2013-01-08 22:40:58 +08:00
/*
* Copyright ( c ) 1999 - 2005 NetGroup , Politecnico di Torino ( Italy )
* Copyright ( c ) 2005 - 2007 CACE Technologies , Davis ( California )
* All rights reserved .
*
* Redistribution and use in source and binary forms , with or without
* modification , are permitted provided that the following conditions
* are met :
*
* 1. Redistributions of source code must retain the above copyright
* notice , this list of conditions and the following disclaimer .
* 2. Redistributions in binary form must reproduce the above copyright
* notice , this list of conditions and the following disclaimer in the
* documentation and / or other materials provided with the distribution .
2021-03-20 22:39:00 +08:00
* 3. Neither the name of the Politecnico di Torino , CACE Technologies
* nor the names of its contributors may be used to endorse or promote
* products derived from this software without specific prior written
2013-01-08 22:40:58 +08:00
* permission .
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* " AS IS " AND ANY EXPRESS OR IMPLIED WARRANTIES , INCLUDING , BUT NOT
* LIMITED TO , THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED . IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT , INDIRECT , INCIDENTAL ,
* SPECIAL , EXEMPLARY , OR CONSEQUENTIAL DAMAGES ( INCLUDING , BUT NOT
* LIMITED TO , PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES ; LOSS OF USE ,
* DATA , OR PROFITS ; OR BUSINESS INTERRUPTION ) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY , WHETHER IN CONTRACT , STRICT LIABILITY , OR TORT
* ( INCLUDING NEGLIGENCE OR OTHERWISE ) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE , EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE .
*
*/
/** @ingroup packetapi
2021-03-20 22:39:00 +08:00
* @ {
2013-01-08 22:40:58 +08:00
*/
/** @defgroup packet32h Packet.dll definitions and data structures
* Packet32 . h contains the data structures and the definitions used by packet . dll .
* The file is used both by the Win9x and the WinNTx versions of packet . dll , and can be included
* by the applications that use the functions of this library
* @ {
*/
# ifndef __PACKET32
# define __PACKET32
# include <winsock2.h>
# ifdef HAVE_AIRPCAP_API
# include <airpcap.h>
# else
# if !defined(AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_)
# define AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_
typedef struct _AirpcapHandle * PAirpcapHandle ;
# endif /* AIRPCAP_HANDLE__EAE405F5_0171_9592_B3C2_C19EC426AD34__DEFINED_ */
# endif /* HAVE_AIRPCAP_API */
# ifdef HAVE_DAG_API
# include <dagc.h>
# endif /* HAVE_DAG_API */
// Working modes
# define PACKET_MODE_CAPT 0x0 ///< Capture mode
# define PACKET_MODE_STAT 0x1 ///< Statistical mode
# define PACKET_MODE_MON 0x2 ///< Monitoring mode
# define PACKET_MODE_DUMP 0x10 ///< Dump mode
# define PACKET_MODE_STAT_DUMP MODE_DUMP | MODE_STAT ///< Statistical dump Mode
/// Alignment macro. Defines the alignment size.
# define Packet_ALIGNMENT sizeof(int)
2021-03-20 22:39:00 +08:00
/// Alignment macro. Rounds up to the next even multiple of Packet_ALIGNMENT.
2013-01-08 22:40:58 +08:00
# define Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1))
2021-03-20 22:39:00 +08:00
# define NdisMediumNull -1 ///< Custom linktype: NDIS doesn't provide an equivalent
# define NdisMediumCHDLC -2 ///< Custom linktype: NDIS doesn't provide an equivalent
# define NdisMediumPPPSerial -3 ///< Custom linktype: NDIS doesn't provide an equivalent
# define NdisMediumBare80211 -4 ///< Custom linktype: NDIS doesn't provide an equivalent
# define NdisMediumRadio80211 -5 ///< Custom linktype: NDIS doesn't provide an equivalent
# define NdisMediumPpi -6 ///< Custom linktype: NDIS doesn't provide an equivalent
2013-01-08 22:40:58 +08:00
// Loopback behaviour definitions
2021-03-20 22:39:00 +08:00
# define NPF_DISABLE_LOOPBACK 1 ///< Drop the packets sent by the NPF driver
# define NPF_ENABLE_LOOPBACK 2 ///< Capture the packets sent by the NPF driver
2013-01-08 22:40:58 +08:00
/*!
\ brief Network type structure .
This structure is used by the PacketGetNetType ( ) function to return information on the current adapter ' s type and speed .
*/
typedef struct NetType
{
2021-03-20 22:39:00 +08:00
UINT LinkType ; ///< The MAC of the current network adapter (see function PacketGetNetType() for more information)
ULONGLONG LinkSpeed ; ///< The speed of the network in bits per second
2013-01-08 22:40:58 +08:00
} NetType ;
//some definitions stolen from libpcap
# ifndef BPF_MAJOR_VERSION
/*!
\ brief A BPF pseudo - assembly program .
2021-03-20 22:39:00 +08:00
The program will be injected in the kernel by the PacketSetBPF ( ) function and applied to every incoming packet .
2013-01-08 22:40:58 +08:00
*/
2021-03-20 22:39:00 +08:00
struct bpf_program
2013-01-08 22:40:58 +08:00
{
2021-03-20 22:39:00 +08:00
UINT bf_len ; ///< Indicates the number of instructions of the program, i.e. the number of struct bpf_insn that will follow.
struct bpf_insn * bf_insns ; ///< A pointer to the first instruction of the program.
2013-01-08 22:40:58 +08:00
} ;
/*!
\ brief A single BPF pseudo - instruction .
bpf_insn contains a single instruction for the BPF register - machine . It is used to send a filter program to the driver .
*/
2021-03-20 22:39:00 +08:00
struct bpf_insn
2013-01-08 22:40:58 +08:00
{
2021-03-20 22:39:00 +08:00
USHORT code ; ///< Instruction type and addressing mode.
UCHAR jt ; ///< Jump if true
UCHAR jf ; ///< Jump if false
int k ; ///< Generic field used for various purposes.
2013-01-08 22:40:58 +08:00
} ;
/*!
\ brief Structure that contains a couple of statistics values on the current capture .
It is used by packet . dll to return statistics about a capture session .
*/
2021-03-20 22:39:00 +08:00
struct bpf_stat
2013-01-08 22:40:58 +08:00
{
2021-03-20 22:39:00 +08:00
UINT bs_recv ; ///< Number of packets that the driver received from the network adapter
///< from the beginning of the current capture. This value includes the packets
///< lost by the driver.
UINT bs_drop ; ///< number of packets that the driver lost from the beginning of a capture.
///< Basically, a packet is lost when the the buffer of the driver is full.
///< In this situation the packet cannot be stored and the driver rejects it.
UINT ps_ifdrop ; ///< drops by interface. XXX not yet supported
UINT bs_capt ; ///< number of packets that pass the filter, find place in the kernel buffer and
///< thus reach the application.
2013-01-08 22:40:58 +08:00
} ;
/*!
\ brief Packet header .
This structure defines the header associated with every packet delivered to the application .
*/
2021-03-20 22:39:00 +08:00
struct bpf_hdr
2013-01-08 22:40:58 +08:00
{
2021-03-20 22:39:00 +08:00
struct timeval bh_tstamp ; ///< The timestamp associated with the captured packet.
///< It is stored in a TimeVal structure.
UINT bh_caplen ; ///< Length of captured portion. The captured portion <b>can be different</b>
///< from the original packet, because it is possible (with a proper filter)
///< to instruct the driver to capture only a portion of the packets.
UINT bh_datalen ; ///< Original length of packet
USHORT bh_hdrlen ; ///< Length of bpf header (this struct plus alignment padding). In some cases,
///< a padding could be added between the end of this structure and the packet
///< data for performance reasons. This filed can be used to retrieve the actual data
///< of the packet.
2013-01-08 22:40:58 +08:00
} ;
/*!
\ brief Dump packet header .
This structure defines the header associated with the packets in a buffer to be used with PacketSendPackets ( ) .
It is simpler than the bpf_hdr , because it corresponds to the header associated by WinPcap and libpcap to a
packet in a dump file . This makes straightforward sending WinPcap dump files to the network .
*/
struct dump_bpf_hdr {
2021-03-20 22:39:00 +08:00
struct timeval ts ; ///< Time stamp of the packet
UINT caplen ; ///< Length of captured portion. The captured portion can smaller than the
///< the original packet, because it is possible (with a proper filter) to
///< instruct the driver to capture only a portion of the packets.
UINT len ; ///< Length of the original packet (off wire).
2013-01-08 22:40:58 +08:00
} ;
# endif
struct bpf_stat ;
2021-03-20 22:39:00 +08:00
# define DOSNAMEPREFIX TEXT("Packet_") ///< Prefix added to the adapters device names to create the WinPcap devices
# define MAX_LINK_NAME_LENGTH 64 //< Maximum length of the devices symbolic links
2013-01-08 22:40:58 +08:00
# define NMAX_PACKET 65535
/*!
\ brief Addresses of a network adapter .
2021-03-20 22:39:00 +08:00
This structure is used by the PacketGetNetInfoEx ( ) function to return the IP addresses associated with
2013-01-08 22:40:58 +08:00
an adapter .
*/
typedef struct npf_if_addr {
2021-03-20 22:39:00 +08:00
struct sockaddr_storage IPAddress ; ///< IP address.
struct sockaddr_storage SubnetMask ; ///< Netmask for that address.
struct sockaddr_storage Broadcast ; ///< Broadcast address.
2013-01-08 22:40:58 +08:00
} npf_if_addr ;
2021-03-20 22:39:00 +08:00
# define ADAPTER_NAME_LENGTH 256 + 12 ///< Maximum length for the name of an adapter. The value is the same used by the IP Helper API.
# define ADAPTER_DESC_LENGTH 128 ///< Maximum length for the description of an adapter. The value is the same used by the IP Helper API.
# define MAX_MAC_ADDR_LENGTH 8 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.
# define MAX_NETWORK_ADDRESSES 16 ///< Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.
2013-01-08 22:40:58 +08:00
typedef struct WAN_ADAPTER_INT WAN_ADAPTER ; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API
typedef WAN_ADAPTER * PWAN_ADAPTER ; ///< Describes an opened wan (dialup, VPN...) network adapter using the NetMon API
2021-03-20 22:39:00 +08:00
# define INFO_FLAG_NDIS_ADAPTER 0 ///< Flag for ADAPTER_INFO: this is a traditional ndis adapter
# define INFO_FLAG_NDISWAN_ADAPTER 1 ///< Flag for ADAPTER_INFO: this is a NdisWan adapter, and it's managed by WANPACKET
# define INFO_FLAG_DAG_CARD 2 ///< Flag for ADAPTER_INFO: this is a DAG card
# define INFO_FLAG_DAG_FILE 6 ///< Flag for ADAPTER_INFO: this is a DAG file
# define INFO_FLAG_DONT_EXPORT 8 ///< Flag for ADAPTER_INFO: when this flag is set, the adapter will not be listed or openend by winpcap. This allows to prevent exporting broken network adapters, like for example FireWire ones.
# define INFO_FLAG_AIRPCAP_CARD 16 ///< Flag for ADAPTER_INFO: this is an airpcap card
# define INFO_FLAG_NPFIM_DEVICE 32
2013-01-08 22:40:58 +08:00
/*!
\ brief Describes an opened network adapter .
This structure is the most important for the functioning of packet . dll , but the great part of its fields
should be ignored by the user , since the library offers functions that avoid to cope with low - level parameters
*/
2021-03-20 22:39:00 +08:00
typedef struct _ADAPTER {
HANDLE hFile ; ///< \internal Handle to an open instance of the NPF driver.
CHAR SymbolicLink [ MAX_LINK_NAME_LENGTH ] ; ///< \internal A string containing the name of the network adapter currently opened.
int NumWrites ; ///< \internal Number of times a packets written on this adapter will be repeated
///< on the wire.
HANDLE ReadEvent ; ///< A notification event associated with the read calls on the adapter.
///< It can be passed to standard Win32 functions (like WaitForSingleObject
///< or WaitForMultipleObjects) to wait until the driver's buffer contains some
///< data. It is particularly useful in GUI applications that need to wait
///< concurrently on several events. In Windows NT/2000 the PacketSetMinToCopy()
///< function can be used to define the minimum amount of data in the kernel buffer
///< that will cause the event to be signalled.
UINT ReadTimeOut ; ///< \internal The amount of time after which a read on the driver will be released and
///< ReadEvent will be signaled, also if no packets were captured
CHAR Name [ ADAPTER_NAME_LENGTH ] ;
PWAN_ADAPTER pWanAdapter ;
UINT Flags ; ///< Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API.
2013-01-08 22:40:58 +08:00
# ifdef HAVE_AIRPCAP_API
2021-03-20 22:39:00 +08:00
PAirpcapHandle AirpcapAd ;
2013-01-08 22:40:58 +08:00
# endif // HAVE_AIRPCAP_API
# ifdef HAVE_NPFIM_API
2021-03-20 22:39:00 +08:00
void * NpfImHandle ;
2013-01-08 22:40:58 +08:00
# endif // HAVE_NPFIM_API
# ifdef HAVE_DAG_API
2021-03-20 22:39:00 +08:00
dagc_t * pDagCard ; ///< Pointer to the dagc API adapter descriptor for this adapter
PCHAR DagBuffer ; ///< Pointer to the buffer with the packets that is received from the DAG card
struct timeval DagReadTimeout ; ///< Read timeout. The dagc API requires a timeval structure
unsigned DagFcsLen ; ///< Length of the frame check sequence attached to any packet by the card. Obtained from the registry
DWORD DagFastProcess ; ///< True if the user requests fast capture processing on this card. Higher level applications can use this value to provide a faster but possibly unprecise capture (for example, libpcap doesn't convert the timestamps).
2013-01-08 22:40:58 +08:00
# endif // HAVE_DAG_API
} ADAPTER , * LPADAPTER ;
/*!
\ brief Structure that contains a group of packets coming from the driver .
This structure defines the header associated with every packet delivered to the application .
*/
2021-03-20 22:39:00 +08:00
typedef struct _PACKET {
HANDLE hEvent ; ///< \deprecated Still present for compatibility with old applications.
OVERLAPPED OverLapped ; ///< \deprecated Still present for compatibility with old applications.
PVOID Buffer ; ///< Buffer with containing the packets. See the PacketReceivePacket() for
///< details about the organization of the data in this buffer
UINT Length ; ///< Length of the buffer
DWORD ulBytesReceived ; ///< Number of valid bytes present in the buffer, i.e. amount of data
///< received by the last call to PacketReceivePacket()
BOOLEAN bIoComplete ; ///< \deprecated Still present for compatibility with old applications.
2013-01-08 22:40:58 +08:00
} PACKET , * LPPACKET ;
/*!
\ brief Structure containing an OID request .
2021-03-20 22:39:00 +08:00
It is used by the PacketRequest ( ) function to send an OID to the interface card driver .
It can be used , for example , to retrieve the status of the error counters on the adapter , its MAC address ,
2013-01-08 22:40:58 +08:00
the list of the multicast groups defined on it , and so on .
*/
struct _PACKET_OID_DATA {
2021-03-20 22:39:00 +08:00
ULONG Oid ; ///< OID code. See the Microsoft DDK documentation or the file ntddndis.h
///< for a complete list of valid codes.
ULONG Length ; ///< Length of the data field
UCHAR Data [ 1 ] ; ///< variable-lenght field that contains the information passed to or received
///< from the adapter.
} ;
2013-01-08 22:40:58 +08:00
typedef struct _PACKET_OID_DATA PACKET_OID_DATA , * PPACKET_OID_DATA ;
# ifdef __cplusplus
extern " C " {
# endif
/**
* @ }
*/
/*
BOOLEAN QueryWinPcapRegistryStringA ( CHAR * SubKeyName ,
2021-03-20 22:39:00 +08:00
CHAR * Value ,
UINT * pValueLen ,
CHAR * DefaultVal ) ;
2013-01-08 22:40:58 +08:00
BOOLEAN QueryWinPcapRegistryStringW ( WCHAR * SubKeyName ,
2021-03-20 22:39:00 +08:00
WCHAR * Value ,
UINT * pValueLen ,
WCHAR * DefaultVal ) ;
2013-01-08 22:40:58 +08:00
*/
2021-03-20 22:39:00 +08:00
2013-01-08 22:40:58 +08:00
//---------------------------------------------------------------------------
// EXPORTED FUNCTIONS
//---------------------------------------------------------------------------
PCHAR PacketGetVersion ( ) ;
PCHAR PacketGetDriverVersion ( ) ;
BOOLEAN PacketSetMinToCopy ( LPADAPTER AdapterObject , int nbytes ) ;
BOOLEAN PacketSetNumWrites ( LPADAPTER AdapterObject , int nwrites ) ;
BOOLEAN PacketSetMode ( LPADAPTER AdapterObject , int mode ) ;
BOOLEAN PacketSetReadTimeout ( LPADAPTER AdapterObject , int timeout ) ;
BOOLEAN PacketSetBpf ( LPADAPTER AdapterObject , struct bpf_program * fp ) ;
BOOLEAN PacketSetLoopbackBehavior ( LPADAPTER AdapterObject , UINT LoopbackBehavior ) ;
INT PacketSetSnapLen ( LPADAPTER AdapterObject , int snaplen ) ;
BOOLEAN PacketGetStats ( LPADAPTER AdapterObject , struct bpf_stat * s ) ;
BOOLEAN PacketGetStatsEx ( LPADAPTER AdapterObject , struct bpf_stat * s ) ;
BOOLEAN PacketSetBuff ( LPADAPTER AdapterObject , int dim ) ;
BOOLEAN PacketGetNetType ( LPADAPTER AdapterObject , NetType * type ) ;
LPADAPTER PacketOpenAdapter ( PCHAR AdapterName ) ;
BOOLEAN PacketSendPacket ( LPADAPTER AdapterObject , LPPACKET pPacket , BOOLEAN Sync ) ;
INT PacketSendPackets ( LPADAPTER AdapterObject , PVOID PacketBuff , ULONG Size , BOOLEAN Sync ) ;
LPPACKET PacketAllocatePacket ( void ) ;
VOID PacketInitPacket ( LPPACKET lpPacket , PVOID Buffer , UINT Length ) ;
VOID PacketFreePacket ( LPPACKET lpPacket ) ;
BOOLEAN PacketReceivePacket ( LPADAPTER AdapterObject , LPPACKET lpPacket , BOOLEAN Sync ) ;
BOOLEAN PacketSetHwFilter ( LPADAPTER AdapterObject , ULONG Filter ) ;
BOOLEAN PacketGetAdapterNames ( PTSTR pStr , PULONG BufferSize ) ;
BOOLEAN PacketGetNetInfoEx ( PCHAR AdapterName , npf_if_addr * buffer , PLONG NEntries ) ;
BOOLEAN PacketRequest ( LPADAPTER AdapterObject , BOOLEAN Set , PPACKET_OID_DATA OidData ) ;
HANDLE PacketGetReadEvent ( LPADAPTER AdapterObject ) ;
BOOLEAN PacketSetDumpName ( LPADAPTER AdapterObject , void * name , int len ) ;
BOOLEAN PacketSetDumpLimits ( LPADAPTER AdapterObject , UINT maxfilesize , UINT maxnpacks ) ;
BOOLEAN PacketIsDumpEnded ( LPADAPTER AdapterObject , BOOLEAN sync ) ;
BOOL PacketStopDriver ( ) ;
VOID PacketCloseAdapter ( LPADAPTER lpAdapter ) ;
BOOLEAN PacketStartOem ( PCHAR errorString , UINT errorStringLength ) ;
BOOLEAN PacketStartOemEx ( PCHAR errorString , UINT errorStringLength , ULONG flags ) ;
PAirpcapHandle PacketGetAirPcapHandle ( LPADAPTER AdapterObject ) ;
//
// Used by PacketStartOemEx
//
2021-03-20 22:39:00 +08:00
# define PACKET_START_OEM_NO_NETMON 0x00000001
2013-01-08 22:40:58 +08:00
# ifdef __cplusplus
}
2021-03-20 22:39:00 +08:00
# endif
2013-01-08 22:40:58 +08:00
# endif //__PACKET32