/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V4( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V4(ar); } /* sTime, elapsed, pkts, bytes, proto, tcp-flags, state, application */ rwpackUnpackFlagsTimesVolumes(rwrec, ar, stream->hdr_starttime, 16, 0); /* sPort, dPort */ rwRecMemSetSPort(rwrec, &ar[16]); rwRecMemSetDPort(rwrec, &ar[18]); /* sIP, dIP */ rwRecMemSetSIPv4(rwrec, &ar[20]); rwRecMemSetDIPv4(rwrec, &ar[24]); /* output */ rwRecMemSetOutput(rwrec, &ar[28]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int genericioRecordUnpack_V3( skstream_t *rwIOS, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t quot; uint16_t rem; /* swap if required */ if (rwIOS->swapFlag) { genericioRecordSwap_V3(ar); } /* sIP, dIP, sPort, dPort, nhIP, input, output */ rwRecMemSetSIPv4(rwrec, &ar[0]); rwRecMemSetDIPv4(rwrec, &ar[4]); rwRecMemSetSPort(rwrec, &ar[8]); rwRecMemSetDPort(rwrec, &ar[10]); rwRecMemSetNhIPv4(rwrec, &ar[12]); rwRecMemSetInput(rwrec, &ar[16]); rwRecMemSetOutput(rwrec, &ar[18]); /* sTime, sTime_msec */ memcpy(", &ar[20], 4); memcpy(&rem, &ar[48], 2); rwRecSetStartTime(rwrec, sktimeCreate(quot, rem)); /* elapsed, elapsed_msec */ memcpy(", &ar[24], 4); memcpy(&rem, &ar[50], 2); rwRecSetElapsed(rwrec, (1000 * quot + rem)); /* pkts, bytes */ rwRecMemSetPkts(rwrec, &ar[28]); rwRecMemSetBytes(rwrec, &ar[32]); /* proto, flowtype, sensor, flags, init_flags, rest_flags, tcp_state */ rwRecMemSetProto(rwrec, &ar[36]); rwRecMemSetFlowType(rwrec, &ar[37]); rwRecMemSetSensor(rwrec, &ar[38]); rwRecMemSetFlags(rwrec, &ar[40]); rwRecMemSetInitFlags(rwrec, &ar[41]); rwRecMemSetRestFlags(rwrec, &ar[42]); rwRecMemSetTcpState(rwrec, &ar[43]); /* bpp field no longer exists */ /* sTime_msec (above), elapsed_msec (above) */ /* application */ rwRecMemSetApplication(rwrec, &ar[52]); RWREC_MAYBE_CLEAR_TCPSTATE_EXPANDED(rwrec); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int genericioRecordUnpack_V2( skstream_t *rwIOS, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t tmp32; /* swap if required */ if (rwIOS->swapFlag) { genericioRecordSwap_V2(ar); } /* sIP, dIP, sPort, dPort, nhIP, input, output */ rwRecMemSetSIPv4(rwrec, &ar[0]); rwRecMemSetDIPv4(rwrec, &ar[4]); rwRecMemSetSPort(rwrec, &ar[8]); rwRecMemSetDPort(rwrec, &ar[10]); rwRecMemSetNhIPv4(rwrec, &ar[12]); rwRecMemSetInput(rwrec, &ar[16]); rwRecMemSetOutput(rwrec, &ar[18]); /* sTime, elapsed */ memcpy(&tmp32, &ar[20], 4); rwRecSetStartTime(rwrec, sktimeCreate(tmp32, 0)); memcpy(&tmp32, &ar[24], 4); rwRecSetElapsed(rwrec, (1000 * tmp32)); /* pkts, bytes */ rwRecMemSetPkts(rwrec, &ar[28]); rwRecMemSetBytes(rwrec, &ar[32]); /* proto, flow_type, sID, flags, init_flags, rest_flags, tcp_state */ rwRecMemSetProto(rwrec, &ar[36]); rwRecMemSetFlowType(rwrec, &ar[37]); rwRecMemSetSensor(rwrec, &ar[38]); rwRecMemSetFlags(rwrec, &ar[40]); rwRecMemSetInitFlags(rwrec, &ar[41]); rwRecMemSetRestFlags(rwrec, &ar[42]); rwRecMemSetTcpState(rwrec, &ar[43]); /* bpp field no longer exists */ RWREC_MAYBE_CLEAR_TCPSTATE_EXPANDED(rwrec); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V1( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t msec_flags; uint8_t is_tcp, prot_flags; /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V1(ar); } /* sIP, dIP, sPort, dPort */ rwRecMemSetSIPv4(rwrec, &ar[0]); rwRecMemSetDIPv4(rwrec, &ar[4]); rwRecMemSetSPort(rwrec, &ar[8]); rwRecMemSetDPort(rwrec, &ar[10]); /* msec times, proto or flags */ memcpy(&msec_flags, &ar[20], 4); /* application */ rwRecMemSetApplication(rwrec, &ar[24]); /* sTime, pkts, bytes, elapsed, proto, tcp-flags, bpp */ rwpackUnpackTimeBytesPktsFlags(rwrec, stream->hdr_starttime, (uint32_t*)&ar[12], (uint32_t*)&ar[16], &msec_flags); /* extra TCP information */ is_tcp = (uint8_t)GET_MASKED_BITS(msec_flags, 10, 1); prot_flags = (uint8_t)GET_MASKED_BITS(msec_flags, 0, 8); rwpackUnpackProtoFlags(rwrec, is_tcp, prot_flags, ar[26], ar[27]); /* output interfaces */ rwRecMemSetOutput(rwrec, &ar[28]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int genericioRecordUnpack_V1( skstream_t *rwIOS, rwGenericRec_V5 *rwrec, uint8_t *ar) { uint32_t tmp32; /* swap if required */ if (rwIOS->swapFlag) { genericioRecordSwap_V1(ar); } /* sIP, dIP, sPort, dPort */ rwRecMemSetSIPv4(rwrec, &ar[0]); rwRecMemSetDIPv4(rwrec, &ar[4]); rwRecMemSetSPort(rwrec, &ar[8]); rwRecMemSetDPort(rwrec, &ar[10]); /* proto, flags, input, output */ rwRecSetProto(rwrec, ar[12]); rwRecSetFlags(rwrec, ar[13]); rwRecSetInput(rwrec, ar[14]); rwRecSetOutput(rwrec, ar[15]); /* nhIP */ rwRecMemSetNhIPv4(rwrec, &ar[16]); /* sTime */ memcpy(&tmp32, &ar[20], 4); rwRecSetStartTime(rwrec, sktimeCreate(tmp32, 0)); /* pkts, bytes */ rwRecMemSetPkts(rwrec, &ar[24]); rwRecMemSetBytes(rwrec, &ar[28]); /* elapsed */ memcpy(&tmp32, &ar[32], 4); rwRecSetElapsed(rwrec, (1000 * tmp32)); /* sID */ rwRecSetSensor(rwrec, ar[36]); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int augsnmpoutioRecordUnpack_V5( skstream_t *stream, rwGenericRec_V5 *rwrec, uint8_t *ar) { /* swap if required */ if (stream->swapFlag) { augsnmpoutioRecordSwap_V5(ar); } /* Start time, TCP flags, Protocol, TCP State */ rwpackUnpackTimesFlagsProto(rwrec, ar, stream->hdr_starttime); /* application */ rwRecMemSetApplication(rwrec, &ar[ 6]); /* sPort, dPort */ rwRecMemSetSPort(rwrec, &ar[ 8]); rwRecMemSetDPort(rwrec, &ar[10]); /* Elapsed */ rwRecMemSetElapsed(rwrec, &ar[12]); /* packets, bytes */ rwRecMemSetPkts(rwrec, &ar[16]); rwRecMemSetBytes(rwrec, &ar[20]); /* sIP, dIP */ rwRecMemSetSIPv4(rwrec, &ar[24]); rwRecMemSetDIPv4(rwrec, &ar[28]); /* output */ rwRecMemSetOutput(rwrec, &ar[32]); /* sensor, flow_type from file name/header */ rwRecSetSensor(rwrec, stream->hdr_sensor); rwRecSetFlowType(rwrec, stream->hdr_flowtype); return SKSTREAM_OK; }
/* * Unpack the array of bytes 'ar' into a record 'rwrec' */ static int genericioRecordUnpack_V5( skstream_t *rwIOS, rwGenericRec_V5 *rwrec, uint8_t *ar) { /* swap if required */ if (rwIOS->swapFlag) { genericioRecordSwap_V5(ar); } #if !SK_ENABLE_IPV6 memcpy(rwrec, ar, RECLEN_RWGENERIC_V5); #else rwRecMemSetStartTime(rwrec, &ar[0]); rwRecMemSetElapsed(rwrec, &ar[8]); rwRecMemSetSPort(rwrec, &ar[12]); rwRecMemSetDPort(rwrec, &ar[14]); rwRecMemSetProto(rwrec, &ar[16]); rwRecMemSetFlowType(rwrec, &ar[17]); rwRecMemSetSensor(rwrec, &ar[18]); rwRecMemSetFlags(rwrec, &ar[20]); rwRecMemSetInitFlags(rwrec, &ar[21]); rwRecMemSetRestFlags(rwrec, &ar[22]); rwRecMemSetTcpState(rwrec, &ar[23]); rwRecMemSetApplication(rwrec, &ar[24]); rwRecMemSetMemo(rwrec, &ar[26]); rwRecMemSetInput(rwrec, &ar[28]); rwRecMemSetOutput(rwrec, &ar[30]); rwRecMemSetPkts(rwrec, &ar[32]); rwRecMemSetBytes(rwrec, &ar[36]); rwRecMemSetSIPv4(rwrec, &ar[40]); rwRecMemSetDIPv4(rwrec, &ar[44]); rwRecMemSetNhIPv4(rwrec, &ar[48]); #endif RWREC_MAYBE_CLEAR_TCPSTATE_EXPANDED(rwrec); return SKSTREAM_OK; }