/* ** Copyright (C) 2005-2007 by Carnegie Mellon University. ** ** @OPENSOURCE_HEADER_START@ ** ** Use of the SILK system and related source code is subject to the terms ** of the following licenses: ** ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.225-7013 ** ** NO WARRANTY ** ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT, ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES. ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE ** DELIVERABLES UNDER THIS LICENSE. ** ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie ** Mellon University, its trustees, officers, employees, and agents from ** all claims or demands made against them (and any related losses, ** expenses, or attorney's fees) arising out of, or relating to Licensee's ** and/or its sub licensees' negligent use or willful misuse of or ** negligent conduct or willful misconduct regarding the Software, ** facilities, or other rights or assistance granted by Carnegie Mellon ** University under this License, including, but not limited to, any ** claims of product liability, personal injury, death, damage to ** property, or violation of any laws or regulations. ** ** Carnegie Mellon University Software Engineering Institute authored ** documents are sponsored by the U.S. Department of Defense under ** Contract F19628-00-C-0003. Carnegie Mellon University retains ** copyrights in all material produced under this contract. The U.S. ** Government retains a non-exclusive, royalty-free license to publish or ** reproduce these documents, or allow others to do so, for U.S. ** Government purposes only pursuant to the copyright license under the ** contract clause at 252.227.7013. ** ** @OPENSOURCE_HEADER_END@ */ /* ** Interface to pull a single flow from a NetFlow v5 PDU ** */ #include "silk.h" RCSIDENT("$SiLK: flowcap-source.c 7399 2007-06-06 14:48:53Z mthomas $"); #include "flowcap-source.h" #include "lzo-file.h" #include "convert-flowcap.h" #ifdef TEST_PRINTF_FORMATS # define IF_LOGFN(f) printf #else # define IF_LOGFN(f) if (! f) { } else f #endif typedef struct flowcap_source_t { sk_msg_fn_t logfn; lzo_decompr_buffer_t buf; uint32_t recs; int version; int recsize; char sensor_name[SK_MAX_STRLEN_SENSOR + 1]; char probe_name[SK_MAX_STRLEN_SENSOR + 1]; char *fn; FILE *fd; uint16_t remaining; } flowcap_source_t; flowcapSource_t flowcapSourceCreateFromFile( const char *path, sk_msg_fn_t logfn) { #define LOG IF_LOGFN(logfn) genericHeader fHdr; flowcapSource_t source; FILE *fd; /* Argument checking */ if (path == NULL) { LOG("NULL path passed to flowcapSourceCreateFromFile."); return NULL; } /* Valid file checking */ if ((fd = fopen(path, "r")) == NULL) { LOG("Unable to open %s for reading.", path); return NULL; } source = (flowcapSource_t)calloc(1, sizeof(flowcap_source_t)); if (source == NULL) { LOG("Unable to allocate memory for a flowSource."); return NULL; } source->logfn = logfn; if (fread(&fHdr, sizeof(fHdr), 1, fd) != 1) { LOG("Unable to read a header from %s.", path); goto error; } if (CHECKMAGIC(&fHdr)) { LOG("Invalid header magic in %s.", path); goto error; } if (fHdr.type != FT_FLOWCAP) { LOG("%s is not a flowcap file.", path); goto error; } if (FC_REC_SIZE(fHdr.version) == -1) { LOG("Unsupported flowcap version %d in %s.", fHdr.version, path); goto error; } /* All current flowcap versions have same header */ if (fread(source->sensor_name, sizeof(source->sensor_name), 1, fd) != 1) { LOG("No sensor name in version %d file %s.", fHdr.version, path); goto error; } if (memchr(source->sensor_name, '\0', sizeof(source->sensor_name)) == NULL) { LOG("Invalid sensor name in %s.", path); goto error; } if (fread(source->probe_name, sizeof(source->probe_name), 1, fd) != 1) { LOG("No probe name in version %d file %s.", fHdr.version, path); goto error; } if (memchr(source->probe_name, '\0', sizeof(source->probe_name)) == NULL) { LOG("Invalid probe name in %s.", path); goto error; } /* File has been validated. Fill in source. */ source->fd = fd; source->fn = strdup(path); if (source->fn == NULL) { LOG("Unable to allocate memory for a flowSource."); goto error; } source->buf = lzo_create_decompr_buffer(); if (source->buf == NULL) { LOG("Unable to create decompression buffer."); free(source->fn); goto error; } lzo_bind_decompr_buffer(source->buf, source->fd); source->version = fHdr.version; source->recsize = FC_REC_SIZE(fHdr.version); return source; error: fclose(fd); free(source); return NULL; #undef LOG } const char *flowcapSourceFileName(const flowcapSource_t source) { if (source == NULL) { return NULL; } return source->fn; } const char *flowcapSourceSensorName(const flowcapSource_t source) { if (source == NULL) { return NULL; } return source->sensor_name; } const char *flowcapSourceProbeName(const flowcapSource_t source) { if (source == NULL) { return NULL; } return source->probe_name; } uint32_t flowcapSourceNumRecs(const flowcapSource_t source) { if (source == NULL) { return 0; } return source->recs; } int flowcapSourceClose(flowcapSource_t source) { int rv; if (source == NULL || source->fd == NULL) { return -1; } rv = fclose(source->fd); source->fd = NULL; return rv; } void flowcapSourceDestroy(flowcapSource_t source) { if (source == NULL) { return; } if (source->fd) { fclose(source->fd); source->fd = NULL; } free(source->fn); lzo_destroy_decompr_buffer(source->buf); free(source); } int flowcapSourceGetGeneric( flowcapSource_t source, rwRec *rwrec) { uint8_t buf[FC_MAX_SIZE]; if (source == NULL || source->fd == NULL) { return -1; } if (lzo_read(source->buf, buf, source->recsize) == source->recsize) { if (flowcapToGeneric((flowcapRec_t)buf, source->version, rwrec)) { return -1; /* Failure */ } source->recs++; return 0; /* Success */ } return -1; /* EOF */ } /* ** Local Variables: ** mode:c ** indent-tabs-mode:nil ** c-basic-offset:4 ** End: */