Receives a TCP packet (assuming it's valid), and returns a TCP_Signature object
(cls, pkt)
| 65 | |
| 66 | @classmethod |
| 67 | def from_packet(cls, pkt): |
| 68 | """ |
| 69 | Receives a TCP packet (assuming it's valid), and returns |
| 70 | a TCP_Signature object |
| 71 | """ |
| 72 | ip_ver = pkt.version |
| 73 | quirks = set() |
| 74 | |
| 75 | def addq(name): |
| 76 | quirks.add(name) |
| 77 | |
| 78 | # IPv4/IPv6 parsing |
| 79 | if ip_ver == 4: |
| 80 | ttl = pkt.ttl |
| 81 | ip_opt_len = (pkt.ihl * 4) - 20 |
| 82 | if pkt.tos & (0x01 | 0x02): |
| 83 | addq("ecn") |
| 84 | if pkt.flags.evil: |
| 85 | addq("0+") |
| 86 | if pkt.flags.DF: |
| 87 | addq("df") |
| 88 | if pkt.id: |
| 89 | addq("id+") |
| 90 | elif pkt.id == 0: |
| 91 | addq("id-") |
| 92 | else: |
| 93 | ttl = pkt.hlim |
| 94 | ip_opt_len = 0 |
| 95 | if pkt.fl: |
| 96 | addq("flow") |
| 97 | if pkt.tc & (0x01 | 0x02): |
| 98 | addq("ecn") |
| 99 | |
| 100 | # TCP parsing |
| 101 | tcp = pkt[TCP] |
| 102 | win = tcp.window |
| 103 | if tcp.flags & (0x40 | 0x80 | 0x01): |
| 104 | addq("ecn") |
| 105 | if tcp.seq == 0: |
| 106 | addq("seq-") |
| 107 | if tcp.flags.A: |
| 108 | if tcp.ack == 0: |
| 109 | addq("ack-") |
| 110 | elif tcp.ack: |
| 111 | addq("ack+") |
| 112 | if tcp.flags.U: |
| 113 | addq("urgf+") |
| 114 | elif tcp.urgptr: |
| 115 | addq("uptr+") |
| 116 | if tcp.flags.P: |
| 117 | addq("pushf+") |
| 118 | |
| 119 | pay_class = 1 if tcp.payload else 0 |
| 120 | |
| 121 | # Manual TCP options parsing |
| 122 | mss = 0 |
| 123 | wscale = 0 |
| 124 | ts1 = 0 |
no test coverage detected