Wireshark  4.3.0
The Wireshark network protocol analyzer
packet-netlink.h
1 /* packet-netlink.h
2  *
3  * Wireshark - Network traffic analyzer
4  * By Gerald Combs <gerald@wireshark.org>
5  * Copyright 2001 Gerald Combs
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  */
9 
10 #ifndef __PACKET_NETLINK_H__
11 #define __PACKET_NETLINK_H__
12 
13 #include <epan/value_string.h>
14 
15 /* from <include/uapi/linux/netlink.h> prefixed with WS_ */
16 enum {
17  WS_NETLINK_ROUTE = 0,
18  WS_NETLINK_UNUSED = 1,
19  WS_NETLINK_USERSOCK = 2,
20  WS_NETLINK_FIREWALL = 3,
21  WS_NETLINK_SOCK_DIAG = 4,
22  WS_NETLINK_NFLOG = 5,
23  WS_NETLINK_XFRM = 6,
24  WS_NETLINK_SELINUX = 7,
25  WS_NETLINK_ISCSI = 8,
26  WS_NETLINK_AUDIT = 9,
27  WS_NETLINK_FIB_LOOKUP = 10,
28  WS_NETLINK_CONNECTOR = 11,
29  WS_NETLINK_NETFILTER = 12,
30  WS_NETLINK_IP6_FW = 13,
31  WS_NETLINK_DNRTMSG = 14,
32  WS_NETLINK_KOBJECT_UEVENT = 15,
33  WS_NETLINK_GENERIC = 16,
34  /* leave room for NETLINK_DM (DM Events) */
35  WS_NETLINK_SCSITRANSPORT = 18,
36  WS_NETLINK_ECRYPTFS = 19,
37  WS_NETLINK_RDMA = 20,
38  WS_NETLINK_CRYPTO = 21,
39  WS_NETLINK_SMC = 22
40 };
41 
42 /* from <include/uapi/linux/netlink.h> prefixed with WS_ */
43 enum {
44  WS_NLM_F_REQUEST = 1, /* It is request message.*/
45  WS_NLM_F_MULTI = 2, /* Multipart message, terminated by NETLINK_MSG_DONE */
46  WS_NLM_F_ACK = 4, /* Reply with ack, with zero or error code */
47  WS_NLM_F_ECHO = 8, /* Echo this request */
48  WS_NLM_F_DUMP_INTR = 16, /* Dump was inconsistent due to sequence change */
49  WS_NLM_F_DUMP_FILTERED = 32, /* Dump was filtered as requested */
50 
51  /* Modifiers to Get request */
52  WS_NLM_F_ROOT = 0x100, /* specify tree root */
53  WS_NLM_F_MATCH = 0x200, /* return all matching */
54  WS_NLM_F_ATOMIC = 0x400, /* return an atomic snapshot of the table */
55 
56  /* Modifiers to NEW request */
57  WS_NLM_F_REPLACE = 0x100, /* Override existing */
58  WS_NLM_F_EXCL = 0x200, /* Do not touch, if it exists */
59  WS_NLM_F_CREATE = 0x400, /* Create, if it does */
60  WS_NLM_F_APPEND = 0x800, /* Add to end of list */
61 
62  /* Modifiers to DELETE request */
63  WS_NLM_F_NONREC = 0x100, /* Do not delete recursively */
64 
65  /* Flags for ACK message */
66  WS_NLM_F_CAPPED = 0x100, /* request was capped */
67  WS_NLM_F_ACK_TLVS = 0x200 /* extended ACK TLVs were included */
68 };
69 
70 
71 extern value_string_ext netlink_family_vals_ext;
72 
73 enum {
74  WS_NLMSG_NOOP = 0x01,
75  WS_NLMSG_ERROR = 0x02,
76  WS_NLMSG_DONE = 0x03,
77  WS_NLMSG_OVERRUN = 0x04,
78  WS_NLMSG_MIN_TYPE = 0x10
79 };
80 
81 /* from <include/uapi/linux/netfilter.h>. Looks like AF_xxx, except for NFPROTO_ARP */
82 enum ws_nfproto {
83  WS_NFPROTO_UNSPEC = 0,
84  WS_NFPROTO_INET = 1,
85  WS_NFPROTO_IPV4 = 2,
86  WS_NFPROTO_ARP = 3,
87  WS_NFPROTO_NETDEV = 5,
88  WS_NFPROTO_BRIDGE = 7,
89  WS_NFPROTO_IPV6 = 10,
90  WS_NFPROTO_DECNET = 12,
91 };
92 extern const value_string nfproto_family_vals[];
93 extern const value_string netfilter_hooks_vals[];
94 
95 #define PACKET_NETLINK_MAGIC 0x4A5ACCCE
96 
98  guint32 magic; /* PACKET_NETLINK_MAGIC */
99 
100  int encoding;
101  guint16 type;
102 };
103 
108 int dissect_netlink_header(tvbuff_t *tvb, proto_tree *tree, int offset, int encoding, int hf_type, proto_item **pi_type);
109 
110 typedef int netlink_attributes_cb_t(tvbuff_t *tvb, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int nla_type, int offset, int len);
111 
112 int dissect_netlink_attributes(tvbuff_t *tvb, int hf_type, int ett, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int offset, int length, netlink_attributes_cb_t cb);
113 
114 int dissect_netlink_attributes_to_end(tvbuff_t *tvb, int hf_type, int ett, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int offset, netlink_attributes_cb_t cb);
115 
116 /*
117  * Similar to dissect_netlink_attributes, but used to parse nested attributes
118  * that model an array of attributes. The first level (tree ett_array) contains
119  * array elements and its type field is the array index. The next level (tree
120  * ett_attrib) contains attributes (where hfi_type applies).
121  */
122 int dissect_netlink_attributes_array(tvbuff_t *tvb, int hf_type, int ett_array, int ett_attrib, void *data, struct packet_netlink_data *nl_data, proto_tree *tree, int offset, int length, netlink_attributes_cb_t cb);
123 
124 #define NLA_F_NESTED 0x8000
125 #define NLA_F_NET_BYTEORDER 0x4000
126 #define NLA_TYPE_MASK 0x3fff
127 
128 
129 /*
130  * Format of the data that is passed to "genl.family" dissectors.
131  */
132 typedef struct {
133  struct packet_netlink_data *nl_data;
134 
135  /* For internal use by genl. */
136  proto_tree *genl_tree;
137 
138  /* fields from genlmsghdr */
139  guint8 cmd; /* Command number */
140 
141  /* XXX This should contain a family version number as well. */
142 } genl_info_t;
143 
144 int dissect_genl_header(tvbuff_t *tvb, genl_info_t *genl_info, struct packet_netlink_data *nl_data, int hf_cmd);
145 
146 #endif /* __PACKET_NETLINK_H__ */
147 
148 /*
149  * Editor modelines - https://www.wireshark.org/tools/modelines.html
150  *
151  * Local variables:
152  * c-basic-offset: 8
153  * tab-width: 8
154  * indent-tabs-mode: t
155  * End:
156  *
157  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
158  * :indentSize=8:tabSize=8:noTabs=false:
159  */
Definition: proto.h:904
Definition: value_string.h:170
Definition: value_string.h:26
Definition: packet-netlink.h:132
Definition: tvbuff-int.h:35