NAF Core Library

libnaf 0.6.0 API documentation

nafcore.h

Go to the documentation of this file.

/*
 ** nafcore.h
 ** NetSA Aggregated Flow (NAF) core ADT support
 **
 ** ------------------------------------------------------------------------
 ** Copyright (C) 2005-2007 Carnegie Mellon University. All Rights Reserved.
 ** ------------------------------------------------------------------------
 ** Authors: Brian Trammell <bht@cert.org>
 ** ------------------------------------------------------------------------
 ** GNU General Public License (GPL) Rights pursuant to Version 2, June 1991
 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.225-7013
 ** ------------------------------------------------------------------------
 */

/* idem hack */
#ifndef _NAF_NAFCORE_H_
#define _NAF_NAFCORE_H_

#include <naf/autoinc.h>

/* NAF core integral type definitions */

typedef uint32_t NAFTimeSec;

typedef struct _NAFlowKey {
    uint32_t            srcid;
    NAFTimeSec          bin;
    uint32_t         sip;
    uint32_t         dip;
    uint16_t            sp;
    uint16_t            dp;
    uint8_t             sipmask;
    uint8_t             dipmask;
    uint8_t             proto;
} NAFlowKey;    

typedef struct _NAFlowVUC {
    GHashTable          *htab;
    GHashTable          *rhtab;
    GHashTable          *ptab;
    GHashTable          *rptab;
} NAFlowVUC;

typedef struct _NAFlowVal {
    uint64_t            oct;
    uint64_t            roct;
    uint64_t            pkt;
    uint64_t            rpkt;
    uint32_t            flo;
    uint32_t            rflo;
    uint32_t            host;
    uint32_t            rhost;
    uint16_t            port;
    uint16_t            rport;
    NAFlowVUC           *vuc;
} NAFlowVal;

typedef struct _NAFlow {
    NAFlowKey   k;
    NAFlowVal   v;
} NAFlow;


typedef struct _NAFlowRaw {
    uint64_t        oct;
    uint64_t        roct;
    uint64_t        pkt;
    uint64_t        rpkt;
    uint32_t        flo;
    uint32_t        rflo;
    uint32_t        stime;
    uint32_t        etime;
    uint32_t        srcid;
    uint32_t     sip;
    uint32_t     dip;
    uint16_t        sp;
    uint16_t        dp;
    uint8_t         sipmask;
    uint8_t         dipmask;
    uint8_t         proto;
    char            pad0[5];
} NAFlowRaw;    

#define NAF_FM_SRCID    0x00000001

#define NAF_FM_SIP      0x00000002

#define NAF_FM_SIPMASK  0x00000004

#define NAF_FM_DIP      0x00000008

#define NAF_FM_DIPMASK  0x00000010

#define NAF_FM_PROTO    0x00000020

#define NAF_FM_SP       0x00000040

#define NAF_FM_DP       0x00000080

#define NAF_FM_OCT      0x00000100

#define NAF_FM_ROCT     0x00000200

#define NAF_FM_PKT      0x00000400

#define NAF_FM_RPKT     0x00000800

#define NAF_FM_FLO      0x00001000

#define NAF_FM_RFLO     0x00002000

#define NAF_FM_SHOSTC   0x00004000

#define NAF_FM_DHOSTC   0x00008000

#define NAF_FM_SPORTC   0x00010000

#define NAF_FM_DPORTC   0x00020000

#define NAF_FM_REVSORT  0x10000000

#define NAF_FM_MTOTAL   0x20000000

#define NAF_FM_VPAD     0x40000000

#define NAF_FM_VSTIME   0x80000000

#define NAF_FM_MASKF    0x0003FFFF

#define NAF_FM_MASKINT  0xF0000000


#define NAF_BA_NONE     0x00000000

#define NAF_BA_UNIFORM  0x00000001

#define NAF_BA_START    0x00000002

#define NAF_BA_END      0x00000003

#define NAF_IP_ICMP     1

#define NAF_IP_TCP      6

#define NAF_IP_UDP      17

typedef struct _NAFlowMask {
    uint16_t        sipmask;
    uint16_t        dipmask;
    uint32_t     sipmaskbits;
    uint32_t     dipmaskbits;
    uint32_t        fieldmask;
    NAFTimeSec      binsize;
    uint32_t        binalg;
} NAFlowMask;

/* error handling */

#define NAF_ERROR_DOMAIN        (g_quark_from_string("certNAFError"))

#define NAF_ERROR_HEADER        1

#define NAF_ERROR_ARGUMENT      2

#define NAF_ERROR_IO            3

#define NAF_ERROR_HORIZON       4

#define NAF_ERROR_MULTIPLE      5

#define NAF_ERROR_EOF           6

fbInfoModel_t *nfInfoModel();

fBuf_t *nfReaderForFP(
    fBuf_t          *fbuf,
    FILE            *fp,
    NAFlowMask      *mask,
    GError          **err);

 gboolean nfRead(
    fBuf_t                  *fbuf,
    NAFlowMask              *mask,
    NAFlowKey               *key,
    NAFlowVal               *val,
    GError                  **err);

fBuf_t *nfWriterForFP(
    fBuf_t                  *fbuf,
    FILE                    *fp,
    uint32_t                domain,
    NAFlowMask              *mask,
    GError                  **err);

gboolean nfWrite(
    fBuf_t                  *fbuf,
    NAFlowMask              *mask,
    NAFlowKey               *key,
    NAFlowVal               *val,
    GError                  **err);

gboolean nfWriterClose(
    fBuf_t          *fbuf,
    GError          **err);

void nfDumpFlow(
    NAFlowKey           *key,
    NAFlowVal           *val,
    const char          *inf);

/* end idem */
#endif

This library is part of the NetSA Security Suite, developed by the CERT NetSA group
at the Software Engineering Institute at Carnegie Mellon University.

© 2006 Carnegie Mellon University