1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
use byteorder::{BigEndian, LittleEndian};
use crate::errors::PcapError;
use crate::pcapng::blocks::{Block, ParsedBlock, EnhancedPacketBlock, InterfaceDescriptionBlock};
use crate::Endianness;
pub struct PcapNgParser {
section: Block<'static>,
interfaces: Vec<Block<'static>>
}
impl PcapNgParser {
pub fn new(src: &[u8]) -> Result<(&[u8], Self), PcapError> {
let (rem, block) = Block::from_slice::<BigEndian>(src)?;
match block.parsed {
ParsedBlock::SectionHeader(_) => {},
_ => return Err(PcapError::InvalidField("SectionHeader missing"))
}
let section = block.to_owned(block.section_header().unwrap().endianness());
let parser = PcapNgParser {
section,
interfaces: vec![]
};
Ok((rem, parser))
}
pub fn next_block<'a>(&mut self, src: &'a [u8]) -> Result<(&'a [u8], Block<'a>), PcapError> {
let endianess = self.section.section_header().unwrap().endianness();
let block_res = if endianess == Endianness::Big {
Block::from_slice::<BigEndian>(src)
}
else {
Block::from_slice::<LittleEndian>(src)
};
if let Ok((_, block)) = &block_res {
if block.section_header().is_some() {
self.section = block.to_owned(endianess);
self.interfaces.clear();
}
else if block.interface_description().is_some() {
self.interfaces.push(block.to_owned(endianess));
}
}
block_res
}
pub fn section(&self) -> &Block<'static> {
&self.section
}
pub fn interfaces(&self) -> &[Block<'static>] {
&self.interfaces[..]
}
pub fn packet_interface(&self, packet: &EnhancedPacketBlock) -> Option<&InterfaceDescriptionBlock> {
self.interfaces.get(packet.interface_id as usize).map(|block| block.interface_description().unwrap())
}
}