pcap-rpcap.c

/*
 * Copyright (c) 2002 - 2005 NetGroup, Politecnico di Torino (Italy)
 * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the Politecnico di Torino, CACE Technologies
 * nor the names of its contributors may be used to endorse or promote
 * products derived from this software without specific prior written
 * permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include <string.h>		/* for strlen(), ... */
#include <stdlib.h>		/* for malloc(), free(), ... */
#include <stdarg.h>		/* for functions with variable number of arguments */
#include <errno.h>		/* for the errno variable */
#include "pcap-int.h"
#include "pcap-rpcap.h"
#include "sockutils.h"

/*
 * \file pcap-rpcap.c
 *
 * This file keeps all the new funtions that are needed for the RPCAP protocol.
 * Almost all the pcap functions need to be modified in order to become compatible
 * with the RPCAP protocol. However, you can find here only the ones that are completely new.
 *
 * This file keeps also the functions that are 'private', i.e. are needed by the RPCAP
 * protocol but are not exported to the user.
 *
 * \warning All the RPCAP functions that are allowed to return a buffer containing
 * the error description can return max PCAP_ERRBUF_SIZE characters.
 * However there is no guarantees that the string will be zero-terminated.
 * Best practice is to define the errbuf variable as a char of size 'PCAP_ERRBUF_SIZE+1'
 * and to insert manually a NULL character at the end of the buffer. This will
 * guarantee that no buffer overflows occur even if we use the printf() to show
 * the error on the screen.
 */

#define PCAP_STATS_STANDARD	0	/* Used by pcap_stats_remote to see if we want standard or extended statistics */
#define PCAP_STATS_EX		1	/* Used by pcap_stats_remote to see if we want standard or extended statistics */

/* Keeps a list of all the opened connections in the active mode. */
struct activehosts *activeHosts;

/*
 * Private data for capturing on WinPcap devices.
 */
struct pcap_win {
	int nonblock;
	int rfmon_selfstart;		/* a flag tells whether the monitor mode is set by itself */
	int filtering_in_kernel;	/* using kernel filter */

#ifdef HAVE_DAG_API
	int	dag_fcs_bits;		/* Number of checksum bits from link layer */
#endif
};

/****************************************************
 *                                                  *
 * Locally defined functions                        *
 *                                                  *
 ****************************************************/
static int rpcap_checkver(SOCKET sock, struct rpcap_header *header, char *errbuf);
static struct pcap_stat *rpcap_stats_remote(pcap_t *p, struct pcap_stat *ps, int mode);
static int pcap_pack_bpffilter(pcap_t *fp, char *sendbuf, int *sendbufidx, struct bpf_program *prog);
static int pcap_createfilter_norpcappkt(pcap_t *fp, struct bpf_program *prog);
static int pcap_updatefilter_remote(pcap_t *fp, struct bpf_program *prog);
static int pcap_setfilter_remote(pcap_t *fp, struct bpf_program *prog);
static int pcap_setsampling_remote(pcap_t *p);


/****************************************************
 *                                                  *
 * Function bodies                                  *
 *                                                  *
 ****************************************************/

/*
 * \ingroup remote_pri_func
 *
 * \brief 	It traslates (i.e. de-serializes) a 'sockaddr_storage' structure from
 * the network byte order to the host byte order.
 *
 * It accepts a 'sockaddr_storage' structure as it is received from the network and it
 * converts it into the host byte order (by means of a set of ntoh() ).
 * The function will allocate the 'sockaddrout' variable according to the address family
 * in use. In case the address does not belong to the AF_INET nor AF_INET6 families,
 * 'sockaddrout' is not allocated and a NULL pointer is returned.
 * This usually happens because that address does not exist on the other host, so the
 * RPCAP daemon sent a 'sockaddr_storage' structure containing all 'zero' values.
 *
 * \param sockaddrin: a 'sockaddr_storage' pointer to the variable that has to be
 * de-serialized.
 *
 * \param sockaddrout: a 'sockaddr_storage' pointer to the variable that will contain
 * the de-serialized data. The structure returned can be either a 'sockaddr_in' or 'sockaddr_in6'.
 * This variable will be allocated automatically inside this function.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size PCAP_ERRBUF_SIZE)
 * that will contain the error message (in case there is one).
 *
 * \return '0' if everything is fine, '-1' if some errors occurred. Basically, the error
 * can be only the fact that the malloc() failed to allocate memory.
 * The error message is returned in the 'errbuf' variable, while the deserialized address
 * is returned into the 'sockaddrout' variable.
 *
 * \warning This function supports only AF_INET and AF_INET6 address families.
 *
 * \warning The sockaddrout (if not NULL) must be deallocated by the user.
 */
int rpcap_deseraddr(struct sockaddr_storage *sockaddrin, struct sockaddr_storage **sockaddrout, char *errbuf)
{
	/* Warning: we support only AF_INET and AF_INET6 */
	if (ntohs(sockaddrin->ss_family) == AF_INET)
	{
		struct sockaddr_in *sockaddr;

		sockaddr = (struct sockaddr_in *) sockaddrin;
		sockaddr->sin_family = ntohs(sockaddr->sin_family);
		sockaddr->sin_port = ntohs(sockaddr->sin_port);

		(*sockaddrout) = (struct sockaddr_storage *) malloc(sizeof(struct sockaddr_in));
		if ((*sockaddrout) == NULL)
		{
			pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc() failed: %s", pcap_strerror(errno));
			return -1;
		}
		memcpy(*sockaddrout, sockaddr, sizeof(struct sockaddr_in));
		return 0;
	}
	if (ntohs(sockaddrin->ss_family) == AF_INET6)
	{
		struct sockaddr_in6 *sockaddr;

		sockaddr = (struct sockaddr_in6 *) sockaddrin;
		sockaddr->sin6_family = ntohs(sockaddr->sin6_family);
		sockaddr->sin6_port = ntohs(sockaddr->sin6_port);
		sockaddr->sin6_flowinfo = ntohl(sockaddr->sin6_flowinfo);
		sockaddr->sin6_scope_id = ntohl(sockaddr->sin6_scope_id);

		(*sockaddrout) = (struct sockaddr_storage *) malloc(sizeof(struct sockaddr_in6));
		if ((*sockaddrout) == NULL)
		{
			pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc() failed: %s", pcap_strerror(errno));
			return -1;
		}
		memcpy(*sockaddrout, sockaddr, sizeof(struct sockaddr_in6));
		return 0;
	}

	/* It is neither AF_INET nor AF_INET6 */
	*sockaddrout = NULL;
	return 0;
}

/* \ingroup remote_pri_func
 *
 * \brief It reads a packet from the network socket. This does not make use of
 * callback (hence the "nocb" string into its name).
 *
 * This function is called by the several pcap_next_ex() when they detect that
 * we have a remote capture and they are the client side. In that case, they need
 * to read packets from the socket.
 *
 * Parameters and return values are exactly the same of the pcap_next_ex().
 *
 * \warning By choice, this function does not make use of semaphores. A smarter
 * implementation should put a semaphore into the data thread, and a signal will
 * be raised as soon as there is data into the socket buffer.
 * However this is complicated and it does not bring any advantages when reading
 * from the network, in which network delays can be much more important than
 * these optimizations. Therefore, we chose the following approach:
 * - the 'timeout' chosen by the user is split in two (half on the server side,
 * with the usual meaning, and half on the client side)
 * - this function checks for packets; if there are no packets, it waits for
 * timeout/2 and then it checks again. If packets are still missing, it returns,
 * otherwise it reads packets.
 */
static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr **pkt_header, u_char **pkt_data)
{
	struct rpcap_header *header;		/* general header according to the RPCAP format */
	struct rpcap_pkthdr *net_pkt_header;	/* header of the packet */
	char netbuf[RPCAP_NETBUF_SIZE];		/* size of the network buffer in which the packet is copied, just for UDP */
	uint32 totread;				/* number of bytes (of payload) currently read from the network (referred to the current pkt) */
	int nread;
	int retval;				/* generic return value */

	/* Structures needed for the select() call */
	fd_set rfds;				/* set of socket descriptors we have to check */
	struct timeval tv;			/* maximum time the select() can block waiting for data */
	struct pcap_md *md;			/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)p->priv + sizeof(struct pcap_win));

	/*
	 * Define the read timeout, to be used in the select()
	 * 'timeout', in pcap_t, is in milliseconds; we have to convert it into sec and microsec
	 */
	tv.tv_sec = p->opt.timeout / 1000;
	tv.tv_usec = (p->opt.timeout - tv.tv_sec * 1000) * 1000;

	/* Watch out sockdata to see if it has input */
	FD_ZERO(&rfds);

	/*
	 * 'fp->rmt_sockdata' has always to be set before calling the select(),
	 * since it is cleared by the select()
	 */
	FD_SET(md->rmt_sockdata, &rfds);

	retval = select((int) md->rmt_sockdata + 1, &rfds, NULL, NULL, &tv);
	if (retval == -1)
	{
		sock_geterror("select(): ", p->errbuf, PCAP_ERRBUF_SIZE);
		return -1;
	}

	/* There is no data waiting, so return '0' */
	if (retval == 0)
		return 0;

	/*
	 * data is here; so, let's copy it into the user buffer.
	 * I'm going to read a new packet; so I reset the number of bytes (payload only) read
	 */
	totread = 0;

	/*
	 * We have to define 'header' as a pointer to a larger buffer,
	 * because in case of UDP we have to read all the message within a single call
	 */
	header = (struct rpcap_header *) netbuf;
	net_pkt_header = (struct rpcap_pkthdr *) (netbuf + sizeof(struct rpcap_header));

	if (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP)
	{
		/* Read the entire message from the network */
		if (sock_recv(md->rmt_sockdata, netbuf, RPCAP_NETBUF_SIZE, SOCK_RECEIVEALL_NO, p->errbuf, PCAP_ERRBUF_SIZE) == -1)
			return -1;
	}
	else
	{
		if (sock_recv(md->rmt_sockdata, netbuf, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, p->errbuf, PCAP_ERRBUF_SIZE) == -1)
			return -1;
	}

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(p->errbuf, md->rmt_sockdata, header, RPCAP_MSG_PACKET, 0);

	if (retval != RPCAP_MSG_PACKET)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
			return -1;	/* Do nothing; just exit from here; the error code is already into the errbuf */

		case -2:		/* The other endpoint sent a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			return 0;	/* Return 'no packets received' */

		default:
			SOCK_ASSERT("Internal error", 1);
			return 0;	/* Return 'no packets received' */
		}
	}

	/* In case of TCP, read the remaining of the packet from the socket */
	if (!(md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP))
	{
		/* Read the RPCAP packet header from the network */
		nread = sock_recv(md->rmt_sockdata, (char *)net_pkt_header,
		    sizeof(struct rpcap_pkthdr), SOCK_RECEIVEALL_YES,
		    p->errbuf, PCAP_ERRBUF_SIZE);
		if (nread == -1)
			return -1;
		totread += nread;
	}

	if ((ntohl(net_pkt_header->caplen) + sizeof(struct pcap_pkthdr)) <= p->bufsize)
	{
		/* Initialize returned structures */
		*pkt_header = (struct pcap_pkthdr *) p->buffer;
		*pkt_data = (u_char*)p->buffer + sizeof(struct pcap_pkthdr);

		(*pkt_header)->caplen = ntohl(net_pkt_header->caplen);
		(*pkt_header)->len = ntohl(net_pkt_header->len);
		(*pkt_header)->ts.tv_sec = ntohl(net_pkt_header->timestamp_sec);
		(*pkt_header)->ts.tv_usec = ntohl(net_pkt_header->timestamp_usec);

		/*
		 * I don't update the counter of the packets dropped by the network since we're using TCP,
		 * therefore no packets are dropped. Just update the number of packets received correctly
		 */
		md->TotCapt++;

		/* Copies the packet into the data buffer */
		if (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP)
		{
			unsigned int npkt;

			/*
			 * In case of UDP the packet has already been read, we have to copy it into 'buffer'.
			 * Another option should be to declare 'netbuf' as 'static'. However this prevents
			 * using several pcap instances within the same process (because the static buffer is shared among
			 * all processes)
			 */
			memcpy(*pkt_data, netbuf + sizeof(struct rpcap_header) + sizeof(struct rpcap_pkthdr), (*pkt_header)->caplen);

			/* We're using UDP, so we need to update the counter of the packets dropped by the network */
			npkt = ntohl(net_pkt_header->npkt);

			if (md->TotCapt != npkt)
			{
				md->TotNetDrops += (npkt - md->TotCapt);
				md->TotCapt = npkt;
			}

		}
		else
		{
			/* In case of TCP, read the remaining of the packet from the socket */
			nread = sock_recv(md->rmt_sockdata, *pkt_data,
			    (*pkt_header)->caplen, SOCK_RECEIVEALL_YES,
			    p->errbuf, PCAP_ERRBUF_SIZE);
			if (nread == -1)
				return -1;
			totread += nread;

			/* Checks if all the data has been read; if not, discard the data in excess */
			/* This check has to be done only on TCP connections */
			if (totread != ntohl(header->plen))
				sock_discard(md->rmt_sockdata, ntohl(header->plen) - totread, NULL, 0);
		}


		/* Packet read successfully */
		return 1;
	}
	else
	{
		pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Received a packet that is larger than the internal buffer size.");
		return -1;
	}

}

/* \ingroup remote_pri_func
 *
 * \brief It reads a packet from the network socket.
 *
 * This function is called by the several pcap_read() when they detect that
 * we have a remote capture and they are the client side. In that case, they need
 * to read packets from the socket.
 *
 * This function relies on the pcap_read_nocb_remote to deliver packets. The
 * difference, here, is that as soon as a packet is read, it is delivered
 * to the application by means of a callback function.
 *
 * Parameters and return values are exactly the same of the pcap_read().
 */
static int pcap_read_remote(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
	struct pcap_pkthdr *pkt_header;
	u_char *pkt_data;
	int n = 0;

	while ((n < cnt) || (cnt < 0))
	{
		if (pcap_read_nocb_remote(p, &pkt_header, &pkt_data) == 1)
		{
			(*callback)(user, pkt_header, pkt_data);
			n++;
		}
		else
			return n;
	}
	return n;
}

/* \ingroup remote_pri_func
 *
 * \brief It sends a CLOSE command to the capture server.
 *
 * This function is called when the user wants to close a pcap_t adapter.
 * In case we're capturing from the network, it sends a command to the other
 * peer that says 'ok, let's stop capturing'.
 * This function is called automatically when the user calls the pcap_close().
 *
 * Parameters and return values are exactly the same of the pcap_close().
 *
 * \warning Since we're closing the connection, we do not check for errors.
 */
static void pcap_cleanup_remote(pcap_t *fp)
{
	struct rpcap_header header;		/* header of the RPCAP packet */
	struct activehosts *temp;		/* temp var needed to scan the host list chain, to detect if we're in active mode */
	int active = 0;					/* active mode or not? */
	struct pcap_md *md;				/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));

	/* detect if we're in active mode */
	temp = activeHosts;
	while (temp)
	{
		if (temp->sockctrl == md->rmt_sockctrl)
		{
			active = 1;
			break;
		}
		temp = temp->next;
	}

	if (!active)
	{
		rpcap_createhdr(&header, RPCAP_MSG_CLOSE, 0, 0);

		/* I don't check for errors, since I'm going to close everything */
		sock_send(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), NULL, 0);
	}
	else
	{
		rpcap_createhdr(&header, RPCAP_MSG_ENDCAP_REQ, 0, 0);

		/* I don't check for errors, since I'm going to close everything */
		sock_send(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), NULL, 0);

		/* wait for the answer */
		/* Don't check what we got, since the present libpcap does not uses this pcap_t anymore */
		sock_recv(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, NULL, 0);

		if (ntohl(header.plen) != 0)
			sock_discard(md->rmt_sockctrl, ntohl(header.plen), NULL, 0);
	}

	if (md->rmt_sockdata)
	{
		sock_close(md->rmt_sockdata, NULL, 0);
		md->rmt_sockdata = 0;
	}

	if ((!active) && (md->rmt_sockctrl))
		sock_close(md->rmt_sockctrl, NULL, 0);

	md->rmt_sockctrl = 0;

	if (md->currentfilter)
	{
		free(md->currentfilter);
		md->currentfilter = NULL;
	}

	/* To avoid inconsistencies in the number of sock_init() */
	sock_cleanup();
}

/* \ingroup remote_pri_func
 *
 * \brief It retrieves network statistics from the other peer.
 *
 * This function is just a void cointainer, since the work is done by the rpcap_stats_remote().
 * See that funcion for more details.
 *
 * Parameters and return values are exactly the same of the pcap_stats().
 */
static int pcap_stats_remote(pcap_t *p, struct pcap_stat *ps)
{
	struct pcap_stat *retval;

	retval = rpcap_stats_remote(p, ps, PCAP_STATS_STANDARD);

	if (retval)
		return 0;
	else
		return -1;
}

#ifdef _WIN32
/* \ingroup remote_pri_func
 *
 * \brief It retrieves network statistics from the other peer.
 *
 * This function is just a void cointainer, since the work is done by the rpcap_stats_remote().
 * See that funcion for more details.
 *
 * Parameters and return values are exactly the same of the pcap_stats_ex().
 */
static struct pcap_stat *pcap_stats_ex_remote(pcap_t *p, int *pcap_stat_size)
{
	*pcap_stat_size = sizeof (p->stat);

	/* PCAP_STATS_EX (third param) means 'extended pcap_stats()' */
	return (rpcap_stats_remote(p, &(p->stat), PCAP_STATS_EX));
}
#endif

/* \ingroup remote_pri_func
 *
 * \brief It retrieves network statistics from the other peer.
 *
 * This function can be called in two modes:
 * - PCAP_STATS_STANDARD: if we want just standard statistics (i.e. the pcap_stats() )
 * - PCAP_STATS_EX: if we want extended statistics (i.e. the pcap_stats_ex() )
 *
 * This 'mode' parameter is needed because in the standard pcap_stats() the variable that keeps the
 * statistics is allocated by the user. Unfortunately, this structure has been extended in order
 * to keep new stats. However, if the user has a smaller structure and it passes it to the pcap_stats,
 * thid function will try to fill in more data than the size of the structure, so that the application
 * goes in memory overflow.
 * So, we need to know it we have to copy just the standard fields, or the extended fields as well.
 *
 * In case we want to copy the extended fields as well, the problem of memory overflow does no
 * longer exist because the structure pcap_stat is no longer allocated by the program;
 * it is allocated by the library instead.
 *
 * \param p: the pcap_t structure related to the current instance.
 *
 * \param ps: a 'pcap_stat' structure, needed for compatibility with pcap_stat(), in which
 * the structure is allocated by the user. In case of pcap_stats_ex, this structure and the
 * function return value point to the same variable.
 *
 * \param mode: one of PCAP_STATS_STANDARD or PCAP_STATS_EX.
 *
 * \return The structure that keeps the statistics, or NULL in case of error.
 * The error string is placed in the pcap_t structure.
 */
static struct pcap_stat *rpcap_stats_remote(pcap_t *p, struct pcap_stat *ps, int mode)
{
	struct rpcap_header header;		/* header of the RPCAP packet */
	struct rpcap_stats netstats;		/* statistics sent on the network */
	uint32 totread = 0;			/* number of bytes of the payload read from the socket */
	int nread;
	int retval;				/* temp variable which stores functions return value */
	struct pcap_md *md;			/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)p->priv + sizeof(struct pcap_win));

	/*
	 * If the capture has still to start, we cannot ask statistics to the other peer,
	 * so we return a fake number
	 */
	if (!md->rmt_capstarted)
	{
		if (mode == PCAP_STATS_STANDARD)
		{
			ps->ps_drop = 0;
			ps->ps_ifdrop = 0;
			ps->ps_recv = 0;
		}
		else
		{
			ps->ps_capt = 0;
			ps->ps_drop = 0;
			ps->ps_ifdrop = 0;
			ps->ps_netdrop = 0;
			ps->ps_recv = 0;
			ps->ps_sent = 0;
		}

		return ps;
	}

	rpcap_createhdr(&header, RPCAP_MSG_STATS_REQ, 0, 0);

	/* Send the PCAP_STATS command */
	if (sock_send(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), p->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	/* Receive the RPCAP stats reply message */
	if (sock_recv(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, p->errbuf, PCAP_ERRBUF_SIZE) == -1)
		goto error;

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(p->errbuf, md->rmt_sockctrl, &header, RPCAP_MSG_STATS_REPLY, RPCAP_MSG_ERROR, 0);

	if (retval != RPCAP_MSG_STATS_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint send a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			goto error;

		case RPCAP_MSG_ERROR:		/* The other endpoint reported an error */
			/* Update totread, since the rpcap_checkmsg() already purged the buffer */
			totread = ntohl(header.plen);

			/* Do nothing; just exit; the error code is already into the errbuf */
			goto error;

		default:
			pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Internal error");
			goto error;
		}
	}

	nread = sock_recv(md->rmt_sockctrl, (char *)&netstats,
	    sizeof(struct rpcap_stats), SOCK_RECEIVEALL_YES,
	    p->errbuf, PCAP_ERRBUF_SIZE);
	if (nread == -1)
		goto error;
	totread += nread;

	if (mode == PCAP_STATS_STANDARD)
	{
		ps->ps_drop = ntohl(netstats.krnldrop);
		ps->ps_ifdrop = ntohl(netstats.ifdrop);
		ps->ps_recv = ntohl(netstats.ifrecv);
	}
	else
	{
		ps->ps_capt = md->TotCapt;
		ps->ps_drop = ntohl(netstats.krnldrop);
		ps->ps_ifdrop = ntohl(netstats.ifdrop);
		ps->ps_netdrop = md->TotNetDrops;
		ps->ps_recv = ntohl(netstats.ifrecv);
		ps->ps_sent = ntohl(netstats.svrcapt);
	}

	/* Checks if all the data has been read; if not, discard the data in excess */
	if (totread != ntohl(header.plen))
	{
		if (sock_discard(md->rmt_sockctrl, ntohl(header.plen) - totread, NULL, 0) == 1)
			goto error;
	}

	return ps;

error:
	if (totread != ntohl(header.plen))
		sock_discard(md->rmt_sockctrl, ntohl(header.plen) - totread, NULL, 0);

	return NULL;
}

/* \ingroup remote_pri_func
 *
 * \brief It opens a remote adapter by opening an RPCAP connection and so on.
 *
 * This function does basically the job of pcap_open_live() for a remote interface.
 * In other words, we have a pcap_read for win32, which reads packets from NPF,
 * another for LINUX, and so on. Now, we have a pcap_opensource_remote() as well.
 * The difference, here, is the capture thread does not start until the
 * pcap_startcapture_remote() is called.
 *
 * This is because, in remote capture, we cannot start capturing data as soon ad the
 * 'open adapter' command is sent. Suppose the remote adapter is already overloaded;
 * if we start a capture (which, by default, has a NULL filter) the new traffic can
 * saturate the network.
 *
 * Instead, we want to "open" the adapter, then send a "start capture" command only
 * when we're ready to start the capture.
 * This funtion does this job: it sends a "open adapter" command (according to the
 * RPCAP protocol), but it does not start the capture.
 *
 * Since the other libpcap functions do not share this way of life, we have to make
 * some dirty things in order to make everyting working.
 *
 * \param fp: A pointer to a pcap_t structure that has been previously created with
 * \ref pcap_create().
 * \param source: see pcap_open().
 * \param auth: see pcap_open().
 *
 * \return 0 in case of success, -1 otherwise. In case of success, the pcap_t pointer in fp can be
 * used as a parameter to the following calls (pcap_compile() and so on). In case of
 * problems, fp->errbuf contains a text explanation of error.
 *
 * \warning In case we call the pcap_compile() and the capture is not started, the filter
 * will be saved into the pcap_t structure, and it will be sent to the other host later
 * (when the pcap_startcapture_remote() is called).
 */
int pcap_opensource_remote(pcap_t *fp, struct pcap_rmtauth *auth)
{
	char host[PCAP_BUF_SIZE], ctrlport[PCAP_BUF_SIZE], iface[PCAP_BUF_SIZE];

	char sendbuf[RPCAP_NETBUF_SIZE];	/* temporary buffer in which data to be sent is buffered */
	int sendbufidx = 0;			/* index which keeps the number of bytes currently buffered */
	uint32 totread = 0;			/* number of bytes of the payload read from the socket */
	int nread;
	int retval;				/* store the return value of the functions */
	int active = 0;				/* '1' if we're in active mode */

	/* socket-related variables */
	struct addrinfo hints;			/* temp, needed to open a socket connection */
	struct addrinfo *addrinfo;		/* temp, needed to open a socket connection */
	SOCKET sockctrl = 0;			/* socket descriptor of the control connection */

	/* RPCAP-related variables */
	struct rpcap_header header;		/* header of the RPCAP packet */
	struct rpcap_openreply openreply;	/* open reply message */

	struct pcap_md *md;			/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));


	/*
	 * determine the type of the source (NULL, file, local, remote)
	 * You must have a valid source string even if we're in active mode, because otherwise
	 * the call to the following function will fail.
	 */
	if (pcap_parsesrcstr(fp->opt.device, &retval, host, ctrlport, iface, fp->errbuf) == -1)
		return -1;

	if (retval != PCAP_SRC_IFREMOTE)
	{
		pcap_snprintf(fp->errbuf, PCAP_ERRBUF_SIZE, "This function is able to open only remote interfaces");
		return -1;
	}

	addrinfo = NULL;

	/*
	 * Warning: this call can be the first one called by the user.
	 * For this reason, we have to initialize the WinSock support.
	 */
	if (sock_init(fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
		return -1;

	sockctrl = rpcap_remoteact_getsock(host, &active, fp->errbuf);
	if (sockctrl == INVALID_SOCKET)
		return -1;

	if (!active)
	{
		/*
		 * We're not in active mode; let's try to open a new
		 * control connection.
		 */
		memset(&hints, 0, sizeof(struct addrinfo));
		hints.ai_family = PF_UNSPEC;
		hints.ai_socktype = SOCK_STREAM;

		if ((ctrlport == NULL) || (ctrlport[0] == 0))
		{
			/* the user chose not to specify the port */
			if (sock_initaddress(host, RPCAP_DEFAULT_NETPORT, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
				return -1;
		}
		else
		{
			/* the user chose not to specify the port */
			if (sock_initaddress(host, ctrlport, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
				return -1;
		}

		if ((sockctrl = sock_open(addrinfo, SOCKOPEN_CLIENT, 0, fp->errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
			goto error;

		freeaddrinfo(addrinfo);
		addrinfo = NULL;

		if (rpcap_sendauth(sockctrl, auth, fp->errbuf) == -1)
			goto error;
	}

	/*
	 * Now it's time to start playing with the RPCAP protocol
	 * RPCAP open command: create the request message
	 */
	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_OPEN_REQ, 0, (uint32) strlen(iface));

	if (sock_bufferize(iface, (int) strlen(iface), sendbuf, &sendbufidx,
		RPCAP_NETBUF_SIZE, SOCKBUF_BUFFERIZE, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	if (sock_send(sockctrl, sendbuf, sendbufidx, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	/* Receive the RPCAP open reply message */
	if (sock_recv(sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
		goto error;

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(fp->errbuf, sockctrl, &header, RPCAP_MSG_OPEN_REPLY, RPCAP_MSG_ERROR, 0);

	if (retval != RPCAP_MSG_OPEN_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint send a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			goto error;

		case RPCAP_MSG_ERROR:		/* The other endpoint reported an error */
			/* Update totread, since the rpcap_checkmsg() already purged the buffer */
			totread = ntohl(header.plen);
			/* Do nothing; just exit; the error code is already into the errbuf */
			goto error;

		default:
			pcap_snprintf(fp->errbuf, PCAP_ERRBUF_SIZE, "Internal error");
			goto error;
		}
	}

	nread = sock_recv(sockctrl, (char *)&openreply,
	    sizeof(struct rpcap_openreply), SOCK_RECEIVEALL_YES,
	    fp->errbuf, PCAP_ERRBUF_SIZE);
	if (nread == -1)
		goto error;
	totread += nread;

	/* Set proper fields into the pcap_t struct */
	fp->linktype = ntohl(openreply.linktype);
	fp->tzoff = ntohl(openreply.tzoff);
	md->rmt_sockctrl = sockctrl;
	md->rmt_clientside = 1;


	/* This code is duplicated from the end of this function */
	fp->read_op = pcap_read_remote;
	fp->setfilter_op = pcap_setfilter_remote;
	fp->getnonblock_op = NULL;	/* This is not implemented in remote capture */
	fp->setnonblock_op = NULL;	/* This is not implemented in remote capture */
	fp->stats_op = pcap_stats_remote;
#ifdef _WIN32
	fp->stats_ex_op = pcap_stats_ex_remote;
#endif
	fp->cleanup_op = pcap_cleanup_remote;

	/* Checks if all the data has been read; if not, discard the data in excess */
	if (totread != ntohl(header.plen))
	{
		if (sock_discard(sockctrl, ntohl(header.plen) - totread, NULL, 0) == 1)
			goto error;
	}
	return 0;

error:
	/*
	 * When the connection has been established, we have to close it. So, at the
	 * beginning of this function, if an error occur we return immediately with
	 * a return NULL; when the connection is established, we have to come here
	 * ('goto error;') in order to close everything properly.
	 *
	 * Checks if all the data has been read; if not, discard the data in excess
	 */
	if (totread != ntohl(header.plen))
		sock_discard(sockctrl, ntohl(header.plen) - totread, NULL, 0);

	if (addrinfo)
		freeaddrinfo(addrinfo);

	if (!active)
		sock_close(sockctrl, NULL, 0);

	return -1;
}

/* \ingroup remote_pri_func
 *
 * \brief It starts a remote capture.
 *
 * This function is requires since the RPCAP protocol decouples the 'open' from the
 * 'start capture' functions.
 * This function takes all the parameters needed (which have been stored into the pcap_t structure)
 * and sends them to the server.
 * If everything is fine, it creates a new child thread that reads data from the network
 * and puts data it into the user buffer.
 * The pcap_read() will read data from the user buffer, as usual.
 *
 * The remote capture acts like a new "kernel", which puts packets directly into
 * the buffer pointed by pcap_t.
 * In fact, this function does not rely on a kernel that reads packets and put them
 * into the user buffer; it has to do that on its own.
 *
 * \param fp: the pcap_t descriptor of the device currently open.
 *
 * \return '0' if everything is fine, '-1' otherwise. The error message (if one)
 * is returned into the 'errbuf' field of the pcap_t structure.
 */
int pcap_startcapture_remote(pcap_t *fp)
{
	char sendbuf[RPCAP_NETBUF_SIZE];	/* temporary buffer in which data to be sent is buffered */
	int sendbufidx = 0;			/* index which keeps the number of bytes currently buffered */
	char portdata[PCAP_BUF_SIZE];		/* temp variable needed to keep the network port for the the data connection */
	uint32 totread = 0;			/* number of bytes of the payload read from the socket */
	int nread;
	int retval;				/* store the return value of the functions */
	int active = 0;				/* '1' if we're in active mode */
	struct activehosts *temp;		/* temp var needed to scan the host list chain, to detect if we're in active mode */
	char host[INET6_ADDRSTRLEN + 1];	/* numeric name of the other host */

	/* socket-related variables*/
	struct addrinfo hints;			/* temp, needed to open a socket connection */
	struct addrinfo *addrinfo;		/* temp, needed to open a socket connection */
	SOCKET sockdata = 0;			/* socket descriptor of the data connection */
	struct sockaddr_storage saddr;		/* temp, needed to retrieve the network data port chosen on the local machine */
	socklen_t saddrlen;			/* temp, needed to retrieve the network data port chosen on the local machine */
	int ai_family;				/* temp, keeps the address family used by the control connection */

	/* RPCAP-related variables*/
	struct rpcap_header header;			/* header of the RPCAP packet */
	struct rpcap_startcapreq *startcapreq;		/* start capture request message */
	struct rpcap_startcapreply startcapreply;	/* start capture reply message */

	/* Variables related to the buffer setting */
	int res, itemp;
	int sockbufsize = 0;

	struct pcap_md *md;			/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));

	/*
	 * Let's check if sampling has been required.
	 * If so, let's set it first
	 */
	if (pcap_setsampling_remote(fp) != 0)
		return -1;


	/* detect if we're in active mode */
	temp = activeHosts;
	while (temp)
	{
		if (temp->sockctrl == md->rmt_sockctrl)
		{
			active = 1;
			break;
		}
		temp = temp->next;
	}

	addrinfo = NULL;

	/*
	 * Gets the complete sockaddr structure used in the ctrl connection
	 * This is needed to get the address family of the control socket
	 * Tip: I cannot save the ai_family of the ctrl sock in the pcap_t struct,
	 * since the ctrl socket can already be open in case of active mode;
	 * so I would have to call getpeername() anyway
	 */
	saddrlen = sizeof(struct sockaddr_storage);
	if (getpeername(md->rmt_sockctrl, (struct sockaddr *) &saddr, &saddrlen) == -1)
	{
		sock_geterror("getsockname(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
		goto error;
	}
	ai_family = ((struct sockaddr_storage *) &saddr)->ss_family;

	/* Get the numeric address of the remote host we are connected to */
	if (getnameinfo((struct sockaddr *) &saddr, saddrlen, host,
		sizeof(host), NULL, 0, NI_NUMERICHOST))
	{
		sock_geterror("getnameinfo(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
		goto error;
	}

	/*
	 * Data connection is opened by the server toward the client if:
	 * - we're using TCP, and the user wants us to be in active mode
	 * - we're using UDP
	 */
	if ((active) || (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP))
	{
		/*
		 * We have to create a new socket to receive packets
		 * We have to do that immediately, since we have to tell the other
		 * end which network port we picked up
		 */
		memset(&hints, 0, sizeof(struct addrinfo));
		/* TEMP addrinfo is NULL in case of active */
		hints.ai_family = ai_family;	/* Use the same address family of the control socket */
		hints.ai_socktype = (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP) ? SOCK_DGRAM : SOCK_STREAM;
		hints.ai_flags = AI_PASSIVE;	/* Data connection is opened by the server toward the client */

		/* Let's the server pick up a free network port for us */
		if (sock_initaddress(NULL, "0", &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
			goto error;

		if ((sockdata = sock_open(addrinfo, SOCKOPEN_SERVER,
			1 /* max 1 connection in queue */, fp->errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
			goto error;

		/* addrinfo is no longer used */
		freeaddrinfo(addrinfo);
		addrinfo = NULL;

		/* get the complete sockaddr structure used in the data connection */
		saddrlen = sizeof(struct sockaddr_storage);
		if (getsockname(sockdata, (struct sockaddr *) &saddr, &saddrlen) == -1)
		{
			sock_geterror("getsockname(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			goto error;
		}

		/* Get the local port the system picked up */
		if (getnameinfo((struct sockaddr *) &saddr, saddrlen, NULL,
			0, portdata, sizeof(portdata), NI_NUMERICSERV))
		{
			sock_geterror("getnameinfo(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			goto error;
		}
	}

	/*
	 * Now it's time to start playing with the RPCAP protocol
	 * RPCAP start capture command: create the request message
	 */
	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_STARTCAP_REQ, 0,
		sizeof(struct rpcap_startcapreq) + sizeof(struct rpcap_filter) + fp->fcode.bf_len * sizeof(struct rpcap_filterbpf_insn));

	/* Fill the structure needed to open an adapter remotely */
	startcapreq = (struct rpcap_startcapreq *) &sendbuf[sendbufidx];

	if (sock_bufferize(NULL, sizeof(struct rpcap_startcapreq), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;

	memset(startcapreq, 0, sizeof(struct rpcap_startcapreq));

	/* By default, apply half the timeout on one side, half of the other */
	fp->opt.timeout = fp->opt.timeout / 2;
	startcapreq->read_timeout = htonl(fp->opt.timeout);

	/* portdata on the openreq is meaningful only if we're in active mode */
	if ((active) || (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP))
	{
		sscanf(portdata, "%d", (int *)&(startcapreq->portdata));	/* cast to avoid a compiler warning */
		startcapreq->portdata = htons(startcapreq->portdata);
	}

	startcapreq->snaplen = htonl(fp->snapshot);
	startcapreq->flags = 0;

	if (md->rmt_flags & PCAP_OPENFLAG_PROMISCUOUS)
		startcapreq->flags |= RPCAP_STARTCAPREQ_FLAG_PROMISC;
	if (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP)
		startcapreq->flags |= RPCAP_STARTCAPREQ_FLAG_DGRAM;
	if (active)
		startcapreq->flags |= RPCAP_STARTCAPREQ_FLAG_SERVEROPEN;

	startcapreq->flags = htons(startcapreq->flags);

	/* Pack the capture filter */
	if (pcap_pack_bpffilter(fp, &sendbuf[sendbufidx], &sendbufidx, &fp->fcode))
		goto error;

	if (sock_send(md->rmt_sockctrl, sendbuf, sendbufidx, fp->errbuf, PCAP_ERRBUF_SIZE))
		goto error;


	/* Receive the RPCAP start capture reply message */
	if (sock_recv(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
		goto error;

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(fp->errbuf, md->rmt_sockctrl, &header, RPCAP_MSG_STARTCAP_REPLY, RPCAP_MSG_ERROR, 0);

	if (retval != RPCAP_MSG_STARTCAP_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint send a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			goto error;

		case RPCAP_MSG_ERROR:		/* The other endpoint reported an error */
			/* Update totread, since the rpcap_checkmsg() already purged the buffer */
			totread = ntohl(header.plen);
			/* Do nothing; just exit; the error code is already into the errbuf */
			goto error;

		default:
			pcap_snprintf(fp->errbuf, PCAP_ERRBUF_SIZE, "Internal error");
			goto error;
		}
	}

	nread = sock_recv(md->rmt_sockctrl, (char *)&startcapreply,
	    sizeof(struct rpcap_startcapreply), SOCK_RECEIVEALL_YES,
	    fp->errbuf, PCAP_ERRBUF_SIZE);
	if (nread == -1)
		goto error;
	totread += nread;

	/*
	 * In case of UDP data stream, the connection is always opened by the daemon
	 * So, this case is already covered by the code above.
	 * Now, we have still to handle TCP connections, because:
	 * - if we're in active mode, we have to wait for a remote connection
	 * - if we're in passive more, we have to start a connection
	 *
	 * We have to do he job in two steps because in case we're opening a TCP connection, we have
	 * to tell the port we're using to the remote side; in case we're accepting a TCP
	 * connection, we have to wait this info from the remote side.
	 */

	if (!(md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP))
	{
		if (!active)
		{
			memset(&hints, 0, sizeof(struct addrinfo));
			hints.ai_family = ai_family;		/* Use the same address family of the control socket */
			hints.ai_socktype = (md->rmt_flags & PCAP_OPENFLAG_DATATX_UDP) ? SOCK_DGRAM : SOCK_STREAM;
			pcap_snprintf(portdata, PCAP_BUF_SIZE, "%d", ntohs(startcapreply.portdata));

			/* Let's the server pick up a free network port for us */
			if (sock_initaddress(host, portdata, &hints, &addrinfo, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
				goto error;

			if ((sockdata = sock_open(addrinfo, SOCKOPEN_CLIENT, 0, fp->errbuf, PCAP_ERRBUF_SIZE)) == INVALID_SOCKET)
				goto error;

			/* addrinfo is no longer used */
			freeaddrinfo(addrinfo);
			addrinfo = NULL;
		}
		else
		{
			SOCKET socktemp;	/* We need another socket, since we're going to accept() a connection */

			/* Connection creation */
			saddrlen = sizeof(struct sockaddr_storage);

			socktemp = accept(sockdata, (struct sockaddr *) &saddr, &saddrlen);

			if (socktemp == -1)
			{
				sock_geterror("accept(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
				goto error;
			}

			/* Now that I accepted the connection, the server socket is no longer needed */
			sock_close(sockdata, fp->errbuf, PCAP_ERRBUF_SIZE);
			sockdata = socktemp;
		}
	}

	/* Let's save the socket of the data connection */
	md->rmt_sockdata = sockdata;

	/* Allocates WinPcap/libpcap user buffer, which is a socket buffer in case of a remote capture */
	/* It has the same size of the one used on the other side of the connection */
	fp->bufsize = ntohl(startcapreply.bufsize);

	/* Let's get the actual size of the socket buffer */
	itemp = sizeof(sockbufsize);

	res = getsockopt(sockdata, SOL_SOCKET, SO_RCVBUF, (char *)&sockbufsize, &itemp);
	if (res == -1)
	{
		sock_geterror("pcap_startcapture_remote()", fp->errbuf, PCAP_ERRBUF_SIZE);
		SOCK_ASSERT(fp->errbuf, 1);
	}

	/*
	 * Warning: on some kernels (e.g. Linux), the size of the user buffer does not take
	 * into account the pcap_header and such, and it is set equal to the snaplen.
	 * In my view, this is wrong (the meaning of the bufsize became a bit strange).
	 * So, here bufsize is the whole size of the user buffer.
	 * In case the bufsize returned is too small, let's adjust it accordingly.
	 */
	if (fp->bufsize <= (u_int) fp->snapshot)
		fp->bufsize += sizeof(struct pcap_pkthdr);

	/* if the current socket buffer is smaller than the desired one */
	if ((u_int) sockbufsize < fp->bufsize)
	{
		/* Loop until the buffer size is OK or the original socket buffer size is larger than this one */
		while (1)
		{
			res = setsockopt(sockdata, SOL_SOCKET, SO_RCVBUF, (char *)&(fp->bufsize), sizeof(fp->bufsize));

			if (res == 0)
				break;

			/*
			 * If something goes wrong, half the buffer size (checking that it does not become smaller than
			 * the current one)
			 */
			fp->bufsize /= 2;

			if ((u_int) sockbufsize >= fp->bufsize)
			{
				fp->bufsize = sockbufsize;
				break;
			}
		}
	}

	/*
	 * Let's allocate the packet; this is required in order to put the packet somewhere when
	 * extracting data from the socket
	 * Since buffering has already been done in the socket buffer, here we need just a buffer,
	 * whose size is equal to the pcap header plus the snapshot length
	 */
	fp->bufsize = fp->snapshot + sizeof(struct pcap_pkthdr);

	fp->buffer = (u_char *)malloc(fp->bufsize);
	if (fp->buffer == NULL)
	{
		pcap_snprintf(fp->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
		goto error;
	}


	/* Checks if all the data has been read; if not, discard the data in excess */
	if (totread != ntohl(header.plen))
	{
		if (sock_discard(md->rmt_sockctrl, ntohl(header.plen) - totread, NULL, 0) == 1)
			goto error;
	}

	/*
	 * In case the user does not want to capture RPCAP packets, let's update the filter
	 * We have to update it here (instead of sending it into the 'StartCapture' message
	 * because when we generate the 'start capture' we do not know (yet) all the ports
	 * we're currently using.
	 */
	if (md->rmt_flags & PCAP_OPENFLAG_NOCAPTURE_RPCAP)
	{
		struct bpf_program fcode;

		if (pcap_createfilter_norpcappkt(fp, &fcode) == -1)
			goto error;

		/* We cannot use 'pcap_setfilter_remote' because formally the capture has not been started yet */
		/* (the 'fp->rmt_capstarted' variable will be updated some lines below) */
		if (pcap_updatefilter_remote(fp, &fcode) == -1)
			goto error;

		pcap_freecode(&fcode);
	}

	md->rmt_capstarted = 1;
	return 0;

error:
	/*
	 * When the connection has been established, we have to close it. So, at the
	 * beginning of this function, if an error occur we return immediately with
	 * a return NULL; when the connection is established, we have to come here
	 * ('goto error;') in order to close everything properly.
	 *
	 * Checks if all the data has been read; if not, discard the data in excess
	 */
	if (totread != ntohl(header.plen))
		sock_discard(md->rmt_sockctrl, ntohl(header.plen) - totread, NULL, 0);

	if ((sockdata) && (sockdata != -1))		/* we can be here because sockdata said 'error' */
		sock_close(sockdata, NULL, 0);

	if (!active)
		sock_close(md->rmt_sockctrl, NULL, 0);

	/*
	 * We do not have to call pcap_close() here, because this function is always called
	 * by the user in case something bad happens
	 */
	// 	if (fp)
	// 	{
	// 		pcap_close(fp);
	// 		fp= NULL;
	// 	}

	return -1;
}

/*
 * \brief Takes a bpf program and sends it to the other host.
 *
 * This function can be called in two cases:
 * - the pcap_startcapture() is called (we have to send the filter along with
 * the 'start capture' command)
 * - we want to udpate the filter during a capture (i.e. the pcap_setfilter()
 * is called when the capture is still on)
 *
 * This function serializes the filter into the sending buffer ('sendbuf', passed
 * as a parameter) and return back. It does not send anything on the network.
 *
 * \param fp: the pcap_t descriptor of the device currently opened.
 *
 * \param sendbuf: the buffer on which the serialized data has to copied.
 *
 * \param sendbufidx: it is used to return the abounf of bytes copied into the buffer.
 *
 * \param prog: the bpf program we have to copy.
 *
 * \return '0' if everything is fine, '-1' otherwise. The error message (if one)
 * is returned into the 'errbuf' field of the pcap_t structure.
 */
static int pcap_pack_bpffilter(pcap_t *fp, char *sendbuf, int *sendbufidx, struct bpf_program *prog)
{
	struct rpcap_filter *filter;
	struct rpcap_filterbpf_insn *insn;
	struct bpf_insn *bf_insn;
	struct bpf_program fake_prog;		/* To be used just in case the user forgot to set a filter */
	unsigned int i;


	if (prog->bf_len == 0)	/* No filters have been specified; so, let's apply a "fake" filter */
	{
		if (pcap_compile(fp, &fake_prog, NULL /* buffer */, 1, 0) == -1)
			return -1;

		prog = &fake_prog;
	}

	filter = (struct rpcap_filter *) sendbuf;

	if (sock_bufferize(NULL, sizeof(struct rpcap_filter), NULL, sendbufidx,
		RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	filter->filtertype = htons(RPCAP_UPDATEFILTER_BPF);
	filter->nitems = htonl((int32)prog->bf_len);

	if (sock_bufferize(NULL, prog->bf_len * sizeof(struct rpcap_filterbpf_insn),
		NULL, sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	insn = (struct rpcap_filterbpf_insn *) (filter + 1);
	bf_insn = prog->bf_insns;

	for (i = 0; i < prog->bf_len; i++)
	{
		insn->code = htons(bf_insn->code);
		insn->jf = bf_insn->jf;
		insn->jt = bf_insn->jt;
		insn->k = htonl(bf_insn->k);

		insn++;
		bf_insn++;
	}

	return 0;
}

/* \ingroup remote_pri_func
 *
 * \brief Update a filter on a remote host.
 *
 * This function is called when the user wants to update a filter.
 * In case we're capturing from the network, it sends the filter to the other peer.
 * This function is *not* called automatically when the user calls the pcap_setfilter().
 * There will be two cases:
 * - the capture is already on: in this case, pcap_setfilter() calls pcap_updatefilter_remote()
 * - the capture has not started yet: in this case, pcap_setfilter() stores the filter into
 * the pcap_t structure, and then the filter is sent with the pcap_startcap().
 *
 * Parameters and return values are exactly the same of the pcap_setfilter().
 *
 * \warning This function *does not* clear the packet currently into the buffers. Therefore,
 * the user has to expect to receive some packets that are related to the previous filter.
 * If you want to discard all the packets before applying a new filter, you have to close
 * the current capture session and start a new one.
 */
static int pcap_updatefilter_remote(pcap_t *fp, struct bpf_program *prog)
{
	int retval;						/* general variable used to keep the return value of other functions */
	char sendbuf[RPCAP_NETBUF_SIZE];/* temporary buffer in which data to be sent is buffered */
	int sendbufidx = 0;				/* index which keeps the number of bytes currently buffered */
	struct rpcap_header header;		/* To keep the reply message */
	struct pcap_md *md;				/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));


	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL, &sendbufidx,
		RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, fp->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_UPDATEFILTER_REQ, 0,
		sizeof(struct rpcap_filter) + prog->bf_len * sizeof(struct rpcap_filterbpf_insn));

	if (pcap_pack_bpffilter(fp, &sendbuf[sendbufidx], &sendbufidx, prog))
		return -1;

	if (sock_send(md->rmt_sockctrl, sendbuf, sendbufidx, fp->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	/* Waits for the answer */
	if (sock_recv(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
		return -1;

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(fp->errbuf, md->rmt_sockctrl, &header, RPCAP_MSG_UPDATEFILTER_REPLY, 0);

	if (retval != RPCAP_MSG_UPDATEFILTER_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint sent a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			/* Do nothing; just exit from here; the error code is already into the errbuf */
			return -1;

		default:
			SOCK_ASSERT("Internal error", 0);
			return -1;
		}
	}

	if (ntohl(header.plen) != 0)	/* the message has an unexpected size */
	{
		if (sock_discard(md->rmt_sockctrl, ntohl(header.plen), fp->errbuf, PCAP_ERRBUF_SIZE) == -1)
			return -1;
	}

	return 0;
}

/*
 * \ingroup remote_pri_func
 *
 * \brief Send a filter to a remote host.
 *
 * This function is called when the user wants to set a filter.
 * In case we're capturing from the network, it sends the filter to the other peer.
 * This function is called automatically when the user calls the pcap_setfilter().
 *
 * Parameters and return values are exactly the same of the pcap_setfilter().
 */
static int pcap_setfilter_remote(pcap_t *fp, struct bpf_program *prog)
{
	struct pcap_md *md;				/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));

	if (!md->rmt_capstarted)
	{
		/* copy filter into the pcap_t structure */
		if (install_bpf_program(fp, prog) == -1)
			return -1;
		return 0;
	}

	/* we have to update a filter during run-time */
	if (pcap_updatefilter_remote(fp, prog))
		return -1;

	return 0;
}

/*
 * \ingroup remote_pri_func
 *
 * \brief Update the current filter in order not to capture rpcap packets.
 *
 * This function is called *only* when the user wants exclude RPCAP packets
 * related to the current session from the captured packets.
 *
 * \return '0' if everything is fine, '-1' otherwise. The error message (if one)
 * is returned into the 'errbuf' field of the pcap_t structure.
 */
static int pcap_createfilter_norpcappkt(pcap_t *fp, struct bpf_program *prog)
{
	int RetVal = 0;
	struct pcap_md *md;				/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)fp->priv + sizeof(struct pcap_win));

	/* We do not want to capture our RPCAP traffic. So, let's update the filter */
	if (md->rmt_flags & PCAP_OPENFLAG_NOCAPTURE_RPCAP)
	{
		struct sockaddr_storage saddr;		/* temp, needed to retrieve the network data port chosen on the local machine */
		socklen_t saddrlen;					/* temp, needed to retrieve the network data port chosen on the local machine */
		char myaddress[128];
		char myctrlport[128];
		char mydataport[128];
		char peeraddress[128];
		char peerctrlport[128];
		char *newfilter;
		const int newstringsize = 1024;
		size_t currentfiltersize;

		/* Get the name/port of the other peer */
		saddrlen = sizeof(struct sockaddr_storage);
		if (getpeername(md->rmt_sockctrl, (struct sockaddr *) &saddr, &saddrlen) == -1)
		{
			sock_geterror("getpeername(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		if (getnameinfo((struct sockaddr *) &saddr, saddrlen, peeraddress,
			sizeof(peeraddress), peerctrlport, sizeof(peerctrlport), NI_NUMERICHOST | NI_NUMERICSERV))
		{
			sock_geterror("getnameinfo(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		/* We cannot check the data port, because this is available only in case of TCP sockets */
		/* Get the name/port of the current host */
		if (getsockname(md->rmt_sockctrl, (struct sockaddr *) &saddr, &saddrlen) == -1)
		{
			sock_geterror("getsockname(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		/* Get the local port the system picked up */
		if (getnameinfo((struct sockaddr *) &saddr, saddrlen, myaddress,
			sizeof(myaddress), myctrlport, sizeof(myctrlport), NI_NUMERICHOST | NI_NUMERICSERV))
		{
			sock_geterror("getnameinfo(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		/* Let's now check the data port */
		if (getsockname(md->rmt_sockdata, (struct sockaddr *) &saddr, &saddrlen) == -1)
		{
			sock_geterror("getsockname(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		/* Get the local port the system picked up */
		if (getnameinfo((struct sockaddr *) &saddr, saddrlen, NULL, 0, mydataport, sizeof(mydataport), NI_NUMERICSERV))
		{
			sock_geterror("getnameinfo(): ", fp->errbuf, PCAP_ERRBUF_SIZE);
			return -1;
		}

		currentfiltersize = strlen(md->currentfilter);

		newfilter = (char *)malloc(currentfiltersize + newstringsize + 1);

		if (currentfiltersize)
		{
			pcap_snprintf(newfilter, currentfiltersize + newstringsize,
				"(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)",
				md->currentfilter, myaddress, peeraddress, myctrlport, peerctrlport, myaddress, peeraddress, mydataport);
		}
		else
		{
			pcap_snprintf(newfilter, currentfiltersize + newstringsize,
				"not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)",
				myaddress, peeraddress, myctrlport, peerctrlport, myaddress, peeraddress, mydataport);
		}

		newfilter[currentfiltersize + newstringsize] = 0;

		/* This is only an hack to make the pcap_compile() working properly */
		md->rmt_clientside = 0;

		if (pcap_compile(fp, prog, newfilter, 1, 0) == -1)
			RetVal = -1;

		/* This is only an hack to make the pcap_compile() working properly */
		md->rmt_clientside = 1;

		free(newfilter);
	}

	return RetVal;
}

/*
 * \ingroup remote_pri_func
 *
 * \brief Set sampling parameters in the remote host.
 *
 * This function is called when the user wants to set activate sampling on the remote host.
 *
 * Sampling parameters are defined into the 'pcap_t' structure.
 *
 * \param p: the pcap_t descriptor of the device currently opened.
 *
 * \return '0' if everything is OK, '-1' is something goes wrong. The error message is returned
 * in the 'errbuf' member of the pcap_t structure.
 */
static int pcap_setsampling_remote(pcap_t *p)
{
	int retval;						/* general variable used to keep the return value of other functions */
	char sendbuf[RPCAP_NETBUF_SIZE];/* temporary buffer in which data to be sent is buffered */
	int sendbufidx = 0;				/* index which keeps the number of bytes currently buffered */
	struct rpcap_header header;		/* To keep the reply message */
	struct rpcap_sampling *sampling_pars;	/* Structure that is needed to send sampling parameters to the remote host */
	struct pcap_md *md;				/* structure used when doing a remote live capture */

	md = (struct pcap_md *) ((u_char*)p->priv + sizeof(struct pcap_win));

	/* If no samping is requested, return 'ok' */
	if (md->rmt_samp.method == PCAP_SAMP_NOSAMP)
		return 0;

	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, p->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_SETSAMPLING_REQ, 0, sizeof(struct rpcap_sampling));

	/* Fill the structure needed to open an adapter remotely */
	sampling_pars = (struct rpcap_sampling *) &sendbuf[sendbufidx];

	if (sock_bufferize(NULL, sizeof(struct rpcap_sampling), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, p->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	memset(sampling_pars, 0, sizeof(struct rpcap_sampling));

	sampling_pars->method = md->rmt_samp.method;
	sampling_pars->value = htonl(md->rmt_samp.value);

	if (sock_send(md->rmt_sockctrl, sendbuf, sendbufidx, p->errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	/* Waits for the answer */
	if (sock_recv(md->rmt_sockctrl, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, p->errbuf, PCAP_ERRBUF_SIZE) == -1)
		return -1;

	/* Checks if the message is correct */
	retval = rpcap_checkmsg(p->errbuf, md->rmt_sockctrl, &header, RPCAP_MSG_SETSAMPLING_REPLY, 0);

	if (retval != RPCAP_MSG_SETSAMPLING_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint sent a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
		case RPCAP_MSG_ERROR:
			/* Do nothing; just exit from here; the error code is already into the errbuf */
			return -1;

		default:
			SOCK_ASSERT("Internal error", 0);
			return -1;
		}
	}

	if (ntohl(header.plen) != 0)	/* the message has an unexpected size */
	{
		if (sock_discard(md->rmt_sockctrl, ntohl(header.plen), p->errbuf, PCAP_ERRBUF_SIZE) == -1)
			return -1;
	}

	return 0;

}

/*********************************************************
 *                                                       *
 * Miscellaneous functions                               *
 *                                                       *
 *********************************************************/


/* \ingroup remote_pri_func
 * \brief It sends a RPCAP error to the other peer.
 *
 * This function has to be called when the main program detects an error. This function
 * will send on the other peer the 'buffer' specified by the user.
 * This function *does not* request a RPCAP CLOSE connection. A CLOSE command must be sent
 * explicitly by the program, since we do not know it the error can be recovered in some
 * way or it is a non-recoverable one.
 *
 * \param sock: the socket we are currently using.
 *
 * \param error: an user-allocated (and '0' terminated) buffer that contains the error
 * description that has to be transmitted on the other peer. The error message cannot
 * be longer than PCAP_ERRBUF_SIZE.
 *
 * \param errcode: a integer which tells the other party the type of error we had;
 * currently is is not too much used.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size PCAP_ERRBUF_SIZE)
 * that will contain the error message (in case there is one). It could be network problem.
 *
 * \return '0' if everything is fine, '-1' if some errors occurred. The error message is returned
 * in the 'errbuf' variable.
 */
int rpcap_senderror(SOCKET sock, char *error, unsigned short errcode, char *errbuf)
{
	char sendbuf[RPCAP_NETBUF_SIZE];			/* temporary buffer in which data to be sent is buffered */
	int sendbufidx = 0;							/* index which keeps the number of bytes currently buffered */
	uint16 length;

	length = (uint16)strlen(error);

	if (length > PCAP_ERRBUF_SIZE)
		length = PCAP_ERRBUF_SIZE;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_ERROR, errcode, length);

	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL, &sendbufidx,
		RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	if (sock_bufferize(error, length, sendbuf, &sendbufidx,
		RPCAP_NETBUF_SIZE, SOCKBUF_BUFFERIZE, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	if (sock_send(sock, sendbuf, sendbufidx, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	return 0;
}

/* \ingroup remote_pri_func
 * \brief Sends the authentication message.
 *
 * It sends the authentication parameters on the control socket.
 * This function is required in order to open the connection with the other end party.
 *
 * \param sock: the socket we are currently using.
 *
 * \param auth: authentication parameters that have to be sent.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size PCAP_ERRBUF_SIZE)
 * that will contain the error message (in case there is one). It could be network problem
 * of the fact that the authorization failed.
 *
 * \return '0' if everything is fine, '-1' if some errors occurred. The error message is returned
 * in the 'errbuf' variable.
 * The error message could be also 'the authentication failed'.
 */
int rpcap_sendauth(SOCKET sock, struct pcap_rmtauth *auth, char *errbuf)
{
	char sendbuf[RPCAP_NETBUF_SIZE];	/* temporary buffer in which data that has to be sent is buffered */
	int sendbufidx = 0;					/* index which keeps the number of bytes currently buffered */
	uint16 length;						/* length of the payload of this message */
	struct rpcap_auth *rpauth;
	uint16 auth_type;
	struct rpcap_header header;
	int retval;							/* temp variable which stores functions return value */

	if (auth)
	{
		auth_type = auth->type;

		switch (auth->type)
		{
		case RPCAP_RMTAUTH_NULL:
			length = sizeof(struct rpcap_auth);
			break;

		case RPCAP_RMTAUTH_PWD:
			length = sizeof(struct rpcap_auth);
			if (auth->username) length += (uint16) strlen(auth->username);
			if (auth->password) length += (uint16) strlen(auth->password);
			break;

		default:
			pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication type not recognized.");
			return -1;
		}
	}
	else
	{
		auth_type = RPCAP_RMTAUTH_NULL;
		length = sizeof(struct rpcap_auth);
	}


	if (sock_bufferize(NULL, sizeof(struct rpcap_header), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	rpcap_createhdr((struct rpcap_header *) sendbuf, RPCAP_MSG_AUTH_REQ, 0, length);

	rpauth = (struct rpcap_auth *) &sendbuf[sendbufidx];

	if (sock_bufferize(NULL, sizeof(struct rpcap_auth), NULL,
		&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_CHECKONLY, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	memset(rpauth, 0, sizeof(struct rpcap_auth));

	rpauth->type = htons(auth_type);

	if (auth_type == RPCAP_RMTAUTH_PWD)
	{

		if (auth->username)
			rpauth->slen1 = (uint16) strlen(auth->username);
		else
			rpauth->slen1 = 0;

		if (sock_bufferize(auth->username, rpauth->slen1, sendbuf,
			&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_BUFFERIZE, errbuf, PCAP_ERRBUF_SIZE))
			return -1;

		if (auth->password)
			rpauth->slen2 = (uint16) strlen(auth->password);
		else
			rpauth->slen2 = 0;

		if (sock_bufferize(auth->password, rpauth->slen2, sendbuf,
			&sendbufidx, RPCAP_NETBUF_SIZE, SOCKBUF_BUFFERIZE, errbuf, PCAP_ERRBUF_SIZE))
			return -1;

		rpauth->slen1 = htons(rpauth->slen1);
		rpauth->slen2 = htons(rpauth->slen2);
	}

	if (sock_send(sock, sendbuf, sendbufidx, errbuf, PCAP_ERRBUF_SIZE))
		return -1;

	if (sock_recv(sock, (char *)&header, sizeof(struct rpcap_header), SOCK_RECEIVEALL_YES, errbuf, PCAP_ERRBUF_SIZE) == -1)
		return -1;

	retval = rpcap_checkmsg(errbuf, sock, &header, RPCAP_MSG_AUTH_REPLY, RPCAP_MSG_ERROR, 0);

	if (retval != RPCAP_MSG_AUTH_REPLY)		/* the message is not the one expected */
	{
		switch (retval)
		{
		case -3:		/* Unrecoverable network error */
		case -2:		/* The other endpoint sent a message that is not allowed here */
		case -1:		/* The other endpoint has a version number that is not compatible with our */
			/* Do nothing; just exit from here; the error code is already into the errbuf */
			return -1;

		case RPCAP_MSG_ERROR:
			return -1;

		default:
			SOCK_ASSERT("Internal error", 0);
			return -1;
		}
	}

	if (ntohl(header.plen))
	{
		if (sock_discard(sock, ntohl(header.plen), errbuf, PCAP_ERRBUF_SIZE))
			return -1;
	}

	return 0;
}

/* \ingroup remote_pri_func
 * \brief Creates a structure of type rpcap_header.
 *
 * This function is provided just because the creation of an rpcap header is quite a common
 * task. It accepts all the values that appears into an rpcap_header, and it puts them in
 * place using the proper hton() calls.
 *
 * \param header: a pointer to a user-allocated buffer which will contain the serialized
 * header, ready to be sent on the network.
 *
 * \param type: a value (in the host by order) which will be placed into the header.type
 * field and that represents the type of the current message.
 *
 * \param value: a value (in the host by order) which will be placed into the header.value
 * field and that has a message-dependent meaning.
 *
 * \param length: a value (in the host by order) which will be placed into the header.length
 * field and that represents the payload length of the message.
 *
 * \return Nothing. The serialized header is returned into the 'header' variable.
 */
void rpcap_createhdr(struct rpcap_header *header, uint8 type, uint16 value, uint32 length)
{
	memset(header, 0, sizeof(struct rpcap_header));

	header->ver = RPCAP_VERSION;
	header->type = type;
	header->value = htons(value);
	header->plen = htonl(length);
}

/* ingroup remote_pri_func
 * \brief Checks if the header of the received message is correct.
 *
 * This function is a way to easily check if the message received, in a certain
 * state of the RPCAP protocol Finite State Machine, is valid. This function accepts,
 * as a parameter, the list of message types that are allowed in a certain situation,
 * and it returns the one which occurs.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size PCAP_ERRBUF_SIZE)
 * that will contain the error message (in case there is one). It could be either problem
 * occurred inside this function (e.g. a network problem in case it tries to send an
 * error on the other peer and the send() call fails), an error message which has been
 * sent to us from the other party, or a version error (the message receive has a version
 * number that is incompatible with our).
 *
 * \param sock: the socket that has to be used to receive data. This function can
 * read data from socket in case the version contained into the message is not compatible
 * with our. In that case, all the message is purged from the socket, so that the following
 * recv() calls will return a new message.
 *
 * \param header: a pointer to and 'rpcap_header' structure that keeps the data received from
 * the network (still in network byte order) and that has to be checked.
 *
 * \param first: this function has a variable number of parameters. From this point on,
 * all the messages that are valid in this context must be passed as parameters.
 * The message type list must be terminated with a '0' value, the null message type,
 * which means 'no more types to check'. The RPCAP protocol does not define anything with
 * message type equal to zero, so there is no ambiguity in using this value as a list terminator.
 *
 * \return The message type of the message that has been detected. In case of errors (e.g. the
 * header contains a type that is not listed among the allowed types), this function will
 * return the following codes:
 * - (-1) if the version is incompatible.
 * - (-2) if the code is not among the one listed into the parameters list
 * - (-3) if a network error (connection reset, ...)
 * - RPCAP_MSG_ERROR if the message is an error message (it follow that the RPCAP_MSG_ERROR
 * could not be present in the allowed message-types list, because this function checks
 * for errors anyway)
 *
 * In case either the version is incompatible or nothing matches (i.e. it returns '-1' or '-2'),
 * it discards the message body (i.e. it reads the remaining part of the message from the
 * network and it discards it) so that the application is ready to receive a new message.
 */
int rpcap_checkmsg(char *errbuf, SOCKET sock, struct rpcap_header *header, uint8 first, ...)
{
	va_list ap;
	uint8 type;
	int32 len;

	va_start(ap, first);

	/* Check if the present version of the protocol can handle this message */
	if (rpcap_checkver(sock, header, errbuf))
	{
		SOCK_ASSERT(errbuf, 1);

		va_end(ap);
		return -1;
	}

	type = first;

	while (type != 0)
	{
		/*
		 * The message matches with one of the types listed
		 * There is no need of conversions since both values are uint8
		 *
		 * Check if the other side reported an error.
		 * If yes, it retrieves it and it returns it back to the caller
		 */
		if (header->type == RPCAP_MSG_ERROR)
		{
			len = ntohl(header->plen);

			if (len >= PCAP_ERRBUF_SIZE)
			{
				if (sock_recv(sock, errbuf, PCAP_ERRBUF_SIZE - 1, SOCK_RECEIVEALL_YES, errbuf, PCAP_ERRBUF_SIZE))
					return -3;

				sock_discard(sock, len - (PCAP_ERRBUF_SIZE - 1), NULL, 0);

				/* Put '\0' at the end of the string */
				errbuf[PCAP_ERRBUF_SIZE - 1] = 0;
			}
			else
			{
				if (sock_recv(sock, errbuf, len, SOCK_RECEIVEALL_YES, errbuf, PCAP_ERRBUF_SIZE) == -1)
					return -3;

				/* Put '\0' at the end of the string */
				errbuf[len] = 0;
			}


			va_end(ap);
			return header->type;
		}

		if (header->type == type)
		{
			va_end(ap);
			return header->type;
		}

		/* get next argument */
		type = va_arg(ap, int);
	}

	/* we already have an error, so please discard this one */
	sock_discard(sock, ntohl(header->plen), NULL, 0);

	pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "The other endpoint sent a message that is not allowed here.");
	SOCK_ASSERT(errbuf, 1);

	va_end(ap);
	return -2;
}

/* \ingroup remote_pri_func
 * \brief Checks if the version contained into the message is compatible with
 * the one handled by this implementation.
 *
 * Right now, this function does not have any sophisticated task: if the versions
 * are different, it returns -1 and it discards the message.
 * It is expected that in the future this message will become more complex.
 *
 * \param sock: the socket that has to be used to receive data. This function can
 * read data from socket in case the version contained into the message is not compatible
 * with our. In that case, all the message is purged from the socket, so that the following
 * recv() calls will return a new (clean) message.
 *
 * \param header: a pointer to and 'rpcap_header' structure that keeps the data received from
 * the network (still in network byte order) and that has to be checked.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size PCAP_ERRBUF_SIZE)
 * that will contain the error message (in case there is one). The error message is
 * "incompatible version".
 *
 * \return '0' if everything is fine, '-1' if some errors occurred. The error message is returned
 * in the 'errbuf' variable.
 */
static int rpcap_checkver(SOCKET sock, struct rpcap_header *header, char *errbuf)
{
	/*
	 * This is a sample function.
	 *
	 * In the real world, you have to check at the type code,
	 * and decide accordingly.
	 */

	if (header->ver != RPCAP_VERSION)
	{
		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Incompatible version number: message discarded.");

		/* we already have an error, so please discard this one */
		sock_discard(sock, ntohl(header->plen), NULL, 0);
		return -1;
	}

	return 0;
}

/* \ingroup remote_pri_func
 *
 * \brief It returns the socket currently used for this active connection
 * (active mode only) and provides an indication of whether this connection
 * is in active mode or not.
 *
 * This function is just for internal use; it returns the socket ID of the
 * active connection currently opened.
 *
 * \param host: a string that keeps the host name of the host for which we
 * want to get the socket ID for that active connection.
 *
 * \param isactive: a pointer to an int that is set to 1 if there's an
 * active connection to that host and 0 otherwise.
 *
 * \param errbuf: a pointer to a user-allocated buffer (of size
 * PCAP_ERRBUF_SIZE) that will contain the error message (in case
 * there is one).
 *
 * \return the socket identifier if everything is fine, '0' if this host
 * is not in the active host list. An indication of whether this host
 * is in the active host list is returned into the isactive variable.
 * It returns 'INVALID_SOCKET' in case of error. The error message is
 * returned into the errbuf variable.
 */
SOCKET rpcap_remoteact_getsock(const char *host, int *isactive, char *errbuf)
{
	struct activehosts *temp;					/* temp var needed to scan the host list chain */
	struct addrinfo hints, *addrinfo, *ai_next;	/* temp var needed to translate between hostname to its address */
	int retval;

	/* retrieve the network address corresponding to 'host' */
	addrinfo = NULL;
	memset(&hints, 0, sizeof(struct addrinfo));
	hints.ai_family = PF_UNSPEC;
	hints.ai_socktype = SOCK_STREAM;

	retval = getaddrinfo(host, "0", &hints, &addrinfo);
	if (retval != 0)
	{
		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "getaddrinfo() %s", gai_strerror(retval));
		*isactive = 0;
		return INVALID_SOCKET;
	}

	temp = activeHosts;

	while (temp)
	{
		ai_next = addrinfo;
		while (ai_next)
		{
			if (sock_cmpaddr(&temp->host, (struct sockaddr_storage *) ai_next->ai_addr) == 0) {
				*isactive = 1;
				return (temp->sockctrl);
			}

			ai_next = ai_next->ai_next;
		}
		temp = temp->next;
	}

	if (addrinfo)
		freeaddrinfo(addrinfo);

	/*
	 * The host for which you want to get the socket ID does not have an
	 * active connection.
	 */
	*isactive = 0;
	return 0;
}