PcapFilter.h

Go to the documentation of this file.

#ifndef PCAPP_FILTER
#define PCAPP_FILTER
 
#include <string>
#include <vector>
#include <memory>
#include "ProtocolType.h"
#include <stdint.h>
#include "ArpLayer.h"
#include "RawPacket.h"
 
//Forward Declaration - used in GeneralFilter
struct bpf_program;
 
namespace pcpp
{
    //Forward Declartation - used in GeneralFilter
    class RawPacket;
 
    typedef enum
    {
        SRC,
        DST,
        SRC_OR_DST
    } Direction;
 
 
    typedef enum
    {
        EQUALS,
        NOT_EQUALS,
        GREATER_THAN,
        GREATER_OR_EQUAL,
        LESS_THAN,
        LESS_OR_EQUAL
    } FilterOperator;
 
 
    class GeneralFilter
    {
    protected:
        bpf_program* m_Program;
        std::string m_LastProgramString;
        pcpp::LinkLayerType m_LastLinkLayerType;
 
        void freeProgram();
 
    public:
        virtual void parseToString(std::string& result) = 0;
 
        bool matchPacketWithFilter(RawPacket* rawPacket);
 
        GeneralFilter() : m_Program(NULL), m_LastProgramString(), m_LastLinkLayerType(pcpp::LINKTYPE_ETHERNET) {}
 
        virtual ~GeneralFilter() { freeProgram(); }
    };
 
    class BPFStringFilter : public GeneralFilter
    {
    private:
        const std::string m_FilterStr;
 
    public:
        BPFStringFilter(const std::string& filterStr) : m_FilterStr(filterStr) {}
 
        virtual ~BPFStringFilter() {}
 
        virtual void parseToString(std::string& result);
 
        bool verifyFilter();
    };
 
 
    class IFilterWithDirection : public GeneralFilter
    {
    private:
        Direction m_Dir;
    protected:
        void parseDirection(std::string& directionAsString);
        Direction getDir() const { return m_Dir; }
        IFilterWithDirection(Direction dir) { m_Dir = dir; }
    public:
        void setDirection(Direction dir) { m_Dir = dir; }
    };
 
 
    class IFilterWithOperator : public GeneralFilter
    {
    private:
        FilterOperator m_Operator;
    protected:
        std::string parseOperator();
        FilterOperator getOperator() const { return m_Operator; }
        IFilterWithOperator(FilterOperator op) { m_Operator = op; }
    public:
        void setOperator(FilterOperator op) { m_Operator = op; }
    };
 
 
 
    class IPFilter : public IFilterWithDirection
    {
    private:
        std::string m_Address;
        std::string m_IPv4Mask;
        int m_Len;
        void convertToIPAddressWithMask(std::string& ipAddrmodified, std::string& mask) const;
        void convertToIPAddressWithLen(std::string& ipAddrmodified) const;
    public:
        IPFilter(const std::string& ipAddress, Direction dir) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(""), m_Len(0) {}
 
        IPFilter(const std::string& ipAddress, Direction dir, const std::string& ipv4Mask) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(ipv4Mask), m_Len(0) {}
 
        IPFilter(const std::string& ipAddress, Direction dir, int len) : IFilterWithDirection(dir), m_Address(ipAddress), m_IPv4Mask(""), m_Len(len) {}
 
        void parseToString(std::string& result);
 
        void setAddr(const std::string& ipAddress) { m_Address = ipAddress; }
 
        void setMask(const std::string& ipv4Mask) { m_IPv4Mask = ipv4Mask; m_Len = 0; }
 
        void setLen(int len) { m_IPv4Mask = ""; m_Len = len; }
    };
 
 
 
    class IPv4IDFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_IpID;
    public:
        IPv4IDFilter(uint16_t ipID, FilterOperator op) : IFilterWithOperator(op), m_IpID(ipID) {}
 
        void parseToString(std::string& result);
 
        void setIpID(uint16_t ipID) { m_IpID = ipID; }
    };
 
 
 
    class IPv4TotalLengthFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_TotalLength;
    public:
        IPv4TotalLengthFilter(uint16_t totalLength, FilterOperator op) : IFilterWithOperator(op), m_TotalLength(totalLength) {}
 
        void parseToString(std::string& result);
 
        void setTotalLength(uint16_t totalLength) { m_TotalLength = totalLength; }
    };
 
 
 
    class PortFilter : public IFilterWithDirection
    {
    private:
        std::string m_Port;
        void portToString(uint16_t portAsInt);
    public:
        PortFilter(uint16_t port, Direction dir);
 
        void parseToString(std::string& result);
 
        void setPort(uint16_t port) { portToString(port); }
    };
 
 
 
    class PortRangeFilter : public IFilterWithDirection
    {
    private:
        uint16_t m_FromPort;
        uint16_t m_ToPort;
    public:
        PortRangeFilter(uint16_t fromPort, uint16_t toPort, Direction dir) : IFilterWithDirection(dir), m_FromPort(fromPort), m_ToPort(toPort) {}
 
        void parseToString(std::string& result);
 
        void setFromPort(uint16_t fromPort) { m_FromPort = fromPort; }
 
        void setToPort(uint16_t toPort) { m_ToPort = toPort; }
    };
 
 
 
    class MacAddressFilter : public IFilterWithDirection
    {
    private:
        MacAddress m_MacAddress;
    public:
        MacAddressFilter(MacAddress address, Direction dir) : IFilterWithDirection(dir), m_MacAddress(address) {}
 
        void parseToString(std::string& result);
 
        void setMacAddress(MacAddress address) { m_MacAddress = address; }
    };
 
 
 
    class EtherTypeFilter : public GeneralFilter
    {
    private:
        uint16_t m_EtherType;
    public:
        EtherTypeFilter(uint16_t etherType) : m_EtherType(etherType) {}
 
        void parseToString(std::string& result);
 
        void setEtherType(uint16_t etherType) { m_EtherType = etherType; }
    };
 
 
 
    class AndFilter : public GeneralFilter
    {
    private:
        std::vector<GeneralFilter*> m_FilterList;
    public:
 
        AndFilter() {}
 
        AndFilter(std::vector<GeneralFilter*>& filters);
 
        void addFilter(GeneralFilter* filter) { m_FilterList.push_back(filter); }
 
        void setFilters(std::vector<GeneralFilter*>& filters);
 
        void parseToString(std::string& result);
    };
 
 
 
    class OrFilter : public GeneralFilter
    {
    private:
        std::vector<GeneralFilter*> m_FilterList;
    public:
 
        OrFilter() {}
 
        OrFilter(std::vector<GeneralFilter*>& filters);
 
        void addFilter(GeneralFilter* filter) { m_FilterList.push_back(filter); }
 
        void parseToString(std::string& result);
    };
 
 
 
    class NotFilter : public GeneralFilter
    {
    private:
        GeneralFilter* m_FilterToInverse;
    public:
        NotFilter(GeneralFilter* filterToInverse) { m_FilterToInverse = filterToInverse; }
 
        void parseToString(std::string& result);
 
        void setFilter(GeneralFilter* filterToInverse) { m_FilterToInverse = filterToInverse; }
    };
 
 
 
    class ProtoFilter : public GeneralFilter
    {
    private:
        ProtocolType m_Proto;
    public:
        ProtoFilter(ProtocolType proto) { m_Proto = proto; }
 
        void parseToString(std::string& result);
 
        void setProto(ProtocolType proto) { m_Proto = proto; }
    };
 
 
 
    class ArpFilter : public GeneralFilter
    {
    private:
        ArpOpcode m_OpCode;
    public:
        ArpFilter(ArpOpcode opCode) { m_OpCode = opCode; }
 
        void parseToString(std::string& result);
 
        void setOpCode(ArpOpcode opCode) { m_OpCode = opCode; }
    };
 
 
 
    class VlanFilter : public GeneralFilter
    {
    private:
        uint16_t m_VlanID;
    public:
        VlanFilter(uint16_t vlanId) : m_VlanID(vlanId) {}
 
        void parseToString(std::string& result);
 
        void setVlanID(uint16_t vlanId) { m_VlanID = vlanId; }
    };
 
 
 
    class TcpFlagsFilter : public GeneralFilter
    {
    public:
        enum TcpFlags
        {
            tcpFin = 1,
            tcpSyn = 2,
            tcpRst = 4,
            tcpPush = 8,
            tcpAck = 16,
            tcpUrg = 32
        };
 
        enum MatchOptions
        {
            MatchAll,
            MatchOneAtLeast
        };
    private:
        uint8_t m_TcpFlagsBitMask;
        MatchOptions m_MatchOption;
    public:
        TcpFlagsFilter(uint8_t tcpFlagBitMask, MatchOptions matchOption) : m_TcpFlagsBitMask(tcpFlagBitMask), m_MatchOption(matchOption) {}
 
        void setTcpFlagsBitMask(uint8_t tcpFlagBitMask, MatchOptions matchOption) { m_TcpFlagsBitMask = tcpFlagBitMask; m_MatchOption = matchOption; }
 
        void parseToString(std::string& result);
    };
 
 
 
    class TcpWindowSizeFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_WindowSize;
    public:
        TcpWindowSizeFilter(uint16_t windowSize, FilterOperator op) : IFilterWithOperator(op), m_WindowSize(windowSize) {}
 
        void parseToString(std::string& result);
 
        void setWindowSize(uint16_t windowSize) { m_WindowSize = windowSize; }
    };
 
 
 
    class UdpLengthFilter : public IFilterWithOperator
    {
    private:
        uint16_t m_Length;
    public:
        UdpLengthFilter(uint16_t legnth, FilterOperator op) : IFilterWithOperator(op), m_Length(legnth) {}
 
        void parseToString(std::string& result);
 
        void setLength(uint16_t legnth) { m_Length = legnth; }
    };
 
} // namespace pcpp
 
#endif