tracedump.h

Go to the documentation of this file.

/*
 * Copyright (C) 2011-2012 IITiS PAN Gliwice <http://www.iitis.pl/>
 * Author: Paweł Foremski <pjf@iitis.pl>
 * Licensed under GNU GPL v. 3
 */

#ifndef _TRACEDUMP_H_
#define _TRACEDUMP_H_

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <dirent.h>
#include <getopt.h>

#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/user.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <linux/net.h>
#include <signal.h>
#include <setjmp.h>
#include <pthread.h>

#include <libpjf/lib.h>

#define TRACEDUMP_VERSION "0.5"

struct tracedump;
struct pid;
struct sock;
struct port;

#include "inject.h"
#include "ptrace.h"
#include "pcap.h"
#include "pid.h"
#include "port.h"

struct tracedump {
        mmatic *mm;                           
        jmp_buf jmp;                          
        /* options */
        struct {
                char **src;                       
                int srclen;                       
                char *outfile;                    
                int snaplen;                      
        } opts;

        /* structures for process tracing */
        struct pid *sp;                       
        thash *pids;                          
        thash *socks;                         
        /* structures for port tracking */
        pthread_mutex_t mutex_ports;          
        pthread_t thread_gc;                  
        thash *tcp_ports;                     
        thash *udp_ports;                     
        /* structures for packet capture */
        struct pcap *pc;                      
};

struct pid {
        struct tracedump *td;                 
        int pid;                              
        bool in_socketcall;                   
        int code;                             
        struct sock *ss;                      
        struct user_regs_struct regs;         
};

struct sock {
        struct tracedump *td;                 
        int socknum;                          
        int type;                             
        unsigned long port;                   
};

struct port {
        struct timeval since;                 
        bool local;                           
        int socknum;                          
};

/* exceptions */
#define EXCEPTION(td, code, arg) longjmp(td->jmp, ((code) & 0xffff) | ((arg) << 16))
#define EXC_PTRACE 1

/* assumes 32-bits in int */
#define EXC_CODE(i) ((i) & 0xffff)
#define EXC_ARG(i) ((i) >> 16)

#endif