Merge pull request #18 from p-l-/move-sebek-contrib

Move sebek to contrib/ (uncommon protocol)

scapy/config.py

@@ -373,7 +373,7 @@ extensions_paths: path or list of paths where extensions are to be looked for
     netcache = NetCache()
     load_layers = ["l2", "inet", "dhcp", "dns", "dot11", "gprs", "hsrp", "inet6", "ir", "isakmp", "l2tp",
                    "mgcp", "mobileip", "netbios", "netflow", "ntp", "ppp", "radius", "rip", "rtp",
-                   "sebek", "skinny", "smb", "snmp", "tftp", "x509", "bluetooth", "dhcp6", "llmnr", "sctp", "vrrp",
+                   "skinny", "smb", "snmp", "tftp", "x509", "bluetooth", "dhcp6", "llmnr", "sctp", "vrrp",
                    "ipsec" ]
     
 

scapy/layers/sebek.py → scapy/contrib/sebek.py

@@ -4,9 +4,12 @@
 ## This program is published under a GPLv2 license
 
 """
-Sebek: Linux kernel module for data collection on honeypots.
+Sebek: kernel module for data collection on honeypots.
 """
 
+# scapy.contrib.description = Sebek
+# scapy.contrib.status = loads
+
 from scapy.fields import *
 from scapy.packet import *
 from scapy.layers.inet import UDP

scapy/contrib/sebek.uts

+# Sebek layer unit tests
+#
+# Type the following command to launch start the tests:
+# $ test/run_tests -P "load_contrib('sebek')" -t scapy/contrib/sebek.uts
+
++ Sebek protocol
+
+= Layer binding 1
+pkt = IP() / UDP() / SebekHead() / SebekV1()
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 1
+
+= Packet dissection 1
+pkt = IP(str(pkt))
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 1
+
+= Layer binding 2
+pkt = IP() / UDP() / SebekHead() / SebekV2Sock()
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 2 and pkt[SebekHead].type ==2
+
+= Packet dissection 2
+pkt = IP(str(pkt))
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 2 and pkt[SebekHead].type ==2
+
+= Layer binding 3
+pkt = IPv6()/UDP()/SebekHead()/SebekV3()
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 3
+
+= Packet dissection 3
+pkt = IPv6(str(pkt))
+pkt.sport == pkt.dport == 1101 and pkt[SebekHead].version == 3