static Bool statusOK(statusE state) {
if (RFIELD(Status, Failed) || (imageFD < 0)) {
bhmMessage("W", PREFIX"_AAF", "Device accessed after initialization failed");
} else if ((state >= STATUS_ACK) && !RFIELD(Status, Ack)) {
bhmMessage("W", PREFIX"_IBA", "Invalid access before status.Acknowledge set");
} else if ((state >= STATUS_DRIVER) && !RFIELD(Status, Driver)) {
bhmMessage("W", PREFIX"_IBD", "Invalid access before status.Driver set");
// Don't do this check - Linux does accesses of partition table before setting DriverOK
// } else if ((state >= STATUS_RUNNING) && !RFIELD(Status, DriverOk)) {
// bhmMessage("W", PREFIX"_IBR", "Invalid access before status.Driver_OK set");
} else {
return True;
}
return False;
}
int
store_v2_flow_deserialise(u_int8_t *buf, int len, struct store_v2_flow_complete *f,
char *ebuf, int elen)
{
int offset, r;
struct store_v2_flow_AGENT_ADDR4 aa4;
struct store_v2_flow_AGENT_ADDR6 aa6;
struct store_v2_flow_SRC_ADDR4 sa4;
struct store_v2_flow_SRC_ADDR6 sa6;
struct store_v2_flow_DST_ADDR4 da4;
struct store_v2_flow_DST_ADDR6 da6;
struct store_v2_flow_GATEWAY_ADDR4 ga4;
struct store_v2_flow_GATEWAY_ADDR6 ga6;
u_int32_t fields, crc;
bzero(f, sizeof(*f));
flowd_crc32_start(&crc);
memcpy(&f->hdr.fields, buf, sizeof(f->hdr.fields));
if (len < sizeof(f->hdr))
SFAILX(STORE_ERR_BUFFER_SIZE,
"supplied length is too small", 1);
if ((r = store_v2_calc_flow_len((struct store_v2_flow *)buf)) == -1)
SFAILX(STORE_ERR_FLOW_INVALID,
"unsupported flow fields specified", 0);
if (len - sizeof(f->hdr) < r)
SFAILX(STORE_ERR_BUFFER_SIZE,
"calulated flow length is less than supplied len", 1);
flowd_crc32_update((u_char *)&f->hdr, sizeof(f->hdr), &crc);
fields = ntohl(f->hdr.fields);
offset = sizeof(f->hdr);
#define RFIELD(flag, dest) do { \
if (SHASFIELD(flag)) { \
memcpy(&dest, buf + offset, sizeof(dest)); \
offset += sizeof(dest); \
if (SHASFIELD(CRC32) && \
STORE_V2_FIELD_##flag != STORE_V2_FIELD_CRC32) { \
flowd_crc32_update((u_char *)&dest, \
sizeof(dest), &crc); \
} \
} } while (0)
RFIELD(TAG, f->tag);
RFIELD(RECV_TIME, f->recv_time);
RFIELD(PROTO_FLAGS_TOS, f->pft);
RFIELD(AGENT_ADDR4, aa4);
RFIELD(AGENT_ADDR6, aa6);
RFIELD(SRC_ADDR4, sa4);
RFIELD(SRC_ADDR6, sa6);
RFIELD(DST_ADDR4, da4);
RFIELD(DST_ADDR6, da6);
RFIELD(GATEWAY_ADDR4, ga4);
RFIELD(GATEWAY_ADDR6, ga6);
RFIELD(SRCDST_PORT, f->ports);
RFIELD(PACKETS, f->packets);
RFIELD(OCTETS, f->octets);
RFIELD(IF_INDICES, f->ifndx);
RFIELD(AGENT_INFO, f->ainfo);
RFIELD(FLOW_TIMES, f->ftimes);
RFIELD(AS_INFO, f->asinf);
RFIELD(FLOW_ENGINE_INFO, f->finf);
RFIELD(CRC32, f->crc32);
/* Sanity check and convert addresses */
if (SHASFIELD(AGENT_ADDR4) && SHASFIELD(AGENT_ADDR6))
SFAILX(-1, "Flow has both v4/v6 agent addrs", 0);
if (SHASFIELD(SRC_ADDR4) && SHASFIELD(SRC_ADDR6))
SFAILX(-1, "Flow has both v4/v6 src addrs", 0);
if (SHASFIELD(DST_ADDR4) && SHASFIELD(DST_ADDR6))
SFAILX(-1, "Flow has both v4/v6 dst addrs", 0);
if (SHASFIELD(GATEWAY_ADDR4) && SHASFIELD(GATEWAY_ADDR6))
SFAILX(-1, "Flow has both v4/v6 gateway addrs", 0);
#define S_CPYADDR(d, s, fam) do { \
(d).af = (fam == 4) ? AF_INET : AF_INET6; \
memcpy(&d.v##fam, &s, sizeof(d.v##fam)); \
} while (0)
if (SHASFIELD(AGENT_ADDR4))
S_CPYADDR(f->agent_addr, aa4.flow_agent_addr, 4);
if (SHASFIELD(AGENT_ADDR6))
S_CPYADDR(f->agent_addr, aa6.flow_agent_addr, 6);
if (SHASFIELD(SRC_ADDR4))
S_CPYADDR(f->src_addr, sa4.src_addr, 4);
if (SHASFIELD(SRC_ADDR6))
S_CPYADDR(f->src_addr, sa6.src_addr, 6);
if (SHASFIELD(DST_ADDR4))
S_CPYADDR(f->dst_addr, da4.dst_addr, 4);
if (SHASFIELD(DST_ADDR6))
S_CPYADDR(f->dst_addr, da6.dst_addr, 6);
if (SHASFIELD(GATEWAY_ADDR4))
S_CPYADDR(f->gateway_addr, ga4.gateway_addr, 4);
if (SHASFIELD(GATEWAY_ADDR6))
S_CPYADDR(f->gateway_addr, ga6.gateway_addr, 6);
if (SHASFIELD(CRC32) && crc != ntohl(f->crc32.crc32))
SFAILX(STORE_ERR_CRC_MISMATCH, "Flow checksum mismatch", 0);
#undef S_CPYADDR
#undef RFIELD
return (STORE_ERR_OK);
}
