parse_pcap_klap: require source host (#1137)

Adds a mandatory `--source-host` to make sure the correct handshake
is captured when multiple hosts are communicating with the target device.
This commit is contained in:
Teemu R. 2024-09-30 10:15:16 +02:00 committed by GitHub
parent 130e1b6023
commit db80c383a9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -212,6 +212,7 @@ def main(
username, username,
password, password,
device_ip, device_ip,
source_host,
pcap_file_path, pcap_file_path,
output_json_name=None, output_json_name=None,
): ):
@ -232,7 +233,6 @@ def main(
) )
operator = Operator(KlapTransportV2(config=fake_device), creds) operator = Operator(KlapTransportV2(config=fake_device), creds)
packets = [] packets = []
# pyshark is a little weird in how it handles iteration, # pyshark is a little weird in how it handles iteration,
@ -241,6 +241,8 @@ def main(
try: try:
packet = capture.next() packet = capture.next()
packet_number = capture._current_packet packet_number = capture._current_packet
if packet.ip.src != source_host:
continue
# we only care about http packets # we only care about http packets
if hasattr( if hasattr(
packet, "http" packet, "http"
@ -325,6 +327,11 @@ def main(
required=True, required=True,
help="the IP of the smart device as it appears in the pcap file.", help="the IP of the smart device as it appears in the pcap file.",
) )
@click.option(
"--source-host",
required=True,
help="the IP of the device communicating with the smart device.",
)
@click.option( @click.option(
"--username", "--username",
required=True, required=True,
@ -348,14 +355,14 @@ def main(
required=False, required=False,
help="The name of the output file, relative to the current directory.", help="The name of the output file, relative to the current directory.",
) )
async def cli(username, password, host, pcap_file_path, output): async def cli(username, password, host, source_host, pcap_file_path, output):
"""Export KLAP data in JSON format from a PCAP file.""" """Export KLAP data in JSON format from a PCAP file."""
# pyshark does not work within a running event loop and we don't want to # pyshark does not work within a running event loop and we don't want to
# install click as well as asyncclick so run in a new thread. # install click as well as asyncclick so run in a new thread.
loop = asyncio.new_event_loop() loop = asyncio.new_event_loop()
thread = Thread( thread = Thread(
target=main, target=main,
args=[loop, username, password, host, pcap_file_path, output], args=[loop, username, password, host, source_host, pcap_file_path, output],
daemon=True, daemon=True,
) )
thread.start() thread.start()