00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022 #ifndef __DECODE_H__
00023 #define __DECODE_H__
00024
00025
00026
00027
00028 #ifdef HAVE_CONFIG_H
00029 #include "config.h"
00030 #endif
00031
00032 #include <sys/types.h>
00033 #include <pcap.h>
00034
00035 #ifndef WIN32
00036 #include <sys/socket.h>
00037 #include <netinet/in.h>
00038 #include <net/if.h>
00039 #endif
00040 #if defined(WIN32) && !defined(IFNAMSIZ)
00041 #include "libnet/IPExport.h"
00042 #define IFNAMESIZ MAX_ADAPTER_NAME
00043 #endif
00044 #include "ubi_SplayTree.h"
00045 #include "bitop.h"
00046
00047
00048
00049 #define ETHERNET_MTU 1500
00050 #define ETHERNET_TYPE_IP 0x0800
00051 #define ETHERNET_TYPE_ARP 0x0806
00052 #define ETHERNET_TYPE_REVARP 0x8035
00053 #define ETHERNET_TYPE_EAPOL 0x888e
00054 #define ETHERNET_TYPE_IPV6 0x86dd
00055 #define ETHERNET_TYPE_IPX 0x8137
00056 #define ETHERNET_TYPE_PPPoE_DISC 0x8863
00057 #define ETHERNET_TYPE_PPPoE_SESS 0x8864
00058 #define ETHERNET_TYPE_8021Q 0x8100
00059
00060 #define ETH_DSAP_SNA 0x08
00061 #define ETH_SSAP_SNA 0x00
00062 #define ETH_DSAP_STP 0x42
00063 #define ETH_SSAP_STP 0x42
00064 #define ETH_DSAP_IP 0xaa
00065 #define ETH_SSAP_IP 0xaa
00066
00067 #define ETH_ORG_CODE_ETHR 0x000000
00068 #define ETH_ORG_CODE_CDP 0x00000c
00069
00070 #define ETHERNET_HEADER_LEN 14
00071 #define ETHERNET_MAX_LEN_ENCAP 1518
00072 #define PPPOE_HEADER_LEN 20
00073 #define MINIMAL_TOKENRING_HEADER_LEN 22
00074 #define MINIMAL_IEEE80211_HEADER_LEN 10
00075 #define IEEE802_11_DATA_HDR_LEN 24
00076 #define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN
00077 #define TOKENRING_LLC_LEN 8
00078 #define SLIP_HEADER_LEN 16
00079
00080
00081
00082 #define WLAN_TYPE_MGMT_ASREQ 0x0
00083 #define WLAN_TYPE_MGMT_ASRES 0x10
00084 #define WLAN_TYPE_MGMT_REREQ 0x20
00085 #define WLAN_TYPE_MGMT_RERES 0x30
00086 #define WLAN_TYPE_MGMT_PRREQ 0x40
00087 #define WLAN_TYPE_MGMT_PRRES 0x50
00088 #define WLAN_TYPE_MGMT_BEACON 0x80
00089 #define WLAN_TYPE_MGMT_ATIM 0x90
00090 #define WLAN_TYPE_MGMT_DIS 0xa0
00091 #define WLAN_TYPE_MGMT_AUTH 0xb0
00092 #define WLAN_TYPE_MGMT_DEAUTH 0xc0
00093
00094 #define WLAN_TYPE_CONT_PS 0xa4
00095 #define WLAN_TYPE_CONT_RTS 0xb4
00096 #define WLAN_TYPE_CONT_CTS 0xc4
00097 #define WLAN_TYPE_CONT_ACK 0xd4
00098 #define WLAN_TYPE_CONT_CFE 0xe4
00099 #define WLAN_TYPE_CONT_CFACK 0xf4
00100
00101 #define WLAN_TYPE_DATA_DATA 0x08
00102 #define WLAN_TYPE_DATA_DTCFACK 0x18
00103 #define WLAN_TYPE_DATA_DTCFPL 0x28
00104 #define WLAN_TYPE_DATA_DTACKPL 0x38
00105 #define WLAN_TYPE_DATA_NULL 0x48
00106 #define WLAN_TYPE_DATA_CFACK 0x58
00107 #define WLAN_TYPE_DATA_CFPL 0x68
00108 #define WLAN_TYPE_DATA_ACKPL 0x78
00109
00110
00111
00112 #define WLAN_FLAG_TODS 0x0100
00113 #define WLAN_FLAG_FROMDS 0x0200
00114 #define WLAN_FLAG_FRAG 0x0400
00115 #define WLAN_FLAG_RETRY 0x0800
00116 #define WLAN_FLAG_PWRMGMT 0x1000
00117 #define WLAN_FLAG_MOREDAT 0x2000
00118 #define WLAN_FLAG_WEP 0x4000
00119 #define WLAN_FLAG_ORDER 0x8000
00120
00121
00122 #define EAPOL_TYPE_EAP 0x00
00123 #define EAPOL_TYPE_START 0x01
00124 #define EAPOL_TYPE_LOGOFF 0x02
00125 #define EAPOL_TYPE_KEY 0x03
00126 #define EAPOL_TYPE_ASF 0x04
00127
00128
00129 #define EAP_CODE_REQUEST 0x01
00130 #define EAP_CODE_RESPONSE 0x02
00131 #define EAP_CODE_SUCCESS 0x03
00132 #define EAP_CODE_FAILURE 0x04
00133
00134 #define EAP_TYPE_IDENTITY 0x01
00135 #define EAP_TYPE_NOTIFY 0x02
00136 #define EAP_TYPE_NAK 0x03
00137 #define EAP_TYPE_MD5 0x04
00138 #define EAP_TYPE_OTP 0x05
00139 #define EAP_TYPE_GTC 0x06
00140 #define EAP_TYPE_TLS 0x0d
00141
00142
00143 #define CHDLC_HEADER_LEN 4
00144 #define CHDLC_ADDR_UNICAST 0x0f
00145 #define CHDLC_ADDR_MULTICAST 0x8f
00146 #define CHDLC_ADDR_BROADCAST 0xff
00147 #define CHDLC_CTRL_UNNUMBERED 0x03
00148
00149
00150
00151
00152
00153
00154
00155 struct ppp_header {
00156 unsigned char address;
00157 unsigned char control;
00158 unsigned short protocol;
00159 };
00160
00161 #ifndef PPP_HDRLEN
00162 #define PPP_HDRLEN sizeof(struct ppp_header)
00163 #endif
00164
00165 #define PPP_IP 0x0021
00166 #define PPP_VJ_COMP 0x002d
00167 #define PPP_VJ_UCOMP 0x002f
00168 #define PPP_IPX 0x002b
00169
00170
00171 #ifndef PPP_MTU
00172 #define PPP_MTU 1500
00173 #endif
00174
00175
00176 #define NULL_HDRLEN 4
00177
00178
00179 #define IP_HEADER_LEN 20
00180 #define TCP_HEADER_LEN 20
00181 #define UDP_HEADER_LEN 8
00182 #define ICMP_HEADER_LEN 4
00183
00184 #define TCP_OPTLENMAX 40
00185
00186 #ifndef IP_MAXPACKET
00187 #define IP_MAXPACKET 65535
00188 #endif
00189
00190 #define TH_FIN 0x01
00191 #define TH_SYN 0x02
00192 #define TH_RST 0x04
00193 #define TH_PUSH 0x08
00194 #define TH_ACK 0x10
00195 #define TH_URG 0x20
00196 #define TH_RES2 0x40
00197 #define TH_RES1 0x80
00198 #define TH_NORESERVED (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)
00199
00200
00201
00202
00203
00204
00205 #define TCPOPT_EOL 0
00206 #define TCPOLEN_EOL 1
00207
00208 #define TCPOPT_NOP 1
00209 #define TCPOLEN_NOP 1
00210
00211 #define TCPOPT_MAXSEG 2
00212 #define TCPOLEN_MAXSEG 4
00213
00214 #define TCPOPT_WSCALE 3
00215 #define TCPOLEN_WSCALE 3
00216
00217 #define TCPOPT_SACKOK 4
00218 #define TCPOLEN_SACKOK 2
00219
00220 #define TCPOPT_SACK 5
00221
00222 #define TCPOPT_ECHO 6
00223 #define TCPOLEN_ECHO 6
00224
00225 #define TCPOPT_ECHOREPLY 7
00226 #define TCPOLEN_ECHOREPLY 6
00227
00228 #define TCPOPT_TIMESTAMP 8
00229 #define TCPOLEN_TIMESTAMP 10
00230
00231 #define TCPOPT_PARTIAL_PERM 9
00232 #define TCPOLEN_PARTIAL_PERM 2
00233
00234 #define TCPOPT_PARTIAL_SVC 10
00235 #define TCPOLEN_PARTIAL_SVC 3
00236
00237
00238 #define TCPOPT_CC 11
00239 #define TCPOPT_CC_NEW 12
00240 #define TCPOPT_CC_ECHO 13
00241 #define TCPOLEN_CC 6
00242 #define TCPOLEN_CC_NEW 6
00243 #define TCPOLEN_CC_ECHO 6
00244
00245 #define TCPOPT_ALTCSUM 15
00246 #define TCPOPT_SKEETER 16
00247 #define TCPOPT_BUBBA 17
00248
00249 #define TCPOPT_TRAILER_CSUM 18
00250 #define TCPOLEN_TRAILER_CSUM 3
00251
00252 #define TCPOPT_MD5SIG 19
00253 #define TCPOLEN_MD5SIG 18
00254
00255
00256 #define TCPOPT_SCPS 20
00257 #define TCPOPT_SELNEGACK 21
00258 #define TCPOPT_RECORDBOUND 22
00259 #define TCPOPT_CORRUPTION 23
00260
00261 #define TCPOPT_SNAP 24
00262 #define TCPOPT_UNASSIGNED 25
00263 #define TCPOPT_COMPRESSION 26
00264
00265
00266 #define TCP_OPT_TRUNC -1
00267 #define TCP_OPT_BADLEN -2
00268
00269
00270 #define TCPOLEN_TSTAMP_APPA (TCPOLEN_TIMESTAMP+2)
00271 #define TCPOPT_TSTAMP_HDR \
00272 (TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP)
00273
00274
00275
00276
00277
00278
00279
00280
00281 #ifndef TCP_MSS
00282 #define TCP_MSS 512
00283 #endif
00284
00285 #ifndef TCP_MAXWIN
00286 #define TCP_MAXWIN 65535
00287 #endif
00288
00289 #ifndef TCP_MAX_WINSHIFT
00290 #define TCP_MAX_WINSHIFT 14
00291 #endif
00292
00293
00294
00295
00296 #ifndef TCP_NODELAY
00297 #define TCP_NODELAY 0x01
00298 #endif
00299
00300 #ifndef TCP_MAXSEG
00301 #define TCP_MAXSEG 0x02
00302 #endif
00303
00304 #define SOL_TCP 6
00305
00306
00307
00308 #define L2TP_PORT 1701
00309 #define DHCP_CLIENT_PORT 68
00310 #define DHCP_SERVER_PORT 67
00311
00312
00313 #ifndef IRIX
00314 #define SNAPLEN 1514
00315 #else
00316 #define SNAPLEN 1500
00317 #endif
00318
00319 #define MIN_SNAPLEN 68
00320 #define PROMISC 1
00321 #define READ_TIMEOUT 500
00322
00323
00324 #define TR_ALEN 6
00325 #define IPARP_SAP 0xaa
00326
00327 #define AC 0x10
00328 #define LLC_FRAME 0x40
00329
00330 #define TRMTU 2000
00331 #define TR_RII 0x80
00332 #define TR_RCF_DIR_BIT 0x80
00333 #define TR_RCF_LEN_MASK 0x1f00
00334 #define TR_RCF_BROADCAST 0x8000
00335 #define TR_RCF_LIMITED_BROADCAST 0xC000
00336 #define TR_RCF_FRAME2K 0x20
00337 #define TR_RCF_BROADCAST_MASK 0xC000
00338
00339
00340
00341 #define FDDI_ALLC_LEN 13
00342 #define FDDI_ALEN 6
00343 #define FDDI_MIN_HLEN (FDDI_ALLC_LEN + 3)
00344
00345 #define FDDI_DSAP_SNA 0x08
00346 #define FDDI_SSAP_SNA 0x00
00347 #define FDDI_DSAP_STP 0x42
00348 #define FDDI_SSAP_STP 0x42
00349 #define FDDI_DSAP_IP 0xaa
00350 #define FDDI_SSAP_IP 0xaa
00351
00352 #define FDDI_ORG_CODE_ETHR 0x000000
00353 #define FDDI_ORG_CODE_CDP 0x00000c
00354
00355
00356 #define ETHERNET_TYPE_CDP 0x2000
00357
00358
00359 #define ARPOP_REQUEST 1
00360 #define ARPOP_REPLY 2
00361 #define ARPOP_RREQUEST 3
00362 #define ARPOP_RREPLY 4
00363
00364
00365 #define PPPoE_CODE_SESS 0x00
00366 #define PPPoE_CODE_PADI 0x09
00367 #define PPPoE_CODE_PADO 0x07
00368 #define PPPoE_CODE_PADR 0x19
00369 #define PPPoE_CODE_PADS 0x65
00370 #define PPPoE_CODE_PADT 0xa7
00371
00372
00373 #define PPPoE_TAG_END_OF_LIST 0x0000
00374 #define PPPoE_TAG_SERVICE_NAME 0x0101
00375 #define PPPoE_TAG_AC_NAME 0x0102
00376 #define PPPoE_TAG_HOST_UNIQ 0x0103
00377 #define PPPoE_TAG_AC_COOKIE 0x0104
00378 #define PPPoE_TAG_VENDOR_SPECIFIC 0x0105
00379 #define PPPoE_TAG_RELAY_SESSION_ID 0x0110
00380 #define PPPoE_TAG_SERVICE_NAME_ERROR 0x0201
00381 #define PPPoE_TAG_AC_SYSTEM_ERROR 0x0202
00382 #define PPPoE_TAG_GENERIC_ERROR 0x0203
00383
00384
00385 #define ICMP_ECHOREPLY 0
00386 #define ICMP_DEST_UNREACH 3
00387 #define ICMP_SOURCE_QUENCH 4
00388 #define ICMP_REDIRECT 5
00389 #define ICMP_ECHO 8
00390 #define ICMP_ROUTER_ADVERTISE 9
00391 #define ICMP_ROUTER_SOLICIT 10
00392 #define ICMP_TIME_EXCEEDED 11
00393 #define ICMP_PARAMETERPROB 12
00394 #define ICMP_TIMESTAMP 13
00395 #define ICMP_TIMESTAMPREPLY 14
00396 #define ICMP_INFO_REQUEST 15
00397 #define ICMP_INFO_REPLY 16
00398 #define ICMP_ADDRESS 17
00399 #define ICMP_ADDRESSREPLY 18
00400 #define NR_ICMP_TYPES 18
00401
00402
00403 #define ICMP_NET_UNREACH 0
00404 #define ICMP_HOST_UNREACH 1
00405 #define ICMP_PROT_UNREACH 2
00406 #define ICMP_PORT_UNREACH 3
00407 #define ICMP_FRAG_NEEDED 4
00408 #define ICMP_SR_FAILED 5
00409 #define ICMP_NET_UNKNOWN 6
00410 #define ICMP_HOST_UNKNOWN 7
00411 #define ICMP_HOST_ISOLATED 8
00412 #define ICMP_PKT_FILTERED_NET 9
00413 #define ICMP_PKT_FILTERED_HOST 10
00414 #define ICMP_NET_UNR_TOS 11
00415 #define ICMP_HOST_UNR_TOS 12
00416 #define ICMP_PKT_FILTERED 13
00417 #define ICMP_PREC_VIOLATION 14
00418 #define ICMP_PREC_CUTOFF 15
00419 #define NR_ICMP_UNREACH 15
00420
00421
00422 #define ICMP_REDIR_NET 0
00423 #define ICMP_REDIR_HOST 1
00424 #define ICMP_REDIR_TOS_NET 2
00425 #define ICMP_REDIR_TOS_HOST 3
00426
00427 #define ICMP_TIMEOUT_TRANSIT 0
00428 #define ICMP_TIMEOUT_REASSY 1
00429
00430 #define ICMP_PARAM_BADIPHDR 0
00431 #define ICMP_PARAM_OPTMISSING 1
00432 #define ICMP_PARAM_BAD_LENGTH 2
00433
00434
00435 #ifndef IPOPT_EOL
00436 #define IPOPT_EOL 0x00
00437 #endif
00438
00439 #ifndef IPOPT_NOP
00440 #define IPOPT_NOP 0x01
00441 #endif
00442
00443 #ifndef IPOPT_RR
00444 #define IPOPT_RR 0x07
00445 #endif
00446
00447 #ifndef IPOPT_RTRALT
00448 #define IPOPT_RTRALT 0x14
00449 #endif
00450
00451 #ifndef IPOPT_TS
00452 #define IPOPT_TS 0x44
00453 #endif
00454
00455 #ifndef IPOPT_SECURITY
00456 #define IPOPT_SECURITY 0x82
00457 #endif
00458
00459 #ifndef IPOPT_LSRR
00460 #define IPOPT_LSRR 0x83
00461 #endif
00462
00463 #ifndef IPOPT_LSRR_E
00464 #define IPOPT_LSRR_E 0x84
00465 #endif
00466
00467 #ifndef IPOPT_SATID
00468 #define IPOPT_SATID 0x88
00469 #endif
00470
00471 #ifndef IPOPT_SSRR
00472 #define IPOPT_SSRR 0x89
00473 #endif
00474
00475
00476
00477
00478 #define TOPT_EOL 0x00
00479 #define TOPT_NOP 0x01
00480 #define TOPT_MSS 0x02
00481 #define TOPT_WS 0x03
00482 #define TOPT_TS 0x08
00483 #ifndef TCPOPT_WSCALE
00484 #define TCPOPT_WSCALE 3
00485 #endif
00486 #ifndef TCPOPT_SACKOK
00487 #define TCPOPT_SACKOK 4
00488 #endif
00489 #ifndef TCPOPT_SACK
00490 #define TCPOPT_SACK 5
00491 #endif
00492 #ifndef TCPOPT_ECHO
00493 #define TCPOPT_ECHO 6
00494 #endif
00495 #ifndef TCPOPT_ECHOREPLY
00496 #define TCPOPT_ECHOREPLY 7
00497 #endif
00498 #ifndef TCPOPT_TIMESTAMP
00499 #define TCPOPT_TIMESTAMP 8
00500 #endif
00501 #ifndef TCPOPT_CC
00502 #define TCPOPT_CC 11
00503 #endif
00504 #ifndef TCPOPT_CCNEW
00505 #define TCPOPT_CCNEW 12
00506 #endif
00507 #ifndef TCPOPT_CCECHO
00508 #define TCPOPT_CCECHO 13
00509 #endif
00510
00511 #define EXTRACT_16BITS(p) ((u_short) ntohs (*(u_short *)(p)))
00512
00513 #ifdef WORDS_MUSTALIGN
00514
00515 #if defined(__GNUC__)
00516
00517 #define EXTRACT_32BITS(p) ({ u_int32_t __tmp; memmove(&__tmp, (p), sizeof(u_int32_t)); (u_int32_t) ntohl(__tmp);})
00518 #endif
00519
00520 #else
00521
00522
00523 #define EXTRACT_32BITS(p) ((u_int32_t) ntohl (*(u_int32_t *)(p)))
00524
00525 #endif
00526
00527
00528 #define PKT_REBUILT_FRAG 0x00000001
00529 #define PKT_REBUILT_STREAM 0x00000002
00530 #define PKT_STREAM_UNEST_UNI 0x00000004
00531
00532
00533
00534 #define PKT_STREAM_UNEST_BI 0x00000008
00535
00536
00537
00538 #define PKT_STREAM_EST 0x00000010
00539 #define PKT_ECN 0x00000020
00540 #define PKT_FROM_SERVER 0x00000040
00541
00542 #define PKT_FROM_CLIENT 0x00000080
00543
00544 #define PKT_HTTP_DECODE 0x00000100
00545 #define PKT_FRAG_ALERTED 0x00000200
00546
00547 #define PKT_STREAM_INSERT 0x00000400
00548 #define PKT_ALT_DECODE 0x00000800
00549
00550
00551 #define PKT_OBFUSCATED 0x40000000
00552 #define PKT_LOGGED 0x80000000
00553
00554
00555
00556
00557
00558 #ifdef WIN32
00559
00560 #pragma warning( disable : 4214 )
00561 #endif
00562
00563
00564 typedef struct _Trh_llc
00565 {
00566 u_int8_t dsap;
00567 u_int8_t ssap;
00568 u_int8_t protid[3];
00569 u_int16_t ethertype;
00570 } Trh_llc;
00571
00572
00573
00574
00575
00576
00577
00578 #ifdef WIN32
00579
00580 #pragma warning( disable : 4214 )
00581 #endif
00582
00583
00584
00585
00586
00587
00588
00589
00590
00591
00592
00593
00594
00595
00596
00597
00598
00599 #define TRH_MR_BCAST(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13)
00600 #define TRH_MR_LEN(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8)
00601 #define TRH_MR_DIR(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 8)
00602 #define TRH_MR_LF(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 7)
00603 #define TRH_MR_RES(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F))
00604
00605 typedef struct _Trh_mr
00606 {
00607 u_int16_t bcast_len_dir_lf_res;
00608 u_int16_t rseg[8];
00609 } Trh_mr;
00610 #ifdef WIN32
00611
00612 #pragma warning( default : 4214 )
00613 #endif
00614
00615
00616 typedef struct _Trh_hdr
00617 {
00618 u_int8_t ac;
00619 u_int8_t fc;
00620 u_int8_t daddr[TR_ALEN];
00621 u_int8_t saddr[TR_ALEN];
00622 } Trh_hdr;
00623
00624 #ifdef WIN32
00625
00626 #pragma warning( default : 4214 )
00627 #endif
00628
00629
00630
00631
00632
00633
00634 typedef struct _Fddi_hdr
00635 {
00636 u_int8_t fc;
00637 u_int8_t daddr[FDDI_ALEN];
00638 u_int8_t saddr[FDDI_ALEN];
00639 } Fddi_hdr;
00640
00641
00642 typedef struct _Fddi_llc_saps
00643 {
00644 u_int8_t dsap;
00645 u_int8_t ssap;
00646 } Fddi_llc_saps;
00647
00648
00649 typedef struct _Fddi_llc_sna
00650 {
00651 u_int8_t ctrl_fld[2];
00652 } Fddi_llc_sna;
00653
00654
00655
00656
00657 typedef struct _Fddi_llc_other
00658 {
00659 u_int8_t ctrl_fld[1];
00660 } Fddi_llc_other;
00661
00662
00663 typedef struct _Fddi_llc_iparp
00664 {
00665 u_int8_t ctrl_fld;
00666 u_int8_t protid[3];
00667 u_int16_t ethertype;
00668 } Fddi_llc_iparp;
00669
00670
00671
00672
00673
00674
00675
00676
00677 #define SLL_HDR_LEN 16
00678 #define SLL_ADDRLEN 8
00679 typedef struct _SLLHdr {
00680 u_int16_t sll_pkttype;
00681 u_int16_t sll_hatype;
00682 u_int16_t sll_halen;
00683 u_int8_t sll_addr[SLL_ADDRLEN];
00684 u_int16_t sll_protocol;
00685 } SLLHdr;
00686
00687
00688
00689
00690
00691
00692
00693 typedef struct _Pflog_hdr
00694 {
00695 u_int32_t af;
00696 char intf[IFNAMSIZ];
00697 short rule;
00698 u_short reason;
00699 u_short action;
00700 u_short dir;
00701 } PflogHdr;
00702
00703 #define PFLOG_HDRLEN sizeof(struct _Pflog_hdr)
00704
00705
00706
00707
00708
00709
00710 #define LINUX_SLL_HOST 0
00711 #define LINUX_SLL_BROADCAST 1
00712 #define LINUX_SLL_MULTICAST 2
00713 #define LINUX_SLL_OTHERHOST 3
00714 #define LINUX_SLL_OUTGOING 4
00715
00716
00717
00718 #define LINUX_SLL_P_802_3 0x0001
00719 #define LINUX_SLL_P_802_2 0x0004
00720
00721
00722 #ifdef WIN32
00723
00724
00725
00726 #pragma warning( disable : 4214 )
00727 #endif
00728
00729 #define VTH_PRIORITY(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13)
00730 #define VTH_CFI(vh) ((ntohs((vh)->vth_pri_cfi_vlan & 0x0100) >> 12))
00731 #define VTH_VLAN(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF))
00732
00733 typedef struct _VlanTagHdr
00734 {
00735 u_int16_t vth_pri_cfi_vlan;
00736 u_int16_t vth_proto;
00737 } VlanTagHdr;
00738 #ifdef WIN32
00739
00740 #pragma warning( default : 4214 )
00741 #endif
00742
00743
00744 typedef struct _EthLlc
00745 {
00746 u_int8_t dsap;
00747 u_int8_t ssap;
00748 } EthLlc;
00749
00750 typedef struct _EthLlcOther
00751 {
00752 u_int8_t ctrl;
00753 u_int8_t org_code[3];
00754 u_int16_t proto_id;
00755 } EthLlcOther;
00756
00757
00758
00759
00760
00761
00762 typedef struct _EtherHdr
00763 {
00764 u_int8_t ether_dst[6];
00765 u_int8_t ether_src[6];
00766 u_int16_t ether_type;
00767
00768 } EtherHdr;
00769
00770
00771
00772
00773
00774 typedef struct _WifiHdr
00775 {
00776 u_int16_t frame_control;
00777 u_int16_t duration_id;
00778 u_int8_t addr1[6];
00779 u_int8_t addr2[6];
00780 u_int8_t addr3[6];
00781 u_int16_t seq_control;
00782 u_int8_t addr4[6];
00783 } WifiHdr;
00784
00785
00786
00787
00788 #ifdef WIN32
00789
00790
00791
00792 #pragma warning( disable : 4214 )
00793 #endif
00794
00795
00796 #define IP_VER(iph) (((iph)->ip_verhl & 0xf0) >> 4)
00797 #define IP_HLEN(iph) ((iph)->ip_verhl & 0x0f)
00798
00799
00800 #define SET_IP_VER(iph, value) ((iph)->ip_verhl = (((iph)->ip_verhl & 0x0f) | (value << 4)))
00801 #define SET_IP_HLEN(iph, value) ((iph)->ip_verhl = (((iph)->ip_verhl & 0xf0) | (value & 0x0f)))
00802
00803 typedef struct _IPHdr
00804 {
00805 u_int8_t ip_verhl;
00806 u_int8_t ip_tos;
00807 u_int16_t ip_len;
00808 u_int16_t ip_id;
00809 u_int16_t ip_off;
00810 u_int8_t ip_ttl;
00811 u_int8_t ip_proto;
00812 u_int16_t ip_csum;
00813 struct in_addr ip_src;
00814 struct in_addr ip_dst;
00815 } IPHdr;
00816 #ifdef WIN32
00817
00818 #pragma warning( default : 4214 )
00819 #endif
00820
00821
00822
00823
00824 #ifdef WIN32
00825
00826
00827
00828 #pragma warning( disable : 4214 )
00829 #endif
00830
00831
00832
00833 #define TCP_OFFSET(tcph) (((tcph)->th_offx2 & 0xf0) >> 4)
00834 #define TCP_X2(tcph) ((tcph)->th_offx2 & 0x0f)
00835
00836
00837 #define SET_TCP_OFFSET(tcph, value) ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0x0f) | (value << 4)))
00838 #define SET_TCP_X2(tcph, value) ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
00839
00840 typedef struct _TCPHdr
00841 {
00842 u_int16_t th_sport;
00843 u_int16_t th_dport;
00844 u_int32_t th_seq;
00845 u_int32_t th_ack;
00846 u_int8_t th_offx2;
00847 u_int8_t th_flags;
00848 u_int16_t th_win;
00849 u_int16_t th_sum;
00850 u_int16_t th_urp;
00851
00852 } TCPHdr;
00853 #ifdef WIN32
00854
00855
00856
00857 #pragma warning( default : 4214 )
00858 #endif
00859
00860
00861 typedef struct _UDPHdr
00862 {
00863 u_int16_t uh_sport;
00864 u_int16_t uh_dport;
00865 u_int16_t uh_len;
00866 u_int16_t uh_chk;
00867
00868 } UDPHdr;
00869
00870
00871 typedef struct _ICMPHdr
00872 {
00873 u_int8_t type;
00874 u_int8_t code;
00875 u_int16_t csum;
00876 union
00877 {
00878 u_int8_t pptr;
00879
00880 struct in_addr gwaddr;
00881
00882 struct idseq
00883 {
00884 u_int16_t id;
00885 u_int16_t seq;
00886 } idseq;
00887
00888 int sih_void;
00889
00890 struct pmtu
00891 {
00892 u_int16_t ipm_void;
00893 u_int16_t nextmtu;
00894 } pmtu;
00895
00896 struct rtradv
00897 {
00898 u_int8_t num_addrs;
00899 u_int8_t wpa;
00900 u_int16_t lifetime;
00901 } rtradv;
00902 } icmp_hun;
00903
00904 #define s_icmp_pptr icmp_hun.pptr
00905 #define s_icmp_gwaddr icmp_hun.gwaddr
00906 #define s_icmp_id icmp_hun.idseq.id
00907 #define s_icmp_seq icmp_hun.idseq.seq
00908 #define s_icmp_void icmp_hun.sih_void
00909 #define s_icmp_pmvoid icmp_hun.pmtu.ipm_void
00910 #define s_icmp_nextmtu icmp_hun.pmtu.nextmtu
00911 #define s_icmp_num_addrs icmp_hun.rtradv.num_addrs
00912 #define s_icmp_wpa icmp_hun.rtradv.wpa
00913 #define s_icmp_lifetime icmp_hun.rtradv.lifetime
00914
00915 union
00916 {
00917
00918 struct ts
00919 {
00920 u_int32_t otime;
00921 u_int32_t rtime;
00922 u_int32_t ttime;
00923 } ts;
00924
00925
00926 struct ih_ip
00927 {
00928 IPHdr *ip;
00929
00930 } ip;
00931
00932 struct ra_addr
00933 {
00934 u_int32_t addr;
00935 u_int32_t preference;
00936 } radv;
00937
00938 u_int32_t mask;
00939
00940 char data[1];
00941
00942 } icmp_dun;
00943 #define s_icmp_otime icmp_dun.ts.otime
00944 #define s_icmp_rtime icmp_dun.ts.rtime
00945 #define s_icmp_ttime icmp_dun.ts.ttime
00946 #define s_icmp_ip icmp_dun.ih_ip
00947 #define s_icmp_radv icmp_dun.radv
00948 #define s_icmp_mask icmp_dun.mask
00949 #define s_icmp_data icmp_dun.data
00950
00951 } ICMPHdr;
00952
00953
00954 typedef struct _echoext
00955 {
00956 u_int16_t id;
00957 u_int16_t seqno;
00958
00959 } echoext;
00960
00961 typedef struct _ARPHdr
00962 {
00963 u_int16_t ar_hrd;
00964 u_int16_t ar_pro;
00965 u_int8_t ar_hln;
00966 u_int8_t ar_pln;
00967 u_int16_t ar_op;
00968 } ARPHdr;
00969
00970
00971
00972 typedef struct _EtherARP
00973 {
00974 ARPHdr ea_hdr;
00975 u_int8_t arp_sha[6];
00976 u_int8_t arp_spa[4];
00977 u_int8_t arp_tha[6];
00978 u_int8_t arp_tpa[4];
00979 } EtherARP;
00980
00981 typedef struct _EtherEapol
00982 {
00983 u_int8_t version;
00984 u_int8_t eaptype;
00985 u_int16_t len;
00986 } EtherEapol;
00987
00988 typedef struct _EAPHdr
00989 {
00990 u_int8_t code;
00991 u_int8_t id;
00992 u_int16_t len;
00993 } EAPHdr;
00994
00995 typedef struct _EapolKey
00996 {
00997 u_int8_t type;
00998 u_int8_t length[2];
00999 u_int8_t counter[8];
01000 u_int8_t iv[16];
01001 u_int8_t index;
01002 u_int8_t sig[16];
01003 } EapolKey;
01004
01005 typedef struct _Options
01006 {
01007 u_int8_t code;
01008 u_int8_t len;
01009 u_int8_t *data;
01010 } Options;
01011
01012
01013 typedef struct _PPPoEHdr
01014 {
01015 EtherHdr ethhdr;
01016 unsigned char ver_type;
01017 unsigned char code;
01018 unsigned short session;
01019 unsigned short length;
01020
01021 } PPPoEHdr;
01022
01023
01024 typedef struct _PPPoE_Tag
01025 {
01026 unsigned short type;
01027 unsigned short length;
01028
01029 } PPPoE_Tag;
01030
01031 #define DECODE_BLEN 65535
01032
01033
01034 #define URI_COUNT 5
01035
01036 #define HTTPURI_PIPELINE_REQ 0x01
01037 typedef struct _HttpUri
01038 {
01039 u_int8_t *uri;
01040 u_int16_t length;
01041 u_int32_t decode_flags;
01042 } HttpUri;
01043
01044
01045 #define SSNFLAG_SEEN_CLIENT 0x00000001
01046 #define SSNFLAG_SEEN_SERVER 0x00000002
01047 #define SSNFLAG_ESTABLISHED 0x00000004
01048 #define SSNFLAG_NMAP 0x00000008
01049 #define SSNFLAG_ECN_CLIENT_QUERY 0x00000010
01050 #define SSNFLAG_ECN_SERVER_REPLY 0x00000020
01051 #define SSNFLAG_HTTP_1_1 0x00000040
01052 #define SSNFLAG_SEEN_PMATCH 0x00000080
01053
01054 #define SSNFLAG_MIDSTREAM 0x00000100
01055 #define SSNFLAG_CLIENT_FIN 0x00000200
01056 #define SSNFLAG_SERVER_FIN 0x00000400
01057 #define SSNFLAG_ALL 0xFFFFFFFF
01058
01059 typedef struct _Stream
01060 {
01061 u_int32_t ip;
01062 u_int16_t port;
01063 u_int8_t state;
01064 u_int32_t isn;
01065 u_int32_t base_seq;
01066 u_int32_t last_ack;
01067 u_int16_t win_size;
01068 u_int32_t next_seq;
01069 u_int32_t pkts_sent;
01070 u_int32_t bytes_sent;
01071 u_int32_t bytes_tracked;
01072 ubi_trRoot data;
01073 } Stream;
01074
01075 typedef struct _Session
01076 {
01077 ubi_trNode Node;
01078
01079 Stream server;
01080 Stream client;
01081
01082 u_int32_t start_time;
01083 u_int32_t last_session_time;
01084
01085 u_int32_t session_flags;
01086 u_int32_t http_alert_flags;
01087
01088 u_int8_t flush_point;
01089 u_int8_t ttl;
01090 } Session;
01091
01092 typedef struct _Packet
01093 {
01094 struct pcap_pkthdr *pkth;
01095 u_int8_t *pkt;
01096
01097 Fddi_hdr *fddihdr;
01098 Fddi_llc_saps *fddisaps;
01099 Fddi_llc_sna *fddisna;
01100 Fddi_llc_iparp *fddiiparp;
01101 Fddi_llc_other *fddiother;
01102
01103 Trh_hdr *trh;
01104 Trh_llc *trhllc;
01105 Trh_mr *trhmr;
01106
01107 SLLHdr *sllh;
01108
01109 PflogHdr *pfh;
01110
01111 EtherHdr *eh;
01112 VlanTagHdr *vh;
01113 EthLlc *ehllc;
01114 EthLlcOther *ehllcother;
01115
01116 WifiHdr *wifih;
01117
01118 EtherARP *ah;
01119
01120 EtherEapol *eplh;
01121 EAPHdr *eaph;
01122 u_int8_t *eaptype;
01123 EapolKey *eapolk;
01124
01125 IPHdr *iph, *orig_iph;
01126 u_int32_t ip_options_len;
01127 u_int8_t *ip_options_data;
01128
01129 TCPHdr *tcph, *orig_tcph;
01130 u_int32_t tcp_options_len;
01131 u_int8_t *tcp_options_data;
01132
01133 UDPHdr *udph, *orig_udph;
01134 ICMPHdr *icmph, *orig_icmph;
01135
01136 echoext *ext;
01137
01138 u_int8_t *data;
01139 u_int16_t dsize;
01140 u_int16_t alt_dsize;
01141
01142
01143 u_int8_t frag_flag;
01144 u_int16_t frag_offset;
01145 u_int8_t mf;
01146 u_int8_t df;
01147 u_int8_t rf;
01148
01149 u_int16_t sp;
01150 u_int16_t dp;
01151 u_int16_t orig_sp;
01152 u_int16_t orig_dp;
01153 u_int32_t caplen;
01154
01155 u_int8_t uri_count;
01156
01157 void *ssnptr;
01158 void *flow;
01159
01160 Options ip_options[40];
01161 u_int32_t ip_option_count;
01162 u_char ip_lastopt_bad;
01163
01164 Options tcp_options[TCP_OPTLENMAX];
01165 u_int32_t tcp_option_count;
01166 u_char tcp_lastopt_bad;
01167
01168
01169 u_int8_t csum_flags;
01170 u_int32_t packet_flags;
01171 int preprocessors;
01172 } Packet;
01173
01174
01175 #define DECODE_CLASS 25
01176
01177 typedef struct _DecoderFlags
01178 {
01179 char decode_alerts;
01180 char tcpopt_experiment;
01181 char tcpopt_obsolete;
01182 char tcpopt_ttcp;
01183 char tcpopt_decode;
01184 char ipopt_decode;
01185 } DecoderFlags;
01186
01187 #define ALERTMSG_LENGTH 256
01188
01189
01190
01191 void InitDecoderFlags(void);
01192 void DecodeTRPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01193 void DecodeFDDIPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01194 void DecodeLinuxSLLPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01195 void DecodeEthPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01196 void DecodeIEEE80211Pkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01197 void DecodeVlan(u_int8_t *, const u_int32_t, Packet *);
01198 void DecodePppPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01199 void DecodePppSerialPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01200 void DecodePppPktEncapsulated(Packet *, const u_int32_t, u_int8_t *);
01201 void DecodeSlipPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01202 void DecodeNullPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01203 void DecodeRawPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01204 void DecodeI4LRawIPPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01205 void DecodeI4LCiscoIPPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01206 void DecodeChdlcPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01207 void DecodePflog(Packet *, struct pcap_pkthdr *, u_int8_t *);
01208 void DecodeIP(u_int8_t *, const u_int32_t, Packet *);
01209 void DecodeARP(u_int8_t *, u_int32_t, Packet *);
01210 void DecodeEapol(u_int8_t *, u_int32_t, Packet *);
01211 void DecodeEapolKey(u_int8_t *, u_int32_t, Packet *);
01212 void DecodeIPV6(u_int8_t *, u_int32_t);
01213 void DecodeIPX(u_int8_t *, u_int32_t);
01214 void DecodeTCP(u_int8_t *, const u_int32_t, Packet *);
01215 void DecodeUDP(u_int8_t *, const u_int32_t, Packet *);
01216 void DecodeEAP(u_int8_t *, const u_int32_t, Packet *);
01217 void DecodeICMP(u_int8_t *, const u_int32_t, Packet *);
01218 void DecodeIPOptions(u_int8_t *, u_int32_t, Packet *);
01219 void DecodeTCPOptions(u_int8_t *, u_int32_t, Packet *);
01220 void DecodeIPOptions(u_int8_t *, u_int32_t, Packet *);
01221 void DecodePPPoEPkt(Packet *, struct pcap_pkthdr *, u_int8_t *);
01222 #if defined(WORDS_MUSTALIGN) && !defined(__GNUC__)
01223 u_int32_t EXTRACT_32BITS (u_char *);
01224 #endif
01225
01226
01227 typedef struct _PortList
01228 {
01229 int ports[32];
01230
01231 int num_entries;
01232
01233 } PortList;
01234
01235 #endif