Parses a TCP sig line and returns a tuple consisting of a TCP_Signature object and bad_ttl as bool
(cls, sig_line)
| 186 | |
| 187 | @classmethod |
| 188 | def from_raw_sig(cls, sig_line): |
| 189 | """ |
| 190 | Parses a TCP sig line and returns a tuple consisting of a |
| 191 | TCP_Signature object and bad_ttl as bool |
| 192 | """ |
| 193 | ver, ttl, olen, mss, wsize, olayout, quirks, pclass = lparse(sig_line, 8) # noqa: E501 |
| 194 | wsize, _, scale = wsize.partition(",") |
| 195 | |
| 196 | ip_ver = -1 if ver == "*" else int(ver) |
| 197 | ttl, bad_ttl = (int(ttl[:-1]), True) if ttl[-1] == "-" else (int(ttl), False) # noqa: E501 |
| 198 | ip_opt_len = int(olen) |
| 199 | mss = -1 if mss == "*" else int(mss) |
| 200 | if wsize == "*": |
| 201 | win, win_type = (0, WIN_TYPE_ANY) |
| 202 | elif wsize[:3] == "mss": |
| 203 | win, win_type = (int(wsize[4:]), WIN_TYPE_MSS) |
| 204 | elif wsize[0] == "%": |
| 205 | win, win_type = (int(wsize[1:]), WIN_TYPE_MOD) |
| 206 | elif wsize[:3] == "mtu": |
| 207 | win, win_type = (int(wsize[4:]), WIN_TYPE_MTU) |
| 208 | else: |
| 209 | win, win_type = (int(wsize), WIN_TYPE_NORMAL) |
| 210 | wscale = -1 if scale == "*" else int(scale) |
| 211 | if quirks: |
| 212 | quirks = frozenset(q for q in quirks.split(",")) |
| 213 | else: |
| 214 | quirks = frozenset() |
| 215 | pay_class = -1 if pclass == "*" else int(pclass == "+") |
| 216 | |
| 217 | sig = cls(olayout, quirks, ip_opt_len, ip_ver, ttl, mss, win, win_type, wscale, pay_class, None) # noqa: E501 |
| 218 | return sig, bad_ttl |
| 219 | |
| 220 | def __str__(self): |
| 221 | quirks = ",".join(q for q in self.quirks) |
no test coverage detected