flowscope 0.10.1

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141

//! Unit-style tests for the HTTP parser, driven via the
//! `SessionParser` API.

use flowscope::http::{HttpMessage, HttpParser, HttpRequest, HttpResponse};
use flowscope::{SessionParser, Timestamp};

#[derive(Default)]
struct Captured {
    reqs: Vec<HttpRequest>,
    resps: Vec<HttpResponse>,
}

impl Captured {
    fn ingest(&mut self, msgs: Vec<HttpMessage>) {
        for m in msgs {
            match m {
                HttpMessage::Request(r) => self.reqs.push(r),
                HttpMessage::Response(r) => self.resps.push(r),
            }
        }
    }
}

fn feed_init(parser: &mut HttpParser, captured: &mut Captured, bytes: &[u8]) {
    captured.ingest(parser.feed_initiator(bytes, Timestamp::default()));
}

fn feed_resp(parser: &mut HttpParser, captured: &mut Captured, bytes: &[u8]) {
    captured.ingest(parser.feed_responder(bytes, Timestamp::default()));
}

#[test]
fn simple_get_request() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_init(
        &mut parser,
        &mut captured,
        b"GET /index.html HTTP/1.1\r\nHost: example.com\r\n\r\n",
    );
    assert_eq!(captured.reqs.len(), 1);
    assert_eq!(captured.reqs[0].method, "GET");
    assert_eq!(captured.reqs[0].path, "/index.html");
    assert!(captured.reqs[0].body.is_empty());
}

#[test]
fn pipelined_requests() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_init(
        &mut parser,
        &mut captured,
        b"GET /a HTTP/1.1\r\nHost: x\r\n\r\n",
    );
    feed_init(
        &mut parser,
        &mut captured,
        b"GET /b HTTP/1.1\r\nHost: x\r\n\r\n",
    );
    feed_init(
        &mut parser,
        &mut captured,
        b"GET /c HTTP/1.1\r\nHost: x\r\n\r\n",
    );
    assert_eq!(captured.reqs.len(), 3);
    assert_eq!(captured.reqs[0].path, "/a");
    assert_eq!(captured.reqs[1].path, "/b");
    assert_eq!(captured.reqs[2].path, "/c");
}

#[test]
fn response_with_content_length_body() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_resp(
        &mut parser,
        &mut captured,
        b"HTTP/1.1 200 OK\r\nContent-Length: 13\r\n\r\nHello, world!",
    );
    assert_eq!(captured.resps.len(), 1);
    assert_eq!(captured.resps[0].status, 200);
    assert_eq!(&*captured.resps[0].body, b"Hello, world!");
}

#[test]
fn split_across_segments() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_init(&mut parser, &mut captured, b"GET /index.html HTTP/1.1\r\n");
    feed_init(&mut parser, &mut captured, b"Host: ex");
    feed_init(&mut parser, &mut captured, b"ample.com\r\n\r\n");
    assert_eq!(captured.reqs.len(), 1);
    assert_eq!(captured.reqs[0].path, "/index.html");
}

#[test]
fn body_split_across_segments() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_resp(
        &mut parser,
        &mut captured,
        b"HTTP/1.1 200 OK\r\nContent-Length: 13\r\n\r\nHello",
    );
    assert!(captured.resps.is_empty(), "should wait for full body");
    feed_resp(&mut parser, &mut captured, b", world!");
    assert_eq!(captured.resps.len(), 1);
    assert_eq!(&*captured.resps[0].body, b"Hello, world!");
}

#[test]
fn connection_close_body_extends_to_fin() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_resp(
        &mut parser,
        &mut captured,
        b"HTTP/1.0 200 OK\r\nConnection: close\r\n\r\n",
    );
    feed_resp(&mut parser, &mut captured, b"hello");
    assert!(captured.resps.is_empty(), "still waiting for FIN");
    feed_resp(&mut parser, &mut captured, b" world");
    // FIN flush.
    captured.ingest(parser.fin_responder());
    assert_eq!(captured.resps.len(), 1);
    assert_eq!(&*captured.resps[0].body, b"hello world");
}

#[test]
fn malformed_doesnt_panic() {
    let mut parser = HttpParser::default();
    let mut captured = Captured::default();
    feed_init(
        &mut parser,
        &mut captured,
        b"\xff\xff\xffNOT HTTP\xff\xff\r\n\r\n",
    );
    // Should not panic; the parser enters Desynced state.
    let _ = parser.fin_initiator();
}