From 4585479ab0ef79344bdc4560491ffd40aceb8118 Mon Sep 17 00:00:00 2001 From: Niels Widger Date: Mon, 18 Sep 2023 14:28:48 -0400 Subject: [PATCH] sharkd: add hosts tap Add `hosts:` tap to `tap` method of `sharkd` which returns a list of resolved hostnames found in the capture file, thus providing the same information as `tsharks -z hosts`. The `hosts:` tap accepts an optional list of comma-separated protocol names `ipv4`, `ip` (synonym for `ipv4`) or `ipv6`. For example, `hosts:ipv4` returns only IPv4 hosts, `hosts:ipv6` returns only IPv6 hosts and `hosts:ipv4,ipv6` returns both IPv4 and IPv6 hosts. If no protocol names are given (i.e. if the request is just `host:`), both IPv4 and IPv6 hosts are returned. In the response, IPv4 and IPv6 hosts are returned in separate `ipv4_hosts` and `ipv6_hosts` arrays containing objects with `name` and `addr` fields. Both arrays are sorted by the `name` field of each object. --- sharkd_session.c | 173 ++++++++++++++++++++++++++++++++++++ test/captures/dns-mdns.pcap | Bin 0 -> 72858 bytes test/suite_sharkd.py | 57 ++++++++++++ 3 files changed, 230 insertions(+) create mode 100644 test/captures/dns-mdns.pcap diff --git a/sharkd_session.c b/sharkd_session.c index a9078eacbd..e9bda22a44 100644 --- a/sharkd_session.c +++ b/sharkd_session.c @@ -3204,6 +3204,130 @@ sharkd_session_free_tap_voip_convs_cb(void *tapdata) g_free(voip_convs_req); } +struct sharkd_hosts_req { + const char *tap_name; + gboolean dump_v4; + gboolean dump_v6; +}; + +static gint +sharkd_session_tap_ipv4_host_compare(gconstpointer a, gconstpointer b) +{ + return ws_ascii_strnatcmp(((const hashipv4_t *)a)->name, + ((const hashipv4_t *)b)->name); +} + +static gint +sharkd_session_tap_ipv6_host_compare(gconstpointer a, gconstpointer b) +{ + return ws_ascii_strnatcmp(((const hashipv6_t *)a)->name, + ((const hashipv6_t *)b)->name); +} + +static void +sharkd_session_tap_ipv4_host_print(gpointer data, gpointer user_data _U_) +{ + hashipv4_t *ipv4_hash_table_entry = (hashipv4_t *)data; + sharkd_json_object_open(NULL); + sharkd_json_value_string("name", ipv4_hash_table_entry->name); + sharkd_json_value_string("addr", ipv4_hash_table_entry->ip); + sharkd_json_object_close(); +} + +static void +sharkd_session_tap_ipv6_host_print(gpointer data, gpointer user_data _U_) +{ + hashipv6_t *ipv6_hash_table_entry = (hashipv6_t *)data; + sharkd_json_object_open(NULL); + sharkd_json_value_string("name", ipv6_hash_table_entry->name); + sharkd_json_value_string("addr", ipv6_hash_table_entry->ip6); + sharkd_json_object_close(); +} + +static void +sharkd_session_tap_ipv4_host_insert_sorted(gpointer key _U_, gpointer value, gpointer user_data) +{ + hashipv4_t *ipv4_hash_table_entry = (hashipv4_t *)value; + GSList **list = (GSList **)user_data; + if ((ipv4_hash_table_entry->flags & NAME_RESOLVED)) { + *list = g_slist_insert_sorted(*list, ipv4_hash_table_entry, sharkd_session_tap_ipv4_host_compare); + } +} + +static void +sharkd_session_tap_ipv6_host_insert_sorted(gpointer key _U_, gpointer value, gpointer user_data) +{ + hashipv6_t *ipv6_hash_table_entry = (hashipv6_t *)value; + GSList **list = (GSList **) user_data; + if ((ipv6_hash_table_entry->flags & NAME_RESOLVED)) { + *list = g_slist_insert_sorted(*list, ipv6_hash_table_entry, sharkd_session_tap_ipv6_host_compare); + } +} + +static void +sharkd_session_tap_ipv4_hosts_print(void) +{ + wmem_map_t *ipv4_hash_table = get_ipv4_hash_table(); + if (!ipv4_hash_table) + return; + GSList *list = NULL; + wmem_map_foreach(ipv4_hash_table, sharkd_session_tap_ipv4_host_insert_sorted, &list); + g_slist_foreach(list, sharkd_session_tap_ipv4_host_print, NULL); + g_slist_free(list); +} + +static void +sharkd_session_tap_ipv6_hosts_print(void) +{ + wmem_map_t *ipv6_hash_table = get_ipv6_hash_table(); + if (!ipv6_hash_table) + return; + GSList *list = NULL; + wmem_map_foreach(ipv6_hash_table, sharkd_session_tap_ipv6_host_insert_sorted, &list); + g_slist_foreach(list, sharkd_session_tap_ipv6_host_print, NULL); + g_slist_free(list); +} + +/** + * sharkd_session_process_tap_hosts_cb() + * + * Output Hosts tap: + * (m) tap - tap name + * (m) type - tap output type + * (o) ipv4_hosts - array of objects with attributes: + * (m) addr - ipv4 address + * (m) name - resolved name of address + * (o) ipv6_hosts - array of objects with attributes: + * (m) addr - ipv6 address + * (m) name - resolved name of address + */ +static void +sharkd_session_process_tap_hosts_cb(void *arg) +{ + struct sharkd_hosts_req *hosts_req = (struct sharkd_hosts_req *)arg; + sharkd_json_object_open(NULL); + sharkd_json_value_string("tap", hosts_req->tap_name); + sharkd_json_value_string("type", "hosts"); + if (hosts_req->dump_v4) { + sharkd_json_array_open("ipv4_hosts"); + sharkd_session_tap_ipv4_hosts_print(); + sharkd_json_array_close(); + } + if (hosts_req->dump_v6) { + sharkd_json_array_open("ipv6_hosts"); + sharkd_session_tap_ipv6_hosts_print(); + sharkd_json_array_close(); + } + sharkd_json_object_close(); +} + +static void +sharkd_session_free_tap_hosts_cb(void *tapdata) +{ + struct sharkd_hosts_req *hosts_req = (struct sharkd_hosts_req *)tapdata; + g_free(hosts_req); +} + static GString* sharkd_session_eo_register_tap_listener(register_eo_t *eo, const char *tap_type, const char *tap_filter, tap_draw_cb tap_draw, void **ptap_data, GFreeFunc* ptap_free) { @@ -3650,6 +3774,55 @@ sharkd_session_process_tap(char *buf, const jsmntok_t *tokens, int count) tap_data = voip_convs_req; tap_free = sharkd_session_free_tap_voip_convs_cb; } + else if (!strncmp(tok_tap, "hosts:", 6)) + { + gboolean dump_v4; + gboolean dump_v6; + struct sharkd_hosts_req *hosts_req; + const char *proto_arg; + gchar **proto_tokens; + gint proto_count; + + proto_arg = tok_tap + 6; + + if (strlen(proto_arg) == 0) { + dump_v4 = TRUE; + dump_v6 = TRUE; + } else { + dump_v4 = FALSE; + dump_v6 = FALSE; + + proto_tokens = g_strsplit(proto_arg, ",", 0); + proto_count = 0; + while (proto_tokens[proto_count]) { + if (!strcmp("ip", proto_tokens[proto_count]) || + !strcmp("ipv4", proto_tokens[proto_count])) { + dump_v4 = TRUE; + } else if (!strcmp("ipv6", proto_tokens[proto_count])) { + dump_v6 = TRUE; + } else { + g_strfreev(proto_tokens); + sharkd_json_error( + rpcid, -11015, NULL, + "sharkd_session_process_tap() hosts=%s invalid 'protos' parameter", tok_tap + ); + return; + } + proto_count++; + } + g_strfreev(proto_tokens); + } + + hosts_req = (struct sharkd_hosts_req *)g_malloc0(sizeof(*hosts_req)); + hosts_req->dump_v4 = dump_v4; + hosts_req->dump_v6 = dump_v6; + hosts_req->tap_name = tok_tap; + + tap_error = register_tap_listener("frame", hosts_req, tap_filter, TL_REQUIRES_PROTO_TREE, NULL, NULL, sharkd_session_process_tap_hosts_cb, NULL); + + tap_data = hosts_req; + tap_free = sharkd_session_free_tap_hosts_cb; + } else { sharkd_json_error( diff --git a/test/captures/dns-mdns.pcap b/test/captures/dns-mdns.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7410b1e7e6533913c6573d3556bceffa70e1d94b GIT binary patch literal 72858 zcmeHQ2V4_bx4)Bw&_NVXuq&2zMd{eZE*9(sRu>RaPytcw4Y6VGy<*3LT`a4PW!Huc z>)PvDR$Y5n-Z?W2Bq1}I>`Zv?d%rI_z$BCN|DSTtIdf-ja_Q*y6a`Tc?h&9Sgo2$u zVRXc?rfO0j{>E*q<@Gtm9ucK`<29QsNFzdghP4YI&(vp+`YnBSf?nT!8MS{=v29(y zruFIKcP`P9SftzqNtA`v`|l@9S1{ZE4@$iAP)$05G~8HOtlaUp!tj|=HL`vr;va-; zx4fS90}#tAJx>&COs5^4f5`-Fe%K2K4sBt$9oNKJy^7~C{@XQLFUk)``?UDRaq zVhpVZ1*O+&Voki@HQY3%Ggfh1of$v^s20v(5elthLAuAIK_kL@MB;`LCP(H<(6j<8 z;iEYL3Dxi6yHN`GB9DZWOj{BH__*mv*h5-Whyo4{Y3V3Id8Ni?G7SDzTYLQhQNO@9 zz{55$D6l>IXWpNWnp`Oq@6l`@axEEXmxGi?+ZKPcfEaM-F$qx+jYT?e-c6w#@WYwaEZb|< z2*r6xp>)ss0dbh6fTMCB&NYY`JVTM`WWif_T7glWWtMvYyrg8F(|jLA6o}qz-Tx-K z_X=B535epRWo0#?EQnf#%yHzg@qikkwPS&|dvO&x3;Vb+R?9vTt#+{uS&%!Tc&tW^ zC!3E11ejZ(RD4j`63j3S5VM;~RRB#$k>`Zih2b+gV+Tx%ue+wA+C}(MRBf;~qgi!@BEa9A zQmSq2i&d&+GoX7^MBh@LRlL2ccxLHSvOie4@^#4PMq0V@CbaV4TEhqElge_@`^tah zlTxjm09Ic6zm}T@0JUDO``0`0uYWHGmf(D1d&C(dPcfA80xORZi+&lnU77&(@81l z&nArRCUdr%w1%}^SL|iQ+RhJbXWrh%$GFBIo>6YAh{bVhK-6 zbYlsT?g5gqvGj$BC6ss`ffLdY*vHMZd>6JibuWSX7)FuWOCZW3gSz}k1cSnZ ze_RMh><~Z+enLs~FiHv8ZpiLZEg}wu>i}815TiRqMCoo&7dh-+*Uws@hwIS+vb2Nk z2(IQYU(eS3IV(Ujlhl0FJV}^SM~2gIj??skETVp34#Mo{aXS=CaS=*h&*%-0@s} z+p)GYEzcn}czK#14Hm=mSPIM2wBw`Wuhz2FG5#J7J(mJV#@1c!9uB2k`XxVlI7CXf zv6tM#8Lm}wpa^%0s7no7>ADE_aES7@yuEC(#NWdqQnL#7M#qwN4>uH~IDInytRkM}jCnPd0=iwIe~4?^6t+NbN`vrE#Q%Kt~egf)&hq zFIT~yK4UA`w?#%&Fr#K6kkez}#8bi4t=o#J3=f*ImBF+;lX?o;&Xuv<9?o`?>$0}n zG2aN=8CCt!b_O^VWjNvWQf8L$&NY_PkQy>@(%a1;r!rBz{zT7U;j1h7TY$+W@ zxDP;-O0A`%2zO41vT~4(Y;nThZ6MNZKr%K?wEF~<(gp4fkS1j~NLfBul@D4oNbgNu zp~ay{?KZ@rNbQ_PfNz4@nemNbC_v(7eTCy*9Eu#es3HvMBGoUb%b^cu0{vO^X{_f~ z=3G604Vv{54$ELMsoiBoMcZTt?8Rz3A$*hn2^)$lAe7&vSJ`#QW z7jWV^FR;4yO^oe!2C+UiEzj-lYS}6fe}9G+c@0R$R!r>~Ba|}tyd_^&7TsAH&dLcF zq@xJWT>tXHAit+Fvsh!nG;8JX(d~waMH6q<# zV8<7ckYMDP#}S7jb%q5|<}5a(i_|`06rlX#r4;BBdTqyiZCQ%T*E8$0`8xE94Eb7b zpMab`0wCu6%3ob7JKv$kvS$_U#T)hD3sZUZNtxHBtSQjG1MX3sa7 zmS=pZ(&*f-UA<9TloA5w#7*jb7W~}?A{|zk^JQhxeS&apMU=l~KoRan5M{2FbX|nI z5k#p}(Ofp)@K;PkN(LlpeF93k6`s4=Mrtex^Sye_P*s##dr=?5C{kwv5akBwBHi|_ z|1@L~seM8sa9!lbdz};Vha8=iIF$U+MQRL<28&t6vG-h$1@q*+@4DA6rot8HD%|u( zY=yHp${db1{rC4c>pc@T%>x)b%&`!O7Fq|%NoEA-B zIR)TK1hMzR7}Z4~r&Yj-rxQ@dC5Y(+QnRlln$~u!`FWbx5_P{5Js$0u`Pj5^*R?ON zJ?)~uh_UB_%`8vT`aOIF+YgzxC&CC@2S~=|e(fF(rSz@GdnG}1XC>V8AWGE`=_tZI z52K3=D8gMLqO8c5t2~HgF+^pwhqY&5P|7-3*@n?5M?~^>R)`e7NNP8d1XAKE^3K+Q z7T709t>B2_^phbJsr?zExEn-~+9x2&9<{B&3{1>etbghtuKqo}$=1J)pTU|Ysed9k zjbS)(t3tk>O=US%#s!dKIq{vH>+KVe(@SAHjbk{q|!P7&s| ze0_rXoOfdC+7>gmu9?<$6Zv^sRJ0)@Ev1fUjc6=1}mhXI* zf9?b$EDDgM^$BA@%8f1g(bpi-!`~>$b3MWx38H+F0Y$hYL6lxcrRyTxks!(_SW{#A z3Xe#cl2`AblpEvnV{QtOz7H{Vl}8lyP(vtEI~GIJ7HdK1)qf-t9OhEp`h zX)iNhp>_%BECVOKJsfiS9XRpLt9XqQQ{VS~Wb3 z2*zD6#>Y{dj}x=+w(-1YgpZAyJ3}9r9?5GvvcgM@?VeGr?M%ya{Yop@>Mnl|hZgw; zNYZ*Zlyd2n98$Kl;=NiRdd5h&r$MfApa^$?h*GtabX|nIKtwT<@v{y1XJ8Pi9UvJS zC)zVc<3Nh{3i*0{e!hs*<&^Pvk!kZC4^npARq~xNK$?3^^?5<6Df6-*Y}byo2@eHA^Gn z&Zt>I^zk0x#M4o#FNo?WuU24fXIh?99>{mr%-?OGMQ#C-u~kI-$`VQ`zC1tHiXqZm z_)xHp5F)tge4?979SNdLwUUk^+$+e1BHZ^NO81}gV|^APodzUhV<~TipR!gCDaA+2 zH|NUV*GvGdFS_zx?}Qk|jzns&APz-puOJRZ>MTn#SZpy|RplAO*%r$m6sdj@r;Aj- zAWFwRLhEGWM`0~hwBu^&=@zod}0JSB{H1aa-4RLVC#GEAtN{$ zRo{_QIB?>t?~TI5^hSSmX6w6YZI{Z=)8gPMF+6{t$MQ6-J!AR``gk#lYWhf=zioRNq}+<5(wU_ ztp9%H_?b*)sK-@?#oIVFK(d8)tt>(^o`!=tKfWiTyI>mP!)o5k2J zfV170y{zqa{$hmf_&O)ORTXV_5jgSK&br8PF}7o`Q)WIkEzb(@QL+MYH=D6tUCwp~ zn9qq;yL{UugYEQQr$pOL1x`G+vur5p{_kUL*tjz-&l{!kV+|Ktq(Nz^YtB&0&f59W zkswl?leyoc^lxXCgsV8BIA%&m5$;G3MR8p^ig0&@C?!72=NtYCk4RB~WNdefJ#o<)UMLbb^R<%;anR5apaf6gg~fXYy5g zQ$Ux?b%oZP_4mVCN|tc7^ie;y57})-IIen0Ulir>KIn@VFJUxfmtm0z&wX-2?&tY1B?&jyIc3UHc z=fgKFPt)4dts$>Ht<<7EJ#tEWmZxcB@pHI*_iOOa(qM!&=_Yl}8A@??=bh^pJ=Y`L z^B_t$8CHV{_iu=@AzZpH!krbO{4*gx)^H(`ce2zqXDDTBedE_0X!mDRK}wg%{P^Ax zM2f4)JNpO;TaG)35amyUC{jB?L}^pYkS6L%9iAD^7X`nXJ48RAZF--SM|T8!6r z_WP2=*zUm-wofoE&pD8lL%_y0xy*S`8R4WvZT(pOIj*H*bug!=?U zNt8hs;hqOkhULpjFhtrfc_kQ1xjA2Iw}Dbz7aFQ~QtK+BxEMr{dZk7jiqz^o9dx-| zIX_kmBGSbVruL0E6sf)uha!h>*6$Nqku!k#+~prRpK(0lJ6qu@&XS?R>Fumg^UZ>s z5(1g3o6J?+-JUF`=gCHJGODvePLcb0R|zTMh9VK)wtBY+TXjuqyHWf+?c3}T!}HWO zmZxd$S?hpc+%cc6{Uhgdm+8Z-kJIqmgT-FG<+}o@x3fYY{|=mZX0%k^9mUvg4s+jI z=3~?HYhf?MV^EqNO2Sq;@2TalU=e9;v2BWG!ayl!_sTRX& zF30J5_P0|+xER67sA`3rLdx@g+mwaddok7OTywV4o7Q%*{5-9rUW(y)WH`&ywDyeo zNigneGd`Zf`S{r_HtuRGWbm=xP8fas4LI?1B<9OSeG|lGSJrl>Q7X(3TD3E1E>lZuakX^L9=4WNGTFV^$jMWf(>#V#O^(z4 z?kuM#X5e9|GY)#|J97F1IPuhXMS{7Q-e_xMw!WLzcKc@W^0Y4IDu(CiFDy^f+OzF! z!MK~x__zk=DI!WFe0rei=T{JE z8z31QOWNHRN~zvf>K#OLKuYXL`BpdZcO;0^(T{hYGrJ>^+AAQ+GlM8ndj)YQQhU<5 zpv#O*p;bFWDr05%vWBY+Q+lwKVPO*)DudqYkDL|?b8=@mt>!rGTEud?Eyp)*=&e@B zsqRJIl|*($Q^i!PC5_l>Wm?-kddACB>9AT1&!n#`Pt)3S&_9B4SC#ScO3udr~DNjEs_98##RySStXS6;h^+& zPr|hoQD*-k9YwesL6m*RrK1RUBZ#v0seC;gf5k+kPk>~shqe0zlv3-h)V1CyB^bWB zq9Y7&+;rvy;TfDykXl#8p-Al!#Gy#7-t)j>B{t?qoFJ0xCsX@I9Ew!mh(nR;oB3d| zpFM@vCJpgnD%?`8!mVSz=~V4<8D>pI&#M?!;Y4uqU^u04oc3gYN6C~>BRKJ0uhZM@ zA*U-~C!To#yVV`URNed4*{W+=o=d%Wd8(3w#PFQ`g5_yiAN$o1j5}Y($2n^U4-`U9 zY8O&L1|RF~p3%n{z=_AlHdmX7vE9Z3tnEz8^GBQfSi^-DsR!5Pjjg-dofS%%ujIWt zB63@l-A-lJ- zHN>>GyTs4a{y~2+Jf~Z+JWXrQ74HRoyovE~InKuyZm@ATy0Q^I=IaIZ_6g`?*AKit zrV`qTvE9m8)^?`ld9_e}tl>h7RChFf241^QSO`)IL$?tEj>FA#Yt9g<_GnYD7DJSV zGN1_eJ#wK4cO;0?5$@cT%QyTL9+5UlzDF3PbUl?Ha}J0UV)B*R;!vbkd2uLGJC;RY zv0^Qx-UW_QiW*#F_ahM!2|N@^_pBd{*KC51S>qm5)|_IGCJ^C%UmS`o7BQ%cRPUlL zWh)4++8K5fYw0IDu9mK`VQZfdtKyo960gxl~xVLis?C~>|%Qk)B5uzKTrFKt;F!$ z5ybK|t&jaG^4e3eWT+UP3wp6UP3!lJ_VV2)$$u3MBh0CT)YW1r<@d5S#1RGpZduG@ ztL1gbwM0#*Ezl3)G0&Ij-XqK&GyYZ>yonNHd|z&@pd z9~#Fn*&UJU!goQ))wKv)udz4pl?TytT!yRBe1GXE!W|`AtygX7D8d~jqI~)#Kh~}x zQmZaf*RCxFDf?4(zf;E)QOhCW)kWOcD~wu5aD@?G(0b^`{shwYDIUOeK-(>^XZ?Ut zXh$U%sGT@{9irUnZ~S=Io=HO~H}hrYZwVj;W*GWTHL0B#qI@)nBDE6}hr)U8-}bJE zQhGAXRYRAAn`SPyAdLux--Sj39EPmL-}owNNE%Q+4?a?qn%pkDw<=NME836jT(14( zfAC&JQo9IWimGi+v6@v^C<6S=DW%%RzF4JNHUqjxMf5G@S;gD4ibtL?hiaph8&6S@ zO7J&std)t<9nLl^pyF8&wF=4M3!)YqVX;yu|OagN{p}pfMo2IIqf-Bl=8Ty?%GbRUIKb;jxX0EX!H^~ zd^g(Qh|fRWK*!W zg3KlbY6Ninxk}0Hb0~?V-$u-r5#c=|aYL!w>ROPqAQ3kmsVe7*WI--hKB?o0x>Z1c zxdjMd9#nRgH)Arh*-fP?fF`8K0YdEH&JjX%dK1FF?mCKjGyM3Tozb~{7pD4}Tj+Kh zC9|Jb_6d*Wj>X^R_~aQaKb3bu@|3 zj=!4ytu?(4-M$u*sI!K^4@ioOMb4sj)V7tuL)uS6 ze{@LJMai+8=<{6RGf=rugwH?`Wr_^C2%obfO5qi`7SoAfG`7Y#;q0v&!O5iMiZD2o zd!9Q^p^+!UH|fS%j$aT(BhI*Sp)uz12#q-v{_8WS&jCO(wk~O(H!cM!9bd|Kt&g8C zB8A*E^?9Q>6x~d&VgKx_5r@~IBXma}S6L9{;iG?Zu7U524bWW$ZG3ikR2TVim5hr* zJIW??N~Uv1MCn@3_|JFHj*Vp?#ia)CJyu8nMhwRRci}20fWkb1(05 z=3dkoz1oj#ziL1EAG{}Z?gg#fW}I$T%ZYomj0~9qQ5xOMMbU{^9TYClaCs-&JybGz z(mf1zxaYa!xG{_<>i~u8balqC%KbTx3+~;VRBoS>mPkq^YK~!)O25gKs>9vpqLZdn zP6{WLLm5p<=8<|c(voz7=*CTxE6gm?RN$hUII}pXFwV%pwv03&4JqH|{tBI$MSKm9 zL8Skm(XH@Pp@QCc&O8|E4I#B^;?HPGg)^?j@YO6ObBsNn(Wx!)a5yQXve0?edJ3BP z7Gq{-d<$%O&77S?@HIRJaQ|y&eP-TQ$jazkUG+;&t~N)*YCryeMzb-m}B4*e*|*I9VVC^F;G!2)xMCSU<(KypDP33StiMb1cNNxG>Z&gXd=y`qJyvR6`5SxCH{S(}y2DuOL@bR&Uj){rv9v$x9KQbm-84(wQhcOfl0QoRL zBea2Pe%{hcJWw$f$l|OG!7~Wlv}}PI4O{dOfjThD;t-7Zf=)e~MW+-Vjir*Aq7$JJ zZG(CNf)7zuzTgtCx$n2SL!#FHsxhU})YqQbkd5#b-0~1xy66!@Y$%#JhuFkslehF@ zh%x3iL<}rIyWs5_fKZe)HjnM^?&<60Wf?xGe|PxX&r2ECuP1TH-i?aupAZw?KOwT8 zIy@$PXk08^9^MDBK3;pZAmkD5w|>1QY-NWP*(?aM%rkMq@C3M zu=LI)@Zc4SFRwg*h8y`*W;<013#;vK=rZ^`rBqs=WV4;QlJgj)79j!TFZEB}jEO-y zwLfX+v6KQSAid;@f>C#FrsYcR7`pE|O6Me3wzeZzK^xq3Ia4PSZz1OvCv`ZN1nDai zi;%AYZ-67k@NI*Vos|?d16)2usSID*Y5M-;YFl0WyyJE}FY)$^$KUJs_;fR`WH~6K z?C@FcV8V>`8L1f?=*qMQSx#@Jm(y-^MbewLq8&+fdJDaZoGAX=dN|#W9!L(7Mj4wjHj|C?I=UL!LHm)J^h|m& zJ)ho4HqdKnf3ltSB{S$5^gMbIy@4#Hmy+7Vm-eD7(e`u|x;$-0r_jR)O~%qw=^^w) zdH{UE-x5-bRHZ%XpJ+SUoi0bK=oR!(vX9iGr_h7xWI7=ujcg|AWG+3MUPv~P-DD0u zi(Zhik)+aV$QCk{o=(rDQ^|UIHAy2==xH>3P$$U(lShEn3lk?o3RbG3nG~vEQm`e? z#8ItOQ)WstN~KhR&yUDDg^0mKrj+4AO>pCI1GAuoK zXJP>o8~=rs*fDg!C4^%elvpUijyy9X%%&^R?BA|Y-Mh@S?@7@!UfdY5cI)TBmloAkYe$6d40ot{@RNJoR|0`W9Kao5H*2C&5=wz~ z0|^!ttcgWgVo{2yY(0`xmL5rp*DJsQ3WX)PHn-c&0z(gM^{`c2RvO=Q{6|}gvNj_g zqZfHvdswQK9aQQbj}nD#J^ehryy3qGJVFZFdRO=G^z_f({l85-+9mTuD!=zx;|@0 z@fN|~4psDwf8S-NH}yc>>7io%;i*d+KA-2<%=&w?`4>jM>{~HRvGiNLzVFXW3N7%g zYbghX_c7}ddtOKGdr~~S!uHYI&J@00-*v&4hDWDNYyYO?gN%^N!J8kXmu`A{(4v#; z9(le$IO5*Owa+VV@ZbM*+~uYUH9au%OT|v1_X@0RUv6U3>0N2AOMeP+x0{`6d4;O7 zr^dX=+n&sBIC5hn+xxwP9280j;Z?0Yf;@^toD{cHIjbC(FB|gJV^kfBX-9*GeyjZS zW`oD?yLptvm&>Y(csM8OKLF#dcp;UU2jufCO`Ai2gUu;YX;SQvo|ZKmE-3P6uW7xf zmi=qWrr`1qgJ<`6vi;#ayCEmm`zXWBtsi}edqAx?x9{tdiZd6ceLXjAQP|3W4sLG6 ze|fK-6*j8l=n|1HgD>1X(7#~G!)FK9n_RThsMd*e!qoXsst3_`=qk@+o_}r?cm818 zJwsw&b^T+6Tlv*B5>KyM@pgER%niYD^L|FKLhX0AejXnm@U7rys=H6$hK>t|zKXBbx=GlJhRxHjG#T;f+>y4M&c2K~QRdj2 z(e{5=wy<;$j$ZtIOj<_z!4gxaUkr;4X}>V$&)R=JtI*NQc8GQD7gJU}DAna!pZOE$ zjeGx_59CT_nE4+<=8u4B1Ke~ozpBHMZkYL#)3r0db2Fxv6d|#90<|;0g!K5|4D;U% z^M546K=(nlg!89BB`I7_^>Xa`qn5XRQkIVGciU#E)7hkwhx#6OIoYG_`{_?+g_g_s z<($>J-hI2TD&V%uXKsh_gPvGFEZTf;T+y&&AKmWuxm-XEIlIE0#kCK5y(v((p~J5C zuU-$W)S$qNGUu-QTkJ90Q@_CWws!uDm2>;P?f2KJHlIpg8?*2^35s5D>*p3`wb%Nz znYza*Fx_+Fv{!GNKWJ%}`N!h-eS$ithbE1mHD0yeIjef>B5A%}fh#LyjGedm#l2}~ z%U2j||8tp92gaTcx%6tow5*h0KYXk++Qz)(Z{4aLc+>gm(HQ|7Kiln|H8&u>Q|ro! z8G{_ll`qnJu~ol_)ru{@o4JMWnKpmSj8+LQ6ARz<`ng%$3uRHij5>A!?;bq*6)d$1W zkaIIQ2mjQ25u0)#-He1pW+g)69Y$i8yb@h|gT${raUzqQ4w|4TaVjKT-15vkj7q%A zNGzaNB1|yd|074@V@$S~!yCie$olnE8w>VS{IR9rVW*mj3p@(loEsCpCa_V%6ep$2 zuZ;=^W|Ubx@TGr4YFxVi@yyU2%ovO2u_n$0+p#mjs#D}= zs;3zkI<`Mu*eZ9{m$r+bL#q?wRD{`Zx|i4$Kti3<1>M_(al#PJ2@lVsdt2{%@{fiS zy!5*_SXgpXM)F{7$^MfmoKS@S_@HzpXS?^NtpesP3A5!f;-XUy2G=aedsLV7VX-8CH?>9tf?l%fP zcU*J7{==I4HTTcajRs;|T=r7rWaT_I_E{3iw3e5(8$qVE%)*(`9+Sa)Y-@QIGV^1U zxBw8~j z`eC0u9$(EU+a|5x>+Q9k`VF$bIIiHk*&n`Nn0n%sq8XBCov0AXX3fyxsROy7TsH~B z-8-Ve1c(a^4S2w90(!Gq8)3=K8OZ~*C6kK-z6nUq4)-Hx1%t#5C3nDbmYvOjH3Uh6 z2^vA7hjWh8hr?y9gJ!we4EAU5zF$Z4^?*7@4ruN#XuP}!TC>e9!650u1j(hmK@#GH zK@xc`CrG|-e{;A2N_++q8-hu2(+xYyZ%I#-IQfEJi7<(B@|3nj43ASVj-mdprwLui zvgfu>#XdJ&`XYAv@`Rw3E>UOuEQ@abY0Rbs<(#;-)n0}^f7|**#LJ{QUDI9B>K%_l3pimtyiDo zyI=oP|9ZQME4nEH>(2J?6ME`)U5hq5hAtU!W>xU(-N!qAe{k(XiOQu;hGmxeIM1&1 zca4~T_&dpH`A3D>!Cgi!zqDXy)Q|XK>uJ2yDjbom>!>5V4} zp_)^kiJu6q_<@=;;2RS^Ox)**d5xMwU4)tw%~Nx_z$&=BHK*za1=$Zn3Aa3%U~}R_ zAf#@28;1%yn!Usr;&m*gXbfh8d-1H3A!Onq6MQWUPEJ5c@SrYju5q#ZmNhlTt}Ny; zamu{%RR%nq>|XEnxl`UH` z-nM(jkMoO;TrXB&%Qc6v37Zd`v|3dp{p**ymemIy`Q=Fb!4?Nc?c}82)&gW%jJ>X9+06b zd-SG9<>nD{sQ>Og{d;C#>dm<{FG6}NMtY34^sI`n*BX$XovG%IQIcQ54Y=u!UebCo zeAqr@s!_R-2JCA!t3!`sA`Kv5fea7#ob1z$sLK3fa{_hQuv$qL!+UVcgEn<>6$Y)I z7TSJ?6@~pQk5xW!u|}J87|rv)sgCD zxSy;(yog&Ksy<7im_(VWoz{xRgr$dU#6%f!nhleVp}%#+s7HyV`>F_Z=FFxWcvSgB zyu(1<5?fr&F|?5zLoRc20`CM$#WB%q+J{N@d%Uck^w`kvG|H>Z ziX+OKJwq<|e?RcT_2jz?CDUT6m$~_N$IrnhJU_30+SR;Ui2oy>$bYJ~2#qUJFZuS( zd1Id0Z=KU^BuapL0+@&DN57*tsTFB28PypA5nVq@Pz4?N)Mtvhcdi~ki{pt6bbiRP^2<{2O22OHbG(uWUSUFVOldPxNI{rQ*Ut*GCB0DMq^!Jt28l&Tzwlf? zPe+NM0+o@S>F1=D9vx&o!Dh^aLN|8&`RdWkh)VKD9ciwpP_K<6L+xD7&(zeQ^Q-dR8>N=)0+ZDCh#l_;` z^HOG6hg%-1Qh(Fx*|WyoE^?XS;0+sg1^Uw4>Vz)-Ye})< z4J_Jxi#UJIe3NCt0zI8;4u968NKw_?`g1=PuUWdT`5(t7SD1XdX`uasb8nyZncn#M z%9p+4YI>IY_|E)kk@%yPSA?FZQpfgiCiU>$-)$GX+`RK~(oJ@4w{WcztVg!jba!#hNICmk5~`=N5qFFJVsHc@dl zrSC|mWsl~k)NYzQe!t`F2Clu=Idz{p$1*GI?#mC~d!2sYtC`D&TgyCW_lbUaYkJEk zd;DxBY`)MUz4^K46AuiEt$JlaT2|QFufLrh-l=WJY0emQD`1HS7j(J<7j9yBi~~2Q zz4pNUW$Ce$;&l=o$k))#+`v6z1_O6GN_^BoP~u;V#148TLJbPtnj=xkNi1+MSE6nh z6Q3o$nSpUmJB*9hfq}6MIQ9#J1*mNE|J$DJZ;qHD#~Jn1LRvpzIJVQ_xD2$e3q$Q| zD177~TPKhB0mnTkvBnT{;sxmew>%u(jz@q*>Zfrak?D#pNcVW`;JM|cC}G!(TnTwR z;kI!m0SV(eAt#hVNS{0s-2HR!Xv!m@R+9wa;E>valW-{u&n6r<`DB1F_>T|DL;u-? z0m%ax$<4JT->e%`TtISmjqW?!R_K&-0!nWG88t@f#1~k@*@RC9Q#GNN*3UVoKDQ^T zYmbPR=Kkm}Wxs0fmw!|(cdi7Ehq)AH)~5DSTcJKR8JTrJR=LcePmL*_ThH@YQ=?B+ zj)OimlBZAY3TFt~ed;O*kbu^PRuue5M1v5*-IcGq24(_z1h+*IqWe6zLKjh10t(mg zX$JE6TVeRtA~mvf->r+9OfphvI8^sIl-}cA?q@6Mgy>L-MlErl&$v^iD(aj#pyzAXQG4JY|=uRCQQRY>W={I1k|+iE~6-!%7oQ#5tT zwwRu^n!2kcCJ?hvsFCjToL>+n8Bm1%qWkW=et9v5)`No56W|lWD#2^GX<19~^GNWW z?yGX&si}R=t;5+X`kCRI^O+|2&akIKu`qlo#zGV`QH(7%>!H#UG-AQdKrA@Md)&T? zNa2D=P8|^G4Bkb)45uDgr0tiDLJDto1(7^@<$ijumK{kWLRyrE$&qIcPNPsC#vV-6 zeQV*SQvVHxFHMMgZ0e8HVUK&=+%TnJsY?)bj1CZOZnxtiBADNOe?%kFsu4o*oz*XZ zlyx9mn5mSU__lcq@r_6&VC!3W%nDnOsGi;;Szxxh#UIR#$VP*t} z95d_~53-suBdKxIc(mU7MyL;L)FB$miq{mos+)6@zj;J|fqS$OBN;IIA}QE(>_(Gr z$1e~leo-zcA90ja6S#YlpiO1MH=rX}6Lf5-tz+lS-QJ4Q5z;>DctlvoOh(5ddUccq zA9ci=?Qzo@sc6UMP5U!C*5P#AbsPNXANtc7i(DNI-31QQyr}3?0OF=r^Ek8TarkIZ zaArXbMXMnrnMoMXmT898*Vfk7_2-Xj@!Dp))h=96+e?hL4tlkfkHoFlHY65|h?}Nw z$KUEbZTw_X%^_zUAlDm|*ST)MX1zLKZ`&9om;;E{El0y+a4xld&9N28 zxqTG`6#eHqhp-*2sJt%p`v3z zQT}{%vNWUUF%3m?@{x=r3~1Yc(KcrymCe3J=OffMRao0HjJ8MhYAYWJ1M%CC(Y7Dw zTQ+`;si&xDrf~e0WfVQGp=fUWO2*#^_|KME3B_+yM#pGQ$LaU5o?f&YRZ4t?fqIHS zJ(gPu#BYWpDjIP?L($y$m5+o0Z37u?qqMb6{cUPL@!CQ?MQu}rwRK{&J+D_=c}S!I ziI%}i0pB+BLT%ULr30qt{g=K)pkn~UpPMq^d<=ZMU!S%zk_Zyk)|=6Gq_(z3`xdoT zh6rl=Go$T3z1qq{VmpxN*u+}Ex6S9Ewrh%W+CJEeZ&`uGOopJS2Vt5~BwSjoTn*ZenH5+{C~1 zEdqT5Ab#Ioyp7s+G1sT9j3f+b%S;Qb%$b{DwKdwesBQg0g4*6;v{mcXRvr@n0}jdb A<^TWy literal 0 HcmV?d00001 diff --git a/test/suite_sharkd.py b/test/suite_sharkd.py index 6763ea187d..1b3e4fa164 100644 --- a/test/suite_sharkd.py +++ b/test/suite_sharkd.py @@ -956,6 +956,63 @@ class TestSharkd: }}, )) + def test_sharkd_req_tap_hosts(self, check_sharkd_session, capture_file): + matchAddrNameList = MatchList( + {"name": MatchAny(str), "addr": MatchAny(str)}) + check_sharkd_session(( + {"jsonrpc":"2.0", "id":1, "method":"load", + "params":{"file": capture_file('dns-mdns.pcap')} + }, + {"jsonrpc":"2.0", "id":2, "method":"tap", "params":{"tap0": "hosts:"}}, + {"jsonrpc":"2.0", "id":3, "method":"tap", "params":{"tap0": "hosts:ip"}}, + {"jsonrpc":"2.0", "id":4, "method":"tap", "params":{"tap0": "hosts:ipv4"}}, + {"jsonrpc":"2.0", "id":5, "method":"tap", "params":{"tap0": "hosts:ipv6"}}, + {"jsonrpc":"2.0", "id":6, "method":"tap", "params":{"tap0": "hosts:invalid"}}, + {"jsonrpc":"2.0", "id":7, "method":"tap", "params":{"tap0": "hosts:ipv4,ipv6"}}, + {"jsonrpc":"2.0", "id":8, "method":"tap", "params":{"tap0": "hosts:ipv4,ipv6,invalid"}}, + ), ( + {"jsonrpc":"2.0","id":1,"result":{"status":"OK"}}, + {"jsonrpc":"2.0","id":2,"result":{ + "taps":[{ + "tap":"hosts:", + "type":"hosts", + "ipv4_hosts":matchAddrNameList, + "ipv6_hosts":matchAddrNameList, + }] + }}, + {"jsonrpc":"2.0","id":3,"result":{ + "taps":[{ + "tap":"hosts:ip", + "type":"hosts", + "ipv4_hosts":matchAddrNameList, + }] + }}, + {"jsonrpc":"2.0","id":4,"result":{ + "taps":[{ + "tap":"hosts:ipv4", + "type":"hosts", + "ipv4_hosts":matchAddrNameList, + }] + }}, + {"jsonrpc":"2.0","id":5,"result":{ + "taps":[{ + "tap":"hosts:ipv6", + "type":"hosts", + "ipv6_hosts":matchAddrNameList, + }] + }}, + {"jsonrpc":"2.0","id":6,"error":{"code":-11015,"message":"sharkd_session_process_tap() hosts=hosts:invalid invalid 'protos' parameter"}}, + {"jsonrpc":"2.0","id":7,"result":{ + "taps":[{ + "tap":"hosts:ipv4,ipv6", + "type":"hosts", + "ipv4_hosts":matchAddrNameList, + "ipv6_hosts":matchAddrNameList, + }] + }}, + {"jsonrpc":"2.0","id":8,"error":{"code":-11015,"message":"sharkd_session_process_tap() hosts=hosts:ipv4,ipv6,invalid invalid 'protos' parameter"}}, + )) + def test_sharkd_req_tap_eo_http(self, check_sharkd_session, capture_file): check_sharkd_session(( {"jsonrpc":"2.0", "id":1, "method":"load",