1 /* $NetBSD: nflog.h,v 1.5 2024/09/02 15:33:39 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2013, Petar Alilovic, 5 * Faculty of Electrical Engineering and Computing, University of Zagreb 6 * All rights reserved 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions are met: 10 * 11 * * Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * * Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY 18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 20 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 23 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 24 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 27 * DAMAGE. 28 */ 29 30 #ifndef lib_pcap_nflog_h 31 #define lib_pcap_nflog_h 32 33 #include <pcap/pcap-inttypes.h> 34 35 /* 36 * Structure of an NFLOG header and TLV parts, as described at 37 * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html 38 * 39 * The NFLOG header is big-endian. 40 * 41 * The TLV length and type are in host byte order. The value is either 42 * big-endian or is an array of bytes in some externally-specified byte 43 * order (text string, link-layer address, link-layer header, packet 44 * data, etc.). 45 */ 46 typedef struct nflog_hdr { 47 uint8_t nflog_family; /* address family */ 48 uint8_t nflog_version; /* version */ 49 uint16_t nflog_rid; /* resource ID */ 50 } nflog_hdr_t; 51 52 typedef struct nflog_tlv { 53 uint16_t tlv_length; /* tlv length */ 54 uint16_t tlv_type; /* tlv type */ 55 /* value follows this */ 56 } nflog_tlv_t; 57 58 typedef struct nflog_packet_hdr { 59 uint16_t hw_protocol; /* hw protocol */ 60 uint8_t hook; /* netfilter hook */ 61 uint8_t pad; /* padding to 32 bits */ 62 } nflog_packet_hdr_t; 63 64 typedef struct nflog_hwaddr { 65 uint16_t hw_addrlen; /* address length */ 66 uint16_t pad; /* padding to 32-bit boundary */ 67 uint8_t hw_addr[8]; /* address, up to 8 bytes */ 68 } nflog_hwaddr_t; 69 70 typedef struct nflog_timestamp { 71 uint64_t sec; 72 uint64_t usec; 73 } nflog_timestamp_t; 74 75 /* 76 * TLV types. 77 */ 78 #define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */ 79 #define NFULA_MARK 2 /* packet mark from skbuff */ 80 #define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */ 81 #define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */ 82 #define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */ 83 #define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */ 84 #define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */ 85 #define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */ 86 #define NFULA_PAYLOAD 9 /* packet payload */ 87 #define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */ 88 #define NFULA_UID 11 /* UID owning socket on which packet was sent/received */ 89 #define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */ 90 #define NFULA_SEQ_GLOBAL 13 /* sequence number of packets on all NFLOG sockets */ 91 #define NFULA_GID 14 /* GID owning socket on which packet was sent/received */ 92 #define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */ 93 #define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */ 94 #define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */ 95 96 #endif 97