• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2013, Petar Alilovic,
3  * Faculty of Electrical Engineering and Computing, University of Zagreb
4  * All rights reserved
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * * Redistributions of source code must retain the above copyright notice,
10  *	 this list of conditions and the following disclaimer.
11  * * Redistributions in binary form must reproduce the above copyright
12  *	 notice, this list of conditions and the following disclaimer in the
13  *	 documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
16  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
18  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
19  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
20  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
21  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
25  * DAMAGE.
26  */
27 
28 #ifndef lib_pcap_nflog_h
29 #define lib_pcap_nflog_h
30 
31 #include <pcap/pcap-inttypes.h>
32 
33 /*
34  * Structure of an NFLOG header and TLV parts, as described at
35  * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html
36  *
37  * The NFLOG header is big-endian.
38  *
39  * The TLV length and type are in host byte order.  The value is either
40  * big-endian or is an array of bytes in some externally-specified byte
41  * order (text string, link-layer address, link-layer header, packet
42  * data, etc.).
43  */
44 typedef struct nflog_hdr {
45 	uint8_t		nflog_family;	/* address family */
46 	uint8_t		nflog_version;	/* version */
47 	uint16_t	nflog_rid;	/* resource ID */
48 } nflog_hdr_t;
49 
50 typedef struct nflog_tlv {
51 	uint16_t	tlv_length;	/* tlv length */
52 	uint16_t	tlv_type;	/* tlv type */
53 	/* value follows this */
54 } nflog_tlv_t;
55 
56 typedef struct nflog_packet_hdr {
57 	uint16_t	hw_protocol;	/* hw protocol */
58 	uint8_t		hook;		/* netfilter hook */
59 	uint8_t		pad;		/* padding to 32 bits */
60 } nflog_packet_hdr_t;
61 
62 typedef struct nflog_hwaddr {
63 	uint16_t	hw_addrlen;	/* address length */
64 	uint16_t	pad;		/* padding to 32-bit boundary */
65 	uint8_t		hw_addr[8];	/* address, up to 8 bytes */
66 } nflog_hwaddr_t;
67 
68 typedef struct nflog_timestamp {
69 	uint64_t	sec;
70 	uint64_t	usec;
71 } nflog_timestamp_t;
72 
73 /*
74  * TLV types.
75  */
76 #define NFULA_PACKET_HDR		1	/* nflog_packet_hdr_t */
77 #define NFULA_MARK			2	/* packet mark from skbuff */
78 #define NFULA_TIMESTAMP			3	/* nflog_timestamp_t for skbuff's time stamp */
79 #define NFULA_IFINDEX_INDEV		4	/* ifindex of device on which packet received (possibly bridge group) */
80 #define NFULA_IFINDEX_OUTDEV		5	/* ifindex of device on which packet transmitted (possibly bridge group) */
81 #define NFULA_IFINDEX_PHYSINDEV		6	/* ifindex of physical device on which packet received (not bridge group) */
82 #define NFULA_IFINDEX_PHYSOUTDEV	7	/* ifindex of physical device on which packet transmitted (not bridge group) */
83 #define NFULA_HWADDR			8	/* nflog_hwaddr_t for hardware address */
84 #define NFULA_PAYLOAD			9	/* packet payload */
85 #define NFULA_PREFIX			10	/* text string - null-terminated, count includes NUL */
86 #define NFULA_UID			11	/* UID owning socket on which packet was sent/received */
87 #define NFULA_SEQ			12	/* sequence number of packets on this NFLOG socket */
88 #define NFULA_SEQ_GLOBAL		13	/* sequence number of pakets on all NFLOG sockets */
89 #define NFULA_GID			14	/* GID owning socket on which packet was sent/received */
90 #define NFULA_HWTYPE			15	/* ARPHRD_ type of skbuff's device */
91 #define NFULA_HWHEADER			16	/* skbuff's MAC-layer header */
92 #define NFULA_HWLEN			17	/* length of skbuff's MAC-layer header */
93 
94 #endif
95