ftencode.c

netflow,抓包

  pdu_v6->records[i].dstaddr = rec_v6->dstaddr;
  pdu_v6->records[i].nexthop = rec_v6->nexthop;
  pdu_v6->records[i].input = rec_v6->input;
  pdu_v6->records[i].output = rec_v6->output;
  pdu_v6->records[i].dPkts = rec_v6->dPkts;
  pdu_v6->records[i].dOctets = rec_v6->dOctets;
  pdu_v6->records[i].First = rec_v6->First;
  pdu_v6->records[i].Last = rec_v6->Last;
  pdu_v6->records[i].srcport = rec_v6->srcport;
  pdu_v6->records[i].dstport = rec_v6->dstport;
  pdu_v6->records[i].prot = rec_v6->prot;
  pdu_v6->records[i].tos = rec_v6->tos;
  pdu_v6->records[i].tcp_flags = rec_v6->tcp_flags;
  pdu_v6->records[i].src_as = rec_v6->src_as;
  pdu_v6->records[i].dst_as = rec_v6->dst_as;
  pdu_v6->records[i].src_mask = rec_v6->src_mask;
  pdu_v6->records[i].dst_mask = rec_v6->dst_mask;
  pdu_v6->records[i].in_encaps = rec_v6->in_encaps;
  pdu_v6->records[i].out_encaps = rec_v6->out_encaps;
  pdu_v6->records[i].peer_nexthop = rec_v6->peer_nexthop;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v6->count ++;
  enc->buf_size += sizeof (struct ftrec_v6);

  if (pdu_v6->count >= FT_PDU_V6_MAXFLOWS)
    return 0;
  else
    return 1;
}

/*
 * function: fts3rec_pdu_v7_encode
 *
 * Encode a fts3rec into a version 7 PDU
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v7_encode(struct ftencode *enc, struct fts3rec_v7 *rec_v7)
{
  struct ftpdu_v7 *pdu_v7;
  u_int seq_index;
  int i;

  pdu_v7 = (struct ftpdu_v7*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v7->engine_id<<8 | rec_v7->engine_type;

  i = pdu_v7->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V7_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v7->version = 7;
    pdu_v7->sysUpTime = rec_v7->sysUpTime;
    pdu_v7->unix_secs = rec_v7->unix_secs;
    pdu_v7->unix_nsecs = rec_v7->unix_nsecs;
    pdu_v7->engine_type = rec_v7->engine_type;
    pdu_v7->engine_id = rec_v7->engine_id;
    pdu_v7->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 24; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v7->sysUpTime != rec_v7->sysUpTime) ||
        (pdu_v7->unix_secs != rec_v7->unix_secs) ||
        (pdu_v7->unix_nsecs != rec_v7->unix_nsecs) ||
        (pdu_v7->engine_id != rec_v7->engine_id) ||
        (pdu_v7->engine_type != rec_v7->engine_type))
        return -1;

  }

  pdu_v7->records[i].srcaddr = rec_v7->srcaddr;
  pdu_v7->records[i].dstaddr = rec_v7->dstaddr;
  pdu_v7->records[i].nexthop = rec_v7->nexthop;
  pdu_v7->records[i].input = rec_v7->input;
  pdu_v7->records[i].output = rec_v7->output;
  pdu_v7->records[i].dPkts = rec_v7->dPkts;
  pdu_v7->records[i].dOctets = rec_v7->dOctets;
  pdu_v7->records[i].First = rec_v7->First;
  pdu_v7->records[i].Last = rec_v7->Last;
  pdu_v7->records[i].srcport = rec_v7->srcport;
  pdu_v7->records[i].dstport = rec_v7->dstport;
  pdu_v7->records[i].prot = rec_v7->prot;
  pdu_v7->records[i].tos = rec_v7->tos;
  pdu_v7->records[i].tcp_flags = rec_v7->tcp_flags;
  pdu_v7->records[i].src_as = rec_v7->src_as;
  pdu_v7->records[i].dst_as = rec_v7->dst_as;
  pdu_v7->records[i].src_mask = rec_v7->src_mask;
  pdu_v7->records[i].dst_mask = rec_v7->dst_mask;
  pdu_v7->records[i].router_sc = rec_v7->router_sc;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v7->count ++;
  enc->buf_size += sizeof (struct ftrec_v7);

  if (pdu_v7->count >= FT_PDU_V7_MAXFLOWS)
    return 0;
  else
    return 1;
}

/*
 * function: fts3rec_pdu_v8_1_encode
 *
 * Encode a fts3rec into a version 8 Agg method 1
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_1_encode(struct ftencode *enc,
  struct fts3rec_v8_1 *rec_v8_1)
{
  struct ftpdu_v8_1 *pdu_v8_1;
  u_int seq_index;
  int i;

  pdu_v8_1 = (struct ftpdu_v8_1*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_1->engine_id<<8 | rec_v8_1->engine_type;

  i = pdu_v8_1->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_1_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_1->version = 8;
    pdu_v8_1->sysUpTime = rec_v8_1->sysUpTime;
    pdu_v8_1->unix_secs = rec_v8_1->unix_secs;
    pdu_v8_1->unix_nsecs = rec_v8_1->unix_nsecs;
    pdu_v8_1->engine_type = rec_v8_1->engine_type;
    pdu_v8_1->engine_id = rec_v8_1->engine_id;
    pdu_v8_1->aggregation = 1;
    pdu_v8_1->agg_version = 2;
    pdu_v8_1->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_1->sysUpTime != rec_v8_1->sysUpTime) ||
        (pdu_v8_1->unix_secs != rec_v8_1->unix_secs) ||
        (pdu_v8_1->unix_nsecs != rec_v8_1->unix_nsecs) ||
        (pdu_v8_1->engine_id != rec_v8_1->engine_id) ||
        (pdu_v8_1->engine_type != rec_v8_1->engine_type))
        return -1;

  }

  pdu_v8_1->records[i].dFlows = rec_v8_1->dFlows;
  pdu_v8_1->records[i].dPkts = rec_v8_1->dPkts;
  pdu_v8_1->records[i].dOctets = rec_v8_1->dOctets;
  pdu_v8_1->records[i].First = rec_v8_1->First;
  pdu_v8_1->records[i].Last = rec_v8_1->Last;
  pdu_v8_1->records[i].src_as = rec_v8_1->src_as;
  pdu_v8_1->records[i].dst_as = rec_v8_1->dst_as;
  pdu_v8_1->records[i].input = rec_v8_1->input;
  pdu_v8_1->records[i].output = rec_v8_1->output;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_1->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_1);

  if (pdu_v8_1->count >= FT_PDU_V8_1_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_1_encode */

/*
 * function: fts3rec_pdu_v8_2_encode
 *
 * Encode a fts3rec into a version 8 Agg method 2
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_2_encode(struct ftencode *enc,
  struct fts3rec_v8_2 *rec_v8_2)
{
  struct ftpdu_v8_2 *pdu_v8_2;
  u_int seq_index;
  int i;

  pdu_v8_2 = (struct ftpdu_v8_2*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_2->engine_id<<8 | rec_v8_2->engine_type;

  i = pdu_v8_2->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_2_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_2->version = 8;
    pdu_v8_2->sysUpTime = rec_v8_2->sysUpTime;
    pdu_v8_2->unix_secs = rec_v8_2->unix_secs;
    pdu_v8_2->unix_nsecs = rec_v8_2->unix_nsecs;
    pdu_v8_2->engine_type = rec_v8_2->engine_type;
    pdu_v8_2->engine_id = rec_v8_2->engine_id;
    pdu_v8_2->aggregation = 2;
    pdu_v8_2->agg_version = 2;
    pdu_v8_2->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_2->sysUpTime != rec_v8_2->sysUpTime) ||
        (pdu_v8_2->unix_secs != rec_v8_2->unix_secs) ||
        (pdu_v8_2->unix_nsecs != rec_v8_2->unix_nsecs) ||
        (pdu_v8_2->engine_id != rec_v8_2->engine_id) ||
        (pdu_v8_2->engine_type != rec_v8_2->engine_type))
        return -1;

  }

  pdu_v8_2->records[i].dFlows = rec_v8_2->dFlows;
  pdu_v8_2->records[i].dPkts = rec_v8_2->dPkts;
  pdu_v8_2->records[i].dOctets = rec_v8_2->dOctets;
  pdu_v8_2->records[i].First = rec_v8_2->First;
  pdu_v8_2->records[i].Last = rec_v8_2->Last;
  pdu_v8_2->records[i].prot = rec_v8_2->prot;
  pdu_v8_2->records[i].srcport = rec_v8_2->srcport;
  pdu_v8_2->records[i].dstport = rec_v8_2->dstport;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_2->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_2);

  if (pdu_v8_2->count >= FT_PDU_V8_2_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_2_encode */

/*
 * function: fts3rec_pdu_v8_3_encode
 *
 * Encode a fts3rec into a version 8 Agg method 3
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_3_encode(struct ftencode *enc,
  struct fts3rec_v8_3 *rec_v8_3)
{
  struct ftpdu_v8_3 *pdu_v8_3;
  u_int seq_index;
  int i;

  pdu_v8_3 = (struct ftpdu_v8_3*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_3->engine_id<<8 | rec_v8_3->engine_type;

  i = pdu_v8_3->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_3_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_3->version = 8;
    pdu_v8_3->sysUpTime = rec_v8_3->sysUpTime;
    pdu_v8_3->unix_secs = rec_v8_3->unix_secs;
    pdu_v8_3->unix_nsecs = rec_v8_3->unix_nsecs;
    pdu_v8_3->engine_type = rec_v8_3->engine_type;
    pdu_v8_3->engine_id = rec_v8_3->engine_id;
    pdu_v8_3->aggregation = 3;
    pdu_v8_3->agg_version = 2;
    pdu_v8_3->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_3->sysUpTime != rec_v8_3->sysUpTime) ||
        (pdu_v8_3->unix_secs != rec_v8_3->unix_secs) ||
        (pdu_v8_3->unix_nsecs != rec_v8_3->unix_nsecs) ||
        (pdu_v8_3->engine_id != rec_v8_3->engine_id) ||
        (pdu_v8_3->engine_type != rec_v8_3->engine_type))
        return -1;

  }

  pdu_v8_3->records[i].dFlows = rec_v8_3->dFlows;
  pdu_v8_3->records[i].dPkts = rec_v8_3->dPkts;
  pdu_v8_3->records[i].dOctets = rec_v8_3->dOctets;
  pdu_v8_3->records[i].First = rec_v8_3->First;
  pdu_v8_3->records[i].Last = rec_v8_3->Last;
  pdu_v8_3->records[i].src_prefix = rec_v8_3->srcaddr;
  pdu_v8_3->records[i].src_mask = rec_v8_3->src_mask;
  pdu_v8_3->records[i].src_as = rec_v8_3->src_as;
  pdu_v8_3->records[i].input = rec_v8_3->input;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_3->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_3);

  if (pdu_v8_3->count >= FT_PDU_V8_3_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_3_encode */

/*
 * function: fts3rec_pdu_v8_4_encode
 *
 * Encode a fts3rec into a version 8 Agg method 4
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_4_encode(struct ftencode *enc,
  struct fts3rec_v8_4 *rec_v8_4)
{
  struct ftpdu_v8_4 *pdu_v8_4;
  u_int seq_index;
  int i;

  pdu_v8_4 = (struct ftpdu_v8_4*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_4->engine_id<<8 | rec_v8_4->engine_type;

  i = pdu_v8_4->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_4_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_4->version = 8;
    pdu_v8_4->sysUpTime = rec_v8_4->sysUpTime;
    pdu_v8_4->unix_secs = rec_v8_4->unix_secs;
    pdu_v8_4->unix_nsecs = rec_v8_4->unix_nsecs;
    pdu_v8_4->engine_type = rec_v8_4->engine_type;
    pdu_v8_4->engine_id = rec_v8_4->engine_id;
    pdu_v8_4->aggregation = 4;
    pdu_v8_4->agg_version = 2;
    pdu_v8_4->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_4->sysUpTime != rec_v8_4->sysUpTime) ||
        (pdu_v8_4->unix_secs != rec_v8_4->unix_secs) ||
        (pdu_v8_4->unix_nsecs != rec_v8_4->unix_nsecs) ||
        (pdu_v8_4->engine_id != rec_v8_4->engine_id) ||
        (pdu_v8_4->engine_type != rec_v8_4->engine_type))
        return -1;

  }

  pdu_v8_4->records[i].dFlows = rec_v8_4->dFlows;
  pdu_v8_4->records[i].dPkts = rec_v8_4->dPkts;
  pdu_v8_4->records[i].dOctets = rec_v8_4->dOctets;
  pdu_v8_4->records[i].First = rec_v8_4->First;
  pdu_v8_4->records[i].Last = rec_v8_4->Last;
  pdu_v8_4->records[i].dst_prefix = rec_v8_4->dstaddr;