CERT NetSA Security Suite  Open Source Tools for Network Monitoring

News | Downloads | Documentation | Tooltips

YAF 0.8.1 | NAF 0.6.0 | SiLK 1.1.1 | RAVE 1.9.9 | Portal 0.8.0
fixbuf 0.7.3 | ipa 0.2.1 | airdbc 0.2.2 | airframe 0.7.2

YAF - Documentation - Core Library 0.8.1 API

Documentation | Downloads

yafcore.h

Go to the documentation of this file.

/*
 ** yafcore.h
 ** YAF core I/O routines
 **
 ** ------------------------------------------------------------------------
 ** Copyright (C) 2006-2008 Carnegie Mellon University. All Rights Reserved.
 ** ------------------------------------------------------------------------
 ** Authors: Brian Trammell <bht@cert.org>
 ** ------------------------------------------------------------------------
 ** GNU General Public License (GPL) Rights pursuant to Version 2, June 1991
 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.225-7013
 ** ------------------------------------------------------------------------
 */

#ifndef _YAF_CORE_H_
#define _YAF_CORE_H_

#include <yaf/autoinc.h>
#include <fixbuf/public.h>

#define YAF_ERROR_DOMAIN        (g_quark_from_string("certYAFError"))

#define YAF_ERROR_HEADER        1

#define YAF_ERROR_ARGUMENT      2

#define YAF_ERROR_IO            3

#define YAF_ERROR_IPFIX         4

#define YAF_ERROR_IMPL          5

#define YAF_ERROR_INTERNAL      6

#define YAF_ERROR_LIMIT         7

#define YAF_ERROR_EOF           8

#define YAF_FLOW_ACTIVE         0

#define YAF_END_IDLE            1

#define YAF_END_ACTIVE          2

#define YAF_END_CLOSED          3

#define YAF_END_FORCED          4

#define YAF_END_RESOURCE        5

#define YAF_END_MASK            0x7f

#define YAF_ENDF_ISCONT         0x80

#define YAF_IP_ICMP             1

#define YAF_IP_TCP              6

#define YAF_IP_UDP              17


#define YAF_MAX_HOOKS           4

#define YAF_HOOKS_MAX_EXPORT    256

typedef struct yfFlowKey_st {
    uint16_t            sp;
    uint16_t            dp;
    uint8_t             proto;
    uint8_t             version;
    union {
        struct {
            uint32_t    sip;
            uint32_t    dip;
        }               v4;
        struct {    
            uint8_t     sip[16];
            uint8_t     dip[16];
        }               v6;
    }                   addr;
} yfFlowKey_t;


typedef struct yfFlowVal_st {
    uint64_t    oct;
    uint64_t    pkt;
#   if YAF_ENABLE_PAYLOAD == 1

    uint32_t    paylen;
    uint8_t     *payload;
#   endif

    uint32_t    isn;
    uint8_t     iflags;
    uint8_t     uflags;
#   ifdef YAF_ENABLE_ENTROPY
    uint8_t     entropyDist[256];
    uint8_t     entropyVal;
#   endif

    uint16_t    tag;
} yfFlowVal_t;

#ifdef YAF_ENABLE_APPLABEL
typedef struct yfFlowAppLabelerState_st {
    uint8_t protoClassified:1;
    uint8_t forwardClassComplete:1;
    uint8_t reverseClassComplete:1;
    uint8_t :5;
} yfFlowAppLabelerState_t;
#define YAF_FLOW_APPLABELER_STATE_UNCLASSIFIED 0
#endif

typedef struct yfFlow_st {
    uint64_t        stime;
    uint64_t        etime;
    #ifdef YAF_ENABLE_APPLABEL

    yfFlowAppLabelerState_t appLabelerState;
    uint16_t        appLabel;
    #endif

    int32_t         rdtime;
    uint8_t         reason;
    yfFlowVal_t     val;
    yfFlowVal_t     rval;
    yfFlowKey_t     key;
} yfFlow_t;

void yfFlowPrepare(
    yfFlow_t          *flow);

void yfFlowCleanup(
    yfFlow_t          *flow);

fBuf_t *yfWriterForFile(
    const char              *path,
    uint32_t                domain,
    GError                  **err);

fBuf_t *yfWriterForFP(
    FILE                    *fp,
    uint32_t                domain,
    GError                  **err);

fBuf_t *yfWriterForSpec(
    fbConnSpec_t            *spec,
    uint32_t                domain,
    GError                  **err);

gboolean yfWriteFlow(
    fBuf_t              *fbuf,
    yfFlow_t            *flow,
    GError              **err);

gboolean yfWriterClose(
    fBuf_t          *fbuf,
    gboolean        flush,
    GError          **err);

fBuf_t *yfReaderForFP(
    fBuf_t          *fbuf,
    FILE            *fp,
    GError          **err);

fbListener_t *yfListenerForSpec(
    fbConnSpec_t        *spec,
    fbListenerAppInit_fn    appinit,
    fbListenerAppFree_fn    appfree,
    GError              **err);

gboolean yfReadFlow(
    fBuf_t          *fbuf,
    yfFlow_t        *flow,
    GError          **err);

gboolean yfReadFlowExtended(
    fBuf_t                  *fbuf,
    yfFlow_t                *flow,
    GError                  **err);

void yfPrintString(
    GString             *rstr,
    yfFlow_t            *flow);

void yfPrintDelimitedString(
    GString                 *rstr,
    yfFlow_t                *flow);

gboolean yfPrint(
    FILE                *out,
    yfFlow_t            *flow,
    GError              **err);

gboolean yfPrintDelimited(
    FILE                *out,
    yfFlow_t            *flow,
    GError              **err);

#endif

YAF | NAF | SiLK | RAVE | fixbuf | ipa | airdbc | airframe | Portal

This library is part of the NetSA Security Suite, developed by the CERT NetSA group
at the Software Engineering Institute at Carnegie Mellon University.

© 2006-2008 Carnegie Mellon University