/src/FreeRDP/winpr/libwinpr/utils/wlog/PacketMessage.c

Source
/**
 * WinPR: Windows Portable Runtime
 * WinPR Logger
 *
 * Copyright 2013 Marc-Andre Moreau <marcandre.moreau@gmail.com>
 * Copyright 2015 Thincast Technologies GmbH
 * Copyright 2015 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <winpr/config.h>

#include "wlog.h"

#include "PacketMessage.h"

#include <winpr/wtypes.h>
#include <winpr/crt.h>
#include <winpr/file.h>
#include <winpr/stream.h>
#include <winpr/sysinfo.h>

static BOOL Pcap_Read_Header(wPcap* pcap, wPcapHeader* header)
{
  return (pcap && pcap->fp && fread((void*)header, sizeof(wPcapHeader), 1, pcap->fp) == 1);
}

static BOOL Pcap_Write_Header(wPcap* pcap, wPcapHeader* header)
{
  return (pcap && pcap->fp && fwrite((void*)header, sizeof(wPcapHeader), 1, pcap->fp) == 1);
}

static BOOL Pcap_Write_RecordHeader(wPcap* pcap, wPcapRecordHeader* record)
{
  return (pcap && pcap->fp && fwrite((void*)record, sizeof(wPcapRecordHeader), 1, pcap->fp) == 1);
}

static BOOL Pcap_Write_RecordContent(wPcap* pcap, wPcapRecord* record)
{
  return (pcap && pcap->fp && fwrite(record->data, record->length, 1, pcap->fp) == 1);
}

static BOOL Pcap_Write_Record(wPcap* pcap, wPcapRecord* record)
{
  return Pcap_Write_RecordHeader(pcap, &record->header) && Pcap_Write_RecordContent(pcap, record);
}

wPcap* Pcap_Open(char* name, BOOL write)
{
  if (!name)
    return nullptr;

  wPcap* pcap = (wPcap*)calloc(1, sizeof(wPcap));

  if (!pcap)
    goto out_fail;

  pcap->fp = winpr_fopen(name, write ? "w+b" : "rb");

  if (!pcap->fp)
    goto out_fail;

  pcap->name = name;
  pcap->write = write;
  pcap->record_count = 0;

  if (write)
  {
    pcap->header.magic_number = PCAP_MAGIC_NUMBER;
    pcap->header.version_major = 2;
    pcap->header.version_minor = 4;
    pcap->header.thiszone = 0;
    pcap->header.sigfigs = 0;
    pcap->header.snaplen = 0xFFFFFFFF;
    pcap->header.network = 1; /* ethernet */
    if (!Pcap_Write_Header(pcap, &pcap->header))
      goto out_fail;
  }
  else
  {
    if (_fseeki64(pcap->fp, 0, SEEK_END) < 0)
      goto out_fail;
    pcap->file_size = (SSIZE_T)_ftelli64(pcap->fp);
    if (pcap->file_size < 0)
      goto out_fail;
    if (_fseeki64(pcap->fp, 0, SEEK_SET) < 0)
      goto out_fail;
    if (!Pcap_Read_Header(pcap, &pcap->header))
      goto out_fail;
  }

  return pcap;

out_fail:
  Pcap_Close(pcap);
  return nullptr;
}

void Pcap_Flush(wPcap* pcap)
{
  if (!pcap || !pcap->fp)
    return;

  while (pcap->record)
  {
    if (!Pcap_Write_Record(pcap, pcap->record))
      return;
    pcap->record = pcap->record->next;
  }

  (void)fflush(pcap->fp);
}

void Pcap_Close(wPcap* pcap)
{
  if (!pcap)
    return;

  Pcap_Flush(pcap);
  if (pcap->fp)
    (void)fclose(pcap->fp);
  free(pcap);
}

static BOOL WLog_PacketMessage_Write_EthernetHeader(wPcap* pcap, wEthernetHeader* ethernet)
{
  wStream* s = nullptr;
  wStream sbuffer = WINPR_C_ARRAY_INIT;
  BYTE buffer[14] = WINPR_C_ARRAY_INIT;
  BOOL ret = TRUE;

  if (!pcap || !pcap->fp || !ethernet)
    return FALSE;

  s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
  if (!s)
    return FALSE;
  Stream_Write(s, ethernet->Destination, 6);
  Stream_Write(s, ethernet->Source, 6);
  Stream_Write_UINT16_BE(s, ethernet->Type);
  if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
    ret = FALSE;

  return ret;
}

static UINT16 IPv4Checksum(const BYTE* ipv4, int length)
{
  long checksum = 0;

  while (length > 1)
  {
    const UINT16 tmp16 = *((const UINT16*)ipv4);
    checksum += tmp16;
    length -= 2;
    ipv4 += 2;
  }

  if (length > 0)
    checksum += *ipv4;

  while (checksum >> 16)
    checksum = (checksum & 0xFFFF) + (checksum >> 16);

  return (UINT16)(~checksum);
}

static BOOL WLog_PacketMessage_Write_IPv4Header(wPcap* pcap, wIPv4Header* ipv4)
{
  wStream* s = nullptr;
  wStream sbuffer = WINPR_C_ARRAY_INIT;
  BYTE buffer[20] = WINPR_C_ARRAY_INIT;
  int ret = TRUE;

  if (!pcap || !pcap->fp || !ipv4)
    return FALSE;

  s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
  if (!s)
    return FALSE;
  Stream_Write_UINT8(s, (BYTE)((ipv4->Version << 4) | ipv4->InternetHeaderLength));
  Stream_Write_UINT8(s, ipv4->TypeOfService);
  Stream_Write_UINT16_BE(s, ipv4->TotalLength);
  Stream_Write_UINT16_BE(s, ipv4->Identification);
  Stream_Write_UINT16_BE(s, (UINT16)((ipv4->InternetProtocolFlags << 13) | ipv4->FragmentOffset));
  Stream_Write_UINT8(s, ipv4->TimeToLive);
  Stream_Write_UINT8(s, ipv4->Protocol);
  Stream_Write_UINT16(s, ipv4->HeaderChecksum);
  Stream_Write_UINT32_BE(s, ipv4->SourceAddress);
  Stream_Write_UINT32_BE(s, ipv4->DestinationAddress);
  ipv4->HeaderChecksum = IPv4Checksum((BYTE*)buffer, 20);
  Stream_Rewind(s, 10);
  Stream_Write_UINT16(s, ipv4->HeaderChecksum);

  if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
    ret = FALSE;

  return ret;
}

static BOOL WLog_PacketMessage_Write_TcpHeader(wPcap* pcap, wTcpHeader* tcp)
{
  wStream* s = nullptr;
  wStream sbuffer = WINPR_C_ARRAY_INIT;
  BYTE buffer[20] = WINPR_C_ARRAY_INIT;
  BOOL ret = TRUE;

  if (!pcap || !pcap->fp || !tcp)
    return FALSE;

  s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
  if (!s)
    return FALSE;
  Stream_Write_UINT16_BE(s, tcp->SourcePort);
  Stream_Write_UINT16_BE(s, tcp->DestinationPort);
  Stream_Write_UINT32_BE(s, tcp->SequenceNumber);
  Stream_Write_UINT32_BE(s, tcp->AcknowledgementNumber);
  Stream_Write_UINT8(s, (UINT8)((tcp->Offset << 4) | (tcp->Reserved & 0xF)));
  Stream_Write_UINT8(s, tcp->TcpFlags);
  Stream_Write_UINT16_BE(s, tcp->Window);
  Stream_Write_UINT16_BE(s, tcp->Checksum);
  Stream_Write_UINT16_BE(s, tcp->UrgentPointer);

  if (pcap->fp)
  {
    if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
      ret = FALSE;
  }

  return ret;
}

static UINT32 g_InboundSequenceNumber = 0;
static UINT32 g_OutboundSequenceNumber = 0;

BOOL WLog_PacketMessage_Write(wPcap* pcap, void* data, size_t length, DWORD flags)
{
  wTcpHeader tcp;
  wIPv4Header ipv4;
  wPcapRecord record;
  wEthernetHeader ethernet;
  ethernet.Type = 0x0800;

  if (!pcap || !pcap->fp)
    return FALSE;

  if (flags & WLOG_PACKET_OUTBOUND)
  {
    /* 00:15:5D:01:64:04 */
    ethernet.Source[0] = 0x00;
    ethernet.Source[1] = 0x15;
    ethernet.Source[2] = 0x5D;
    ethernet.Source[3] = 0x01;
    ethernet.Source[4] = 0x64;
    ethernet.Source[5] = 0x04;
    /* 00:15:5D:01:64:01 */
    ethernet.Destination[0] = 0x00;
    ethernet.Destination[1] = 0x15;
    ethernet.Destination[2] = 0x5D;
    ethernet.Destination[3] = 0x01;
    ethernet.Destination[4] = 0x64;
    ethernet.Destination[5] = 0x01;
  }
  else
  {
    /* 00:15:5D:01:64:01 */
    ethernet.Source[0] = 0x00;
    ethernet.Source[1] = 0x15;
    ethernet.Source[2] = 0x5D;
    ethernet.Source[3] = 0x01;
    ethernet.Source[4] = 0x64;
    ethernet.Source[5] = 0x01;
    /* 00:15:5D:01:64:04 */
    ethernet.Destination[0] = 0x00;
    ethernet.Destination[1] = 0x15;
    ethernet.Destination[2] = 0x5D;
    ethernet.Destination[3] = 0x01;
    ethernet.Destination[4] = 0x64;
    ethernet.Destination[5] = 0x04;
  }

  ipv4.Version = 4;
  ipv4.InternetHeaderLength = 5;
  ipv4.TypeOfService = 0;
  ipv4.TotalLength = (UINT16)(length + 20 + 20);
  ipv4.Identification = 0;
  ipv4.InternetProtocolFlags = 0x02;
  ipv4.FragmentOffset = 0;
  ipv4.TimeToLive = 128;
  ipv4.Protocol = 6; /* TCP */
  ipv4.HeaderChecksum = 0;

  if (flags & WLOG_PACKET_OUTBOUND)
  {
    ipv4.SourceAddress = 0xC0A80196;      /* 192.168.1.150 */
    ipv4.DestinationAddress = 0x4A7D64C8; /* 74.125.100.200 */
  }
  else
  {
    ipv4.SourceAddress = 0x4A7D64C8;      /* 74.125.100.200 */
    ipv4.DestinationAddress = 0xC0A80196; /* 192.168.1.150 */
  }

  tcp.SourcePort = 3389;
  tcp.DestinationPort = 3389;

  if (flags & WLOG_PACKET_OUTBOUND)
  {
    tcp.SequenceNumber = g_OutboundSequenceNumber;
    tcp.AcknowledgementNumber = g_InboundSequenceNumber;
    WINPR_ASSERT(length + g_OutboundSequenceNumber <= UINT32_MAX);
    g_OutboundSequenceNumber += WINPR_ASSERTING_INT_CAST(uint32_t, length);
  }
  else
  {
    tcp.SequenceNumber = g_InboundSequenceNumber;
    tcp.AcknowledgementNumber = g_OutboundSequenceNumber;

    WINPR_ASSERT(length + g_InboundSequenceNumber <= UINT32_MAX);
    g_InboundSequenceNumber += WINPR_ASSERTING_INT_CAST(uint32_t, length);
  }

  tcp.Offset = 5;
  tcp.Reserved = 0;
  tcp.TcpFlags = 0x0018;
  tcp.Window = 0x7FFF;
  tcp.Checksum = 0;
  tcp.UrgentPointer = 0;
  record.data = data;
  record.length = length;
  const size_t offset = 14 + 20 + 20;
  WINPR_ASSERT(record.length <= UINT32_MAX - offset);
  const uint32_t rloff = WINPR_ASSERTING_INT_CAST(uint32_t, record.length + offset);
  record.header.incl_len = rloff;
  record.header.orig_len = rloff;
  record.next = nullptr;

  UINT64 ns = winpr_GetUnixTimeNS();
  record.header.ts_sec = (UINT32)WINPR_TIME_NS_TO_S(ns);
  record.header.ts_usec = WINPR_TIME_NS_REM_US(ns);

  if (!Pcap_Write_RecordHeader(pcap, &record.header) ||
      !WLog_PacketMessage_Write_EthernetHeader(pcap, &ethernet) ||
      !WLog_PacketMessage_Write_IPv4Header(pcap, &ipv4) ||
      !WLog_PacketMessage_Write_TcpHeader(pcap, &tcp) || !Pcap_Write_RecordContent(pcap, &record))
    return FALSE;
  (void)fflush(pcap->fp);
  return TRUE;
}

Coverage Report

Created: 2026-07-30 07:06

Line	Count	Source
1		/**
2		* WinPR: Windows Portable Runtime
3		* WinPR Logger
4		*
5		* Copyright 2013 Marc-Andre Moreau <marcandre.moreau@gmail.com>
6		* Copyright 2015 Thincast Technologies GmbH
7		* Copyright 2015 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
8		*
9		* Licensed under the Apache License, Version 2.0 (the "License");
10		* you may not use this file except in compliance with the License.
11		* You may obtain a copy of the License at
12		*
13		* http://www.apache.org/licenses/LICENSE-2.0
14		*
15		* Unless required by applicable law or agreed to in writing, software
16		* distributed under the License is distributed on an "AS IS" BASIS,
17		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18		* See the License for the specific language governing permissions and
19		* limitations under the License.
20		*/
21
22		#include <winpr/config.h>
23
24		#include "wlog.h"
25
26		#include "PacketMessage.h"
27
28		#include <winpr/wtypes.h>
29		#include <winpr/crt.h>
30		#include <winpr/file.h>
31		#include <winpr/stream.h>
32		#include <winpr/sysinfo.h>
33
34		static BOOL Pcap_Read_Header(wPcap* pcap, wPcapHeader* header)
35	0	{
36	0	return (pcap && pcap->fp && fread((void*)header, sizeof(wPcapHeader), 1, pcap->fp) == 1);
37	0	}
38
39		static BOOL Pcap_Write_Header(wPcap* pcap, wPcapHeader* header)
40	0	{
41	0	return (pcap && pcap->fp && fwrite((void*)header, sizeof(wPcapHeader), 1, pcap->fp) == 1);
42	0	}
43
44		static BOOL Pcap_Write_RecordHeader(wPcap* pcap, wPcapRecordHeader* record)
45	0	{
46	0	return (pcap && pcap->fp && fwrite((void*)record, sizeof(wPcapRecordHeader), 1, pcap->fp) == 1);
47	0	}
48
49		static BOOL Pcap_Write_RecordContent(wPcap* pcap, wPcapRecord* record)
50	0	{
51	0	return (pcap && pcap->fp && fwrite(record->data, record->length, 1, pcap->fp) == 1);
52	0	}
53
54		static BOOL Pcap_Write_Record(wPcap* pcap, wPcapRecord* record)
55	0	{
56	0	return Pcap_Write_RecordHeader(pcap, &record->header) && Pcap_Write_RecordContent(pcap, record);
57	0	}
58
59		wPcap* Pcap_Open(char* name, BOOL write)
60	0	{
61	0	if (!name)
62	0	return nullptr;
63
64	0	wPcap* pcap = (wPcap*)calloc(1, sizeof(wPcap));
65
66	0	if (!pcap)
67	0	goto out_fail;
68
69	0	pcap->fp = winpr_fopen(name, write ? "w+b" : "rb");
70
71	0	if (!pcap->fp)
72	0	goto out_fail;
73
74	0	pcap->name = name;
75	0	pcap->write = write;
76	0	pcap->record_count = 0;
77
78	0	if (write)
79	0	{
80	0	pcap->header.magic_number = PCAP_MAGIC_NUMBER;
81	0	pcap->header.version_major = 2;
82	0	pcap->header.version_minor = 4;
83	0	pcap->header.thiszone = 0;
84	0	pcap->header.sigfigs = 0;
85	0	pcap->header.snaplen = 0xFFFFFFFF;
86	0	pcap->header.network = 1; /* ethernet */
87	0	if (!Pcap_Write_Header(pcap, &pcap->header))
88	0	goto out_fail;
89	0	}
90	0	else
91	0	{
92	0	if (_fseeki64(pcap->fp, 0, SEEK_END) < 0)
93	0	goto out_fail;
94	0	pcap->file_size = (SSIZE_T)_ftelli64(pcap->fp);
95	0	if (pcap->file_size < 0)
96	0	goto out_fail;
97	0	if (_fseeki64(pcap->fp, 0, SEEK_SET) < 0)
98	0	goto out_fail;
99	0	if (!Pcap_Read_Header(pcap, &pcap->header))
100	0	goto out_fail;
101	0	}
102
103	0	return pcap;
104
105	0	out_fail:
106	0	Pcap_Close(pcap);
107	0	return nullptr;
108	0	}
109
110		void Pcap_Flush(wPcap* pcap)
111	0	{
112	0	if (!pcap \|\| !pcap->fp)
113	0	return;
114
115	0	while (pcap->record)
116	0	{
117	0	if (!Pcap_Write_Record(pcap, pcap->record))
118	0	return;
119	0	pcap->record = pcap->record->next;
120	0	}
121
122	0	(void)fflush(pcap->fp);
123	0	}
124
125		void Pcap_Close(wPcap* pcap)
126	0	{
127	0	if (!pcap)
128	0	return;
129
130	0	Pcap_Flush(pcap);
131	0	if (pcap->fp)
132	0	(void)fclose(pcap->fp);
133	0	free(pcap);
134	0	}
135
136		static BOOL WLog_PacketMessage_Write_EthernetHeader(wPcap* pcap, wEthernetHeader* ethernet)
137	0	{
138	0	wStream* s = nullptr;
139	0	wStream sbuffer = WINPR_C_ARRAY_INIT;
140	0	BYTE buffer[14] = WINPR_C_ARRAY_INIT;
141	0	BOOL ret = TRUE;
142
143	0	if (!pcap \|\| !pcap->fp \|\| !ethernet)
144	0	return FALSE;
145
146	0	s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
147	0	if (!s)
148	0	return FALSE;
149	0	Stream_Write(s, ethernet->Destination, 6);
150	0	Stream_Write(s, ethernet->Source, 6);
151	0	Stream_Write_UINT16_BE(s, ethernet->Type);
152	0	if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
153	0	ret = FALSE;
154
155	0	return ret;
156	0	}
157
158		static UINT16 IPv4Checksum(const BYTE* ipv4, int length)
159	0	{
160	0	long checksum = 0;
161
162	0	while (length > 1)
163	0	{
164	0	const UINT16 tmp16 = ((const UINT16)ipv4);
165	0	checksum += tmp16;
166	0	length -= 2;
167	0	ipv4 += 2;
168	0	}
169
170	0	if (length > 0)
171	0	checksum += *ipv4;
172
173	0	while (checksum >> 16)
174	0	checksum = (checksum & 0xFFFF) + (checksum >> 16);
175
176	0	return (UINT16)(~checksum);
177	0	}
178
179		static BOOL WLog_PacketMessage_Write_IPv4Header(wPcap* pcap, wIPv4Header* ipv4)
180	0	{
181	0	wStream* s = nullptr;
182	0	wStream sbuffer = WINPR_C_ARRAY_INIT;
183	0	BYTE buffer[20] = WINPR_C_ARRAY_INIT;
184	0	int ret = TRUE;
185
186	0	if (!pcap \|\| !pcap->fp \|\| !ipv4)
187	0	return FALSE;
188
189	0	s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
190	0	if (!s)
191	0	return FALSE;
192	0	Stream_Write_UINT8(s, (BYTE)((ipv4->Version << 4) \| ipv4->InternetHeaderLength));
193	0	Stream_Write_UINT8(s, ipv4->TypeOfService);
194	0	Stream_Write_UINT16_BE(s, ipv4->TotalLength);
195	0	Stream_Write_UINT16_BE(s, ipv4->Identification);
196	0	Stream_Write_UINT16_BE(s, (UINT16)((ipv4->InternetProtocolFlags << 13) \| ipv4->FragmentOffset));
197	0	Stream_Write_UINT8(s, ipv4->TimeToLive);
198	0	Stream_Write_UINT8(s, ipv4->Protocol);
199	0	Stream_Write_UINT16(s, ipv4->HeaderChecksum);
200	0	Stream_Write_UINT32_BE(s, ipv4->SourceAddress);
201	0	Stream_Write_UINT32_BE(s, ipv4->DestinationAddress);
202	0	ipv4->HeaderChecksum = IPv4Checksum((BYTE*)buffer, 20);
203	0	Stream_Rewind(s, 10);
204	0	Stream_Write_UINT16(s, ipv4->HeaderChecksum);
205
206	0	if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
207	0	ret = FALSE;
208
209	0	return ret;
210	0	}
211
212		static BOOL WLog_PacketMessage_Write_TcpHeader(wPcap* pcap, wTcpHeader* tcp)
213	0	{
214	0	wStream* s = nullptr;
215	0	wStream sbuffer = WINPR_C_ARRAY_INIT;
216	0	BYTE buffer[20] = WINPR_C_ARRAY_INIT;
217	0	BOOL ret = TRUE;
218
219	0	if (!pcap \|\| !pcap->fp \|\| !tcp)
220	0	return FALSE;
221
222	0	s = Stream_StaticInit(&sbuffer, buffer, sizeof(buffer));
223	0	if (!s)
224	0	return FALSE;
225	0	Stream_Write_UINT16_BE(s, tcp->SourcePort);
226	0	Stream_Write_UINT16_BE(s, tcp->DestinationPort);
227	0	Stream_Write_UINT32_BE(s, tcp->SequenceNumber);
228	0	Stream_Write_UINT32_BE(s, tcp->AcknowledgementNumber);
229	0	Stream_Write_UINT8(s, (UINT8)((tcp->Offset << 4) \| (tcp->Reserved & 0xF)));
230	0	Stream_Write_UINT8(s, tcp->TcpFlags);
231	0	Stream_Write_UINT16_BE(s, tcp->Window);
232	0	Stream_Write_UINT16_BE(s, tcp->Checksum);
233	0	Stream_Write_UINT16_BE(s, tcp->UrgentPointer);
234
235	0	if (pcap->fp)
236	0	{
237	0	if (fwrite(buffer, sizeof(buffer), 1, pcap->fp) != 1)
238	0	ret = FALSE;
239	0	}
240
241	0	return ret;
242	0	}
243
244		static UINT32 g_InboundSequenceNumber = 0;
245		static UINT32 g_OutboundSequenceNumber = 0;
246
247		BOOL WLog_PacketMessage_Write(wPcap* pcap, void* data, size_t length, DWORD flags)
248	0	{
249	0	wTcpHeader tcp;
250	0	wIPv4Header ipv4;
251	0	wPcapRecord record;
252	0	wEthernetHeader ethernet;
253	0	ethernet.Type = 0x0800;
254
255	0	if (!pcap \|\| !pcap->fp)
256	0	return FALSE;
257
258	0	if (flags & WLOG_PACKET_OUTBOUND)
259	0	{
260		/* 00:15:5D:01:64:04 */
261	0	ethernet.Source[0] = 0x00;
262	0	ethernet.Source[1] = 0x15;
263	0	ethernet.Source[2] = 0x5D;
264	0	ethernet.Source[3] = 0x01;
265	0	ethernet.Source[4] = 0x64;
266	0	ethernet.Source[5] = 0x04;
267		/* 00:15:5D:01:64:01 */
268	0	ethernet.Destination[0] = 0x00;
269	0	ethernet.Destination[1] = 0x15;
270	0	ethernet.Destination[2] = 0x5D;
271	0	ethernet.Destination[3] = 0x01;
272	0	ethernet.Destination[4] = 0x64;
273	0	ethernet.Destination[5] = 0x01;
274	0	}
275	0	else
276	0	{
277		/* 00:15:5D:01:64:01 */
278	0	ethernet.Source[0] = 0x00;
279	0	ethernet.Source[1] = 0x15;
280	0	ethernet.Source[2] = 0x5D;
281	0	ethernet.Source[3] = 0x01;
282	0	ethernet.Source[4] = 0x64;
283	0	ethernet.Source[5] = 0x01;
284		/* 00:15:5D:01:64:04 */
285	0	ethernet.Destination[0] = 0x00;
286	0	ethernet.Destination[1] = 0x15;
287	0	ethernet.Destination[2] = 0x5D;
288	0	ethernet.Destination[3] = 0x01;
289	0	ethernet.Destination[4] = 0x64;
290	0	ethernet.Destination[5] = 0x04;
291	0	}
292
293	0	ipv4.Version = 4;
294	0	ipv4.InternetHeaderLength = 5;
295	0	ipv4.TypeOfService = 0;
296	0	ipv4.TotalLength = (UINT16)(length + 20 + 20);
297	0	ipv4.Identification = 0;
298	0	ipv4.InternetProtocolFlags = 0x02;
299	0	ipv4.FragmentOffset = 0;
300	0	ipv4.TimeToLive = 128;
301	0	ipv4.Protocol = 6; /* TCP */
302	0	ipv4.HeaderChecksum = 0;
303
304	0	if (flags & WLOG_PACKET_OUTBOUND)
305	0	{
306	0	ipv4.SourceAddress = 0xC0A80196; /* 192.168.1.150 */
307	0	ipv4.DestinationAddress = 0x4A7D64C8; /* 74.125.100.200 */
308	0	}
309	0	else
310	0	{
311	0	ipv4.SourceAddress = 0x4A7D64C8; /* 74.125.100.200 */
312	0	ipv4.DestinationAddress = 0xC0A80196; /* 192.168.1.150 */
313	0	}
314
315	0	tcp.SourcePort = 3389;
316	0	tcp.DestinationPort = 3389;
317
318	0	if (flags & WLOG_PACKET_OUTBOUND)
319	0	{
320	0	tcp.SequenceNumber = g_OutboundSequenceNumber;
321	0	tcp.AcknowledgementNumber = g_InboundSequenceNumber;
322	0	WINPR_ASSERT(length + g_OutboundSequenceNumber <= UINT32_MAX);
323	0	g_OutboundSequenceNumber += WINPR_ASSERTING_INT_CAST(uint32_t, length);
324	0	}
325	0	else
326	0	{
327	0	tcp.SequenceNumber = g_InboundSequenceNumber;
328	0	tcp.AcknowledgementNumber = g_OutboundSequenceNumber;
329
330	0	WINPR_ASSERT(length + g_InboundSequenceNumber <= UINT32_MAX);
331	0	g_InboundSequenceNumber += WINPR_ASSERTING_INT_CAST(uint32_t, length);
332	0	}
333
334	0	tcp.Offset = 5;
335	0	tcp.Reserved = 0;
336	0	tcp.TcpFlags = 0x0018;
337	0	tcp.Window = 0x7FFF;
338	0	tcp.Checksum = 0;
339	0	tcp.UrgentPointer = 0;
340	0	record.data = data;
341	0	record.length = length;
342	0	const size_t offset = 14 + 20 + 20;
343	0	WINPR_ASSERT(record.length <= UINT32_MAX - offset);
344	0	const uint32_t rloff = WINPR_ASSERTING_INT_CAST(uint32_t, record.length + offset);
345	0	record.header.incl_len = rloff;
346	0	record.header.orig_len = rloff;
347	0	record.next = nullptr;
348
349	0	UINT64 ns = winpr_GetUnixTimeNS();
350	0	record.header.ts_sec = (UINT32)WINPR_TIME_NS_TO_S(ns);
351	0	record.header.ts_usec = WINPR_TIME_NS_REM_US(ns);
352
353	0	if (!Pcap_Write_RecordHeader(pcap, &record.header) \|\|
354	0	!WLog_PacketMessage_Write_EthernetHeader(pcap, &ethernet) \|\|
355	0	!WLog_PacketMessage_Write_IPv4Header(pcap, &ipv4) \|\|
356	0	!WLog_PacketMessage_Write_TcpHeader(pcap, &tcp) \|\| !Pcap_Write_RecordContent(pcap, &record))
357	0	return FALSE;
358	0	(void)fflush(pcap->fp);
359	0	return TRUE;
360	0	}