Big Sessions cleanup

Author: gpotter2

doc/scapy/layers/automotive.rst

@@ -1158,7 +1158,7 @@ then casted to ``UDS`` objects through the ``basecls`` parameter
 Usage example::
 
     with PcapReader("test/contrib/automotive/ecu_trace.pcap") as sock:
-        udsmsgs = sniff(session=ISOTPSession, session_kwargs={"use_ext_addr":False, "basecls":UDS}, count=50, opened_socket=sock)
+        udsmsgs = sniff(session=ISOTPSession(use_ext_addr=False, basecls=UDS), count=50, opened_socket=sock)
 
 
     ecu = Ecu()
@@ -1183,7 +1183,7 @@ Usage example::
     session = EcuSession()
 
     with PcapReader("test/contrib/automotive/ecu_trace.pcap") as sock:
-        udsmsgs = sniff(session=ISOTPSession, session_kwargs={"supersession": session, "use_ext_addr":False, "basecls":UDS}, count=50, opened_socket=sock)
+        udsmsgs = sniff(session=ISOTPSession(use_ext_addr=False, basecls=UDS, supersession=session)), count=50, opened_socket=sock)
 
     ecu = session.ecu
     print(ecu.log)

doc/scapy/usage.rst

@@ -783,7 +783,7 @@ Those sessions can be used using the ``session=`` parameter of ``sniff()``. Exam
 
 .. note::
    To implement your own Session class, in order to support another flow-based protocol, start by copying a sample from `scapy/sessions.py <https://github.com/secdev/scapy/blob/master/scapy/sessions.py>`_
-   Your custom ``Session`` class only needs to extend the :py:class:`~scapy.sessions.DefaultSession` class, and implement a ``on_packet_received`` function, such as in the example.
+   Your custom ``Session`` class only needs to extend the :py:class:`~scapy.sessions.DefaultSession` class, and implement a ``process`` or a ``recv`` function, such as in the examples.
 
 
 How to use TCPSession to defragment TCP packets

scapy/base_classes.py

@@ -326,6 +326,28 @@ def __new__(cls: Type[_T],
 
             dct["fields_desc"] = final_fld
 
+        # Add default dispatch_hook if a minlength_hook is present
+        if "minlength_hook" in dct:
+            minlength_hook = dct.pop("minlength_hook")
+            _dispatch_hook = dct.pop(
+                "dispatch_hook",
+                lambda *_, **__: cls
+            )
+            from scapy.config import conf
+
+            def dispatch_hook(
+                _pkt: Optional[bytes] = None,
+                *args: Any,
+                **kwargs: Any
+            ) -> Type['Packet']:
+                if _pkt and len(_pkt) < minlength_hook(_pkt):
+                    return conf.padding_layer
+                return cast(
+                    Type['Packet'],
+                    _dispatch_hook(_pkt, *args, **kwargs),
+                )
+            dct["dispatch_hook"] = dispatch_hook
+
         dct.setdefault("__slots__", [])
         for attr in ["name", "overload_fields"]:
             try:

scapy/contrib/automotive/ecu.py

@@ -469,17 +469,16 @@ class EcuSession(DefaultSession):
     """
     def __init__(self, *args, **kwargs):
         # type: (Any, Any) -> None
-        DefaultSession.__init__(self, *args, **kwargs)
         self.ecu = Ecu(logging=kwargs.pop("logging", True),
                        verbose=kwargs.pop("verbose", True),
                        store_supported_responses=kwargs.pop("store_supported_responses", True))  # noqa: E501
+        super(EcuSession, self).__init__(*args, **kwargs)
 
-    def on_packet_received(self, pkt):
-        # type: (Optional[Packet]) -> None
+    def process(self, pkt: Packet) -> Optional[Packet]:
         if not pkt:
-            return
+            return None
         self.ecu.update(pkt)
-        DefaultSession.on_packet_received(self, pkt)
+        return pkt
 
 
 class EcuResponse:

scapy/contrib/isotp/isotp_utils.py

@@ -14,12 +14,15 @@
 from scapy.utils import EDecimal
 from scapy.packet import Packet
 from scapy.sessions import DefaultSession
+from scapy.supersocket import SuperSocket
 from scapy.contrib.isotp.isotp_packet import ISOTP, N_PCI_CF, N_PCI_SF, \
     N_PCI_FF, N_PCI_FC
 
 # Typing imports
 from typing import (
+    cast,
     Iterable,
+    Iterator,
     Optional,
     Union,
     List,
@@ -336,20 +339,23 @@ class ISOTPSession(DefaultSession):
 
     def __init__(self, *args, **kwargs):
         # type: (Any, Any) -> None
-        super(ISOTPSession, self).__init__(*args, **kwargs)
         self.m = ISOTPMessageBuilder(
             use_ext_address=kwargs.pop("use_ext_address", None),
             rx_id=kwargs.pop("rx_id", None),
             basecls=kwargs.pop("basecls", ISOTP))
+        super(ISOTPSession, self).__init__(*args, **kwargs)
 
-    def on_packet_received(self, pkt):
-        # type: (Optional[Packet]) -> None
+    def recv(self, sock: SuperSocket) -> Iterator[Packet]:
+        """
+        Will be called by sniff() to ask for a packet
+        """
+        pkt = sock.recv()
         if not pkt:
             return
         self.m.feed(pkt)
         while len(self.m) > 0:
-            rcvd = self.m.pop()
-            if self._supersession:
-                self._supersession.on_packet_received(rcvd)
-            else:
-                super(ISOTPSession, self).on_packet_received(rcvd)
+            rcvd = cast(Optional[Packet], self.m.pop())
+            if rcvd:
+                rcvd = self.process(rcvd)
+            if rcvd:
+                yield rcvd

scapy/layers/dcerpc.py

@@ -91,6 +91,11 @@
     EPacketListField,
 )
 
+# Typing imports
+from typing import (
+    Optional,
+)
+
 
 # DCE/RPC Packet
 DCE_RPC_TYPE = {
@@ -1895,12 +1900,11 @@ def _process_dcerpc_packet(self, pkt):
             pkt = self._parse_with_opnum(pkt, opnum, opts)
         return pkt
 
-    def on_packet_received(self, pkt):
+    def process(self, pkt: Packet) -> Optional[Packet]:
         if DceRpc5 in pkt:
-            return super(DceRpcSession, self).on_packet_received(
-                self._process_dcerpc_packet(pkt)
-            )
-        return super(DceRpcSession, self).on_packet_received(pkt)
+            return self._process_dcerpc_packet(pkt)
+        else:
+            return pkt
 
 
 # --- TODO cleanup below

scapy/layers/inet.py

@@ -1897,7 +1897,7 @@ def parse_args(self, ip, port, *args, **kargs):
         self.src = self.l4.src
         self.sack = self.l4[TCP].ack
         self.rel_seq = None
-        self.rcvbuf = TCPSession(prn=self._transmit_packet, store=False)
+        self.rcvbuf = TCPSession()
         bpf = "host %s  and host %s and port %i and port %i" % (self.src,
                                                                 self.dst,
                                                                 self.sport,
@@ -1982,7 +1982,7 @@ def receive_data(self, pkt):
             # Answer with an Ack
             self.send(self.l4)
             # Process data - will be sent to the SuperSocket through this
-            self.rcvbuf.on_packet_received(pkt)
+            self._transmit_packet(self.rcvbuf.process(pkt))
 
     @ATMT.ioevent(ESTABLISHED, name="tcp", as_supersocket="tcplink")
     def outgoing_data_received(self, fd):

scapy/layers/netflow.py

@@ -64,11 +64,16 @@
 )
 from scapy.packet import Packet, bind_layers, bind_bottom_up
 from scapy.plist import PacketList
-from scapy.sessions import IPSession, DefaultSession
+from scapy.sessions import IPSession
 
 from scapy.layers.inet import UDP
 from scapy.layers.inet6 import IP6Field
 
+# Typing imports
+from typing import (
+    Optional,
+)
+
 
 class NetflowHeader(Packet):
     name = "Netflow Header"
@@ -1596,25 +1601,21 @@ class NetflowSession(IPSession):
     See help(scapy.layers.netflow) for more infos.
     """
     def __init__(self, *args, **kwargs):
-        IPSession.__init__(self, *args, **kwargs)
         self.definitions = {}
         self.definitions_opts = {}
         self.ignored = set()
+        super(NetflowSession, self).__init__(*args, **kwargs)
 
-    def _process_packet(self, pkt):
+    def process(self, pkt: Packet) -> Optional[Packet]:
+        pkt = super(NetflowSession, self).process(pkt)
+        if not pkt:
+            return
         _netflowv9_defragment_packet(pkt,
                                      self.definitions,
                                      self.definitions_opts,
                                      self.ignored)
         return pkt
 
-    def on_packet_received(self, pkt):
-        # First, defragment IP if necessary
-        pkt = self._ip_process_packet(pkt)
-        # Now handle NetflowV9 defragmentation
-        pkt = self._process_packet(pkt)
-        DefaultSession.on_packet_received(self, pkt)
-
 
 class NetflowOptionsRecordScopeV9(NetflowRecordV9):
     name = "Netflow Options Template Record V9/10 - Scope"

scapy/layers/tls/handshake.py

@@ -463,7 +463,7 @@ def tls_session_update(self, msg_str):
                         # RFC 8701: GREASE of TLS will send unknown versions
                         # here. We have to ignore them
                         if ver in _tls_version:
-                            self.tls_session.advertised_tls_version = ver
+                            s.advertised_tls_version = ver
                             break
                 if isinstance(e, TLS_Ext_SignatureAlgorithms):
                     s.advertised_sig_algs = e.sig_algs

scapy/layers/tls/record.py

@@ -328,6 +328,12 @@ def dispatch_hook(cls, _pkt=None, *args, **kargs):
                         return SSLv2
                     # Not SSLv2: continuation
                     return _TLSEncryptedContent
+                if plen >= 5:
+                    # Check minimum length
+                    msglen = struct.unpack('!H', _pkt[3:5])[0] + 5
+                    if plen < msglen:
+                        # This is a fragment
+                        return conf.padding_layer
                 # Check TLS 1.3
                 if s and s.tls_version == 0x0304:
                     _has_cipher = lambda x: (
@@ -567,12 +573,24 @@ def do_dissect_payload(self, s):
         as the TLS session to be used would get lost.
         """
         if s:
+            # Check minimum length
+            if len(s) < 5:
+                p = conf.raw_layer(s, _internal=1, _underlayer=self)
+                self.add_payload(p)
+                return
+            msglen = struct.unpack('!H', s[3:5])[0] + 5
+            if len(s) < msglen:
+                # This is a fragment
+                self.add_payload(conf.padding_layer(s))
+                return
             try:
                 p = TLS(s, _internal=1, _underlayer=self,
                         tls_session=self.tls_session)
             except KeyboardInterrupt:
                 raise
             except Exception:
+                if conf.debug_dissector:
+                    raise
                 p = conf.raw_layer(s, _internal=1, _underlayer=self)
             self.add_payload(p)