Parses p0f.fp file and stores the data with described structures.
(self, file)
| 358 | f.close() |
| 359 | |
| 360 | def _parse_file(self, file): |
| 361 | """ |
| 362 | Parses p0f.fp file and stores the data with described structures. |
| 363 | """ |
| 364 | label_id = -1 |
| 365 | |
| 366 | for line in file: |
| 367 | if line[0] in (";", "\n"): |
| 368 | continue |
| 369 | line = line.strip() |
| 370 | |
| 371 | if line[0] == "[": |
| 372 | section, direction = lparse(line[1:-1], 2) |
| 373 | if section == "mtu": |
| 374 | self.base[section] = [] |
| 375 | curr_records = self.base[section] |
| 376 | else: |
| 377 | if section not in self.base: |
| 378 | self.base[section] = {direction: []} |
| 379 | elif direction not in self.base[section]: |
| 380 | self.base[section][direction] = [] |
| 381 | curr_records = self.base[section][direction] |
| 382 | else: |
| 383 | param, _, val = line.partition(" = ") |
| 384 | param = param.strip() |
| 385 | |
| 386 | if param == "sig": |
| 387 | if section == "mtu": |
| 388 | record_class = MTU_Record |
| 389 | elif section == "tcp": |
| 390 | record_class = TCP_Record |
| 391 | elif section == "http": |
| 392 | record_class = HTTP_Record |
| 393 | curr_records.append(record_class(label_id, val)) |
| 394 | |
| 395 | elif param == "label": |
| 396 | label_id += 1 |
| 397 | if section == "mtu": |
| 398 | self.labels.append(val) |
| 399 | continue |
| 400 | # label = type:class:name:flavor |
| 401 | t, c, name, flavor = lparse(val, 4) |
| 402 | self.labels.append((t, c, name, flavor)) |
| 403 | |
| 404 | elif param == "sys": |
| 405 | sys_names = tuple(name for name in val.split(",")) |
| 406 | self.labels[label_id] += (sys_names,) |
| 407 | |
| 408 | def get_sigs_by_os(self, direction, osgenre, osdetails=None): |
| 409 | """Get TCP signatures that match an OS genre and details (if specified). |