pcapreader.h

Go to the documentation of this file.

 
#pragma once
 
 
#include <promeki/config.h>
#if PROMEKI_ENABLE_NETWORK
#include <cstdint>
#include <promeki/namespace.h>
#include <promeki/buffer.h>
#include <promeki/bufferview.h>
#include <promeki/datetime.h>
#include <promeki/enums_pcap.h>
#include <promeki/error.h>
#include <promeki/list.h>
#include <promeki/result.h>
#include <promeki/string.h>
 
PROMEKI_NAMESPACE_BEGIN
 
class IODevice;
 
struct PcapRecord {
                DateTime captureTime;
 
                PcapLinkType linkType;
 
                BufferView frame;
 
                uint32_t originalLength = 0;
 
                bool snapTruncated = false;
 
                size_t capturedLength() const { return frame.size(); }
};
 
class PcapReader {
        public:
                static constexpr size_t MaxRecordLength = 256u * 1024u * 1024u;
 
                static constexpr uint32_t MagicMicros = 0xa1b2c3d4u;
 
                static constexpr uint32_t MagicNanos = 0xa1b23c4du;
 
                static constexpr uint32_t PngBlockShb = 0x0a0d0d0au;
                static constexpr uint32_t PngByteOrderMagic = 0x1a2b3c4du;
                static constexpr uint32_t PngBlockIdb = 0x00000001u; 
                static constexpr uint32_t PngBlockSpb = 0x00000003u; 
                static constexpr uint32_t PngBlockEpb = 0x00000006u; 
 
                PcapReader() = default;
 
                Error open(IODevice &device);
 
                Error openFile(const String &path);
 
                Error openBuffer(const Buffer &buf);
 
                bool isOpen() const { return _format != PcapFileFormat::Unknown; }
 
                PcapFileFormat format() const { return _format; }
 
                PcapByteOrder byteOrder() const { return _byteOrder; }
 
                PcapLinkType linkType() const;
 
                uint32_t snapLength() const;
 
                size_t interfaceCount() const { return _interfaces.size(); }
 
                Result<PcapRecord> next();
 
                void close();
 
        private:
                struct Interface {
                                PcapLinkType linkType = PcapLinkType::Ethernet;
                                uint32_t snapLength = 0;
                                uint8_t tsResolCode = 6;
                };
 
                Error parseHeader();
                Error parseClassicHeader();
                Error parsePcapngFirstSection();
                Result<PcapRecord> nextClassic();
                Result<PcapRecord> nextPcapng();
                Error consumePcapngIdb(size_t bodyOff, size_t bodyLen);
 
                Buffer _backing;                  
                size_t _pos = 0;                  
                size_t _size = 0;                 
                PcapFileFormat _format = PcapFileFormat::Unknown;
                PcapByteOrder _byteOrder = PcapByteOrder::Unknown;
                bool _be = false;                 
                bool _nanoTs = false;             
                uint32_t _snaplen = 0;            
                PcapLinkType _classicLink = PcapLinkType::Ethernet;
                List<Interface> _interfaces;      
};
 
PROMEKI_NAMESPACE_END
 
#endif // PROMEKI_ENABLE_NETWORK