huginn-net 2.0.0

Multi-protocol passive fingerprinting library: TCP/HTTP (p0f-style) + TLS (JA4) analysis
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

#[cfg(feature = "http-p0f-request")]
use huginn_net_http::output::HttpRequestOutput;
#[cfg(feature = "http-p0f-response")]
use huginn_net_http::output::HttpResponseOutput;
#[cfg(feature = "tcp-mtu")]
use huginn_net_tcp::output::MTUOutput;
#[cfg(feature = "tcp-syn-ack")]
use huginn_net_tcp::output::SynAckTCPOutput;
#[cfg(feature = "tcp-syn")]
use huginn_net_tcp::output::SynTCPOutput;
#[cfg(feature = "tcp-uptime")]
use huginn_net_tcp::output::UptimeOutput;
use huginn_net_tls::output::TlsClientOutput;

/// Represents the output from the Huginn Net analyzer.
///
/// This struct contains various optional outputs that can be derived
/// from analyzing TCP, HTTP, and TLS packets.
#[derive(Debug)]
#[cfg_attr(feature = "json", derive(serde::Serialize))]
pub struct FingerprintResult {
    /// Information derived from TCP SYN packets.
    ///
    /// Present only when the `tcp-syn` feature is enabled.
    #[cfg(feature = "tcp-syn")]
    pub tcp_syn: Option<SynTCPOutput>,

    /// Information derived from TCP SYN-ACK packets.
    ///
    /// Present only when the `tcp-syn-ack` feature is enabled.
    #[cfg(feature = "tcp-syn-ack")]
    pub tcp_syn_ack: Option<SynAckTCPOutput>,

    /// Information about the TCP Maximum Transmission Unit (MTU).
    ///
    /// Present only when the `tcp-mtu` feature is enabled.
    #[cfg(feature = "tcp-mtu")]
    pub tcp_mtu: Option<MTUOutput>,

    /// Information about the TCP client system uptime.
    ///
    /// Present only when the `tcp-uptime` feature is enabled.
    #[cfg(feature = "tcp-uptime")]
    pub tcp_client_uptime: Option<UptimeOutput>,

    /// Information about the TCP server system uptime.
    ///
    /// Present only when the `tcp-uptime` feature is enabled.
    #[cfg(feature = "tcp-uptime")]
    pub tcp_server_uptime: Option<UptimeOutput>,

    /// Information derived from HTTP request headers.
    ///
    /// Present only when the `http-p0f-request` feature is enabled.
    #[cfg(feature = "http-p0f-request")]
    pub http_request: Option<HttpRequestOutput>,

    /// Information derived from HTTP response headers.
    ///
    /// Present only when the `http-p0f-response` feature is enabled.
    #[cfg(feature = "http-p0f-response")]
    pub http_response: Option<HttpResponseOutput>,

    /// Information derived from TLS ClientHello analysis using JA4 fingerprinting.
    /// JA4 methodology by FoxIO, LLC - implementation from scratch for Huginn Net.
    pub tls_client: Option<TlsClientOutput>,
}

impl FingerprintResult {
    #[must_use]
    pub fn is_empty(&self) -> bool {
        #[cfg(feature = "tcp-syn")]
        if self.tcp_syn.is_some() {
            return false;
        }
        #[cfg(feature = "tcp-syn-ack")]
        if self.tcp_syn_ack.is_some() {
            return false;
        }
        #[cfg(feature = "tcp-mtu")]
        if self.tcp_mtu.is_some() {
            return false;
        }
        #[cfg(feature = "tcp-uptime")]
        if self.tcp_client_uptime.is_some() {
            return false;
        }
        #[cfg(feature = "tcp-uptime")]
        if self.tcp_server_uptime.is_some() {
            return false;
        }
        #[cfg(feature = "http-p0f-request")]
        if self.http_request.is_some() {
            return false;
        }
        #[cfg(feature = "http-p0f-response")]
        if self.http_response.is_some() {
            return false;
        }
        if self.tls_client.is_some() {
            return false;
        }
        true
    }
}