extern crate bitfield; extern crate byteorder; extern crate eui48; mod packet_handler; use pcap::{Capture, Linktype}; use regex::bytes::Regex; use std::str; use std::convert::TryInto; //use std::thread::{spawn, JoinHandle}; //use std::sync::mpsc::{channel, Receiver}; /* protocol ids, LittleEndian */ const ETH_P_IPV6: usize = 0xDD86; const ETH_P_IP: usize = 0x08; const TCP: usize = 0x06; const UDP: usize = 0x11; const ETH_P_ARP: usize = 0x0608; const ETH_P_RARP: usize = 0x3580; /* QryData could be written in the sense of QryData{ ... frame: .., packet: .., segment:.. } On the one hand, only the actual type of frame/packet/segment would be contained in the resulting struct. So, increased benefit in serialization/cpu time, could result in less data to be serialized, depending on layout. On the other hand, each datagram::type needs to implement traits which would need to be dynamically dispatched by returning any of these types per iso level from a single function each. The result would be a performance decrease. See: https://doc.rust-lang.org/book/ch10-02-traits.html#returning-types-that-implement-traits See: https://doc.rust-lang.org/book/ch17-02-trait-objects.html#trait-objects-perform-dynamic-dispatch Then again, parser logic would be fewer lines + more unified using the latter method. Maybe better optimizable as well? Maybe this is a nice tradeoff? TODO: Implement and benchmark dynamically dispatched packet data in conjunction with restructured QryData. */ #[derive(Debug, Clone)] pub struct QryData { pub id: i32, pub time: f64, pub data: Option>, pub ether_header: Option, pub ipv4_header: Option, pub ipv6_header: Option, pub tcp_header: Option, pub udp_header: Option, pub arp_header: Option, pub reg_res: Option, } fn init_qrydata( ) -> Result { Ok(QryData { id: 0, time: 0.0, data: None, ether_header: None::, ipv4_header: None::, ipv6_header: None::, tcp_header: None::, udp_header: None::, arp_header: None::, reg_res: None::, }) } #[allow(dead_code)] enum EncapsulationType { // pcap::Linktype::get_name() is unsafe. EN10MB = 1, // See: https://docs.rs/pcap/0.7.0/src/pcap/lib.rs.html#247-261 RAW = 101, // Would this be an issue? } impl QryData { // This is not cool! // This will get modularized into subfunctions fn encap_en10mb( packet_data: &[u8] ) -> Option { let mut pkg: QryData = init_qrydata().unwrap(); pkg.ether_header = Some(packet_handler::ethernet_handler(packet_data)).unwrap(); match pkg.ether_header.unwrap().ether_type as usize { ETH_P_IP => { pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap(); let protocol_type = pkg.ipv4_header.unwrap().ip_protocol.clone() as usize; let l3_header_length = pkg.ipv4_header.unwrap().ip_ihl; pkg.transport_layer(packet_data, protocol_type, l3_header_length).unwrap(); } ETH_P_IPV6 => { pkg.ipv6_header = Some(packet_handler::ipv6_handler(packet_data)).unwrap(); let protocol_type = pkg.ipv6_header.unwrap().next_header.clone() as usize; pkg.transport_layer(packet_data, protocol_type, 10).unwrap(); } ETH_P_ARP | ETH_P_RARP => { pkg.arp_header = Some(packet_handler::arp_handler(packet_data)).unwrap(); } _ => println!("Network protocol not implemented"), } Some(pkg) } fn encap_raw ( packet_data: &[u8] ) -> Option { let mut pkg: QryData = init_qrydata().unwrap(); let ip_version: usize = ((packet_data[0] & 0xf0) >> 4).try_into().unwrap(); match ip_version { 4 => { pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap(); let protocol_type = pkg.ipv4_header.unwrap().ip_protocol.clone() as usize; let l3_header_length = pkg.ipv4_header.unwrap().ip_ihl; pkg.transport_layer(packet_data, protocol_type, l3_header_length).unwrap(); } 6 => { pkg.ipv6_header = Some(packet_handler::ipv6_handler(packet_data)).unwrap(); let protocol_type = pkg.ipv6_header.unwrap().next_header.clone() as usize; pkg.transport_layer(packet_data, protocol_type, 10).unwrap(); } _ => println!("Network Protocol not implemented") } Some(pkg) } // TODO: impl correct Err type and use in Result fn transport_layer (&mut self, packet_data: &[u8], protocol_type: usize, l3_header_length: u32) -> Result<(), core::fmt::Error> { match protocol_type { TCP => { self.tcp_header = Some(packet_handler::tcp_handler( l3_header_length, packet_data, )) .unwrap(); self.data = Some(packet_handler::payload_handler( l3_header_length, self.tcp_header.unwrap().data_offset, packet_data, )).unwrap(); } UDP => { self.udp_header = Some(packet_handler::udp_handler( l3_header_length, packet_data, )) .unwrap(); self.data = Some(packet_handler::payload_handler( l3_header_length, 7, packet_data, )).unwrap(); } _ => println!("Transport layer protocol not implemented"), } Ok(()) } } /* Regex parse _complete_ package */ fn flag_carnage(re: &Regex, payload: &[u8]) -> Option { let mut flags: String = String::new(); for mat in re.find_iter(payload) { // TODO: Test benchmark format! vs. push_str() // flags.push_str(&format!("{} ",std::str::from_utf8(mat.as_bytes()).unwrap())); // See: https://github.com/hoodie/concatenation_benchmarks-rs flags.push_str(std::str::from_utf8(mat.as_bytes()).unwrap()); flags.push_str(";"); } match 0 < flags.len() { false => None, true => Some(flags), } } pub fn parse(parse_file: &std::path::Path, filter_str: &str, regex_filter: &str) -> Vec { let mut me: QryData = init_qrydata().unwrap(); let mut v: Vec = Vec::new(); let mut cap = Capture::from_file(parse_file).unwrap(); Capture::filter(&mut cap, &filter_str).unwrap(); let linktype = cap.get_datalink(); println!("{:?}", &linktype); let re = Regex::new(regex_filter).unwrap(); while let Ok(packet) = cap.next() { match linktype { // Syntax is clunky, but no num_derive + num_traits dependencies. Linktype(1) => me = QryData::encap_en10mb(packet.data).unwrap(), // EN10MB Linktype(101) => me = QryData::encap_raw(packet.data).unwrap(), // RAW _ => (), }; me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64; //me.data = Some(packet.data.to_vec()); me.reg_res = flag_carnage(&re, packet.data); // Regex overhead is between 4-9% --single threaded-- on complete packet [u8] data v.push(me.clone()); } v } /* This could need some love */ pub fn parse_device(parse_device: &str, filter_str: &str, insert_max: &usize, regex_filter: &str) -> Vec { let mut me: QryData = init_qrydata ( ).unwrap(); let mut v: Vec = Vec::new(); let mut cap = Capture::from_device(parse_device).unwrap().open().unwrap(); Capture::filter(&mut cap, &filter_str).unwrap(); let linktype = cap.get_datalink(); let re = Regex::new(regex_filter).unwrap(); 'parse: while let Ok(packet) = cap.next() { match linktype { Linktype(1) => me = QryData::encap_en10mb(packet.data).unwrap(), Linktype(101) => me = QryData::encap_raw(packet.data).unwrap(), _ => (), } me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64; me.reg_res = flag_carnage(&re, packet.data); v.push(me.clone()); if &v.len() >= insert_max { break 'parse; } } v }