logo       

Re: TLV based protocols: msg#00017

security.scapy.general

Subject: Re: TLV based protocols

Hi,


Anybody done any work in scapy on TLV based protocols rather than static
header types?


Here is my attempt to make TLV more generic in scapy using mechanisms found in actual DNS* objects.

It is fairly basic:
- build your TLV from Packet

class TLVPacket(Packet):
name = 'TLV'
fields_desc = [ ByteField('type', 0),
ByteField('len', None),
StrField('value', None)
]

- build your TLVCountField from the new (Short|Byte)CountField

class TLVCountField(ShortCountField):
def __init__(self, name, default, field):
ShortCountField.__init__(self, name, default, field, TLVPacket)

- build your TLVField from MainCountField and implement dissectme()

class TLVField(MainCountField):
def __init__(self, name, countfld):
MainCountField.__init__(self, name, countfld)
# Note: each instance of MainCountField should re-implement dissectme()
def dissectme(self, s, p):
t = s[p:p+2]
type,l = struct.unpack('BB', t)
tlv = TLVPacket(s[p:p+2+l])
p = p+l+2
return tlv,p

- use them in a Packet

class Header(Packet):
name = 'TLV based header'
fields_desc = [
TLVCountField('num', None, 'tlv'),
TLVField('tlv', 'num')
]

- use it
tlv=Header(num=2, tlv=TLVPacket(type=1, len=4, value='toto')/ TLVPacket(type=2, len=5, value='pouet'))

I think it is better to make DHCPOptionsField more generic. The payload operator / is somwhow confusing and the tlv field in the packet should be a list.

Guillaume


Attachment: tlv.py
Description: Text Data





---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe@xxxxxxxxxx
Pour obtenir de l'aide, ecrivez a: scapy.ml-help@xxxxxxxxxx
<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

News | FAQ | advertise