layers

type ARPPacket struct {
	HardwareType     uint16 // Network link protocol type.
	ProtocolType     uint16 // Internetwork protocol for which the ARP request is intended.
	ProtocolTypeDesc string // Internetwork protocol description.
	Hlen             uint8  // Length (in octets) of a hardware address.
	Plen             uint8  // Length (in octets) of internetwork addresses.
	Op               uint16 // Specifies the operation that the sender is performing.
	OpDesc           string // Operation description.
	// Media address of the sender. In an ARP request this field is used to indicate
	// the address of the host sending the request. In an ARP reply this field is used
	// to indicate the address of the host that the request was looking for.
	SenderMAC net.HardwareAddr
	SenderIP  netip.Addr // Internetwork address of the sender.
	// Media address of the intended receiver. In an ARP request this field is ignored.
	// In an ARP reply this field is used to indicate the address of the host that originated the ARP request.
	TargetMAC net.HardwareAddr
	TargetIP  netip.Addr // Internetwork address of the intended receiver.
}

type CipherSuite struct {
	Value uint16
	Desc  string
}

type DNSFlags struct {
	Raw        uint16
	QR         uint8  // Indicates if the message is a query (0) or a reply (1).
	QRDesc     string // Query (0) or Reply (1)
	OPCode     uint8  // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-5
	OPCodeDesc string
	AA         uint8 // Authoritative Answer, in a response, indicates if the DNS server is authoritative for the queried hostname.
	TC         uint8 // TrunCation, indicates that this message was truncated due to excessive length.
	RD         uint8 // Recursion Desired, indicates if the client means a recursive query.
	RA         uint8 // Recursion Available, in a response, indicates if the replying DNS server supports recursion.
	Z          uint8 // Zero, reserved for future use.
	AU         uint8 // Indicates if answer/authority portion was authenticated by the server.
	NA         uint8 // Indicates if non-authenticated data is accepatable.
	RCode      uint8 // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
	RCodeDesc  string
}

type DNSMessage struct {
	TransactionID uint16    // Used for matching response to queries.
	Flags         *DNSFlags // Flags specify the requested operation and a response code.
	QDCount       uint16    // Count of entries in the queries section.
	ANCount       uint16    //  Count of entries in the answers section.
	NSCount       uint16    // Count of entries in the authority section.
	ARCount       uint16    // Count of entries in the additional section.
	Questions     []*QueryEntry
	AnswerRRs     []*ResourceRecord
	AuthorityRRs  []*ResourceRecord
	AdditionalRRs []*ResourceRecord
}

type EthernetFrame struct {
	DstMAC        net.HardwareAddr // MAC address of the destination device.
	SrcMAC        net.HardwareAddr // MAC address of the source device.
	EtherType     uint16           // The protocol of the upper layer.
	EtherTypeDesc string           // Protocol description
	// contains filtered or unexported fields
}

type Extension struct {
	Value uint16
	Desc  string
}

type FTPMessage struct {
	// contains filtered or unexported fields
}

type HSTLSParser interface {
	ParseHS(data []byte) error
}

type HTTPMessage struct {
	Request  *http.Request
	Response *http.Response
}

type ICMPSegment struct {
	Type     uint8  // ICMP type.
	TypeDesc string // ICMP type description.
	Code     uint8  // ICMP subtype.
	CodeDesc string // ICMP subtype description.
	// Internet checksum (RFC 1071) for error checking, calculated from the ICMP header
	// and data with value 0 substituted for this field.
	Checksum uint16
	Data     []byte // Contents vary based on the ICMP type and code.
}

type ICMPv6Segment struct {
	Type     uint8
	TypeDesc string
	Code     uint8
	CodeDesc string
	Checksum uint16
	Data     []byte
}

type IPv4Flags struct {
	Reserved uint8
	MF       uint8
	DF       uint8
}

type IPv4Packet struct {
	Version        uint8      // 4 bits version (for IPv4, this is always equal to 4).
	IHL            uint8      // 4 bits size of header (number of 32-bit words).
	DSCP           uint8      // 6 bits specifies differentiated services.
	DSCPDesc       string     // differentiated services description.
	ECN            uint8      // 2 bits end-to-end notification of network congestion without dropping packets.
	TotalLength    uint16     // 16 bits defines the entire packet size in bytes, including header and data.
	Identification uint16     // 16 bits identifies the group of fragments of a single IP datagram.
	Flags          *IPv4Flags // 3 bits used to control or identify fragments.
	FragmentOffset uint16     // 13 bits offset of a particular fragment.
	TTL            uint8      // 8 bits limits a datagram's lifetime to prevent network failure.
	Protocol       uint8      // 8 bits defines the protocol used in the data portion of the IP datagram.
	ProtocolDesc   string     // Protocol description.
	HeaderChecksum uint16     // 16 bits used for error checking of the header.
	SrcIP          netip.Addr // IPv4 address of the sender of the packet.
	DstIP          netip.Addr // IPv4 address of the receiver of the packet.
	Options        []byte     // if ihl > 5
	// contains filtered or unexported fields
}

type IPv6Packet struct {
	Version        uint8         // 4 bits version field (for IPv6, this is always equal to 6).
	TrafficClass   *TrafficClass // 6 + 2 bits holds DS and ECN values.
	FlowLabel      uint32        // 20 bits high-entropy identifier of a flow of packets between a source and destination.
	PayloadLength  uint16        // 16 bits the size of the payload in octets, including any extension headers.
	NextHeader     uint8         // 8 bits specifies the type of the next header.
	NextHeaderDesc string        // next header description
	// 8 bits replaces the time to live field in IPv4. This value is decremented by one at each forwarding node
	// and the packet is discarded if it becomes 0. However, the destination node should process the packet normally
	// even if received with a hop limit of 0.
	HopLimit uint8
	SrcIP    netip.Addr // The unicast IPv6 address of the sending node.
	DstIP    netip.Addr // The IPv6 unicast or multicast address of the destination node(s).
	// contains filtered or unexported fields
}

type Layer interface {
	fmt.Stringer
	Parse(data []byte) error
	NextLayer() (layer string, payload []byte)
	Summary() string
}

type Message struct {
	PacketLength     uint32
	PaddingLength    uint8
	MesssageType     uint8
	MesssageTypeDesc string
	Payload          []byte
}

type QueryEntry struct {
	Name  string       // Name of the node to which this record pertains.
	Type  *RecordType  // Type of RR in numeric form.
	Class *RecordClass // Class code.
}

type RDataA struct {
	Address netip.Addr
}

type RDataAAAA struct {
	Address netip.Addr
}

type RDataCNAME struct {
	CName string
}

type RDataHTTPS struct {
	Data string // TODO: add proper parsing
}

type RDataMX struct {
	Preference uint16
	Exchange   string
}

type RDataNS struct {
	NsdName string
}

type RDataOPT struct {
	UDPPayloadSize     uint16
	HigherBitsExtRCode uint8
	EDNSVer            uint8
	Z                  uint16
	DataLen            uint16
}

type RDataSOA struct {
	PrimaryNS            string
	RespAuthorityMailbox string
	SerialNumber         uint32
	RefreshInterval      uint32
	RetryInterval        uint32
	ExpireLimit          uint32
	MinimumTTL           uint32
}

type RDataTXT struct {
	TxtData string
}

type RDataUnknown struct {
	Data string
}

type Record struct {
	ContentType     uint8
	ContentTypeDesc string
	Version         *TLSVersion
	Length          uint16
	Data            []byte
}

type RecordClass struct {
	Name string
	Val  uint16
}

type RecordType struct {
	Name string
	Val  uint16
}

type ResourceRecord struct {
	Name     string       // Name of the node to which this record pertains.
	Type     *RecordType  // Type of RR in numeric form.
	Class    *RecordClass // Class code.
	TTL      uint32       // Count of seconds that the RR stays valid.
	RDLength uint16       // Length of RData field (specified in octets).
	RData    fmt.Stringer // Additional RR-specific data.
}

type SNMPMessage struct {
	Payload []byte
}

type SSHMessage struct {
	Protocol string
	Messages []*Message
}

type ServerName struct {
	Type         uint16
	Length       uint16
	SNListLength uint16
	SNType       uint8
	SNNameLength uint16
	SNName       string
}

type TCPFlags struct {
	Raw uint8
	CWR uint8
	ECE uint8
	URG uint8
	ACK uint8
	PSH uint8
	RST uint8
	SYN uint8
	FIN uint8
}

type TCPSegment struct {
	SrcPort uint16 // Identifies the sending port.
	DstPort uint16 // Identifies the receiving port.
	// If the SYN flag is set (1), then this is the initial sequence number. The sequence number of the actual
	// first data byte and the acknowledged number in the corresponding ACK are then this sequence number plus 1.
	// If the SYN flag is unset (0), then this is the accumulated sequence number of the first data byte of this
	// segment for the current session.
	SeqNumber uint32
	// If the ACK flag is set, the value is the next sequence number that the sender of the ACK is expecting.
	AckNumber  uint32
	DataOffset uint8     // 4 bits specifies the size of the TCP header in 32-bit words.
	Reserved   uint8     // 4 bits reserved for future use and should be set to zero.
	Flags      *TCPFlags // Contains 8 1-bit flags (control bits)
	// The size of the receive window, which specifies the number of window size units[b] that the sender of
	// this segment is currently willing to receive.
	WindowSize uint16
	// The 16-bit checksum field is used for error-checking of the TCP header, the payload and an IP pseudo-header.
	Checksum uint16
	// If the URG flag is set, then this 16-bit field is an offset from the sequence number
	// indicating the last urgent data byte.
	UrgentPointer uint16
	Options       []byte // The length of this field is determined by the data offset field.
	// contains filtered or unexported fields
}

type TLSClientHello struct {
	Type               uint8
	TypeDesc           string
	Length             int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version            *TLSVersion
	Random             []byte //32 bytes
	SessionIDLength    uint8  // if 0 no session follows
	SessionID          string
	CipherSuitesLength uint16
	CipherSuites       []*CipherSuite
	CmprMethodsLength  uint8  // usually 0x01
	CmprMethods        []byte // usually 0x00
	ExtensionLength    uint16
	Extensions         []*Extension
	ServerName         *ServerName
	ALPN               []string
}

type TLSMessage struct {
	Records []*Record
	Data    []byte
}

type TLSServerHello struct {
	Type             uint8
	TypeDesc         string
	Length           int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version          *TLSVersion
	Random           []byte //32 bytes
	SessionIDLength  uint8  // if 0 no session follows
	SessionID        string
	CipherSuite      *CipherSuite
	CmprMethod       uint8
	ExtensionLength  uint16
	Extensions       []*Extension
	SupportedVersion *TLSVersion
}

type TLSVersion struct {
	Value uint16
	Desc  string
}

type TrafficClass struct {
	Raw      uint8
	DSCP     uint8
	DSCPDesc string
	ECN      uint8
}

type UDPSegment struct {
	SrcPort   uint16 // Identifies the sending port.
	DstPort   uint16 // Identifies the receiving port.
	UDPLength uint16 // Specifies the length in bytes of the UDP header and UDP data.
	Checksum  uint16 // The checksum field may be used for error-checking of the header and data.
	// contains filtered or unexported fields
}