NflogLayer.h

Go to the documentation of this file.

#ifndef PACKETPP_NFLOG_LAYER
#define PACKETPP_NFLOG_LAYER

#include "Layer.h"
#include "TLVData.h"
#include "GeneralUtils.h"


namespace pcpp
{
#pragma pack(push, 1)
    struct nflog_header
    {
        uint8_t addressFamily;
        uint8_t version;
        uint16_t resourceId;
    };
#pragma pack(pop)

    enum class NflogTlvType
    {
        NFULA_PACKET_HDR            = 1,
        NFULA_MARK                  = 2,
        NFULA_TIMESTAMP             = 3,
        NFULA_IFINDEX_INDEV         = 4,
        NFULA_IFINDEX_OUTDEV        = 5,
        NFULA_IFINDEX_PHYSINDEV     = 6,
        NFULA_IFINDEX_PHYSOUTDEV    = 7,
        NFULA_HWADDR                = 8,
        NFULA_PAYLOAD               = 9,
        NFULA_PREFIX                = 10,
        NFULA_UID                   = 11,
        NFULA_SEQ                   = 12,
        NFULA_SEQ_GLOBAL            = 13,
        NFULA_GID                   = 14,
        NFULA_HWTYPE                = 15,
        NFULA_HWHEADER              = 16,
        NFULA_HWLEN                 = 17,
    };

    class NflogTlv
    {
    private:
        struct NflogTLVRawData
        {
            uint16_t recordLen;
            uint16_t recordType;
            uint8_t recordValue[];
        };
        NflogTLVRawData* m_Data;
    public:
        explicit NflogTlv(uint8_t* recordRawData)
        {
            assign(recordRawData);
        }

        size_t getTotalSize() const
        {
            // as in https://github.com/the-tcpdump-group/libpcap/blob/766b607d60d8038087b49fc4cf433dac3dcdb49c/pcap-util.c#L371-L374
            return align<4>(m_Data->recordLen);
        }

        void assign(uint8_t* recordRawData)
        {
            m_Data = (NflogTLVRawData*)recordRawData;
        }

        bool isNull() const
        {
            return (m_Data == nullptr);
        }

        uint16_t getType() const { return m_Data->recordType; }

        uint8_t* getRecordBasePtr() const { return (uint8_t*)m_Data; }

        uint8_t* getValue() const { return m_Data->recordValue; }
    };

    class NflogLayer : public Layer
    {
    public:
        NflogLayer(uint8_t* data, size_t dataLen, Packet* packet) : Layer(data, dataLen, NULL, packet) { m_Protocol = NFLOG; }

        ~NflogLayer() {}

        nflog_header* getNflogHeader() const { return (nflog_header*)m_Data; }

        uint8_t getFamily();

        uint8_t getVersion();

        uint16_t getResourceId();

        NflogTlv getTlvByType(NflogTlvType type) const;

        // implement abstract methods

        void parseNextLayer();

        size_t getHeaderLen() const;

        void computeCalculateFields() {};

        std::string toString() const;

        OsiModelLayer getOsiModelLayer() const { return OsiModelDataLinkLayer; }

        static bool isDataValid(const uint8_t* data, size_t dataLen);

    private:
        uint8_t* getTlvsBasePtr() const { return m_Data + sizeof(nflog_header); }

        TLVRecordReader<NflogTlv> m_TlvReader;
    };

} // namespace pcpp

#endif /* PACKETPP_NFLOG_LAYER */