diff --git a/scapy/config.py b/scapy/config.py index 42f65242007d0e39f16d10fc3f20168fef319631..14d024abfebea7e61a528e826381bd116bd2b847 100644 --- a/scapy/config.py +++ b/scapy/config.py @@ -373,7 +373,7 @@ extensions_paths: path or list of paths where extensions are to be looked for netcache = NetCache() load_layers = ["l2", "inet", "dhcp", "dns", "dot11", "gprs", "hsrp", "inet6", "ir", "isakmp", "l2tp", "mgcp", "mobileip", "netbios", "netflow", "ntp", "ppp", "radius", "rip", "rtp", - "sebek", "skinny", "smb", "snmp", "tftp", "x509", "bluetooth", "dhcp6", "llmnr", "sctp", "vrrp", + "skinny", "smb", "snmp", "tftp", "x509", "bluetooth", "dhcp6", "llmnr", "sctp", "vrrp", "ipsec" ] diff --git a/scapy/layers/sebek.py b/scapy/contrib/sebek.py similarity index 97% rename from scapy/layers/sebek.py rename to scapy/contrib/sebek.py index c54e6728f2e0a3f9e4e34d2267afb16b75a02cd6..f43ee259df290e80dff4a7e3f82c2655c9c3c6bf 100644 --- a/scapy/layers/sebek.py +++ b/scapy/contrib/sebek.py @@ -4,9 +4,12 @@ ## This program is published under a GPLv2 license """ -Sebek: Linux kernel module for data collection on honeypots. +Sebek: kernel module for data collection on honeypots. """ +# scapy.contrib.description = Sebek +# scapy.contrib.status = loads + from scapy.fields import * from scapy.packet import * from scapy.layers.inet import UDP diff --git a/scapy/contrib/sebek.uts b/scapy/contrib/sebek.uts new file mode 100644 index 0000000000000000000000000000000000000000..de1be6b98cec454b87562ddb66e4a55c5fde599d --- /dev/null +++ b/scapy/contrib/sebek.uts @@ -0,0 +1,30 @@ +# Sebek layer unit tests +# +# Type the following command to launch start the tests: +# $ test/run_tests -P "load_contrib('sebek')" -t scapy/contrib/sebek.uts + ++ Sebek protocol + += Layer binding 1 +pkt = IP() / UDP() / SebekHead() / SebekV1() +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 1 + += Packet dissection 1 +pkt = IP(str(pkt)) +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 1 + += Layer binding 2 +pkt = IP() / UDP() / SebekHead() / SebekV2Sock() +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 2 and pkt[SebekHead].type ==2 + += Packet dissection 2 +pkt = IP(str(pkt)) +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 2 and pkt[SebekHead].type ==2 + += Layer binding 3 +pkt = IPv6()/UDP()/SebekHead()/SebekV3() +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 3 + += Packet dissection 3 +pkt = IPv6(str(pkt)) +pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 3