CHANGELOG.md

Change Log

[Unreleased][unreleased]

Added

Changed/Fixed

0.16.0

Added

• Add SLL2 support (#31)
• Add support for PCAP "modified" format (#35)

Changed/Fixed

• code refactor: split source files, reorganize crate (#36) Note: no change in the public API
• CI refactor (#33)

Thanks

• Daniel McCarney, @gcsbt, David Ibbitson

0.15.0

Upgrade notes and breaking changes

The PcapNGOption type now uses a Cow<[u8]> instead of &[u8]. To access raw value, use option.value() or &option.value instead of option.value. This allow changing the options when serializing blocks.

The new error types may require to match more variants when handling errors.

The PcapError::Incomplete variant now contains a value: the number of missing bytes, or 0 if unknown.

The InterfaceDescriptionBlock::if_tsoffset field is now a i64 (signed).

Changed/Fixed

• Set MSRV to 1.53.0
• Fix if_tsoffset to be a signed value (#21)
• Add support for Apple-specific process information block (#27)
• Added const for LINUX_SLL2 (#31)
• PcapNGOption:
  • Allow PcapNGOption to own data (using a Cow<[u8]>)
  • Serialize: use provided if_tsresol and if_tsoffset (#24)
  • Add helper methods to allow extracting value from PcapNGOption
• Error handling:
  • Add PcapError::UnexpectedEof error type (#28)
  • Reader: report how many additional bytes are needed when returning Incomplete
  • Add new error kind BufferTooSmall, and raise error if buffer capacity is too small (#29)
  • Return Eof if reader is exhausted AND bytes have been consumed (#30)

Thanks

• iczero, Julien Gamba, Bobby Richter

0.14.1

Changed/Fixed

• Fix serialization of some options (#23, #25, #26)
• Fix broken internal links (#19)
• Fix returned value for Incomplete to be number of missing bytes, not total (#22)
• NG Reader: fix documentation and example to correctly refill buffer (#18, #20)

Thanks

• vrbhartiya, Clint White, Jade Lovelace

0.14.0

Changed/Fixed

• Properly handle errors when decoding timestamp resolution (#16)
• Remove deprecated pcapng parsing functions

0.13.3

Changed/Fixed

• Fix computation of resolution for pcapng, when using power of two (#16)

0.13.2

Changed/Fixed

• Add explicit configuration flags for rustdoc (#17)

0.13.1

Changed/Fixed

• PcapReaderIterator: add method to test if reader is exhausted This also fix a case where reader returned Incomplete because it could not distinguish EOF and a request of 0 bytes.

0.13.0

Changed/Fixed

• Upgrade to nom 7
• Set MSRV to 1.46

0.12.0

Added

• Add method to get total number of consumed bytes for PcapReaderIterator

Changed/Fixed

• Report error instead of EOF when a block is incomplete and no more data is available
• Add input to error type (helps diagnosing errors) PcapError now usually has a lifetime

0.11.1

Changed/Fixed

• Fix potential integer overflows when aligning data in EPB and BSD Overflow was harmless, length arguments is tested after aligning anyway
• pcapng: use streaming parsers, return incomplete instead of eof (#13)

0.11.0

Added

• Add trait PcapNGPacketBlock

Changed/Fixed

• Rewrite Pcap and PcapNG block parsing functions
  • the 'block_type' field is always read as little-endian This is used to get the endianness for the encoding of the block.
  • new parsing functions are faster
• Use consistent names for big-endian/little-endian versions:
  • 'parse_block' is deprecated and replaced by 'parse_block_le'
  • 'parse_enhancedpacketblock' is deprecated and replaced by 'parse_enhancedpacketblock_le'
  • same for all parsing functions with '_le'
  • 'parse_sectionheader' is replaced by 'parse_sectionheaderblock'
• Functions that parse a specific block type (for ex. EPB) return the matching type (EnhancedPacketBlock) with encapsulating it in a Block
• Improve documentation and examples

0.10.1

Changed/Fixed

• Re-export nom so crate users do not need to import it
• Convert doc links to short form when possible

0.10.0

Changed/Fixed

• Upgrade to nom 6

0.9.4

Added

• Add trait PartialEq to PcapError

Changed/Fixed

• Improve error handling in create_reader (if input is empty or incomplete)
• Set MSRV to 1.44
• Update consume() documentation, it does not refill buffer (Closes #9)

0.9.3

Added

• Add support for nanosecond-resolution legacy PCAP files

0.9.2

Added

• Add Error trait to PcapError
• Edition 2018: remove all "extern crate" statements
• QA: warn if using unstable features, forbid unsafe code

0.9.1

Added

• Check magic constants when reading DSB and SJE blocks
• Add ToVec implementation for SJE, DCB and Block

0.9.0

Added

• Add Default trait to Linktype
• Add NameRecordType constants
• pcap-ng: add method to get the (normalized) magic of blocks
• Add support for Decryption Secrets Block (DSB)
• Add support for Systemd Journal Export Block (SJE)

Changed/Fixed

• Improve documentation (remove relative links, broken outside docs.rs)

0.8.4

• Add method to access data of the PcapReaderIterator buffer
• Fix all clippy warnings

0.8.3

• Avoid integer overflow in parse_name_record edge case

0.8.2

• Remove byteorder crate, use functions from std
• Return Eof if refill failed (avoid infinite loop)

0.8.1

• Upgrade to cookie-factory 0.3.0

0.8.0

• Add basic support for serialization (little-endian only)
• Add basic support for Wireshark exported PDUs
• Add traits Clone and Debug to PacketData
• Move data parsing functions to a subdirectory

0.7.1

• Fix wrong EOF detection
• Fix handling of incomplete reads (in example)

0.7.0

• Upgrade to nom 5
  • Breaking API changes, mainly for error types

0.6.1

• Make LegacyPcapBlock a regular structure with parser, and add serialization

0.6.0

• Complete rewrite of the crate (breaks API)
• Add streaming parser iterators
• Replace Packet with Blocks
  • Allows handling of non-data blocks
  • Handles correctly timestamps and resolution
  • Remove incorrect or deprecated code
• Better parsing of all variants (BE/LE, block types, etc.)
• Better (and panic-free) functions to extract block contents
• Set edition to 2018
• Better documentation

0.5.1

• Fix computation of timestamp for high-resolution pcap-ng