* The authenticator field is now a XStrFixedLenField (this improves its readability when displayed using show() or show2()).
* RADIUS module update.
* The description of the compute_message_authenticator() method (RadiusAttr_Message_Authenticator class) has been edited.
* The "Response Authenticator computation" test requires the Cryptography library.
* Fix attribute names in compute_message_authenticator().
* Applied guedou's comments.
Specify field length in the Message-Authenticator attribute.
Currently, only internal encryption and decryption were tested but the
implementation might not be the on it is supposed to be.
Add reference packets generated using Ubuntu-16.04, iproute2 and ping:
# ip -V
ip utility, iproute2-ss151103
# uname -a
Linux router-vm 4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
# ping -V
ping utility, iputils-s20160308
Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com>
In TLS, the AES-CCM test is commented out because CCM is not supported
by cryptography. But the combined_modes_ccm keyword is made to skip
these tests.
In IPsec, some IPv4 tests are located in the IPv6 section. Also add the
same combination of test for the AES-CCM as the other modes.
Also, there is some errors in the key material as the *MUST*
implementation uses a 16 bytes key and a 3 bytes nonce. Fix those
lengths.
Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com>
The default values of the "value_size" field is None. This can trigger
an issue
when computing the "len" field.
Test: str(EAP_MD5())
In order to fix this issue, the default value of the "value_size" field
has been set to 0.
Tests have been added in "regression.uts".
Added regression tests for EAP_TLS and EAP_FAST.
Use XStrLenField in EAP_MD5, EAP_TLS and EAP_FAST packets instead of StrLenField.
Delete blank lines before the class description (EAPOL, EAP, EAP_MD5, EAP_TLS and EAP_FAST packet classes).
"registered_options" dictionary was renamed "registered_methods"
(EAP-MD5, EAP-TLS etc are not options, but authentication methods).
EAP getlayer() and haslayer() methods have been overloaded in order to
allow access to a given "EAP layer" (such as EAP_TLS, for instance) by
providing the parent class name ("EAP"). For example, this is now
possible:
>>> eap_tls = EAP_TLS()
>>> EAP_TLS in eap_tls
True
>>> EAP in eap_tls
True
>>> eap_tls[EAP_TLS]
<EAP_TLS |>
>>> eap_tls[EAP]
<EAP_TLS |>
Regression tests have been added.
The ICV size is defined by the authentication algorithm in the SA.
it can be deduced from the payloadlen field but the padding len is
unknown aswell so there is no way to find both without the SA.
Assume everything in payloadlen is the ICV until the verification called
from the SA. Fill padding when possible.
Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com>
- this feature allows conversion of large ranges where
all entries coalesce to the same representation without bloating
a dict. For instance, 0x0 to 0xffff all display as "toto" except
a few odds 0x2 which are displayed as "tutu".
Before this feature, you needed to write
enum = {x: 'toto' for x in xrange(0, 0xffff)
enum[2] = 'tutu'
XShortEnumField('test', 0, enum)
* Fix IA_PD length error
I tested this and noticed wireshark wasn't parsing the message correctly. Turns out the length is wrong.
* Update regression.uts
Fix test for DHCP6OptIA_PD
* Update length of DHCP6OptIA_PD in test.
This PR makes it possible to check if several flags are all set, by
writting, for example, `if pkt[TCP].flags.SA:`.
It only works for single letter flags (e.g., will work for TCP().flags
but not for IP().flags), and only when getting a value.
Thanks @guedou for suggesting that.
Change the cryptographic library used in the following layers:
* IPSec
* TLS
* Dot11
Notes:
* Fix the WEP key in regression.uts: Should be a 40 bits key (5 ASCII)
and 24 bits nonce for 64 bits WEP. The key was 8 ASCII => 88 bits
in total
* AES-GCM and AES-CMAC algorithms are now native in cryptography: add
tests in ipsec.uts
* cryptography only supports Python 2.6+
* Fix the docstring for the pad method
Removed:
* MD2 and MD4 hash algorithms for RSA in tls/crypto/pkcs1.py
* AES-XCBC-96 not supported by cryptography.
Signed-off-by: Thomas Faivre <thomas.faivre@6wind.com>
* Add conf.checkIPinIP
This setting, when set to False, will exclude IP layers which encapsulate
another IP layer from the checks to tell if a packet is an answer to
another one.
Fixes#383
* conf.checkIPinIP affects both IP() and IPv6()
Setting conf.checkIPinIP will handle IP()/IP(), IP()/IPv6(),
IPv6()/IP(), IPv6()/IPv6().
Thanks @guedou!
* Clean-up IP.hashret and .answers code
* Add tests for .hashret() and .answers()
* Support (BPF) filter in sniff() with offline parameter set
Fixes#393
Also, fixes#355
* Add tests for wrpcap() and sniff(offline=)
as suggested by Guillaume.
Also, cleanup regression.uts since it was a pain to find a place
to add those tests.
* Fix PATH for tcpdump with non-root user
* Do not run tcpdump tests when tcpdump is not available
* Appveyor tests: install WinDump.exe
Thanks @gpotter2
* Corrected ICV length for AES-GCM and AES-CCM in IPSec layer. Added unit tests to the ipsec campaign.
* Added travis support for pycrypto 2.7a1 combined modes.
* Updated documentation for pycrypto installation.
Moved all modifications to modules not needed in arch that were causing
crashed to another file next to __init__ (in arch.windows).
Fixed "run_tests.bat" crash: the old usage of the %DATE% param was no more supported.
The "NextProtocol" field was added as an unconditional field which made the
VXLAN packet header consume an additional 8-bts when used in a Legacy VXLAN
deployments (flags=0x08) or in GPID deployments (flags=0x88). The resulting
regression caused incorrect parsing of subsequent headers. For example, if an
Ethernet header followed the VXLAN header then it would not be interpreted as
an Ethernet header. The actually interpretation would depend on what value was
stored in the Ether.dst field.
This change updates the field layout specification such that the NextProtocol
field is conditional on flags=0x04, and shortens the reserved field by 8-bits
if that condition is true.
fixes bug #281
Signed-off-by: Allain Legacy <allain.legacy@windriver.com>
Since part of the previously reserved Bytes are now used to annouce
the next header, this also updates the vxlan unit tests.
Original commit by: Christophe Fontaine <christophe.fontaine@qosmos.com>
Signed-off-by: Gabriel Ganne <gabriel.ganne@qosmos.com>
When interface names are longer than 7 characters, netstat will truncate
them to the first 7 chars which leads to looking up an invalid interface
name.
We attempt to guess the name of the interface based on the output of
ifconfig -l. If there is only one candidate we consider it, otherwise we
ignore it.
* References to the 'Raw' class were replaced by conf.raw_layer.
* Fix potential infinite loop in NTPExtPacketListField::getfield() + typo.
* Added regression test (Extension dissection test).
* layers/vxlan: add group policy extension support
This is based on the following draft RFC:
http://tools.ietf.org/html/draft-smith-vxlan-group-policy-00
Add more unit tests in regression.uts.
Signed-off-by: Robin Jarry <robin.jarry@6wind.com>
* Move VXLAN to layers
VXLAN has an official RFC: http://tools.ietf.org/html/rfc7348
It should be in automatically loaded layers.
Move tests to regression.uts.
Signed-off-by: Robin Jarry <robin.jarry@6wind.com>
* load_contrib: fallback to layers when contrib not found
Useful when a scapy.contrib module has been moved to scapy.layers.
Signed-off-by: Robin Jarry <robin.jarry@6wind.com>
When using scapy as a third party library, we do not "benefit" from the
loading routine that puts all symbols in the __builtin__ namespace. This
implies that all modules must be "importable" without any errors for
undefined symbols.
This patch fixes importing every scapy module individually. Some
circular imports were fixed (between inet6 and dhcp6).
Most errors were detected by using pylint with the right configuration
(scapy produces a *lot* of errors). Other errors were detected with the
following shell script:
export PYTHONPATH=".:$PYTHONPATH"
for f in $(find scapy/ -name '*.py'); do
f=${f%/__init__.py}
module=$(echo ${f%.py} | sed 's,/,.,g')
python -c "import $module; print $module"
done
Also, replace all implicit relative imports by absolute imports to avoid
surprises with some python versions.
Signed-off-by: Robin Jarry <robin.jarry@6wind.com>