Python dpkt.NeedData方法代码示例

# 需要导入模块: import dpkt [as 别名]
# 或者: from dpkt import NeedData [as 别名]
def assembleServerHello(hdr, pkt):
  global chCache, shCache
  if len(chCache) == 0:
    return

  eth, ip, tcp = parseTCP(pkt)
  if len(tcp.data) == 0:
    return
  
  chIdx = chCache.idx(ip.dst, ip.src, tcp.dport)
  shIdx = shCache.idx(ip.src, ip.dst, tcp.sport)
  if chIdx in chCache:
    if shIdx in shCache:
      if shCache[shIdx][0] == tcp.seq:
        try:
          tls = dpkt.ssl.TLS(shCache[shIdx][1] + tcp.data)
          SNI = chCache[chIdx]
          del chCache[chIdx]
          del shCache[shIdx]
          parseServerHello(SNI, ip, tls)
        except dpkt.NeedData:
          shCache.insert(shIdx, len(tcp.data), tcp.data)
    else:
      try:
        tls = dpkt.ssl.TLS(tcp.data)
        SNI = chCache[chIdx]
        del chCache[chIdx]
        del shCache[shIdx]
        parseServerHello(SNI, ip, tls)
      except dpkt.NeedData:
        shCache.insert(shIdx, tcp.seq + len(tcp.data), tcp.data) 

# 需要导入模块: import dpkt [as 别名]
# 或者: from dpkt import NeedData [as 别名]
def iplayer_from_raw(raw, linktype=1):
    """Converts a raw packet to a dpkt packet regarding of link type.
    @param raw: raw packet
    @param linktype: integer describing link type as expected by dpkt
    """
    if linktype == 1:  # ethernet
        try:
            pkt = dpkt.ethernet.Ethernet(raw)
            return pkt.data
        except dpkt.NeedData:
            pass
    elif linktype == 101:  # raw
        return dpkt.ip.IP(raw)
    else:
        raise CuckooProcessingError("unknown PCAP linktype") 

# 需要导入模块: import dpkt [as 别名]
# 或者: from dpkt import NeedData [as 别名]
def packetHandler(self, udp, data):
        try:
            dhcp_packet = dpkt.dhcp.DHCP(data)
        except dpkt.NeedData as e:
            self.warn('{} dpkt could not parse session data (DHCP packet not found)'.format(str(e)))
            return

        # Pull the transaction ID from the packet
        self.xid = hex(dhcp_packet.xid)

        # if we have a DHCP INFORM PACKET
        if dhcp_packet.op == dpkt.dhcp.DHCP_OP_REQUEST:
            self.debug(dhcp_packet.op)
            for option_code, msg_value in dhcp_packet.opts:

                # if opt is CLIENT_ID (61)
                # unpack the msg_value and reformat the MAC address
                if option_code == dpkt.dhcp.DHCP_OPT_CLIENT_ID:
                    hardware_type, mac = unpack('B6s', msg_value)
                    mac = binascii.hexlify(mac)
                    self.mac_address = ':'.join([mac[i:i+2] for i in range(0, len(mac), 2)])

                # if opt is HOSTNAME (12)
                elif option_code == dpkt.dhcp.DHCP_OPT_HOSTNAME:
                    self.client_hostname = msg_value
      
  
        if self.xid and self.client_hostname and self.mac_address:
            self.alert('Transaction ID: {0:<12} Client Hostname: {1:<15} Client MAC: {2:<20}'.format(
                       self.xid, self.client_hostname,  self.mac_address), **udp.info()) 

# 需要导入模块: import dpkt [as 别名]
# 或者: from dpkt import NeedData [as 别名]
def _https_identify(self, conn, data):
        """Extract a combination of the Session ID, Client Random, and Server
        Random in order to identify the accompanying master secret later."""
        if not hasattr(dpkt.ssl, "TLSRecord"):
            if not Pcap.notified_dpkt:
                Pcap.notified_dpkt = True
                log.warning("Using an old version of dpkt that does not "
                            "support TLS streams (install the latest with "
                            "`pip install dpkt`)")
            return

        try:
            record = dpkt.ssl.TLSRecord(data)
        except dpkt.NeedData:
            return
        except:
            log.exception("Error reading possible TLS Record")
            return

        # Is this a valid TLS packet?
        if record.type not in dpkt.ssl.RECORD_TYPES:
            return

        try:
            record = dpkt.ssl.RECORD_TYPES[record.type](record.data)
        except dpkt.ssl.SSL3Exception:
            return
        except dpkt.NeedData:
            log.exception("Incomplete possible TLS Handshake record found")
            return

        # Is this a TLSv1 Handshake packet?
        if not isinstance(record, dpkt.ssl.TLSHandshake):
            return

        # We're only interested in the TLS Server Hello packets.
        if not isinstance(record.data, dpkt.ssl.TLSServerHello):
            return

        # Extract the server random and the session id.
        self.tls_keys.append({
            "server_random": record.data.random.encode("hex"),
            "session_id": record.data.session_id.encode("hex"),
        })