B

K ë(Œqã@s°dZd
dl
mZ
d
dlmZ
d
dlmZ
d
dlmZm	Z	
d
dl
mZ
d
dlmZm
Z
mZmZmZmZmZmZ
Gdd	„d	eƒZGd
d„deƒZGdd
„d
eƒZGdd„deƒZdS)z0
Sessions: decode flow of packets when sniffing
é)
Údefaultdict)
Úraw)
Úconf)Ú	NoPayloadÚPacket)
Ú
PacketList)ÚAnyÚCallableÚDefaultDictÚDictÚListÚOptionalÚTupleÚcastc@sjeZ
dZd
Zddd„
Zedd„ƒ
Zejdd„ƒ
Zed	d
„ƒ
Zejdd
„ƒ
Zedd
„ƒ
Z	dd„Z
dd„ZdS)ÚDefaultSessionz#Default session: no stream decodingNFcOsH|
|_||_
g|_d
|_||_|jrD|j|j_|j
|j_d|_
d|_dS)Nr
F)Ú_DefaultSession__prnÚ_DefaultSession__storeÚlstÚ_DefaultSession__countÚ
_supersessionÚprnÚstore)ÚselfrrZsupersessionÚargsZkarg©rúŒ/build/wlanpi-profiler-8o1rr4/wlanpi-profiler-1.0.9/debian/wlanpi-profiler/opt/wlanpi-profiler/lib/python3.7/site-packages/scapy/sessions.pyÚ__init__ s	










zDefaultSession.__init__c


Cs|jS)
N)
r)
rrrrr4szDefaultSession.storecCs|jr|
|j_
n|
|_dS)
N)rrr)rÚvalrrrr9s

c


Cs|jS)
N)
r)
rrrrrAszDefaultSession.prncCs|jr|
|j_
n|
|_dS)
N)rrr)rÚ
frrrrFs

c


Cs|jr|jj
S|jSdS)
N)rÚcountr)
rrrrrNs
zDefaultSession.countc

Cs$|jrt
|jjd
ƒSt
|jd
ƒSdS)NZSniffed)rrr)
rrrrÚtoPacketListVs
zDefaultSession.toPacketListcCst|
sd
St|
t
ƒr0x|
D]}t ||¡
qWd
S|jd7_|jrP|j |
¡

|jrp| |
¡
}|d
k	rpt	|ƒ

d
S)zpDEV: entry point. Will be called by sniff() for each
        received packet (that passes the filters).
        Né
)
Ú
isinstanceÚlistrÚon_packet_receivedrrrÚappendrÚprint)rÚpktÚ
pÚresultrrrr$]s














z!DefaultSession.on_packet_received)NFN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__rÚpropertyrÚsetterrrr r$rrrrrs



rc@s(eZ
dZd
Zdd„Zdd„Zdd„ZdS)	Ú	IPSessionzVDefragment IP packets 'on-the-flow'.

    Usage:
    >>> sniff(session=IPSession)
    c
Os tj
|f
|
ž|Ž

ttƒ
|_dS)
N)rrrr#Ú	fragments)rrÚkwargsrrrrxs
zIPSession.__init__cCsÈd
dlm
}m}
||
kr|
S|
|}d
|
_|jd
ks<|jjrÀ|j|j|j	|j
f}|j| |
¡

|jjs¼zH|j|d
jd
kr®g}||j||gƒ
|d
}| 
t|ƒ
¡
}|SWd|j|=XdS|
SdS)Nr
)Ú_defrag_listÚIP)Úscapy.layers.inetr3r4Z_defrag_posÚfragÚflagsZMFÚidÚsrcÚdstÚprotor1r%Ú	__class__r)rÚpacketr3r4ÚipZuniqÚdefragZdefragmented_packetrrrÚ_ip_process_packet}s(
















zIPSession._ip_process_packetcCs|
sdSt 
|| |
¡
¡
dS)
N)rr$r@)rr'rrrr$˜s




zIPSession.on_packet_receivedN)r*r+r,r-rr@r$rrrrr0qsr0c@sTeZ
dZd
Zdd„Zdd„Zdd„Zdd	„Zd
d„ZeZ	dd
„Z
dd„Zdd„ZdS)ÚStringBufferaW
StringBuffer is an object used to re-order data received during
    a TCP transmission.

    Each TCP fragment contains a sequence number, which marks
    (relatively to the first sequence number) the index of the data contained
    in the fragment.

    If a TCP fragment is missed, this class will fill the missing space with
    zeros.
    c

Cstd
ƒ
|_
d|_g|_dS)Nór
)Ú	bytearrayÚcontentÚcontent_lenÚ
incomplete)
rrrrr­s


zStringBuffer.__init__cCs„t|
ƒ
}|d
}|||j
krj|jd||j
|7_|j |j
|f¡

|||_
t|jƒ
|j
ksjt‚
|
t|jƒ
|||…<dS)Nr!ó
)ÚlenrErDrFr%ÚAssertionErrorÚ
memoryview)rÚdataÚseqÚdata_lenrrrr%³s





zStringBuffer.appendc


Csd
S)NTr)
rrrrÚfullÃszStringBuffer.fullc

Cs| ¡
dS)
N)
r)
rrrrÚclearÉszStringBuffer.clearc

Cs
t|j
ƒ
S)
N)ÚboolrE)
rrrrÚ__bool__ÍszStringBuffer.__bool__c


Cs|jS)
N)
rE)
rrrrÚ__len__ÒszStringBuffer.__len__c

Cs
t|j
ƒ
S)
N)ÚbytesrD)
rrrrÚ	__bytes__ÖszStringBuffer.__bytes__c

Cstt
| ¡ƒS)
N)rÚstrrT)
rrrrÚ__str__ÚszStringBuffer.__str__N)
r*r+r,r-rr%rNrOrQÚ__nonzero__rRrTrVrrrrrA¢s

rAcs6eZ
dZd
ZdZd
‡f
dd„	Zdd„Zdd	„Z‡ZS)Ú
TCPSessiona"A Session that matches seq/ack packets together to dissect
    special protocols, such as HTTP.

    DEV: implement a class-function `tcp_reassemble` in your Packet class::

        @classmethod
        def tcp_reassemble(cls, data, metadata):
            # data = the reassembled data from the same request/flow
            # metadata = empty dictionary, that can be used to store data
            [...]
            # If the packet is available, return it. Otherwise don't.
            # Whenever you return a packet, the buffer will be discarded.
            return pkt
            # Otherwise, maybe store stuff in metadata, and return None,
            # as you need additional data.
            return None

    For more details and a real example, see:
    https://scapy.readthedocs.io/en/latest/usage.html#how-to-use-tcpsession-to-defragment-tcp-packets

    :param app: Whether the socket is on application layer = has no TCP
                layer. This is used for instance if you are using a native
                TCP socket. Default to False
    z_TCP {IP:%IP.src%}{IPv6:%IPv6.src%}:%r,TCP.sport% > {IP:%IP.dst%}{IPv6:%IPv6.dst%}:%r,TCP.dport%Fcs<tt
|ƒj||Ž

|
|_|
r*d
|_i|_ntdd„ƒ
|_dS)NrBcSs
tƒifS)
N)
rArrrrÚ<lambda>
rBz%TCPSession.__init__.<locals>.<lambda>)ÚsuperrXrÚapprKÚmetadatarÚ	tcp_frags)rr[rr2)
r<rrrüs




zTCPSession.__init__cCsÜ
|jrT|
j
}t|d
ƒs|
S|jt|
ƒ
7_| |j|j¡}
|
rPd|_i|_|
SdSddlm}m	}
|
rp||
krt|
S|
|j
}t|tt
jfƒr’|
S|j}|
|j}|
 |j¡
}|j|\}	}
d|
krò|j
}t|d
ƒrÜ|j}n|
S||
d<||
d
<n|
d
}|
 dd¡}|dk
r |d}|
d<||}|	 ||¡
|
|jj
sP|
|jj
rXd	|
d
<|
|jj
rnd	|
d<d}
|	 ¡
rŠ|t|	ƒ
|
ƒ}
|

rØ|	 ¡
|
 ¡
|j|=|j ¡
||
k
rÐd|
|_d|
|_|
|
SdS)zzProcess each packet: matches the TCP seq/ack numbers
        to follow the TCP streams, and orders the fragments.
        Útcp_reassemblerBNr
)r4ÚTCPÚ	pay_classÚrelative_seqr!TZtcp_endZtcp_psh) r[r<ÚhasattrrKrSr^r\r5r4r_Úpayloadr"rrZ
padding_layerÚoriginalrLZsprintfÚfmtr]Úgetr%r7Ú
FÚ
RÚ
PrNrOZ
underlayerZremove_payloadrHÚchksum)rr'r`r4r_ZpayZnew_datarLÚidentrKr\r^rar=rrrÚ_process_packet

sf














































zTCPSession._process_packetcCs4|
sd
S| |
¡
}
|
sd
S| 
|
¡
}
t ||
¡
d
S)z—Hook to the Sessions API: entry point of the dissection.
        This will defragment IP if necessary, then process to
        TCP reassembly.
        N)r@rlrr$)rr'rrrr$X
s





zTCPSession.on_packet_received)
F)	r*r+r,r-rerrlr$Ú
__classcell__rr)
r<rrXßs
NrXN)r-ÚcollectionsrZscapy.compatrZscapy.configrZscapy.packetrrZscapy.plistrrr	r
rrr
rrÚobjectrr0rArXrrrrÚ<module>s



(T1=