pcap-int.h 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553
  1. /*
  2. * Copyright (c) 1994, 1995, 1996
  3. * The Regents of the University of California. All rights reserved.
  4. *
  5. * Redistribution and use in source and binary forms, with or without
  6. * modification, are permitted provided that the following conditions
  7. * are met:
  8. * 1. Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * 2. Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in the
  12. * documentation and/or other materials provided with the distribution.
  13. * 3. All advertising materials mentioning features or use of this software
  14. * must display the following acknowledgement:
  15. * This product includes software developed by the Computer Systems
  16. * Engineering Group at Lawrence Berkeley Laboratory.
  17. * 4. Neither the name of the University nor of the Laboratory may be used
  18. * to endorse or promote products derived from this software without
  19. * specific prior written permission.
  20. *
  21. * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  22. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24. * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31. * SUCH DAMAGE.
  32. *
  33. * @(#) $Header: /home/cvs/plc-utils/VisualStudioNET/include/pcap-int.h,v 1.1.1.1 2011-08-27 15:30:16 cmaier Exp $ (LBL)
  34. */
  35. #ifndef pcap_int_h
  36. #define pcap_int_h
  37. #ifdef __cplusplus
  38. extern "C"
  39. {
  40. #endif
  41. #include <pcap.h>
  42. #ifdef WIN32
  43. #include <Packet32.h>
  44. #endif /* WIN32 */
  45. #ifdef MSDOS
  46. #include <fcntl.h>
  47. #include <io.h>
  48. #endif
  49. /*
  50. * Savefile
  51. */
  52. typedef enum
  53. {
  54. NOT_SWAPPED,
  55. SWAPPED,
  56. MAYBE_SWAPPED
  57. }
  58. swapped_type_t;
  59. struct pcap_sf
  60. {
  61. FILE *rfile;
  62. int swapped;
  63. int hdrsize;
  64. swapped_type_t lengths_swapped;
  65. int version_major;
  66. int version_minor;
  67. u_char *base;
  68. };
  69. struct pcap_md
  70. {
  71. struct pcap_stat stat;
  72. /*XXX*/
  73. int use_bpf;
  74. /* using kernel filter */
  75. u_long TotPkts;
  76. /* can't oflow for 79 hrs on ether */
  77. u_long TotAccepted;
  78. /* count accepted by filter */
  79. u_long TotDrops;
  80. /* count of dropped packets */
  81. long TotMissed;
  82. /* missed by i/f during this run */
  83. long OrigMissed;
  84. /* missed by i/f before this run */
  85. char *device;
  86. /* device name */
  87. #ifdef linux
  88. int sock_packet;
  89. /* using Linux 2.0 compatible interface */
  90. int timeout;
  91. /* timeout specified to pcap_open_live */
  92. int clear_promisc;
  93. /* must clear promiscuous mode when we close */
  94. int cooked;
  95. /* using SOCK_DGRAM rather than SOCK_RAW */
  96. int ifindex;
  97. /* interface index of device we're bound to */
  98. int lo_ifindex;
  99. /* interface index of the loopback device */
  100. struct pcap *next;
  101. /* list of open promiscuous sock_packet pcaps */
  102. u_int packets_read;
  103. /* count of packets read with recvfrom() */
  104. #endif
  105. #ifdef HAVE_DAG_API
  106. #ifdef HAVE_DAG_STREAMS_API
  107. u_char *dag_mem_bottom;
  108. /* DAG card current memory bottom pointer */
  109. u_char *dag_mem_top;
  110. /* DAG card current memory top pointer */
  111. #else
  112. void *dag_mem_base;
  113. /* DAG card memory base address */
  114. u_int dag_mem_bottom;
  115. /* DAG card current memory bottom offset */
  116. u_int dag_mem_top;
  117. /* DAG card current memory top offset */
  118. #endif /* HAVE_DAG_STREAMS_API */
  119. int dag_fcs_bits;
  120. /* Number of checksum bits from link layer */
  121. int dag_offset_flags;
  122. /* Flags to pass to dag_offset(). */
  123. int dag_stream;
  124. /* DAG stream number */
  125. int dag_timeout;
  126. /* timeout specified to pcap_open_live.
  127. * Same as in linux above, introduce
  128. * generally? */
  129. #endif /* HAVE_DAG_API */
  130. #ifdef HAVE_REMOTE
  131. /*!
  132. * There is really a mess with previous variables, and it seems to me that they are not used
  133. * (they are used in pcap_pf.c only). I think we have to start using them.
  134. * The meaning is the following:
  135. *
  136. * - TotPkts: the amount of packets received by the bpf filter, *before* applying the filter
  137. * - TotAccepted: the amount of packets that satisfies the filter
  138. * - TotDrops: the amount of packet that were dropped into the kernel buffer because of lack of space
  139. * - TotMissed: the amount of packets that were dropped by the physical interface; it is basically
  140. * the value of the hardware counter into the card. This number is never put to zero, so this number
  141. * takes into account the *total* number of interface drops starting from the interface power-on.
  142. * - OrigMissed: the amount of packets that were dropped by the interface *when the capture begins*.
  143. * This value is used to detect the number of packets dropped by the interface *during the present
  144. * capture*, so that (ps_ifdrops= TotMissed - OrigMissed).
  145. */
  146. unsigned int TotNetDrops;
  147. //!< keeps the number of packets that have been dropped by the network
  148. /*!
  149. * \brief It keeps the number of packets that have been received by the application.
  150. *
  151. * Packets dropped by the kernel buffer are not counted in this variable. The variable is always
  152. * equal to (TotAccepted - TotDrops), exept for the case of remote capture, in which we have also
  153. * packets in fligh, i.e. that have been transmitted by the remote host, but that have not been
  154. * received (yet) from the client. In this case, (TotAccepted - TotDrops - TotNetDrops) gives a
  155. * wrong result, since this number does not corresponds always to the number of packet received by
  156. * the application. For this reason, in the remote capture we need another variable that takes
  157. * into account of the number of packets actually received by the application.
  158. */
  159. unsigned int TotCapt;
  160. #endif /* HAVE_REMOTE */
  161. };
  162. /*
  163. * Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H
  164. * Tru64 UNIX, and NetBSD pad to make everything line up on a nice boundary.
  165. */
  166. #if defined(ultrix) || defined(__osf__) || (defined(__NetBSD__) && __NetBSD_Version__ > 106000000)
  167. #define PCAP_FDDIPAD 3
  168. #endif
  169. struct pcap
  170. {
  171. #ifdef WIN32
  172. ADAPTER *adapter;
  173. LPPACKET Packet;
  174. int timeout;
  175. int nonblock;
  176. #else
  177. int fd;
  178. int selectable_fd;
  179. int send_fd;
  180. #endif /* WIN32 */
  181. int snapshot;
  182. int linktype;
  183. int tzoff;
  184. /* timezone offset */
  185. int offset;
  186. /* offset for proper alignment */
  187. int break_loop;
  188. /* flag set to force break from packet-reading loop */
  189. #ifdef PCAP_FDDIPAD
  190. int fddipad;
  191. #endif
  192. #ifdef MSDOS
  193. int inter_packet_wait;
  194. /* offline: wait between packets */
  195. void (*wait_proc)(void);
  196. /* call proc while waiting */
  197. #endif
  198. struct pcap_sf sf;
  199. struct pcap_md md;
  200. /*
  201. * Read buffer.
  202. */
  203. int bufsize;
  204. u_char *buffer;
  205. u_char *bp;
  206. int cc;
  207. /*
  208. * Place holder for pcap_next().
  209. */
  210. u_char *pkt;
  211. /* We're accepting only packets in this direction/these directions. */
  212. pcap_direction_t direction;
  213. /*
  214. * Methods.
  215. */
  216. int (*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);
  217. int (*inject_op)(pcap_t *, const void *, size_t);
  218. int (*setfilter_op)(pcap_t *, struct bpf_program *);
  219. int (*setdirection_op)(pcap_t *, pcap_direction_t);
  220. int (*set_datalink_op)(pcap_t *, int);
  221. int (*getnonblock_op)(pcap_t *, char *);
  222. int (*setnonblock_op)(pcap_t *, int, char *);
  223. int (*stats_op)(pcap_t *, struct pcap_stat *);
  224. void (*close_op)(pcap_t *);
  225. /*
  226. * Placeholder for filter code if bpf not in kernel.
  227. */
  228. struct bpf_program fcode;
  229. char errbuf [PCAP_ERRBUF_SIZE + 1];
  230. int dlt_count;
  231. u_int *dlt_list;
  232. struct pcap_pkthdr pcap_header;
  233. /* This is needed for the pcap_next_ex() to work */
  234. #ifdef HAVE_REMOTE
  235. #ifndef WIN32 // Win32 already defines 'timeout'
  236. int timeout;
  237. //!< timeout to be used in the pcap_open()
  238. #endif
  239. /*! \brief '1' if we're the network client; needed by several functions (like pcap_setfilter() ) to know if
  240. * they have to use the socket or they have to open the local adapter. */
  241. int rmt_clientside;
  242. SOCKET rmt_sockctrl;
  243. //!< socket ID of the socket used for the control connection
  244. SOCKET rmt_sockdata;
  245. //!< socket ID of the socket used for the data connection
  246. int rmt_flags;
  247. //!< we have to save flags, since they are passed by the pcap_open_live(), but they are used by the pcap_startcapture()
  248. int rmt_capstarted;
  249. //!< 'true' if the capture is already started (needed to knoe if we have to call the pcap_startcapture()
  250. struct pcap_samp rmt_samp;
  251. //!< Keeps the parameters related to the sampling process.
  252. char *currentfilter;
  253. //!< Pointer to a buffer (allocated at run-time) that stores the current filter. Needed when flag PCAP_OPENFLAG_NOCAPTURE_RPCAP is turned on.
  254. #endif /* HAVE_REMOTE */
  255. };
  256. /*
  257. * This is a timeval as stored in a savefile.
  258. * It has to use the same types everywhere, independent of the actual
  259. * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some
  260. * platforms and 64-bit tv_sec values on other platforms, and writing
  261. * out native `struct timeval' values would mean files could only be
  262. * read on systems with the same tv_sec size as the system on which
  263. * the file was written.
  264. */
  265. struct pcap_timeval
  266. {
  267. bpf_int32 tv_sec;
  268. /* seconds */
  269. bpf_int32 tv_usec;
  270. /* microseconds */
  271. };
  272. /*
  273. * This is a `pcap_pkthdr' as actually stored in a savefile.
  274. *
  275. * Do not change the format of this structure, in any way (this includes
  276. * changes that only affect the length of fields in this structure),
  277. * and do not make the time stamp anything other than seconds and
  278. * microseconds (e.g., seconds and nanoseconds). Instead:
  279. *
  280. * introduce a new structure for the new format;
  281. *
  282. * send mail to "tcpdump-workers@tcpdump.org", requesting a new
  283. * magic number for your new capture file format, and, when
  284. * you get the new magic number, put it in "savefile.c";
  285. *
  286. * use that magic number for save files with the changed record
  287. * header;
  288. *
  289. * make the code in "savefile.c" capable of reading files with
  290. * the old record header as well as files with the new record header
  291. * (using the magic number to determine the header format).
  292. *
  293. * Then supply the changes to "patches@tcpdump.org", so that future
  294. * versions of libpcap and programs that use it (such as tcpdump) will
  295. * be able to read your new capture file format.
  296. */
  297. struct pcap_sf_pkthdr
  298. {
  299. struct pcap_timeval ts;
  300. /* time stamp */
  301. bpf_u_int32 caplen;
  302. /* length of portion present */
  303. bpf_u_int32 len;
  304. /* length this packet (off wire) */
  305. };
  306. /*
  307. * How a `pcap_pkthdr' is actually stored in savefiles written
  308. * by some patched versions of libpcap (e.g. the ones in Red
  309. * Hat Linux 6.1 and 6.2).
  310. *
  311. * Do not change the format of this structure, in any way (this includes
  312. * changes that only affect the length of fields in this structure).
  313. * Instead, introduce a new structure, as per the above.
  314. */
  315. struct pcap_sf_patched_pkthdr
  316. {
  317. struct pcap_timeval ts;
  318. /* time stamp */
  319. bpf_u_int32 caplen;
  320. /* length of portion present */
  321. bpf_u_int32 len;
  322. /* length this packet (off wire) */
  323. int index;
  324. unsigned short protocol;
  325. unsigned char pkt_type;
  326. };
  327. int yylex (void);
  328. #ifndef min
  329. #define min(a, b) ((a) > (b) ? (b) : (a))
  330. #endif
  331. /* XXX should these be in pcap.h? */
  332. int pcap_offline_read (pcap_t *, int, pcap_handler, u_char *);
  333. int pcap_read (pcap_t *, int cnt, pcap_handler, u_char *);
  334. #ifndef HAVE_STRLCPY
  335. #define strlcpy(x, y, z) \
  336. (strncpy ((x), (y), (z)), \ ((z) <= 0? 0: ((x)[(z) - 1] = '\0')), \ strlen ((y)))
  337. #endif
  338. #include <stdarg.h>
  339. #if !defined(HAVE_SNPRINTF)
  340. #define snprintf pcap_snprintf
  341. extern int snprintf (char *, size_t, const char *, ...);
  342. #endif
  343. #if !defined(HAVE_VSNPRINTF)
  344. #define vsnprintf pcap_vsnprintf
  345. extern int vsnprintf (char *, size_t, const char *, va_list ap);
  346. #endif
  347. /*
  348. * Routines that most pcap implementations can use for non-blocking mode.
  349. */
  350. #if !defined(WIN32) && !defined(MSDOS)
  351. int pcap_getnonblock_fd (pcap_t *, char *);
  352. int pcap_setnonblock_fd (pcap_t *p, int, char *);
  353. #endif
  354. void pcap_close_common (pcap_t *);
  355. /*
  356. * Internal interfaces for "pcap_findalldevs()".
  357. *
  358. * "pcap_platform_finddevs()" is a platform-dependent routine to
  359. * add devices not found by the "standard" mechanisms (SIOCGIFCONF,
  360. * "getifaddrs()", etc..
  361. *
  362. * "pcap_add_if()" adds an interface to the list of interfaces.
  363. */
  364. int pcap_platform_finddevs (pcap_if_t **, char *);
  365. int add_addr_to_iflist (pcap_if_t **, const char *, u_int, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, char *);
  366. int pcap_add_if (pcap_if_t **, const char *, u_int, const char *, char *);
  367. struct sockaddr *dup_sockaddr (struct sockaddr *, size_t);
  368. int add_or_find_if (pcap_if_t **, pcap_if_t **, const char *, u_int, const char *, char *);
  369. #ifdef WIN32
  370. char *pcap_win32strerror (void);
  371. #endif
  372. int install_bpf_program (pcap_t *, struct bpf_program *);
  373. int pcap_strcasecmp (const char *, const char *);
  374. #ifdef __cplusplus
  375. }
  376. #endif
  377. #endif