decode.h
1 /*
2  * @internal
3  *
4  ** @file decode.h
5  ** YAF Layer 2 and Layer 3 decode routines
6  **
7  ** ------------------------------------------------------------------------
8  ** Copyright (C) 2007-2021 Carnegie Mellon University. All Rights Reserved.
9  ** ------------------------------------------------------------------------
10  ** Authors: Brian Trammell
11  ** ------------------------------------------------------------------------
12  ** @OPENSOURCE_HEADER_START@
13  ** Use of the YAF system and related source code is subject to the terms
14  ** of the following licenses:
15  **
16  ** GNU General Public License (GPL) Rights pursuant to Version 2, June 1991
17  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
18  **
19  ** NO WARRANTY
20  **
21  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER
22  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY
23  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN
24  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
25  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT
26  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE,
27  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE
28  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT,
29  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY
30  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF
31  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES.
32  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF
33  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON
34  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE
35  ** DELIVERABLES UNDER THIS LICENSE.
36  **
37  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie
38  ** Mellon University, its trustees, officers, employees, and agents from
39  ** all claims or demands made against them (and any related losses,
40  ** expenses, or attorney's fees) arising out of, or relating to Licensee's
41  ** and/or its sub licensees' negligent use or willful misuse of or
42  ** negligent conduct or willful misconduct regarding the Software,
43  ** facilities, or other rights or assistance granted by Carnegie Mellon
44  ** University under this License, including, but not limited to, any
45  ** claims of product liability, personal injury, death, damage to
46  ** property, or violation of any laws or regulations.
47  **
48  ** Carnegie Mellon University Software Engineering Institute authored
49  ** documents are sponsored by the U.S. Department of Defense under
50  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains
51  ** copyrights in all material produced under this contract. The U.S.
52  ** Government retains a non-exclusive, royalty-free license to publish or
53  ** reproduce these documents, or allow others to do so, for U.S.
54  ** Government purposes only pursuant to the copyright license under the
55  ** contract clause at 252.227.7013.
56  **
57  ** @OPENSOURCE_HEADER_END@
58  ** ------------------------------------------------------------------------
59  */
60 
76 #ifndef _YAF_DECODE_H_
77 #define _YAF_DECODE_H_
78 
79 #include <yaf/autoinc.h>
80 #include <yaf/yafcore.h>
81 
83 typedef struct yfIPFragInfo_st {
85  uint32_t ipid;
87  uint16_t offset;
89  uint16_t iphlen;
94  uint16_t l4hlen;
99  uint8_t frag;
103  uint8_t more;
105 
107 #define YF_MPLS_LABEL_COUNT_MAX 3
108 
110 typedef struct yfL2Info_st {
112  uint8_t smac[6];
114  uint8_t dmac[6];
116  uint16_t l2hlen;
118  uint16_t vlan_tag;
120  uint32_t mpls_count;
122  uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX];
123 } yfL2Info_t;
124 
126 typedef struct yfMPTCPInfo_st {
128  uint64_t idsn;
130  uint32_t token;
132  uint16_t mss;
134  uint8_t flags;
135  /* address id */
136  uint8_t addrid;
137 } yfMPTCPInfo_t;
138 
140 typedef struct yfTCPInfo_st {
142  uint32_t seq;
144  uint8_t flags;
147 } yfTCPInfo_t;
148 
150 typedef struct yfPBuf_st {
152  uint64_t ptime;
156  size_t allHeaderLen;
158  struct pcap_pkthdr pcap_hdr;
160  pcap_t *pcapt;
162  uint64_t pcap_offset;
164  uint16_t pcap_caplist;
166  uint16_t iplen;
168  uint16_t ifnum;
171  uint8_t frag;
176 # if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
177 
178  size_t headerLen;
180  uint8_t headerVal[YFP_IPTCPHEADER_SIZE];
181 # endif /* if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT) */
182 
183  size_t paylen;
187  uint8_t payload[1];
188 } yfPBuf_t;
189 
191 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
192 
194 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
195 
197 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
198 
199 struct yfDecodeCtx_st;
201 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
202 
204 #define YF_TYPE_IPv4 0x0800
205 
206 #define YF_TYPE_IPv6 0x86DD
207 
211 #define YF_TYPE_IPANY 0x0000
212 
214 #define YF_PROTO_IP6_HOP 0
215 
216 #define YF_PROTO_ICMP 1
217 
218 #define YF_PROTO_TCP 6
219 
220 #define YF_PROTO_UDP 17
221 
222 #define YF_PROTO_IP6_ROUTE 43
223 
224 #define YF_PROTO_IP6_FRAG 44
225 
226 #define YF_PROTO_GRE 47
227 
228 #define YF_PROTO_ICMP6 58
229 
230 #define YF_PROTO_IP6_NONEXT 59
231 
232 #define YF_PROTO_IP6_DOPT 60
233 
235 #define YF_TF_FIN 0x01
236 
237 #define YF_TF_SYN 0x02
238 
239 #define YF_TF_RST 0x04
240 
241 #define YF_TF_PSH 0x08
242 
243 #define YF_TF_ACK 0x10
244 
245 #define YF_TF_URG 0x20
246 
247 #define YF_TF_ECE 0x40
248 
249 #define YF_TF_CWR 0x80
250 
252 #define YF_MF_PRIO_CHANGE 0x01
253 
254 #define YF_MF_PRIORITY 0x02
255 
256 #define YF_MF_FAIL 0x04
257 
258 #define YF_MF_FASTCLOSE 0x08
259 
277 yfDecodeCtx_t *
278 yfDecodeCtxAlloc(
279  int datalink,
280  uint16_t reqtype,
281  gboolean gremode);
282 
288 void
289 yfDecodeCtxFree(
290  yfDecodeCtx_t *ctx);
291 
326 gboolean
327 yfDecodeToPBuf(
328  yfDecodeCtx_t *ctx,
329  uint64_t ptime,
330  size_t caplen,
331  const uint8_t *pkt,
332  yfIPFragInfo_t *fraginfo,
333  size_t pbuflen,
334  yfPBuf_t *pbuf);
335 
343 uint64_t
344 yfDecodeTimeval(
345  const struct timeval *tv);
346 
354 uint64_t
355 yfDecodeTimeNTP(
356  uint64_t ntp);
357 
364 void
365 yfDecodeDumpStats(
366  yfDecodeCtx_t *ctx,
367  uint64_t packetTotal);
368 
375 void
376 yfDecodeResetOffset(
377  yfDecodeCtx_t *ctx);
378 
385 uint32_t
386 yfGetDecodeStats(
387  yfDecodeCtx_t *ctx);
388 
389 
403 gboolean
404 yfDefragTCP(
405  uint8_t *pkt,
406  size_t *caplen,
407  yfFlowKey_t *key,
408  yfIPFragInfo_t *fraginfo,
409  yfTCPInfo_t *tcpinfo,
410  size_t *payoff);
411 
412 #endif /* ifndef _YAF_DECODE_H_ */
uint32_t token
token
Definition: decode.h:130
size_t allHeaderLen
Length of all headers, L2, L3, L4.
Definition: decode.h:156
uint8_t dmac[6]
Destination MAC address.
Definition: decode.h:114
uint16_t iphlen
IP header length.
Definition: decode.h:89
TCP information structure.
Definition: decode.h:140
yfFlowKey_t key
Flow key containing decoded IP and transport headers.
Definition: decode.h:154
uint16_t mss
maximum segment size
Definition: decode.h:132
yfL2Info_t l2info
Decoded layer 2 information.
Definition: decode.h:175
uint8_t more
More fragments flag.
Definition: decode.h:103
uint16_t offset
Fragment offset within the reassembled datagram.
Definition: decode.h:87
uint8_t flags
TCP flags.
Definition: decode.h:144
#define YFP_IPTCPHEADER_SIZE
This is the size of the packet to store away for use primarily in passive OS fingerprinting,...
Definition: yafcore.h:188
struct pcap_pkthdr pcap_hdr
pcap header
Definition: decode.h:158
A YAF flow key.
Definition: yafcore.h:208
uint16_t iplen
Packet IP length.
Definition: decode.h:166
MPTCP information structure.
Definition: decode.h:126
uint16_t ifnum
Interface number packet was decoded from.
Definition: decode.h:168
pcap_t * pcapt
pcap struct
Definition: decode.h:160
uint8_t payload[1]
Captured payload buffer.
Definition: decode.h:187
uint8_t flags
flags
Definition: decode.h:134
uint32_t seq
TCP sequence number.
Definition: decode.h:142
uint64_t idsn
initial dsn
Definition: decode.h:128
size_t paylen
Length of payload available in captured payload buffer.
Definition: decode.h:183
yfMPTCPInfo_t mptcp
MPTCP Info.
Definition: decode.h:146
uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX]
MPLS label stack.
Definition: decode.h:122
uint16_t l2hlen
Layer 2 Header Length.
Definition: decode.h:116
uint16_t l4hlen
Decoded header length.
Definition: decode.h:94
YAF Core Library.
uint16_t pcap_caplist
caplist
Definition: decode.h:164
uint8_t frag
flag for determining if the packet was fragmented 0-no, 1-yes, 2-not fully assembled
Definition: decode.h:171
Full packet information structure.
Definition: decode.h:150
uint64_t pcap_offset
offset into pcap
Definition: decode.h:162
Packet decoding interface for YAF.
Definition: decode.h:83
uint32_t ipid
Fragment ID.
Definition: decode.h:85
uint32_t mpls_count
MPLS label count.
Definition: decode.h:120
Datalink layer information structure.
Definition: decode.h:110
yfTCPInfo_t tcpinfo
TCP information structure.
Definition: decode.h:173
uint64_t ptime
Packet timestamp in epoch milliseconds.
Definition: decode.h:152
uint8_t frag
Fragmented packet flag.
Definition: decode.h:99
uint16_t vlan_tag
VLAN tag.
Definition: decode.h:118
uint8_t smac[6]
Source MAC address.
Definition: decode.h:112