decode.h
1 /*
2  * @internal
3  *
4  ** @file decode.h
5  ** YAF Layer 2 and Layer 3 decode routines
6  **
7  ** ------------------------------------------------------------------------
8  ** Copyright (C) 2007-2015 Carnegie Mellon University. All Rights Reserved.
9  ** ------------------------------------------------------------------------
10  ** Authors: Brian Trammell
11  ** ------------------------------------------------------------------------
12  ** @OPENSOURCE_HEADER_START@
13  ** Use of the YAF system and related source code is subject to the terms
14  ** of the following licenses:
15  **
16  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
17  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
18  **
19  ** NO WARRANTY
20  **
21  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER
22  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY
23  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN
24  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
25  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT
26  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE,
27  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE
28  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT,
29  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY
30  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF
31  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES.
32  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF
33  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON
34  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE
35  ** DELIVERABLES UNDER THIS LICENSE.
36  **
37  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie
38  ** Mellon University, its trustees, officers, employees, and agents from
39  ** all claims or demands made against them (and any related losses,
40  ** expenses, or attorney's fees) arising out of, or relating to Licensee's
41  ** and/or its sub licensees' negligent use or willful misuse of or
42  ** negligent conduct or willful misconduct regarding the Software,
43  ** facilities, or other rights or assistance granted by Carnegie Mellon
44  ** University under this License, including, but not limited to, any
45  ** claims of product liability, personal injury, death, damage to
46  ** property, or violation of any laws or regulations.
47  **
48  ** Carnegie Mellon University Software Engineering Institute authored
49  ** documents are sponsored by the U.S. Department of Defense under
50  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains
51  ** copyrights in all material produced under this contract. The U.S.
52  ** Government retains a non-exclusive, royalty-free license to publish or
53  ** reproduce these documents, or allow others to do so, for U.S.
54  ** Government purposes only pursuant to the copyright license under the
55  ** contract clause at 252.227.7013.
56  **
57  ** @OPENSOURCE_HEADER_END@
58  ** ------------------------------------------------------------------------
59  */
60 
75 #ifndef _YAF_DECODE_H_
76 #define _YAF_DECODE_H_
77 
78 #include <yaf/autoinc.h>
79 #include <yaf/yafcore.h>
80 
82 typedef struct yfIPFragInfo_st {
84  uint32_t ipid;
86  uint16_t offset;
88  uint16_t iphlen;
93  uint16_t l4hlen;
98  uint8_t frag;
102  uint8_t more;
104 
106 #define YF_MPLS_LABEL_COUNT_MAX 3
107 
109 typedef struct yfL2Info_st {
111  uint8_t smac[6];
113  uint8_t dmac[6];
115  uint16_t l2hlen;
117  uint16_t vlan_tag;
119  uint32_t mpls_count;
121  uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX];
122 } yfL2Info_t;
123 
125 typedef struct yfTCPInfo_st {
127  uint32_t seq;
129  uint8_t flags;
130 } yfTCPInfo_t;
131 
133 typedef struct yfPBuf_st {
135  uint64_t ptime;
139  size_t allHeaderLen;
141  struct pcap_pkthdr pcap_hdr;
143  pcap_t *pcapt;
145  uint64_t pcap_offset;
147  uint16_t pcap_caplist;
149  uint16_t iplen;
151  uint16_t ifnum;
156 # if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
157 
158  size_t headerLen;
160  uint8_t headerVal[YFP_IPTCPHEADER_SIZE];
161 # endif
162 
163  size_t paylen;
167  uint8_t payload[1];
168 } yfPBuf_t;
169 
171 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
172 
174 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
175 
177 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
178 
179 struct yfDecodeCtx_st;
181 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
182 
184 #define YF_TYPE_IPv4 0x0800
185 
186 #define YF_TYPE_IPv6 0x86DD
187 
191 #define YF_TYPE_IPANY 0x0000
192 
194 #define YF_PROTO_IP6_HOP 0
195 
196 #define YF_PROTO_ICMP 1
197 
198 #define YF_PROTO_TCP 6
199 
200 #define YF_PROTO_UDP 17
201 
202 #define YF_PROTO_IP6_ROUTE 43
203 
204 #define YF_PROTO_IP6_FRAG 44
205 
206 #define YF_PROTO_GRE 47
207 
208 #define YF_PROTO_ICMP6 58
209 
210 #define YF_PROTO_IP6_NONEXT 59
211 
212 #define YF_PROTO_IP6_DOPT 60
213 
215 #define YF_TF_FIN 0x01
216 
217 #define YF_TF_SYN 0x02
218 
219 #define YF_TF_RST 0x04
220 
221 #define YF_TF_PSH 0x08
222 
223 #define YF_TF_ACK 0x10
224 
225 #define YF_TF_URG 0x20
226 
227 #define YF_TF_ECE 0x40
228 
229 #define YF_TF_CWR 0x80
230 
249 yfDecodeCtx_t *yfDecodeCtxAlloc(
250  int datalink,
251  uint16_t reqtype,
252  gboolean gremode);
253 
259 void yfDecodeCtxFree(
260  yfDecodeCtx_t *ctx);
261 
297 gboolean yfDecodeToPBuf(
298  yfDecodeCtx_t *ctx,
299  uint64_t ptime,
300  size_t caplen,
301  const uint8_t *pkt,
302  yfIPFragInfo_t *fraginfo,
303  size_t pbuflen,
304  yfPBuf_t *pbuf);
305 
314 uint64_t yfDecodeTimeval(
315  const struct timeval *tv);
316 
325 uint64_t yfDecodeTimeNTP(
326  uint64_t ntp);
327 
335 void yfDecodeDumpStats(
336  yfDecodeCtx_t *ctx,
337  uint64_t packetTotal);
338 
345 void yfDecodeResetOffset(
346  yfDecodeCtx_t *ctx);
347 
354 uint32_t yfGetDecodeStats(
355  yfDecodeCtx_t *ctx);
356 
357 
371 gboolean yfDefragTCP(
372  uint8_t *pkt,
373  size_t *caplen,
374  yfFlowKey_t *key,
375  yfIPFragInfo_t *fraginfo,
376  yfTCPInfo_t *tcpinfo,
377  size_t *payoff);
378 
379 /* end idem */
380 #endif
uint16_t pcap_caplist
caplist
Definition: decode.h:147
uint8_t flags
TCP flags.
Definition: decode.h:129
uint16_t l4hlen
Decoded header length.
Definition: decode.h:93
uint16_t iplen
Packet IP length.
Definition: decode.h:149
#define YFP_IPTCPHEADER_SIZE
This is the size of the packet to store away for use primarily in passive OS fingerprinting, this value is only used if application labeling is enabled.
Definition: yafcore.h:182
YAF Core Library.
uint32_t ipid
Fragment ID.
Definition: decode.h:84
uint32_t mpls_count
MPLS label count.
Definition: decode.h:119
uint8_t more
More fragments flag.
Definition: decode.h:102
yfFlowKey_t key
Flow key containing decoded IP and transport headers.
Definition: decode.h:137
TCP information structure.
Definition: decode.h:125
uint8_t frag
Fragmented packet flag.
Definition: decode.h:98
yfTCPInfo_t tcpinfo
TCP information structure.
Definition: decode.h:153
size_t allHeaderLen
Length of all headers, L2, L3, L4.
Definition: decode.h:139
size_t paylen
Length of payload available in captured payload buffer.
Definition: decode.h:163
uint64_t ptime
Packet timestamp in epoch milliseconds.
Definition: decode.h:135
Packet decoding interface for YAF.
Definition: decode.h:82
yfL2Info_t l2info
Decoded layer 2 information.
Definition: decode.h:155
uint8_t smac[6]
Source MAC address.
Definition: decode.h:111
uint32_t seq
TCP sequence number.
Definition: decode.h:127
A YAF flow key.
Definition: yafcore.h:202
Datalink layer information structure.
Definition: decode.h:109
uint16_t vlan_tag
VLAN tag.
Definition: decode.h:117
pcap_t * pcapt
pcap struct
Definition: decode.h:143
Full packet information structure.
Definition: decode.h:133
uint16_t iphlen
IP header length.
Definition: decode.h:88
struct pcap_pkthdr pcap_hdr
pcap header
Definition: decode.h:141
uint8_t dmac[6]
Destination MAC address.
Definition: decode.h:113
uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX]
MPLS label stack.
Definition: decode.h:121
uint64_t pcap_offset
offset into pcap
Definition: decode.h:145
uint16_t offset
Fragment offset within the reassembled datagram.
Definition: decode.h:86
uint16_t ifnum
Interface number packet was decoded from.
Definition: decode.h:151
uint8_t payload[1]
Captured payload buffer.
Definition: decode.h:167
uint16_t l2hlen
Layer 2 Header Length.
Definition: decode.h:115