Skip to content

Commit 739d314

Browse files
jingfeihujingfeihu
committed
Support Inband Flow Analyzer (IFA)
1.support IFA over ipv4/ipv6 + udp/tcp/vxlan/gre/geneve 2.add IFA unit tests
1 parent 1346522 commit 739d314

File tree

4 files changed

+388
-8
lines changed

4 files changed

+388
-8
lines changed

‎scapy/contrib/ifa.py

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# SPDX-License-Identifier: GPL-2.0-or-later
2+
# This file is part of Scapy
3+
# See https://scapy.net/ for more information
4+
# Copyright (C) 2024 Jingfei Hu <[email protected]>
5+
6+
# scapy.contrib.description = Inband Flow Analyzer Protocol (IFA)
7+
# scapy.contrib.status = loads
8+
9+
'''
10+
Inband Flow Analyzer Protocol (IFA)
11+
12+
References:
13+
https://datatracker.ietf.org/doc/html/draft-kumar-ippm-ifa-08
14+
'''
15+
16+
import struct
17+
import socket
18+
from scapy.data import IP_PROTOS
19+
from scapy.layers.l2 import Ether, GRE
20+
from scapy.layers.inet import IP, TCP, UDP
21+
from scapy.layers.inet6 import IPv6
22+
from scapy.layers.vxlan import VXLAN
23+
from scapy.contrib.geneve import GENEVE
24+
from scapy.packet import Packet, bind_layers
25+
from scapy.fields import BitField, BitEnumField, FlagsField, \
26+
ByteField, ByteEnumField, ShortField, IntField, PacketListField
27+
28+
IPPROTO_IFA = 131
29+
IP_PROTOS[IPPROTO_IFA] = 'IFA'
30+
31+
_ifa_flags = [
32+
'C', # Checksum
33+
'TA', # Turn Around
34+
'I', # Inband
35+
'TS', # Tail Stamp
36+
'MF', # Metadata Fragment
37+
'R', # Reserved
38+
'R', # Reserved
39+
'R', # Reserved
40+
]
41+
42+
_ifa_action = [
43+
'R', # Reserved
44+
'R', # Reserved
45+
'R', # Reserved
46+
'R', # Reserved
47+
'R', # Reserved
48+
'R', # Reserved
49+
'C', # Color bit to mark the packet
50+
'L', # Loss bit to measure packet loss
51+
]
52+
53+
_ifa_speed = {
54+
0: '10Gbps',
55+
1: '25Gbps',
56+
2: '40Gbps',
57+
3: '50Gbps',
58+
4: '100Gbps',
59+
5: '200Gbps',
60+
6: '400Gbps',
61+
}
62+
63+
64+
class IFA(Packet):
65+
name = 'IFA'
66+
fields_desc = [
67+
BitField('ver', 3, 4),
68+
BitField('gns', 0, 4),
69+
ByteEnumField("nexthdr", 0, IP_PROTOS),
70+
FlagsField("flags", 0, 8, _ifa_flags),
71+
ByteField('maxlen', 255),
72+
]
73+
74+
75+
class IFAMd(Packet):
76+
name = 'IFAMd'
77+
fields_desc = [
78+
BitField('lns', 0, 4),
79+
BitField('device_id', 0, 20),
80+
ByteField('ttl', 0),
81+
BitEnumField('speed', 0, 4, _ifa_speed),
82+
BitField('ecn', 0, 2),
83+
BitField('qid', 0, 6),
84+
BitField('rx_sec', 0, 20),
85+
ShortField('dport', 0),
86+
ShortField('sport', 0),
87+
IntField('rx_nsec', 0),
88+
IntField('latency', 0),
89+
IntField('qbytes', 0),
90+
ShortField('rsvd0', 0),
91+
ShortField('qcells', 0),
92+
IntField('rsvd1', 0),
93+
]
94+
95+
def extract_padding(self, s):
96+
return "", s
97+
98+
99+
class IFAMdHdr(Packet):
100+
name = 'IFAMdHdr'
101+
fields_desc = [
102+
ByteField('request', 0),
103+
FlagsField("action", 0, 8, _ifa_action),
104+
ByteField('hoplmt', 128),
105+
ByteField('curlen', 0),
106+
PacketListField("mdstack", None, IFAMd,
107+
length_from=lambda pkt: pkt.curlen * 4)
108+
]
109+
110+
def post_build(self, p, pay):
111+
mdlen = (len(p) - 4) // 4
112+
if self.curlen != mdlen:
113+
p = p[:3] + struct.pack("!B", mdlen) + p[4:]
114+
return p + pay
115+
116+
def guess_payload_class(self, payload):
117+
if isinstance(self.underlayer, UDP):
118+
if self.underlayer.dport in [4789, 4790]:
119+
return VXLAN
120+
elif self.underlayer.dport == 6081:
121+
return GENEVE
122+
elif isinstance(self.underlayer, GRE):
123+
if self.underlayer.proto == 0x6558:
124+
return Ether
125+
if self.underlayer.proto == 0x0800:
126+
return IP
127+
if self.underlayer.proto == 0x86dd:
128+
return IPv6
129+
return Packet.guess_payload_class(self, payload)
130+
131+
132+
bind_layers(IP, IFA, proto=IPPROTO_IFA)
133+
bind_layers(IPv6, IFA, nh=IPPROTO_IFA)
134+
bind_layers(IFA, TCP, nexthdr=socket.IPPROTO_TCP)
135+
bind_layers(IFA, UDP, nexthdr=socket.IPPROTO_UDP)
136+
bind_layers(IFA, GRE, nexthdr=socket.IPPROTO_GRE)

‎scapy/layers/inet.py

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -757,11 +757,15 @@ def post_build(self, p, pay):
757757
dataofs = (dataofs << 4) | orb(p[12]) & 0x0f
758758
p = p[:12] + chb(dataofs & 0xff) + p[13:]
759759
if self.chksum is None:
760-
if isinstance(self.underlayer, IP):
761-
ck = in4_chksum(socket.IPPROTO_TCP, self.underlayer, p)
760+
_underlayer = self.underlayer
761+
from scapy.contrib.ifa import IFA
762+
if isinstance(self.underlayer, IFA):
763+
_underlayer = self.underlayer.underlayer
764+
if isinstance(_underlayer, IP):
765+
ck = in4_chksum(socket.IPPROTO_TCP, _underlayer, p)
762766
p = p[:16] + struct.pack("!H", ck) + p[18:]
763-
elif conf.ipv6_enabled and isinstance(self.underlayer, scapy.layers.inet6.IPv6) or isinstance(self.underlayer, scapy.layers.inet6._IPv6ExtHdr): # noqa: E501
764-
ck = scapy.layers.inet6.in6_chksum(socket.IPPROTO_TCP, self.underlayer, p) # noqa: E501
767+
elif conf.ipv6_enabled and isinstance(_underlayer, scapy.layers.inet6.IPv6) or isinstance(_underlayer, scapy.layers.inet6._IPv6ExtHdr): # noqa: E501
768+
ck = scapy.layers.inet6.in6_chksum(socket.IPPROTO_TCP, _underlayer, p) # noqa: E501
765769
p = p[:16] + struct.pack("!H", ck) + p[18:]
766770
else:
767771
log_runtime.info(
@@ -814,6 +818,12 @@ def mysummary(self):
814818
else:
815819
return self.sprintf("TCP %TCP.sport% > %TCP.dport% %TCP.flags%")
816820

821+
def guess_payload_class(self, payload):
822+
from scapy.contrib.ifa import IFA, IFAMdHdr
823+
if isinstance(self.underlayer, IFA):
824+
return IFAMdHdr
825+
return Packet.guess_payload_class(self, payload)
826+
817827

818828
class UDP(Packet):
819829
name = "UDP"
@@ -829,14 +839,18 @@ def post_build(self, p, pay):
829839
tmp_len = len(p)
830840
p = p[:4] + struct.pack("!H", tmp_len) + p[6:]
831841
if self.chksum is None:
832-
if isinstance(self.underlayer, IP):
833-
ck = in4_chksum(socket.IPPROTO_UDP, self.underlayer, p)
842+
_underlayer = self.underlayer
843+
from scapy.contrib.ifa import IFA
844+
if isinstance(self.underlayer, IFA):
845+
_underlayer = self.underlayer.underlayer
846+
if isinstance(_underlayer, IP):
847+
ck = in4_chksum(socket.IPPROTO_UDP, _underlayer, p)
834848
# According to RFC768 if the result checksum is 0, it should be set to 0xFFFF # noqa: E501
835849
if ck == 0:
836850
ck = 0xFFFF
837851
p = p[:6] + struct.pack("!H", ck) + p[8:]
838-
elif isinstance(self.underlayer, scapy.layers.inet6.IPv6) or isinstance(self.underlayer, scapy.layers.inet6._IPv6ExtHdr): # noqa: E501
839-
ck = scapy.layers.inet6.in6_chksum(socket.IPPROTO_UDP, self.underlayer, p) # noqa: E501
852+
elif isinstance(_underlayer, scapy.layers.inet6.IPv6) or isinstance(_underlayer, scapy.layers.inet6._IPv6ExtHdr): # noqa: E501
853+
ck = scapy.layers.inet6.in6_chksum(socket.IPPROTO_UDP, _underlayer, p) # noqa: E501
840854
# According to RFC2460 if the result checksum is 0, it should be set to 0xFFFF # noqa: E501
841855
if ck == 0:
842856
ck = 0xFFFF
@@ -870,6 +884,12 @@ def mysummary(self):
870884
else:
871885
return self.sprintf("UDP %UDP.sport% > %UDP.dport%")
872886

887+
def guess_payload_class(self, payload):
888+
from scapy.contrib.ifa import IFA, IFAMdHdr
889+
if isinstance(self.underlayer, IFA):
890+
return IFAMdHdr
891+
return Packet.guess_payload_class(self, payload)
892+
873893

874894
# RFC 4884 ICMP extensions
875895
_ICMP_classnums = {

‎scapy/layers/l2.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,12 @@ def post_build(self, p, pay):
668668
p = p[:4] + chb((c >> 8) & 0xff) + chb(c & 0xff) + p[6:]
669669
return p
670670

671+
def guess_payload_class(self, payload: bytes) -> Type[Packet]:
672+
from scapy.contrib.ifa import IFA, IFAMdHdr
673+
if isinstance(self.underlayer, IFA):
674+
return IFAMdHdr
675+
return Packet.guess_payload_class(self, payload)
676+
671677

672678
class GRE_PPTP(GRE):
673679

0 commit comments

Comments
 (0)