Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
The Center for Applied Internet Data Analysis
corsaro_int.h
Go to the documentation of this file.
1 /*
2  * corsaro
3  *
4  * Alistair King, CAIDA, UC San Diego
5  * corsaro-info@caida.org
6  *
7  * Copyright (C) 2012 The Regents of the University of California.
8  *
9  * This file is part of corsaro.
10  *
11  * corsaro is free software: you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation, either version 3 of the License, or
14  * (at your option) any later version.
15  *
16  * corsaro is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with corsaro. If not, see <http://www.gnu.org/licenses/>.
23  *
24  */
25 
26 #ifndef __CORSARO_INT_H
27 #define __CORSARO_INT_H
28 
29 #include "libtrace.h"
30 
31 #include "config.h"
32 
33 #include "corsaro.h"
34 
35 #include "corsaro_file.h"
36 #include "corsaro_geo.h"
37 #include "corsaro_plugin.h"
38 
47 /* GCC optimizations */
48 #if __GNUC__ >= 3
49 # define DEPRECATED __attribute__((deprecated))
50 # define SIMPLE_FUNCTION __attribute__((pure))
51 # define UNUSED __attribute__((unused))
52 # define PACKED __attribute__((packed))
53 # define PRINTF(formatpos,argpos) __attribute__((format(printf,formatpos,argpos)))
54 #else
55 # define DEPRECATED
56 # define SIMPLE_FUNCTION
57 # define UNUSED
58 # define PACKED
59 # define PRINTF(formatpos,argpos)
60 #endif
61 
70 typedef enum corsaro_magic
71  {
73  CORSARO_MAGIC = 0x45444752,
75  CORSARO_MAGIC_HEADER = 0x48454144,
77  CORSARO_MAGIC_INTERVAL = 0x494E5452,
78  /* corsaro data block magic number - "DATA" */
79  CORSARO_MAGIC_DATA = 0x44415441,
80  /* corsaro trailer magic number - "FOOT" */
81  CORSARO_MAGIC_TRAILER = 0x464F4F54
83 
89 {
91  uint32_t corsaro_magic;
93  uint32_t magic;
95  uint8_t version_major;
97  uint8_t version_minor;
99  uint32_t local_init_time;
101  uint16_t interval_length;
103  uint16_t traceuri_len;
105  uint8_t *traceuri;
107  uint16_t plugin_cnt;
109  uint32_t *plugin_magics;
110 } PACKED;
111 
117 {
119  uint32_t corsaro_magic;
121  uint32_t magic;
123  uint64_t packet_cnt;
125  uint64_t accepted_cnt;
127  uint64_t dropped_cnt;
135  uint32_t runtime;
136 } PACKED;
137 
157 {
159  uint32_t corsaro_magic;
161  uint32_t magic;
163  uint16_t number;
165  uint32_t time;
166 } PACKED;
167 
173 {
175  uint32_t corsaro_magic;
177  uint32_t magic;
179  uint32_t plugin_magic;
180 } PACKED;
181 
185 #define CORSARO_INTERVAL_DEFAULT 60
186 
195 {
197  uint8_t flags;
198 };
199 
201 enum
202  {
205 
208  };
209 
212 {
215 
218 
221 
223  libtrace_packet_t *ltpacket;
224 };
225 
227 #define LT_PKT(corsaro_packet) (corsaro_packet->ltpacket)
228 
230 struct corsaro
231 {
233  struct timeval init_time;
234 
236  libtrace_t *trace;
237 
239  char *uridata;
240 
242  char *monitorname;
243 
245  char *template;
246 
249 
252 
255 
258 
261 
264 
267 
270 
272  /* this is what gets passed to any function relating to plugin management */
274 
278 
280  int interval;
281 
284 
290 
293 
295  uint32_t next_report;
296 
298  struct timeval first_ts;
299 
301  struct timeval last_ts;
302 
305 
307  uint64_t packet_cnt;
308 
311  uint64_t accepted_pkts;
312 
315  uint64_t dropped_pkts;
316 
318  int started;
319 
320 };
321 
324 {
326  char *uridata;
327 
330 
333 
335  /* this is what gets passed to any function relating to plugin management */
337 
340 
342  int started;
343 
344 };
345 
347 #define CORSARO_IN_RECORD_DEFAULT_BUFFER_LEN LIBTRACE_PACKET_BUFSIZE+1024
348 
351 {
354 
356  uint8_t *buffer;
357 
359  size_t buffer_len;
360 
363 
364 };
365 
366 #endif /* __CORSARO_INT_H */
Structure representing the start or end of an interval.
Definition: corsaro_int.h:156
An opaque structure defining an corsaro input file.
Definition: corsaro_file.h:86
uint32_t last_packet_time
The trace time of the last packet (seconds)
Definition: corsaro_int.h:131
corsaro_plugin_t * plugin
Pointer to the plugin to be used to read this file.
Definition: corsaro_int.h:339
Plugins which write output should ignore this packet.
Definition: corsaro_int.h:207
int interval
The number of seconds after which plugins will be asked to dump data.
Definition: corsaro_int.h:280
Header file dealing with the corsaro plugin manager.
int compress_level
The compression level (ignored if not compressing)
Definition: corsaro_int.h:254
uint64_t dropped_pkts
The total number of packets that have been dropped by libtrace (before the current interval) ...
Definition: corsaro_int.h:315
Header file which exports the public libcorsaro API.
Structure representing the start or end of a plugin data block.
Definition: corsaro_int.h:172
uint64_t packet_cnt
The total number of packets that have been processed.
Definition: corsaro_int.h:307
An opaque structure defining an corsaro output file.
Definition: corsaro_file.h:60
struct timeval init_time
The local wall time that corsaro was started at.
Definition: corsaro_int.h:233
uint16_t traceuri_len
The length of the (optional) trace uri string.
Definition: corsaro_int.h:103
A reusable opaque structure for corsaro to read an input record into.
Definition: corsaro_int.h:350
int interval_end_needed
Whether there are un-dumped packets in the current interval.
Definition: corsaro_int.h:304
corsaro_interval_align_t interval_align
The first interval end will be rounded down to the nearest integer multiple of the interval length if...
Definition: corsaro_int.h:277
corsaro_file_mode_t output_mode
The default output mode for new files.
Definition: corsaro_int.h:248
corsaro_plugin_manager_t * plugin_manager
A pointer to the corsaro plugin manager state.
Definition: corsaro_int.h:336
uint32_t corsaro_magic
The global corsaro magic number.
Definition: corsaro_int.h:175
size_t buffer_len
The length of the buffer.
Definition: corsaro_int.h:359
uint32_t * plugin_magics
A pointer to the list of plugin magic numbers used.
Definition: corsaro_int.h:109
int started
Has this corsaro_in object been started yet?
Definition: corsaro_int.h:342
uint32_t magic
The interval magic number.
Definition: corsaro_int.h:161
uint32_t plugin_magic
The plugin magic.
Definition: corsaro_int.h:179
uint64_t accepted_pkts
The total number of packets that have been accepted by libtrace (before the current interval) ...
Definition: corsaro_int.h:311
corsaro_packet_t * packet
A pointer to the wrapper packet passed to the plugins.
Definition: corsaro_int.h:269
Structure which represents a geolocation provider.
Definition: corsaro_geo.h:137
uint32_t corsaro_magic
The global corsaro magic number.
Definition: corsaro_int.h:159
struct timeval last_ts
The time of the most recent packet seen by corsaro.
Definition: corsaro_int.h:301
Highest numbered geolocation provider ID.
Definition: corsaro_geo.h:132
libtrace_packet_t * ltpacket
A pointer to the underlying libtrace packet.
Definition: corsaro_int.h:223
uint16_t number
The interval number (starts at 0)
Definition: corsaro_int.h:163
corsaro header magic number - "HEAD"
Definition: corsaro_int.h:75
uint32_t corsaro_magic
The global corsaro magic number.
Definition: corsaro_int.h:91
A lightweight wrapper around a libtrace packet.
Definition: corsaro_int.h:211
corsaro_plugin_manager_t * plugin_manager
A pointer to the corsaro plugin manager state.
Definition: corsaro_int.h:273
Structure representing a corsaro file header.
Definition: corsaro_int.h:88
int logfile_disabled
Has the user asked us not to log to a file?
Definition: corsaro_int.h:266
Holds the metadata for the plugin manager.
Overall corsaro magic number - "EDGR".
Definition: corsaro_int.h:73
Structure representing a corsaro file trailer.
Definition: corsaro_int.h:116
corsaro_in_record_type_t expected_type
The next expected record type when reading the corsaro_global file.
Definition: corsaro_int.h:332
uint16_t plugin_cnt
The number of plugins used.
Definition: corsaro_int.h:107
uint32_t first_packet_time
The trace time of the first packet (seconds)
Definition: corsaro_int.h:129
enum corsaro_interval_align corsaro_interval_align_t
Settings for interval alignment.
uint64_t packet_cnt
The total number of packets that corsaro processed.
Definition: corsaro_int.h:123
uint32_t magic
The trailer magic number.
Definition: corsaro_int.h:121
Header file dealing with the low-level file IO.
uint64_t accepted_cnt
The number of packets libtrace reports as accepted.
Definition: corsaro_int.h:125
int meta_output_rotate
The meta output files will be rotated after n intervals if >=0 a value of 0 indicates no rotation...
Definition: corsaro_int.h:289
enum corsaro_file_compress corsaro_file_compress_t
Supported compression types (must be kept in sync with wandio)
corsaro_packet_state_t state
The corsaro state associated with this packet.
Definition: corsaro_int.h:214
uint8_t version_major
The corsaro major version number.
Definition: corsaro_int.h:95
uint8_t flags
Features of the packet that have been identified by earlier plugins.
Definition: corsaro_int.h:197
uint8_t * buffer
The buffer to read the record into.
Definition: corsaro_int.h:356
int output_rotate
The output files will be rotated after n intervals if >0.
Definition: corsaro_int.h:283
corsaro_interval_t interval_start
State for the current interval.
Definition: corsaro_int.h:292
corsaro_magic
Enum of overall corsaro magic numbers.
Definition: corsaro_int.h:70
corsaro_geo_provider_t * geo_provider_default
Default geolocation provider object associated with this packet.
Definition: corsaro_int.h:220
uint32_t local_init_time
The local time that corsaro was started at.
Definition: corsaro_int.h:99
corsaro interval magic number - "INTR"
Definition: corsaro_int.h:77
The packet is classified as backscatter.
Definition: corsaro_int.h:204
int global_file_disabled
Has the user asked us not to create a global output file?
Definition: corsaro_int.h:260
uint16_t interval_length
The interval length (seconds)
Definition: corsaro_int.h:101
uint32_t time
The time this interval started/ended.
Definition: corsaro_int.h:165
uint8_t * traceuri
A pointer to the traceuri string.
Definition: corsaro_int.h:105
char * monitorname
The name of the monitor that corsaro is running on.
Definition: corsaro_int.h:242
Corsaro input state.
Definition: corsaro_int.h:323
uint32_t corsaro_magic
The global corsaro magic number.
Definition: corsaro_int.h:119
corsaro_geo_provider_t * geo_providers[CORSARO_GEO_PROVIDER_MAX]
Array of geolocation provider objects associated with this packet.
Definition: corsaro_int.h:217
enum corsaro_magic corsaro_magic_t
Enum of overall corsaro magic numbers.
char * uridata
The uri that was used to open the trace file.
Definition: corsaro_int.h:239
char * uridata
The uri of the file to read data from.
Definition: corsaro_int.h:326
uint32_t magic
The plugin data magic number.
Definition: corsaro_int.h:177
corsaro_file_compress_t compress
The compression type (based on the file name)
Definition: corsaro_int.h:251
Corsaro state for a packet.
Definition: corsaro_int.h:194
uint8_t version_minor
The corsaro minor version number.
Definition: corsaro_int.h:97
uint32_t local_final_time
The time that corsaro completed processing the trace.
Definition: corsaro_int.h:133
corsaro_in_t * corsaro
The corsaro input object the record is associated with.
Definition: corsaro_int.h:353
struct timeval first_ts
The time of the the first packet seen by corsaro.
Definition: corsaro_int.h:298
corsaro_file_t * logfile
The file to write log output to.
Definition: corsaro_int.h:263
Corsaro output state.
Definition: corsaro_int.h:230
corsaro_file_t * global_file
The corsaro output file to write global output to.
Definition: corsaro_int.h:257
libtrace_t * trace
The libtrace trace pointer for the trace that we are being fed.
Definition: corsaro_int.h:236
corsaro_in_record_type_t type
The type of the record currently in the buffer.
Definition: corsaro_int.h:362
uint32_t runtime
The number of (wall) seconds that corsaro took to process the trace.
Definition: corsaro_int.h:135
int started
Has this corsaro object been started yet?
Definition: corsaro_int.h:318
uint64_t dropped_cnt
The number of packets libtrace reports as dropped.
Definition: corsaro_int.h:127
enum corsaro_file_mode corsaro_file_mode_t
Enum of supported file modes.
enum corsaro_in_record_type corsaro_in_record_type_t
Corsaro input record types.
uint32_t next_report
The time that this interval will be dumped at.
Definition: corsaro_int.h:295
Header file dealing with the corsaro geolocation subsystem.
An corsaro packet processing plugin.
uint32_t magic
The header magic number.
Definition: corsaro_int.h:93
corsaro_file_in_t * file
The corsaro input file to read data from.
Definition: corsaro_int.h:329