00001
00105 #ifndef _YAF_CORE_H_
00106 #define _YAF_CORE_H_
00107
00108 #include <yaf/autoinc.h>
00109 #include <fixbuf/public.h>
00110
00111
00117 #define CERT_PEN 6871
00118
00124 #define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
00125
00126 #define YAF_ERROR_HEADER 1
00127
00128 #define YAF_ERROR_ARGUMENT 2
00129
00130 #define YAF_ERROR_IO 3
00131
00132 #define YAF_ERROR_IPFIX 4
00133
00134 #define YAF_ERROR_IMPL 5
00135
00136 #define YAF_ERROR_INTERNAL 6
00137
00138 #define YAF_ERROR_LIMIT 7
00139
00140 #define YAF_ERROR_EOF 8
00141
00142 #define YAF_ERROR_ALIGNMENT 9
00143
00144 #define YAF_ERROR_PACKET_PAYLOAD 10
00145
00146
00147
00152 #define YAF_FLOW_ACTIVE 0
00153
00154 #define YAF_END_IDLE 1
00155
00156 #define YAF_END_ACTIVE 2
00157
00158 #define YAF_END_CLOSED 3
00159
00160 #define YAF_END_FORCED 4
00161
00162 #define YAF_END_RESOURCE 5
00163
00164 #define YAF_END_UDPFORCE 6
00165
00166 #define YAF_END_MASK 0x7f
00167
00169 #define YAF_ENDF_ISCONT 0x80
00170
00172 #define YAF_IP_ICMP 1
00173
00174 #define YAF_IP_TCP 6
00175
00176 #define YAF_IP_UDP 17
00177
00181 #define YFP_IPTCPHEADER_SIZE 128
00182
00183 #define ETHERNET_MAC_ADDR_LENGTH 6
00184
00186 #define YAF_MAX_HOOKS 4
00187
00189 #define YAF_HOOKS_MAX_EXPORT 256
00190
00195 typedef struct yfFlowKey_st {
00197 uint16_t sp;
00199 uint16_t dp;
00201 uint8_t proto;
00203 uint8_t version;
00205 uint16_t vlanId;
00209 #if YAF_ENABLE_DAG_SEPARATE_INTERFACES
00210 uint8_t dagIf;
00211 #endif
00212
00213 union {
00214 struct {
00216 uint32_t sip;
00218 uint32_t dip;
00219 } v4;
00220 struct {
00222 uint8_t sip[16];
00224 uint8_t dip[16];
00225 } v6;
00226 } addr;
00227 } yfFlowKey_t;
00228
00229
00234 typedef struct yfFlowVal_st {
00236 uint64_t oct;
00238 uint64_t pkt;
00239 # if YAF_ENABLE_PAYLOAD
00240
00241 uint32_t paylen;
00243 uint8_t *payload;
00244 # endif
00245
00246 uint32_t isn;
00248 uint8_t iflags;
00250 uint8_t uflags;
00252
00253 # if YAF_ENABLE_ENTROPY
00254
00255 uint8_t entropy;
00257 uint8_t entpad[7];
00258 # endif
00259 # if YAF_ENABLE_P0F
00260
00261 const char *osname;
00262 const char *osver;
00263 uint8_t fuzzyMatch;
00264 uint8_t fuzzyPad[7];
00265 char *osFingerPrint;
00266 # endif
00267 # if YAF_ENABLE_FPEXPORT
00268 uint32_t firstPacketLen;
00269 uint32_t secondPacketLen;
00270 uint8_t *firstPacket;
00271 uint8_t *secondPacket;
00272
00273 # endif
00274
00275 } yfFlowVal_t;
00276
00277
00284 typedef struct yfFlow_st {
00286 uint64_t stime;
00288 uint64_t etime;
00289 #ifdef YAF_ENABLE_HOOKS
00290
00291 void *hfctx[YAF_MAX_HOOKS];
00292 #endif
00293
00297 int32_t rdtime;
00299 uint8_t reason;
00300 #if YAF_ENABLE_APPLABEL
00301
00302 uint16_t appLabel;
00303 #endif
00304
00305 uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00307 uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00309 yfFlowVal_t val;
00311 yfFlowVal_t rval;
00313 yfFlowKey_t key;
00314 } yfFlow_t;
00315
00316
00325 void yfAlignmentCheck(void);
00326
00327
00336 void yfFlowPrepare(
00337 yfFlow_t *flow);
00338
00346 void yfFlowCleanup(
00347 yfFlow_t *flow);
00348
00360 fBuf_t *yfWriterForFile(
00361 const char *path,
00362 uint32_t domain,
00363 GError **err);
00364
00378 fBuf_t *yfWriterForFP(
00379 FILE *fp,
00380 uint32_t domain,
00381 GError **err);
00382
00392 fBuf_t *yfWriterForSpec(
00393 fbConnSpec_t *spec,
00394 uint32_t domain,
00395 GError **err);
00396
00397
00398 #ifdef HAVE_SPREAD
00399
00408 fBuf_t *yfWriterForSpread(
00409 fbSpreadParams_t *params,
00410 uint32_t domain,
00411 GError **err);
00412
00413 #endif
00414
00415
00428 gboolean yfWriteFlow(
00429 void *yfContext,
00430 yfFlow_t *flow,
00431 GError **err);
00432
00445 gboolean yfWriterClose(
00446 fBuf_t *fbuf,
00447 gboolean flush,
00448 GError **err);
00449
00454 void yfWriterExportPayload(
00455 gboolean payload_mode);
00456
00461 void yfWriterExportMappedV6(
00462 gboolean map_mode);
00463
00476 fBuf_t *yfReaderForFP(
00477 fBuf_t *fbuf,
00478 FILE *fp,
00479 GError **err);
00480
00497 fbListener_t *yfListenerForSpec(
00498 fbConnSpec_t *spec,
00499 fbListenerAppInit_fn appinit,
00500 fbListenerAppFree_fn appfree,
00501 GError **err);
00502
00518 gboolean yfReadFlow(
00519 fBuf_t *fbuf,
00520 yfFlow_t *flow,
00521 GError **err);
00522
00541 gboolean yfReadFlowExtended(
00542 fBuf_t *fbuf,
00543 yfFlow_t *flow,
00544 GError **err);
00545
00553 void yfPrintString(
00554 GString *rstr,
00555 yfFlow_t *flow);
00556
00565 void yfPrintDelimitedString(
00566 GString *rstr,
00567 yfFlow_t *flow,
00568 gboolean yaft_mac);
00569
00579 gboolean yfPrint(
00580 FILE *out,
00581 yfFlow_t *flow,
00582 GError **err);
00583
00594 gboolean yfPrintDelimited(
00595 FILE *out,
00596 yfFlow_t *flow,
00597 gboolean yaft_mac,
00598 GError **err);
00599
00609 void yfPrintColumnHeaders(
00610 FILE *out,
00611 gboolean yaft_mac,
00612 GError **err);
00613
00614
00615 #endif