capfile 0.1.2

Pure Rust crate for reading/writing pcap/pcapng files with zero-copy parsing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

//! Memory-mapped file reading for zero-copy access

#[cfg(feature = "std")]
use memmap2::Mmap;
use std::fs::File;
use std::path::Path;

use crate::error::Error;
use crate::format::pcap::PcapHeader;
use crate::reader::PacketRef;

/// A zero-copy PCAP reader using memory mapping
pub struct PcapReaderMmap {
    data: Mmap,
    header: PcapHeader,
    position: usize,
    is_nano: bool,
}

impl PcapReaderMmap {
    /// Open a pcap file with memory mapping
    pub fn open<P: AsRef<Path>>(path: P) -> Result<Self, Error> {
        let file = File::open(path)?;
        // SAFETY: memmap2::Mmap::map is unsafe because it assumes the file
        // won't change during the lifetime of the mapping. We hold the file
        // open for the duration of the mapping's lifetime, ensuring safety.
        // The file is valid for the entire duration of this reader.
        let data = unsafe { Mmap::map(&file)? };

        let (header, _) = PcapHeader::parse(&data)?;

        Ok(Self {
            data,
            header,
            position: 24, // Skip header
            is_nano: header.is_nano(),
        })
    }

    /// Get the pcap header
    pub fn header(&self) -> PcapHeader {
        self.header
    }

    /// Get link type
    pub fn link_type(&self) -> u32 {
        self.header.network
    }

    /// Read the next packet using zero-copy mmap
    pub fn next_packet(&mut self) -> Result<Option<PacketRef>, Error> {
        if self.position + 16 > self.data.len() {
            return Ok(None);
        }

        let ts_sec = u32::from_le_bytes([
            self.data[self.position],
            self.data[self.position + 1],
            self.data[self.position + 2],
            self.data[self.position + 3],
        ]);
        let ts_usec = u32::from_le_bytes([
            self.data[self.position + 4],
            self.data[self.position + 5],
            self.data[self.position + 6],
            self.data[self.position + 7],
        ]);
        let incl_len = u32::from_le_bytes([
            self.data[self.position + 8],
            self.data[self.position + 9],
            self.data[self.position + 10],
            self.data[self.position + 11],
        ]);
        let orig_len = u32::from_le_bytes([
            self.data[self.position + 12],
            self.data[self.position + 13],
            self.data[self.position + 14],
            self.data[self.position + 15],
        ]);

        self.position += 16;

        let timestamp_ns = if self.is_nano {
            (ts_sec as u64) * 1_000_000_000 + ts_usec as u64
        } else {
            (ts_sec as u64) * 1_000_000_000 + (ts_usec as u64) * 1000
        };

        let data_len = incl_len as usize;
        if self.position + data_len > self.data.len() {
            return Ok(None);
        }

        let packet_data = &self.data[self.position..self.position + data_len];
        self.position += data_len;

        Ok(Some(PacketRef::new(
            packet_data,
            timestamp_ns,
            orig_len,
            incl_len,
        )))
    }

    /// Get current position in file
    pub fn position(&self) -> usize {
        self.position
    }

    /// Check if there are more packets
    pub fn has_more(&self) -> bool {
        self.position < self.data.len()
    }
}

/// Iterator over packets using mmap
pub struct PcapIteratorMmap {
    reader: PcapReaderMmap,
}

impl Iterator for PcapIteratorMmap {
    type Item = Result<PacketRef, Error>;

    fn next(&mut self) -> Option<Self::Item> {
        self.reader.next_packet().transpose()
    }
}

impl IntoIterator for PcapReaderMmap {
    type Item = Result<PacketRef, Error>;
    type IntoIter = PcapIteratorMmap;

    fn into_iter(self) -> Self::IntoIter {
        PcapIteratorMmap { reader: self }
    }
}