Source code for pcapng_utils.tshark.utils

 1import binascii
 2import json
 3from datetime import datetime, timezone
 4from hashlib import sha1
 5from typing import Optional, Any
 6
 7from .types import TsharkRaw
 8
 9
[docs] 10def get_tshark_bytes_from_raw(r: Optional[TsharkRaw]) -> bytes: 11 """ 12 Format of '*_raw' fields produced with '-x' flag: [hexa: str, *sizes: int] 13 14 Sizes are 4 integers in tshark old versions and 5 integers in newer (>= v4.6) 15 """ 16 if r is None: 17 return b"" 18 assert isinstance(r, list) and len(r) in {5, 6}, r 19 assert all(isinstance(i, int) for i in r[1:]), r 20 hexa = r[0] 21 assert isinstance(hexa, str) and hexa.isascii(), r 22 return binascii.unhexlify(hexa)
23 24
[docs] 25def har_entry_with_common_fields(har_entry: dict[str, Any]) -> dict[str, Any]: 26 """ 27 Return provided HAR entry together with common fields. 28 29 In particular, we add the non-standard `_sha1Id` field that serves both as entry identifier + 30 easy changes-tracker across different releases of this software. 31 """ 32 to_hash = json.dumps( 33 har_entry, allow_nan=False, ensure_ascii=True, indent=0, sort_keys=True 34 ).encode("ascii") 35 sha1id = sha1(to_hash).hexdigest() 36 timestamp_iso = datetime.fromtimestamp( 37 har_entry["_timestamp"], timezone.utc 38 ).isoformat() 39 timing_tot = sum(dur for dur in har_entry["timings"].values() if dur != -1) 40 return { 41 "_sha1Id": sha1id, 42 "startedDateTime": timestamp_iso, 43 **har_entry, 44 "time": round(timing_tot, 2), 45 "cache": {}, # not handled by this software 46 }