PCAPNG: Adding SHB Options

scapy/utils.py

@@ -2403,6 +2403,9 @@ class RawPcapNgWriter(GenericRawPcapWriter):
 
     def __init__(self,
                  filename,  # type: str
+                 shb_hardware=None,  # type: Optional[str]
+                 shb_os=None,  # type: Optional[str]
+                 shb_userapp=None,  # type: Optional[str]
                  ):
         # type: (...) -> None
 
@@ -2416,6 +2419,10 @@ def __init__(self,
         self.endian = "<"
         self.endian_magic = b"\x4d\x3c\x2b\x1a"
 
+        self.shb_hardware = shb_hardware
+        self.shb_os = shb_os
+        self.shb_userapp = shb_userapp
+
         self.filename = filename
         self.f = open(filename, "wb", 4096)
 
@@ -2483,6 +2490,24 @@ def _write_block_shb(self):
         # Section Length
         block_shb += struct.pack(self.endian + "q", -1)
 
+        # Add Hardware Name Option (2), if exists
+        if self.shb_hardware is not None:
+            block_shb += struct.pack(self.endian + "HH", 0x0002, len(self.shb_hardware))
+            block_shb += self.shb_hardware.encode()
+            block_shb = self._add_padding(block_shb)
+
+        # Add OS Name Option (3), if exists
+        if self.shb_os is not None:
+            block_shb += struct.pack(self.endian + "HH", 0x0003, len(self.shb_os))
+            block_shb += self.shb_os.encode()
+            block_shb = self._add_padding(block_shb)
+
+        # Add User Application Name Option (4), if exists
+        if self.shb_userapp is not None:
+            block_shb += struct.pack(self.endian + "HH", 0x0004, len(self.shb_userapp))
+            block_shb += self.shb_userapp.encode()
+            #block_shb = self._add_padding(block_shb)
+
         self.f.write(self.build_block(block_type, block_shb))
 
     def _write_block_idb(self,

test/regression.uts

@@ -2158,6 +2158,16 @@ l = rdpcap(tmpfile)
 assert b"Scapy" in l[0][Raw].load
 assert l[0].time == ts
 
+= Write a pcapng with SHB options
+
+tmpfile = get_temp_file(autoext=".pcapng")
+r = RawPcapNgWriter(tmpfile, shb_hardware="hardware", shb_os="os", shb_userapp="userapp")
+r._write_block_shb()
+r.f.close()
+
+# without a reader not much we can check
+assert os.stat(tmpfile).st_size == 60
+
 = Check wrpcapng()
 
 tmpfile = get_temp_file(autoext=".pcapng")