secdev/scapy

Native *BSD support

guedou opened this issue · 7 comments

guedou commented

I am making good progress to port the BPF mode to Scapy 2

So far, it works fine on OS X 10.9.5 but I need to write better unit tests to ensure that the patch will also work on other *BSD flavors.

Here is the teasing:

>>> sys.platform

'darwin'

>>> conf.L3socket

<L3bpfSocket: read/write packets using BPF>

>>> srp1(Ether()/IP(dst="8.8.8.8")/ICMP(), filter="host 8.8.8.8")

Begin emission:

..Finished to send 1 packets.

.*

Received 4 packets, got 1 answers, remaining 0 packets

<Ether  dst=b8:e8:56:45:8c:e6 src=3a:71:de:90:0b:64 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=28 id=0 flags= frag=0L ttl=41 proto=icmp chksum=0xcbbb src=8.8.8.8 dst=172.20.10.2 options=[] |<ICMP  type=echo-reply code=0 chksum=0xffff id=0x0 seq=0x0 |>>>
p-l- commented

Great!

guedou commented

The code is now available here: https://github.com/guedou/scapy-bpf

So far, only the IPv6 regression tests fails (but they also do with pcap/dnet) on OS X.

guedou commented

The code is still under development.The following items must be checked before committing to the main repository:

  • fix pcapdnet dependencies
  • fix Issue #109
  • add OS X to Travis CI
    • use pcapdnet.py as root
    • add BPF mode as non root
    • add BPF mode as root
  • write unit tests for functions in bpf.py and bsd.py (regression.uts & bpf.uts: 86% LOC coverage)
  • inject/sniff on the loopback interface:
    • FreeBSD & OS X: sr1() v4/v6 OK - srp1() only works for v4 ...
    • OpenBSD & NetBSD: KO on write() "Address family not supported by protocol family"
  • FreeBSD
    • tested on 10.2
    • fix run_scapy (pkg install python2 creates the python2 alias)
  • OpenBSD
    • tested on 5.5: the python2 link must be created manually
    • tested on 5.9: the python2 link must be created manually
  • NetBSD
    • tested on 7.0 (pkg_add py27-readline): the python2 link must be created manually
  • test networking & automatons
  • test pipes: a simple example works fine
krytarowski commented

Thank you for your NetBSD work.

  • 👍1
guedou commented

@krytarowski Thanks for your support ! I have a special relation with NetBSD as I used it a lot few years ago =) I won't be able to test the code on something else than amd64. If you have access to other architectures, I will be pleased to fix the bugs (if any).

krytarowski commented

Lately I'm focused on amd64.

guedou commented

PR #221 includes this patch, and is waiting to be reviewed.