pcap-remote.h

Go to the documentation of this file.

/*
 * Copyright (c) 2002 - 2005 NetGroup, Politecnico di Torino (Italy)
 * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the Politecnico di Torino, CACE Technologies 
 * nor the names of its contributors may be used to endorse or promote 
 * products derived from this software without specific prior written 
 * permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

#ifndef __PCAP_REMOTE_H__
#define __PCAP_REMOTE_H__


#include "pcap.h"
#include "sockutils.h"  // Needed for some structures (like SOCKET, sockaddr_in) which are used here


/*********************************************************
 *                                                       *
 * General definitions / typedefs for the RPCAP protocol *
 *                                                       *
 *********************************************************/

// All the following structures and typedef belongs to the Private Documentation
#define RPCAP_DEFAULT_NETPORT "2002" 
#define RPCAP_DEFAULT_NETPORT_ACTIVE "2003"
#define RPCAP_DEFAULT_NETADDR ""    
#define RPCAP_VERSION 0             
#define RPCAP_TIMEOUT_INIT 90       
#define RPCAP_TIMEOUT_RUNTIME 180   
#define RPCAP_ACTIVE_WAIT 30        
#define RPCAP_SUSPEND_WRONGAUTH 1   
#define RPCAP_NETBUF_SIZE 64000


#define RPCAP_HOSTLIST_SEP " ,;\n\r"




// WARNING: These could need to be changed on other platforms
typedef unsigned char uint8;        
typedef unsigned short uint16;      
typedef unsigned int uint32;        
typedef int int32;                  




struct activehosts
{
    struct sockaddr_storage host;
    SOCKET sockctrl;
    struct activehosts *next;
};


/*********************************************************
 *                                                       *
 * Protocol messages formats                             *
 *                                                       *
 *********************************************************/
// WARNING Take care you compiler does not insert padding for better alignments into these structs


struct rpcap_header
{
    uint8 ver;                          
    uint8 type;                         
    uint16 value;                       
    uint32 plen;                        
};


struct rpcap_findalldevs_if
{
    uint16 namelen;                     
    uint16 desclen;                     
    uint32 flags;                       
    uint16 naddr;                       
    uint16 dummy;                       
};


struct rpcap_findalldevs_ifaddr
{
    struct sockaddr_storage addr;       
    struct sockaddr_storage netmask;    
    struct sockaddr_storage broadaddr;  
    struct sockaddr_storage dstaddr;    
};



struct rpcap_openreply
{
    int32 linktype;                     
    int32 tzoff;                        
};



struct rpcap_startcapreq
{
    uint32 snaplen;                     
    uint32 read_timeout;                
    uint16 flags;                       
    uint16 portdata;                    
};


struct rpcap_startcapreply
{
    int32 bufsize;                      
    uint16 portdata;                    
    uint16 dummy;                       
};


struct rpcap_pkthdr
{
    uint32 timestamp_sec;   
    uint32 timestamp_usec;  
    uint32 caplen;          
    uint32 len;             
    uint32 npkt;            
};


struct rpcap_filter
{
    uint16 filtertype;          
    uint16 dummy;               
    uint32 nitems;              
};


struct rpcap_filterbpf_insn
{
    uint16 code;            
    uint8 jt;               
    uint8 jf;               
    int32 k;                
};


struct rpcap_auth
{
    uint16 type;            
    uint16 dummy;           
    uint16 slen1;           
    uint16 slen2;           
};


struct rpcap_stats
{
    uint32 ifrecv;      
    uint32 ifdrop;      
    uint32 krnldrop;    
    uint32 svrcapt;     
};


struct rpcap_sampling
{
    uint8 method;       
    uint8 dummy1;       
    uint16 dummy2;      
    uint32 value;       
};



// Messages field coding
#define RPCAP_MSG_ERROR 1               
#define RPCAP_MSG_FINDALLIF_REQ 2       
#define RPCAP_MSG_OPEN_REQ 3            
#define RPCAP_MSG_STARTCAP_REQ 4        
#define RPCAP_MSG_UPDATEFILTER_REQ 5    
#define RPCAP_MSG_CLOSE 6               
#define RPCAP_MSG_PACKET 7              
#define RPCAP_MSG_AUTH_REQ 8            
#define RPCAP_MSG_STATS_REQ 9           
#define RPCAP_MSG_ENDCAP_REQ 10         
#define RPCAP_MSG_SETSAMPLING_REQ 11    
#define RPCAP_MSG_FINDALLIF_REPLY   (128+RPCAP_MSG_FINDALLIF_REQ)       
#define RPCAP_MSG_OPEN_REPLY        (128+RPCAP_MSG_OPEN_REQ)            
#define RPCAP_MSG_STARTCAP_REPLY    (128+RPCAP_MSG_STARTCAP_REQ)        
#define RPCAP_MSG_UPDATEFILTER_REPLY (128+RPCAP_MSG_UPDATEFILTER_REQ)   
#define RPCAP_MSG_AUTH_REPLY        (128+RPCAP_MSG_AUTH_REQ)            
#define RPCAP_MSG_STATS_REPLY       (128+RPCAP_MSG_STATS_REQ)           
#define RPCAP_MSG_ENDCAP_REPLY      (128+RPCAP_MSG_ENDCAP_REQ)          
#define RPCAP_MSG_SETSAMPLING_REPLY (128+RPCAP_MSG_SETSAMPLING_REQ)     
#define RPCAP_STARTCAPREQ_FLAG_PROMISC 1    
#define RPCAP_STARTCAPREQ_FLAG_DGRAM 2      
#define RPCAP_STARTCAPREQ_FLAG_SERVEROPEN 4 
#define RPCAP_STARTCAPREQ_FLAG_INBOUND 8    
#define RPCAP_STARTCAPREQ_FLAG_OUTBOUND 16  
#define RPCAP_UPDATEFILTER_BPF 1            
// Network error codes
#define PCAP_ERR_NETW 1                 
#define PCAP_ERR_INITTIMEOUT 2          
#define PCAP_ERR_AUTH 3                 
#define PCAP_ERR_FINDALLIF 4            
#define PCAP_ERR_NOREMOTEIF 5           
#define PCAP_ERR_OPEN 6                 
#define PCAP_ERR_UPDATEFILTER 7         
#define PCAP_ERR_GETSTATS 8             
#define PCAP_ERR_READEX 9               
#define PCAP_ERR_HOSTNOAUTH 10          
#define PCAP_ERR_REMOTEACCEPT 11        
#define PCAP_ERR_STARTCAPTURE 12        
#define PCAP_ERR_ENDCAPTURE 13          
#define PCAP_ERR_RUNTIMETIMEOUT 14      
#define PCAP_ERR_SETSAMPLING 15         
#define PCAP_ERR_WRONGMSG 16            
#define PCAP_ERR_WRONGVER 17             // end of private documentation






/*********************************************************
 *                                                       *
 * Exported funtion prototypes                           *
 *                                                       *
 *********************************************************/
int pcap_opensource_remote(pcap_t *p, struct pcap_rmtauth *auth);
int pcap_startcapture_remote(pcap_t *fp);

int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr **pkt_header, u_char **pkt_data);
int pcap_read_remote(pcap_t *p, int cnt, pcap_handler callback, u_char *user);
int pcap_updatefilter_remote(pcap_t *fp, struct bpf_program *prog);
int pcap_setfilter_remote(pcap_t *fp, struct bpf_program *prog);
int pcap_stats_remote(pcap_t *p, struct pcap_stat *ps);
int pcap_setsampling_remote(pcap_t *p);
struct pcap_stat *pcap_stats_ex_remote(pcap_t *p);
void pcap_cleanup_remote(pcap_t *p);

void rpcap_createhdr(struct rpcap_header *header, uint8 type, uint16 value, uint32 length);
int rpcap_deseraddr(struct sockaddr_storage *sockaddrin, struct sockaddr_storage **sockaddrout, char *errbuf);
int rpcap_checkmsg(char *errbuf, SOCKET sock, struct rpcap_header *header, uint8 first, ...);
int rpcap_senderror(SOCKET sock, char *error, unsigned short errcode, char *errbuf);
int rpcap_sendauth(SOCKET sock, struct pcap_rmtauth *auth, char *errbuf);

int rpcap_remoteact_getsock(const char *host, char *errbuf);

#endif

---

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2008 CACE Technologies. All rights reserved.