dissectors/irc.py at master · cssaheel/dissectors · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
from scapy.packet import *
from scapy.fields import *
from scapy.ansmachine import *
from scapy.layers.inet import *
import dissector


class IRCResField(StrField):
    """
    field class for handling irc responses
    @attention: it inherets StrField from Scapy library
    """
    holds_packets = 1
    name = "IRCResField"

    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
                        pkt.underlayer.underlayer.fields["src"],\
                         pkt.underlayer.underlayer.fields["dst"],\
                          pkt.underlayer.fields["sport"],\
                           pkt.underlayer.fields["dport"],\
                            pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        value = ""
        ls = s.split("\r\n")
        length = len(ls)
        if length == 1:
            return "", value
        elif length > 1:
                value = ""
                value = value + "response: " + ls[0]
                i = 1
                while i < length - 1:
                    value = value + " response: " + ls[i]
                    if i < length - 2:
                        value = value + " | "
                    i = i + 1
                return "", value
        else:
            return "", ""

    def __init__(self, name, default, fmt, remain=0):
        """
        class constructor for initializing the instance variables
        @param name: name of the field
        @param default: Scapy has many formats to represent the data
        internal, human and machine. anyways you may sit this param to None.
        @param fmt: specifying the format, this has been set to "H"
        @param remain: this parameter specifies the size of the remaining
        data so make it 0 to handle all of the data.
        """
        self.name = name
        StrField.__init__(self, name, default, fmt, remain)


class IRCReqField(StrField):
    """
    field class for handling irc requests
    @attention: it inherets StrField from Scapy library
    """
    holds_packets = 1
    name = "IRCReqField"

    def getfield(self, pkt, s):
        """
        this method will get the packet, takes what does need to be
        taken and let the remaining go, so it returns two values.
        first value which belongs to this field and the second is
        the remaining which does need to be dissected with
        other "field classes".
        @param pkt: holds the whole packet
        @param s: holds only the remaining data which is not dissected yet.
        """
        cstream = -1
        if pkt.underlayer.name == "TCP":
            cstream = dissector.check_stream(\
                        pkt.underlayer.underlayer.fields["src"],\
                         pkt.underlayer.underlayer.fields["dst"],\
                          pkt.underlayer.fields["sport"],\
                           pkt.underlayer.fields["dport"],\
                            pkt.underlayer.fields["seq"], s)
        if not cstream == -1:
            s = cstream
        remain = ""
        value = ""
        ls = s.split()
        length = len(ls)
        if length > 1:
            value = "command: " + ls[0] + ","
            if length == 2:
                remain = ls[1]
                value = value + " Parameters: " + remain
                return "", value
            else:
                i = 1
                remain = ""
                while i < length:
                    if i != 1:
                        remain = remain + " " + ls[i]
                    else:
                        remain = remain + ls[i]
                    i = i + 1
                value = value + " Parameters: " + remain
                return "", value
        else:
            return "", ls[0]

    def __init__(self, name, default, fmt, remain=0):
        """
        class constructor for initializing the instance variables
        @param name: name of the field
        @param default: Scapy has many formats to represent the data
        internal, human and machine. anyways you may sit this param to None.
        @param fmt: specifying the format, this has been set to "H"
        @param remain: this parameter specifies the size of the remaining
        data so make it 0 to handle all of the data.
        """
        self.name = name
        StrField.__init__(self, name, default, fmt, remain)


class IRCRes(Packet):
    """
    class for handling irc responses
    @attention: it inherets Packet from Scapy library
    """
    name = "irc"
    fields_desc = [IRCResField("response", "", "H")]


class IRCReq(Packet):
    """
    class for handling irc requests
    @attention: it inherets Packet from Scapy library
    """
    name = "irc"
    fields_desc = [IRCReqField("command", "", "H")]

bind_layers(TCP, IRCReq, dport=6660)
bind_layers(TCP, IRCReq, dport=6661)
bind_layers(TCP, IRCReq, dport=6662)
bind_layers(TCP, IRCReq, dport=6663)
bind_layers(TCP, IRCReq, dport=6664)
bind_layers(TCP, IRCReq, dport=6665)
bind_layers(TCP, IRCReq, dport=6666)
bind_layers(TCP, IRCReq, dport=6667)
bind_layers(TCP, IRCReq, dport=6668)
bind_layers(TCP, IRCReq, dport=6669)
bind_layers(TCP, IRCReq, dport=7000)
bind_layers(TCP, IRCReq, dport=194)
bind_layers(TCP, IRCReq, dport=6697)


bind_layers(TCP, IRCRes, sport=6660)
bind_layers(TCP, IRCRes, sport=6661)
bind_layers(TCP, IRCRes, sport=6662)
bind_layers(TCP, IRCRes, sport=6663)
bind_layers(TCP, IRCRes, sport=6664)
bind_layers(TCP, IRCRes, sport=6665)
bind_layers(TCP, IRCRes, sport=6666)
bind_layers(TCP, IRCRes, sport=6667)
bind_layers(TCP, IRCRes, sport=6668)
bind_layers(TCP, IRCRes, sport=6669)
bind_layers(TCP, IRCRes, sport=7000)
bind_layers(TCP, IRCRes, sport=194)
bind_layers(TCP, IRCRes, sport=6697)