From cc6876a18bf508a050eb65a9c5a752f2eacbfa07 Mon Sep 17 00:00:00 2001 From: Matthew Clark Date: Wed, 30 Nov 2022 15:18:52 -0500 Subject: [PATCH 1/4] Add bpf_filter to PipeCapture. A good idea? --- src/pyshark/capture/pipe_capture.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/pyshark/capture/pipe_capture.py b/src/pyshark/capture/pipe_capture.py index d2a777b9..852e8880 100644 --- a/src/pyshark/capture/pipe_capture.py +++ b/src/pyshark/capture/pipe_capture.py @@ -4,7 +4,7 @@ class PipeCapture(Capture): - def __init__(self, pipe, display_filter=None, only_summaries=False, + def __init__(self, pipe, bpf_filter=None, display_filter=None, only_summaries=False, decryption_key=None, encryption_type='wpa-pwk', decode_as=None, disable_protocol=None, tshark_path=None, override_prefs=None, use_json=False, include_raw=False, eventloop=None, custom_parameters=None, debug=False): @@ -33,6 +33,7 @@ def __init__(self, pipe, display_filter=None, only_summaries=False, tshark_path=tshark_path, override_prefs=override_prefs, use_json=use_json, include_raw=include_raw, eventloop=eventloop, custom_parameters=custom_parameters, debug=debug) + self.bpf_filter = bpf_filter self._pipe = pipe def get_parameters(self, packet_count=None): From 53e1044a94b38bdaddd05425ebcab13b35c45144 Mon Sep 17 00:00:00 2001 From: Matthew Clark Date: Thu, 8 Dec 2022 09:37:25 -0500 Subject: [PATCH 2/4] Add fifo check for file capture --- src/pyshark/capture/file_capture.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pyshark/capture/file_capture.py b/src/pyshark/capture/file_capture.py index 8ccd83c1..cdfa4e10 100644 --- a/src/pyshark/capture/file_capture.py +++ b/src/pyshark/capture/file_capture.py @@ -45,8 +45,8 @@ def __init__(self, input_file=None, keep_packets=True, display_filter=None, only self.input_filepath = pathlib.Path(input_file) if not self.input_filepath.exists(): raise FileNotFoundError(f"[Errno 2] No such file or directory: {self.input_filepath}") - if not self.input_filepath.is_file(): - raise FileNotFoundError(f"{self.input_filepath} is a directory") + if not self.input_filepath.is_file() and not self.input_filepath.is_fifo(): + raise FileNotFoundError(f"{self.input_filepath} is not a file or fifo") self.keep_packets = keep_packets self._packet_generator = self._packets_from_tshark_sync() From e39a65ec46658c9608cc8de89abf4259b81e6a67 Mon Sep 17 00:00:00 2001 From: Matthew Clark Date: Thu, 8 Dec 2022 09:39:17 -0500 Subject: [PATCH 3/4] Sync with upstream --- src/pyshark/capture/pipe_capture.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/pyshark/capture/pipe_capture.py b/src/pyshark/capture/pipe_capture.py index 852e8880..d2a777b9 100644 --- a/src/pyshark/capture/pipe_capture.py +++ b/src/pyshark/capture/pipe_capture.py @@ -4,7 +4,7 @@ class PipeCapture(Capture): - def __init__(self, pipe, bpf_filter=None, display_filter=None, only_summaries=False, + def __init__(self, pipe, display_filter=None, only_summaries=False, decryption_key=None, encryption_type='wpa-pwk', decode_as=None, disable_protocol=None, tshark_path=None, override_prefs=None, use_json=False, include_raw=False, eventloop=None, custom_parameters=None, debug=False): @@ -33,7 +33,6 @@ def __init__(self, pipe, bpf_filter=None, display_filter=None, only_summaries=Fa tshark_path=tshark_path, override_prefs=override_prefs, use_json=use_json, include_raw=include_raw, eventloop=eventloop, custom_parameters=custom_parameters, debug=debug) - self.bpf_filter = bpf_filter self._pipe = pipe def get_parameters(self, packet_count=None): From e4d0b6eef9e73063d1288fa8d793d29965da9a89 Mon Sep 17 00:00:00 2001 From: Matthew Clark Date: Thu, 8 Dec 2022 21:32:15 -0500 Subject: [PATCH 4/4] Merge some PR's into mine --- src/pyshark/capture/live_capture.py | 10 +++++++--- src/pyshark/packet/packet.py | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/pyshark/capture/live_capture.py b/src/pyshark/capture/live_capture.py index f5c27c65..66562bf9 100644 --- a/src/pyshark/capture/live_capture.py +++ b/src/pyshark/capture/live_capture.py @@ -65,15 +65,19 @@ def __init__(self, interface=None, bpf_filter=None, display_filter=None, only_su def get_parameters(self, packet_count=None): """Returns the special tshark parameters to be used according to the configuration of this class.""" - params = super(LiveCapture, self).get_parameters(packet_count=packet_count) - # Read from STDIN - params += ["-i", "-"] + params = super(LiveCapture, self).get_parameters( + packet_count=packet_count) + # Read directly from interfaces + for interface in self.interfaces: + params += ["-i", interface] return params def _verify_capture_parameters(self): all_interfaces_names = tshark.get_all_tshark_interfaces_names(self.tshark_path) all_interfaces_lowercase = [interface.lower() for interface in all_interfaces_names] for each_interface in self.interfaces: + if each_interface.startswith("rpcap://"): + continue if each_interface.isnumeric(): continue if each_interface.lower() not in all_interfaces_lowercase: diff --git a/src/pyshark/packet/packet.py b/src/pyshark/packet/packet.py index da8f6ead..2c066ab6 100644 --- a/src/pyshark/packet/packet.py +++ b/src/pyshark/packet/packet.py @@ -120,7 +120,7 @@ def __getattr__(self, item): Allows layers to be retrieved via get attr. For instance: pkt.ip """ for layer in self.layers: - if layer.layer_name == item: + if layer.layer_name.lower() == item: return layer raise AttributeError("No attribute named %s" % item)