epan/dissectors/packet-netlink.h

   1 /* packet-netlink.h
   2  *
   3  * Wireshark - Network traffic analyzer
   4  * By Gerald Combs <gerald@wireshark.org>
   5  * Copyright 2001 Gerald Combs
   6  *
   7  * SPDX-License-Identifier: GPL-2.0-or-later
   8  */
   9
  10 #ifndef __PACKET_NETLINK_H__
  11 #define __PACKET_NETLINK_H__
  12
  13 #include <epan/value_string.h>
  14
  15 /* from <include/uapi/linux/netlink.h> prefixed with WS_ */
  16 enum {
  17         WS_NETLINK_ROUTE = 0,
  18         WS_NETLINK_UNUSED = 1,
  19         WS_NETLINK_USERSOCK = 2,
  20         WS_NETLINK_FIREWALL = 3,
  21         WS_NETLINK_SOCK_DIAG = 4,
  22         WS_NETLINK_NFLOG = 5,
  23         WS_NETLINK_XFRM = 6,
  24         WS_NETLINK_SELINUX = 7,
  25         WS_NETLINK_ISCSI = 8,
  26         WS_NETLINK_AUDIT = 9,
  27         WS_NETLINK_FIB_LOOKUP = 10,
  28         WS_NETLINK_CONNECTOR = 11,
  29         WS_NETLINK_NETFILTER = 12,
  30         WS_NETLINK_IP6_FW = 13,
  31         WS_NETLINK_DNRTMSG = 14,
  32         WS_NETLINK_KOBJECT_UEVENT = 15,
  33         WS_NETLINK_GENERIC = 16,
  34         /* leave room for NETLINK_DM (DM Events) */
  35         WS_NETLINK_SCSITRANSPORT = 18,
  36         WS_NETLINK_ECRYPTFS = 19,
  37         WS_NETLINK_RDMA = 20,
  38         WS_NETLINK_CRYPTO = 21,
  39         WS_NETLINK_SMC = 22
  40 };
  41
  42 /* from <include/uapi/linux/netlink.h> prefixed with WS_ */
  43 enum {
  44         WS_NLM_F_REQUEST = 1,    /* It is request message.*/
  45         WS_NLM_F_MULTI = 2,      /* Multipart message, terminated by NETLINK_MSG_DONE */
  46         WS_NLM_F_ACK = 4,        /* Reply with ack, with zero or error code */
  47         WS_NLM_F_ECHO = 8,       /* Echo this request */
  48         WS_NLM_F_DUMP_INTR = 16, /* Dump was inconsistent due to sequence change */
  49         WS_NLM_F_DUMP_FILTERED = 32, /* Dump was filtered as requested */
  50
  51         /* Modifiers to Get request */
  52         WS_NLM_F_ROOT = 0x100,   /* specify tree root */
  53         WS_NLM_F_MATCH = 0x200,  /* return all matching */
  54         WS_NLM_F_ATOMIC = 0x400, /* return an atomic snapshot of the table */
  55
  56         /* Modifiers to NEW request */
  57         WS_NLM_F_REPLACE = 0x100,  /* Override existing */
  58         WS_NLM_F_EXCL = 0x200,     /* Do not touch, if it exists */
  59         WS_NLM_F_CREATE = 0x400,   /* Create, if it does */
  60         WS_NLM_F_APPEND = 0x800,   /* Add to end of list */
  61
  62         /* Modifiers to DELETE request */
  63         WS_NLM_F_NONREC = 0x100,   /* Do not delete recursively */
  64
  65         /* Flags for ACK message */
  66         WS_NLM_F_CAPPED = 0x100,   /* request was capped */
  67         WS_NLM_F_ACK_TLVS = 0x200  /* extended ACK TLVs were included */
  68 };
  69
  70
  71 extern value_string_ext netlink_family_vals_ext;
  72
  73 enum {
  74         WS_NLMSG_NOOP     = 0x01,
  75         WS_NLMSG_ERROR    = 0x02,
  76         WS_NLMSG_DONE     = 0x03,
  77         WS_NLMSG_OVERRUN  = 0x04,
  78         WS_NLMSG_MIN_TYPE     = 0x10    /** type < WS_NLMSG_MIN_TYPE are reserved */
  79 };
  80
  81 /* from <include/uapi/linux/netfilter.h>. Looks like AF_xxx, except for NFPROTO_ARP */
  82 enum ws_nfproto {
  83         WS_NFPROTO_UNSPEC =  0,
  84         WS_NFPROTO_INET   =  1,
  85         WS_NFPROTO_IPV4   =  2,
  86         WS_NFPROTO_ARP    =  3,
  87         WS_NFPROTO_NETDEV =  5,
  88         WS_NFPROTO_BRIDGE =  7,
  89         WS_NFPROTO_IPV6   = 10,
  90         WS_NFPROTO_DECNET = 12,
  91 };
  92 extern const value_string nfproto_family_vals[];
  93 extern const value_string netfilter_hooks_vals[];
  94
  95 #define PACKET_NETLINK_MAGIC 0x4A5ACCCE
  96
  97 struct packet_netlink_data {
  98         uint32_t magic; /* PACKET_NETLINK_MAGIC */
  99
 100         int encoding;
 101         uint16_t type;
 102 };
 103
 104 /**
 105  * Dissects the Netlink message header (struct nlmsghdr). The "hfi_type" field
 106  * is added for the "nlmsg_type" field and returned into pi_type.
 107  */
 108 int dissect_netlink_header(tvbuff_t *tvb, proto_tree *tree, int offset, int encoding, int hf_type, proto_item **pi_type);
 109
 110 typedef int netlink_attributes_cb_t(tvbuff_t *tvb, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int nla_type, int offset, int len);
 111
 112 int dissect_netlink_attributes(tvbuff_t *tvb, int hf_type, int ett, void *data, struct packet_netlink_data *nl_data,  proto_tree *tree, int offset, int length, netlink_attributes_cb_t cb);
 113
 114 int dissect_netlink_attributes_to_end(tvbuff_t *tvb, int hf_type, int ett, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int offset, netlink_attributes_cb_t cb);
 115
 116 /*
 117  * Similar to dissect_netlink_attributes, but used to parse nested attributes
 118  * that model an array of attributes. The first level (tree ett_array) contains
 119  * array elements and its type field is the array index. The next level (tree
 120  * ett_attrib) contains attributes (where hfi_type applies).
 121  */
 122 int dissect_netlink_attributes_array(tvbuff_t *tvb, int hf_type, int ett_array, int ett_attrib, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int offset, int length, netlink_attributes_cb_t cb);
 123
 124 #define NLA_F_NESTED            0x8000
 125 #define NLA_F_NET_BYTEORDER     0x4000
 126 #define NLA_TYPE_MASK           0x3fff
 127
 128
 129 /*
 130  * Format of the data that is passed to "genl.family" dissectors.
 131  */
 132 typedef struct {
 133         struct packet_netlink_data *nl_data;
 134
 135         /* For internal use by genl. */
 136         proto_tree     *genl_tree;
 137
 138         /* fields from genlmsghdr */
 139         uint8_t                 cmd; /* Command number */
 140
 141         /* XXX This should contain a family version number as well. */
 142 } genl_info_t;
 143
 144 int dissect_genl_header(tvbuff_t *tvb, genl_info_t *genl_info, struct packet_netlink_data *nl_data, int hf_cmd);
 145
 146 #endif /* __PACKET_NETLINK_H__ */
 147
 148 /*
 149  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 150  *
 151  * Local variables:
 152  * c-basic-offset: 8
 153  * tab-width: 8
 154  * indent-tabs-mode: t
 155  * End:
 156  *
 157  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 158  * :indentSize=8:tabSize=8:noTabs=false:
 159  */