Software Engineering Institute | Carnegie Mellon©
CERT NetSA Security Suite
Monitoring for Large-Scale Networks

YAF

Documentation

YAF

  • Documentation
  • Downloads
  • Main Page
  • Data Structures
  • Files
  • File List
  • Globals

yafcore.h

Go to the documentation of this file.
00001 /*
00002  *
00003  ** @file yafcore.h
00004  ** YAF core I/O routines
00005  **
00006  ** ------------------------------------------------------------------------
00007  ** Copyright (C) 2006-2011 Carnegie Mellon University. All Rights Reserved.
00008  ** ------------------------------------------------------------------------
00009  ** Authors: Brian Trammell 
00010  ** ------------------------------------------------------------------------
00011  ** Use of the YAF system and related source code is subject to the terms 
00012  ** of the following licenses:
00013  ** 
00014  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
00015  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
00016  ** 
00017  ** NO WARRANTY
00018  ** 
00019  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER 
00020  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY 
00021  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN 
00022  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY 
00023  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT 
00024  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, 
00025  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE 
00026  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT, 
00027  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY 
00028  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF 
00029  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES. 
00030  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF 
00031  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON 
00032  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE 
00033  ** DELIVERABLES UNDER THIS LICENSE.
00034  ** 
00035  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie 
00036  ** Mellon University, its trustees, officers, employees, and agents from 
00037  ** all claims or demands made against them (and any related losses, 
00038  ** expenses, or attorney's fees) arising out of, or relating to Licensee's 
00039  ** and/or its sub licensees' negligent use or willful misuse of or 
00040  ** negligent conduct or willful misconduct regarding the Software, 
00041  ** facilities, or other rights or assistance granted by Carnegie Mellon 
00042  ** University under this License, including, but not limited to, any 
00043  ** claims of product liability, personal injury, death, damage to 
00044  ** property, or violation of any laws or regulations.
00045  ** 
00046  ** Carnegie Mellon University Software Engineering Institute authored 
00047  ** documents are sponsored by the U.S. Department of Defense under 
00048  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains 
00049  ** copyrights in all material produced under this contract. The U.S. 
00050  ** Government retains a non-exclusive, royalty-free license to publish or 
00051  ** reproduce these documents, or allow others to do so, for U.S. 
00052  ** Government purposes only pursuant to the copyright license under the 
00053  ** contract clause at 252.227.7013.
00054  ** 
00055  ** ------------------------------------------------------------------------
00056  */
00057 
00103 #ifndef _YAF_CORE_H_
00104 #define _YAF_CORE_H_
00105 
00106 #include <yaf/autoinc.h>
00107 #include <fixbuf/public.h>
00108 
00109 
00115 #define CERT_PEN    6871
00116 
00122 #define YAF_ERROR_DOMAIN        (g_quark_from_string("certYAFError"))
00123 
00124 #define YAF_ERROR_HEADER        1
00125 
00126 #define YAF_ERROR_ARGUMENT      2
00127 
00128 #define YAF_ERROR_IO            3
00129 
00130 #define YAF_ERROR_IPFIX         4
00131 
00132 #define YAF_ERROR_IMPL          5
00133 
00134 #define YAF_ERROR_INTERNAL      6
00135 
00136 #define YAF_ERROR_LIMIT         7
00137 
00138 #define YAF_ERROR_EOF           8
00139 
00140 #define YAF_ERROR_ALIGNMENT         9
00141 
00142 #define YAF_ERROR_PACKET_PAYLOAD    10
00143 
00144 
00145 
00150 #define YAF_FLOW_ACTIVE         0
00151 
00152 #define YAF_END_IDLE            1
00153 
00154 #define YAF_END_ACTIVE          2
00155 
00156 #define YAF_END_CLOSED          3
00157 
00158 #define YAF_END_FORCED          4
00159 
00160 #define YAF_END_RESOURCE        5
00161 
00162 #define YAF_END_UDPFORCE        0x1F
00163 
00164 #define YAF_SAME_SIZE           0x01
00165 
00166 #define YAF_END_MASK            0x7F
00167 
00169 #define YAF_ENDF_ISCONT         0x80
00170 
00172 #define YAF_IP_ICMP             1
00173 
00174 #define YAF_IP_TCP              6
00175 
00176 #define YAF_IP_UDP              17
00177 
00181 #define YFP_IPTCPHEADER_SIZE 128
00182 
00183 #define ETHERNET_MAC_ADDR_LENGTH 6
00184 
00186 #define YAF_MAX_HOOKS           4
00187 
00189 #define YAF_HOOKS_MAX_EXPORT    256
00190 
00195 typedef struct yfFlowKey_st {
00197     uint16_t            sp;
00199     uint16_t            dp;
00201     uint8_t             proto;
00203     uint8_t             version;
00205     uint16_t            vlanId;
00209     #if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_NAPATECH_SEPARATE_INTERFACES
00210     uint8_t             netIf;
00211     #endif
00212 
00213     union {
00214         struct {
00216             uint32_t    sip;
00218             uint32_t    dip;
00219         }               v4;
00220         struct {    
00222             uint8_t     sip[16];
00224             uint8_t     dip[16];
00225         }               v6;
00226     }                   addr;
00227 } yfFlowKey_t;
00228 
00229 
00234 typedef struct yfFlowVal_st {
00236     uint64_t    oct;
00238     uint64_t    pkt;
00239 #   if YAF_ENABLE_PAYLOAD
00240 
00241     uint32_t    paylen;
00243     uint8_t     *payload;
00244 #   endif
00245 
00246     uint32_t    isn;
00248     uint16_t    first_pkt_size;
00250     uint16_t    attributes;
00252     uint8_t     iflags;
00254     uint8_t     uflags;
00255 #   if YAF_ENABLE_ENTROPY
00256 
00257     uint8_t     entropy;
00259     uint8_t     entpad[7];
00260 #   endif
00261 #   if YAF_ENABLE_P0F
00262 
00263     const char  *osname;
00265     const char  *osver;
00267     uint8_t     fuzzyMatch;
00269     uint8_t     fuzzyPad[7];
00271     char  *osFingerPrint;
00272 #   endif
00273 #   if YAF_ENABLE_FPEXPORT
00274 
00275     uint32_t    firstPacketLen;
00277     uint32_t    secondPacketLen;
00279     uint8_t     *firstPacket;
00281     uint8_t     *secondPacket;
00282   
00283 #   endif
00284 
00285 } yfFlowVal_t;
00286 
00287 
00294 typedef struct yfFlow_st {
00296     uint64_t        stime;
00298     uint64_t        etime;
00299 #ifdef YAF_ENABLE_HOOKS
00300 
00304     void            *hfctx[YAF_MAX_HOOKS];
00305 #endif
00306 
00310     int32_t         rdtime;
00312     uint8_t         reason;
00313 #if YAF_ENABLE_APPLABEL
00314 
00315     uint16_t        appLabel;
00316 #endif
00317 
00318     uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00320     uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH];
00322     yfFlowVal_t     val;
00324     yfFlowVal_t     rval;
00326     yfFlowKey_t     key;
00327 } yfFlow_t;
00328 
00337 void yfAlignmentCheck(void);
00338 
00339 
00348 void yfFlowPrepare(
00349     yfFlow_t          *flow);
00350 
00358 void yfFlowCleanup(
00359     yfFlow_t          *flow);
00360 
00372 fBuf_t *yfWriterForFile(
00373     const char              *path,
00374     uint32_t                domain,
00375     GError                  **err);
00376 
00390 fBuf_t *yfWriterForFP(
00391     FILE                    *fp,
00392     uint32_t                domain,
00393     GError                  **err);
00394 
00404 fBuf_t *yfWriterForSpec(
00405     fbConnSpec_t            *spec,
00406     uint32_t                domain,
00407     GError                  **err);
00408 
00409 
00410 #ifdef HAVE_SPREAD
00411 
00423 fBuf_t *yfWriterForSpread(
00424     fbSpreadParams_t       *params,
00425     uint32_t               domain,
00426     uint16_t               *spreadGroupIndex,
00427     GError                 **err);
00428 
00429 #endif /* HAVE_SPREAD */
00430 
00445 gboolean yfWriteStatsFlow(
00446     void *yfContext,
00447     uint32_t pcap_drop,
00448     GTimer *timer,
00449     GError **err);
00450 
00463 gboolean yfWriteFlow(
00464     void                *yfContext,
00465     yfFlow_t            *flow,
00466     GError              **err);
00467 
00480 gboolean yfWriterClose(
00481     fBuf_t          *fbuf,
00482     gboolean        flush,
00483     GError          **err);
00484 
00489 void yfWriterExportPayload(
00490     gboolean            payload_mode);
00491 
00496 void yfWriterExportMappedV6(
00497     gboolean            map_mode);
00498 
00511 fBuf_t *yfReaderForFP(
00512     fBuf_t          *fbuf,
00513     FILE            *fp,
00514     GError          **err);
00515 
00532 fbListener_t *yfListenerForSpec(
00533     fbConnSpec_t        *spec,
00534     fbListenerAppInit_fn    appinit,
00535     fbListenerAppFree_fn    appfree,
00536     GError              **err);
00537 
00553 gboolean yfReadFlow(
00554     fBuf_t          *fbuf,
00555     yfFlow_t        *flow,
00556     GError          **err);
00557 
00576 gboolean yfReadFlowExtended(
00577     fBuf_t                  *fbuf,
00578     yfFlow_t                *flow,
00579     GError                  **err);
00580 
00588 void yfPrintString(
00589     GString             *rstr,
00590     yfFlow_t            *flow);
00591 
00600 void yfPrintDelimitedString(
00601     GString                 *rstr,
00602     yfFlow_t                *flow,
00603     gboolean                yaft_mac);
00604 
00614 gboolean yfPrint(
00615     FILE                *out,
00616     yfFlow_t            *flow,
00617     GError              **err);
00618 
00629 gboolean yfPrintDelimited(
00630     FILE                *out,
00631     yfFlow_t            *flow,
00632     gboolean            yaft_mac,
00633     GError              **err);
00634 
00644 void yfPrintColumnHeaders(
00645     FILE           *out,
00646     gboolean       yaft_mac,
00647     GError         **err);
00648 
00649 #if YAF_ENABLE_HOOKS
00650 
00655 fbInfoModel_t *yfDPIInfoModel();
00656 #endif 
00657 
00658 
00659 
00660 #endif
© 2006-2011 Carnegie Mellon University