PcapNgFileReaderDevice.h

Go to the documentation of this file.

#pragma once
 
#include "RawPacket.h"
#include "Packet.h"
#include "IFileDevice.h"
#include "PcapCommon.h"
#include <fstream>
#include <vector>
#include <string>
#include <memory>
 
 
namespace pcpp
{
enum class PcapNgBlockType : uint32_t
{
    SectionHeader = 0x0A0D0D0A,
    InterfaceDescription = 0x00000001,
    Packet = 0x00000002,
    SimplePacket = 0x00000003,
    NameResolution = 0x00000004,
    InterfaceStatistics = 0x00000005,
    EnhancedPacket = 0x00000006,
    Custom = 0x00000BAD,
    CustomReserved = 0x40000BAD
};
 
#pragma pack(push, 1)
struct PcapNgBlockHeader
{
    uint32_t blockType;
    uint32_t blockTotalLength;
};
 
struct PcapNgSectionHeaderBlock
{
    PcapNgBlockHeader blockHeader;
    uint32_t byteOrderMagic;
    uint16_t majorVersion;
    uint16_t minorVersion;
    int64_t sectionLength;
    // Options follow
};
 
struct PcapNgInterfaceDescriptionBlock
{
    PcapNgBlockHeader blockHeader;
    uint16_t linkType;
    uint16_t reserved;
    uint32_t snapLen;
    // Options follow
};
 
struct PcapNgEnhancedPacketBlock
{
    PcapNgBlockHeader blockHeader;
    uint32_t interfaceId;
    uint32_t timestampHigh;
    uint32_t timestampLow;
    uint32_t capturedLen;
    uint32_t originalLen;
    // Packet data and options follow
};
 
struct PcapNgSimplePacketBlock
{
    PcapNgBlockHeader blockHeader;
    uint32_t originalLen;
    // Packet data follows
};
 
struct PcapNgOptionHeader
{
    uint16_t optionCode;
    uint16_t optionLength;
};
#pragma pack(pop)
 
class PcapNgFileReaderDevice : public IFileReaderDevice
{
public:
    explicit PcapNgFileReaderDevice(const std::string& fileName);
    
    ~PcapNgFileReaderDevice() override;
    
    bool open() override;
    
    void close() override;
    
    bool getNextPacket(RawPacket& rawPacket) override;
    
    bool isOpened() const override
    {
        return m_File.is_open();
    }
    
    std::string getOS() const;
    
    std::string getHardware() const;
    
    std::string getCaptureApplication() const;
    
    std::string getCaptureFileComment() const;
    
    bool getNextPacket(RawPacket& rawPacket, std::string& packetComment);
    
    PcapNgFileReaderDevice(const PcapNgFileReaderDevice&) = delete;
    PcapNgFileReaderDevice& operator=(const PcapNgFileReaderDevice&) = delete;
 
private:
    std::ifstream m_File;
    struct SectionInfo
    {
        uint32_t byteOrderMagic;
        uint16_t majorVersion;
        uint16_t minorVersion;
        uint16_t linkType;
        uint32_t snapLen;
        uint8_t timestampResolution;
        std::string os;
        std::string hardware;
        std::string captureApplication;
        std::string fileComment;
    };
    
    std::vector<SectionInfo> m_Sections;
    size_t m_CurrentSection;
    std::vector<uint8_t> m_ReadBuffer;
    
    bool readBlockHeader(PcapNgBlockHeader& blockHeader);
    
    bool readSectionHeaderBlock(const PcapNgSectionHeaderBlock& shb, SectionInfo& sectionInfo);
    
    bool readInterfaceDescriptionBlock(const PcapNgInterfaceDescriptionBlock& idb, SectionInfo& sectionInfo);
    
    bool readEnhancedPacketBlock(const PcapNgEnhancedPacketBlock& epb, const SectionInfo& sectionInfo,
                                RawPacket& rawPacket, std::string* packetComment = nullptr);
    
    bool readSimplePacketBlock(const PcapNgSimplePacketBlock& spb, const SectionInfo& sectionInfo,
                              RawPacket& rawPacket);
    
    size_t readOptions(const uint8_t* data, size_t length, SectionInfo& sectionInfo);
    
    static bool isLittleEndian();
    
    static uint16_t swap16(uint16_t value);
    
    static uint32_t swap32(uint32_t value);
    
    static uint64_t swap64(uint64_t value);
};
} // namespace pcpp