileValuez(%s), c34K|]}t|VdSr.lhexr0vs r2r3zlhex..-(!5!5a$q''!5!5!5!5!5!5r4[%s]c34K|]}t|VdSr.rrs r2r3zlhex../rr4) scapy.volatilerr5reprinthextuplejoinlistr6)r:rs r2rr%s,,,,,,!]##Aww!S1vv !U6 !5!51!5!5!55555!T6 !5!51!5!5!55555 q66Mr4cd}t|}t|}d}||krt|d|zz }tdD]/}||z|kr|dt|||zzz }*|dz }0|dt |||dzd zz }|dz }||kt|d r |d d n|}|r|St |d S) zBuild a tcpdump like hexadecimal view :param p: a Packet :param dump: define if the result must be printed or returned in a variable :return: a String only when dump=True r|rz%04x z%02X z z %s Tr N)rlenrangerrendswithprint)pdumpsr:x_lenrrs r2hexdumpr3s AQA FFE A e)) X\r  A1uu}}Ws1QU8}},,U  WtAaBhKt444 44 R e))**T"")#2#A  atr4cXd}t|||| }|r|St|dS)aeBuild an equivalent view of hexdump() on a single line Note that setting both onlyasc and onlyhex to 1 results in a empty output :param p: a Packet :param onlyasc: 1 to display only the ascii view :param onlyhex: 1 to display only the hexadecimal view :param dump: print the view if False :return: a String only when dump=True r|)onlyasconlyhexrN)hexstrr)rrrrrs r2 linehexdumprRs> Aq'7d(CCCA  atr4ct|}dd|D}|r|St|dS)aOBuild a per byte hexadecimal representation Example: >>> chexdump(IP()) 0x45, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0x00, 0x40, 0x00, 0x7c, 0xe7, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01 # noqa: E501 :param p: a Packet :param dump: print the view if False :return: a String only if dump=True rc3:K|]}dt|zVdS)z%#04xNrr0r:s r2r3zchexdump..vs-..q'CFF"......r4N)rrr)rrr:rs r2chexdumprhsL QA ..A.....A  atr4ct|}g}|s2|dd|D|s$|t||d|S)z*Build a fancy tcpdump like hex from bytes. c3:K|]}dt|zVdS)%02XNr)r0bs r2r3zhexstr..s,55a&3q66/555555r4r )rrrr)rrrrr:rs r2rr~s QA A 7 55155555666 ' au%%%&&& 99Q<<r4c@dd|DS)z= Convert provided bitstring to a simple string of hex digits r|c3:K|]}dt|zVdS)z%02xNrrs r2r3zrepr_hex..s,..q6CFF?......r4rrs r2repr_hexrs% 77..A... . ..r4ar(ralgoautojunkc  )*t|)t|*|Dt)t*z}|dkrd}|dkrtjdnd}g}g}|dkr)ddd)*ddd*d}d}d} d d i} t t*D]} | dz|zd| dz ff| d| f<t t)D]} | dz|zdz| dz dff| | df<t t*D]} t t)D]} t | | dz | dz fd | )| *| kzz| dz | dz ff| | dz | fd |z| dz | ff| | | dz fd |z| | dz ff| | | f<t)dz } t*dz } | | cxkrdkspn| | | fd\} }|)| dz| dz|*|dz| dz| |} } | | cxkrdkjnVnnR|dkr9tj)*| })fd t t)D}*fdt t*D}| D]h}|\}}}}}|dkr||||z }|dg||z zz }*|dkr|dg||z zz }||||z }J|dvr||||z }||||z }i|rRt|}t|}|dgt|||z zz }|dgt|||z zz }ntd|zd x}x}} dtj jtj jd}d}d }t|}| |kr|| | dz} || | dz}!t!d| D}"t!d|!D}#|r|"sd }d}|r| |!krd}|rL|}$d } | | s| dz } |$dz}$| | t#|||z d|$zd||"z }| }%nt#dd|rL|}&d } |!| s| dz } |&dz}&|!| t#|||z d|&zd||#z }|!}%nt#ddt#ddd}'t dD]} | | zt t|t|kr|%| r|| | |!| k||z z}(t#|(dt%|%| zd| | |!| kr|'t'|%| d z }'nJ|'|(t'|%| z }'n(t#d!d|'dz }'nt#d!d| d"krt#ddt#d|'|s|#s d }d}| dz } n |#rd }d}n| dz } | |kdSdS)#an Show differences between 2 binary strings, Packets... Available algorithms: - wagnerfischer: Use the Wagner and Fischer algorithm to compute the Levenstein distance between the strings then backtrack. - difflib: Use the difflib.SequenceMatcher implementation. This based on a modified version of the Ratcliff and Obershelp algorithm. This is much faster, but far less accurate. https://docs.python.org/3.8/library/difflib.html#difflib.SequenceMatcher :param a: :param b: The binary strings, packets... to compare :param algo: Force the algo to be 'wagnerfischer' or 'difflib'. By default, this is chosen depending on the complexity, optimistically preferring wagnerfischer unless really necessary. :param autojunk: (difflib only) See difflib documentation. NgcA wagnerfischerg.Az:Complexity is a bit high. hexdiff will take a few seconds.difflibrrXrr)rrr)rrrc*g|]}||dzSrXru)r0rxbs r2 zhexdiff..%4441QU7 444r4c*g|]}||dzSrru)r0rybs r2rzhexdiff..rr4rr4insert)equalreplacezUnknown algorithm '%s'c|Sr.rur:s r2zhexdiff..sQr4)rrrXrc34K|]}t|VdSr.rr0ks r2r3zhexdiff.. (''AQ''''''r4c34K|]}t|VdSr.rrs r2r3zhexdiff.. rr4z%04xrendz r|rTrr)rrrinforminrrSequenceMatcher get_opcodesmax ValueErrorrrleftrightsumrrr)+rrrr complexity backtrackx backtrackyINSERTDELETESUBSTdrri2j2smxarryarropcodetypx0x1y0y1lbxlbyr:ycolorizedoxdoybtx_lenlinexlineyxxyyxdlineydclcolrrs+ @@r2hexdiffr2s"2 aB aB |WWs2ww&   #DC$PDJJ  "X "X } %s2ww 5 5AA'"a!e4Ab!eHHs2ww 9 9AA'!+a!eR[8AaeHHs2ww  A3r77^^  q1ua!e|_Q'%2a5BqE>*BBQUAPQENSq1uax[^f,q1uaj9q!a%x[^f,q!a%j9!Q$  GGaK GGaK<<<>C  #BAAh QaAh  %(39%frk22 < < < < GADD &c " " " "  #BAAh QaAh  %(39%frk22 < < < < GADD &c " " " " cs r # #A1us3z??C OO<<<<7 "E!Ha$8S3Y#GHC##fs47||344#>>>>Qx58++d47$7777cc$tAw--000$C((((#IBBd$$$$Avvbc"""" c2  b CC GAA RC g++++++r4HrXsc|Sr.ruchks r2rrMsCr4c|dz dz|dzzS)Nrur5s r2rrOscQh$->#(,Jr4ct|dzdkr|dz }ttjd|}|dz |dzz}||dz z }|}t|dzS)NrXr3ri)rrarraychecksum_endian_transform)pktrs r2checksumr@Rsr 3xx!|q u  EKS ! !""A bQZ AbLA A $Q ' '& 00r4cDdx}}|D] }||z }||z } |dz}|dz}||fS)Nrr9ru)charbufc0c1chars r2 _fletcher16rF]sKKB d  b#IB#IB 8Or4c6t|\}}|dz|zS)aCalculates Fletcher-16 checksum of the given buffer. Note: If the buffer contains the two checkbytes derived from the Fletcher-16 checksum # noqa: E501 the result of this function has to be 0. Otherwise the buffer has been corrupted. # noqa: E501 r8)rF)binbufrCrDs r2fletcher16_checksumrIjs#6""HR !Gr>r4cvt||krtdt|z|d|dz||dzdz}t|\}}t||z dz |z|z dz}|dkr|dz }d|z |z }|dkr|dz}t|t|zS) aCalculates the Fletcher-16 checkbytes returned as 2 byte binary-string. Including the bytes into the buffer (at the position marked by offset) the # noqa: E501 global Fletcher-16 checksum of the buffer will be 0. Thus it is easy to verify # noqa: E501 the integrity of the buffer on the receiver side. For details on the algorithm, see RFC 2328 chapter 12.1.7 and RFC 905 Annex B. # noqa: E501 z"Packet too short for checkbytes %dNsr;rXr9ri)r ExceptionrFr)rHoffsetrCrDr:r$s r2fletcher16_checkbytesrMws 6{{V.s0GGCAr OOGGGGGGr4:)rrsplitmacs r2mac2strrTs7 88GGYs^^-A-A#-F-FGGG G GGr4ch tt|dkS#t$rYnwxYwdS)NF)rrTr rRs r2 valid_macrWsE 73<<  A%%      5s " //ct|tr=dt|zddtt t |zSdt|zddt|zS)Nz%02x:r)r5r6rrmapordrs r2str2macr[sh!S<#a&& #2#&s3{{););;; c!ff crc "U1XX --r4cZddt|DS)z9 Returns a random string of length (length >= 0) r4c3fK|],}tjdtjddV-dS)Brr9Nstructpackrandomrandintr0_s r2r3zrandstring..N,,KV^As%;%;<<,,,,,,r4rrlengths r2 randstringrj< 88,,"6]],,, , ,,r4cZddt|DS)zM Returns a random string of length (length >= 0) without zero in it. r4c3fK|],}tjdtjddV-dS)r^rXr9Nr_rds r2r3z&zerofree_randstring..rfr4rgrhs r2zerofree_randstringrnrkr4cLdtd||S)zj Returns the binary OR of the 2 provided strings s1 and s2. s1 and s2 must be of same length. r4c2tjd||zSNz!Br`rar:r$s r2rzstror..V[q1u%=%=r4rrYs1s2s r2strorry& 88C==r2FF G GGr4cLdtd||S)zk Returns the binary XOR of the 2 provided strings s1 and s2. s1 and s2 must be of same length. r4c2tjd||z Srqrrrss r2rzstrxor..rtr4rurvs r2strxorr}rzr4cLdtd||S)zk Returns the binary AND of the 2 provided strings s1 and s2. s1 and s2 must be of same length. r4c2tjd||zSrqrrrss r2rzstrand..rtr4rurvs r2strandrrzr4Tc|t|z}|r|| d|d| zS||d|d|zS)z, Rotate the binary by 'count' bytes Nr)rwcountroffs r2strrotrsU #b''/C #3$%%y2ete9$$#$$x"TcT(""r4255.255.255.255c:|dkrdStj|S)Nr)socket inet_aton) ip_strings r2rrs$ ) ) );#I.. .r4c t|}n%#tj$rtd|zwxYwt t t jd|dS)NzBad IP format: %s!Ir)rrerrorr rrr`unpack)r:ips r2atolrsf2 q\\ <222,q01112 V]4,,Q/ 0 00s"4c t|}n#t$rYdSwxYw t|n##ttt jf$rYdSwxYwdSNFT)rUnicodeDecodeErrorrrr rraddrs r2valid_iprsx uu T Z .uu 4s  4AAc t|}n#t$rYdSwxYwd|vrY|dd\}}t|o0|odt |cxkodkncSt|S)NF/rXrr)rrrQrisdigitrrrmasks r2 valid_netr s uu d{{::c1%%D||G G1D 3G3G3G3GR3G3G3G3GG D>>   c t|}n#t$rYdSwxYw ttj|n#tj$rYdSwxYwdSr)rrrrAF_INET6rrs r2 valid_ip6rsy uu&/4(((( <uu 4s  ?AAc t|}n#t$rYdSwxYwd|vrY|dd\}}t|o0|odt |cxkodkncSt|S)NFrrXr)rrrQrrrrs r2 valid_net6r#s uu d{{::c1%%D}}IIAT4I4I4I4Ic4I4I4I4II T??rcLttjd|dzS)Nr) inet_ntoar`rars r2ltoar/s V[q:~66 7 77r4cd|z dzS)Nlrrurs r2itomr4s ! #z 11r4c |dks|dkrtd|ztdtjddd|z zdz S)u Return the mask (bitstring) associated with provided length value. For instance if function is called on 20, return value is b'ÿÿð'. rrz;value provided to in4_cidr2mask outside [0, 32] domain (%d)rz>Ir;rX)rr}r`ra)ms r2 in4_cidr2maskr9sZ 2vvQ[^__```  D!b1f+/**  r4cttj|}t|}ttj|}|t ||kS)zK Returns True when 'addr' belongs to prefix/mask. False otherwise. )rrAF_INETrr)rrrtempprefzeros r2in4_isincludedrIsH V^T * *D   D V^V , ,D 6$%% %%r4c$t|ddS)z~ Returns True if provided address in printable format belongs to allocated Multicast address space (224.0.0.0/4). 224.0.0.0rr6s r2 in4_ismaddrrT #{A . ..r4c$t|ddS)zb Returns True if address belongs to link-local multicast address space (224.0.0.0/24) rrrs r2 in4_ismlladdrr]s #{B / //r4clt|ddo#t|dd ot|dd S)zl Returns True if address belongs to global multicast address space (224.0.1.0-238.255.255.255). rrr 239.0.0.0r8rrs r2 in4_ismgladdrrfsF sK++ 0 3 R 0 00 0 3 Q / //r4c$t|ddS)ze Returns True if address belongs to limited scope multicast address space (239.0.0.0/8). rr8rrs r2 in4_ismlsaddrrsrr4cnttjdttj|kS)z` Returns True if address is the link-local all-nodes multicast address (224.0.0.1). z 224.0.0.1)rrrrs r2in4_isaddrllallnodesr|s, fnk 2 2 fnc * * +,r4c<d|ddz|d|dfzS)z Return the multicast mac address associated with provided IPv4 address. Passed address must be in network format. z01:00:5e:%.2x:%.2x:%.2xrXrr;ru)rs r2 in4_getnsmacrs& %!t QqT1Q4'@ @@r4cb|tjdpddS)zy Decode bytes into a string using the system locale. Useful on Windows where it can be unusual (e.g. cp1252) rXutf-8r)encodingerrors)decodelocale getlocalers r2decode_locale_strrs- 88V-//2=gi8 P PPr4c&eZdZdZddZdZdZdS)ContextManagerSubprocessa Context manager that eases checking for unknown command, without crashing. Example: >>> with ContextManagerSubprocess("tcpdump"): >>> subprocess.Popen(["tcpdump", "--version"]) ERROR: Could not execute tcpdump, is it installed? Tc"||_||_dSr.)progsuppress)rBrrs r2__init__z!ContextManagerSubprocess.__init__s   r4cdSr.rurBs r2 __enter__z"ContextManagerSubprocess.__enter__s r4c||dSt|tr d|jz}n|jd|jjd}|js ||t j|ddS)Nz&Could not execute %s, is it installed?z: execution failed ()T)exc_info)r5EnvironmentErrorrrgr/rrr)rBexc_type exc_value tracebackmsgs r2__exit__z!ContextManagerSubprocess.__exit__s   04 i!1 2 2 :TYFCC "+++C} (3-- #----tr4NT)r/rorprqrrrrur4r2rrsP  !!!!    r4rc,eZdZdZdZdZdZddZdS) ContextManagerCaptureOutputz Context manager that intercept the console's output. Example: >>> with ContextManagerCaptureOutput() as cmco: ... print("hey") ... assert cmco.get_output() == "hey" cd|_dSNr|result_export_objectrs r2rz$ContextManagerCaptureOutput.__init__s$&!!!r4cddlm}|fd}|}||_tj|_|t_|S)Nr)mockc&|xj|z c_dSr.r)r decorators r2writez4ContextManagerCaptureOutput.__enter__..writes  * *a / * * * *r4)unittestrMockrrstdout bck_stdout)rBrr mock_stdouts r2rz%ContextManagerCaptureOutput.__enter__sW!!!!!!# 0 0 0 0iikk ! *   r4c(|jt_dSNF)rrr)rBexcs r2rz$ContextManagerCaptureOutput.__exit__s_ ur4Fc|jdr#|r!tt|jS|jS)Nzb')r startswithreval)rB eval_bytess r2 get_outputz&ContextManagerCaptureOutput.get_outputsD  $ / / 5 5 >* >T$";<<== =((r4NF)r/rorprqrrrrrur4r2rrs_'''    ))))))r4rcz|d}|r|S|tjdt|}|tjj}d}|t rtd|z}d}nkttjj 5tj tjj gtj j }dddn #1swxYwY|d |z}t|tr|d rAtj |d ddtj j }nm|d r+t%|d dd}n-t%t&j|d}t-t.t0|}tj d|d|pdd|pddtj |tj }|t5|\} } |jdkrt9dt;| z |n#t>$rYnwxYw|rDtAj } t&j!|j"shtAj#dtAj | z dkrtIdtJnt&j!|j"ht r>tjj tjj&krt'j'|j"n`ttjj 5tj tjj |j"gdddn #1swxYwYdS)a Processes graph description using an external software. This method is used to convert a graphviz format to an image. :param graph: GraphViz graph description :param prog: which graphviz program to use :param format: output type (svg, ps, gif, jpg, etc.), passed to dot's "-T" option :param string: if not None, simply return the graph string :param target: filename or redirect. Defaults pipe to Imagemagick's display program :param options: options to be passed to prog Nsvgz*type is deprecated, and was renamed formatFr)rxT)stdinz-T%s|rX)shellr>wb"z" r|r)rrrstderrrz)GraphViz call failed (is it installed?): g?rzHTemporary file '%s' could not be written. Graphic will not be displayed.)(warningswarnDeprecationWarningrrdotr rzrdisplayrPopenPIPErr5r6rlstriprrrabspathrrbytes communicater returncoderrrrKtimeexistsrsleeprr_default startfile) graphrformattargetr8stringoptions start_viewerprocrer waiting_starts r2do_graphrs .~    8     |y}L ~  G"3<888FLL)$)*;<< G G#)49+<*=0:AAAAF G G G G G G G G G G G G G G G&&#9   S ! ! 9%fQRRj&7&7&9&9,6O====B F   s # # 9&*++--t44FF"'//&11488F "U)V $ $F   $$ 2 v||<*/&   D   e!4!455IAv ! 8 f               G '..-- G JsOOOy{{]*Q..bdlmmm '..-- G  G49, 0BBB V[))))-di.?@@GG$di&7%EFFFGGGGGGGGGGGGGGG 4s696B;;B?B?I$$ I10I19+N00N47N4z {\tt\char123}z {\tt\char125}z {\tt\char92}z\^{}z\$z\#z\_z\&z\%z {\tt\char124}z {\tt\char126}z {\tt\char60}z {\tt\char62}) {}\^$#re&%r~.cs 1ayr4)rr*r)lstcolkargsr.rrrs r2colgenr2[s7  6{{Q!  IIg88 9 9EAs6{{## A AA3v;;'' A As6{{++AAAAvva166#eFAES[[+@$A61q5TWX^T_T_J_C`bhjknojosvw}s~s~i~bAAAAAA AAr4tag%05ic#"K ||zV|dz } )NTrXru)labelstarts r2incremental_labelr7ls)em  r4c0t|ddSNr;)bin)vals r2binreprr<ss s88ABB<r4crt|dddddS)Nrr|rr)rrrs r2long_converterr>xs0 qyyr""**333R 8 88r4cDeZdZdZdZdZdZdZdZdZ dZ d Z d S) EnumElementc"||_||_dSr.)_key_value)rBkeyvalues r2rzEnumElement.__init__s  r4ctd|jd|jjd|jd|jdS)Nr'_namer[z]>)__dict__r*rgr/rBrCrs r2__repr__zEnumElement.__repr__sB $ 1 1'4>;R S S S SUYU^U^U^`d`k`k`kllr4c,t|j|Sr.)getattrrCrBattrs r2 __getattr__zEnumElement.__getattr__t{D)))r4c|jSr.)rBrs r2__str__zEnumElement.__str__s yr4cDt|Sr.)rrRrs r2 __bytes__zEnumElement.__bytes__sDLLNN+++r4c|jSr.)rCrs r2__hash__zEnumElement.__hash__s {r4c*t|jSr.)rrCrs r2__int__zEnumElement.__int__s4;r4c2|jt|kSr.)rCrrGs r2rdzEnumElement.__eq__s{c%jj((r4c.|| Sr.)rdrGs r2__neq__zEnumElement.__neq__s;;u%%%%r4N) r/rorprrJrOrRrTrVrXrdr[rur4r2r@r@s mmm***,,,   )))&&&&&r4r@c<eZdZeZfdZdZdZddZdZ xZ S)Enum_metaclassci}|D]:\}}t|tr |||}|||<|||<;||d<t t |||||S)N __rdict__)itemsr5r element_classrcr]__new__)clsrbasesdctrdictrrrgs r2rbzEnum_metaclass.__new__sIIKK  DAq!S!! %%a++Aa K^S))11#tUCHHHr4c|j|Sr.r_rMs r2 __getitem__zEnum_metaclass.__getitem__s~d##r4c||jvSr.rh)rBr;s r2 __contains__zEnum_metaclass.__contains__sdn$$r4Nc8|j||Sr.)r_r*)rBrNr;s r2r*zEnum_metaclass.gets~!!$,,,r4cHd|jd|jzS)Nz<%s>r)rIr*r/rs r2rJzEnum_metaclass.__repr__s! ))&$-@@@@r4r.) r/rorpr@rarbrirkr*rJrrrss@r2r]r]sM I I I I I$$$%%%----AAAAAAAr4r]c ddl}ttj|t j|dddS)Nrr; )zlibrbase64 b64encodecompresspickledumpsrobjrps r2 export_objectrxsPKKK & 4==c1)=)=qAA B B I I K KLLLLLr4cddl}|tj}t j|tj| S)Nr) rprrreadrtloads decompressrq b64decodestriprvs r2 import_objectrsPKKK {inn <(8(E(EFF G GGr4ctj|d}tj|||dS)zPickle a Python objectrN)gziprrtrr)fnamerwrys r2 save_objectrs8 5$  B KRHHJJJJJr4cPtjtj|dS)zunpickle a Python objectr)rtloadrr)rs r2 load_objectrs  ;ty-- . ..r4{Gz?cbtjdt|}t|}| tdt ||z}t jt||D]&}||t jddzdz||<'| S)z] Corrupt a given percentage (at least one byte) or number of bytes from a string r^NrXr9) r=rrr rrbsamplerrctobytesdatarnrs_lenrs r2 corrupt_bytesrs  Cd++,,A FFEy 3uqy>> " " ]5<< + +55!v~a---4! 99;;r4cRtjdt|}t|dz}| tdt ||z}t jt||D]}||dzxxd|dzzzcc<|S)zX Flip a given percentage (at least one bit) or number of bits from a string r^r8NrX) r=rrr rrbrrrrs r2 corrupt_bitsrs  Cd++,,A FFQJEy 3uqy>> " " ]5<< + +"" !q& Q1q5\! 99;;r4ct|g|Ri|5}||ddddS#1swxYwYdS)a8Write a list of packets to a pcap file :param filename: the name of the file to write packets to, or an open, writable file-like object. The file descriptor will be closed at the end of the call, so do not use an object you do not want to close (e.g., running wrpcap(sys.stdout, []) in interactive mode will crash Scapy). :param gz: set to 1 to save a gzipped capture :param linktype: force linktype value :param endianness: "<" or ">", force endianness :param sync: do not bufferize writes to the capture file N) PcapWriterrfilenamer?argsr1fdescs r2wrpcapr s& H -t - - -u - - C 488ct|5}||ddddS#1swxYwYdS)aWrite a list of packets to a pcapng file :param filename: the name of the file to write packets to, or an open, writable file-like object. The file descriptor will be closed at the end of the call, so do not use an object you do not want to close (e.g., running wrpcapng(sys.stdout, []) in interactive mode will crash Scapy). :param pkt: packets to write N) PcapNgWriterr)rr?rs r2wrpcapngr$s h  5 C 377rct|5}||cdddS#1swxYwYdS)zeRead a pcap or pcapng file and return a packet list :param count: read only packets rN) PcapReaderread_allrrrs r2rdpcapr6s H  +~~E~**++++++++++++++++++rc>eZdZdZfdZdZedZxZS)PcapReader_metaclassz"Metaclass for (Raw)Pcap(Ng)Readersctt|||||}d|vr ||d_|S)zxThe `alternative` class attribute is declared in the PcapNg variant, and set here to the Pcap variant. alternative)rcrrbr)rcrrdrenewclsrgs r2rbzPcapReader_metaclass.__new__PsM +S1199 uc   C  -3C  * r4c|||j|j|j}||\}}}|st d |||||S#t tf$rYnwxYwd|jvre|jd}|||j|j|j} |||||S#t tf$rYnwxYwt d)zNCreates a cls instance, use the `alternative` if that fails. zNo data could be read!rNot a supported capture file)rbr/r7rIrrrEOFError)rcrrrmagics r2__call__zPcapReader_metaclass.__call__]s; KK  L M L    "%(!3!3% !(   JJx . . .H*    D  CL ( (,}-C    A   8UE222#X.    <===s$A,,B?BCC.-C.ct|tr|}t|d}|d}|dkr?|dt j|}|d}||dz }n(|}t|dd}|d}|||fS) z1Open (if necessary) filename, and read the magic.rr;sr)fileobjrNo namer)r5r6rrzseekrGzipFilerL)rrrrs r2rzPcapReader_metaclass.opens eS ! ! "H4((EJJqMME ## 1  e444 1  UZZ]] "EEEufi88HJJqMME%%r4) r/rorprqrbr staticmethodrrrrss@r2rrMsi,,     %>%>%>N&&\&&&&&r4rceZdZdZdZejdgdZddZdZ dZ d Z e fd Z e fd Zd ZddZe fdZdZdZdZe ddZdS) RawPcapReaderz;A stateful pcap reader. Each packet is returned as a stringTPacketMetadatasecusecwirelencaplenNc||_||_|dkrd|_d|_nQ|dkrd|_d|_n<|dkrd|_d|_n'|dkrd|_d|_nt d |z|jd }t |d krt d tj|jd z|\}}}}} } | |_ | |_ dS) NsrFsòr'sCannot call read_packet() in RawPcapReader. Use _read_packet())rKrBrs r2 read_packetzRawPcapReader.read_packets    r4c&|D] }||dS)zcall the specified callback routine for each packet read This is just a convenience function for the main loop that allows for easy launching of packet processing in a thread. Nru)rBcallbackrs r2dispatchzRawPcapReader.dispatchs,  A HQKKKK  r4rcg}|dkrF|dz} |}n#t$rYnwxYw|||dkF|S)z6return a list of all packets in the pcap file rrX)rrr)rBrresrs r2 _read_allzRawPcapReader._read_allstqjj QJE $$&&     JJqMMM qjj s $ 11c:||dS)z Emulate a socket rr)rrs r2recvzRawPcapReader.recv s   d ++A..r4cFtrdn|jSNrr rfilenors r2rzRawPcapReader.fileno1rr$&--//1r4ct|jtjr|jj|jdSr.)r5rrrrrrs r2rzRawPcapReader.closesA dfdm , , # FN " " "  r4c.|dSr.)rrBrrtracbacks r2rzRawPcapReader.__exit__s r4c|Sr.ru)socketsremains r2selectzRawPcapReader.select!s r4NNrr.)r/rorprqnonblocking_socket collections namedtuplerrrrrr rrrrrrrrrrrur4r2rrsGEE +[+,<,P,P,PRRN:   !$NNNN, #           //// 222  \r4r) metaclasscHeZdZd dZdZeffd ZefdZdZd dZ xZ S) rNc$t|||| tjj|j|_dS#t$rCtd|j|jfztj ddl }tj |_YdSwxYw)Nz9PcapReader: unknown LL type [%i]/[%#x]. Using Raw packetsr) rrrl2types num2layerrLLclsKeyErrorr raw_layer scapy.packet)rBrrrrs r2rzPcapReader.__init__*stXue<<< (/ DJJJ ( ( ( OSWS`bfboRpp q q q~%####DJJJJ  (s!AA BBc|Sr.rurs r2rzPcapReader.__enter__8rr4c tt||}|t|\}} |j|fi|}n_#t $rt $rHtjrddl m }|j|f|_ tj ddl }tj |}YnwxYwtdt|jrdndz} t!|j| |jzz|_|j|_|S)Nrrdebug i)rcrrrrKeyboardInterruptrKrdebug_dissectorscapy.sendrecvr crashed_onrrrrr>rrrr) rBrkwargsrprpkt_inforrrpowerrgs r2rzPcapReader.read_packet<s, :t $ $ 1 1t 1 < < :N 8 " 1''''AA      " " "# 000000$(J? ~%####q!!AAA " wTY'>rrB???(,)>>??$ sA AB%$B%c |jdd|i|SNrrurrBrrs r2rzPcapReader.recvUs t44T4V444r4cV |S#t$rtwxYwr.)rrrrs r2rzPcapReader.__next__Ys: ##%% %     rrc||}ddlm}||tj|jS)Nr)plist)r)rrrr*rrbasenamer)rBrrrs r2rzPcapReader.read_all`sPnnU##"'*:*:4=*I*IJJJr4rr) r/rorprrr rrrrrrrss@r2rr)s ( ( ( ( #25555   KKKKKKKKr4rceZdZdZeZejdgdZddZ e fdZ dZ dZ e fd Zd Zd Zd Zd ZdZdZdZdZdS)RawPcapNgReaderzEA stateful pcapng reader. Each packet is returned as bytes. PacketMetadataNg rtsresoltshightslowrcommentifname directionprocess_informationNcJ||_||_g|_ddi|_|j|j|j|j|j|j d|_ d|_ g|_ |dkrtd|z |dS#t$rtdwxYw)Nr@B)rXr;rrVrl! z)Not a pcapng capture file (bad magic: %r)z/The first SHB of the pcapng file is malformed !)rr interfacesdefault_options_read_block_idb_read_block_pkt_read_block_spb_read_block_epb_read_block_dsb_read_block_pib blocktypesrrr_read_block_shbrrBrrrs r2rzRawPcapNgReader.__init__us   w ''''( 0    #% ' ' '!;eC    " " " " "   !A  s 2BB"c tj|jdz|jdd}n#tj$rt wxYw|dkr|dS tj|jdz|jdd}n)#tj$rtdt wxYw|dkrtdt |dz }|j|}t||krtd| |||j vr|j |||SdS) NIrri z0PcapNg: Error reading blocklen before block body zPcapNg: Invalid block length !z-PcapNg: Invalid Block body length (too short)) r`rrrrzrrr,rrr_read_block_tailr+)rBr blocktypeblocklen_block_body_lengthblocks r2 _read_blockzRawPcapNgReader._read_blocks|  dkC&7QHHKII|   N   " "  " " "4 }T[3%6 AGGJHH|    F G G GN  b== 4 5 5 5N%] .// u::+ + +!#011 1 h'''  ' '-4?9-eT:: :ts;>A5;B11&Ccd|dzr2|j| dz}td||fz |tj|jdz|jddkrt ddS#tj$rtdt wxYw)NrzDPcapNg: bad blocklen %d (MUST be a multiple of 4. Ignored padding %rr/rz+PcapNg: Invalid pcapng block (bad blocklen)z0PcapNg: Could not read blocklen after block body)rrzrr`rrrr)rBr3pads r2r1z RawPcapNgReader._read_block_tails a< <&++xi!m,,C ),4c?; < < < 6=s):)-Q999:<<<LMMM<<|    F G G GN s AB &B/c|jd}|jd}|dkrd|_n$|dkrd|_ntdt t j|jdz|d}n)#t j$rtd twxYw|d krtd |d t|jd } t j|jdz|d}n)#t j$rtdtwxYw|dkrtd|dt|jd}t|dkrtdt|d z }|j|}t||krtd| || |dS)zSection Header Blockrs+PcapNg: Bad magic in Section Header Block (not a pcapng file?)r/rzPcapNg: Could not read blocklenz-PcapNg: Invalid Section Header Block length (z)!r;r3z"PcapNg: Could not read major valuerXzPcapNg: SHB Major version z unsupported !rz3PcapNg: Could not read minor value & section lengthz9PcapNg: Invalid Section Header Block options (too short)N) rrzrrrr`rrrrr1 _read_options) rB _blocklenrr3_majormajorskipped _options_lenrs r2r,zRawPcapNgReader._read_block_shbs'FKKNN Q ( ( (DKK * * *DKK , - - -N }T[3%6 BB1EHH|    5 6 6 6N  b== PHPPP Q Q QNQ M$+"3V<7>6<9BCV/XX Y Ys!+.6A$;#C6D!G6G7c d}|| tj|jdz|dd\}n9#tj$r't dt |ztwxYwt||j |d}|dd|zd|t |j |d|j |dddd|dddi fS) zSimple Packet Blockrr/NrzPcapNg: SPB is too small %d/4 !rXr;rr) rPr`rrrrrrrr#rr)rBr5rrNrrs r2r'zRawPcapNgReader._read_block_spbs    ''' }T[3%6bqb BBHGG|    5E B C C CN Wdoe4Q788aF l#ETE*..8Nq8Q7;u7Ma7PQZ7[6:597>7;6:9=CE/GG H Hs 'A6A7c  tj|jdz|dd\}}}}}}n9#tj$r't dt |zt wxYw|||dd|zd|t |j |d|j |dd|||dddi fS) z(Obsolete) Packet BlockHH4INrz PcapNg: PKT is too small %d/20 !rr;rr) r`rrrrrrrPrrr#) rBr5rrNdropsrrrrs r2r&zRawPcapNgReader._read_block_pkts ;A= f$crc << 8E5&%|    6UC D D DN    '''bfn%ete,..8Nq8Q7;u7Ma7PQZ7[6<5:7>7;6:9=CE/GG H Hs ,/6A%cN tj|jdz|dd\}}|dd}n7#tj$r%t dt |t wxYw|| dzz}t ||krt dt |d|d|}||drt d|dkrttd d d urt d dSd d l m }t}t|d5} | || dddn #1swxYwY||} | st ddS| t_dt_dSt d|dS)zDecryption Secrets BlockIINr8zPcapNg: DSB is too small %d!rz#PcapNg: invalid DSB secrets length!z&PcapNg: DSB options are not supported!iKSLT tls_sessionsFzkPcapNg: TLS Key Log available, but the TLS layer is not loaded! Scapy won't be able to decrypt the packets.r) load_nss_keysrz#PcapNg: invalid TLS Key Log in DSB!Tz(PcapNg: Unknown DSB secrets type (0x%x)!)r`rrrrrrrLrscapy.layers.tls.sessionr`rzrrr tls_nss_keystls_session_enable) rBr5r secrets_typesecrets_lengthpadded_secrets_length secrets_datar`rrykeyss r2r)zRawPcapNgReader._read_block_dsbs8  +1= d"bqb ,, (L.!""IEE|    2CJJ ? ? ?N  !/>/Q1F F u::- - - 9 : : :N3334_n_E &'' ( > < = = = : % %t^U33u<<233333CBBBBB)??(D))RHH\***HHJJJ%}X..3ABBBBB)-D%.2D+++ > M M M M Ms254A)*EEEcj tj|jdz|ddd}d|i}|dd}n7#tj$r%t dt |t wxYw||}|D]|\}}|dkr| dd |d <%|dkrQt |d kr!tt| |d <_t dt |}|j |dS)zApple Process Information Blockr/Nrridz/PcapNg: DPEB is too small (%d). Cannot get PID!r;asciibackslashreplacerr)r uuidz)PcapNg: DPEB UUID length is invalid (%d)!)r`rrrrrrr<r`rr6rrr)rBr5redpeb_pidrrrGrEs r2r*zRawPcapNgReader._read_block_pibsV  }T[3%6bqb BB1EH#'"2 !""IEE|    EJJ   N  $$U++"==?? ( (KD%qyy.3ll7DV.W.W#F++u::##25d6G6G6G2H2H'//GJJ(((  ''(;<<<<-D-D-DEEN ####J #:   .$.$.$`!$    ,***@?Y?Y?YBHHH6HHH02N2N2Nh=====r4rcLeZdZeZd dZdZeffd Zefde de ddfd Z xZ S) PcapNgReaderNc@t||||dSr.)rrr-s r2rzPcapNgReader.__init__ s"  x>>>>>r4c|Sr.rurs r2rzPcapNgReader.__enter__ rr4c 8tt||}|t|\}\ }}}}} } } } } tjj|}||fi|}nK#t$rt$r4tj rtj ddl }t j |}YnwxYw|t|dz|z|z |_ | |_| |_| |_| |_| | dd|_|S)Nrrrrrl)rcrprrrrrrrKrrrr>rrrrrJrr sniffed_on)rBrrr rrrrrrrrrrrcrrrgs r2rzPcapNgReader.read_packetsL < & & 3 3 3 > > :Njlg gHgvugw Sf ",(2CA    AA      " " "# ~%####q!!AAA  "  v|u455?AF   3 8 8 : :  !==2DEEALs A%%AB-,B-rrrr(c |jdd|i|Sr rrs r2rzPcapNgReader.recv-s t44T4V444r4r) r/rorprrrrr rrrrrrrss@r2rprpsK???? #8 #555c5h55555555r4rpcVeZdZUdZeed<dZ d dZdZdZ d dZ dS) GenericPcapWriterFrctr.NotImplementedErrorrBr?s r2 _write_headerzGenericPcapWriter._write_header5s!!r4Nc tr.ry) rBpacketrrrrrrrrs r2 _write_packetzGenericPcapWriter._write_packet9s "!r4ct|drR|P|j}t|}tt||z |jrdndz}t |}||d}||fS)Nrʚ;r r)hasattrrrroundrrf)rBr~rr packet_timetmps r2 _get_timezGenericPcapWriter._get_timeGs 66 " " ){$k +&&5+"3*.)@JJ"BCCDDK(( ?t|DDyr4cXt|ds |t|trttjj|j|_nC#t$r6d}t||jj |jj t|_YnwxYw| |dS)Nrz3%s: unknown LL type for %s. Using type 1 (Ethernet)) rr5r rrr layer2numrgrrr/r r|)rBr?rs r2 write_headerzGenericPcapWriter.write_headerXstZ(( + +;*S%"8"8;"N $ 6M!  + + +KT^4cm6LMMM *  + 3s?A=BBc ||||\}}t|}|t|n|}|t|dr|j}||}t |dd}t |dd} t |dd} t |tstj j |j } n|j } | "t| d} |||||||| | |  dS)aW Writes a single packet to the pcap file. :param packet: Packet, or bytes for a single packet :type packet: scapy.packet.Packet or bytes :param sec: time the packet was captured, in seconds since epoch. If not supplied, defaults to now. :type sec: float :param usec: If ``nano=True``, then number of nanoseconds after the second that the packet was captured. If ``nano=False``, then the number of microseconds after the second the packet was captured. If ``sec`` is not specified, this value is ignored. :type usec: int or long :param caplen: The length of the packet in the capture file. If not specified, uses ``len(raw(packet))``. :type caplen: int :param wirelen: The length of the packet on the wire. If not specified, tries ``packet.wirelen``, otherwise uses ``caplen``. :type wirelen: int :return: None :rtype: None Nrrrtrr)rrrrrrrr)rrrrrrLr5r rrrrgrr6encoder) rBr~rrrrf_secrawpktrrrrs r2 write_packetzGenericPcapWriter.write_packeths*@nnVS$77 tf%% &VF ?vy)) ) . ?G&)T22t44FK66 &%(( % L2 HH}H  [[''00F  D7      r4NNNNNNN)NNNN) r/rorprr__annotations__r|rrrrrur4r2rwrw1s DMMM"""!""! $ " " " ""   $ ! > > > > > > r4rwcBeZdZdZdZdZdZdZdZdZ dZ dZ dZ dS) GenericRawPcapWriterFNcFtrdn|jSrrrs r2rzGenericRawPcapWriter.filenorr4c4|jSr.)rflushrs r2rzGenericRawPcapWriter.flushv||~~r4cl|js|d|jSr.)header_presentrrrrs r2rzGenericRawPcapWriter.closes1" $   d # # #v||~~r4c|Sr.rurs r2rzGenericRawPcapWriter.__enter__rr4cV||dSr.)rrrs r2rzGenericRawPcapWriter.__exit__s   r4ct|tr3|js||||dSddlm}||jD]}|js||t|tsE|jtj t|dkrtd||dS)a  Writes a Packet, a SndRcvList object, or bytes to a pcap file. :param pkt: Packet(s) to write (one record for each Packet), or raw bytes to write (as one record). :type pkt: iterable[scapy.packet.Packet], scapy.packet.Packet or bytes r IterSocketNzRInconsistent linktypes detected! The resulting file might contain invalid packets.)r5r rrrscapy.supersocketriterrrrr*r8rrBr?rrs r2rzGenericRawPcapWriter.writes  c5 ! ! %& '!!#&&&   c " " " " " 5 4 4 4 4 4Z__) % %*)%%a(((!!U++ )9)9$q''4)H)HHH0 !!!$$$$ % %r4) r/rorprrsyncrrrrrrrrur4r2rrsN D D A222  %%%%%r4rcFeZdZdZddddddedfdZdZ d dZdS) RawPcapWriter4A stream PCAP writer with more control than wrpcap()NFr|c |r||_||_||_||_||_||_||_|rd} t|trY||_ |r4tttj ||rdpdd|_dSt||rdpd| |_dS||_t|dd|_ dS)a :param filename: the name of the file to write packets to, or an open, writable file-like object. :param linktype: force linktype to a given value. If None, linktype is taken from the first writer packet :param gz: compress the capture on the fly :param endianness: force an endianness (little:"<", big:">"). Default is native :param append: append packets to the capture file instead of truncating it :param sync: do not bufferize writes to the capture file :param nano: use nanosecond-precision (requires libpcap >= 1.5.0) rabrrorrN)rrrgzrrrr5r6rr _ByteStreamrrrrL) rBrrr endiannessrrrrbufszs r2rzRawPcapWriter.__init__s6  %$DM       E h $ $ A$DM Hk49fo5q,,h4(?4GGDF#Hfi@@DMMMr4c Td|_|jr|jrtj|jd}nt |jd} |dr |dS |n#|wxYwt|dstd|j tj |jdz|jrdndd d d d |j|j|j dS) NTrrrzOlinktype could not be guessed. Please pass a linktype while creating the writerIHHIIIIlM[[F ?G ;$, AQB{5!b&04 "F**w"HIIJJ  V[v!5!$S4BB C C C  U6]]### 9  FLLNNNNN  r4r)r/rorprqr rr|rrur4r2rrs>>0A0A0A0Ad@!""! $444444r4rcpeZdZdZdZdZdZd dZdZdZ d d Z d Z dd Z dd Z dS)RawPcapNgWriter8A stream pcapng writer with more control than wrpcapng()cd|_d|_ddi|_d|_d|_||_t |dd|_dS)NFr rr'r:rr)rr interfaces2idr endian_magicrrr)rBrs r2rzRawPcapNgWriter.__init__p sP $ ;? /  hd++r4c^t|dr|t|j}|d}||fSNrrrrfrrBr~rrs r2rzRawPcapNgWriter._get_time > 66 " " ){FK(( <DDyr4c8|t| dzdzz }|S)Nrr<r)rBraw_datas r2 _add_paddingzRawPcapNgWriter._add_padding s#s8}}n)W44r4Nc||}|r||z }dt|z}|}|tj|jdz|z }||z }|tj|jdz|z }|S)Nr0r/)rrr`rar)rB block_type block_bodyrblock_total_lengthr5s r2 build_blockzRawPcapNgWriter.build_block s&&z22  " ' !J #j//1 T[3.0BCCC  T[3.0BCCC r4c|js8d|_|||jdSdS)NTr)r_write_block_shb_write_block_idbrr{s r2r|zRawPcapNgWriter._write_header sP" :"&D   ! ! # # #  ! !4= ! 9 9 9 9 9 : :r4c4d}|j}|tj|jdzdz }|tj|jdzdz }|tj|jdzdz }|j|||dS)Nr"r3rXrqr)rr`rarrrr)rBr block_shbs r2rz RawPcapNgWriter._write_block_shb s) % V[s!2A666 V[s!2A666 V[s!2B777   T%%j)<<=====r4c*tj|jdzd}tj|jdz|}|tj|jdzdz }|tj|jdzdz }d}|dtj|jdzdt|}|||z }|tj|jdzddz }|j||||dS) Nr/rXr3rirDr;r)r`rarrrrrr)rBrrr block_idbrFs r2rz RawPcapNgWriter._write_block_idb s[s!2A66 K c 18<< V[s!2A666 V[s!2F;;;   ;t{T11c&kkBBD D%%f-- -D FK d 2Aq99 9D  T%%j)T%JJKKKKKr4ctj|jdzd}tj|jdzt|}||z }|j|||dS)Nr/r)r`rarrrrr)rBraw_pktr block_spbs r2_write_block_spbz RawPcapNgWriter._write_block_spb sn[s!2A66 K c 13w<<@@ W   T%%j)<<=====r4c"|r"t||jz}|dz } |dz} ndx} } |st|}|st|}tj|jdzd} tj|jdz|} | tj|jdz| z } | tj|jdz| z } | tj|jdz|z } | tj|jdz|z } | |z } d} |Ut |}| tj|jdzdt|z } | ||z } t|tkrA| tj|jdzd d z } | tj|jdz|z } | r!| tj|jdzddz } |j | | | | dS) Nrrrr/rVr4rDrXr;rr) rrrr`rarrrr8rrr)rBrifid timestamprorglenrflagstmp_tsts_hights_lowr block_epbrFs r2_write_block_epbz RawPcapNgWriter._write_block_epb s   !T\122FlGj(FF Gf "\\F "\\F[s!2A66 K c 1488 V[s!2G<<< V[s!2F;;; V[s!2F;;; V[s!2F;;; W   "7++G FK d 2As7||DD DD D%%g.. .D ;;#   FK d 2Aq99 9D FK c 1599 9D  : FK d 2Aq99 9D  T%%j).2&44 5 5 5 5 5r4c |t|}||}|j|d} | Jt|jdz} | |j|<|||t | tkr| dz} nd} ||||||| | |j r|j dSdS)a Writes a single packet to the pcap file. :param packet: bytes for a single packet :type packet: bytes :param linktype: linktype value associated with the packet :type linktype: int :param sec: time the packet was captured, in seconds since epoch. If not supplied, defaults to now. :type sec: float :param caplen: The length of the packet in the capture file. If not specified, uses ``len(packet)``. :type caplen: int :param wirelen: The length of the packet on the wire. If not specified, uses ``caplen``. :type wirelen: int :param comment: UTF-8 string containing human-readable comment text that is associated to the current block. Line separators SHOULD be a carriage-return + linefeed (' ') or just linefeed (' '); either form may appear and be considered a line separator. The string is not zero-terminated. :type bytes :param ifname: UTF-8 string containing the name of the device used to capture data. The string is not zero-terminated. :type bytes :param direction: 0 = information not available, 1 = inbound, 2 = outbound :type int :return: None :rtype: None NrX)rrr)rrrrrr) rrr*r valuesrr8rrrrr) rBr~rrrrrrrrrrs r2rzRawPcapNgWriter._write_packet s\ >[[F ?G!%%fd33 <t)002233a7D)-D v &  ! !8F ! C C C  ??c ! !OEEE fF%,gDPU  W W W 9  FLLNNNNN  r4r.)NNNNNr)r/rorprqrrrrr|rrrrrrur4r2rrm sBB,,,$    .:::>>>$!%LLLL2 > > >$( $ $!%#55555555t!""! $CCCCCCr4rceZdZdZdS)rrN)r/rorprqrur4r2rrf s>>Dr4rceZdZdZdZdS)rrc^t|dr|t|j}|d}||fSrrrs r2rzPcapNgWriter._get_timen rr4N)r/rorprqrrur4r2rrk s)BB     r4rct|5}||cdddS#1swxYwYdS)zZRead a ERF file and return a packet list :param count: read only packets rN)ERFEthernetReaderrrs r2rderfr~ s 8 $ $+~~E~**++++++++++++++++++rc*eZdZdZedZdS)ERFEthernetReader_metaclassc|||j|j|j}||\}} ||||S#t tf$rYnwxYwd|jvrd|jd}|||j|j|j} ||||S#t tf$rYnwxYwt d)Nrr)rbr/r7rIrrrr)rcrrrs r2rz$ERFEthernetReader_metaclass.__call__ s  KKS\3=#, G G((8,,%  JJx ' ' 'H*    D  CL ( (,}-C    A   8U+++#X.    <===s$AA-,A-.CCCcPt|tr{|} tj|d5}|ddddn #1swxYwYtj|d}n3#t $rt|d}YnwxYw|}t |dd}||fS)zOpen (if necessary) filenamerrXNrr)r5r6rrrzIOErrorrL)rrrrs r2rz ERFEthernetReader_metaclass.open s eS ! ! 9H -Yx.. #HHQKKK                (D11 - - -Xt,, -Eufi88Hs4A1A A1AA1AA11B BN)r/rorprrrrur4r2rr s>>>>4\r4rc&eZdZddZdZefdZdS)rNcj||_||_tdtdz|_dS)Nrr)rrrr )rBrrs r2rzERFEthernetReader.__init__ s,  R[[GBKK/ r4ct|dz }|dz}|dz}||dzdzz }|dz}t||j|zzS)NrrrlrX)r>r )rBr;rfrac_secs r2_convert_erf_timestampz(ERFEthernetReader._convert_erf_timestamp sU2gz>EX *q00Rdj833444r4c |jd}t|dkrtt jd|ddd}t jd|dd\}}}}}|dzdkrt d|dzr8|jd}|j|d z } n|j|dz } | d|} dd lm}  | | fi|} nZ#t$rt$rCtj rdd l m} | | f| _tjddl}tj| } YnwxYw||| _|| _| S) NrBBHHHr;zInvalid ERF Type (Not TYPE_ETH)rr)Etherr)rrzrrr`rrscapy.layers.l2rrrKrrrrrrrrrr)rBrrrrr8rerlenwlenrpbrrrrs r2rzERFEthernetReader.read_packet sfkk"oo s88b==N}T3rr7++A."(xQRR!A!Aaq$ $;!  !"CDD D $; ' AA D2I&&AA D2I&&AqvY)))))) "b##F##AA      " " "# 000000$)1: ~%####q!!AAA ",,T22 s> DAEEr.)r/rorprrr rrur4r2rr sP0000555 #//////r4rct|g|Ri|5}||ddddS#1swxYwYdS)a/Write a list of packets to a ERF file :param filename: the name of the file to write packets to, or an open, writable file-like object. The file descriptor will be closed at the end of the call, so do not use an object you do not want to close (e.g., running wrerf(sys.stdout, []) in interactive mode will crash Scapy). :param gz: set to 1 to save a gzipped capture :param append: append packets to the capture file instead of truncating it :param sync: do not bufferize writes to the capture file N)ERFEthernetWriterrrs r2wrerfr s& 8 4d 4 4 4e 4 4 Crc<eZdZdZ dfd ZdZdZdZxZS)rz;A stream ERF Ethernet writer with more control than wrerf()Fc`tt|||||dS)aR :param filename: the name of the file to write packets to, or an open, writable file-like object. :param gz: compress the capture on the fly :param append: append packets to the capture file instead of truncating it :param sync: do not bufferize writes to the capture file )rrrN)rcrr)rBrrrrrgs r2rzERFEthernetWriter.__init__ sB &&//357=59 0 ; ; ; ; ;r4cbddlm}||jD]}||dS)z Writes a Packet, a SndRcvList object, or bytes to a ERF file. :param pkt: Packet(s) to write (one record for each Packet) :type pkt: iterable[scapy.packet.Packet], scapy.packet.Packet rrN)rrrrrs r2rzERFEthernetWriter.write. sQ 100000C% ! !A   a  ! !r4c t|drWt|j}ttt|j|z dzdzdz }|dz|z}n#ttjdz}t |dz}t|dr|j}||}|jtj d||jtj ddd |d |d |jt||j dS) Nrrrrrz>BBHHHHr;r) rrrrrrrrr`rar r)rBr?rrr;rrs r2rzERFEthernetWriter.write_packet; s( 3   'ch--CE38c>U":;;<<BeKLLDd"AADIKK  B&A3xx"} 3 " " "kG ?G  V[q))***  V[Aq$7AFFGGG  U3ZZ     r4c4|jSr.)rrrs r2rzERFEthernetWriter.closeS rr4)FFF) r/rorprqrrrrrrrss@r2rr s{EE ;;;;;;( ! ! !0r4rctjd}d} |rt|j}nt} |}|snR |||dz }n#t$rtdYmwxYwqn#t$rYnwxYw| dd}t|S)zImports a tcpdump like hexadecimal view e.g: exported via hexdump() or tcpdump or wireshark's "export as hex" :param input_string: String containing the hexdump input to parse. If None, read from standard input. z@^((0x)?[0-9a-fA-F]{2,}[ :\t]{,3}|) *(([0-9a-fA-F]{2} {,2}){,16})r|Tr;zParsing error during hexcapr) recompilerreadlineinputr~matchgroupsrKrrrr) input_stringre_extract_hexcaprinput_functionr.s r2 import_hexcaprX s #fgg A  #%l33##))++D  &,,T2299;;A>>   5666          #rA Q<<s5>B)0BB)B$!B)#B$$B)) B65B6c @t|ftjj|d|S)z Runs Wireshark on a list of packets. See :func:`tcpdump` for more parameter description. Note: this defaults to wait=False, to run Wireshark in the background. )rwait)tcpdumprr wireshark)pktlistr rs r2r r y s& 7 J!44 J J6 J JJr4c J|dg}t|ftjj|d|S)z Run tshark on a list of packets. :param args: If not specified, defaults to ``tshark -V``. See :func:`tcpdump` for more parameters. Nz-V)rr)r rrtshark)r rrs r2tdecoder s2 |v 7 G!1 G G G GGr4cnddlm}tt||S)z"Guess the DLT name from its value.r)pcap_datalink_val_to_name)scapy.libs.winpcapyrrr r)rErs r2_guess_linktype_namer s>>===== 0077 8 8 ? ? A AAr4cddlm}tt||}|dkrt d|t S|S)zGuess the value of a DLT name.r)pcap_datalink_name_to_valrz"Unknown linktype: %s. Using EN10MB)rrrrrrr )rrr;s r2_guess_linktype_valuer s^>===== s--dkkmm<< = =C byy4d;;; Jr4c  |p|}|3tjjstdtjjg}n(t |t r|g}nt d| t | tr# t| } nV#t$rd} YnHwxYw| dr | dd} | } t| } n#t$rd} YnwxYw| dkrt d|d| gz }|g}nt|}|| t t rt5}t |trQ |\}}|j} t$r | d krt&} n$#t($rt d wxYw|j} dddn #1swxYwYd d lm}||| |||s|r t0jnd}|rt5t6jnd}d|"t:o|d tjjk}| L|d tjjkrddg} n;|d tjjkr t$sgd} nddg} nt| } Kt?|d | 5t1j ||z||dddn #1swxYwYnt t rPt?|d | 5t1j |dgz|z||dddn #1swxYwYn$|rtCdd} |"tGfdd|$n2#tJ$r%tMdtO|| YnwxYwt?|d | 5t1j |d|j(gz|z||dddn #1swxYwYnN )t?|d | 5t1j || z|z||dddn #1swxYwYn#tJt f$rt?|d | 5t1j || z|zt0j||dddn #1swxYwYYdS j*"tGfddj*$n2#tJ$rtOj*| YntV$rYnwxYwYnwxYwdS|r>> tcpdump([IP()/TCP(), IP()/UDP()]) reading from file -, link-type RAW (Raw IP) 16:46:00.474515 IP 127.0.0.1.20 > 127.0.0.1.80: Flags [S], seq 0, win 8192, length 0 # noqa: E501 16:46:00.475019 IP 127.0.0.1.53 > 127.0.0.1.53: [|domain] >>> tcpdump([IP()/TCP(), IP()/UDP()], prog=conf.prog.tshark) 1 0.000000 127.0.0.1 -> 127.0.0.1 TCP 40 20->80 [SYN] Seq=0 Win=8192 Len=0 # noqa: E501 2 0.000459 127.0.0.1 -> 127.0.0.1 UDP 28 53->53 Len=0 To get a JSON representation of a tshark-parsed PacketList(), one can:: >>> import json, pprint >>> json_data = json.load(tcpdump(IP(src="217.25.178.5", ... dst="45.33.32.156"), ... prog=conf.prog.tshark, ... args=["-T", "json"], ... getfd=True)) >>> pprint.pprint(json_data) [{u'_index': u'packets-2016-12-23', u'_score': None, u'_source': {u'layers': {u'frame': {u'frame.cap_len': u'20', u'frame.encap_type': u'7', [...] }, u'ip': {u'ip.addr': u'45.33.32.156', u'ip.checksum': u'0x0000a20d', [...] u'ip.ttl': u'64', u'ip.version': u'4'}, u'raw': u'Raw packet data'}}, u'_type': u'pcap_file'}] >>> json_data[0]['_source']['layers']['ip']['ip.ttl'] u'64' Nztcpdump is not availablezprog must be a stringrDLT_rz7Unknown linktype. Try passing its datalink name insteadz-yz)Cannot get linktype from a PcapNg packet.r)compile_filterrz-ki-)z-U-rrr)r)rrz.pcapT)rxryc.dSNirzr sr2rztcpdump..{ sW\\'22r4r4r))rrrc.dSrr r!sr2rztcpdump.. sg!6!6r4c8jdSr)rrz)rsr2rztcpdump.. s))'22r4)0rrr rr5r6r rrrrrrrrrprrr r rscapy.arch.commonrrrr rrdevnullrr rr rz writelinesrrAttributeErrorrrrrrUnboundLocalErrorr terminaterr )r rgetfdrfltrgetprocquiet use_tempfileread_stdin_optsrr  _suppress linktype_namerdremetadatarrrtmpfilerrs` @r2r r  sH  WE |y  !*  !" D#  2v0111 h $ $   4X > >      ""6** (#ABB<$M 0::     r>>I  }%% |Dzz    7C 8 8 G$$ +b,// +&(oo&7&7 8#+#4"/x3'.H#(G "{H + + + + + + + + + + + + + + + 544444sX.... C $ 7 7Z__4F!& 0T"*   DF D>$q'TY->">  7di) ) )$clOO !W ) ) )' )///OO#SkOO// %d1g B B B  #t D                GS ! !=# %d1g B B B  #g&-D                5#       2222C88    MMOOOO  8 8 8,g66G 7Gh 7 7 7 7 7 7 8 &d1g B B B  #gl++d2D                # NN   )$q'IFFF  !'?*T1!!!                 + # # #)$q'IFFF  !'?*T1$/!!                | # %%6666<<   """" " ? ? ?tz7X>>>>>>$    % #. | xx 2222C 8 8      {  s <B BBC CC:F42FF4F F44F8;F82KK K L>>MM&N,O O #%PPP"+R Q8, R8Q<<R?Q<R(U,,)S! U,!S% %U,(S% )U,2+T7U,7!U&U, U&#U,%U&&U,+U,c>t}t||ttjj5t jtjj|gdddn #1swxYwYt|}tj ||S)zARun hexedit on a list of packets, then return the edited packets.N) rzrrrrhexeditrrrrr)r rrpktlists r2r6r6 s A 1g !$)"3 4 400*A.///000000000000000ayyHIaLLL Os&A//A36A3c tjdd}|dkr|Str|ddlm}m}|jd}|d}|j||}|r0tj d|j \ }}}} } } } } }}}| | z dz}|S|S ttjd }n#t$rYnwxYw|r|S dd l}dd l}tjd dddd}|d|j|}tj d |d}n#t*t,f$rd }YnwxYw|S) zGet terminal width (number of characters) if in a window. Notice: this will try several methods in order to support as many terminals and OS as possible. )rr)fallbackr)windllcreate_string_bufferi hhhhHhhhhhhrXCOLUMNSNHHHHO)shutilget_terminal_sizer ctypesr:r;kernel32 GetStdHandleGetConsoleScreenBufferInfor`rrawrrenvironrKfcntltermiosraioctl TIOCGWINSZrModuleNotFoundError)sizexr:r;hcsbirbufxbufycurxcurywattrr toprbottommaxxmaxyrIrJrr:s r2get_terminal_widthrZ s  $f 5 5 5a 8E zz  77777777 O ( ( - -##B''o88DAA  5;]=RVRZ5[5[ 3T4tU 3vtTDL1$EL  BJy)**          K1a + + KK7-q 1 1 fa((+ ( ) Ls%(C CCAD55E  E c6|rd}nd}t|d}t||dz zttz}d}|fdt |D]\}g} g} t |D]F\} } t | t r,| | | | pd G| rw|=d} t| d d iD]e}| rd g|z}nt |}t | D]\} }|| ||<| | zt|| dz } fttttd f|}||z}d t|D}t!}t"jr|r||z }t'||krd }|t+|fd|D}|t+|} t || }|dddz|<t||| <t||| <t+||<t'||k|rt-jd|d|D|r-| dtd|Ddfd|DS)aO Pretty list to fit the terminal, and add header. :param rtlst: a list of tuples. each tuple contains a value which can be either a string or a list of string. :param sortBy: the column id (starting with 0) which will be used for ordering :param borders: whether to put borders on the table or not rrrrXFNc|Sr.ru)r:sortBys r2rzpretty_list.. s 6r4rDr fillvalue.c@g|]}td|DS)c34K|]}t|VdSr.rr0r$s r2r3z)pretty_list...' s(&&qCFF&&&&&&r4)r rs r2rzpretty_list..' s/===1&&A&&&&&===r4Tc:g|]}t|Srur)r0r:rs r2rzpretty_list..2 s#---3qt99---r4rez?Table cropped to fit the terminal (conf.auto_crop_tables==True)cg|]}d|zS)z%%-%dsrurs r2rzpretty_list..? s666x!|666r4c3 K|] }d|zV dS)rNrurs r2r3zpretty_list..B s&991sQw999999r4rc3"K|] }|zV dSr.ru)r0r:fmts r2r3zpretty_list..D s'--S1W------r4)rrr sort enumerater5rrrrrrrr"r6ziprZrauto_crop_tablesrindexr rrr)rtlstheaderr]borders_spacecols _spacelen_cropedr.idsrrr;rex_vals extra_linerOrtslstcolwidthwidthrowr;rhrs ` @@r2 pretty_listr| sQ vay>>DF tax(3w<<7IG  **** +++U##4oo * *FAs#t$$ * 1  cjS)))  aA&>#>>  ,"%JJ!%dJ%cNN//DAq$+AJJqMM QUE*$5$5666Q $uS#X' / /F f_F==V ===H  E ## !(mme##Gs8}}--A----f---C #c((##AVAYAQ49s?AaDaF1I1YYCFc((HQK(mme## \Z[[[ ++66X666 7 7C; a9999999::: 99----f--- - --r4.1fcgd}|sdSttj|d}|r8|t|kr%t |dd|zzz |||dz zSt |dzS)zC Convert a size in octets to a human string representation )KMGTPE0Bir;rrXr^)rmathlogrrr6)r:rhunitsrs r2 human_sizerG s + * *E t DHQ  A;QU^^a!b1f+os++eAEl:: q66C<r4c <ii} i} i} d} |D]} d|| D\}}}tt|| } t|dt|t||<d| |<|| ||f<t}t| }|r||nn |t nQ#t $rD |tn$#t $r|YnwxYwYnwxYw|r||nn |t nQ#t $rD |tn$#t $r|YnwxYwYnwxYwd}|r || fd|D}||dzz }|| }||dzz }|dz }|D])}||| |<|| ||zz }|dz }*||dzz }|r||dzz }|D]E}|||zz }|dz }|D]+}|| || ||fd zz }|dz },||dzz }F|r||dzz }|r|St|d dS) z@Core function of the make_table suite, which generates the tablerc,g|]}t|Srur)r0rs r2rz __make_table..i s///c!ff///r4Nr^r|c g|] }| Sruru)r0r:vxs r2rz __make_table.. s';';';!1';';';r4rrrr) r rr*rrirrKrr)yfmtfuncfmtfuncendlinerfxyzsortxsorty seplinefuncrvyvzvxfrOrr+r,zzvxkvykrseplinerhr:r$rs @r2 __make_tablerU sy B B B CG //ddAh/// Bc"ggw''RVVB]]CGGSWW5522B8 r((C r((C  U  HHH        T""""         U  HHH        T""""       A+g';';';';s';';';<< Wt^ (7  CrMAHA AA SVaZ S4A Wt^  S1W  S  A Q"&&!Q--- -A HAA Wt^ Wt^  aRtslC## D1.D  D1 D+(D1*D++D10D1E** F85FF8F2/F81F22F87F8c*tdddg|Ri|S)Nc d|zSNz%%-%isruls r2rzmake_table.. (Q,r4c d|zSrrurs r2rzmake_table.. rr4r|rrr1s r2 make_tabler sA            r4c0tdddg|Rddi|S)Nc d|zSNz%%-%is |rurs r2rz"make_lined_table.. *q.r4c d|zSrrurs r2rz"make_lined_table.. rr4r|rcVdd|dz g|zdgzDS)N+c3&K|] }d|dzzV dS)rr;Nrurbs r2r3z5make_lined_table.... s;* * C1q5M* * * * * * r4rXrdrrr:s r2rz"make_lined_table.. sA* * $%E7Q;"#5* * * " " r4rrs r2make_lined_tabler sP                  r4c0tdddg|Rddi|S)NcdS)Nz%srurs r2rz make_tex_table.. s$r4cdS)Nz& %srurs r2rz make_tex_table.. s&r4z\\rcdS)Nz\hlinerurs r2rz make_tex_table.. sr4rrs r2make_tex_tabler sM        +*      r4ct|} tj|}n#t$r|}YnwxYwtjtjtj}|d||ddzd} | d}||z }|sn| dfd| d D}td t|D]"}|| s|| ="d |d d S) zWhois client for Python)zwhois.ripe.net+utf8s r4Trsremarks:cFg|]}|r|||Srur)r0r. ignore_tags r2rzwhois.. s5 l l ld l$ lt_iOjOj lT l l lr4 rXrN)r6r gethostbynamerKr SOCK_STREAMconnectsendrrrrQrrr~r) ip_addresswhois_ipqueryranswerrlinesrrs @r2whoisr sa:H$X..  fnf&899AII$%%%FF5<<  ' )*** F FF4LL!     GGIIIJ l l l lfll511 l l lE 1c%jj ! !aRy   qb  ::eABBi  s ' 66ceZdZUdZddZiZeeede ffe d<iZ eeedeffe d<iZ eeede effe d<ed eddfd Zed ed e edee eeeed fffd Zed eded e edee eeeed feeed fffdZe ddededeegeffdZededeegeffdZededeegeffdZdefdZddZd deeddfdZd!dZd"deddfdZ dS)#CLIUtila Provides a Util class to easily create simple CLI tools in Scapy, that can still be used as an API. Doc: - override the ps1() function - register commands with the @CLIUtil.addcomment decorator - call the loop() function when ready rNcJ ddl}dS#t$rtdwxYw)z; Check that all dependencies are installed rNz1You need to have IPython installed to use the CLI)prompt_toolkit ImportError)rBrs r2 _depcheckzCLIUtil._depcheck sH S ! ! ! ! ! ! S S SQRR R Ss".commandscommands_outputcommands_completefunccdtj|jD|_d|jD|_dS)zW Internal function to parse arguments from the kwargs of the functions cPg|]#}|jtjjk|j$Sru)kindinspect Parameter KEYWORD_ONLYrrs r2rz*CLIUtil._inspectkwargs..s7   v*777 F777r4cHg|]}t|dkrd|znd|z S)rXz-%sz--%srrs r2rz*CLIUtil._inspectkwargs..sB   q66Q;;UQYYVaZ   r4N)r signature parametersr _flagnames_flags)rs r2_inspectkwargszCLIUtil._inspectkwargs sb    d # # . 5 5 7 7      _    r4rTci}|jrHd}|D]9}||jvr.|dz }d||j|j|<9||d}||fS)zI Internal function to parse CLI arguments of a function. rrXTN)rrrm)rrrrargs r2 _parsekwargszCLIUtil._parsekwargss{,. ; A  $+%%FAFJF4?4;+<+.funcIs^),CL & CK*C    s # # # K  K !IJJJJr4r&)rcrrrs``` r2 addcommandzCLIUtil.addcommand@sD ' ,=         r4c4dtdtffd }|S)zB Decorator to register a command output processor processorrcP|jj<||Sr.)rr/rrrcrs r2rzCLIUtil.addoutput..funcXs,09C  -   y ) ) ) r4rrcrrs`` r2 addoutputzCLIUtil.addoutputSs>  - 2C        r4c4dtdtffd }|S)z; Decorator to register a command completor rrc&|jj<|Sr.)rr/rs r2rz!CLIUtil.addcomplete..funccs2;C !#, / r4rrs`` r2 addcompletezCLIUtil.addcomplete^s>  - 2C        r4cdS)z- Return the PS1 of the shell z> rurs r2ps1z CLIUtil.ps1hs tr4c$tddS)z, Function called on exiting ExitedN)rrs r2rz CLIUtil.closens hr4cfdtdtffd |ri|jvrtd|zdSj|}t||d|jo|jdSdjjz}tdd t|d z zzd zt|td d t|d z zzd zttfdj DdgdS)z: Return the help related to this CLI util rrc j}jjvr|jjjz }d|r"ddd|Dznddfdt t jj ddDS)Nrz%s c3 K|] }d|zV dS)rNrurs r2r3z.CLIUtil.help.._args..~s&$?$?AVaZ$?$?$?$?$?$?r4r|c3K|]S}|jjv|jddk!d|j|j|jtjjkrdnddVTdS)rrer'N?r|r)rrdefaultrrempty)r0r:rs r2r3z.CLIUtil.help.._args..s  vT_44c9I9I9I *ai7;L;R.R.R  :J9I9I9I  r4rX) rrJr/rrrrrrr)rrrBs` r2_argszCLIUtil.help.._argsxsK$$&&E} 444-dm<CC%ECHH$?$?$?$?$?????"$%    "'"3D"9"9"D"K"K"M"MNNqrrR        r4zUnknown command '%s'Nz: u│ %s - Help │u┌u─r;u┐u└u┘cg|]L\}}|||jr2|jddpdfMS)rrr|)rqr~rQ)r0rrrs r2rz CLIUtil.help..sp &C  !E$KK LPT\-?-?-A-A-G-G-M-Ma-PVTVr4)Command Arguments Description) rr6rrrqr~rgr/rr|r`)rBrrrors` @r2helpz CLIUtil.helpts        *  $-'',s2333=%D d  5!3!3!5!55      )4>+BBF %%3v;;?33e; < < < &MMM %%3v;;?33e; < < <  *.)<)<)>)> ==       r4#prompt_toolkit.completion.CompletercLddlm}mGfdd|}|S)z; Returns a prompt_toolkit custom completer r) Completer CompletionceZdZfdZdS)(CLIUtil._completer..CLICompleterc32 K|jsdS|jd}|d jvr4 fd jDD]} |t  V nt |dkrdS  j  |dd\}}}d|} jvr7 j  |D]} |t | V dS)Nrrc3FK|]}||VdSr.r)r0r:rs r2r3zKCLIUtil._completer..CLICompleter.get_completions..s5(W(WqQ\\RUEVEV(W(W(W(W(W(W(Wr4)start_positionrX) completion_requestedtextrQlowerrrrrr) cmpldocumentcomplete_eventparts possible_cmdrrer possible_argrr rBs @r2get_completionsz8CLIUtil._completer..CLICompleter.get_completionssR%:F ++C00Ahnn&&dm++(W(W(W(WDM(W(W(WQQ (js3xxiPPPPPPPQ5zzQ!%!3!3DM#4FUSTSUSUY!W!WJD!Q((4..Cd444,GD,B3,Gc,R,RUUL",*\3s88)"T"T"TTTTTr4N)r/rorpr)r rBsr2 CLICompleterr s3        r4r)prompt_toolkit.completionrr )rBrrr s` @r2 _completerzCLIUtil._completersf DCCCCCCC        9   *|~~r4rrcddlm}||} ||}n0#t $rYHt$r|YdSwxYw| ddd}| dd }|s|dvr)| d ||d vrdS||j vrtd n|j |}||||\}}}|jrd |g}|jrd |dvr|dd dkrtd |d d d\} } t'jt'j| d z| zfd|j||| D} n|g} n|g} d} | D]} ||g|Ri|} no#t.$r(td| |YAt0$r2} td| z|rt3j| Yd} ~ nd} ~ wwxYw | r||jvr|j||| fi|#t0$r} td| zYd} ~ d} ~ wwxYw)z, Main command handling loop r) PromptSession) completerTrrXN)rrOrexitzUnknown command. Type help or ?*z3More than 1 glob star (*) is currently unsupported.z.*c@g|]}||gSru)r)r0r:regs r2rz CLIUtil.loop..s;!!!$%"yy||!C!!!r4zBad number of arguments !)rzCommand failed with error: %sz&Output processor failed with error: %s)rrrpromptrr~rrrrQrrrrrrrrrrrescaper TypeErrorrKrprint_exceptionr)rBrrsessionrrrrrbeforeaftercallsrexr"s @r2loopz CLIUtil.loops 100000-$//*;*;<<<: M nnTXXZZ006688$        99S>>!""%D))C..#))++1133C ((( #((4..)))f}}$-''78888}S)*.*<*#>#>5D05dCMM9MMM$MMMFKLLLLLLLLMs: MsM9A"" B.BB I/J:? J:(J55J:> K L)LL)rN)FFr.)rr)r)!r/rorprqrrrr6rrrrrrrr&rr"r'r classmethodrrerrrrrr rrrr,rur4r2rr s!SSSS/1Hd3c**+00057OT#xS112777=?tC#tCy.!99:???  .  4    \  3i tCy$sGDM122 3\& ' ' 'S  ' tCy$sGDM12Dgdm9K4LL M ' ' '[ '! $%'88 9 [$-(O=PRc=c4d[S  55 55555n:AMAM#AMdAMAMAMAMAMAMr4rrcBi}|jrtjd|j}|s|j}n|d}tjd|d}|D]J\}}}|}|}|dkr|st d|||<Knd}tj|j |tj }g} tj |j D]'} | js | j} i} | jt"ur| jd ur d | z} d | d <n-d | d <n'| jt&t(t*fvr | j| d<nc| jtjjkrJ| jtjjkr | | jd| d<nd| z} | j| d<n| | j| jtjjkrd| d <| j|vr|| j| d<|j| fi| )t;|dt>_ ddl!m"} | t>_# |fd| Did$DdS#tJ$r>}tMdt'|z|'Yd}~dSd}~wwxYw)a Generate an Argparse call from a function, then call this function. Notes: - for the arguments to have a description, the sphinx docstring format must be used. See https://sphinx-rtd-tutorial.readthedocs.io/en/latest/docstrings.html - the arguments must be typed in Python (we ignore Sphinx-specific types) untyped arguments are ignored. - only types that would be supported by argparse are supported. The others are omitted. z?((?:.|\n)*?)(\n\s*:(?:param|type|raises|return|rtype)(?:.|\n)*)rXz3\s*:(param|type|raises|return|rtype)\s*([^:]*):(.*)r;paramz:param: without a name !r|)r descriptionformatter_classTzno- store_falseaction store_truer8rnargsz--rrrrr) DefaultThemec:g|]}|Sru)pop)r0r:paramss r2rz AutoArgparse..`s# 0 0 0fjjmm 0 0 0r4cXi|]'\}}|dr |ddn||(S)no_rNr)r0rrs r2 z AutoArgparse..asKAq,,u--41221qr4zERROR: N)(rqrrr~groupfindallr argparseArgumentParserr/ArgumentDefaultsHelpFormatterrrrr annotationrrerr6rrfrrrPOSITIONAL_ONLYrVAR_POSITIONAL add_argumentvars parse_argsrlogLevel scapy.themesr6rr`AssertionErrorr print_help)rargsdocrdesc sphinxargsargtypeargparamargdescparser positionalr/parname paramkwargsr6r+r9s @r2 AutoArgparserV sG | H N L      0<%%''DD771::DF J/9 0 0*7#>>++!--//g%%#E()CDDD(/GH%  0  $ ] >F J"4((3::<<44  *  t # #}$$'/(5 H%%(4 H%%  #sE!2 2 2"'"2K    =G-3 3 3zW.>>>!!%*---'* G$$.%*]K " "   ej ) ) ) :*9 9 9$,K ! : ")%*"5K G33{3333 &##%% & &FDM))))))#|~~D   0 0 0 0Z 0 0 0 "LLNN       i#b''!"""s$0K L 3LLc.eZdZd dZdZdZdZdZdS) PeriodicSenderThread?Tcft|tstd|g|_n||_||_t j|_t j|_|j ||_ ||_ t j |dS)z Thread to send packets periodically Args: sock: socket where packet is sent periodically pkt: packet or list of packets to send interval: interval between two packets r(N)r5rr_pkts_socket threadingEvent_stopped_enabledset _interval_ignore_exceptionsThreadr)rBsockr?intervalignore_exceptionss r2rzPeriodicSenderThread.__init__qs#t$$ x--.DJJDJ !)) !))  !"3!!$'''''r4c8|jdSr.)r`rars r2enablezPeriodicSenderThread.enables r4c8|jdSr.)r`clearrs r2disablezPeriodicSenderThread.disables r4c|js|jjs|jD]} |jr|j|n)#ttf$r}|j rYd}~dS|d}~wwxYw|j |j |js |jjrn|js|jjdSdSdSdS)N)timeout) r_is_setr\closedr[r`rr TimeoutErrorrcr rb)rBrrs r2runzPeriodicSenderThread.runs?-&&(( 1D Z   }++--- ))!,,,.   .    ""4>":::=''))T\-@E-&&(( 1D         s3A$$B 5BBB cr|j||jdzdSr9)r_rarrbrs r2stopzPeriodicSenderThread.stops5  $.1$%%%%%r4N)rYT)r/rorprrirlrrrtrur4r2rXrXpsd((((* &&&&&r4rXcBeZdZdZedZdZdZdZdZ dS)SingleConversationSocketcD||_tj|_dSr.)_innerr]RLock _tx_mutex)rBos r2rz!SingleConversationSocket.__init__s "**r4c|jjSr.)rxrIrs r2rIz!SingleConversationSocket.__dict__s {##r4c,t|j|Sr.)rLrx)rBrs r2rOz$SingleConversationSocket.__getattr__rPr4ch|j5|jj|i|cdddS#1swxYwYdSr.)rzrxsr1rBrr1s r2rzSingleConversationSocket.sr1s ^ 3 3"4;?D2E22 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 '++ch|j5|jj|i|cdddS#1swxYwYdSr.)rzrxsrrs r2rzSingleConversationSocket.srs ^ 2 2!4;>41511 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2rc|j5 |j|cdddS#ttf$r }|j|d}~wwxYw#1swxYwYdSr.)rzrxrConnectionErrorrr)rBr:rs r2rzSingleConversationSocket.sends ^   {''**        $W-    !!###           s,A$0A!AA!!A$$A(+A(N) r/rorprpropertyrIrOrrrrur4r2rvrvsz+++ $$X$***333 222 r4rv)Fr|Fr)r)rrFrr)NNNNNN)r3rr.)rNr) NFFNNNFFNNNTF)rF)r})NNNF)rqririor itertoolsrrmrr?r=rqrrrrrrrrtrbrrArr`rrrr]rrr scapy.configr scapy.constsrr r scapy.datar r r scapy.compatrrrrr scapy.errorrrrrscapy.pton_ntoprtypingrrrrrrrrr r!r"r#r$r%r&r'rr( scapy.plistr)r*rr+rr rrr<r_Decimalr>rzrr6rrrrregisterrrrrrrrrer2rar>r@rFrIrMrTrWr[rjrnryr}rrrrrrrrrrrrrrrrrrrrrobjectrrrr)r,r2r7r<r>r@r8r]rxrrrrrrrrrrrrrprwrrrrrrrrrrrr rrrr r6rZr|rrrrrrrrVrdrXrvrur4r2rs/  !!!!!!     1111111111////////// &%%%%%  ######77777777------BuIt},- " # CBCBCBCBCBwCBCBCBL           ,"eCHo$3cRY      : : :   <**    ///  ww Xv w Xv w 3-w w  wwwwt6;sA+%% / J J111      <HHH ...,,,,,,HHHHHHHHH # # # # !F&''' II|/////////   111            888 222    &&&///000   ///,,,AAAQQQ(((((v(((V$)$)$)$)$)&$)$)$)R     TTTTp               "   AAA" 999$&$&$&$&$&$&$&$&NAAAAATAAAHMMM HHHH///         &," + + + +,J&J&J&J&J&4J&J&J&ZLLLLL2LLLL^;K;K;K;K;K;K;K;K|[=[=[=[=[=m[=[=[=| )5)5)5)5)5?J)5)5)5Xu u u u u u u u p8%8%8%8%8%,8%8%8%vFFFFF(FFFRvvvvv*vvvr        ?&++++,,,,,"6,,,^EEEEE "=EEEEP,>>>>> >>>B@ K K K K HHHH$BBB        LLLL^   ***^O.O.O.O.d    (   NNNNb       !!!DXMXMXMXMXMXMXMXMv\(\T\\\\H1&1&1&1&1&9+1&1&1&hvs>J J&%J&