path: root/tests/test_summarize.cpp

#include <doctest/doctest.h>
#include <pcap.h>

#include <string_view>
#include <vector>

#include "packeteer/summarize.hpp"

namespace {

// Ethernet + IPv4 + UDP + DNS query for "example.com", assembled the
// same way the real capture path hands bytes to summarize_packet: one
// contiguous frame, no struct-casting.
std::vector<unsigned char> ethernet_ipv4_udp_dns_frame() {
    std::vector<unsigned char> dns = {
        0x12, 0x9d, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        7, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 3, 'c', 'o', 'm', 0,
        0x00, 0x01, 0x00, 0x01,
    };

    std::vector<unsigned char> udp(8, 0);
    udp[0] = 0xD4; udp[1] = 0x31;  // src port 54321
    udp[2] = 0x00; udp[3] = 0x35;  // dst port 53
    std::uint16_t udp_len = static_cast<std::uint16_t>(8 + dns.size());
    udp[4] = static_cast<unsigned char>(udp_len >> 8);
    udp[5] = static_cast<unsigned char>(udp_len & 0xFF);

    std::vector<unsigned char> ip(20, 0);
    ip[0] = 0x45;
    ip[8] = 64;                             // ttl
    ip[9] = packeteer::net::kProtoUdp;      // proto
    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;   // src 10.0.0.1
    ip[16] = 10; ip[17] = 0; ip[18] = 0; ip[19] = 2;   // dst 10.0.0.2

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66,  // dst mac
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,  // src mac
        0x08, 0x00,                          // ethertype IPv4
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip.begin(), ip.end());
    frame.insert(frame.end(), udp.begin(), udp.end());
    frame.insert(frame.end(), dns.begin(), dns.end());
    return frame;
}

// Ethernet + IPv4 + TCP + an HTTP GET request. This is the only test
// exercising L7Registry's TCP-payload path with a real registered
// dissector - DNS only ever runs over UDP, so summarize_packet's TCP
// branch calling into l7_summarize() was otherwise unverified.
std::vector<unsigned char> ethernet_ipv4_tcp_http_frame() {
    std::string_view request = "GET /index.html HTTP/1.1\r\nHost: example.com\r\n\r\n";
    std::vector<unsigned char> http(request.begin(), request.end());

    std::vector<unsigned char> tcp(20, 0);
    tcp[0] = 0xC3; tcp[1] = 0x50;  // src port 50000
    tcp[2] = 0x00; tcp[3] = 0x50;  // dst port 80
    tcp[12] = 5 << 4;              // data_offset = 5 (20-byte header)
    tcp[13] = 0x18;                // PSH | ACK

    std::vector<unsigned char> ip(20, 0);
    ip[0] = 0x45;
    ip[8] = 64;                        // ttl
    ip[9] = packeteer::net::kProtoTcp;  // proto
    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;   // src 10.0.0.1
    ip[16] = 10; ip[17] = 0; ip[18] = 0; ip[19] = 2;   // dst 10.0.0.2

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66,  // dst mac
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,  // src mac
        0x08, 0x00,                          // ethertype IPv4
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip.begin(), ip.end());
    frame.insert(frame.end(), tcp.begin(), tcp.end());
    frame.insert(frame.end(), http.begin(), http.end());
    return frame;
}

// Ethernet + IPv6 + a Hop-by-Hop Options extension header + TCP. Proves
// walk_ipv6_extension_headers() is actually wired into summarize_packet's
// IPv6 branch, not just unit-tested in isolation - without it, this
// packet's TCP layer (and any L7 behind it) would be silently invisible.
std::vector<unsigned char> ethernet_ipv6_hopbyhop_tcp_frame() {
    std::vector<unsigned char> tcp(20, 0);
    tcp[0] = 0x00; tcp[1] = 0x50;  // src port 80
    tcp[2] = 0x00; tcp[3] = 0x51;  // dst port 81
    tcp[12] = 5 << 4;               // data_offset = 5
    tcp[13] = 0x02;                 // SYN

    std::vector<unsigned char> hop_by_hop = {
        static_cast<unsigned char>(packeteer::net::kProtoTcp),
        0x00,                        // hdr_ext_len = 0 -> total length (0+1)*8 = 8 bytes
        0, 0, 0, 0, 0, 0,            // option padding
    };

    std::vector<unsigned char> ip6(40, 0);
    ip6[0] = 0x60;  // version 6
    std::uint16_t payload_len = static_cast<std::uint16_t>(hop_by_hop.size() + tcp.size());
    ip6[4] = static_cast<unsigned char>(payload_len >> 8);
    ip6[5] = static_cast<unsigned char>(payload_len & 0xFF);
    ip6[6] = packeteer::net::kNextHeaderHopByHop;
    ip6[7] = 64;    // hop_limit
    ip6[23] = 0x01; // src = ::1
    ip6[39] = 0x01; // dst = ::1

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66,  // dst mac
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,  // src mac
        0x86, 0xDD,                          // ethertype IPv6
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip6.begin(), ip6.end());
    frame.insert(frame.end(), hop_by_hop.begin(), hop_by_hop.end());
    frame.insert(frame.end(), tcp.begin(), tcp.end());
    return frame;
}

}  // namespace

TEST_CASE("summarize_packet walks a Hop-by-Hop extension header to reach TCP") {
    auto line = packeteer::summarize_packet(ethernet_ipv6_hopbyhop_tcp_frame(), DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x86dd"
          " | IPv6 ::1 -> ::1 ttl=64 proto=6"
          " | TCP 80 -> 81 [S] seq=0 ack=0 win=0");
}

TEST_CASE("summarize_packet decodes a full Ethernet/IPv4/TCP/HTTP frame end to end") {
    auto line = packeteer::summarize_packet(ethernet_ipv4_tcp_http_frame(), DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x0800"
          " | IPv4 10.0.0.1 -> 10.0.0.2 ttl=64 proto=6"
          " | TCP 50000 -> 80 [AP] seq=0 ack=0 win=0"
          " | HTTP GET /index.html Host: example.com");
}

TEST_CASE("summarize_packet decodes a full Ethernet/IPv4/UDP/DNS frame end to end") {
    auto line = packeteer::summarize_packet(ethernet_ipv4_udp_dns_frame(), DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x0800"
          " | IPv4 10.0.0.1 -> 10.0.0.2 ttl=64 proto=17"
          " | UDP 54321 -> 53 len=37"
          " | DNS query id=4765 example.com type=1");
}

TEST_CASE("summarize_packet on DLT_RAW skips the Ethernet line entirely") {
    auto frame = ethernet_ipv4_udp_dns_frame();
    std::vector<unsigned char> raw(frame.begin() + packeteer::net::kEthernetHeaderLen, frame.end());

    auto line = packeteer::summarize_packet(raw, DLT_RAW);
    CHECK(line.substr(0, 3) == "RAW");
    CHECK(line.find("ETH") == std::string::npos);
    CHECK(line.find("IPv4 10.0.0.1 -> 10.0.0.2") != std::string::npos);
}

TEST_CASE("summarize_packet reports a truncated Ethernet frame without decoding further") {
    std::vector<unsigned char> bytes(10, 0);  // shorter than the 14-byte header
    auto line = packeteer::summarize_packet(bytes, DLT_EN10MB);
    CHECK(line == "[10 bytes] truncated ethernet frame");
}

TEST_CASE("summarize_packet stops after the Ethernet line for an unhandled ethertype") {
    std::vector<unsigned char> bytes = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,
        0x80, 0x35,  // RARP - real ethertype, just not one this project decodes
    };
    auto line = packeteer::summarize_packet(bytes, DLT_EN10MB);
    CHECK(line == "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x8035");
}

TEST_CASE("summarize_packet decodes an LLDP frame end to end") {
    std::vector<unsigned char> bytes = {
        0x01, 0x80, 0xC2, 0x00, 0x00, 0x0E,  // dst: LLDP multicast
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,  // src mac
        0x88, 0xCC,                          // ethertype: LLDP
        // Chassis ID TLV: subtype=4 (MAC), value=aa:bb:cc:dd:ee:ff
        0x02, 0x07, 4, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,
        // Port ID TLV: subtype=7 (locally assigned), value="eth0"
        0x04, 0x05, 7, 'e', 't', 'h', '0',
        // TTL TLV: 120 seconds
        0x06, 0x02, 0x00, 0x78,
        // End of LLDPDU
        0x00, 0x00,
    };
    auto line = packeteer::summarize_packet(bytes, DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 01:80:c2:00:00:0e ethertype=0x88cc | "
          "LLDP chassis=aa:bb:cc:dd:ee:ff port=eth0 ttl=120");
}

TEST_CASE("summarize_packet decodes an ARP request end to end") {
    std::vector<unsigned char> bytes = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,
        0x08, 0x06,  // ARP
        0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x01,
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 10, 0, 0, 1,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 10, 0, 0, 2,
    };
    auto line = packeteer::summarize_packet(bytes, DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x0806 | "
          "ARP who-has 10.0.0.2 tell 10.0.0.1 (aa:bb:cc:dd:ee:ff)");
}

TEST_CASE("summarize_packet reports a non-first IPv4 fragment without decoding fake TCP/UDP") {
    // Payload here is arbitrary bytes - if this were mistakenly
    // handed to a transport parser it would produce a plausible-
    // looking but entirely fake TCP/UDP line. The point of this test
    // is that it must not.
    std::vector<unsigned char> fake_continuation_data = {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x01, 0x02, 0x03};

    std::vector<unsigned char> ip(20, 0);
    ip[0] = 0x45;
    ip[4] = 0x00; ip[5] = 0x7B;  // identification = 123
    ip[6] = 0x00; ip[7] = 0x08;  // fragment_offset = 8 (byte offset 64), MF=0
    ip[9] = packeteer::net::kProtoTcp;
    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;
    ip[16] = 10; ip[17] = 0; ip[18] = 0; ip[19] = 2;

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x08, 0x00,
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip.begin(), ip.end());
    frame.insert(frame.end(), fake_continuation_data.begin(), fake_continuation_data.end());

    auto line = packeteer::summarize_packet(frame, DLT_EN10MB);
    CHECK(line.find("fragment id=123 offset=64") != std::string::npos);
    CHECK(line.find("TCP") == std::string::npos);  // must not have decoded the fake continuation data
}

TEST_CASE("summarize_packet falls back to the RTCP heuristic on an unmatched UDP port") {
    std::vector<unsigned char> rtcp = {0x80, 0xC9, 0x00, 0x01, 0, 0, 0, 0};  // RR, len=1 -> 8 bytes

    std::vector<unsigned char> udp(8, 0);
    udp[0] = 0x4E; udp[1] = 0x20;  // src port 20000: not any registered L7 port
    udp[2] = 0x4E; udp[3] = 0x21;  // dst port 20001: likewise unregistered
    std::uint16_t udp_len = static_cast<std::uint16_t>(8 + rtcp.size());
    udp[4] = static_cast<unsigned char>(udp_len >> 8);
    udp[5] = static_cast<unsigned char>(udp_len & 0xFF);

    std::vector<unsigned char> ip(20, 0);
    ip[0] = 0x45;
    ip[8] = 64;
    ip[9] = packeteer::net::kProtoUdp;
    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;
    ip[16] = 10; ip[17] = 0; ip[18] = 0; ip[19] = 2;

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x08, 0x00,
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip.begin(), ip.end());
    frame.insert(frame.end(), udp.begin(), udp.end());
    frame.insert(frame.end(), rtcp.begin(), rtcp.end());

    auto line = packeteer::summarize_packet(frame, DLT_EN10MB);
    CHECK(line.find("RTCP? RR") != std::string::npos);
}

TEST_CASE("summarize_packet decodes IGMP directly on IP (not through a TCP/UDP port)") {
    std::vector<unsigned char> igmp = {0x16, 0x00, 0x00, 0x00, 239, 255, 255, 250};  // v2 report

    std::vector<unsigned char> ip(20, 0);
    ip[0] = 0x45;
    ip[8] = 1;
    ip[9] = packeteer::net::kProtoIgmp;
    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;
    ip[16] = 239; ip[17] = 255; ip[18] = 255; ip[19] = 250;

    std::vector<unsigned char> eth = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x08, 0x00,
    };

    std::vector<unsigned char> frame = eth;
    frame.insert(frame.end(), ip.begin(), ip.end());
    frame.insert(frame.end(), igmp.begin(), igmp.end());

    auto line = packeteer::summarize_packet(frame, DLT_EN10MB);
    CHECK(line.find("IGMP V2 Membership Report group=239.255.255.250") != std::string::npos);
}

TEST_CASE("summarize_packet unwraps a VLAN tag to reach the real ARP payload underneath") {
    std::vector<unsigned char> bytes = {
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,
        0x81, 0x00,        // ethertype: 802.1Q
        0x00, 42,          // TCI: VLAN 42
        0x08, 0x06,        // real ethertype: ARP
        0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x01,
        0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 10, 0, 0, 1,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 10, 0, 0, 2,
    };
    auto line = packeteer::summarize_packet(bytes, DLT_EN10MB);
    CHECK(line ==
          "ETH aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 ethertype=0x8100 vlan=42 | "
          "ARP who-has 10.0.0.2 tell 10.0.0.1 (aa:bb:cc:dd:ee:ff)");
}

TEST_CASE("hex_dump_lines produces one line per 16 bytes, with the right byte count") {
    std::vector<unsigned char> bytes(20, 0);
    for (std::size_t i = 0; i < bytes.size(); ++i) bytes[i] = static_cast<unsigned char>(i);

    auto lines = packeteer::hex_dump_lines(bytes);
    REQUIRE(lines.size() == 2);
    CHECK(lines[0].substr(0, 6) == "000000");
    CHECK(lines[1].substr(0, 6) == "000010");
    CHECK(lines[0].find("00 01 02 03") != std::string::npos);
    CHECK(lines[0].find('|') != std::string::npos);
}