CERT NetSA Security Suite
Monitoring for Large-Scale Networks

# fixbuf

Documentation

- Main Page
- Related Pages
- Data Structures
- Files

- File List
- Globals

private.h
Go to the documentation of this file.
1
61 #ifndef _FB_PRIVATE_H_
62 #define _FB_PRIVATE_H_
63 #include <fixbuf/public.h>
64
65 #if HAVE_SPREAD
66 #include <sp.h>
67 #include <pthread.h>
68 #endif
69
70 #ident "$Id$"
71
84 #define IPFIX_ENTERPRISE_BIT 0x8000
85
87 #define IPFIX_REVERSE_PEN 29305
88
91 #define FB_MSGLEN_MAX 65535
92
93 #if HAVE_SPREAD
94
95 typedef struct sp_groupname_st
96 {
97 char name[MAX_GROUP_NAME];
98 } sp_groupname_t;
99
100 #define FB_SPREAD_NUM_GROUPS 16
101 #define FB_SPREAD_MTU 8192
102
103 typedef struct fbSpreadSpec_st {
106 fbSession_t *session;
109 char * daemon;
111 sp_groupname_t *groups;
113 int num_groups;
115 sp_groupname_t *groups_to_send;
116 int num_groups_to_send;
118 mailbox mbox;
120 char privgroup[MAX_GROUP_NAME + 2];
122 pthread_mutex_t write_lock;
124 pthread_t recv_thread;
126 mailbox recv_mbox;
128 char recv_privgroup[MAX_GROUP_NAME + 2];
130 GError *recv_err;
132 int recv_exit;
134 int recv_max_groups;
136 int recv_num_groups;
138 sp_groupname_t *recv_groups;
140 int recv_max;
142 char *recv_mess;
143 } fbSpreadSpec_t;
144
145 #endif /* HAVE_SPREAD */
146
153 typedef struct fbUDPConnSpec_st {
155 fbSession_t *session;
157 void *ctx;
159 union {
160 struct sockaddr so;
161 struct sockaddr_in ip4;
162 struct sockaddr_in6 ip6;
163 } peer;
165 size_t peerlen;
167 struct fbUDPConnSpec_st *next;
169 struct fbUDPConnSpec_st *prev;
171 time_t last_seen;
173 uint32_t obdomain;
175 gboolean reject;
176 } fbUDPConnSpec_t;
177
178
184 struct fbTemplate_st {
186 fbInfoModel_t *model;
188 int ref_count;
190 uint16_t ie_count;
195 uint16_t scope_count;
202 uint16_t ie_len;
208 uint16_t ie_internal_len;
213 uint16_t tmpl_len;
215 gboolean is_varlen;
217 fbInfoElement_t **ie_ary;
219 GHashTable *indices;
221 uint16_t *off_cache;
223 gboolean active;
228 void *tmpl_ctx;
232 fbTemplateCtxFree2_fn ctx_free;
236 void *app_ctx;
237 };
238
245 void fBufRewind(
246 fBuf_t *fbuf);
247
259 gboolean fBufAppendTemplate(
260 fBuf_t *fbuf,
261 uint16_t tmpl_id,
262 fbTemplate_t *tmpl,
263 gboolean revoked,
264 GError **err);
265
266 #if HAVE_SPREAD
267
273 void fBufSetExportGroups(
274 fBuf_t *fbuf,
275 char **groups,
276 int num_groups,
277 GError **err);
278
279
280 #endif
281
287 void fBufRemoveTemplateTcplan(
288 fBuf_t *fbuf,
289 fbTemplate_t *tmpl);
290
295 void fBufSetSession(
296 fBuf_t *fbuf,
297 fbSession_t *session);
298
299
307 uint32_t fbInfoElementHash(
308 fbInfoElement_t *ie);
309
318 gboolean fbInfoElementEqual(
319 const fbInfoElement_t *a,
320 const fbInfoElement_t *b);
321
329 void fbInfoElementDebug(
330 gboolean tmpl,
331 fbInfoElement_t *ie);
332
340 const fbInfoElement_t *fbInfoModelGetElement(
341 fbInfoModel_t *model,
342 fbInfoElement_t *ex_ie);
343
352 gboolean fbInfoElementCopyToTemplate(
353 fbInfoModel_t *model,
354 fbInfoElement_t *ex_ie,
355 fbInfoElement_t *tmpl_ie);
356
367 gboolean fbInfoElementCopyToTemplateByName(
368 fbInfoModel_t *model,
369 const char *name,
370 uint16_t len_override,
371 fbInfoElement_t *tmpl_ie);
372
381 const fbInfoElement_t *fbInfoModelAddAlienElement(
382 fbInfoModel_t *model,
383 fbInfoElement_t *ex_ie);
384
392 void fbTemplateRetain(
393 fbTemplate_t *tmpl);
394
402 void fbTemplateRelease(
403 fbTemplate_t *tmpl);
404
412 void fbTemplateFree(
413 fbTemplate_t *tmpl);
414
423 void fbTemplateDebug(
424 const char *label,
425 uint16_t tid,
426 fbTemplate_t *tmpl);
427
434 fbNewTemplateCallback_fn fbSessionTemplateCallback(
435 fbSession_t *session);
436
443 fbTemplateCtxCallback2_fn fbSessionTemplateCtxCallback(
444 fbSession_t *session);
445
453 void *fbSessionTemplateCtxCallbackAppCtx(
454 fbSession_t *session);
455
462 fbSession_t *fbSessionClone(
463 fbSession_t *base);
464
472 uint32_t fbSessionGetSequence(
473 fbSession_t *session);
474
482 void fbSessionSetSequence(
483 fbSession_t *session,
484 uint32_t sequence);
485
493 void fbSessionSetTemplateBuffer(
494 fbSession_t *session,
495 fBuf_t *fbuf);
496
504 void fbSessionSetCollector(
505 fbSession_t *session,
506 fbCollector_t *collector);
507
508 #if HAVE_SPREAD
509
513 void fbSessionSetGroupParams(
514 fbSession_t *session,
515 sp_groupname_t *groups,
516 int num_groups);
517
523 void fbSessionSetPrivateGroup(
524 fbSession_t *session,
525 char *group,
526 char *privgroup);
527
532 void fbSessionSetGroup(
533 fbSession_t *session,
534 char *group);
535
540 unsigned int fbSessionGetGroupOffset(
541 fbSession_t *session,
542 char *group);
543
548 unsigned int fbSessionGetGroup(
549 fbSession_t *session);
550 #endif
551
552 void fbSessionClearIntTmplTableFlag(
553 fbSession_t *session);
554
555 void fbSessionClearExtTmplTableFlag(
556 fbSession_t *session);
557
558 int fbSessionIntTmplTableFlagIsSet(
559 fbSession_t *session);
560
561 int fbSessionExtTmplTableFlagIsSet(
562 fbSession_t *session);
571 gboolean fbConnSpecLookupAI(
572 fbConnSpec_t *spec,
573 gboolean passive,
574 GError **err);
575
584 gboolean fbConnSpecInitTLS(
585 fbConnSpec_t *spec,
586 gboolean passive,
587 GError **err);
588
596 fbConnSpec_t *fbConnSpecCopy(
597 fbConnSpec_t *spec);
598
606 void fbConnSpecFree(
607 fbConnSpec_t *spec);
608
609 #if HAVE_SPREAD
610
617 fbSpreadSpec_t *fbConnSpreadCopy(
618 fbSpreadParams_t *spec);
619
627 void fbConnSpreadFree(
628 fbSpreadSpec_t *spec);
629
638 const char * fbConnSpreadError(
639 int err );
640
641
651 void fbExporterSetGroupsToSend(
652 fbExporter_t *exporter,
653 char **groups,
654 int num_groups);
655
656
666 gboolean fbExporterCheckGroups(
667 fbExporter_t *exporter,
668 char **groups,
669 int num_groups);
670
671
672 #endif /* HAVE_SPREAD */
673
681 uint16_t fbExporterGetMTU(
682 fbExporter_t *exporter);
683
693 gboolean fbExportMessage(
694 fbExporter_t *exporter,
695 uint8_t *msgbase,
696 size_t msglen,
697 GError **err);
698
706 void fbExporterFree(
707 fbExporter_t *exporter);
708
716 void fbCollectorRemoveListenerLastBuf(
717 fBuf_t *fbuf,
718 fbCollector_t *collector);
719
730 fbCollector_t *fbCollectorAllocSocket(
731 fbListener_t *listener,
732 void *ctx,
733 int fd,
734 struct sockaddr *peer,
735 size_t peerlen);
736
748 fbCollector_t *fbCollectorAllocTLS(
749 fbListener_t *listener,
750 void *ctx,
751 int fd,
752 struct sockaddr *peer,
753 size_t peerlen,
754 GError **err);
755
765 gboolean fbCollectMessage(
766 fbCollector_t *collector,
767 uint8_t *msgbase,
768 size_t *msglen,
769 GError **err);
770
778 int fbCollectorGetFD(
779 fbCollector_t *collector);
780
787 void fbCollectorSetFD(
788 fbCollector_t *collector,
789 int fd);
790
798 void fbCollectorFree(
799 fbCollector_t *collector);
800
808 gboolean fbCollectorHasTranslator(
809 fbCollector_t *collector);
810
811
825 gboolean fbCollectMessageBuffer(
826 uint8_t *hdr,
827 size_t b_len,
828 size_t *m_len,
829 GError **err);
830
831
832 #if HAVE_SPREAD
833
840 gboolean fbCollectorTestGroupMembership(
841 fbCollector_t *collector,
842 int group_offset);
843
844 #endif
845
853 void fbListenerAppFree(
854 fbListener_t *listener,
855 void *ctx);
856
864 void fbListenerRemoveLastBuf(
865 fBuf_t *fbuf,
866 fbListener_t *listener);
867
875 void fbListenerRemove(
876 fbListener_t *listener,
877 int fd);
878
886 fbConnSpec_t *fbListenerGetConnSpec(
887 fbListener_t *listener);
888
895 void fbCollectorInterruptSocket(
896 fbCollector_t *collector);
897
902 gboolean fbListenerCallAppInit(
903 fbListener_t *listener,
904 fbUDPConnSpec_t *spec,
905 GError **err);
906
912 fbSession_t *fbListenerSetPeerSession(
913 fbListener_t *listener,
914 fbSession_t *session);
915
916 #endif
fbUDPConnSpec_st::reject
gboolean reject
reject flag
Definition: private.h:175
fbCollectMessage
gboolean fbCollectMessage(fbCollector_t *collector, uint8_t *msgbase, size_t *msglen, GError **err)
fbCollectMessage
fbTemplateRelease
void fbTemplateRelease(fbTemplate_t *tmpl)
fbTemplateRelease
fbListenerSetPeerSession
fbSession_t * fbListenerSetPeerSession(fbListener_t *listener, fbSession_t *session)
Set the session on the fbuf and listener.
fbCollectorInterruptSocket
void fbCollectorInterruptSocket(fbCollector_t *collector)
Interrupt the socket for a given collector to stop it from reading more data.
fbInfoElementCopyToTemplateByName
gboolean fbInfoElementCopyToTemplateByName(fbInfoModel_t *model, const char *name, uint16_t len_override, fbInfoElement_t *tmpl_ie)
fbInfoElementCopyToTemplateByName
fbUDPConnSpec_st::ctx
void * ctx
application context.
Definition: private.h:157
fbUDPConnSpec_st::prev
struct fbUDPConnSpec_st * prev
doubly linked to timeout faster
Definition: private.h:169
fbInfoModelGetElement
const fbInfoElement_t * fbInfoModelGetElement(fbInfoModel_t *model, fbInfoElement_t *ex_ie)
fbInfoModelGetElement
fbUDPConnSpec_st::peerlen
size_t peerlen
size of peer
Definition: private.h:165
fbCollector_t
struct fbCollector_st fbCollector_t
IPFIX Collecting Process endpoint.
Definition: public.h:1634
fbExporter_t
struct fbExporter_st fbExporter_t
IPFIX Exporting Process endpoint.
Definition: public.h:1624
fbCollectorGetFD
int fbCollectorGetFD(fbCollector_t *collector)
fbCollectorGetFD
fbSession_t
struct fbSession_st fbSession_t
An IPFIX Transport Session state container.
Definition: public.h:1526
fbCollectorAllocSocket
fbCollector_t * fbCollectorAllocSocket(fbListener_t *listener, void *ctx, int fd, struct sockaddr *peer, size_t peerlen)
fbCollectorAllocSocket
fbListener_t
struct fbListener_st fbListener_t
IPFIX Collecting Process session listener.
Definition: public.h:1643
fbInfoElementHash
uint32_t fbInfoElementHash(fbInfoElement_t *ie)
fbInfoElementHash
fbTemplate_st::active
gboolean active
TRUE if this template has been activated (is no longer mutable)
Definition: private.h:223
fbListenerCallAppInit
gboolean fbListenerCallAppInit(fbListener_t *listener, fbUDPConnSpec_t *spec, GError **err)
call appinit from UDP
fbUDPConnSpec_st::last_seen
time_t last_seen
last seen time
Definition: private.h:171
fbTemplate_st::ie_count
uint16_t ie_count
Count of information elements in template.
Definition: private.h:190
fbTemplate_st::model
fbInfoModel_t * model
Information model (for looking up information elements by spec)
Definition: private.h:186
fBufAppendTemplate
gboolean fBufAppendTemplate(fBuf_t *fbuf, uint16_t tmpl_id, fbTemplate_t *tmpl, gboolean revoked, GError **err)
fBufAppendTemplate
fbSessionTemplateCallback
fbNewTemplateCallback_fn fbSessionTemplateCallback(fbSession_t *session)
Returns the callback function for a given session.
fbUDPConnSpec_st
An UDP Connection specifier.
Definition: private.h:153
fbCollectorRemoveListenerLastBuf
void fbCollectorRemoveListenerLastBuf(fBuf_t *fbuf, fbCollector_t *collector)
fbCollectorRemoveListenerLastBuf
fbConnSpecInitTLS
gboolean fbConnSpecInitTLS(fbConnSpec_t *spec, gboolean passive, GError **err)
fbConnSpecInitTLS
fbNewTemplateCallback_fn
void(* fbNewTemplateCallback_fn)(fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl)
The callback function to be called when the session receives a new external template from the connect...
Definition: public.h:1705
fbTemplate_st::ie_internal_len
uint16_t ie_internal_len
Total length required to store this template in a data structure.
Definition: private.h:208
fbUDPConnSpec_st::next
struct fbUDPConnSpec_st * next
link to next one in list
Definition: private.h:167
public.h
Fixbuf IPFIX protocol library public interface.
fbTemplateRetain
void fbTemplateRetain(fbTemplate_t *tmpl)
fbTemplateRetain
fbListenerRemove
void fbListenerRemove(fbListener_t *listener, int fd)
fbListenerRemove
fbTemplateCtxCallback2_fn
void(* fbTemplateCtxCallback2_fn)(fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void *app_ctx, void **tmpl_ctx, fbTemplateCtxFree2_fn *fn)
A callback function that will be called when the session receives a new external template.
Definition: public.h:1791
fbConnSpecLookupAI
gboolean fbConnSpecLookupAI(fbConnSpec_t *spec, gboolean passive, GError **err)
fbConnSpecLookupAI
fbExportMessage
gboolean fbExportMessage(fbExporter_t *exporter, uint8_t *msgbase, size_t msglen, GError **err)
fbExportMessage
fbTemplate_st::ref_count
int ref_count
Reference count.
Definition: private.h:188
fbUDPConnSpec_st::obdomain
uint32_t obdomain
with peer address this is the key
Definition: private.h:173
fbTemplateDebug
void fbTemplateDebug(const char *label, uint16_t tid, fbTemplate_t *tmpl)
fbTemplateDebug
fbCollectorFree
void fbCollectorFree(fbCollector_t *collector)
fbCollectorFree
fbSessionClone
fbSession_t * fbSessionClone(fbSession_t *base)
fbSessionClone
fbTemplate_st::tmpl_len
uint16_t tmpl_len
Total length of the template record or options template record defining this template.
Definition: private.h:213
fbInfoModel_t
struct fbInfoModel_st fbInfoModel_t
An IPFIX information model.
Definition: public.h:1060
fbCollectorHasTranslator
gboolean fbCollectorHasTranslator(fbCollector_t *collector)
fbCollectorHasTranslator
fbListenerAppFree
void fbListenerAppFree(fbListener_t *listener, void *ctx)
fbListenerAppFree
fbTemplate_st::ie_len
uint16_t ie_len
Total length of information elements in records described by this template.
Definition: private.h:202
fbConnSpecFree
void fbConnSpecFree(fbConnSpec_t *spec)
fbConnSpecFree
fbTemplate_st::off_cache
uint16_t * off_cache
Field offset cache.
Definition: private.h:221
fBufRewind
void fBufRewind(fBuf_t *fbuf)
fBufRewind
fbTemplate_st::app_ctx
void * app_ctx
The application's Context pointer for the ctx_free function.
Definition: private.h:236
fbListenerRemoveLastBuf
void fbListenerRemoveLastBuf(fBuf_t *fbuf, fbListener_t *listener)
fbListenerRemoveLastBuf
fbTemplate_st::indices
GHashTable * indices
Map of information element to index in ie_ary.
Definition: private.h:219
fbTemplate_st::ctx_free
fbTemplateCtxFree2_fn ctx_free
Callback to free the ctx pointer when template is freed.
Definition: private.h:232
fbSessionSetTemplateBuffer
void fbSessionSetTemplateBuffer(fbSession_t *session, fBuf_t *fbuf)
fbSessionSetTemplateBuffer
fbSessionTemplateCtxCallbackAppCtx
void * fbSessionTemplateCtxCallbackAppCtx(fbSession_t *session)
Return the ctx callback function's application context for a given session.
fbTemplate_st::is_varlen
gboolean is_varlen
Set to TRUE if this template contains any variable length IEs.
Definition: private.h:215
fbExporterFree
void fbExporterFree(fbExporter_t *exporter)
fbExporterFree
fbCollectMessageBuffer
gboolean fbCollectMessageBuffer(uint8_t *hdr, size_t b_len, size_t *m_len, GError **err)
fbCollectMessageBuffer
fbInfoElementEqual
gboolean fbInfoElementEqual(const fbInfoElement_t *a, const fbInfoElement_t *b)
fbInfoElementEqual
fbSessionTemplateCtxCallback
fbTemplateCtxCallback2_fn fbSessionTemplateCtxCallback(fbSession_t *session)
Return the ctx callback function for a given session.
fbCollectorSetFD
void fbCollectorSetFD(fbCollector_t *collector, int fd)
fbCollectorSetFD
fbInfoElementCopyToTemplate
gboolean fbInfoElementCopyToTemplate(fbInfoModel_t *model, fbInfoElement_t *ex_ie, fbInfoElement_t *tmpl_ie)
fbInfoElementCopyToTemplate
fbTemplate_st::tmpl_ctx
void * tmpl_ctx
Template context.
Definition: private.h:228
fbSessionGetSequence
uint32_t fbSessionGetSequence(fbSession_t *session)
fbSessionGetSequence
fbExporterGetMTU
uint16_t fbExporterGetMTU(fbExporter_t *exporter)
fbExporterGetMTU
fbTemplate_st
An IPFIX template or options template structure.
Definition: private.h:184
fbConnSpecCopy
fbConnSpec_t * fbConnSpecCopy(fbConnSpec_t *spec)
fbConnSpecCopy
fbInfoElementDebug
void fbInfoElementDebug(gboolean tmpl, fbInfoElement_t *ie)
fbInfoElementDebug
fbUDPConnSpec_st::peer
union fbUDPConnSpec_st::@0 peer
key to this conn spec
fbTemplate_st::ie_ary
fbInfoElement_t ** ie_ary
Ordered array of pointers to information elements in this template.
Definition: private.h:217
fbCollectorAllocTLS
fbCollector_t * fbCollectorAllocTLS(fbListener_t *listener, void *ctx, int fd, struct sockaddr *peer, size_t peerlen, GError **err)
fbCollectorAllocTLS
fbConnSpec_st
Connection specifier.
Definition: public.h:1562
fbSessionSetCollector
void fbSessionSetCollector(fbSession_t *session, fbCollector_t *collector)
fbSessionSetCollector
fBuf_t
struct fBuf_st fBuf_t
An IPFIX message buffer.
Definition: public.h:1034
fbTemplateFree
void fbTemplateFree(fbTemplate_t *tmpl)
fbTemplateFree
fbInfoModelAddAlienElement
const fbInfoElement_t * fbInfoModelAddAlienElement(fbInfoModel_t *model, fbInfoElement_t *ex_ie)
fbInfoModelAddAlienElement
fbInfoElement_st
A single IPFIX Information Element definition.
Definition: public.h:1388
fbTemplateCtxFree2_fn
void(* fbTemplateCtxFree2_fn)(void *tmpl_ctx, void *app_ctx)
A callback function that is called when a template is freed.
Definition: public.h:1729
fbTemplate_st::scope_count
uint16_t scope_count
Count of scope information elements in template.
Definition: private.h:195
fbListenerGetConnSpec
fbConnSpec_t * fbListenerGetConnSpec(fbListener_t *listener)
fbListenerGetConnSpec
fBufSetSession
void fBufSetSession(fBuf_t *fbuf, fbSession_t *session)
fBufSetSession
fbUDPConnSpec_t
struct fbUDPConnSpec_st fbUDPConnSpec_t
An UDP Connection specifier.
fbSessionSetSequence
void fbSessionSetSequence(fbSession_t *session, uint32_t sequence)
fbSessionSetSequence
fbUDPConnSpec_st::session
fbSession_t * session
pointer to the session for this peer address
Definition: private.h:155
fBufRemoveTemplateTcplan
void fBufRemoveTemplateTcplan(fBuf_t *fbuf, fbTemplate_t *tmpl)
fBufRemoveTemplateTcplan