search

rusticata / pcap-parser

PCAP/PCAPNG file format parser written in pure Rust. Fast, zero-copy, safe.
Other
104 stars 24 forks source link

Fix options correctly, add some more tests to serialization #26

Closed lf- closed 1 year ago

lf- commented 1 year ago

I was adding support for ShbUserAppl in my packet capture program and found it was causing bad pcaps, so I went bug hunting.

If an option had unaligned length, the alignment bytes would not be inserted while serializing it so the file would be invalid. Also, EndOfOpt insertion was implemented inconsistently and would not always be assured.

I also added a few tests to serialization to ensure that well-formed packets are not fixed, which turned up that we were wiping if_id values.

It might be worthwhile in the future to build a harness in which entire pcaps from the Wireshark repo are grabbed and round-trip parsed. Also, it could be useful to use proptest to generate synthetic pcap data and throw it through the parser.

chifflier commented 1 year ago

Hi, Thanks for the PR! I'll review it ASAP

About tests and pcaps: I have a separate crate to run some tests, to avoid committing big files into this repo. I may add it as a git submodule later, but I have to check for license first (files come from wireshark and other repositories)

chifflier commented 1 year ago

Applied, thanks!