| /* | |
| * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy) | |
| * Copyright (c) 2005 - 2007 CACE Technologies, Davis (California) | |
| * All rights reserved. | |
| * | |
| * Redistribution and use in source and binary forms, with or without | |
| * modification, are permitted provided that the following conditions | |
| * are met: | |
| * | |
| * 1. Redistributions of source code must retain the above copyright | |
| * notice, this list of conditions and the following disclaimer. | |
| * 2. Redistributions in binary form must reproduce the above copyright | |
| * notice, this list of conditions and the following disclaimer in the | |
| * documentation and/or other materials provided with the distribution. | |
| * 3. Neither the name of the Politecnico di Torino, CACE Technologies | |
| * nor the names of its contributors may be used to endorse or promote | |
| * products derived from this software without specific prior written | |
| * permission. | |
| * | |
| * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
| * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
| * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
| * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
| * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
| * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
| * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
| * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
| * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
| * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| * | |
| */ | |
| /** @ingroup packetapi | |
| * @{ | |
| */ | |
| /** @defgroup packet32h Packet.dll definitions and data structures | |
| * Packet32.h contains the data structures and the definitions used by packet.dll. | |
| * The file is used both by the Win9x and the WinNTx versions of packet.dll, and can be included | |
| * by the applications that use the functions of this library | |
| * @{ | |
| */ | |
| #ifndef __PACKET32 | |
| #define __PACKET32 | |
| #include <winsock2.h> | |
| #ifdef HAVE_AIRPCAP_API | |
| #include <airpcap.h> | |
| #else | |
| #if !defined(AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_) | |
| #define AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_ | |
| typedef struct _AirpcapHandle *PAirpcapHandle; | |
| #endif /* AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_ */ | |
| #endif /* HAVE_AIRPCAP_API */ | |
| #ifdef HAVE_DAG_API | |
| #include <dagc.h> | |
| #endif /* HAVE_DAG_API */ | |
| // Working modes | |
| #define PACKET_MODE_CAPT 0x0 ///< Capture mode | |
| #define PACKET_MODE_STAT 0x1 ///< Statistical mode | |
| #define PACKET_MODE_MON 0x2 ///< Monitoring mode | |
| #define PACKET_MODE_DUMP 0x10 ///< Dump mode | |
| #define PACKET_MODE_STAT_DUMP MODE_DUMP | MODE_STAT ///< Statistical dump Mode | |
| /// Alignment macro. Defines the alignment size. | |
| #define Packet_ALIGNMENT sizeof(int) | |
| /// Alignment macro. Rounds up to the next even multiple of Packet_ALIGNMENT. | |
| #define Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1)) | |
| #define NdisMediumNull -1 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| #define NdisMediumCHDLC -2 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| #define NdisMediumPPPSerial -3 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| #define NdisMediumBare80211 -4 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| #define NdisMediumRadio80211 -5 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| #define NdisMediumPpi -6 ///< Custom linktype: NDIS doesn't provide an equivalent | |
| // Loopback behaviour definitions | |
| #define NPF_DISABLE_LOOPBACK 1 ///< Drop the packets sent by the NPF driver | |
| #define NPF_ENABLE_LOOPBACK 2 ///< Capture the packets sent by the NPF driver | |
| /*! | |
| \brief Network type structure. | |
| This structure is used by the PacketGetNetType() function to return information on the current adapter's type and speed. | |
| */ | |
| typedef struct NetType | |
| { | |
| UINT LinkType; ///< The MAC of the current network adapter (see function PacketGetNetType() for more information) | |
| ULONGLONG LinkSpeed; ///< The speed of the network in bits per second | |
| }NetType; | |
| //some definitions stolen from libpcap | |
| #ifndef BPF_MAJOR_VERSION | |
| /*! | |
| \brief A BPF pseudo-assembly program. | |
| The program will be injected in the kernel by the PacketSetBPF() function and applied to every incoming packet. | |
| */ | |
| struct bpf_program | |
| { | |
| UINT bf_len; ///< Indicates the number of instructions of the program, i.e. the number of struct bpf_insn that will follow. | |
| struct bpf_insn *bf_insns; ///< A pointer to the first instruction of the program. | |
| }; | |
| /*! | |
| \brief A single BPF pseudo-instruction. | |
| bpf_insn contains a single instruction for the BPF register-machine. It is used to send a filter program to the driver. | |
| */ | |
| struct bpf_insn | |
| { | |
| USHORT code; ///< Instruction type and addressing mode. | |
| UCHAR jt; ///< Jump if true | |
| UCHAR jf; ///< Jump if false | |
| int k; ///< Generic field used for various purposes. | |
| }; | |
| /*! | |
| \brief Structure that contains a couple of statistics values on the current capture. | |
| It is used by packet.dll to return statistics about a capture session. | |
| */ | |
| struct bpf_stat | |
| { | |
| UINT bs_recv; ///< Number of packets that the driver received from the network adapter | |
| ///< from the beginning of the current capture. This value includes the packets | |
| ///< lost by the driver. | |
| UINT bs_drop; ///< number of packets that the driver lost from the beginning of a capture. | |
| ///< Basically, a packet is lost when the the buffer of the driver is full. | |
| ///< In this situation the packet cannot be stored and the driver rejects it. | |
| UINT ps_ifdrop; ///< drops by interface. XXX not yet supported | |
| UINT bs_capt; ///< number of packets that pass the filter, find place in the kernel buffer and | |
| ///< thus reach the application. | |
| }; | |
| /*! | |
| \brief Packet header. | |
| This structure defines the header associated with every packet delivered to the application. | |
| */ | |
| struct bpf_hdr | |
| { | |
| struct timeval bh_tstamp; ///< The timestamp associated with the captured packet. | |
| ///< It is stored in a TimeVal structure. | |
| UINT bh_caplen; ///< Length of captured portion. The captured portion <b>can be different</b> | |
| ///< from the original packet, because it is possible (with a proper filter) | |
| ///< to instruct the driver to capture only a portion of the packets. | |
| UINT bh_datalen; ///< Original length of packet | |
| USHORT bh_hdrlen; ///< Length of bpf header (this struct plus alignment padding). In some cases, | |
| ///< a padding could be added between the end of this structure and the packet | |
| ///< data for performance reasons. This filed can be used to retrieve the actual data | |
| ///< of the packet. | |
| }; | |
| /*! | |
| \brief Dump packet header. | |
| This structure defines the header associated with the packets in a buffer to be used with PacketSendPackets(). | |
| It is simpler than the bpf_hdr, because it corresponds to the header associated by WinPcap and libpcap to a | |
| packet in a dump file. This makes straightforward sending WinPcap dump files to the network. | |
| */ | |
| struct dump_bpf_hdr{ | |
| struct timeval ts; ///< Time stamp of the packet | |
| UINT caplen; ///< Length of captured portion. The captured portion can smaller than the | |
| ///< the original packet, because it is possible (with a proper filter) to | |
| ///< instruct the driver to capture only a portion of the packets. | |
| UINT len; ///< Length of the original packet (off wire). | |
| }; | |
| #endif | |
| struct bpf_stat; | |
| #define DOSNAMEPREFIX TEXT("Packet_") ///< Prefix added to the adapters device names to create the WinPcap devices | |
| #define MAX_LINK_NAME_LENGTH 64 //< Maximum length of the devices symbolic links | |
| #define NMAX_PACKET 65535 | |
| /*! | |
| \brief Addresses of a network adapter. | |
| This structure is used by the PacketGetNetInfoEx() function to return the IP addresses associated with | |
| an adapter. | |
| */ | |
| typedef struct npf_if_addr { | |
| struct sockaddr_storage IPAddress; ///< IP address. | |
| struct sockaddr_storage SubnetMask; ///< Netmask for that address. | |
| struct sockaddr_storage Broadcast; ///< Broadcast address. | |
| }npf_if_addr; | |
| #define ADAPTER_NAME_LENGTH 256 + 12 ///< Maximum length for the name of an adapter. The value is the same used by the IP Helper API. | |
| #define ADAPTER_DESC_LENGTH 128 ///< Maximum length for the description of an adapter. The value is the same used by the IP Helper API. | |
| #define MAX_MAC_ADDR_LENGTH 8 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API. | |
| #define MAX_NETWORK_ADDRESSES 16 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API. | |
| typedef struct WAN_ADAPTER_INT WAN_ADAPTER; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API | |
| typedef WAN_ADAPTER *PWAN_ADAPTER; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API | |
| #define INFO_FLAG_NDIS_ADAPTER 0 ///< Flag for ADAPTER_INFO: this is a traditional ndis adapter | |
| #define INFO_FLAG_NDISWAN_ADAPTER 1 ///< Flag for ADAPTER_INFO: this is a NdisWan adapter, and it's managed by WANPACKET | |
| #define INFO_FLAG_DAG_CARD 2 ///< Flag for ADAPTER_INFO: this is a DAG card | |
| #define INFO_FLAG_DAG_FILE 6 ///< Flag for ADAPTER_INFO: this is a DAG file | |
| #define INFO_FLAG_DONT_EXPORT 8 ///< Flag for ADAPTER_INFO: when this flag is set, the adapter will not be listed or openend by winpcap. This allows to prevent exporting broken network adapters, like for example FireWire ones. | |
| #define INFO_FLAG_AIRPCAP_CARD 16 ///< Flag for ADAPTER_INFO: this is an airpcap card | |
| #define INFO_FLAG_NPFIM_DEVICE 32 | |
| /*! | |
| \brief Describes an opened network adapter. | |
| This structure is the most important for the functioning of packet.dll, but the great part of its fields | |
| should be ignored by the user, since the library offers functions that avoid to cope with low-level parameters | |
| */ | |
| typedef struct _ADAPTER { | |
| HANDLE hFile; ///< \internal Handle to an open instance of the NPF driver. | |
| CHAR SymbolicLink[MAX_LINK_NAME_LENGTH]; ///< \internal A string containing the name of the network adapter currently opened. | |
| int NumWrites; ///< \internal Number of times a packets written on this adapter will be repeated | |
| ///< on the wire. | |
| HANDLE ReadEvent; ///< A notification event associated with the read calls on the adapter. | |
| ///< It can be passed to standard Win32 functions (like WaitForSingleObject | |
| ///< or WaitForMultipleObjects) to wait until the driver's buffer contains some | |
| ///< data. It is particularly useful in GUI applications that need to wait | |
| ///< concurrently on several events. In Windows NT/2000 the PacketSetMinToCopy() | |
| ///< function can be used to define the minimum amount of data in the kernel buffer | |
| ///< that will cause the event to be signalled. | |
| UINT ReadTimeOut; ///< \internal The amount of time after which a read on the driver will be released and | |
| ///< ReadEvent will be signaled, also if no packets were captured | |
| CHAR Name[ADAPTER_NAME_LENGTH]; | |
| PWAN_ADAPTER pWanAdapter; | |
| UINT Flags; ///< Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API. | |
| #ifdef HAVE_AIRPCAP_API | |
| PAirpcapHandle AirpcapAd; | |
| #endif // HAVE_AIRPCAP_API | |
| #ifdef HAVE_NPFIM_API | |
| void* NpfImHandle; | |
| #endif // HAVE_NPFIM_API | |
| #ifdef HAVE_DAG_API | |
| dagc_t *pDagCard; ///< Pointer to the dagc API adapter descriptor for this adapter | |
| PCHAR DagBuffer; ///< Pointer to the buffer with the packets that is received from the DAG card | |
| struct timeval DagReadTimeout; ///< Read timeout. The dagc API requires a timeval structure | |
| unsigned DagFcsLen; ///< Length of the frame check sequence attached to any packet by the card. Obtained from the registry | |
| DWORD DagFastProcess; ///< True if the user requests fast capture processing on this card. Higher level applications can use this value to provide a faster but possibly unprecise capture (for example, libpcap doesn't convert the timestamps). | |
| #endif // HAVE_DAG_API | |
| } ADAPTER, *LPADAPTER; | |
| /*! | |
| \brief Structure that contains a group of packets coming from the driver. | |
| This structure defines the header associated with every packet delivered to the application. | |
| */ | |
| typedef struct _PACKET { | |
| HANDLE hEvent; ///< \deprecated Still present for compatibility with old applications. | |
| OVERLAPPED OverLapped; ///< \deprecated Still present for compatibility with old applications. | |
| PVOID Buffer; ///< Buffer with containing the packets. See the PacketReceivePacket() for | |
| ///< details about the organization of the data in this buffer | |
| UINT Length; ///< Length of the buffer | |
| DWORD ulBytesReceived; ///< Number of valid bytes present in the buffer, i.e. amount of data | |
| ///< received by the last call to PacketReceivePacket() | |
| BOOLEAN bIoComplete; ///< \deprecated Still present for compatibility with old applications. | |
| } PACKET, *LPPACKET; | |
| /*! | |
| \brief Structure containing an OID request. | |
| It is used by the PacketRequest() function to send an OID to the interface card driver. | |
| It can be used, for example, to retrieve the status of the error counters on the adapter, its MAC address, | |
| the list of the multicast groups defined on it, and so on. | |
| */ | |
| struct _PACKET_OID_DATA { | |
| ULONG Oid; ///< OID code. See the Microsoft DDK documentation or the file ntddndis.h | |
| ///< for a complete list of valid codes. | |
| ULONG Length; ///< Length of the data field | |
| UCHAR Data[1]; ///< variable-lenght field that contains the information passed to or received | |
| ///< from the adapter. | |
| }; | |
| typedef struct _PACKET_OID_DATA PACKET_OID_DATA, *PPACKET_OID_DATA; | |
| #ifdef __cplusplus | |
| extern "C" { | |
| #endif | |
| /** | |
| * @} | |
| */ | |
| /* | |
| BOOLEAN QueryWinPcapRegistryStringA(CHAR *SubKeyName, | |
| CHAR *Value, | |
| UINT *pValueLen, | |
| CHAR *DefaultVal); | |
| BOOLEAN QueryWinPcapRegistryStringW(WCHAR *SubKeyName, | |
| WCHAR *Value, | |
| UINT *pValueLen, | |
| WCHAR *DefaultVal); | |
| */ | |
| //--------------------------------------------------------------------------- | |
| // EXPORTED FUNCTIONS | |
| //--------------------------------------------------------------------------- | |
| PCHAR PacketGetVersion(); | |
| PCHAR PacketGetDriverVersion(); | |
| BOOLEAN PacketSetMinToCopy(LPADAPTER AdapterObject,int nbytes); | |
| BOOLEAN PacketSetNumWrites(LPADAPTER AdapterObject,int nwrites); | |
| BOOLEAN PacketSetMode(LPADAPTER AdapterObject,int mode); | |
| BOOLEAN PacketSetReadTimeout(LPADAPTER AdapterObject,int timeout); | |
| BOOLEAN PacketSetBpf(LPADAPTER AdapterObject,struct bpf_program *fp); | |
| BOOLEAN PacketSetLoopbackBehavior(LPADAPTER AdapterObject, UINT LoopbackBehavior); | |
| INT PacketSetSnapLen(LPADAPTER AdapterObject,int snaplen); | |
| BOOLEAN PacketGetStats(LPADAPTER AdapterObject,struct bpf_stat *s); | |
| BOOLEAN PacketGetStatsEx(LPADAPTER AdapterObject,struct bpf_stat *s); | |
| BOOLEAN PacketSetBuff(LPADAPTER AdapterObject,int dim); | |
| BOOLEAN PacketGetNetType (LPADAPTER AdapterObject,NetType *type); | |
| LPADAPTER PacketOpenAdapter(PCHAR AdapterName); | |
| BOOLEAN PacketSendPacket(LPADAPTER AdapterObject,LPPACKET pPacket,BOOLEAN Sync); | |
| INT PacketSendPackets(LPADAPTER AdapterObject,PVOID PacketBuff,ULONG Size, BOOLEAN Sync); | |
| LPPACKET PacketAllocatePacket(void); | |
| VOID PacketInitPacket(LPPACKET lpPacket,PVOID Buffer,UINT Length); | |
| VOID PacketFreePacket(LPPACKET lpPacket); | |
| BOOLEAN PacketReceivePacket(LPADAPTER AdapterObject,LPPACKET lpPacket,BOOLEAN Sync); | |
| BOOLEAN PacketSetHwFilter(LPADAPTER AdapterObject,ULONG Filter); | |
| BOOLEAN PacketGetAdapterNames(PTSTR pStr,PULONG BufferSize); | |
| BOOLEAN PacketGetNetInfoEx(PCHAR AdapterName, npf_if_addr* buffer, PLONG NEntries); | |
| BOOLEAN PacketRequest(LPADAPTER AdapterObject,BOOLEAN Set,PPACKET_OID_DATA OidData); | |
| HANDLE PacketGetReadEvent(LPADAPTER AdapterObject); | |
| BOOLEAN PacketSetDumpName(LPADAPTER AdapterObject, void *name, int len); | |
| BOOLEAN PacketSetDumpLimits(LPADAPTER AdapterObject, UINT maxfilesize, UINT maxnpacks); | |
| BOOLEAN PacketIsDumpEnded(LPADAPTER AdapterObject, BOOLEAN sync); | |
| BOOL PacketStopDriver(); | |
| VOID PacketCloseAdapter(LPADAPTER lpAdapter); | |
| BOOLEAN PacketStartOem(PCHAR errorString, UINT errorStringLength); | |
| BOOLEAN PacketStartOemEx(PCHAR errorString, UINT errorStringLength, ULONG flags); | |
| PAirpcapHandle PacketGetAirPcapHandle(LPADAPTER AdapterObject); | |
| // | |
| // Used by PacketStartOemEx | |
| // | |
| #define PACKET_START_OEM_NO_NETMON 0x00000001 | |
| #ifdef __cplusplus | |
| } | |
| #endif | |
| #endif //__PACKET32 |