From fa156424ea60c61afa0980d858d5b137ca2d8539 Mon Sep 17 00:00:00 2001 From: Dimitar Krastev Date: Thu, 2 Oct 2025 14:54:35 +0300 Subject: [PATCH 1/4] Deprecated matchPacketWithFilter in favor of the shorter `GenericFilter::matches`. --- Pcap++/header/PcapDevice.h | 3 +++ Pcap++/header/PcapFilter.h | 6 ++++++ Pcap++/src/PcapDevice.cpp | 8 +++++++- Pcap++/src/PcapFileDevice.cpp | 5 ++--- 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/Pcap++/header/PcapDevice.h b/Pcap++/header/PcapDevice.h index b29445041d..68d73eddf1 100644 --- a/Pcap++/header/PcapDevice.h +++ b/Pcap++/header/PcapDevice.h @@ -1,6 +1,7 @@ #pragma once #include "Device.h" +#include "DeprecationUtils.h" // forward declaration for the pcap descriptor defined in pcap.h struct pcap; @@ -159,6 +160,8 @@ namespace pcpp /// @param[in] filter A filter class to test against /// @param[in] rawPacket A pointer to the raw packet to match the filter with /// @return True if raw packet matches the filter or false otherwise + /// @deprecated This method is deprecated, use GeneralFilter::matches(...) method directly. + PCPP_DEPRECATED("Prefer GeneralFilter::matches(...) method directly.") static bool matchPacketWithFilter(GeneralFilter& filter, RawPacket* rawPacket); // implement abstract methods diff --git a/Pcap++/header/PcapFilter.h b/Pcap++/header/PcapFilter.h index caea80608c..7fffd57cd6 100644 --- a/Pcap++/header/PcapFilter.h +++ b/Pcap++/header/PcapFilter.h @@ -109,6 +109,8 @@ namespace pcpp /// @param[in] rawPacket A pointer to a raw packet which the filter will be matched against /// @return True if the filter matches (or if it's empty). False if the packet doesn't match or if the filter /// could not be compiled + /// @deprecated This method is deprecated, use matches(...) overload instead. + PCPP_DEPRECATED("Prefer matches(...) overload.") bool matchPacketWithFilter(const RawPacket* rawPacket) const; /// Match a packet data with the filter stored in this object. If the filter is empty the method returns "true". @@ -120,6 +122,8 @@ namespace pcpp /// @param[in] linkType The packet link type /// @return True if the filter matches (or if it's empty). False if the packet doesn't match or if the filter /// could not be compiled + /// @deprecated This method is deprecated, use matches(...) overload instead. + PCPP_DEPRECATED("Prefer matches(...) overload.") bool matchPacketWithFilter(const uint8_t* packetData, uint32_t packetDataLength, timespec packetTimestamp, uint16_t linkType) const; @@ -170,6 +174,8 @@ namespace pcpp /// Match a raw packet with a given BPF filter. /// @param[in] rawPacket A pointer to the raw packet to match the BPF filter with /// @return True if a raw packet matches the BPF filter or false otherwise + /// @deprecated This method is deprecated, use matches(...) overload instead. + PCPP_DEPRECATED("Prefer matches(...) overload.") bool matchPacketWithFilter(RawPacket* rawPacket) const; /// @brief Match a raw packet against the filter. diff --git a/Pcap++/src/PcapDevice.cpp b/Pcap++/src/PcapDevice.cpp index 98549052c1..616d76ce36 100644 --- a/Pcap++/src/PcapDevice.cpp +++ b/Pcap++/src/PcapDevice.cpp @@ -152,7 +152,13 @@ namespace pcpp bool IPcapDevice::matchPacketWithFilter(GeneralFilter& filter, RawPacket* rawPacket) { - return filter.matchPacketWithFilter(rawPacket); + if (rawPacket == nullptr) + { + PCPP_LOG_ERROR("Raw packet pointer is null"); + return false; + } + + return filter.matches(*rawPacket); } std::string IPcapDevice::getPcapLibVersionInfo() diff --git a/Pcap++/src/PcapFileDevice.cpp b/Pcap++/src/PcapFileDevice.cpp index fc312ba13b..213eb9e87f 100644 --- a/Pcap++/src/PcapFileDevice.cpp +++ b/Pcap++/src/PcapFileDevice.cpp @@ -580,8 +580,7 @@ namespace pcpp return false; } - while (!m_BpfWrapper.matchPacketWithFilter(pktData, pktHeader.captured_length, pktHeader.timestamp, - pktHeader.data_link)) + while (!m_BpfWrapper.matches(pktData, pktHeader.captured_length, pktHeader.timestamp, pktHeader.data_link)) { if (!light_get_next_packet(toLightPcapNgT(m_LightPcapNg), &pktHeader, &pktData)) { @@ -721,7 +720,7 @@ namespace pcpp return false; } - if (!m_BpfWrapper.matchPacketWithFilter(&packet)) + if (!m_BpfWrapper.matches(packet)) { return false; } From ad34c72b7fb45d70a8d0c313b4ac899897d3e412 Mon Sep 17 00:00:00 2001 From: Dimitar Krastev Date: Thu, 2 Oct 2025 15:09:50 +0300 Subject: [PATCH 2/4] Updated call sites to use matches instead of matchPacketWithFilter. --- Examples/IPDefragUtil/main.cpp | 2 +- Examples/IPFragUtil/main.cpp | 2 +- Examples/PcapSplitter/SimpleSplitters.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Examples/IPDefragUtil/main.cpp b/Examples/IPDefragUtil/main.cpp index 24930fe7ad..929ec5af39 100644 --- a/Examples/IPDefragUtil/main.cpp +++ b/Examples/IPDefragUtil/main.cpp @@ -125,7 +125,7 @@ void processPackets(pcpp::IFileReaderDevice* reader, pcpp::IFileWriterDevice* wr if (filterByBpf) { // check if packet matches the BPF filter supplied by the user - if (pcpp::IPcapDevice::matchPacketWithFilter(filter, &rawPacket)) + if (filter.matches(rawPacket)) { stats.ipPacketsMatchBpfFilter++; } diff --git a/Examples/IPFragUtil/main.cpp b/Examples/IPFragUtil/main.cpp index 93b09bd0ad..882c922310 100644 --- a/Examples/IPFragUtil/main.cpp +++ b/Examples/IPFragUtil/main.cpp @@ -258,7 +258,7 @@ void processPackets(pcpp::IFileReaderDevice* reader, pcpp::IFileWriterDevice* wr if (filterByBpf) { // check if packet matches the BPF filter supplied by the user - if (pcpp::IPcapDevice::matchPacketWithFilter(filter, &rawPacket)) + if (filter.matches(rawPacket)) { stats.ipPacketsMatchBpfFilter++; } diff --git a/Examples/PcapSplitter/SimpleSplitters.h b/Examples/PcapSplitter/SimpleSplitters.h index e05abcb575..4f2c11e170 100644 --- a/Examples/PcapSplitter/SimpleSplitters.h +++ b/Examples/PcapSplitter/SimpleSplitters.h @@ -131,7 +131,7 @@ class BpfCriteriaSplitter : public Splitter */ int getFileNumber(pcpp::Packet& packet, std::vector& filesToClose) { - if (pcpp::IPcapDevice::matchPacketWithFilter(filter, packet.getRawPacket())) + if (packet.getRawPacket() != nullptr && filter.matches(*packet.getRawPacket())) return 0; return 1; } From 5baa53ec395f4b5d2ecf704c2ed164ad99497ae2 Mon Sep 17 00:00:00 2001 From: Dimitar Krastev Date: Fri, 3 Oct 2025 10:34:37 +0300 Subject: [PATCH 3/4] Updated tests to use matches syntax. --- Tests/Pcap++Test/Tests/FilterTests.cpp | 36 +++++++++++++------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/Tests/Pcap++Test/Tests/FilterTests.cpp b/Tests/Pcap++Test/Tests/FilterTests.cpp index 5a28409e17..2c915c7f6c 100644 --- a/Tests/Pcap++Test/Tests/FilterTests.cpp +++ b/Tests/Pcap++Test/Tests/FilterTests.cpp @@ -225,12 +225,12 @@ PTF_TEST_CASE(TestPcapFilters_General_BPFStr) int validCounter = 0; - for (pcpp::RawPacketVector::VectorIterator iter = rawPacketVec.begin(); iter != rawPacketVec.end(); iter++) + for (auto* rawPacketPtr : rawPacketVec) { - if (bpfStringFilter.matchPacketWithFilter(*iter)) + if (bpfStringFilter.matches(*rawPacketPtr)) { ++validCounter; - pcpp::Packet packet(*iter); + pcpp::Packet packet(rawPacketPtr); pcpp::EthLayer* ethLayer = packet.getLayerOfType(); PTF_ASSERT_EQUAL(ethLayer->getDestMac(), macAddr); } @@ -250,13 +250,13 @@ PTF_TEST_CASE(TestPcapFilters_MatchStatic) fileReaderDev.close(); // Test empty BPFstring (the "ALL" filter) in combination with a "-" (example wrong filter) - for (pcpp::RawPacketVector::VectorIterator iter = rawPacketVec.begin(); iter != rawPacketVec.end(); iter++) + for (auto* rawPacketPtr : rawPacketVec) { pcpp::BPFStringFilter emptyFilter(""); - PTF_ASSERT_TRUE(emptyFilter.matchPacketWithFilter(*iter)); + PTF_ASSERT_TRUE(emptyFilter.matches(*rawPacketPtr)); pcpp::BPFStringFilter wrongFilter("-"); pcpp::Logger::getInstance().suppressLogs(); - PTF_ASSERT_FALSE(wrongFilter.matchPacketWithFilter(*iter)); + PTF_ASSERT_FALSE(wrongFilter.matches(*rawPacketPtr)); pcpp::Logger::getInstance().enableLogs(); } @@ -825,16 +825,16 @@ PTF_TEST_CASE(TestPcapFilters_LinkLayer) fileReaderDev1.close(); int validCounter = 0; - for (pcpp::RawPacketVector::VectorIterator iter = rawPacketVec.begin(); iter != rawPacketVec.end(); iter++) + for (auto* rawPacketPtr : rawPacketVec) { - pcpp::Packet packet(*iter); + pcpp::Packet packet(rawPacketPtr); if (pcpp::IPv4Layer* ip4layer = packet.getLayerOfType()) { pcpp::BPFStringFilter bpfStringFilter( "host " + ip4layer->getDstIPAddress().toString()); // checking against real filter, not the "" filter - if (bpfStringFilter.matchPacketWithFilter(*iter)) + if (bpfStringFilter.matches(*rawPacketPtr)) { - if ((*iter)->getLinkLayerType() == pcpp::LINKTYPE_DLT_RAW1) + if (rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_DLT_RAW1) { ++validCounter; } @@ -851,16 +851,16 @@ PTF_TEST_CASE(TestPcapFilters_LinkLayer) fileReaderDev2.close(); validCounter = 0; - for (pcpp::RawPacketVector::VectorIterator iter = rawPacketVec.begin(); iter != rawPacketVec.end(); iter++) + for (auto* rawPacketPtr : rawPacketVec) { - pcpp::Packet packet(*iter); + pcpp::Packet packet(rawPacketPtr); if (pcpp::IPv4Layer* ip4layer = packet.getLayerOfType()) { pcpp::BPFStringFilter bpfStringFilter( "host " + ip4layer->getDstIPAddress().toString()); // checking against real filter, not the "" filter - if (bpfStringFilter.matchPacketWithFilter(*iter)) + if (bpfStringFilter.matches(*rawPacketPtr)) { - if ((*iter)->getLinkLayerType() == pcpp::LINKTYPE_LINUX_SLL) + if (rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_LINUX_SLL) { ++validCounter; } @@ -877,16 +877,16 @@ PTF_TEST_CASE(TestPcapFilters_LinkLayer) fileReaderDev3.close(); validCounter = 0; - for (pcpp::RawPacketVector::VectorIterator iter = rawPacketVec.begin(); iter != rawPacketVec.end(); iter++) + for (auto* rawPacketPtr : rawPacketVec) { - pcpp::Packet packet(*iter); + pcpp::Packet packet(rawPacketPtr); if (pcpp::IPv4Layer* ip4layer = packet.getLayerOfType()) { pcpp::BPFStringFilter bpfStringFilter( "host " + ip4layer->getDstIPAddress().toString()); // checking against real filter, not the "" filter - if (bpfStringFilter.matchPacketWithFilter(*iter)) + if (bpfStringFilter.matches(*rawPacketPtr)) { - if ((*iter)->getLinkLayerType() == pcpp::LINKTYPE_ETHERNET) + if (rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_ETHERNET) { ++validCounter; } From c0313adc78d50a2f98933061f0ad1ce829a92ea8 Mon Sep 17 00:00:00 2001 From: Dimitar Krastev Date: Sun, 5 Oct 2025 15:29:32 +0300 Subject: [PATCH 4/4] Fixed comment. --- Tests/Pcap++Test/Tests/FilterTests.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Tests/Pcap++Test/Tests/FilterTests.cpp b/Tests/Pcap++Test/Tests/FilterTests.cpp index 2c915c7f6c..8c46a50003 100644 --- a/Tests/Pcap++Test/Tests/FilterTests.cpp +++ b/Tests/Pcap++Test/Tests/FilterTests.cpp @@ -815,7 +815,7 @@ PTF_TEST_CASE(TestPcapFiltersOffline) PTF_TEST_CASE(TestPcapFilters_LinkLayer) { - // check if matchPacketWithFilter work properly for packets with different LinkLayerType + // check if GeneralFilter::matches(...) work properly for packets with different LinkLayerType // pcpp::LINKTYPE_DLT_RAW1 layer pcpp::PcapFileReaderDevice fileReaderDev1(RAW_IP_PCAP_PATH);