Ticket #117: scapy_eigrp.py

#!/usr/bin/env python
"""
    EIGRP Scapy Extension
    ~~~~~~~~~~~~~~~~~~~~~

    :version:   2008-04-27
    :copyright: 2008 by Jochen Bartl
    :e-mail:    lobo@c3a.de
    :license:   GPL v2

        This program is free software; you can redistribute it and/or
        modify it under the terms of the GNU General Public License
        as published by the Free Software Foundation; either version 2
        of the License, or (at your option) any later version.

        This program is distributed in the hope that it will be useful,
        but WITHOUT ANY WARRANTY; without even the implied warranty of
        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        GNU General Public License for more details.

    :Thanks:

    - TLV code derived from the CDP implementation of scapy. (Thanks to Nicolas Bareil and Arnaud Ebalard)
        http://trac.secdev.org/scapy/ticket/18
    - IOS / EIGRP Version Representation FIX by Dirk Loss
"""

from scapy import *

class EigrpIPField(StrField):
    """
    This is a special field type for handling ip addresses of destination networks in internal and
    external route updates.

    EIGRP removes zeros from the host portion of the ip address if the netmask is 8, 16 or 24 bits.
    """

    def __init__(self, name, default, fld=None, length_from=None, shift=0):
        StrField.__init__(self, name, default, shift=shift)
        self.length_from = length_from
        if fld is not None or shift != 0:
            FIELD_LENGTH_MANAGEMENT_DEPRECATION(self.__class__.__name__)
            self.length_from = lambda pkt,fld=fld,shift=shift: getattr(pkt,fld)-shift

    def h2i(self, pkt, x):
        if type(x) is str:
            try:
                inet_aton(x)
            except socket.error:
                print x
                x = Net(x)
        elif type(x) is list:
            x = [self.h2i(pkt, n) for n in x]
        return x

    def i2m(self, pkt, x):
        x = inet_aton(x)
        l = self.length_from(pkt)
        if l <= 8:
            return x[:1]
        elif l <= 16:
            return x[:2]
        elif l <= 24:
            return x[:3]
        else:
            return x

    def m2i(self, pkt, x):
        l = self.length_from(pkt)
        if l <= 8:
            x += "\x00\x00\x00"
        elif l <= 16:
            x += "\x00\x00"
        elif l <= 24:
            x += "\x00"

        return inet_ntoa(x)

    def getfield(self, pkt, s):
        l = self.length_from(pkt)
        if l <= 8:
            l = 8
        elif l <= 16:
            l = 16
        elif l <= 24:
            l = 24
        else:
            l = 32

        return s[l:], self.m2i(pkt,s[:l])

class EIGRPParam(Packet):
    name = "EIGRP Parameters"
    fields_desc = [ XShortField("type", 0x0001),
            ShortField("len", 12),
            ByteField("k1", 1),
            ByteField("k2", 0),
            ByteField("k3", 1),
            ByteField("k4", 0),
            ByteField("k5", 0),
            ByteField("reserved", 0),
            ShortField("holdtime", 15)
            ]

    def guess_payload_class(self, p):
        return Padding

class EIGRPAuthData(Packet):
    name = "EIGRP Authentication Data"
    fields_desc = [ XShortField("type", 0x0002),
            FieldLenField("len", None, "authdata", "!H", adjust=lambda pkt,x: x + 4),
            ShortField("authtype", 2),
            ShortField("keysize", 16),
            IntField("keyid", 1),
            StrFixedLenField("nullpad", "\x00" * 12, 12),
            StrLenField("authdata", RandString(36), length_from=lambda pkt: pkt.len - 24),
            ]

    def guess_payload_class(self, p):
        return Padding

class EIGRPSeq(Packet):
    name = "EIGRP Sequence"
    fields_desc = [ XShortField("type", 0x0003),
            ShortField("len", 9),
            ByteField("addrlen", 4),
            IPField("ipaddr", "192.168.0.1")
            ]

    def guess_payload_class(self, p):
        return Padding

class ShortVersionField(ShortField):
    def i2repr(self, pkt, x):
        try:
            minor = x & 0xff
            major = (x >> 8) & 0xff
        except TypeError:
            return "unknown"
        else:
            # We print a leading 'v' so that these values don't look like floats
            return "v%s.%s" % (major, minor)


class EIGRPSwVer(Packet):
    name = "EIGRP Software Version"
    fields_desc = [ XShortField("type", 0x0004),
            ShortField("len", 8),
            ShortVersionField("ios", 3072), # v12.0
            ShortVersionField("eigrp", 258) # v1.2
            ]

    def guess_payload_class(self, p):
        return Padding

class EIGRPNms(Packet):
    name = "EIGRP Next Multicast Sequence"
    fields_desc = [ XShortField("type", 0x0005),
            ShortField("len", 8),
            IntField("nms", 144)
            ]

    def guess_payload_class(self, p):
        return Padding

class EIGRPIntRoute(Packet):
    name = "EIGRP Internal Route"
    fields_desc = [ XShortField("type", 0x0102),
            FieldLenField("len", None, "dst", "!H", adjust=lambda pkt,x: x + 25),
            IPField("nexthop", "192.168.0.0"),
            IntField("delay", 0),
            IntField("bandwidth", 0),
            X3BytesField("MTU", 1500),
            ByteField("hopcount", 0),
            ByteField("reliability", 0),
            ByteField("load", 0),
            XShortField("reserved", 0),
            ByteField("prefixlen", 24),
            EigrpIPField("dst", "", length_from=lambda pkt: pkt.prefixlen),
            ]

    def guess_payload_class(self, p):
        return Padding

class EIGRPExtRoute(Packet):
    name = "EIGRP External Route"
    fields_desc = [ XShortField("type", 0x0103),
            FieldLenField("len", None, "dst", "!H", adjust=lambda pkt,x: x + 25),
            IPField("nexthop", "192.168.0.0"),
            IPField("originrouter", "192.168.0.1"),
            IntField("originasn", 0),
            IntField("tag", 0),
            IntField("externalmetric", 0),
            ShortField("reserved", 0),
            ByteField("extprotocolid", 3),
            XByteField("flags", 0x0),
            IntField("delay", 0),
            IntField("bandwidth", 256),
            X3BytesField("MTU", 1500),
            ByteField("hopcount", 0),
            ByteField("reliability", 0),
            ByteField("load", 0),
            XShortField("reserved", 0),
            ByteField("prefixlen", 24),
            EigrpIPField("dst", "", length_from=lambda pkt: pkt.prefixlen)
            ]

    def guess_payload_class(self, p):
        return Padding

# TODO: Stuck-In-Active Messgeas

_eigrp_tlv_cls = {
                    0x0001: "EIGRPParam",
                    0x0002: "EIGRPAuthData",
                    0x0003: "EIGRPSeq",
                    0x0004: "EIGRPSwVer",
                    0x0005: "EIGRPNms",
                    0x0102: "EIGRPIntRoute",
                    0x0103: "EIGRPExtRoute"
                   }

class RepeatedTlvListField(PacketListField):
    def __init__(self, name, default, cls):
        PacketField.__init__(self, name, default, cls)

    def getfield(self, pkt, s):
        lst = []
        remain = s
        while len(remain) > 0:
            p = self.m2i(pkt,remain)
            if Padding in p:
                pad = p[Padding]
                remain = pad.load
                del(pad.underlayer.payload)
            else:
                remain = ""
            lst.append(p)
        return remain,lst

    def addfield(self, pkt, s, val):
        return s+reduce(str.__add__, map(str, val),"")

def _EIGRPGuessPayloadClass(p, **kargs):
    cls = Raw
    if len(p) >= 2:
        t = struct.unpack("!H", p[:2])[0]
        clsname = _eigrp_tlv_cls.get(t, "Raw")
        cls = globals()[clsname]
        return cls(p, **kargs)

_EIGRP_OPCODES = { 1 : "Update",
                   2 : "Request",
                   3 : "Query",
                   4 : "Replay",
                   5 : "Hello" }

class EIGRP(Packet):
    name = "EIGRP"
    fields_desc = [ ByteField("ver", 2),
                    ByteEnumField("opcode", 5, _EIGRP_OPCODES),
                    XShortField("chksum", None),
                    XIntField("flags", 0),
                    IntField("seq", 0),
                    IntField("ack", 0),
                    IntField("asn", 100),
                    RepeatedTlvListField("tlvlist", [], _EIGRPGuessPayloadClass)
                 ]

    def post_build(self, p, pay):
        p += pay
        if self.chksum is None:
            c = checksum(p)
            p = p[:2] + chr((c>>8)&0xff)+chr(c&0xff) + p[4:]
        return p

    def mysummary(self):
        return self.sprintf("EIGRP (AS=%EIGRP.asn% Opcode=%EIGRP.opcode% Flags=%EIGRP.flags%)")


bind_layers( IP, EIGRP, proto=88)

if __name__ == "__main__":
    interact(mydict=globals(), mybanner="EIGRP")