# This file is part of Scapy # See http://www.secdev.org/projects/scapy for more information # Copyright (C) Lucas Preston # This program is published under a GPLv2 license # scapy.contrib.description = Network File System (NFS) v3 # scapy.contrib.status = loads from scapy.contrib.oncrpc import RPC, RPC_Call, Object_Name from binascii import unhexlify from scapy.packet import Packet, bind_layers from scapy.fields import IntField, IntEnumField, FieldListField, LongField, \ XIntField, XLongField, ConditionalField, PacketListField, StrLenField, \ PacketField from scapy.modules.six import integer_types nfsstat3 = { 0: 'NFS3_OK', 1: 'NFS3ERR_PERM', 2: 'NFS3ERR_NOENT', 5: 'NFS3ERR_IO', 6: 'NFS3ERR_NXIO', 13: 'NFS3ERR_ACCES', 17: 'NFS3ERR_EXIST', 18: 'NFS3ERR_XDEV', 19: 'NFS3ERR_NODEV', 20: 'NFS3ERR_NOTDIR', 21: 'NFS3ERR_ISDIR', 22: 'NFS3ERR_INVAL', 27: 'NFS3ERR_FBIG', 28: 'NFS3ERR_NOSPC', 30: 'NFS3ERR_ROFS', 31: 'NFS3ERR_MLINK', 63: 'NFS3ERR_NAMETOOLONG', 66: 'NFS3ERR_NOTEMPTY', 69: 'NFS3ERR_DQUOT', 70: 'NFS3ERR_STALE', 71: 'NFS3ERR_REMOTE', 10001: 'NFS3ERR_BADHANDLE', 10002: 'NFS3ERR_NOT_SYNC', 10003: 'NFS3ERR_BAD_COOKIE', 10004: 'NFS3ERR_NOTSUPP', 10005: 'NFS3ERR_TOOSMALL', 10006: 'NFS3ERR_SERVERFAULT', 10007: 'NFS3ERR_BADTYPE', 10008: 'NFS3ERR_JUKEBOX' } ftype3 = { 1: 'NF3REG', 2: 'NF3DIR', 3: 'NF3BLK', 4: 'NF3CHR', 5: 'NF3LNK', 6: 'NF3SOCK', 7: 'NF3FIFO' } def loct(x): if isinstance(x, integer_types): return oct(x) if isinstance(x, tuple): return "(%s)" % ", ".join(map(loct, x)) if isinstance(x, list): return "[%s]" % ", ".join(map(loct, x)) return x class OIntField(IntField): """IntField child with octal representation""" def i2repr(self, pkt, x): return loct(self.i2h(pkt, x)) class Fattr3(Packet): name = 'File Attributes' fields_desc = [ IntEnumField('type', 0, ftype3), OIntField('mode', 0), IntField('nlink', 0), IntField('uid', 0), IntField('gid', 0), LongField('size', 0), LongField('used', 0), FieldListField( 'rdev', [0, 0], IntField('', None), count_from=lambda x: 2 ), XLongField('fsid', 0), XLongField('fileid', 0), IntField('atime_s', 0), IntField('atime_ns', 0), IntField('mtime_s', 0), IntField('mtime_ns', 0), IntField('ctime_s', 0), IntField('ctime_ns', 0) ] def extract_padding(self, s): return '', s class File_Object(Packet): name = 'File Object' fields_desc = [ IntField('length', 0), StrLenField('fh', b'', length_from=lambda pkt: pkt.length), StrLenField('fill', b'', length_from=lambda pkt: (4 - pkt.length) % 4) ] def set(self, new_filehandle, length=None, fill=None): # convert filehandle to bytes if it was passed as a string if new_filehandle.isalnum(): new_filehandle = unhexlify(new_filehandle) if length is None: length = len(new_filehandle) if fill is None: fill = b'\x00' * ((4 - length) % 4) self.length = length self.fh = new_filehandle self.fill = fill def extract_padding(self, s): return '', s class WCC_Attr(Packet): name = 'File Attributes' fields_desc = [ LongField('size', 0), IntField('mtime_s', 0), IntField('mtime_ns', 0), IntField('ctime_s', 0), IntField('ctime_ns', 0) ] def extract_padding(self, s): return '', s class File_From_Dir_Plus(Packet): name = 'File' fields_desc = [ LongField('fileid', 0), PacketField('filename', Object_Name(), Object_Name), LongField('cookie', 0), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), IntField('handle_follows', 0), ConditionalField( PacketField('filehandle', File_Object(), File_Object), lambda pkt: pkt.handle_follows == 1 ), IntField('value_follows', 0) ] def extract_padding(self, s): return '', s class File_From_Dir(Packet): name = 'File' fields_desc = [ LongField('fileid', 0), PacketField('filename', Object_Name(), Object_Name), LongField('cookie', 0), IntField('value_follows', 0) ] def extract_padding(self, s): return '', s attrs_enum = {0: 'DONT SET', 1: 'SET'} times_enum = {0: 'DONT CHANGE', 1: 'SERVER TIME', 2: 'CLIENT TIME'} class Sattr3(Packet): name = 'Setattr3' fields_desc = [ IntEnumField('set_mode', 0, attrs_enum), ConditionalField(OIntField('mode', 0), lambda pkt: pkt.set_mode == 1), IntEnumField('set_uid', 0, attrs_enum), ConditionalField(IntField('uid', 0), lambda pkt: pkt.set_uid == 1), IntEnumField('set_gid', 0, attrs_enum), ConditionalField(IntField('gid', 0), lambda pkt: pkt.set_gid == 1), IntEnumField('set_size', 0, attrs_enum), ConditionalField(LongField('size', 0), lambda pkt: pkt.set_size == 1), IntEnumField('set_atime', 0, times_enum), ConditionalField( IntField('atime_s', 0), lambda pkt: pkt.set_atime == 2 ), ConditionalField( IntField('atime_ns', 0), lambda pkt: pkt.set_atime == 2 ), IntEnumField('set_mtime', 0, times_enum), ConditionalField( IntField('mtime_s', 0), lambda pkt: pkt.set_mtime == 2 ), ConditionalField( IntField('mtime_ns', 0), lambda pkt: pkt.set_mtime == 2 ) ] def extract_padding(self, s): return '', s class GETATTR_Call(Packet): name = 'GETATTR Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object) ] class GETATTR_Reply(Packet): name = 'GETATTR Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.status == 0 ) ] def extract_padding(self, s): return '', None bind_layers(RPC, GETATTR_Call, mtype=0) bind_layers( RPC_Call, GETATTR_Call, program=100003, pversion=3, procedure=1 ) bind_layers(RPC, GETATTR_Reply, mtype=1) class LOOKUP_Call(Packet): name = 'LOOKUP Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('filename', Object_Name(), Object_Name) ] class LOOKUP_Reply(Packet): name = 'LOOKUP Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), ConditionalField( PacketField('filehandle', File_Object(), File_Object), lambda pkt: pkt.status == 0 ), ConditionalField(IntField('af_file', 0), lambda pkt: pkt.status == 0), ConditionalField( PacketField('file_attributes', Fattr3(), Fattr3), lambda pkt: pkt.status == 0 and pkt.af_file == 1 ), IntField('af_dir', 0), ConditionalField( PacketField('dir_attributes', Fattr3(), Fattr3), lambda pkt: pkt.af_dir == 1 ) ] bind_layers(RPC, LOOKUP_Call, mtype=0) bind_layers(RPC, LOOKUP_Reply, mtype=1) bind_layers(RPC_Call, LOOKUP_Call, program=100003, pversion=3, procedure=3) class NULL_Call(Packet): name = 'NFS NULL Call' fields_desc = [] class NULL_Reply(Packet): name = 'NFS NULL Reply' fields_desc = [] bind_layers(RPC, NULL_Call, mtype=0) bind_layers(RPC, NULL_Reply, mtype=1) bind_layers(RPC_Call, NULL_Call, program=100003, pversion=3, procedure=0) class FSINFO_Call(Packet): name = 'FSINFO Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object) ] class FSINFO_Reply(Packet): name = 'FSINFO Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField(IntField('rtmax', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('rtpref', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('rtmult', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('wtmax', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('wtpref', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('wtmult', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('dtpref', 0), lambda pkt: pkt.status == 0), ConditionalField( LongField('maxfilesize', 0), lambda pkt: pkt.status == 0 ), ConditionalField( IntField('timedelta_s', 0), lambda pkt: pkt.status == 0 ), ConditionalField( IntField('timedelta_ns', 0), lambda pkt: pkt.status == 0 ), ConditionalField( XIntField('properties', 0), lambda pkt: pkt.status == 0 ), ] bind_layers(RPC, FSINFO_Call, mtype=0) bind_layers(RPC, FSINFO_Reply, mtype=1) bind_layers( RPC_Call, FSINFO_Call, program=100003, pversion=3, procedure=19 ) class PATHCONF_Call(Packet): name = 'PATHCONF Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object) ] class PATHCONF_Reply(Packet): name = 'PATHCONF Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField(IntField('linkmax', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('name_max', 0), lambda pkt: pkt.status == 0), ConditionalField( IntEnumField('no_trunc', 0, {0: 'NO', 1: 'YES'}), lambda pkt: pkt.status == 0 ), ConditionalField( IntEnumField('chown_restricted', 0, {0: 'NO', 1: 'YES'}), lambda pkt: pkt.status == 0 ), ConditionalField( IntEnumField('case_insensitive', 0, {0: 'NO', 1: 'YES'}), lambda pkt: pkt.status == 0 ), ConditionalField( IntEnumField('case_preserving', 0, {0: 'NO', 1: 'YES'}), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, PATHCONF_Call, mtype=0) bind_layers(RPC, PATHCONF_Reply, mtype=1) bind_layers( RPC_Call, PATHCONF_Call, program=100003, pversion=3, procedure=20 ) access_specs = { 0x0001: 'READ', 0x0002: 'LOOKUP', 0x0004: 'MODIFY', 0x0008: 'EXTEND', 0x0010: 'DELETE', 0x0020: 'EXECUTE' } class ACCESS_Call(Packet): name = 'ACCESS Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), IntEnumField('check_access', 1, access_specs) ] class ACCESS_Reply(Packet): name = 'ACCESS Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField( XIntField('access_rights', 0), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, ACCESS_Call, mtype=0) bind_layers(RPC, ACCESS_Reply, mtype=1) bind_layers(RPC_Call, ACCESS_Call, program=100003, pversion=3, procedure=4) class READDIRPLUS_Call(Packet): name = 'READDIRPLUS Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), LongField('cookie', 0), LongField('verifier', 0), IntField('dircount', 512), IntField('maxcount', 4096) ] class READDIRPLUS_Reply(Packet): name = 'READDIRPLUS Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField( LongField('verifier', 0), lambda pkt: pkt.status == 0 ), ConditionalField( IntField('value_follows', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketListField( 'files', None, cls=File_From_Dir_Plus, next_cls_cb=lambda pkt, lst, cur, remain: File_From_Dir_Plus if pkt.value_follows == 1 and (len(lst) == 0 or cur.value_follows == 1) and len(remain) > 4 else None ), lambda pkt: pkt.status == 0 ), ConditionalField(IntField('eof', 0), lambda pkt: pkt.status == 0) ] def extract_padding(self, s): return '', s bind_layers(RPC, READDIRPLUS_Call, mtype=0) bind_layers(RPC, READDIRPLUS_Reply, mtype=1) bind_layers( RPC_Call, READDIRPLUS_Call, program=100003, pversion=3, procedure=17 ) class WRITE_Call(Packet): name = 'WRITE Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), LongField('offset', 0), IntField('count', 0), IntEnumField('stable', 0, {0: 'UNSTABLE', 1: 'STABLE'}), IntField('length', 0), StrLenField('contents', b'', length_from=lambda pkt: pkt.length), StrLenField('fill', b'', length_from=lambda pkt: (4 - pkt.length) % 4) ] class WRITE_Reply(Packet): name = 'WRITE Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before', 0), ConditionalField( PacketField('attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ), ConditionalField(IntField('count', 0), lambda pkt: pkt.status == 0), ConditionalField( IntEnumField('committed', 0, {0: 'UNSTABLE', 1: 'STABLE'}), lambda pkt: pkt.status == 0 ), ConditionalField( XLongField('verifier', 0), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, WRITE_Call, mtype=0) bind_layers(RPC, WRITE_Reply, mtype=1) bind_layers(RPC_Call, WRITE_Call, program=100003, pversion=3, procedure=7) class COMMIT_Call(Packet): name = 'COMMIT Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), LongField('offset', 0), IntField('count', 0) ] class COMMIT_Reply(Packet): name = 'COMMIT Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before', 0), ConditionalField( PacketField('attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ), ConditionalField( XLongField('verifier', 0), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, COMMIT_Call, mtype=0) bind_layers(RPC, COMMIT_Reply, mtype=1) bind_layers( RPC_Call, COMMIT_Call, program=100003, pversion=3, procedure=21 ) class SETATTR_Call(Packet): name = 'SETATTR Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), PacketField('attributes', Sattr3(), Sattr3), IntField('check', 0) ] class SETATTR_Reply(Packet): name = 'SETATTR Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before', 0), ConditionalField( PacketField('attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, SETATTR_Call, mtype=0) bind_layers(RPC, SETATTR_Reply, mtype=1) bind_layers( RPC_Call, SETATTR_Call, program=100003, pversion=3, procedure=2 ) class FSSTAT_Call(Packet): name = 'FSSTAT Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object) ] class FSSTAT_Reply(Packet): name = 'FSSTAT Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField(LongField('tbytes', 0), lambda pkt: pkt.status == 0), ConditionalField(LongField('fbytes', 0), lambda pkt: pkt.status == 0), ConditionalField(LongField('abytes', 0), lambda pkt: pkt.status == 0), ConditionalField(LongField('tfiles', 0), lambda pkt: pkt.status == 0), ConditionalField(LongField('ffiles', 0), lambda pkt: pkt.status == 0), ConditionalField(LongField('afiles', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('invarsec', 0), lambda pkt: pkt.status == 0) ] bind_layers(RPC, FSSTAT_Call, mtype=0) bind_layers(RPC, FSSTAT_Reply, mtype=1) bind_layers( RPC_Call, FSSTAT_Call, program=100003, pversion=3, procedure=18 ) class CREATE_Call(Packet): name = 'CREATE Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('filename', Object_Name(), Object_Name), IntEnumField('create_mode', None, {0: 'UNCHECKED', 1: 'GUARDED', 2: 'EXCLUSIVE'}), ConditionalField( PacketField('attributes', Sattr3(), Sattr3), lambda pkt: pkt.create_mode != 2 ), ConditionalField( XLongField('verifier', 0), lambda pkt: pkt.create_mode == 2 ) ] class CREATE_Reply(Packet): name = 'CREATE Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), ConditionalField( IntField('handle_follows', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('filehandle', File_Object(), File_Object), lambda pkt: pkt.status == 0 and pkt.handle_follows == 1 ), ConditionalField( IntField('attributes_follow', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.status == 0 and pkt.attributes_follow == 1 ), IntField('af_before', 0), ConditionalField( PacketField('dir_attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('dir_attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, CREATE_Call, mtype=0) bind_layers(RPC, CREATE_Reply, mtype=1) bind_layers(RPC_Call, CREATE_Call, program=100003, pversion=3, procedure=8) class REMOVE_Call(Packet): name = 'REMOVE Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('filename', Object_Name(), Object_Name) ] class REMOVE_Reply(Packet): name = 'REMOVE Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before', 0), ConditionalField( PacketField('attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, REMOVE_Call, mtype=0) bind_layers(RPC, REMOVE_Reply, mtype=1) bind_layers( RPC_Call, REMOVE_Call, program=100003, pversion=3, procedure=12 ) class READDIR_Call(Packet): name = 'READDIR Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), LongField('cookie', 0), XLongField('verifier', 0), IntField('count', 0) ] class READDIR_Reply(Packet): name = 'READDIR Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField( XLongField('verifier', 0), lambda pkt: pkt.status == 0 ), ConditionalField( IntField('value_follows', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketListField( 'files', None, cls=File_From_Dir, next_cls_cb=lambda pkt, lst, cur, remain: File_From_Dir if pkt.value_follows == 1 and (len(lst) == 0 or cur.value_follows == 1) and len(remain) > 4 else None ), lambda pkt: pkt.status == 0), ConditionalField(IntField('eof', 0), lambda pkt: pkt.status == 0) ] bind_layers(RPC, READDIR_Call, mtype=0) bind_layers(RPC, READDIR_Reply, mtype=1) bind_layers( RPC_Call, READDIR_Call, program=100003, pversion=3, procedure=16 ) class RENAME_Call(Packet): name = 'RENAME Call' fields_desc = [ PacketField('dir_from', File_Object(), File_Object), PacketField('name_from', Object_Name(), Object_Name), PacketField('dir_to', File_Object(), File_Object), PacketField('name_to', Object_Name(), Object_Name), ] class RENAME_Reply(Packet): name = 'RENAME Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before_f', 0), ConditionalField( PacketField('attributes_before_f', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before_f == 1 ), IntField('af_after_f', 0), ConditionalField( PacketField('attributes_after_f', Fattr3(), Fattr3), lambda pkt: pkt.af_after_f == 1 ), IntField('af_before_t', 0), ConditionalField( PacketField('attributes_before_t', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before_t == 1 ), IntField('af_after_t', 0), ConditionalField( PacketField('attributes_after_t', Fattr3(), Fattr3), lambda pkt: pkt.af_after_t == 1 ) ] bind_layers(RPC, RENAME_Call, mtype=0) bind_layers(RPC, RENAME_Reply, mtype=1) bind_layers( RPC_Call, RENAME_Call, program=100003, pversion=3, procedure=14 ) class LINK_Call(Packet): name = 'LINK Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), PacketField('link_dir', File_Object(), File_Object), PacketField('link_name', Object_Name(), Object_Name) ] class LINK_Reply(Packet): name = 'LINK Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_file', 0), ConditionalField( PacketField('file_attributes', Fattr3(), Fattr3), lambda pkt: pkt.af_file == 1 ), IntField('af_link_before', 0), ConditionalField( PacketField('link_attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_link_before == 1 ), IntField('af_link_after', 0), ConditionalField( PacketField('link_attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_link_after == 1 ) ] bind_layers(RPC, LINK_Call, mtype=0) bind_layers(RPC, LINK_Reply, mtype=1) bind_layers(RPC_Call, LINK_Call, program=100003, pversion=3, procedure=15) class RMDIR_Call(Packet): name = 'RMDIR Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('filename', Object_Name(), Object_Name), ] class RMDIR_Reply(Packet): name = 'RMDIR Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('af_before', 0), ConditionalField( PacketField('attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, RMDIR_Call, mtype=0) bind_layers(RPC, RMDIR_Reply, mtype=1) bind_layers(RPC_Call, RMDIR_Call, program=100003, pversion=3, procedure=13) class READLINK_Call(Packet): name = 'READLINK Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object) ] class READLINK_Reply(Packet): name = 'READLINK Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField( PacketField('filename', Object_Name(), Object_Name), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, READLINK_Call, mtype=0) bind_layers(RPC, READLINK_Reply, mtype=1) bind_layers( RPC_Call, READLINK_Call, program=100003, pversion=3, procedure=5 ) class READ_Call(Packet): name = 'READ Call' fields_desc = [ PacketField('filehandle', File_Object(), File_Object), LongField('offset', 0), IntField('count', 0) ] class READ_Reply(Packet): name = 'READ Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), IntField('attributes_follow', 0), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.attributes_follow == 1 ), ConditionalField(IntField('count', 0), lambda pkt: pkt.status == 0), ConditionalField(IntField('eof', 0), lambda pkt: pkt.status == 0), ConditionalField( IntField('data_length', 0), lambda pkt: pkt.status == 0 ), ConditionalField( StrLenField('data', b'', length_from=lambda pkt: pkt.data_length), lambda pkt: pkt.status == 0 ), ConditionalField( StrLenField( 'fill', b'', length_from=lambda pkt: (4 - pkt.data_length) % 4 ), lambda pkt: pkt.status == 0 ) ] bind_layers(RPC, READ_Call, mtype=0) bind_layers(RPC, READ_Reply, mtype=1) bind_layers(RPC_Call, READ_Call, program=100003, pversion=3, procedure=6) class MKDIR_Call(Packet): name = 'MKDIR Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('dir_name', Object_Name(), Object_Name), PacketField('attributes', Sattr3(), Sattr3) ] class MKDIR_Reply(Packet): name = 'MKDIR Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), ConditionalField( IntField('handle_follows', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('filehandle', File_Object(), File_Object), lambda pkt: pkt.status == 0 and pkt.handle_follows == 1 ), ConditionalField( IntField('attributes_follow', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.status == 0 and pkt.attributes_follow == 1 ), IntField('af_before', 0), ConditionalField( PacketField('dir_attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('dir_attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, MKDIR_Call, mtype=0) bind_layers(RPC, MKDIR_Reply, mtype=1) bind_layers(RPC_Call, MKDIR_Call, program=100003, pversion=3, procedure=9) class SYMLINK_Call(Packet): name = 'SYMLINK Call' fields_desc = [ PacketField('dir', File_Object(), File_Object), PacketField('dir_name', Object_Name(), Object_Name), PacketField('attributes', Sattr3(), Sattr3), PacketField('link_name', Object_Name(), Object_Name) ] class SYMLINK_Reply(Packet): name = 'SYMLINK Reply' fields_desc = [ IntEnumField('status', 0, nfsstat3), ConditionalField( IntField('handle_follows', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('filehandle', File_Object(), File_Object), lambda pkt: pkt.status == 0 and pkt.handle_follows == 1 ), ConditionalField( IntField('attributes_follow', 0), lambda pkt: pkt.status == 0 ), ConditionalField( PacketField('attributes', Fattr3(), Fattr3), lambda pkt: pkt.status == 0 and pkt.attributes_follow == 1 ), IntField('af_before', 0), ConditionalField( PacketField('dir_attributes_before', WCC_Attr(), WCC_Attr), lambda pkt: pkt.af_before == 1 ), IntField('af_after', 0), ConditionalField( PacketField('dir_attributes_after', Fattr3(), Fattr3), lambda pkt: pkt.af_after == 1 ) ] bind_layers(RPC, SYMLINK_Call, mtype=0) bind_layers(RPC, SYMLINK_Reply, mtype=1) bind_layers( RPC_Call, SYMLINK_Call, program=100003, pversion=3, procedure=10 )