decode.h

/*
 * @internal
 *
 ** @file decode.h
 ** YAF Layer 2 and Layer 3 decode routines
 **
 ** ------------------------------------------------------------------------
 ** Copyright (C) 2007-2015 Carnegie Mellon University. All Rights Reserved.
 ** ------------------------------------------------------------------------
 ** Authors: Brian Trammell
 ** ------------------------------------------------------------------------
 ** @OPENSOURCE_HEADER_START@
 ** Use of the YAF system and related source code is subject to the terms
 ** of the following licenses:
 **
 ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
 **
 ** NO WARRANTY
 **
 ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER
 ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY
 ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN
 ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
 ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT
 ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE,
 ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE
 ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT,
 ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY
 ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF
 ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES.
 ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF
 ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON
 ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE
 ** DELIVERABLES UNDER THIS LICENSE.
 **
 ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie
 ** Mellon University, its trustees, officers, employees, and agents from
 ** all claims or demands made against them (and any related losses,
 ** expenses, or attorney's fees) arising out of, or relating to Licensee's
 ** and/or its sub licensees' negligent use or willful misuse of or
 ** negligent conduct or willful misconduct regarding the Software,
 ** facilities, or other rights or assistance granted by Carnegie Mellon
 ** University under this License, including, but not limited to, any
 ** claims of product liability, personal injury, death, damage to
 ** property, or violation of any laws or regulations.
 **
 ** Carnegie Mellon University Software Engineering Institute authored
 ** documents are sponsored by the U.S. Department of Defense under
 ** Contract FA8721-05-C-0003. Carnegie Mellon University retains
 ** copyrights in all material produced under this contract. The U.S.
 ** Government retains a non-exclusive, royalty-free license to publish or
 ** reproduce these documents, or allow others to do so, for U.S.
 ** Government purposes only pursuant to the copyright license under the
 ** contract clause at 252.227.7013.
 **
 ** @OPENSOURCE_HEADER_END@
 ** ------------------------------------------------------------------------
 */

#ifndef _YAF_DECODE_H_
#define _YAF_DECODE_H_

#include <yaf/autoinc.h>
#include <yaf/yafcore.h>

typedef struct yfIPFragInfo_st {
    uint32_t        ipid;
    uint16_t        offset;
    uint16_t        iphlen;
    uint16_t        l4hlen;
    uint8_t         frag;
    uint8_t         more;
} yfIPFragInfo_t;

#define YF_MPLS_LABEL_COUNT_MAX     3

typedef struct yfL2Info_st {
    uint8_t         smac[6];
    uint8_t         dmac[6];
    uint16_t        l2hlen;
    uint16_t        vlan_tag;
    uint32_t        mpls_count;
    uint32_t        mpls_label[YF_MPLS_LABEL_COUNT_MAX];
} yfL2Info_t;

typedef struct yfMPTCPInfo_st {
    uint64_t        idsn;
    uint32_t        token;
    uint16_t        mss;
    uint8_t         flags;
    /* address id */
    uint8_t         addrid;
} yfMPTCPInfo_t;

typedef struct yfTCPInfo_st {
    uint32_t        seq;
    uint8_t         flags;
    yfMPTCPInfo_t   mptcp;
} yfTCPInfo_t;

typedef struct yfPBuf_st {
    uint64_t        ptime;
    yfFlowKey_t     key;
    size_t          allHeaderLen;
    struct pcap_pkthdr  pcap_hdr;
    pcap_t          *pcapt;
    uint64_t        pcap_offset;
    uint16_t        pcap_caplist;
    uint16_t        iplen;
    uint16_t        ifnum;
    uint8_t         frag;
    yfTCPInfo_t     tcpinfo;
    yfL2Info_t      l2info;
# if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)

    size_t          headerLen;
    uint8_t         headerVal[YFP_IPTCPHEADER_SIZE];
#   endif

    size_t          paylen;
    uint8_t         payload[1];
} yfPBuf_t;

#define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)

#define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)

#define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)

struct yfDecodeCtx_st;
typedef struct yfDecodeCtx_st yfDecodeCtx_t;

#define YF_TYPE_IPv4    0x0800

#define YF_TYPE_IPv6    0x86DD

#define YF_TYPE_IPANY   0x0000

#define YF_PROTO_IP6_HOP    0

#define YF_PROTO_ICMP       1

#define YF_PROTO_TCP        6

#define YF_PROTO_UDP        17

#define YF_PROTO_IP6_ROUTE  43

#define YF_PROTO_IP6_FRAG   44

#define YF_PROTO_GRE        47

#define YF_PROTO_ICMP6      58

#define YF_PROTO_IP6_NONEXT  59

#define YF_PROTO_IP6_DOPT   60

#define YF_TF_FIN       0x01

#define YF_TF_SYN       0x02

#define YF_TF_RST       0x04

#define YF_TF_PSH       0x08

#define YF_TF_ACK       0x10

#define YF_TF_URG       0x20

#define YF_TF_ECE       0x40

#define YF_TF_CWR       0x80

#define YF_MF_PRIO_CHANGE    0x01

#define YF_MF_PRIORITY       0x02

#define YF_MF_FAIL           0x04

#define YF_MF_FASTCLOSE      0x08

yfDecodeCtx_t *yfDecodeCtxAlloc(
    int             datalink,
    uint16_t        reqtype,
    gboolean        gremode);

void yfDecodeCtxFree(
    yfDecodeCtx_t           *ctx);

gboolean yfDecodeToPBuf(
    yfDecodeCtx_t           *ctx,
    uint64_t                ptime,
    size_t                  caplen,
    const uint8_t           *pkt,
    yfIPFragInfo_t          *fraginfo,
    size_t                  pbuflen,
    yfPBuf_t                *pbuf);

uint64_t yfDecodeTimeval(
    const struct timeval    *tv);

uint64_t yfDecodeTimeNTP(
    uint64_t                ntp);

void yfDecodeDumpStats(
    yfDecodeCtx_t       *ctx,
    uint64_t            packetTotal);

void yfDecodeResetOffset(
    yfDecodeCtx_t *ctx);

uint32_t yfGetDecodeStats(
    yfDecodeCtx_t *ctx);


gboolean yfDefragTCP(
    uint8_t             *pkt,
    size_t              *caplen,
    yfFlowKey_t         *key,
    yfIPFragInfo_t      *fraginfo,
    yfTCPInfo_t         *tcpinfo,
    size_t              *payoff);

/* end idem */
#endif