The Tcpdump Group git mirrors - libpcap/blob - rpcap/rpcap-protocol.h

   1 /*
   2  * Copyright (c) 2002 - 2005 NetGroup, Politecnico di Torino (Italy)
   3  * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  * notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  * notice, this list of conditions and the following disclaimer in the
  14  * documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the Politecnico di Torino, CACE Technologies
  16  * nor the names of its contributors may be used to endorse or promote
  17  * products derived from this software without specific prior written
  18  * permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  23  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  24  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  26  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #ifndef __RPCAP_PROTOCOL_H__
  35 #define __RPCAP_PROTOCOL_H__
  36
  37 #define RPCAP_DEFAULT_NETPORT "2002" /* Default port on which the RPCAP daemon is waiting for connections. */
  38 /* Default port on which the client workstation is waiting for connections in case of active mode. */
  39 #define RPCAP_DEFAULT_NETPORT_ACTIVE "2003"
  40 #define RPCAP_DEFAULT_NETADDR ""        /* Default network address on which the RPCAP daemon binds to. */
  41 #define RPCAP_VERSION 0                 /* Present version of the RPCAP protocol (0 = Experimental). */
  42
  43 /*
  44  * Separators used for the host list.
  45  *
  46  * It is used:
  47  * - by the rpcapd daemon, when you types a list of allowed connecting hosts
  48  * - by the rpcap client in active mode, when the client waits for incoming
  49  * connections from other hosts
  50  */
  51 #define RPCAP_HOSTLIST_SEP " ,;\n\r"
  52
  53 /*********************************************************
  54  *                                                       *
  55  * Protocol messages formats                             *
  56  *                                                       *
  57  *********************************************************/
  58 /* WARNING Take care you compiler does not insert padding for better alignments into these structs */
  59
  60 /* WARNING: These might need to be changed on other platforms */
  61 typedef unsigned char uint8;    /* 8-bit unsigned integer */
  62 typedef unsigned short uint16;  /* 16-bit unsigned integer */
  63 typedef unsigned int uint32;    /* 32-bit unsigned integer */
  64 typedef int int32;              /* 32-bit signed integer */
  65
  66 /* Common header for all the RPCAP messages */
  67 struct rpcap_header
  68 {
  69         uint8 ver;      /* RPCAP version number */
  70         uint8 type;     /* RPCAP message type (error, findalldevs, ...) */
  71         uint16 value;   /* Message-dependent value (not always used) */
  72         uint32 plen;    /* Length of the payload of this RPCAP message */
  73 };
  74
  75 /* Format of the message for the interface description (findalldevs command) */
  76 struct rpcap_findalldevs_if
  77 {
  78         uint16 namelen; /* Length of the interface name */
  79         uint16 desclen; /* Length of the interface description */
  80         uint32 flags;   /* Interface flags */
  81         uint16 naddr;   /* Number of addresses */
  82         uint16 dummy;   /* Must be zero */
  83 };
  84
  85 /*
  86  * Format of an address as sent over the wire.
  87  *
  88  * Do *NOT* use struct sockaddr_storage, as the layout for that is
  89  * machine-dependent.
  90  *
  91  * RFC 2553 gives two sample layouts, both of which are 128 bytes long,
  92  * both of which are aligned on an 8-byte boundary, and both of which
  93  * have 2 bytes before the address data.
  94  *
  95  * However, one has a 2-byte address family value at the beginning
  96  * and the other has a 1-byte address length value and a 1-byte
  97  * address family value; this reflects the fact that the original
  98  * BSD sockaddr structure had a 2-byte address family value, which
  99  * was later changed to a 1-byte address length value and a 1-byte
 100  * address family value, when support for variable-length OSI
 101  * network-layer addresses was added.
 102  *
 103  * Furthermore, Solaris's struct sockaddr_storage is 256 bytes
 104  * long.
 105  *
 106  * This structure is supposed to be aligned on an 8-byte boundary;
 107  * the message header is 8 bytes long, so we don't have to do
 108  * anything to ensure it's aligned on that boundary within a packet,
 109  * so we just define it as 128 bytes long, with a 2-byte address
 110  * family.  (We only support IPv4 and IPv6 addresses, which are fixed-
 111  * length.)  That way, it's the same size as sockaddr_storage on
 112  * Windows, and it'll look like what an older Windows client will
 113  * expect.
 114  *
 115  * In addition, do *NOT* use the host's AF_ value for an address,
 116  * as the value for AF_INET6 is machine-dependent.  We use the
 117  * Windows value, so it'll look like what an older Windows client
 118  * will expect.
 119  *
 120  * (The Windows client is the only one that has been distributed
 121  * as a standard part of *pcap; UN*X clients are probably built
 122  * from source by the user or administrator, so they're in a
 123  * better position to upgrade an old client.  Therefore, we
 124  * try to make what goes over the wire look like what comes
 125  * from a Windows server.)
 126  */
 127 struct rpcap_sockaddr
 128 {
 129         uint16  family;                 /* Address family */
 130         char    data[128-2];            /* Data */
 131 };
 132
 133 /*
 134  * Format of an IPv4 address as sent over the wire.
 135  */
 136 #define RPCAP_AF_INET   2               /* Value on all OSes */
 137 struct rpcap_sockaddr_in
 138 {
 139         uint16  family;                 /* Address family */
 140         uint16  port;                   /* Port number */
 141         uint32  addr;                   /* IPv4 address */
 142         uint8   zero[8];                /* Padding */
 143 };
 144
 145 /*
 146  * Format of an IPv6 address as sent over the wire.
 147  */
 148 #define RPCAP_AF_INET6  23              /* Value on Windows */
 149 struct rpcap_sockaddr_in6
 150 {
 151         uint16  family;                 /* Address family */
 152         uint16  port;                   /* Port number */
 153         uint32  flowinfo;               /* IPv6 flow information */
 154         uint8   addr[16];               /* IPv6 address */
 155         uint32  scope_id;               /* Scope zone index */
 156 };
 157
 158 /* Format of the message for the address listing (findalldevs command) */
 159 struct rpcap_findalldevs_ifaddr
 160 {
 161         struct rpcap_sockaddr addr;             /* Network address */
 162         struct rpcap_sockaddr netmask;          /* Netmask for that address */
 163         struct rpcap_sockaddr broadaddr;        /* Broadcast address for that address */
 164         struct rpcap_sockaddr dstaddr;          /* P2P destination address for that address */
 165 };
 166
 167 /*
 168  * \brief Format of the message of the connection opening reply (open command).
 169  *
 170  * This structure transfers over the network some of the values useful on the client side.
 171  */
 172 struct rpcap_openreply
 173 {
 174         int32 linktype; /* Link type */
 175         int32 tzoff;    /* Timezone offset */
 176 };
 177
 178 /* Format of the message that starts a remote capture (startcap command) */
 179 struct rpcap_startcapreq
 180 {
 181         uint32 snaplen;         /* Length of the snapshot (number of bytes to capture for each packet) */
 182         uint32 read_timeout;    /* Read timeout in milliseconds */
 183         uint16 flags;           /* Flags (see RPCAP_STARTCAPREQ_FLAG_xxx) */
 184         uint16 portdata;        /* Network port on which the client is waiting at (if 'serveropen') */
 185 };
 186
 187 /* Format of the reply message that devoted to start a remote capture (startcap reply command) */
 188 struct rpcap_startcapreply
 189 {
 190         int32 bufsize;          /* Size of the user buffer allocated by WinPcap; it can be different from the one we chose */
 191         uint16 portdata;        /* Network port on which the server is waiting at (passive mode only) */
 192         uint16 dummy;           /* Must be zero */
 193 };
 194
 195 /*
 196  * \brief Format of the header which encapsulates captured packets when transmitted on the network.
 197  *
 198  * This message requires the general header as well, since we want to be able to exchange
 199  * more information across the network in the future (for example statistics, and kind like that).
 200  */
 201 struct rpcap_pkthdr
 202 {
 203         uint32 timestamp_sec;   /* 'struct timeval' compatible, it represents the 'tv_sec' field */
 204         uint32 timestamp_usec;  /* 'struct timeval' compatible, it represents the 'tv_usec' field */
 205         uint32 caplen;          /* Length of portion present in the capture */
 206         uint32 len;             /* Real length this packet (off wire) */
 207         uint32 npkt;            /* Ordinal number of the packet (i.e. the first one captured has '1', the second one '2', etc) */
 208 };
 209
 210 /* General header used for the pcap_setfilter() command; keeps just the number of BPF instructions */
 211 struct rpcap_filter
 212 {
 213         uint16 filtertype;      /* type of the filter transferred (BPF instructions, ...) */
 214         uint16 dummy;           /* Must be zero */
 215         uint32 nitems;          /* Number of items contained into the filter (e.g. BPF instructions for BPF filters) */
 216 };
 217
 218 /* Structure that keeps a single BPF instuction; it is repeated 'ninsn' times according to the 'rpcap_filterbpf' header */
 219 struct rpcap_filterbpf_insn
 220 {
 221         uint16 code;    /* opcode of the instruction */
 222         uint8 jt;       /* relative offset to jump to in case of 'true' */
 223         uint8 jf;       /* relative offset to jump to in case of 'false' */
 224         int32 k;        /* instruction-dependent value */
 225 };
 226
 227 /* Structure that keeps the data required for the authentication on the remote host */
 228 struct rpcap_auth
 229 {
 230         uint16 type;    /* Authentication type */
 231         uint16 dummy;   /* Must be zero */
 232         uint16 slen1;   /* Length of the first authentication item (e.g. username) */
 233         uint16 slen2;   /* Length of the second authentication item (e.g. password) */
 234 };
 235
 236 /* Structure that keeps the statistics about the number of packets captured, dropped, etc. */
 237 struct rpcap_stats
 238 {
 239         uint32 ifrecv;          /* Packets received by the kernel filter (i.e. pcap_stats.ps_recv) */
 240         uint32 ifdrop;          /* Packets dropped by the network interface (e.g. not enough buffers) (i.e. pcap_stats.ps_ifdrop) */
 241         uint32 krnldrop;        /* Packets dropped by the kernel filter (i.e. pcap_stats.ps_drop) */
 242         uint32 svrcapt;         /* Packets captured by the RPCAP daemon and sent on the network */
 243 };
 244
 245 /* Structure that is needed to set sampling parameters */
 246 struct rpcap_sampling
 247 {
 248         uint8 method;   /* Sampling method */
 249         uint8 dummy1;   /* Must be zero */
 250         uint16 dummy2;  /* Must be zero */
 251         uint32 value;   /* Parameter related to the sampling method */
 252 };
 253
 254 /* Messages field coding */
 255 #define RPCAP_MSG_ERROR                 1       /* Message that keeps an error notification */
 256 #define RPCAP_MSG_FINDALLIF_REQ         2       /* Request to list all the remote interfaces */
 257 #define RPCAP_MSG_OPEN_REQ              3       /* Request to open a remote device */
 258 #define RPCAP_MSG_STARTCAP_REQ          4       /* Request to start a capture on a remote device */
 259 #define RPCAP_MSG_UPDATEFILTER_REQ      5       /* Send a compiled filter into the remote device */
 260 #define RPCAP_MSG_CLOSE                 6       /* Close the connection with the remote peer */
 261 #define RPCAP_MSG_PACKET                7       /* This is a 'data' message, which carries a network packet */
 262 #define RPCAP_MSG_AUTH_REQ              8       /* Message that keeps the authentication parameters */
 263 #define RPCAP_MSG_STATS_REQ             9       /* It requires to have network statistics */
 264 #define RPCAP_MSG_ENDCAP_REQ            10      /* Stops the current capture, keeping the device open */
 265 #define RPCAP_MSG_SETSAMPLING_REQ       11      /* Set sampling parameters */
 266
 267 #define RPCAP_MSG_FINDALLIF_REPLY       (128+RPCAP_MSG_FINDALLIF_REQ)           /* Keeps the list of all the remote interfaces */
 268 #define RPCAP_MSG_OPEN_REPLY            (128+RPCAP_MSG_OPEN_REQ)                        /* The remote device has been opened correctly */
 269 #define RPCAP_MSG_STARTCAP_REPLY        (128+RPCAP_MSG_STARTCAP_REQ)            /* The capture is starting correctly */
 270 #define RPCAP_MSG_UPDATEFILTER_REPLY (128+RPCAP_MSG_UPDATEFILTER_REQ)   /* The filter has been applied correctly on the remote device */
 271 #define RPCAP_MSG_AUTH_REPLY            (128+RPCAP_MSG_AUTH_REQ)                        /* Sends a message that says 'ok, authorization successful' */
 272 #define RPCAP_MSG_STATS_REPLY           (128+RPCAP_MSG_STATS_REQ)                       /* Message that keeps the network statistics */
 273 #define RPCAP_MSG_ENDCAP_REPLY          (128+RPCAP_MSG_ENDCAP_REQ)                      /* Confirms that the capture stopped successfully */
 274 #define RPCAP_MSG_SETSAMPLING_REPLY     (128+RPCAP_MSG_SETSAMPLING_REQ)         /* Confirms that the capture stopped successfully */
 275
 276 #define RPCAP_STARTCAPREQ_FLAG_PROMISC          0x00000001      /* Enables promiscuous mode (default: disabled) */
 277 #define RPCAP_STARTCAPREQ_FLAG_DGRAM            0x00000002      /* Use a datagram (i.e. UDP) connection for the data stream (default: use TCP)*/
 278 #define RPCAP_STARTCAPREQ_FLAG_SERVEROPEN       0x00000004      /* The server has to open the data connection toward the client */
 279 #define RPCAP_STARTCAPREQ_FLAG_INBOUND          0x00000008      /* Capture only inbound packets (take care: the flag has no effects with promiscuous enabled) */
 280 #define RPCAP_STARTCAPREQ_FLAG_OUTBOUND         0x00000010      /* Capture only outbound packets (take care: the flag has no effects with promiscuous enabled) */
 281
 282 #define RPCAP_UPDATEFILTER_BPF 1                        /* This code tells us that the filter is encoded with the BPF/NPF syntax */
 283
 284 /* Network error codes */
 285 #define PCAP_ERR_NETW           1       /* Network error */
 286 #define PCAP_ERR_INITTIMEOUT    2       /* The RPCAP initial timeout has expired */
 287 #define PCAP_ERR_AUTH           3       /* Generic authentication error */
 288 #define PCAP_ERR_FINDALLIF      4       /* Generic findalldevs error */
 289 #define PCAP_ERR_NOREMOTEIF     5       /* The findalldevs was ok, but the remote end had no interfaces to list */
 290 #define PCAP_ERR_OPEN           6       /* Generic pcap_open error */
 291 #define PCAP_ERR_UPDATEFILTER   7       /* Generic updatefilter error */
 292 #define PCAP_ERR_GETSTATS       8       /* Generic pcap_stats error */
 293 #define PCAP_ERR_READEX         9       /* Generic pcap_next_ex error */
 294 #define PCAP_ERR_HOSTNOAUTH     10      /* The host is not authorized to connect to this server */
 295 #define PCAP_ERR_REMOTEACCEPT   11      /* Generic pcap_remoteaccept error */
 296 #define PCAP_ERR_STARTCAPTURE   12      /* Generic pcap_startcapture error */
 297 #define PCAP_ERR_ENDCAPTURE     13      /* Generic pcap_endcapture error */
 298 #define PCAP_ERR_RUNTIMETIMEOUT 14      /* The RPCAP run-time timeout has expired */
 299 #define PCAP_ERR_SETSAMPLING    15      /* Error during the settings of sampling parameters */
 300 #define PCAP_ERR_WRONGMSG       16      /* The other end endpoint sent a message which has not been recognized */
 301 #define PCAP_ERR_WRONGVER       17      /* The other end endpoint has a version number that is not compatible with our */
 302
 303 #endif