-
Notifications
You must be signed in to change notification settings - Fork 5
/
lprobe.h
1948 lines (1617 loc) · 56.6 KB
/
lprobe.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* lprobe - a Netflow v5/v9/IPFIX probe for IPv4/v6
*
* Copyright (C) 2002-14 Luca Deri <deri@ltop.org>
*
* http://www.ltop.org/
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#ifndef _lprobe_H_
#define _lprobe_H_
/* *************************** */
//#define DEMO
#define MAX_DEMO_FLOWS 25000
#ifdef DEMO
#define DEMO_MODE
//#define MAKE_STATIC_PLUGINS
#endif
/* *************************** */
#include "config.h"
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
/* See http://www.redhat.com/magazine/009jul05/features/execshield/ */
#ifdef __OPTIMIZE__
#ifndef _FORTIFY_SOURCE
#define _FORTIFY_SOURCE 2
#endif
#endif
#if defined(linux) || defined(__linux__)
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
/*
* This allows to hide the (minimal) differences between Linux and BSD
*/
#include <features.h>
#ifndef __FAVOR_BSD
#define __FAVOR_BSD
#endif
#ifndef _BSD_SOURCE
#define _BSD_SOURCE
#endif
#endif /* linux || __linux__ */
#ifdef WIN32
#include <winsock2.h> /* winsock.h is included automatically */
#include <process.h>
#include <io.h>
#include <process.h> /* for getpid() and the exec..() family */
#define srandom srand
#define random rand
#ifndef localtime
#define localtime_r(a,b) localtime(a)
#endif
/* Values for the second argument to access.
These may be OR'd together. */
#define R_OK 4 /* Test for read permission. */
#define W_OK 2 /* Test for write permission. */
//#define X_OK 1 /* execute permission - unsupported in windows*/
#define F_OK 0 /* Test for existence. */
#define access _access
#define ftruncate _chsize
/* WIN32 Memory Debugger */
//#include "vld.h"
#include "dirent.h"
#endif
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#endif
#include <signal.h>
#include <fcntl.h>
#include <ctype.h>
#ifndef WIN32
#include <strings.h>
#include <pwd.h>
#include <fstab.h>
#endif
#include <limits.h>
#include <float.h>
#include <math.h>
#include <sys/types.h>
#ifdef linux
/* #include <sys/sysinfo.h> */
#include <malloc.h>
#endif
#ifdef HAVE_SCHED_H
#ifndef __USE_GNU
#define __USE_GNU
#endif
#include <sched.h>
#endif
#define MAX_NUM_RECYCLED_BUFFERS 16384
#include <getopt.h> /* getopt from: http://www.pwilson.net/sample.html. */
#ifndef WIN32
#include <sys/mman.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <netdb.h>
#define PERFORMANCE
#if defined(PERFORMANCE) \
&& defined(__GNUC__) \
&& (defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4) \
|| defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8))
#define HAVE_COMPARE_AND_SWAP
#endif
#ifdef HAVE_GDBM
#include <gdbm.h>
#endif
#ifdef __arm__
#pragma pack(1)
#endif
#ifdef __NetBSD__
#include <net/if_ether.h>
#endif
#ifdef HAVE_NETINET_IF_ETHER_H
#include <netinet/if_ether.h>
#endif
#ifdef HAVE_NET_ETHERNET_H
#include <net/ethernet.h>
#endif
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#endif
#ifdef __arm__
#pragma pack()
#endif
#include <sys/stat.h>
#include "pcap.h"
#ifdef HAVE_DL_H
#include <dl.h>
#endif
#ifdef HAVE_DLFCN_H
#include <dlfcn.h>
#endif
#ifdef HAVE_DIRENT_H
#include <dirent.h>
#endif
#ifdef WIN32
#define HAVE_MYSQL
//#define HAVE_SQLITE
#define HAVE_ZMQ
#endif
#ifdef HAVE_MYSQL
#include <mysql.h>
#define MYSQL_OPT "--mysql"
#define MYSQL_SKIP_DB_CREATION "--mysql-skip-db-creation"
#endif
#ifdef HAVE_LIBSQLITE3
#define HAVE_SQLITE
#endif
#ifdef HAVE_SQLITE
#include <sqlite3.h>
#endif
/* GeoIP */
#ifdef HAVE_GEOIP
#include "GeoIP.h"
#include "GeoIPCity.h"
#endif
/* Redis - http://www.redis.io/ */
#ifdef HAVE_REDIS
#include <hiredis/hiredis.h>
#include <hiredis/async.h>
#endif
#ifdef HAVE_NETFILTER
#include <linux/types.h>
#include <linux/netfilter.h> /* for NF_ACCEPT */
#include <libnfnetlink/libnfnetlink.h>
#include <libnetfilter_queue/libnetfilter_queue.h>
#endif
#ifdef HAVE_RDKAFKA
#include "rdkafka.h"
#endif
#ifdef HAVE_ZMQ
#include "zmq.h"
struct zmq_msg_hdr {
char url[32];
u_int32_t version;
u_int32_t size;
};
#endif
#ifdef HAVE_TEMPLATE_EXTENSIONS
#include "templates.h"
#endif
#include "ndpi_main.h"
#include "template.h"
/* CysSSL Sniffer Interface */
#ifdef HAVE_YASSL
#define FILETYPE_PEM 1
#define FILETYPE_DER 2
extern int ssl_SetPrivateKey(const char* address, int port, const char* keyFile, int keyType, const char* password, char* error);
extern int ssl_DecodePacket(const unsigned char* packet, int length, unsigned char* data, char* error);
extern void ssl_InitSniffer(void);
extern void ssl_FreeSniffer(void);
#endif
#define TEMPLATE_LIST_LEN 64
#define DEFAULT_MIN_NUM_LINES 10000
#define DEFAULT_MAX_NUM_LINES 1000000
#ifndef TH_FIN
#define TH_FIN 0x01
#endif
#ifndef TH_SYN
#define TH_SYN 0x02
#endif
#ifndef TH_RST
#define TH_RST 0x04
#endif
#ifndef TH_PUSH
#define TH_PUSH 0x08
#endif
#ifndef TH_ACK
#define TH_ACK 0x10
#endif
#ifndef TH_URG
#define TH_URG 0x20
#endif
#define DEFAULT_MTU 1514
#define JUMBO_MTU 9000
/*
* Structure of a 10Mb/s Ethernet header.
*/
struct eth_header {
u_char ether_dhost[6];
u_char ether_shost[6];
u_short ether_type;
};
/* http://en.wikipedia.org/wiki/Stdint.h */
/* On various systems there's u_int64_t but not u_int64_t */
#ifndef WIN32
#include <pthread.h>
#include <stdarg.h>
#include <syslog.h>
#ifndef PTHREAD_RWLOCK_INITIALIZER
#undef HAVE_RW_LOCK
#endif
#ifndef HAVE_RW_LOCK
#define pthread_rwlock_t pthread_mutex_t
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_rdlock pthread_mutex_lock
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#define pthread_rwlock_destroy pthread_mutex_destroy
#endif
#else /* WIN32 */
#ifdef USE_SPARROW
extern int checkSparrow();
#endif
#define usleep(a) Sleep(a/1000)
#ifdef WIN32_THREADS
#define pthread_t HANDLE
#define pthread_mutex_t HANDLE
#define pthread_rwlock_t HANDLE
#endif
#if !defined (__GNUC__)
typedef u_int32_t tcp_seq;
#endif
/*
* TCP header.
* Per RFC 793, September, 1981.
*/
struct tcphdr {
u_int16_t th_sport; /* source port */
u_int16_t th_dport; /* destination port */
tcp_seq th_seq; /* sequence number */
tcp_seq th_ack; /* acknowledgement number */
#if BYTE_ORDER == LITTLE_ENDIAN
u_char th_x2:4, /* (unused) */
th_off:4; /* data offset */
#else
u_char th_off:4, /* data offset */
th_x2:4; /* (unused) */
#endif
u_int8_t th_flags;
u_int16_t th_win; /* window */
u_int16_t th_sum; /* checksum */
u_int16_t th_urp; /* urgent pointer */
};
/* ********************************************* */
struct ip {
#if BYTE_ORDER == LITTLE_ENDIAN
u_int8_t ip_hl:4, /* header length */
ip_v:4; /* version */
#else
u_int8_t ip_v:4, /* version */
ip_hl:4; /* header length */
#endif
u_int8_t ip_tos; /* type of service */
int16_t ip_len; /* total length */
u_int16_t ip_id; /* identification */
int16_t ip_off; /* fragment offset field */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_int8_t ip_ttl; /* time to live */
u_int8_t ip_p; /* protocol */
u_int16_t ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
/* ********************************************* */
/*
* Udp protocol header.
* Per RFC 768, September, 1981.
*/
struct udphdr {
u_int16_t uh_sport; /* source port */
u_int16_t uh_dport; /* destination port */
int16_t uh_ulen; /* udp length */
u_int16_t uh_sum; /* udp checksum */
};
/* ********************************************* */
extern int gettimeofday(struct timeval *tv, struct timezone *tz);
#ifndef WIN32
extern char *strtok_r(char *s, const char *delim, char **save_ptr);
#else
#define strcasecmp(a, b) lstrcmpiA(a, b)
extern const char *strcasestr(const char *haystack, const char *needle);
extern int ptw32_processInitialize (void);
#endif
extern int lprobe_sleep(int secToSleep);
#ifdef WIN32_THREADS
extern int pthread_create(pthread_t *threadId, void* notUsed, void *(*__start_routine) (void *), char* userParm);
extern void pthread_detach(pthread_t *threadId);
extern int pthread_mutex_init(pthread_mutex_t *mutex, char* notused);
extern void pthread_mutex_destroy(pthread_mutex_t *mutex);
extern int pthread_mutex_lock(pthread_mutex_t *mutex);
extern int pthread_mutex_trylock(pthread_mutex_t *mutex);
extern int pthread_mutex_unlock(pthread_mutex_t *mutex);
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#endif
#endif /* WIN32 */
#ifdef HAVE_JSON_C
#include <json-c/json.h>
#endif
/* http://en.wikipedia.org/wiki/SCTP_packet_structure */
struct sctphdr {
/* Common Header */
u_int16_t sport, dport;
u_int32_t verification_tag; /* A 32-bit random value created during initialization to distinguish stale packets from a previous connection. */
u_int32_t checksum; /* CRC32c algorithm */
};
struct sctp_chunk {
/* Chunk Info */
u_int8_t chunk_type, chunk_flags;
u_int16_t chunk_len;
};
struct sctp_data_chunk {
/* Data Header */
u_int32_t tsn; /* Transmission sequence number (TSN) */
u_int16_t stream_id; /* Stream identifier */
u_int16_t stream_sequence; /* Stream sequence number */
u_int32_t payload_id; /* Payload protocol identifier */
};
#ifdef WIN32
#define CONST_DIR_SEP '\\'
#else
#define CONST_DIR_SEP '/'
#endif
#define PREFIX "/usr/local"
#define LICENSE_FILE_NAME "lprobe.license"
/*
2^32 minus a large value so that we won't wrap for sure
Note that lprobe can work as sFlow collector and thus
we cannot expect packets to be 1500 bytes but they can
very well be 3072000 or more. Thus better set a high
threshold but not too high to risk missing the wrap
*/
#define BYTES_WRAP_THRESHOLD 0xFF000000
#include "bucket.h"
#include "collect.h"
typedef struct ether80211q {
u_int16_t vlanId;
u_int16_t protoType;
} Ether80211q;
/* GRE (Generic Route Encapsulation) */
#ifndef IPPROTO_GRE
#define IPPROTO_GRE 47
#endif
#define GRE_HEADER_CHECKSUM 0x8000 /* 32 bit */
#define GRE_HEADER_ROUTING 0x4000 /* 32 bit */
#define GRE_HEADER_KEY 0x2000 /* 32 bit */
#define GRE_HEADER_SEQ_NUM 0x1000 /* 32 bit */
struct grev1_header {
u_int16_t flags_and_version;
u_int16_t proto;
};
/* GPRS Tunneling Protocol */
struct gtpv0_header {
u_int8_t flags, message_type;
u_int16_t total_length, sequence_number, flow_label;
u_int8_t sndcp_number, padding[3];
u_int64_t tunnel_id;
} __attribute__((__packed__));
struct gtpv1_header {
u_int8_t flags, message_type;
u_int16_t total_length;
u_int32_t tunnel_id;
u_int16_t sequence_number;
u_int8_t pdu_nuber, next_ext_header;
} __attribute__((__packed__));
struct gtpv2_header {
u_int8_t flags, message_type;
u_int16_t message_len;
u_int32_t teid;
u_int8_t sequence_number[3], spare;
} __attribute__((__packed__));
struct l2tp_header {
u_int16_t flags, tunnel_id, session_id;
} __attribute__((__packed__));
struct ppp_header {
u_int8_t address, control;
u_int16_t protocol;
} __attribute__((__packed__));
struct ppp_multilink_header {
u_int8_t flags, sequence_number[3];
} __attribute__((__packed__));
struct mobileip_header {
u_int8_t message_type, next_header;
u_int16_t reserved;
};
#define lprobe_REVISION "$Revision: 3962 $"
extern char lprobe_revision[];
typedef enum {
text_format = 0,
sqlite_format,
binary_format,
binary_core_flow_format,
} DumpFormat;
typedef enum {
epoch_ts_format = 0,
epoch_with_usec_ts_format,
human_readable_ts_format
} TimestampFormat;
typedef enum {
export_all_flows = 0,
export_bidirectional_flows_only,
export_monodirectional_flows_only
} BiflowsExportPolicy;
/* Update LogEventSeverity2Str in util.c when changing the structure below */
typedef enum {
severity_error = 0,
severity_warning,
severity_info
} LogEventSeverity;
/* Update LogEventType2Str in util.c when changing the structure below */
typedef enum {
probe_started = 0,
probe_stopped,
packet_drop,
flow_export_error,
collector_connection_error,
collector_connected,
collector_disconnected,
collector_too_slow
} LogEventType;
extern void allocateHash(void);
#ifdef ETHER_HEADER_HAS_EA
# define ESRC(ep) ((ep)->ether_shost.ether_addr_octet)
# define EDST(ep) ((ep)->ether_dhost.ether_addr_octet)
#else
# define ESRC(ep) ((ep)->ether_shost)
# define EDST(ep) ((ep)->ether_dhost)
#endif
/* BSD AF_ values. */
#define BSD_AF_INET 2
#define BSD_AF_INET6_BSD 24 /* OpenBSD (and probably NetBSD), BSD/OS */
#define BSD_AF_INET6_FREEBSD 28
#define BSD_AF_INET6_DARWIN 30
#if defined(DARWIN) && !defined(SNOW_LEOPARD)
#define PLUGIN_EXTENSION ".dylib"
#else
#define PLUGIN_EXTENSION ".so"
#endif
/*
Courtesy of http://ettercap.sourceforge.net/
*/
#ifndef CFG_LITTLE_ENDIAN
#define ptohs(x) ( (u_int16_t) \
((u_int16_t)*((u_int8_t *)x+1)<<8| \
(u_int16_t)*((u_int8_t *)x+0)<<0) \
)
#define ptohl(x) ( (u_int32)*((u_int8_t *)x+3)<<24| \
(u_int32)*((u_int8_t *)x+2)<<16| \
(u_int32)*((u_int8_t *)x+1)<<8| \
(u_int32)*((u_int8_t *)x+0)<<0 \
)
#else
#define ptohs(x) *(u_int16_t *)(x)
#define ptohl(x) *(u_int32 *)(x)
#endif
#define TCPOPT_EOL 0
#define TCPOPT_NOP 1
#define TCPOPT_MAXSEG 2
#define TCPOPT_WSCALE 3
#define TCPOPT_SACKOK 4
#define TCPOPT_TIMESTAMP 8
#define MAX_AS_PATH_LEN 10
/* ************************************ */
#ifndef ETHERTYPE_IP
#define ETHERTYPE_IP 0x0800 /* IP protocol */
#endif
#ifndef ETHERTYPE_IPV6
#define ETHERTYPE_IPV6 0x86DD /* IPv6 protocol */
#endif
#ifndef ETHERTYPE_MPLS
#define ETHERTYPE_MPLS 0x8847 /* MPLS protocol */
#endif
#ifndef ETHERTYPE_MPLS_MULTI
#define ETHERTYPE_MPLS_MULTI 0x8848 /* MPLS multicast packet */
#endif
#ifndef ETHERTYPE_PPPoE
#define ETHERTYPE_PPPoE 0x8864 /* PPP over Ethernet */
#endif
struct ether_mpls_header {
u_int8_t label, exp, bos;
u_int8_t ttl;
};
#define NULL_HDRLEN 4
#ifndef SOLARIS
/* VLAN support - Courtesy of Mikael Cam <mca@mgn.net> - 2002/08/28 */
#ifndef ETHER_ADDR_LEN
#define ETHER_ADDR_LEN 6
#endif
struct ether_vlan_header {
u_int8_t evl_dhost[ETHER_ADDR_LEN];
u_int8_t evl_shost[ETHER_ADDR_LEN];
u_int16_t evl_encap_proto;
u_int16_t evl_tag;
u_int16_t evl_proto;
};
#endif
#ifdef SOLARIS
struct ip6_ext {
u_int8_t ip6e_nxt;
u_int8_t ip6e_len;
} __attribute__((__packed__));
#endif
#define NO_VLAN (u_int16_t)-1
#define MAX_VLAN 4096
#ifndef ETHERTYPE_VLAN
#define ETHERTYPE_VLAN 0x08100
#endif
typedef struct ipV4Fragment {
u_int32_t src, dst;
u_short fragmentId, numPkts, len, sport, dport;
time_t firstSeen;
struct ipV4Fragment *next;
} IpV4Fragment;
/* ************************************ */
#ifndef linux
#undef IP_HDRINCL
#endif
#define TRANSPORT_UDP 1
#define TRANSPORT_TCP 2
#define TRANSPORT_SCTP 3
#ifdef IP_HDRINCL
#define TRANSPORT_UDP_RAW 4
#endif
#ifndef IPPROTO_SCTP
#define IPPROTO_SCTP 132
#endif
typedef struct collectorAddress {
u_int8_t isIPv6; /* 0=IPv4, 1=IPv6 or anything else (generic addrinfo) */
u_int8_t transport; /* TRANSPORT_XXXX */
u_int flowSequence;
union {
struct sockaddr_in v4Address;
struct sockaddr_in6 v6Address;
} u;
int sockFd; /* Socket file descriptor */
struct timeval lastExportTime; /* Time when last packet was exported [Set only with -e] */
} CollectorAddress;
/* ************************************ */
#ifndef WIN32
#include <pthread.h>
typedef struct conditionalVariable {
pthread_mutex_t mutex;
pthread_cond_t condvar;
int predicate;
} ConditionalVariable;
#else
typedef struct conditionalVariable {
HANDLE condVar;
CRITICAL_SECTION criticalSection;
} ConditionalVariable;
#endif
extern int createCondvar(ConditionalVariable *condvarId);
extern void deleteCondvar(ConditionalVariable *condvarId);
extern int waitCondvar(ConditionalVariable *condvarId);
extern int signalCondvar(ConditionalVariable *condvarId, int broadcast);
#define TEMP_PREFIX ".temp"
#define BUF_SIZE 512
#define NO_INTERFACE_INDEX ((u_int16_t)-1)
#define TRACE_ERROR 0, __FILE__, __LINE__
#define TRACE_WARNING 1, __FILE__, __LINE__
#define TRACE_NORMAL 2, __FILE__, __LINE__
#define TRACE_INFO 3, __FILE__, __LINE__
/* ************************************************ */
extern char *optarg;
/* ********** ICMP ******************** */
#ifdef WIN32
struct icmp_ra_addr
{
u_int32_t ira_addr;
u_int32_t ira_preference;
};
#endif /* WIN32 */
struct icmp_hdr
{
u_int8_t icmp_type; /* type of message, see below */
u_int8_t icmp_code; /* type sub code */
u_int16_t icmp_cksum; /* ones complement checksum of struct */
u_int16_t icmp_identifier, icmp_seqnum;
};
struct icmp6_hdr {
u_int8_t icmp6_type;/* type field */
u_int8_t icmp6_code;/* code field */
u_int16_t icmp6_cksum;/* checksum field */
union {
u_int32_t icmp6_un_data32[1]; /* type-specific field */
u_int16_t icmp6_un_data16[2]; /* type-specific field */
u_int8_t icmp6_un_data8[4]; /* type-specific field */
} icmp6_dataun;
};
/*
* Definition of ICMP types and code field values.
*/
#define lprobe_ICMP_ECHOREPLY 0 /* echo reply */
#define lprobe_ICMP_UNREACH 3 /* dest unreachable, codes: */
#define lprobe_ICMP_UNREACH_NET 0 /* bad net */
#define lprobe_ICMP_UNREACH_HOST 1 /* bad host */
#define lprobe_ICMP_UNREACH_PROTOCOL 2 /* bad protocol */
#define lprobe_ICMP_UNREACH_PORT 3 /* bad port */
#define lprobe_ICMP_UNREACH_NEEDFRAG 4 /* IP_DF caused drop */
#define lprobe_ICMP_UNREACH_SRCFAIL 5 /* src route failed */
#define lprobe_ICMP_UNREACH_NET_UNKNOWN 6 /* unknown net */
#define lprobe_ICMP_UNREACH_HOST_UNKNOWN 7 /* unknown host */
#define lprobe_ICMP_UNREACH_ISOLATED 8 /* src host isolated */
#define lprobe_ICMP_UNREACH_NET_PROHIB 9 /* prohibited access */
#define lprobe_ICMP_UNREACH_HOST_PROHIB 10 /* ditto */
#define lprobe_ICMP_UNREACH_TOSNET 11 /* bad tos for net */
#define lprobe_ICMP_UNREACH_TOSHOST 12 /* bad tos for host */
#define lprobe_ICMP_UNREACH_FILTER_PROHIB 13 /* admin prohib */
#define lprobe_ICMP_UNREACH_HOST_PRECEDENCE 14 /* host prec vio. */
#define lprobe_ICMP_UNREACH_PRECEDENCE_CUTOFF 15 /* prec cutoff */
#define lprobe_ICMP_SOURCEQUENCH 4 /* packet lost, slow down */
#define lprobe_ICMP_REDIRECT 5 /* shorter route, codes: */
#define lprobe_ICMP_REDIRECT_NET 0 /* for network */
#define lprobe_ICMP_REDIRECT_HOST 1 /* for host */
#define lprobe_ICMP_REDIRECT_TOSNET 2 /* for tos and net */
#define lprobe_ICMP_REDIRECT_TOSHOST 3 /* for tos and host */
#define lprobe_ICMP_ECHO 8 /* echo service */
#define lprobe_ICMP_ROUTERADVERT 9 /* router advertisement */
#define lprobe_ICMP_ROUTERSOLICIT 10 /* router solicitation */
#define lprobe_ICMP_TIMXCEED 11 /* time exceeded, code: */
#define lprobe_ICMP_TIMXCEED_INTRANS 0 /* ttl==0 in transit */
#define lprobe_ICMP_TIMXCEED_REASS 1 /* ttl==0 in reass */
#define lprobe_ICMP_PARAMPROB 12 /* ip header bad */
#define lprobe_ICMP_PARAMPROB_ERRATPTR 0 /* error at param ptr */
#define lprobe_ICMP_PARAMPROB_OPTABSENT 1 /* req. opt. absent */
#define lprobe_ICMP_PARAMPROB_LENGTH 2 /* bad length */
#define lprobe_ICMP_TSTAMP 13 /* timestamp request */
#define lprobe_ICMP_TSTAMPREPLY 14 /* timestamp reply */
#define lprobe_ICMP_IREQ 15 /* information request */
#define lprobe_ICMP_IREQREPLY 16 /* information reply */
#define lprobe_ICMP_MASKREQ 17 /* address mask request */
#define lprobe_ICMP_MASKREPLY 18 /* address mask reply */
#define lprobe_ICMP_MAXTYPE 18
/* ********* NETFLOW ****************** */
/*
For more info see:
http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm
ftp://ftp.net.ohio-state.edu/users/maf/cisco/
*/
/* ********************************* */
#define FLOW_VERSION_1 1
#define DEFAULT_V1FLOWS_PER_PACKET 30
struct flow_ver1_hdr {
u_int16_t version; /* Current version = 1*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
};
struct flow_ver1_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration */
u_int32_t dOctets; /* Octets sent in Duration */
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t pad; /* pad to word boundary */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int8_t pad2[7]; /* pad to word boundary */
};
typedef struct single_flow_ver1_rec {
struct flow_ver1_hdr flowHeader;
struct flow_ver1_rec flowRecord[DEFAULT_V1FLOWS_PER_PACKET+1 /* safe against buffer overflows */];
} NetFlow1Record;
/* ***************************************** */
#define FLOW_VERSION_5 5
#define DEFAULT_V5FLOWS_PER_PACKET 30
struct flow_ver5_hdr {
u_int16_t version; /* Current version=5*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.)*/
u_int8_t engine_id; /* Slot number of the flow switching engine */
u_int16_t sampleRate; /* Packet capture sample rate */
};
struct flow_ver5_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration (milliseconds between 1st
& last packet in this flow)*/
u_int32_t dOctets; /* Octets sent in Duration (milliseconds between 1st
& last packet in this flow)*/
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int8_t pad1; /* pad to word boundary */
u_int8_t tcp_flags; /* Cumulative OR of tcp flags */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int16_t src_as; /* source peer/origin Autonomous System */
u_int16_t dst_as; /* dst peer/origin Autonomous System */
u_int8_t src_mask; /* source route's mask bits */
u_int8_t dst_mask; /* destination route's mask bits */
u_int16_t pad2; /* pad to word boundary */
};
typedef struct single_flow_ver5_rec {
struct flow_ver5_hdr flowHeader;
struct flow_ver5_rec flowRecord[DEFAULT_V5FLOWS_PER_PACKET+1 /* safe against buffer overflows */];
} NetFlow5Record;
/* ************************************ */
#define FLOW_VERSION_7 7
#define DEFAULT_V7FLOWS_PER_PACKET 28
/* ********************************* */
struct flow_ver7_hdr {
u_int16_t version; /* Current version=7*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int32_t reserved;
};
struct flow_ver7_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration */
u_int32_t dOctets; /* Octets sent in Duration */
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int8_t flags; /* Shortcut mode(dest only,src only,full flows*/
u_int8_t tcp_flags; /* Cumulative OR of tcp flags */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int16_t dst_as; /* dst peer/origin Autonomous System */
u_int16_t src_as; /* source peer/origin Autonomous System */
u_int8_t dst_mask; /* destination route's mask bits */
u_int8_t src_mask; /* source route's mask bits */
u_int16_t pad2; /* pad to word boundary */
u_int32_t router_sc; /* Router which is shortcut by switch */
};
typedef struct single_flow_ver7_rec {
struct flow_ver7_hdr flowHeader;
struct flow_ver7_rec flowRecord[DEFAULT_V7FLOWS_PER_PACKET+1 /* safe against buffer overflows */];
} NetFlow7Record;
/* ************************************ */
/* NetFlow v9/IPFIX */
typedef struct flow_ver9_hdr {
u_int16_t version; /* Current version=9*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int32_t sourceId; /* Source id */
} V9FlowHeader;