use byteorder::{BigEndian, LittleEndian};
use crate::errors::PcapError;
use crate::pcapng::blocks::{Block, ParsedBlock, EnhancedPacketBlock, InterfaceDescriptionBlock};
use crate::Endianness;
pub struct PcapNgParser {
section: Block<'static>,
interfaces: Vec<Block<'static>>
}
impl PcapNgParser {
pub fn new(src: &[u8]) -> Result<(&[u8], Self), PcapError> {
let (rem, block) = Block::from_slice::<BigEndian>(src)?;
match block.parsed {
ParsedBlock::SectionHeader(_) => {},
_ => return Err(PcapError::InvalidField("SectionHeader missing"))
}
let section = block.to_owned(block.section_header().unwrap().endianness());
let parser = PcapNgParser {
section,
interfaces: vec![]
};
Ok((rem, parser))
}
pub fn next_block<'a>(&mut self, src: &'a [u8]) -> Result<(&'a [u8], Block<'a>), PcapError> {
let endianess = self.section.section_header().unwrap().endianness();
let block_res = if endianess == Endianness::Big {
Block::from_slice::<BigEndian>(src)
}
else {
Block::from_slice::<LittleEndian>(src)
};
if let Ok((_, block)) = &block_res {
if block.section_header().is_some() {
self.section = block.to_owned(endianess);
self.interfaces.clear();
}
else if block.interface_description().is_some() {
self.interfaces.push(block.to_owned(endianess));
}
}
block_res
}
pub fn section(&self) -> &Block<'static> {
&self.section
}
pub fn interfaces(&self) -> &[Block<'static>] {
&self.interfaces[..]
}
pub fn packet_interface(&self, packet: &EnhancedPacketBlock) -> Option<&InterfaceDescriptionBlock> {
self.interfaces.get(packet.interface_id as usize).map(|block| block.interface_description().unwrap())
}
}