huginn-net-http 2.0.0

HTTP fingerprinting (p0f-style) analysis for huginn-net
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

use huginn_net_http::packet_parser::{
    detect_datalink_format, parse_packet, DatalinkFormat, IpPacket,
};
use pnet::packet::Packet;

#[test]
fn test_detect_null_datalink() {
    // NULL datalink: 4-byte header + IPv6 packet
    let null_packet = vec![
        0x1e, 0x00, 0x00, 0x00, // NULL header
        0x60, 0x00, 0x00, 0x00, // IPv6 header start (version=6)
        0x00, 0x14, 0x06, 0x40, // IPv6 payload length, next header (TCP), hop limit
        // Add minimal IPv6 addresses (32 bytes total)
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, // src
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, // dst
    ];

    let format = detect_datalink_format(&null_packet);
    assert_eq!(format, Some(DatalinkFormat::Null));
}

#[test]
fn test_detect_raw_ipv4() {
    // Raw IPv4 packet (no datalink header)
    let raw_ipv4 = vec![
        0x45, 0x00, 0x00, 0x1c, // Version=4, IHL=5, TOS=0, Total Length=28
        0x00, 0x00, 0x40, 0x00, // ID=0, Flags=0x4000 (DF), Fragment Offset=0
        0x40, 0x06, 0x7c, 0xb0, // TTL=64, Protocol=TCP(6), Checksum
        0xc0, 0xa8, 0x01, 0x01, // Source IP: 192.168.1.1
        0xc0, 0xa8, 0x01, 0x02, // Dest IP: 192.168.1.2
    ];
    let format = detect_datalink_format(&raw_ipv4);
    assert_eq!(format, Some(DatalinkFormat::RawIp));
}

#[test]
fn test_detect_raw_ipv6() {
    // Raw IPv6 packet (no datalink header)
    let raw_ipv6 = vec![
        0x60, 0x00, 0x00, 0x00, // Version=6, Traffic Class=0, Flow Label=0
        0x00, 0x00, 0x06, 0x40, // Payload Length=0, Next Header=TCP(6), Hop Limit=64
        // Source address: 2001:db8::1
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, // Destination address: 2001:db8::2
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02,
    ];
    let format = detect_datalink_format(&raw_ipv6);
    assert_eq!(format, Some(DatalinkFormat::RawIp));
}

#[test]
fn test_detect_ethernet_ipv4() {
    // Ethernet frame with IPv4 payload
    let ethernet_ipv4 = vec![
        // Ethernet header (14 bytes)
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Destination MAC
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Source MAC
        0x08, 0x00, // EtherType: IPv4
        // IPv4 header
        0x45, 0x00, 0x00, 0x1c, // Version=4, IHL=5, TOS=0, Total Length=28
        0x00, 0x00, 0x40, 0x00, // ID=0, Flags=0x4000 (DF), Fragment Offset=0
        0x40, 0x06, 0x7c, 0xb0, // TTL=64, Protocol=TCP(6), Checksum
        0xc0, 0xa8, 0x01, 0x01, // Source IP: 192.168.1.1
        0xc0, 0xa8, 0x01, 0x02, // Dest IP: 192.168.1.2
    ];
    let format = detect_datalink_format(&ethernet_ipv4);
    assert_eq!(format, Some(DatalinkFormat::Ethernet));
}

#[test]
fn test_detect_ethernet_ipv6() {
    // Ethernet frame with IPv6 payload
    let ethernet_ipv6 = vec![
        // Ethernet header (14 bytes)
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Destination MAC
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Source MAC
        0x86, 0xDD, // EtherType: IPv6
        // IPv6 header (40 bytes)
        0x60, 0x00, 0x00, 0x00, // Version=6, Traffic Class=0, Flow Label=0
        0x00, 0x00, 0x06, 0x40, // Payload Length=0, Next Header=TCP(6), Hop Limit=64
        // Source address: 2001:db8::1
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, // Destination address: 2001:db8::2
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02,
    ];
    let format = detect_datalink_format(&ethernet_ipv6);
    assert_eq!(format, Some(DatalinkFormat::Ethernet));
}

#[test]
fn test_parse_ethernet_ipv4() {
    // Test parsing Ethernet frame with IPv4
    let ethernet_ipv4 = vec![
        // Ethernet header (14 bytes)
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Destination MAC
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Source MAC
        0x08, 0x00, // EtherType: IPv4
        // IPv4 header
        0x45, 0x00, 0x00, 0x1c, // Version=4, IHL=5, TOS=0, Total Length=28
        0x00, 0x00, 0x40, 0x00, // ID=0, Flags=0x4000 (DF), Fragment Offset=0
        0x40, 0x06, 0x7c, 0xb0, // TTL=64, Protocol=TCP(6), Checksum
        0xc0, 0xa8, 0x01, 0x01, // Source IP: 192.168.1.1
        0xc0, 0xa8, 0x01, 0x02, // Dest IP: 192.168.1.2
    ];
    match parse_packet(&ethernet_ipv4) {
        IpPacket::Ipv4(ipv4) => {
            assert_eq!(ipv4.get_version(), 4); // Version=4
            assert_eq!(ipv4.get_header_length(), 5); // IHL=5 (5 * 4 = 20 bytes)
        }
        _ => panic!("Expected IPv4 packet"),
    }
}

#[test]
fn test_parse_raw_ipv6() {
    // Test parsing raw IPv6 packet
    let raw_ipv6 = vec![
        0x60, 0x00, 0x00, 0x00, // Version=6, Traffic Class=0, Flow Label=0
        0x00, 0x00, 0x06, 0x40, // Payload Length=0, Next Header=TCP(6), Hop Limit=64
        // Source address: 2001:db8::1
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, // Destination address: 2001:db8::2
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02,
    ];
    match parse_packet(&raw_ipv6) {
        IpPacket::Ipv6(ipv6) => {
            assert_eq!(ipv6.get_version(), 6); // Version=6
            assert_eq!(ipv6.packet().len(), 40); // IPv6 header length
        }
        _ => panic!("Expected IPv6 packet"),
    }
}

#[test]
fn test_parse_null_datalink_ipv6() {
    // Test parsing NULL datalink with IPv6
    let null_ipv6 = vec![
        0x1e, 0x00, 0x00, 0x00, // NULL header
        0x60, 0x00, 0x00, 0x00, // IPv6 header start (version=6)
        0x00, 0x14, 0x06, 0x40, // IPv6 payload length, next header (TCP), hop limit
        // Add minimal IPv6 addresses (32 bytes total)
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, // src
        0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, // dst
    ];
    match parse_packet(&null_ipv6) {
        IpPacket::Ipv6(ipv6) => {
            assert_eq!(ipv6.get_version(), 6); // Version=6
            assert_eq!(ipv6.packet().len(), 40); // IPv6 header (40 bytes total)
        }
        _ => panic!("Expected NULL datalink IPv6 packet"),
    }
}