Refactor/code alignment (#149)

* feat: add NO_COLOR support and centralized theme palette

Introduce a theme module with semantic color aliases derived from
7 base constants, replacing ~100 scattered hardcoded Color::* values.
Add --no-color flag and NO_COLOR env var support (https://no-color.org).

* refactor: simplify and align code patterns across codebase

- Add Display impl for TcpState, deduplicating state name mapping
- Extract NONE_PLACEHOLDER constant in ui.rs (15 scattered instances)
- Replace magic port literals with named constants in DPI module
- Standardize lock handling to .expect() with descriptive messages
- Remove leftover Firefox-specific debug logging from ui.rs

Author: domcyrus

src/cli.rs

@@ -95,6 +95,12 @@ pub fn build_cli() -> Command {
                 .long("show-ptr-lookups")
                 .help("Show PTR lookup connections in UI (hidden by default when --resolve-dns is enabled)")
                 .action(clap::ArgAction::SetTrue),
+        )
+        .arg(
+            Arg::new("no-color")
+                .long("no-color")
+                .help("Disable all colors in the UI (also respects NO_COLOR env var)")
+                .action(clap::ArgAction::SetTrue),
         );
 
     #[cfg(target_os = "linux")]

src/main.rs

@@ -91,6 +91,14 @@ fn main() -> Result<()> {
         info!("PTR lookup connections will be shown in UI");
     }
 
+    // Check NO_COLOR environment variable and --no-color flag (https://no-color.org)
+    let no_color =
+        matches.get_flag("no-color") || std::env::var("NO_COLOR").is_ok_and(|v| !v.is_empty());
+    if no_color {
+        info!("Colors disabled (NO_COLOR)");
+        ui::set_no_color(true);
+    }
+
     // Set up terminal
     let backend = CrosstermBackend::new(io::stdout());
     let mut terminal = ui::setup_terminal(backend)?;

src/network/dpi/mod.rs

@@ -18,6 +18,21 @@ mod ssh;
 pub use cipher_suites::{format_cipher_suite, is_secure_cipher_suite};
 pub use quic::{is_partial_sni, try_extract_tls_from_reassembler};
 
+// Well-known port numbers used for DPI protocol detection.
+const PORT_SSH: u16 = 22;
+const PORT_DNS: u16 = 53;
+const PORT_DHCP_SERVER: u16 = 67;
+const PORT_DHCP_CLIENT: u16 = 68;
+const PORT_NTP: u16 = 123;
+const PORT_NETBIOS_NS: u16 = 137;
+const PORT_NETBIOS_DGM: u16 = 138;
+const PORT_SNMP: u16 = 161;
+const PORT_SNMP_TRAP: u16 = 162;
+const PORT_HTTPS: u16 = 443;
+const PORT_SSDP: u16 = 1900;
+const PORT_MDNS: u16 = 5353;
+const PORT_LLMNR: u16 = 5355;
+
 /// Result of DPI analysis
 #[derive(Debug, Clone)]
 pub struct DpiResult {
@@ -45,7 +60,7 @@ pub fn analyze_tcp_packet(
     }
 
     // 2. Check for TLS/HTTPS (port 443 or TLS handshake)
-    if (local_port == 443 || remote_port == 443 || https::is_tls_handshake(payload))
+    if (local_port == PORT_HTTPS || remote_port == PORT_HTTPS || https::is_tls_handshake(payload))
         && let Some(tls_result) = https::analyze_https(payload)
     {
         return Some(DpiResult {
@@ -54,7 +69,7 @@ pub fn analyze_tcp_packet(
     }
 
     // 3. Check for SSH (port 22 or SSH banner)
-    if (local_port == 22 || remote_port == 22 || ssh::is_likely_ssh(payload))
+    if (local_port == PORT_SSH || remote_port == PORT_SSH || ssh::is_likely_ssh(payload))
         && let Some(ssh_result) = ssh::analyze_ssh(payload, _is_outgoing)
     {
         return Some(DpiResult {
@@ -79,7 +94,7 @@ pub fn analyze_udp_packet(
     }
 
     // 1. DNS (port 53)
-    if (local_port == 53 || remote_port == 53)
+    if (local_port == PORT_DNS || remote_port == PORT_DNS)
         && let Some(dns_result) = dns::analyze_dns(payload)
     {
         return Some(DpiResult {
@@ -88,7 +103,7 @@ pub fn analyze_udp_packet(
     }
 
     // 2. QUIC/HTTP3 (port 443)
-    if (local_port == 443 || remote_port == 443) && quic::is_quic_packet(payload) {
+    if (local_port == PORT_HTTPS || remote_port == PORT_HTTPS) && quic::is_quic_packet(payload) {
         let quic_info = quic::parse_quic_packet(payload);
         if let Some(quic_info) = quic_info {
             debug!("QUIC packet detected: {:?}", quic_info);
@@ -106,7 +121,7 @@ pub fn analyze_udp_packet(
     }
 
     // 3. mDNS (port 5353)
-    if (local_port == 5353 || remote_port == 5353)
+    if (local_port == PORT_MDNS || remote_port == PORT_MDNS)
         && let Some(mdns_result) = mdns::analyze_mdns(payload)
     {
         return Some(DpiResult {
@@ -117,7 +132,10 @@ pub fn analyze_udp_packet(
     // 4. DHCP (ports 67-68)
     if matches!(
         (local_port, remote_port),
-        (67, _) | (68, _) | (_, 67) | (_, 68)
+        (PORT_DHCP_SERVER, _)
+            | (PORT_DHCP_CLIENT, _)
+            | (_, PORT_DHCP_SERVER)
+            | (_, PORT_DHCP_CLIENT)
     ) && let Some(dhcp_result) = dhcp::analyze_dhcp(payload)
     {
         return Some(DpiResult {
@@ -126,7 +144,7 @@ pub fn analyze_udp_packet(
     }
 
     // 5. NTP (port 123)
-    if (local_port == 123 || remote_port == 123)
+    if (local_port == PORT_NTP || remote_port == PORT_NTP)
         && let Some(ntp_result) = ntp::analyze_ntp(payload)
     {
         return Some(DpiResult {
@@ -135,7 +153,7 @@ pub fn analyze_udp_packet(
     }
 
     // 6. LLMNR (port 5355)
-    if (local_port == 5355 || remote_port == 5355)
+    if (local_port == PORT_LLMNR || remote_port == PORT_LLMNR)
         && let Some(llmnr_result) = llmnr::analyze_llmnr(payload)
     {
         return Some(DpiResult {
@@ -144,7 +162,7 @@ pub fn analyze_udp_packet(
     }
 
     // 7. SSDP (port 1900)
-    if (local_port == 1900 || remote_port == 1900)
+    if (local_port == PORT_SSDP || remote_port == PORT_SSDP)
         && let Some(ssdp_result) = ssdp::analyze_ssdp(payload)
     {
         return Some(DpiResult {
@@ -153,7 +171,7 @@ pub fn analyze_udp_packet(
     }
 
     // 8. NetBIOS-NS (port 137)
-    if (local_port == 137 || remote_port == 137)
+    if (local_port == PORT_NETBIOS_NS || remote_port == PORT_NETBIOS_NS)
         && let Some(netbios_result) = netbios::analyze_netbios_ns(payload)
     {
         return Some(DpiResult {
@@ -162,7 +180,7 @@ pub fn analyze_udp_packet(
     }
 
     // 9. NetBIOS-DGM (port 138)
-    if (local_port == 138 || remote_port == 138)
+    if (local_port == PORT_NETBIOS_DGM || remote_port == PORT_NETBIOS_DGM)
         && let Some(netbios_result) = netbios::analyze_netbios_dgm(payload)
     {
         return Some(DpiResult {
@@ -173,7 +191,7 @@ pub fn analyze_udp_packet(
     // 10. SNMP (ports 161-162)
     if matches!(
         (local_port, remote_port),
-        (161, _) | (162, _) | (_, 161) | (_, 162)
+        (PORT_SNMP, _) | (PORT_SNMP_TRAP, _) | (_, PORT_SNMP) | (_, PORT_SNMP_TRAP)
     ) && let Some(snmp_result) = snmp::analyze_snmp(payload)
     {
         return Some(DpiResult {

src/network/platform/freebsd/process.rs

@@ -179,14 +179,14 @@ impl ProcessLookup for FreeBSDProcessLookup {
 
         // Simple cache lookup with no refresh on cache miss.
         // The enrichment thread handles periodic refresh.
-        let cache = self.cache.read().unwrap();
+        let cache = self.cache.read().expect("cache lock poisoned");
         cache.lookup.get(&key).cloned()
     }
 
     fn refresh(&self) -> Result<()> {
         let process_map = Self::build_process_map()?;
 
-        let mut cache = self.cache.write().unwrap();
+        let mut cache = self.cache.write().expect("cache lock poisoned");
         cache.lookup = process_map;
         cache.last_refresh = Instant::now();
 

src/network/platform/linux/enhanced.rs

@@ -128,7 +128,7 @@ mod ebpf_enhanced {
                     );
 
                     if let Some(result) = self.try_ebpf_lookup(conn) {
-                        let mut stats = self.stats.write().unwrap();
+                        let mut stats = self.stats.write().expect("stats lock poisoned");
                         stats.ebpf_hits += 1;
                         debug!(
                             "Enhanced lookup: eBPF hit for PID {} ({})",
@@ -153,7 +153,7 @@ mod ebpf_enhanced {
                         );
 
                         if let Some(result) = self.try_ebpf_icmp_lookup(conn, *id) {
-                            let mut stats = self.stats.write().unwrap();
+                            let mut stats = self.stats.write().expect("stats lock poisoned");
                             stats.ebpf_hits += 1;
                             debug!(
                                 "Enhanced lookup: eBPF ICMP hit for PID {} ({})",
@@ -170,7 +170,7 @@ mod ebpf_enhanced {
 
             // Fall back to procfs approach
             if let Some(result) = self.procfs_lookup.get_process_for_connection(conn) {
-                let mut stats = self.stats.write().unwrap();
+                let mut stats = self.stats.write().expect("stats lock poisoned");
                 stats.procfs_hits += 1;
                 return Some(result);
             }
@@ -179,7 +179,10 @@ mod ebpf_enhanced {
         }
 
         fn try_ebpf_lookup(&self, conn: &Connection) -> Option<(u32, String)> {
-            let mut tracker_guard = self.ebpf_tracker.write().unwrap();
+            let mut tracker_guard = self
+                .ebpf_tracker
+                .write()
+                .expect("ebpf_tracker lock poisoned");
             let tracker = match tracker_guard.as_mut() {
                 Some(t) => {
                     debug!("eBPF lookup: Tracker available, performing lookup");
@@ -240,7 +243,10 @@ mod ebpf_enhanced {
         }
 
         fn try_ebpf_icmp_lookup(&self, conn: &Connection, icmp_id: u16) -> Option<(u32, String)> {
-            let mut tracker_guard = self.ebpf_tracker.write().unwrap();
+            let mut tracker_guard = self
+                .ebpf_tracker
+                .write()
+                .expect("ebpf_tracker lock poisoned");
             let tracker = tracker_guard.as_mut()?;
 
             match tracker.lookup_icmp(conn.local_addr.ip(), conn.remote_addr.ip(), icmp_id) {
@@ -276,7 +282,7 @@ mod ebpf_enhanced {
         pub fn is_ebpf_available(&self) -> bool {
             self.ebpf_tracker
                 .read()
-                .unwrap()
+                .expect("ebpf_tracker lock poisoned")
                 .as_ref()
                 .map(|t| t.is_healthy())
                 .unwrap_or(false)
@@ -285,7 +291,10 @@ mod ebpf_enhanced {
         /// Perform periodic cleanup of stale eBPF map entries
         fn maybe_cleanup_ebpf_map(&self) {
             let now = Instant::now();
-            let mut last_cleanup = self.last_cleanup.write().unwrap();
+            let mut last_cleanup = self
+                .last_cleanup
+                .write()
+                .expect("last_cleanup lock poisoned");
 
             if now.duration_since(*last_cleanup).as_secs()
                 >= self.cleanup_config.cleanup_interval_secs
@@ -294,7 +303,12 @@ mod ebpf_enhanced {
                 drop(last_cleanup);
 
                 // Perform cleanup
-                if let Some(tracker) = self.ebpf_tracker.write().unwrap().as_mut() {
+                if let Some(tracker) = self
+                    .ebpf_tracker
+                    .write()
+                    .expect("ebpf_tracker lock poisoned")
+                    .as_mut()
+                {
                     let cleaned =
                         tracker.cleanup_stale_entries(self.cleanup_config.stale_threshold_secs);
                     if cleaned > 0 {
@@ -314,7 +328,7 @@ mod ebpf_enhanced {
 
             // Update protocol statistics
             {
-                let mut stats = self.stats.write().unwrap();
+                let mut stats = self.stats.write().expect("stats lock poisoned");
                 stats.total_lookups += 1;
 
                 // Track IP version
@@ -336,11 +350,14 @@ mod ebpf_enhanced {
 
             // Try cache first
             {
-                let cache = self.unified_cache.read().unwrap();
+                let cache = self
+                    .unified_cache
+                    .read()
+                    .expect("unified_cache lock poisoned");
                 if cache.last_refresh.elapsed() < Duration::from_secs(2)
                     && let Some(process_info) = cache.lookup.get(&key)
                 {
-                    let mut stats = self.stats.write().unwrap();
+                    let mut stats = self.stats.write().expect("stats lock poisoned");
                     stats.cache_hits += 1;
                     return Some(process_info.clone());
                 }
@@ -350,16 +367,19 @@ mod ebpf_enhanced {
             if let Some(result) = self.lookup_process_enhanced(conn) {
                 // Update cache with the result
                 {
-                    let mut cache = self.unified_cache.write().unwrap();
+                    let mut cache = self
+                        .unified_cache
+                        .write()
+                        .expect("unified_cache lock poisoned");
                     cache.lookup.insert(key, result.clone());
 
-                    let mut stats = self.stats.write().unwrap();
+                    let mut stats = self.stats.write().expect("stats lock poisoned");
                     stats.cache_entries = cache.lookup.len() as u64;
                 }
                 Some(result)
             } else {
                 // Track failed lookups
-                let mut stats = self.stats.write().unwrap();
+                let mut stats = self.stats.write().expect("stats lock poisoned");
                 stats.failed_lookups += 1;
                 None
             }
@@ -371,7 +391,10 @@ mod ebpf_enhanced {
 
             // Update our cache timestamp
             {
-                let mut cache = self.unified_cache.write().unwrap();
+                let mut cache = self
+                    .unified_cache
+                    .write()
+                    .expect("unified_cache lock poisoned");
                 cache.last_refresh = Instant::now();
                 // Optionally clear cache to force fresh lookups
                 cache.lookup.clear();
@@ -538,7 +561,7 @@ mod procfs_only {
 
             // Update protocol statistics
             {
-                let mut stats = self.stats.write().unwrap();
+                let mut stats = self.stats.write().expect("stats lock poisoned");
                 stats.total_lookups += 1;
 
                 // Track IP version
@@ -560,11 +583,14 @@ mod procfs_only {
 
             // Try cache first
             {
-                let cache = self.unified_cache.read().unwrap();
+                let cache = self
+                    .unified_cache
+                    .read()
+                    .expect("unified_cache lock poisoned");
                 if cache.last_refresh.elapsed() < Duration::from_secs(2)
                     && let Some(process_info) = cache.lookup.get(&key)
                 {
-                    let mut stats = self.stats.write().unwrap();
+                    let mut stats = self.stats.write().expect("stats lock poisoned");
                     stats.cache_hits += 1;
                     return Some(process_info.clone());
                 }
@@ -574,17 +600,20 @@ mod procfs_only {
             if let Some(result) = self.procfs_lookup.get_process_for_connection(conn) {
                 // Update cache with the result
                 {
-                    let mut cache = self.unified_cache.write().unwrap();
+                    let mut cache = self
+                        .unified_cache
+                        .write()
+                        .expect("unified_cache lock poisoned");
                     cache.lookup.insert(key, result.clone());
 
-                    let mut stats = self.stats.write().unwrap();
+                    let mut stats = self.stats.write().expect("stats lock poisoned");
                     stats.cache_entries = cache.lookup.len() as u64;
                     stats.procfs_hits += 1;
                 }
                 Some(result)
             } else {
                 // Track failed lookups
-                let mut stats = self.stats.write().unwrap();
+                let mut stats = self.stats.write().expect("stats lock poisoned");
                 stats.failed_lookups += 1;
                 None
             }
@@ -596,7 +625,10 @@ mod procfs_only {
 
             // Update our cache timestamp
             {
-                let mut cache = self.unified_cache.write().unwrap();
+                let mut cache = self
+                    .unified_cache
+                    .write()
+                    .expect("unified_cache lock poisoned");
                 cache.last_refresh = Instant::now();
                 // Optionally clear cache to force fresh lookups
                 cache.lookup.clear();