Coverage Report

Created: 2026-03-31 07:53

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/PcapPlusPlus/Packet++/header/RawPacket.h
Line
Count
Source
1
#pragma once
2
3
#include <stdint.h>
4
#ifdef _MSC_VER
5
# include <winsock2.h>
6
# include <time.h>
7
#else
8
# include <sys/time.h>
9
#endif
10
#include <stddef.h>
11
12
#include "DeprecationUtils.h"
13
14
/// @file
15
16
/// @namespace pcpp
17
/// @brief The main namespace for the PcapPlusPlus lib
18
namespace pcpp
19
{
20
  /// An enum describing all known link layer type. Taken from: http://www.tcpdump.org/linktypes.html .
21
  enum LinkLayerType
22
  {
23
    /// BSD loopback encapsulation
24
    LINKTYPE_NULL = 0,
25
    /// IEEE 802.3 Ethernet
26
    LINKTYPE_ETHERNET = 1,
27
    /// AX.25 packet
28
    LINKTYPE_AX25 = 3,
29
    /// IEEE 802.5 Token Ring
30
    LINKTYPE_IEEE802_5 = 6,
31
    /// ARCNET Data Packets
32
    LINKTYPE_ARCNET_BSD = 7,
33
    /// SLIP, encapsulated with a LINKTYPE_SLIP header
34
    LINKTYPE_SLIP = 8,
35
    /// PPP, as per RFC 1661 and RFC 1662
36
    LINKTYPE_PPP = 9,
37
    /// FDDI, as specified by ANSI INCITS 239-1994
38
    LINKTYPE_FDDI = 10,
39
    /// Raw IP
40
    LINKTYPE_DLT_RAW1 = 12,
41
    /// Raw IP (OpenBSD)
42
    LINKTYPE_DLT_RAW2 = 14,
43
    /// PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547
44
    LINKTYPE_PPP_HDLC = 50,
45
    /// PPPoE
46
    LINKTYPE_PPP_ETHER = 51,
47
    /// RFC 1483 LLC/SNAP-encapsulated ATM
48
    LINKTYPE_ATM_RFC1483 = 100,
49
    /// Raw IP
50
    LINKTYPE_RAW = 101,
51
    /// Cisco PPP with HDLC framing
52
    LINKTYPE_C_HDLC = 104,
53
    /// IEEE 802.11 wireless LAN
54
    LINKTYPE_IEEE802_11 = 105,
55
    /// Frame Relay
56
    LINKTYPE_FRELAY = 107,
57
    /// OpenBSD loopback encapsulation
58
    LINKTYPE_LOOP = 108,
59
    /// Linux "cooked" capture encapsulation
60
    LINKTYPE_LINUX_SLL = 113,
61
    /// Apple LocalTalk
62
    LINKTYPE_LTALK = 114,
63
    /// OpenBSD pflog
64
    LINKTYPE_PFLOG = 117,
65
    /// Prism monitor mode information followed by an 802.11 header
66
    LINKTYPE_IEEE802_11_PRISM = 119,
67
    /// RFC 2625 IP-over-Fibre Channel
68
    LINKTYPE_IP_OVER_FC = 122,
69
    /// ATM traffic, encapsulated as per the scheme used by SunATM devices
70
    LINKTYPE_SUNATM = 123,
71
    /// Radiotap link-layer information followed by an 802.11 header
72
    LINKTYPE_IEEE802_11_RADIOTAP = 127,
73
    /// ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999
74
    LINKTYPE_ARCNET_LINUX = 129,
75
    /// Apple IP-over-IEEE 1394 cooked header
76
    LINKTYPE_APPLE_IP_OVER_IEEE1394 = 138,
77
    /// Signaling System 7 Message Transfer Part Level 2
78
    LINKTYPE_MTP2_WITH_PHDR = 139,
79
    /// Signaling System 7 Message Transfer Part Level 2
80
    LINKTYPE_MTP2 = 140,
81
    /// Signaling System 7 Message Transfer Part Level 3
82
    LINKTYPE_MTP3 = 141,
83
    /// Signaling System 7 Signalling Connection Control Part
84
    LINKTYPE_SCCP = 142,
85
    /// Signaling System 7 Signalling Connection Control Part
86
    LINKTYPE_DOCSIS = 143,
87
    /// Linux-IrDA packets
88
    LINKTYPE_LINUX_IRDA = 144,
89
    /// Reserved for private use
90
    LINKTYPE_USER0 = 147,
91
    /// Reserved for private use
92
    LINKTYPE_USER1 = 148,
93
    /// Reserved for private use
94
    LINKTYPE_USER2 = 149,
95
    /// Reserved for private use
96
    LINKTYPE_USER3 = 150,
97
    /// Reserved for private use
98
    LINKTYPE_USER4 = 151,
99
    /// Reserved for private use
100
    LINKTYPE_USER5 = 152,
101
    /// Reserved for private use
102
    LINKTYPE_USER6 = 153,
103
    /// Reserved for private use
104
    LINKTYPE_USER7 = 154,
105
    /// Reserved for private use
106
    LINKTYPE_USER8 = 155,
107
    /// Reserved for private use
108
    LINKTYPE_USER9 = 156,
109
    /// Reserved for private use
110
    LINKTYPE_USER10 = 157,
111
    /// Reserved for private use
112
    LINKTYPE_USER11 = 158,
113
    /// Reserved for private use
114
    LINKTYPE_USER12 = 159,
115
    /// Reserved for private use
116
    LINKTYPE_USER13 = 160,
117
    /// Reserved for private use
118
    LINKTYPE_USER14 = 161,
119
    /// Reserved for private use
120
    LINKTYPE_USER15 = 162,
121
    /// AVS monitor mode information followed by an 802.11 header
122
    LINKTYPE_IEEE802_11_AVS = 163,
123
    /// BACnet MS/TP frames
124
    LINKTYPE_BACNET_MS_TP = 165,
125
    /// PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC, but with the 0xff address byte replaced by a
126
    /// direction indication - 0x00 for incoming and 0x01 for outgoing
127
    LINKTYPE_PPP_PPPD = 166,
128
    /// General Packet Radio Service Logical Link Control
129
    LINKTYPE_GPRS_LLC = 169,
130
    /// Transparent-mapped generic framing procedure
131
    LINKTYPE_GPF_T = 170,
132
    /// Frame-mapped generic framing procedure
133
    LINKTYPE_GPF_F = 171,
134
    /// Link Access Procedures on the D Channel (LAPD) frames
135
    LINKTYPE_LINUX_LAPD = 177,
136
    /// Bluetooth HCI UART transport layer
137
    LINKTYPE_BLUETOOTH_HCI_H4 = 187,
138
    /// USB packets, beginning with a Linux USB header
139
    LINKTYPE_USB_LINUX = 189,
140
    /// Per-Packet Information information
141
    LINKTYPE_PPI = 192,
142
    /// IEEE 802.15.4 wireless Personal Area Network
143
    LINKTYPE_IEEE802_15_4 = 195,
144
    /// Various link-layer types, with a pseudo-header, for SITA
145
    LINKTYPE_SITA = 196,
146
    /// Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF record
147
    LINKTYPE_ERF = 197,
148
    /// Bluetooth HCI UART transport layer
149
    LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR = 201,
150
    /// AX.25 packet, with a 1-byte KISS header containing a type indicator
151
    LINKTYPE_AX25_KISS = 202,
152
    /// Link Access Procedures on the D Channel (LAPD) frames
153
    LINKTYPE_LAPD = 203,
154
    /// PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero value meaning
155
    /// "received by this host" and a non-zero value meaning  "sent by this host"
156
    LINKTYPE_PPP_WITH_DIR = 204,
157
    /// Cisco PPP with HDLC framing
158
    LINKTYPE_C_HDLC_WITH_DIR = 205,
159
    /// Frame Relay
160
    LINKTYPE_FRELAY_WITH_DIR = 206,
161
    /// IPMB over an I2C circuit
162
    LINKTYPE_IPMB_LINUX = 209,
163
    /// IEEE 802.15.4 wireless Personal Area Network
164
    LINKTYPE_IEEE802_15_4_NONASK_PHY = 215,
165
    /// USB packets, beginning with a Linux USB header
166
    LINKTYPE_USB_LINUX_MMAPPED = 220,
167
    /// Fibre Channel FC-2 frames, beginning with a Frame_Header
168
    LINKTYPE_FC_2 = 224,
169
    /// Fibre Channel FC-2 frames
170
    LINKTYPE_FC_2_WITH_FRAME_DELIMS = 225,
171
    /// Solaris ipnet pseudo-header
172
    LINKTYPE_IPNET = 226,
173
    /// CAN (Controller Area Network) frames, with a pseudo-header as supplied by Linux SocketCAN
174
    LINKTYPE_CAN_SOCKETCAN = 227,
175
    /// Raw IPv4; the packet begins with an IPv4 header
176
    LINKTYPE_IPV4 = 228,
177
    /// Raw IPv6; the packet begins with an IPv6 header
178
    LINKTYPE_IPV6 = 229,
179
    /// IEEE 802.15.4 wireless Personal Area Network, without the FCS at the end of the frame
180
    LINKTYPE_IEEE802_15_4_NOFCS = 230,
181
    /// Raw D-Bus messages, starting with the endianness flag, followed by the message type, etc., but without the
182
    /// authentication handshake before the message sequence
183
    LINKTYPE_DBUS = 231,
184
    /// DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver), with the
185
    /// message format specified by the PCAP format for DVB-CI specification
186
    LINKTYPE_DVB_CI = 235,
187
    /// Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but not the same as, 27.010)
188
    LINKTYPE_MUX27010 = 236,
189
    /// D_PDUs as described by NATO standard STANAG 5066, starting with the synchronization sequence, and including
190
    /// both header and data CRCs
191
    LINKTYPE_STANAG_5066_D_PDU = 237,
192
    /// Linux netlink NETLINK NFLOG socket log messages
193
    LINKTYPE_NFLOG = 239,
194
    /// Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an
195
    /// Ethernet frame, beginning with the MAC header and ending with the FCS
196
    LINKTYPE_NETANALYZER = 240,
197
    /// Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an
198
    /// Ethernet frame, beginning with the preamble, SFD, and MAC header, and ending with the FCS
199
    LINKTYPE_NETANALYZER_TRANSPARENT = 241,
200
    /// IP-over-InfiniBand, as specified by RFC 4391 section 6
201
    LINKTYPE_IPOIB = 242,
202
    /// MPEG-2 Transport Stream transport packets, as specified by ISO 13818-1/ITU-T Recommendation H.222.0
203
    LINKTYPE_MPEG_2_TS = 243,
204
    /// Pseudo-header for ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40
205
    /// protocol tester
206
    LINKTYPE_NG40 = 244,
207
    /// Pseudo-header for NFC LLCP packet captures, followed by frame data for the LLCP Protocol as specified by
208
    /// NFCForum-TS-LLCP_1.1
209
    LINKTYPE_NFC_LLCP = 245,
210
    /// Raw InfiniBand frames, starting with the Local Routing Header
211
    LINKTYPE_INFINIBAND = 247,
212
    /// SCTP packets, as defined by RFC 4960, with no lower-level protocols such as IPv4 or IPv6
213
    LINKTYPE_SCTP = 248,
214
    /// USB packets, beginning with a USBPcap header
215
    LINKTYPE_USBPCAP = 249,
216
    /// Serial-line packet header for the Schweitzer Engineering Laboratories "RTAC" product
217
    LINKTYPE_RTAC_SERIAL = 250,
218
    /// Bluetooth Low Energy air interface Link Layer packets
219
    LINKTYPE_BLUETOOTH_LE_LL = 251,
220
    /// Linux Netlink capture encapsulation
221
    LINKTYPE_NETLINK = 253,
222
    /// Bluetooth Linux Monitor encapsulation of traffic for the BlueZ stack
223
    LINKTYPE_BLUETOOTH_LINUX_MONITOR = 254,
224
    /// Bluetooth Basic Rate and Enhanced Data Rate baseband packets
225
    LINKTYPE_BLUETOOTH_BREDR_BB = 255,
226
    /// Bluetooth Low Energy link-layer packets
227
    LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR = 256,
228
    /// PROFIBUS data link layer packets, as specified by IEC standard 61158-6-3
229
    LINKTYPE_PROFIBUS_DL = 257,
230
    /// Apple PKTAP capture encapsulation
231
    LINKTYPE_PKTAP = 258,
232
    /// Ethernet-over-passive-optical-network packets
233
    LINKTYPE_EPON = 259,
234
    /// IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" in the PICMG HPM.2 specification
235
    LINKTYPE_IPMI_HPM_2 = 260,
236
    /// Per Joshua Wright <jwright@hasborg.com>, formats for Z-Wave RF profiles R1 and R2 captures
237
    LINKTYPE_ZWAVE_R1_R2 = 261,
238
    /// Per Joshua Wright <jwright@hasborg.com>, formats for Z-Wave RF profile R3 captures
239
    LINKTYPE_ZWAVE_R3 = 262,
240
    /// Formats for WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol common packet
241
    /// structure captures
242
    LINKTYPE_WATTSTOPPER_DLM = 263,
243
    /// Messages between ISO 14443 contactless smartcards (Proximity Integrated Circuit Card, PICC) and card readers
244
    /// (Proximity Coupling Device, PCD), with the message format specified by the PCAP format for ISO14443
245
    /// specification
246
    LINKTYPE_ISO_14443 = 264,
247
    /// Linux "cooked" capture encapsulation v2
248
    LINKTYPE_LINUX_SLL2 = 276,
249
    /// Set if interface ID for a packet of a pcapng file is too high
250
    LINKTYPE_INVALID = 0xFFFF
251
  };
252
253
  /// Max packet size supported
254
107
#define PCPP_MAX_PACKET_SIZE 65536
255
256
  class RawPacket;
257
258
  namespace internal
259
  {
260
    /// @brief Type of RawPacket implementation
261
    ///
262
    /// This is mainly used internally to distinguish between different implementations without using RTTI.
263
    ///
264
    /// Only the standard RawPacket implementation is defined in Packet++ library.
265
    /// Other device specific implementations are defined in their respective parts of Pcap++.
266
    enum class RawPacketImplType : uint8_t
267
    {
268
      /// @brief Unknown type
269
      Unknown = 0,
270
      /// @brief Standard RawPacket
271
      Standard = 1,
272
      /// @brief DPDK MBuf based RawPacket
273
      DpdkMBuf = 2,
274
      /// @brief WinDivert based RawPacket
275
      WinDivert = 3
276
    };
277
278
    /// @brief Get the concrete implementation type of a RawPacket instance
279
    /// @param rawPacket The RawPacket instance
280
    /// @return A value of RawPacketImplType enum representing the concrete implementation type of the given
281
    /// RawPacket instance.
282
    RawPacketImplType getRawPacketImplementationType(RawPacket const& rawPacket);
283
  }  // namespace internal
284
285
  /// @class RawPacket
286
  /// This class holds the packet as raw (not parsed) data. The data is held as byte array. In addition to the data
287
  /// itself every instance also holds a timestamp representing the time the packet was received by the NIC. RawPacket
288
  /// instance isn't read only. The user can change the packet data, add or remove data, etc.
289
  class RawPacket
290
  {
291
    friend internal::RawPacketImplType internal::getRawPacketImplementationType(RawPacket const& rawPacket);
292
293
  protected:
294
    uint8_t* m_RawData = nullptr;
295
    int m_RawDataLen = 0;
296
    int m_FrameLength = 0;
297
    timespec m_TimeStamp{};  // Zero initialized
298
    bool m_OwnsRawData = false;
299
    bool m_RawPacketSet = false;
300
    LinkLayerType m_LinkLayerType = LinkLayerType::LINKTYPE_ETHERNET;
301
302
    void copyDataFrom(const RawPacket& other, bool allocateData = true);
303
304
  public:
305
    /// A default constructor that initializes class'es attributes to default value:
306
    /// - data pointer is set to nullptr
307
    /// - data length is set to 0
308
    /// - frame length is set to 0
309
    /// - takeOwnership is set to 'false'
310
    /// - timestamp is set to 0
311
    /// - layer type is set to Ethernet
312
12.5k
    RawPacket() = default;
313
314
    /// A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually
315
    /// used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.).
316
    /// The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has
317
    /// arrived to the device
318
    /// @param[in] pRawData A pointer to the raw data
319
    /// @param[in] rawDataLen The raw data length in bytes
320
    /// @param[in] timestamp The timestamp packet was received by the NIC (in usec precision)
321
    /// @param[in] takeOwnership If 'true' the RawPacket will take ownership of the pRawData pointer and will
322
    /// free it when the RawPacket instance is destroyed or the buffer is replaced.
323
    /// @param[in] layerType The link layer type of this raw packet. The default is Ethernet
324
    RawPacket(const uint8_t* pRawData, int rawDataLen, timeval timestamp, bool takeOwnership,
325
              LinkLayerType layerType = LINKTYPE_ETHERNET);
326
327
    /// A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually
328
    /// used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.).
329
    /// The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has
330
    /// arrived to the device
331
    /// @param[in] pRawData A pointer to the raw data
332
    /// @param[in] rawDataLen The raw data length in bytes
333
    /// @param[in] timestamp The timestamp packet was received by the NIC (in nsec precision)
334
    /// @param[in] takeOwnership If 'true' the RawPacket will take ownership of the pRawData pointer and will
335
    /// free it when the RawPacket instance is destroyed or the buffer is replaced.
336
    /// @param[in] layerType The link layer type of this raw packet. The default is Ethernet
337
    RawPacket(const uint8_t* pRawData, int rawDataLen, timespec timestamp, bool takeOwnership,
338
              LinkLayerType layerType = LINKTYPE_ETHERNET);
339
340
    /// A destructor for this class. Frees the raw data if takeOwnership was set to 'true'
341
    virtual ~RawPacket();
342
343
    /// A copy constructor that copies all data from another instance. Notice all raw data is copied (using memcpy),
344
    /// so when the original or the other instance are freed, the other won't be affected
345
    /// @param[in] other The instance to copy from
346
    RawPacket(const RawPacket& other);
347
348
    /// Assignment operator overload for this class. When using this operator on an already initialized RawPacket
349
    /// instance, the original raw data is freed first if takeOwnership was set to 'true'.
350
    /// Then the other instance is copied to this instance, the same way the copy constructor works
351
    /// @param[in] other The instance to copy from
352
    RawPacket& operator=(const RawPacket& other);
353
354
    /// @brief Clones the current packet. Caller is responsible for deallocation of the memory.
355
    /// @return A pointer to the new RawPacket object which is a clone of this object
356
    virtual RawPacket* clone() const;
357
358
    /// @return RawPacket object type. Each derived class should return a different value
359
    /// @deprecated Deprecated due to unclear semantics and type safety.
360
    /// The functionality has been moved to the unstable internal API in as
361
    /// internal::getRawPacketImplementationType(RawPacket const& rawPacket).
362
    PCPP_DEPRECATED("Deprecated due to unclear semantics.")
363
    virtual uint8_t getObjectType() const
364
0
    {
365
0
      return 0;
366
0
    }
367
368
    /// Set a raw data. If data was already set and takeOwnership was set to 'true' the old data will be
369
    /// freed first
370
    /// @param[in] pRawData A pointer to the new raw data
371
    /// @param[in] rawDataLen The new raw data length in bytes
372
    /// @param[in] timestamp The timestamp packet was received by the NIC (in usec precision)
373
    /// @param[in] layerType The link layer type for this raw data
374
    /// @param[in] frameLength When reading from pcap files, sometimes the captured length is different from the
375
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
376
    /// set to -1 it is assumed both lengths are equal
377
    /// @return True if raw data was set successfully, false otherwise
378
    /// @deprecated This method does not update ownership of the pRawData pointer, inheriting the previous buffer's
379
    /// ownership. Use the overload that takes bool takeOwnership parameter for explicit control.
380
    /// @remarks Derived classes may not support using the raw data buffer directly.
381
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
382
    /// and instead get the raw data pointer using getRawData().
383
    PCPP_DEPRECATED("Use the overload that takes bool takeOwnership parameter for explicit control.")
384
    bool setRawData(const uint8_t* pRawData, int rawDataLen, timeval timestamp,
385
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
386
387
    /// @brief Assign a buffer to use as raw data.
388
    ///
389
    /// If the RawPacket already had raw data, it will be disposed of accordingly.
390
    ///
391
    /// @param pRawData A pointer to the new raw data buffer.
392
    /// @param rawDataLen The length of the new raw data buffer in bytes.
393
    /// @param takeOwnership If true, the RawPacket will take ownership of the buffer and will be responsible for
394
    /// freeing it.
395
    /// @param timestamp The timestamp packet was received by the NIC (in usec precision).
396
    /// @param layerType The link layer type for this raw data.
397
    /// @param frameLength When reading from pcap files, sometimes the captured length is different from the
398
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
399
    /// set to -1 it is assumed both lengths are equal
400
    /// @return True if raw data was set successfully, false otherwise.
401
    /// @remarks Derived classes may not support using the raw data buffer directly.
402
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
403
    /// and instead get the raw data pointer using getRawData().
404
    bool setRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timeval timestamp,
405
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
406
407
    /// Set a raw data. If data was already set and takeOwnership was set to 'true' the old data will be
408
    /// freed first
409
    /// @param[in] pRawData A pointer to the new raw data
410
    /// @param[in] rawDataLen The new raw data length in bytes
411
    /// @param[in] timestamp The timestamp packet was received by the NIC (in nsec precision)
412
    /// @param[in] layerType The link layer type for this raw data
413
    /// @param[in] frameLength When reading from pcap files, sometimes the captured length is different from the
414
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
415
    /// set to -1 it is assumed both lengths are equal
416
    /// @return True if raw data was set successfully, false otherwise
417
    /// @deprecated This method does not update ownership of the pRawData pointer, inheriting the previous buffer's
418
    /// ownership. Use the overload that takes bool takeOwnership parameter for explicit control.
419
    /// @remarks Derived classes may not support using the raw data buffer directly.
420
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
421
    /// and instead get the raw data pointer using getRawData().
422
    PCPP_DEPRECATED("Use the overload that takes bool takeOwnership parameter for explicit control.")
423
    bool setRawData(const uint8_t* pRawData, int rawDataLen, timespec timestamp,
424
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
425
426
    /// @brief Assign a buffer to use as raw data.
427
    ///
428
    /// If the RawPacket already had raw data, it will be disposed of accordingly.
429
    ///
430
    /// @param pRawData A pointer to the new raw data buffer.
431
    /// @param rawDataLen The length of the new raw data buffer in bytes.
432
    /// @param takeOwnership If true, the RawPacket will take ownership of the buffer and will be responsible for
433
    /// freeing it.
434
    /// @param timestamp The timestamp packet was received by the NIC (in nsec precision).
435
    /// @param layerType The link layer type for this raw data.
436
    /// @param frameLength When reading from pcap files, sometimes the captured length is different from the
437
    /// actual packet length. This parameter represents the packet length. This parameter is optional, if not set or
438
    /// set to -1 it is assumed both lengths are equal
439
    /// @return True if raw data was set successfully, false otherwise.
440
    /// @remarks Derived classes may not support using the raw data buffer directly.
441
    /// Users should not rely on the RawPacket always writing to the provided pointer location,
442
    /// and instead get the raw data pointer using getRawData().
443
    bool setRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timespec timestamp,
444
                    LinkLayerType layerType = LINKTYPE_ETHERNET, int frameLength = -1);
445
446
    /// Initialize a raw packet with data. The main difference between this method and setRawData() is that
447
    /// setRawData() is meant for replacing the data in an existing raw packet, whereas this method is meant to be
448
    /// used right after constructing a raw packet using the default c'tor, before setting any data
449
    /// @param pRawData A pointer to the new raw data
450
    /// @param rawDataLen The new raw data length in bytes
451
    /// @param timestamp The timestamp packet was received by the NIC (in nsec precision)
452
    /// @param layerType The link layer type for this raw data
453
    /// @return True if raw data was set successfully, false otherwise
454
    /// @deprecated Prefer using setRawData() with takeOwnership `false`.
455
    PCPP_DEPRECATED("Prefer using setRawData() with takeOwnership `false`.")
456
    bool initWithRawData(const uint8_t* pRawData, int rawDataLen, timespec timestamp,
457
                         LinkLayerType layerType = LINKTYPE_ETHERNET);
458
459
    /// Get raw data pointer
460
    /// @return A read-only pointer to the raw data
461
    const uint8_t* getRawData() const
462
3.08M
    {
463
3.08M
      return m_RawData;
464
3.08M
    }
465
466
    /// Get the link layer type
467
    /// @return the type of the link layer
468
    LinkLayerType getLinkLayerType() const
469
1.05M
    {
470
1.05M
      return m_LinkLayerType;
471
1.05M
    }
472
473
    /// This static method validates whether a link type integer value is valid
474
    /// @param[in] linkTypeValue Link type integer value
475
    /// @return True if the link type value is valid and can be casted into LinkLayerType enum, false otherwise
476
    static bool isLinkTypeValid(int linkTypeValue);
477
478
    /// Get raw data length in bytes
479
    /// @return Raw data length in bytes
480
    int getRawDataLen() const
481
3.18M
    {
482
3.18M
      return m_RawDataLen;
483
3.18M
    }
484
485
    /// Get frame length in bytes
486
    /// @return frame length in bytes
487
    int getFrameLength() const
488
4.62k
    {
489
4.62k
      return m_FrameLength;
490
4.62k
    }
491
    /// Get raw data timestamp
492
    /// @return Raw data timestamp
493
    timespec getPacketTimeStamp() const
494
203k
    {
495
203k
      return m_TimeStamp;
496
203k
    }
497
498
    /// Set raw packet timestamp with usec precision
499
    /// @param[in] timestamp The timestamp to set (with usec precision)
500
    /// @return True if timestamp was set successfully, false otherwise
501
    virtual bool setPacketTimeStamp(timeval timestamp);
502
503
    /// Set raw packet timestamp with nsec precision
504
    /// @param[in] timestamp The timestamp to set (with nsec precision)
505
    /// @return True if timestamp was set successfully, false otherwise
506
    virtual bool setPacketTimeStamp(timespec timestamp);
507
508
    /// Get an indication whether raw data was already set for this instance.
509
    /// @return True if raw data was set for this instance. Raw data can be set using the non-default constructor,
510
    /// using setRawData(), using the copy constructor or using the assignment operator. Returns false otherwise,
511
    /// for example: if the instance was created using the default constructor or clear() was called
512
    bool isPacketSet() const
513
0
    {
514
0
      return m_RawPacketSet;
515
0
    }
516
517
    /// Clears all members of this instance, meaning setting raw data to nullptr, raw data length to 0, etc.
518
    /// Frees the raw data if takeOwnership was set to 'true'
519
    /// @todo set timestamp to a default value as well
520
    virtual void clear();
521
522
    /// Append data to the end of current data. This method works without allocating more memory, it just uses
523
    /// memcpy() to copy dataToAppend at the end of the current data. This means that the method assumes this memory
524
    /// was already allocated by the user. If it isn't the case then this method will cause memory corruption
525
    /// @param[in] dataToAppend A pointer to the data to append to current raw data
526
    /// @param[in] dataToAppendLen Length in bytes of dataToAppend
527
    virtual void appendData(const uint8_t* dataToAppend, size_t dataToAppendLen);
528
529
    /// Insert new data at some index of the current data and shift the remaining old data to the end. This method
530
    /// works without allocating more memory, it just copies dataToAppend at the relevant index and shifts the
531
    /// remaining data to the end. This means that the method assumes this memory was already allocated by the user.
532
    /// If it isn't the case then this method will cause memory corruption
533
    /// @param[in] atIndex The index to insert the new data to
534
    /// @param[in] dataToInsert A pointer to the new data to insert
535
    /// @param[in] dataToInsertLen Length in bytes of dataToInsert
536
    virtual void insertData(int atIndex, const uint8_t* dataToInsert, size_t dataToInsertLen);
537
538
    /// Remove certain number of bytes from current raw data buffer. All data after the removed bytes will be
539
    /// shifted back
540
    /// @param[in] atIndex The index to start removing bytes from
541
    /// @param[in] numOfBytesToRemove Number of bytes to remove
542
    /// @return True if all bytes were removed successfully, or false if atIndex+numOfBytesToRemove is out-of-bounds
543
    /// of the raw data buffer
544
    virtual bool removeData(int atIndex, size_t numOfBytesToRemove);
545
546
    /// Re-allocate raw packet buffer meaning add size to it without losing the current packet data. This method
547
    /// allocates the required buffer size as instructed by the use and then copies the raw data from the current
548
    /// allocated buffer to the new one. This method can become useful if the user wants to insert or append data to
549
    /// the raw data, and the previous allocated buffer is too small, so the user wants to allocate a larger buffer
550
    /// and get RawPacket instance to point to it
551
    /// @param[in] newBufferLength The new buffer length as required by the user. The method is responsible to
552
    /// allocate the memory
553
    /// @return True if data was reallocated successfully, false otherwise
554
    virtual bool reallocateData(size_t newBufferLength);
555
556
  protected:
557
    /// @brief Get the type of RawPacket implementation.
558
    virtual internal::RawPacketImplType getImplType() const
559
0
    {
560
0
      return internal::RawPacketImplType::Standard;
561
0
    }
562
563
    // Updates the raw data buffer and related members. Used by setRawData() methods.
564
    virtual bool doSetRawData(const uint8_t* pRawData, int rawDataLen, bool takeOwnership, timespec timestamp,
565
                              LinkLayerType layerType, int frameLength);
566
  };
567
568
  namespace internal
569
  {
570
    inline RawPacketImplType getRawPacketImplementationType(RawPacket const& rawPacket)
571
0
    {
572
0
      return rawPacket.getImplType();
573
0
    }
574
  }  // namespace internal
575
}  // namespace pcpp