NflogLayer.h

Go to the documentation of this file.

#pragma once
 
#include "Layer.h"
#include "TLVData.h"
#include "GeneralUtils.h"
 
 
namespace pcpp
{
#pragma pack(push, 1)
    struct nflog_header
    {
        uint8_t addressFamily;
        uint8_t version;
        uint16_t resourceId;
    };
#pragma pack(pop)
    static_assert(sizeof(nflog_header) == 4, "nflog_header size is not 4 bytes");
 
    enum class NflogTlvType
    {
        NFULA_PACKET_HDR = 1,
        NFULA_MARK = 2,
        NFULA_TIMESTAMP = 3,
        NFULA_IFINDEX_INDEV = 4,
        NFULA_IFINDEX_OUTDEV = 5,
        NFULA_IFINDEX_PHYSINDEV = 6,
        NFULA_IFINDEX_PHYSOUTDEV = 7,
        NFULA_HWADDR = 8,
        NFULA_PAYLOAD = 9,
        NFULA_PREFIX = 10,
        NFULA_UID = 11,
        NFULA_SEQ = 12,
        NFULA_SEQ_GLOBAL = 13,
        NFULA_GID = 14,
        NFULA_HWTYPE = 15,
        NFULA_HWHEADER = 16,
        NFULA_HWLEN = 17,
    };
 
    class NflogTlv
    {
    private:
        struct NflogTLVRawData
        {
            uint16_t recordLen;
            uint16_t recordType;
            uint8_t recordValue[];
        };
        NflogTLVRawData* m_Data;
 
    public:
        explicit NflogTlv(uint8_t* recordRawData)
        {
            assign(recordRawData);
        }
 
        size_t getTotalSize() const
        {
            // as in
            // https://github.com/the-tcpdump-group/libpcap/blob/766b607d60d8038087b49fc4cf433dac3dcdb49c/pcap-util.c#L371-L374
            return align<4>(m_Data->recordLen);
        }
 
        void assign(uint8_t* recordRawData)
        {
            m_Data = reinterpret_cast<NflogTLVRawData*>(recordRawData);
        }
 
        static bool canAssign(const uint8_t* recordRawData, size_t tlvDataLen)
        {
            return recordRawData != nullptr && tlvDataLen >= sizeof(NflogTLVRawData::recordLen);
        }
 
        bool isNull() const
        {
            return (m_Data == nullptr);
        }
 
        uint16_t getType() const
        {
            return m_Data->recordType;
        }
 
        uint8_t* getRecordBasePtr() const
        {
            return reinterpret_cast<uint8_t*>(m_Data);
        }
 
        uint8_t* getValue() const
        {
            return m_Data->recordValue;
        }
    };
 
    class NflogLayer : public Layer
    {
    public:
        NflogLayer(uint8_t* data, size_t dataLen, Packet* packet) : Layer(data, dataLen, nullptr, packet, NFLOG)
        {}
 
        ~NflogLayer() override = default;
 
        nflog_header* getNflogHeader() const
        {
            return reinterpret_cast<nflog_header*>(m_Data);
        }
 
        uint8_t getFamily() const;
 
        uint8_t getVersion() const;
 
        uint16_t getResourceId() const;
 
        NflogTlv getTlvByType(NflogTlvType type) const;
 
        // implement abstract methods
 
        void parseNextLayer() override;
 
        size_t getHeaderLen() const override;
 
        void computeCalculateFields() override {};
 
        std::string toString() const override;
 
        OsiModelLayer getOsiModelLayer() const override
        {
            return OsiModelDataLinkLayer;
        }
 
        static bool isDataValid(const uint8_t* data, size_t dataLen);
 
        struct SerializedFields : Layer::SerializedFields
        {
            static std::vector<FieldDescriptor> all()
            {
                auto result = Layer::SerializedFields::all();
                std::initializer_list<FieldDescriptor> extra{ Family, Version, ResourceID, Attributes };
                std::copy(extra.begin(), extra.end(), std::back_inserter(result));
                return result;
            }
 
            static const FieldDescriptor Family;
 
            static const FieldDescriptor Version;
 
            static const FieldDescriptor ResourceID;
 
            static const FieldDescriptor Attributes;
 
            static const FieldDescriptor Attribute;
        };
 
    protected:
        void serializeLayer(ObjectScope& serializer) const override;
 
    private:
        uint8_t* getTlvsBasePtr() const
        {
            return m_Data + sizeof(nflog_header);
        }
 
        TLVRecordReader<NflogTlv> m_TlvReader;
    };
 
}  // namespace pcpp