rendered paste bodyIndex: dsniff/core/service.py
===================================================================
--- dsniff/core/service.py (revision 8)
+++ dsniff/core/service.py (working copy)
@@ -4,8 +4,6 @@
from dsniff.core import flow
from dsniff.lib import net
-#import pyappid as appid
-
# XXX - override some service definitions
_services = {
'aolmail':'tcp and dst port 80 and dst net 205.188.0.0/16',
@@ -15,76 +13,83 @@
'hotmail':'tcp and dst port 80 and dst net 64.4.0.0/18',
'lycosmail':'tcp and dst port 80 and dst net 208.36.123.0/24',
'yahoomail':'tcp and dst port 80 and dst net 66.163.160.0/19 or 64.58.76.0/22 or 64.41.224.0/23',
+ 'dns':'dst port 53',
}
-class ServiceHandler(dsniff.Handler):
- name = 'service'
- auto = False
+try:
+ import appid
+ class ServiceHandler(dsniff.Handler):
+ name = 'service'
+ auto = False
- def setup(self):
- if self.auto:
- self.subscribe('flow', 'tcp or udp', self.recv_flow)
- else:
- self._register = self.__proxy_register
- self._unregister = self.__proxy_unregister
+ def setup(self):
+ if self.auto:
+ self.subscribe('flow', 'tcp or udp', self.recv_flow)
+ else:
+ self._register = self.__proxy_register
+ self._unregister = self.__proxy_unregister
- def recv_flow(self, f):
- if '_service' in f.save:
- self.publish(f.save['_service'], f)
- return
- if f.state == flow.FLOW_START:
+ def recv_flow(self, f):
+ if '_service' in f.save:
+ self.publish(f.save['_service'], f)
+ return
+ if f.state == flow.FLOW_START:
+ for half in f.half.itervalues():
+ half.save['_appid'] = appid.appid()
+ half.save['_appid_buf'] = half.data or ''
+ app = (-1, 0)
for half in f.half.itervalues():
- half.save['_appid'] = appid.appid()
- half.save['_appid_buf'] = half.data or ''
- app = -1
- for half in f.half.itervalues():
- if half.data:
- half.save['_appid_buf'] += half.data
- app = half.save['_appid'].process(half.data)
- if app != -1: # APPID_CONTINUE
- break
- if app != -1:
- event = appid.app_to_name(app).lower()
- print 'appid match:', event
- if event in self.callbacks:
- f.save['_service'] = event
- for half in f.half.itervalues():
- half.data = half.save.pop('_appid_buf')
- del half.save['_appid']
- f.state = flow.FLOW_START
- self.publish(event, f)
- if f.client.data:
- f.state = flow.FLOW_CLIENT_DATA
+ if half.data:
+ half.save['_appid_buf'] += half.data
+ print sys.stderr, 'appid about to process'
+ app = half.save['_appid'].process(f.p, f.sport, f.dport, half.data)
+ print sys.stderr, 'appid returned %s' % (app,)
+ if app[0] != -1: # APPID_CONTINUE
+ break
+ if app[0] != -1:
+ event = appid.app_to_name(app[0]).lower()
+ print 'appid match:', event
+ if event in self.callbacks:
+ f.save['_service'] = event
+ for half in f.half.itervalues():
+ half.data = half.save.pop('_appid_buf')
+ del half.save['_appid']
+ f.state = flow.FLOW_START
self.publish(event, f)
- if f.server.data:
- f.state = flow.FLOW_SERVER_DATA
- self.publish(event, f)
- else:
- for half in f.half.itervalues():
- del half.save['_appid_buf']
- del half.save['_appid']
- f.unregister(self.recv_flow)
+ if f.client.data:
+ f.state = flow.FLOW_CLIENT_DATA
+ self.publish(event, f)
+ if f.server.data:
+ f.state = flow.FLOW_SERVER_DATA
+ self.publish(event, f)
+ else:
+ for half in f.half.itervalues():
+ del half.save['_appid_buf']
+ del half.save['_appid']
+ f.unregister(self.recv_flow)
- def __event_to_fcaps(self, event):
- if event in _services:
- return [ _services[event] ]
- svcs = net.serv_aton(event)
- l = []
- for p in (1, 6, 17):
- ports = [ str(svc[1]) for svc in svcs if svc[0] == p ]
- if ports:
- l.append('%s and dst port %s' %
- (net.proto_ntoa(p), ' or '.join(ports)))
- return l
+ def __event_to_fcaps(self, event):
+ if event in _services:
+ return [ _services[event] ]
+ svcs = net.serv_aton(event)
+ l = []
+ for p in (1, 6, 17):
+ ports = [ str(svc[1]) for svc in svcs if svc[0] == p ]
+ if ports:
+ l.append('%s and dst port %s' %
+ (net.proto_ntoa(p), ' or '.join(ports)))
+ return l
- def __proxy_register(self, event, callback):
- # XXX - just proxy to FlowHandler
- fcaps = self.__event_to_fcaps(event)
- for fcap in fcaps:
- self.subscribe('flow', fcap, callback)
+ def __proxy_register(self, event, callback):
+ # XXX - just proxy to FlowHandler
+ fcaps = self.__event_to_fcaps(event)
+ for fcap in fcaps:
+ self.subscribe('flow', fcap, callback)
- def __proxy_unregister(self, event, callback):
- # XXX - just proxy to FlowHandler
- fcaps = self.__event_to_fcaps(event)
- for fcap in fcaps:
- self.unsubscribe('flow', fcap, callback)
+ def __proxy_unregister(self, event, callback):
+ # XXX - just proxy to FlowHandler
+ fcaps = self.__event_to_fcaps(event)
+ for fcap in fcaps:
+ self.unsubscribe('flow', fcap, callback)
+except ImportError, e:
+ pass