PcapFilter.h

Go to the documentation of this file.

#ifndef PCAPP_FILTER
#define PCAPP_FILTER

#include <string>
#include <vector>
#include <memory>
#include "ProtocolType.h"
#include <stdint.h>
#include "ArpLayer.h"
#include "RawPacket.h"

//Forward Declaration - used in GeneralFilter
struct bpf_program;

namespace pcpp
{
    //Forward Declaration - used in GeneralFilter
    class RawPacket;

    typedef enum
    {
        SRC,
        DST,
        SRC_OR_DST
    } Direction;


    typedef enum
    {
        EQUALS,
        NOT_EQUALS,
        GREATER_THAN,
        GREATER_OR_EQUAL,
        LESS_THAN,
        LESS_OR_EQUAL
    } FilterOperator;

    class BpfFilterWrapper
    {
    private:
        std::string m_FilterStr;
        LinkLayerType m_LinkType;
        bpf_program* m_Program;

        void freeProgram();

    public:

        BpfFilterWrapper();

        ~BpfFilterWrapper();

        bool setFilter(const std::string& filter, LinkLayerType linkType = LINKTYPE_ETHERNET);

        bool matchPacketWithFilter(const RawPacket* rawPacket);

        bool matchPacketWithFilter(const uint8_t* packetData, uint32_t packetDataLength, timespec packetTimestamp, uint16_t linkType);
    };

    class GeneralFilter
    {
    protected:
        BpfFilterWrapper m_BpfWrapper;

    public:
        virtual void parseToString(std::string& result) = 0;

        bool matchPacketWithFilter(RawPacket* rawPacket);

        GeneralFilter() {}

        virtual ~GeneralFilter() {}
    };

    class BPFStringFilter : public GeneralFilter
    {
    private:
        const std::string m_FilterStr;

    public:
        explicit BPFStringFilter(const std::string& filterStr) : m_FilterStr(filterStr) {}

        virtual ~BPFStringFilter() {}

        virtual void parseToString(std::string& result);

        bool verifyFilter();
    };


    class IFilterWithDirection : public GeneralFilter
    {
    private:
        Direction m_Dir;
    protected:
        void parseDirection(std::string& directionAsString);
        Direction getDir() const { return m_Dir; }
        explicit IFilterWithDirection(Direction dir) { m_Dir = dir; }
    public:
        void setDirection(Direction dir) { m_Dir = dir; }
    };


    class IFilterWithOperator : public GeneralFilter
    {
    private:
        FilterOperator m_Operator;
    protected:
        std::string parseOperator();
        FilterOperator getOperator() const { return m_Operator; }
        explicit IFilterWithOperator(FilterOperator op) { m_Operator = op; }
    public:
        void setOperator(FilterOperator op) { m_Operator = op; }
    };



    class IPFilter : public IFilterWithDirection
    {
    private:
        std::string m_Address;
        std::string m_IPv4Mask;
        int m_Len;
        void convertToIPAddressWithMask(std::string& ipAddrmodified, std::string& mask) const;
        void convertToIPAddressWithLen(std::string& ipAddrmodified) const;
    public:
        IPFilter(const std::string& ipAddress, Direction dir) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(""), m_Len(0) {}

        IPFilter(const std::string& ipAddress, Direction dir, const std::string& ipv4Mask) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(ipv4Mask), m_Len(0) {}

        IPFilter(const std::string& ipAddress, Direction dir, int len) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(""), m_Len(len) {}

        void parseToString(std::string& result);

        void setAddr(const std::string& ipAddress) { m_Address = ipAddress; }

        void setMask(const std::string& ipv4Mask) { m_IPv4Mask = ipv4Mask; m_Len = 0; }

        void setLen(int len) { m_IPv4Mask = ""; m_Len = len; }
    };



    class IPv4IDFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_IpID;
    public:
        IPv4IDFilter(uint16_t ipID, FilterOperator op) : IFilterWithOperator(op), m_IpID(ipID) {}

        void parseToString(std::string& result);

        void setIpID(uint16_t ipID) { m_IpID = ipID; }
    };



    class IPv4TotalLengthFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_TotalLength;
    public:
        IPv4TotalLengthFilter(uint16_t totalLength, FilterOperator op) : IFilterWithOperator(op), m_TotalLength(totalLength) {}

        void parseToString(std::string& result);

        void setTotalLength(uint16_t totalLength) { m_TotalLength = totalLength; }
    };



    class PortFilter : public IFilterWithDirection
    {
    private:
        std::string m_Port;
        void portToString(uint16_t portAsInt);
    public:
        PortFilter(uint16_t port, Direction dir);

        void parseToString(std::string& result);

        void setPort(uint16_t port) { portToString(port); }
    };



    class PortRangeFilter : public IFilterWithDirection
    {
    private:
        uint16_t m_FromPort;
        uint16_t m_ToPort;
    public:
        PortRangeFilter(uint16_t fromPort, uint16_t toPort, Direction dir) : IFilterWithDirection(dir), m_FromPort(fromPort), m_ToPort(toPort) {}

        void parseToString(std::string& result);

        void setFromPort(uint16_t fromPort) { m_FromPort = fromPort; }

        void setToPort(uint16_t toPort) { m_ToPort = toPort; }
    };



    class MacAddressFilter : public IFilterWithDirection
    {
    private:
        MacAddress m_MacAddress;
    public:
        MacAddressFilter(MacAddress address, Direction dir) : IFilterWithDirection(dir), m_MacAddress(address) {}

        void parseToString(std::string& result);

        void setMacAddress(MacAddress address) { m_MacAddress = address; }
    };



    class EtherTypeFilter : public GeneralFilter
    {
    private:
        uint16_t m_EtherType;
    public:
        explicit EtherTypeFilter(uint16_t etherType) : m_EtherType(etherType) {}

        void parseToString(std::string& result);

        void setEtherType(uint16_t etherType) { m_EtherType = etherType; }
    };



    class AndFilter : public GeneralFilter
    {
    private:
        std::vector<GeneralFilter*> m_FilterList;
    public:

        AndFilter() {}

        explicit AndFilter(std::vector<GeneralFilter*>& filters);

        void addFilter(GeneralFilter* filter) { m_FilterList.push_back(filter); }

        void setFilters(std::vector<GeneralFilter*>& filters);

        void parseToString(std::string& result);
    };



    class OrFilter : public GeneralFilter
    {
    private:
        std::vector<GeneralFilter*> m_FilterList;
    public:

        OrFilter() {}

        explicit OrFilter(std::vector<GeneralFilter*>& filters);

        void addFilter(GeneralFilter* filter) { m_FilterList.push_back(filter); }

        void parseToString(std::string& result);
    };



    class NotFilter : public GeneralFilter
    {
    private:
        GeneralFilter* m_FilterToInverse;
    public:
        explicit NotFilter(GeneralFilter* filterToInverse) { m_FilterToInverse = filterToInverse; }

        void parseToString(std::string& result);

        void setFilter(GeneralFilter* filterToInverse) { m_FilterToInverse = filterToInverse; }
    };



    class ProtoFilter : public GeneralFilter
    {
    private:
        ProtocolType m_Proto;
    public:
        explicit ProtoFilter(ProtocolType proto) : m_Proto(proto) {}

        void parseToString(std::string& result);

        void setProto(ProtocolType proto) { m_Proto = proto; }
    };



    class ArpFilter : public GeneralFilter
    {
    private:
        ArpOpcode m_OpCode;
    public:
        explicit ArpFilter(ArpOpcode opCode) : m_OpCode(opCode) {}

        void parseToString(std::string& result);

        void setOpCode(ArpOpcode opCode) { m_OpCode = opCode; }
    };



    class VlanFilter : public GeneralFilter
    {
    private:
        uint16_t m_VlanID;
    public:
        explicit VlanFilter(uint16_t vlanId) : m_VlanID(vlanId) {}

        void parseToString(std::string& result);

        void setVlanID(uint16_t vlanId) { m_VlanID = vlanId; }
    };



    class TcpFlagsFilter : public GeneralFilter
    {
    public:
        enum TcpFlags
        {
            tcpFin = 1,
            tcpSyn = 2,
            tcpRst = 4,
            tcpPush = 8,
            tcpAck = 16,
            tcpUrg = 32
        };

        enum MatchOptions
        {
            MatchAll,
            MatchOneAtLeast
        };
    private:
        uint8_t m_TcpFlagsBitMask;
        MatchOptions m_MatchOption;
    public:
        TcpFlagsFilter(uint8_t tcpFlagBitMask, MatchOptions matchOption) : m_TcpFlagsBitMask(tcpFlagBitMask), m_MatchOption(matchOption) {}

        void setTcpFlagsBitMask(uint8_t tcpFlagBitMask, MatchOptions matchOption) { m_TcpFlagsBitMask = tcpFlagBitMask; m_MatchOption = matchOption; }

        void parseToString(std::string& result);
    };



    class TcpWindowSizeFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_WindowSize;
    public:
        TcpWindowSizeFilter(uint16_t windowSize, FilterOperator op) : IFilterWithOperator(op), m_WindowSize(windowSize) {}

        void parseToString(std::string& result);

        void setWindowSize(uint16_t windowSize) { m_WindowSize = windowSize; }
    };



    class UdpLengthFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_Length;
    public:
        UdpLengthFilter(uint16_t length, FilterOperator op) : IFilterWithOperator(op), m_Length(length) {}

        void parseToString(std::string& result);

        void setLength(uint16_t length) { m_Length = length; }
    };

} // namespace pcpp

#endif