I'm putting together a new protocol layer in scapy. I'm using a packetfield to represent a len-value pair within the protocal. I can get the layer to build a packet. .show()
and hexdump()
show the packet fields as expected. .show2()
however is a different story.
I have something similar too:
class bar(Packet):
name="Bar Packet"
fields_desc = [
FieldLenField("len", None, length_of="val", fmt="!H"),
StrLenField("val", "", length_from=lambda p:p.len)
]
class foo(Packet):
name="Foo Packet"
fields_desc = [
XByteField("fld1", 0x00),
XByteField("fld2", 0x00),
PacketField("fld3", '', bar),
PacketField("fld4", '', bar),
PacketField("fld5", '', bar),
XByteField("fld6", 0x00),
XByteField("fld7", 0x00)
]
If I construct a packet as such:
p = foo()
p.fld3 = bar(val="one")
p.fld4 = bar(val="two")
p.fld5 = bar(val="three")
p.show()
and hexdump(p)
work as expected.
However, p.show2()
builds the packet just fine but fails to dissect the packet string. Fields 1 - 3 dissect as expected (fld3.len
even gets properly calculated). Dissection stop here. The remaining bytes become Raw payload to fld3, and fields 4 - 7 get nothing.
I've attempted to bind_layers(foo, bar)
and get the same results. Based on reading here, in the scapy documentation, and in various scapy protocol files, I think something needs to be done in bar.post_dissect()
, but I'm not sure what.
How do I get bar
to relinquish its remaining raw payload back to foo
for further dissection?
FieldLenField
andStrLenField
. What is the goal of thePacket
bar
? – StephenG Jul 25 '16 at 1:32bar
is just a len:value pair. In the above case, there is more than one of these in my foo packets. But there is a use case for providing them in lists and providing multiple display formats. In the short-term, I just used foo{bar1_len, bar1_val, bar2_len, bar2_val, ... etc}. But was looking for something a bit more flexible for future usage. – B Keenan Aug 10 '16 at 14:54