a k#d&S@sdZddlmZddlmZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z ddlmZddlmZmZmZdd lmZmZdd lmZmZmZdd lmZmZmZmZm Z dd l!m"Z"dd l#m$Z$e j%durddl&Z'gdZ(e e(de _)e e(de _*e e(de _+e e(de _,Gddde Z-d\a.a/a0a1ddZ2e2ddZ3ddZ4ddZ5e j6j7ddZ8d d!Z9e j6j7d*d#d$Z:d+d&d'Z;d(d)Z.a2icsg|] }|qSrr).0er%rr Pz.p0fKnowledgeBase.lazy_init..z,Can't parse p0f database (new p0f version ?)) openrIOErrorr basetuplesplitlenappend Exceptionclose)rflineZlirr(r lazy_init=s,    $   zp0fKnowledgeBase.lazy_initN)__name__ __module__ __qualname__rr=rrrrr8sr)NNNNcCs,ttjattjattjattja dSr) rrp0f_basep0f_kdb p0fa_basep0fa_kdb p0fr_basep0fr_kdb p0fo_basep0fo_kdbrrrrp0f_load_knowledgebases_s   rIcCsH|d@dkrtS|d@dkr tS|d@dvr0tS|d@dkr@tSdSdS)Nr-)r,)rBrDrFrH)flagsrrr p0f_selectdbjs    rOc Cs|}|t|}|trJ|trJ|t}t|jtrBqJ|j}qt|tr`t|jtsht dt |jj }|j }t |}|dkr|tkrd}nd}|tkrd}d}d}d}d}|jjd>d }|jjD]^} |d 8}| dd kr|d t| d d 7}| d }|d8}q| ddkrF|dt| d d 7}|d8}q| ddkr| d ddkrp|d7}n|d7}| d d dkrd}|d8}q| ddkr|d7}|d 8}q| ddkr|d7}q| ddkr|d7}|dkr0d}qt| dtr |dtd | d7}q|d| d7}q|dd}|dkrLd}|jj} |dkr|dkr| |dkrdt| |} n&| |ddkrd t| |d} t| } d} |tkr|jj d!@d!kr| d"7} |jj|jjkr| d#7} |jjdkr| d$7} |r| d%7} |jdkr0| d&7} |jgkrD| d'7} |jjdkrZ| d(7} |jjdkrp| d)7} |jjdkr| d*7} |r| d 7} |tkr|jj d+@dkr| d,7} n|jj d@dkr| d,7} |tkrt|jjts| d-7} | dkrd} || ||j j||| ffS).NNot a TCP/IP packetd*rr1Fr-rLr+MSSM,WScaleW TimestampzT0,zT,T SAckOKzS,NOPzN,EOLzE,z?%i,.S(TrMKQ0PZIUXA FD)copy __class__rhaslayerrr getlayer isinstancepayload TypeErrorrOrNttlr7rFrHZdataofsoptionsstrr windowseqackidurgptrreservedr ZDF) pktdbrvssZooomssZqqTZqqPZilenoptionwinqqrrr packet2p0f|s                   rcCsd}||d|dkp`|ddkp`|dddko`|do`t|dt|ddddk7}||d|dko|d|ddk7}dD]$}|||||kp||dk7}q||d|dk7}|dd }|dd }t|t|kr d }tt|D]}||||kst||d krnt||dkrn||ddkrn||d||dkst||d krt||dkr||ddkr||d||dkrt||ddt||d ddksd }qq|r |t|7}|S) NrrR%r+rl)r-r.rWr,rVTr-F)r"r#r6r7range)r$ydiZxoptZyoptZsamerrr p0f_correl sF`("*  rcCst|\}}|r|}ng}|s.tdgSg}t|ddd}|D]<}t||}||krL||d|d|d|tjfqL|S)ziPassive OS fingerprinting: which OS emitted this TCP packet ? p0f(packet) -> accuracy, [list of guesses] zp0f base empty.r,rVr.r/r0r+) rget_baser r7r6rr8rrv)rrsigpbrmaxbrrrrp0f&s   (rcCsz t|}Wnty YdS0|gkrRdddttt|dddf}n|d}d}z t|}Wnty|Yn0|dkrd}|d|dd |d}|dur||d t|d d 7}n||d 7}|ddur|dt|dd7}t|dS)z,Calls p0f and returns a user-friendly outputNUNKNOWN[r r+z:?:?]rz%IP.src%:%TCP.sport% -  z (up: iz- hrs) -> %IP.dst%:%TCP.dport% (%TCP.flags%)z( -> %IP.dst%:%TCP.dport% (%TCP.flags%)r-z (distance )) rr9joinmaprxr pkt2uptimeZsprintfprint)rruptimeresrrrprnp0f=s*  (   rrQcCstt|tstdt|tr$tdt|ts8t|jS|jD](}|ddkr>|dd|}|Sq>tddS)zzCalculate the date the machine which emitted the packet booted using TCP timestamp # noqa: E501 pkt2uptime(pkt, [HZ=100])zNot a TCP packetrrZr+zNo timestamp optionN)rsr rur r rrtrw)rZHZopttrrrrYs       rc s|}|tr<|tr<|t}t|jtr4q<|j}qt|trRt|jtsZtdt|jj }r| }|dur~g}fdd|D}rfdd|D}n|r|g}n t |}|t kr|jj d@dkrdd|D}ndd|D}|st d |td t|d } t|jj} d d | d} | d} fdd| ddD} g}| ddkr|| ddD]}|d dkr| d d dkrdt| d d d}nd}| rd | kr|ksnd} |d ddkr0| dur|d| fn|dtd |fn|d dkrt|dd}| durv| |d krv|d| fn|d|td ||fn|dt|d dfn|d dkr| rd | krdksnd} |d ddkr$| dur|d| fn|dtfn|d dkrt|dd}| durj| |d krj|d| fn|d|td d|dfn|dt|d dfn|dkr|d n|d!kr|dur|}n@| d rd | d krd"krnn | d }n td#d$}d!| d%vr.d }n@| d rbd | d krTd"krbnn | d }n td d&}|d||ffn|dkr|d'n|d(kr|d)n|d*kr|d+n|d d,krft|d dtd vrJtd t|d dd }td t|d dd }||t|tt|fn|t|d dd-fn td.|||j_q| d dkrt |j_!n| d "rt| d |j_!n| d d dkrt| d d d}|td d|d|j_!n| d d d!kr&|t| d d d|j_!n\| d d dkrzd/d|D}|sTt d0|d d t| d d d|j_!nt d1| d ||_#|j d| dO_ | d%dkr| d%D]}|d2krd |_$n|d3krt |j_%n|d4krt&|j_'n|d5kr@|t(kr$|jj d6O_ n|jj t)gd7O_ nH|d8krr|t(krr|t*j+ttd d9d:}n|d;kr|jj'|j_,qd<| d%vrd |j_,n|jj,d krt&|j_,|j-r|j-}q|S)=aModifies pkt so that p0f will think it has been sent by a specific OS. If osdetails is None, then we randomly pick up a personality matching osgenre. If osgenre and signature are also None, we use a local signature (using p0f_getlocalsigs). If signature is specified (as a tuple), we use the signature. For now, only TCP Syn packets are supported. Some specifications of the p0f.fp file are not (yet) implemented.rPNcsg|]}|dkr|qS)r/rr&r$)osgenrerrr)r*z#p0f_impersonate..csg|]}|dkr|qS)r0rr) osdetailsrrr)r*r,cSsg|]}d|dvr|qSrcr.rrrrrr)r*cSsg|]}d|dvr|qSrrrrrrr)r*zNo match in the p0f databaserr+cSst|tjr|SdSr)rsr integer_types)valrrrr*z!p0f_impersonate..rTrXcsg|] }|qSrr)r&o)int_onlyrrr)r*rZ)NNr_rVrUr`irRrr-rY)minrZT0)rZ)rrrblxlwr.l)r\rSN)r]NE)r^N?rSzunhandled TCP option %scSsg|]}|ddkr|qS)rrTrrrrrr) r*z5TCP window value requires MSS, and MSS option not setz#Unhandled window size specificationrgrirkrmrl)r!rlrarn )loadrdre).rorqrr rrrsrtrurOrNrp0f_getlocalsigsrFrrandomrandintr7dictrwgetr6r#r8rrr structunpackrcalcsize_fixr rryr"rvr|r}rr{rHchoicerZ raw_layerrzZ underlayer)rrr signatureZ extrahopsZmturrrZpersZ orig_optsZmss_hintZ wscale_hintZts_hintrwrZmaxmssZcoefZts_aZts_boptnameZ optstructrrr)rrrrp0f_impersonatels             *  *           &            rc st}tdd}|dkrifdd}tjdd}d}t|dt||d d }|D]}t|D] }||qhq\t |dn|dkrt d nrt d tjtjtjd }z|d|fWntj yYn0|d|f|d|f|tdS)aThis function returns a dictionary of signatures indexed by p0f db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack. You need to have your firewall at least accepting the TCP packets from/to a high port (30000 <= x <= 40000) on your loopback interface. Please note that the generated signatures come from the loopback interface and may (are likely to) be different than those generated on "normal" interfaces.i0ui@rcsN|dvr |dg|d<n*|d|dvrJ|d|ddS)Nrr+)r8)rresultrr addresultJs z#p0f_getlocalsigs..addresultz 127.0.0.1z tcp and port rW)ifacefiltercounttimeoutz fork errorr+)type)osforkrrrrouterrxrwaitpidrerrortimesleepsocketAF_INET SOCK_STREAMconnectbindr:_exit) pidportrrrplrelts1rrrr:s2        r)rQ)NNNrrN)=__doc__ __future__rrrrrrrZ scapy.datarrZ scapy.configrZ scapy.compatrZscapy.layers.inetrr r Z scapy.packetr r Z scapy.errorr rrZscapy.volatilerrrrrZscapy.sendrecvrZ scapy.libsrrZ scapy.routeZscapyZ _p0fpathsrArCrErGrrBrDrFrHrIrOrrcommandsregisterrrrrrrrrrsR           $    O