rustflow_export 0.14.0

IPFIX exporter for captured network traffic; the `rustflow export` command
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

use anyhow::Result;

use crate::flow::FlowKey;

#[cfg(target_os = "linux")]
mod af_packet;
#[cfg(target_os = "macos")]
mod bpf;
#[cfg(feature = "pcap")]
mod libpcap;
#[cfg(any(target_os = "linux", target_os = "macos", feature = "pcap"))]
mod packet;

pub trait Capture {
    fn next_packet(&mut self) -> Option<PacketInfo>;
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
pub enum Backend {
    /// The native backend of this platform
    Auto,
    /// AF_PACKET mmap ring (Linux only)
    AfPacket,
    /// BPF device, `/dev/bpfN` (macOS only)
    Bpf,
    /// libpcap / Npcap
    Pcap,
}

pub fn open(
    backend: Backend,
    interface: &str,
    promiscuous: bool,
    sampling_interval: u32,
) -> Result<Box<dyn Capture>> {
    match backend {
        Backend::Auto if cfg!(target_os = "linux") => {
            open_af_packet(interface, promiscuous, sampling_interval)
        }
        Backend::Auto if cfg!(target_os = "macos") => {
            open_bpf(interface, promiscuous, sampling_interval)
        }
        Backend::Auto | Backend::Pcap => open_pcap(interface, promiscuous, sampling_interval),
        Backend::AfPacket => open_af_packet(interface, promiscuous, sampling_interval),
        Backend::Bpf => open_bpf(interface, promiscuous, sampling_interval),
    }
}

#[cfg(target_os = "linux")]
fn open_af_packet(
    interface: &str,
    promiscuous: bool,
    sampling_interval: u32,
) -> Result<Box<dyn Capture>> {
    Ok(Box::new(af_packet::AfPacket::new(
        interface,
        promiscuous,
        sampling_interval,
    )?))
}

#[cfg(not(target_os = "linux"))]
fn open_af_packet(_: &str, _: bool, _: u32) -> Result<Box<dyn Capture>> {
    anyhow::bail!("The af-packet capture backend requires Linux; use --capture pcap")
}

#[cfg(target_os = "macos")]
fn open_bpf(
    interface: &str,
    promiscuous: bool,
    sampling_interval: u32,
) -> Result<Box<dyn Capture>> {
    Ok(Box::new(bpf::Bpf::new(
        interface,
        promiscuous,
        sampling_interval,
    )?))
}

#[cfg(not(target_os = "macos"))]
fn open_bpf(_: &str, _: bool, _: u32) -> Result<Box<dyn Capture>> {
    anyhow::bail!("The bpf capture backend requires macOS; use --capture pcap")
}

#[cfg(feature = "pcap")]
fn open_pcap(
    interface: &str,
    promiscuous: bool,
    sampling_interval: u32,
) -> Result<Box<dyn Capture>> {
    Ok(Box::new(libpcap::Libpcap::new(
        interface,
        promiscuous,
        sampling_interval,
    )?))
}

#[cfg(not(feature = "pcap"))]
fn open_pcap(_: &str, _: bool, _: u32) -> Result<Box<dyn Capture>> {
    anyhow::bail!("This build has no pcap support; rebuild with `--features pcap`")
}

#[derive(Debug, Clone)]
pub struct PacketInfo {
    pub flow_key: FlowKey,
    pub packet_size: u64,
    pub tcp_flags: u16,
}