layers

type ARPOperation struct {
	Val  Operation
	Desc string
}

type ARPPacket struct {
	HardwareType     uint16        // Network link protocol type.
	ProtocolType     uint16        // Internetwork protocol for which the ARP request is intended.
	ProtocolTypeDesc string        // Internetwork protocol description.
	Hlen             uint8         // Length (in octets) of a hardware address.
	Plen             uint8         // Length (in octets) of internetwork addresses.
	Op               *ARPOperation // Specifies the operation that the sender is performing.
	// Media address of the sender. In an ARP request this field is used to indicate
	// the address of the host sending the request. In an ARP reply this field is used
	// to indicate the address of the host that the request was looking for.
	SenderMAC net.HardwareAddr
	SenderIP  netip.Addr // Internetwork address of the sender.
	// Media address of the intended receiver. In an ARP request this field is ignored.
	// In an ARP reply this field is used to indicate the address of the host that originated the ARP request.
	TargetMAC net.HardwareAddr
	TargetIP  netip.Addr // Internetwork address of the intended receiver.
	DstVendor string
	SrcVendor string
}

type CipherSuite struct {
	Value uint16
	Desc  string
}

type DNSFlags struct {
	Raw    uint16     `json:"raw"`
	QR     *DNSQRFlag `json:"qr"`     // Indicates if the message is a query (0) or a reply (1).
	OPCode *DNSOpCode `json:"opcode"` // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-5
	AA     uint8      `json:"aa"`     // Authoritative Answer, in a response, indicates if the DNS server is authoritative for the queried hostname.
	TC     uint8      `json:"tc"`     // TrunCation, indicates that this message was truncated due to excessive length.
	RD     uint8      `json:"rd"`     // Recursion Desired, indicates if the client means a recursive query.
	RA     uint8      `json:"ra"`     // Recursion Available, in a response, indicates if the replying DNS server supports recursion.
	Z      uint8      `json:"z"`      // Zero, reserved for future use.
	AU     uint8      `json:"au"`     // Indicates if answer/authority portion was authenticated by the server.
	NA     uint8      `json:"na"`     // Indicates if non-authenticated data is accepatable.
	RCode  *DNSRCode  `json:"rcode"`  // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
}

type DNSMessage struct {
	TransactionID uint16            `json:"transaction-id"`       // Used for matching response to queries.
	Flags         *DNSFlags         `json:"flags,omitempty"`      // Flags specify the requested operation and a response code.
	QDCount       uint16            `json:"questions-count"`      // Count of entries in the queries section.
	ANCount       uint16            `json:"answer-rrs-count"`     //  Count of entries in the answers section.
	NSCount       uint16            `json:"authority-rrs-count"`  // Count of entries in the authority section.
	ARCount       uint16            `json:"additional-rrs-count"` // Count of entries in the additional section.
	Questions     []*QueryEntry     `json:"questions,omitempty"`
	AnswerRRs     []*ResourceRecord `json:"answers,omitempty"`
	AuthorityRRs  []*ResourceRecord `json:"authoritative-nameservers,omitempty"`
	AdditionalRRs []*ResourceRecord `json:"additional-records,omitempty"`
}

type DNSOpCode struct {
	Val  OpCode `json:"val"`
	Desc string `json:"desc"`
}

type DNSQRFlag struct {
	Val  QRFlag `json:"val"`
	Desc string `json:"desc"`
}

type DNSRCode struct {
	Val  RCode  `json:"val"`
	Desc string `json:"desc"`
}

type DestOptsExtHeader struct {
	NextHeader *IPProtocol // Identifies the type of header immediately following the Destination Options header.
	HdrExtLen  uint8       // Length of the Hop-by-Hop Options header in 8-octet units, not including the first 8 octets.
	Options    []TLVOpt    /* Variable-length field, of length such that the complete Destination Options header is an
	integer multiple of 8 octets long.  Contains one or more TLV-encoded options */
}

type EtherType uint16

type EthernetFrame struct {
	DstMAC    net.HardwareAddr // MAC address of the destination device.
	SrcMAC    net.HardwareAddr // MAC address of the source device.
	EtherType *EthernetType    // The protocol of the upper layer.
	Payload   []byte
	DstVendor string
	SrcVendor string
}

type EthernetType struct {
	Val  EtherType
	Desc string // Protocol description
}

type Extension struct {
	Value uint16
	Desc  string
}

type FTPMessage struct {
	// contains filtered or unexported fields
}

type FragmentExtHeader struct {
	NextHeader *IPProtocol // Identifies the type of header immediately following the Routing header.
	// Reserved uint8
	FragmentOffset uint16 /* 13-bit unsigned integer.  The offset, in 8-octet units, of the data following this
	header, relative to the start of the Fragmentable Part of the original packet. */
	M              bool // 1 = more fragments; 0 = last fragment.
	Identification uint32
}

type HSTLSParser interface {
	ParseHS(data []byte) error
}

type HTTPMessage struct {
	Request  *http.Request
	Response *http.Response
}

type HTTPRequest struct {
	Host          string      `json:"host,omitempty"`
	URI           string      `json:"uri,omitempty"`
	Method        string      `json:"method,omitempty"`
	Proto         string      `json:"proto,omitempty"`
	ContentLength int         `json:"content-length,omitempty"`
	Header        http.Header `json:"header,omitempty"`
}

type HTTPRequestWrapper struct {
	Request *HTTPRequest `json:"http_request"`
}

type HTTPResponse struct {
	Proto         string      `json:"proto,omitempty"`
	Status        string      `json:"status,omitempty"`
	ContentLength int         `json:"content-length,omitempty"`
	Header        http.Header `json:"header,omitempty"`
}

type HTTPResponseWrapper struct {
	Response *HTTPResponse `json:"http_response"`
}

type HopByHopExtHeader struct {
	NextHeader *IPProtocol // Identifies the type of header immediately following the Hop-by-Hop Options header.
	HdrExtLen  uint8       // Length of the Hop-by-Hop Options header in 8-octet units, not including the first 8 octets.
	Options    []TLVOpt    /* Variable-length field, of length such that the complete Hop-by-Hop Options header is an
	integer multiple of 8 octets long.  Contains one or more TLV-encoded options, as described in Section 4.2 */
}

type ICMPSegment struct {
	Type     uint8  // ICMP type.
	TypeDesc string // ICMP type description.
	Code     uint8  // ICMP subtype.
	CodeDesc string // ICMP subtype description.
	// Internet checksum (RFC 1071) for error checking, calculated from the ICMP header
	// and data with value 0 substituted for this field.
	Checksum uint16
	Data     []byte // Contents vary based on the ICMP type and code.
}

type ICMPv6Message interface {
	Type() ICMPv6MessageType
	MarshalBinary() ([]byte, error)
	ToBytes() []byte
	SetChecksum(pseudo []byte) error
}

type ICMPv6MessageType uint8

type ICMPv6NeighborAdvertisement struct {
	Checksum      uint16
	Router        bool
	Solicited     bool
	Override      bool
	TargetAddress netip.Addr
	Options       []ICMPv6Option
}

type ICMPv6NeighborSolicitation struct {
	Checksum      uint16
	TargetAddress netip.Addr
	Options       []ICMPv6Option
}

type ICMPv6OptLinkLayerAddress struct {
	Direction LLADirection
	Addr      net.HardwareAddr
}

type ICMPv6OptMTU struct {
	MTU uint32
}

type ICMPv6OptPrefixInfo struct {
	PrefixLength                   uint8 // 0-128
	OnLink                         bool
	AutonomousAddressConfiguration bool
	ValidLifetime                  uint32
	PreferredLifetime              uint32
	Prefix                         netip.Addr
}

type ICMPv6OptRDNSS struct {
	Lifetime  uint32
	Addresses []netip.Addr
}

type ICMPv6Option interface {
	OptType() ICMPv6OptionType
	MarshalBinary() ([]byte, error)
	ToBytes() []byte
}

type ICMPv6OptionType uint8

type ICMPv6RouterAdvertisement struct {
	Checksum             uint16
	CurHopLimit          uint8
	ManagedConfiguration bool
	OtherConfiguration   bool
	HomeAgent            bool
	Prf                  ICMPv6RouterPreference
	NDProxy              bool
	SNACRouter           bool
	RouterLifetime       uint16
	ReachableTime        uint32
	RetranstTimer        uint32
	Options              []ICMPv6Option
}

type ICMPv6RouterPreference int

type ICMPv6RouterSolicitation struct {
	Checksum uint16
	Options  []ICMPv6Option
}

type ICMPv6Segment struct {
	Type     uint8
	TypeDesc string
	Code     uint8
	CodeDesc string
	Checksum uint16
	Data     []byte
}

type IPProto uint8

type IPProtocol struct {
	Val  IPProto // 8 bits defines the protocol used in the data portion of the IP datagram.
	Desc string  // Protocol description.
}

type IPv4Flags struct {
	Raw      uint8
	Reserved uint8
	DF       uint8
	MF       uint8
}

type IPv4Packet struct {
	// Internet Protocol version 4 is described in IETF publication RFC 791.
	Version        uint8      // 4 bits version (for IPv4, this is always equal to 4).
	IHL            uint8      // 4 bits size of header (number of 32-bit words).
	DSCP           uint8      // 6 bits specifies differentiated services.
	DSCPDesc       string     // differentiated services description.
	ECN            uint8      // 2 bits end-to-end notification of network congestion without dropping packets.
	TotalLength    uint16     // 16 bits defines the entire packet size in bytes, including header and data.
	Identification uint16     // 16 bits identifies the group of fragments of a single IP datagram.
	Flags          *IPv4Flags // 3 bits used to control or identify fragments.
	FragmentOffset uint16     // 13 bits offset of a particular fragment.
	TTL            uint8      // 8 bits limits a datagram's lifetime to prevent network failure.
	Protocol       *IPProtocol
	HeaderChecksum uint16     // 16 bits used for error checking of the header.
	SrcIP          netip.Addr // IPv4 address of the sender of the packet.
	DstIP          netip.Addr // IPv4 address of the receiver of the packet.
	Options        []byte     // if ihl > 5
	Payload        []byte
}

type IPv4PseudoHeader struct {
	SrcIP       netip.Addr
	DstIP       netip.Addr
	Protocol    *IPProtocol
	TotalLength uint16
}

type IPv6ExtHdrOptType uint8

type IPv6ExtHdrType uint8

type IPv6ExtHeader interface {
	Type() IPv6ExtHdrType
	SetNextHeader(next *IPProtocol)
	MarshalBinary() ([]byte, error)
	ToBytes() []byte
}

type IPv6OptHomeAddress struct {
	// The alignment requirement for the Home Address option is 8n + 6.
	// OptDataLen uint8 /*8-bit unsigned integer.  Length of the option, in octets,
	// excluding the Option Type and Option Length fields.  This field MUST be set to 16.*/
	HomeAddress netip.Addr // The home address of the mobile node sending the packet. This address MUST be a unicast routable address.
}

type IPv6OptPad1 struct{}

type IPv6OptPad1M struct {
	Count int // number of bytes to add

} // made up

type IPv6OptPadN struct {
	/*
		The PadN option is used to insert two or more octets of padding
		into the Options area of a header.  For N octets of padding, the
		Opt Data Len field contains the value N-2, and the Option Data
		consists of N-2 zero-valued octets.
	*/
	OptDataLen uint8 // Length of the Option Data field of this option, in octets.
}

type IPv6Packet struct {
	Version          uint8         // 4 bits version field (for IPv6, this is always equal to 6).
	TrafficClass     *TrafficClass // 6 + 2 bits holds DS and ECN values.
	FlowLabel        uint32        // 20 bits high-entropy identifier of a flow of packets between a source and destination.
	PayloadLength    uint16        // 16 bits the size of the payload in octets, including any extension headers.
	NextHeader       *IPProtocol   // 8 bits specifies the type of the next header.
	UpperLayer       *IPProtocol
	FinalDestination netip.Addr
	// 8 bits replaces the time to live field in IPv4. This value is decremented by one at each forwarding node
	// and the packet is discarded if it becomes 0. However, the destination node should process the packet normally
	// even if received with a hop limit of 0.
	HopLimit   uint8
	SrcIP      netip.Addr // The unicast IPv6 address of the sending node.
	DstIP      netip.Addr // The IPv6 unicast or multicast address of the destination node(s).
	ExtHeaders []IPv6ExtHeader
	Payload    []byte // Upper-layer payload
}

type IPv6PseudoHeader struct {
	SrcIP                  netip.Addr
	DstIP                  netip.Addr
	UpperLayerPacketLength uint32
	NextHeader             *IPProtocol
}

type IPv6RoutingType uint8

type LLADirection uint8

type Layer interface {
	fmt.Stringer
	Parse(data []byte) error
	NextLayer() Layer
	Summary() string
	Name() LayerName
}

type LayerName string

type Message struct {
	PacketLength     uint32
	PaddingLength    uint8
	MesssageType     uint8
	MesssageTypeDesc string
	Payload          []byte
}

type MobilityExtHeader struct {
	NextHeader *IPProtocol // Identifies the type of header immediately following the Mobility Header. Uses the same values as the IPv6 Next Header field
	HdrExtLen  uint8       // Length of the Hop-by-Hop Options header in 8-octet units, not including the first 8 octets.
	MHType     uint8       /* Identifies the particular mobility message in question. Current values are specified in Section 6.1.2 and onward.
	An unrecognized MH Type field causes an error indication to be sent. */
	// Reserved uint8
	Checksum uint16 /*
		          16-bit unsigned integer.  This field contains the checksum of the
				  Mobility Header.  The checksum is calculated from the octet string
				  consisting of a "pseudo-header" followed by the entire Mobility
				  Header starting with the Payload Proto field.  The checksum is the
				  16-bit one's complement of the one's complement sum of this
				  string.

				  The pseudo-header contains IPv6 header fields, as specified in
				  Section 8.1 of RFC 2460 [6].  The Next Header value used in the
				  pseudo-header is 135.  The addresses used in the pseudo-header are
				  the addresses that appear in the Source and Destination Address
				  fields in the IPv6 packet carrying the Mobility Header.
				  Note that the procedures of calculating upper-layer checksums
				  while away from home described in Section 11.3.1 apply even for
				  the Mobility Header.  If a mobility message has a Home Address
				  destination option, then the checksum calculation uses the home
				  address in this option as the value of the IPv6 Source Address
				  field.  The type 2 routing header is treated as explained in [6].

				  The Mobility Header is considered as the upper-layer protocol for
				  the purposes of calculating the pseudo-header.  The Upper-Layer
				  Packet Length field in the pseudo-header MUST be set to the total
				  length of the Mobility Header.

				  For computing the checksum, the checksum field is set to zero.
	*/
	MessageData []byte // A variable-length field containing the data specific to the indicated Mobility Header type.
	// Reserved uint16
	Options []TLVOpt
}

type NoNextExtHeader struct{}

type OpCode uint8

type Operation uint16

type QRFlag uint8

type QueryEntry struct {
	Name  string       `json:"name"`         // Name of the node to which this record pertains.
	Type  *RecordType  `json:"record-type"`  // Type of RR in numeric form.
	Class *RecordClass `json:"record-class"` // Class code.
}

type RCode uint8

type RData interface {
	fmt.Stringer
	encoding.BinaryMarshaler
	ToBytes() []byte
}

type RDataA struct {
	Address netip.Addr `json:"address"`
}

type RDataAAAA struct {
	Address netip.Addr `json:"address"`
}

type RDataCNAME struct {
	CName string `json:"cname"`
}

type RDataHTTPS struct {
	SvcPriority uint16      `json:"svc-priority"`
	Length      int         `json:"length"`
	TargetName  string      `json:"target-name"`
	SvcParams   []*SvcParam `json:"svc-params"`
}

type RDataMX struct {
	Preference uint16 `json:"preference"`
	Exchange   string `json:"exchange"`
}

type RDataNS struct {
	NsdName string `json:"ns"`
}

type RDataOPT struct {
	UDPPayloadSize     uint16 `json:"udp-payload-size"`
	HigherBitsExtRCode uint8  `json:"higer-bits-in-extended-rcode"`
	EDNSVer            uint8  `json:"edns0-version"`
	Z                  uint16 `json:"z"`
	DataLen            uint16 `json:"data-length"`
}

type RDataSOA struct {
	PrimaryNS            string `json:"primary-nameserver"`
	RespAuthorityMailbox string `json:"responsible-authority-mailbox"`
	SerialNumber         uint32 `json:"serial-number"`
	RefreshInterval      uint32 `json:"refresh-interval"`
	RetryInterval        uint32 `json:"retry-interval"`
	ExpireLimit          uint32 `json:"expire-limit"`
	MinimumTTL           uint32 `json:"minimum-ttl"`
}

type RDataTXT struct {
	TxtData string `json:"txt-data"`
}

type RDataUnknown struct {
	Data []byte `json:"data"`
}

type RecType uint16

type Record struct {
	ContentType     uint8
	ContentTypeDesc string
	Version         *TLSVersion
	Length          uint16
	Data            []byte
}

type RecordClass struct {
	Name string `json:"name"`
	Val  uint16 `json:"val"`
}

type RecordType struct {
	Name string  `json:"name"`
	Val  RecType `json:"val"`
}

type ResourceRecord struct {
	Name     string       `json:"name"`         // Name of the node to which this record pertains.
	Type     *RecordType  `json:"record-type"`  // Type of RR in numeric form.
	Class    *RecordClass `json:"record-class"` // Class code.
	TTL      uint32       `json:"ttl"`          // Count of seconds that the RR stays valid.
	RDLength uint16       `json:"rdata-length"` // Length of RData field (specified in octets).
	RData    RData        `json:"rdata"`        // Additional RR-specific data.
}

type RoutingExtHeader struct {
	NextHeader   *IPProtocol     // Identifies the type of header immediately following the Routing header.
	HdrExtLen    uint8           // Length of the Hop-by-Hop Options header in 8-octet units, not including the first 8 octets.
	RoutingType  IPv6RoutingType // identifier of a particular Routing header variant
	SegmentsLeft uint8           // Number of route segments remaining, i.e., number of explicitly listed intermediate nodes
	// still to be visited before reaching the final destination.
	Data []byte // type-specific data
}

type SNMPMessage struct {
	Payload []byte
}

type SSHMessage struct {
	Protocol string
	Messages []*Message
}

type ServerName struct {
	Type         uint16
	Length       uint16
	SNListLength uint16
	SNType       uint8
	SNNameLength uint16
	SNName       string
}

type SvcParam struct {
	Key    *SvcParamKey `json:"svc-param-key"`
	Length uint16       `json:"svc-param-value-length"`
	Value  []byte       `json:"svc-param-value"` // TODO: add proper parsing
}

type SvcParamKey struct {
	Val  uint16 `json:"val"`
	Desc string `json:"desc"`
}

type TCPFlag struct {
	Val  uint8
	Desc string
}

type TCPFlags struct {
	Raw uint8
	Val []*TCPFlag
}

type TCPSegment struct {
	SrcPort uint16 // Identifies the sending port.
	DstPort uint16 // Identifies the receiving port.
	// If the SYN flag is set (1), then this is the initial sequence number. The sequence number of the actual
	// first data byte and the acknowledged number in the corresponding ACK are then this sequence number plus 1.
	// If the SYN flag is unset (0), then this is the accumulated sequence number of the first data byte of this
	// segment for the current session.
	SeqNumber uint32
	// If the ACK flag is set, the value is the next sequence number that the sender of the ACK is expecting.
	AckNumber  uint32
	DataOffset uint8     // 4 bits specifies the size of the TCP header in 32-bit words.
	Reserved   uint8     // 4 bits reserved for future use and should be set to zero.
	Flags      *TCPFlags // Contains 8 1-bit flags (control bits)
	// The size of the receive window, which specifies the number of window size units[b] that the sender of
	// this segment is currently willing to receive.
	WindowSize uint16
	// The 16-bit checksum field is used for error-checking of the TCP header, the payload and an IP pseudo-header.
	Checksum uint16
	// If the URG flag is set, then this 16-bit field is an offset from the sequence number
	// indicating the last urgent data byte.
	UrgentPointer uint16
	Options       []byte // The length of this field is determined by the data offset field.
	Payload       []byte
}

type TLSClientHello struct {
	Type               uint8
	TypeDesc           string
	Length             int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version            *TLSVersion
	Random             []byte // 32 bytes
	SessionIDLength    uint8  // if 0 no session follows
	SessionID          string
	CipherSuitesLength uint16
	CipherSuites       []*CipherSuite
	CmprMethodsLength  uint8  // usually 0x01
	CmprMethods        []byte // usually 0x00
	ExtensionLength    uint16
	Extensions         []*Extension
	ServerName         *ServerName
	ALPN               []string
}

type TLSClientHelloRequest struct {
	SNI          string   `json:"sni,omitempty"`
	Type         string   `json:"type,omitempty"`
	Version      string   `json:"version,omitempty"`
	SessionID    string   `json:"session_id,omitempty"`
	CipherSuites []string `json:"cipher_suites,omitempty"`
	Extensions   []string `json:"extensions,omitempty"`
	ALPN         []string `json:"alpn,omitempty"`
}

type TLSClientHelloRequestWrapper struct {
	Request TLSClientHelloRequest `json:"tls_request"`
}

type TLSMessage struct {
	Records []*Record
	Data    []byte
}

type TLSServerHello struct {
	Type             uint8
	TypeDesc         string
	Length           int // 3 bytes int(uint(b[2]) | uint(b[1])<<8 | uint(b[0])<<16))
	Version          *TLSVersion
	Random           []byte // 32 bytes
	SessionIDLength  uint8  // if 0 no session follows
	SessionID        string
	CipherSuite      *CipherSuite
	CmprMethod       uint8
	ExtensionLength  uint16
	Extensions       []*Extension
	SupportedVersion *TLSVersion
}

type TLSServerHelloResponse struct {
	Type             string   `json:"type,omitempty"`
	Version          string   `json:"version,omitempty"`
	SessionID        string   `json:"session_id,omitempty"`
	CipherSuite      string   `json:"cipher_suite,omitempty"`
	Extensions       []string `json:"extensions,omitempty"`
	SupportedVersion string   `json:"supported_version,omitempty"`
}

type TLSServerHelloResponseWrapper struct {
	Response TLSServerHelloResponse `json:"tls_response"`
}

type TLSVersion struct {
	Val  uint16
	Desc string
}

type TLVOpt interface {
	Type() IPv6ExtHdrOptType
	MarshalBinary() ([]byte, error)
	ToBytes() []byte
}

type TrafficClass struct {
	Raw      uint8
	DSCP     uint8
	DSCPDesc string
	ECN      uint8
}

type UDPSegment struct {
	// UDP protocol is defined in RFC 768.
	SrcPort   uint16 // Identifies the sending port.
	DstPort   uint16 // Identifies the receiving port.
	UDPLength uint16 // Specifies the length in bytes of the UDP header and UDP data.
	Checksum  uint16 // The checksum field may be used for error-checking of the header and data.
	Payload   []byte
}