Software Engineering Institute | Carnegie Mellon©
CERT NetSA Security Suite
Monitoring for Large-Scale Networks

YAF

Documentation

YAF

  • Documentation
  • Downloads
  • Main Page
  • Data Structures
  • Files
  • File List
  • Globals

decode.h

00001 /*@internal
00002  *
00003  ** @file decode.h
00004  ** YAF Layer 2 and Layer 3 decode routines
00005  **
00006  ** ------------------------------------------------------------------------
00007  ** Copyright (C) 2007-2011 Carnegie Mellon University. All Rights Reserved.
00008  ** ------------------------------------------------------------------------
00009  ** Authors: Brian Trammell
00010  ** ------------------------------------------------------------------------
00011  ** @OPENSOURCE_HEADER_START@  
00012  ** Use of the YAF system and related source code is subject to the terms 
00013  ** of the following licenses:
00014  ** 
00015  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
00016  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
00017  ** 
00018  ** NO WARRANTY
00019  ** 
00020  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER 
00021  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY 
00022  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN 
00023  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY 
00024  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT 
00025  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, 
00026  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE 
00027  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT, 
00028  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY 
00029  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF 
00030  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES. 
00031  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF 
00032  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON 
00033  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE 
00034  ** DELIVERABLES UNDER THIS LICENSE.
00035  ** 
00036  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie 
00037  ** Mellon University, its trustees, officers, employees, and agents from 
00038  ** all claims or demands made against them (and any related losses, 
00039  ** expenses, or attorney's fees) arising out of, or relating to Licensee's 
00040  ** and/or its sub licensees' negligent use or willful misuse of or 
00041  ** negligent conduct or willful misconduct regarding the Software, 
00042  ** facilities, or other rights or assistance granted by Carnegie Mellon 
00043  ** University under this License, including, but not limited to, any 
00044  ** claims of product liability, personal injury, death, damage to 
00045  ** property, or violation of any laws or regulations.
00046  ** 
00047  ** Carnegie Mellon University Software Engineering Institute authored 
00048  ** documents are sponsored by the U.S. Department of Defense under 
00049  ** Contract F19628-00-C-0003. Carnegie Mellon University retains 
00050  ** copyrights in all material produced under this contract. The U.S. 
00051  ** Government retains a non-exclusive, royalty-free license to publish or 
00052  ** reproduce these documents, or allow others to do so, for U.S. 
00053  ** Government purposes only pursuant to the copyright license under the 
00054  ** contract clause at 252.227.7013.
00055  ** 
00056  ** @OPENSOURCE_HEADER_END@    
00057  ** ------------------------------------------------------------------------
00058  */
00059 
00074 #ifndef _YAF_DECODE_H_
00075 #define _YAF_DECODE_H_
00076 
00077 #include <yaf/autoinc.h>
00078 #include <yaf/yafcore.h>
00079 
00081 typedef struct yfIPFragInfo_st {
00083     uint32_t        ipid;
00085     uint16_t        offset;
00087     uint16_t        iphlen;
00092     uint16_t        l4hlen;
00097     uint8_t         frag;
00101     uint8_t         more;
00102 } yfIPFragInfo_t;
00103 
00105 #define YF_MPLS_LABEL_COUNT_MAX     10
00106 
00108 typedef struct yfL2Info_st {
00110     uint8_t         smac[6];
00112     uint8_t         dmac[6];
00114     uint16_t        vlan_tag;
00116     uint32_t        mpls_count;
00118     uint32_t        mpls_label[YF_MPLS_LABEL_COUNT_MAX];
00119 } yfL2Info_t;
00120 
00122 typedef struct yfTCPInfo_st {
00124     uint32_t        seq;
00126     uint8_t         flags;
00127 } yfTCPInfo_t;
00128 
00130 typedef struct yfPBuf_st {
00132     uint64_t        ptime;
00134     yfFlowKey_t     key;
00136     uint16_t        iplen;
00138     uint16_t        ifnum;
00140     yfTCPInfo_t     tcpinfo;
00142     yfL2Info_t      l2info;
00144 #   if defined(YAF_ENABLE_DAG_SEPARATE_INTERFACES) || defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
00145     size_t          headerLen;
00146     uint8_t         headerVal[YFP_IPTCPHEADER_SIZE];
00147 #   endif
00148 
00149     size_t          paylen;
00153     uint8_t         payload[1];
00154 } yfPBuf_t;
00155 
00157 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
00158 
00160 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
00161 
00163 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
00164 
00165 struct yfDecodeCtx_st;
00167 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
00168 
00170 #define YF_TYPE_IPv4    0x0800
00171 
00172 #define YF_TYPE_IPv6    0x86DD
00173 
00177 #define YF_TYPE_IPANY   0x0000
00178 
00180 #define YF_PROTO_IP6_HOP    0
00181 
00182 #define YF_PROTO_ICMP       1
00183 
00184 #define YF_PROTO_TCP        6
00185 
00186 #define YF_PROTO_UDP        17
00187 
00188 #define YF_PROTO_IP6_ROUTE  43
00189 
00190 #define YF_PROTO_IP6_FRAG   44
00191 
00192 #define YF_PROTO_GRE        47
00193 
00194 #define YF_PROTO_ICMP6      58
00195 
00196 #define YF_PROTO_IP6_NONEXT  59
00197 
00198 #define YF_PROTO_IP6_DOPT   60
00199 
00201 #define YF_TF_FIN   0x01
00202 
00203 #define YF_TF_SYN   0x02
00204 
00205 #define YF_TF_RST   0x04
00206 
00207 #define YF_TF_PSH   0x08
00208 
00209 #define YF_TF_ACK   0x10
00210 
00211 #define YF_TF_URG   0x20
00212 
00213 #define YF_TF_ECE   0x40
00214 
00215 #define YF_TF_CWR   0x80
00216 
00235 yfDecodeCtx_t *yfDecodeCtxAlloc(
00236     int             datalink,
00237     uint16_t        reqtype,
00238     gboolean        gremode);
00239 
00245 void yfDecodeCtxFree(
00246     yfDecodeCtx_t           *ctx);
00247 
00283 gboolean yfDecodeToPBuf(
00284     yfDecodeCtx_t           *ctx,
00285     uint64_t                ptime,
00286     size_t                  caplen,
00287     const uint8_t           *pkt,
00288     yfIPFragInfo_t          *fraginfo,
00289     size_t                  pbuflen,
00290     yfPBuf_t                *pbuf);
00291 
00300 uint64_t yfDecodeTimeval(
00301     const struct timeval    *tv);
00302 
00311 uint64_t yfDecodeTimeNTP(
00312     uint64_t                ntp);
00313 
00320 void yfDecodeDumpStats(
00321     yfDecodeCtx_t       *ctx); 
00322 
00323 /* end idem */
00324 #endif 
© 2006-2011 Carnegie Mellon University