Haskell PCAP writing / dump (instance Storable PktHdr)

haskell-pcap-writing.hs

module PktHdrStorableInstance where

import Foreign.Marshal.Utils (with)
import Foreign.Ptr (plusPtr)
import Foreign.Storable
import Network.Pcap
import Network.Pcap.Base (toPktHdr)

#include <pcap.h>


-- From: http://www.haskell.org/haskellwiki/FFI_cook_book
#let alignment t = "%lu", (unsigned long) offsetof(struct { char x__; t (y__); }, y__)


instance Storable PktHdr where
    alignment _ = (#alignment struct pcap_pkthdr)
    sizeOf _ = (#size struct pcap_pkthdr)
    peek = toPktHdr
    poke ptr PktHdr { hdrSeconds = s
                    , hdrUseconds = u
                    , hdrCaptureLength = cl
                    , hdrWireLength = wl } = do
        let ts = (#ptr struct pcap_pkthdr, ts) ptr

        (#poke struct timeval, tv_sec) ts s
        (#poke struct timeval, tv_usec) ts u
        (#poke struct pcap_pkthdr, caplen) ptr cl
        (#poke struct pcap_pkthdr, len) ptr wl


-- | Copies one PCAP file to another by going through all the packets.
--
-- Uses `loop` and `dump`.
copyPcap :: IO ()
copyPcap = do

  inHandle <- openOffline "myfile.pcap"

  len <- snapshotLen inHandle
  link <- datalink inHandle

  outHandle <- openDead link len
  outDump <- openDump outHandle "myfile-copy.pcap"

  _ <- loop inHandle (-1) (procPacket outDump)

  return ()

  where
    procPacket :: DumpHandle -> Callback
    procPacket outDump hdr conentPtr = with hdr $ \hdrPtr -> do
      dump outDump hdrPtr conentPtr