PACKETP(3)

NAME
packetp - packet purgatory

SYNOPSIS
#include <packetp.h>

typedef int (*packet_handler)(struct packetp_ctx *ctx, uint8_t *packet, void *state);
struct packetp_ctx *
packetp_init(void);
int
packetp_set_target(struct packetp_ctx *ctx, struct addr *target);
int
packetp_set_proxy(struct packetp_ctx *ctx, struct addr *proxy);
int
packetp_set_type(struct packetp_ctx *ctx, int type);
int
packetp_set_simplified(struct packetp_ctx *ctx, int simplified);
int
packetp_set_verbose(struct packetp_ctx *ctx, int verbose);
int
packetp_start(struct packetp_ctx *ctx, packet_handler outbound, packet_handler inbound, void *state);

DESCRIPTION
packetp provides a portable API for packet capture, modification, and reinjection by user-space processes. Applications that require packet modification may write functional code that is independent of the method used to capture and modify traffic. Packet purgatory is heavily intertwined with pcap(3) and dnet(3)

ROUTINES
packetp_init() is used to obtain a context, which is pre-initialized to some (hopefully usable) defaults.

packetp_set_type() sets the type of mechanism that packet purgatory will use to capture and reinject packets. Valid types are:

    #define PP_FAKEIP 1 /* Uses proxy IP */
    #define PP_LOOPFW 2 /* Uses firewalls and route table mangling */

The type is set to PP_LOOPFW by default.

packetp_set_target() modifies the context to only capture packets bound for the target host or network. If the type has been set to PP_FAKEIP, the target address must be a host address, not a network. By default, the target address is set to IP_ADDR_ANY.

packetp_set_proxy() sets the proxy address that will be used to intercept packets in PP_FAKEIP mode. This will have no effect using other packet purgatory types. The proxy address must be a host address, and not a network. In order to be effective, this address must be on the same subnet to a local ethernet interface. There is no default proxy address.

packetp_set_simplified() determines whether packet purgatory will reinject packets automatically, or if the packet handling functions will handle that. By default, simplified is set to 1, which means that packet purgatory will automatically reinject the modified packet buffer if the packet handler returns zero.

packetp_set_verbose() determines whether packet purgatory will output error messages to stderr, or will just return back (somewhat less informative) error codes. By default, verbose is set to zero.

packetp_start() begins the process of capturing, modifying, and (potentially) re-emitting packets, based on the contents of the context. The inbound and outbound functions will be called when packets have been intercepted, and passed the packets, the context, and another (user specified) pointer.

RETURN VALUES
packetp_init() returns a pointer to a newly allocated packetp_ctx structure, or NULL on failure.

packetp_set_type(), packetp_set_simplified(), packetp_set_target(), packetp_set_proxy(), and packetp_set_verbose() return 0 on success, or -1 on failure.

packetp_start() should not return unless something goes wrong, or a signal is received. The following return values are defined:

    #define EPCAP      -1  /* Failed obtaining a pcap handle */
    #define EARP       -2  /* Failed creating child to ARP for proxy IP */
    #define EARPDIED   -3  /* The proxy IP ARP child terminated */
    #define ESELECT    -4  /* Error reading in select (possible signal) */
    #define EROUTE     -5  /* Failed saving state of route table */
    #define EFIREWALL  -6  /* Failed opening fw handle */
    #define EUNKNOWN   -7  /* wedge_type is unknown */
    #define EOPEN      -8  /* Failed opening libdnet handles */
    #define EMEM       -9  /* Failed allocating memory */

SEE ALSO
pcap(3) dnet(3)

AUTHORS
Todd MacDermid <tmacd@synacklabs.net>