C:/work/RevealedSystems/EyeSpy-RS/eyespy/src/objects/logic/network/packetDecoder.py

Go to the documentation of this file.

# Copyright (C) 2008-2009  Mark Hanegraaff
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.


import pcapy
from impacket.ImpactDecoder import EthDecoder, IPDecoder
from impacket.ImpactPacket import ImpactPacketException, IP, TCP, UDP, ICMP, IGMP
from objects.logic.common.logger import logger
from objects.logic.common.exception import exception


## The packetDecoder is a wrapper class for several Impacket and pcapy
# objects, and is used to turn a string of raw bytes, representing an Ethernet frame (only ethernet is supported)
# into a Dictionary of more easily accessible attributes. 
class packetDecoder():
    def __init__(self):
        self.readerObject = None
        self.datalink     = None
        self.EthDecoder   = None
        self.IPDecoder    = None
        
        # protocols contained in Ethernet Frame
        # if protocol is not here, then it's not supported yet
        self.PROTOCOL_IP        = 2048        
        self.PROTOCOL_ARP       = 2054
        
        # protocols contained in IP Frame
        self.PROTOCOL_ICMP      = 1
        self.PROTOCOL_IGMP      = 2 
        
        self.PROTOCOL_TCP       = 6
        self.PROTOCOL_UDP       = 17
        
    
    ## Returns the protocol Name (as a string) given the protocol number as extracted from the Ethernet Frame.
    # Currently IP and ARP are supported
    # @param protNum Integer
    # @return String 
    def getNetProtocolString(self, protNum):
        if protNum == self.PROTOCOL_IP:
            return "IP"
        if protNum == self.PROTOCOL_ARP:
            return "ARP"
        
        return "UNK"
    
    ## Returns the protocol Name (as a string) given the IP Assigned Protocol Name.
    # Currently Supported: ICMP, IGMP, TCP, UDP
    # @param protNum Integer
    # @return String
    def getXportProtocolString(self, protNum):
        if protNum == self.PROTOCOL_ICMP:
            return "ICMP"
        if protNum == self.PROTOCOL_IGMP:
            return "IGMP"
        if protNum == self.PROTOCOL_TCP:
            return "TCP"
        if protNum == self.PROTOCOL_UDP:
            return "UDP"
        
        return "UNK"
    
    
    
    
    ## Set the reader object (defined in captureInterface::openDevice implementation class),
    # and perform some additional initialization.
    # @param readerObj Reader object returned by pcapy's open_live(...) method    
    def setReader(self, readerObj):        
        if readerObj == None: 
            logger.log(__name__ + ": Could not set reader object. Object is null")
            raise exception("There was an error configuring the network device. This device cannot be used", True)
        
        logger.log(__name__ + ":initializing reader object")
        self.readerObject = readerObj
        self.datalink = self.readerObject.datalink()
                
        #### is this event neded?
        # for now let's only support Ethernet, others will come
        if self.datalink == pcapy.DLT_EN10MB:
            self.EthDecoder = EthDecoder()
            self.IPDecoder = IPDecoder()
        else: 
            logger.log(__name__ + "Data link is not supported. Only Ethernet is currently supported")
            raise exception("Data link is not supported. Only Ethernet is currently supported", 1)
       
       
       
    ## Does not set the reader object, but performs the same additional initialization
    # that setReader does. This is the method which is usually called when a user wants to decode raw
    # packets without having to open device first.
    def setDefaultReader(self):
        self.EthDecoder = EthDecoder()
        self.IPDecoder = IPDecoder()
        
    
    
    
    ## Performs the actual decoding of the raw packet data
    # @param header Raw DataLink header
    # @param data  Raw DataLink frame
    def decodePacket(self, header, data):        
        
        dict = None
        try:
            ethernetPacket = self.EthDecoder.decode(data)
        except Exception, e:
            logger.log(__name__ + "There was an error decoding raw packet")
            logger.log(str(e))
            return
        
        except ImpactPacketException, ime:
            logger.log(__name__ + "There was an error decoding raw packet")
            logger.log(str(ime))
            return
            
   
        ether_protocol_typ = ethernetPacket.get_ether_type()
        
        if (ether_protocol_typ == self.PROTOCOL_IP):
            dict = self.handle_ethernet_IPPacket(ethernetPacket)
        elif (ether_protocol_typ == self.PROTOCOL_ARP):
            dict = self.handle_ethernet_ARPPacket(ethernetPacket)
        else:
            logger.log(__name__ + ": Received an unsupported Ehternet protocol type -- ")
            
        
        return dict
    
    
    
    ## Helper function used to decode an Ethernet Frame.
    # @param ethernetFrame impacket structure representing an Ethernet Frame
    def handle_ethernet_IPPacket(self, ethernetFrame):        
        
        try:
            decodedPacket = None
            ipPacket = ethernetFrame.child()
            
            #get the IP header
            ipHeader = ipPacket.get_bytes()[0:ipPacket.get_header_size()]
            ipPacketProtocol = ipPacket.get_ip_p()
        except Exception, ex:
                logger.log(__name__ + ": Could not process IP packet")
                logger.log(ex)                   
            
        
        if (ipPacketProtocol == self.PROTOCOL_TCP):
            try:
                
                tcpPacket = ipPacket.child()
             
                tcpHeader = tcpPacket.get_bytes() + tcpPacket.get_padded_options() 
                                
                
                
                payload = tcpPacket.get_packet()
                payload = payload[tcpPacket.get_header_size():]        

                #figure out payload size = IPLEN - IP_HEADER_LEN - TCP_HEADER_LEN
                payloadLen = ipPacket.get_ip_len() - (ipPacket.get_ip_hl() * 4) - (tcpPacket.get_th_off() * 4)
                
            except Exception, ex:
                   logger.log(__name__ + ": Could not process TCP packet")
                   logger.log(ex)
                   
                   raise ex
            else:
                
                decodedPacket = self.createPacketDic('ETHERNET', self.PROTOCOL_IP, self.PROTOCOL_TCP, payloadLen, 
                                            ipPacket.get_ip_src(), tcpPacket.get_th_sport(), ipPacket.get_ip_dst(), tcpPacket.get_th_dport(),
                                            ipHeader, tcpHeader, payload)                                 
        
        if (ipPacketProtocol == self.PROTOCOL_UDP):
            
            try:
                udpPacket = ipPacket.child()
                
                udpHeader = udpPacket.get_bytes()[0:udpPacket.get_header_size()]
                
                payload = udpPacket.get_packet()
                payload = payload[udpPacket.get_header_size():]
           
                #msg = "UDP: %s:%d --> %s:%d" % (ipPacket.get_ip_src(), udpPacket.get_uh_sport(), ipPacket.get_ip_dst(), udpPacket.get_uh_dport())                        
                #print msg
                
                #figure out payload size = UDP_LEN - 8BYTES
                payloadLen = udpPacket.get_uh_ulen() - 8
                    
            except Exception, ex:
                   logger.log(__name__ + ": Could not process UDP packet")
                   logger.log(ex)
                   
                   raise ex
            else:                
                decodedPacket = self.createPacketDic('ETHERNET', self.PROTOCOL_IP, self.PROTOCOL_UDP, payloadLen, 
                                        ipPacket.get_ip_src(), udpPacket.get_uh_sport(), ipPacket.get_ip_dst(), udpPacket.get_uh_dport(),
                                        ipHeader, udpHeader, payload)
        
        if (ipPacketProtocol == self.PROTOCOL_ICMP):
            message = "%s: Got an ICMP packet -- %s -> %s" % (__name__, ipPacket.get_ip_src(), ipPacket.get_ip_dst())
            #logger.log(message)
            
            try:
                icmpPacket = ipPacket.child()
                
                icmpHeader = icmpPacket.get_bytes()[0:icmpPacket.get_header_size()]
            except Exception, ex:
                logger.log(__name__ + ": Could not process ICMP packet")
                logger.log(ex)
                   
                raise ex
            else:
                decodedPacket = self.createPacketDic('ETHERNET', self.PROTOCOL_IP, self.PROTOCOL_ICMP, 0, 
                                        ipPacket.get_ip_src(), 0, ipPacket.get_ip_dst(), 0,
                                        ipHeader, icmpHeader, None)
                
        if (ipPacketProtocol == self.PROTOCOL_IGMP):
            #logger.log(__name__ + ": Got an IGMP packet")
            try:
                igmpPacket = ipPacket.child()
                
                igmpHeader = igmpPacket.get_bytes()
            except Exception, ex:
                logger.log(__name__ + ": Could not process IGMP packet")
                logger.log(ex)
                   
                raise ex
            else:
                decodedPacket = self.createPacketDic('ETHERNET', self.PROTOCOL_IP, self.PROTOCOL_IGMP, 0, 
                                        ipPacket.get_ip_src(), 0, ipPacket.get_ip_dst(), 0,
                                        ipHeader, igmpHeader, None)            
            
        return decodedPacket
    
    
    ## Helper function used to decode an ARP Packet.
    # @param ARPPacket Impacket structure representing an ARP Packet
    def handle_ethernet_ARPPacket(self, ARPPacket):
        logger.log(__name__ +  ":Received ARP packet. No handler for that yet")
        
        
        
    ## Creates the actual Dictionary given the supplied set of parameters
    # @param lanProtocol String representing DataLink protocol 
    # @param netProtocol String representing network protocol
    # @param transportProtocol String representing Transport protocol
    # @param payloadSize Integer representing the payload size
    # @param sourceIP Source IP String
    # @param sourcePort Source Port Integer
    # @param destIP Destination IP String
    # @param destPort Destination Port Integer
    # @param netHeader Network Protocol Header
    # @param xportHeader Transport Protocol Header
    # @param payload Actual Payload as Stream of Bytes
    # @return Dictionary
    def createPacketDic(self, 
                              lanProtocol, #Ethernet, etc
                              netProtocol, #IP, ARP
                              transportProtocol, #TCP,UDP,ICMP, etc
                              payloadSize, #Payload Sze
                              sourceIP,
                              sourcePort,
                              destIP,
                              destPort,
                              netHeader,
                              xportHeader,
                              payload):
        
        decodedPacket = dict()
        
        decodedPacket['lanProtocol']        = lanProtocol
        decodedPacket['netProtocol']        = netProtocol
        decodedPacket['transportProtocol']  = transportProtocol
        decodedPacket['sourceIP']           = sourceIP
        decodedPacket['sourcePort']         = sourcePort        
        decodedPacket['destIP']             = destIP
        decodedPacket['destPort']           = destPort
        decodedPacket['payloadSize']        = payloadSize
        
        decodedPacket['networkHeader']      = netHeader
        decodedPacket['transportHeader']    = xportHeader
        decodedPacket['payload']            = payload
        
        
        return decodedPacket
    
    
    
    ## Given the transport header, which must be ICMP, this method will determine if this is ping request or reply
    # @param netHeader IP Header
    # @param xportHeader ICMP Header
    # @return Boolean
    def isPing(self, netHeader, xportHeader):
        try:
            ipHdr = IP(netHeader)
        except ImpactPacketException, ex:
            # Not IP?
            logger.log(__name__ + "Error parsing IP header when trying to determine if content is PING:" + str(ex))
            return False
        
        ipPacketProtocol = ipHdr.get_ip_p()
        
        # not ICMP
        if ipPacketProtocol != self.PROTOCOL_ICMP:
            return False
        
        try:
            icmpHdr = ICMP(xportHeader)        
            icmpType = icmpHdr.get_icmp_type()
        
            if icmpType == 0 or icmpType == 8:
                return True
        except ImpactPacketException, ex:
             # Error parsing ICMP?
            logger.log(__name__ + "Error parsing ICMP header when trying to determine if content is PING: " + str(ex))
            return False
    
        

---