flowscope 0.18.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

//! Smoke tests for the per-parser `*_from_pcap` helpers and
//! `Driver::run_pcap`. Walks the bundled fixtures end-to-end
//! through each one-call iterator and asserts on its shape.

#![cfg(all(feature = "pcap", feature = "extractors", feature = "tracker"))]

const HTTP_PCAP: &str = "tests/data/http_session.pcap";
const DNS_PCAP: &str = "tests/data/dns_queries.pcap";

#[test]
#[cfg(feature = "http")]
fn http_requests_from_pcap_walks_fixture() {
    let mut count = 0u32;
    for (_key, req) in flowscope::http::requests_from_pcap(HTTP_PCAP).expect("open") {
        count += 1;
        assert!(req.method_str().is_some());
    }
    assert!(count > 0, "expected ≥1 HTTP request in {HTTP_PCAP}");
}

#[test]
#[cfg(feature = "http")]
fn http_responses_from_pcap_walks_fixture() {
    let mut count = 0u32;
    for (_key, resp) in flowscope::http::responses_from_pcap(HTTP_PCAP).expect("open") {
        count += 1;
        assert!(resp.status >= 100);
    }
    assert!(count > 0, "expected ≥1 HTTP response in {HTTP_PCAP}");
}

#[test]
#[cfg(feature = "http")]
fn http_exchanges_from_pcap_walks_fixture() {
    let mut count = 0u32;
    for (_key, ex) in flowscope::http::exchanges_from_pcap(HTTP_PCAP).expect("open") {
        count += 1;
        assert!(ex.request.method_str().is_some());
    }
    assert!(count > 0);
}

#[test]
#[cfg(feature = "dns")]
fn dns_messages_from_pcap_walks_fixture() {
    let mut count = 0u32;
    for (_key, _msg) in flowscope::dns::messages_from_pcap(DNS_PCAP).expect("open") {
        count += 1;
    }
    assert!(count > 0, "expected ≥1 DNS message in {DNS_PCAP}");
}

#[test]
fn flow_summaries_from_pcap_walks_fixture() {
    let summaries: Vec<_> = flowscope::pcap::flow_summaries_from_pcap(HTTP_PCAP)
        .expect("open")
        .collect();
    assert!(!summaries.is_empty(), "expected ≥1 flow summary");
    let (_key, stats, _reason) = &summaries[0];
    assert!(stats.bytes_initiator + stats.bytes_responder > 0);
}

#[test]
fn driver_run_pcap_yields_lifecycle_events() {
    use flowscope::driver::{Driver, Event};
    use flowscope::extract::FiveTuple;

    let driver = Driver::builder(FiveTuple::bidirectional()).build();
    let mut started = 0u32;
    let mut ended = 0u32;
    for ev in driver.run_pcap(HTTP_PCAP).expect("open") {
        match ev.expect("event") {
            Event::FlowStarted { .. } => started += 1,
            Event::FlowEnded { .. } => ended += 1,
            _ => {}
        }
    }
    assert!(started > 0, "expected ≥1 FlowStarted");
    assert!(ended > 0, "expected ≥1 FlowEnded after iterator drain");
}

#[test]
#[cfg(feature = "http")]
fn driver_run_pcap_drives_registered_slots() {
    use flowscope::driver::{Driver, SlotMessage};
    use flowscope::extract::{FiveTuple, FiveTupleKey};
    use flowscope::http::{HttpMessage, HttpParser};

    let mut builder = Driver::builder(FiveTuple::bidirectional());
    let mut http_slot = builder.session_on_ports(HttpParser::default(), [80, 8080]);
    let driver = builder.build();

    // Drain the iterator; messages should land in the slot.
    for ev in driver.run_pcap(HTTP_PCAP).expect("open") {
        let _ = ev.expect("event");
    }
    let mut msgs: Vec<SlotMessage<HttpMessage, FiveTupleKey>> = Vec::new();
    http_slot.drain(&mut msgs);
    assert!(
        !msgs.is_empty(),
        "expected HTTP slot to receive ≥1 message during run_pcap"
    );
}