Scapy: adding a new protocol with complex field groupings

Question

I am trying to specify a new package format using scapy . The package has a list of elements, and the elements consist of "grouped fields". By "grouped fields" I mean a subsequence of fields of different types. The only way to create “grouped fields” that I know of in scapy is to use the Packet class and use FieldLenField / PacketListField to refer to the length of the sequence and the type of list members. Is that the way? Something like this:

 from scapy.packet import Packet from scapy.fields import * class RepeatingGroupedSequence(Packet): name = "Simple group of two fields" fields_desc = [IntField('field1', 1), IntField('field2', 2)] class TopLayer(Packet): name = "Storage for Repeating Sequence" fields_desc = [FieldLenField("length", None, count_of='rep_seq'), PacketListField('rep_seq', None, RepeatingGroupedSequence, count_from = lambda pkt: pkt.length), ] #Now here is the problem that I have with assembling PacketListField: #craft TopLayer packet p = TopLayer() #add two "repeated sequences" p.rep_seq = [ RepeatingGroupedSequence(), RepeatingGroupedSequence() ] #both sequences can observed p.show() #but the underlying structure of the repeated sequence is #Raw# at this stage p.show2() #length is 2 print p.rep_seq, 'length:', len(p.rep_seq) #but the cloned packet has only one "repeated sequence", the rest is raw clone = TopLayer(str(p)) clone.show() #length is 1 print clone.rep_seq, 'length:', len(clone.rep_seq) 

The problem with this approach is that the grouping structure is not preserved when the package is built. During assembly, the second instance of the RepeatedSequence treated as an unhandled body, even if the count field is 2. How do you add RepeatingSequences so that the structure is preserved during reassembly? Is there a way to group fields without using Packet as a storage type for lists?

Answer 1

The RepeatingGroupedSequence class must overwrite the extract_padding method:

 def extract_padding(self, s): return '', s 

By default, each additional package considers everything as its own layer, that is:

 def extract_padding(self, s): return s, None 

And this is not what is used for grouping purposes. Can someone clarify the difference between indentation and separation of layers?