Software Engineering Institute | Carnegie Mellon©
CERT NetSA Security Suite
Monitoring for Large-Scale Networks

YAF

Documentation

YAF

  • Documentation
  • Downloads
  • Main Page
  • Data Structures
  • Files
  • File List
  • Globals

yafcore.h

Go to the documentation of this file.
00001 
00105 #ifndef _YAF_CORE_H_
00106 #define _YAF_CORE_H_
00107 
00108 #include <yaf/autoinc.h>
00109 #include <fixbuf/public.h>
00110 
00111 
00117 #define CERT_PEN    6871
00118 
00124 #define YAF_ERROR_DOMAIN        (g_quark_from_string("certYAFError"))
00125 
00126 #define YAF_ERROR_HEADER        1
00127 
00128 #define YAF_ERROR_ARGUMENT      2
00129 
00130 #define YAF_ERROR_IO            3
00131 
00132 #define YAF_ERROR_IPFIX         4
00133 
00134 #define YAF_ERROR_IMPL          5
00135 
00136 #define YAF_ERROR_INTERNAL      6
00137 
00138 #define YAF_ERROR_LIMIT         7
00139 
00140 #define YAF_ERROR_EOF           8
00141 
00142 #define YAF_ERROR_ALIGNMENT         9
00143 
00144 #define YAF_ERROR_PACKET_PAYLOAD    10
00145 
00146 
00147 
00152 #define YAF_FLOW_ACTIVE         0
00153 
00154 #define YAF_END_IDLE            1
00155 
00156 #define YAF_END_ACTIVE          2
00157 
00158 #define YAF_END_CLOSED          3
00159 
00160 #define YAF_END_FORCED          4
00161 
00162 #define YAF_END_RESOURCE        5
00163 
00164 #define YAF_END_UDPFORCE        6
00165 
00166 #define YAF_END_MASK            0x7f
00167 
00169 #define YAF_ENDF_ISCONT         0x80
00170 
00172 #define YAF_IP_ICMP             1
00173 
00174 #define YAF_IP_TCP              6
00175 
00176 #define YAF_IP_UDP              17
00177 
00181 #define YFP_IPTCPHEADER_SIZE 128
00182 
00183 #define ETHERNET_MAC_ADDR_LENGTH 6
00184 
00186 #define YAF_MAX_HOOKS           4
00187 
00189 #define YAF_HOOKS_MAX_EXPORT    256
00190 
00195 typedef struct yfFlowKey_st {
00197     uint16_t            sp;
00199     uint16_t            dp;
00201     uint8_t             proto;
00203     uint8_t             version;
00205     uint16_t            vlanId;
00209     #if YAF_ENABLE_DAG_SEPARATE_INTERFACES
00210     uint8_t             dagIf;
00211     #endif
00212 
00213     union {
00214         struct {
00216             uint32_t    sip;
00218             uint32_t    dip;
00219         }               v4;
00220         struct {    
00222             uint8_t     sip[16];
00224             uint8_t     dip[16];
00225         }               v6;
00226     }                   addr;
00227 } yfFlowKey_t;
00228 
00229 
00234 typedef struct yfFlowVal_st {
00236     uint64_t    oct;
00238     uint64_t    pkt;
00239 #   if YAF_ENABLE_PAYLOAD
00240 
00241     uint32_t    paylen;
00243     uint8_t     *payload;
00244 #   endif
00245 
00246     uint32_t    isn;
00248     uint8_t     iflags;
00250     uint8_t     uflags;
00252 /*    uint16_t    tag; */
00253 #   if YAF_ENABLE_ENTROPY
00254 
00255     uint8_t     entropy;
00257     uint8_t     entpad[7];
00258 #   endif
00259 #   if YAF_ENABLE_P0F
00260 
00261     const char  *osname;
00262     const char  *osver;
00263     uint8_t     fuzzyMatch;
00264     uint8_t     fuzzyPad[7];
00265     char  *osFingerPrint;
00266 #   endif
00267 #   if YAF_ENABLE_FPEXPORT
00268     uint32_t    firstPacketLen;
00269     uint32_t    secondPacketLen;
00270     uint8_t     *firstPacket;
00271     uint8_t     *secondPacket;
00272   
00273 #   endif
00274 
00275 } yfFlowVal_t;
00276 
00277 
00284 typedef struct yfFlow_st {
00286     uint64_t        stime;
00288     uint64_t        etime;
00289 #ifdef YAF_ENABLE_HOOKS
00290 
00291     void            *hfctx[YAF_MAX_HOOKS];
00292 #endif
00293 
00297     int32_t         rdtime;
00299     uint8_t         reason;
00300 #if YAF_ENABLE_APPLABEL
00301 
00302     uint16_t        appLabel;
00303 #endif
00304 
00305     uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00307     uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00309     yfFlowVal_t     val;
00311     yfFlowVal_t     rval;
00313     yfFlowKey_t     key;
00314 } yfFlow_t;
00315 
00316 
00325 void yfAlignmentCheck(void);
00326 
00327 
00336 void yfFlowPrepare(
00337     yfFlow_t          *flow);
00338 
00346 void yfFlowCleanup(
00347     yfFlow_t          *flow);
00348 
00360 fBuf_t *yfWriterForFile(
00361     const char              *path,
00362     uint32_t                domain,
00363     GError                  **err);
00364 
00378 fBuf_t *yfWriterForFP(
00379     FILE                    *fp,
00380     uint32_t                domain,
00381     GError                  **err);
00382 
00392 fBuf_t *yfWriterForSpec(
00393     fbConnSpec_t            *spec,
00394     uint32_t                domain,
00395     GError                  **err);
00396 
00397 
00398 #ifdef HAVE_SPREAD
00399 
00408 fBuf_t *yfWriterForSpread(
00409     fbSpreadParams_t       *params,
00410     uint32_t               domain,
00411     GError                 **err);
00412 
00413 #endif /* HAVE_SPREAD */
00414 
00415 
00428 gboolean yfWriteFlow(
00429     void                *yfContext,
00430     yfFlow_t            *flow,
00431     GError              **err);
00432 
00445 gboolean yfWriterClose(
00446     fBuf_t          *fbuf,
00447     gboolean        flush,
00448     GError          **err);
00449 
00454 void yfWriterExportPayload(
00455     gboolean            payload_mode);
00456 
00461 void yfWriterExportMappedV6(
00462     gboolean            map_mode);
00463 
00476 fBuf_t *yfReaderForFP(
00477     fBuf_t          *fbuf,
00478     FILE            *fp,
00479     GError          **err);
00480 
00497 fbListener_t *yfListenerForSpec(
00498     fbConnSpec_t        *spec,
00499     fbListenerAppInit_fn    appinit,
00500     fbListenerAppFree_fn    appfree,
00501     GError              **err);
00502 
00518 gboolean yfReadFlow(
00519     fBuf_t          *fbuf,
00520     yfFlow_t        *flow,
00521     GError          **err);
00522 
00541 gboolean yfReadFlowExtended(
00542     fBuf_t                  *fbuf,
00543     yfFlow_t                *flow,
00544     GError                  **err);
00545 
00553 void yfPrintString(
00554     GString             *rstr,
00555     yfFlow_t            *flow);
00556 
00565 void yfPrintDelimitedString(
00566     GString                 *rstr,
00567     yfFlow_t                *flow,
00568     gboolean                yaft_mac);
00569 
00579 gboolean yfPrint(
00580     FILE                *out,
00581     yfFlow_t            *flow,
00582     GError              **err);
00583 
00594 gboolean yfPrintDelimited(
00595     FILE                *out,
00596     yfFlow_t            *flow,
00597     gboolean            yaft_mac,
00598     GError              **err);
00599 
00609 void yfPrintColumnHeaders(
00610     FILE           *out,
00611     gboolean       yaft_mac,
00612     GError         **err);
00613 
00614 
00615 #endif
© 2006-2011 Carnegie Mellon University