Crate http_collator 

HTTP collation library

Collates individual data events (from eBPF, pcap, etc.) into complete HTTP request/response exchanges. Supports both HTTP/1.x and HTTP/2.

Usage

Implement the DataEvent trait for your data source, then feed events to the Collator:

use http_collator::{Collator, CollationEvent, DataEvent, Direction};
use bytes::Bytes;

struct MyEvent {
    payload: Vec<u8>,
    timestamp_ns: u64,
    direction: Direction,
    connection_id: u64,
    process_id: u32,
    remote_port: u16,
}

impl DataEvent for MyEvent {
    fn payload(&self) -> &[u8] { &self.payload }
    fn timestamp_ns(&self) -> u64 { self.timestamp_ns }
    fn direction(&self) -> Direction { self.direction }
    fn connection_id(&self) -> u64 { self.connection_id }
    fn process_id(&self) -> u32 { self.process_id }
    fn remote_port(&self) -> u16 { self.remote_port }
}

let collator = Collator::<MyEvent>::new();
for event in collator.add_event(my_event) {
    match event {
        CollationEvent::Message { message, metadata } => {
            println!("parsed message for conn {}", metadata.connection_id);
        }
        CollationEvent::Exchange(exchange) => {
            println!("complete exchange: {exchange}");
        }
    }
}

Modules

h1

HTTP/1.x parsing utilities

Structs

Collator

Collates individual data events into complete request/response exchanges.

CollatorConfig

Configuration for what the collator emits

Exchange

A complete request/response exchange

HttpRequest

HTTP request parsed from any HTTP version

HttpResponse

HTTP response parsed from any HTTP version

MessageMetadata

Metadata about a parsed message

Enums

CollationEvent

Events emitted by the collator

Direction

Direction of data flow for a network event.

ParsedHttpMessage

Classification of parsed HTTP message

Protocol

Protocol detected for a connection

Constants

MAX_BUF_SIZE

Default maximum buffer size for data events (TLS record size)

Traits

DataEvent

Trait for data events that can be collated into HTTP exchanges.

Functions

detect_protocol

Detect whether raw bytes look like HTTP/1.x or HTTP/2 traffic.