One can now use tcpdump or tshark to dissect packets from
Scapy. This can help, for example, to check Scapy's dissectors

This fixes at least an issue fragmentation (for which a new test
has been added)

* Add conf.checkIPinIP

This setting, when set to False, will exclude IP layers which encapsulate
another IP layer from the checks to tell if a packet is an answer to
another one.

Fixes #383

* conf.checkIPinIP affects both IP() and IPv6()

Setting conf.checkIPinIP will handle IP()/IP(), IP()/IPv6(),
IPv6()/IP(), IPv6()/IPv6().

Thanks @guedou!

* Clean-up IP.hashret and .answers code

* Add tests for .hashret() and .answers()

* Support (BPF) filter in sniff() with offline parameter set

Fixes #393
Also, fixes #355

* Add tests for wrpcap() and sniff(offline=)

as suggested by Guillaume.

Also, cleanup regression.uts since it was a pain to find a place
to add those tests.

* Fix PATH for tcpdump with non-root user

* Do not run tcpdump tests when tcpdump is not available

* Appveyor tests: install WinDump.exe

Thanks @gpotter2

- original patch from Yitai Schwartz, https://bitbucket.org/secdev/scapy/pull-requests/62/

The "NextProtocol" field was added as an unconditional field which made the
VXLAN packet header consume an additional 8-bts when used in a Legacy VXLAN
deployments (flags=0x08) or in GPID deployments (flags=0x88).  The resulting
regression caused incorrect parsing of subsequent headers.  For example, if an
Ethernet header followed the VXLAN header then it would not be interpreted as
an Ethernet header.  The actually interpretation would depend on what value was
stored in the Ether.dst field.

This change updates the field layout specification such that the NextProtocol
field is conditional on flags=0x04, and shortens the reserved field by 8-bits
if that condition is true.

fixes bug #281

Signed-off-by: Allain Legacy <allain.legacy@windriver.com>

Testing:
Updated dhcp6 regression tests

Since part of the previously reserved Bytes are now used to annouce
the next header, this also updates the vxlan unit tests.

Original commit by: Christophe Fontaine <christophe.fontaine@qosmos.com>

Signed-off-by: Gabriel Ganne <gabriel.ganne@qosmos.com>

When interface names are longer than 7 characters, netstat will truncate
them to the first 7 chars which leads to looking up an invalid interface
name.
We attempt to guess the name of the interface based on the output of
ifconfig -l. If there is only one candidate we consider it, otherwise we
ignore it.

* References to the 'Raw' class were replaced by conf.raw_layer.
* Fix potential infinite loop in NTPExtPacketListField::getfield() + typo.
* Added regression test (Extension dissection test).

* layers/vxlan: add group policy extension support
This is based on the following draft RFC:
http://tools.ietf.org/html/draft-smith-vxlan-group-policy-00



Add more unit tests in regression.uts.

Signed-off-by: Robin Jarry <robin.jarry@6wind.com>

* Move VXLAN to layers

VXLAN has an official RFC: http://tools.ietf.org/html/rfc7348


It should be in automatically loaded layers.

Move tests to regression.uts.

Signed-off-by: Robin Jarry <robin.jarry@6wind.com>

* load_contrib: fallback to layers when contrib not found

Useful when a scapy.contrib module has been moved to scapy.layers.

Signed-off-by: Robin Jarry <robin.jarry@6wind.com>

When using scapy as a third party library, we do not "benefit" from the
loading routine that puts all symbols in the __builtin__ namespace. This
implies that all modules must be "importable" without any errors for
undefined symbols.

This patch fixes importing every scapy module individually. Some
circular imports were fixed (between inet6 and dhcp6).

Most errors were detected by using pylint with the right configuration
(scapy produces a *lot* of errors). Other errors were detected with the
following shell script:

    export PYTHONPATH=".:$PYTHONPATH"
    for f in $(find scapy/ -name '*.py'); do
        f=${f%/__init__.py}
        module=$(echo ${f%.py} | sed 's,/,.,g')
        python -c "import $module; print $module"
    done

Also, replace all implicit relative imports by absolute imports to avoid
surprises with some python versions.

Signed-off-by: Robin Jarry <robin.jarry@6wind.com>

EAPOL / EAP updates and regression tests

Allow one to send the TCP User Timeout Option described in RFC 5482 in
a crafted TCP segment.
Also added unit tests in new "TCP options" section of
test/regression.uts

Insert DER test data inside x509.uts and move it from scapy/layers/ to test/ (also, remove obsolete X.509 tests from test/regression.uts

As suggested by @guedou, this adds tests for fragment() and
defragment() functions.