nflog.h

Go to the documentation of this file.

/*
 * Copyright (c) 2013, Petar Alilovic,
 * Faculty of Electrical Engineering and Computing, University of Zagreb
 * All rights reserved
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * * Redistributions of source code must retain the above copyright notice,
 *   this list of conditions and the following disclaimer.
 * * Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in the
 *   documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
 
#ifndef lib_pcap_nflog_h
#define lib_pcap_nflog_h
 
#include <pcap/pcap-inttypes.h>
 
/*
 * Structure of an NFLOG header and TLV parts, as described at
 * https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html
 *
 * The NFLOG header is big-endian.
 *
 * The TLV length and type are in host byte order.  The value is either
 * big-endian or is an array of bytes in some externally-specified byte
 * order (text string, link-layer address, link-layer header, packet
 * data, etc.).
 */
typedef struct nflog_hdr {
    uint8_t     nflog_family;   /* address family */
    uint8_t     nflog_version;  /* version */
    uint16_t    nflog_rid;  /* resource ID */
} nflog_hdr_t;
 
typedef struct nflog_tlv {
    uint16_t    tlv_length; /* tlv length */
    uint16_t    tlv_type;   /* tlv type */
    /* value follows this */
} nflog_tlv_t;
 
typedef struct nflog_packet_hdr {
    uint16_t    hw_protocol;    /* hw protocol */
    uint8_t     hook;       /* netfilter hook */
    uint8_t     pad;        /* padding to 32 bits */
} nflog_packet_hdr_t;
 
typedef struct nflog_hwaddr {
    uint16_t    hw_addrlen; /* address length */
    uint16_t    pad;        /* padding to 32-bit boundary */
    uint8_t     hw_addr[8]; /* address, up to 8 bytes */
} nflog_hwaddr_t;
 
typedef struct nflog_timestamp {
    uint64_t    sec;
    uint64_t    usec;
} nflog_timestamp_t;
 
/*
 * TLV types.
 */
#define NFULA_PACKET_HDR        1   /* nflog_packet_hdr_t */
#define NFULA_MARK          2   /* packet mark from skbuff */
#define NFULA_TIMESTAMP         3   /* nflog_timestamp_t for skbuff's time stamp */
#define NFULA_IFINDEX_INDEV     4   /* ifindex of device on which packet received (possibly bridge group) */
#define NFULA_IFINDEX_OUTDEV        5   /* ifindex of device on which packet transmitted (possibly bridge group) */
#define NFULA_IFINDEX_PHYSINDEV     6   /* ifindex of physical device on which packet received (not bridge group) */
#define NFULA_IFINDEX_PHYSOUTDEV    7   /* ifindex of physical device on which packet transmitted (not bridge group) */
#define NFULA_HWADDR            8   /* nflog_hwaddr_t for hardware address */
#define NFULA_PAYLOAD           9   /* packet payload */
#define NFULA_PREFIX            10  /* text string - null-terminated, count includes NUL */
#define NFULA_UID           11  /* UID owning socket on which packet was sent/received */
#define NFULA_SEQ           12  /* sequence number of packets on this NFLOG socket */
#define NFULA_SEQ_GLOBAL        13  /* sequence number of pakets on all NFLOG sockets */
#define NFULA_GID           14  /* GID owning socket on which packet was sent/received */
#define NFULA_HWTYPE            15  /* ARPHRD_ type of skbuff's device */
#define NFULA_HWHEADER          16  /* skbuff's MAC-layer header */
#define NFULA_HWLEN         17  /* length of skbuff's MAC-layer header */
 
#endif