pcap_parser/pcapng/
unknown.rs

1use nom::error::ParseError;
2use nom::IResult;
3
4use crate::endianness::{PcapBE, PcapEndianness, PcapLE};
5use crate::PcapError;
6
7use super::*;
8
9/// Unknown block (magic not recognized, or not yet implemented)
10#[derive(Debug)]
11pub struct UnknownBlock<'a> {
12    /// Block type (little endian)
13    pub block_type: u32,
14    pub block_len1: u32,
15    pub data: &'a [u8],
16    pub block_len2: u32,
17}
18
19impl<'a, En: PcapEndianness> PcapNGBlockParser<'a, En, UnknownBlock<'a>> for UnknownBlock<'a> {
20    const HDR_SZ: usize = 12;
21    const MAGIC: u32 = 0;
22
23    fn inner_parse<E: ParseError<&'a [u8]>>(
24        block_type: u32,
25        block_len1: u32,
26        i: &'a [u8],
27        block_len2: u32,
28    ) -> IResult<&'a [u8], UnknownBlock<'a>, E> {
29        let block = UnknownBlock {
30            block_type,
31            block_len1,
32            data: i,
33            block_len2,
34        };
35        Ok((i, block))
36    }
37}
38
39/// Parse an unknown block (little-endian)
40pub fn parse_unknownblock_le(i: &[u8]) -> IResult<&[u8], UnknownBlock<'_>, PcapError<&[u8]>> {
41    ng_block_parser::<UnknownBlock, PcapLE, _, _>()(i)
42}
43
44/// Parse an unknown block (big-endian)
45pub fn parse_unknownblock_be(i: &[u8]) -> IResult<&[u8], UnknownBlock<'_>, PcapError<&[u8]>> {
46    ng_block_parser::<UnknownBlock, PcapBE, _, _>()(i)
47}
pcap_parser/pcapng/unknown.rs

pcap_parser/pcapng/
unknown.rs
