"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "src/tcpdemux.h" between
tcpflow-1.5.0.tar.gz and tcpflow-1.6.1.tar.gz

About: tcpflow is a TCP/IP packet demultiplexer that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.

tcpdemux.h  (tcpflow-1.5.0):tcpdemux.h  (tcpflow-1.6.1)
skipping to change at line 49 skipping to change at line 49
#endif #endif
#include <queue> #include <queue>
#include "intrusive_list.h" #include "intrusive_list.h"
/** /**
* the tcp demultiplixer * the tcp demultiplixer
* This is a singleton class; we only need a single demultiplexer. * This is a singleton class; we only need a single demultiplexer.
*/ */
class tcpdemux { class tcpdemux {
/* These are not implemented */
tcpdemux(const tcpdemux &t);
tcpdemux &operator=(const tcpdemux &that);
/* see http://mikecvet.wordpress.com/tag/hashing/ */ /* see http://mikecvet.wordpress.com/tag/hashing/ */
typedef struct { typedef struct {
long operator() (const flow_addr &k) const {return k.hash(); } long operator() (const flow_addr &k) const {return k.hash(); }
} flow_addr_hash; } flow_addr_hash;
typedef struct { typedef struct {
bool operator() (const flow_addr &x, const flow_addr &y) const { return x==y;} bool operator() (const flow_addr &x, const flow_addr &y) const { return x==y;}
} flow_addr_key_eq; } flow_addr_key_eq;
#ifdef HAVE_TR1_UNORDERED_MAP #ifdef HAVE_TR1_UNORDERED_MAP
typedef std::tr1::unordered_map<flow_addr,tcpip *,flow_addr_hash,flow_addr_k ey_eq> flow_map_t; // active flows typedef std::tr1::unordered_map<flow_addr,tcpip *,flow_addr_hash,flow_addr_k ey_eq> flow_map_t; // active flows
typedef std::tr1::unordered_map<flow_addr,saved_flow *,flow_addr_hash,flow_a ddr_key_eq> saved_flow_map_t; // flows that have been saved typedef std::tr1::unordered_map<flow_addr,saved_flow *,flow_addr_hash,flow_a ddr_key_eq> saved_flow_map_t; // flows that have been saved
typedef std::tr1::unordered_map<flow_addr,sparse_saved_flow *,flow_addr_hash ,flow_addr_key_eq> sparse_saved_flow_map_t; // flows ctxt caching for pcap disse ction
#else #else
typedef std::unordered_map<flow_addr,tcpip *,flow_addr_hash,flow_addr_key_eq > flow_map_t; // active flows typedef std::unordered_map<flow_addr,tcpip *,flow_addr_hash,flow_addr_key_eq > flow_map_t; // active flows
typedef std::unordered_map<flow_addr,saved_flow *,flow_addr_hash,flow_addr_k ey_eq> saved_flow_map_t; // flows that have been saved typedef std::unordered_map<flow_addr,saved_flow *,flow_addr_hash,flow_addr_k ey_eq> saved_flow_map_t; // flows that have been saved
typedef std::unordered_map<flow_addr,sparse_saved_flow *,flow_addr_hash,flow _addr_key_eq> sparse_saved_flow_map_t; // flows ctxt caching for pcap dissection
#endif #endif
typedef std::vector<class saved_flow *> saved_flows_t; // needs to be ordere d typedef std::vector<class saved_flow *> saved_flows_t; // needs to be ordere d
tcpdemux(); tcpdemux();
#ifdef HAVE_SQLITE3 #ifdef HAVE_SQLITE3
sqlite3 *db; sqlite3 *db;
sqlite3_stmt *insert_flow; sqlite3_stmt *insert_flow;
#endif #endif
pcap_writer *flow_sorter;
/* facility logic hinge */
int (tcpdemux::*tcp_processor)(const ipaddr &src, const ipaddr &dst,sa_famil
y_t family,
const u_char *tcp_data, uint32_t tcp_length,
const be13::packet_info &pi);
public: public:
static uint32_t tcp_timeout; static uint32_t tcp_timeout;
static std::string tcp_cmd; // command to run on each tcp
flow
static int tcp_subproc_max; // how many subprocesses are we all
owed?
static int tcp_subproc; // how many do we currently have?
static int tcp_alert_fd;
static unsigned int get_max_fds(void); // returns the max static unsigned int get_max_fds(void); // returns the max
virtual ~tcpdemux(){ virtual ~tcpdemux(){
if(xreport) delete xreport; delete xreport;
if(pwriter) delete pwriter; delete pwriter;
} }
/* The pure options class means we can add new options without having to mod ify the tcpdemux constructor. */ /* The pure options class means we can add new options without having to mod ify the tcpdemux constructor. */
class options { class options {
public:; public:;
enum { MAX_SEEK=1024*1024*16 }; enum { MAX_SEEK=1024*1024*16 };
options():console_output(false),console_output_nonewline(false), options():console_output(false),console_output_nonewline(false),
store_output(true),opt_md5(false), store_output(true),opt_md5(false),
post_processing(false),gzip_decompress(true), post_processing(false),gzip_decompress(true),
max_bytes_per_flow(-1), max_bytes_per_flow(-1),
max_flows(0),suppress_header(0), max_flows(0),suppress_header(0),
output_strip_nonprint(true),output_hex(false),use_color(0), output_strip_nonprint(true),output_json(false),
output_pcap(false),output_hex(false),use_color(0),
output_packet_index(false),max_seek(MAX_SEEK) { output_packet_index(false),max_seek(MAX_SEEK) {
} }
bool console_output; bool console_output;
bool console_output_nonewline; bool console_output_nonewline;
bool store_output; // do we output? bool store_output; // do we output?
bool opt_md5; // do we calculate MD5 on DFXML output? bool opt_md5; // do we calculate MD5 on DFXML output?
bool post_processing; // decode headers after tcp connection c loses bool post_processing; // decode headers after tcp connection c loses
bool gzip_decompress; bool gzip_decompress;
int64_t max_bytes_per_flow; int64_t max_bytes_per_flow;
uint32_t max_flows; uint32_t max_flows;
bool suppress_header; bool suppress_header;
bool output_strip_nonprint; bool output_strip_nonprint;
bool output_json;
bool output_pcap;
bool output_hex; bool output_hex;
bool use_color; bool use_color;
bool output_packet_index; // Generate a packet index file giving t he timestamp and location bool output_packet_index; // Generate a packet index file giving t he timestamp and location
// bytes written to the flow file. // bytes written to the flow file.
int32_t max_seek; // signed becuase we compare with abs() int32_t max_seek; // signed becuase we compare with abs()
}; };
enum { WARN_TOO_MANY_FILES=10000}; // warn if more than this number of file s in a directory enum { WARN_TOO_MANY_FILES=10000}; // warn if more than this number of file s in a directory
std::string outdir; /* output directory */ std::string outdir; /* output directory */
uint64_t flow_counter; // how many flows have we seen? uint64_t flow_counter; // how many flows have we seen?
uint64_t packet_counter; // monotomically increasing uint64_t packet_counter; // monotomically increasing
dfxml_writer *xreport; // DFXML output file dfxml_writer *xreport; // DFXML output file
pcap_writer *pwriter; // where we should write packets pcap_writer *pwriter; // where we should write packets
unsigned int max_open_flows; // how large did it ever get? unsigned int max_open_flows; // how large did it ever get?
unsigned int max_fds; // maximum number of file descriptors fo r this tcpdemux unsigned int max_fds; // maximum number of file descriptors fo r this tcpdemux
uint64_t unique_id; // next unique id to assign
flow_map_t flow_map; // db of open tcpip objects, indexed by flow flow_map_t flow_map; // db of open tcpip objects, indexed by flow
intrusive_list<tcpip> open_flows; // the tcpip flows with open files in acce ss order intrusive_list<tcpip> open_flows; // the tcpip flows with open files in acce ss order
saved_flow_map_t saved_flow_map; // db of saved flows, indexed by flow saved_flow_map_t saved_flow_map; // db of saved flows, indexed by flow
sparse_saved_flow_map_t flow_fd_cache_map; // db caching saved flows descri ptors, indexed by flow
saved_flows_t saved_flows; // the flows that were saved saved_flows_t saved_flows; // the flows that were saved
bool start_new_connections; // true if we should start new conn ections bool start_new_connections; // true if we should start new conn ections
options opt; options opt;
class feature_recorder_set *fs; // where features extracted from each class feature_recorder_set *fs; // where features extracted from each flow s
flow should be stored hould be stored
static uint32_t max_saved_flows; // how many saved flows are kept in t he saved_flow_map static uint32_t max_saved_flows; // how many saved flows are kept in t he saved_flow_map
void alter_processing_core();
static tcpdemux *getInstance(); static tcpdemux *getInstance();
/* Databse */ /* Databse */
void openDB(); // open the database file if we are using it in outdir directory. void openDB(); // open the database file if we are using it in outdir directory.
void write_flow_record(const std::string &starttime,const std::string &endt ime, void write_flow_record(const std::string &starttime,const std::string &endt ime,
const std::string &src_ipn,const std::string &dst_ip n, const std::string &src_ipn,const std::string &dst_ip n,
const std::string &mac_daddr,const std::string &mac_ saddr, const std::string &mac_daddr,const std::string &mac_ saddr,
uint64_t packets,uint16_t srcport,uint16_t dstport, uint64_t packets,uint16_t srcport,uint16_t dstport,
const std::string &hashdigest_md5); const std::string &hashdigest_md5);
skipping to change at line 175 skipping to change at line 191
* new flows. * new flows.
*/ */
void save_flow(tcpip *); void save_flow(tcpip *);
/** packet processing. /** packet processing.
* Each returns 0 if processed, 1 if not processed, -1 if error. * Each returns 0 if processed, 1 if not processed, -1 if error.
*/ */
int process_tcp(const ipaddr &src, const ipaddr &dst,sa_family_t family, int process_tcp(const ipaddr &src, const ipaddr &dst,sa_family_t family,
const u_char *tcp_data, uint32_t tcp_length, const u_char *tcp_data, uint32_t tcp_length,
const be13::packet_info &pi); const be13::packet_info &pi);
int dissect_tcp(const ipaddr &src, const ipaddr &dst,sa_family_t family,
const u_char *tcp_data, uint32_t tcp_length,
const be13::packet_info &pi);
int process_ip4(const be13::packet_info &pi); int process_ip4(const be13::packet_info &pi);
int process_ip6(const be13::packet_info &pi); int process_ip6(const be13::packet_info &pi);
int process_pkt(const be13::packet_info &pi); int process_pkt(const be13::packet_info &pi);
private:;
/* These are not implemented */
tcpdemux(const tcpdemux &t);
tcpdemux &operator=(const tcpdemux &that);
}; };
#endif #endif
 End of changes. 16 change blocks. 
16 lines changed or deleted 43 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)