Corsaro plugin that maps ip address to AS Numbers. More...

Macros
#define	CORSARO_PFX2AS_MAGIC 0x41532323
	The magic number for this plugin - "AS##". More...

#define	PLUGIN_NAME "pfx2as"
	The name of this plugin - should match the file name. More...

#define	BUFFER_LEN 1024
	The length of the line buffer when reading pfx2as files. More...

#define	PFX2AS_COL_CNT 3
	The number of columns in a pfx2as file. More...

#define	STATE(corsaro) (CORSARO_PLUGIN_STATE(corsaro, pfx2as, CORSARO_PLUGIN_ID_PFX2AS))
	Extends the generic plugin state convenience macro in corsaro_plugin.h. More...

#define	PLUGIN(corsaro) (CORSARO_PLUGIN_PLUGIN(corsaro, CORSARO_PLUGIN_ID_PFX2AS))
	Extends the generic plugin plugin convenience macro in corsaro_plugin.h. More...

Functions
static void	usage (corsaro_plugin_t *plugin)
	Print plugin usage to stderr. More...

static int	parse_args (corsaro_t *corsaro)
	Parse the arguments given to the plugin. More...

static int	parse_asn (char asn_str, uint32_t *asn_arr)
	Parse an underscore-separated list of ASNs. More...

static void	str_free (const char *str)
	Free a string (for use with the map) More...

static int	read_routeviews (corsaro_t corsaro, corsaro_file_in_t file)
	Read the prefix2as file. More...

static corsaro_geo_record_t *	cache_get (kh_32record_t *hash, uint32_t ip)
	Get an ASN record from the cache given an IP address. More...

static void	cache_add (kh_32record_t hash, uint32_t ip, corsaro_geo_record_t record)
	Add an ASN record to the hash for the given IP address. More...

static int	process_generic (corsaro_t corsaro, corsaro_packet_state_t state, uint32_t src_ip)
	Common code between process_packet and process_flowtuple. More...

corsaro_plugin_t *	corsaro_pfx2as_alloc (corsaro_t *corsaro)
	Implements the alloc function of the plugin API. More...

int	corsaro_pfx2as_probe_filename (const char *fname)
	Implements the probe_filename function of the plugin API. More...

int	corsaro_pfx2as_probe_magic (corsaro_in_t corsaro, corsaro_file_in_t file)
	Implements the probe_magic function of the plugin API. More...

int	corsaro_pfx2as_init_output (corsaro_t *corsaro)
	Implements the init_output function of the plugin API. More...

int	corsaro_pfx2as_init_input (corsaro_in_t *corsaro)
	Implements the init_input function of the plugin API. More...

int	corsaro_pfx2as_close_input (corsaro_in_t *corsaro)
	Implements the close_input function of the plugin API. More...

int	corsaro_pfx2as_close_output (corsaro_t *corsaro)
	Implements the close_output function of the plugin API. More...

off_t	corsaro_pfx2as_read_record (struct corsaro_in corsaro, corsaro_in_record_type_t record_type, corsaro_in_record_t *record)
	Implements the read_record function of the plugin API. More...

off_t	corsaro_pfx2as_read_global_data_record (struct corsaro_in corsaro, enum corsaro_in_record_type record_type, struct corsaro_in_record *record)
	Implements the read_global_data_record function of the plugin API. More...

int	corsaro_pfx2as_start_interval (corsaro_t corsaro, corsaro_interval_t int_start)
	Implements the start_interval function of the plugin API. More...

int	corsaro_pfx2as_end_interval (corsaro_t corsaro, corsaro_interval_t int_end)
	Implements the end_interval function of the plugin API. More...

int	corsaro_pfx2as_process_packet (corsaro_t corsaro, corsaro_packet_t packet)
	Implements the process_packet function of the plugin API. More...

Variables
static corsaro_plugin_t	corsaro_pfx2as_plugin
	Initialize the hash type (32bit keys, geo_record values) More...

Detailed Description

Corsaro plugin that maps ip address to AS Numbers.

Author: Karyn Benson; Alistair King

Definition in file corsaro_pfx2as.c.

Macro Definition Documentation

#define BUFFER_LEN 1024

The length of the line buffer when reading pfx2as files.

Definition at line 114 of file corsaro_pfx2as.c.

Referenced by read_routeviews().

#define CORSARO_PFX2AS_MAGIC 0x41532323

The magic number for this plugin - "AS##".

Definition at line 77 of file corsaro_pfx2as.c.

#define PFX2AS_COL_CNT 3

The number of columns in a pfx2as file.

Definition at line 117 of file corsaro_pfx2as.c.

Referenced by read_routeviews().

#define PLUGIN ( corsaro ) (CORSARO_PLUGIN_PLUGIN(corsaro, CORSARO_PLUGIN_ID_PFX2AS))

Extends the generic plugin plugin convenience macro in corsaro_plugin.h.

Definition at line 123 of file corsaro_pfx2as.c.

Referenced by corsaro_pfx2as_close_output(), corsaro_pfx2as_init_output(), and parse_args().

#define PLUGIN_NAME "pfx2as"

The name of this plugin - should match the file name.

Definition at line 80 of file corsaro_pfx2as.c.

#define STATE ( corsaro ) (CORSARO_PLUGIN_STATE(corsaro, pfx2as, CORSARO_PLUGIN_ID_PFX2AS))

Extends the generic plugin state convenience macro in corsaro_plugin.h.

Definition at line 120 of file corsaro_pfx2as.c.

Referenced by corsaro_pfx2as_close_output(), parse_args(), process_generic(), and read_routeviews().

Function Documentation

static void cache_add	(	kh_32record_t *	hash,
		uint32_t	ip,
		corsaro_geo_record_t *	record
	)

static

Add an ASN record to the hash for the given IP address.

Definition at line 375 of file corsaro_pfx2as.c.

References record.

Referenced by process_generic().

static corsaro_geo_record_t* cache_get	(	kh_32record_t *	hash,
		uint32_t	ip
	)

static

Get an ASN record from the cache given an IP address.

Definition at line 362 of file corsaro_pfx2as.c.

References record.

Referenced by process_generic().

corsaro_plugin_t* corsaro_pfx2as_alloc ( corsaro_t * corsaro )

Implements the alloc function of the plugin API.

Definition at line 459 of file corsaro_pfx2as.c.

References corsaro_pfx2as_plugin.

int corsaro_pfx2as_close_input ( corsaro_in_t * corsaro )

Implements the close_input function of the plugin API.

Definition at line 554 of file corsaro_pfx2as.c.

int corsaro_pfx2as_close_output ( corsaro_t * corsaro )

Implements the close_output function of the plugin API.

Definition at line 560 of file corsaro_pfx2as.c.

References corsaro_geo_free_provider(), corsaro_log(), corsaro_plugin_free_state(), PLUGIN, corsaro::plugin_manager, record, and STATE.

Referenced by corsaro_pfx2as_init_output().

int corsaro_pfx2as_end_interval	(	corsaro_t *	corsaro,
		corsaro_interval_t *	int_end
	)

Implements the end_interval function of the plugin API.

Definition at line 616 of file corsaro_pfx2as.c.

int corsaro_pfx2as_init_input ( corsaro_in_t * corsaro )

Implements the init_input function of the plugin API.

Definition at line 548 of file corsaro_pfx2as.c.

int corsaro_pfx2as_init_output ( corsaro_t * corsaro )

Implements the init_output function of the plugin API.

Definition at line 479 of file corsaro_pfx2as.c.

References corsaro_file_rclose(), corsaro_file_ropen(), CORSARO_GEO_DATASTRUCTURE_DEFAULT, corsaro_geo_init_provider(), CORSARO_GEO_PROVIDER_DEFAULT_NO, CORSARO_GEO_PROVIDER_PFX2AS, corsaro_log(), corsaro_pfx2as_close_output(), corsaro_plugin_register_state(), malloc_zero(), parse_args(), PLUGIN, corsaro::plugin_manager, read_routeviews(), and record.

int corsaro_pfx2as_probe_filename ( const char * fname )

Implements the probe_filename function of the plugin API.

Definition at line 465 of file corsaro_pfx2as.c.

References corsaro_pfx2as_plugin, and corsaro_plugin_probe_filename().

int corsaro_pfx2as_probe_magic	(	corsaro_in_t *	corsaro,
		corsaro_file_in_t *	file
	)

Implements the probe_magic function of the plugin API.

Definition at line 472 of file corsaro_pfx2as.c.

int corsaro_pfx2as_process_packet	(	corsaro_t *	corsaro,
		corsaro_packet_t *	packet
	)

Implements the process_packet function of the plugin API.

Definition at line 623 of file corsaro_pfx2as.c.

References LT_PKT, process_generic(), and corsaro_packet::state.

off_t corsaro_pfx2as_read_global_data_record	(	struct corsaro_in *	corsaro,
		enum corsaro_in_record_type *	record_type,
		struct corsaro_in_record *	record
	)

Implements the read_global_data_record function of the plugin API.

Definition at line 599 of file corsaro_pfx2as.c.

off_t corsaro_pfx2as_read_record	(	struct corsaro_in *	corsaro,
		corsaro_in_record_type_t *	record_type,
		corsaro_in_record_t *	record
	)

Implements the read_record function of the plugin API.

Definition at line 590 of file corsaro_pfx2as.c.

int corsaro_pfx2as_start_interval	(	corsaro_t *	corsaro,
		corsaro_interval_t *	int_start
	)

Implements the start_interval function of the plugin API.

Definition at line 608 of file corsaro_pfx2as.c.

static int parse_args ( corsaro_t * corsaro )

static

Parse the arguments given to the plugin.

Definition at line 137 of file corsaro_pfx2as.c.

References corsaro_plugin::argc, corsaro_plugin::argv, PLUGIN, STATE, and usage().

Referenced by corsaro_pfx2as_init_output().

static int parse_asn	(	char *	asn_str,
		uint32_t **	asn_arr
	)

static

Parse an underscore-separated list of ASNs.

Definition at line 178 of file corsaro_pfx2as.c.

Referenced by read_routeviews().

static int process_generic	(	corsaro_t *	corsaro,
		corsaro_packet_state_t *	state,
		uint32_t	src_ip
	)

static

Common code between process_packet and process_flowtuple.

Definition at line 387 of file corsaro_pfx2as.c.

References cache_add(), cache_get(), corsaro_geo_dump_record(), corsaro_geo_get_by_id(), corsaro_geo_next_record(), corsaro_geo_provider_add_record(), corsaro_geo_provider_clear(), corsaro_geo_provider_lookup_record(), CORSARO_GEO_PROVIDER_PFX2AS, record, and STATE.

Referenced by corsaro_pfx2as_process_packet().

static int read_routeviews	(	corsaro_t *	corsaro,
		corsaro_file_in_t *	file
	)

static

Read the prefix2as file.

Definition at line 225 of file corsaro_pfx2as.c.

References corsaro_geo_record::asn, corsaro_geo_record::asn_cnt, corsaro_geo_record::asn_ip_cnt, BUFFER_LEN, chomp(), corsaro_file_rgets(), corsaro_geo_init_record(), corsaro_geo_provider_associate_record(), corsaro_log(), parse_asn(), PFX2AS_COL_CNT, record, STATE, and str_free().

Referenced by corsaro_pfx2as_init_output().

static void str_free ( const char * str )

inlinestatic

Free a string (for use with the map)

Definition at line 219 of file corsaro_pfx2as.c.

Referenced by read_routeviews().

static void usage ( corsaro_plugin_t * plugin )

static

Print plugin usage to stderr.

Definition at line 127 of file corsaro_pfx2as.c.

References corsaro_plugin::argv.

Referenced by parse_args().

Variable Documentation

corsaro_plugin_t corsaro_pfx2as_plugin

static

Initial value:

= {
  PLUGIN_NAME,                                 
  CORSARO_PLUGIN_ID_PFX2AS,                         
  CORSARO_PFX2AS_MAGIC,                             
  CORSARO_PLUGIN_GENERATE_PTRS(corsaro_pfx2as),
  CORSARO_PLUGIN_GENERATE_TAIL,
}

Initialize the hash type (32bit keys, geo_record values)

Initialize the map type (string keys, geo_record values Common plugin information across all instances

Definition at line 88 of file corsaro_pfx2as.c.

Referenced by corsaro_pfx2as_alloc(), and corsaro_pfx2as_probe_filename().

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

Function Documentation

Variable Documentation