1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198

use std::str::from_utf8;

use chrono::{DateTime, Utc, NaiveDateTime};
use jsonpath_rust::JsonPathFinder;
use serde_json::Value;
use unescape::unescape;

pub struct JsonParser;

impl JsonParser {
    pub fn find(json_binary: &[u8], path: &str) -> Value {
        let json = from_utf8(json_binary).unwrap();
        let finder = JsonPathFinder::from_str(json, path).expect("path not found");

        finder.find()
    }
    pub fn first(value: &Value) -> Option<&Value> {
        let value_json = value.as_array().unwrap();
        if value_json.len() > 1 {
            panic!("currently supported only one packet in the file: CU-861mdc6t7")
        }

        value_json.first()
    }

    pub fn print(json_path_value: &Value) -> String {
        format!("{}", json_path_value)
    }

    pub fn pretty(json_path_value: &Value) -> String {
        format!("{:#}", json_path_value)
    }

    pub fn get_vec(json_path_value: Value) -> Vec<u8> {
        serde_json::to_vec(&json_path_value).unwrap()
    }

    pub fn get_string(mut json_path_value: Value) -> String {
        let value = json_path_value.get_mut(0).take()
            .expect("value not found");

        unescape(value.as_str().unwrap()).unwrap()
    }

    pub fn get_utc_frame_time(json_path_value: Value) -> DateTime<Utc> {
        const FORMAT_STR: &str = "%b %d, %Y %H:%M:%S.%f %Z";
        let datetime_str = Self::get_string(json_path_value);
        NaiveDateTime::parse_from_str(&datetime_str, FORMAT_STR).unwrap().and_utc()
    }

    pub fn get_utc_timestamp_millis(json_path_value: Value) -> i64 {
        let path_value = JsonParser::get_string(json_path_value);
        let timestamp: Vec<&str> = path_value
            .split('.')
            .collect();
        let fraction = &timestamp.get(1).unwrap()[0..3];
        format!("{}{}", &timestamp.first().unwrap(), fraction).parse::<i64>().unwrap()
    }

    pub fn get_utc_timestamp_nanos(json_path_value: Value) -> i64 {
        let value_str: String = JsonParser::get_string(json_path_value).split('.').collect();

        value_str.parse::<i64>().unwrap()
    }
}

#[cfg(test)]
mod tests {
    use chrono::NaiveDateTime;

    use crate::file::files::Files;
    use crate::jsons::json_pcap_parser::PATH_FRAME_TIME_EPOCH;
    use crate::test_resources;

    use super::*;

    #[test]
    fn expected_extract_layer() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp.json"));
        let json_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted.json"));

        let result = JsonParser::find(&pcap_buffer, "$.._source.layers");
        let json = JsonParser::print(&result);

        assert_eq!(json, from_utf8(&json_buffer).unwrap());
    }

    #[test]
    #[should_panic]
    fn support_only_one_packet_in_file() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/dhcp.pcap"));

        let value = JsonParser::find(&pcap_buffer, "$.._source.layers");
        JsonParser::first(&value);
    }

    #[test]
    fn expected_extract_layer_pretty() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp.json"));
        let json_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));

        let result = JsonParser::find(&pcap_buffer, "$.._source.layers");
        let json = JsonParser::pretty(&result);

        assert_eq!(json, from_utf8(&json_buffer).unwrap());
    }

    #[test]
    fn expected_extract_frame_time() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));

        let result = JsonParser::find(&pcap_buffer, "$..frame['frame.time']");
        let time = JsonParser::get_string(result);

        assert_eq!(time, "Sep 18, 2013 04:49:07.000000000 UTC");
    }

    #[test]
    fn expected_get_utc_timestamp_millis() {
        const EXPECTED_TIME: i64 = 1379479747000;

        let pcap_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));
        let value = JsonParser::find(&pcap_buffer, PATH_FRAME_TIME_EPOCH);
        let result = JsonParser::get_utc_timestamp_millis(value);

        assert_eq!(result, EXPECTED_TIME)
    }

    #[test]
    fn expected_get_utc_timestamp_nanos() {
        const EXPECTED_TIME: i64 = 1379479747000000000;

        let pcap_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));
        let value = JsonParser::find(&pcap_buffer, PATH_FRAME_TIME_EPOCH);
        let result = JsonParser::get_utc_timestamp_nanos(value);

        assert_eq!(result, EXPECTED_TIME)
    }

    #[test]
    fn expected_get_utc_timestamp_nanos_2() {
        const EXPECTED_TIME: i64 = 1688714981480935000;

        let pcap_buffer = Files::read_vector(test_resources!("captures/epoch_frame_time.json"));
        let value = JsonParser::find(&pcap_buffer, PATH_FRAME_TIME_EPOCH);
        let result = JsonParser::get_utc_timestamp_nanos(value);

        assert_eq!(result, EXPECTED_TIME)
    }

    #[test]
    #[should_panic]
    fn panic_if_unknown_path() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));

        let unknown_path = "";
        JsonParser::find(&pcap_buffer, unknown_path);
    }

    #[test]
    #[should_panic]
    fn panic_if_value_not_found() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted_pretty.json"));

        let unknown_path = "$..frame1";
        let result = JsonParser::find(&pcap_buffer, unknown_path);
        JsonParser::get_string(result);
    }

    #[test]
    fn expected_extract_layer_and_return_vec() {
        let pcap_buffer = Files::read_vector(test_resources!("captures/arp.json"));
        let json_buffer = Files::read_vector(test_resources!("captures/arp_layer_extracted.json"));

        let result = JsonParser::find(&pcap_buffer, "$.._source.layers");
        let json = JsonParser::get_vec(result);

        assert_eq!(json, json_buffer);
    }

    #[test]
    fn expected_convert_frame_time_to_date_time() {
        let time = NaiveDateTime::parse_from_str("Sat, 11 Feb 2023 23:40:00.000000000 UTC", "%a, %d %b %Y %H:%M:%S.%f %Z").unwrap().and_utc();
        println!("{:?}", time);

        let time = NaiveDateTime::parse_from_str("Sep 18, 2013 07:49:07.000000000 EEST", "%b %d, %Y %H:%M:%S.%f %Z").unwrap().and_utc();
        println!("{:?}", time);

        let time = NaiveDateTime::parse_from_str("Dec  5, 2004 21:16:24.317453000 EET", "%b %d, %Y %H:%M:%S.%f %Z").unwrap().and_utc();
        println!("{:?}", time);

        let pcap_buffer = Files::read_vector(test_resources!("captures/arp.json"));
        let result = JsonParser::find(&pcap_buffer, "$..frame['frame.time']");
        let time = JsonParser::get_utc_frame_time(result);
        println!("{:?}", time);
        assert_eq!(time.to_string(), "2013-09-18 04:49:07 UTC".to_string());
    }
}