LittleShark/PCAPFileReader.cpp at master · ES-Six/LittleShark · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#include "PCAPFileReader.h"

#include <iostream>


namespace MyLibPCAP
{
    MyLibPCAP::PCAPFileReader::PCAPFileReader(const std::string &file_path)
    {
        in_stream = new std::ifstream(file_path, std::ifstream::binary);

        if (!in_stream->is_open()) {
            return;
        }
        in_stream->read((char *)&this->pcap_header, sizeof(MyLibPCAP::pcap_file_header));

        if (in_stream->gcount() < sizeof(MyLibPCAP::pcap_file_header)) {
            std::cout << "Error : truncated file" << std::endl;
            return;
        }
    }

    MyLibPCAP::PCAPFileReader::~PCAPFileReader() {
        if (in_stream->is_open()) {
            in_stream->close();
            delete in_stream;
        }
    }

    MyLibPCAP::pcap_endianess MyLibPCAP::PCAPFileReader::getFileEndianess() {
        switch (this->pcap_header.magic) {
            case 0xA1B2C3D4:
                return MyLibPCAP::pcap_endianess::IS_IDENTICAL;
            case 0xD4C3B2A1:
                return MyLibPCAP::pcap_endianess::IS_SWAPPED;
            default:
                return MyLibPCAP::pcap_endianess::IS_UNKNOWN;
        }
    }

    MyLibPCAP::pcap_file_header *MyLibPCAP::PCAPFileReader::getPCAPFileHeader() {
        return &this->pcap_header;
    }

    bool MyLibPCAP::PCAPFileReader::hasNextPacket() {
        if (!in_stream->is_open()) {
            this->nextPacket = nullptr;
            return false;
        }

        auto pkthdr = new MyLibPCAP::pcap_pkthdr();

        in_stream->read((char *)pkthdr, sizeof(MyLibPCAP::pcap_pkthdr));

        if (in_stream->gcount() < sizeof(MyLibPCAP::pcap_pkthdr)) {
            if (!in_stream->eof()) {
                std::cerr << "Error : truncated file" << std::endl;
            }
            delete pkthdr;
            this->nextPacket = nullptr;
            return false;
        }
        if (this->pcap_header.snaplen < pkthdr->caplen) {
            std::cerr << "Error: uncompatible file detected" << std::endl;
            delete pkthdr;
            this->nextPacket = nullptr;
            return false;
        }

        auto pktcontent = new char[pkthdr->caplen];

        in_stream->read(pktcontent, pkthdr->caplen);

        if (in_stream->gcount() < pkthdr->caplen) {
            std::cerr << "Error : truncated file" << std::endl;
            delete pkthdr;
            delete[] pktcontent;
            this->nextPacket = nullptr;
            return false;
        }

        this->nextPacket = new PacketWrapper();
        this->nextPacket->setPacketHeader(pkthdr);
        this->nextPacket->setPacketContent(reinterpret_cast<unsigned char *>(pktcontent));
        return this->nextPacket;
    }

    MyLibPCAP::PacketWrapper *MyLibPCAP::PCAPFileReader::getNextPacket() const {
        return this->nextPacket;
    }
}