Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
The Center for Applied Internet Data Analysis
corsaro_flowtuple.h
Go to the documentation of this file.
1 /*
2  * corsaro
3  *
4  * Alistair King, CAIDA, UC San Diego
5  * corsaro-info@caida.org
6  *
7  * Copyright (C) 2012 The Regents of the University of California.
8  *
9  * This file is part of corsaro.
10  *
11  * corsaro is free software: you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation, either version 3 of the License, or
14  * (at your option) any later version.
15  *
16  * corsaro is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with corsaro. If not, see <http://www.gnu.org/licenses/>.
23  *
24  */
25 
26 #ifndef __CORSARO_FLOWTUPLE_H
27 #define __CORSARO_FLOWTUPLE_H
28 
29 #include "khash.h"
30 #include "ksort.h"
31 
32 #include "corsaro_plugin.h"
33 
42 CORSARO_PLUGIN_GENERATE_PROTOS(corsaro_flowtuple)
43 
44 CORSARO_PLUGIN_GENERATE_FT_PROTO(corsaro_flowtuple)
45 
70 struct corsaro_flowtuple
71 {
73  uint32_t src_ip;
74 
76 #ifdef CORSARO_SLASH_EIGHT
77  struct
78  {
80  uint8_t b;
82  uint8_t c;
84  uint8_t d;
85  } dst_ip;
86 #else
87  uint32_t dst_ip;
88 #endif
89 
91  uint16_t src_port;
92 
94  uint16_t dst_port;
95 
97  uint8_t protocol;
98 
100  uint8_t ttl;
101 
103  uint8_t tcp_flags;
104 
106  uint16_t ip_len;
107 
110  uint32_t packet_cnt;
111 } PACKED;
112 
114 typedef enum corsaro_flowtuple_class_type
115  {
117  CORSARO_FLOWTUPLE_CLASS_BACKSCATTER = 0,
118 
120  CORSARO_FLOWTUPLE_CLASS_ICMPREQ = 1,
121 
123  CORSARO_FLOWTUPLE_CLASS_OTHER = 2,
124 
126  CORSARO_FLOWTUPLE_CLASS_MAX = CORSARO_FLOWTUPLE_CLASS_OTHER,
127 
128  } corsaro_flowtuple_class_type_t;
129 
134 struct corsaro_flowtuple_class_start
135 {
137  uint32_t magic;
139  uint16_t class_type;
141  uint32_t count;
142 } PACKED;
143 
148 struct corsaro_flowtuple_class_end
149 {
151  uint32_t magic;
153  uint16_t class_type;
154 } PACKED;
155 
176 int corsaro_flowtuple_probe_file(corsaro_in_t *corsaro, const char *fturi);
177 
183 uint32_t corsaro_flowtuple_get_source_ip(struct corsaro_flowtuple *flowtuple);
184 
190 uint32_t corsaro_flowtuple_get_destination_ip(struct corsaro_flowtuple *flowtuple);
191 
199 off_t corsaro_flowtuple_fprint(corsaro_t *corsaro, corsaro_file_t *file,
200  struct corsaro_flowtuple *flowtuple);
201 
206 void corsaro_flowtuple_print(struct corsaro_flowtuple *flowtuple);
207 
215 off_t corsaro_flowtuple_class_start_fprint(corsaro_t *corsaro, corsaro_file_t *file,
216  corsaro_flowtuple_class_start_t *class);
217 
222 void corsaro_flowtuple_class_start_print(corsaro_flowtuple_class_start_t *class);
223 
231 off_t corsaro_flowtuple_class_end_fprint(corsaro_t *corsaro,
232  corsaro_file_t *file,
233  corsaro_flowtuple_class_end_t *class);
234 
239 void corsaro_flowtuple_class_end_print(corsaro_flowtuple_class_end_t *class);
240 
249 off_t corsaro_flowtuple_record_fprint(corsaro_t *corsaro, corsaro_file_t *file,
250  corsaro_in_record_type_t record_type,
251  corsaro_in_record_t *record);
252 
259 int corsaro_flowtuple_record_print(corsaro_in_record_type_t record_type,
260  corsaro_in_record_t *record);
261 
291 #define CORSARO_FLOWTUPLE_BYTECNT (sizeof(struct corsaro_flowtuple)) /* (4+3+2+2+1+1+1+2)+4*/
292 
294 /* is this platform independent? */
295 #ifdef CORSARO_SLASH_EIGHT
296 #define CORSARO_FLOWTUPLE_IP_TO_SIXT(n32, flowtuple) \
297  { \
298  (flowtuple)->dst_ip.b = ((n32 & htonl(0x00FF0000)) >> 8); \
299  (flowtuple)->dst_ip.c = ((n32 & htonl(0x0000FF00)) >> 16); \
300  (flowtuple)->dst_ip.d = ((n32 & htonl(0x000000FF)) >> 24); \
301  }
302 #else
303 #define CORSARO_FLOWTUPLE_IP_TO_SIXT(n32, flowtuple) \
304  { \
305  (flowtuple)->dst_ip = n32; \
306  }
307 #endif
308 
310 #ifdef CORSARO_SLASH_EIGHT
311 #define CORSARO_FLOWTUPLE_SIXT_TO_IP(flowtuple) \
312  ( \
313  CORSARO_SLASH_EIGHT | \
314  (flowtuple)->dst_ip.b << 8 | \
315  (flowtuple)->dst_ip.c << 16 | \
316  (flowtuple)->dst_ip.d << 24 \
317  )
318 #else
319 #define CORSARO_FLOWTUPLE_SIXT_TO_IP(flowtuple) \
320  ((flowtuple)->dst_ip)
321 #endif
322 
324 #define CORSARO_FLOWTUPLE_SHIFT_AND_XOR(value) h ^= (h<<5) + (h>>27) + (value)
325 
355 khint32_t corsaro_flowtuple_hash_func(struct corsaro_flowtuple *ft);
356 
358 #ifdef CORSARO_SLASH_EIGHT
359 #define corsaro_flowtuple_hash_equal(alpha, bravo) \
360  ( \
361  (alpha)->src_ip == (bravo)->src_ip && \
362  (alpha)->dst_ip.b == (bravo)->dst_ip.b && \
363  (alpha)->dst_ip.c == (bravo)->dst_ip.c && \
364  (alpha)->dst_ip.d == (bravo)->dst_ip.d && \
365  (alpha)->src_port == (bravo)->src_port && \
366  (alpha)->dst_port == (bravo)->dst_port && \
367  (alpha)->protocol == (bravo)->protocol && \
368  (alpha)->ttl == (bravo)->ttl && \
369  (alpha)->tcp_flags == (bravo)->tcp_flags && \
370  (alpha)->ip_len == (bravo)->ip_len \
371  )
372 #else
373 #define corsaro_flowtuple_hash_equal(alpha, bravo) \
374  ( \
375  (alpha)->src_ip == (bravo)->src_ip && \
376  (alpha)->dst_ip == (bravo)->dst_ip && \
377  (alpha)->src_port == (bravo)->src_port && \
378  (alpha)->dst_port == (bravo)->dst_port && \
379  (alpha)->protocol == (bravo)->protocol && \
380  (alpha)->ttl == (bravo)->ttl && \
381  (alpha)->tcp_flags == (bravo)->tcp_flags && \
382  (alpha)->ip_len == (bravo)->ip_len \
383  )
384 #endif
385 
391 #ifdef CORSARO_SLASH_EIGHT
392 #define corsaro_flowtuple_lt(alpha, bravo) \
393  ( \
394  ((alpha)->protocol < (bravo)->protocol) || \
395  ( \
396  ((alpha)->protocol == (bravo)->protocol) && \
397  ( \
398  ((alpha)->ttl < (bravo)->ttl) || \
399  ( \
400  ((alpha)->ttl == (bravo)->ttl) && \
401  ( \
402  ((alpha)->tcp_flags < (bravo)->tcp_flags) || \
403  ( \
404  ((alpha)->tcp_flags == (bravo)->tcp_flags) && \
405  ( \
406  ((alpha)->src_ip < (bravo)->src_ip) || \
407  ( \
408  ((alpha)->src_ip == (bravo)->src_ip) && \
409  ( \
410  ((alpha)->dst_ip.d < (bravo)->dst_ip.d) || \
411  ( \
412  ((alpha)->dst_ip.d == (bravo)->dst_ip.d) && \
413  ( \
414  ((alpha)->dst_ip.c < (bravo)->dst_ip.c) || \
415  ( \
416  ((alpha)->dst_ip.c == (bravo)->dst_ip.c) && \
417  ( \
418  ((alpha)->dst_ip.b < (bravo)->dst_ip.b) || \
419  ( \
420  ((alpha)->dst_ip.b == (bravo)->dst_ip.b) && \
421  ( \
422  ((alpha)->src_port < (bravo)->src_port) || \
423  ( \
424  ((alpha)->src_port == (bravo)->src_port) && \
425  ( \
426  ((alpha)->dst_port < (bravo)->dst_port) || \
427  ( \
428  ((alpha)->dst_port == (bravo)->dst_port) && \
429  ( \
430  ((alpha)->ip_len < (bravo)->ip_len) \
431  ) \
432  ) \
433  ) \
434  ) \
435  ) \
436  ) \
437  ) \
438  ) \
439  ) \
440  ) \
441  ) \
442  ) \
443  ) \
444  ) \
445  ) \
446  ) \
447  ) \
448  ) \
449  )
450 #else
451 #define corsaro_flowtuple_lt(alpha, bravo) \
452  ( \
453  ((alpha)->protocol < (bravo)->protocol) || \
454  ( \
455  ((alpha)->protocol == (bravo)->protocol) && \
456  ( \
457  ((alpha)->ttl < (bravo)->ttl) || \
458  ( \
459  ((alpha)->ttl == (bravo)->ttl) && \
460  ( \
461  ((alpha)->tcp_flags < (bravo)->tcp_flags) || \
462  ( \
463  ((alpha)->tcp_flags == (bravo)->tcp_flags) && \
464  ( \
465  ((alpha)->src_ip < (bravo)->src_ip) || \
466  ( \
467  ((alpha)->src_ip == (bravo)->src_ip) && \
468  ( \
469  ((alpha)->dst_ip < (bravo)->dst_ip) || \
470  ( \
471  ((alpha)->dst_ip == (bravo)->dst_ip) && \
472  ( \
473  ((alpha)->src_port < (bravo)->src_port) || \
474  ( \
475  ((alpha)->src_port == (bravo)->src_port) && \
476  ( \
477  ((alpha)->dst_port < (bravo)->dst_port) || \
478  ( \
479  ((alpha)->dst_port == (bravo)->dst_port) && \
480  ( \
481  ((alpha)->ip_len < (bravo)->ip_len) \
482  ) \
483  ) \
484  ) \
485  ) \
486  ) \
487  ) \
488  ) \
489  ) \
490  ) \
491  ) \
492  ) \
493  ) \
494  ) \
495  ) \
496  )
497 #endif
498 
503 void corsaro_flowtuple_free(struct corsaro_flowtuple *t);
504 
512 int corsaro_flowtuple_add_inc(void *hash, struct corsaro_flowtuple *t,
513  uint32_t increment);
514 
517 #endif /* __CORSARO_FLOWTUPLE_H */
518 
corsaro_plugin.h
Header file dealing with the corsaro plugin manager.
CORSARO_FLOWTUPLE_CLASS_MAX
The highest class value currently in use.
Definition: corsaro_flowtuple.h:126
corsaro_file
An opaque structure defining an corsaro output file.
Definition: corsaro_file.h:60
CORSARO_FLOWTUPLE_CLASS_BACKSCATTER
This packet is a backscatter packet.
Definition: corsaro_flowtuple.h:117
corsaro_flowtuple_get_source_ip
uint32_t corsaro_flowtuple_get_source_ip(struct corsaro_flowtuple *flowtuple)
Get the source IP of the tuple in network byte order.
corsaro_in_record
A reusable opaque structure for corsaro to read an input record into.
Definition: corsaro_int.h:350
corsaro_flowtuple_class_end::class_type
uint16_t class_type
The type of class (of type corsaro_flowtuple_class_type_t)
Definition: corsaro_flowtuple.h:153
corsaro_flowtuple_class_type
corsaro_flowtuple_class_type
Possible classification types for a flowtuple.
Definition: corsaro_flowtuple.h:114
corsaro_flowtuple_record_fprint
off_t corsaro_flowtuple_record_fprint(corsaro_t *corsaro, corsaro_file_t *file, corsaro_in_record_type_t record_type, corsaro_in_record_t *record)
Write a generic flowtuple record to the given corsaro file in ascii.
Definition: corsaro_flowtuple.c:1170
corsaro_flowtuple_probe_file
int corsaro_flowtuple_probe_file(corsaro_in_t *corsaro, const char *fturi)
Determine if the file given contains flowtuple data.
Definition: corsaro_flowtuple.c:1033
corsaro_flowtuple::ip_len
uint16_t ip_len
Length of the IP packet (from the IP header)
Definition: corsaro_flowtuple.h:106
CORSARO_FLOWTUPLE_CLASS_ICMPREQ
This packet is an ICMP Request packet.
Definition: corsaro_flowtuple.h:120
corsaro_flowtuple_class_start_print
void corsaro_flowtuple_class_start_print(corsaro_flowtuple_class_start_t *class)
Write a flowtuple class start record to stdout in ascii format.
Definition: corsaro_flowtuple.c:1148
corsaro_flowtuple::dst_ip
uint32_t dst_ip
A Structure which represents the 3 useful bytes of the destination ip.
Definition: corsaro_flowtuple.h:87
corsaro_flowtuple_class_start
Represents the start record of a flowtuple class.
Definition: corsaro_flowtuple.h:134
corsaro_flowtuple_free
void corsaro_flowtuple_free(struct corsaro_flowtuple *t)
Free memory allocated for a flowtuple structure.
corsaro_flowtuple_class_end
Represents the end record of a flowtuple class.
Definition: corsaro_flowtuple.h:148
corsaro_flowtuple_class_start::count
uint32_t count
The number of flowtuples in the class.
Definition: corsaro_flowtuple.h:141
corsaro_flowtuple_get_destination_ip
uint32_t corsaro_flowtuple_get_destination_ip(struct corsaro_flowtuple *flowtuple)
Get the destination IP of the tuple in network byte order.
corsaro_flowtuple::dst_port
uint16_t dst_port
The destination port (or ICMP code)
Definition: corsaro_flowtuple.h:94
corsaro_flowtuple_class_end_print
void corsaro_flowtuple_class_end_print(corsaro_flowtuple_class_end_t *class)
Write a flowtuple class end record to stdout in ascii format.
Definition: corsaro_flowtuple.c:1164
corsaro_flowtuple_class_type_t
enum corsaro_flowtuple_class_type corsaro_flowtuple_class_type_t
Possible classification types for a flowtuple.
record
static corsaro_in_record_t * record
A pointer to a corsaro record.
Definition: corsaro_main.c:76
corsaro_flowtuple_print
void corsaro_flowtuple_print(struct corsaro_flowtuple *flowtuple)
Write a flowtuple to stdout in ascii format.
corsaro_flowtuple_hash_func
khint32_t corsaro_flowtuple_hash_func(struct corsaro_flowtuple *ft)
Hash the given flowtuple into a 32bit value.
Definition: corsaro_flowtuple.c:1306
corsaro_flowtuple::src_port
uint16_t src_port
The source port (or ICMP type)
Definition: corsaro_flowtuple.h:91
corsaro_flowtuple_fprint
off_t corsaro_flowtuple_fprint(corsaro_t *corsaro, corsaro_file_t *file, struct corsaro_flowtuple *flowtuple)
Write a flowtuple to the given corsaro file in ascii.
corsaro_flowtuple
Represents the eight important fields in the ip header that we will use to 'uniquely' identify a pack...
Definition: corsaro_flowtuple.h:70
corsaro_flowtuple_class_end::magic
uint32_t magic
The flowtuple magic number 'SIXT'.
Definition: corsaro_flowtuple.h:151
corsaro_in
Corsaro input state.
Definition: corsaro_int.h:323
corsaro_flowtuple::ttl
uint8_t ttl
The TTL.
Definition: corsaro_flowtuple.h:100
corsaro_flowtuple_add_inc
int corsaro_flowtuple_add_inc(void *hash, struct corsaro_flowtuple *t, uint32_t increment)
Either add the given flowtuple to the hash, or increment the current count.
corsaro_flowtuple::tcp_flags
uint8_t tcp_flags
TCP Flags (excluding NS)
Definition: corsaro_flowtuple.h:103
corsaro_flowtuple_class_start::class_type
uint16_t class_type
The type of class (of type corsaro_flowtuple_class_type_t)
Definition: corsaro_flowtuple.h:139
corsaro_flowtuple_class_start::magic
uint32_t magic
The flowtuple magic number 'SIXT' (or 'SIXU' if not using /8 opts)
Definition: corsaro_flowtuple.h:137
CORSARO_FLOWTUPLE_CLASS_OTHER
The packet is not backscatter, not ICMP Request.
Definition: corsaro_flowtuple.h:123
corsaro
Corsaro output state.
Definition: corsaro_int.h:230
corsaro_flowtuple_record_print
int corsaro_flowtuple_record_print(corsaro_in_record_type_t record_type, corsaro_in_record_t *record)
Write a generic flowtuple record to stdout in ascii format.
Definition: corsaro_flowtuple.c:1202
corsaro_flowtuple::packet_cnt
uint32_t packet_cnt
The number of packets that comprise this flowtuple This is populated immediately before the tuple is ...
Definition: corsaro_flowtuple.h:110
corsaro_flowtuple::src_ip
uint32_t src_ip
The source IP.
Definition: corsaro_flowtuple.h:73
corsaro_flowtuple::protocol
uint8_t protocol
The protocol.
Definition: corsaro_flowtuple.h:97
corsaro_in_record_type_t
enum corsaro_in_record_type corsaro_in_record_type_t
Corsaro input record types.
corsaro_flowtuple_class_end_fprint
off_t corsaro_flowtuple_class_end_fprint(corsaro_t *corsaro, corsaro_file_t *file, corsaro_flowtuple_class_end_t *class)
Write a flowtuple class end record to the given corsaro file in ascii.
Definition: corsaro_flowtuple.c:1155
CORSARO_PLUGIN_GENERATE_PROTOS
#define CORSARO_PLUGIN_GENERATE_PROTOS(plugin)
Convenience macro that defines all the function prototypes for the corsaro plugin API...
Definition: corsaro_plugin.h:44
corsaro_flowtuple_class_start_fprint
off_t corsaro_flowtuple_class_start_fprint(corsaro_t *corsaro, corsaro_file_t *file, corsaro_flowtuple_class_start_t *class)
Write a flowtuple class start record to the given corsaro file in ascii.
Definition: corsaro_flowtuple.c:1137