xbase-util 0.7.3__tar.gz → 0.7.4__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {xbase_util-0.7.3 → xbase_util-0.7.4}/PKG-INFO +1 -1
- {xbase_util-0.7.3 → xbase_util-0.7.4}/setup.py +1 -1
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/packet_util.py +2 -33
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/segment.py +6 -4
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.7.3 → xbase_util-0.7.4}/README.md +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/setup.cfg +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/__init__.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/esreq.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/pcap_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util/xbase_util.py +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.7.3 → xbase_util-0.7.4}/xbase_util_assets/arkimeparse.js +0 -0
@@ -70,37 +70,6 @@ http_req_method = re.compile(r"(GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH) \/[^\s]*
|
|
70
70
|
http_req_path = re.compile(r"(?:GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH)\s+(\/[^\s]*)\s+HTTP\/\d\.\d")
|
71
71
|
res_status_code_pattern = re.compile(r"HTTP\/\d\.\d\s+(\d{3})\s+.*")
|
72
72
|
|
73
|
-
|
74
|
-
# def get_all_packets_by_reg(packets):
|
75
|
-
# http_Req_Raw = {}
|
76
|
-
# http_methods = ("POST /", "PUT /", "OPTIONS /", "DELETE /", "GET /")
|
77
|
-
# for packet in packets:
|
78
|
-
# if TCP in packet and Raw in packet:
|
79
|
-
# data = packet[Raw].load
|
80
|
-
# ack = packet[TCP].ack
|
81
|
-
# next_ack = packet[TCP].seq + len(data)
|
82
|
-
# if ack not in http_Req_Raw:
|
83
|
-
# http_Req_Raw[ack] = {"time": [float(packet.time)], "data": data, "next_ack": next_ack}
|
84
|
-
# else:
|
85
|
-
# http_Req_Raw[ack]["time"].append(float(packet.time))
|
86
|
-
# http_Req_Raw[ack]["data"] += data
|
87
|
-
# http_Req_Raw[ack]["next_ack"] = next_ack
|
88
|
-
# packet_list = [
|
89
|
-
# {
|
90
|
-
# 'req_data': item['data'],
|
91
|
-
# 'res_data': http_Req_Raw[item['next_ack']]['data'],
|
92
|
-
# 'req_text': filter_visible_chars(item['data']),
|
93
|
-
# 'res_text': filter_visible_chars(http_Req_Raw[item['next_ack']]['data']),
|
94
|
-
# 'req_time': item['time'],
|
95
|
-
# 'res_time': http_Req_Raw[item['next_ack']]['time']
|
96
|
-
# }
|
97
|
-
# for ack, item in http_Req_Raw.items()
|
98
|
-
# if item['next_ack'] in http_Req_Raw # 检查 next_ack 是否存在
|
99
|
-
# and any(method in filter_visible_chars(item['data']) for method in http_methods)
|
100
|
-
# ]
|
101
|
-
# return packet_list
|
102
|
-
|
103
|
-
|
104
73
|
def get_header_value(header_set, value):
|
105
74
|
result = [item for item in header_set if value in item]
|
106
75
|
if len(result) != 0:
|
@@ -139,9 +108,9 @@ def get_detail_by_package(publicField, req_header, req_body, res_header, res_bod
|
|
139
108
|
res_field['plain_body_src'] = ""
|
140
109
|
res_field['plain_body_dst'] = ""
|
141
110
|
if content_type_is_plain(req_header):
|
142
|
-
res_field['plain_body_src'] =
|
111
|
+
res_field['plain_body_src'] = req_body
|
143
112
|
if content_type_is_plain(res_header):
|
144
|
-
res_field['plain_body_dst'] =
|
113
|
+
res_field['plain_body_dst'] = res_body
|
145
114
|
|
146
115
|
http_server_version_res = http_version.findall(res_header)
|
147
116
|
res_field['http.serverVersion'] = http_server_version_res[0] if len(http_server_version_res) > 0 else ""
|
@@ -8,6 +8,8 @@ import numpy as np
|
|
8
8
|
from scapy.all import *
|
9
9
|
from scapy.layers.inet import TCP
|
10
10
|
|
11
|
+
from xbase_util.packet_util import filter_visible_chars
|
12
|
+
|
11
13
|
REQUEST_LINE_RE = re.compile(rb"^(GET|POST|PUT|DELETE|OPTIONS|HEAD|PATCH)\s[^\r\n]+\r\n", re.MULTILINE)
|
12
14
|
RESPONSE_LINE_RE = re.compile(rb"^HTTP/\d\.\d\s+\d{3}\s?[^\r\n]*", re.IGNORECASE)
|
13
15
|
|
@@ -104,13 +106,13 @@ def parse_req_or_res(data, pkts):
|
|
104
106
|
|
105
107
|
decompressed = gzip.decompress(result_body)
|
106
108
|
result_body_str = "\n".join(
|
107
|
-
[line.strip() for line in decompressed
|
109
|
+
[line.strip() for line in filter_visible_chars(decompressed).splitlines() if
|
108
110
|
line.strip() != ""])
|
109
111
|
except Exception as e:
|
110
|
-
result_body_str = result_body
|
112
|
+
result_body_str = filter_visible_chars(result_body)
|
111
113
|
else:
|
112
|
-
result_body_str = result_body
|
113
|
-
return header
|
114
|
+
result_body_str = filter_visible_chars(result_body)
|
115
|
+
return filter_visible_chars(header), result_body_str, [float(pkt.time) for pkt in pkts]
|
114
116
|
|
115
117
|
|
116
118
|
def get_all_packets_by_segment(packets):
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|