nprobe.i

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

/* Return 1 if server side of transaction complete */

int http_serv_comp()
{
	return !(self->inner.hserver.status & TRANS_INCOMPLETE);
}

/* Return 1 if server side of transaction finished */

int http_serv_fin()
{
	return (self->inner.hserver.status & TRANS_FINISHED);
}

/* Return > 0 if transaction complete or finished */
int http_obj_comporfin()
{
  int status = self->inner.hserver.status;
  if (status & TRANS_INCOMPLETE)
    {
      if (status & TRANS_FINISHED)
	return 2;
      else
	return 0;
    }
  else
    {
      return 1;
    }
}

/* Return 1 if object size known and all received */
int http_obj_known_all_recd()
{
  return (self->inner.hserver.body_len != HTTP_BODY_LEN_UNKNOWN 
	  && self->inner.hserver.recd_len == self->inner.hserver.body_len);
}

/* Return object size (irrespective of successful completion, etc) */
int http_obj_size()
{
  return self->inner.hserver.body_len != HTTP_BODY_LEN_UNKNOWN ? 
    self->inner.hserver.body_len 
      : self->inner.hserver.recd_len + self->inner.hserver.gaps_bytes;
}

/* Return object claimed size */
int http_obj_len()
{
  return self->inner.hserver.body_len;
}

/* Return object bytes seen (including gaps) */
int http_obj_bytes()
{
  return self->inner.hserver.recd_len + self->inner.hserver.gaps_bytes;
}

/* Return object pkts seen (including gaps) */
int http_obj_pkts()
{
  return self->inner.hserver.recd_pkts + self->inner.hserver.gaps_pkts;
}
  

/* Return HTTP server return code */
int http_server_retcode()
{
  return self->inner.sinf.status_code;
}

/* Return HTTP request method */
int http_meth()
{
  return self->inner.cinf.method;
}

/* Return HTTP object type(s) */
int http_c_obtype()
{
  return self->inner.hclient.content_type;
}

int http_s_obtype()
{
  return (int)self->inner.hserver.content_type;
}

/* Return pointer to links buffer */
/*  struct links_chars *get_links_buf() */
/*  { */
/*    return &self->links; */
/*  } */

/*
 * Return pointer to links buffer
 *  - returned as long otherwise Swig/Python will turn it into a string
 * object
 */
long get_links_buf()
{
  return (long)(self->links.buf);
}

/* Return length of buffer */
int get_links_buflen()
{
  return self->links.totchars;
}

/* Return > 0 if can be implied that whole object has been delivered */
int http_obj_implied_comp(struct tcp_conn *tconnp)
{
	int status_code = self->inner.sinf.status_code;
	int status_ok = (status_code == 200 || status_code == 203 || status_code == 206);

	int body_len_ok = 
		(self->inner.hserver.body_len != HTTP_BODY_LEN_UNKNOWN 
		&& self->inner.hserver.body_len == self->inner.hserver.recd_len);

	if (body_len_ok && status_ok)
		/* got it all or successfully resynched */
		{
			if (self->inner.hserver.status & TRANS_RESYNCHED)
				return 1;
			else
				return 2;
		}

	else if (self->inner.hserver.body_len == HTTP_BODY_LEN_UNKNOWN  
		&& (tconnp->flow_inner.state & TCP_SERV_FIN)
		&& status_ok)
		/* 
		 * completion implied by server close 
		 * - can't be persistent or would have shown as error 
		 */
		{
			if (self->inner.hserver.status & TRANS_RESYNCHED)
				return 3;
			else
				return 4;
		}
		

	else if (tconnp->flow_inner.state & TCP_CLI_RST)
		return 5;

	else if (tconnp->flow_inner.state & TCP_CLI_RST)
		return 6;

	else if (status_code != 200 || status_code != 203)
		return self->inner.sinf.status_code;

	else return 0;
}
	 

/* Print out in squid log form */
void http_print_squidlike(struct tcp_conn *tconn, int code)
{
	_http_print_like_squidlog(self, tconn, code);
}



}; /* End addmethods http_trans */

/*****************************************************************************/


/*
 * Class udp_conn - represents a UDP connection 
 * - corresponds to an Nprobe dump file udp connection record.
 * Comprises class udp_conn (data about UDP connection)
 */

%addmethods udp_conn { 

/* Constructor */
udp_conn()
{
	struct udp_conn *upf;	
	if ((upf = (struct udp_conn *)malloc(sizeof(struct udp_conn))) == NULL)
	 	wr_error("udp_conn: malloc");
	upf->flow_inner.serv_type = UDP_SERV_OTHER;
	upf->service_data = NULL;
	return upf;
}
	
/*Destructor */
~udp_conn() 
{
  	_dealloc_udp_conn(self);
}

/* ascii print out of udp-conn */
void printself()
{
	report_udp_conn(self, self->indx);
}

/*
 * Get current UDP connection record from file - excluding service data
 * - next_rec already called and record identified as UDP  
 */
void get_conn(struct np_file *file)
{
  _read_udp_conn(file, self, DATA_ALLOC_ON_FLY, NO_DATA);
  self->indx = file->indx -1;
  return;
}

/* Get next UDP data from file - excluding service data */
int get_udp_conn(struct np_file *file)
{
  int rec_type = _next_rec(file, REC_UDP_ALL);
  if (rec_type == -1)
    {
      return -1;
    }
  else
    {
      assert(rec_type > REC_UDP_MIN && rec_type < REC_UDP_MAX);
      _read_udp_conn(file, self, DATA_ALLOC_ON_FLY, NO_DATA);
      self->indx = file->indx -1;
      return rec_type;
    }
}

/*
 * Get current UDP connection record from file - including service data
 * - next_rec already called and record identified as UDP  
 */
void get_conn_and_data(struct np_file *file)
{
  _read_udp_conn(file, self, DATA_ALLOC_ON_FLY, GET_DATA);
  return;
}

/* Get next UDP data from file - including service data */
int get_udp_conn_and_data(struct np_file *file)
{
  int rec_type = _next_rec(file, REC_UDP_ALL);
  if (rec_type == -1)
    {
      return -1;
    }
  else
    {
      assert(rec_type > REC_UDP_MIN && rec_type < REC_UDP_MAX);
      _read_udp_conn(file, self, DATA_ALLOC_ON_FLY, GET_DATA);
      self->indx = file->indx -1;
      return rec_type;
    }
}

/*
 * Get next UDP/NS record from file - excluding ns data
 */

int get_ns_conn(struct np_file *file)
{
  int rec_type = _next_rec(file, REC_UDP_DNS);
  if (rec_type == -1)
    {
      return -1;
    }
  else
    {
      assert(rec_type == REC_UDP_DNS);
      _read_udp_conn(file, self, TRANS_ALLOC_ON_FLY, NO_TRANS);
      assert(self->flow_inner.serv_type == UDP_SERV_DNS);
      self->indx = file->indx -1;
      return rec_type;
    }
}

/* Quick accessors for times */

struct ulonglong *open()
{
  return (struct ulonglong *)&self->flow_inner.first_arr_tm;
}
struct ulonglong *close()
{
  return (struct ulonglong *)&self->flow_inner.last_arr_tm;
}

/* Return true if connection is known service */
int serv_is_known()
{
  return (self->flow_inner.serv_type != UDP_SERV_OTHER);
}

/* Return total octets transferred by client in a udp flow */
unsigned int tot_client_octs()
{
  return _udp_tot_client_octs(self);
}

/* Return total octets transferred by server in a udp flow */
unsigned int tot_server_octs()
{
  return _udp_tot_server_octs(self);
}
	

/* Return total octets transferred in a udp flow (duplex) */
unsigned int tot_octs()
{
  return _udp_tot_octs(self);
}

/* Return total packets transferred by client in a udp flow */
unsigned int tot_client_pkts()
{
  return _udp_tot_client_pkts(self);
}

/* Return total packets transferred by server in a udp flow */
unsigned int tot_server_pkts()
{
  return _udp_tot_server_pkts(self);
}
	

/* Return total octets transferred in a udp flow (duplex) */
unsigned int tot_pkts()
{
  return _udp_tot_pkts(self);
}

/* quick accessor for src host NBO */
unsigned int shost()
{
  return self->flow_inner.srcaddr;
}

/* quick accessor for dst host NBO */
unsigned int dhost()
{
  return self->flow_inner.dstaddr;
}

/* Return source port */
unsigned short sport()
{
  return ntohs(self->flow_inner.srcport);
}

/* Return dest port */
unsigned short dport()
{
  return ntohs(self->flow_inner.dstport);
}

/* Return 1 if traffic in both directions seen */
int both_seen()
{
	return ((self->flow_inner.state & UDP_CLIENT_SEEN)
		&& (self->flow_inner.state & UDP_SERVER_SEEN));
}

/* Return 1 if traffic from server seen */
int server_seen()
{
	return (self->flow_inner.state & UDP_SERVER_SEEN);
}

/* Return 1 if traffic from client seen */
int client_seen()
{
	return (self->flow_inner.state & UDP_CLIENT_SEEN);
}

}; /* End addmethods udp_conn */

/*****************************************************************************/


/*
 * Class icmp_rec - represents an ICMP message
 */

%addmethods icmp_rec { 

/* Constructor */
icmp_rec()
{
  struct icmp_rec *ip;	
  if ((ip = (struct icmp_rec *)malloc(sizeof(struct icmp_rec))) == NULL)
    wr_error("icmp_rec: malloc");
  return ip;
}

/*Destructor */
~icmp_rec() 
{
  free(self);
}

/* Populate from file */
void get_rec(struct np_file *file)
{
  _read_icmp(file, self);
  return;
}

void printself(int indx)
{
  report_icmp(self, indx);
}

}; /* End addmethods icmp_rec */

/*****************************************************************************/


/*
 * Class ns_fullrec - represents an NS lookup 
 * - corresponds to an Nprobe dump file ns record.
 * Comprises class ns_fullrec
 */

%addmethods ns_fullrec { 

/* Constructor */
ns_fullrec()
{
	struct ns_fullrec *np;	
	if ((np = (struct ns_fullrec *)malloc(sizeof(struct ns_fullrec))) == NULL)
	 	wr_error("ns_fullrec: malloc");
	return np;
}
	
/*Destructor */
~ns_fullrec() 
{
  	_dealloc_ns_rec(self);
}

/* ascii print out of ns record */
void printself()
{
	report_ns(self);
}

/*
 * Get current ns record from file - UDP record has already been read  
 */
void get_ns_rec(struct np_file *file)
{
  _read_ns_rec(file, self, DATA_ALLOC_ON_FLY);
  return;
}

/* Quick accessors for request/response packet times */
unsigned int ns_reqtm()
{
  return self->ns_rec.req_us;
}

unsigned int ns_reptm()
{
  return self->ns_rec.rep_us;
}



}; /* End addmethods ns_fullrec */

/*****************************************************************************/

/*
 * Class rrent - used to parse rr buffer
 */

%addmethods rrent {

rrent()
{
  struct rrent *rp;	
  if ((rp = (struct rrent *)malloc(sizeof(struct rrent))) == NULL)
    wr_error("rrent: malloc");
  return rp;
}

void printself()
{
  printf("code %d\n", self->code);
  switch (self->code)
    {
    case RR_NONE: printf("None\n"); return; break;
    case RR_IPADDR: printf("%s -> %s\n", self->req, intoa(self->addr)); break;
    case RR_CNAME: printf("%s -> %s\n", self->req, self->can); break;
    case RR_NOT_INET:
    case RR_OTHER_TYPE:
    case RR_REQ: printf("Other\n"); break;
    default:  wr_error("rrent: printself"); break;
    }
}

int nextent(int indx, struct ns_fullrec *np)
{
  char errbuf[256];
  char *rr;
  char *cp;

  if (np->rrbuf == NULL)
    return -1;

  rr = np->rrbuf;
  cp = &rr[indx];

  self->code = (int)*cp;
  //printf("XXX %d\n", self->code); fflush(stdout);

  switch (*cp++)
    {
    case RR_NONE:
      return -1;
      break;
    case RR_NOT_INET:
      //printf("\tRR class ");
      //printf("%s", tok2str(class2str, "(Class %d)", *((unsigned short *)cp)));
      cp +=2;
      //printf("\n");
      break;
    case RR_OTHER_TYPE:
      //printf("\tRR type ");
      //printf("%s", tok2str(type2str, "(Type %d)", *((unsigned short *)cp)));
      cp +=2;
      //printf("\n");
      break;
    case RR_CNAME:
      //printf("\t");
      //printf("%s", cp);
      cp += sprintf(self->req, "%s", cp) + 1;
      //printf("  ->  ");
      //printf("%s", cp);
      cp += sprintf(self->can, "%s", cp) + 1;
      //printf ("\n");
      break;
    case RR_REQ:
      //printf("\t(");
      //printf("%s", cp);
      cp += strlen(cp) + 1;
      //printf(")\n");
      break;
    case RR_IPADDR:
      //printf("\t");
      //printf("%s", cp);
      cp += sprintf(self->req, "%s", cp) + 1;
      //printf("  ->  %s\n", intoa(*((unsigned int *)cp)));
      self->addr = *((int *)cp);
      cp += 4;
      break;
    default:
      sprintf(errbuf, "report_ns - unknown rr type %x\n", *(cp - 1));
      wr_error(errbuf);
      break;
    }
  
  return (int)(cp -rr);
}



}; /* End addmethods rrent */

/*****************************************************************************/


/*
 * Class linkrec - used to retrieve next link in il_img or links buffer
 */

%addmethods linkrec { 

/* Constructor */
linkrec()
{
  struct linkrec *lp;	
  if ((lp = (struct linkrec *)malloc(sizeof(struct linkrec))) == NULL)
    wr_error("linkrec: malloc");
  return lp;
}


~linkrec() 
{
  //fprintf(stderr, "Freeing link_rec\n");
  free(self);
}

/* Given index into buffer and ptr to it populate the record */
/*  int next_lrec(int indx, struct links_chars *bufp) */
/*  { */
/*    return _get_next_link_rec(self, indx, bufp); */
/*  } */

/* Given index into buffer and ptr to it populate the record */
int next_lrec(int indx, long bufp)
{
  return _get_next_link_rec(self, indx, bufp);
}



char *type_string()
{
  return link_rec_type_string((unsigned short) self->type);
}

void set_type(int type)
{
  self->type = (uint)type;
}



}; /* End addmethods linkrec */