nflog.h 3.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. /*
  2. * Copyright (c) 2013, Petar Alilovic,
  3. * Faculty of Electrical Engineering and Computing, University of Zagreb
  4. * All rights reserved
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions are met:
  8. *
  9. * * Redistributions of source code must retain the above copyright notice,
  10. * this list of conditions and the following disclaimer.
  11. * * Redistributions in binary form must reproduce the above copyright
  12. * notice, this list of conditions and the following disclaimer in the
  13. * documentation and/or other materials provided with the distribution.
  14. *
  15. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
  16. * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  17. * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  18. * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
  19. * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  20. * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  21. * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22. * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
  25. * DAMAGE.
  26. */
  27. #ifndef lib_pcap_nflog_h
  28. #define lib_pcap_nflog_h
  29. #include <pcap/pcap-inttypes.h>
  30. /*
  31. * Structure of an NFLOG header and TLV parts, as described at
  32. * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html
  33. *
  34. * The NFLOG header is big-endian.
  35. *
  36. * The TLV length and type are in host byte order. The value is either
  37. * big-endian or is an array of bytes in some externally-specified byte
  38. * order (text string, link-layer address, link-layer header, packet
  39. * data, etc.).
  40. */
  41. typedef struct nflog_hdr {
  42. uint8_t nflog_family; /* address family */
  43. uint8_t nflog_version; /* version */
  44. uint16_t nflog_rid; /* resource ID */
  45. } nflog_hdr_t;
  46. typedef struct nflog_tlv {
  47. uint16_t tlv_length; /* tlv length */
  48. uint16_t tlv_type; /* tlv type */
  49. /* value follows this */
  50. } nflog_tlv_t;
  51. typedef struct nflog_packet_hdr {
  52. uint16_t hw_protocol; /* hw protocol */
  53. uint8_t hook; /* netfilter hook */
  54. uint8_t pad; /* padding to 32 bits */
  55. } nflog_packet_hdr_t;
  56. typedef struct nflog_hwaddr {
  57. uint16_t hw_addrlen; /* address length */
  58. uint16_t pad; /* padding to 32-bit boundary */
  59. uint8_t hw_addr[8]; /* address, up to 8 bytes */
  60. } nflog_hwaddr_t;
  61. typedef struct nflog_timestamp {
  62. uint64_t sec;
  63. uint64_t usec;
  64. } nflog_timestamp_t;
  65. /*
  66. * TLV types.
  67. */
  68. #define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */
  69. #define NFULA_MARK 2 /* packet mark from skbuff */
  70. #define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */
  71. #define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */
  72. #define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */
  73. #define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */
  74. #define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */
  75. #define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */
  76. #define NFULA_PAYLOAD 9 /* packet payload */
  77. #define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */
  78. #define NFULA_UID 11 /* UID owning socket on which packet was sent/received */
  79. #define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */
  80. #define NFULA_SEQ_GLOBAL 13 /* sequence number of pakets on all NFLOG sockets */
  81. #define NFULA_GID 14 /* GID owning socket on which packet was sent/received */
  82. #define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */
  83. #define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */
  84. #define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */
  85. #endif