decode.h
1/*
2 * Copyright 2007-2023 Carnegie Mellon University
3 * See license information in LICENSE.txt.
4 */
5/*
6 * decode.h
7 * YAF Layer 2 and Layer 3 decode routines
8 *
9 * ------------------------------------------------------------------------
10 * Authors: Brian Trammell
11 * ------------------------------------------------------------------------
12 * @DISTRIBUTION_STATEMENT_BEGIN@
13 * YAF 2.14.0
14 *
15 * Copyright 2023 Carnegie Mellon University.
16 *
17 * NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
18 * INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
19 * UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
20 * AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
21 * PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF
22 * THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF
23 * ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT
24 * INFRINGEMENT.
25 *
26 * Released under a GNU GPL 2.0-style license, please see LICENSE.txt or
27 * contact permission@sei.cmu.edu for full terms.
28 *
29 * [DISTRIBUTION STATEMENT A] This material has been approved for public
30 * release and unlimited distribution. Please see Copyright notice for
31 * non-US Government use and distribution.
32 *
33 * GOVERNMENT PURPOSE RIGHTS - Software and Software Documentation
34 *
35 * Contract No.: FA8702-15-D-0002
36 *
37 * Contractor Name: Carnegie Mellon University
38 *
39 * Contractor Address: 4500 Fifth Avenue, Pittsburgh, PA 15213
40 *
41 * The Government's rights to use, modify, reproduce, release, perform,
42 * display, or disclose this software are restricted by paragraph (b)(2) of
43 * the Rights in Noncommercial Computer Software and Noncommercial Computer
44 * Software Documentation clause contained in the above identified
45 * contract. No restrictions apply after the expiration date shown
46 * above. Any reproduction of the software or portions thereof marked with
47 * this legend must also reproduce the markings.
48 *
49 * Carnegie Mellon(R) and CERT(R) are registered in the U.S. Patent and
50 * Trademark Office by Carnegie Mellon University.
51 *
52 * This Software includes and/or makes use of Third-Party Software each
53 * subject to its own license.
54 *
55 * DM23-0544
56 * @DISTRIBUTION_STATEMENT_END@
57 * ------------------------------------------------------------------------
58 */
59
78#ifndef _YAF_DECODE_H_
79#define _YAF_DECODE_H_
80
81#include <yaf/autoinc.h>
82#include <yaf/yafcore.h>
83
85typedef struct yfIPFragInfo_st {
87 uint32_t ipid;
89 uint16_t offset;
91 uint16_t iphlen;
96 uint16_t l4hlen;
101 uint8_t frag;
105 uint8_t more;
107
109#define YF_MPLS_LABEL_COUNT_MAX 3
110
112typedef struct yfL2Info_st {
114 uint8_t smac[6];
116 uint8_t dmac[6];
118 uint16_t l2hlen;
120 uint16_t vlan_tag;
122 uint32_t mpls_count;
124 uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX];
125} yfL2Info_t;
126
128typedef struct yfMPTCPInfo_st {
130 uint64_t idsn;
132 uint32_t token;
134 uint16_t mss;
136 uint8_t flags;
137 /* address id */
138 uint8_t addrid;
140
142typedef struct yfTCPInfo_st {
144 uint32_t seq;
146 uint8_t flags;
150
152typedef struct yfPBuf_st {
154 uint64_t ptime;
160 struct pcap_pkthdr pcap_hdr;
162 pcap_t *pcapt;
164 uint64_t pcap_offset;
166 uint16_t pcap_caplist;
168 uint32_t iplen;
170 uint16_t ifnum;
173 uint8_t frag;
178# if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
180 size_t headerLen;
182 uint8_t headerVal[YFP_IPTCPHEADER_SIZE];
183# endif /* if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT) */
185 size_t paylen;
189 uint8_t payload[1];
190} yfPBuf_t;
191
193#define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
194
196#define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
197
199#define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
200
201struct yfDecodeCtx_st;
203typedef struct yfDecodeCtx_st yfDecodeCtx_t;
204
206#define YF_TYPE_IPv4 0x0800
208#define YF_TYPE_IPv6 0x86DD
213#define YF_TYPE_IPANY 0x0000
214
216#define YF_PROTO_IP6_HOP 0
218#define YF_PROTO_ICMP 1
220#define YF_PROTO_TCP 6
222#define YF_PROTO_UDP 17
224#define YF_PROTO_IP6_ROUTE 43
226#define YF_PROTO_IP6_FRAG 44
228#define YF_PROTO_GRE 47
230#define YF_PROTO_ICMP6 58
232#define YF_PROTO_IP6_NONEXT 59
234#define YF_PROTO_IP6_DOPT 60
235
237#define YF_TF_FIN 0x01
239#define YF_TF_SYN 0x02
241#define YF_TF_RST 0x04
243#define YF_TF_PSH 0x08
245#define YF_TF_ACK 0x10
247#define YF_TF_URG 0x20
249#define YF_TF_ECE 0x40
251#define YF_TF_CWR 0x80
252
254#define YF_MF_PRIO_CHANGE 0x01
256#define YF_MF_PRIORITY 0x02
258#define YF_MF_FAIL 0x04
260#define YF_MF_FASTCLOSE 0x08
261
279yfDecodeCtx_t *
280yfDecodeCtxAlloc(
281 int datalink,
282 uint16_t reqtype,
283 gboolean gremode);
284
290void
291yfDecodeCtxFree(
292 yfDecodeCtx_t *ctx);
293
328gboolean
329yfDecodeToPBuf(
330 yfDecodeCtx_t *ctx,
331 uint64_t ptime,
332 size_t caplen,
333 const uint8_t *pkt,
334 yfIPFragInfo_t *fraginfo,
335 size_t pbuflen,
336 yfPBuf_t *pbuf);
337
345uint64_t
346yfDecodeTimeval(
347 const struct timeval *tv);
348
356uint64_t
357yfDecodeTimeNTP(
358 uint64_t ntp);
359
366void
367yfDecodeDumpStats(
368 yfDecodeCtx_t *ctx,
369 uint64_t packetTotal);
370
377void
378yfDecodeResetOffset(
379 yfDecodeCtx_t *ctx);
380
387uint32_t
388yfGetDecodeStats(
389 yfDecodeCtx_t *ctx);
390
391
405gboolean
406yfDefragTCP(
407 uint8_t *pkt,
408 size_t *caplen,
409 yfFlowKey_t *key,
410 yfIPFragInfo_t *fraginfo,
411 yfTCPInfo_t *tcpinfo,
412 size_t *payoff);
413
414#endif /* ifndef _YAF_DECODE_H_ */
A YAF flow key.
Definition: yafcore.h:211
Fragmentation information structure.
Definition: decode.h:85
uint16_t offset
Fragment offset within the reassembled datagram.
Definition: decode.h:89
uint16_t l4hlen
Decoded header length.
Definition: decode.h:96
uint8_t more
More fragments flag.
Definition: decode.h:105
uint32_t ipid
Fragment ID.
Definition: decode.h:87
uint16_t iphlen
IP header length.
Definition: decode.h:91
uint8_t frag
Fragmented packet flag.
Definition: decode.h:101
Datalink layer information structure.
Definition: decode.h:112
uint16_t vlan_tag
VLAN tag.
Definition: decode.h:120
uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX]
MPLS label stack.
Definition: decode.h:124
uint32_t mpls_count
MPLS label count.
Definition: decode.h:122
uint8_t dmac[6]
Destination MAC address.
Definition: decode.h:116
uint16_t l2hlen
Layer 2 Header Length.
Definition: decode.h:118
uint8_t smac[6]
Source MAC address.
Definition: decode.h:114
MPTCP information structure.
Definition: decode.h:128
uint32_t token
token
Definition: decode.h:132
uint8_t flags
flags
Definition: decode.h:136
uint64_t idsn
initial dsn
Definition: decode.h:130
uint16_t mss
maximum segment size
Definition: decode.h:134
Full packet information structure.
Definition: decode.h:152
uint64_t pcap_offset
offset into pcap
Definition: decode.h:164
uint64_t ptime
Packet timestamp in epoch milliseconds.
Definition: decode.h:154
yfTCPInfo_t tcpinfo
TCP information structure.
Definition: decode.h:175
uint32_t iplen
Packet IP length.
Definition: decode.h:168
yfL2Info_t l2info
Decoded layer 2 information.
Definition: decode.h:177
pcap_t * pcapt
pcap struct
Definition: decode.h:162
uint16_t ifnum
Interface number packet was decoded from.
Definition: decode.h:170
uint16_t pcap_caplist
caplist
Definition: decode.h:166
size_t paylen
Length of payload available in captured payload buffer.
Definition: decode.h:185
size_t allHeaderLen
Length of all headers, L2, L3, L4.
Definition: decode.h:158
struct pcap_pkthdr pcap_hdr
pcap header
Definition: decode.h:160
yfFlowKey_t key
Flow key containing decoded IP and transport headers.
Definition: decode.h:156
uint8_t frag
flag for determining if the packet was fragmented 0-no, 1-yes, 2-not fully assembled
Definition: decode.h:173
uint8_t payload[1]
Captured payload buffer.
Definition: decode.h:189
TCP information structure.
Definition: decode.h:142
uint32_t seq
TCP sequence number.
Definition: decode.h:144
uint8_t flags
TCP flags.
Definition: decode.h:146
yfMPTCPInfo_t mptcp
MPTCP Info.
Definition: decode.h:148
YAF Core Library.
#define YFP_IPTCPHEADER_SIZE
This is the size of the packet to store away for use primarily in passive OS fingerprinting,...
Definition: yafcore.h:191