1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2 #pragma once
3 
4 /*
5  * For details about the file format see RFC:
6  *   https://www.ietf.org/id/draft-tuexen-opsawg-pcapng-03.html
7  *  and
8  *    https://github.com/pcapng/pcapng/
9  */
10 enum pcapng_block_types {
11         PCAPNG_INTERFACE_BLOCK = 1,
12         PCAPNG_PACKET_BLOCK,		/* Obsolete */
13         PCAPNG_SIMPLE_PACKET_BLOCK,
14         PCAPNG_NAME_RESOLUTION_BLOCK,
15         PCAPNG_INTERFACE_STATS_BLOCK,
16         PCAPNG_ENHANCED_PACKET_BLOCK,
17 
18         PCAPNG_SECTION_BLOCK   = 0x0A0D0D0A,
19 };
20 
21 struct pcapng_option {
22         uint16_t code;
23         uint16_t length;
24         uint8_t data[];
25 };
26 
27 #define PCAPNG_BYTE_ORDER_MAGIC 0x1A2B3C4D
28 #define PCAPNG_MAJOR_VERS 1
29 #define PCAPNG_MINOR_VERS 0
30 
31 enum pcapng_opt {
32         PCAPNG_OPT_END     = 0,
33         PCAPNG_OPT_COMMENT = 1,
34 };
35 
36 struct pcapng_section {
37         uint32_t block_type;
38         uint32_t block_length;
39         uint32_t byte_order_magic;
40         uint16_t major_version;
41         uint16_t minor_version;
42         uint64_t section_length;
43 };
44 
45 enum pcapng_section_opt {
46         PCAPNG_SHB_HARDWARE = 2,
47         PCAPNG_SHB_OS       = 3,
48         PCAPNG_SHB_USERAPPL = 4,
49 };
50 
51 struct pcapng_interface_block {
52         uint32_t block_type;	/* 1 */
53         uint32_t block_length;
54         uint16_t link_type;
55         uint16_t reserved;
56         uint32_t snap_len;
57 };
58 
59 enum pcapng_interface_options {
60         PCAPNG_IFB_NAME	 = 2,
61         PCAPNG_IFB_DESCRIPTION,
62         PCAPNG_IFB_IPV4ADDR,
63         PCAPNG_IFB_IPV6ADDR,
64         PCAPNG_IFB_MACADDR,
65         PCAPNG_IFB_EUIADDR,
66         PCAPNG_IFB_SPEED,
67         PCAPNG_IFB_TSRESOL,
68         PCAPNG_IFB_TZONE,
69         PCAPNG_IFB_FILTER,
70         PCAPNG_IFB_OS,
71         PCAPNG_IFB_FCSLEN,
72         PCAPNG_IFB_TSOFFSET,
73         PCAPNG_IFB_HARDWARE,
74 };
75 
76 struct pcapng_enhance_packet_block {
77         uint32_t block_type;	/* 6 */
78         uint32_t block_length;
79         uint32_t interface_id;
80         uint32_t timestamp_hi;
81         uint32_t timestamp_lo;
82         uint32_t capture_length;
83         uint32_t original_length;
84 };
85 
86 /* Flags values */
87 #define PCAPNG_IFB_INBOUND   0b01
88 #define PCAPNG_IFB_OUTBOUND  0b10
89 
90 enum pcapng_epb_options {
91         PCAPNG_EPB_FLAGS = 2,
92         PCAPNG_EPB_HASH,
93         PCAPNG_EPB_DROPCOUNT,
94         PCAPNG_EPB_PACKETID,
95         PCAPNG_EPB_QUEUE,
96         PCAPNG_EPB_VERDICT,
97 };
98 
99 struct pcapng_statistics_block {
100         uint32_t block_type;	/* 5 */
101         uint32_t block_length;
102         uint32_t interface_id;
103         uint32_t timestamp_hi;
104         uint32_t timestamp_lo;
105 };
106 
107 enum pcapng_isb_options {
108         PCAPNG_ISB_STARTTIME = 2,
109         PCAPNG_ISB_ENDTIME,
110         PCAPNG_ISB_IFRECV,
111         PCAPNG_ISB_IFDROP,
112         PCAPNG_ISB_FILTERACCEPT,
113         PCAPNG_ISB_OSDROP,
114         PCAPNG_ISB_USRDELIV,
115 };
116