Coverage Report

Created: 2026-02-14 06:19

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/PcapPlusPlus/Packet++/header/RawPacket.h
Line
Count
Source
1
#pragma once
2
3
#include <stdint.h>
4
#ifdef _MSC_VER
5
# include <winsock2.h>
6
# include <time.h>
7
#else
8
# include <sys/time.h>
9
#endif
10
#include <stddef.h>
11
12
#include "DeprecationUtils.h"
13
14
/// @file
15
16
/// @namespace pcpp
17
/// @brief The main namespace for the PcapPlusPlus lib
18
namespace pcpp
19
{
20
  /// An enum describing all known link layer type. Taken from: http://www.tcpdump.org/linktypes.html .
21
  enum LinkLayerType
22
  {
23
    /// BSD loopback encapsulation
24
    LINKTYPE_NULL = 0,
25
    /// IEEE 802.3 Ethernet
26
    LINKTYPE_ETHERNET = 1,
27
    /// AX.25 packet
28
    LINKTYPE_AX25 = 3,
29
    /// IEEE 802.5 Token Ring
30
    LINKTYPE_IEEE802_5 = 6,
31
    /// ARCNET Data Packets
32
    LINKTYPE_ARCNET_BSD = 7,
33
    /// SLIP, encapsulated with a LINKTYPE_SLIP header
34
    LINKTYPE_SLIP = 8,
35
    /// PPP, as per RFC 1661 and RFC 1662
36
    LINKTYPE_PPP = 9,
37
    /// FDDI, as specified by ANSI INCITS 239-1994
38
    LINKTYPE_FDDI = 10,
39
    /// Raw IP
40
    LINKTYPE_DLT_RAW1 = 12,
41
    /// Raw IP (OpenBSD)
42
    LINKTYPE_DLT_RAW2 = 14,
43
    /// PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547
44
    LINKTYPE_PPP_HDLC = 50,
45
    /// PPPoE
46
    LINKTYPE_PPP_ETHER = 51,
47
    /// RFC 1483 LLC/SNAP-encapsulated ATM
48
    LINKTYPE_ATM_RFC1483 = 100,
49
    /// Raw IP
50
    LINKTYPE_RAW = 101,
51
    /// Cisco PPP with HDLC framing
52
    LINKTYPE_C_HDLC = 104,
53
    /// IEEE 802.11 wireless LAN
54
    LINKTYPE_IEEE802_11 = 105,
55
    /// Frame Relay
56
    LINKTYPE_FRELAY = 107,
57
    /// OpenBSD loopback encapsulation
58
    LINKTYPE_LOOP = 108,
59
    /// Linux "cooked" capture encapsulation
60
    LINKTYPE_LINUX_SLL = 113,
61
    /// Apple LocalTalk
62
    LINKTYPE_LTALK = 114,
63
    /// OpenBSD pflog
64
    LINKTYPE_PFLOG = 117,
65
    /// Prism monitor mode information followed by an 802.11 header
66
    LINKTYPE_IEEE802_11_PRISM = 119,
67
    /// RFC 2625 IP-over-Fibre Channel
68
    LINKTYPE_IP_OVER_FC = 122,
69
    /// ATM traffic, encapsulated as per the scheme used by SunATM devices
70
    LINKTYPE_SUNATM = 123,
71
    /// Radiotap link-layer information followed by an 802.11 header
72
    LINKTYPE_IEEE802_11_RADIOTAP = 127,
73
    /// ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999
74
    LINKTYPE_ARCNET_LINUX = 129,
75
    /// Apple IP-over-IEEE 1394 cooked header
76
    LINKTYPE_APPLE_IP_OVER_IEEE1394 = 138,
77
    /// Signaling System 7 Message Transfer Part Level 2
78
    LINKTYPE_MTP2_WITH_PHDR = 139,
79
    /// Signaling System 7 Message Transfer Part Level 2
80
    LINKTYPE_MTP2 = 140,
81
    /// Signaling System 7 Message Transfer Part Level 3
82
    LINKTYPE_MTP3 = 141,
83
    /// Signaling System 7 Signalling Connection Control Part
84
    LINKTYPE_SCCP = 142,
85
    /// Signaling System 7 Signalling Connection Control Part
86
    LINKTYPE_DOCSIS = 143,
87
    /// Linux-IrDA packets
88
    LINKTYPE_LINUX_IRDA = 144,
89
    /// Reserved for private use
90
    LINKTYPE_USER0 = 147,
91
    /// Reserved for private use
92
    LINKTYPE_USER1 = 148,
93
    /// Reserved for private use
94
    LINKTYPE_USER2 = 149,
95
    /// Reserved for private use
96
    LINKTYPE_USER3 = 150,
97
    /// Reserved for private use
98
    LINKTYPE_USER4 = 151,
99
    /// Reserved for private use
100
    LINKTYPE_USER5 = 152,
101
    /// Reserved for private use
102
    LINKTYPE_USER6 = 153,
103
    /// Reserved for private use
104
    LINKTYPE_USER7 = 154,
105
    /// Reserved for private use
106
    LINKTYPE_USER8 = 155,
107
    /// Reserved for private use
108
    LINKTYPE_USER9 = 156,
109
    /// Reserved for private use
110
    LINKTYPE_USER10 = 157,
111
    /// Reserved for private use
112
    LINKTYPE_USER11 = 158,
113
    /// Reserved for private use
114
    LINKTYPE_USER12 = 159,
115
    /// Reserved for private use
116
    LINKTYPE_USER13 = 160,
117
    /// Reserved for private use
118
    LINKTYPE_USER14 = 161,
119
    /// Reserved for private use
120
    LINKTYPE_USER15 = 162,
121
    /// AVS monitor mode information followed by an 802.11 header
122
    LINKTYPE_IEEE802_11_AVS = 163,
123
    /// BACnet MS/TP frames
124
    LINKTYPE_BACNET_MS_TP = 165,
125
    /// PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC, but with the 0xff address byte replaced by a
126
    /// direction indication - 0x00 for incoming and 0x01 for outgoing
127
    LINKTYPE_PPP_PPPD = 166,
128
    /// General Packet Radio Service Logical Link Control
129
    LINKTYPE_GPRS_LLC = 169,
130
    /// Transparent-mapped generic framing procedure
131
    LINKTYPE_GPF_T = 170,
132
    /// Frame-mapped generic framing procedure
133
    LINKTYPE_GPF_F = 171,
134
    /// Link Access Procedures on the D Channel (LAPD) frames
135
    LINKTYPE_LINUX_LAPD = 177,
136
    /// Bluetooth HCI UART transport layer
137
    LINKTYPE_BLUETOOTH_HCI_H4 = 187,
138
    /// USB packets, beginning with a Linux USB header
139
    LINKTYPE_USB_LINUX = 189,
140
    /// Per-Packet Information information
141
    LINKTYPE_PPI = 192,
142
    /// IEEE 802.15.4 wireless Personal Area Network
143
    LINKTYPE_IEEE802_15_4 = 195,
144
    /// Various link-layer types, with a pseudo-header, for SITA
145
    LINKTYPE_SITA = 196,
146
    /// Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF record
147
    LINKTYPE_ERF = 197,
148
    /// Bluetooth HCI UART transport layer
149
    LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR = 201,
150
    /// AX.25 packet, with a 1-byte KISS header containing a type indicator
151
    LINKTYPE_AX25_KISS = 202,
152
    /// Link Access Procedures on the D Channel (LAPD) frames
153
    LINKTYPE_LAPD = 203,
154
    /// PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero value meaning
155
    /// "received by this host" and a non-zero value meaning  "sent by this host"
156
    LINKTYPE_PPP_WITH_DIR = 204,
157
    /// Cisco PPP with HDLC framing
158
    LINKTYPE_C_HDLC_WITH_DIR = 205,
159
    /// Frame Relay
160
    LINKTYPE_FRELAY_WITH_DIR = 206,
161
    /// IPMB over an I2C circuit
162
    LINKTYPE_IPMB_LINUX = 209,
163
    /// IEEE 802.15.4 wireless Personal Area Network
164
    LINKTYPE_IEEE802_15_4_NONASK_PHY = 215,
165
    /// USB packets, beginning with a Linux USB header
166
    LINKTYPE_USB_LINUX_MMAPPED = 220,
167
    /// Fibre Channel FC-2 frames, beginning with a Frame_Header
168
    LINKTYPE_FC_2 = 224,
169
    /// Fibre Channel FC-2 frames
170
    LINKTYPE_FC_2_WITH_FRAME_DELIMS = 225,
171
    /// Solaris ipnet pseudo-header
172
    LINKTYPE_IPNET = 226,
173
    /// CAN (Controller Area Network) frames, with a pseudo-header as supplied by Linux SocketCAN
174
    LINKTYPE_CAN_SOCKETCAN = 227,
175
    /// Raw IPv4; the packet begins with an IPv4 header
176
    LINKTYPE_IPV4 = 228,
177
    /// Raw IPv6; the packet begins with an IPv6 header
178
    LINKTYPE_IPV6 = 229,
179
    /// IEEE 802.15.4 wireless Personal Area Network, without the FCS at the end of the frame
180
    LINKTYPE_IEEE802_15_4_NOFCS = 230,
181
    /// Raw D-Bus messages, starting with the endianness flag, followed by the message type, etc., but without the
182
    /// authentication handshake before the message sequence
183
    LINKTYPE_DBUS = 231,
184
    /// DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver), with the
185
    /// message format specified by the PCAP format for DVB-CI specification
186
    LINKTYPE_DVB_CI = 235,
187
    /// Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but not the same as, 27.010)
188
    LINKTYPE_MUX27010 = 236,
189
    /// D_PDUs as described by NATO standard STANAG 5066, starting with the synchronization sequence, and including
190
    /// both header and data CRCs
191
    LINKTYPE_STANAG_5066_D_PDU = 237,
192
    /// Linux netlink NETLINK NFLOG socket log messages
193
    LINKTYPE_NFLOG = 239,
194
    /// Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an
195
    /// Ethernet frame, beginning with the MAC header and ending with the FCS
196
    LINKTYPE_NETANALYZER = 240,
197
    /// Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an
198
    /// Ethernet frame, beginning with the preamble, SFD, and MAC header, and ending with the FCS
199
    LINKTYPE_NETANALYZER_TRANSPARENT = 241,
200
    /// IP-over-InfiniBand, as specified by RFC 4391 section 6
201
    LINKTYPE_IPOIB = 242,
202
    /// MPEG-2 Transport Stream transport packets, as specified by ISO 13818-1/ITU-T Recommendation H.222.0
203
    LINKTYPE_MPEG_2_TS = 243,
204
    /// Pseudo-header for ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40
205
    /// protocol tester
206
    LINKTYPE_NG40 = 244,
207
    /// Pseudo-header for NFC LLCP packet captures, followed by frame data for the LLCP Protocol as specified by
208
    /// NFCForum-TS-LLCP_1.1
209
    LINKTYPE_NFC_LLCP = 245,
210
    /// Raw InfiniBand frames, starting with the Local Routing Header
211
    LINKTYPE_INFINIBAND = 247,
212
    /// SCTP packets, as defined by RFC 4960, with no lower-level protocols such as IPv4 or IPv6
213
    LINKTYPE_SCTP = 248,
214
    /// USB packets, beginning with a USBPcap header
215
    LINKTYPE_USBPCAP = 249,
216
    /// Serial-line packet header for the Schweitzer Engineering Laboratories "RTAC" product
217
    LINKTYPE_RTAC_SERIAL = 250,
218
    /// Bluetooth Low Energy air interface Link Layer packets
219
    LINKTYPE_BLUETOOTH_LE_LL = 251,
220
    /// Linux Netlink capture encapsulation
221
    LINKTYPE_NETLINK = 253,
222
    /// Bluetooth Linux Monitor encapsulation of traffic for the BlueZ stack
223
    LINKTYPE_BLUETOOTH_LINUX_MONITOR = 254,
224
    /// Bluetooth Basic Rate and Enhanced Data Rate baseband packets
225
    LINKTYPE_BLUETOOTH_BREDR_BB = 255,
226
    /// Bluetooth Low Energy link-layer packets
227
    LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR = 256,
228
    /// PROFIBUS data link layer packets, as specified by IEC standard 61158-6-3
229
    LINKTYPE_PROFIBUS_DL = 257,
230
    /// Apple PKTAP capture encapsulation
231
    LINKTYPE_PKTAP = 258,
232
    /// Ethernet-over-passive-optical-network packets
233
    LINKTYPE_EPON = 259,
234
    /// IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" in the PICMG HPM.2 specification
235
    LINKTYPE_IPMI_HPM_2 = 260,
236
    /// Per Joshua Wright <jwright@hasborg.com>, formats for Z-Wave RF profiles R1 and R2 captures
237
    LINKTYPE_ZWAVE_R1_R2 = 261,
238
    /// Per Joshua Wright <jwright@hasborg.com>, formats for Z-Wave RF profile R3 captures
239
    LINKTYPE_ZWAVE_R3 = 262,
240
    /// Formats for WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol common packet
241
    /// structure captures
242
    LINKTYPE_WATTSTOPPER_DLM = 263,
243
    /// Messages between ISO 14443 contactless smartcards (Proximity Integrated Circuit Card, PICC) and card readers
244
    /// (Proximity Coupling Device, PCD), with the message format specified by the PCAP format for ISO14443
245
    /// specification
246
    LINKTYPE_ISO_14443 = 264,
247
    /// Linux "cooked" capture encapsulation v2
248
    LINKTYPE_LINUX_SLL2 = 276,
249
    /// Set if interface ID for a packet of a pcapng file is too high
250
    LINKTYPE_INVALID = 0xFFFF
251
  };
252
253
  /// Max packet size supported
254
0
#define PCPP_MAX_PACKET_SIZE 65536
255
256
  /// @class RawPacket
257
  /// This class holds the packet as raw (not parsed) data. The data is held as byte array. In addition to the data
258
  /// itself every instance also holds a timestamp representing the time the packet was received by the NIC. RawPacket
259
  /// instance isn't read only. The user can change the packet data, add or remove data, etc.
260
  class RawPacket
261
  {
262
  protected:
263
    uint8_t* m_RawData = nullptr;
264
    int m_RawDataLen = 0;
265
    int m_FrameLength = 0;
266
    timespec m_TimeStamp{};  // Zero initialized
267
    bool m_OwnsRawData = false;
268
    bool m_RawPacketSet = false;
269
    LinkLayerType m_LinkLayerType = LinkLayerType::LINKTYPE_ETHERNET;
270
271
    void copyDataFrom(const RawPacket& other, bool allocateData = true);
272
273
  public:
274
    /// A default constructor that initializes class'es attributes to default value:
275
    /// - data pointer is set to nullptr
276
    /// - data length is set to 0
277
    /// - frame length is set to 0
278
    /// - takeOwnership is set to 'false'
279
    /// - timestamp is set to 0
280
    /// - layer type is set to Ethernet
281
13.5k
    RawPacket() = default;
282
283
    /// A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually
284
    /// used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.).
285
    /// The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has
286
    /// arrived to the device
287
    /// @param[in] pRawData A pointer to the raw data
288
    /// @param[in] rawDataLen The raw data length in bytes
289
    /// @param[in] timestamp The timestamp packet was received by the NIC (in usec precision)
290
    /// @param[in] takeOwnership If 'true' the RawPacket will take ownership of the pRawData pointer and will
291
    /// free it when the RawPacket instance is destroyed or the buffer is replaced.
292
    /// @param[in] layerType The link layer type of this raw packet. The default is Ethernet
293
    RawPacket(const uint8_t* pRawData, int rawDataLen, timeval timestamp, bool takeOwnership,
294
              LinkLayerType layerType = LINKTYPE_ETHERNET);
295
296
    /// A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually
297
    /// used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.).
298
    /// The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has
299
    /// arrived to the device
300
    /// @param[in] pRawData A pointer to the raw data
301
    /// @param[in] rawDataLen The raw data length in bytes
302
    /// @param[in] timestamp The timestamp packet was received by the NIC (in nsec precision)
303
    /// @param[in] takeOwnership If 'true' the RawPacket will take ownership of the pRawData pointer and will
304
    /// free it when the RawPacket instance is destroyed or the buffer is replaced.
305
    /// @param[in] layerType The link layer type of this raw packet. The default is Ethernet
306
    RawPacket(const uint8_t* pRawData, int rawDataLen, timespec timestamp, bool takeOwnership,
307
              LinkLayerType layerType = LINKTYPE_ETHERNET);
308
309
    /// A destructor for this class. Frees the raw data if takeOwnership was set to 'true'
310
    virtual ~RawPacket();
311
312
    /// A copy constructor that copies all data from another instance. Notice all raw data is copied (using memcpy),
313
    /// so when the original or the other instance are freed, the other won't be affected
314
    /// @param[in] other The instance to copy from
315
    RawPacket(const RawPacket& other);
316
317
    /// Assignment operator overload for this class. When using this operator on an already initialized RawPacket
318
    /// instance, the original raw data is freed first if takeOwnership was set to 'true'.
319
    /// Then the other instance is copied to this instance, the same way the copy constructor works
320
    /// @param[in] other The instance to copy from
321
    RawPacket& operator=(const RawPacket& other);
322
323
    /// @brief Clones the current packet. Caller is responsible for deallocation of the memory.
324
    /// @return A pointer to the new RawPacket object which is a clone of this object
325
    virtual RawPacket* clone() const;
326
327
    /// @return RawPacket object type. Each derived class should return a different value
328
    virtual uint8_t getObjectType() const
329
0
    {
330
0
      return 0;
331
0
    }
332
333
    /// Set a raw data. If data was already set and takeOwnership was set to 'true' the old data will be
334
    /// freed first
335
    /// @param[in] pRawData A pointer to the new raw data
336
    /// @param[in] rawDataLen The new raw data length in bytes
337
    /// @param[in] timestamp The timestamp packet was received by the NIC (in usec precision)
338
    /// @param[in] layerType The link layer type for this raw data
339
    /// @param[in] frameLength When reading from pcap files, sometimes the captured length is different from the
340
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
341
    /// set to -1 it is assumed both lengths are equal
342
    /// @return True if raw data was set successfully, false otherwise
343
    /// @deprecated This method does not update ownership of the pRawData pointer, inheriting the previous buffer's
344
    /// ownership. Use the overload that takes bool takeOwnership parameter for explicit control.
345
    /// @remarks Derived classes may not support using the raw data buffer directly.
346
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
347
    /// and instead get the raw data pointer using getRawData().
348
    PCPP_DEPRECATED("Use the overload that takes bool takeOwnership parameter for explicit control.")
349
    bool setRawData(const uint8_t* pRawData, int rawDataLen, timeval timestamp,
350
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
351
352
    /// @brief Assign a buffer to use as raw data.
353
    ///
354
    /// If the RawPacket already had raw data, it will be disposed of accordingly.
355
    ///
356
    /// @param pRawData A pointer to the new raw data buffer.
357
    /// @param rawDataLen The length of the new raw data buffer in bytes.
358
    /// @param takeOwnership If true, the RawPacket will take ownership of the buffer and will be responsible for
359
    /// freeing it.
360
    /// @param timestamp The timestamp packet was received by the NIC (in usec precision).
361
    /// @param layerType The link layer type for this raw data.
362
    /// @param frameLength When reading from pcap files, sometimes the captured length is different from the
363
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
364
    /// set to -1 it is assumed both lengths are equal
365
    /// @return True if raw data was set successfully, false otherwise.
366
    /// @remarks Derived classes may not support using the raw data buffer directly.
367
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
368
    /// and instead get the raw data pointer using getRawData().
369
    bool setRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timeval timestamp,
370
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
371
372
    /// Set a raw data. If data was already set and takeOwnership was set to 'true' the old data will be
373
    /// freed first
374
    /// @param[in] pRawData A pointer to the new raw data
375
    /// @param[in] rawDataLen The new raw data length in bytes
376
    /// @param[in] timestamp The timestamp packet was received by the NIC (in nsec precision)
377
    /// @param[in] layerType The link layer type for this raw data
378
    /// @param[in] frameLength When reading from pcap files, sometimes the captured length is different from the
379
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
380
    /// set to -1 it is assumed both lengths are equal
381
    /// @return True if raw data was set successfully, false otherwise
382
    /// @deprecated This method does not update ownership of the pRawData pointer, inheriting the previous buffer's
383
    /// ownership. Use the overload that takes bool takeOwnership parameter for explicit control.
384
    /// @remarks Derived classes may not support using the raw data buffer directly.
385
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
386
    /// and instead get the raw data pointer using getRawData().
387
    PCPP_DEPRECATED("Use the overload that takes bool takeOwnership parameter for explicit control.")
388
    bool setRawData(const uint8_t* pRawData, int rawDataLen, timespec timestamp,
389
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
390
391
    /// @brief Assign a buffer to use as raw data.
392
    ///
393
    /// If the RawPacket already had raw data, it will be disposed of accordingly.
394
    ///
395
    /// @param pRawData A pointer to the new raw data buffer.
396
    /// @param rawDataLen The length of the new raw data buffer in bytes.
397
    /// @param takeOwnership If true, the RawPacket will take ownership of the buffer and will be responsible for
398
    /// freeing it.
399
    /// @param timestamp The timestamp packet was received by the NIC (in nsec precision).
400
    /// @param layerType The link layer type for this raw data.
401
    /// @param frameLength When reading from pcap files, sometimes the captured length is different from the
402
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
403
    /// set to -1 it is assumed both lengths are equal
404
    /// @return True if raw data was set successfully, false otherwise.
405
    /// @remarks Derived classes may not support using the raw data buffer directly.
406
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
407
    /// and instead get the raw data pointer using getRawData().
408
    bool setRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timespec timestamp,
409
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
410
411
    /// Initialize a raw packet with data. The main difference between this method and setRawData() is that
412
    /// setRawData() is meant for replacing the data in an existing raw packet, whereas this method is meant to be
413
    /// used right after constructing a raw packet using the default c'tor, before setting any data
414
    /// @param pRawData A pointer to the new raw data
415
    /// @param rawDataLen The new raw data length in bytes
416
    /// @param timestamp The timestamp packet was received by the NIC (in nsec precision)
417
    /// @param layerType The link layer type for this raw data
418
    /// @return True if raw data was set successfully, false otherwise
419
    /// @deprecated Prefer using setRawData() with takeOwnership `false`.
420
    PCPP_DEPRECATED("Prefer using setRawData() with takeOwnership `false`.")
421
    bool initWithRawData(const uint8_t* pRawData, int rawDataLen, timespec timestamp,
422
                         LinkLayerType layerType = LINKTYPE_ETHERNET);
423
424
    /// Get raw data pointer
425
    /// @return A read-only pointer to the raw data
426
    const uint8_t* getRawData() const
427
2.80M
    {
428
2.80M
      return m_RawData;
429
2.80M
    }
430
431
    /// Get the link layer type
432
    /// @return the type of the link layer
433
    LinkLayerType getLinkLayerType() const
434
1.29M
    {
435
1.29M
      return m_LinkLayerType;
436
1.29M
    }
437
438
    /// This static method validates whether a link type integer value is valid
439
    /// @param[in] linkTypeValue Link type integer value
440
    /// @return True if the link type value is valid and can be casted into LinkLayerType enum, false otherwise
441
    static bool isLinkTypeValid(int linkTypeValue);
442
443
    /// Get raw data length in bytes
444
    /// @return Raw data length in bytes
445
    int getRawDataLen() const
446
3.02M
    {
447
3.02M
      return m_RawDataLen;
448
3.02M
    }
449
450
    /// Get frame length in bytes
451
    /// @return frame length in bytes
452
    int getFrameLength() const
453
0
    {
454
0
      return m_FrameLength;
455
0
    }
456
    /// Get raw data timestamp
457
    /// @return Raw data timestamp
458
    timespec getPacketTimeStamp() const
459
255k
    {
460
255k
      return m_TimeStamp;
461
255k
    }
462
463
    /// Set raw packet timestamp with usec precision
464
    /// @param[in] timestamp The timestamp to set (with usec precision)
465
    /// @return True if timestamp was set successfully, false otherwise
466
    virtual bool setPacketTimeStamp(timeval timestamp);
467
468
    /// Set raw packet timestamp with nsec precision
469
    /// @param[in] timestamp The timestamp to set (with nsec precision)
470
    /// @return True if timestamp was set successfully, false otherwise
471
    virtual bool setPacketTimeStamp(timespec timestamp);
472
473
    /// Get an indication whether raw data was already set for this instance.
474
    /// @return True if raw data was set for this instance. Raw data can be set using the non-default constructor,
475
    /// using setRawData(), using the copy constructor or using the assignment operator. Returns false otherwise,
476
    /// for example: if the instance was created using the default constructor or clear() was called
477
    bool isPacketSet() const
478
0
    {
479
0
      return m_RawPacketSet;
480
0
    }
481
482
    /// Clears all members of this instance, meaning setting raw data to nullptr, raw data length to 0, etc.
483
    /// Frees the raw data if takeOwnership was set to 'true'
484
    /// @todo set timestamp to a default value as well
485
    virtual void clear();
486
487
    /// Append data to the end of current data. This method works without allocating more memory, it just uses
488
    /// memcpy() to copy dataToAppend at the end of the current data. This means that the method assumes this memory
489
    /// was already allocated by the user. If it isn't the case then this method will cause memory corruption
490
    /// @param[in] dataToAppend A pointer to the data to append to current raw data
491
    /// @param[in] dataToAppendLen Length in bytes of dataToAppend
492
    virtual void appendData(const uint8_t* dataToAppend, size_t dataToAppendLen);
493
494
    /// Insert new data at some index of the current data and shift the remaining old data to the end. This method
495
    /// works without allocating more memory, it just copies dataToAppend at the relevant index and shifts the
496
    /// remaining data to the end. This means that the method assumes this memory was already allocated by the user.
497
    /// If it isn't the case then this method will cause memory corruption
498
    /// @param[in] atIndex The index to insert the new data to
499
    /// @param[in] dataToInsert A pointer to the new data to insert
500
    /// @param[in] dataToInsertLen Length in bytes of dataToInsert
501
    virtual void insertData(int atIndex, const uint8_t* dataToInsert, size_t dataToInsertLen);
502
503
    /// Remove certain number of bytes from current raw data buffer. All data after the removed bytes will be
504
    /// shifted back
505
    /// @param[in] atIndex The index to start removing bytes from
506
    /// @param[in] numOfBytesToRemove Number of bytes to remove
507
    /// @return True if all bytes were removed successfully, or false if atIndex+numOfBytesToRemove is out-of-bounds
508
    /// of the raw data buffer
509
    virtual bool removeData(int atIndex, size_t numOfBytesToRemove);
510
511
    /// Re-allocate raw packet buffer meaning add size to it without losing the current packet data. This method
512
    /// allocates the required buffer size as instructed by the use and then copies the raw data from the current
513
    /// allocated buffer to the new one. This method can become useful if the user wants to insert or append data to
514
    /// the raw data, and the previous allocated buffer is too small, so the user wants to allocate a larger buffer
515
    /// and get RawPacket instance to point to it
516
    /// @param[in] newBufferLength The new buffer length as required by the user. The method is responsible to
517
    /// allocate the memory
518
    /// @return True if data was reallocated successfully, false otherwise
519
    virtual bool reallocateData(size_t newBufferLength);
520
521
  protected:
522
    // Updates the raw data buffer and related members. Used by setRawData() methods.
523
    virtual bool doSetRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timespec timestamp,
524
                              LinkLayerType layerType, int frameLength);
525
  };
526
527
}  // namespace pcpp