pfring_ft.h

Go to the documentation of this file.

/*
 *
 * (C) 2018-2023 - ntop
 *
 *  http://www.ntop.org/
 *
 * This code is proprietary code subject to the terms and conditions
 * defined in LICENSE file which is part of this source code package.
 *
 */
 
#ifndef _PFRING_FT_H_
#define _PFRING_FT_H_
 
#include <sys/types.h>
 
#ifdef __cplusplus
extern "C" {
#endif
 
#define FT_API_VERSION 95
 
typedef void pfring_ft_table;
typedef void pfring_ft_list;
typedef void pfring_ft_flow;
 
struct ndpi_detection_module_struct;
struct ndpi_flow_struct;
 
/*** enums ***/
 
#define PFRING_FT_ACTION_DEFAULT 0
#define PFRING_FT_ACTION_FORWARD 1
#define PFRING_FT_ACTION_DISCARD 2 
#define PFRING_FT_ACTION_USER_1  3
#define PFRING_FT_ACTION_USER_2  4
#define PFRING_FT_ACTION_SLICE   5 
typedef u_int8_t pfring_ft_action;
 
typedef enum { 
  s2d_direction = 0, 
  d2s_direction,     
  PF_RING_FT_FLOW_NUM_DIRECTIONS
} pfring_ft_direction;
 
typedef enum {
  PFRING_FT_FLOW_STATUS_ACTIVE = 0,     
  PFRING_FT_FLOW_STATUS_IDLE_TIMEOUT,   
  PFRING_FT_FLOW_STATUS_ACTIVE_TIMEOUT, 
  PFRING_FT_FLOW_STATUS_END_DETECTED,   
  PFRING_FT_FLOW_STATUS_FORCED_END,     
  PFRING_FT_FLOW_STATUS_SLICE_TIMEOUT,  
  PFRING_FT_FLOW_STATUS_OVERFLOW        
} pfring_ft_flow_status;
 
#define PF_RING_FT_FLOW_FLAGS_L7_GUESS    (1 <<  0) 
typedef struct {
  u_int32_t num_protocols; 
  /* Filtering */
  struct {
    pfring_ft_action *protocol_to_action; 
  } match;
 
  /* Shunting */
  struct {
    u_int8_t default_npkts;      
    u_int8_t tcp_npkts;          
    u_int8_t udp_npkts;          
    u_int8_t *protocol_to_npkts; 
  } shunt;
} pfring_ft_flow_filter;
 
/*** packet header structs ***/
 
typedef u_int32_t pfring_ft_in4_addr;
 
typedef struct {
  union {
    u_int8_t   u6_addr8[16];
    u_int16_t  u6_addr16[8];
    u_int32_t  u6_addr32[4];
  } u6_addr;
} __attribute__((packed))
pfring_ft_in6_addr;
 
typedef struct {
  u_int8_t ihl:4, version:4;
  u_int8_t tos;
  u_int16_t tot_len;
  u_int16_t id;
  u_int16_t frag_off;
  u_int8_t ttl;
  u_int8_t protocol;
  u_int16_t check;
  u_int32_t saddr;
  u_int32_t daddr;
} __attribute__((packed))
pfring_ft_iphdr;
 
typedef struct {
  u_int32_t ip6_un1_flow;
  u_int16_t ip6_un1_plen;
  u_int8_t ip6_un1_nxt;
  u_int8_t ip6_un1_hlim;
  pfring_ft_in6_addr ip6_src;
  pfring_ft_in6_addr ip6_dst;
} __attribute__((packed))
pfring_ft_ipv6hdr;
 
typedef struct {
  u_int16_t source;
  u_int16_t dest;
  u_int32_t seq;
  u_int32_t ack_seq;
  u_int16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1;
  u_int16_t window;
  u_int16_t check;
  u_int16_t urg_ptr;
} __attribute__((packed))
pfring_ft_tcphdr;
 
typedef struct {
  u_int16_t source;
  u_int16_t dest;
  u_int16_t len;
  u_int16_t check;
} __attribute__((packed))
pfring_ft_udphdr;
 
/*** packet metadata structs ***/
 
typedef struct {     /* pfring_pkthdr / pcap_pkthdr common struct */
  struct timeval ts; 
  u_int32_t caplen;  
  u_int32_t len;     
} pfring_ft_pcap_pkthdr;
 
typedef struct {       /* additional packet metadata not available in pcap_pkthdr */
  u_int32_t hash;      
  u_int16_t device_id; 
  u_int8_t  port_id;   
  u_int8_t  reserved;  
} pfring_ft_ext_pkthdr;
 
typedef struct {
  pfring_ft_pcap_pkthdr *hdr;
  pfring_ft_ext_pkthdr *ext_hdr;
  pfring_ft_direction direction;
  pfring_ft_action action;
  u_int16_t vlan_id;
  u_int8_t ip_version;
  u_int8_t l4_proto;
  u_int16_t payload_len;
  u_int16_t reserved; /* padding */
  union {
    pfring_ft_iphdr   *ip4;
    pfring_ft_ipv6hdr *ip6;
  } l3;
  union {
    pfring_ft_tcphdr *tcp;
    pfring_ft_udphdr *udp;
  } l4;
  const u_char *payload;
} pfring_ft_packet_metadata;
 
/*** flow metadata structs ***/
 
typedef union {
  pfring_ft_in4_addr v4;
  pfring_ft_in6_addr v6;
} pfring_ft_ip_address;
 
typedef struct {
  u_int16_t master_protocol;  
  u_int16_t app_protocol;     
  int category;
} pfring_ft_ndpi_protocol;
 
typedef struct {
  u_int8_t smac[6];           
  u_int8_t dmac[6];           
  pfring_ft_ip_address saddr; 
  pfring_ft_ip_address daddr; 
  u_int8_t ip_version;        
  u_int8_t protocol;          
  u_int16_t sport;            
  u_int16_t dport;            
  u_int16_t vlan_id;          
} pfring_ft_flow_key;
 
typedef struct {
  u_int64_t pkts;           
  u_int64_t bytes;          
  struct timeval first;     
  struct timeval last;      
  u_int8_t tcp_flags;       
  u_int8_t port_id;         
  u_int16_t device_id;      
} pfring_ft_flow_dir_value;
 
typedef struct {
  pfring_ft_flow_dir_value direction[PF_RING_FT_FLOW_NUM_DIRECTIONS]; 
  pfring_ft_ndpi_protocol l7_protocol; 
  u_int32_t tunnel_type; 
  u_int32_t tunnel_id;   
  union {
    struct {
      char *query;            
      u_int16_t queryType;    
      u_int16_t replyCode;    
    } dns;
 
    struct {
      char *serverName;       
      u_int8_t *sha1_certificate_fingerprint; 
    } tls;
 
    struct {
      char *serverName;       
      char *url;              
      u_int16_t responseCode; 
    } http;
 
    struct {
      u_int8_t type;          
      u_int8_t code;          
    } icmp;
  } l7_metadata;
 
  pfring_ft_flow_status status;
  u_int32_t flags;            
  u_char *user;               
} pfring_ft_flow_value;
 
/*** stats struct ***/
 
typedef struct {
  u_int64_t active_flows;     
  u_int64_t flows;            
  u_int64_t err_no_room;      
  u_int64_t err_no_mem;       
  u_int64_t disc_no_ip;       
  u_int64_t max_lookup_depth; 
  u_int64_t packets;          
  u_int64_t bytes;            
} pfring_ft_stats;
 
typedef struct {
  u_int32_t num_buffered_records;
  u_int32_t exported_flows;
  u_int32_t dropped_flows;
} pfring_ft_export_stats;
 
/*** Callbacks prototypes ***/
 
typedef void
(*pfring_ft_export_list_func) (
  pfring_ft_list *flows_list,
  void *user
);
 
typedef void
(*pfring_ft_export_flow_func) (
  pfring_ft_flow *flow,
  void *user
);
 
typedef void
(*pfring_ft_flow_packet_func) (
  const u_char *data,
  pfring_ft_packet_metadata *metadata,
  pfring_ft_flow *flow,
  void *user
);
 
#define PFRING_FT_TABLE_FLAGS_DPI       (1 << 0) 
#define PFRING_FT_TABLE_FLAGS_DPI_EXTRA (1 << 1) 
#define PFRING_FT_DECODE_TUNNELS        (1 << 2) 
#define PFRING_FT_IGNORE_HW_HASH        (1 << 3) 
#define PFRING_FT_IGNORE_VLAN           (1 << 4) 
#define PFRING_FT_TABLE_FLAGS_NO_GUESS  (1 << 5) 
pfring_ft_table *
pfring_ft_create_table(
  u_int32_t flags,
  u_int32_t max_flows,
  u_int32_t flow_idle_timeout,
  u_int32_t flow_lifetime_timeout,
  u_int32_t user_metadata_size
);
 
void
pfring_ft_destroy_table(
  pfring_ft_table *table
);
 
void
pfring_ft_flow_set_flow_slicing(
  pfring_ft_table *table,
  u_int32_t flow_slice_timeout
);
 
void
pfring_ft_set_new_flow_callback(
  pfring_ft_table *table,
  pfring_ft_export_flow_func callback,
  void *user
);
 
void
pfring_ft_set_flow_packet_callback(
  pfring_ft_table *table,
  pfring_ft_flow_packet_func callback, 
  void *user
);
 
void
pfring_ft_set_l7_detected_callback(
  pfring_ft_table *table,
  pfring_ft_flow_packet_func callback, 
  void *user
);
 
void
pfring_ft_set_flow_export_callback(
  pfring_ft_table *table,
  pfring_ft_export_flow_func callback,
  void *user
);
 
void
pfring_ft_set_flow_list_export_callback(
  pfring_ft_table *table,
  pfring_ft_export_list_func callback, 
  void *user
);
 
pfring_ft_action
pfring_ft_process(
  pfring_ft_table *table,
  const u_char *packet,
  const pfring_ft_pcap_pkthdr *header,
  const pfring_ft_ext_pkthdr *ext_header
);
 
int
pfring_ft_housekeeping(
  pfring_ft_table *table,
  u_int32_t epoch
);
 
void
pfring_ft_flush(
  pfring_ft_table *table
);
 
pfring_ft_flow *
pfring_ft_list_get_next(
  pfring_ft_list *list
);
 
u_int64_t
pfring_ft_flow_get_id(
  pfring_ft_flow *flow
);
 
pfring_ft_flow_key *
pfring_ft_flow_get_key(
  pfring_ft_flow *flow
);
 
pfring_ft_flow_value *
pfring_ft_flow_get_value(
  pfring_ft_flow *flow
);
 
struct ndpi_flow_struct *
pfring_ft_flow_get_ndpi_handle(
  pfring_ft_flow *flow
);
 
void
pfring_ft_flow_set_action(
  pfring_ft_flow *flow,
  pfring_ft_action action
);
 
pfring_ft_action
pfring_ft_flow_get_action(
  pfring_ft_flow *flow
);
 
int
pfring_ft_flow_get_users(
  pfring_ft_flow *flow
);
 
void
pfring_ft_flow_free(
  pfring_ft_flow *flow
);
 
void
pfring_ft_zmq_export_configure(
  pfring_ft_table *table,
  const char *endpoint,
  const char *server_public_key,
  u_int8_t probe_mode,
  u_int8_t disable_compression,
  u_int8_t use_json
);
 
void
pfring_ft_zmq_export_flow(
  pfring_ft_flow *flow,
  void *user
);
 
void
pfring_ft_zmq_export_stats(
  pfring_ft_table *table,
  const char *if_name,
  u_int16_t if_speed,
  const char *if_ip,
  const char *management_ip
);
 
void
pfring_ft_zmq_get_stats(
  pfring_ft_table *table,
  pfring_ft_export_stats *stats
);
 
void 
pfring_ft_set_default_action(
  pfring_ft_table *table,
  pfring_ft_action action
);
 
int
pfring_ft_load_configuration(
  pfring_ft_table *table, 
  const char *path
);
 
int
pfring_ft_load_configuration_ext(
  pfring_ft_table *table, 
  const char *path,
  pfring_ft_flow_filter *filter
);
 
void 
pfring_ft_set_shunt_protocol_by_name(
  pfring_ft_table *table,
  const char *protocol_name,
  u_int8_t packets
);
 
void 
pfring_ft_set_filter_all_protocols(
  pfring_ft_table *table,
  pfring_ft_action action
);
 
void 
pfring_ft_set_filter_protocol_by_name(
  pfring_ft_table *table,
  const char *protocol_name,
  pfring_ft_action action
);
 
char *
pfring_ft_l7_protocol_name(
  pfring_ft_table *table,
  pfring_ft_ndpi_protocol *protocol,
  char *buffer, 
  int buffer_len
);
 
u_int16_t
pfring_ft_l7_protocol_id(
  pfring_ft_table *table,
  const char *name
);
 
int
pfring_ft_set_ndpi_handle(
  pfring_ft_table *table,
  struct ndpi_detection_module_struct *ndpi
);
 
struct ndpi_detection_module_struct *
pfring_ft_get_ndpi_handle(
  pfring_ft_table *table
);
 
int
pfring_ft_load_ndpi_protocols(
  pfring_ft_table *table,
  const char *path
);
 
int
pfring_ft_load_ndpi_categories(
  pfring_ft_table *table,
  const char *path
);
 
int
pfring_ft_is_ndpi_available();
 
pfring_ft_stats *
pfring_ft_get_stats(
  pfring_ft_table *table
);
 
void
pfring_ft_version(
  char *version
);
 
u_int32_t
pfring_ft_api_version(
);
 
int
pfring_ft_license(
  char *system_id, 
  time_t *license_expiration, 
  time_t *maintenance_expiration
);
 
int
pfring_ft_set_license(
  const char *license_key
);
 
void
pfring_ft_debug(
  void
);
 
#ifdef __cplusplus
}
#endif
 
#endif /* _PFRING_FT_H_ */