197a9217aSAntonio Huete Jimenez /* 297a9217aSAntonio Huete Jimenez * Copyright (c) 2013, Petar Alilovic, 397a9217aSAntonio Huete Jimenez * Faculty of Electrical Engineering and Computing, University of Zagreb 497a9217aSAntonio Huete Jimenez * All rights reserved 597a9217aSAntonio Huete Jimenez * 697a9217aSAntonio Huete Jimenez * Redistribution and use in source and binary forms, with or without 797a9217aSAntonio Huete Jimenez * modification, are permitted provided that the following conditions are met: 897a9217aSAntonio Huete Jimenez * 997a9217aSAntonio Huete Jimenez * * Redistributions of source code must retain the above copyright notice, 1097a9217aSAntonio Huete Jimenez * this list of conditions and the following disclaimer. 1197a9217aSAntonio Huete Jimenez * * Redistributions in binary form must reproduce the above copyright 1297a9217aSAntonio Huete Jimenez * notice, this list of conditions and the following disclaimer in the 1397a9217aSAntonio Huete Jimenez * documentation and/or other materials provided with the distribution. 1497a9217aSAntonio Huete Jimenez * 1597a9217aSAntonio Huete Jimenez * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY 1697a9217aSAntonio Huete Jimenez * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 1797a9217aSAntonio Huete Jimenez * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 1897a9217aSAntonio Huete Jimenez * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY 1997a9217aSAntonio Huete Jimenez * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 2097a9217aSAntonio Huete Jimenez * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 2197a9217aSAntonio Huete Jimenez * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2297a9217aSAntonio Huete Jimenez * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2397a9217aSAntonio Huete Jimenez * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2497a9217aSAntonio Huete Jimenez * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 2597a9217aSAntonio Huete Jimenez * DAMAGE. 2697a9217aSAntonio Huete Jimenez */ 2797a9217aSAntonio Huete Jimenez 2897a9217aSAntonio Huete Jimenez #ifndef lib_pcap_nflog_h 2997a9217aSAntonio Huete Jimenez #define lib_pcap_nflog_h 3097a9217aSAntonio Huete Jimenez 31*3a289941SAaron LI #include <pcap/pcap-inttypes.h> 32*3a289941SAaron LI 3397a9217aSAntonio Huete Jimenez /* 3497a9217aSAntonio Huete Jimenez * Structure of an NFLOG header and TLV parts, as described at 35*3a289941SAaron LI * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html 3697a9217aSAntonio Huete Jimenez * 3797a9217aSAntonio Huete Jimenez * The NFLOG header is big-endian. 3897a9217aSAntonio Huete Jimenez * 3997a9217aSAntonio Huete Jimenez * The TLV length and type are in host byte order. The value is either 4097a9217aSAntonio Huete Jimenez * big-endian or is an array of bytes in some externally-specified byte 4197a9217aSAntonio Huete Jimenez * order (text string, link-layer address, link-layer header, packet 4297a9217aSAntonio Huete Jimenez * data, etc.). 4397a9217aSAntonio Huete Jimenez */ 4497a9217aSAntonio Huete Jimenez typedef struct nflog_hdr { 45*3a289941SAaron LI uint8_t nflog_family; /* address family */ 46*3a289941SAaron LI uint8_t nflog_version; /* version */ 47*3a289941SAaron LI uint16_t nflog_rid; /* resource ID */ 4897a9217aSAntonio Huete Jimenez } nflog_hdr_t; 4997a9217aSAntonio Huete Jimenez 5097a9217aSAntonio Huete Jimenez typedef struct nflog_tlv { 51*3a289941SAaron LI uint16_t tlv_length; /* tlv length */ 52*3a289941SAaron LI uint16_t tlv_type; /* tlv type */ 5397a9217aSAntonio Huete Jimenez /* value follows this */ 5497a9217aSAntonio Huete Jimenez } nflog_tlv_t; 5597a9217aSAntonio Huete Jimenez 5697a9217aSAntonio Huete Jimenez typedef struct nflog_packet_hdr { 57*3a289941SAaron LI uint16_t hw_protocol; /* hw protocol */ 58*3a289941SAaron LI uint8_t hook; /* netfilter hook */ 59*3a289941SAaron LI uint8_t pad; /* padding to 32 bits */ 6097a9217aSAntonio Huete Jimenez } nflog_packet_hdr_t; 6197a9217aSAntonio Huete Jimenez 6297a9217aSAntonio Huete Jimenez typedef struct nflog_hwaddr { 63*3a289941SAaron LI uint16_t hw_addrlen; /* address length */ 64*3a289941SAaron LI uint16_t pad; /* padding to 32-bit boundary */ 65*3a289941SAaron LI uint8_t hw_addr[8]; /* address, up to 8 bytes */ 6697a9217aSAntonio Huete Jimenez } nflog_hwaddr_t; 6797a9217aSAntonio Huete Jimenez 6897a9217aSAntonio Huete Jimenez typedef struct nflog_timestamp { 69*3a289941SAaron LI uint64_t sec; 70*3a289941SAaron LI uint64_t usec; 7197a9217aSAntonio Huete Jimenez } nflog_timestamp_t; 7297a9217aSAntonio Huete Jimenez 7397a9217aSAntonio Huete Jimenez /* 7497a9217aSAntonio Huete Jimenez * TLV types. 7597a9217aSAntonio Huete Jimenez */ 7697a9217aSAntonio Huete Jimenez #define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */ 7797a9217aSAntonio Huete Jimenez #define NFULA_MARK 2 /* packet mark from skbuff */ 7897a9217aSAntonio Huete Jimenez #define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */ 7997a9217aSAntonio Huete Jimenez #define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */ 8097a9217aSAntonio Huete Jimenez #define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */ 8197a9217aSAntonio Huete Jimenez #define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */ 8297a9217aSAntonio Huete Jimenez #define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */ 8397a9217aSAntonio Huete Jimenez #define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */ 8497a9217aSAntonio Huete Jimenez #define NFULA_PAYLOAD 9 /* packet payload */ 8597a9217aSAntonio Huete Jimenez #define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */ 8697a9217aSAntonio Huete Jimenez #define NFULA_UID 11 /* UID owning socket on which packet was sent/received */ 8797a9217aSAntonio Huete Jimenez #define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */ 8897a9217aSAntonio Huete Jimenez #define NFULA_SEQ_GLOBAL 13 /* sequence number of pakets on all NFLOG sockets */ 8997a9217aSAntonio Huete Jimenez #define NFULA_GID 14 /* GID owning socket on which packet was sent/received */ 9097a9217aSAntonio Huete Jimenez #define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */ 9197a9217aSAntonio Huete Jimenez #define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */ 9297a9217aSAntonio Huete Jimenez #define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */ 9397a9217aSAntonio Huete Jimenez 9497a9217aSAntonio Huete Jimenez #endif 95