extern crate bitfield; extern crate byteorder; extern crate eui48; mod packet_handler; use eui48::{MacAddress}; use pcap::Capture; use regex::bytes::Regex; use std::str; //use std::thread::{spawn, JoinHandle}; //use std::sync::mpsc::{channel, Receiver}; /* protocol ids, LittleEndian */ const ETH_P_IPV6: usize = 0xDD86; const ETH_P_IP: usize = 0x08; const TCP: usize = 0x06; const UDP: usize = 0x11; const ETH_P_ARP: usize = 0x0608; const ETH_P_RARP: usize = 0x3580; fn build_ether() -> packet_handler::EtherHeader { packet_handler::EtherHeader { ether_dhost: MacAddress::new([0;6]), ether_shost: MacAddress::new([0;6]), ether_type: 0, } } /* QryData could be written in the sense of QryData{ ... frame: .., packet: .., segment:.. } On the one hand, only the actual type of frame/packet/segment would be contained in the resulting struct. So, increased benefit in serialization/cpu time, could result in less data to be serialized, depending on layout. On the other hand, each datagram::type needs to implement traits which would need to be dynamically dispatched by returning any of these types per iso level from a single function each. The result would be a performance decrease. See: https://doc.rust-lang.org/book/ch17-02-trait-objects.html#trait-objects-perform-dynamic-dispatch Then again, parser logic would be fewer lines + more unified using the latter method. Maybe better optimizable as well? Maybe this is a nice tradeoff? TODO: Implement and benchmark dynamically dispatched packet data in conjunction with restructured QryData. */ #[derive(Debug, Clone)] pub struct QryData { pub id: i32, pub time: f64, pub data: Option>, pub ether_header: packet_handler::EtherHeader, pub ipv4_header: Option, pub ipv6_header: Option, pub tcp_header: Option, pub udp_header: Option, pub arp_header: Option, pub reg_res: Option, } fn init_qrydata( ) -> Result { let ether_init = build_ether(); Ok(QryData { id: 0, time: 0.0, data: None, ether_header: ether_init, ipv4_header: None::, ipv6_header: None::, tcp_header: None::, udp_header: None::, arp_header: None::, reg_res: None::, }) } enum EncapsulationType { ETHER = 1, RAWIP = 107, } impl QryData { // This is not cool! // This will get modularized into subfunctions fn encap_ether( packet_data: &[u8] ) -> Option { let mut pkg: QryData = init_qrydata().unwrap(); pkg.ether_header = packet_handler::ethernet_handler(packet_data); match pkg.ether_header.ether_type as usize { ETH_P_IP => { //pkg.ipv6_header = None::; pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap(); match pkg.ipv4_header.unwrap().ip_protocol as usize { TCP => { // pkg.udp_header = None::; pkg.tcp_header = Some(packet_handler::tcp_handler( pkg.ipv4_header.unwrap().ip_ihl, packet_data, )) .unwrap(); pkg.data = Some(packet_handler::payload_handler( pkg.ipv4_header.unwrap().ip_ihl, pkg.tcp_header.unwrap().data_offset, packet_data, )).unwrap(); } UDP => { // pkg.tcp_header = None::; pkg.udp_header = Some(packet_handler::udp_handler( pkg.ipv4_header.unwrap().ip_ihl, packet_data, )) .unwrap(); pkg.data = Some(packet_handler::payload_handler( pkg.ipv4_header.unwrap().ip_ihl, 7, packet_data, )).unwrap(); } _ => println!("Transport layer protocol not implemented"), } } ETH_P_IPV6 => { //pkg.ipv4_header = None::; pkg.ipv6_header = Some(packet_handler::ipv6_handler(packet_data)).unwrap(); match pkg.ipv6_header.unwrap().next_header as usize { TCP => { // pkg.udp_header = None::; pkg.tcp_header = Some(packet_handler::tcp_handler(10, packet_data)).unwrap(); pkg.data = Some(packet_handler::payload_handler( 10, pkg.tcp_header.unwrap().data_offset, packet_data, )).unwrap(); } UDP => { // pkg.tcp_header = None::; pkg.udp_header = Some(packet_handler::udp_handler(10, packet_data)).unwrap(); pkg.data = Some(packet_handler::payload_handler(10, 7, packet_data)).unwrap(); } _ => println!("Transport layer protocol not implemented"), } } ETH_P_ARP | ETH_P_RARP => { pkg.arp_header = Some(packet_handler::arp_handler(packet_data)).unwrap(); pkg.data = None; } _ => println!("Network protocol not implemented"), } Some(pkg) } fn encap_rawip ( packet_data: &[u8] ) -> Option { let mut pkg: QryData = init_qrydata().unwrap(); //pkg.ether_header = None::; //pkg.ipv6_header = None::; pkg.ipv4_header = Some(packet_handler::ip_handler(packet_data)).unwrap(); match pkg.ipv4_header.unwrap().ip_protocol as usize { TCP => { pkg.udp_header = None::; pkg.tcp_header = Some(packet_handler::tcp_handler( pkg.ipv4_header.unwrap().ip_ihl, packet_data, )) .unwrap(); pkg.data = Some(packet_handler::payload_handler( pkg.ipv4_header.unwrap().ip_ihl, pkg.tcp_header.unwrap().data_offset, packet_data, )).unwrap(); } UDP => { pkg.tcp_header = None::; pkg.udp_header = Some(packet_handler::udp_handler( pkg.ipv4_header.unwrap().ip_ihl, packet_data, )) .unwrap(); pkg.data = Some(packet_handler::payload_handler( pkg.ipv4_header.unwrap().ip_ihl, 7, packet_data, )).unwrap(); } _ => println!("Transport layer protocol not implemented"), } Some(pkg) } } /* Regex parse _complete_ package */ fn flag_carnage(re: &Regex, payload: &[u8]) -> Option { let mut flags: String = String::new(); for mat in re.find_iter(payload) { // TODO: Test benchmark format! vs. push_str() // flags.push_str(&format!("{} ",std::str::from_utf8(mat.as_bytes()).unwrap())); // See: https://github.com/hoodie/concatenation_benchmarks-rs flags.push_str(std::str::from_utf8(mat.as_bytes()).unwrap()); flags.push_str(";"); } match 0 < flags.len() { false => None, true => Some(flags), } } pub fn parse(parse_file: &std::path::Path, filter_str: &str, regex_filter: &str, encap: u16) -> Vec { let mut me: QryData = init_qrydata().unwrap(); let mut v: Vec = Vec::new(); let mut cap = Capture::from_file(parse_file).unwrap(); Capture::filter(&mut cap, &filter_str).unwrap(); let re = Regex::new(regex_filter).unwrap(); while let Ok(packet) = cap.next() { match encap { // Syntax is clunky, but no num_derive + num_traits dependencies. encap if encap == EncapsulationType::ETHER as u16 => me = QryData::encap_ether(packet.data).unwrap(), encap if encap == EncapsulationType::RAWIP as u16 => me = QryData::encap_rawip(packet.data).unwrap(), _ => (), }; me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64; //me.data = Some(packet.data.to_vec()); me.reg_res = flag_carnage(&re, packet.data); // Regex overhead is between 4-9% --single threaded-- on complete packet [u8] data v.push(me.clone()); } v } /* This could need some love */ pub fn parse_device(parse_device: &str, filter_str: &str, insert_max: &usize, regex_filter: &str) -> Vec { let mut me: QryData = init_qrydata ( ).unwrap(); let mut v: Vec = Vec::new(); let mut cap = Capture::from_device(parse_device).unwrap().open().unwrap(); Capture::filter(&mut cap, &filter_str).unwrap(); let re = Regex::new(regex_filter).unwrap(); 'parse: while let Ok(packet) = cap.next() { me.time = (packet.header.ts.tv_usec as f64 / 1000000.0) + packet.header.ts.tv_sec as f64; me.data = Some(packet.data.to_vec()); me.reg_res = flag_carnage(&re, packet.data); me.ether_header = packet_handler::ethernet_handler(packet.data); match me.ether_header.ether_type as usize { ETH_P_IP => { me.ipv6_header = None::; me.ipv4_header = Some(packet_handler::ip_handler(packet.data)).unwrap(); match me.ipv4_header.unwrap().ip_protocol as usize { TCP => { me.tcp_header = Some(packet_handler::tcp_handler( me.ipv4_header.unwrap().ip_ihl, packet.data, )) .unwrap(); me.data = Some(packet_handler::payload_handler( me.ipv4_header.unwrap().ip_ihl, me.tcp_header.unwrap().data_offset, packet.data, )).unwrap(); } UDP => { me.udp_header = Some(packet_handler::udp_handler( me.ipv4_header.unwrap().ip_ihl, packet.data, )) .unwrap(); me.data = Some(packet_handler::payload_handler( me.ipv4_header.unwrap().ip_ihl, 7, packet.data, )).unwrap(); } _ => println!("network protocol not implemented"), } } ETH_P_IPV6 => { me.ipv4_header = None::; me.ipv6_header = Some(packet_handler::ipv6_handler(packet.data)).unwrap(); match me.ipv6_header.unwrap().next_header as usize { TCP => { me.tcp_header = Some(packet_handler::tcp_handler(10, packet.data)).unwrap(); me.data = Some(packet_handler::payload_handler( 10, me.tcp_header.unwrap().data_offset, packet.data, )).unwrap(); } UDP => { me.udp_header = Some(packet_handler::udp_handler(10, packet.data)).unwrap(); me.data = Some(packet_handler::payload_handler(10, 7, packet.data)).unwrap(); } _ => println!("network protocol not implemented"), } } ETH_P_ARP | ETH_P_RARP => { me.arp_header = Some(packet_handler::arp_handler(packet.data)).unwrap(); me.data = None; } _ => println!("network protocol not implemented"), } v.push(QryData { id: 0, time: me.time, data: me.data, ether_header: me.ether_header, ipv4_header: me.ipv4_header, ipv6_header: me.ipv6_header, tcp_header: me.tcp_header, udp_header: me.udp_header, arp_header: me.arp_header, reg_res: me.reg_res, }); if &v.len() >= insert_max { break 'parse; } } v }