00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055
00056
00057
00103 #ifndef _YAF_CORE_H_
00104 #define _YAF_CORE_H_
00105
00106 #include <yaf/autoinc.h>
00107 #include <fixbuf/public.h>
00108
00109
00115 #define CERT_PEN 6871
00116
00122 #define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
00123
00124 #define YAF_ERROR_HEADER 1
00125
00126 #define YAF_ERROR_ARGUMENT 2
00127
00128 #define YAF_ERROR_IO 3
00129
00130 #define YAF_ERROR_IPFIX 4
00131
00132 #define YAF_ERROR_IMPL 5
00133
00134 #define YAF_ERROR_INTERNAL 6
00135
00136 #define YAF_ERROR_LIMIT 7
00137
00138 #define YAF_ERROR_EOF 8
00139
00140 #define YAF_ERROR_ALIGNMENT 9
00141
00142 #define YAF_ERROR_PACKET_PAYLOAD 10
00143
00144
00145
00150 #define YAF_FLOW_ACTIVE 0
00151
00152 #define YAF_END_IDLE 1
00153
00154 #define YAF_END_ACTIVE 2
00155
00156 #define YAF_END_CLOSED 3
00157
00158 #define YAF_END_FORCED 4
00159
00160 #define YAF_END_RESOURCE 5
00161
00162 #define YAF_END_UDPFORCE 0x1F
00163
00164 #define YAF_SAME_SIZE 0x01
00165
00166 #define YAF_END_MASK 0x7F
00167
00169 #define YAF_ENDF_ISCONT 0x80
00170
00172 #define YAF_IP_ICMP 1
00173
00174 #define YAF_IP_TCP 6
00175
00176 #define YAF_IP_UDP 17
00177
00181 #define YFP_IPTCPHEADER_SIZE 128
00182
00183 #define ETHERNET_MAC_ADDR_LENGTH 6
00184
00186 #define YAF_MAX_HOOKS 4
00187
00189 #define YAF_HOOKS_MAX_EXPORT 256
00190
00195 typedef struct yfFlowKey_st {
00197 uint16_t sp;
00199 uint16_t dp;
00201 uint8_t proto;
00203 uint8_t version;
00205 uint16_t vlanId;
00209 #if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_NAPATECH_SEPARATE_INTERFACES
00210 uint8_t netIf;
00211 #endif
00212
00213 union {
00214 struct {
00216 uint32_t sip;
00218 uint32_t dip;
00219 } v4;
00220 struct {
00222 uint8_t sip[16];
00224 uint8_t dip[16];
00225 } v6;
00226 } addr;
00227 } yfFlowKey_t;
00228
00229
00234 typedef struct yfFlowVal_st {
00236 uint64_t oct;
00238 uint64_t pkt;
00239 # if YAF_ENABLE_PAYLOAD
00240
00241 uint32_t paylen;
00243 uint8_t *payload;
00244 # endif
00245
00246 uint32_t isn;
00248 uint16_t first_pkt_size;
00250 uint16_t attributes;
00252 uint8_t iflags;
00254 uint8_t uflags;
00255 # if YAF_ENABLE_ENTROPY
00256
00257 uint8_t entropy;
00259 uint8_t entpad[7];
00260 # endif
00261 # if YAF_ENABLE_P0F
00262
00263 const char *osname;
00265 const char *osver;
00267 uint8_t fuzzyMatch;
00269 uint8_t fuzzyPad[7];
00271 char *osFingerPrint;
00272 # endif
00273 # if YAF_ENABLE_FPEXPORT
00274
00275 uint32_t firstPacketLen;
00277 uint32_t secondPacketLen;
00279 uint8_t *firstPacket;
00281 uint8_t *secondPacket;
00282
00283 # endif
00284
00285 } yfFlowVal_t;
00286
00287
00294 typedef struct yfFlow_st {
00296 uint64_t stime;
00298 uint64_t etime;
00299 #ifdef YAF_ENABLE_HOOKS
00300
00304 void *hfctx[YAF_MAX_HOOKS];
00305 #endif
00306
00310 int32_t rdtime;
00312 uint8_t reason;
00313 #if YAF_ENABLE_APPLABEL
00314
00315 uint16_t appLabel;
00316 #endif
00317
00318 uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00320 uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00322 yfFlowVal_t val;
00324 yfFlowVal_t rval;
00326 yfFlowKey_t key;
00327 } yfFlow_t;
00328
00337 void yfAlignmentCheck(void);
00338
00339
00348 void yfFlowPrepare(
00349 yfFlow_t *flow);
00350
00358 void yfFlowCleanup(
00359 yfFlow_t *flow);
00360
00372 fBuf_t *yfWriterForFile(
00373 const char *path,
00374 uint32_t domain,
00375 GError **err);
00376
00390 fBuf_t *yfWriterForFP(
00391 FILE *fp,
00392 uint32_t domain,
00393 GError **err);
00394
00404 fBuf_t *yfWriterForSpec(
00405 fbConnSpec_t *spec,
00406 uint32_t domain,
00407 GError **err);
00408
00409
00410 #ifdef HAVE_SPREAD
00411
00423 fBuf_t *yfWriterForSpread(
00424 fbSpreadParams_t *params,
00425 uint32_t domain,
00426 uint16_t *spreadGroupIndex,
00427 GError **err);
00428
00429 #endif
00430
00445 gboolean yfWriteStatsFlow(
00446 void *yfContext,
00447 uint32_t pcap_drop,
00448 GTimer *timer,
00449 GError **err);
00450
00463 gboolean yfWriteFlow(
00464 void *yfContext,
00465 yfFlow_t *flow,
00466 GError **err);
00467
00480 gboolean yfWriterClose(
00481 fBuf_t *fbuf,
00482 gboolean flush,
00483 GError **err);
00484
00489 void yfWriterExportPayload(
00490 gboolean payload_mode);
00491
00496 void yfWriterExportMappedV6(
00497 gboolean map_mode);
00498
00511 fBuf_t *yfReaderForFP(
00512 fBuf_t *fbuf,
00513 FILE *fp,
00514 GError **err);
00515
00532 fbListener_t *yfListenerForSpec(
00533 fbConnSpec_t *spec,
00534 fbListenerAppInit_fn appinit,
00535 fbListenerAppFree_fn appfree,
00536 GError **err);
00537
00553 gboolean yfReadFlow(
00554 fBuf_t *fbuf,
00555 yfFlow_t *flow,
00556 GError **err);
00557
00576 gboolean yfReadFlowExtended(
00577 fBuf_t *fbuf,
00578 yfFlow_t *flow,
00579 GError **err);
00580
00588 void yfPrintString(
00589 GString *rstr,
00590 yfFlow_t *flow);
00591
00600 void yfPrintDelimitedString(
00601 GString *rstr,
00602 yfFlow_t *flow,
00603 gboolean yaft_mac);
00604
00614 gboolean yfPrint(
00615 FILE *out,
00616 yfFlow_t *flow,
00617 GError **err);
00618
00629 gboolean yfPrintDelimited(
00630 FILE *out,
00631 yfFlow_t *flow,
00632 gboolean yaft_mac,
00633 GError **err);
00634
00644 void yfPrintColumnHeaders(
00645 FILE *out,
00646 gboolean yaft_mac,
00647 GError **err);
00648
00649 #if YAF_ENABLE_HOOKS
00650
00655 fbInfoModel_t *yfDPIInfoModel();
00656 #endif
00657
00658
00659
00660 #endif