home *** CD-ROM | disk | FTP | other *** search
-
- //============================================================================
- // MODULE: Filter.h
- //
- // Description:
- //
- // Bloodhound DLL for Filtering.
- //
- // Modification History
- //
- // stevehi 03/22/93 Created.
- // raypa 10/25/93 Changed HPROPERTYDB to HPROTOCOL.
- // SteveHi 10/28/93 pull Value out of Object union
- //============================================================================
-
-
-
- #if !defined(_FILTER_)
-
- #define _FILTER_
-
- //============================================================================
- // types
- //============================================================================
-
-
- typedef HFILTER * LPHFILTER;
-
-
- typedef DWORD FILTERACTIONTYPE;
- typedef DWORD VALUETYPE;
-
-
- // check for protocols existing in the frame.
-
- // ProtocolPart
- // this is the raw data for a Protocol based expression
- //
- // WHAT??? FIELD DESCRIPTION EXAMPLE
- // ------- ----- ----------- -------
- // Count of Protocol(nPropertyDBs) Number of protocols to pass 5
- // PropertyDB Table (PropertyDB) Table of HPROTOCOL SMB, LLC, MAC
- //
- // NOTE: the nPropertyDBs field may also be the following, which implies that
- // all are selected but that none have actually been put into the structure
-
- #define PROTOCOL_NUM_ANY (-1)
-
- //... Use PROTOCOLTABLE defined in BHTYPES.H
-
- typedef PROTOCOLTABLE PROTOCOLTABLETYPE; // array of HPROTOCOL's
- typedef PROTOCOLTABLETYPE *LPPROTOCOLTABLETYPE;
-
- // filter bits stores who passed what filter per frame to speed up
- // the filter process... This is actually an array.
-
- typedef DWORD FILTERBITS;
-
- typedef FILTERBITS *LPFILTERBITS;
-
- typedef SYSTEMTIME *LPTIME;
- typedef SYSTEMTIME UNALIGNED * ULPTIME;
-
-
- // The Filter Object is the basic unit of the postfix stack.
- // I need to restart the convert property to value if the comparison does not match.
- // To do this, I need the original pointer to the property. Pull the hProperty out of
- // the union so that the pointer to the property is saved.
-
- typedef struct _FILTEROBJECT
- {
- FILTERACTIONTYPE Action; // Object action, see codes below
- HPROPERTY hProperty; // property key
- union
- {
- VALUETYPE Value; // value of the object.
- HPROTOCOL hProtocol; // protocol key.
- LPVOID lpArray; // if array, length is ItemCount below.
- LPPROTOCOLTABLETYPE lpProtocolTable; // list of protocols to see if exist in frame.
- LPADDRESS lpAddress; // kernel type address, mac or ip
- ULPLARGEINT lpLargeInt; // Double DWORD used by NT
- ULPTIME lpTime; // pointer to SYSTEMTIME
- LPOBJECT_IDENTIFIER lpOID; // pointer to OBJECT_IDENTIFIER
-
- };
- union
- {
- WORD ByteCount; // Number of BYTES!
- WORD ByteOffset; // offset for array compare
- };
-
- struct _FILTEROBJECT * pNext; // reserved
- } FILTEROBJECT;
-
- typedef FILTEROBJECT * LPFILTEROBJECT;
-
- #define FILTERINFO_SIZE (sizeof(FILTEROBJECT) )
-
-
-
- typedef struct _FILTERDESC
- {
- WORD NumEntries;
- WORD Flags; // private
- LPFILTEROBJECT lpStack;
- LPFILTEROBJECT lpKeepLast;
- LPVOID UIInstanceData; // UI specific information.
- LPFILTERBITS lpFilterBits; // cache who passed
- LPFILTERBITS lpCheckBits; // have we looked at it yet?
-
- } FILTERDESC;
-
- typedef FILTERDESC * LPFILTERDESC;
-
- #define FILTERDESC_SIZE sizeof(FILTERDESC)
-
-
- //============================================================================
- // Macros.
- //============================================================================
-
- #define FilterGetUIInstanceData(hfilt) (((LPFILTERDESC)hfilt)->UIInstanceData)
- #define FilterSetUIInstanceData(hfilt,inst) (((LPFILTERDESC)hfilt)->UIInstanceData = (LPVOID)inst)
-
- //============================================================================
- // defines
- //============================================================================
-
- #define FILTERFREEPOOLSTART 20
-
- #define INVALIDELEMENT -1
- #define INVALIDVALUE ((VALUETYPE) -9999)
-
- // use filter failed to check the return code on FilterFrame.
- #define FILTER_FAIL_WITH_ERROR -1
- #define FILTER_PASSED TRUE
- #define FILTER_FAILED FALSE
-
- // NOTE NOTE NOTE If you change the values of the following constants, you
- // MUST modify the TableEval table in filtloc.h.
-
- #define FILTERACTION_INVALID 0
- #define FILTERACTION_PROPERTY 1
- #define FILTERACTION_VALUE 2
- #define FILTERACTION_STRING 3
- #define FILTERACTION_ARRAY 4
- #define FILTERACTION_AND 5
- #define FILTERACTION_OR 6
- #define FILTERACTION_XOR 7
- #define FILTERACTION_PROPERTYEXIST 8
- #define FILTERACTION_CONTAINSNC 9
- #define FILTERACTION_CONTAINS 10
- #define FILTERACTION_NOT 11
- #define FILTERACTION_EQUALNC 12
- #define FILTERACTION_EQUAL 13
- #define FILTERACTION_NOTEQUALNC 14
- #define FILTERACTION_NOTEQUAL 15
- #define FILTERACTION_GREATERNC 16
- #define FILTERACTION_GREATER 17
- #define FILTERACTION_LESSNC 18
- #define FILTERACTION_LESS 19
- #define FILTERACTION_GREATEREQUALNC 20
- #define FILTERACTION_GREATEREQUAL 21
- #define FILTERACTION_LESSEQUALNC 22
- #define FILTERACTION_LESSEQUAL 23
- #define FILTERACTION_PLUS 24
- #define FILTERACTION_MINUS 25
- #define FILTERACTION_ADDRESS 26
- #define FILTERACTION_ADDRESSANY 27
- #define FILTERACTION_FROM 28
- #define FILTERACTION_TO 29
- #define FILTERACTION_FROMTO 30
- #define FILTERACTION_AREBITSON 31
- #define FILTERACTION_AREBITSOFF 32
- #define FILTERACTION_PROTOCOLSEXIST 33
- #define FILTERACTION_PROTOCOLEXIST 34
- #define FILTERACTION_ARRAYEQUAL 35
- #define FILTERACTION_DEREFPROPERTY 36
- #define FILTERACTION_LARGEINT 37
- #define FILTERACTION_TIME 38
- #define FILTERACTION_ADDR_ETHER 39
- #define FILTERACTION_ADDR_TOKEN 40
- #define FILTERACTION_ADDR_FDDI 41
- #define FILTERACTION_ADDR_IPX 42
- #define FILTERACTION_ADDR_IP 43
- #define FILTERACTION_OID 44
- #define FILTERACTION_OID_CONTAINS 45
- #define FILTERACTION_OID_BEGINS_WITH 46
- #define FILTERACTION_OID_ENDS_WITH 47
- #define FILTERACTION_ADDR_VINES 48
-
- #define FILTERACTION_EXPRESSION 97
- #define FILTERACTION_BOOL 98
- #define FILTERACTION_NOEVAL 99
-
-
- #define FILTER_NO_MORE_FRAMES 0xFFFFFFFF
- #define FILTER_CANCELED 0xFFFFFFFE
- #define FILTER_DIRECTION_NEXT TRUE
- #define FILTER_DIRECTION_PREV FALSE
-
-
-
-
- //============================================================================
- // Helper functions.
- //============================================================================
-
- typedef BOOL (WINAPI *STATUSPROC)(DWORD, HCAPTURE, HFILTER, DWORD);
- // callback to show filter status:
- // DWORD nFrame
- // HCAPTURE
- // HFILTER
- // DWORD UI Instance data (hwnd)
-
-
- //============================================================================
- // Global data.
- //============================================================================
-
-
-
- //=============================================================================
- // FILTER API's.
- //=============================================================================
-
- extern HFILTER WINAPI CreateFilter(VOID);
-
- extern DWORD WINAPI DestroyFilter(HFILTER hFilter);
-
- extern HFILTER WINAPI FilterDuplicate(HFILTER hFilter);
-
- extern DWORD WINAPI DisableParserFilter(HFILTER hFilter, HPARSER hParser);
-
- extern DWORD WINAPI EnableParserFilter(HFILTER hFilter, HPARSER hParser);
-
- extern DWORD WINAPI FilterAddObject(HFILTER hFilter, LPFILTEROBJECT lpFilterObject );
-
- extern VOID WINAPI FilterFlushBits(HFILTER hFilter);
-
- extern DWORD WINAPI FilterFrame(HFRAME hFrame, HFILTER hFilter, HCAPTURE hCapture);
- // returns -1 == check BH set last error
- // 0 == FALSE
- // 1 == TRUE
-
- DWORD WINAPI FilterFindFrame ( HFILTER hFilter,
- HCAPTURE hCapture,
- DWORD nFrame,
- STATUSPROC StatusProc,
- DWORD UIInstance,
- DWORD TimeDelta,
- BOOL FilterDirection );
-
- HFRAME FilterFindPropertyInstance ( HFRAME hFrame,
- HFILTER hMasterFilter,
- HCAPTURE hCapture,
- HFILTER hInstanceFilter,
- LPPROPERTYINST *lpPropRestartKey,
- STATUSPROC StatusProc,
- DWORD UIInstance,
- DWORD TimeDelta,
- BOOL FilterForward );
-
-
- extern VOID WINAPI SetCurrentFilter(HFILTER);
- extern HFILTER WINAPI GetCurrentFilter(VOID);
-
-
-
- #endif
-