a
    kÄ#d¬  ã                   @   s2  d Z ddlmZmZmZmZmZmZmZm	Z	m
Z
 ddlmZmZ ddlmZ ddlmZ G dd„ deƒZG dd	„ d	eƒZG d
d„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZeeedd� eeedd� eeeddd� eeedd� eeeddd� eeedd� eeeddd� eeedd� dS )z8
Sebek: kernel module for data collection on honeypots.
é    )	ÚFieldLenFieldÚIPFieldÚIntFieldÚShortEnumFieldÚ
ShortFieldÚStrFixedLenFieldÚStrLenFieldÚ	XIntFieldÚByteEnumField)ÚPacketÚbind_layers)ÚUDP)Ú	IP_PROTOSc                
   @   sX   e Zd ZdZeddƒeddƒedddddd	d
œƒeddƒeddƒeddƒgZdd„ Z	dS )Ú	SebekHeadzSebek headerÚmagiciÐÐÐ Úversioné   Útyper   é   é   )ÚreadÚwriteÚsocketÚopenÚcounterZtime_secZ	time_usecc                 C   s
   |   d¡S )Nz2Sebek Header v%SebekHead.version% %SebekHead.type%)Úsprintf©Úself© r   úJ/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/contrib/sebek.pyÚ	mysummary!   s    zSebekHead.mysummaryN)
Ú__name__Ú
__module__Ú__qualname__Únamer	   r   r   r   Úfields_descr    r   r   r   r   r      s   
ÿúr   c                
   @   s\   e Zd ZdZeddƒeddƒeddƒedddƒed	d
ddd�edddd„ d�gZdd„ Z	d
S )ÚSebekV1zSebek v1Úpidr   ÚuidÚfdÚcmdÚ é   Údata_lengthNÚdataÚI©Úfmtc                 C   s   | j S ©N©r-   ©Úxr   r   r   Ú<lambda>/   ó    zSebekV1.<lambda>©Zlength_fromc                 C   s&   t | jtƒr| j d¡S |  d¡S d S )Nz)Sebek v1 %SebekHead.type% (%SebekV1.cmd%)zSebek v1 (%SebekV1.cmd%)©Ú
isinstanceZ
underlayerr   r   r   r   r   r   r    1   s    zSebekV1.mysummary©
r!   r"   r#   r$   r   r   r   r   r%   r    r   r   r   r   r&   (   s   
ûr&   c                   @   sl   e Zd ZdZeddƒeddƒeddƒeddƒeddƒedd	d
ƒeddddd�edd	dd„ d�gZdd„ Z	dS )ÚSebekV3zSebek v3Ú
parent_pidr   r'   r(   r)   Úinoder*   r+   r,   r-   Nr.   r/   r0   c                 C   s   | j S r2   r3   r4   r   r   r   r6   A   r7   zSebekV3.<lambda>r8   c                 C   s&   t | jtƒr| j d¡S |  d¡S d S )Nz;Sebek v%SebekHead.version% %SebekHead.type% (%SebekV3.cmd%)zSebek v3 (%SebekV3.cmd%)r9   r   r   r   r   r    C   s    zSebekV3.mysummaryr;   r   r   r   r   r<   8   s   
ù	r<   c                   @   s   e Zd Zdd„ ZdS )ÚSebekV2c                 C   s&   t | jtƒr| j d¡S |  d¡S d S )Nz;Sebek v%SebekHead.version% %SebekHead.type% (%SebekV2.cmd%)zSebek v2 (%SebekV2.cmd%)r9   r   r   r   r   r    K   s    zSebekV2.mysummaryN©r!   r"   r#   r    r   r   r   r   r?   J   s   r?   c                   @   sœ   e Zd ZdZeddƒeddƒeddƒeddƒeddƒedd	d
ƒeddƒeddƒeddƒeddƒeddƒedddddddddd
dœƒe	dde
ƒgZdd„ ZdS )ÚSebekV3SockzSebek v2 socketr=   r   r'   r(   r)   r>   r*   r+   r,   r-   é   Zdipz	127.0.0.1ÚdportÚsipÚsportÚcallr   r   é   é   é   é   é   )ÚbindÚconnectÚlistenÚacceptÚsendmsgÚrecvmsgÚsendtoÚrecvfromÚprotoc                 C   s&   t | jtƒr| j d¡S |  d¡S d S )Nz?Sebek v%SebekHead.version% %SebekHead.type% (%SebekV3Sock.cmd%)z#Sebek v3 socket (%SebekV3Sock.cmd%)r9   r   r   r   r   r    f   s    zSebekV3Sock.mysummaryN)r!   r"   r#   r$   r   r   r   r   r   r
   r   r%   r    r   r   r   r   rA   R   s*   
ü
ðrA   c                   @   s   e Zd Zdd„ ZdS )ÚSebekV2Sockc                 C   s&   t | jtƒr| j d¡S |  d¡S d S )Nz?Sebek v%SebekHead.version% %SebekHead.type% (%SebekV2Sock.cmd%)z#Sebek v2 socket (%SebekV2Sock.cmd%)r9   r   r   r   r   r    n   s    zSebekV2Sock.mysummaryNr@   r   r   r   r   rU   m   s   rU   iM  )rE   )rC   )rC   rE   r   )r   r   )r   r   r   N)Ú__doc__Zscapy.fieldsr   r   r   r   r   r   r   r	   r
   Zscapy.packetr   r   Zscapy.layers.inetr   Z
scapy.datar   r   r&   r<   r?   rA   rU   r   r   r   r   Ú<module>   s$   ,