1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use std::io::Read;
use byteorder::{BigEndian, LittleEndian};
use crate::errors::PcapError;
use crate::pcapng::blocks::{ParsedBlock, EnhancedPacketBlock, InterfaceDescriptionBlock};
use crate::Endianness;
use crate::peek_reader::PeekReader;
use crate::pcapng::{Block, SectionHeaderBlock, BlockType};

/// Wraps another reader and uses it to read a PcapNg formated stream.
///
/// It implements the Iterator trait in order to read one block at a time except the first SectionHeaderBlock
///
/// # Examples
///
/// ```rust,no_run
/// use std::fs::File;
/// use pcap_file::pcapng::PcapNgReader;
///
/// let file_in = File::open("test.pcapng").expect("Error opening file");
/// let pcapng_reader = PcapNgReader::new(file_in).unwrap();
///
/// // Read test.pcapng
/// for block in pcapng_reader {
///
///     //Check if there is no error
///     let block = block.unwrap();
///
///     //Parse block content
///     let parsed_block = block.parsed().unwrap();
///
///     //Do something
/// }
/// ```
pub struct PcapNgReader<R: Read> {
    reader: PeekReader<R>,
    section: SectionHeaderBlock<'static>,
    interfaces: Vec<InterfaceDescriptionBlock<'static>>
}

impl<R: Read> PcapNgReader<R> {

    /// Creates a new `PcapNgReader` from a reader.
    /// Parses the first block which must be a valid SectionHeaderBlock
    pub fn new(mut reader: R) -> Result<PcapNgReader<R>, PcapError> {

        let current_block = Block::from_reader::<_, BigEndian>(&mut reader)?;
        let section = current_block.parsed()?;

        let section = match section {
            ParsedBlock::SectionHeader(section) => section.into_owned(),
            _ => return Err(PcapError::InvalidField("SectionHeader missing"))
        };

        Ok(
            PcapNgReader {
                reader: PeekReader::new(reader),
                section,
                interfaces: vec![]
            }
        )
    }

    /// Returns the current SectionHeaderBlock
    pub fn section(&self) -> &SectionHeaderBlock<'static> {
        &self.section
    }

    /// Returns the current interfaces
    pub fn interfaces(&self) -> &[InterfaceDescriptionBlock<'static>] {
        &self.interfaces[..]
    }

    /// Returns the InterfaceDescriptionBlock corresponding to the given packet
    pub fn packet_interface(&self, packet: &EnhancedPacketBlock) -> Option<&InterfaceDescriptionBlock> {
        self.interfaces.get(packet.interface_id as usize)
    }

    fn next_impl(&mut self) -> Result<Block<'static>, PcapError> {

        // Read next Block
        let endianess = self.section.endianness();
        let block = match endianess {
            Endianness::Big => Block::from_reader::<_, BigEndian>(&mut self.reader)?,
            Endianness::Little => Block::from_reader::<_, LittleEndian>(&mut self.reader)?
        };

        match block.type_ {
            BlockType::SectionHeader => {

                self.section = block.parsed()?.into_section_header().unwrap().into_owned();
                self.interfaces.clear();
            },
            BlockType::InterfaceDescription => {
                self.interfaces.push(block.parsed()?.into_interface_description().unwrap().into_owned())
            },
            _ => {}
        }

        Ok(block)
    }
}

impl<R: Read> Iterator for PcapNgReader<R> {
    type Item = Result<Block<'static>, PcapError>;

    fn next(&mut self) -> Option<Self::Item> {
        match self.reader.is_empty() {
            Ok(is_empty) if is_empty => return None,
            Err(err) => return Some(Err(err.into())),
            _ => {}
        }

        Some(self.next_impl())
    }
}