/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V4( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V4(ar); } /* sTime, elapsed, pkts, bytes, proto, tcp-flags, state, application */ rwpackUnpackFlagsTimesVolumes(rwrec, ar, stream->hdr_starttime, 16, 0); /* sPort, dPort */ rwRecMemSetSPort(rwrec, &ar[16]); rwRecMemSetDPort(rwrec, &ar[18]); /* sIP, dIP */ rwRecMemSetSIPv4(rwrec, &ar[20]); rwRecMemSetDIPv4(rwrec, &ar[24]); /* output */ rwRecMemSetOutput(rwrec, &ar[28]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int ipv6ioRecordUnpack_V2( skstream_t *rwIOS, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t ip; /* swap if required */ if (rwIOS->swapFlag) { ipv6ioRecordSwap_V2(ar); } /* Start time, TCP flags, Protocol, TCP State */ rwpackUnpackTimesFlagsProto(rwrec, ar, rwIOS->hdr_starttime); /* application */ rwRecMemSetApplication(rwrec, &ar[ 6]); /* sPort, dPort */ rwRecMemSetSPort(rwrec, &ar[ 8]); rwRecMemSetDPort(rwrec, &ar[10]); /* Elapsed */ rwRecMemSetElapsed(rwrec, &ar[12]); /* packets, bytes */ rwRecMemSetPkts(rwrec, &ar[16]); rwRecMemSetBytes(rwrec, &ar[20]); /* sIP, dIP */ if (ar[5] & 0x80) { /* Record is IPv6 */ #if !SK_ENABLE_IPV6 return SKSTREAM_ERR_UNSUPPORT_IPV6; #else rwRecSetIPv6(rwrec); rwRecMemSetSIPv6(rwrec, &ar[24]); rwRecMemSetDIPv6(rwrec, &ar[40]); #endif /* SK_ENABLE_IPV6 */ } else { /* Record is IPv4 */ memcpy(&ip, &ar[24+12], sizeof(ip)); rwRecSetSIPv4(rwrec, ntohl(ip)); memcpy(&ip, &ar[40+12], sizeof(ip)); rwRecSetDIPv4(rwrec, ntohl(ip)); } /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, rwIOS->hdr_sensor); rwRecSetFlowType(rwrec, rwIOS->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V1( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t msec_flags; uint8_t is_tcp, prot_flags; /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V1(ar); } /* sIP, dIP, sPort, dPort */ rwRecMemSetSIPv4(rwrec, &ar[0]); rwRecMemSetDIPv4(rwrec, &ar[4]); rwRecMemSetSPort(rwrec, &ar[8]); rwRecMemSetDPort(rwrec, &ar[10]); /* msec times, proto or flags */ memcpy(&msec_flags, &ar[20], 4); /* application */ rwRecMemSetApplication(rwrec, &ar[24]); /* sTime, pkts, bytes, elapsed, proto, tcp-flags, bpp */ rwpackUnpackTimeBytesPktsFlags(rwrec, stream->hdr_starttime, (uint32_t*)&ar[12], (uint32_t*)&ar[16], &msec_flags); /* extra TCP information */ is_tcp = (uint8_t)GET_MASKED_BITS(msec_flags, 10, 1); prot_flags = (uint8_t)GET_MASKED_BITS(msec_flags, 0, 8); rwpackUnpackProtoFlags(rwrec, is_tcp, prot_flags, ar[26], ar[27]); /* output interfaces */ rwRecMemSetOutput(rwrec, &ar[28]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V5( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V5(ar); } /* Start time, TCP flags, Protocol, TCP State */ rwpackUnpackTimesFlagsProto(rwrec, ar, stream->hdr_starttime); /* application */ rwRecMemSetApplication(rwrec, &ar[ 6]); /* sPort, dPort */ rwRecMemSetSPort(rwrec, &ar[ 8]); rwRecMemSetDPort(rwrec, &ar[10]); /* Elapsed */ rwRecMemSetElapsed(rwrec, &ar[12]); /* packets, bytes */ rwRecMemSetPkts(rwrec, &ar[16]); rwRecMemSetBytes(rwrec, &ar[20]); /* sIP, dIP */ rwRecMemSetSIPv4(rwrec, &ar[24]); rwRecMemSetDIPv4(rwrec, &ar[28]); /* output */ rwRecMemSetOutput(rwrec, &ar[32]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }