Added all the include and lib files for WinPCap.
Warning: don't forget to provide the WinPCap DLL with the DeSmuME binaries when releasing!
This commit is contained in:
luigi__
parent
331c4ee269
commit
061f375146
|
|
@ -0,0 +1,90 @@
|
|||
/*++ BUILD Version: 0004 // Increment this if a change has global effects
|
||||
Copyright (c) 1992-1993 Microsoft Corporation
|
||||
Module Name:
|
||||
devioctl.h
|
||||
Revision History:
|
||||
-- */
|
||||
// begin_winioctl
|
||||
#ifndef _DEVIOCTL_
|
||||
#define _DEVIOCTL_
|
||||
// begin_ntddk begin_nthal begin_ntifs
|
||||
//
|
||||
// Define the various device type values. Note that values used by Microsoft
|
||||
// Corporation are in the range 0-32767, and 32768-65535 are reserved for use
|
||||
// by customers.
|
||||
//
|
||||
#define DEVICE_TYPE ULONG
|
||||
#define FILE_DEVICE_BEEP 0x00000001
|
||||
#define FILE_DEVICE_CD_ROM 0x00000002
|
||||
#define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
|
||||
#define FILE_DEVICE_CONTROLLER 0x00000004
|
||||
#define FILE_DEVICE_DATALINK 0x00000005
|
||||
#define FILE_DEVICE_DFS 0x00000006
|
||||
#define FILE_DEVICE_DISK 0x00000007
|
||||
#define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
|
||||
#define FILE_DEVICE_FILE_SYSTEM 0x00000009
|
||||
#define FILE_DEVICE_INPORT_PORT 0x0000000a
|
||||
#define FILE_DEVICE_KEYBOARD 0x0000000b
|
||||
#define FILE_DEVICE_MAILSLOT 0x0000000c
|
||||
#define FILE_DEVICE_MIDI_IN 0x0000000d
|
||||
#define FILE_DEVICE_MIDI_OUT 0x0000000e
|
||||
#define FILE_DEVICE_MOUSE 0x0000000f
|
||||
#define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
|
||||
#define FILE_DEVICE_NAMED_PIPE 0x00000011
|
||||
#define FILE_DEVICE_NETWORK 0x00000012
|
||||
#define FILE_DEVICE_NETWORK_BROWSER 0x00000013
|
||||
#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
|
||||
#define FILE_DEVICE_NULL 0x00000015
|
||||
#define FILE_DEVICE_PARALLEL_PORT 0x00000016
|
||||
#define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
|
||||
#define FILE_DEVICE_PRINTER 0x00000018
|
||||
#define FILE_DEVICE_SCANNER 0x00000019
|
||||
#define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
|
||||
#define FILE_DEVICE_SERIAL_PORT 0x0000001b
|
||||
#define FILE_DEVICE_SCREEN 0x0000001c
|
||||
#define FILE_DEVICE_SOUND 0x0000001d
|
||||
#define FILE_DEVICE_STREAMS 0x0000001e
|
||||
#define FILE_DEVICE_TAPE 0x0000001f
|
||||
#define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
|
||||
#define FILE_DEVICE_TRANSPORT 0x00000021
|
||||
#define FILE_DEVICE_UNKNOWN 0x00000022
|
||||
#define FILE_DEVICE_VIDEO 0x00000023
|
||||
#define FILE_DEVICE_VIRTUAL_DISK 0x00000024
|
||||
#define FILE_DEVICE_WAVE_IN 0x00000025
|
||||
#define FILE_DEVICE_WAVE_OUT 0x00000026
|
||||
#define FILE_DEVICE_8042_PORT 0x00000027
|
||||
#define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
|
||||
#define FILE_DEVICE_BATTERY 0x00000029
|
||||
#define FILE_DEVICE_BUS_EXTENDER 0x0000002a
|
||||
#define FILE_DEVICE_MODEM 0x0000002b
|
||||
#define FILE_DEVICE_VDM 0x0000002c
|
||||
#define FILE_DEVICE_MASS_STORAGE 0x0000002d
|
||||
//
|
||||
// Macro definition for defining IOCTL and FSCTL function control codes. Note
|
||||
// that function codes 0-2047 are reserved for Microsoft Corporation, and
|
||||
// 2048-4095 are reserved for customers.
|
||||
//
|
||||
#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
|
||||
((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
|
||||
)
|
||||
//
|
||||
// Define the method codes for how buffers are passed for I/O and FS controls
|
||||
//
|
||||
#define METHOD_BUFFERED 0
|
||||
#define METHOD_IN_DIRECT 1
|
||||
#define METHOD_OUT_DIRECT 2
|
||||
#define METHOD_NEITHER 3
|
||||
//
|
||||
// Define the access check value for any access
|
||||
//
|
||||
//
|
||||
// The FILE_READ_ACCESS and FILE_WRITE_ACCESS constants are also defined in
|
||||
// ntioapi.h as FILE_READ_DATA and FILE_WRITE_DATA. The values for these
|
||||
// constants *MUST* always be in sync.
|
||||
//
|
||||
#define FILE_ANY_ACCESS 0
|
||||
#define FILE_READ_ACCESS ( 0x0001 ) // file & pipe
|
||||
#define FILE_WRITE_ACCESS ( 0x0002 ) // file & pipe
|
||||
// end_ntddk end_nthal end_ntifs
|
||||
#endif // _DEVIOCTL_
|
||||
// end_winioctl
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/* @(#) $Header: /tcpdump/master/libpcap/Win32/Include/Gnuc.h,v 1.1 2002/08/01 08:33:05 risso Exp $ (LBL) */
|
||||
|
||||
/* Define __P() macro, if necessary */
|
||||
|
||||
#ifndef __P
|
||||
#if __STDC__
|
||||
#define __P(protos) protos
|
||||
#else
|
||||
#define __P(protos) ()
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* inline foo */
|
||||
#ifndef __cplusplus
|
||||
#ifdef __GNUC__
|
||||
#define inline __inline
|
||||
#else
|
||||
#define inline
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Handle new and old "dead" routine prototypes
|
||||
*
|
||||
* For example:
|
||||
*
|
||||
* __dead void foo(void) __attribute__((volatile));
|
||||
*
|
||||
*/
|
||||
#ifdef __GNUC__
|
||||
#ifndef __dead
|
||||
#define __dead volatile
|
||||
#endif
|
||||
#if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 5)
|
||||
#ifndef __attribute__
|
||||
#define __attribute__(args)
|
||||
#endif
|
||||
#endif
|
||||
#else
|
||||
#ifndef __dead
|
||||
#define __dead
|
||||
#endif
|
||||
#ifndef __attribute__
|
||||
#define __attribute__(args)
|
||||
#endif
|
||||
#endif
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,26 @@
|
|||
|
||||
#ifndef __NTDDPACKET
|
||||
#define __NTDDPACKET 1
|
||||
#include "devioctl.h"
|
||||
/*#include <packon.h> */
|
||||
struct _PACKET_OID_DATA {
|
||||
ULONG Oid;
|
||||
ULONG Length;
|
||||
UCHAR Data[1];
|
||||
};
|
||||
|
||||
typedef struct _PACKET_OID_DATA PACKET_OID_DATA, *PPACKET_OID_DATA;
|
||||
|
||||
/*#include <packoff.h> */
|
||||
#define FILE_DEVICE_PROTOCOL 0x8000
|
||||
#define IOCTL_PROTOCOL_QUERY_OID CTL_CODE(FILE_DEVICE_PROTOCOL, 0 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_SET_OID CTL_CODE(FILE_DEVICE_PROTOCOL, 1 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_STATISTICS CTL_CODE(FILE_DEVICE_PROTOCOL, 2 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_RESET CTL_CODE(FILE_DEVICE_PROTOCOL, 3 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_READ CTL_CODE(FILE_DEVICE_PROTOCOL, 4 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_WRITE CTL_CODE(FILE_DEVICE_PROTOCOL, 5 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_MACNAME CTL_CODE(FILE_DEVICE_PROTOCOL, 6 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_OPEN CTL_CODE(FILE_DEVICE_PROTOCOL, 7 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_CLOSE CTL_CODE(FILE_DEVICE_PROTOCOL, 8 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
|
||||
#endif
|
||||
Binary file not shown.
|
|
@ -0,0 +1,405 @@
|
|||
/*
|
||||
* Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
|
||||
* Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino, CACE Technologies
|
||||
* nor the names of its contributors may be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
/** @ingroup packetapi
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** @defgroup packet32h Packet.dll definitions and data structures
|
||||
* Packet32.h contains the data structures and the definitions used by packet.dll.
|
||||
* The file is used both by the Win9x and the WinNTx versions of packet.dll, and can be included
|
||||
* by the applications that use the functions of this library
|
||||
* @{
|
||||
*/
|
||||
|
||||
#ifndef __PACKET32
|
||||
#define __PACKET32
|
||||
|
||||
#include <winsock2.h>
|
||||
|
||||
#include "devioctl.h"
|
||||
|
||||
#ifdef HAVE_AIRPCAP_API
|
||||
#include <airpcap.h>
|
||||
#else
|
||||
#if !defined(AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_)
|
||||
#define AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_
|
||||
typedef struct _AirpcapHandle *PAirpcapHandle;
|
||||
#endif /* AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_ */
|
||||
#endif /* HAVE_AIRPCAP_API */
|
||||
|
||||
#ifdef HAVE_DAG_API
|
||||
#include <dagc.h>
|
||||
#endif /* HAVE_DAG_API */
|
||||
|
||||
// Working modes
|
||||
#define PACKET_MODE_CAPT 0x0 ///< Capture mode
|
||||
#define PACKET_MODE_STAT 0x1 ///< Statistical mode
|
||||
#define PACKET_MODE_MON 0x2 ///< Monitoring mode
|
||||
#define PACKET_MODE_DUMP 0x10 ///< Dump mode
|
||||
#define PACKET_MODE_STAT_DUMP MODE_DUMP | MODE_STAT ///< Statistical dump Mode
|
||||
|
||||
// ioctls
|
||||
#define FILE_DEVICE_PROTOCOL 0x8000
|
||||
|
||||
#define IOCTL_PROTOCOL_STATISTICS CTL_CODE(FILE_DEVICE_PROTOCOL, 2 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_RESET CTL_CODE(FILE_DEVICE_PROTOCOL, 3 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_READ CTL_CODE(FILE_DEVICE_PROTOCOL, 4 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_WRITE CTL_CODE(FILE_DEVICE_PROTOCOL, 5 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_PROTOCOL_MACNAME CTL_CODE(FILE_DEVICE_PROTOCOL, 6 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_OPEN CTL_CODE(FILE_DEVICE_PROTOCOL, 7 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
#define IOCTL_CLOSE CTL_CODE(FILE_DEVICE_PROTOCOL, 8 , METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
|
||||
#define pBIOCSETBUFFERSIZE 9592 ///< IOCTL code: set kernel buffer size.
|
||||
#define pBIOCSETF 9030 ///< IOCTL code: set packet filtering program.
|
||||
#define pBIOCGSTATS 9031 ///< IOCTL code: get the capture stats.
|
||||
#define pBIOCSRTIMEOUT 7416 ///< IOCTL code: set the read timeout.
|
||||
#define pBIOCSMODE 7412 ///< IOCTL code: set working mode.
|
||||
#define pBIOCSWRITEREP 7413 ///< IOCTL code: set number of physical repetions of every packet written by the app.
|
||||
#define pBIOCSMINTOCOPY 7414 ///< IOCTL code: set minimum amount of data in the kernel buffer that unlocks a read call.
|
||||
#define pBIOCSETOID 2147483648U ///< IOCTL code: set an OID value.
|
||||
#define pBIOCQUERYOID 2147483652U ///< IOCTL code: get an OID value.
|
||||
#define pATTACHPROCESS 7117 ///< IOCTL code: attach a process to the driver. Used in Win9x only.
|
||||
#define pDETACHPROCESS 7118 ///< IOCTL code: detach a process from the driver. Used in Win9x only.
|
||||
#define pBIOCSETDUMPFILENAME 9029 ///< IOCTL code: set the name of a the file used by kernel dump mode.
|
||||
#define pBIOCEVNAME 7415 ///< IOCTL code: get the name of the event that the driver signals when some data is present in the buffer.
|
||||
#define pBIOCSENDPACKETSNOSYNC 9032 ///< IOCTL code: Send a buffer containing multiple packets to the network, ignoring the timestamps associated with the packets.
|
||||
#define pBIOCSENDPACKETSSYNC 9033 ///< IOCTL code: Send a buffer containing multiple packets to the network, respecting the timestamps associated with the packets.
|
||||
#define pBIOCSETDUMPLIMITS 9034 ///< IOCTL code: Set the dump file limits. See the PacketSetDumpLimits() function.
|
||||
#define pBIOCISDUMPENDED 7411 ///< IOCTL code: Get the status of the kernel dump process. See the PacketIsDumpEnded() function.
|
||||
#define pBIOCISETLOBBEH 7410 ///< IOCTL code: Set the loopback behavior of the driver with packets sent by itself: capture or drop.
|
||||
#define pBIOCSETEVENTHANDLE 7920 ///< IOCTL code: Passes the read event HANDLE allocated by the user (packet.dll) to the kernel level driver.
|
||||
|
||||
#define pBIOCSTIMEZONE 7471 ///< IOCTL code: set time zone. Used in Win9x only.
|
||||
|
||||
|
||||
/// Alignment macro. Defines the alignment size.
|
||||
#define Packet_ALIGNMENT sizeof(int)
|
||||
/// Alignment macro. Rounds up to the next even multiple of Packet_ALIGNMENT.
|
||||
#define Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1))
|
||||
|
||||
#define NdisMediumNull -1 ///< Custom linktype: NDIS doesn't provide an equivalent
|
||||
#define NdisMediumCHDLC -2 ///< Custom linktype: NDIS doesn't provide an equivalent
|
||||
#define NdisMediumPPPSerial -3 ///< Custom linktype: NDIS doesn't provide an equivalent
|
||||
#define NdisMediumBare80211 -4 ///< Custom linktype: NDIS doesn't provide an equivalent
|
||||
#define NdisMediumRadio80211 -5 ///< Custom linktype: NDIS doesn't provide an equivalent
|
||||
|
||||
// Loopback behaviour definitions
|
||||
#define NPF_DISABLE_LOOPBACK 1 ///< Drop the packets sent by the NPF driver
|
||||
#define NPF_ENABLE_LOOPBACK 2 ///< Capture the packets sent by the NPF driver
|
||||
|
||||
/*!
|
||||
\brief Network type structure.
|
||||
|
||||
This structure is used by the PacketGetNetType() function to return information on the current adapter's type and speed.
|
||||
*/
|
||||
typedef struct NetType
|
||||
{
|
||||
UINT LinkType; ///< The MAC of the current network adapter (see function PacketGetNetType() for more information)
|
||||
ULONGLONG LinkSpeed; ///< The speed of the network in bits per second
|
||||
}NetType;
|
||||
|
||||
|
||||
//some definitions stolen from libpcap
|
||||
|
||||
#ifndef BPF_MAJOR_VERSION
|
||||
|
||||
/*!
|
||||
\brief A BPF pseudo-assembly program.
|
||||
|
||||
The program will be injected in the kernel by the PacketSetBPF() function and applied to every incoming packet.
|
||||
*/
|
||||
struct bpf_program
|
||||
{
|
||||
UINT bf_len; ///< Indicates the number of instructions of the program, i.e. the number of struct bpf_insn that will follow.
|
||||
struct bpf_insn *bf_insns; ///< A pointer to the first instruction of the program.
|
||||
};
|
||||
|
||||
/*!
|
||||
\brief A single BPF pseudo-instruction.
|
||||
|
||||
bpf_insn contains a single instruction for the BPF register-machine. It is used to send a filter program to the driver.
|
||||
*/
|
||||
struct bpf_insn
|
||||
{
|
||||
USHORT code; ///< Instruction type and addressing mode.
|
||||
UCHAR jt; ///< Jump if true
|
||||
UCHAR jf; ///< Jump if false
|
||||
int k; ///< Generic field used for various purposes.
|
||||
};
|
||||
|
||||
/*!
|
||||
\brief Structure that contains a couple of statistics values on the current capture.
|
||||
|
||||
It is used by packet.dll to return statistics about a capture session.
|
||||
*/
|
||||
struct bpf_stat
|
||||
{
|
||||
UINT bs_recv; ///< Number of packets that the driver received from the network adapter
|
||||
///< from the beginning of the current capture. This value includes the packets
|
||||
///< lost by the driver.
|
||||
UINT bs_drop; ///< number of packets that the driver lost from the beginning of a capture.
|
||||
///< Basically, a packet is lost when the the buffer of the driver is full.
|
||||
///< In this situation the packet cannot be stored and the driver rejects it.
|
||||
UINT ps_ifdrop; ///< drops by interface. XXX not yet supported
|
||||
UINT bs_capt; ///< number of packets that pass the filter, find place in the kernel buffer and
|
||||
///< thus reach the application.
|
||||
};
|
||||
|
||||
/*!
|
||||
\brief Packet header.
|
||||
|
||||
This structure defines the header associated with every packet delivered to the application.
|
||||
*/
|
||||
struct bpf_hdr
|
||||
{
|
||||
struct timeval bh_tstamp; ///< The timestamp associated with the captured packet.
|
||||
///< It is stored in a TimeVal structure.
|
||||
UINT bh_caplen; ///< Length of captured portion. The captured portion <b>can be different</b>
|
||||
///< from the original packet, because it is possible (with a proper filter)
|
||||
///< to instruct the driver to capture only a portion of the packets.
|
||||
UINT bh_datalen; ///< Original length of packet
|
||||
USHORT bh_hdrlen; ///< Length of bpf header (this struct plus alignment padding). In some cases,
|
||||
///< a padding could be added between the end of this structure and the packet
|
||||
///< data for performance reasons. This filed can be used to retrieve the actual data
|
||||
///< of the packet.
|
||||
};
|
||||
|
||||
/*!
|
||||
\brief Dump packet header.
|
||||
|
||||
This structure defines the header associated with the packets in a buffer to be used with PacketSendPackets().
|
||||
It is simpler than the bpf_hdr, because it corresponds to the header associated by WinPcap and libpcap to a
|
||||
packet in a dump file. This makes straightforward sending WinPcap dump files to the network.
|
||||
*/
|
||||
struct dump_bpf_hdr{
|
||||
struct timeval ts; ///< Time stamp of the packet
|
||||
UINT caplen; ///< Length of captured portion. The captured portion can smaller than the
|
||||
///< the original packet, because it is possible (with a proper filter) to
|
||||
///< instruct the driver to capture only a portion of the packets.
|
||||
UINT len; ///< Length of the original packet (off wire).
|
||||
};
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
struct bpf_stat;
|
||||
|
||||
#define DOSNAMEPREFIX TEXT("Packet_") ///< Prefix added to the adapters device names to create the WinPcap devices
|
||||
#define MAX_LINK_NAME_LENGTH 64 //< Maximum length of the devices symbolic links
|
||||
#define NMAX_PACKET 65535
|
||||
|
||||
/*!
|
||||
\brief Addresses of a network adapter.
|
||||
|
||||
This structure is used by the PacketGetNetInfoEx() function to return the IP addresses associated with
|
||||
an adapter.
|
||||
*/
|
||||
typedef struct npf_if_addr {
|
||||
struct sockaddr_storage IPAddress; ///< IP address.
|
||||
struct sockaddr_storage SubnetMask; ///< Netmask for that address.
|
||||
struct sockaddr_storage Broadcast; ///< Broadcast address.
|
||||
}npf_if_addr;
|
||||
|
||||
|
||||
#define ADAPTER_NAME_LENGTH 256 + 12 ///< Maximum length for the name of an adapter. The value is the same used by the IP Helper API.
|
||||
#define ADAPTER_DESC_LENGTH 128 ///< Maximum length for the description of an adapter. The value is the same used by the IP Helper API.
|
||||
#define MAX_MAC_ADDR_LENGTH 8 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.
|
||||
#define MAX_NETWORK_ADDRESSES 16 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.
|
||||
|
||||
|
||||
typedef struct WAN_ADAPTER_INT WAN_ADAPTER; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API
|
||||
typedef WAN_ADAPTER *PWAN_ADAPTER; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API
|
||||
|
||||
#define INFO_FLAG_NDIS_ADAPTER 0 ///< Flag for ADAPTER_INFO: this is a traditional ndis adapter
|
||||
#define INFO_FLAG_NDISWAN_ADAPTER 1 ///< Flag for ADAPTER_INFO: this is a NdisWan adapter, and it's managed by WANPACKET
|
||||
#define INFO_FLAG_DAG_CARD 2 ///< Flag for ADAPTER_INFO: this is a DAG card
|
||||
#define INFO_FLAG_DAG_FILE 6 ///< Flag for ADAPTER_INFO: this is a DAG file
|
||||
#define INFO_FLAG_DONT_EXPORT 8 ///< Flag for ADAPTER_INFO: when this flag is set, the adapter will not be listed or openend by winpcap. This allows to prevent exporting broken network adapters, like for example FireWire ones.
|
||||
#define INFO_FLAG_AIRPCAP_CARD 16 ///< Flag for ADAPTER_INFO: this is an airpcap card
|
||||
#define INFO_FLAG_NPFIM_DEVICE 32
|
||||
/*!
|
||||
\brief Contains comprehensive information about a network adapter.
|
||||
|
||||
This structure is filled with all the accessory information that the user can need about an adapter installed
|
||||
on his system.
|
||||
*/
|
||||
typedef struct _ADAPTER_INFO
|
||||
{
|
||||
struct _ADAPTER_INFO *Next; ///< Pointer to the next adapter in the list.
|
||||
CHAR Name[ADAPTER_NAME_LENGTH + 1]; ///< Name of the device representing the adapter.
|
||||
CHAR Description[ADAPTER_DESC_LENGTH + 1]; ///< Human understandable description of the adapter
|
||||
UINT MacAddressLen; ///< Length of the link layer address.
|
||||
UCHAR MacAddress[MAX_MAC_ADDR_LENGTH]; ///< Link layer address.
|
||||
NetType LinkLayer; ///< Physical characteristics of this adapter. This NetType structure contains the link type and the speed of the adapter.
|
||||
INT NNetworkAddresses; ///< Number of network layer addresses of this adapter.
|
||||
npf_if_addr *NetworkAddresses; ///< Pointer to an array of npf_if_addr, each of which specifies a network address of this adapter.
|
||||
UINT Flags; ///< Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API.
|
||||
}
|
||||
ADAPTER_INFO, *PADAPTER_INFO;
|
||||
|
||||
/*!
|
||||
\brief Describes an opened network adapter.
|
||||
|
||||
This structure is the most important for the functioning of packet.dll, but the great part of its fields
|
||||
should be ignored by the user, since the library offers functions that avoid to cope with low-level parameters
|
||||
*/
|
||||
typedef struct _ADAPTER {
|
||||
HANDLE hFile; ///< \internal Handle to an open instance of the NPF driver.
|
||||
CHAR SymbolicLink[MAX_LINK_NAME_LENGTH]; ///< \internal A string containing the name of the network adapter currently opened.
|
||||
int NumWrites; ///< \internal Number of times a packets written on this adapter will be repeated
|
||||
///< on the wire.
|
||||
HANDLE ReadEvent; ///< A notification event associated with the read calls on the adapter.
|
||||
///< It can be passed to standard Win32 functions (like WaitForSingleObject
|
||||
///< or WaitForMultipleObjects) to wait until the driver's buffer contains some
|
||||
///< data. It is particularly useful in GUI applications that need to wait
|
||||
///< concurrently on several events. In Windows NT/2000 the PacketSetMinToCopy()
|
||||
///< function can be used to define the minimum amount of data in the kernel buffer
|
||||
///< that will cause the event to be signalled.
|
||||
|
||||
UINT ReadTimeOut; ///< \internal The amount of time after which a read on the driver will be released and
|
||||
///< ReadEvent will be signaled, also if no packets were captured
|
||||
CHAR Name[ADAPTER_NAME_LENGTH];
|
||||
PWAN_ADAPTER pWanAdapter;
|
||||
UINT Flags; ///< Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API.
|
||||
|
||||
#ifdef HAVE_AIRPCAP_API
|
||||
PAirpcapHandle AirpcapAd;
|
||||
#endif // HAVE_AIRPCAP_API
|
||||
|
||||
#ifdef HAVE_NPFIM_API
|
||||
void* NpfImHandle;
|
||||
#endif // HAVE_NPFIM_API
|
||||
|
||||
#ifdef HAVE_DAG_API
|
||||
dagc_t *pDagCard; ///< Pointer to the dagc API adapter descriptor for this adapter
|
||||
PCHAR DagBuffer; ///< Pointer to the buffer with the packets that is received from the DAG card
|
||||
struct timeval DagReadTimeout; ///< Read timeout. The dagc API requires a timeval structure
|
||||
unsigned DagFcsLen; ///< Length of the frame check sequence attached to any packet by the card. Obtained from the registry
|
||||
DWORD DagFastProcess; ///< True if the user requests fast capture processing on this card. Higher level applications can use this value to provide a faster but possibly unprecise capture (for example, libpcap doesn't convert the timestamps).
|
||||
#endif // HAVE_DAG_API
|
||||
} ADAPTER, *LPADAPTER;
|
||||
|
||||
/*!
|
||||
\brief Structure that contains a group of packets coming from the driver.
|
||||
|
||||
This structure defines the header associated with every packet delivered to the application.
|
||||
*/
|
||||
typedef struct _PACKET {
|
||||
HANDLE hEvent; ///< \deprecated Still present for compatibility with old applications.
|
||||
OVERLAPPED OverLapped; ///< \deprecated Still present for compatibility with old applications.
|
||||
PVOID Buffer; ///< Buffer with containing the packets. See the PacketReceivePacket() for
|
||||
///< details about the organization of the data in this buffer
|
||||
UINT Length; ///< Length of the buffer
|
||||
DWORD ulBytesReceived; ///< Number of valid bytes present in the buffer, i.e. amount of data
|
||||
///< received by the last call to PacketReceivePacket()
|
||||
BOOLEAN bIoComplete; ///< \deprecated Still present for compatibility with old applications.
|
||||
} PACKET, *LPPACKET;
|
||||
|
||||
/*!
|
||||
\brief Structure containing an OID request.
|
||||
|
||||
It is used by the PacketRequest() function to send an OID to the interface card driver.
|
||||
It can be used, for example, to retrieve the status of the error counters on the adapter, its MAC address,
|
||||
the list of the multicast groups defined on it, and so on.
|
||||
*/
|
||||
struct _PACKET_OID_DATA {
|
||||
ULONG Oid; ///< OID code. See the Microsoft DDK documentation or the file ntddndis.h
|
||||
///< for a complete list of valid codes.
|
||||
ULONG Length; ///< Length of the data field
|
||||
UCHAR Data[1]; ///< variable-lenght field that contains the information passed to or received
|
||||
///< from the adapter.
|
||||
};
|
||||
typedef struct _PACKET_OID_DATA PACKET_OID_DATA, *PPACKET_OID_DATA;
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/**
|
||||
* @}
|
||||
*/
|
||||
|
||||
/*
|
||||
BOOLEAN QueryWinPcapRegistryStringA(CHAR *SubKeyName,
|
||||
CHAR *Value,
|
||||
UINT *pValueLen,
|
||||
CHAR *DefaultVal);
|
||||
|
||||
BOOLEAN QueryWinPcapRegistryStringW(WCHAR *SubKeyName,
|
||||
WCHAR *Value,
|
||||
UINT *pValueLen,
|
||||
WCHAR *DefaultVal);
|
||||
*/
|
||||
|
||||
//---------------------------------------------------------------------------
|
||||
// EXPORTED FUNCTIONS
|
||||
//---------------------------------------------------------------------------
|
||||
|
||||
PCHAR PacketGetVersion();
|
||||
PCHAR PacketGetDriverVersion();
|
||||
BOOLEAN PacketSetMinToCopy(LPADAPTER AdapterObject,int nbytes);
|
||||
BOOLEAN PacketSetNumWrites(LPADAPTER AdapterObject,int nwrites);
|
||||
BOOLEAN PacketSetMode(LPADAPTER AdapterObject,int mode);
|
||||
BOOLEAN PacketSetReadTimeout(LPADAPTER AdapterObject,int timeout);
|
||||
BOOLEAN PacketSetBpf(LPADAPTER AdapterObject,struct bpf_program *fp);
|
||||
BOOLEAN PacketSetLoopbackBehavior(LPADAPTER AdapterObject, UINT LoopbackBehavior);
|
||||
INT PacketSetSnapLen(LPADAPTER AdapterObject,int snaplen);
|
||||
BOOLEAN PacketGetStats(LPADAPTER AdapterObject,struct bpf_stat *s);
|
||||
BOOLEAN PacketGetStatsEx(LPADAPTER AdapterObject,struct bpf_stat *s);
|
||||
BOOLEAN PacketSetBuff(LPADAPTER AdapterObject,int dim);
|
||||
BOOLEAN PacketGetNetType (LPADAPTER AdapterObject,NetType *type);
|
||||
LPADAPTER PacketOpenAdapter(PCHAR AdapterName);
|
||||
BOOLEAN PacketSendPacket(LPADAPTER AdapterObject,LPPACKET pPacket,BOOLEAN Sync);
|
||||
INT PacketSendPackets(LPADAPTER AdapterObject,PVOID PacketBuff,ULONG Size, BOOLEAN Sync);
|
||||
LPPACKET PacketAllocatePacket(void);
|
||||
VOID PacketInitPacket(LPPACKET lpPacket,PVOID Buffer,UINT Length);
|
||||
VOID PacketFreePacket(LPPACKET lpPacket);
|
||||
BOOLEAN PacketReceivePacket(LPADAPTER AdapterObject,LPPACKET lpPacket,BOOLEAN Sync);
|
||||
BOOLEAN PacketSetHwFilter(LPADAPTER AdapterObject,ULONG Filter);
|
||||
BOOLEAN PacketGetAdapterNames(PTSTR pStr,PULONG BufferSize);
|
||||
BOOLEAN PacketGetNetInfoEx(PCHAR AdapterName, npf_if_addr* buffer, PLONG NEntries);
|
||||
BOOLEAN PacketRequest(LPADAPTER AdapterObject,BOOLEAN Set,PPACKET_OID_DATA OidData);
|
||||
HANDLE PacketGetReadEvent(LPADAPTER AdapterObject);
|
||||
BOOLEAN PacketSetDumpName(LPADAPTER AdapterObject, void *name, int len);
|
||||
BOOLEAN PacketSetDumpLimits(LPADAPTER AdapterObject, UINT maxfilesize, UINT maxnpacks);
|
||||
BOOLEAN PacketIsDumpEnded(LPADAPTER AdapterObject, BOOLEAN sync);
|
||||
BOOL PacketStopDriver();
|
||||
VOID PacketCloseAdapter(LPADAPTER lpAdapter);
|
||||
BOOLEAN PacketStartOem(PCHAR errorString, UINT errorStringLength);
|
||||
PAirpcapHandle PacketGetAirPcapHandle(LPADAPTER AdapterObject);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif //__PACKET32
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
/*
|
||||
* Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
|
||||
* Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino, CACE Technologies
|
||||
* nor the names of its contributors may be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __WIN32_EXTENSIONS_H__
|
||||
#define __WIN32_EXTENSIONS_H__
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Definitions */
|
||||
|
||||
/*!
|
||||
\brief A queue of raw packets that will be sent to the network with pcap_sendqueue_transmit().
|
||||
*/
|
||||
struct pcap_send_queue
|
||||
{
|
||||
u_int maxlen; ///< Maximum size of the the queue, in bytes. This variable contains the size of the buffer field.
|
||||
u_int len; ///< Current size of the queue, in bytes.
|
||||
char *buffer; ///< Buffer containing the packets to be sent.
|
||||
};
|
||||
|
||||
typedef struct pcap_send_queue pcap_send_queue;
|
||||
|
||||
/*!
|
||||
\brief This typedef is a support for the pcap_get_airpcap_handle() function
|
||||
*/
|
||||
#if !defined(AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_)
|
||||
#define AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_
|
||||
typedef struct _AirpcapHandle *PAirpcapHandle;
|
||||
#endif
|
||||
|
||||
#define BPF_MEM_EX_IMM 0xc0
|
||||
#define BPF_MEM_EX_IND 0xe0
|
||||
|
||||
/*used for ST*/
|
||||
#define BPF_MEM_EX 0xc0
|
||||
#define BPF_TME 0x08
|
||||
|
||||
#define BPF_LOOKUP 0x90
|
||||
#define BPF_EXECUTE 0xa0
|
||||
#define BPF_INIT 0xb0
|
||||
#define BPF_VALIDATE 0xc0
|
||||
#define BPF_SET_ACTIVE 0xd0
|
||||
#define BPF_RESET 0xe0
|
||||
#define BPF_SET_MEMORY 0x80
|
||||
#define BPF_GET_REGISTER_VALUE 0x70
|
||||
#define BPF_SET_REGISTER_VALUE 0x60
|
||||
#define BPF_SET_WORKING 0x50
|
||||
#define BPF_SET_ACTIVE_READ 0x40
|
||||
#define BPF_SET_AUTODELETION 0x30
|
||||
#define BPF_SEPARATION 0xff
|
||||
|
||||
/* Prototypes */
|
||||
pcap_send_queue* pcap_sendqueue_alloc(u_int memsize);
|
||||
|
||||
void pcap_sendqueue_destroy(pcap_send_queue* queue);
|
||||
|
||||
int pcap_sendqueue_queue(pcap_send_queue* queue, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data);
|
||||
|
||||
u_int pcap_sendqueue_transmit(pcap_t *p, pcap_send_queue* queue, int sync);
|
||||
|
||||
HANDLE pcap_getevent(pcap_t *p);
|
||||
|
||||
struct pcap_stat *pcap_stats_ex(pcap_t *p, int *pcap_stat_size);
|
||||
|
||||
int pcap_setuserbuffer(pcap_t *p, int size);
|
||||
|
||||
int pcap_live_dump(pcap_t *p, char *filename, int maxsize, int maxpacks);
|
||||
|
||||
int pcap_live_dump_ended(pcap_t *p, int sync);
|
||||
|
||||
int pcap_offline_filter(struct bpf_program *prog, const struct pcap_pkthdr *header, const u_char *pkt_data);
|
||||
|
||||
int pcap_start_oem(char* err_str, int flags);
|
||||
|
||||
PAirpcapHandle pcap_get_airpcap_handle(pcap_t *p);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif //__WIN32_EXTENSIONS_H__
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
/*
|
||||
* Copyright (C) 1999 WIDE Project.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the project nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
#ifndef _BITTYPES_H
|
||||
#define _BITTYPES_H
|
||||
|
||||
#ifndef HAVE_U_INT8_T
|
||||
|
||||
#if SIZEOF_CHAR == 1
|
||||
typedef unsigned char u_int8_t;
|
||||
typedef signed char int8_t;
|
||||
#elif SIZEOF_INT == 1
|
||||
typedef unsigned int u_int8_t;
|
||||
typedef signed int int8_t;
|
||||
#else /* XXX */
|
||||
#error "there's no appropriate type for u_int8_t"
|
||||
#endif
|
||||
#define HAVE_U_INT8_T 1
|
||||
#define HAVE_INT8_T 1
|
||||
|
||||
#endif /* HAVE_U_INT8_T */
|
||||
|
||||
#ifndef HAVE_U_INT16_T
|
||||
|
||||
#if SIZEOF_SHORT == 2
|
||||
typedef unsigned short u_int16_t;
|
||||
typedef signed short int16_t;
|
||||
#elif SIZEOF_INT == 2
|
||||
typedef unsigned int u_int16_t;
|
||||
typedef signed int int16_t;
|
||||
#elif SIZEOF_CHAR == 2
|
||||
typedef unsigned char u_int16_t;
|
||||
typedef signed char int16_t;
|
||||
#else /* XXX */
|
||||
#error "there's no appropriate type for u_int16_t"
|
||||
#endif
|
||||
#define HAVE_U_INT16_T 1
|
||||
#define HAVE_INT16_T 1
|
||||
|
||||
#endif /* HAVE_U_INT16_T */
|
||||
|
||||
#ifndef HAVE_U_INT32_T
|
||||
|
||||
#if SIZEOF_INT == 4
|
||||
typedef unsigned int u_int32_t;
|
||||
typedef signed int int32_t;
|
||||
#elif SIZEOF_LONG == 4
|
||||
typedef unsigned long u_int32_t;
|
||||
typedef signed long int32_t;
|
||||
#elif SIZEOF_SHORT == 4
|
||||
typedef unsigned short u_int32_t;
|
||||
typedef signed short int32_t;
|
||||
#else /* XXX */
|
||||
#error "there's no appropriate type for u_int32_t"
|
||||
#endif
|
||||
#define HAVE_U_INT32_T 1
|
||||
#define HAVE_INT32_T 1
|
||||
|
||||
#endif /* HAVE_U_INT32_T */
|
||||
|
||||
#ifndef HAVE_U_INT64_T
|
||||
#if SIZEOF_LONG_LONG == 8
|
||||
typedef unsigned long long u_int64_t;
|
||||
#elif defined(_MSC_EXTENSIONS)
|
||||
typedef unsigned _int64 u_int64_t;
|
||||
#elif SIZEOF_INT == 8
|
||||
typedef unsigned int u_int64_t;
|
||||
#elif SIZEOF_LONG == 8
|
||||
typedef unsigned long u_int64_t;
|
||||
#elif SIZEOF_SHORT == 8
|
||||
typedef unsigned short u_int64_t;
|
||||
#else /* XXX */
|
||||
#error "there's no appropriate type for u_int64_t"
|
||||
#endif
|
||||
|
||||
#endif /* HAVE_U_INT64_T */
|
||||
|
||||
#ifndef PRId64
|
||||
#ifdef _MSC_EXTENSIONS
|
||||
#define PRId64 "I64d"
|
||||
#else /* _MSC_EXTENSIONS */
|
||||
#define PRId64 "lld"
|
||||
#endif /* _MSC_EXTENSIONS */
|
||||
#endif /* PRId64 */
|
||||
|
||||
#ifndef PRIo64
|
||||
#ifdef _MSC_EXTENSIONS
|
||||
#define PRIo64 "I64o"
|
||||
#else /* _MSC_EXTENSIONS */
|
||||
#define PRIo64 "llo"
|
||||
#endif /* _MSC_EXTENSIONS */
|
||||
#endif /* PRIo64 */
|
||||
|
||||
#ifndef PRIx64
|
||||
#ifdef _MSC_EXTENSIONS
|
||||
#define PRIx64 "I64x"
|
||||
#else /* _MSC_EXTENSIONS */
|
||||
#define PRIx64 "llx"
|
||||
#endif /* _MSC_EXTENSIONS */
|
||||
#endif /* PRIx64 */
|
||||
|
||||
#ifndef PRIu64
|
||||
#ifdef _MSC_EXTENSIONS
|
||||
#define PRIu64 "I64u"
|
||||
#else /* _MSC_EXTENSIONS */
|
||||
#define PRIu64 "llu"
|
||||
#endif /* _MSC_EXTENSIONS */
|
||||
#endif /* PRIu64 */
|
||||
|
||||
#endif /* _BITTYPES_H */
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __bucket_lookup
|
||||
#define __bucket_lookup
|
||||
#ifdef WIN32
|
||||
#include "tme.h"
|
||||
#endif
|
||||
|
||||
#ifdef __FreeBSD__
|
||||
|
||||
#ifdef _KERNEL
|
||||
#include <net/tme/tme.h>
|
||||
#else
|
||||
#include <tme/tme.h>
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
#define BUCKET_LOOKUP_INSERT 0x00000011
|
||||
uint32 bucket_lookup_insert(uint8 *key, TME_DATA *data, MEM_TYPE *mem_ex, struct time_conv *time_ref);
|
||||
#define BUCKET_LOOKUP 0x00000010
|
||||
uint32 bucket_lookup(uint8 *key, TME_DATA *data, MEM_TYPE *mem_ex, struct time_conv *time_ref);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __count_packets
|
||||
#define __count_packets
|
||||
|
||||
#ifdef WIN32
|
||||
#include "tme.h"
|
||||
#endif
|
||||
|
||||
#ifdef __FreeBSD__
|
||||
|
||||
#ifdef _KERNEL
|
||||
#include <net/tme/tme.h>
|
||||
#else
|
||||
#include <tme/tme.h>
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
typedef struct __c_p_data
|
||||
{
|
||||
struct timeval timestamp;
|
||||
uint64 packets;
|
||||
uint64 bytes;
|
||||
}
|
||||
c_p_data;
|
||||
|
||||
#define COUNT_PACKETS 0x00000000
|
||||
uint32 count_packets(uint8 *block, uint32 pkt_size, TME_DATA *data, MEM_TYPE *mem_ex, uint8 *mem_data);
|
||||
|
||||
#endif
|
||||
|
||||
|
|
@ -0,0 +1,165 @@
|
|||
/*
|
||||
* Copyright (c) 1993, 1994, 1997
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that: (1) source code distributions
|
||||
* retain the above copyright notice and this paragraph in its entirety, (2)
|
||||
* distributions including binary code include the above copyright notice and
|
||||
* this paragraph in its entirety in the documentation or other materials
|
||||
* provided with the distribution, and (3) all advertising materials mentioning
|
||||
* features or use of this software display the following acknowledgement:
|
||||
* ``This product includes software developed by the University of California,
|
||||
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
||||
* the University nor the names of its contributors may be used to endorse
|
||||
* or promote products derived from this software without specific prior
|
||||
* written permission.
|
||||
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
||||
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/Win32/Include/ip6_misc.h,v 1.4.2.1 2006/01/22 18:13:47 gianluca Exp $ (LBL)
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file contains a collage of declarations for IPv6 from FreeBSD not present in Windows
|
||||
*/
|
||||
|
||||
#include <winsock2.h>
|
||||
|
||||
#ifndef __MINGW32__
|
||||
#include <ws2tcpip.h>
|
||||
#endif /* __MINGW32__ */
|
||||
|
||||
#ifndef __MINGW32__
|
||||
#define IN_MULTICAST(a) IN_CLASSD(a)
|
||||
#endif
|
||||
|
||||
#define IN_EXPERIMENTAL(a) ((((u_int32_t) (a)) & 0xf0000000) == 0xf0000000)
|
||||
|
||||
#define IN_LOOPBACKNET 127
|
||||
|
||||
#ifdef __MINGW32__
|
||||
/* IPv6 address */
|
||||
struct in6_addr
|
||||
{
|
||||
union
|
||||
{
|
||||
u_int8_t u6_addr8[16];
|
||||
u_int16_t u6_addr16[8];
|
||||
u_int32_t u6_addr32[4];
|
||||
} in6_u;
|
||||
#define s6_addr in6_u.u6_addr8
|
||||
#define s6_addr16 in6_u.u6_addr16
|
||||
#define s6_addr32 in6_u.u6_addr32
|
||||
#define s6_addr64 in6_u.u6_addr64
|
||||
};
|
||||
|
||||
#define IN6ADDR_ANY_INIT { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 }
|
||||
#define IN6ADDR_LOOPBACK_INIT { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 }
|
||||
#endif /* __MINGW32__ */
|
||||
|
||||
|
||||
#if (defined WIN32) || (defined __MINGW32__)
|
||||
typedef unsigned short sa_family_t;
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef __MINGW32__
|
||||
|
||||
#define __SOCKADDR_COMMON(sa_prefix) \
|
||||
sa_family_t sa_prefix##family
|
||||
|
||||
/* Ditto, for IPv6. */
|
||||
struct sockaddr_in6
|
||||
{
|
||||
__SOCKADDR_COMMON (sin6_);
|
||||
u_int16_t sin6_port; /* Transport layer port # */
|
||||
u_int32_t sin6_flowinfo; /* IPv6 flow information */
|
||||
struct in6_addr sin6_addr; /* IPv6 address */
|
||||
};
|
||||
|
||||
#define IN6_IS_ADDR_V4MAPPED(a) \
|
||||
((((u_int32_t *) (a))[0] == 0) && (((u_int32_t *) (a))[1] == 0) && \
|
||||
(((u_int32_t *) (a))[2] == htonl (0xffff)))
|
||||
|
||||
#define IN6_IS_ADDR_MULTICAST(a) (((u_int8_t *) (a))[0] == 0xff)
|
||||
|
||||
#define IN6_IS_ADDR_LINKLOCAL(a) \
|
||||
((((u_int32_t *) (a))[0] & htonl (0xffc00000)) == htonl (0xfe800000))
|
||||
|
||||
#define IN6_IS_ADDR_LOOPBACK(a) \
|
||||
(((u_int32_t *) (a))[0] == 0 && ((u_int32_t *) (a))[1] == 0 && \
|
||||
((u_int32_t *) (a))[2] == 0 && ((u_int32_t *) (a))[3] == htonl (1))
|
||||
#endif /* __MINGW32__ */
|
||||
|
||||
#define ip6_vfc ip6_ctlun.ip6_un2_vfc
|
||||
#define ip6_flow ip6_ctlun.ip6_un1.ip6_un1_flow
|
||||
#define ip6_plen ip6_ctlun.ip6_un1.ip6_un1_plen
|
||||
#define ip6_nxt ip6_ctlun.ip6_un1.ip6_un1_nxt
|
||||
#define ip6_hlim ip6_ctlun.ip6_un1.ip6_un1_hlim
|
||||
#define ip6_hops ip6_ctlun.ip6_un1.ip6_un1_hlim
|
||||
|
||||
#define nd_rd_type nd_rd_hdr.icmp6_type
|
||||
#define nd_rd_code nd_rd_hdr.icmp6_code
|
||||
#define nd_rd_cksum nd_rd_hdr.icmp6_cksum
|
||||
#define nd_rd_reserved nd_rd_hdr.icmp6_data32[0]
|
||||
|
||||
/*
|
||||
* IPV6 extension headers
|
||||
*/
|
||||
#define IPPROTO_HOPOPTS 0 /* IPv6 hop-by-hop options */
|
||||
#define IPPROTO_IPV6 41 /* IPv6 header. */
|
||||
#define IPPROTO_ROUTING 43 /* IPv6 routing header */
|
||||
#define IPPROTO_FRAGMENT 44 /* IPv6 fragmentation header */
|
||||
#define IPPROTO_ESP 50 /* encapsulating security payload */
|
||||
#define IPPROTO_AH 51 /* authentication header */
|
||||
#define IPPROTO_ICMPV6 58 /* ICMPv6 */
|
||||
#define IPPROTO_NONE 59 /* IPv6 no next header */
|
||||
#define IPPROTO_DSTOPTS 60 /* IPv6 destination options */
|
||||
#define IPPROTO_PIM 103 /* Protocol Independent Multicast. */
|
||||
|
||||
#define IPV6_RTHDR_TYPE_0 0
|
||||
|
||||
/* Option types and related macros */
|
||||
#define IP6OPT_PAD1 0x00 /* 00 0 00000 */
|
||||
#define IP6OPT_PADN 0x01 /* 00 0 00001 */
|
||||
#define IP6OPT_JUMBO 0xC2 /* 11 0 00010 = 194 */
|
||||
#define IP6OPT_JUMBO_LEN 6
|
||||
#define IP6OPT_ROUTER_ALERT 0x05 /* 00 0 00101 */
|
||||
|
||||
#define IP6OPT_RTALERT_LEN 4
|
||||
#define IP6OPT_RTALERT_MLD 0 /* Datagram contains an MLD message */
|
||||
#define IP6OPT_RTALERT_RSVP 1 /* Datagram contains an RSVP message */
|
||||
#define IP6OPT_RTALERT_ACTNET 2 /* contains an Active Networks msg */
|
||||
#define IP6OPT_MINLEN 2
|
||||
|
||||
#define IP6OPT_BINDING_UPDATE 0xc6 /* 11 0 00110 */
|
||||
#define IP6OPT_BINDING_ACK 0x07 /* 00 0 00111 */
|
||||
#define IP6OPT_BINDING_REQ 0x08 /* 00 0 01000 */
|
||||
#define IP6OPT_HOME_ADDRESS 0xc9 /* 11 0 01001 */
|
||||
#define IP6OPT_EID 0x8a /* 10 0 01010 */
|
||||
|
||||
#define IP6OPT_TYPE(o) ((o) & 0xC0)
|
||||
#define IP6OPT_TYPE_SKIP 0x00
|
||||
#define IP6OPT_TYPE_DISCARD 0x40
|
||||
#define IP6OPT_TYPE_FORCEICMP 0x80
|
||||
#define IP6OPT_TYPE_ICMP 0xC0
|
||||
|
||||
#define IP6OPT_MUTABLE 0x20
|
||||
|
||||
|
||||
#ifdef __MINGW32__
|
||||
#ifndef EAI_ADDRFAMILY
|
||||
struct addrinfo {
|
||||
int ai_flags; /* AI_PASSIVE, AI_CANONNAME */
|
||||
int ai_family; /* PF_xxx */
|
||||
int ai_socktype; /* SOCK_xxx */
|
||||
int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */
|
||||
size_t ai_addrlen; /* length of ai_addr */
|
||||
char *ai_canonname; /* canonical name for hostname */
|
||||
struct sockaddr *ai_addr; /* binary address */
|
||||
struct addrinfo *ai_next; /* next structure in linked list */
|
||||
};
|
||||
#endif
|
||||
#endif /* __MINGW32__ */
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2005 NetGroup, Politecnico di Torino (Italy)
|
||||
* Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino, CACE Technologies
|
||||
* nor the names of its contributors may be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __memory_t
|
||||
#define __memory_t
|
||||
|
||||
#define uint8 UCHAR
|
||||
#define int8 CHAR
|
||||
#define uint16 USHORT
|
||||
#define int16 SHORT
|
||||
#define uint32 ULONG
|
||||
#define int32 LONG
|
||||
#define uint64 ULONGLONG
|
||||
#define int64 LONGLONG
|
||||
|
||||
/*memory type*/
|
||||
typedef struct __MEM_TYPE
|
||||
{
|
||||
uint8 *buffer;
|
||||
uint32 size;
|
||||
} MEM_TYPE, *PMEM_TYPE;
|
||||
|
||||
#define LONG_AT(base,offset) (*(int32*)((uint8*)base+(uint32)offset))
|
||||
|
||||
#define ULONG_AT(base,offset) (*(uint32*)((uint8*)base+(uint32)offset))
|
||||
|
||||
#define SHORT_AT(base,offset) (*(int16*)((uint8*)base+(uint32)offset))
|
||||
|
||||
#define USHORT_AT(base,offset) (*(uint16*)((uint8*)base+(uint32)offset))
|
||||
|
||||
__inline int32 SW_LONG_AT(void *b, uint32 c)
|
||||
{
|
||||
return ((int32)*((uint8 *)b+c)<<24|
|
||||
(int32)*((uint8 *)b+c+1)<<16|
|
||||
(int32)*((uint8 *)b+c+2)<<8|
|
||||
(int32)*((uint8 *)b+c+3)<<0);
|
||||
}
|
||||
|
||||
|
||||
__inline uint32 SW_ULONG_AT(void *b, uint32 c)
|
||||
{
|
||||
return ((uint32)*((uint8 *)b+c)<<24|
|
||||
(uint32)*((uint8 *)b+c+1)<<16|
|
||||
(uint32)*((uint8 *)b+c+2)<<8|
|
||||
(uint32)*((uint8 *)b+c+3)<<0);
|
||||
}
|
||||
|
||||
__inline int16 SW_SHORT_AT(void *b, uint32 os)
|
||||
{
|
||||
return ((int16)
|
||||
((int16)*((uint8 *)b+os+0)<<8|
|
||||
(int16)*((uint8 *)b+os+1)<<0));
|
||||
}
|
||||
|
||||
__inline uint16 SW_USHORT_AT(void *b, uint32 os)
|
||||
{
|
||||
return ((uint16)
|
||||
((uint16)*((uint8 *)b+os+0)<<8|
|
||||
(uint16)*((uint8 *)b+os+1)<<0));
|
||||
}
|
||||
|
||||
__inline VOID SW_ULONG_ASSIGN(void *dst, uint32 src)
|
||||
{
|
||||
*((uint8*)dst+0)=*((uint8*)&src+3);
|
||||
*((uint8*)dst+1)=*((uint8*)&src+2);
|
||||
*((uint8*)dst+2)=*((uint8*)&src+1);
|
||||
*((uint8*)dst+3)=*((uint8*)&src+0);
|
||||
|
||||
}
|
||||
|
||||
#ifdef WIN_NT_DRIVER
|
||||
|
||||
#define ALLOCATE_MEMORY(dest,type,amount) \
|
||||
(dest)=ExAllocatePoolWithTag(NonPagedPool,sizeof(type)*(amount), '0TWA');
|
||||
#define ALLOCATE_ZERO_MEMORY(dest,type,amount) \
|
||||
{ \
|
||||
(dest)=ExAllocatePoolWithTag(NonPagedPool,sizeof(type)*(amount), '1TWA'); \
|
||||
if ((dest)!=NULL) \
|
||||
RtlZeroMemory((dest),sizeof(type)*(amount)); \
|
||||
}
|
||||
|
||||
#define FREE_MEMORY(dest) ExFreePool(dest);
|
||||
#define ZERO_MEMORY(dest,amount) RtlZeroMemory(dest,amount);
|
||||
#define COPY_MEMORY(dest,src,amount) RtlCopyMemory(dest,src,amount);
|
||||
|
||||
#else
|
||||
|
||||
#define ALLOCATE_MEMORY(dest,type,amount) \
|
||||
(dest)=(type*)GlobalAlloc(GPTR, sizeof(type)*(amount));
|
||||
#define ALLOCATE_ZERO_MEMORY(dest,type,amount) \
|
||||
(dest)=(type*)GlobalAlloc(GPTR, sizeof(type)*(amount));
|
||||
|
||||
#define FREE_MEMORY(dest) GlobalFree(dest);
|
||||
#define ZERO_MEMORY(dest,amount) RtlZeroMemory(dest,amount);
|
||||
#define COPY_MEMORY(dest,src,amount) RtlCopyMemory(dest,src,amount);
|
||||
|
||||
|
||||
#endif /*WIN_NT_DRIVER*/
|
||||
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __normal_lookup
|
||||
#define __normal_lookup
|
||||
|
||||
#ifdef WIN32
|
||||
#include "tme.h"
|
||||
#endif
|
||||
|
||||
#ifdef __FreeBSD__
|
||||
|
||||
#ifdef _KERNEL
|
||||
#include <net/tme/tme.h>
|
||||
#else
|
||||
#include <tme/tme.h>
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
#define NORMAL_LUT_W_INSERT 0x00000000
|
||||
uint32 normal_lut_w_insert(uint8 *key, TME_DATA *data, MEM_TYPE *mem_ex, struct time_conv *time_ref);
|
||||
#define NORMAL_LUT_WO_INSERT 0x00000001
|
||||
uint32 normal_lut_wo_insert(uint8 *key, TME_DATA *data, MEM_TYPE *mem_ex, struct time_conv *time_ref);
|
||||
#define DUMMY_INSERT 1234
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,736 @@
|
|||
/*-
|
||||
* Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* This code is derived from the Stanford/CMU enet packet filter,
|
||||
* (net/enet.c) distributed as part of 4.3BSD, and code contributed
|
||||
* to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
|
||||
* Berkeley Laboratory.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by the University of
|
||||
* California, Berkeley and its contributors.
|
||||
* 4. Neither the name of the University nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)bpf.h 7.1 (Berkeley) 5/7/91
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.34.2.11 2006/07/27 21:06:17 gianluca Exp $ (LBL)
|
||||
*/
|
||||
|
||||
/*
|
||||
* This is libpcap's cut-down version of bpf.h; it includes only
|
||||
* the stuff needed for the code generator and the userland BPF
|
||||
* interpreter, and the libpcap APIs for setting filters, etc..
|
||||
*
|
||||
* "pcap-bpf.c" will include the native OS version, as it deals with
|
||||
* the OS's BPF implementation.
|
||||
*
|
||||
* XXX - should this all just be moved to "pcap.h"?
|
||||
*/
|
||||
|
||||
#ifndef BPF_MAJOR_VERSION
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* BSD style release date */
|
||||
#define BPF_RELEASE 199606
|
||||
|
||||
#ifdef MSDOS /* must be 32-bit */
|
||||
typedef long bpf_int32;
|
||||
typedef unsigned long bpf_u_int32;
|
||||
#else
|
||||
typedef int bpf_int32;
|
||||
typedef u_int bpf_u_int32;
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Alignment macros. BPF_WORDALIGN rounds up to the next
|
||||
* even multiple of BPF_ALIGNMENT.
|
||||
*/
|
||||
#ifndef __NetBSD__
|
||||
#define BPF_ALIGNMENT sizeof(bpf_int32)
|
||||
#else
|
||||
#define BPF_ALIGNMENT sizeof(long)
|
||||
#endif
|
||||
#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
|
||||
|
||||
#define BPF_MAXINSNS 512
|
||||
#define BPF_MAXBUFSIZE 0x8000
|
||||
#define BPF_MINBUFSIZE 32
|
||||
|
||||
/*
|
||||
* Structure for "pcap_compile()", "pcap_setfilter()", etc..
|
||||
*/
|
||||
struct bpf_program {
|
||||
u_int bf_len;
|
||||
struct bpf_insn *bf_insns;
|
||||
};
|
||||
|
||||
/*
|
||||
* Struct return by BIOCVERSION. This represents the version number of
|
||||
* the filter language described by the instruction encodings below.
|
||||
* bpf understands a program iff kernel_major == filter_major &&
|
||||
* kernel_minor >= filter_minor, that is, if the value returned by the
|
||||
* running kernel has the same major number and a minor number equal
|
||||
* equal to or less than the filter being downloaded. Otherwise, the
|
||||
* results are undefined, meaning an error may be returned or packets
|
||||
* may be accepted haphazardly.
|
||||
* It has nothing to do with the source code version.
|
||||
*/
|
||||
struct bpf_version {
|
||||
u_short bv_major;
|
||||
u_short bv_minor;
|
||||
};
|
||||
/* Current version number of filter architecture. */
|
||||
#define BPF_MAJOR_VERSION 1
|
||||
#define BPF_MINOR_VERSION 1
|
||||
|
||||
/*
|
||||
* Data-link level type codes.
|
||||
*
|
||||
* Do *NOT* add new values to this list without asking
|
||||
* "tcpdump-workers@tcpdump.org" for a value. Otherwise, you run the
|
||||
* risk of using a value that's already being used for some other purpose,
|
||||
* and of having tools that read libpcap-format captures not being able
|
||||
* to handle captures with your new DLT_ value, with no hope that they
|
||||
* will ever be changed to do so (as that would destroy their ability
|
||||
* to read captures using that value for that other purpose).
|
||||
*/
|
||||
|
||||
/*
|
||||
* These are the types that are the same on all platforms, and that
|
||||
* have been defined by <net/bpf.h> for ages.
|
||||
*/
|
||||
#define DLT_NULL 0 /* BSD loopback encapsulation */
|
||||
#define DLT_EN10MB 1 /* Ethernet (10Mb) */
|
||||
#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
|
||||
#define DLT_AX25 3 /* Amateur Radio AX.25 */
|
||||
#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
|
||||
#define DLT_CHAOS 5 /* Chaos */
|
||||
#define DLT_IEEE802 6 /* IEEE 802 Networks */
|
||||
#define DLT_ARCNET 7 /* ARCNET, with BSD-style header */
|
||||
#define DLT_SLIP 8 /* Serial Line IP */
|
||||
#define DLT_PPP 9 /* Point-to-point Protocol */
|
||||
#define DLT_FDDI 10 /* FDDI */
|
||||
|
||||
/*
|
||||
* These are types that are different on some platforms, and that
|
||||
* have been defined by <net/bpf.h> for ages. We use #ifdefs to
|
||||
* detect the BSDs that define them differently from the traditional
|
||||
* libpcap <net/bpf.h>
|
||||
*
|
||||
* XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
|
||||
* but I don't know what the right #define is for BSD/OS.
|
||||
*/
|
||||
#define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */
|
||||
|
||||
#ifdef __OpenBSD__
|
||||
#define DLT_RAW 14 /* raw IP */
|
||||
#else
|
||||
#define DLT_RAW 12 /* raw IP */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Given that the only OS that currently generates BSD/OS SLIP or PPP
|
||||
* is, well, BSD/OS, arguably everybody should have chosen its values
|
||||
* for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
|
||||
* didn't. So it goes.
|
||||
*/
|
||||
#if defined(__NetBSD__) || defined(__FreeBSD__)
|
||||
#ifndef DLT_SLIP_BSDOS
|
||||
#define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */
|
||||
#define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */
|
||||
#endif
|
||||
#else
|
||||
#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
|
||||
#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* 17 is used for DLT_OLD_PFLOG in OpenBSD;
|
||||
* OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
|
||||
* 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
|
||||
*/
|
||||
|
||||
#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
|
||||
|
||||
/*
|
||||
* Apparently Redback uses this for its SmartEdge 400/800. I hope
|
||||
* nobody else decided to use it, too.
|
||||
*/
|
||||
#define DLT_REDBACK_SMARTEDGE 32
|
||||
|
||||
/*
|
||||
* These values are defined by NetBSD; other platforms should refrain from
|
||||
* using them for other purposes, so that NetBSD savefiles with link
|
||||
* types of 50 or 51 can be read as this type on all platforms.
|
||||
*/
|
||||
#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
|
||||
#define DLT_PPP_ETHER 51 /* PPP over Ethernet */
|
||||
|
||||
/*
|
||||
* The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
|
||||
* a link-layer type of 99 for the tcpdump it supplies. The link-layer
|
||||
* header has 6 bytes of unknown data, something that appears to be an
|
||||
* Ethernet type, and 36 bytes that appear to be 0 in at least one capture
|
||||
* I've seen.
|
||||
*/
|
||||
#define DLT_SYMANTEC_FIREWALL 99
|
||||
|
||||
/*
|
||||
* Values between 100 and 103 are used in capture file headers as
|
||||
* link-layer types corresponding to DLT_ types that differ
|
||||
* between platforms; don't use those values for new DLT_ new types.
|
||||
*/
|
||||
|
||||
/*
|
||||
* This value was defined by libpcap 0.5; platforms that have defined
|
||||
* it with a different value should define it here with that value -
|
||||
* a link type of 104 in a save file will be mapped to DLT_C_HDLC,
|
||||
* whatever value that happens to be, so programs will correctly
|
||||
* handle files with that link type regardless of the value of
|
||||
* DLT_C_HDLC.
|
||||
*
|
||||
* The name DLT_C_HDLC was used by BSD/OS; we use that name for source
|
||||
* compatibility with programs written for BSD/OS.
|
||||
*
|
||||
* libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
|
||||
* for source compatibility with programs written for libpcap 0.5.
|
||||
*/
|
||||
#define DLT_C_HDLC 104 /* Cisco HDLC */
|
||||
#define DLT_CHDLC DLT_C_HDLC
|
||||
|
||||
#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
|
||||
|
||||
/*
|
||||
* 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
|
||||
* except when it isn't. (I.e., sometimes it's just raw IP, and
|
||||
* sometimes it isn't.) We currently handle it as DLT_LINUX_SLL,
|
||||
* so that we don't have to worry about the link-layer header.)
|
||||
*/
|
||||
|
||||
/*
|
||||
* Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
|
||||
* with other values.
|
||||
* DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
|
||||
* (DLCI, etc.).
|
||||
*/
|
||||
#define DLT_FRELAY 107
|
||||
|
||||
/*
|
||||
* OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
|
||||
* that the AF_ type in the link-layer header is in network byte order.
|
||||
*
|
||||
* OpenBSD defines it as 12, but that collides with DLT_RAW, so we
|
||||
* define it as 108 here. If OpenBSD picks up this file, it should
|
||||
* define DLT_LOOP as 12 in its version, as per the comment above -
|
||||
* and should not use 108 as a DLT_ value.
|
||||
*/
|
||||
#define DLT_LOOP 108
|
||||
|
||||
/*
|
||||
* Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
|
||||
* DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
|
||||
* than OpenBSD.
|
||||
*/
|
||||
#ifdef __OpenBSD__
|
||||
#define DLT_ENC 13
|
||||
#else
|
||||
#define DLT_ENC 109
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Values between 110 and 112 are reserved for use in capture file headers
|
||||
* as link-layer types corresponding to DLT_ types that might differ
|
||||
* between platforms; don't use those values for new DLT_ types
|
||||
* other than the corresponding DLT_ types.
|
||||
*/
|
||||
|
||||
/*
|
||||
* This is for Linux cooked sockets.
|
||||
*/
|
||||
#define DLT_LINUX_SLL 113
|
||||
|
||||
/*
|
||||
* Apple LocalTalk hardware.
|
||||
*/
|
||||
#define DLT_LTALK 114
|
||||
|
||||
/*
|
||||
* Acorn Econet.
|
||||
*/
|
||||
#define DLT_ECONET 115
|
||||
|
||||
/*
|
||||
* Reserved for use with OpenBSD ipfilter.
|
||||
*/
|
||||
#define DLT_IPFILTER 116
|
||||
|
||||
/*
|
||||
* OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
|
||||
* in SuSE 6.3, so we can't use 17 for it in capture-file headers.
|
||||
*
|
||||
* XXX: is there a conflict with DLT_PFSYNC 18 as well?
|
||||
*/
|
||||
#ifdef __OpenBSD__
|
||||
#define DLT_OLD_PFLOG 17
|
||||
#define DLT_PFSYNC 18
|
||||
#endif
|
||||
#define DLT_PFLOG 117
|
||||
|
||||
/*
|
||||
* Registered for Cisco-internal use.
|
||||
*/
|
||||
#define DLT_CISCO_IOS 118
|
||||
|
||||
/*
|
||||
* For 802.11 cards using the Prism II chips, with a link-layer
|
||||
* header including Prism monitor mode information plus an 802.11
|
||||
* header.
|
||||
*/
|
||||
#define DLT_PRISM_HEADER 119
|
||||
|
||||
/*
|
||||
* Reserved for Aironet 802.11 cards, with an Aironet link-layer header
|
||||
* (see Doug Ambrisko's FreeBSD patches).
|
||||
*/
|
||||
#define DLT_AIRONET_HEADER 120
|
||||
|
||||
/*
|
||||
* Reserved for Siemens HiPath HDLC.
|
||||
*/
|
||||
#define DLT_HHDLC 121
|
||||
|
||||
/*
|
||||
* This is for RFC 2625 IP-over-Fibre Channel.
|
||||
*
|
||||
* This is not for use with raw Fibre Channel, where the link-layer
|
||||
* header starts with a Fibre Channel frame header; it's for IP-over-FC,
|
||||
* where the link-layer header starts with an RFC 2625 Network_Header
|
||||
* field.
|
||||
*/
|
||||
#define DLT_IP_OVER_FC 122
|
||||
|
||||
/*
|
||||
* This is for Full Frontal ATM on Solaris with SunATM, with a
|
||||
* pseudo-header followed by an AALn PDU.
|
||||
*
|
||||
* There may be other forms of Full Frontal ATM on other OSes,
|
||||
* with different pseudo-headers.
|
||||
*
|
||||
* If ATM software returns a pseudo-header with VPI/VCI information
|
||||
* (and, ideally, packet type information, e.g. signalling, ILMI,
|
||||
* LANE, LLC-multiplexed traffic, etc.), it should not use
|
||||
* DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
|
||||
* and the like don't have to infer the presence or absence of a
|
||||
* pseudo-header and the form of the pseudo-header.
|
||||
*/
|
||||
#define DLT_SUNATM 123 /* Solaris+SunATM */
|
||||
|
||||
/*
|
||||
* Reserved as per request from Kent Dahlgren <kent@praesum.com>
|
||||
* for private use.
|
||||
*/
|
||||
#define DLT_RIO 124 /* RapidIO */
|
||||
#define DLT_PCI_EXP 125 /* PCI Express */
|
||||
#define DLT_AURORA 126 /* Xilinx Aurora link layer */
|
||||
|
||||
/*
|
||||
* Header for 802.11 plus a number of bits of link-layer information
|
||||
* including radio information, used by some recent BSD drivers as
|
||||
* well as the madwifi Atheros driver for Linux.
|
||||
*/
|
||||
#define DLT_IEEE802_11_RADIO 127 /* 802.11 plus radiotap radio header */
|
||||
|
||||
/*
|
||||
* Reserved for the TZSP encapsulation, as per request from
|
||||
* Chris Waters <chris.waters@networkchemistry.com>
|
||||
* TZSP is a generic encapsulation for any other link type,
|
||||
* which includes a means to include meta-information
|
||||
* with the packet, e.g. signal strength and channel
|
||||
* for 802.11 packets.
|
||||
*/
|
||||
#define DLT_TZSP 128 /* Tazmen Sniffer Protocol */
|
||||
|
||||
/*
|
||||
* BSD's ARCNET headers have the source host, destination host,
|
||||
* and type at the beginning of the packet; that's what's handed
|
||||
* up to userland via BPF.
|
||||
*
|
||||
* Linux's ARCNET headers, however, have a 2-byte offset field
|
||||
* between the host IDs and the type; that's what's handed up
|
||||
* to userland via PF_PACKET sockets.
|
||||
*
|
||||
* We therefore have to have separate DLT_ values for them.
|
||||
*/
|
||||
#define DLT_ARCNET_LINUX 129 /* ARCNET */
|
||||
|
||||
/*
|
||||
* Juniper-private data link types, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>. The DLT_s are used
|
||||
* for passing on chassis-internal metainformation such as
|
||||
* QOS profiles, etc..
|
||||
*/
|
||||
#define DLT_JUNIPER_MLPPP 130
|
||||
#define DLT_JUNIPER_MLFR 131
|
||||
#define DLT_JUNIPER_ES 132
|
||||
#define DLT_JUNIPER_GGSN 133
|
||||
#define DLT_JUNIPER_MFR 134
|
||||
#define DLT_JUNIPER_ATM2 135
|
||||
#define DLT_JUNIPER_SERVICES 136
|
||||
#define DLT_JUNIPER_ATM1 137
|
||||
|
||||
/*
|
||||
* Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
|
||||
* <dieter@apple.com>. The header that's presented is an Ethernet-like
|
||||
* header:
|
||||
*
|
||||
* #define FIREWIRE_EUI64_LEN 8
|
||||
* struct firewire_header {
|
||||
* u_char firewire_dhost[FIREWIRE_EUI64_LEN];
|
||||
* u_char firewire_shost[FIREWIRE_EUI64_LEN];
|
||||
* u_short firewire_type;
|
||||
* };
|
||||
*
|
||||
* with "firewire_type" being an Ethernet type value, rather than,
|
||||
* for example, raw GASP frames being handed up.
|
||||
*/
|
||||
#define DLT_APPLE_IP_OVER_IEEE1394 138
|
||||
|
||||
/*
|
||||
* Various SS7 encapsulations, as per a request from Jeff Morriss
|
||||
* <jeff.morriss[AT]ulticom.com> and subsequent discussions.
|
||||
*/
|
||||
#define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */
|
||||
#define DLT_MTP2 140 /* MTP2, without pseudo-header */
|
||||
#define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
|
||||
#define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */
|
||||
|
||||
/*
|
||||
* DOCSIS MAC frames.
|
||||
*/
|
||||
#define DLT_DOCSIS 143
|
||||
|
||||
/*
|
||||
* Linux-IrDA packets. Protocol defined at http://www.irda.org.
|
||||
* Those packets include IrLAP headers and above (IrLMP...), but
|
||||
* don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
|
||||
* framing can be handled by the hardware and depend on the bitrate.
|
||||
* This is exactly the format you would get capturing on a Linux-IrDA
|
||||
* interface (irdaX), but not on a raw serial port.
|
||||
* Note the capture is done in "Linux-cooked" mode, so each packet include
|
||||
* a fake packet header (struct sll_header). This is because IrDA packet
|
||||
* decoding is dependant on the direction of the packet (incomming or
|
||||
* outgoing).
|
||||
* When/if other platform implement IrDA capture, we may revisit the
|
||||
* issue and define a real DLT_IRDA...
|
||||
* Jean II
|
||||
*/
|
||||
#define DLT_LINUX_IRDA 144
|
||||
|
||||
/*
|
||||
* Reserved for IBM SP switch and IBM Next Federation switch.
|
||||
*/
|
||||
#define DLT_IBM_SP 145
|
||||
#define DLT_IBM_SN 146
|
||||
|
||||
/*
|
||||
* Reserved for private use. If you have some link-layer header type
|
||||
* that you want to use within your organization, with the capture files
|
||||
* using that link-layer header type not ever be sent outside your
|
||||
* organization, you can use these values.
|
||||
*
|
||||
* No libpcap release will use these for any purpose, nor will any
|
||||
* tcpdump release use them, either.
|
||||
*
|
||||
* Do *NOT* use these in capture files that you expect anybody not using
|
||||
* your private versions of capture-file-reading tools to read; in
|
||||
* particular, do *NOT* use them in products, otherwise you may find that
|
||||
* people won't be able to use tcpdump, or snort, or Ethereal, or... to
|
||||
* read capture files from your firewall/intrusion detection/traffic
|
||||
* monitoring/etc. appliance, or whatever product uses that DLT_ value,
|
||||
* and you may also find that the developers of those applications will
|
||||
* not accept patches to let them read those files.
|
||||
*
|
||||
* Also, do not use them if somebody might send you a capture using them
|
||||
* for *their* private type and tools using them for *your* private type
|
||||
* would have to read them.
|
||||
*
|
||||
* Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value,
|
||||
* as per the comment above, and use the type you're given.
|
||||
*/
|
||||
#define DLT_USER0 147
|
||||
#define DLT_USER1 148
|
||||
#define DLT_USER2 149
|
||||
#define DLT_USER3 150
|
||||
#define DLT_USER4 151
|
||||
#define DLT_USER5 152
|
||||
#define DLT_USER6 153
|
||||
#define DLT_USER7 154
|
||||
#define DLT_USER8 155
|
||||
#define DLT_USER9 156
|
||||
#define DLT_USER10 157
|
||||
#define DLT_USER11 158
|
||||
#define DLT_USER12 159
|
||||
#define DLT_USER13 160
|
||||
#define DLT_USER14 161
|
||||
#define DLT_USER15 162
|
||||
|
||||
/*
|
||||
* For future use with 802.11 captures - defined by AbsoluteValue
|
||||
* Systems to store a number of bits of link-layer information
|
||||
* including radio information:
|
||||
*
|
||||
* http://www.shaftnet.org/~pizza/software/capturefrm.txt
|
||||
*
|
||||
* but it might be used by some non-AVS drivers now or in the
|
||||
* future.
|
||||
*/
|
||||
#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
|
||||
|
||||
/*
|
||||
* Juniper-private data link type, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>. The DLT_s are used
|
||||
* for passing on chassis-internal metainformation such as
|
||||
* QOS profiles, etc..
|
||||
*/
|
||||
#define DLT_JUNIPER_MONITOR 164
|
||||
|
||||
/*
|
||||
* Reserved for BACnet MS/TP.
|
||||
*/
|
||||
#define DLT_BACNET_MS_TP 165
|
||||
|
||||
/*
|
||||
* Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
|
||||
*
|
||||
* This is used in some OSes to allow a kernel socket filter to distinguish
|
||||
* between incoming and outgoing packets, on a socket intended to
|
||||
* supply pppd with outgoing packets so it can do dial-on-demand and
|
||||
* hangup-on-lack-of-demand; incoming packets are filtered out so they
|
||||
* don't cause pppd to hold the connection up (you don't want random
|
||||
* input packets such as port scans, packets from old lost connections,
|
||||
* etc. to force the connection to stay up).
|
||||
*
|
||||
* The first byte of the PPP header (0xff03) is modified to accomodate
|
||||
* the direction - 0x00 = IN, 0x01 = OUT.
|
||||
*/
|
||||
#define DLT_PPP_PPPD 166
|
||||
|
||||
/*
|
||||
* Names for backwards compatibility with older versions of some PPP
|
||||
* software; new software should use DLT_PPP_PPPD.
|
||||
*/
|
||||
#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD
|
||||
#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD
|
||||
|
||||
/*
|
||||
* Juniper-private data link type, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>. The DLT_s are used
|
||||
* for passing on chassis-internal metainformation such as
|
||||
* QOS profiles, cookies, etc..
|
||||
*/
|
||||
#define DLT_JUNIPER_PPPOE 167
|
||||
#define DLT_JUNIPER_PPPOE_ATM 168
|
||||
|
||||
#define DLT_GPRS_LLC 169 /* GPRS LLC */
|
||||
#define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
|
||||
#define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */
|
||||
|
||||
/*
|
||||
* Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
|
||||
* monitoring equipment.
|
||||
*/
|
||||
#define DLT_GCOM_T1E1 172
|
||||
#define DLT_GCOM_SERIAL 173
|
||||
|
||||
/*
|
||||
* Juniper-private data link type, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>. The DLT_ is used
|
||||
* for internal communication to Physical Interface Cards (PIC)
|
||||
*/
|
||||
#define DLT_JUNIPER_PIC_PEER 174
|
||||
|
||||
/*
|
||||
* Link types requested by Gregor Maier <gregor@endace.com> of Endace
|
||||
* Measurement Systems. They add an ERF header (see
|
||||
* http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
|
||||
* the link-layer header.
|
||||
*/
|
||||
#define DLT_ERF_ETH 175 /* Ethernet */
|
||||
#define DLT_ERF_POS 176 /* Packet-over-SONET */
|
||||
|
||||
/*
|
||||
* Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
|
||||
* for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
|
||||
* includes additional information before the LAPD header, so it's
|
||||
* not necessarily a generic LAPD header.
|
||||
*/
|
||||
#define DLT_LINUX_LAPD 177
|
||||
|
||||
/*
|
||||
* Juniper-private data link type, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>.
|
||||
* The DLT_ are used for prepending meta-information
|
||||
* like interface index, interface name
|
||||
* before standard Ethernet, PPP, Frelay & C-HDLC Frames
|
||||
*/
|
||||
#define DLT_JUNIPER_ETHER 178
|
||||
#define DLT_JUNIPER_PPP 179
|
||||
#define DLT_JUNIPER_FRELAY 180
|
||||
#define DLT_JUNIPER_CHDLC 181
|
||||
|
||||
/*
|
||||
* Multi Link Frame Relay (FRF.16)
|
||||
*/
|
||||
#define DLT_MFR 182
|
||||
|
||||
/*
|
||||
* Juniper-private data link type, as per request from
|
||||
* Hannes Gredler <hannes@juniper.net>.
|
||||
* The DLT_ is used for internal communication with a
|
||||
* voice Adapter Card (PIC)
|
||||
*/
|
||||
#define DLT_JUNIPER_VP 183
|
||||
|
||||
/*
|
||||
* Arinc 429 frames.
|
||||
* DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
|
||||
* Every frame contains a 32bit A429 label.
|
||||
* More documentation on Arinc 429 can be found at
|
||||
* http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
|
||||
*/
|
||||
#define DLT_A429 184
|
||||
|
||||
/*
|
||||
* Arinc 653 Interpartition Communication messages.
|
||||
* DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
|
||||
* Please refer to the A653-1 standard for more information.
|
||||
*/
|
||||
#define DLT_A653_ICM 185
|
||||
|
||||
/*
|
||||
* Controller Area Network (CAN) v. 2.0B packets.
|
||||
* DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
|
||||
* Used to dump CAN packets coming from a CAN Vector board.
|
||||
* More documentation on the CAN v2.0B frames can be found at
|
||||
* http://www.can-cia.org/downloads/?269
|
||||
*/
|
||||
#define DLT_CAN20B 190
|
||||
|
||||
|
||||
/*
|
||||
* The instruction encodings.
|
||||
*/
|
||||
/* instruction classes */
|
||||
#define BPF_CLASS(code) ((code) & 0x07)
|
||||
#define BPF_LD 0x00
|
||||
#define BPF_LDX 0x01
|
||||
#define BPF_ST 0x02
|
||||
#define BPF_STX 0x03
|
||||
#define BPF_ALU 0x04
|
||||
#define BPF_JMP 0x05
|
||||
#define BPF_RET 0x06
|
||||
#define BPF_MISC 0x07
|
||||
|
||||
/* ld/ldx fields */
|
||||
#define BPF_SIZE(code) ((code) & 0x18)
|
||||
#define BPF_W 0x00
|
||||
#define BPF_H 0x08
|
||||
#define BPF_B 0x10
|
||||
#define BPF_MODE(code) ((code) & 0xe0)
|
||||
#define BPF_IMM 0x00
|
||||
#define BPF_ABS 0x20
|
||||
#define BPF_IND 0x40
|
||||
#define BPF_MEM 0x60
|
||||
#define BPF_LEN 0x80
|
||||
#define BPF_MSH 0xa0
|
||||
|
||||
/* alu/jmp fields */
|
||||
#define BPF_OP(code) ((code) & 0xf0)
|
||||
#define BPF_ADD 0x00
|
||||
#define BPF_SUB 0x10
|
||||
#define BPF_MUL 0x20
|
||||
#define BPF_DIV 0x30
|
||||
#define BPF_OR 0x40
|
||||
#define BPF_AND 0x50
|
||||
#define BPF_LSH 0x60
|
||||
#define BPF_RSH 0x70
|
||||
#define BPF_NEG 0x80
|
||||
#define BPF_JA 0x00
|
||||
#define BPF_JEQ 0x10
|
||||
#define BPF_JGT 0x20
|
||||
#define BPF_JGE 0x30
|
||||
#define BPF_JSET 0x40
|
||||
#define BPF_SRC(code) ((code) & 0x08)
|
||||
#define BPF_K 0x00
|
||||
#define BPF_X 0x08
|
||||
|
||||
/* ret - BPF_K and BPF_X also apply */
|
||||
#define BPF_RVAL(code) ((code) & 0x18)
|
||||
#define BPF_A 0x10
|
||||
|
||||
/* misc */
|
||||
#define BPF_MISCOP(code) ((code) & 0xf8)
|
||||
#define BPF_TAX 0x00
|
||||
#define BPF_TXA 0x80
|
||||
|
||||
/*
|
||||
* The instruction data structure.
|
||||
*/
|
||||
struct bpf_insn {
|
||||
u_short code;
|
||||
u_char jt;
|
||||
u_char jf;
|
||||
bpf_int32 k;
|
||||
};
|
||||
|
||||
/*
|
||||
* Macros for insn array initializers.
|
||||
*/
|
||||
#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
|
||||
#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
|
||||
|
||||
#if __STDC__ || defined(__cplusplus)
|
||||
extern int bpf_validate(struct bpf_insn *, int);
|
||||
extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
|
||||
#else
|
||||
extern int bpf_validate();
|
||||
extern u_int bpf_filter();
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
|
||||
*/
|
||||
#define BPF_MEMWORDS 16
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,373 @@
|
|||
/*
|
||||
* Copyright (c) 1994, 1995, 1996
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by the Computer Systems
|
||||
* Engineering Group at Lawrence Berkeley Laboratory.
|
||||
* 4. Neither the name of the University nor of the Laboratory may be used
|
||||
* to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.68.2.9 2006/02/22 17:09:54 gianluca Exp $ (LBL)
|
||||
*/
|
||||
|
||||
#ifndef pcap_int_h
|
||||
#define pcap_int_h
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include <pcap.h>
|
||||
|
||||
#ifdef WIN32
|
||||
#include <Packet32.h>
|
||||
#endif /* WIN32 */
|
||||
|
||||
#ifdef MSDOS
|
||||
#include <fcntl.h>
|
||||
#include <io.h>
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Savefile
|
||||
*/
|
||||
typedef enum {
|
||||
NOT_SWAPPED,
|
||||
SWAPPED,
|
||||
MAYBE_SWAPPED
|
||||
} swapped_type_t;
|
||||
|
||||
struct pcap_sf {
|
||||
FILE *rfile;
|
||||
int swapped;
|
||||
int hdrsize;
|
||||
swapped_type_t lengths_swapped;
|
||||
int version_major;
|
||||
int version_minor;
|
||||
u_char *base;
|
||||
};
|
||||
|
||||
struct pcap_md {
|
||||
struct pcap_stat stat;
|
||||
/*XXX*/
|
||||
int use_bpf; /* using kernel filter */
|
||||
u_long TotPkts; /* can't oflow for 79 hrs on ether */
|
||||
u_long TotAccepted; /* count accepted by filter */
|
||||
u_long TotDrops; /* count of dropped packets */
|
||||
long TotMissed; /* missed by i/f during this run */
|
||||
long OrigMissed; /* missed by i/f before this run */
|
||||
char *device; /* device name */
|
||||
#ifdef linux
|
||||
int sock_packet; /* using Linux 2.0 compatible interface */
|
||||
int timeout; /* timeout specified to pcap_open_live */
|
||||
int clear_promisc; /* must clear promiscuous mode when we close */
|
||||
int cooked; /* using SOCK_DGRAM rather than SOCK_RAW */
|
||||
int ifindex; /* interface index of device we're bound to */
|
||||
int lo_ifindex; /* interface index of the loopback device */
|
||||
struct pcap *next; /* list of open promiscuous sock_packet pcaps */
|
||||
u_int packets_read; /* count of packets read with recvfrom() */
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_DAG_API
|
||||
#ifdef HAVE_DAG_STREAMS_API
|
||||
u_char *dag_mem_bottom; /* DAG card current memory bottom pointer */
|
||||
u_char *dag_mem_top; /* DAG card current memory top pointer */
|
||||
#else
|
||||
void *dag_mem_base; /* DAG card memory base address */
|
||||
u_int dag_mem_bottom; /* DAG card current memory bottom offset */
|
||||
u_int dag_mem_top; /* DAG card current memory top offset */
|
||||
#endif /* HAVE_DAG_STREAMS_API */
|
||||
int dag_fcs_bits; /* Number of checksum bits from link layer */
|
||||
int dag_offset_flags; /* Flags to pass to dag_offset(). */
|
||||
int dag_stream; /* DAG stream number */
|
||||
int dag_timeout; /* timeout specified to pcap_open_live.
|
||||
* Same as in linux above, introduce
|
||||
* generally? */
|
||||
#endif /* HAVE_DAG_API */
|
||||
|
||||
#ifdef HAVE_REMOTE
|
||||
/*!
|
||||
There is really a mess with previous variables, and it seems to me that they are not used
|
||||
(they are used in pcap_pf.c only). I think we have to start using them.
|
||||
The meaning is the following:
|
||||
|
||||
- TotPkts: the amount of packets received by the bpf filter, *before* applying the filter
|
||||
- TotAccepted: the amount of packets that satisfies the filter
|
||||
- TotDrops: the amount of packet that were dropped into the kernel buffer because of lack of space
|
||||
- TotMissed: the amount of packets that were dropped by the physical interface; it is basically
|
||||
the value of the hardware counter into the card. This number is never put to zero, so this number
|
||||
takes into account the *total* number of interface drops starting from the interface power-on.
|
||||
- OrigMissed: the amount of packets that were dropped by the interface *when the capture begins*.
|
||||
This value is used to detect the number of packets dropped by the interface *during the present
|
||||
capture*, so that (ps_ifdrops= TotMissed - OrigMissed).
|
||||
*/
|
||||
unsigned int TotNetDrops; //!< keeps the number of packets that have been dropped by the network
|
||||
/*!
|
||||
\brief It keeps the number of packets that have been received by the application.
|
||||
|
||||
Packets dropped by the kernel buffer are not counted in this variable. The variable is always
|
||||
equal to (TotAccepted - TotDrops), exept for the case of remote capture, in which we have also
|
||||
packets in fligh, i.e. that have been transmitted by the remote host, but that have not been
|
||||
received (yet) from the client. In this case, (TotAccepted - TotDrops - TotNetDrops) gives a
|
||||
wrong result, since this number does not corresponds always to the number of packet received by
|
||||
the application. For this reason, in the remote capture we need another variable that takes
|
||||
into account of the number of packets actually received by the application.
|
||||
*/
|
||||
unsigned int TotCapt;
|
||||
#endif /* HAVE_REMOTE */
|
||||
};
|
||||
|
||||
/*
|
||||
* Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H
|
||||
* Tru64 UNIX, and NetBSD pad to make everything line up on a nice boundary.
|
||||
*/
|
||||
#if defined(ultrix) || defined(__osf__) || (defined(__NetBSD__) && __NetBSD_Version__ > 106000000)
|
||||
#define PCAP_FDDIPAD 3
|
||||
#endif
|
||||
|
||||
struct pcap {
|
||||
#ifdef WIN32
|
||||
ADAPTER *adapter;
|
||||
LPPACKET Packet;
|
||||
int timeout;
|
||||
int nonblock;
|
||||
#else
|
||||
int fd;
|
||||
int selectable_fd;
|
||||
int send_fd;
|
||||
#endif /* WIN32 */
|
||||
int snapshot;
|
||||
int linktype;
|
||||
int tzoff; /* timezone offset */
|
||||
int offset; /* offset for proper alignment */
|
||||
|
||||
int break_loop; /* flag set to force break from packet-reading loop */
|
||||
|
||||
#ifdef PCAP_FDDIPAD
|
||||
int fddipad;
|
||||
#endif
|
||||
|
||||
#ifdef MSDOS
|
||||
int inter_packet_wait; /* offline: wait between packets */
|
||||
void (*wait_proc)(void); /* call proc while waiting */
|
||||
#endif
|
||||
|
||||
struct pcap_sf sf;
|
||||
struct pcap_md md;
|
||||
|
||||
/*
|
||||
* Read buffer.
|
||||
*/
|
||||
int bufsize;
|
||||
u_char *buffer;
|
||||
u_char *bp;
|
||||
int cc;
|
||||
|
||||
/*
|
||||
* Place holder for pcap_next().
|
||||
*/
|
||||
u_char *pkt;
|
||||
|
||||
/* We're accepting only packets in this direction/these directions. */
|
||||
pcap_direction_t direction;
|
||||
|
||||
/*
|
||||
* Methods.
|
||||
*/
|
||||
int (*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);
|
||||
int (*inject_op)(pcap_t *, const void *, size_t);
|
||||
int (*setfilter_op)(pcap_t *, struct bpf_program *);
|
||||
int (*setdirection_op)(pcap_t *, pcap_direction_t);
|
||||
int (*set_datalink_op)(pcap_t *, int);
|
||||
int (*getnonblock_op)(pcap_t *, char *);
|
||||
int (*setnonblock_op)(pcap_t *, int, char *);
|
||||
int (*stats_op)(pcap_t *, struct pcap_stat *);
|
||||
void (*close_op)(pcap_t *);
|
||||
|
||||
/*
|
||||
* Placeholder for filter code if bpf not in kernel.
|
||||
*/
|
||||
struct bpf_program fcode;
|
||||
|
||||
char errbuf[PCAP_ERRBUF_SIZE + 1];
|
||||
int dlt_count;
|
||||
u_int *dlt_list;
|
||||
|
||||
struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */
|
||||
|
||||
#ifdef HAVE_REMOTE
|
||||
#ifndef WIN32 // Win32 already defines 'timeout'
|
||||
int timeout; //!< timeout to be used in the pcap_open()
|
||||
#endif
|
||||
/*! \brief '1' if we're the network client; needed by several functions (like pcap_setfilter() ) to know if
|
||||
they have to use the socket or they have to open the local adapter. */
|
||||
int rmt_clientside;
|
||||
|
||||
SOCKET rmt_sockctrl; //!< socket ID of the socket used for the control connection
|
||||
SOCKET rmt_sockdata; //!< socket ID of the socket used for the data connection
|
||||
int rmt_flags; //!< we have to save flags, since they are passed by the pcap_open_live(), but they are used by the pcap_startcapture()
|
||||
int rmt_capstarted; //!< 'true' if the capture is already started (needed to knoe if we have to call the pcap_startcapture()
|
||||
struct pcap_samp rmt_samp; //!< Keeps the parameters related to the sampling process.
|
||||
char *currentfilter; //!< Pointer to a buffer (allocated at run-time) that stores the current filter. Needed when flag PCAP_OPENFLAG_NOCAPTURE_RPCAP is turned on.
|
||||
#endif /* HAVE_REMOTE */
|
||||
};
|
||||
|
||||
/*
|
||||
* This is a timeval as stored in a savefile.
|
||||
* It has to use the same types everywhere, independent of the actual
|
||||
* `struct timeval'; `struct timeval' has 32-bit tv_sec values on some
|
||||
* platforms and 64-bit tv_sec values on other platforms, and writing
|
||||
* out native `struct timeval' values would mean files could only be
|
||||
* read on systems with the same tv_sec size as the system on which
|
||||
* the file was written.
|
||||
*/
|
||||
|
||||
struct pcap_timeval {
|
||||
bpf_int32 tv_sec; /* seconds */
|
||||
bpf_int32 tv_usec; /* microseconds */
|
||||
};
|
||||
|
||||
/*
|
||||
* This is a `pcap_pkthdr' as actually stored in a savefile.
|
||||
*
|
||||
* Do not change the format of this structure, in any way (this includes
|
||||
* changes that only affect the length of fields in this structure),
|
||||
* and do not make the time stamp anything other than seconds and
|
||||
* microseconds (e.g., seconds and nanoseconds). Instead:
|
||||
*
|
||||
* introduce a new structure for the new format;
|
||||
*
|
||||
* send mail to "tcpdump-workers@tcpdump.org", requesting a new
|
||||
* magic number for your new capture file format, and, when
|
||||
* you get the new magic number, put it in "savefile.c";
|
||||
*
|
||||
* use that magic number for save files with the changed record
|
||||
* header;
|
||||
*
|
||||
* make the code in "savefile.c" capable of reading files with
|
||||
* the old record header as well as files with the new record header
|
||||
* (using the magic number to determine the header format).
|
||||
*
|
||||
* Then supply the changes to "patches@tcpdump.org", so that future
|
||||
* versions of libpcap and programs that use it (such as tcpdump) will
|
||||
* be able to read your new capture file format.
|
||||
*/
|
||||
|
||||
struct pcap_sf_pkthdr {
|
||||
struct pcap_timeval ts; /* time stamp */
|
||||
bpf_u_int32 caplen; /* length of portion present */
|
||||
bpf_u_int32 len; /* length this packet (off wire) */
|
||||
};
|
||||
|
||||
/*
|
||||
* How a `pcap_pkthdr' is actually stored in savefiles written
|
||||
* by some patched versions of libpcap (e.g. the ones in Red
|
||||
* Hat Linux 6.1 and 6.2).
|
||||
*
|
||||
* Do not change the format of this structure, in any way (this includes
|
||||
* changes that only affect the length of fields in this structure).
|
||||
* Instead, introduce a new structure, as per the above.
|
||||
*/
|
||||
|
||||
struct pcap_sf_patched_pkthdr {
|
||||
struct pcap_timeval ts; /* time stamp */
|
||||
bpf_u_int32 caplen; /* length of portion present */
|
||||
bpf_u_int32 len; /* length this packet (off wire) */
|
||||
int index;
|
||||
unsigned short protocol;
|
||||
unsigned char pkt_type;
|
||||
};
|
||||
|
||||
int yylex(void);
|
||||
|
||||
#ifndef min
|
||||
#define min(a, b) ((a) > (b) ? (b) : (a))
|
||||
#endif
|
||||
|
||||
/* XXX should these be in pcap.h? */
|
||||
int pcap_offline_read(pcap_t *, int, pcap_handler, u_char *);
|
||||
int pcap_read(pcap_t *, int cnt, pcap_handler, u_char *);
|
||||
|
||||
#ifndef HAVE_STRLCPY
|
||||
#define strlcpy(x, y, z) \
|
||||
(strncpy((x), (y), (z)), \
|
||||
((z) <= 0 ? 0 : ((x)[(z) - 1] = '\0')), \
|
||||
strlen((y)))
|
||||
#endif
|
||||
|
||||
#include <stdarg.h>
|
||||
|
||||
#if !defined(HAVE_SNPRINTF)
|
||||
#define snprintf pcap_snprintf
|
||||
extern int snprintf (char *, size_t, const char *, ...);
|
||||
#endif
|
||||
|
||||
#if !defined(HAVE_VSNPRINTF)
|
||||
#define vsnprintf pcap_vsnprintf
|
||||
extern int vsnprintf (char *, size_t, const char *, va_list ap);
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Routines that most pcap implementations can use for non-blocking mode.
|
||||
*/
|
||||
#if !defined(WIN32) && !defined(MSDOS)
|
||||
int pcap_getnonblock_fd(pcap_t *, char *);
|
||||
int pcap_setnonblock_fd(pcap_t *p, int, char *);
|
||||
#endif
|
||||
|
||||
void pcap_close_common(pcap_t *);
|
||||
|
||||
/*
|
||||
* Internal interfaces for "pcap_findalldevs()".
|
||||
*
|
||||
* "pcap_platform_finddevs()" is a platform-dependent routine to
|
||||
* add devices not found by the "standard" mechanisms (SIOCGIFCONF,
|
||||
* "getifaddrs()", etc..
|
||||
*
|
||||
* "pcap_add_if()" adds an interface to the list of interfaces.
|
||||
*/
|
||||
int pcap_platform_finddevs(pcap_if_t **, char *);
|
||||
int add_addr_to_iflist(pcap_if_t **, const char *, u_int, struct sockaddr *,
|
||||
size_t, struct sockaddr *, size_t, struct sockaddr *, size_t,
|
||||
struct sockaddr *, size_t, char *);
|
||||
int pcap_add_if(pcap_if_t **, const char *, u_int, const char *, char *);
|
||||
struct sockaddr *dup_sockaddr(struct sockaddr *, size_t);
|
||||
int add_or_find_if(pcap_if_t **, pcap_if_t **, const char *, u_int,
|
||||
const char *, char *);
|
||||
|
||||
#ifdef WIN32
|
||||
char *pcap_win32strerror(void);
|
||||
#endif
|
||||
|
||||
int install_bpf_program(pcap_t *, struct bpf_program *);
|
||||
|
||||
int pcap_strcasecmp(const char *, const char *);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
/*
|
||||
* Copyright (c) 2002 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#define SIZEOF_CHAR 1
|
||||
#define SIZEOF_SHORT 2
|
||||
#define SIZEOF_INT 4
|
||||
#ifndef _MSC_EXTENSIONS
|
||||
#define SIZEOF_LONG_LONG 8
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Avoids a compiler warning in case this was already defined
|
||||
* (someone defined _WINSOCKAPI_ when including 'windows.h', in order
|
||||
* to prevent it from including 'winsock.h')
|
||||
*/
|
||||
#ifdef _WINSOCKAPI_
|
||||
#undef _WINSOCKAPI_
|
||||
#endif
|
||||
#include <winsock2.h>
|
||||
|
||||
#include <fcntl.h>
|
||||
|
||||
#include "bittypes.h"
|
||||
#include <time.h>
|
||||
#include <io.h>
|
||||
|
||||
#ifndef __MINGW32__
|
||||
#include "IP6_misc.h"
|
||||
#endif
|
||||
|
||||
#define caddr_t char*
|
||||
|
||||
#define snprintf _snprintf
|
||||
#define vsnprintf _vsnprintf
|
||||
#define inline __inline
|
||||
|
|
@ -0,0 +1,344 @@
|
|||
/* -*- Mode: c; tab-width: 8; indent-tabs-mode: 1; c-basic-offset: 8; -*- */
|
||||
/*
|
||||
* Copyright (c) 1993, 1994, 1995, 1996, 1997
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by the Computer Systems
|
||||
* Engineering Group at Lawrence Berkeley Laboratory.
|
||||
* 4. Neither the name of the University nor of the Laboratory may be used
|
||||
* to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/pcap.h,v 1.52.2.6 2006/02/09 22:26:49 guy Exp $ (LBL)
|
||||
*/
|
||||
|
||||
#ifndef lib_pcap_h
|
||||
#define lib_pcap_h
|
||||
|
||||
#if defined(WIN32)
|
||||
#include <pcap-stdinc.h>
|
||||
#elif defined(MSDOS)
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h> /* u_int, u_char etc. */
|
||||
#else /* UN*X */
|
||||
#include <sys/types.h>
|
||||
#include <sys/time.h>
|
||||
#endif /* WIN32/MSDOS/UN*X */
|
||||
|
||||
#ifndef PCAP_DONT_INCLUDE_PCAP_BPF_H
|
||||
#include <pcap-bpf.h>
|
||||
#endif
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
#ifdef HAVE_REMOTE
|
||||
// We have to define the SOCKET here, although it has been defined in sockutils.h
|
||||
// This is to avoid the distribution of the 'sockutils.h' file around
|
||||
// (for example in the WinPcap developer's pack)
|
||||
#ifndef SOCKET
|
||||
#ifdef WIN32
|
||||
#define SOCKET unsigned int
|
||||
#else
|
||||
#define SOCKET int
|
||||
#endif
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#define PCAP_VERSION_MAJOR 2
|
||||
#define PCAP_VERSION_MINOR 4
|
||||
|
||||
#define PCAP_ERRBUF_SIZE 256
|
||||
|
||||
/*
|
||||
* Compatibility for systems that have a bpf.h that
|
||||
* predates the bpf typedefs for 64-bit support.
|
||||
*/
|
||||
#if BPF_RELEASE - 0 < 199406
|
||||
typedef int bpf_int32;
|
||||
typedef u_int bpf_u_int32;
|
||||
#endif
|
||||
|
||||
typedef struct pcap pcap_t;
|
||||
typedef struct pcap_dumper pcap_dumper_t;
|
||||
typedef struct pcap_if pcap_if_t;
|
||||
typedef struct pcap_addr pcap_addr_t;
|
||||
|
||||
/*
|
||||
* The first record in the file contains saved values for some
|
||||
* of the flags used in the printout phases of tcpdump.
|
||||
* Many fields here are 32 bit ints so compilers won't insert unwanted
|
||||
* padding; these files need to be interchangeable across architectures.
|
||||
*
|
||||
* Do not change the layout of this structure, in any way (this includes
|
||||
* changes that only affect the length of fields in this structure).
|
||||
*
|
||||
* Also, do not change the interpretation of any of the members of this
|
||||
* structure, in any way (this includes using values other than
|
||||
* LINKTYPE_ values, as defined in "savefile.c", in the "linktype"
|
||||
* field).
|
||||
*
|
||||
* Instead:
|
||||
*
|
||||
* introduce a new structure for the new format, if the layout
|
||||
* of the structure changed;
|
||||
*
|
||||
* send mail to "tcpdump-workers@tcpdump.org", requesting a new
|
||||
* magic number for your new capture file format, and, when
|
||||
* you get the new magic number, put it in "savefile.c";
|
||||
*
|
||||
* use that magic number for save files with the changed file
|
||||
* header;
|
||||
*
|
||||
* make the code in "savefile.c" capable of reading files with
|
||||
* the old file header as well as files with the new file header
|
||||
* (using the magic number to determine the header format).
|
||||
*
|
||||
* Then supply the changes to "patches@tcpdump.org", so that future
|
||||
* versions of libpcap and programs that use it (such as tcpdump) will
|
||||
* be able to read your new capture file format.
|
||||
*/
|
||||
struct pcap_file_header {
|
||||
bpf_u_int32 magic;
|
||||
u_short version_major;
|
||||
u_short version_minor;
|
||||
bpf_int32 thiszone; /* gmt to local correction */
|
||||
bpf_u_int32 sigfigs; /* accuracy of timestamps */
|
||||
bpf_u_int32 snaplen; /* max length saved portion of each pkt */
|
||||
bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */
|
||||
};
|
||||
|
||||
typedef enum {
|
||||
PCAP_D_INOUT = 0,
|
||||
PCAP_D_IN,
|
||||
PCAP_D_OUT
|
||||
} pcap_direction_t;
|
||||
|
||||
/*
|
||||
* Generic per-packet information, as supplied by libpcap.
|
||||
*
|
||||
* The time stamp can and should be a "struct timeval", regardless of
|
||||
* whether your system supports 32-bit tv_sec in "struct timeval",
|
||||
* 64-bit tv_sec in "struct timeval", or both if it supports both 32-bit
|
||||
* and 64-bit applications. The on-disk format of savefiles uses 32-bit
|
||||
* tv_sec (and tv_usec); this structure is irrelevant to that. 32-bit
|
||||
* and 64-bit versions of libpcap, even if they're on the same platform,
|
||||
* should supply the appropriate version of "struct timeval", even if
|
||||
* that's not what the underlying packet capture mechanism supplies.
|
||||
*/
|
||||
struct pcap_pkthdr {
|
||||
struct timeval ts; /* time stamp */
|
||||
bpf_u_int32 caplen; /* length of portion present */
|
||||
bpf_u_int32 len; /* length this packet (off wire) */
|
||||
};
|
||||
|
||||
/*
|
||||
* As returned by the pcap_stats()
|
||||
*/
|
||||
struct pcap_stat {
|
||||
u_int ps_recv; /* number of packets received */
|
||||
u_int ps_drop; /* number of packets dropped */
|
||||
u_int ps_ifdrop; /* drops by interface XXX not yet supported */
|
||||
#ifdef HAVE_REMOTE
|
||||
u_int ps_capt; /* number of packets that are received by the application; please get rid off the Win32 ifdef */
|
||||
u_int ps_sent; /* number of packets sent by the server on the network */
|
||||
u_int ps_netdrop; /* number of packets lost on the network */
|
||||
#endif /* HAVE_REMOTE */
|
||||
};
|
||||
|
||||
#ifdef MSDOS
|
||||
/*
|
||||
* As returned by the pcap_stats_ex()
|
||||
*/
|
||||
struct pcap_stat_ex {
|
||||
u_long rx_packets; /* total packets received */
|
||||
u_long tx_packets; /* total packets transmitted */
|
||||
u_long rx_bytes; /* total bytes received */
|
||||
u_long tx_bytes; /* total bytes transmitted */
|
||||
u_long rx_errors; /* bad packets received */
|
||||
u_long tx_errors; /* packet transmit problems */
|
||||
u_long rx_dropped; /* no space in Rx buffers */
|
||||
u_long tx_dropped; /* no space available for Tx */
|
||||
u_long multicast; /* multicast packets received */
|
||||
u_long collisions;
|
||||
|
||||
/* detailed rx_errors: */
|
||||
u_long rx_length_errors;
|
||||
u_long rx_over_errors; /* receiver ring buff overflow */
|
||||
u_long rx_crc_errors; /* recv'd pkt with crc error */
|
||||
u_long rx_frame_errors; /* recv'd frame alignment error */
|
||||
u_long rx_fifo_errors; /* recv'r fifo overrun */
|
||||
u_long rx_missed_errors; /* recv'r missed packet */
|
||||
|
||||
/* detailed tx_errors */
|
||||
u_long tx_aborted_errors;
|
||||
u_long tx_carrier_errors;
|
||||
u_long tx_fifo_errors;
|
||||
u_long tx_heartbeat_errors;
|
||||
u_long tx_window_errors;
|
||||
};
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Item in a list of interfaces.
|
||||
*/
|
||||
struct pcap_if {
|
||||
struct pcap_if *next;
|
||||
char *name; /* name to hand to "pcap_open_live()" */
|
||||
char *description; /* textual description of interface, or NULL */
|
||||
struct pcap_addr *addresses;
|
||||
bpf_u_int32 flags; /* PCAP_IF_ interface flags */
|
||||
};
|
||||
|
||||
#define PCAP_IF_LOOPBACK 0x00000001 /* interface is loopback */
|
||||
|
||||
/*
|
||||
* Representation of an interface address.
|
||||
*/
|
||||
struct pcap_addr {
|
||||
struct pcap_addr *next;
|
||||
struct sockaddr *addr; /* address */
|
||||
struct sockaddr *netmask; /* netmask for that address */
|
||||
struct sockaddr *broadaddr; /* broadcast address for that address */
|
||||
struct sockaddr *dstaddr; /* P2P destination address for that address */
|
||||
};
|
||||
|
||||
typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
|
||||
const u_char *);
|
||||
|
||||
char *pcap_lookupdev(char *);
|
||||
int pcap_lookupnet(const char *, bpf_u_int32 *, bpf_u_int32 *, char *);
|
||||
pcap_t *pcap_open_live(const char *, int, int, int, char *);
|
||||
pcap_t *pcap_open_dead(int, int);
|
||||
pcap_t *pcap_open_offline(const char *, char *);
|
||||
pcap_t *pcap_fopen_offline(FILE *, char *);
|
||||
void pcap_close(pcap_t *);
|
||||
int pcap_loop(pcap_t *, int, pcap_handler, u_char *);
|
||||
int pcap_dispatch(pcap_t *, int, pcap_handler, u_char *);
|
||||
const u_char*
|
||||
pcap_next(pcap_t *, struct pcap_pkthdr *);
|
||||
int pcap_next_ex(pcap_t *, struct pcap_pkthdr **, const u_char **);
|
||||
void pcap_breakloop(pcap_t *);
|
||||
int pcap_stats(pcap_t *, struct pcap_stat *);
|
||||
int pcap_setfilter(pcap_t *, struct bpf_program *);
|
||||
int pcap_setdirection(pcap_t *, pcap_direction_t);
|
||||
int pcap_getnonblock(pcap_t *, char *);
|
||||
int pcap_setnonblock(pcap_t *, int, char *);
|
||||
void pcap_perror(pcap_t *, char *);
|
||||
int pcap_inject(pcap_t *, const void *, size_t);
|
||||
int pcap_sendpacket(pcap_t *, const u_char *, int);
|
||||
char *pcap_strerror(int);
|
||||
char *pcap_geterr(pcap_t *);
|
||||
int pcap_compile(pcap_t *, struct bpf_program *, char *, int,
|
||||
bpf_u_int32);
|
||||
int pcap_compile_nopcap(int, int, struct bpf_program *,
|
||||
char *, int, bpf_u_int32);
|
||||
void pcap_freecode(struct bpf_program *);
|
||||
int pcap_datalink(pcap_t *);
|
||||
int pcap_list_datalinks(pcap_t *, int **);
|
||||
int pcap_set_datalink(pcap_t *, int);
|
||||
int pcap_datalink_name_to_val(const char *);
|
||||
const char *pcap_datalink_val_to_name(int);
|
||||
const char *pcap_datalink_val_to_description(int);
|
||||
int pcap_snapshot(pcap_t *);
|
||||
int pcap_is_swapped(pcap_t *);
|
||||
int pcap_major_version(pcap_t *);
|
||||
int pcap_minor_version(pcap_t *);
|
||||
|
||||
/* XXX */
|
||||
FILE *pcap_file(pcap_t *);
|
||||
int pcap_fileno(pcap_t *);
|
||||
|
||||
pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);
|
||||
pcap_dumper_t *pcap_dump_fopen(pcap_t *, FILE *fp);
|
||||
FILE *pcap_dump_file(pcap_dumper_t *);
|
||||
long pcap_dump_ftell(pcap_dumper_t *);
|
||||
int pcap_dump_flush(pcap_dumper_t *);
|
||||
void pcap_dump_close(pcap_dumper_t *);
|
||||
void pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);
|
||||
|
||||
int pcap_findalldevs(pcap_if_t **, char *);
|
||||
void pcap_freealldevs(pcap_if_t *);
|
||||
|
||||
const char *pcap_lib_version(void);
|
||||
|
||||
/* XXX this guy lives in the bpf tree */
|
||||
u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
|
||||
int bpf_validate(struct bpf_insn *f, int len);
|
||||
char *bpf_image(struct bpf_insn *, int);
|
||||
void bpf_dump(struct bpf_program *, int);
|
||||
|
||||
#if defined(WIN32)
|
||||
|
||||
/*
|
||||
* Win32 definitions
|
||||
*/
|
||||
|
||||
int pcap_setbuff(pcap_t *p, int dim);
|
||||
int pcap_setmode(pcap_t *p, int mode);
|
||||
int pcap_setmintocopy(pcap_t *p, int size);
|
||||
|
||||
#ifdef WPCAP
|
||||
/* Include file with the wpcap-specific extensions */
|
||||
#include <Win32-Extensions.h>
|
||||
#endif /* WPCAP */
|
||||
|
||||
#define MODE_CAPT 0
|
||||
#define MODE_STAT 1
|
||||
#define MODE_MON 2
|
||||
|
||||
#elif defined(MSDOS)
|
||||
|
||||
/*
|
||||
* MS-DOS definitions
|
||||
*/
|
||||
|
||||
int pcap_stats_ex (pcap_t *, struct pcap_stat_ex *);
|
||||
void pcap_set_wait (pcap_t *p, void (*yield)(void), int wait);
|
||||
u_long pcap_mac_packets (void);
|
||||
|
||||
#else /* UN*X */
|
||||
|
||||
/*
|
||||
* UN*X definitions
|
||||
*/
|
||||
|
||||
int pcap_get_selectable_fd(pcap_t *);
|
||||
|
||||
#endif /* WIN32/MSDOS/UN*X */
|
||||
|
||||
#ifdef HAVE_REMOTE
|
||||
/* Includes most of the public stuff that is needed for the remote capture */
|
||||
#include "remote-ext.h"
|
||||
#endif /* HAVE_REMOTE */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,441 @@
|
|||
/*
|
||||
* Copyright (c) 2002 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
#ifndef __REMOTE_EXT_H__
|
||||
#define __REMOTE_EXT_H__
|
||||
|
||||
|
||||
|
||||
// Definition for Microsoft Visual Studio
|
||||
#if _MSC_VER > 1000
|
||||
#pragma once
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*!
|
||||
\file remote-ext.h
|
||||
|
||||
The goal of this file it to include most of the new definitions that should be
|
||||
placed into the pcap.h file.
|
||||
|
||||
It includes all new definitions (structures and functions like pcap_open().
|
||||
Some of the functions are not really a remote feature, but, right now,
|
||||
they are placed here.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
// All this stuff is public
|
||||
/*! \addtogroup remote_struct
|
||||
\{
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
/*!
|
||||
\brief Defines the maximum buffer size in which address, port, interface names are kept.
|
||||
|
||||
In case the adapter name or such is larger than this value, it is truncated.
|
||||
This is not used by the user; however it must be aware that an hostname / interface
|
||||
name longer than this value will be truncated.
|
||||
*/
|
||||
#define PCAP_BUF_SIZE 1024
|
||||
|
||||
|
||||
/*! \addtogroup remote_source_ID
|
||||
\{
|
||||
*/
|
||||
|
||||
|
||||
/*!
|
||||
\brief Internal representation of the type of source in use (file,
|
||||
remote/local interface).
|
||||
|
||||
This indicates a file, i.e. the user want to open a capture from a local file.
|
||||
*/
|
||||
#define PCAP_SRC_FILE 2
|
||||
/*!
|
||||
\brief Internal representation of the type of source in use (file,
|
||||
remote/local interface).
|
||||
|
||||
This indicates a local interface, i.e. the user want to open a capture from
|
||||
a local interface. This does not involve the RPCAP protocol.
|
||||
*/
|
||||
#define PCAP_SRC_IFLOCAL 3
|
||||
/*!
|
||||
\brief Internal representation of the type of source in use (file,
|
||||
remote/local interface).
|
||||
|
||||
This indicates a remote interface, i.e. the user want to open a capture from
|
||||
an interface on a remote host. This does involve the RPCAP protocol.
|
||||
*/
|
||||
#define PCAP_SRC_IFREMOTE 4
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/
|
||||
|
||||
|
||||
|
||||
/*! \addtogroup remote_source_string
|
||||
|
||||
The formats allowed by the pcap_open() are the following:
|
||||
- file://path_and_filename [opens a local file]
|
||||
- rpcap://devicename [opens the selected device devices available on the local host, without using the RPCAP protocol]
|
||||
- rpcap://host/devicename [opens the selected device available on a remote host]
|
||||
- rpcap://host:port/devicename [opens the selected device available on a remote host, using a non-standard port for RPCAP]
|
||||
- adaptername [to open a local adapter; kept for compability, but it is strongly discouraged]
|
||||
- (NULL) [to open the first local adapter; kept for compability, but it is strongly discouraged]
|
||||
|
||||
The formats allowed by the pcap_findalldevs_ex() are the following:
|
||||
- file://folder/ [lists all the files in the given folder]
|
||||
- rpcap:// [lists all local adapters]
|
||||
- rpcap://host:port/ [lists the devices available on a remote host]
|
||||
|
||||
Referring to the 'host' and 'port' paramters, they can be either numeric or literal. Since
|
||||
IPv6 is fully supported, these are the allowed formats:
|
||||
|
||||
- host (literal): e.g. host.foo.bar
|
||||
- host (numeric IPv4): e.g. 10.11.12.13
|
||||
- host (numeric IPv4, IPv6 style): e.g. [10.11.12.13]
|
||||
- host (numeric IPv6): e.g. [1:2:3::4]
|
||||
- port: can be either numeric (e.g. '80') or literal (e.g. 'http')
|
||||
|
||||
Here you find some allowed examples:
|
||||
- rpcap://host.foo.bar/devicename [everything literal, no port number]
|
||||
- rpcap://host.foo.bar:1234/devicename [everything literal, with port number]
|
||||
- rpcap://10.11.12.13/devicename [IPv4 numeric, no port number]
|
||||
- rpcap://10.11.12.13:1234/devicename [IPv4 numeric, with port number]
|
||||
- rpcap://[10.11.12.13]:1234/devicename [IPv4 numeric with IPv6 format, with port number]
|
||||
- rpcap://[1:2:3::4]/devicename [IPv6 numeric, no port number]
|
||||
- rpcap://[1:2:3::4]:1234/devicename [IPv6 numeric, with port number]
|
||||
- rpcap://[1:2:3::4]:http/devicename [IPv6 numeric, with literal port number]
|
||||
|
||||
\{
|
||||
*/
|
||||
|
||||
|
||||
/*!
|
||||
\brief String that will be used to determine the type of source in use (file,
|
||||
remote/local interface).
|
||||
|
||||
This string will be prepended to the interface name in order to create a string
|
||||
that contains all the information required to open the source.
|
||||
|
||||
This string indicates that the user wants to open a capture from a local file.
|
||||
*/
|
||||
#define PCAP_SRC_FILE_STRING "file://"
|
||||
/*!
|
||||
\brief String that will be used to determine the type of source in use (file,
|
||||
remote/local interface).
|
||||
|
||||
This string will be prepended to the interface name in order to create a string
|
||||
that contains all the information required to open the source.
|
||||
|
||||
This string indicates that the user wants to open a capture from a network interface.
|
||||
This string does not necessarily involve the use of the RPCAP protocol. If the
|
||||
interface required resides on the local host, the RPCAP protocol is not involved
|
||||
and the local functions are used.
|
||||
*/
|
||||
#define PCAP_SRC_IF_STRING "rpcap://"
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/*!
|
||||
\addtogroup remote_open_flags
|
||||
\{
|
||||
*/
|
||||
|
||||
/*!
|
||||
\brief Defines if the adapter has to go in promiscuous mode.
|
||||
|
||||
It is '1' if you have to open the adapter in promiscuous mode, '0' otherwise.
|
||||
Note that even if this parameter is false, the interface could well be in promiscuous
|
||||
mode for some other reason (for example because another capture process with
|
||||
promiscuous mode enabled is currently using that interface).
|
||||
On on Linux systems with 2.2 or later kernels (that have the "any" device), this
|
||||
flag does not work on the "any" device; if an argument of "any" is supplied,
|
||||
the 'promisc' flag is ignored.
|
||||
*/
|
||||
#define PCAP_OPENFLAG_PROMISCUOUS 1
|
||||
|
||||
/*!
|
||||
\brief Defines if the data trasfer (in case of a remote
|
||||
capture) has to be done with UDP protocol.
|
||||
|
||||
If it is '1' if you want a UDP data connection, '0' if you want
|
||||
a TCP data connection; control connection is always TCP-based.
|
||||
A UDP connection is much lighter, but it does not guarantee that all
|
||||
the captured packets arrive to the client workstation. Moreover,
|
||||
it could be harmful in case of network congestion.
|
||||
This flag is meaningless if the source is not a remote interface.
|
||||
In that case, it is simply ignored.
|
||||
*/
|
||||
#define PCAP_OPENFLAG_DATATX_UDP 2
|
||||
|
||||
|
||||
/*!
|
||||
\brief Defines if the remote probe will capture its own generated traffic.
|
||||
|
||||
In case the remote probe uses the same interface to capture traffic and to send
|
||||
data back to the caller, the captured traffic includes the RPCAP traffic as well.
|
||||
If this flag is turned on, the RPCAP traffic is excluded from the capture, so that
|
||||
the trace returned back to the collector is does not include this traffic.
|
||||
*/
|
||||
#define PCAP_OPENFLAG_NOCAPTURE_RPCAP 4
|
||||
|
||||
/*!
|
||||
\brief Defines if the local adapter will capture its own generated traffic.
|
||||
|
||||
This flag tells the underlying capture driver to drop the packets that were sent by itself.
|
||||
This is usefult when building applications like bridges, that should ignore the traffic
|
||||
they just sent.
|
||||
*/
|
||||
#define PCAP_OPENFLAG_NOCAPTURE_LOCAL 8
|
||||
|
||||
/*!
|
||||
\brief This flag configures the adapter for maximum responsiveness.
|
||||
|
||||
In presence of a large value for nbytes, WinPcap waits for the arrival of several packets before
|
||||
copying the data to the user. This guarantees a low number of system calls, i.e. lower processor usage,
|
||||
i.e. better performance, which is good for applications like sniffers. If the user sets the
|
||||
PCAP_OPENFLAG_MAX_RESPONSIVENESS flag, the capture driver will copy the packets as soon as the application
|
||||
is ready to receive them. This is suggested for real time applications (like, for example, a bridge)
|
||||
that need the best responsiveness.*/
|
||||
#define PCAP_OPENFLAG_MAX_RESPONSIVENESS 16
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/
|
||||
|
||||
|
||||
/*!
|
||||
\addtogroup remote_samp_methods
|
||||
\{
|
||||
*/
|
||||
|
||||
/*!
|
||||
\brief No sampling has to be done on the current capture.
|
||||
|
||||
In this case, no sampling algorithms are applied to the current capture.
|
||||
*/
|
||||
#define PCAP_SAMP_NOSAMP 0
|
||||
|
||||
/*!
|
||||
\brief It defines that only 1 out of N packets must be returned to the user.
|
||||
|
||||
In this case, the 'value' field of the 'pcap_samp' structure indicates the
|
||||
number of packets (minus 1) that must be discarded before one packet got accepted.
|
||||
In other words, if 'value = 10', the first packet is returned to the caller, while
|
||||
the following 9 are discarded.
|
||||
*/
|
||||
#define PCAP_SAMP_1_EVERY_N 1
|
||||
|
||||
/*!
|
||||
\brief It defines that we have to return 1 packet every N milliseconds.
|
||||
|
||||
In this case, the 'value' field of the 'pcap_samp' structure indicates the 'waiting
|
||||
time' in milliseconds before one packet got accepted.
|
||||
In other words, if 'value = 10', the first packet is returned to the caller; the next
|
||||
returned one will be the first packet that arrives when 10ms have elapsed.
|
||||
*/
|
||||
#define PCAP_SAMP_FIRST_AFTER_N_MS 2
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/
|
||||
|
||||
|
||||
/*!
|
||||
\addtogroup remote_auth_methods
|
||||
\{
|
||||
*/
|
||||
|
||||
/*!
|
||||
\brief It defines the NULL authentication.
|
||||
|
||||
This value has to be used within the 'type' member of the pcap_rmtauth structure.
|
||||
The 'NULL' authentication has to be equal to 'zero', so that old applications
|
||||
can just put every field of struct pcap_rmtauth to zero, and it does work.
|
||||
*/
|
||||
#define RPCAP_RMTAUTH_NULL 0
|
||||
/*!
|
||||
\brief It defines the username/password authentication.
|
||||
|
||||
With this type of authentication, the RPCAP protocol will use the username/
|
||||
password provided to authenticate the user on the remote machine. If the
|
||||
authentication is successful (and the user has the right to open network devices)
|
||||
the RPCAP connection will continue; otherwise it will be dropped.
|
||||
|
||||
This value has to be used within the 'type' member of the pcap_rmtauth structure.
|
||||
*/
|
||||
#define RPCAP_RMTAUTH_PWD 1
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
/*!
|
||||
|
||||
\brief This structure keeps the information needed to autheticate
|
||||
the user on a remote machine.
|
||||
|
||||
The remote machine can either grant or refuse the access according
|
||||
to the information provided.
|
||||
In case the NULL authentication is required, both 'username' and
|
||||
'password' can be NULL pointers.
|
||||
|
||||
This structure is meaningless if the source is not a remote interface;
|
||||
in that case, the functions which requires such a structure can accept
|
||||
a NULL pointer as well.
|
||||
*/
|
||||
struct pcap_rmtauth
|
||||
{
|
||||
/*!
|
||||
\brief Type of the authentication required.
|
||||
|
||||
In order to provide maximum flexibility, we can support different types
|
||||
of authentication based on the value of this 'type' variable. The currently
|
||||
supported authentication methods are defined into the
|
||||
\link remote_auth_methods Remote Authentication Methods Section\endlink.
|
||||
|
||||
*/
|
||||
int type;
|
||||
/*!
|
||||
\brief Zero-terminated string containing the username that has to be
|
||||
used on the remote machine for authentication.
|
||||
|
||||
This field is meaningless in case of the RPCAP_RMTAUTH_NULL authentication
|
||||
and it can be NULL.
|
||||
*/
|
||||
char *username;
|
||||
/*!
|
||||
\brief Zero-terminated string containing the password that has to be
|
||||
used on the remote machine for authentication.
|
||||
|
||||
This field is meaningless in case of the RPCAP_RMTAUTH_NULL authentication
|
||||
and it can be NULL.
|
||||
*/
|
||||
char *password;
|
||||
};
|
||||
|
||||
|
||||
/*!
|
||||
\brief This structure defines the information related to sampling.
|
||||
|
||||
In case the sampling is requested, the capturing device should read
|
||||
only a subset of the packets coming from the source. The returned packets depend
|
||||
on the sampling parameters.
|
||||
|
||||
\warning The sampling process is applied <strong>after</strong> the filtering process.
|
||||
In other words, packets are filtered first, then the sampling process selects a
|
||||
subset of the 'filtered' packets and it returns them to the caller.
|
||||
*/
|
||||
struct pcap_samp
|
||||
{
|
||||
/*!
|
||||
Method used for sampling. Currently, the supported methods are listed in the
|
||||
\link remote_samp_methods Sampling Methods Section\endlink.
|
||||
*/
|
||||
int method;
|
||||
|
||||
/*!
|
||||
This value depends on the sampling method defined. For its meaning, please check
|
||||
at the \link remote_samp_methods Sampling Methods Section\endlink.
|
||||
*/
|
||||
int value;
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
//! Maximum lenght of an host name (needed for the RPCAP active mode)
|
||||
#define RPCAP_HOSTLIST_SIZE 1024
|
||||
|
||||
|
||||
/*!
|
||||
\}
|
||||
*/ // end of public documentation
|
||||
|
||||
|
||||
// Exported functions
|
||||
|
||||
|
||||
|
||||
/** \name New WinPcap functions
|
||||
|
||||
This section lists the new functions that are able to help considerably in writing
|
||||
WinPcap programs because of their easiness of use.
|
||||
*/
|
||||
//\{
|
||||
pcap_t *pcap_open(const char *source, int snaplen, int flags, int read_timeout, struct pcap_rmtauth *auth, char *errbuf);
|
||||
int pcap_createsrcstr(char *source, int type, const char *host, const char *port, const char *name, char *errbuf);
|
||||
int pcap_parsesrcstr(const char *source, int *type, char *host, char *port, char *name, char *errbuf);
|
||||
int pcap_findalldevs_ex(char *source, struct pcap_rmtauth *auth, pcap_if_t **alldevs, char *errbuf);
|
||||
struct pcap_samp *pcap_setsampling(pcap_t *p);
|
||||
|
||||
//\}
|
||||
// End of new winpcap functions
|
||||
|
||||
|
||||
|
||||
/** \name Remote Capture functions
|
||||
*/
|
||||
//\{
|
||||
SOCKET pcap_remoteact_accept(const char *address, const char *port, const char *hostlist, char *connectinghost, struct pcap_rmtauth *auth, char *errbuf);
|
||||
int pcap_remoteact_list(char *hostlist, char sep, int size, char *errbuf);
|
||||
int pcap_remoteact_close(const char *host, char *errbuf);
|
||||
void pcap_remoteact_cleanup();
|
||||
//\}
|
||||
// End of remote capture functions
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __tcp_session
|
||||
#define __tcp_session
|
||||
|
||||
#ifdef WIN32
|
||||
#include "tme.h"
|
||||
#endif
|
||||
|
||||
#ifdef __FreeBSD__
|
||||
|
||||
#ifdef _KERNEL
|
||||
#include <net/tme/tme.h>
|
||||
#else
|
||||
#include <tme/tme.h>
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
#define UNKNOWN 0
|
||||
#define SYN_RCV 1
|
||||
#define SYN_ACK_RCV 2
|
||||
#define ESTABLISHED 3
|
||||
#define CLOSED_RST 4
|
||||
#define FIN_CLN_RCV 5
|
||||
#define FIN_SRV_RCV 6
|
||||
#define CLOSED_FIN 7
|
||||
#define ERROR_TCP 8
|
||||
#define FIRST_IS_CLN 0
|
||||
#define FIRST_IS_SRV 0xffffffff
|
||||
#define FIN_CLN 1
|
||||
#define FIN_SRV 2
|
||||
|
||||
#define MAX_WINDOW 65536
|
||||
|
||||
typedef struct __tcp_data
|
||||
{
|
||||
struct timeval timestamp_block; /*DO NOT MOVE THIS VALUE*/
|
||||
struct timeval syn_timestamp;
|
||||
struct timeval last_timestamp;
|
||||
struct timeval syn_ack_timestamp;
|
||||
uint32 direction;
|
||||
uint32 seq_n_0_srv;
|
||||
uint32 seq_n_0_cln;
|
||||
uint32 ack_srv; /* acknowledge of (data sent by server) */
|
||||
uint32 ack_cln; /* acknowledge of (data sent by client) */
|
||||
uint32 status;
|
||||
uint32 pkts_cln_to_srv;
|
||||
uint32 pkts_srv_to_cln;
|
||||
uint32 bytes_srv_to_cln;
|
||||
uint32 bytes_cln_to_srv;
|
||||
uint32 close_state;
|
||||
}
|
||||
tcp_data;
|
||||
|
||||
#define FIN 1
|
||||
#define SYN 2
|
||||
#define RST 4
|
||||
#define PSH 8
|
||||
#define ACK 16
|
||||
#define URG 32
|
||||
|
||||
#define TCP_SESSION 0x00000800
|
||||
uint32 tcp_session(uint8 *block, uint32 pkt_size, TME_DATA *data, MEM_TYPE *mem_ex, uint8 *mem_data);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,485 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2005 NetGroup, Politecnico di Torino (Italy)
|
||||
* Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino, CACE Technologies
|
||||
* nor the names of its contributors may be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _time_calls
|
||||
#define _time_calls
|
||||
|
||||
#ifdef WIN_NT_DRIVER
|
||||
|
||||
#include "debug.h"
|
||||
#include "ndis.h"
|
||||
|
||||
#define DEFAULT_TIMESTAMPMODE 0
|
||||
|
||||
#define TIMESTAMPMODE_SINGLE_SYNCHRONIZATION 0
|
||||
#define TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_WITH_FIXUP 1
|
||||
#define TIMESTAMPMODE_QUERYSYSTEMTIME 2
|
||||
#define TIMESTAMPMODE_RDTSC 3
|
||||
|
||||
#define TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_NO_FIXUP 99
|
||||
|
||||
#define TIMESTAMPMODE_REGKEY L"TimestampMode"
|
||||
|
||||
extern ULONG TimestampMode;
|
||||
|
||||
/*!
|
||||
\brief A microsecond precise timestamp.
|
||||
|
||||
included in the sf_pkthdr or the bpf_hdr that NPF associates with every packet.
|
||||
*/
|
||||
|
||||
struct timeval {
|
||||
long tv_sec; ///< seconds
|
||||
long tv_usec; ///< microseconds
|
||||
};
|
||||
|
||||
#endif /*WIN_NT_DRIVER*/
|
||||
|
||||
struct time_conv
|
||||
{
|
||||
ULONGLONG reference;
|
||||
struct timeval start[32];
|
||||
};
|
||||
|
||||
#ifdef WIN_NT_DRIVER
|
||||
|
||||
__inline void TIME_DESYNCHRONIZE(struct time_conv *data)
|
||||
{
|
||||
data->reference = 0;
|
||||
// data->start.tv_sec = 0;
|
||||
// data->start.tv_usec = 0;
|
||||
}
|
||||
|
||||
|
||||
__inline void ReadTimeStampModeFromRegistry(PUNICODE_STRING RegistryPath)
|
||||
{
|
||||
ULONG NewLength;
|
||||
PWSTR NullTerminatedString;
|
||||
RTL_QUERY_REGISTRY_TABLE Queries[2];
|
||||
ULONG DefaultTimestampMode = DEFAULT_TIMESTAMPMODE;
|
||||
|
||||
NewLength = RegistryPath->Length/2;
|
||||
|
||||
NullTerminatedString = ExAllocatePoolWithTag(PagedPool, (NewLength+1) *sizeof(WCHAR), '2TWA');
|
||||
|
||||
if (NullTerminatedString != NULL)
|
||||
{
|
||||
RtlCopyMemory(NullTerminatedString, RegistryPath->Buffer, RegistryPath->Length);
|
||||
|
||||
NullTerminatedString[NewLength]=0;
|
||||
|
||||
RtlZeroMemory(Queries, sizeof(Queries));
|
||||
|
||||
Queries[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
|
||||
Queries[0].Name = TIMESTAMPMODE_REGKEY;
|
||||
Queries[0].EntryContext = &TimestampMode;
|
||||
Queries[0].DefaultType = REG_DWORD;
|
||||
Queries[0].DefaultData = &DefaultTimestampMode;
|
||||
Queries[0].DefaultLength = sizeof(ULONG);
|
||||
|
||||
if(RtlQueryRegistryValues(RTL_REGISTRY_ABSOLUTE, NullTerminatedString, Queries, NULL, NULL) != STATUS_SUCCESS)
|
||||
{
|
||||
TimestampMode = DEFAULT_TIMESTAMPMODE;
|
||||
}
|
||||
|
||||
RtlWriteRegistryValue( RTL_REGISTRY_ABSOLUTE, NullTerminatedString, TIMESTAMPMODE_REGKEY, REG_DWORD, &TimestampMode,sizeof(ULONG));
|
||||
ExFreePool(NullTerminatedString);
|
||||
}
|
||||
else
|
||||
TimestampMode = DEFAULT_TIMESTAMPMODE;
|
||||
}
|
||||
|
||||
#pragma optimize ("g",off) //Due to some weird behaviour of the optimizer of DDK build 2600
|
||||
|
||||
/* KeQueryPerformanceCounter TimeStamps */
|
||||
__inline void SynchronizeOnCpu(struct timeval *start)
|
||||
{
|
||||
// struct timeval *start = (struct timeval*)Data;
|
||||
|
||||
struct timeval tmp;
|
||||
LARGE_INTEGER SystemTime;
|
||||
LARGE_INTEGER i;
|
||||
ULONG tmp2;
|
||||
LARGE_INTEGER TimeFreq,PTime;
|
||||
|
||||
// get the absolute value of the system boot time.
|
||||
|
||||
PTime = KeQueryPerformanceCounter(&TimeFreq);
|
||||
KeQuerySystemTime(&SystemTime);
|
||||
|
||||
start->tv_sec = (LONG)(SystemTime.QuadPart/10000000-11644473600);
|
||||
|
||||
start->tv_usec = (LONG)((SystemTime.QuadPart%10000000)/10);
|
||||
|
||||
start->tv_sec -= (ULONG)(PTime.QuadPart/TimeFreq.QuadPart);
|
||||
|
||||
start->tv_usec -= (LONG)((PTime.QuadPart%TimeFreq.QuadPart)*1000000/TimeFreq.QuadPart);
|
||||
|
||||
if (start->tv_usec < 0)
|
||||
{
|
||||
start->tv_sec --;
|
||||
start->tv_usec += 1000000;
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
// inline assembler is not supported with the current AMD64 compilers
|
||||
// At the moment we simply disable this timestamping mode on AMD64.
|
||||
// A solution would be to allocate a small memory from the non-paged
|
||||
// pool, dump the instructions on that buffer, and then execute them.
|
||||
// The non paged pool is needed since it's the only area of kernel
|
||||
// data memory that is not subject to the NX protection.
|
||||
// Or use some lower level trick, like using an assembler to assemble
|
||||
// a small function for this.
|
||||
//
|
||||
|
||||
#ifdef _X86_
|
||||
/*RDTSC timestamps */
|
||||
/* callers must be at IRQL=PASSIVE_LEVEL*/
|
||||
__inline VOID TimeSynchronizeRDTSC(struct time_conv *data)
|
||||
{
|
||||
struct timeval tmp;
|
||||
LARGE_INTEGER system_time;
|
||||
ULONGLONG curr_ticks;
|
||||
KIRQL old;
|
||||
LARGE_INTEGER start_kqpc,stop_kqpc,start_freq,stop_freq;
|
||||
ULONGLONG start_ticks,stop_ticks;
|
||||
ULONGLONG delta,delta2;
|
||||
KEVENT event;
|
||||
LARGE_INTEGER i;
|
||||
ULONGLONG reference;
|
||||
|
||||
if (data->reference!=0)
|
||||
return;
|
||||
|
||||
KeInitializeEvent(&event,NotificationEvent,FALSE);
|
||||
|
||||
i.QuadPart=-3500000;
|
||||
|
||||
KeRaiseIrql(HIGH_LEVEL,&old);
|
||||
start_kqpc=KeQueryPerformanceCounter(&start_freq);
|
||||
__asm
|
||||
{
|
||||
push eax
|
||||
push edx
|
||||
push ecx
|
||||
rdtsc
|
||||
lea ecx, start_ticks
|
||||
mov [ecx+4], edx
|
||||
mov [ecx], eax
|
||||
pop ecx
|
||||
pop edx
|
||||
pop eax
|
||||
}
|
||||
|
||||
KeLowerIrql(old);
|
||||
|
||||
KeWaitForSingleObject(&event,UserRequest,KernelMode,TRUE ,&i);
|
||||
|
||||
KeRaiseIrql(HIGH_LEVEL,&old);
|
||||
stop_kqpc=KeQueryPerformanceCounter(&stop_freq);
|
||||
__asm
|
||||
{
|
||||
push eax
|
||||
push edx
|
||||
push ecx
|
||||
rdtsc
|
||||
lea ecx, stop_ticks
|
||||
mov [ecx+4], edx
|
||||
mov [ecx], eax
|
||||
pop ecx
|
||||
pop edx
|
||||
pop eax
|
||||
}
|
||||
KeLowerIrql(old);
|
||||
|
||||
delta=stop_ticks-start_ticks;
|
||||
delta2=stop_kqpc.QuadPart-start_kqpc.QuadPart;
|
||||
if (delta>10000000000)
|
||||
{
|
||||
delta/=16;
|
||||
delta2/=16;
|
||||
}
|
||||
|
||||
reference=delta*(start_freq.QuadPart)/delta2;
|
||||
|
||||
data->reference=reference/1000;
|
||||
|
||||
if (reference%1000>500)
|
||||
data->reference++;
|
||||
|
||||
data->reference*=1000;
|
||||
|
||||
reference=data->reference;
|
||||
|
||||
KeQuerySystemTime(&system_time);
|
||||
|
||||
__asm
|
||||
{
|
||||
push eax
|
||||
push edx
|
||||
push ecx
|
||||
rdtsc
|
||||
lea ecx, curr_ticks
|
||||
mov [ecx+4], edx
|
||||
mov [ecx], eax
|
||||
pop ecx
|
||||
pop edx
|
||||
pop eax
|
||||
}
|
||||
|
||||
tmp.tv_sec=-(LONG)(curr_ticks/reference);
|
||||
|
||||
tmp.tv_usec=-(LONG)((curr_ticks%reference)*1000000/reference);
|
||||
|
||||
system_time.QuadPart-=116444736000000000;
|
||||
|
||||
tmp.tv_sec+=(LONG)(system_time.QuadPart/10000000);
|
||||
tmp.tv_usec+=(LONG)((system_time.QuadPart%10000000)/10);
|
||||
|
||||
if (tmp.tv_usec<0)
|
||||
{
|
||||
tmp.tv_sec--;
|
||||
tmp.tv_usec+=1000000;
|
||||
}
|
||||
|
||||
data->start[0] = tmp;
|
||||
|
||||
IF_LOUD(DbgPrint("Frequency %I64u MHz\n",data->reference);)
|
||||
}
|
||||
#endif //_X86_
|
||||
|
||||
#pragma optimize ("g",on) //Due to some weird behaviour of the optimizer of DDK build 2600
|
||||
|
||||
__inline VOID TIME_SYNCHRONIZE(struct time_conv *data)
|
||||
{
|
||||
ULONG NumberOfCpus, i;
|
||||
KAFFINITY AffinityMask;
|
||||
|
||||
if (data->reference != 0)
|
||||
return;
|
||||
|
||||
NumberOfCpus = NdisSystemProcessorCount();
|
||||
|
||||
if ( TimestampMode == TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_WITH_FIXUP || TimestampMode == TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_NO_FIXUP)
|
||||
{
|
||||
for (i = 0 ; i < NumberOfCpus ; i++ )
|
||||
{
|
||||
AffinityMask = (1 << i);
|
||||
ZwSetInformationThread(NtCurrentThread(), ThreadAffinityMask, &AffinityMask, sizeof(KAFFINITY));
|
||||
SynchronizeOnCpu(&(data->start[i]));
|
||||
}
|
||||
AffinityMask = 0xFFFFFFFF;
|
||||
ZwSetInformationThread(NtCurrentThread(), ThreadAffinityMask, &AffinityMask, sizeof(KAFFINITY));
|
||||
data->reference = 1;
|
||||
}
|
||||
else
|
||||
if ( TimestampMode == TIMESTAMPMODE_QUERYSYSTEMTIME )
|
||||
{
|
||||
//do nothing
|
||||
data->reference = 1;
|
||||
}
|
||||
else
|
||||
//
|
||||
// This timestamp mode is supported on x86 (32 bit) only
|
||||
//
|
||||
#ifdef _X86_
|
||||
if ( TimestampMode == TIMESTAMPMODE_RDTSC )
|
||||
{
|
||||
TimeSynchronizeRDTSC(data);
|
||||
}
|
||||
else
|
||||
#endif // _X86_
|
||||
{ //it should be only the normal case i.e. TIMESTAMPMODE_SINGLESYNCHRONIZATION
|
||||
SynchronizeOnCpu(data->start);
|
||||
data->reference = 1;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
#pragma optimize ("g",off) //Due to some weird behaviour of the optimizer of DDK build 2600
|
||||
|
||||
__inline void GetTimeKQPC(struct timeval *dst, struct time_conv *data)
|
||||
{
|
||||
LARGE_INTEGER PTime, TimeFreq;
|
||||
LONG tmp;
|
||||
ULONG CurrentCpu;
|
||||
static struct timeval old_ts={0,0};
|
||||
|
||||
|
||||
PTime = KeQueryPerformanceCounter(&TimeFreq);
|
||||
tmp = (LONG)(PTime.QuadPart/TimeFreq.QuadPart);
|
||||
|
||||
if (TimestampMode == TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_WITH_FIXUP || TimestampMode == TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_NO_FIXUP)
|
||||
{
|
||||
//actually this code is ok only if we are guaranteed that no thread scheduling will take place.
|
||||
CurrentCpu = KeGetCurrentProcessorNumber();
|
||||
|
||||
dst->tv_sec = data->start[CurrentCpu].tv_sec + tmp;
|
||||
dst->tv_usec = data->start[CurrentCpu].tv_usec + (LONG)((PTime.QuadPart%TimeFreq.QuadPart)*1000000/TimeFreq.QuadPart);
|
||||
|
||||
if (dst->tv_usec >= 1000000)
|
||||
{
|
||||
dst->tv_sec ++;
|
||||
dst->tv_usec -= 1000000;
|
||||
}
|
||||
|
||||
if (TimestampMode == TIMESTAMPMODE_SYNCHRONIZATION_ON_CPU_WITH_FIXUP)
|
||||
{
|
||||
if (old_ts.tv_sec > dst->tv_sec || (old_ts.tv_sec == dst->tv_sec && old_ts.tv_usec > dst->tv_usec) )
|
||||
*dst = old_ts;
|
||||
|
||||
else
|
||||
old_ts = *dst;
|
||||
}
|
||||
}
|
||||
else
|
||||
{ //it should be only the normal case i.e. TIMESTAMPMODE_SINGLESYNCHRONIZATION
|
||||
dst->tv_sec = data->start[0].tv_sec + tmp;
|
||||
dst->tv_usec = data->start[0].tv_usec + (LONG)((PTime.QuadPart%TimeFreq.QuadPart)*1000000/TimeFreq.QuadPart);
|
||||
|
||||
if (dst->tv_usec >= 1000000)
|
||||
{
|
||||
dst->tv_sec ++;
|
||||
dst->tv_usec -= 1000000;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
// inline assembler is not supported with the current AMD64 compilers
|
||||
// At the moment we simply disable this timestamping mode on AMD64.
|
||||
// A solution would be to allocate a small memory from the non-paged
|
||||
// pool, dump the instructions on that buffer, and then execute them.
|
||||
// The non paged pool is needed since it's the only area of kernel
|
||||
// data memory that is not subject to the NX protection.
|
||||
// Or use some lower level trick, like using an assembler to assemble
|
||||
// a small function for this.
|
||||
//
|
||||
|
||||
#ifdef _X86_
|
||||
__inline void GetTimeRDTSC(struct timeval *dst, struct time_conv *data)
|
||||
{
|
||||
|
||||
ULONGLONG tmp = 0;
|
||||
__asm
|
||||
{
|
||||
push eax
|
||||
push edx
|
||||
push ecx
|
||||
rdtsc
|
||||
lea ecx, tmp
|
||||
mov [ecx+4], edx
|
||||
mov [ecx], eax
|
||||
pop ecx
|
||||
pop edx
|
||||
pop eax
|
||||
}
|
||||
|
||||
if (data->reference==0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
dst->tv_sec=(LONG)(tmp/data->reference);
|
||||
|
||||
dst->tv_usec=(LONG)((tmp-dst->tv_sec*data->reference)*1000000/data->reference);
|
||||
|
||||
dst->tv_sec+=data->start[0].tv_sec;
|
||||
|
||||
dst->tv_usec+=data->start[0].tv_usec;
|
||||
|
||||
if (dst->tv_usec>=1000000)
|
||||
{
|
||||
dst->tv_sec++;
|
||||
dst->tv_usec-=1000000;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
#endif //_X86_
|
||||
|
||||
__inline void GetTimeQST(struct timeval *dst, struct time_conv *data)
|
||||
{
|
||||
LARGE_INTEGER SystemTime;
|
||||
|
||||
KeQuerySystemTime(&SystemTime);
|
||||
|
||||
dst->tv_sec = (LONG)(SystemTime.QuadPart/10000000-11644473600);
|
||||
dst->tv_usec = (LONG)((SystemTime.QuadPart%10000000)/10);
|
||||
|
||||
}
|
||||
|
||||
#pragma optimize ("g",on) //Due to some weird behaviour of the optimizer of DDK build 2600
|
||||
|
||||
|
||||
__inline void GET_TIME(struct timeval *dst, struct time_conv *data)
|
||||
{
|
||||
|
||||
//
|
||||
// This timestamp mode is supported on x86 (32 bit) only
|
||||
//
|
||||
#ifdef _X86_
|
||||
if ( TimestampMode == TIMESTAMPMODE_RDTSC )
|
||||
{
|
||||
GetTimeRDTSC(dst,data);
|
||||
}
|
||||
else
|
||||
#endif // _X86_
|
||||
if ( TimestampMode == TIMESTAMPMODE_QUERYSYSTEMTIME )
|
||||
{
|
||||
GetTimeQST(dst,data);
|
||||
}
|
||||
else
|
||||
{
|
||||
GetTimeKQPC(dst,data);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#else /*WIN_NT_DRIVER*/
|
||||
|
||||
__inline void FORCE_TIME(struct timeval *src, struct time_conv *dest)
|
||||
{
|
||||
dest->start[0]=*src;
|
||||
}
|
||||
|
||||
__inline void GET_TIME(struct timeval *dst, struct time_conv *data)
|
||||
{
|
||||
*dst=data->start[0];
|
||||
}
|
||||
|
||||
#endif /*WIN_NT_DRIVER*/
|
||||
|
||||
|
||||
#endif /*_time_calls*/
|
||||
|
|
@ -0,0 +1,176 @@
|
|||
/*
|
||||
* Copyright (c) 2001 - 2003
|
||||
* NetGroup, Politecnico di Torino (Italy)
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the Politecnico di Torino nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __tme_include_
|
||||
#define __tme_include_
|
||||
|
||||
#ifdef WIN_NT_DRIVER
|
||||
#include "ndis.h"
|
||||
#else
|
||||
#include <windows.h>
|
||||
#endif /*WIN_NT_DRIVER*/
|
||||
|
||||
#include "memory_t.h"
|
||||
#include "time_calls.h"
|
||||
|
||||
|
||||
/* error codes */
|
||||
#define TME_ERROR 0
|
||||
#define TME_SUCCESS 1
|
||||
#define TME_TRUE 2
|
||||
#define TME_FALSE 3
|
||||
|
||||
/* some constants */
|
||||
#define DEFAULT_MEM_EX_SIZE 65536
|
||||
#define MAX_TME_DATA_BLOCKS 4
|
||||
#define TME_NONE_ACTIVE 0xffffffff
|
||||
#define DELTA_READ 2 /* secs */
|
||||
|
||||
#define TME_LUT_ENTRIES 0x00000000
|
||||
#define TME_MAX_FILL_STATE 0x00000001 /*potrebbe servire per un thread a passive level!?!?! */
|
||||
#define TME_REHASHING_VALUE 0x00000002
|
||||
#define TME_KEY_LEN 0x00000003
|
||||
#define TME_SHARED_MEMORY_BLOCKS 0x00000004
|
||||
#define TME_FILLED_ENTRIES 0x00000005
|
||||
#define TME_BLOCK_SIZE 0x00000006
|
||||
#define TME_EXTRA_SEGMENT_SIZE 0x00000007
|
||||
#define TME_LOOKUP_CODE 0x00000008
|
||||
#define TME_OUT_LUT_EXEC 0x00000009
|
||||
#define TME_FILLED_BLOCKS 0x0000000a
|
||||
#define TME_DEFAULT_EXEC 0x0000000b
|
||||
#define TME_LUT_BASE_ADDRESS 0x0000000c
|
||||
#define TME_SHARED_MEMORY_BASE_ADDRESS 0x0000000d
|
||||
#define TME_EXTRA_SEGMENT_BASE_ADDRESS 0x0000000e
|
||||
#define TME_LAST_FOUND 0x0000000f /* contains the offset of the last found entry */
|
||||
#define TME_LAST_FOUND_BLOCK 0x00000010
|
||||
/* TME default values */
|
||||
#define TME_LUT_ENTRIES_DEFAULT 32007
|
||||
#define TME_REHASHING_VALUE_DEFAULT 1
|
||||
#define TME_SHARED_MEMORY_BLOCKS_DEFAULT 16000
|
||||
#define TME_BLOCK_SIZE_DEFAULT 64
|
||||
#define TME_EXTRA_SEGMENT_SIZE_DEFAULT 0
|
||||
#define TME_LOOKUP_CODE_DEFAULT 0
|
||||
#define TME_OUT_LUT_EXEC_DEFAULT 0
|
||||
#define TME_DEFAULT_EXEC_DEFAULT 0
|
||||
#define TME_MAX_FILL_STATE_DEFAULT 15000
|
||||
|
||||
#define IS_VALIDATED(src,index) (src&(1<<index))
|
||||
|
||||
#define VALIDATE(src,index) src|=(1<<index);
|
||||
|
||||
|
||||
#define FORCE_NO_DELETION(timestamp) (struct timeval*)(timestamp)->tv_sec=0x7fffffff;
|
||||
|
||||
struct __TME_DATA;
|
||||
|
||||
/* TME callback prototypes */
|
||||
typedef uint32 (*lut_fcn)(uint8 *key, struct __TME_DATA *data,MEM_TYPE *mem_ex, struct time_conv *time_ref );
|
||||
typedef uint32 (*exec_fcn)(uint8 *block, uint32 pkt_size, struct __TME_DATA *data, MEM_TYPE *mem_ex, uint8 *mem_data);
|
||||
|
||||
/* DO NOT MODIFY THIS STRUCTURE!!!! GV */
|
||||
typedef struct __RECORD
|
||||
|
||||
{
|
||||
uint32 block;
|
||||
uint32 exec_fcn;
|
||||
}
|
||||
RECORD, *PRECORD;
|
||||
|
||||
/* TME data registers */
|
||||
struct __TME_DATA
|
||||
{
|
||||
uint32 lut_entries;
|
||||
uint32 max_fill_state;
|
||||
uint32 rehashing_value;
|
||||
uint32 key_len;
|
||||
uint32 shared_memory_blocks;
|
||||
uint32 filled_entries;
|
||||
uint32 block_size;
|
||||
uint32 extra_segment_size;
|
||||
uint32 filled_blocks;
|
||||
lut_fcn lookup_code;
|
||||
uint32 default_exec;
|
||||
uint32 out_lut_exec;
|
||||
uint8 *lut_base_address;
|
||||
uint8 *shared_memory_base_address;
|
||||
uint8 *extra_segment_base_address;
|
||||
struct timeval last_read;
|
||||
uint32 enable_deletion;
|
||||
uint8 *last_found;
|
||||
};
|
||||
|
||||
typedef struct __TME_DATA TME_DATA,*PTME_DATA;
|
||||
|
||||
|
||||
|
||||
/* TME core */
|
||||
typedef struct __TME_CORE
|
||||
{
|
||||
uint32 working;
|
||||
uint32 active;
|
||||
uint32 validated_blocks;
|
||||
TME_DATA block_data[MAX_TME_DATA_BLOCKS];
|
||||
uint32 active_read;
|
||||
|
||||
} TME_CORE, *PTME_CORE;
|
||||
|
||||
static __inline int32 IS_DELETABLE(void *timestamp, TME_DATA *data)
|
||||
{
|
||||
struct timeval *ts=(struct timeval*)timestamp;
|
||||
|
||||
if (data->enable_deletion==FALSE)
|
||||
return FALSE;
|
||||
if (data->filled_entries<data->max_fill_state)
|
||||
return FALSE;
|
||||
if ((ts->tv_sec+DELTA_READ)<data->last_read.tv_sec)
|
||||
return TRUE;
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/* functions to manage TME */
|
||||
uint32 init_tme_block(TME_CORE *tme, uint32 block);
|
||||
uint32 validate_tme_block(MEM_TYPE *mem_ex, TME_CORE *tme, uint32 block, uint32 mem_ex_offset);
|
||||
uint32 lookup_frontend(MEM_TYPE *mem_ex, TME_CORE *tme,uint32 mem_ex_offset, struct time_conv *time_ref);
|
||||
uint32 execute_frontend(MEM_TYPE *mem_ex, TME_CORE *tme, uint32 pkt_size,uint32 offset);
|
||||
uint32 set_active_tme_block(TME_CORE *tme, uint32 block);
|
||||
uint32 init_extended_memory(uint32 size, MEM_TYPE *mem_ex);
|
||||
uint32 reset_tme(TME_CORE *tme);
|
||||
uint32 get_tme_block_register(TME_DATA *data,MEM_TYPE *mem_ex,uint32 rgstr,uint32 *rval);
|
||||
uint32 set_tme_block_register(TME_DATA *data,MEM_TYPE *mem_ex,uint32 rgstr,uint32 value, int32 init);
|
||||
uint32 set_active_read_tme_block(TME_CORE *tme, uint32 block);
|
||||
uint32 set_autodeletion(TME_DATA *data, uint32 value);
|
||||
|
||||
/* function mappers */
|
||||
lut_fcn lut_fcn_mapper(uint32 index);
|
||||
exec_fcn exec_fcn_mapper(uint32 index);
|
||||
|
||||
#endif
|
||||
Binary file not shown.
Loading…
Reference in New Issue