tpcpr/src/parser/mod.rs

extern crate bitfield;
extern crate byteorder;
extern crate eui48;
mod packet_handler;
use pcap::{Capture, Linktype};
use regex::bytes::Regex;
use std::str;
//use std::thread::{spawn, JoinHandle};
//use std::sync::mpsc::{channel, Receiver};


/* protocol ids, LittleEndian */
const ETH_P_IPV6: usize = 0xDD86;
const ETH_P_IP: usize = 0x08;
const TCP: usize = 0x06;
const UDP: usize = 0x11;
const ETH_P_ARP: usize  = 0x0608;
const ETH_P_RARP: usize = 0x3580; 

/* 
 QryData could be written in the sense of QryData{ ... frame: .., packet: .., segment:.. }
 On the one hand, only the actual type of frame/packet/segment would be contained in the resulting struct. 
 So, increased benefit in serialization/cpu time, could result in less data to be serialized, depending on layout.
 On the other hand, each datagram::type needs to implement traits which would need to be dynamically dispatched by returning any of these types per iso level from a single function each. The result would be a performance decrease. 
 See: https://doc.rust-lang.org/book/ch17-02-trait-objects.html#trait-objects-perform-dynamic-dispatch
 Then again, parser logic would be fewer lines + more unified using the latter method. Maybe better optimizable as well? Maybe this is a nice tradeoff?
 TODO: Implement and benchmark dynamically dispatched packet data in conjunction with restructured QryData. 
*/
#[derive(Debug, Clone)]
pub struct QryData {
    pub id: i32,
    pub time: f64,
    pub data: Option<Vec<u8>>,
    pub ether_header: Option<packet_handler::EtherHeader>,
    pub ipv4_header: Option<packet_handler::IpV4Header>,
    pub ipv6_header: Option<packet_handler::IpV6Header>,
    pub tcp_header: Option<packet_handler::TcpHeader>,
    pub udp_header: Option<packet_handler::UdpHeader>,
    pub arp_header: Option<packet_handler::ArpHeader>,
    pub reg_res: Option<String>,
}

fn init_qrydata( ) -> Result<QryData, core::fmt::Error> {
    Ok(QryData {
        id: 0,
        time: 0.0,
        data: None,
        ether_header: None::<packet_handler::EtherHeader>,
        ipv4_header: None::<packet_handler::IpV4Header>,
        ipv6_header: None::<packet_handler::IpV6Header>,
        tcp_header: None::<packet_handler::TcpHeader>,
        udp_header: None::<packet_handler::UdpHeader>,
        arp_header: None::<packet_handler::ArpHeader>,
        reg_res: None::<String>,
    })
    
}

enum EncapsulationType { // pcap::Linktype::get_name() is unsafe. 
    EN10MB = 1,         // See: https://docs.rs/pcap/0.7.0/src/pcap/lib.rs.html#247-261
    RAW = 101,          // Would this be an issue?
}    

impl QryData {
// This is not cool!
// This will get modularized into subfunctions
    fn encap_ether( packet_data: &[u8] ) -> Option<QryData> {
        let mut pkg: QryData = init_qrydata().unwrap();
        pkg.ether_header = Some(packet_handler::ethernet_handler(packet_data)).unwrap();
        match pkg.ether_header.unwrap().ether_type as usize {
            ETH_P_IP => {
                pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap();
                match pkg.ipv4_header.unwrap().ip_protocol as usize {
                    TCP => { 
                        pkg.tcp_header = Some(packet_handler::tcp_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            packet_data,
                        ))
                        .unwrap();
                        pkg.data = Some(packet_handler::payload_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            pkg.tcp_header.unwrap().data_offset,
                            packet_data,
                        )).unwrap();
                    }
                    UDP => {
                        pkg.udp_header = Some(packet_handler::udp_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            packet_data,
                        ))
                        .unwrap();
                        pkg.data = Some(packet_handler::payload_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            7,
                            packet_data,
                        )).unwrap();
                    }
                    _ => println!("Transport layer protocol not implemented"),
                }
            }
            ETH_P_IPV6 => {
                pkg.ipv6_header = Some(packet_handler::ipv6_handler(packet_data)).unwrap();
                match pkg.ipv6_header.unwrap().next_header as usize {
                    TCP => {
                        pkg.tcp_header = Some(packet_handler::tcp_handler(10, packet_data)).unwrap();
                        pkg.data = Some(packet_handler::payload_handler(
                            10,
                            pkg.tcp_header.unwrap().data_offset,
                            packet_data,
                        )).unwrap();
                    }
                    UDP => {
                        pkg.udp_header = Some(packet_handler::udp_handler(10, packet_data)).unwrap();
                        pkg.data = Some(packet_handler::payload_handler(10, 7, packet_data)).unwrap();
                    }
                    _ => println!("Transport layer protocol not implemented"),
                }
            }
            ETH_P_ARP | ETH_P_RARP => {
                pkg.arp_header = Some(packet_handler::arp_handler(packet_data)).unwrap();
            }
            _ => println!("Network protocol not implemented"),
        }
     Some(pkg)
    }

    fn encap_rawip ( packet_data: &[u8] ) -> Option<QryData> {
                let mut pkg: QryData = init_qrydata().unwrap();
                pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap();
                match pkg.ipv4_header.unwrap().ip_protocol as usize {
                    TCP => {
                        pkg.tcp_header = Some(packet_handler::tcp_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            packet_data,
                        ))
                        .unwrap();
                        pkg.data = Some(packet_handler::payload_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            pkg.tcp_header.unwrap().data_offset,
                            packet_data,
                        )).unwrap();
                    }
                    UDP => { 
                        pkg.udp_header = Some(packet_handler::udp_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            packet_data,
                        ))
                        .unwrap();
                        pkg.data = Some(packet_handler::payload_handler(
                            pkg.ipv4_header.unwrap().ip_ihl,
                            7,
                            packet_data,
                        )).unwrap();
                    }
                   _ => println!("Transport layer protocol not implemented"),
        
            }
        Some(pkg)
    }
}

/* Regex parse _complete_ package */
fn flag_carnage(re: &Regex, payload: &[u8]) -> Option<String> {
    let mut flags: String = String::new();
    for mat in re.find_iter(payload) {
        // TODO:  Test benchmark format! vs. push_str()
        // flags.push_str(&format!("{} ",std::str::from_utf8(mat.as_bytes()).unwrap()));
        // See: https://github.com/hoodie/concatenation_benchmarks-rs
        flags.push_str(std::str::from_utf8(mat.as_bytes()).unwrap());
        flags.push_str(";");
    }
    match 0 < flags.len() {
        false => None,
        true => Some(flags),
    }
}

pub fn parse(parse_file: &std::path::Path, filter_str: &str, regex_filter: &str, encap: u16) -> Vec<QryData> {
    let mut me: QryData = init_qrydata().unwrap();
    let mut v: Vec<QryData> = Vec::new();

    let mut cap = Capture::from_file(parse_file).unwrap();
    Capture::filter(&mut cap, &filter_str).unwrap();
    let re = Regex::new(regex_filter).unwrap();
    while let Ok(packet) = cap.next() {

        match encap {
            // Syntax is clunky, but no num_derive + num_traits dependencies.
            encap if encap == EncapsulationType::EN10MB as u16 => me = QryData::encap_ether(packet.data).unwrap(),
            encap if encap == EncapsulationType::RAW as u16 => me = QryData::encap_rawip(packet.data).unwrap(),
            _ => (),
        };
        
        me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64;
        //me.data = Some(packet.data.to_vec());
        me.reg_res = flag_carnage(&re, packet.data); // Regex overhead is between 4-9% --single threaded-- on complete packet [u8] data
        v.push(me.clone());
    }
    v
}


/* This could need some love */
pub fn parse_device(parse_device: &str, filter_str: &str, insert_max: &usize, regex_filter: &str) -> Vec<QryData> {
    let mut me:  QryData = init_qrydata ( ).unwrap();
    let mut v: Vec<QryData> = Vec::new();
    let mut cap = Capture::from_device(parse_device).unwrap().open().unwrap();
    Capture::filter(&mut cap, &filter_str).unwrap();
    let linktype = cap.get_datalink();
    let re = Regex::new(regex_filter).unwrap();
    'parse: while let Ok(packet) = cap.next() {
        match linktype { 
            Linktype(1) => me = QryData::encap_ether(packet.data).unwrap(),
            Linktype(101) => me = QryData::encap_rawip(packet.data).unwrap(),
            _ => (),
        }

        me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64;  
        me.reg_res = flag_carnage(&re, packet.data);
      
        v.push(me.clone());  
        
        if &v.len() >= insert_max {
            break 'parse;
        }
    }
    v
}