Input plugin for flowmon, parse HTTP headers. More...

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <pcap.h>
#include <stdbool.h>
#include <sys/timeb.h>
#include <time.h>
#include <signal.h>
#include <sys/cdefs.h>
#include <flowmonexp/plugin_input.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/ether.h>
#include "flowmon-input-http.h"
#include "lex.h"
#include <openssl/md5.h>
#include <inttypes.h>

Data Structures
struct	plugin_private_http

Macros
#define	PRINTV(format, args...) do {if (VERBOSE) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)
#define	PRINTD(format, args...) do {if (DEBUG) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)
#define	PRINTA(format, args...) do {if (VERBOSE \|\| DEBUG) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)

Functions
	SET_PLUGIN_TYPE (PLUGIN_TYPE_INPUT\|PLUGIN_TYPE_PROCESS)
int	lex_strstr (char buf, int n, http_record_t http)
	Function to parse buffer with flex.
void	plugin_input_getter_init (void plugin_private, flow_record_getter_t *getter_list)
	Function to initialize getters.
char *	getfilter (char *file)
	reads libpcap filter from file
void *	plugin_input_init (char *params, int full_packet, int data_offset)
	initialization of input-http plugin
void	plugin_process_update (void plugin_private, flow_record_t record, flow_record_t *update)
	process update function, refills flow data if flow is not already filled
unsigned char *	getbuf (int counter, unsigned char *packets[40], int min, int max)
	Get buffer for benchmarking from C array isntead of pcap.
int	parse_headers (unsigned char buf, http_record_t http, int buflen)
	parse HTTP headers from data payload
char	YY_GET_EOF_CHAR ()
YY_BUFFER_STATE	my_scan_buffer (char *base, yy_size_t size, yyscan_t yyscanner)
void	my_init_extra (yyscan_t backup_scanner, YY_EXTRA_TYPE user_defined, yyscan_t scanner)
YY_BUFFER_STATE	my_scan_bytes (yyconst char *yybytes, yy_size_t _yybytes_len, yyscan_t yyscanner)
void	my_delete_buffer (YY_BUFFER_STATE b, yyscan_t yyscanner)
plugin_desc_t *	plugin_process_desc ()
	Returns plugin description.
void *	plugin_process_init (char *params, int data_offset)
	blank function

Variables
int	GLOBAL_FLOW_OFFSET
bool	VERBOSE
bool	DEBUG
yyscan_t	backup_scanner
yyscan_t	scanner

Detailed Description

Input plugin for flowmon, parse HTTP headers.

Author:: Tomas Sima simat.nosp@m.omas.nosp@m.@mail.nosp@m..mun.nosp@m.i.cz#

Date:: 16.12.2012

Copyright:: Copyright (C) 2012 Masaryk University, Institute of Computer Science All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
Neither the name of the Masaryk University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

This software is provided ``as is'', and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the company or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.

Id:: flowmon-input-http.c 1109 2013-03-13 14:19:57Z 255519

Definition in file flowmon-input-http.c.

Macro Definition Documentation

#define PRINTV	(	format,
		args...
	)	do {if (VERBOSE) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)

Print when verbose mode is on

Definition at line 64 of file flowmon-input-http.c.

#define PRINTD	(	format,
		args...
	)	do {if (DEBUG) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)

Print when debug mode is on

Definition at line 67 of file flowmon-input-http.c.

#define PRINTA	(	format,
		args...
	)	do {if (VERBOSE \|\| DEBUG) { fprintf(stdout, format, ##args); fflush(stdout); } } while (0)

Print when debug of verbose mode is on

Definition at line 70 of file flowmon-input-http.c.

Function Documentation

SET_PLUGIN_TYPE ( PLUGIN_TYPE_INPUT| PLUGIN_TYPE_PROCESS )

Set plugin type for flowmonexp

int lex_strstr	(	char *	buf,
		int	n,
		http_record_t *	http
	)

inline

Function to parse buffer with flex.

Parameters:

*buf	pointer to start of data payload
n	length of buffer
*http	pointer to plugin internal structure

Returns:: void

void plugin_input_getter_init	(	void *	plugin_private,
		flow_record_getter_t **	getter_list
	)

Function to initialize getters.

Parameters:

*plugin_private	allocated plugin's private structure
**getter_list	list of getters to export

Returns:: void

char* getfilter ( char * file )

reads libpcap filter from file

Parameters:

*file with filter on first line

Returns:: pointer to start of filter

void* plugin_input_init	(	char *	params,
		int	full_packet,
		int	data_offset
	)

initialization of input-http plugin

Parameters:

*params	= character field
full_packet	= ???
data_offset	= offset to acces plugin's private structure

Returns:: pointer to string with filter

void plugin_process_update	(	void *	plugin_private,
		flow_record_t *	record,
		flow_record_t *	update
	)

process update function, refills flow data if flow is not already filled

Parameters:

*plugin_private	= plugin private structure
*record	= data got from prevous packets
*update	= data got from current packet

Returns:: pointer to plugins internal structure

unsigned char* getbuf	(	int	counter,
		unsigned char *	packets[40],
		int	min,
		int	max
	)

inline

Get buffer for benchmarking from C array isntead of pcap.

Parameters:

counter	number of passed packets
*packets	array with different packets exported from wireshark
min	specify range of packets
max	specify range of packets

Returns:: void

int parse_headers	(	unsigned char *	buf,
		http_record_t *	http,
		int	buflen
	)

inline

parse HTTP headers from data payload

Parameters:

*buf	= pointer to start of data payload
*http	= structure to fill parsed data
buflen	= length of buffer

Returns:: 0 if ok, non-zero if not

char YY_GET_EOF_CHAR ( )

inline