Index: /pm/trunk/deps/scapy-patches/smb.patch =================================================================== --- /pm/trunk/deps/scapy-patches/smb.patch (revision 5525) +++ /pm/trunk/deps/scapy-patches/smb.patch (revision 5525) @@ -0,0 +1,472 @@ +diff -r 7a211173d33f scapy/fields.py +--- a/scapy/fields.py Mon Jan 11 17:59:00 2010 +0100 ++++ b/scapy/fields.py Thu Feb 11 15:02:28 2010 +0100 +@@ -271,7 +271,7 @@ + + class ShortField(Field): + def __init__(self, name, default): +- Field.__init__(self, name, default, "H") ++ Field.__init__(self, name, default, "!H") + + class LEShortField(Field): + def __init__(self, name, default): +@@ -478,8 +478,8 @@ + return rr + + class NetBIOSNameField(StrFixedLenField): +- def __init__(self, name, default, length=31): +- StrFixedLenField.__init__(self, name, default, length) ++ def __init__(self, name, default, length=31, length_from=None): ++ StrFixedLenField.__init__(self, name, default, length, length_from=length_from) + def i2m(self, pkt, x): + l = self.length_from(pkt)/2 + if x is None: +@@ -491,6 +491,7 @@ + return x + def m2i(self, pkt, x): + x = x.strip("\x00").strip(" ") ++ if len(x) % 2 != 0: x+='A' + return "".join(map(lambda x,y: chr((((ord(x)-1)&0xf)<<4)+((ord(y)-1)&0xf)), x[::2],x[1::2])) + + class StrLenField(StrField): +@@ -585,6 +586,27 @@ + def randval(self): + return RandTermString(RandNum(0,1200),"\x00") + ++class NBTStrField(StrField): ++ def addfield(self, pkt, s, val): ++ return s+self.i2m(pkt, val) ++ def getfield(self, pkt, s): ++ l = s.find("\x00\x00") ++ if l < 0: ++ return "",s ++ if l > 0 and l + 2 < len(s) and s[l+2] == "\x00": ++ l += 1 ++ return s[l+2:],self.m2i(pkt, s[:l+2]) ++ def i2m(self, pkt, s): ++ if s.endswith("\x00\x00"): ++ s = s[:-1] ++ else: ++ s += "\x00" ++ return ''.join(map(lambda x: x + "\x00", list(s))) ++ def m2i(self, pkt, s): ++ return s.replace('\x00', '').strip(" ") ++ def randval(self): ++ return RandTermString(RandNum(0,1200), "\x00") ++ + class StrStopField(StrField): + def __init__(self, name, default, stop, additionnal=0): + Field.__init__(self, name, default) +diff -r 7a211173d33f scapy/layers/netbios.py +--- a/scapy/layers/netbios.py Mon Jan 11 17:59:00 2010 +0100 ++++ b/scapy/layers/netbios.py Thu Feb 11 15:02:28 2010 +0100 +@@ -199,8 +199,22 @@ + class NBTSession(Packet): + name="NBT Session Packet" + fields_desc= [ByteEnumField("TYPE",0,{0x00:"Session Message",0x81:"Session Request",0x82:"Positive Session Response",0x83:"Negative Session Response",0x84:"Retarget Session Response",0x85:"Session Keepalive"}), +- BitField("RESERVED",0x00,7), +- BitField("LENGTH",0,17)] ++ #BitField("RESERVED",0x00,7), ++ #BitField("LENGTH",0,17), ++ ByteField("RESERVED", 0), ++ ShortField("LENGTH",None), ++ ConditionalField(NetBIOSNameField("CALLEDNAME", "", None, length_from = lambda pkt:pkt.LENGTH/2), lambda pkt:pkt.TYPE==0x81), ++ ConditionalField(NetBIOSNameField("CALLINGNAME", "", None, length_from = lambda pkt:pkt.LENGTH/2), lambda pkt:pkt.TYPE==0x81), ++ ConditionalField(ByteField("ERRORCODE", 0), lambda pkt:pkt.TYPE==0x83), ++ ] ++ ++ def post_build(self, p, pay): ++ if self.LENGTH is None: ++ l = len(pay) ++ if l > 65535: ++ self.RESERVED |= 1 # Extended flag ++ p = p[:1] + struct.pack("B", self.RESERVED) + struct.pack("!H",len(pay)) + p[4:] ++ return p+pay + + bind_layers( UDP, NBNSQueryRequest, dport=137) + bind_layers( UDP, NBNSRequest, dport=137) +@@ -214,3 +228,6 @@ + bind_layers( UDP, NBNSWackResponse, sport=137) + bind_layers( UDP, NBTDatagram, dport=138) + bind_layers( TCP, NBTSession, dport=139) ++bind_layers( TCP, NBTSession, sport=139) ++bind_layers( TCP, NBTSession, dport=445) ++bind_layers( TCP, NBTSession, sport=445) +diff -r 7a211173d33f scapy/layers/smb.py +--- a/scapy/layers/smb.py Mon Jan 11 17:59:00 2010 +0100 ++++ b/scapy/layers/smb.py Thu Feb 11 15:02:28 2010 +0100 +@@ -7,6 +7,280 @@ + from scapy.fields import * + from scapy.layers.netbios import NBTSession + ++BINDER = {} ++ ++################################################################################ ++# SMB Header ++################################################################################ ++ ++class SMBHeader(Packet): ++ name="SMB Protocol Header" ++ fields_desc = [StrFixedLenField("Start","\xffSMB",4), ++ ByteEnumField("Command",0x72,{0x72:"SMB_COM_NEGOTIATE"}), ++ ByteField("Error_Class",0x02), ++ ByteField("Reserved",0), ++ LEShortField("Error_Code",4), ++ ByteField("Flags",0), ++ LEShortField("Flags2",0x0000), ++ LEShortField("PIDHigh",0x0000), ++ LELongField("Signature",0x0), ++ LEShortField("Unused",0x0), ++ LEShortField("TID",0), ++ LEShortField("PID",0), ++ LEShortField("UID",0), ++ LEShortField("MID",0)] ++ ++ def guess_payload_class(self, payload): ++ index = self.Flags & 128 != 0 and 1 or 0 ++ protos = BINDER.get(self.Command, None) ++ ++ if isinstance(protos, tuple): ++ proto = protos[index].get(ord(payload[0])) ++ ++ if proto: ++ return proto ++ ++ if self.Command == 0x72 and payload[0] == '\x11' and len(payload) > 23: ++ if ord(payload[23]) & 128: # SERVER_CAP_EXTENDED_SECURITY ++ return SMBNegociate_Response_Advanced_Security ++ else: ++ return SMBNegociate_Response ++ ++ return Packet.guess_payload_class(self, payload) ++ ++bind_layers(NBTSession, SMBHeader, TYPE=0) ++ ++################################################################################ ++# (0x32) SMB Setup AndX ++################################################################################ ++ ++class SMBSetup_AndX_Response(Packet): ++ name="Session Setup AndX Response" ++ fields_desc=[ByteField("WordCount",0), ++ LEShortField("TotalParameterCount",0), ++ LEShortField("TotalDataCount",0), ++ LEShortField("MaxParameterCount",0), ++ LEShortField("MaxDataCount",0), ++ LEShortField("MaxSetupCount",0), ++ ByteField("Reserved",0), ++ LEShortField("Flags",0), ++ LELongField("Timeout",0), ++ LEShortField("Reserved",0), ++ LEShortField("ParameterCount",0), ++ LEShortField("ParameterOffset",0), ++ LEShortField("DataCount",0), ++ LEShortField("DataOffset",0), ++ ByteField("SetupCount",0), ++ ByteField("Reserved",0), ++ LEShortField("SubCommand",0), ++ LEShortField("ByteCount",0), ++ ] ++ ++ ++################################################################################ ++# (0x73) SMB Setup AndX ++################################################################################ ++ ++class SMBSetup_AndX_Response(Packet): ++ name="Session Setup AndX Response" ++ fields_desc=[ByteField("WordCount",0), ++ LEShortField("ByteCount",0)] ++ ++ def guess_payload_class(self, payload): ++ if self.ByteCount > 0: ++ return SMBDialect ++ return Packet.guess_payload_class(self, payload) ++ ++class SMBSetup_AndX_Request(Packet): ++ name="Session Setup AndX Request" ++ fields_desc=[ByteField("WordCount",13), ++ ByteEnumField("AndXCommand",0x75,{0x75:"SMB_COM_TREE_CONNECT_ANDX"}), ++ ByteField("Reserved",0), ++ LEShortField("AndXOffset",96), ++ LEShortField("MaxBuffer",2920), ++ LEShortField("MaxMPXCount",50), ++ LEShortField("VCNumber",0), ++ LEIntField("SessionKey",0), ++ LEFieldLenField("ANSIPasswordLength",None,"ANSIPassword"), ++ LEFieldLenField("UnicodePasswordLength",None,"UnicodePassword"), ++ LEIntField("Reserved2",0), ++ LEShortField("Capabilities",0x05), ++ BitField("UnixExtensions",0,1), ++ BitField("Reserved3",0,7), ++ BitField("ExtendedSecurity",0,1), ++ BitField("CompBulk",0,2), ++ BitField("Reserved5",0,5), ++ LEShortField("ByteCount",35), ++ StrLenField("ANSIPassword", "Pass",length_from=lambda x:x.ANSIPasswordLength), ++ StrLenField("UnicodePassword", "Pass",length_from=lambda x:x.UnicodePasswordLength), ++ NBTStrField("Account","GUEST"), ++ NBTStrField("PrimaryDomain", ""), ++ NBTStrField("NativeOS","Windows 4.0"), ++ NBTStrField("NativeLanManager","Windows 4.0"), ++ #StrLenField("ExtraBytes", "", length_from=lambda x:(x.ByteCount - x.ANSIPasswordLength - x.UnicodePasswordLength - (len(x.Account) + len(x.PrimaryDomain) + len(x.NativeOS) + len(x.NativeLanManager) + 4) * 2 + 1) / 2)] ++ StrLenField("ExtraBytes", "", length_from=lambda x:(x.ByteCount - x.ANSIPasswordLength - x.UnicodePasswordLength - (len(x.Account) + len(x.PrimaryDomain) + len(x.NativeOS) + len(x.NativeLanManager) + 4) * 2) & ~1)] ++ ++ def guess_payload_class(self, payload): ++ protos = BINDER.get(self.AndXCommand, None) ++ ++ if isinstance(protos, tuple): ++ proto = protos[0].get(ord(payload[0])) ++ ++ if proto: ++ return proto ++ ++ return Packet.guess_payload_class(self, payload) ++ ++class SMBSetup_AndX_Response_Advanced_Security(Packet): ++ name="SMBNegociate Protocol Response Advanced Security" ++ fields_desc = [ByteField("WordCount",4), ++ ByteEnumField("AndXCommand",0x75,{0x75:"SMB_COM_TREE_CONNECT_ANDX"}), ++ ByteField("Reserved",0), ++ LEShortField("AndXOffset",0), ++ LEShortField("Action",0), ++ LEShortField("SecurityBlobLength",0), ++ LEShortField("ByteCount",0), ++ StrLenField("SecurityBlob", "", length_from=lambda x:x.SecurityBlobLength), ++ NBTStrField("NativeOS","Windows 4.0"), ++ NBTStrField("NativeLanManager","Windows 4.0")] ++ ++class SMBSetup_AndX_Request_Advanced_Security(Packet): ++ name="SMBNegociate Protocol Response Advanced Security" ++ fields_desc = [ByteField("WordCount",12), ++ ByteEnumField("AndXCommand",0x75,{0x75:"SMB_COM_TREE_CONNECT_ANDX"}), ++ ByteField("Reserved",0), ++ LEShortField("AndXOffset",0), ++ LEShortField("MaxBuffer",2920), ++ LEShortField("MaxMPXCount",50), ++ LEShortField("VCNumber",0), ++ LEIntField("SessionKey",0x0000), ++ LEShortField("SecurityBlobLength",0), ++ LEIntField("Reserved2", 0), ++ LEIntField("Capabilities", 0), ++ LEShortField("ByteCount",0), ++ StrLenField("SecurityBlob", "", length_from=lambda x:x.SecurityBlobLength), ++ NBTStrField("NativeOS","Windows 4.0"), ++ NBTStrField("NativeLanManager","Windows 4.0"), ++ NBTStrField("PrimaryDomain", "")] ++ ++BINDER[0x73] = ({13 : SMBSetup_AndX_Request, ++ 12 : SMBSetup_AndX_Request_Advanced_Security}, ++ { 0 : SMBSetup_AndX_Response, ++ 4 : SMBSetup_AndX_Response_Advanced_Security}) ++ ++################################################################################ ++# (0x80) Query Information Disk ++################################################################################ ++ ++class SMBQueryInformationDisk_Request(Packet): ++ name="SMB Query Information Disk" ++ fields_desc=[ByteField("WordCount", 0), ++ LEShortField("ByteCount",0)] ++ ++class SMBQueryInformationDisk_Response(Packet): ++ name="SMB Query Information Disk" ++ fields_desc=[ByteField("WordCount", 0), ++ LEShortField("TotalUnits", 0), ++ LEShortField("BlocksPerUnit", 0), ++ LEShortField("BlockSize", 0), ++ LEShortField("FreeUnits", 0), ++ LEShortField("Reserved", 0), ++ LEShortField("ByteCount",0)] ++ ++BINDER[0x80] = ({0 : SMBQueryInformationDisk_Request}, {5 : SMBQueryInformationDisk_Response}) ++ ++################################################################################ ++# (0x75) SMB Tree Connect AndX ++################################################################################ ++ ++class SMBTree_Connect_AndX_Request(Packet): ++ name="Session Tree Connect AndX Request" ++ fields_desc=[ByteField("WordCount",4), ++ ByteEnumField("AndXCommand",0xFF,{0xFF:"SMB_COM_NONE"}), ++ ByteField("Reserved",0), ++ LEShortField("AndXOffset",0), ++ LEShortField("Flags",0x2), ++ LEShortField("PasswordLength",0x1), ++ LEShortField("ByteCount",18), ++ ByteField("Password",0), ++ NBTStrField("Path","\\\\WIN2K\\IPC$"), ++ StrNullField("Service","IPC")] ++ ++class SMBTree_Connect_AndX_Response(Packet): ++ name="Session Tree Connect AndX Response" ++ fields_desc=[ByteField("WordCount",3), ++ ByteEnumField("AndXCommand",0xFF,{0xFF:"SMB_COM_NONE"}), ++ ByteField("Reserved",0), ++ LEShortField("AndXOffset",80), ++ LEShortField("OptionalSupport",0x01), ++ LEShortField("ByteCount",5), ++ StrNullField("Service","IPC"), ++ NBTStrField("NativeFileSystem","")] ++ ++BINDER[0x75] = ({4 : SMBTree_Connect_AndX_Request}, {3 : SMBTree_Connect_AndX_Response}) ++ ++################################################################################ ++# (0x72) SMB Negociate ++################################################################################ ++ ++class SMBDialect(Packet): ++ name="SMB Negociate Protocol Request Tail" ++ fields_desc=[ByteField("BufferFormat",0x02), ++ StrNullField("BufferData","NT LM 0.12")] ++ ++bind_layers(SMBDialect, SMBDialect) ++ ++class SMBNegociate_Response(Packet): ++ name="SMB Negociate Protocol Response" ++ fields_desc=[ByteField("WordCount",17), ++ LEShortField("DialectIndex",7), ++ ByteField("SecurityMode",0x03), ++ LEShortField("MaxMpxCount",50), ++ LEShortField("MaxNumberVC",1), ++ LEIntField("MaxBufferSize",16144), ++ LEIntField("MaxRawSize",65536), ++ LEIntField("SessionKey",0x0000), ++ LEShortField("ServerCapabilities",0xf3f9), ++ BitField("UnixExtensions",0,1), ++ BitField("Reserved2",0,7), ++ BitField("ExtendedSecurity",0,1), ++ FlagsField("CompBulk",0,2,"CB"), ++ BitField("Reserved3",0,5), ++ # There have been 127490112000000000 tenths of micro-seconds between 1st january 1601 and 1st january 2005. 127490112000000000=0x1C4EF94D6228000, so ServerTimeHigh=0xD6228000 and ServerTimeLow=0x1C4EF94. ++ LEIntField("ServerTimeHigh",0xD6228000L), ++ LEIntField("ServerTimeLow",0x1C4EF94), ++ LEShortField("ServerTimeZone",0x3c), ++ ByteField("EncryptionKeyLength",8), ++ LEShortField("ByteCount",24), ++ BitField("EncryptionKey",0,64), ++ NBTStrField("DomainName","WORKGROUP"), ++ NBTStrField("ServerName","RMFF1")] ++ ++class SMBNegociate_Response_Advanced_Security(Packet): ++ name="SMB Negociate Protocol Response" ++ fields_desc = [ByteField("WordCount",17), ++ LEShortField("DialectIndex",10), ++ ByteField("SecurityMode",0x03), ++ LEShortField("MaxMpxCount",50), ++ LEShortField("MaxNumberVC",1), ++ LEIntField("MaxBufferSize",16144), ++ LEIntField("MaxRawSize",65536), ++ LEIntField("SessionKey",0x0000), ++ LEIntField("ServerCapabilities",0xf3f9), ++ LEIntField("ServerTimeHigh",0xD6228000L), ++ LEIntField("ServerTimeLow",0x1C4EF94), ++ LEShortField("ServerTimeZone",0x3c), ++ ByteField("EncryptionKeyLength",0), ++ LEFieldLenField("ByteCount", None, "SecurityBlob", adjust=lambda pkt,x:x-16), ++ BitField("GUID",0,128), ++ StrLenField("SecurityBlob", "", length_from=lambda x:x.ByteCount+16)] ++ ++BINDER[0x72] = ({0 : SMBDialect}, {}) ++ #{17 : SMBNegociate_Response}) ++ ++################################################################################## ++# END HERE ++################################################################################## + + # SMB NetLogon Response Header + class SMBNetlogon_Protocol_Response_Header(Packet): +@@ -106,32 +380,6 @@ + StrNullField("ServerName","WIN"), + LEShortField("LM20Token", 0xffff)] + +-# SMBNegociate Protocol Request Header +-class SMBNegociate_Protocol_Request_Header(Packet): +- name="SMBNegociate Protocol Request Header" +- fields_desc = [StrFixedLenField("Start","\xffSMB",4), +- ByteEnumField("Command",0x72,{0x72:"SMB_COM_NEGOTIATE"}), +- ByteField("Error_Class",0), +- ByteField("Reserved",0), +- LEShortField("Error_code",0), +- ByteField("Flags",0x18), +- LEShortField("Flags2",0x0000), +- LEShortField("PIDHigh",0x0000), +- LELongField("Signature",0x0), +- LEShortField("Unused",0x0), +- LEShortField("TID",0), +- LEShortField("PID",1), +- LEShortField("UID",0), +- LEShortField("MID",2), +- ByteField("WordCount",0), +- LEShortField("ByteCount",12)] +- +-# SMB Negociate Protocol Request Tail +-class SMBNegociate_Protocol_Request_Tail(Packet): +- name="SMB Negociate Protocol Request Tail" +- fields_desc=[ByteField("BufferFormat",0x02), +- StrNullField("BufferData","NT LM 0.12")] +- + # SMBNegociate Protocol Response Advanced Security + class SMBNegociate_Protocol_Response_Advanced_Security(Packet): + name="SMBNegociate Protocol Response Advanced Security" +@@ -211,8 +459,8 @@ + ByteField("EncryptionKeyLength",8), + LEShortField("ByteCount",24), + BitField("EncryptionKey",0,64), +- StrNullField("DomainName","WORKGROUP"), +- StrNullField("ServerName","RMFF1")] ++ NBTStrField("DomainName","WORKGROUP"), ++ NBTStrField("ServerName","RMFF1")] + + # SMBNegociate Protocol Response No Security No Key + class SMBNegociate_Protocol_Response_No_Security_No_Key(Packet): +@@ -290,10 +538,11 @@ + BitField("Reserved5",0,5), + LEShortField("ByteCount",35), + StrLenField("ANSIPassword", "Pass",length_from=lambda x:x.ANSIPasswordLength), +- StrNullField("Account","GUEST"), +- StrNullField("PrimaryDomain", ""), +- StrNullField("NativeOS","Windows 4.0"), +- StrNullField("NativeLanManager","Windows 4.0"), ++ StrLenField("UnicodePassword", "Pass",length_from=lambda x:x.UnicodePasswordLength), ++ NBTStrField("Account","GUEST"), ++ NBTStrField("PrimaryDomain", ""), ++ NBTStrField("NativeOS","Windows 4.0"), ++ NBTStrField("NativeLanManager","Windows 4.0"), + ByteField("WordCount2",4), + ByteEnumField("AndXCommand2",0xFF,{0xFF:"SMB_COM_NONE"}), + ByteField("Reserved6",0), +@@ -302,7 +551,7 @@ + LEShortField("PasswordLength",0x1), + LEShortField("ByteCount2",18), + ByteField("Password",0), +- StrNullField("Path","\\\\WIN2K\\IPC$"), ++ NBTStrField("Path","\\\\WIN2K\\IPC$"), + StrNullField("Service","IPC")] + + # Session Setup AndX Response +@@ -328,9 +577,9 @@ + LEShortField("AndXOffset",66), + LEShortField("Action",0), + LEShortField("ByteCount",25), +- StrNullField("NativeOS","Windows 4.0"), +- StrNullField("NativeLanManager","Windows 4.0"), +- StrNullField("PrimaryDomain",""), ++ NBTStrField("NativeOS","Windows 4.0"), ++ NBTStrField("NativeLanManager","Windows 4.0"), ++ NBTStrField("PrimaryDomain",""), + ByteField("WordCount2",3), + ByteEnumField("AndXCommand2",0xFF,{0xFF:"SMB_COM_NONE"}), + ByteField("Reserved3",0), +@@ -340,11 +589,3 @@ + StrNullField("Service","IPC"), + StrNullField("NativeFileSystem","")] + +-bind_layers( NBTSession, SMBNegociate_Protocol_Request_Header, ) +-bind_layers( NBTSession, SMBNegociate_Protocol_Response_Advanced_Security, ExtendedSecurity=1) +-bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security, ExtendedSecurity=0, EncryptionKeyLength=8) +-bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security_No_Key, ExtendedSecurity=0, EncryptionKeyLength=0) +-bind_layers( NBTSession, SMBSession_Setup_AndX_Request, ) +-bind_layers( NBTSession, SMBSession_Setup_AndX_Response, ) +-bind_layers( SMBNegociate_Protocol_Request_Header, SMBNegociate_Protocol_Request_Tail, ) +-bind_layers( SMBNegociate_Protocol_Request_Tail, SMBNegociate_Protocol_Request_Tail, ) Index: /pm/trunk/deps/scapy-patches/dns.patch =================================================================== --- /pm/trunk/deps/scapy-patches/dns.patch (revision 5525) +++ /pm/trunk/deps/scapy-patches/dns.patch (revision 5525) @@ -0,0 +1,416 @@ +diff -r 7a211173d33f scapy/layers/dns.py +--- a/scapy/layers/dns.py Mon Jan 11 17:59:00 2010 +0100 ++++ b/scapy/layers/dns.py Thu Feb 11 15:03:04 2010 +0100 +@@ -10,14 +10,23 @@ + from scapy.ansmachine import * + from scapy.layers.inet import UDP + ++def unroll(rrname): ++ ret = [] ++ splitted = rrname.split('.') ++ for i in xrange(len(splitted) - 1): ++ yield '.'.join(splitted[0:i]), '.'.join(splitted[i:]) ++ ++def convert(x): ++ x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..) ++ x = map(lambda y: chr(len(y))+y, x) ++ x = "".join(x) ++ if x[-1] != "\x00": ++ x += "\x00" ++ return x ++ + class DNSStrField(StrField): + def i2m(self, pkt, x): +- x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..) +- x = map(lambda y: chr(len(y))+y, x) +- x = "".join(x) +- if x[-1] != "\x00": +- x += "\x00" +- return x ++ return convert(x) + def getfield(self, pkt, s): + n = "" + while 1: +@@ -45,7 +54,7 @@ + x = x.payload + i += 1 + return i +- ++ + def i2m(self, pkt, x): + if x is None: + x = self._countRR(pkt) +@@ -54,10 +63,12 @@ + if x is None: + x = self._countRR(pkt) + return x +- + +-def DNSgetstr(s,p): ++ ++def DNSgetstr(s,p,off=12): + name = "" ++ rawname = "" ++ compressed = False + q = 0 + jpath = [p] + while 1: +@@ -67,26 +78,31 @@ + l = ord(s[p]) + p += 1 + if l & 0xc0: ++ if not compressed: ++ rawname += s[p-1] + s[p] ++ compressed = True + if not q: + q = p+1 + if p >= len(s): + warning("DNS incomplete jump token at (ofs=%i)" % p) + break +- p = ((l & 0x3f) << 8) + ord(s[p]) - 12 ++ p = ((l & 0x3f) << 8) + ord(s[p]) - off + if p in jpath: + warning("DNS decompression loop detected") + break + jpath.append(p) + continue + elif l > 0: ++ if not compressed: ++ rawname += s[p-1] + s[p:p+l] + name += s[p:p+l]+"." + p += l + continue + break + if q: + p = q +- return name,p +- ++ return name,p,compressed and rawname or "" ++ + + class DNSRRField(StrField): + holds_packets=1 +@@ -98,18 +114,20 @@ + if x is None: + return "" + return str(x) +- def decodeRR(self, name, s, p): ++ ++ def decodeRR(self, name, origname, s, p): + ret = s[p:p+10] + type,cls,ttl,rdlen = struct.unpack("!HHIH", ret) + p += 10 + rr = DNSRR("\x00"+ret+s[p:p+rdlen]) + if rr.type in [2, 3, 4, 5]: +- rr.rdata = DNSgetstr(s,p)[0] ++ rr.rdata,_,rr.origrdata = DNSgetstr(s,p) + del(rr.rdlen) +- ++ + p += rdlen +- ++ + rr.rrname = name ++ rr.origrrname = origname + return rr,p + def getfield(self, pkt, s): + if type(s) is tuple : +@@ -123,28 +141,28 @@ + return s,"" + while c: + c -= 1 +- name,p = DNSgetstr(s,p) +- rr,p = self.decodeRR(name, s, p) ++ name,p,origname = DNSgetstr(s,p) ++ rr,p = self.decodeRR(name, origname, s, p) + if ret is None: + ret = rr + else: + ret.add_payload(rr) ++ + if self.passon: + return (s,p),ret + else: + return s[p:],ret +- +- ++ ++ + class DNSQRField(DNSRRField): + holds_packets=1 +- def decodeRR(self, name, s, p): ++ def decodeRR(self, name, origname, s, p): + ret = s[p:p+4] + p += 4 + rr = DNSQR("\x00"+ret) + rr.qname = name + return rr,p +- +- ++ + + class RDataField(StrLenField): + def m2i(self, pkt, s): +@@ -155,7 +173,7 @@ + family = socket.AF_INET6 + elif pkt.type == 12: + s = DNSgetstr(s, 0)[0] +- if family is not None: ++ if family is not None: + s = inet_ntop(family, s) + return s + def i2m(self, pkt, s): +@@ -165,26 +183,35 @@ + elif pkt.type == 28: + if s: + s = inet_pton(socket.AF_INET6, s) +- elif pkt.type in [2,3,4,5]: +- s = "".join(map(lambda x: chr(len(x))+x, s.split("."))) +- if ord(s[-1]): +- s += "\x00" ++ elif pkt.type in [2,3,4,5,12]: ++ s = convert(s) + return s + ++ + class RDLenField(Field): + def __init__(self, name): + Field.__init__(self, name, None, "H") + def i2m(self, pkt, x): + if x is None: +- rdataf = pkt.get_field("rdata") +- x = len(rdataf.i2m(pkt, pkt.rdata)) ++ val = pkt.getfieldval('origrdata') ++ x = len(val) ++ ++ if x == 0: ++ rdataf = pkt.get_field("rdata") ++ x = len(rdataf.i2m(pkt, pkt.rdata)) ++ + return x + def i2h(self, pkt, x): + if x is None: +- rdataf = pkt.get_field("rdata") +- x = len(rdataf.i2m(pkt, pkt.rdata)) ++ val = pkt.getfieldval('origrdata') ++ x = len(val) ++ ++ if x == 0: ++ rdataf = pkt.get_field("rdata") ++ x = len(rdataf.i2m(pkt, pkt.rdata)) ++ + return x +- ++ + + class DNS(Packet): + name = "DNS" +@@ -210,7 +237,7 @@ + and self.id == other.id + and self.qr == 1 + and other.qr == 0) +- ++ + def mysummary(self): + type = ["Qry","Ans"][self.qr] + name = "" +@@ -224,24 +251,152 @@ + name = ' "%s"' % self.qd.qname + return 'DNS %s%s ' % (type, name) + ++ def do_build(self): ++ pay="" ++ cnames = {} ++ ++ def addpointer(x, pos): ++ if x in cnames: ++ return ++ ++ if x and x[-1] == '.': ++ x = x[:-1] ++ ++ for f, d in unroll(x): ++ if d not in cnames: ++ cnames[d] = pos + x.find(d) ++ ++ def getpointer(x): ++ if x[-1] == '.': ++ x = x[:-1] ++ if x in cnames: ++ return cnames[x] ++ return -1 ++ ++ for f in self.fields_desc[:13]: ++ val = self.getfieldval(f.name) ++ if isinstance(val, RawVal): ++ pay += str(val) ++ else: ++ pay = f.addfield(self, pay, val) ++ ++ for f in self.fields_desc[13:]: ++ try: ++ val = self.fields[f.name] ++ except KeyError: ++ continue ++ ++ if not val: ++ continue ++ ++ while not isinstance(val, NoPayload): ++ if isinstance(val, DNSQR): ++ addpointer(val.getfieldval('qname'), len(pay)) ++ pay += str(val) ++ elif isinstance(val, DNSRR): ++ oldpos = len(pay) ++ ++ rrname = val.getfieldval('rrname') ++ orrname = val.getfieldval('origrrname') ++ drrname = orrname and \ ++ DNSgetstr(pay + orrname, len(pay), 0)[0] or None ++ ++ if drrname == rrname: ++ pay += orrname ++ else: ++ compressed = False ++ ++ for first, domain in unroll(rrname): ++ idx = getpointer(domain) ++ ++ if idx >= 0: ++ pay += first and convert(first)[:-1] or '' ++ pay += struct.pack("!H", 0xc000 | idx) ++ compressed = True ++ break ++ ++ if not compressed: ++ pay = val.fields_desc[0].addfield(val, pay, rrname) ++ ++ addpointer(rrname, len(pay) - 1) ++ oldpos = len(pay) ++ ++ interesting = False ++ rdata = val.getfieldval('rdata') ++ ++ # First we try to compress the rdata and set origrdata field ++ if val.getfieldval('type') in [2,3,4,5,12]: ++ interesting = True ++ ++ packrdata = convert(rdata) ++ ordata = val.getfieldval('origrdata') ++ tmppay = pay + "\x00" * 10 ++ ++ drdata = ordata and \ ++ DNSgetstr(tmppay + orrname, len(tmppay), 0)[0] or None ++ ++ if drdata == rdata: ++ packrdata = ordata ++ val.setfieldval('origrdata', packrdata) ++ else: ++ compressed = False ++ ++ for first, domain in unroll(rdata): ++ idx = getpointer(domain) ++ ++ if idx >= 0: ++ packrdata = first and convert(first)[:-1] or '' ++ packrdata += struct.pack("!H", 0xc000 | idx) ++ val.setfieldval('origrdata', packrdata) ++ compressed = True ++ break ++ ++ if not compressed: ++ val.setfieldval('origrdata', packrdata) ++ ++ addpointer(rdata, oldpos + 10) ++ else: ++ val.setfieldval('origrdata', '') ++ ++ # These fields could not be compressed ++ for rrf in val.fields_desc[1:5]: ++ rrval = val.getfieldval(rrf.name) ++ ++ if isinstance(rrval, RawVal): ++ pay += str(rrval) ++ else: ++ pay = rrf.addfield(val, pay, rrval) ++ ++ if not interesting: ++ pay = val.fields_desc[5].addfield(val, pay, val.getfieldval('rdata')) ++ else: ++ pay += packrdata ++ ++ val = val.payload ++ return pay ++ + dnstypes = { 0:"ANY", 255:"ALL", + 1:"A", 2:"NS", 3:"MD", 4:"MD", 5:"CNAME", 6:"SOA", 7: "MB", 8:"MG", + 9:"MR",10:"NULL",11:"WKS",12:"PTR",13:"HINFO",14:"MINFO",15:"MX",16:"TXT", + 17:"RP",18:"AFSDB",28:"AAAA", 33:"SRV",38:"A6",39:"DNAME"} + ++ + dnsqtypes = {251:"IXFR",252:"AXFR",253:"MAILB",254:"MAILA",255:"ALL"} + dnsqtypes.update(dnstypes) + dnsclasses = {1: 'IN', 2: 'CS', 3: 'CH', 4: 'HS', 255: 'ANY'} + + ++class OriginalDataField(StrField): ++ def i2m(self, pkt, x): ++ return '' ++ + class DNSQR(Packet): + name = "DNS Question Record" + show_indent=0 + fields_desc = [ DNSStrField("qname",""), + ShortEnumField("qtype", 1, dnsqtypes), + ShortEnumField("qclass", 1, dnsclasses) ] +- +- ++ + + class DNSRR(Packet): + name = "DNS Resource Record" +@@ -251,7 +406,9 @@ + ShortEnumField("rclass", 1, dnsclasses), + IntField("ttl", 0), + RDLenField("rdlen"), +- RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen) ] ++ RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen), ++ OriginalDataField("origrdata", ""), ++ OriginalDataField("origrrname", "")] + + bind_layers( UDP, DNS, dport=53) + bind_layers( UDP, DNS, sport=53) +@@ -275,9 +432,7 @@ + return r.getlayer(DNS).rcode + else: + return -1 +- +- +- ++ + + @conf.commands.register + def dyndns_del(nameserver, name, type="ALL", ttl=10): +@@ -297,7 +452,7 @@ + return r.getlayer(DNS).rcode + else: + return -1 +- ++ + + class DNS_am(AnsweringMachine): + function_name="dns_spoof" +@@ -312,7 +467,7 @@ + + def is_request(self, req): + return req.haslayer(DNS) and req.getlayer(DNS).qr == 0 +- ++ + def make_reply(self, req): + ip = req.getlayer(IP) + dns = req.getlayer(DNS) +@@ -322,4 +477,3 @@ + an=DNSRR(rrname=dns.qd.qname, ttl=10, rdata=rdata)) + return resp + +- Index: /pm/trunk/deps/scapy-patches/ppp-datalink.patch =================================================================== --- /pm/trunk/deps/scapy-patches/ppp-datalink.patch (revision 5525) +++ /pm/trunk/deps/scapy-patches/ppp-datalink.patch (revision 5525) @@ -0,0 +1,9 @@ +diff -r 7a211173d33f scapy/layers/ppp.py +--- a/scapy/layers/ppp.py Mon Jan 11 17:59:00 2010 +0100 ++++ b/scapy/layers/ppp.py Thu Feb 11 14:05:20 2010 +0100 +@@ -339,3 +339,5 @@ + bind_layers( PPP, PPP_ECP, proto=0x8053) + bind_layers( Ether, PPP_IPCP, type=0x8021) + bind_layers( Ether, PPP_ECP, type=0x8053) ++ ++conf.l2types.register(9, PPP) Index: /trunk/deps/scapy-patches/dns-patch.diff =================================================================== --- /pm/trunk/deps/scapy-patches/dns-patch.diff (revision 5507) +++ (revision ) @@ -1,416 +1,0 @@ -diff -r f9b1019a270e scapy/layers/dns.py ---- a/scapy/layers/dns.py Mon Dec 14 16:36:32 2009 +0100 -+++ b/scapy/layers/dns.py Thu Jan 07 17:47:11 2010 +0100 -@@ -10,14 +10,23 @@ - from scapy.ansmachine import * - from scapy.layers.inet import UDP - -+def unroll(rrname): -+ ret = [] -+ splitted = rrname.split('.') -+ for i in xrange(len(splitted) - 1): -+ yield '.'.join(splitted[0:i]), '.'.join(splitted[i:]) -+ -+def convert(x): -+ x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..) -+ x = map(lambda y: chr(len(y))+y, x) -+ x = "".join(x) -+ if x[-1] != "\x00": -+ x += "\x00" -+ return x -+ - class DNSStrField(StrField): - def i2m(self, pkt, x): -- x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..) -- x = map(lambda y: chr(len(y))+y, x) -- x = "".join(x) -- if x[-1] != "\x00": -- x += "\x00" -- return x -+ return convert(x) - def getfield(self, pkt, s): - n = "" - while 1: -@@ -45,7 +54,7 @@ - x = x.payload - i += 1 - return i -- -+ - def i2m(self, pkt, x): - if x is None: - x = self._countRR(pkt) -@@ -54,10 +63,12 @@ - if x is None: - x = self._countRR(pkt) - return x -- - --def DNSgetstr(s,p): -+ -+def DNSgetstr(s,p,off=12): - name = "" -+ rawname = "" -+ compressed = False - q = 0 - jpath = [p] - while 1: -@@ -67,26 +78,31 @@ - l = ord(s[p]) - p += 1 - if l & 0xc0: -+ if not compressed: -+ rawname += s[p-1] + s[p] -+ compressed = True - if not q: - q = p+1 - if p >= len(s): - warning("DNS incomplete jump token at (ofs=%i)" % p) - break -- p = ((l & 0x3f) << 8) + ord(s[p]) - 12 -+ p = ((l & 0x3f) << 8) + ord(s[p]) - off - if p in jpath: - warning("DNS decompression loop detected") - break - jpath.append(p) - continue - elif l > 0: -+ if not compressed: -+ rawname += s[p-1] + s[p:p+l] - name += s[p:p+l]+"." - p += l - continue - break - if q: - p = q -- return name,p -- -+ return name,p,compressed and rawname or "" -+ - - class DNSRRField(StrField): - holds_packets=1 -@@ -98,18 +114,20 @@ - if x is None: - return "" - return str(x) -- def decodeRR(self, name, s, p): -+ -+ def decodeRR(self, name, origname, s, p): - ret = s[p:p+10] - type,cls,ttl,rdlen = struct.unpack("!HHIH", ret) - p += 10 - rr = DNSRR("\x00"+ret+s[p:p+rdlen]) - if rr.type in [2, 3, 4, 5]: -- rr.rdata = DNSgetstr(s,p)[0] -+ rr.rdata,_,rr.origrdata = DNSgetstr(s,p) - del(rr.rdlen) -- -+ - p += rdlen -- -+ - rr.rrname = name -+ rr.origrrname = origname - return rr,p - def getfield(self, pkt, s): - if type(s) is tuple : -@@ -123,28 +141,28 @@ - return s,"" - while c: - c -= 1 -- name,p = DNSgetstr(s,p) -- rr,p = self.decodeRR(name, s, p) -+ name,p,origname = DNSgetstr(s,p) -+ rr,p = self.decodeRR(name, origname, s, p) - if ret is None: - ret = rr - else: - ret.add_payload(rr) -+ - if self.passon: - return (s,p),ret - else: - return s[p:],ret -- -- -+ -+ - class DNSQRField(DNSRRField): - holds_packets=1 -- def decodeRR(self, name, s, p): -+ def decodeRR(self, name, origname, s, p): - ret = s[p:p+4] - p += 4 - rr = DNSQR("\x00"+ret) - rr.qname = name - return rr,p -- -- -+ - - class RDataField(StrLenField): - def m2i(self, pkt, s): -@@ -155,7 +173,7 @@ - family = socket.AF_INET6 - elif pkt.type == 12: - s = DNSgetstr(s, 0)[0] -- if family is not None: -+ if family is not None: - s = inet_ntop(family, s) - return s - def i2m(self, pkt, s): -@@ -165,26 +183,35 @@ - elif pkt.type == 28: - if s: - s = inet_pton(socket.AF_INET6, s) -- elif pkt.type in [2,3,4,5]: -- s = "".join(map(lambda x: chr(len(x))+x, s.split("."))) -- if ord(s[-1]): -- s += "\x00" -+ elif pkt.type in [2,3,4,5,12]: -+ s = convert(s) - return s - -+ - class RDLenField(Field): - def __init__(self, name): - Field.__init__(self, name, None, "H") - def i2m(self, pkt, x): - if x is None: -- rdataf = pkt.get_field("rdata") -- x = len(rdataf.i2m(pkt, pkt.rdata)) -+ val = pkt.getfieldval('origrdata') -+ x = len(val) -+ -+ if x == 0: -+ rdataf = pkt.get_field("rdata") -+ x = len(rdataf.i2m(pkt, pkt.rdata)) -+ - return x - def i2h(self, pkt, x): - if x is None: -- rdataf = pkt.get_field("rdata") -- x = len(rdataf.i2m(pkt, pkt.rdata)) -+ val = pkt.getfieldval('origrdata') -+ x = len(val) -+ -+ if x == 0: -+ rdataf = pkt.get_field("rdata") -+ x = len(rdataf.i2m(pkt, pkt.rdata)) -+ - return x -- -+ - - class DNS(Packet): - name = "DNS" -@@ -210,7 +237,7 @@ - and self.id == other.id - and self.qr == 1 - and other.qr == 0) -- -+ - def mysummary(self): - type = ["Qry","Ans"][self.qr] - name = "" -@@ -224,24 +251,152 @@ - name = ' "%s"' % self.qd.qname - return 'DNS %s%s ' % (type, name) - -+ def do_build(self): -+ pay="" -+ cnames = {} -+ -+ def addpointer(x, pos): -+ if x in cnames: -+ return -+ -+ if x and x[-1] == '.': -+ x = x[:-1] -+ -+ for f, d in unroll(x): -+ if d not in cnames: -+ cnames[d] = pos + x.find(d) -+ -+ def getpointer(x): -+ if x[-1] == '.': -+ x = x[:-1] -+ if x in cnames: -+ return cnames[x] -+ return -1 -+ -+ for f in self.fields_desc[:13]: -+ val = self.getfieldval(f.name) -+ if isinstance(val, RawVal): -+ pay += str(val) -+ else: -+ pay = f.addfield(self, pay, val) -+ -+ for f in self.fields_desc[13:]: -+ try: -+ val = self.fields[f.name] -+ except KeyError: -+ continue -+ -+ if not val: -+ continue -+ -+ while not isinstance(val, NoPayload): -+ if isinstance(val, DNSQR): -+ addpointer(val.getfieldval('qname'), len(pay)) -+ pay += str(val) -+ elif isinstance(val, DNSRR): -+ oldpos = len(pay) -+ -+ rrname = val.getfieldval('rrname') -+ orrname = val.getfieldval('origrrname') -+ drrname = orrname and \ -+ DNSgetstr(pay + orrname, len(pay), 0)[0] or None -+ -+ if drrname == rrname: -+ pay += orrname -+ else: -+ compressed = False -+ -+ for first, domain in unroll(rrname): -+ idx = getpointer(domain) -+ -+ if idx >= 0: -+ pay += first and convert(first)[:-1] or '' -+ pay += struct.pack("!H", 0xc000 | idx) -+ compressed = True -+ break -+ -+ if not compressed: -+ pay = val.fields_desc[0].addfield(val, pay, rrname) -+ -+ addpointer(rrname, len(pay) - 1) -+ oldpos = len(pay) -+ -+ interesting = False -+ rdata = val.getfieldval('rdata') -+ -+ # First we try to compress the rdata and set origrdata field -+ if val.getfieldval('type') in [2,3,4,5,12]: -+ interesting = True -+ -+ packrdata = convert(rdata) -+ ordata = val.getfieldval('origrdata') -+ tmppay = pay + "\x00" * 10 -+ -+ drdata = ordata and \ -+ DNSgetstr(tmppay + orrname, len(tmppay), 0)[0] or None -+ -+ if drdata == rdata: -+ packrdata = ordata -+ val.setfieldval('origrdata', packrdata) -+ else: -+ compressed = False -+ -+ for first, domain in unroll(rdata): -+ idx = getpointer(domain) -+ -+ if idx >= 0: -+ packrdata = first and convert(first)[:-1] or '' -+ packrdata += struct.pack("!H", 0xc000 | idx) -+ val.setfieldval('origrdata', packrdata) -+ compressed = True -+ break -+ -+ if not compressed: -+ val.setfieldval('origrdata', packrdata) -+ -+ addpointer(rdata, oldpos + 10) -+ else: -+ val.setfieldval('origrdata', '') -+ -+ # These fields could not be compressed -+ for rrf in val.fields_desc[1:5]: -+ rrval = val.getfieldval(rrf.name) -+ -+ if isinstance(rrval, RawVal): -+ pay += str(rrval) -+ else: -+ pay = rrf.addfield(val, pay, rrval) -+ -+ if not interesting: -+ pay = val.fields_desc[5].addfield(val, pay, val.getfieldval('rdata')) -+ else: -+ pay += packrdata -+ -+ val = val.payload -+ return pay -+ - dnstypes = { 0:"ANY", 255:"ALL", - 1:"A", 2:"NS", 3:"MD", 4:"MD", 5:"CNAME", 6:"SOA", 7: "MB", 8:"MG", - 9:"MR",10:"NULL",11:"WKS",12:"PTR",13:"HINFO",14:"MINFO",15:"MX",16:"TXT", - 17:"RP",18:"AFSDB",28:"AAAA", 33:"SRV",38:"A6",39:"DNAME"} - -+ - dnsqtypes = {251:"IXFR",252:"AXFR",253:"MAILB",254:"MAILA",255:"ALL"} - dnsqtypes.update(dnstypes) - dnsclasses = {1: 'IN', 2: 'CS', 3: 'CH', 4: 'HS', 255: 'ANY'} - - -+class OriginalDataField(StrField): -+ def i2m(self, pkt, x): -+ return '' -+ - class DNSQR(Packet): - name = "DNS Question Record" - show_indent=0 - fields_desc = [ DNSStrField("qname",""), - ShortEnumField("qtype", 1, dnsqtypes), - ShortEnumField("qclass", 1, dnsclasses) ] -- -- -+ - - class DNSRR(Packet): - name = "DNS Resource Record" -@@ -251,7 +406,9 @@ - ShortEnumField("rclass", 1, dnsclasses), - IntField("ttl", 0), - RDLenField("rdlen"), -- RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen) ] -+ RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen), -+ OriginalDataField("origrdata", ""), -+ OriginalDataField("origrrname", "")] - - bind_layers( UDP, DNS, dport=53) - bind_layers( UDP, DNS, sport=53) -@@ -275,9 +432,7 @@ - return r.getlayer(DNS).rcode - else: - return -1 -- -- -- -+ - - @conf.commands.register - def dyndns_del(nameserver, name, type="ALL", ttl=10): -@@ -297,7 +452,7 @@ - return r.getlayer(DNS).rcode - else: - return -1 -- -+ - - class DNS_am(AnsweringMachine): - function_name="dns_spoof" -@@ -312,7 +467,7 @@ - - def is_request(self, req): - return req.haslayer(DNS) and req.getlayer(DNS).qr == 0 -- -+ - def make_reply(self, req): - ip = req.getlayer(IP) - dns = req.getlayer(DNS) -@@ -322,4 +477,3 @@ - an=DNSRR(rrname=dns.qd.qname, ttl=10, rdata=rdata)) - return resp - -- Index: /trunk/deps/scapy-patches/smb-fixes.patch =================================================================== --- /pm/trunk/deps/scapy-patches/smb-fixes.patch (revision 5507) +++ (revision ) @@ -1,437 +1,0 @@ -diff -r 7a211173d33f scapy/fields.py ---- a/scapy/fields.py Mon Jan 11 17:59:00 2010 +0100 -+++ b/scapy/fields.py Fri Jan 29 13:54:42 2010 +0100 -@@ -271,7 +271,7 @@ - - class ShortField(Field): - def __init__(self, name, default): -- Field.__init__(self, name, default, "H") -+ Field.__init__(self, name, default, "!H") - - class LEShortField(Field): - def __init__(self, name, default): -@@ -478,8 +478,8 @@ - return rr - - class NetBIOSNameField(StrFixedLenField): -- def __init__(self, name, default, length=31): -- StrFixedLenField.__init__(self, name, default, length) -+ def __init__(self, name, default, length=31, length_from=None): -+ StrFixedLenField.__init__(self, name, default, length, length_from=length_from) - def i2m(self, pkt, x): - l = self.length_from(pkt)/2 - if x is None: -@@ -491,6 +491,7 @@ - return x - def m2i(self, pkt, x): - x = x.strip("\x00").strip(" ") -+ if len(x) % 2 != 0: x+='A' - return "".join(map(lambda x,y: chr((((ord(x)-1)&0xf)<<4)+((ord(y)-1)&0xf)), x[::2],x[1::2])) - - class StrLenField(StrField): -@@ -585,6 +586,27 @@ - def randval(self): - return RandTermString(RandNum(0,1200),"\x00") - -+class NBTStrField(StrField): -+ def addfield(self, pkt, s, val): -+ return s+self.i2m(pkt, val) -+ def getfield(self, pkt, s): -+ l = s.find("\x00\x00") -+ if l < 0: -+ return "",s -+ if l > 0 and l + 2 < len(s) and s[l+2] == "\x00": -+ l += 1 -+ return s[l+2:],self.m2i(pkt, s[:l+2]) -+ def i2m(self, pkt, s): -+ if s.endswith("\x00\x00"): -+ s = s[:-1] -+ else: -+ s += "\x00" -+ return ''.join(map(lambda x: x + "\x00", list(s))) -+ def m2i(self, pkt, s): -+ return s.replace('\x00', '').strip(" ") -+ def randval(self): -+ return RandTermString(RandNum(0,1200), "\x00") -+ - class StrStopField(StrField): - def __init__(self, name, default, stop, additionnal=0): - Field.__init__(self, name, default) -diff -r 7a211173d33f scapy/layers/netbios.py ---- a/scapy/layers/netbios.py Mon Jan 11 17:59:00 2010 +0100 -+++ b/scapy/layers/netbios.py Fri Jan 29 13:54:42 2010 +0100 -@@ -199,8 +199,22 @@ - class NBTSession(Packet): - name="NBT Session Packet" - fields_desc= [ByteEnumField("TYPE",0,{0x00:"Session Message",0x81:"Session Request",0x82:"Positive Session Response",0x83:"Negative Session Response",0x84:"Retarget Session Response",0x85:"Session Keepalive"}), -- BitField("RESERVED",0x00,7), -- BitField("LENGTH",0,17)] -+ #BitField("RESERVED",0x00,7), -+ #BitField("LENGTH",0,17), -+ ByteField("RESERVED", 0), -+ ShortField("LENGTH",None), -+ ConditionalField(NetBIOSNameField("CALLEDNAME", "", None, length_from = lambda pkt:pkt.LENGTH/2), lambda pkt:pkt.TYPE==0x81), -+ ConditionalField(NetBIOSNameField("CALLINGNAME", "", None, length_from = lambda pkt:pkt.LENGTH/2), lambda pkt:pkt.TYPE==0x81), -+ ConditionalField(ByteField("ERRORCODE", 0), lambda pkt:pkt.TYPE==0x83), -+ ] -+ -+ def post_build(self, p, pay): -+ if self.LENGTH is None: -+ l = len(pay) -+ if l > 65535: -+ self.RESERVED |= 1 # Extended flag -+ p = p[:1] + struct.pack("B", self.RESERVED) + struct.pack("!H",len(pay)) + p[4:] -+ return p+pay - - bind_layers( UDP, NBNSQueryRequest, dport=137) - bind_layers( UDP, NBNSRequest, dport=137) -@@ -214,3 +228,6 @@ - bind_layers( UDP, NBNSWackResponse, sport=137) - bind_layers( UDP, NBTDatagram, dport=138) - bind_layers( TCP, NBTSession, dport=139) -+bind_layers( TCP, NBTSession, sport=139) -+bind_layers( TCP, NBTSession, dport=445) -+bind_layers( TCP, NBTSession, sport=445) -diff -r 7a211173d33f scapy/layers/smb.py ---- a/scapy/layers/smb.py Mon Jan 11 17:59:00 2010 +0100 -+++ b/scapy/layers/smb.py Fri Jan 29 13:54:42 2010 +0100 -@@ -7,6 +7,245 @@ - from scapy.fields import * - from scapy.layers.netbios import NBTSession - -+BINDER = {} -+ -+################################################################################ -+# SMB Header -+################################################################################ -+ -+class SMBHeader(Packet): -+ name="SMB Protocol Header" -+ fields_desc = [StrFixedLenField("Start","\xffSMB",4), -+ ByteEnumField("Command",0x72,{0x72:"SMB_COM_NEGOTIATE"}), -+ ByteField("Error_Class",0x02), -+ ByteField("Reserved",0), -+ LEShortField("Error_Code",4), -+ ByteField("Flags",0), -+ LEShortField("Flags2",0x0000), -+ LEShortField("PIDHigh",0x0000), -+ LELongField("Signature",0x0), -+ LEShortField("Unused",0x0), -+ LEShortField("TID",0), -+ LEShortField("PID",0), -+ LEShortField("UID",0), -+ LEShortField("MID",0)] -+ -+ def guess_payload_class(self, payload): -+ index = self.Flags & 128 != 0 and 1 or 0 -+ secure = self.Flags2 & 2048 != 0 and 1 or 0 -+ protos = BINDER.get(self.Command, None) -+ -+ if isinstance(protos, tuple): -+ if isinstance(protos[index], tuple): -+ return protos[index][secure] -+ return protos[index] -+ -+ return Packet.guess_payload_class(self, payload) -+ -+bind_layers(NBTSession, SMBHeader, TYPE=0) -+ -+################################################################################ -+# (0x32) SMB Setup AndX -+################################################################################ -+ -+class SMBSetup_AndX_Response(Packet): -+ name="Session Setup AndX Response" -+ fields_desc=[ByteField("WordCount",0), -+ LEShortField("TotalParameterCount",0), -+ LEShortField("TotalDataCount",0), -+ LEShortField("MaxParameterCount",0), -+ LEShortField("MaxDataCount",0), -+ LEShortField("MaxSetupCount",0), -+ ByteField("Reserved",0), -+ LEShortField("Flags",0), -+ LELongField("Timeout",0), -+ LEShortField("Reserved",0), -+ LEShortField("ParameterCount",0), -+ LEShortField("ParameterOffset",0), -+ LEShortField("DataCount",0), -+ LEShortField("DataOffset",0), -+ ByteField("SetupCount",0), -+ ByteField("Reserved",0), -+ LEShortField("SubCommand",0), -+ LEShortField("ByteCount",0), -+ ] -+ -+ -+################################################################################ -+# (0x73) SMB Setup AndX -+################################################################################ -+ -+class SMBSetup_AndX_Response(Packet): -+ name="Session Setup AndX Response" -+ fields_desc=[ByteField("WordCount",0), -+ LEShortField("ByteCount",0)] -+ -+ def guess_payload_class(self, payload): -+ if self.ByteCount > 0: -+ return SMBDialect -+ return Packet.guess_payload_class(self, payload) -+ -+class SMBSetup_AndX_Request(Packet): -+ name="Session Setup AndX Request" -+ fields_desc=[ByteField("WordCount",13), -+ ByteEnumField("AndXCommand",0x75,{0x75:"SMB_COM_TREE_CONNECT_ANDX"}), -+ ByteField("Reserved",0), -+ LEShortField("AndXOffset",96), -+ LEShortField("MaxBuffer",2920), -+ LEShortField("MaxMPXCount",50), -+ LEShortField("VCNumber",0), -+ LEIntField("SessionKey",0), -+ LEFieldLenField("ANSIPasswordLength",None,"ANSIPassword"), -+ LEFieldLenField("UnicodePasswordLength",None,"UnicodePassword"), -+ LEIntField("Reserved2",0), -+ LEShortField("Capabilities",0x05), -+ BitField("UnixExtensions",0,1), -+ BitField("Reserved3",0,7), -+ BitField("ExtendedSecurity",0,1), -+ BitField("CompBulk",0,2), -+ BitField("Reserved5",0,5), -+ LEShortField("ByteCount",35), -+ StrLenField("ANSIPassword", "Pass",length_from=lambda x:x.ANSIPasswordLength), -+ StrLenField("UnicodePassword", "Pass",length_from=lambda x:x.UnicodePasswordLength), -+ NBTStrField("Account","GUEST"), -+ NBTStrField("PrimaryDomain", ""), -+ NBTStrField("NativeOS","Windows 4.0"), -+ NBTStrField("NativeLanManager","Windows 4.0"), -+ StrLenField("ExtraBytes", "", length_from=lambda x:(x.ByteCount - x.ANSIPasswordLength - x.UnicodePasswordLength - (len(x.Account) + len(x.PrimaryDomain) + len(x.NativeOS) + len(x.NativeLanManager) + 4) * 2 + 1) / 2)] -+ -+ def guess_payload_class(self, payload): -+ protos = BINDER.get(self.AndXCommand, None) -+ if protos: -+ return protos[0] -+ return Packet.guess_payload_class(self, payload) -+ -+class SMBSetup_AndX_Response_Advanced_Security(Packet): -+ name="SMBNegociate Protocol Response Advanced Security" -+ fields_desc = [ByteField("WordCount",4), -+ ByteEnumField("AndXCommand",0x75,{0x75:"SMB_COM_TREE_CONNECT_ANDX"}), -+ ByteField("Reserved",0), -+ ShortField("AndXOffset",0), -+ ByteField("Action",0), -+ ShortField("SecurityBlobLength",0), -+ ShortField("ByteCount",0), -+ StrLenField("SecurityBlob", "", length_from=lambda x:x.SecurityBlobLength), -+ NBTStrField("NativeOS","Windows 4.0"), -+ NBTStrField("NativeLanManager","Windows 4.0")] -+ -+BINDER[0x73] = (SMBSetup_AndX_Request, (SMBSetup_AndX_Response, SMBSetup_AndX_Response_Advanced_Security)) -+ -+################################################################################ -+# (0x80) Query Information Disk -+################################################################################ -+ -+class SMBQueryInformationDisk_Request(Packet): -+ name="SMB Query Information Disk" -+ fields_desc=[ByteField("WordCount", 0), -+ LEShortField("ByteCount",0)] -+ -+class SMBQueryInformationDisk_Response(Packet): -+ name="SMB Query Information Disk" -+ fields_desc=[ByteField("WordCount", 0), -+ LEShortField("TotalUnits", 0), -+ LEShortField("BlocksPerUnit", 0), -+ LEShortField("BlockSize", 0), -+ LEShortField("FreeUnits", 0), -+ LEShortField("Reserved", 0), -+ LEShortField("ByteCount",0)] -+ -+BINDER[0x80] = (SMBQueryInformationDisk_Request, SMBQueryInformationDisk_Response) -+ -+################################################################################ -+# (0x75) SMB Tree Connect AndX -+################################################################################ -+ -+class SMBTree_Connect_AndX_Request(Packet): -+ name="Session Tree Connect AndX Request" -+ fields_desc=[ByteField("WordCount",4), -+ ByteEnumField("AndXCommand",0xFF,{0xFF:"SMB_COM_NONE"}), -+ ByteField("Reserved",0), -+ LEShortField("AndXOffset",0), -+ LEShortField("Flags",0x2), -+ LEShortField("PasswordLength",0x1), -+ LEShortField("ByteCount",18), -+ ByteField("Password",0), -+ NBTStrField("Path","\\\\WIN2K\\IPC$"), -+ StrNullField("Service","IPC")] -+ -+class SMBTree_Connect_AndX_Response(Packet): -+ name="Session Tree Connect AndX Response" -+ fields_desc=[ByteField("WordCount",3), -+ ByteEnumField("AndXCommand",0xFF,{0xFF:"SMB_COM_NONE"}), -+ ByteField("Reserved",0), -+ LEShortField("AndXOffset",80), -+ LEShortField("OptionalSupport",0x01), -+ LEShortField("ByteCount",5), -+ StrNullField("Service","IPC"), -+ NBTStrField("NativeFileSystem","")] -+ -+BINDER[0x75] = (SMBTree_Connect_AndX_Request, SMBTree_Connect_AndX_Response) -+ -+################################################################################ -+# (0x72) SMB Negociate -+################################################################################ -+ -+class SMBDialect(Packet): -+ name="SMB Negociate Protocol Request Tail" -+ fields_desc=[ByteField("BufferFormat",0x02), -+ StrNullField("BufferData","NT LM 0.12")] -+ -+bind_layers(SMBDialect, SMBDialect) -+ -+class SMBNegociate_Response(Packet): -+ name="SMB Negociate Protocol Response" -+ fields_desc=[ByteField("WordCount",17), -+ LEShortField("DialectIndex",7), -+ ByteField("SecurityMode",0x03), -+ LEShortField("MaxMpxCount",50), -+ LEShortField("MaxNumberVC",1), -+ LEIntField("MaxBufferSize",16144), -+ LEIntField("MaxRawSize",65536), -+ LEIntField("SessionKey",0x0000), -+ LEShortField("ServerCapabilities",0xf3f9), -+ BitField("UnixExtensions",0,1), -+ BitField("Reserved2",0,7), -+ BitField("ExtendedSecurity",0,1), -+ FlagsField("CompBulk",0,2,"CB"), -+ BitField("Reserved3",0,5), -+ # There have been 127490112000000000 tenths of micro-seconds between 1st january 1601 and 1st january 2005. 127490112000000000=0x1C4EF94D6228000, so ServerTimeHigh=0xD6228000 and ServerTimeLow=0x1C4EF94. -+ LEIntField("ServerTimeHigh",0xD6228000L), -+ LEIntField("ServerTimeLow",0x1C4EF94), -+ LEShortField("ServerTimeZone",0x3c), -+ ByteField("EncryptionKeyLength",8), -+ LEShortField("ByteCount",24), -+ BitField("EncryptionKey",0,64), -+ NBTStrField("DomainName","WORKGROUP"), -+ NBTStrField("ServerName","RMFF1")] -+ -+class SMBNegociate_Response_Advanced_Security(Packet): -+ name="SMB Negociate Protocol Response" -+ fields_desc = [ByteField("WordCount",17), -+ LEShortField("DialectIndex",10), -+ ByteField("SecurityMode",0x03), -+ LEShortField("MaxMpxCount",50), -+ LEShortField("MaxNumberVC",1), -+ LEIntField("MaxBufferSize",16144), -+ LEIntField("MaxRawSize",65536), -+ LEIntField("SessionKey",0x0000), -+ LEIntField("ServerCapabilities",0xf3f9), -+ LEIntField("ServerTimeHigh",0xD6228000L), -+ LEIntField("ServerTimeLow",0x1C4EF94), -+ LEShortField("ServerTimeZone",0x3c), -+ ByteField("EncryptionKeyLength",0), -+ LEFieldLenField("ByteCount", None, "SecurityBlob", adjust=lambda pkt,x:x-16), -+ BitField("GUID",0,128), -+ StrLenField("SecurityBlob", "", length_from=lambda x:x.ByteCount+16)] -+ -+BINDER[0x72] = (SMBDialect, (SMBNegociate_Response, SMBNegociate_Response_Advanced_Security)) -+ -+################################################################################## -+# END HERE -+################################################################################## - - # SMB NetLogon Response Header - class SMBNetlogon_Protocol_Response_Header(Packet): -@@ -106,32 +345,6 @@ - StrNullField("ServerName","WIN"), - LEShortField("LM20Token", 0xffff)] - --# SMBNegociate Protocol Request Header --class SMBNegociate_Protocol_Request_Header(Packet): -- name="SMBNegociate Protocol Request Header" -- fields_desc = [StrFixedLenField("Start","\xffSMB",4), -- ByteEnumField("Command",0x72,{0x72:"SMB_COM_NEGOTIATE"}), -- ByteField("Error_Class",0), -- ByteField("Reserved",0), -- LEShortField("Error_code",0), -- ByteField("Flags",0x18), -- LEShortField("Flags2",0x0000), -- LEShortField("PIDHigh",0x0000), -- LELongField("Signature",0x0), -- LEShortField("Unused",0x0), -- LEShortField("TID",0), -- LEShortField("PID",1), -- LEShortField("UID",0), -- LEShortField("MID",2), -- ByteField("WordCount",0), -- LEShortField("ByteCount",12)] -- --# SMB Negociate Protocol Request Tail --class SMBNegociate_Protocol_Request_Tail(Packet): -- name="SMB Negociate Protocol Request Tail" -- fields_desc=[ByteField("BufferFormat",0x02), -- StrNullField("BufferData","NT LM 0.12")] -- - # SMBNegociate Protocol Response Advanced Security - class SMBNegociate_Protocol_Response_Advanced_Security(Packet): - name="SMBNegociate Protocol Response Advanced Security" -@@ -211,8 +424,8 @@ - ByteField("EncryptionKeyLength",8), - LEShortField("ByteCount",24), - BitField("EncryptionKey",0,64), -- StrNullField("DomainName","WORKGROUP"), -- StrNullField("ServerName","RMFF1")] -+ NBTStrField("DomainName","WORKGROUP"), -+ NBTStrField("ServerName","RMFF1")] - - # SMBNegociate Protocol Response No Security No Key - class SMBNegociate_Protocol_Response_No_Security_No_Key(Packet): -@@ -290,10 +503,11 @@ - BitField("Reserved5",0,5), - LEShortField("ByteCount",35), - StrLenField("ANSIPassword", "Pass",length_from=lambda x:x.ANSIPasswordLength), -- StrNullField("Account","GUEST"), -- StrNullField("PrimaryDomain", ""), -- StrNullField("NativeOS","Windows 4.0"), -- StrNullField("NativeLanManager","Windows 4.0"), -+ StrLenField("UnicodePassword", "Pass",length_from=lambda x:x.UnicodePasswordLength), -+ NBTStrField("Account","GUEST"), -+ NBTStrField("PrimaryDomain", ""), -+ NBTStrField("NativeOS","Windows 4.0"), -+ NBTStrField("NativeLanManager","Windows 4.0"), - ByteField("WordCount2",4), - ByteEnumField("AndXCommand2",0xFF,{0xFF:"SMB_COM_NONE"}), - ByteField("Reserved6",0), -@@ -302,7 +516,7 @@ - LEShortField("PasswordLength",0x1), - LEShortField("ByteCount2",18), - ByteField("Password",0), -- StrNullField("Path","\\\\WIN2K\\IPC$"), -+ NBTStrField("Path","\\\\WIN2K\\IPC$"), - StrNullField("Service","IPC")] - - # Session Setup AndX Response -@@ -328,9 +542,9 @@ - LEShortField("AndXOffset",66), - LEShortField("Action",0), - LEShortField("ByteCount",25), -- StrNullField("NativeOS","Windows 4.0"), -- StrNullField("NativeLanManager","Windows 4.0"), -- StrNullField("PrimaryDomain",""), -+ NBTStrField("NativeOS","Windows 4.0"), -+ NBTStrField("NativeLanManager","Windows 4.0"), -+ NBTStrField("PrimaryDomain",""), - ByteField("WordCount2",3), - ByteEnumField("AndXCommand2",0xFF,{0xFF:"SMB_COM_NONE"}), - ByteField("Reserved3",0), -@@ -340,11 +554,3 @@ - StrNullField("Service","IPC"), - StrNullField("NativeFileSystem","")] - --bind_layers( NBTSession, SMBNegociate_Protocol_Request_Header, ) --bind_layers( NBTSession, SMBNegociate_Protocol_Response_Advanced_Security, ExtendedSecurity=1) --bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security, ExtendedSecurity=0, EncryptionKeyLength=8) --bind_layers( NBTSession, SMBNegociate_Protocol_Response_No_Security_No_Key, ExtendedSecurity=0, EncryptionKeyLength=0) --bind_layers( NBTSession, SMBSession_Setup_AndX_Request, ) --bind_layers( NBTSession, SMBSession_Setup_AndX_Response, ) --bind_layers( SMBNegociate_Protocol_Request_Header, SMBNegociate_Protocol_Request_Tail, ) --bind_layers( SMBNegociate_Protocol_Request_Tail, SMBNegociate_Protocol_Request_Tail, )