Exemplo n.º 1
0
/*
 *  Unpack the array of bytes 'ar' into a record 'rwrec'
 */
static int
ipv6ioRecordUnpack_V2(
    skstream_t         *rwIOS,
    rwGenericRec_V5    *rwrec,
    uint8_t            *ar)
{
    uint32_t ip;

    /* swap if required */
    if (rwIOS->swapFlag) {
        ipv6ioRecordSwap_V2(ar);
    }

    /* Start time, TCP flags, Protocol, TCP State */
    rwpackUnpackTimesFlagsProto(rwrec, ar, rwIOS->hdr_starttime);

    /* application */
    rwRecMemSetApplication(rwrec, &ar[ 6]);

    /* sPort, dPort */
    rwRecMemSetSPort(rwrec, &ar[ 8]);
    rwRecMemSetDPort(rwrec, &ar[10]);

    /* Elapsed */
    rwRecMemSetElapsed(rwrec, &ar[12]);

    /* packets, bytes */
    rwRecMemSetPkts(rwrec,  &ar[16]);
    rwRecMemSetBytes(rwrec, &ar[20]);

    /* sIP, dIP */
    if (ar[5] & 0x80) {
        /* Record is IPv6 */
#if !SK_ENABLE_IPV6
        return SKSTREAM_ERR_UNSUPPORT_IPV6;
#else
        rwRecSetIPv6(rwrec);
        rwRecMemSetSIPv6(rwrec, &ar[24]);
        rwRecMemSetDIPv6(rwrec, &ar[40]);
#endif /* SK_ENABLE_IPV6 */
    } else {
        /* Record is IPv4 */
        memcpy(&ip, &ar[24+12], sizeof(ip));
        rwRecSetSIPv4(rwrec, ntohl(ip));

        memcpy(&ip, &ar[40+12], sizeof(ip));
        rwRecSetDIPv4(rwrec, ntohl(ip));
    }

    /* sensor, flow_type from file name/header */
    rwRecSetSensor(rwrec, rwIOS->hdr_sensor);
    rwRecSetFlowType(rwrec, rwIOS->hdr_flowtype);

    return SKSTREAM_OK;
}
Exemplo n.º 2
0
/*
 *  Unpack the array of bytes 'ar' into a record 'rwrec'
 */
static int
ipv6ioRecordUnpack_V1(
    skstream_t         *rwIOS,
    rwGenericRec_V5    *rwrec,
    uint8_t            *ar)
{
    uint32_t ip;

    /* swap if required */
    if (rwIOS->swapFlag) {
        ipv6ioRecordSwap_V1(ar);
    }

    rwRecMemSetStartTime(rwrec, &ar[0]);
    rwRecMemSetElapsed(rwrec, &ar[8]);
    rwRecMemSetSPort(rwrec, &ar[12]);
    rwRecMemSetDPort(rwrec, &ar[14]);
    rwRecMemSetProto(rwrec, &ar[16]);
    rwRecMemSetFlowType(rwrec, &ar[17]);
    rwRecMemSetSensor(rwrec, &ar[18]);
    rwRecMemSetFlags(rwrec, &ar[20]);
    rwRecMemSetInitFlags(rwrec, &ar[21]);
    rwRecMemSetRestFlags(rwrec, &ar[22]);
    rwRecMemSetTcpState(rwrec, &ar[23]);
    rwRecMemSetApplication(rwrec, &ar[24]);
    rwRecMemSetMemo(rwrec, &ar[26]);
    rwRecMemSetPkts(rwrec, &ar[28]);
    rwRecMemSetBytes(rwrec, &ar[32]);

    if (ar[23] & 0x80) {
        /* Record is IPv6 */
#if !SK_ENABLE_IPV6
        return SKSTREAM_ERR_UNSUPPORT_IPV6;
#else
        rwRecSetIPv6(rwrec);
        rwRecMemSetSIPv6(rwrec, &ar[36]);
        rwRecMemSetDIPv6(rwrec, &ar[52]);
#endif /* SK_ENABLE_IPV6 */
    } else {
        /* Record is IPv4 */

        /* sIP */
        memcpy(&ip, &ar[48], sizeof(ip));
        rwRecSetSIPv4(rwrec, ntohl(ip));

        /* dIP */
        memcpy(&ip, &ar[64], sizeof(ip));
        rwRecSetDIPv4(rwrec, ntohl(ip));
    }

    RWREC_MAYBE_CLEAR_TCPSTATE_EXPANDED(rwrec);

    return SKSTREAM_OK;
}
Exemplo n.º 3
0
/*
 *  Unpack the array of bytes 'ar' into a record 'rwrec'
 */
static int
ipv6routingioRecordUnpack_V3(
    skstream_t         *stream,
    rwRec              *rwrec,
    uint8_t            *ar)
{
    uint32_t u32;
    uint64_t u64;

#if !SK_ENABLE_IPV6
    if (ar[23] & 0x80) {
        /* Record is IPv6 */
        return SKSTREAM_ERR_UNSUPPORT_IPV6;
    }
#endif

    /* swap if required */
    if (stream->swapFlag) {
        ipv6routingioRecordSwap_V3(ar);
    }

    rwRecMemSetStartTime(rwrec, &ar[0]);
    rwRecMemSetElapsed(rwrec, &ar[8]);
    rwRecMemSetSPort(rwrec, &ar[12]);
    rwRecMemSetDPort(rwrec, &ar[14]);
    rwRecMemSetProto(rwrec, &ar[16]);
    rwRecMemSetFlowType(rwrec, &ar[17]);
    rwRecMemSetSensor(rwrec, &ar[18]);
    rwRecMemSetFlags(rwrec, &ar[20]);
    rwRecMemSetInitFlags(rwrec, &ar[21]);
    rwRecMemSetRestFlags(rwrec, &ar[22]);
    rwRecMemSetTcpState(rwrec, &ar[23]);
    rwRecMemSetApplication(rwrec, &ar[24]);
    rwRecMemSetMemo(rwrec, &ar[26]);

    /* Input; set to UINT16_MAX if too large */
    memcpy(&u32, &ar[28], sizeof(u32));
    if (u32 > UINT16_MAX) {
        rwRecSetInput(rwrec, UINT16_MAX);
    } else {
        rwRecSetInput(rwrec, (uint16_t)u32);
    }

    /* Packets; set to UINT32_MAX if too large */
    memcpy(&u64, &ar[32], sizeof(u64));
    if (u64 > UINT32_MAX) {
        rwRecSetPkts(rwrec, UINT32_MAX);
    } else {
        rwRecSetPkts(rwrec, (uint32_t)u64);
    }

    /* Bytes; set to UINT32_MAX if too large */
    memcpy(&u64, &ar[40], sizeof(u64));
    if (u64 > UINT32_MAX) {
        rwRecSetBytes(rwrec, UINT32_MAX);
    } else {
        rwRecSetBytes(rwrec, (uint32_t)u64);
    }

    /* Output; set to UINT16_MAX if too large */
    memcpy(&u32, &ar[96], sizeof(u32));
    if (u32 > UINT16_MAX) {
        rwRecSetOutput(rwrec, UINT16_MAX);
    } else {
        rwRecSetOutput(rwrec, (uint16_t)u32);
    }

#if SK_ENABLE_IPV6
    if (ar[23] & 0x80) {
        /* Record is IPv6 */
        rwRecSetIPv6(rwrec);
        rwRecMemSetSIPv6(rwrec, &ar[48]);
        rwRecMemSetDIPv6(rwrec, &ar[64]);
        rwRecMemSetNhIPv6(rwrec, &ar[80]);
    } else
#endif  /* SK_ENABLE_IPV6 */
    {
        /* Record is IPv4, but data encoded as IPv6 */
        uint32_t ip;

        /* sIP */
        memcpy(&ip, &ar[60], sizeof(ip));
        rwRecSetSIPv4(rwrec, ntohl(ip));

        /* dIP */
        memcpy(&ip, &ar[76], sizeof(ip));
        rwRecSetDIPv4(rwrec, ntohl(ip));

        /* nhIP */
        memcpy(&ip, &ar[92], sizeof(ip));
        rwRecSetNhIPv4(rwrec, ntohl(ip));
    }

    /*
     * No need for this; file format is post SiLK-3.6.0
     * RWREC_MAYBE_CLEAR_TCPSTATE_EXPANDED(rwrec);
     */

    return SKSTREAM_OK;
}