问题访问/迭代 python 中的复杂字典对象

Question

So I'd like to preface this with I'm brand new to python...I'm trying to access values from a complex object. When using a for loop in a for loop I keep getting errors like...

TypeError: object does not support assignment

or

AtributeError: 'str' object has no attribute 'syn'

...which I think are stemming from either assignment to scan.results object in section #1 connect(packet.s or improper construction of classes. In #2 area of the method connect_scan_exist we can see issues accessing value.flags.XX. I think it is due to the way I have constructed the supporting class objects that are utilized in the dictionary.

Method

# determine if a connect scan takes place
def connect_scan_exist(packets):
  s = scan()

# 1. grab all TCP syn

 for key, value in packets.items():
    # add tcp packets with syn that are not already entered
    if ( value.packet_type == 'TCP'
        and value.source_ip 
        and value.destination_ip 
        and value.destination_port 
        and value.flags.syn
        and value.flags.ack == False
        and value.flags.rst == False
        and value.flags.fin == False):
      s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)

# 2. iterate over all TCP syn looking for matching syn/ack

for skey, svalue in s.results.items():
    for key, value in packets.items():
      # print(len(value.flags))
      if ( value.destination_ip == svalue.source_ip
        and value.source_ip == svalue.destination_ip
        and value.source_port == svalue.destination_port
        # and value.scan_categories.is_null_scan ## <---this one works 
        and value.flags.syn
        and value.flags.ack
        and value.flags.rst == False
        and value.flags.fin == False
        and value.timestamp > svalue.source_syn_time
        and svalue.destination_synack is None):
        # update scan result with cooresponding syn/ack
        s.results[str(value.source_ip) + '|' + 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].destination_synack = True
        s.results[str(value.source_ip) + '|'+ 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].destination_synack_time = value.timestamp

# 3. iterate over all TCP syn looking for matching ack

 for skey, svalue in s.results.items():
    for key, value in packets.items():
      if ( value.source_ip == svalue.source_ip
        and value.destination_ip == svalue.destination_ip
        and value.destination_port == svalue.destination_port
        and value.flags.syn == False 
        and value.flags.ack
        and value.flags.rst == False
        and value.flags.fin == False
        and value.timestamp > svalue.source_synack_time
        and svalue.source_ack is None):
        # update scan result with cooresponding syn/ack
        s.results[str(value.source_ip) + '|' + 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].source_ack = True
        s.results[str(value.source_ip) + '|'+ 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].source_ack_time = value.timestamp
  # 4. remove all incomplete ? maybe 
  # 5. analysis
  s.scanfound = (True if (len(s.results) > 10) else False)
  s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
  return s

Classes

# define connect scan class
class connect(object):
  def __init__(self, src_ip=None, dst_ip=None, dst_port=None, src_syn=None, src_syn_time=None, dst_synack=None, dst_synack_time=None, 
    src_ack=None, src_ack_time=None):
    self.source_ip = src_ip
    self.destination_ip = dst_ip
    self.destination_port = dst_port
    self.source_syn = src_syn
    self.source_syn_time = src_syn_time
    self.destination_synack = dst_synack
    self.destination_synack_time = dst_synack_time
    self.source_ack = src_ack
    self.source_ack_time = src_ack_time

# define half open scan class
class scan(object):
  def __init__(self, scan=False, desc=None):
    self.scanfound = scan
    self.description = desc
    self.results = dict()

# define generic packet class
class generic_packet(object): 
  def __init__(self, packet_type=None, time=None, src_mac=None, src=None, src_port=None, dst_mac=None, dst=None, 
    dst_port=None, seq=None, ack=None, flags=None, options=None, data=None):
    self.packet_type = packet_type
    self.timestamp = time
    self.scan_categories = scan_type()
    self.source_mac = src_mac
    self.source_ip = src
    self.source_port = src_port
    self.destination_mac = dst_mac
    self.destination_ip = dst
    self.destination_port = dst_port
    self.sequence = seq
    self.acknowledge = ack
    self.flags = flags # tcp_flags(flags)
    self.options = options
    self.data = data

Answer 1

When running the code it looks like some elements of packets are str , not tcp_flags .

You can skip these elements adding this line 186:

if not isinstance(value.flags, tcp_flags):
    continue

Or since packets appears to contain TCP and UDP you can check for value.packet_type == 'TCP' in steps #2 and #3. The program is failing on UDP packets which have generic_packet.flags = None so the object has no syn,ack etc in scope.

# determine if a connect scan takes place
def connect_scan_exist(packets):
  s = scan()
  # 1. grab all TCP syn
  for key, value in packets.items():
    # add tcp packets with syn that are not already entered
    if ( value.packet_type == 'TCP'
        and value.source_ip 
        and value.destination_ip 
        and value.destination_port 
        and value.flags.syn
        and value.flags.ack == False
        and value.flags.rst == False
        and value.flags.fin == False):
      s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)

  # 2. iterate over all TCP syn looking for matching syn/ack
  for skey, svalue in s.results.items():
    for key, value in packets.items():
      # print(len(value.flags))
      if (value.packet_type == 'TCP' 
        and value.destination_ip == svalue.source_ip
        and value.source_ip == svalue.destination_ip
        and value.source_port == svalue.destination_port
        # and value.scan_categories.is_null_scan ## <---this one works 
        and value.flags.syn
        and value.flags.ack
        and value.flags.rst == False
        and value.flags.fin == False
        and value.timestamp > svalue.source_syn_time
        and svalue.destination_synack is None):
        # update scan result with cooresponding syn/ack
        s.results[str(value.source_ip) + '|' + 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].destination_synack = True
        s.results[str(value.source_ip) + '|'+ 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].destination_synack_time = value.timestamp

  # 3. iterate over all TCP syn looking for matching ack
  for skey, svalue in s.results.items():
    for key, value in packets.items():
      if ( **value.packet_type == 'TCP'**
        and value.source_ip == svalue.source_ip
        and value.destination_ip == svalue.destination_ip
        and value.destination_port == svalue.destination_port
        and value.flags.syn == False 
        and value.flags.ack
        and value.flags.rst == False
        and value.flags.fin == False
        and value.timestamp > svalue.source_synack_time
        and svalue.source_ack is None):
        # update scan result with cooresponding syn/ack
        s.results[str(value.source_ip) + '|' + 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].source_ack = True
        s.results[str(value.source_ip) + '|'+ 
                  str(value.destination_ip) + '|' + 
                  str(value.destination_port)].source_ack_time = value.timestamp
  # 4. remove all incomplete ? maybe 
  # 5. analysis
  s.scanfound = (True if (len(s.results) > 10) else False)
  s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
  return s