PacketListField重复块中的长度

时间:2018-10-31 18:13:18

标签: python scapy

作为我的第一个涉及Scapy库的大型项目,我正在尝试实现HEP3 / EEP3协议解剖器(specs)。我正在努力理解如何分解这些块(一个HEP3数据包中可能有很多)。我从文档和Google搜索中获得了应该为此使用PacketListField的信息,但我没有获得如何获取块的长度以使scapy解析所有块的方法。这是我到目前为止的代码:

   select I.*
    INTO #tmpInvs
    FROM OPENJSON(@identObj)
    WITH (
        invs NVARCHAR(MAX) AS JSON
    ) AS caseIdentInvs
    CROSS APPLY OPENJSON (caseIdentInvs.invs)
    WITH (
        userId INT,
        invTypeCd CHAR(5),
        importId INT,
        seqId INT
    ) I;
    IF EXISTS (SELECT i.seqId FROM #tmpInvs i WHERE i.seqId != NULL)
    WITH cte AS
    (
        SELECT i.*,ci.case_ident_id AS case_ident_id, ki.inv_type_name AS inv_type_name
        FROM #tmpInvs i
        INNER JOIN case_idents ci ON i.importId=ci.import_id
        INNER JOIN kdd_inv_type ki ON i.invTypeCd=ki.inv_type_cd
    )
    UPDATE T
    SET
        inv_id = ct.userId,
        inv_type_cd = ct.invTypeCd,
        inv_type_name = ct.inv_type_name
    FROM case_ident_to_inv T
    INNER JOIN cte AS ct ON ct.case_ident_id = T.case_ident_id

    WHERE seq_id = ct.seqId

    ELSE

    INSERT INTO case_ident_to_inv(inv_id, case_ident_id, inv_type_cd, inv_type_name)
    SELECT userId, case_ident_id, invTypeCd, inv_type_name
    FROM cte

到目前为止(硬编码的7个字节的长度)的结果是:

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import scapy.all as sa


HEP_CHUNK_HEADER = 6


class HEP3Chunk(sa.Packet):
    name = "HEP3Chunk"
    fields_desc = [
        sa.ShortField("chunk_vendor_id", 0),
        sa.ShortField("chunk_type_id", 0),
        sa.ShortField("chunk_length", 0),
        sa.StrLenField("chunk_val", None, length_from=lambda pkt: pkt.chunk1_length - HEP_CHUNK_HEADER),
    ]
    def extract_padding(self, s):
        return "", s

class HEP3(sa.Packet):
    name = "HEP3"
    fields_desc = [
        sa.StrFixedLenField("hep_proto_id", "HEP3", 4),
        sa.ShortField("total_length", 0),
        #sa.FieldLenField("flf", None, length_of="hep_chunk"),
        sa.PacketListField("chunks", None, HEP3Chunk, count_from=lambda pkt: None, length_from=lambda pkt: None),
    ]

能否请您给我一个提示,说明如何处理块的长度,以读取和分解所有块?

谢谢。

1 个答案:

答案 0 :(得分:0)

以下是一些提示

  • 如果不使用length_fromcount_from函数,请不要指定它们。
  • 您在HEP3Chunk中所做的事情很好,您甚至获得了extract_padding的权利,每个人都忘记了
  • 对于HEP3,您可以设置length_from=lambda pkt: pkt.total_length-6(我不计算评论字段)