corsaro.h

Go to the documentation of this file.

/* 
 * corsaro
 *
 * Alistair King, CAIDA, UC San Diego
 * corsaro-info@caida.org
 * 
 * Copyright (C) 2012 The Regents of the University of California.
 * 
 * This file is part of corsaro.
 *
 * corsaro is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * corsaro is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with corsaro.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#ifndef __CORSARO_H
#define __CORSARO_H

#include "config.h"

#include "libtrace.h"
#include "wandio.h"

typedef struct corsaro corsaro_t;
typedef struct corsaro_in corsaro_in_t;
typedef struct corsaro_packet corsaro_packet_t;
typedef struct corsaro_in_record corsaro_in_record_t;
typedef struct corsaro_header corsaro_header_t;
typedef struct corsaro_trailer corsaro_trailer_t;
typedef struct corsaro_interval corsaro_interval_t;
typedef struct corsaro_plugin_data corsaro_plugin_data_t;

typedef enum corsaro_in_record_type
  {
    CORSARO_IN_RECORD_TYPE_NULL                  = 0,

    CORSARO_IN_RECORD_TYPE_INTERNAL_REDIRECT    = 1,

    CORSARO_IN_RECORD_TYPE_IO_HEADER             = 2,

    CORSARO_IN_RECORD_TYPE_IO_TRAILER            = 3,
    
    CORSARO_IN_RECORD_TYPE_IO_INTERVAL_START     = 4,

    CORSARO_IN_RECORD_TYPE_IO_INTERVAL_END       = 5,

    CORSARO_IN_RECORD_TYPE_IO_PLUGIN_START       = 6,
    
    CORSARO_IN_RECORD_TYPE_IO_PLUGIN_END         = 7,

    /* plugin specific records */

    /* corsaro_distributions has 10-19 */
    
    CORSARO_IN_RECORD_TYPE_DISTRIBUTIONS_START   = 10,
    
    CORSARO_IN_RECORD_TYPE_DISTRIBUTIONS_END     = 11,
    
    CORSARO_IN_RECORD_TYPE_DISTRIBUTIONS_ELEMENT = 12,

    /* corsaro_flowtuple has 20-29 */

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_CLASS_START  = 20,

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_CLASS_END    = 21,

    CORSARO_IN_RECORD_TYPE_FLOWTUPLE_FLOWTUPLE     = 22,

    /* corsaro_dos has 30-39 */
    
    CORSARO_IN_RECORD_TYPE_DOS_GLOBAL_HEADER     = 30,

    CORSARO_IN_RECORD_TYPE_DOS_HEADER            = 31,

    CORSARO_IN_RECORD_TYPE_DOS_ATTACK_VECTOR     = 32,

    /* corsaro_sip doesn't need any records */

    /* corsaro_symantec doesn't need any records */

  } corsaro_in_record_type_t;

typedef enum corsaro_file_mode
  {
    CORSARO_FILE_MODE_ASCII  = 0,
    CORSARO_FILE_MODE_BINARY = 1,
    CORSARO_FILE_MODE_TRACE  = 2,

    CORSARO_FILE_MODE_DEFAULT = CORSARO_FILE_MODE_ASCII
  } corsaro_file_mode_t;

typedef enum corsaro_file_compress
  {
    CORSARO_FILE_COMPRESS_NONE = WANDIO_COMPRESS_NONE,
    CORSARO_FILE_COMPRESS_ZLIB = WANDIO_COMPRESS_ZLIB,
    CORSARO_FILE_COMPRESS_BZ2  = WANDIO_COMPRESS_BZ2,
    CORSARO_FILE_COMPRESS_LZO  = WANDIO_COMPRESS_LZO,

    CORSARO_FILE_COMPRESS_DEFAULT = CORSARO_FILE_COMPRESS_ZLIB
  } corsaro_file_compress_t;

corsaro_t *corsaro_alloc_output(char *template, corsaro_file_mode_t mode);

int corsaro_start_output(corsaro_t *corsaro);

void corsaro_set_interval(corsaro_t *corsaro, int interval);

int corsaro_set_traceuri(corsaro_t *corsaro, char *traceuri);

int corsaro_enable_plugin(corsaro_t *corsaro, const char *plugin_name);

const char *corsaro_get_traceuri(corsaro_t *corsaro);

int corsaro_set_monitorname(corsaro_t *corsaro, char *name);

const char *corsaro_get_monitorname(corsaro_t *corsaro);

int corsaro_per_packet(corsaro_t *corsaro, libtrace_packet_t *packet);

int corsaro_finalize_output(corsaro_t *corsaro);

/*
 * === This comment is commented out... ===
 * The file uri can optionally contain a prefix which tells corsaro the type
 * of the file (ascii or binary) and the plugin which created it.
 * For example, binary:corsaro_flowtuple:/path/to/file.gz indicates that the 
 * file is written in binary format, by the corsaro_flowtuple plugin.
 *
 * If no prefix is given, corsaro will attempt to guess the type and plugin.
 */
corsaro_in_t *corsaro_alloc_input(char *corsarouri);

int corsaro_start_input(corsaro_in_t *corsaro);

corsaro_in_record_t *corsaro_in_alloc_record(corsaro_in_t *corsaro);

void corsaro_in_free_record(corsaro_in_record_t *record);

off_t corsaro_in_read_record(corsaro_in_t *corsaro, 
                         corsaro_in_record_type_t *record_type,
                         corsaro_in_record_t *record);

void *corsaro_in_get_record_data(corsaro_in_t *corsaro, corsaro_in_record_t *record);

int corsaro_finalize_input(corsaro_in_t *corsaro);

#endif /* __CORSARO_H */