YAF Core Library

libyaf 0.8.0 API documentation

decode.h

Go to the documentation of this file.

/*
 ** decode.h
 ** YAF Layer 2 and Layer 3 decode routines
 **
 ** ------------------------------------------------------------------------
 ** Copyright (C) 2007 Carnegie Mellon University. All Rights Reserved.
 ** ------------------------------------------------------------------------
 ** Authors: Brian Trammell <bht@cert.org>
 ** ------------------------------------------------------------------------
 ** GNU General Public License (GPL) Rights pursuant to Version 2, June 1991
 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.225-7013
 ** ------------------------------------------------------------------------
 */

#ifndef _YAF_DECODE_H_
#define _YAF_DECODE_H_

#include <yaf/autoinc.h>
#include <yaf/yafcore.h>

#define YF_MPLS_LABEL_COUNT_MAX     10

typedef struct yfL2Info_st {
    uint8_t         smac[6];
    uint8_t         dmac[6];
    uint16_t        vlan_tag;
    uint32_t        mpls_count;
    uint32_t        mpls_label[YF_MPLS_LABEL_COUNT_MAX];
} yfL2Info_t;

typedef struct yfIPFragInfo_st {
    uint32_t        ipid;
    uint16_t        offset;
    uint16_t        iphlen;
    uint16_t        l4hlen;
    uint8_t         frag;
    uint8_t         more;
} yfIPFragInfo_t;

typedef struct yfTCPInfo_st {
    uint32_t        seq;
    uint8_t         flags;
} yfTCPInfo_t;

#define YF_TYPE_IPv4    0x0800

#define YF_TYPE_IPv6    0x86DD

#define YF_TYPE_IPANY   0x0000

#define YF_PROTO_IP6_HOP    0

#define YF_PROTO_ICMP       1

#define YF_PROTO_TCP        6

#define YF_PROTO_UDP        17

#define YF_PROTO_IP6_ROUTE  43

#define YF_PROTO_IP6_FRAG   44

#define YF_PROTO_GRE        47

#define YF_PROTO_ICMP6      58

#define YF_PROTO_IP6_DOPT   60

#define YF_TF_FIN   0x01

#define YF_TF_SYN   0x02

#define YF_TF_RST   0x04

#define YF_TF_PSH   0x08

#define YF_TF_ACK   0x10

#define YF_TF_URG   0x20

#define YF_TF_ECE   0x40

#define YF_TF_CWR   0x80

gboolean yfDecodePkt(
    int                     datalink,
    uint16_t                reqtype,
    const struct timeval    *ptime,
    size_t                  *caplen,
    const uint8_t           *pkt,
    yfFlowKey_t             *key,
    uint16_t                *iplen,
    yfTCPInfo_t             *tcpinfo,
    yfIPFragInfo_t          *fraginfo,
    yfL2Info_t              *l2info,
    const uint8_t           **payload);

void yfDecodeDumpStats();

/* end idem */
#endif 

This library is part of the NetSA Security Suite, developed by the CERT NetSA group
at the Software Engineering Institute at Carnegie Mellon University.

© 2006-2008 Carnegie Mellon University