guess 0.2.0

High-performance zero-copy network protocol detection from first bytes.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

/* src/protocols/http.rs */
use crate::{DetectionStatus, ProtocolVersion};

/// Probes for HTTP protocol and version.
#[inline(always)]
pub(crate) fn probe(data: &[u8]) -> (DetectionStatus, ProtocolVersion<'_>) {
	if data.len() < 4 {
		return (DetectionStatus::Incomplete, ProtocolVersion::Unknown);
	}

	// HTTP/2 Connection Preface
	if data.starts_with(b"PRI ") {
		if data.starts_with(b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n") {
			return (DetectionStatus::Match, ProtocolVersion::Http("2.0"));
		}
		if b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n".starts_with(data) {
			return (DetectionStatus::Incomplete, ProtocolVersion::Unknown);
		}
	}

	// HTTP/1.x Methods
	let is_method = matches!(data[0], b'G' | b'P' | b'D' | b'H' | b'O' | b'C' | b'T');
	if is_method {
		let limit = data.len().min(64);
		let mut eol = limit;
		for (i, &b) in data.iter().enumerate().take(limit) {
			if b == b'\n' {
				eol = i;
				break;
			}
		}

		let line = &data[..eol];
		if let Some(pos) = find_sub(line, b" HTTP/1.") {
			if line.len() > pos + 8 {
				let version = match line[pos + 8] {
					b'1' => "1.1",
					b'0' => "1.0",
					_ => "1.x",
				};
				return (DetectionStatus::Match, ProtocolVersion::Http(version));
			}
			return (DetectionStatus::Incomplete, ProtocolVersion::Unknown);
		}

		if is_likely_http_method(data) {
			return (DetectionStatus::Incomplete, ProtocolVersion::Unknown);
		}
	}

	(DetectionStatus::NoMatch, ProtocolVersion::Unknown)
}

/// Helper to check for common HTTP methods.
#[inline(always)]
fn is_likely_http_method(data: &[u8]) -> bool {
	data.starts_with(b"GET ")
		|| data.starts_with(b"POST ")
		|| data.starts_with(b"PUT ")
		|| data.starts_with(b"DELETE ")
		|| data.starts_with(b"HEAD ")
		|| data.starts_with(b"OPTIONS ")
		|| data.starts_with(b"CONNECT ")
		|| data.starts_with(b"TRACE ")
		|| data.starts_with(b"PATCH ")
}

/// Helper to find a substring in a byte slice.
#[inline(always)]
fn find_sub(data: &[u8], sub: &[u8]) -> Option<usize> {
	if sub.len() > data.len() {
		return None;
	}
	for i in 0..=(data.len() - sub.len()) {
		if &data[i..i + sub.len()] == sub {
			return Some(i);
		}
	}
	None
}