xbase-util 0.9.1__tar.gz → 0.9.3__tar.gz

{xbase_util-0.9.1 → xbase_util-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xbase_util
-Version: 0.9.1
+Version: 0.9.3
 Summary: 网络安全基础工具
 Home-page: https://gitee.com/jimonik/xbase_util.git
 Author: xyt

{xbase_util-0.9.1 → xbase_util-0.9.3}/setup.py

@@ -3,7 +3,7 @@ from distutils.core import setup
 from setuptools import find_packages
 
 setup(name="xbase_util",
-      version="0.9.1",
+      version="0.9.3",
       description="网络安全基础工具",
       long_description="包含提取，预测，训练的基础工具",
       author="xyt",

{xbase_util-0.9.1 → xbase_util-0.9.3}/xbase_util/common_util.py

@@ -26,7 +26,7 @@ def filter_visible_chars(data):
     return ''.join(chr(b) for b in data if 32 <= b <= 126 or b in (9, 10, 13))
 
 
-def parse_chunked_body(data: bytes,session_id="none",skey='') -> bytes:
+def parse_chunked_body(data: bytes,need_un_gzip=False,session_id="none",skey='') -> bytes:
     try:
         body = b''
         while True:
@@ -41,13 +41,13 @@ def parse_chunked_body(data: bytes,session_id="none",skey='') -> bytes:
             chunk_end = chunk_start + chunk_size
             body += data[chunk_start:chunk_end]
             data = data[chunk_end + 2:]
-        # if need_un_gzip:
-        #     try:
-        #         return gzip.decompress(body)
-        #     except gzip.BadGzipFile:
-        #         print(f"解压错误:{session_id}")
-        #         return body
-        # else:
+        if need_un_gzip:
+            try:
+                return gzip.decompress(body)
+            except gzip.BadGzipFile:
+                print(f"解压错误:{session_id}")
+                return body
+        else:
             return body
     except Exception as e:
         traceback.print_exc()

{xbase_util-0.9.1 → xbase_util-0.9.3}/xbase_util/pcap_util.py

@@ -4,6 +4,7 @@ import math
 import os
 import struct
 import time
+import traceback
 import zlib
 from functools import cmp_to_key
 
@@ -246,9 +247,7 @@ def get_file_and_read_pos(session_id, file, pos_list):
         packets[i] = packet_bytes
         while next_packet in packets:
             buffer = packets[next_packet]
-
-            next_packet += 1
-            # del packets[next_packet]
+            del packets[next_packet]
             next_packet = next_packet + 1
             if b_offset + len(buffer) > len(byte_array):
                 res.extend(byte_array[:b_offset])
@@ -274,7 +273,7 @@ def process_session_id_disk_simple(id, node, packet_pos, esdb, pcap_path_prefix)
     return get_file_and_read_pos(id, file, pos_list)
 
 
-def parse_body(data,skey='',session_id='none'):
+def parse_body(data, skey='', session_id='none'):
     if data.find(b"\r\n\r\n") != -1:
         res = data.split(b"\r\n\r\n", 1)
         header = res[0]
@@ -284,22 +283,24 @@ def parse_body(data,skey='',session_id='none'):
         body = b''
     chunked_pattern = pattern_chuncked.search(header)
     gzip_pattern = pattern_gzip.search(header)
+    need_unzip = gzip_pattern and b'gzip' in gzip_pattern.group()
     if chunked_pattern and b'chunked' in chunked_pattern.group():
-        body = parse_chunked_body(body,session_id=session_id,skey=skey)
-    if gzip_pattern and b'gzip' in gzip_pattern.group():
+        body = parse_chunked_body(body, need_un_gzip=need_unzip, session_id=session_id, skey=skey)
+    elif need_unzip:
         try:
             body = gzip.decompress(body)
-        except:
+        except Exception as e:
+            traceback.print_exc()
             print(f"解压失败:{skey} {session_id}")
+            body = b''
     return filter_visible_chars(header), filter_visible_chars(body)
 
 
 def reassemble_session_pcap(reassemble_tcp_res, skey, session_id='none'):
-    my_map = None  # 初始化为 None
+    my_map = None
     packet_list = []
     for packet in reassemble_tcp_res:
-        header, body = parse_body(packet['data'],skey=skey, session_id=session_id)
-        # 如果当前数据包是请求
+        header, body = parse_body(packet['data'], skey=skey, session_id=session_id)
         if packet['key'] == skey:
             if my_map is not None:
                 packet_list.append(copy.deepcopy(my_map))
@@ -400,8 +401,6 @@ def reassemble_tcp_pcap(p):
         return a_ack - (b_seq + len(b_data) - 1)
 
     packets2.sort(key=cmp_to_key(compare_packets))
-    # del packets[num_packets:]
-    # Now divide up conversation
     clientSeq = 0
     hostSeq = 0
     previous = 0

{xbase_util-0.9.1 → xbase_util-0.9.3}/xbase_util/test.py

@@ -3,7 +3,7 @@ from scapy.utils import rdpcap
 from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
 
 if __name__ == '__main__':
-    packets_scapy = reassemble_tcp_pcap(rdpcap("test.pcap"))
-    skey = '10.28.7.6:53867'
-    all_packets = reassemble_session_pcap(packets_scapy, skey=skey,session_id='enn')
+    packets_scapy = reassemble_tcp_pcap(rdpcap("test1.pcap"))
+    skey = '10.28.7.53:58598'
+    all_packets = reassemble_session_pcap(packets_scapy, skey=skey,session_id='emmmmm')
     print(all_packets)

{xbase_util-0.9.1 → xbase_util-0.9.3}/xbase_util.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xbase-util
-Version: 0.9.1
+Version: 0.9.3
 Summary: 网络安全基础工具
 Home-page: https://gitee.com/jimonik/xbase_util.git
 Author: xyt