process_lookup.h

Go to the documentation of this file.

 
#ifndef __WSUTIL_PROCESS_LOOKUP_H__
#define __WSUTIL_PROCESS_LOOKUP_H__
 
#include <wireshark.h>
#include <wsutil/inet_addr.h>
 
#ifdef __cplusplus
extern "C" {
#endif /* __cplusplus */

typedef struct ws_process_info {
    uint32_t  pid;            
    bool      has_ppid;       
    uint32_t  ppid;           
    bool      has_uid;        
    uint32_t  uid;            
    char     *name;           
    char     *path;           
    char     *user;           
    uint8_t  *cmdline;        
    size_t    cmdline_len;    
    uint64_t  start_time_ns;  
} ws_process_info_t;

typedef enum {
    WS_PROCESS_LOOKUP_TCP = 6,
    WS_PROCESS_LOOKUP_UDP = 17
} ws_process_lookup_protocol_t;

typedef struct ws_socket_endpoint {
    uint8_t  ip_version;      
    union {
        ws_in4_addr ipv4;     
        ws_in6_addr ipv6;     
    } addr;
    uint16_t port;            
} ws_socket_endpoint_t;

typedef struct ws_process_lookup ws_process_lookup_t;

WS_DLL_PUBLIC bool
ws_process_lookup_supported(void);

WS_DLL_PUBLIC ws_process_lookup_t *
ws_process_lookup_new(char **err_msg);

WS_DLL_PUBLIC void
ws_process_lookup_free(ws_process_lookup_t *lookup);

typedef enum {
    WS_PROCESS_DETAIL_BASIC,  
    WS_PROCESS_DETAIL_FULL    
} ws_process_detail_t;

WS_DLL_PUBLIC void
ws_process_lookup_set_detail(ws_process_lookup_t *lookup, ws_process_detail_t detail);

WS_DLL_PUBLIC void
ws_process_lookup_set_refresh_interval(ws_process_lookup_t *lookup, unsigned interval_ms);

WS_DLL_PUBLIC bool
ws_process_lookup_refresh(ws_process_lookup_t *lookup, char **err_msg);

WS_DLL_PUBLIC unsigned
ws_process_lookup_socket(ws_process_lookup_t *lookup,
                         ws_process_lookup_protocol_t protocol,
                         const ws_socket_endpoint_t *local,
                         const ws_socket_endpoint_t *remote,
                         GPtrArray *processes);

WS_DLL_PUBLIC const ws_process_info_t *
ws_process_lookup_pid(ws_process_lookup_t *lookup, uint32_t pid);
 
#ifdef __cplusplus
}
#endif /* __cplusplus */
 
#endif /* __WSUTIL_PROCESS_LOOKUP_H__ */
 
/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local variables:
 * c-basic-offset: 4
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * vi: set shiftwidth=4 tabstop=8 expandtab:
 * :indentSize=4:tabSize=8:noTabs=true:
 */