0

Attempting to read a pcap with Kaitai Struct in python.

I have created the python files from the pcap.ksy file 

$ ./bin/kaitai-struct-compiler -t python  --outdir xx formats/network/pcap.ksy 
$ ls xx
ethernet_frame.py  ipv6_packet.py  __pycache__
icmp_packet.py     packet_ppi.py   tcp_segment.py
ipv4_packet.py     pcap.py         udp_datagram.py

PYTHONPATH is set to the xx directory. Now if I run a simple one line script to check that I can load the modules

from pcap import Pcap

I get this error

$ python3 try.py 
Traceback (most recent call last):
  File "try.py", line 1, in <module>
    from pcap import Pcap
  File "/spare/tmp/scratch/kaitai-struct-compiler-0.8/xx/pcap.py", line 11, in <module>
    from packet_ppi import PacketPpi
  File "/spare/tmp/scratch/kaitai-struct-compiler-0.8/xx/packet_ppi.py", line 11, in <module>
    from ethernet_frame import EthernetFrame
  File "/spare/tmp/scratch/kaitai-struct-compiler-0.8/xx/ethernet_frame.py", line 11, in <module>
    from ipv6_packet import Ipv6Packet
  File "/spare/tmp/scratch/kaitai-struct-compiler-0.8/xx/ipv6_packet.py", line 12, in <module>
    from ipv4_packet import Ipv4Packet
  File "/spare/tmp/scratch/kaitai-struct-compiler-0.8/xx/ipv4_packet.py", line 13, in <module>
    from ipv6_packet import Ipv6Packet
ImportError: cannot import name 'Ipv6Packet'

My reading of that is the python path is ok and the python modules are working their way down the chain from pacp, through Ethernet, ipv6 to ipv4. Then ipv4 attempts to load ipv6 again and the script falls over.

I think the code is triggering an import loop.

Anyone know what I'm doing wrong?

pmqs
  • 3,066
  • 2
  • 13
  • 22
  • https://stackoverflow.com/a/58048508/2030808 covers the same ground. Looks like a bug to me. – pmqs Dec 10 '19 at 13:40

1 Answers1

1

It's a circular dependency problem which only manifests in Python, and it is solved with a workaround in newer Kaitai Struct builds (0.9 unstable).

Please try updating to KS 0.9+.

GreyCat
  • 16,622
  • 18
  • 74
  • 112
  • Thanks, already found a workaround in https://stackoverflow.com/questions/48344121/installing-kaitai-struct-python/58048508#58048508. Now trying to figure out how to read a pcap a packet at a time. Looking at the python generated from pcap.ksy, it seems consume the complete pcap in one go. My application needs to deal with very large pcaps, so requires a streamed interface. – pmqs Dec 11 '19 at 08:41
  • It's actually also a very frequently asked question. One of possible solutions: https://github.com/kaitai-io/kaitai_struct/issues/255#issuecomment-329247604 – GreyCat Dec 12 '19 at 09:16