
    h                        d Z ddlmZmZmZmZmZmZmZm	Z	m
Z
 ddlmZmZ ddlmZ ddlmZ  G d de          Z G d d	e          Z G d
 de          Z G d de          Z G d de          Z G d de          Z eeed            eeed            eeedd            eeed            eeedd            eeed            eeedd            eeed           dS )z8
Sebek: kernel module for data collection on honeypots.
    )	FieldLenFieldIPFieldIntFieldShortEnumField
ShortFieldStrFixedLenFieldStrLenField	XIntFieldByteEnumField)Packetbind_layers)UDP)	IP_PROTOSc                       e Zd ZdZ edd           edd           edddddd	d
           edd           edd           edd          gZd Z	dS )	SebekHeadzSebek headermagici version   typer         )readwritesocketopencountertime_sec	time_usecc                 ,    |                      d          S )Nz2Sebek Header v%SebekHead.version% %SebekHead.type%)sprintfselfs    W/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/contrib/sebek.py	mysummaryzSebekHead.mysummary!   s    ||PQQQ    N)
__name__
__module____qualname__namer
   r   r   r   fields_descr$    r%   r#   r   r      s        D9Wh//:i++!>&!a!891.F .F G G8Iq))8J**8K++-KR R R R Rr%   r   c            
           e Zd ZdZ edd           edd           edd           eddd           ed	d
dd           eddd           gZd Z	d
S )SebekV1zSebek v1pidr   uidfdcmd    data_lengthNdataIfmtc                     | j         S Nr4   xs    r#   <lambda>zSebekV1.<lambda>/        r%   length_fromc                     t          | j        t                    r| j                            d          S |                     d          S )Nz)Sebek v1 %SebekHead.type% (%SebekV1.cmd%)zSebek v1 (%SebekV1.cmd%)
isinstance
underlayerr   r    r!   s    r#   r$   zSebekV1.mysummary1   s@    doy11 	<?**+VWWW<< :;;;r%   
r&   r'   r(   r)   r   r   r   r	   r*   r$   r+   r%   r#   r-   r-   (   s        D8E1%%8E1%%8D!$$##E2r22 =f#FFF;vr7M7MNNNPK< < < < <r%   r-   c                       e Zd ZdZ edd           edd           edd           edd           edd           edd	d
           edddd           edd	d           gZd Z	dS )SebekV3zSebek v3
parent_pidr   r.   r/   r0   inoder1   r2   r3   r4   Nr5   r6   r7   c                     | j         S r:   r;   r<   s    r#   r>   zSebekV3.<lambda>A   r?   r%   r@   c                     t          | j        t                    r| j                            d          S |                     d          S )Nz;Sebek v%SebekHead.version% %SebekHead.type% (%SebekV3.cmd%)zSebek v3 (%SebekV3.cmd%)rC   r!   s    r#   r$   zSebekV3.mysummaryC   @    doy11 	<?**+hiii<< :;;;r%   rF   r+   r%   r#   rH   rH   8   s        D8L!,,8E1%%8E1%%8D!$$8GQ''##E2r22 =f#FFF;vr7M7MNNNPK< < < < <r%   rH   c                       e Zd Zd ZdS )SebekV2c                     t          | j        t                    r| j                            d          S |                     d          S )Nz;Sebek v%SebekHead.version% %SebekHead.type% (%SebekV2.cmd%)zSebek v2 (%SebekV2.cmd%)rC   r!   s    r#   r$   zSebekV2.mysummaryK   rM   r%   Nr&   r'   r(   r$   r+   r%   r#   rO   rO   J   s#        < < < < <r%   rO   c                   R   e Zd ZdZ edd           edd           edd           edd           edd           edd	d
           edd           edd           edd           edd           edd           edddddddddd
d           e	dde
          gZd ZdS )SebekV3SockzSebek v2 socketrI   r   r.   r/   r0   rJ   r1   r2   r3   r4      dipz	127.0.0.1dportsipsportcallr   r                  )bindconnectlistenacceptsendmsgrecvmsgsendtorecvfromprotoc                     t          | j        t                    r| j                            d          S |                     d          S )Nz?Sebek v%SebekHead.version% %SebekHead.type% (%SebekV3Sock.cmd%)z#Sebek v3 socket (%SebekV3Sock.cmd%)rC   r!   s    r#   r$   zSebekV3Sock.mysummaryf   A    doy11 	G?**+lmmm<< EFFFr%   N)r&   r'   r(   r)   r   r   r   r   r   r   r   r*   r$   r+   r%   r#   rS   rS   R   s        D8L!,,8E1%%8E1%%8D!$$8GQ''##E2r228M2..75+..:gq))75+..:gq))!>&!a9:a89b9;r:<	.> .> ? ?
 !=!Y77!9K$G G G G Gr%   rS   c                       e Zd Zd ZdS )SebekV2Sockc                     t          | j        t                    r| j                            d          S |                     d          S )Nz?Sebek v%SebekHead.version% %SebekHead.type% (%SebekV2Sock.cmd%)z#Sebek v2 socket (%SebekV2Sock.cmd%)rC   r!   s    r#   r$   zSebekV2Sock.mysummaryn   ri   r%   NrQ   r+   r%   r#   rk   rk   m   s(        G G G G Gr%   rk   iM  )rX   )rV   )rV   rX   r   )r   r   )r   r   r   N)__doc__scapy.fieldsr   r   r   r   r   r   r	   r
   r   scapy.packetr   r   scapy.layers.inetr   
scapy.datar   r   r-   rH   rO   rS   rk   r+   r%   r#   <module>rr      s   H H H H H H H H H H H H H H H H H H H H H H , , , , , , , , ! ! ! ! ! !            R R R R R R R R"< < < < <f < < < < < < < <f < < <$< < < < <g < < <G G G G G& G G G6G G G G G+ G G G C$ ' ' ' ' C$ ' ' ' ' C$d 3 3 3 3 Iw * * * * I{AA 6 6 6 6 Iw * * * * I{AA 6 6 6 6 Iw * * * * * *r%   