1 /* $NetBSD: nflog.h,v 1.2 2014/11/19 19:33:31 christos Exp $ */
4 * Copyright (c) 2013, Petar Alilovic,
5 * Faculty of Electrical Engineering and Computing, University of Zagreb
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
11 * * Redistributions of source code must retain the above copyright notice,
12 * this list of conditions and the following disclaimer.
13 * * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
23 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
24 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
30 #ifndef _PCAP_NFLOG_H__
31 #define _PCAP_NFLOG_H__
34 * Structure of an NFLOG header and TLV parts, as described at
35 * http://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html
37 * The NFLOG header is big-endian.
39 * The TLV length and type are in host byte order. The value is either
40 * big-endian or is an array of bytes in some externally-specified byte
41 * order (text string, link-layer address, link-layer header, packet
44 typedef struct nflog_hdr
{
45 u_int8_t nflog_family
; /* address family */
46 u_int8_t nflog_version
; /* version */
47 u_int16_t nflog_rid
; /* resource ID */
50 typedef struct nflog_tlv
{
51 u_int16_t tlv_length
; /* tlv length */
52 u_int16_t tlv_type
; /* tlv type */
53 /* value follows this */
56 typedef struct nflog_packet_hdr
{
57 u_int16_t hw_protocol
; /* hw protocol */
58 u_int8_t hook
; /* netfilter hook */
59 u_int8_t pad
; /* padding to 32 bits */
62 typedef struct nflog_hwaddr
{
63 u_int16_t hw_addrlen
; /* address length */
64 u_int16_t pad
; /* padding to 32-bit boundary */
65 u_int8_t hw_addr
[8]; /* address, up to 8 bytes */
68 typedef struct nflog_timestamp
{
76 #define NFULA_PACKET_HDR 1 /* nflog_packet_hdr_t */
77 #define NFULA_MARK 2 /* packet mark from skbuff */
78 #define NFULA_TIMESTAMP 3 /* nflog_timestamp_t for skbuff's time stamp */
79 #define NFULA_IFINDEX_INDEV 4 /* ifindex of device on which packet received (possibly bridge group) */
80 #define NFULA_IFINDEX_OUTDEV 5 /* ifindex of device on which packet transmitted (possibly bridge group) */
81 #define NFULA_IFINDEX_PHYSINDEV 6 /* ifindex of physical device on which packet received (not bridge group) */
82 #define NFULA_IFINDEX_PHYSOUTDEV 7 /* ifindex of physical device on which packet transmitted (not bridge group) */
83 #define NFULA_HWADDR 8 /* nflog_hwaddr_t for hardware address */
84 #define NFULA_PAYLOAD 9 /* packet payload */
85 #define NFULA_PREFIX 10 /* text string - null-terminated, count includes NUL */
86 #define NFULA_UID 11 /* UID owning socket on which packet was sent/received */
87 #define NFULA_SEQ 12 /* sequence number of packets on this NFLOG socket */
88 #define NFULA_SEQ_GLOBAL 13 /* sequence number of pakets on all NFLOG sockets */
89 #define NFULA_GID 14 /* GID owning socket on which packet was sent/received */
90 #define NFULA_HWTYPE 15 /* ARPHRD_ type of skbuff's device */
91 #define NFULA_HWHEADER 16 /* skbuff's MAC-layer header */
92 #define NFULA_HWLEN 17 /* length of skbuff's MAC-layer header */