ftencode.c

netflow,抓包

  enc->buf_size += sizeof (struct ftrec_v8_9);

  if (pdu_v8_9->count >= FT_PDU_V8_9_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_9_encode */

/*
 * function: fts3rec_pdu_v8_10_encode
 *
 * Encode a fts3rec into a version 8 Agg method 10
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_10_encode(struct ftencode *enc,
  struct fts3rec_v8_10 *rec_v8_10)
{
  struct ftpdu_v8_10 *pdu_v8_10;
  u_int seq_index;
  int i;

  pdu_v8_10 = (struct ftpdu_v8_10*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_10->engine_id<<8 | rec_v8_10->engine_type;

  i = pdu_v8_10->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_10_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_10->version = 8;
    pdu_v8_10->sysUpTime = rec_v8_10->sysUpTime;
    pdu_v8_10->unix_secs = rec_v8_10->unix_secs;
    pdu_v8_10->unix_nsecs = rec_v8_10->unix_nsecs;
    pdu_v8_10->engine_type = rec_v8_10->engine_type;
    pdu_v8_10->engine_id = rec_v8_10->engine_id;
    pdu_v8_10->aggregation = 10;
    pdu_v8_10->agg_version = 2;
    pdu_v8_10->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_10->sysUpTime != rec_v8_10->sysUpTime) ||
        (pdu_v8_10->unix_secs != rec_v8_10->unix_secs) ||
        (pdu_v8_10->unix_nsecs != rec_v8_10->unix_nsecs) ||
        (pdu_v8_10->engine_id != rec_v8_10->engine_id) ||
        (pdu_v8_10->engine_type != rec_v8_10->engine_type))
        return -1;

  }

  pdu_v8_10->records[i].dFlows = rec_v8_10->dFlows;
  pdu_v8_10->records[i].dPkts = rec_v8_10->dPkts;
  pdu_v8_10->records[i].dOctets = rec_v8_10->dOctets;
  pdu_v8_10->records[i].First = rec_v8_10->First;
  pdu_v8_10->records[i].Last = rec_v8_10->Last;
  pdu_v8_10->records[i].srcport = rec_v8_10->srcport;
  pdu_v8_10->records[i].dstport = rec_v8_10->dstport;
  pdu_v8_10->records[i].prot = rec_v8_10->prot;
  pdu_v8_10->records[i].tos = rec_v8_10->tos;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_10->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_10);

  if (pdu_v8_10->count >= FT_PDU_V8_10_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_10_encode */

/*
 * function: fts3rec_pdu_v8_11_encode
 *
 * Encode a fts3rec into a version 8 Agg method 11
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_11_encode(struct ftencode *enc,
  struct fts3rec_v8_11 *rec_v8_11)
{
  struct ftpdu_v8_11 *pdu_v8_11;
  u_int seq_index;
  int i;

  pdu_v8_11 = (struct ftpdu_v8_11*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_11->engine_id<<8 | rec_v8_11->engine_type;

  i = pdu_v8_11->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_11_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_11->version = 8;
    pdu_v8_11->sysUpTime = rec_v8_11->sysUpTime;
    pdu_v8_11->unix_secs = rec_v8_11->unix_secs;
    pdu_v8_11->unix_nsecs = rec_v8_11->unix_nsecs;
    pdu_v8_11->engine_type = rec_v8_11->engine_type;
    pdu_v8_11->engine_id = rec_v8_11->engine_id;
    pdu_v8_11->aggregation = 11;
    pdu_v8_11->agg_version = 2;
    pdu_v8_11->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_11->sysUpTime != rec_v8_11->sysUpTime) ||
        (pdu_v8_11->unix_secs != rec_v8_11->unix_secs) ||
        (pdu_v8_11->unix_nsecs != rec_v8_11->unix_nsecs) ||
        (pdu_v8_11->engine_id != rec_v8_11->engine_id) ||
        (pdu_v8_11->engine_type != rec_v8_11->engine_type))
        return -1;

  }

  pdu_v8_11->records[i].dFlows = rec_v8_11->dFlows;
  pdu_v8_11->records[i].dPkts = rec_v8_11->dPkts;
  pdu_v8_11->records[i].dOctets = rec_v8_11->dOctets;
  pdu_v8_11->records[i].First = rec_v8_11->First;
  pdu_v8_11->records[i].Last = rec_v8_11->Last;
  pdu_v8_11->records[i].src_prefix = rec_v8_11->srcaddr;
  pdu_v8_11->records[i].src_mask = rec_v8_11->src_mask;
  pdu_v8_11->records[i].tos = rec_v8_11->tos;
  pdu_v8_11->records[i].src_as = rec_v8_11->src_as;
  pdu_v8_11->records[i].input = rec_v8_11->input;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_11->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_11);

  if (pdu_v8_11->count >= FT_PDU_V8_11_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_11_encode */

/*
 * function: fts3rec_pdu_v8_12_encode
 *
 * Encode a fts3rec into a version 8 Agg method 12
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_12_encode(struct ftencode *enc,
  struct fts3rec_v8_12 *rec_v8_12)
{
  struct ftpdu_v8_12 *pdu_v8_12;
  u_int seq_index;
  int i;

  pdu_v8_12 = (struct ftpdu_v8_12*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_12->engine_id<<8 | rec_v8_12->engine_type;

  i = pdu_v8_12->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_12_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_12->version = 8;
    pdu_v8_12->sysUpTime = rec_v8_12->sysUpTime;
    pdu_v8_12->unix_secs = rec_v8_12->unix_secs;
    pdu_v8_12->unix_nsecs = rec_v8_12->unix_nsecs;
    pdu_v8_12->engine_type = rec_v8_12->engine_type;
    pdu_v8_12->engine_id = rec_v8_12->engine_id;
    pdu_v8_12->aggregation = 12;
    pdu_v8_12->agg_version = 2;
    pdu_v8_12->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_12->sysUpTime != rec_v8_12->sysUpTime) ||
        (pdu_v8_12->unix_secs != rec_v8_12->unix_secs) ||
        (pdu_v8_12->unix_nsecs != rec_v8_12->unix_nsecs) ||
        (pdu_v8_12->engine_id != rec_v8_12->engine_id) ||
        (pdu_v8_12->engine_type != rec_v8_12->engine_type))
        return -1;

  }

  pdu_v8_12->records[i].dFlows = rec_v8_12->dFlows;
  pdu_v8_12->records[i].dPkts = rec_v8_12->dPkts;
  pdu_v8_12->records[i].dOctets = rec_v8_12->dOctets;
  pdu_v8_12->records[i].First = rec_v8_12->First;
  pdu_v8_12->records[i].Last = rec_v8_12->Last;
  pdu_v8_12->records[i].dst_prefix = rec_v8_12->dstaddr;
  pdu_v8_12->records[i].output = rec_v8_12->output;
  pdu_v8_12->records[i].dst_mask = rec_v8_12->dst_mask;
  pdu_v8_12->records[i].dst_as = rec_v8_12->dst_as;
  pdu_v8_12->records[i].tos = rec_v8_12->tos;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_12->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_12);

  if (pdu_v8_12->count >= FT_PDU_V8_12_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_12_encode */

/*
 * function: fts3rec_pdu_v8_13_encode
 *
 * Encode a fts3rec into a version 8 Agg method 13
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_13_encode(struct ftencode *enc,
  struct fts3rec_v8_13 *rec_v8_13)
{
  struct ftpdu_v8_13 *pdu_v8_13;
  u_int seq_index;
  int i;

  pdu_v8_13 = (struct ftpdu_v8_13*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_13->engine_id<<8 | rec_v8_13->engine_type;

  i = pdu_v8_13->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_13_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_13->version = 8;
    pdu_v8_13->sysUpTime = rec_v8_13->sysUpTime;
    pdu_v8_13->unix_secs = rec_v8_13->unix_secs;
    pdu_v8_13->unix_nsecs = rec_v8_13->unix_nsecs;
    pdu_v8_13->engine_type = rec_v8_13->engine_type;
    pdu_v8_13->engine_id = rec_v8_13->engine_id;
    pdu_v8_13->aggregation = 13;
    pdu_v8_13->agg_version = 2;
    pdu_v8_13->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_13->sysUpTime != rec_v8_13->sysUpTime) ||
        (pdu_v8_13->unix_secs != rec_v8_13->unix_secs) ||
        (pdu_v8_13->unix_nsecs != rec_v8_13->unix_nsecs) ||
        (pdu_v8_13->engine_id != rec_v8_13->engine_id) ||
        (pdu_v8_13->engine_type != rec_v8_13->engine_type))
        return -1;

  }

  pdu_v8_13->records[i].dFlows = rec_v8_13->dFlows;
  pdu_v8_13->records[i].dPkts = rec_v8_13->dPkts;
  pdu_v8_13->records[i].dOctets = rec_v8_13->dOctets;
  pdu_v8_13->records[i].First = rec_v8_13->First;
  pdu_v8_13->records[i].Last = rec_v8_13->Last;
  pdu_v8_13->records[i].src_prefix = rec_v8_13->srcaddr;
  pdu_v8_13->records[i].dst_prefix = rec_v8_13->dstaddr;
  pdu_v8_13->records[i].dst_mask = rec_v8_13->dst_mask;
  pdu_v8_13->records[i].src_mask = rec_v8_13->src_mask;
  pdu_v8_13->records[i].tos = rec_v8_13->tos;
  pdu_v8_13->records[i].src_as = rec_v8_13->src_as;
  pdu_v8_13->records[i].dst_as = rec_v8_13->dst_as;
  pdu_v8_13->records[i].input = rec_v8_13->input;
  pdu_v8_13->records[i].output = rec_v8_13->output;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_13->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_13);

  if (pdu_v8_13->count >= FT_PDU_V8_13_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_13_encode */

/*
 * function: fts3rec_pdu_v8_14_encode
 *
 * Encode a fts3rec into a version 8 Agg method 14
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_14_encode(struct ftencode *enc,
  struct fts3rec_v8_14 *rec_v8_14)
{
  struct ftpdu_v8_14 *pdu_v8_14;
  u_int seq_index;
  int i;

  pdu_v8_14 = (struct ftpdu_v8_14*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_14->engine_id<<8 | rec_v8_14->engine_type;

  i = pdu_v8_14->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_14_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_14->version = 8;
    pdu_v8_14->sysUpTime = rec_v8_14->sysUpTime;
    pdu_v8_14->unix_secs = rec_v8_14->unix_secs;
    pdu_v8_14->unix_nsecs = rec_v8_14->unix_nsecs;
    pdu_v8_14->engine_type = rec_v8_14->engine_type;
    pdu_v8_14->engine_id = rec_v8_14->engine_id;
    pdu_v8_14->aggregation = 14;
    pdu_v8_14->agg_version = 2;
    pdu_v8_14->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_14->sysUpTime != rec_v8_14->sysUpTime) ||
        (pdu_v8_14->unix_secs != rec_v8_14->unix_secs) ||
        (pdu_v8_14->unix_nsecs != rec_v8_14->unix_nsecs) ||
        (pdu_v8_14->engine_id != rec_v8_14->engine_id) ||
        (pdu_v8_14->engine_type != rec_v8_14->engine_type))
        return -1;

  }

  pdu_v8_14->records[i].dFlows = rec_v8_14->dFlows;
  pdu_v8_14->records[i].dPkts = rec_v8_14->dPkts;
  pdu_v8_14->records[i].dOctets = rec_v8_14->dOctets;
  pdu_v8_14->records[i].First = rec_v8_14->First;
  pdu_v8_14->records[i].Last = rec_v8_14->Last;
  pdu_v8_14->records[i].src_prefix = rec_v8_14->srcaddr;
  pdu_v8_14->records[i].dst_prefix = rec_v8_14->dstaddr;
  pdu_v8_14->records[i].srcport = rec_v8_14->srcport;
  pdu_v8_14->records[i].dstport = rec_v8_14->dstport;
  pdu_v8_14->records[i].input = rec_v8_14->input;
  pdu_v8_14->records[i].output = rec_v8_14->output;
  pdu_v8_14->records[i].dst_mask = rec_v8_14->dst_mask;
  pdu_v8_14->records[i].src_mask = rec_v8_14->src_mask;
  pdu_v8_14->records[i].tos = rec_v8_14->tos;
  pdu_v8_14->records[i].prot = rec_v8_14->prot;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_14->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_14);

  if (pdu_v8_14->count >= FT_PDU_V8_14_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_14_encode */