USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Init decoder's custom output module #82

Closed amm3 closed 8 years ago

amm3 commented 8 years ago

I restored a line that had previously been commented out to (re)initialize the decoder's custom output module. Without this call, the initial call to __init__ done at the decoder load time doesn't have access to the output filehandle, and therefore any writes done within the output initialization are vaporized. Results are most obvious when a decoder uses colorout and the output is directed to an HTML file using -o.

Example command: decode -d followstream file.pcap -o streams.html

Without this call to __init__ in decode.py, the HTML headers including stylesheets are not written to the output file.

dev195 commented 8 years ago

Okay, I see what's going on and how this fixes the followstream issue. There's a problem, however. It fixes this specific issue, but introduces new ones.

When running that one line to re-init the output module, it only passes the one keyword argument (i.e. (fh=out.fh)). This blows away any custom arguments a decoder writer might've fed to the output module in the decoder. For example, something like this in a decoder's __init__ function would not work...

self.out = jsonout.JSONOutput(geoip=True)

The 'geoip' argument given to it would be blown away when the output module is re-inited.

The colorout module seems to overcome this by including a series of checks for each of its kwargs to see if it was previously set. Unfortunately, none of the other output modules do this.

We'll need to think of a more complete way to fix this.

dev195 commented 8 years ago

I just made a new pull request #83

When you get a chance, can you see if it solves your issue in a way that works for you?

amm3 commented 8 years ago

Pull request #83 solves the issue. Closing this one.