Use file content heuristics to decide file reader.

.pre-commit-config.yaml

@@ -1,4 +1,4 @@
-exclude: '.*\.(pcap|pcapng|dat)|(PacketExamples|PcapExamples|expected_output|pcap_examples).*\.txt'
+exclude: '.*\.(pcap|pcapng|dat)|(PacketExamples|PcapExamples|expected_output|pcap_examples).*\.(txt|zst|zstd)'
 fail_fast: false
 repos:
   - repo: local

Pcap++/header/PcapFileDevice.h

@@ -124,7 +124,19 @@ namespace pcpp
 		/// it returns an instance of PcapFileReaderDevice
 		/// @param[in] fileName The file name to open
 		/// @return An instance of the reader to read the file. Notice you should free this instance when done using it
+		/// @deprecated Prefer `createReader` due to selection of reader based on file content instead of extension.
+		PCPP_DEPRECATED("Prefer `createReader` due to selection of reader based on file content instead of extension.")
 		static IFileReaderDevice* getReader(const std::string& fileName);
+
+		/// @brief Creates an instance of the reader best fit to read the file.
+		///
+		/// The factory function uses heuristics based on the file content to decide the reader.
+		/// If the file type is known at compile time, it is better to construct a concrete reader instance directly.
+		///
+		/// @param[in] fileName The path to the file to open.
+		/// @return A unique pointer to a reader instance or nullptr if the file is not supported.
+		/// @throws std::runtime_error If the file could not be opened.
+		static std::unique_ptr<IFileReaderDevice> createReader(const std::string& fileName);
 	};
 
 	/// @class IFileWriterDevice

Pcap++/src/PcapFileDevice.cpp

@@ -1,6 +1,8 @@
 #define LOG_MODULE PcapLogModuleFileDevice
 
 #include <cerrno>
+#include <array>
+#include <algorithm>
 #include "PcapFileDevice.h"
 #include "light_pcapng_ext.h"
 #include "Logger.h"
@@ -28,32 +30,189 @@ namespace pcpp
 		{
 			return reinterpret_cast<light_pcapng_t*>(pcapngHandle);
 		}
+
+		struct pcap_file_header
+		{
+			uint32_t magic;
+			uint16_t version_major;
+			uint16_t version_minor;
+			int32_t thiszone;
+			uint32_t sigfigs;
+			uint32_t snaplen;
+			uint32_t linktype;
+		};
+
+		struct packet_header
+		{
+			uint32_t tv_sec;
+			uint32_t tv_usec;
+			uint32_t caplen;
+			uint32_t len;
+		};
+
+		/// @brief Check if a stream is seekable.
+		/// @param stream The stream to check.
+		/// @return True if the stream supports seek operations, false otherwise.
+		bool isStreamSeekable(std::istream& stream)
+		{
+			auto pos = stream.tellg();
+			if (stream.fail())
+			{
+				stream.clear();
+				return false;
+			}
+
+			if (stream.seekg(pos).fail())
+			{
+				stream.clear();
+				return false;
+			}
+
+			return true;
+		}
+
+		class StreamPositionCheckpoint
+		{
+		public:
+			explicit StreamPositionCheckpoint(std::istream& stream)
+			    : m_Stream(stream), m_State(stream.rdstate()), m_Pos(stream.tellg())
+			{}
+
+			~StreamPositionCheckpoint()
+			{
+				m_Stream.seekg(m_Pos);
+				m_Stream.clear(m_State);
+			}
+
+		private:
+			std::istream& m_Stream;
+			std::ios_base::iostate m_State;
+			std::streampos m_Pos;
+		};
+
+		enum class CaptureFileFormat
+		{
+			Unknown,
+			Pcap,
+			PcapNG,
+			Snoop,
+		};
+
+		/// @brief Heuristic file format detector that scans the magic number of the file format header.
+		class CaptureFileFormatDetector
+		{
+		public:
+			/// @brief Checks a content stream for the magic number and determines the type.
+			/// @param content A content stream that contains the file content.
+			/// @return A CaptureFileFormat value with the detected content type.
+			CaptureFileFormat detectFormat(std::istream& content)
+			{
+				// Check if the stream supports seeking.
+				if (!isStreamSeekable(content))
+				{
+					throw std::runtime_error("Heuristic file format detection requires seekable stream");
+				}
+
+				if (isPcapFile(content))
+					return CaptureFileFormat::Pcap;
+
+				// PcapNG backend can support ZstdCompressed Pcap files, so we assume an archive is compressed PcapNG.
+				if (isPcapNgFile(content) || isZstdArchive(content))
+					return CaptureFileFormat::PcapNG;
+
+				if (isSnoopFile(content))
+					return CaptureFileFormat::Snoop;
+
+				return CaptureFileFormat::Unknown;
+			}
+
+		private:
+			bool isPcapFile(std::istream& content)
+			{
+				constexpr std::array<uint32_t, 4> pcapMagicNumbers = {
+					0xa1'b2'c3'd4,  // regular pcap, microsecond-precision
+					0xd4'c3'b2'a1,  // regular pcap, microsecond-precision (byte-swapped)
+					0xa1'b2'3c'4d,  // regular pcap, nanosecond-precision
+					0x4d'3c'b2'a1   // regular pcap, nanosecond-precision (byte-swapped)
+				};
+
+				StreamPositionCheckpoint checkpoint(content);
+
+				pcap_file_header header;
+				content.read(reinterpret_cast<char*>(&header), sizeof(header));
+				if (content.gcount() != sizeof(header))
+				{
+					return false;
+				}
+
+				return std::find(pcapMagicNumbers.begin(), pcapMagicNumbers.end(), header.magic) !=
+				       pcapMagicNumbers.end();
+			}
+
+			bool isPcapNgFile(std::istream& content)
+			{
+				constexpr std::array<uint32_t, 1> pcapMagicNumbers = {
+					0x0A'0D'0D'0A,  // pcapng magic number (palindrome)
+				};
+
+				StreamPositionCheckpoint checkpoint(content);
+
+				uint32_t magic = 0;
+				content.read(reinterpret_cast<char*>(&magic), sizeof(magic));
+				if (content.gcount() != sizeof(magic))
+				{
+					return false;
+				}
+
+				return std::find(pcapMagicNumbers.begin(), pcapMagicNumbers.end(), magic) != pcapMagicNumbers.end();
+			}
+
+			bool isSnoopFile(std::istream& content)
+			{
+				constexpr std::array<uint64_t, 2> snoopMagicNumbers = {
+					0x73'6E'6F'6F'70'00'00'00,  // snoop magic number, "snoop" in ASCII
+					0x00'00'00'70'6F'6F'6E'73   // snoop magic number, "snoop" in ASCII (byte-swapped)
+				};
+
+				StreamPositionCheckpoint checkpoint(content);
+
+				uint64_t magic = 0;
+				content.read(reinterpret_cast<char*>(&magic), sizeof(magic));
+				if (content.gcount() != sizeof(magic))
+				{
+					return false;
+				}
+
+				return std::find(snoopMagicNumbers.begin(), snoopMagicNumbers.end(), magic) != snoopMagicNumbers.end();
+			}
+
+			bool isZstdArchive(std::istream& content)
+			{
+				constexpr std::array<uint32_t, 2> zstdMagicNumbers = {
+					0x28'B5'2F'FD,  // zstd archive magic number
+					0xFD'2F'B5'28,  // zstd archive magic number (byte-swapped)
+				};
+
+				StreamPositionCheckpoint checkpoint(content);
+
+				uint32_t magic = 0;
+				content.read(reinterpret_cast<char*>(&magic), sizeof(magic));
+				if (content.gcount() != sizeof(magic))
+				{
+					return false;
+				}
+
+				return std::find(zstdMagicNumbers.begin(), zstdMagicNumbers.end(), magic) != zstdMagicNumbers.end();
+			}
+		};
+
 	}  // namespace
 
 	template <typename T, size_t N> constexpr size_t ARRAY_SIZE(T (&)[N])
 	{
 		return N;
 	}
 
-	struct pcap_file_header
-	{
-		uint32_t magic;
-		uint16_t version_major;
-		uint16_t version_minor;
-		int32_t thiszone;
-		uint32_t sigfigs;
-		uint32_t snaplen;
-		uint32_t linktype;
-	};
-
-	struct packet_header
-	{
-		uint32_t tv_sec;
-		uint32_t tv_usec;
-		uint32_t caplen;
-		uint32_t len;
-	};
-
 	static bool checkNanoSupport()
 	{
 #if defined(PCAP_TSTAMP_PRECISION_NANO)
@@ -130,6 +289,27 @@ namespace pcpp
 		return new PcapFileReaderDevice(fileName);
 	}
 
+	std::unique_ptr<IFileReaderDevice> IFileReaderDevice::createReader(const std::string& fileName)
+	{
+		std::ifstream fileContent(fileName, std::ios_base::binary);
+		if (fileContent.fail())
+		{
+			throw std::runtime_error("Could not open: " + fileName);
+		}
+
+		switch (CaptureFileFormatDetector().detectFormat(fileContent))
+		{
+		case CaptureFileFormat::Pcap:
+			return std::make_unique<PcapFileReaderDevice>(fileName);
+		case CaptureFileFormat::PcapNG:
+			return std::make_unique<PcapNgFileReaderDevice>(fileName);
+		case CaptureFileFormat::Snoop:
+			return std::make_unique<SnoopFileReaderDevice>(fileName);
+		default:
+			return nullptr;
+		}
+	}
+
 	uint64_t IFileReaderDevice::getFileSize() const
 	{
 		std::ifstream fileStream(m_FileName.c_str(), std::ifstream::ate | std::ifstream::binary);

Tests/Pcap++Test/PcapExamples/file_heuristics/bogus-content.pcap

@@ -0,0 +1 @@
+4561d5a474d6as465d8as41d1as6531863d1as65d1a36d1

Tests/Pcap++Test/PcapExamples/file_heuristics/bogus-content.pcapng

@@ -0,0 +1 @@
+4561d5a474d6as465d8as41d1as6531863d1as65d1a36d1

Tests/Pcap++Test/PcapExamples/file_heuristics/bogus-content.txt

@@ -0,0 +1 @@
+4561d5a474d6as465d8as41d1as6531863d1as65d1a36d1

Tests/Pcap++Test/PcapExamples/file_heuristics/bogus-content.zst

@@ -0,0 +1 @@
+4561d5a474d6as465d8as41d1as6531863d1as65d1a36d1

Tests/Pcap++Test/TestDefinition.h

@@ -20,6 +20,7 @@ PTF_TEST_CASE(TestLogger);
 PTF_TEST_CASE(TestLoggerMultiThread);
 
 // Implemented in FileTests.cpp
+PTF_TEST_CASE(TestIFileReaderDeviceFactory);
 PTF_TEST_CASE(TestPcapFileReadWrite);
 PTF_TEST_CASE(TestPcapFilePrecision);
 PTF_TEST_CASE(TestPcapSllFileReadWrite);

Tests/Pcap++Test/Tests/FileTests.cpp

@@ -26,6 +26,74 @@ class FileReaderTeardown
 	}
 };
 
+PTF_TEST_CASE(TestIFileReaderDeviceFactory)
+{
+	// These files are correctly formatted and with correct extensions
+	constexpr const char* PCAP_NANOSEC_FILE_PATH = "PcapExamples/file_heuristics/nanosecs.pcap";
+	constexpr const char* PCAP_MICROSEC_FILE_PATH = "PcapExamples/file_heuristics/microsecs.pcap";
+	constexpr const char* PCAPNG_FILE_PATH = "PcapExamples/file_heuristics/pcapng-example.pcapng";
+	constexpr const char* PCAPNG_ZST_FILE_PATH = "PcapExamples/file_heuristics/pcapng-example.pcapng.zst";
+	constexpr const char* PCAPNG_ZSTD_FILE_PATH = "PcapExamples/file_heuristics/pcapng-example.pcapng.zstd";
+	// TODO: add snoop file
+
+	// These files are correctly formatted but with wrong extensions
+	constexpr const char* PCAPNG_AS_PCAP_FILE_PATH = "PcapExamples/file_heuristics/pcapng-with-pcap-ext.pcapng.pcap";
+	constexpr const char* PCAP_AS_DAT_FILE_PATH = "PcapExamples/file_heuristics/pcap-with-dat-ext.pcap.dat";
+
+	// These files have a correct extension but are actually garbage data.
+	constexpr const char* PCAP_BOGUS_FILE_PATH = "PcapExamples/file_heuristics/bogus-content.pcap";
+	constexpr const char* PCAPNG_BOGUS_FILE_PATH = "PcapExamples/file_heuristics/bogus-content.pcapng";
+	constexpr const char* PCAPNG_ZST_BOGUS_FILE_PATH = "PcapExamples/file_heuristics/bogus-content.zst";
+
+	// This file has a wrong extension and is actually garbage data.
+	constexpr const char* BOGUS_FILE_PATH = "PcapExamples/file_heuristics/bogus-content.txt";
+
+	// Test non-existent file
+	PTF_ASSERT_RAISES(pcpp::IFileReaderDevice::createReader("BogusFile"), std::runtime_error,
+	                  "Could not open: BogusFile");
+
+	std::unique_ptr<pcpp::IFileReaderDevice> dev;
+
+	// Test existent files with correct format and extension
+	for (const auto& filePath : { PCAP_NANOSEC_FILE_PATH, PCAP_MICROSEC_FILE_PATH })
+	{
+		dev = pcpp::IFileReaderDevice::createReader(filePath);
+		PTF_ASSERT_NOT_NULL(dev);
+		PTF_ASSERT_NOT_NULL(dynamic_cast<pcpp::PcapFileReaderDevice*>(dev.get()));
+		PTF_ASSERT_TRUE(dev->open());
+	}
+
+	for (const auto& filePath : { PCAPNG_FILE_PATH, PCAPNG_ZST_FILE_PATH, PCAPNG_ZSTD_FILE_PATH })
+	{
+		dev = pcpp::IFileReaderDevice::createReader(filePath);
+		PTF_ASSERT_NOT_NULL(dev);
+		PTF_ASSERT_NOT_NULL(dynamic_cast<pcpp::PcapNgFileReaderDevice*>(dev.get()));
+		PTF_ASSERT_TRUE(dev->open());
+	}
+
+	// Test existent files with correct format but wrong extension
+	dev = pcpp::IFileReaderDevice::createReader(PCAPNG_AS_PCAP_FILE_PATH);
+	PTF_ASSERT_NOT_NULL(dev);
+	PTF_ASSERT_NOT_NULL(dynamic_cast<pcpp::PcapNgFileReaderDevice*>(dev.get()));
+	PTF_ASSERT_TRUE(dev->open());
+
+	dev = pcpp::IFileReaderDevice::createReader(PCAP_AS_DAT_FILE_PATH);
+	PTF_ASSERT_NOT_NULL(dev);
+	PTF_ASSERT_NOT_NULL(dynamic_cast<pcpp::PcapFileReaderDevice*>(dev.get()));
+	PTF_ASSERT_TRUE(dev->open());
+
+	// Test existent files with correct extension but bogus content
+	for (const auto& filePath : { PCAP_BOGUS_FILE_PATH, PCAPNG_BOGUS_FILE_PATH, PCAPNG_ZST_BOGUS_FILE_PATH })
+	{
+		dev = pcpp::IFileReaderDevice::createReader(filePath);
+		PTF_ASSERT_NULL(dev);
+	}
+
+	// Test existent file with wrong extension and bogus content
+	dev = pcpp::IFileReaderDevice::createReader(BOGUS_FILE_PATH);
+	PTF_ASSERT_NULL(dev);
+}
+
 PTF_TEST_CASE(TestPcapFileReadWrite)
 {
 	pcpp::PcapFileReaderDevice readerDev(EXAMPLE_PCAP_PATH);
@@ -754,7 +822,7 @@ PTF_TEST_CASE(TestPcapNgFileReadWriteAdv)
 
 	PTF_ASSERT_EQUAL(packetCount, 161);
 
-	// -------
+	// ------- IFileReaderDevice::getReader() Factory
 
 	// copy the .zstd file to a similar file with .zst extension
 	std::ifstream zstdFile(EXAMPLE2_PCAPNG_ZSTD_WRITE_PATH, std::ios::binary);

Tests/Pcap++Test/main.cpp

@@ -215,6 +215,7 @@ int main(int argc, char* argv[])
 	PTF_RUN_TEST(TestLogger, "no_network;logger");
 	PTF_RUN_TEST(TestLoggerMultiThread, "no_network;logger;skip_mem_leak_check");
 
+	PTF_RUN_TEST(TestIFileReaderDeviceFactory, "no_network;pcap;pcapng;snoop");
 	PTF_RUN_TEST(TestPcapFileReadWrite, "no_network;pcap");
 	PTF_RUN_TEST(TestPcapFilePrecision, "no_network;pcap");
 	PTF_RUN_TEST(TestPcapSllFileReadWrite, "no_network;pcap");