USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.44k stars 1.14k forks source link

Blob handling #148

Open amm3 opened 2 years ago

amm3 commented 2 years ago

It appears that the blob_handler() function isn't getting called at certain critical junctures. My understanding was that the core code would call this function (if defined in a plugin) as it processed packets, every time the stream changed direction. It actually looks like the blob_handlers aren't called until the connection closes and the blobs are formed/iterated.

jpsnyder commented 2 years ago

The blobs are indeed handled after the connection closes. https://github.com/USArmyResearchLab/Dshell/blob/master/dshell/core.py#L606

I believe it doesn't process them inline because of potential retransmitted packets for an older blob. https://github.com/USArmyResearchLab/Dshell/blob/master/dshell/core.py#L1208

dev195 commented 2 years ago

I see both sides of this issue. It's useful for the blobs to be complete before processing, which is why Dshell currently handles them when the connection closes. But it is also useful to handle blobs as they come, such as when users interrupt the decoding process or listen live on the wire.

Would there be interest in a command-line switch? Dshell could default to handling blobs after the connection closes, but will handle them immediately if the user sets the flag? There might be issues if packets are retransmitted, but users can accept that risk when they use the flag.

amm3 commented 2 years ago

I could see the command-line option being useful, but it seems like something more tied to the design of a particular decoder/plugin. Perhaps the plugin could set its default/desired behavior on instantiation with a command-line option to override that?

jpsnyder commented 1 year ago

Unsure how that could be added effectively. It looks like blobs are only calculated once requested by the .blobs property on the Connection object (which probably helps with speed).

Perhaps the Connection object can follow the producer/consumer model like the other elements and have a produce_blobs() function. Which would have the Connection object statefully produce any new blobs since the last time it was called. Although it should be understood that the blob's produced this way would be different than if you did conn.blobs since they are prematurely being passed through the chain.