Return Eof if reader is exhausted AND bytes have been consumed (Closes …

…#30)

If a call to `.next()` matched all the bytes from the buffer, the next call to
`.consume()` would put the buffer to available_data == position == 0.
But if reader is not exhausted, we should not return Eof, just incomplete, on
the next read.

src/capture_pcap.rs

@@ -142,7 +142,7 @@ where
         // 1) all bytes have been read
         // 2) no more data is available
         if self.buffer.available_data() == 0
-            && (self.buffer.position() == 0 || self.reader_exhausted)
+            && (self.buffer.position() == 0 && self.reader_exhausted)
         {
             return Err(PcapError::Eof);
         }

src/capture_pcapng.rs

@@ -154,7 +154,7 @@ where
         // 1) all bytes have been read
         // 2) no more data is available
         if self.buffer.available_data() == 0
-            && (self.buffer.position() == 0 || self.reader_exhausted)
+            && (self.buffer.position() == 0 && self.reader_exhausted)
         {
             return Err(PcapError::Eof);
         }

tests/pcapng.rs

@@ -431,3 +431,24 @@ fn test_reader_buffer_too_small() {
     }
     assert_eq!(num_blocks, 9);
 }
+
+// related issue: https://github.com/rusticata/pcap-parser/issues/30
+#[test]
+fn test_pcapng_earlyeofandnotexhausted() {
+    let path = "assets/test001-le.pcapng";
+    let file = File::open(path).unwrap();
+    let buffered = BufReader::new(file);
+
+    // 96 is exactly the size of the first SHB, so the first consume will empty the buffer
+    let mut reader = PcapNGReader::new(96, buffered).expect("PcapNGReader");
+    let (offset, _block) = reader.next().expect("could not read first block");
+    reader.consume(offset);
+    // the second read happens in the following situation: buf.available_data == 0 AND buf.position == 0
+    assert_eq!(reader.position(), 0);
+    assert!(reader.data().is_empty());
+    let res = reader.next();
+    // res should not be Eof
+    assert!(!matches!(res, Err(PcapError::Eof)));
+    // res should be Incomplete(4) (attempt to read magic)
+    assert!(matches!(res, Err(PcapError::Incomplete(4))));
+}