1 Feb 2010 13:30
Re: Adding protocol to Scapy
Pierre-François Bonnefoi <bonnefoi <at> unilim.fr>
2010-02-01 12:30:56 GMT
2010-02-01 12:30:56 GMT
Hello,
I've added a new class to manage the list of pseudo-TLVs :
class ListeSTUNAttributs(PacketListField):
def __init__(self, name, default, cls):
PacketField.__init__(self, name, default, cls)
def getfield(self, pkt, s):
liste = []
reste = s
while len(reste) > 0:
p = self.m2i(pkt, reste)
if Padding in p:
pad = p[Padding]
reste = pad.load
del(pad.underlayer.payload)
else:
reste = ""
liste.append(p)
return reste, liste
def addfield(self, pkt, s, val):
return s+reduce(str.__add__, map(str, val), "")
This code has been taken from OSPF extension.
I've also added to my code some bind_layers as :
bind_layers(STUN, STUN_Attribut1)
bind_layers(STUN, STUN_Attribut2)
bind_layers(STUN_Attribut1, STUN_Attribut2)
(Continue reading)
> My point is to make something the most simple and the most respectful of
> common practices of using Scapy.
>
> It's a work aiming at students so, I've to find the correct way to do
> this (I've some mor philosophical questions about Fields and Class
> inheriting from Packet, but I'll keep them from another time 
>
> Thank you for your help,
> Pierre-François.
>
Best Regards,
Jochen
> Le 01/02/10 00:05, Jochen Bartl a écrit :
> > Hi Pierre-François,
> >
> > maybe I can help you to understand the code for parsing TLV fields,
> > because I have used code from the CDP layer for my EIGRP layer.
> >
> > At first, it seems like the AllPacketListField isn't needed anymore in
> > recent Scapy versions. It can be replaced by the normal PacketListField.
> > This reduces the code to the following code fragments, which we should
> > have a look at:
> >
> > # Dictionary to map the TLV type value to the class name of a sub-packet
> > _cdp_tlv_cls = { 0x0001: "CDPMsgDeviceID",
> > 0x0002: "CDPMsgAddr",
> > 0x0003: "CDPMsgPortID",
> > 0x0004: "CDPMsgCapabilities",
> > 0x0005: "CDPMsgSoftwareVersion",
> > 0x0006: "CDPMsgPlatform",
> > 0x0007: "CDPMsgIPPrefix"
> > }
> >
> > # Only a helper function for getting the TLV class
> > # from the global scope.
> > def get_cls(name, fallback_cls):
> > return __builtin__.__dict__.get(name, fallback_cls)
> >
> > # This function tells the PacketListField, how it should extract
> > # the TLVs from the payload
> > def _CDPGuessPayloadClass(p, **kargs):
> > cls = Raw
> > if len(p)>= 2:
> > # Read 2 bytes (H - Unsigned short) from the payload
> > # to get the TLV type value
> > t = struct.unpack("!H", p[:2])[0]
> > # Find out if the value t is in the dict _cdp_tlv_cls
> > # if not, return the default TLV class CDPMsgGeneric
> > cls = get_cls(_cdp_tlv_cls.get(t, "Raw"), CDPMsgGeneric)
> >
> > return cls(p, **kargs)
> >
> >
> > I hope this explanation is not too basic or confuses you more. You could
> > take the following steps to use this code for your own layer:
> >
> > 1.) Define PacketListField + function to extract TLVs in main header of
> > the protocol
> > 2.) Modify _CDPGuessPayloadClass, if your protocol's TLV type field
> > isn't 2 bytes long
> > 3.) Modify also CDPMsgGeneric if the TLV type or length field isn't 2
> > bytes long
> > 4.) Write TLV classes for your sub-packets (TLVs)
> > 5.) Add those classes to the _cdp_tlv_cls dictionary
> > 6.) Maybe you want to replace CDP class and function names with STUN in
> > the code 
RSS Feed