rpcap-protocol.h 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450
  1. /*
  2. * Copyright (c) 2002 - 2005 NetGroup, Politecnico di Torino (Italy)
  3. * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. *
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in the
  14. * documentation and/or other materials provided with the distribution.
  15. * 3. Neither the name of the Politecnico di Torino, CACE Technologies
  16. * nor the names of its contributors may be used to endorse or promote
  17. * products derived from this software without specific prior written
  18. * permission.
  19. *
  20. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  23. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  24. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  25. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  26. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  27. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  28. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  29. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  30. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  31. *
  32. */
  33. #ifndef __RPCAP_PROTOCOL_H__
  34. #define __RPCAP_PROTOCOL_H__
  35. #define RPCAP_DEFAULT_NETPORT "2002" /* Default port on which the RPCAP daemon is waiting for connections. */
  36. /* Default port on which the client workstation is waiting for connections in case of active mode. */
  37. #define RPCAP_DEFAULT_NETPORT_ACTIVE "2003"
  38. #define RPCAP_DEFAULT_NETADDR "" /* Default network address on which the RPCAP daemon binds to. */
  39. /*
  40. * Minimum and maximum supported versions of the protocol.
  41. *
  42. * If new message types are added, the protocol version MUST be changed,
  43. * so that a client knows, from the negotiated protocol version, what
  44. * messages can be sent to the server.
  45. *
  46. * If the format of an existing message type is changed, the protocol
  47. * version MUST be changed, so that each side knows, from the negotiated
  48. * protocol version, what format should be used.
  49. *
  50. * The RPCAP_MSG_ERROR format MUST not change, as it's used to, among
  51. * other things, report "incorrect version number" errors, where, if
  52. * the format changed, the sender of the message might not know what
  53. * versions the recipient would understand, or might know a version
  54. * they support (the version number they sent) but might not know
  55. * the format of the message in that version.
  56. *
  57. * Other message versions SHOULD not change, as that would complicate
  58. * the process of interpreting the message, making it version-dependent.
  59. * Introducing a new message with a new format is preferable.
  60. *
  61. * Version negotiation is done as part of the authentication process:
  62. *
  63. * The client sends an authentication request, with the version number
  64. * in the request being the maximum version it supports.
  65. *
  66. * If the server supports that version, it attempts to authenticate the
  67. * client, and replies as appropriate, with the version number in the
  68. * reply being that version.
  69. *
  70. * If the server doesn't support that version because it's too large,
  71. * it replies with a RPCAP_MSG_ERROR message, with the maximum version
  72. * they support as the version number in the reply, and with the error
  73. * code being PCAP_ERR_WRONGVER.
  74. *
  75. * If the server doesn't support that version because it's too small,
  76. * it replies with a RPCAP_MSG_ERROR message, with that version as
  77. * the version number in the reply, and with the error code being
  78. * PCAP_ERR_WRONGVER.
  79. *
  80. * If the client supports that version, it retries the authentication
  81. * with that version and, if that fails for any reason, including
  82. * PCAP_ERR_WRONGVER, fails. Otherwise, it fails, telling its caller
  83. * that there's no version that both support.
  84. *
  85. * This requires that the set of versions supported by a client or
  86. * server be a range of integers, with no gaps. Thus:
  87. *
  88. * the client's version set is [Cmin, Cmax], with Cmin <= Cmax;
  89. *
  90. * the server's version set is [Smin, Smax], with Smin <= Smax;
  91. *
  92. * the client sends Cmax as the version number in the initial
  93. * authentication request;
  94. *
  95. * if the server doesn't support the version sent by the client,
  96. * either Smax < Cmax or Smin > Cmax (because the client sent Cmax
  97. * to the server, and the server doesn't support it);
  98. *
  99. * if Smax < Cmax:
  100. *
  101. * the server sends Smax as the version number in the RPCAP_MSG_ERROR/
  102. * PCAP_ERR_WRONGVER message - the client will accept this because
  103. * Cmax != 0, as these numbers are unsigned, and this means that
  104. * this isn't an old client that rejects all messages with a non-zero
  105. * version number, it's a new client that accepts RPCAP_MSG_ERROR
  106. * messages no matter what the version is;
  107. *
  108. * if Smax >= Cmin, both the client and the server can use it, and
  109. * the client retries with Smax;
  110. *
  111. * if Smax < Cmin, there is no version the client and server can
  112. * both support.
  113. *
  114. * if Smin > Cmax:
  115. *
  116. * the server sends Cmax as the version number in the RPCAP_MSG_ERROR/
  117. * PCAP_ERR_WRONGVER message - the client will accept this because
  118. * Cmax is a valid client version number.
  119. *
  120. * the client will retry with Cmax, get the same version failure,
  121. * and report that there is no version the client and server can
  122. * both support (as the version sets are disjoint).
  123. *
  124. * Old negotiation-unaware clients just send version 0 and, if they
  125. * get back PCAP_ERR_WRONGVER, treat it as a fatal error. This
  126. * means they'll fail to talk to any server that can't handle
  127. * version 0, which is the appropriate thing to do, as they can
  128. * only use version 0.
  129. *
  130. * Old negotiation-unaware servers fail if they get a version other
  131. * than 0, sending back PCAP_ERR_WRONGVER with version 0, which is
  132. * the only version, and thus both the minimum and maximum version,
  133. * they support. The client will either fail if it doesn't support
  134. * version 0, or will retry with version 0 and succeed, so it will
  135. * fail with servers that can't handle version 0 or will negotiate
  136. * version 0 with servers that can handle version 0.
  137. */
  138. #define RPCAP_MIN_VERSION 0
  139. #define RPCAP_MAX_VERSION 0
  140. /*
  141. * Version numbers are unsigned, so if RPCAP_MIN_VERSION is 0, they
  142. * are >= the minimum version, by definition; don't check against
  143. * RPCAP_MIN_VERSION, as you may get compiler warnings that the
  144. * comparison will always succeed.
  145. */
  146. #if RPCAP_MIN_VERSION == 0
  147. #define RPCAP_VERSION_IS_SUPPORTED(v) ((v) <= RPCAP_MAX_VERSION)
  148. #else
  149. #define RPCAP_VERSION_IS_SUPPORTED(v) \
  150. ((v) >= RPCAP_MIN_VERSION && (v) <= RPCAP_MAX_VERSION)
  151. #endif
  152. /*
  153. * Separators used for the host list.
  154. *
  155. * It is used:
  156. * - by the rpcapd daemon, when you types a list of allowed connecting hosts
  157. * - by the rpcap client in active mode, when the client waits for incoming
  158. * connections from other hosts
  159. */
  160. #define RPCAP_HOSTLIST_SEP " ,;\n\r"
  161. /*********************************************************
  162. * *
  163. * Protocol messages formats *
  164. * *
  165. *********************************************************/
  166. /*
  167. * WARNING: This file defines some structures that are used to transfer
  168. * data on the network.
  169. * Note that your compiler MUST not insert padding into these structures
  170. * for better alignment.
  171. * These structures have been created in order to be correctly aligned to
  172. * a 32-bit boundary, but be careful in any case.
  173. */
  174. /*
  175. * WARNING: These typedefs MUST be of a specific size.
  176. * You might have to change them on your platform.
  177. *
  178. * XXX - use the C99 types? Microsoft's newer versions of Visual Studio
  179. * support them.
  180. */
  181. typedef unsigned char uint8; /* 8-bit unsigned integer */
  182. typedef unsigned short uint16; /* 16-bit unsigned integer */
  183. typedef unsigned int uint32; /* 32-bit unsigned integer */
  184. typedef int int32; /* 32-bit signed integer */
  185. /* Common header for all the RPCAP messages */
  186. struct rpcap_header
  187. {
  188. uint8 ver; /* RPCAP version number */
  189. uint8 type; /* RPCAP message type (error, findalldevs, ...) */
  190. uint16 value; /* Message-dependent value (not always used) */
  191. uint32 plen; /* Length of the payload of this RPCAP message */
  192. };
  193. /* Format of the message for the interface description (findalldevs command) */
  194. struct rpcap_findalldevs_if
  195. {
  196. uint16 namelen; /* Length of the interface name */
  197. uint16 desclen; /* Length of the interface description */
  198. uint32 flags; /* Interface flags */
  199. uint16 naddr; /* Number of addresses */
  200. uint16 dummy; /* Must be zero */
  201. };
  202. /*
  203. * Format of an address as sent over the wire.
  204. *
  205. * Do *NOT* use struct sockaddr_storage, as the layout for that is
  206. * machine-dependent.
  207. *
  208. * RFC 2553 gives two sample layouts, both of which are 128 bytes long,
  209. * both of which are aligned on an 8-byte boundary, and both of which
  210. * have 2 bytes before the address data.
  211. *
  212. * However, one has a 2-byte address family value at the beginning
  213. * and the other has a 1-byte address length value and a 1-byte
  214. * address family value; this reflects the fact that the original
  215. * BSD sockaddr structure had a 2-byte address family value, which
  216. * was later changed to a 1-byte address length value and a 1-byte
  217. * address family value, when support for variable-length OSI
  218. * network-layer addresses was added.
  219. *
  220. * Furthermore, Solaris's struct sockaddr_storage is 256 bytes
  221. * long.
  222. *
  223. * This structure is supposed to be aligned on an 8-byte boundary;
  224. * the message header is 8 bytes long, so we don't have to do
  225. * anything to ensure it's aligned on that boundary within a packet,
  226. * so we just define it as 128 bytes long, with a 2-byte address
  227. * family. (We only support IPv4 and IPv6 addresses, which are fixed-
  228. * length.) That way, it's the same size as sockaddr_storage on
  229. * Windows, and it'll look like what an older Windows client will
  230. * expect.
  231. *
  232. * In addition, do *NOT* use the host's AF_ value for an address,
  233. * as the value for AF_INET6 is machine-dependent. We use the
  234. * Windows value, so it'll look like what an older Windows client
  235. * will expect.
  236. *
  237. * (The Windows client is the only one that has been distributed
  238. * as a standard part of *pcap; UN*X clients are probably built
  239. * from source by the user or administrator, so they're in a
  240. * better position to upgrade an old client. Therefore, we
  241. * try to make what goes over the wire look like what comes
  242. * from a Windows server.)
  243. */
  244. struct rpcap_sockaddr
  245. {
  246. uint16 family; /* Address family */
  247. char data[128-2]; /* Data */
  248. };
  249. /*
  250. * Format of an IPv4 address as sent over the wire.
  251. */
  252. #define RPCAP_AF_INET 2 /* Value on all OSes */
  253. struct rpcap_sockaddr_in
  254. {
  255. uint16 family; /* Address family */
  256. uint16 port; /* Port number */
  257. uint32 addr; /* IPv4 address */
  258. uint8 zero[8]; /* Padding */
  259. };
  260. /*
  261. * Format of an IPv6 address as sent over the wire.
  262. */
  263. #define RPCAP_AF_INET6 23 /* Value on Windows */
  264. struct rpcap_sockaddr_in6
  265. {
  266. uint16 family; /* Address family */
  267. uint16 port; /* Port number */
  268. uint32 flowinfo; /* IPv6 flow information */
  269. uint8 addr[16]; /* IPv6 address */
  270. uint32 scope_id; /* Scope zone index */
  271. };
  272. /* Format of the message for the address listing (findalldevs command) */
  273. struct rpcap_findalldevs_ifaddr
  274. {
  275. struct rpcap_sockaddr addr; /* Network address */
  276. struct rpcap_sockaddr netmask; /* Netmask for that address */
  277. struct rpcap_sockaddr broadaddr; /* Broadcast address for that address */
  278. struct rpcap_sockaddr dstaddr; /* P2P destination address for that address */
  279. };
  280. /*
  281. * \brief Format of the message of the connection opening reply (open command).
  282. *
  283. * This structure transfers over the network some of the values useful on the client side.
  284. */
  285. struct rpcap_openreply
  286. {
  287. int32 linktype; /* Link type */
  288. int32 tzoff; /* Timezone offset */
  289. };
  290. /* Format of the message that starts a remote capture (startcap command) */
  291. struct rpcap_startcapreq
  292. {
  293. uint32 snaplen; /* Length of the snapshot (number of bytes to capture for each packet) */
  294. uint32 read_timeout; /* Read timeout in milliseconds */
  295. uint16 flags; /* Flags (see RPCAP_STARTCAPREQ_FLAG_xxx) */
  296. uint16 portdata; /* Network port on which the client is waiting at (if 'serveropen') */
  297. };
  298. /* Format of the reply message that devoted to start a remote capture (startcap reply command) */
  299. struct rpcap_startcapreply
  300. {
  301. int32 bufsize; /* Size of the user buffer allocated by WinPcap; it can be different from the one we chose */
  302. uint16 portdata; /* Network port on which the server is waiting at (passive mode only) */
  303. uint16 dummy; /* Must be zero */
  304. };
  305. /*
  306. * \brief Format of the header which encapsulates captured packets when transmitted on the network.
  307. *
  308. * This message requires the general header as well, since we want to be able to exchange
  309. * more information across the network in the future (for example statistics, and kind like that).
  310. */
  311. struct rpcap_pkthdr
  312. {
  313. uint32 timestamp_sec; /* 'struct timeval' compatible, it represents the 'tv_sec' field */
  314. uint32 timestamp_usec; /* 'struct timeval' compatible, it represents the 'tv_usec' field */
  315. uint32 caplen; /* Length of portion present in the capture */
  316. uint32 len; /* Real length this packet (off wire) */
  317. uint32 npkt; /* Ordinal number of the packet (i.e. the first one captured has '1', the second one '2', etc) */
  318. };
  319. /* General header used for the pcap_setfilter() command; keeps just the number of BPF instructions */
  320. struct rpcap_filter
  321. {
  322. uint16 filtertype; /* type of the filter transferred (BPF instructions, ...) */
  323. uint16 dummy; /* Must be zero */
  324. uint32 nitems; /* Number of items contained into the filter (e.g. BPF instructions for BPF filters) */
  325. };
  326. /* Structure that keeps a single BPF instuction; it is repeated 'ninsn' times according to the 'rpcap_filterbpf' header */
  327. struct rpcap_filterbpf_insn
  328. {
  329. uint16 code; /* opcode of the instruction */
  330. uint8 jt; /* relative offset to jump to in case of 'true' */
  331. uint8 jf; /* relative offset to jump to in case of 'false' */
  332. int32 k; /* instruction-dependent value */
  333. };
  334. /* Structure that keeps the data required for the authentication on the remote host */
  335. struct rpcap_auth
  336. {
  337. uint16 type; /* Authentication type */
  338. uint16 dummy; /* Must be zero */
  339. uint16 slen1; /* Length of the first authentication item (e.g. username) */
  340. uint16 slen2; /* Length of the second authentication item (e.g. password) */
  341. };
  342. /* Structure that keeps the statistics about the number of packets captured, dropped, etc. */
  343. struct rpcap_stats
  344. {
  345. uint32 ifrecv; /* Packets received by the kernel filter (i.e. pcap_stats.ps_recv) */
  346. uint32 ifdrop; /* Packets dropped by the network interface (e.g. not enough buffers) (i.e. pcap_stats.ps_ifdrop) */
  347. uint32 krnldrop; /* Packets dropped by the kernel filter (i.e. pcap_stats.ps_drop) */
  348. uint32 svrcapt; /* Packets captured by the RPCAP daemon and sent on the network */
  349. };
  350. /* Structure that is needed to set sampling parameters */
  351. struct rpcap_sampling
  352. {
  353. uint8 method; /* Sampling method */
  354. uint8 dummy1; /* Must be zero */
  355. uint16 dummy2; /* Must be zero */
  356. uint32 value; /* Parameter related to the sampling method */
  357. };
  358. /* Messages field coding */
  359. #define RPCAP_MSG_IS_REPLY 0x080 /* Flag indicating a reply */
  360. #define RPCAP_MSG_ERROR 1 /* Message that keeps an error notification */
  361. #define RPCAP_MSG_FINDALLIF_REQ 2 /* Request to list all the remote interfaces */
  362. #define RPCAP_MSG_OPEN_REQ 3 /* Request to open a remote device */
  363. #define RPCAP_MSG_STARTCAP_REQ 4 /* Request to start a capture on a remote device */
  364. #define RPCAP_MSG_UPDATEFILTER_REQ 5 /* Send a compiled filter into the remote device */
  365. #define RPCAP_MSG_CLOSE 6 /* Close the connection with the remote peer */
  366. #define RPCAP_MSG_PACKET 7 /* This is a 'data' message, which carries a network packet */
  367. #define RPCAP_MSG_AUTH_REQ 8 /* Message that keeps the authentication parameters */
  368. #define RPCAP_MSG_STATS_REQ 9 /* It requires to have network statistics */
  369. #define RPCAP_MSG_ENDCAP_REQ 10 /* Stops the current capture, keeping the device open */
  370. #define RPCAP_MSG_SETSAMPLING_REQ 11 /* Set sampling parameters */
  371. #define RPCAP_MSG_FINDALLIF_REPLY (RPCAP_MSG_FINDALLIF_REQ | RPCAP_MSG_IS_REPLY) /* Keeps the list of all the remote interfaces */
  372. #define RPCAP_MSG_OPEN_REPLY (RPCAP_MSG_OPEN_REQ | RPCAP_MSG_IS_REPLY) /* The remote device has been opened correctly */
  373. #define RPCAP_MSG_STARTCAP_REPLY (RPCAP_MSG_STARTCAP_REQ | RPCAP_MSG_IS_REPLY) /* The capture is starting correctly */
  374. #define RPCAP_MSG_UPDATEFILTER_REPLY (RPCAP_MSG_UPDATEFILTER_REQ | RPCAP_MSG_IS_REPLY) /* The filter has been applied correctly on the remote device */
  375. #define RPCAP_MSG_AUTH_REPLY (RPCAP_MSG_AUTH_REQ | RPCAP_MSG_IS_REPLY) /* Sends a message that says 'ok, authorization successful' */
  376. #define RPCAP_MSG_STATS_REPLY (RPCAP_MSG_STATS_REQ | RPCAP_MSG_IS_REPLY) /* Message that keeps the network statistics */
  377. #define RPCAP_MSG_ENDCAP_REPLY (RPCAP_MSG_ENDCAP_REQ | RPCAP_MSG_IS_REPLY) /* Confirms that the capture stopped successfully */
  378. #define RPCAP_MSG_SETSAMPLING_REPLY (RPCAP_MSG_SETSAMPLING_REQ | RPCAP_MSG_IS_REPLY) /* Confirms that the capture stopped successfully */
  379. #define RPCAP_STARTCAPREQ_FLAG_PROMISC 0x00000001 /* Enables promiscuous mode (default: disabled) */
  380. #define RPCAP_STARTCAPREQ_FLAG_DGRAM 0x00000002 /* Use a datagram (i.e. UDP) connection for the data stream (default: use TCP)*/
  381. #define RPCAP_STARTCAPREQ_FLAG_SERVEROPEN 0x00000004 /* The server has to open the data connection toward the client */
  382. #define RPCAP_STARTCAPREQ_FLAG_INBOUND 0x00000008 /* Capture only inbound packets (take care: the flag has no effect with promiscuous enabled) */
  383. #define RPCAP_STARTCAPREQ_FLAG_OUTBOUND 0x00000010 /* Capture only outbound packets (take care: the flag has no effect with promiscuous enabled) */
  384. #define RPCAP_UPDATEFILTER_BPF 1 /* This code tells us that the filter is encoded with the BPF/NPF syntax */
  385. /* Network error codes */
  386. #define PCAP_ERR_NETW 1 /* Network error */
  387. #define PCAP_ERR_INITTIMEOUT 2 /* The RPCAP initial timeout has expired */
  388. #define PCAP_ERR_AUTH 3 /* Generic authentication error */
  389. #define PCAP_ERR_FINDALLIF 4 /* Generic findalldevs error */
  390. #define PCAP_ERR_NOREMOTEIF 5 /* The findalldevs was ok, but the remote end had no interfaces to list */
  391. #define PCAP_ERR_OPEN 6 /* Generic pcap_open error */
  392. #define PCAP_ERR_UPDATEFILTER 7 /* Generic updatefilter error */
  393. #define PCAP_ERR_GETSTATS 8 /* Generic pcap_stats error */
  394. #define PCAP_ERR_READEX 9 /* Generic pcap_next_ex error */
  395. #define PCAP_ERR_HOSTNOAUTH 10 /* The host is not authorized to connect to this server */
  396. #define PCAP_ERR_REMOTEACCEPT 11 /* Generic pcap_remoteaccept error */
  397. #define PCAP_ERR_STARTCAPTURE 12 /* Generic pcap_startcapture error */
  398. #define PCAP_ERR_ENDCAPTURE 13 /* Generic pcap_endcapture error */
  399. #define PCAP_ERR_RUNTIMETIMEOUT 14 /* The RPCAP run-time timeout has expired */
  400. #define PCAP_ERR_SETSAMPLING 15 /* Error during the settings of sampling parameters */
  401. #define PCAP_ERR_WRONGMSG 16 /* The other end endpoint sent a message which has not been recognized */
  402. #define PCAP_ERR_WRONGVER 17 /* The other end endpoint has a version number that is not compatible with our */
  403. /*
  404. * \brief Buffer used by socket functions to send-receive packets.
  405. * In case you plan to have messages larger than this value, you have to increase it.
  406. */
  407. #define RPCAP_NETBUF_SIZE 64000
  408. /*********************************************************
  409. * *
  410. * Routines used by the rpcap client and rpcap daemon *
  411. * *
  412. *********************************************************/
  413. #include "sockutils.h"
  414. extern void rpcap_createhdr(struct rpcap_header *header, uint8 ver, uint8 type, uint16 value, uint32 length);
  415. extern const char *rpcap_msg_type_string(uint8 type);
  416. extern int rpcap_senderror(SOCKET sock, uint8 ver, uint16 errcode, const char *error, char *errbuf);
  417. #endif