layers

type ARPOperation struct {
	Val  Operation
	Desc string
}

type ARPPacket struct {
	HardwareType     uint16        // Network link protocol type.
	ProtocolType     uint16        // Internetwork protocol for which the ARP request is intended.
	ProtocolTypeDesc string        // Internetwork protocol description.
	Hlen             uint8         // Length (in octets) of a hardware address.
	Plen             uint8         // Length (in octets) of internetwork addresses.
	Op               *ARPOperation // Specifies the operation that the sender is performing.
	// Media address of the sender. In an ARP request this field is used to indicate
	// the address of the host sending the request. In an ARP reply this field is used
	// to indicate the address of the host that the request was looking for.
	SenderMAC net.HardwareAddr
	SenderIP  netip.Addr // Internetwork address of the sender.
	// Media address of the intended receiver. In an ARP request this field is ignored.
	// In an ARP reply this field is used to indicate the address of the host that originated the ARP request.
	TargetMAC net.HardwareAddr
	TargetIP  netip.Addr // Internetwork address of the intended receiver.
	DstVendor string
	SrcVendor string
}

type CipherSuite struct {
	Value uint16
	Desc  string
}

type DNSFlags struct {
	Raw        uint16 `json:"raw"`
	QR         uint8  `json:"qr"`     // Indicates if the message is a query (0) or a reply (1).
	QRDesc     string `json:"qrdesc"` // Query (0) or Reply (1)
	OPCode     uint8  `json:"opcode"` // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-5
	OPCodeDesc string `json:"opcodedesc"`
	AA         uint8  `json:"aa"`    // Authoritative Answer, in a response, indicates if the DNS server is authoritative for the queried hostname.
	TC         uint8  `json:"tc"`    // TrunCation, indicates that this message was truncated due to excessive length.
	RD         uint8  `json:"rd"`    // Recursion Desired, indicates if the client means a recursive query.
	RA         uint8  `json:"ra"`    // Recursion Available, in a response, indicates if the replying DNS server supports recursion.
	Z          uint8  `json:"z"`     // Zero, reserved for future use.
	AU         uint8  `json:"au"`    // Indicates if answer/authority portion was authenticated by the server.
	NA         uint8  `json:"na"`    // Indicates if non-authenticated data is accepatable.
	RCode      uint8  `json:"rcode"` // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
	RCodeDesc  string `json:"rcodedesc"`
}

type DNSMessage struct {
	TransactionID uint16            `json:"transaction-id"`       // Used for matching response to queries.
	Flags         *DNSFlags         `json:"flags,omitempty"`      // Flags specify the requested operation and a response code.
	QDCount       uint16            `json:"questions-count"`      // Count of entries in the queries section.
	ANCount       uint16            `json:"answer-rrs-count"`     //  Count of entries in the answers section.
	NSCount       uint16            `json:"authority-rrs-count"`  // Count of entries in the authority section.
	ARCount       uint16            `json:"additional-rrs-count"` // Count of entries in the additional section.
	Questions     []*QueryEntry     `json:"questions,omitempty"`
	AnswerRRs     []*ResourceRecord `json:"answers,omitempty"`
	AuthorityRRs  []*ResourceRecord `json:"authoritative-nameservers,omitempty"`
	AdditionalRRs []*ResourceRecord `json:"additional-records,omitempty"`
}

type EtherType uint16

type EthernetFrame struct {
	DstMAC    net.HardwareAddr // MAC address of the destination device.
	SrcMAC    net.HardwareAddr // MAC address of the source device.
	EtherType *EthernetType    // The protocol of the upper layer.
	Payload   []byte
	DstVendor string
	SrcVendor string
}

type EthernetType struct {
	Val  EtherType
	Desc string // Protocol description
}

type Extension struct {
	Value uint16
	Desc  string
}

type FTPMessage struct {
	// contains filtered or unexported fields
}

type HSTLSParser interface {
	ParseHS(data []byte) error
}

type HTTPMessage struct {
	Request  *http.Request
	Response *http.Response
}

type HTTPRequest struct {
	Host          string      `json:"host,omitempty"`
	URI           string      `json:"uri,omitempty"`
	Method        string      `json:"method,omitempty"`
	Proto         string      `json:"proto,omitempty"`
	ContentLength int         `json:"content-length,omitempty"`
	Header        http.Header `json:"header,omitempty"`
}

type HTTPRequestWrapper struct {
	Request *HTTPRequest `json:"http_request"`
}

type HTTPResponse struct {
	Proto         string      `json:"proto,omitempty"`
	Status        string      `json:"status,omitempty"`
	ContentLength int         `json:"content-length,omitempty"`
	Header        http.Header `json:"header,omitempty"`
}

type HTTPResponseWrapper struct {
	Response *HTTPResponse `json:"http_response"`
}

type ICMPSegment struct {
	Type     uint8  // ICMP type.
	TypeDesc string // ICMP type description.
	Code     uint8  // ICMP subtype.
	CodeDesc string // ICMP subtype description.
	// Internet checksum (RFC 1071) for error checking, calculated from the ICMP header
	// and data with value 0 substituted for this field.
	Checksum uint16
	Data     []byte // Contents vary based on the ICMP type and code.
}

type ICMPv6Segment struct {
	Type     uint8
	TypeDesc string
	Code     uint8
	CodeDesc string
	Checksum uint16
	Data     []byte
}

type IPProto uint8

type IPv4Flags struct {
	Raw      uint8
	Reserved uint8
	DF       uint8
	MF       uint8
}

type IPv4Packet struct {
	// Internet Protocol version 4 is described in IETF publication RFC 791.
	Version        uint8      // 4 bits version (for IPv4, this is always equal to 4).
	IHL            uint8      // 4 bits size of header (number of 32-bit words).
	DSCP           uint8      // 6 bits specifies differentiated services.
	DSCPDesc       string     // differentiated services description.
	ECN            uint8      // 2 bits end-to-end notification of network congestion without dropping packets.
	TotalLength    uint16     // 16 bits defines the entire packet size in bytes, including header and data.
	Identification uint16     // 16 bits identifies the group of fragments of a single IP datagram.
	Flags          *IPv4Flags // 3 bits used to control or identify fragments.
	FragmentOffset uint16     // 13 bits offset of a particular fragment.
	TTL            uint8      // 8 bits limits a datagram's lifetime to prevent network failure.
	Protocol       *IPv4Proto
	HeaderChecksum uint16     // 16 bits used for error checking of the header.
	SrcIP          netip.Addr // IPv4 address of the sender of the packet.
	DstIP          netip.Addr // IPv4 address of the receiver of the packet.
	Options        []byte     // if ihl > 5
	Payload        []byte
}

type IPv4Proto struct {
	Val  IPProto // 8 bits defines the protocol used in the data portion of the IP datagram.
	Desc string  // Protocol description.
}

type IPv4PseudoHeader struct {
	SrcIP       netip.Addr
	DstIP       netip.Addr
	Protocol    *IPv4Proto
	TotalLength uint16
}

type IPv6Packet struct {
	Version        uint8         // 4 bits version field (for IPv6, this is always equal to 6).
	TrafficClass   *TrafficClass // 6 + 2 bits holds DS and ECN values.
	FlowLabel      uint32        // 20 bits high-entropy identifier of a flow of packets between a source and destination.
	PayloadLength  uint16        // 16 bits the size of the payload in octets, including any extension headers.
	NextHeader     uint8         // 8 bits specifies the type of the next header.
	NextHeaderDesc string        // next header description
	// 8 bits replaces the time to live field in IPv4. This value is decremented by one at each forwarding node
	// and the packet is discarded if it becomes 0. However, the destination node should process the packet normally
	// even if received with a hop limit of 0.
	HopLimit uint8
	SrcIP    netip.Addr // The unicast IPv6 address of the sending node.
	DstIP    netip.Addr // The IPv6 unicast or multicast address of the destination node(s).
	Payload  []byte
}

type Layer interface {
	fmt.Stringer
	Parse(data []byte) error
	NextLayer() Layer
	Summary() string
	Name() LayerName
}

type LayerName string

type Message struct {
	PacketLength     uint32
	PaddingLength    uint8
	MesssageType     uint8
	MesssageTypeDesc string
	Payload          []byte
}

type Operation uint16

type QueryEntry struct {
	Name  string       `json:"name"`         // Name of the node to which this record pertains.
	Type  *RecordType  `json:"record-type"`  // Type of RR in numeric form.
	Class *RecordClass `json:"record-class"` // Class code.
}

type RDataA struct {
	Address netip.Addr `json:"address"`
}

type RDataAAAA struct {
	Address netip.Addr `json:"address"`
}

type RDataCNAME struct {
	CName string `json:"cname"`
}

type RDataHTTPS struct {
	SvcPriority uint16      `json:"svc-priority"`
	Length      int         `json:"length"`
	TargetName  string      `json:"target-name"`
	SvcParams   []*SvcParam `json:"svc-params"`
}

type RDataMX struct {
	Preference uint16 `json:"preference"`
	Exchange   string `json:"exchange"`
}

type RDataNS struct {
	NsdName string `json:"ns"`
}

type RDataOPT struct {
	UDPPayloadSize     uint16 `json:"udp-payload-size"`
	HigherBitsExtRCode uint8  `json:"higer-bits-in-extended-rcode"`
	EDNSVer            uint8  `json:"edns0-version"`
	Z                  uint16 `json:"z"`
	DataLen            uint16 `json:"data-length"`
}

type RDataSOA struct {
	PrimaryNS            string `json:"primary-nameserver"`
	RespAuthorityMailbox string `json:"responsible-authority-mailbox"`
	SerialNumber         uint32 `json:"serial-number"`
	RefreshInterval      uint32 `json:"refresh-interval"`
	RetryInterval        uint32 `json:"retry-interval"`
	ExpireLimit          uint32 `json:"expire-limit"`
	MinimumTTL           uint32 `json:"minimum-ttl"`
}

type RDataTXT struct {
	TxtData string `json:"txt-data"`
}

type RDataUnknown struct {
	Data string `json:"data"`
}

type Record struct {
	ContentType     uint8
	ContentTypeDesc string
	Version         *TLSVersion
	Length          uint16
	Data            []byte
}

type RecordClass struct {
	Name string `json:"name"`
	Val  uint16 `json:"val"`
}

type RecordType struct {
	Name string `json:"name"`
	Val  uint16 `json:"val"`
}

type ResourceRecord struct {
	Name     string       `json:"name"`         // Name of the node to which this record pertains.
	Type     *RecordType  `json:"record-type"`  // Type of RR in numeric form.
	Class    *RecordClass `json:"record-class"` // Class code.
	TTL      uint32       `json:"ttl"`          // Count of seconds that the RR stays valid.
	RDLength uint16       `json:"rdata-length"` // Length of RData field (specified in octets).
	RData    fmt.Stringer `json:"rdata"`        // Additional RR-specific data.
}

type SNMPMessage struct {
	Payload []byte
}

type SSHMessage struct {
	Protocol string
	Messages []*Message
}

type ServerName struct {
	Type         uint16
	Length       uint16
	SNListLength uint16
	SNType       uint8
	SNNameLength uint16
	SNName       string
}

type SvcParam struct {
	Key    *SvcParamKey `json:"svc-param-key"`
	Length uint16       `json:"svc-param-value-length"`
	Value  []byte       `json:"svc-param-value"` // TODO: add proper parsing
}

type SvcParamKey struct {
	Val  uint16 `json:"val"`
	Desc string `json:"desc"`
}

type TCPFlag struct {
	Val  uint8
	Desc string
}

type TCPFlags struct {
	Raw uint8
	Val []*TCPFlag
}

type TCPSegment struct {
	SrcPort uint16 // Identifies the sending port.
	DstPort uint16 // Identifies the receiving port.
	// If the SYN flag is set (1), then this is the initial sequence number. The sequence number of the actual
	// first data byte and the acknowledged number in the corresponding ACK are then this sequence number plus 1.
	// If the SYN flag is unset (0), then this is the accumulated sequence number of the first data byte of this
	// segment for the current session.
	SeqNumber uint32
	// If the ACK flag is set, the value is the next sequence number that the sender of the ACK is expecting.
	AckNumber  uint32
	DataOffset uint8     // 4 bits specifies the size of the TCP header in 32-bit words.
	Reserved   uint8     // 4 bits reserved for future use and should be set to zero.
	Flags      *TCPFlags // Contains 8 1-bit flags (control bits)
	// The size of the receive window, which specifies the number of window size units[b] that the sender of
	// this segment is currently willing to receive.
	WindowSize uint16
	// The 16-bit checksum field is used for error-checking of the TCP header, the payload and an IP pseudo-header.
	Checksum uint16
	// If the URG flag is set, then this 16-bit field is an offset from the sequence number
	// indicating the last urgent data byte.
	UrgentPointer uint16
	Options       []byte // The length of this field is determined by the data offset field.
	Payload       []byte
}

type TLSClientHello struct {
	Type               uint8
	TypeDesc           string
	Length             int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version            *TLSVersion
	Random             []byte // 32 bytes
	SessionIDLength    uint8  // if 0 no session follows
	SessionID          string
	CipherSuitesLength uint16
	CipherSuites       []*CipherSuite
	CmprMethodsLength  uint8  // usually 0x01
	CmprMethods        []byte // usually 0x00
	ExtensionLength    uint16
	Extensions         []*Extension
	ServerName         *ServerName
	ALPN               []string
}

type TLSClientHelloRequest struct {
	SNI          string   `json:"sni,omitempty"`
	Type         string   `json:"type,omitempty"`
	Version      string   `json:"version,omitempty"`
	SessionID    string   `json:"session_id,omitempty"`
	CipherSuites []string `json:"cipher_suites,omitempty"`
	Extensions   []string `json:"extensions,omitempty"`
	ALPN         []string `json:"alpn,omitempty"`
}

type TLSClientHelloRequestWrapper struct {
	Request TLSClientHelloRequest `json:"tls_request"`
}

type TLSMessage struct {
	Records []*Record
	Data    []byte
}

type TLSServerHello struct {
	Type             uint8
	TypeDesc         string
	Length           int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version          *TLSVersion
	Random           []byte // 32 bytes
	SessionIDLength  uint8  // if 0 no session follows
	SessionID        string
	CipherSuite      *CipherSuite
	CmprMethod       uint8
	ExtensionLength  uint16
	Extensions       []*Extension
	SupportedVersion *TLSVersion
}

type TLSServerHelloResponse struct {
	Type             string   `json:"type,omitempty"`
	Version          string   `json:"version,omitempty"`
	SessionID        string   `json:"session_id,omitempty"`
	CipherSuite      string   `json:"cipher_suite,omitempty"`
	Extensions       []string `json:"extensions,omitempty"`
	SupportedVersion string   `json:"supported_version,omitempty"`
}

type TLSServerHelloResponseWrapper struct {
	Response TLSServerHelloResponse `json:"tls_response"`
}

type TLSVersion struct {
	Val  uint16
	Desc string
}

type TrafficClass struct {
	Raw      uint8
	DSCP     uint8
	DSCPDesc string
	ECN      uint8
}

type UDPSegment struct {
	// UDP protocol is defined in RFC 768.
	SrcPort   uint16 // Identifies the sending port.
	DstPort   uint16 // Identifies the receiving port.
	UDPLength uint16 // Specifies the length in bytes of the UDP header and UDP data.
	Checksum  uint16 // The checksum field may be used for error-checking of the header and data.
	Payload   []byte
}