1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
|
/**
* @file flow.c
* @author Chris Green <cmg@sourcefire.com>
* @date Thu May 29 15:38:05 2003
*
* @brief FLOW and associated operations
*
*
*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "flow.h"
#include "flow_stat.h"
#include "flow_print.h"
#include <stdlib.h>
#include <string.h> /* for memcpy */
int flow_init(FLOW *flow,
char protocol,
u_int32_t init_address,
u_int16_t init_port,
u_int32_t resp_address,
u_int16_t resp_port)
{
if(flow == NULL)
{
return FLOW_ENULL;
}
flow->key.protocol = protocol;
flow->key.init_address = init_address;
flow->key.init_port = init_port;
flow->key.resp_address = resp_address;
flow->key.resp_port = resp_port;
if(flowstat_clear(&flow->stats))
{
flow_printf("unable to clear flow stats\n");
return FLOW_EINVALID;
}
/** have not done anything with the flow->data section yet */
return FLOW_SUCCESS;
}
/**
* Calloc a FLOW object of the right type -- this function is not needed
*
* @param family address family
* @param flow paramter to return the actual flow in
* @param size # of bytes allocated for a new flow
*
* @return 0 on sucess, else failure
*/
int flow_alloc(int family, FLOW **flow, int *size)
{
int tmpsize = sizeof(FLOW);
FLOW *fp;
if(!flow || !size)
{
return FLOW_ENULL;
}
fp = (FLOW *) calloc(1,tmpsize);
if(fp == NULL)
{
*size = 0;
return FLOW_ENOMEM;
}
*size = tmpsize;
*flow = fp;
return FLOW_SUCCESS;
}
/**
* Given a packet, generate a key.
*
* @todo ICMP errors on an existing flow
*
* @param key where to set the key
* @param p Packet to make a key from
*
* @return FLOW_SUCCESS on success, else failure
*/
int flowkey_make(FLOWKEY *key, FLOWPACKET *p)
{
u_int8_t proto;
if(!key || !p)
return FLOW_ENULL;
memset(key, 0, sizeof(FLOWKEY));
/* IPV4 path */
if(IsIPv4Packet(p))
{
proto = GetIPv4Proto(p);
switch(proto)
{
case IPPROTO_TCP:
case IPPROTO_UDP:
key->init_port = GetIPv4SrcPort(p);
key->resp_port = GetIPv4DstPort(p);
default:
key->protocol = proto;
key->init_address = GetIPv4SrcIp(p);
key->resp_address = GetIPv4DstIp(p);
}
return FLOW_SUCCESS;
}
return FLOW_EINVALID;
}
/**
* print out a key to a file stream
*
* @param key what to print
*
* @return 0 on sucess
*/
int flowkey_print(FLOWKEY *key)
{
flow_printf(" Protocol : %d", key->protocol);
flow_printf(" InitAddress: %s", inet_ntoa(*(struct in_addr *) &key->init_address));
flow_printf(" InitPort : %d", key->init_port);
flow_printf(" RespAddress: %s", inet_ntoa(*(struct in_addr *) &key->resp_address));
flow_printf(" RespPort : %d", key->resp_port);
return 0;
}
/**
* Copy into dst from src and normalize the results so that things
* will hash to the same entry no matter what.
*
* This should only be used for SEARCHING as it doesn't store much else.
*
* @param dst where to copy to
* @param src where to copy from
*/
int flowkey_normalize(FLOWKEY *dst, const FLOWKEY *src)
{
/* normal memcpy */
dst->protocol = src->protocol;
if(src->init_address > src->resp_address)
{
dst->resp_port = src->init_port;
dst->init_port = src->resp_port;
dst->init_address = src->resp_address;
dst->resp_address = src->init_address;
}
else
{
dst->init_port = src->init_port;
dst->resp_port = src->resp_port;
dst->init_address = src->init_address;
dst->resp_address = src->resp_address;
}
return 0;
}
/**
* perform key comparison
*
* @param s1 pointer to A
* @param s2 pointer to B
* @param n size of each node
*
* @return 0 if they are equal, else they aren't equal
*/
int flowkeycmp_fcn(const void *s1, const void *s2, size_t n)
{
FLOWKEY *a = (FLOWKEY *) s1;
FLOWKEY *b = (FLOWKEY *) s2;
if(a->init_port != b->init_port)
return -1;
if(a->init_address != b->init_address)
return -1;
if(a->resp_address != b->resp_address)
return -1;
if(a->resp_port != b->resp_port)
return -1;
if(a->protocol != b->protocol)
return -1;
return 0;
}
|
