corsaro.h

Go to the documentation of this file.

/*
 * corsaro
 *
 * Alistair King, CAIDA, UC San Diego
 * corsaro-info@caida.org
 *
 * Copyright (C) 2012 The Regents of the University of California.
 *
 * This file is part of corsaro.
 *
 * corsaro is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * corsaro is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with corsaro.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#ifndef __CORSARO_H
#define __CORSARO_H

#include "config.h"

#include "libtrace.h"
#include "wandio.h"

typedef struct corsaro corsaro_t;
typedef struct corsaro_in corsaro_in_t;
typedef struct corsaro_packet corsaro_packet_t;
typedef struct corsaro_packet_state corsaro_packet_state_t;
typedef struct corsaro_in_record corsaro_in_record_t;
typedef struct corsaro_header corsaro_header_t;
typedef struct corsaro_trailer corsaro_trailer_t;
typedef struct corsaro_interval corsaro_interval_t;
typedef struct corsaro_plugin_data corsaro_plugin_data_t;

#ifdef WITH_PLUGIN_SIXT

typedef struct corsaro_flowtuple corsaro_flowtuple_t;
typedef struct corsaro_flowtuple_class_start corsaro_flowtuple_class_start_t;
typedef struct corsaro_flowtuple_class_end corsaro_flowtuple_class_end_t;
#endif

typedef enum corsaro_in_record_type
  {
    CORSARO_IN_RECORD_TYPE_NULL                  = 0,

    CORSARO_IN_RECORD_TYPE_INTERNAL_REDIRECT    = 1,

    CORSARO_IN_RECORD_TYPE_IO_HEADER             = 2,

    CORSARO_IN_RECORD_TYPE_IO_TRAILER            = 3,

    CORSARO_IN_RECORD_TYPE_IO_INTERVAL_START     = 4,

    CORSARO_IN_RECORD_TYPE_IO_INTERVAL_END       = 5,

    CORSARO_IN_RECORD_TYPE_IO_PLUGIN_START       = 6,

    CORSARO_IN_RECORD_TYPE_IO_PLUGIN_END         = 7,

    /* plugin specific records */

    /* corsaro_flowtuple has 20-29 */

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_CLASS_START  = 20,

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_CLASS_END    = 21,

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_FLOWTUPLE     = 22,

    /* corsaro_dos has 30-39 */

    CORSARO_IN_RECORD_TYPE_DOS_GLOBAL_HEADER     = 30,

    CORSARO_IN_RECORD_TYPE_DOS_HEADER            = 31,

    CORSARO_IN_RECORD_TYPE_DOS_ATTACK_VECTOR     = 32,

  } corsaro_in_record_type_t;

typedef enum corsaro_file_mode
  {
    CORSARO_FILE_MODE_ASCII  = 0,
    CORSARO_FILE_MODE_BINARY = 1,
    CORSARO_FILE_MODE_TRACE  = 2,
    CORSARO_FILE_MODE_UNKNOWN = 3,

    CORSARO_FILE_MODE_DEFAULT = CORSARO_FILE_MODE_UNKNOWN
  } corsaro_file_mode_t;

typedef enum corsaro_file_compress
  {
    CORSARO_FILE_COMPRESS_NONE = WANDIO_COMPRESS_NONE,
    CORSARO_FILE_COMPRESS_ZLIB = WANDIO_COMPRESS_ZLIB,
    CORSARO_FILE_COMPRESS_BZ2  = WANDIO_COMPRESS_BZ2,
    CORSARO_FILE_COMPRESS_LZO  = WANDIO_COMPRESS_LZO,

    CORSARO_FILE_COMPRESS_DEFAULT = CORSARO_FILE_COMPRESS_ZLIB
  } corsaro_file_compress_t;

typedef enum corsaro_interval_align
  {
    CORSARO_INTERVAL_ALIGN_NO      = 0,
    CORSARO_INTERVAL_ALIGN_YES     = 1,
    CORSARO_INTERVAL_ALIGN_DEFAULT = CORSARO_INTERVAL_ALIGN_NO,
  } corsaro_interval_align_t;

corsaro_t *corsaro_alloc_output(char *template, corsaro_file_mode_t mode);

int corsaro_start_output(corsaro_t *corsaro);

void corsaro_set_interval_alignment(corsaro_t *corsaro,
                                    corsaro_interval_align_t interval_align);

void corsaro_set_interval(corsaro_t *corsaro, unsigned int interval);

void corsaro_set_output_rotation(corsaro_t *corsaro,
                                 int intervals);

void corsaro_set_meta_output_rotation(corsaro_t *corsaro,
                                      int intervals);

int corsaro_is_rotate_interval(corsaro_t *corsaro);


int corsaro_set_trace(corsaro_t *corsaro, libtrace_t *trace);

int corsaro_set_traceuri(corsaro_t *corsaro, char *traceuri);

void corsaro_disable_logfile(corsaro_t *corsaro);

void corsaro_disable_globalfile(corsaro_t *corsaro);

int corsaro_enable_plugin(corsaro_t *corsaro, const char *plugin_name,
                          const char *plugin_args);

int corsaro_get_plugin_names(char ***plugin_names);

void corsaro_free_plugin_names(char **plugin_names, int plugin_cnt);

uint64_t corsaro_get_accepted_packets(corsaro_t *corsaro);

uint64_t corsaro_get_dropped_packets(corsaro_t *corsaro);

const char *corsaro_get_traceuri(corsaro_t *corsaro);

int corsaro_set_monitorname(corsaro_t *corsaro, char *name);

const char *corsaro_get_monitorname(corsaro_t *corsaro);

int corsaro_per_packet(corsaro_t *corsaro, libtrace_packet_t *packet);

int corsaro_per_record(corsaro_t *corsaro,
                       corsaro_in_record_type_t type,
                       corsaro_in_record_t *record);

int corsaro_finalize_output(corsaro_t *corsaro);

/*
 * === This comment is commented out... ===
 * The file uri can optionally contain a prefix which tells corsaro the type
 * of the file (ascii or binary) and the plugin which created it.
 * For example, binary:corsaro_flowtuple:/path/to/file.gz indicates that the
 * file is written in binary format, by the corsaro_flowtuple plugin.
 *
 * If no prefix is given, corsaro will attempt to guess the type and plugin.
 */
corsaro_in_t *corsaro_alloc_input(const char *corsarouri);

int corsaro_start_input(corsaro_in_t *corsaro);

corsaro_in_record_t *corsaro_in_alloc_record(corsaro_in_t *corsaro);

void corsaro_in_free_record(corsaro_in_record_t *record);

off_t corsaro_in_read_record(corsaro_in_t *corsaro,
                             corsaro_in_record_type_t *record_type,
                             corsaro_in_record_t *record);

void *corsaro_in_get_record_data(corsaro_in_record_t *record);

int corsaro_finalize_input(corsaro_in_t *corsaro);

#endif /* __CORSARO_H */