Software Engineering Institute | Carnegie Mellon©
CERT NetSA Security Suite
Monitoring for Large-Scale Networks

YAF

Documentation

YAF

  • Documentation
  • Downloads
  • Main Page
  • Data Structures
  • Files
  • File List
  • Globals

decode.h

00001 /*
00002  * @internal
00003  *
00004  ** @file decode.h
00005  ** YAF Layer 2 and Layer 3 decode routines
00006  **
00007  ** ------------------------------------------------------------------------
00008  ** Copyright (C) 2007-2012 Carnegie Mellon University. All Rights Reserved.
00009  ** ------------------------------------------------------------------------
00010  ** Authors: Brian Trammell
00011  ** ------------------------------------------------------------------------
00012  ** @OPENSOURCE_HEADER_START@
00013  ** Use of the YAF system and related source code is subject to the terms
00014  ** of the following licenses:
00015  **
00016  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
00017  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
00018  **
00019  ** NO WARRANTY
00020  **
00021  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER
00022  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY
00023  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN
00024  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
00025  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT
00026  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE,
00027  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE
00028  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT,
00029  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY
00030  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF
00031  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES.
00032  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF
00033  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON
00034  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE
00035  ** DELIVERABLES UNDER THIS LICENSE.
00036  **
00037  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie
00038  ** Mellon University, its trustees, officers, employees, and agents from
00039  ** all claims or demands made against them (and any related losses,
00040  ** expenses, or attorney's fees) arising out of, or relating to Licensee's
00041  ** and/or its sub licensees' negligent use or willful misuse of or
00042  ** negligent conduct or willful misconduct regarding the Software,
00043  ** facilities, or other rights or assistance granted by Carnegie Mellon
00044  ** University under this License, including, but not limited to, any
00045  ** claims of product liability, personal injury, death, damage to
00046  ** property, or violation of any laws or regulations.
00047  **
00048  ** Carnegie Mellon University Software Engineering Institute authored
00049  ** documents are sponsored by the U.S. Department of Defense under
00050  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains
00051  ** copyrights in all material produced under this contract. The U.S.
00052  ** Government retains a non-exclusive, royalty-free license to publish or
00053  ** reproduce these documents, or allow others to do so, for U.S.
00054  ** Government purposes only pursuant to the copyright license under the
00055  ** contract clause at 252.227.7013.
00056  **
00057  ** @OPENSOURCE_HEADER_END@
00058  ** ------------------------------------------------------------------------
00059  */
00060 
00075 #ifndef _YAF_DECODE_H_
00076 #define _YAF_DECODE_H_
00077 
00078 #include <yaf/autoinc.h>
00079 #include <yaf/yafcore.h>
00080 
00082 typedef struct yfIPFragInfo_st {
00084     uint32_t        ipid;
00086     uint16_t        offset;
00088     uint16_t        iphlen;
00093     uint16_t        l4hlen;
00098     uint8_t         frag;
00102     uint8_t         more;
00103 } yfIPFragInfo_t;
00104 
00106 #define YF_MPLS_LABEL_COUNT_MAX     10
00107 
00109 typedef struct yfL2Info_st {
00111     uint8_t         smac[6];
00113     uint8_t         dmac[6];
00115     uint16_t        l2hlen;
00117     uint16_t        vlan_tag;
00119     uint32_t        mpls_count;
00121     uint32_t        mpls_label[YF_MPLS_LABEL_COUNT_MAX];
00122 } yfL2Info_t;
00123 
00125 typedef struct yfTCPInfo_st {
00127     uint32_t        seq;
00129     uint8_t         flags;
00130 } yfTCPInfo_t;
00131 
00133 typedef struct yfPBuf_st {
00135     uint64_t        ptime;
00137     yfFlowKey_t     key;
00139     size_t          allHeaderLen;
00141     struct pcap_pkthdr     pcap_hdr;
00143     pcap_t          *pcapt;
00145     uint16_t        iplen;
00147     uint16_t        ifnum;
00149     yfTCPInfo_t     tcpinfo;
00151     yfL2Info_t      l2info;
00152 # if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
00153 
00154     size_t          headerLen;
00156     uint8_t         headerVal[YFP_IPTCPHEADER_SIZE];
00157 #   endif
00158 
00159     size_t          paylen;
00163     uint8_t         payload[1];
00164 } yfPBuf_t;
00165 
00167 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
00168 
00170 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
00171 
00173 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
00174 
00175 struct yfDecodeCtx_st;
00177 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
00178 
00180 #define YF_TYPE_IPv4    0x0800
00181 
00182 #define YF_TYPE_IPv6    0x86DD
00183 
00187 #define YF_TYPE_IPANY   0x0000
00188 
00190 #define YF_PROTO_IP6_HOP    0
00191 
00192 #define YF_PROTO_ICMP       1
00193 
00194 #define YF_PROTO_TCP        6
00195 
00196 #define YF_PROTO_UDP        17
00197 
00198 #define YF_PROTO_IP6_ROUTE  43
00199 
00200 #define YF_PROTO_IP6_FRAG   44
00201 
00202 #define YF_PROTO_GRE        47
00203 
00204 #define YF_PROTO_ICMP6      58
00205 
00206 #define YF_PROTO_IP6_NONEXT  59
00207 
00208 #define YF_PROTO_IP6_DOPT   60
00209 
00211 #define YF_TF_FIN       0x01
00212 
00213 #define YF_TF_SYN       0x02
00214 
00215 #define YF_TF_RST       0x04
00216 
00217 #define YF_TF_PSH       0x08
00218 
00219 #define YF_TF_ACK       0x10
00220 
00221 #define YF_TF_URG       0x20
00222 
00223 #define YF_TF_ECE       0x40
00224 
00225 #define YF_TF_CWR       0x80
00226 
00245 yfDecodeCtx_t *yfDecodeCtxAlloc(
00246     int             datalink,
00247     uint16_t        reqtype,
00248     gboolean        gremode);
00249 
00255 void yfDecodeCtxFree(
00256     yfDecodeCtx_t           *ctx);
00257 
00293 gboolean yfDecodeToPBuf(
00294     yfDecodeCtx_t           *ctx,
00295     uint64_t                ptime,
00296     size_t                  caplen,
00297     const uint8_t           *pkt,
00298     yfIPFragInfo_t          *fraginfo,
00299     size_t                  pbuflen,
00300     yfPBuf_t                *pbuf);
00301 
00310 uint64_t yfDecodeTimeval(
00311     const struct timeval    *tv);
00312 
00321 uint64_t yfDecodeTimeNTP(
00322     uint64_t                ntp);
00323 
00331 void yfDecodeDumpStats(
00332     yfDecodeCtx_t       *ctx,
00333     uint64_t            packetTotal);
00334 
00341 uint32_t yfGetDecodeStats(
00342     yfDecodeCtx_t *ctx);
00343 
00344 
00358 gboolean yfDefragTCP(
00359     uint8_t             *pkt,
00360     size_t              *caplen,
00361     yfFlowKey_t         *key,
00362     yfIPFragInfo_t      *fraginfo,
00363     yfTCPInfo_t         *tcpinfo,
00364     size_t              *payoff);
00365 
00366 /* end idem */
00367 #endif
© 2006-2012 Carnegie Mellon University