pfring_ft.h

Go to the documentation of this file.

/*
 *
 * (C) 2018 - ntop.org
 *
 *  http://www.ntop.org/
 *
 * This code is proprietary code subject to the terms and conditions
 * defined in LICENSE file which is part of this source code package.
 *
 */

#ifndef _PFRING_FT_H_
#define _PFRING_FT_H_

#include <sys/types.h>

#ifdef __cplusplus
extern "C" {
#endif

typedef void pfring_ft_table;
typedef void pfring_ft_list;
typedef void pfring_ft_flow;

struct ndpi_detection_module_struct;

/*** enums ***/

typedef enum {
  PFRING_FT_ACTION_DEFAULT = 0,
  PFRING_FT_ACTION_FORWARD,
  PFRING_FT_ACTION_DISCARD
} pfring_ft_action;

typedef enum { 
  s2d_direction = 0, 
  d2s_direction,     
  NUM_DIRECTIONS
} pfring_ft_direction;

/*** packet header structs ***/

typedef u_int32_t pfring_ft_in4_addr;

typedef struct {
  union {
    u_int8_t   u6_addr8[16];
    u_int16_t  u6_addr16[8];
    u_int32_t  u6_addr32[4];
  } u6_addr;
} __attribute__((packed))
pfring_ft_in6_addr;

typedef struct {
  u_int8_t ihl:4, version:4;
  u_int8_t tos;
  u_int16_t tot_len;
  u_int16_t id;
  u_int16_t frag_off;
  u_int8_t ttl;
  u_int8_t protocol;
  u_int16_t check;
  u_int32_t saddr;
  u_int32_t daddr;
} __attribute__((packed))
pfring_ft_iphdr;

typedef struct {
  u_int32_t ip6_un1_flow;
  u_int16_t ip6_un1_plen;
  u_int8_t ip6_un1_nxt;
  u_int8_t ip6_un1_hlim;
  pfring_ft_in6_addr ip6_src;
  pfring_ft_in6_addr ip6_dst;
} __attribute__((packed))
pfring_ft_ipv6hdr;

typedef struct {
  u_int16_t source;
  u_int16_t dest;
  u_int32_t seq;
  u_int32_t ack_seq;
  u_int16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1;
  u_int16_t window;
  u_int16_t check;
  u_int16_t urg_ptr;
} __attribute__((packed))
pfring_ft_tcphdr;

typedef struct {
  u_int16_t source;
  u_int16_t dest;
  u_int16_t len;
  u_int16_t check;
} __attribute__((packed))
pfring_ft_udphdr;

/*** packet metadata structs ***/

typedef struct { /* pfring_pkthdr / pcap_pkthdr common struct */
  struct timeval ts; 
  u_int32_t caplen;  
  u_int32_t len;     
} pfring_ft_pcap_pkthdr;

typedef struct { /* additional packet metadata not available in pcap_pkthdr */
  u_int32_t hash;  
} pfring_ft_ext_pkthdr;

typedef struct {
  pfring_ft_pcap_pkthdr *hdr;
  pfring_ft_ext_pkthdr *ext_hdr;
  pfring_ft_direction direction;
  u_int16_t vlan_id;
  u_int8_t ip_version;
  u_int8_t l4_proto;
  u_int16_t payload_len;
  u_int16_t reserved; /* padding */
  union {
    pfring_ft_iphdr   *ip4;
    pfring_ft_ipv6hdr *ip6;
  } l3;
  union {
    pfring_ft_tcphdr *tcp;
    pfring_ft_udphdr *udp;
  } l4;
  const u_char *payload;
} pfring_ft_packet_metadata;

/*** flow metadata structs ***/

typedef union {
  pfring_ft_in4_addr v4;
  pfring_ft_in6_addr v6;
} pfring_ft_ip_address;

typedef struct {
  u_int16_t master_protocol;  
  u_int16_t app_protocol;     
  int category;
} pfring_ft_ndpi_protocol;

typedef struct {
  pfring_ft_ip_address saddr; 
  pfring_ft_ip_address daddr; 
  u_int8_t ip_version;        
  u_int8_t protocol;          
  u_int16_t sport;            
  u_int16_t dport;            
  u_int16_t vlan_id;          
} pfring_ft_flow_key;

typedef struct {
  struct {
    u_int64_t pkts;                    
    u_int64_t bytes;                   
    struct timeval first;              
    struct timeval last;               
    u_int8_t tcp_flags;                
  } direction[NUM_DIRECTIONS];         
  pfring_ft_ndpi_protocol l7_protocol; 
  void *user;                          
} pfring_ft_flow_value;

/*** stats struct ***/

typedef struct {
  u_int64_t flows;            
  u_int64_t err_no_room;      
  u_int64_t err_no_mem;       
  u_int64_t disc_no_ip;       
  u_int64_t max_lookup_depth; 
} pfring_ft_stats;

/*** Callbacks prototypes ***/

typedef void
(*pfring_ft_export_list_func) (
  pfring_ft_list *flows_list,
  void *user
);

typedef void
(*pfring_ft_export_flow_func) (
  pfring_ft_flow *flow,
  void *user
);

typedef void
(*pfring_ft_flow_packet_func) (
  const u_char *data,
  pfring_ft_packet_metadata *metadata,
  pfring_ft_flow *flow,
  void *user
);

#define PFRING_FT_TABLE_FLAGS_DPI (1 << 0) 
pfring_ft_table *
pfring_ft_create_table(
  u_int32_t flags,
  u_int32_t max_flows,
  u_int32_t flow_timeout
);

void
pfring_ft_destroy_table(
  pfring_ft_table *table
);

void
pfring_ft_set_new_flow_callback(
  pfring_ft_table *table,
  pfring_ft_export_flow_func callback,
  void *user
);

void
pfring_ft_set_flow_packet_callback(
  pfring_ft_table *table,
  pfring_ft_flow_packet_func callback, 
  void *user
);

void
pfring_ft_set_flow_export_callback(
  pfring_ft_table *table,
  pfring_ft_export_flow_func callback,
  void *user
);

void
pfring_ft_set_flow_list_export_callback(
  pfring_ft_table *table,
  pfring_ft_export_list_func callback, 
  void *user
);

pfring_ft_action
pfring_ft_process(
  pfring_ft_table *table,
  const u_char *packet,
  const pfring_ft_pcap_pkthdr *header,
  const pfring_ft_ext_pkthdr *ext_header
);

int
pfring_ft_housekeeping(
  pfring_ft_table *table,
  u_int32_t epoch
);

void
pfring_ft_flush(
  pfring_ft_table *table
);

pfring_ft_flow *
pfring_ft_list_get_next(
  pfring_ft_list *list
);

pfring_ft_flow_key *
pfring_ft_flow_get_key(
  pfring_ft_flow *flow
);

pfring_ft_flow_value *
pfring_ft_flow_get_value(
  pfring_ft_flow *flow
);

void
pfring_ft_flow_set_action(
  pfring_ft_flow *flow,
  pfring_ft_action action
);

void
pfring_ft_flow_free(
  pfring_ft_flow *flow
);

void
pfring_ft_load_configuration(
  pfring_ft_table *table, 
  const char *path
);

void 
pfring_ft_set_shunt_protocol_by_name(
  pfring_ft_table *table,
  const char *protocol_name,
  u_int8_t packets
);

void 
pfring_ft_set_filter_protocol_by_name(
  pfring_ft_table *table,
  const char *protocol_name,
  pfring_ft_action action
);

char *
pfring_ft_l7_protocol_name(
  pfring_ft_table *table,
  pfring_ft_ndpi_protocol *protocol,
  char *buffer, 
  int buffer_len
);

int
pfring_ft_set_ndpi_handle(
  pfring_ft_table *table,
  struct ndpi_detection_module_struct *ndpi
);

int
pfring_ft_load_ndpi_categories(
  pfring_ft_table *table,
  const char *path
);

pfring_ft_stats *
pfring_ft_get_stats(
  pfring_ft_table *table
);

void
pfring_ft_version(
  char *version
);

int
pfring_ft_license(
  char *system_id, 
  time_t *license_expiration, 
  time_t *maintenance_expiration
);

void
pfring_ft_debug(
  void
);

#ifdef __cplusplus
}
#endif

#endif /* _PFRING_FT_H_ */