input-ip6tun.c

Go to the documentation of this file.

#define VERSION "0.1"

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pcap.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/ether.h>
#include <poll.h>
#include <string.h>
#include <errno.h>
#include <signal.h>
#include <sys/types.h>
#include <endian.h> 
#include <openssl/md5.h>

#include <flowmonexp/plugin_input.h>

#ifdef HANIC
#include <libsze2.h>
#endif

#include "input-ip6tun.h"

#include <endian.h>
#ifndef le32toh
#       include <byteswap.h>
#       if __BYTE_ORDER == __LITTLE_ENDIAN
#               define le32toh(x) (x)
#       else /* __BIG_ENDIAN platform */
#               define le32toh(x) bswap_32(x)
#       endif
#endif

#ifndef PROCESS_PLUGIN
unsigned int __attribute__((used))plugin_type = (PLUGIN_TYPE_INPUT);
#endif

typedef struct ip6tun_input_private_struct {
        pcap_t *pcap_if; 
        pcap_t *pcap_file; 
        long id; 
#ifdef HANIC
        struct szedata *sze; 
        char card[BUFSIZE]; 
#endif
        int (*packet_getter) (unsigned char**, packet_info_t*, struct ip6tun_input_private_struct*); 
        int (*shutdown) (struct ip6tun_input_private_struct*); 
        int data_offset; 
        unsigned char *packet_data; 
        unsigned int packet_data_offset; 
        unsigned int packet_length; 
} ip6tun_input_private_t;

typedef struct {
        l3_t            l3; 
        l4_t            l4; 
        uint8_t         mechanism; 
        uint8_t         ttl_hop; 
        uint8_t         hop; 
        uint32_t        validity_map; 
        struct {
                uint8_t         headers; 
                uint8_t         trailers; 
        } teredo;
#ifdef IP6TUN_GEOIP
        struct {
                char            regular_src[4];
                char            regular_dst[4];
                char            ip6tun_src[4];
                char            ip6tun_dst[4];
        } geoip;
#endif
} ip6tun_record_t;


int ip6tun_input_record_offset; 
static unsigned int ip6tun_packet_data_offset; 
static unsigned char *ip6tun_packet_data; 
static plugin_desc_t ip6tun_input_plugin_desc = {
        "input-ip6tun",
        "Version " VERSION
        "\nInput plugin processing tunneled IPv6 traffic\
        \n One of input parameters (mandatory)\
         \n\tpcap_if=interface    network interface using pcap"
        "\n\t  id=value           set interface ID (default = 0)"
        "\n\tpcap_file=file       pcap file using pcap"
        "\n\t  id=value           set interface ID (default = 0)"
#ifdef SNF
        "\n\tsnf=snf_interface    snf network interface"
        "\n\t  id=value           set interface ID (default = 0)"
#endif
#ifdef RAWNETCAP
        "\n\trawnetcap=interface  network interface using rawnetcap"
        "\n\t  id=value           set interface ID (default = 0)"
#endif
#ifdef HANIC
        "\n\thanic=mask           bitmask of DMA channels"
        "\n\t  card=value         COMBO card to use (0-9), default 0"
        "\n\t  id=value           common interface ID for all input interfaces, set automatically by default"
#endif
        ,
        sizeof(ip6tun_record_t),
        0
};


plugin_desc_t *plugin_input_desc()
{
        return (&ip6tun_input_plugin_desc);
}

int parse_ipv6 (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record, int teredo);

int parse_proto41 (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record);

int parse_teredo (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record);

int parse_ayiya (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record);

int parse_eth (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record);

void value_fill_srcaddr6 (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l3.addr.ipv6.src), 0, 16, len, 0);
}

void value_fill_dstaddr6 (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l3.addr.ipv6.dst), 0, 16, len, 0);
}

void value_fill_srcport (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l4.src_port), 0, sizeof (uint16_t), len, 0);
}

void value_fill_icmp_type_code (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l4.icmp_type_code), 0, sizeof (uint16_t), len, 0);
}

void value_fill_dstport (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l4.dst_port), 0, sizeof (uint16_t), len, 0);
}

void value_fill_tcp_flags (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l4.tcp_flags), 0, sizeof (uint8_t), len, 0);
}

void value_fill_teredo_headers (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->teredo.headers), 0, sizeof (uint8_t), len, 0);
}

void value_fill_teredo_trailers (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->teredo.trailers), 0, sizeof (uint8_t), len, 0);
}

void value_fill_ttl_hop (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->ttl_hop), 0, sizeof (uint8_t), len, 0);
}

void value_fill_hop (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->hop), 0, sizeof (uint8_t), len, 0);
}

void value_fill_l4protocol (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->l4.protocol), 0, sizeof (uint8_t), len, 0);
}

void value_fill_mechnism (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->mechanism), 0, sizeof (uint8_t), len, 0);
}

#ifdef IP6TUN_GEOIP

void value_fill_geoip_ip6tun_src (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->geoip.ip6tun_src), 0, sizeof (char) * COUNTRY_CODE_LEN, len, 0);
}

void value_fill_geoip_ip6tun_dst (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->geoip.ip6tun_dst), 0, sizeof (char) * COUNTRY_CODE_LEN, len, 0);
}

void value_fill_geoip_regular_src (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->geoip.regular_src), 0, sizeof (char) * COUNTRY_CODE_LEN, len, 0);
}

void value_fill_geoip_regular_dst (void *self, flow_record_t *record, void *dst, int len, int to_network_byte_order)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        record_universal_get (dst, &(ip6tun_record->geoip.regular_dst), 0, sizeof (char) * COUNTRY_CODE_LEN, len, 0);
}

int validity_geoip_regular (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_GEOIP_REG) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_geoip_ip6tun (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_GEOIP_IP6TUN) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

#endif

int validity_addr6 (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_IPV6) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_port (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_PORTS) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_tcp_flags (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_FLAGS) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}
int validity_teredo_headers (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_TEREDO_HDR) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_teredo_trailers (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_TEREDO_TRL) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_ttl_hop (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_TTL_HOP) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_hop (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_HOP) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_l4protocol (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_L4_PROTO) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_icmp_type_code (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_ICMP) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

int validity_mechanism (void *self, flow_record_t *record)
{
        ip6tun_input_private_t *p = (ip6tun_input_private_t*) self;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, p->data_offset);
        
        if (ip6tun_record->validity_map & IP6TUN_RECORD_TMECH) {
                        return (VALIDITE_SUCCESS);
        } else {
                        return (VALIDITE_FAILED);
        }
}

#ifdef IP6TUN_GEOIP

int value_length_geoip (void *self, flow_record_t *record)
{
        return (sizeof(char) * COUNTRY_CODE_LEN);
}
#endif

int value_length_mechanism (void *self, flow_record_t *record)
{
        return (sizeof(uint8_t));
}

int value_length_ttl_hop (void *self, flow_record_t *record)
{
        return (sizeof(uint8_t));
}

int value_length_tcp_flags (void *self, flow_record_t *record)
{
        return (sizeof(uint8_t));
}

int value_length_protocol (void *self, flow_record_t *record)
{
        return (sizeof(uint8_t));
}

int value_length_port (void *self, flow_record_t *record)
{
        return (sizeof(uint16_t));
}

int value_length_teredo_headers_trailers (void *self, flow_record_t *record)
{
        return (sizeof(uint8_t));
}

int value_length_icmp_type_code (void *self, flow_record_t *record)
{
        return (sizeof(uint16_t));
}

int value_length_addr6 (void *self, flow_record_t *record)
{
        return (sizeof (ipv6_addr_t));
}

void plugin_input_getter_init(void *plugin_private, flow_record_getter_t **getter_list)
{
        getter_add (getter_list, "TUN_SRC_IPv6", 16, plugin_private, &validity_addr6, &value_length_addr6, &value_fill_srcaddr6);
        getter_add (getter_list, "TUN_DST_IPv6", 16, plugin_private, &validity_addr6, &value_length_addr6, &value_fill_dstaddr6);

        getter_add (getter_list, "TUN_SRC_PORT", 2, plugin_private, &validity_port, &value_length_port, &value_fill_srcport);
        getter_add (getter_list, "TUN_DST_PORT", 2, plugin_private, &validity_port, &value_length_port, &value_fill_dstport);

        getter_add (getter_list, "TUN_PROTOCOL", 1, plugin_private, &validity_l4protocol, &value_length_protocol, &value_fill_l4protocol);
        getter_add (getter_list, "TUN_TYPE", 1, plugin_private, &validity_mechanism, &value_length_mechanism, &value_fill_mechnism);

        getter_add (getter_list, "TUN_TCP_FLAGS", 1, plugin_private, &validity_tcp_flags, &value_length_tcp_flags, &value_fill_tcp_flags);
        getter_add (getter_list, "TUN_ICMP_TYPE_CODE", 2, plugin_private, &validity_icmp_type_code, &value_length_icmp_type_code, &value_fill_icmp_type_code);

        getter_add (getter_list, "TUN_TEREDO_HDRS", 1, plugin_private, &validity_teredo_headers, &value_length_teredo_headers_trailers, &value_fill_teredo_headers);
        getter_add (getter_list, "TUN_TEREDO_TRLS", 1, plugin_private, &validity_teredo_trailers, &value_length_teredo_headers_trailers, &value_fill_teredo_trailers);

        getter_add (getter_list, "TUN_HOP", 1, plugin_private, &validity_hop, &value_length_ttl_hop, &value_fill_hop);
        getter_add (getter_list, "TTL_HOP", 1, plugin_private, &validity_ttl_hop, &value_length_ttl_hop, &value_fill_ttl_hop);

#ifdef IP6TUN_GEOIP
        getter_add (getter_list, "TUN_SRC_COUNTRY", 4, plugin_private, &validity_geoip_ip6tun, &value_length_geoip, &value_fill_geoip_ip6tun_src);
        getter_add (getter_list, "TUN_DST_COUNTRY", 4, plugin_private, &validity_geoip_ip6tun, &value_length_geoip, &value_fill_geoip_ip6tun_dst);

        getter_add (getter_list, "SRC_COUNTRY", 4, plugin_private, &validity_geoip_regular, &value_length_geoip, &value_fill_geoip_regular_src);
        getter_add (getter_list, "DST_COUNTRY", 4, plugin_private, &validity_geoip_regular, &value_length_geoip, &value_fill_geoip_regular_dst);
#endif
}

static MD5_CTX md5;


int ip6tun_init_pcap_file (ip6tun_input_private_t *plugin_private, char *source)
{
        char errbuf[PCAP_ERRBUF_SIZE];
        
        plugin_private->pcap_file = pcap_open_offline (source, errbuf);
        
        if (plugin_private->pcap_file == NULL) {
                return EXIT_FAILURE;
        }
        
        return EXIT_SUCCESS;
}

int ip6tun_init_pcap_if (ip6tun_input_private_t *plugin_private, char *source)
{
        char errbuf[PCAP_ERRBUF_SIZE];
        
        plugin_private->pcap_if = pcap_open_live (source, PCAP_SIZE, 1, 0, errbuf);

        if (plugin_private->pcap_if == NULL) {
                return EXIT_FAILURE;
        }
        
        return EXIT_SUCCESS;
}

#ifdef HANIC

int ip6tun_init_hanic (ip6tun_input_private_t *plugin_private, char *source)
{
        unsigned int rx = 0xffff, tx = 0;
        
        /* set rx mask according to parameter value */
        rx = atoi(source);
        
        /* open SZE device */
        if ((plugin_private->sze = szedata_open(plugin_private->card)) == NULL) {
                fprintf(stderr, "IP6TUN: szedata_open failed\n");
                return (EXIT_FAILURE);
        }

        /* subscribe required interface */
        if (szedata_subscribe3(plugin_private->sze, &rx, &tx)) {
                fprintf(stderr, "IP6TUN: szedata subscribe failed\n");
                return (EXIT_FAILURE);
        }

        /* and finally start subscribed interface */
        if(szedata_start(plugin_private->sze)) {
                fprintf(stderr, "IP6TUN: szedata start failed\n");
                return (EXIT_FAILURE);
        }

        return EXIT_SUCCESS;
}

int ip6tun_shutdown_hanic(ip6tun_input_private_t *plugin_private)
{
        szedata_close(plugin_private->sze);

        return EXIT_SUCCESS;
}
#endif

#ifdef RAWNETCAP

int ip6tun_init_rawnetcap  (ip6tun_input_private_t *plugin_private, char *source)
{
        return EXIT_FAILURE;
}
#endif

#ifdef SNF

int ip6tun_init_snf (ip6tun_input_private_t *plugin_private, char *source)
{
        return EXIT_FAILURE;
}
#endif

int ip6tun_shutdown_uni(ip6tun_input_private_t *plugin_private)
{
        return EXIT_SUCCESS;    
}

int ip6tun_get_packet_pcap_file (unsigned char **buf, packet_info_t *packet_info, ip6tun_input_private_t *plugin_private)
{
        struct pcap_pkthdr hdr;

        *buf = (unsigned char*) pcap_next (plugin_private->pcap_file, &hdr);

        if (*buf == NULL) {
                sleep (5);
                raise (SIGQUIT);
                sleep (5);
                return EXIT_FAILURE;
        }

        packet_info->length = hdr.len;
        packet_info->cap_length = hdr.caplen;
        packet_info->arrival_time = ((uint64_t) hdr.ts.tv_sec * NSEC_IN_SEC) + ((uint64_t) hdr.ts.tv_usec * NSEC_IN_USEC);
        packet_info->input_interface = (uint16_t) plugin_private->id;
        packet_info->output_interface = 0;

        return EXIT_SUCCESS;
}

int ip6tun_get_packet_pcap_if (unsigned char **buf, packet_info_t *packet_info, ip6tun_input_private_t *plugin_private)
{
        struct pcap_pkthdr hdr;

        *buf = (unsigned char*) pcap_next (plugin_private->pcap_if, &hdr);

        packet_info->length = hdr.len;
        packet_info->cap_length = hdr.caplen;
        packet_info->arrival_time = ((uint64_t) hdr.ts.tv_sec * NSEC_IN_SEC) + ((uint64_t) hdr.ts.tv_usec * NSEC_IN_USEC);
        packet_info->input_interface = (uint16_t) plugin_private->id;
        packet_info->output_interface = 0;

        if (*buf == NULL) {
                return EXIT_FAILURE;
        }
        return EXIT_SUCCESS;
}

#ifdef HANIC

int ip6tun_get_packet_hanic  (unsigned char **buf, packet_info_t *packet_info, ip6tun_input_private_t *plugin_private)
{
        unsigned char *hw_data, *data;
        unsigned int hw_data_len, sw_data_len, len;
        uint32_t sec, nsec;

        /* read next packet from subscribed interface via sze */
        if ((data = szedata_read_next (plugin_private->sze, &len)) == NULL) {
                return (EXIT_FAILURE);
        }

        /* parse packet */
        szedata_decode_packet (data, buf, &hw_data, &sw_data_len, &hw_data_len);
        //packet_info->length = ntohs(*(uint32_t*) hw_data);
        packet_info->cap_length = sw_data_len;

        sec = le32toh(*(uint32_t*)(hw_data + 8));
        nsec = le32toh(*(uint32_t*)(hw_data + 4));
        packet_info->arrival_time = ((uint64_t) sec * NSEC_IN_SEC) + nsec;
        
        if (plugin_private->id < 0) {
                packet_info->input_interface = (uint16_t) hw_data[3];
        } else {
                packet_info->input_interface = (uint16_t) plugin_private->id;
        }       

        return EXIT_SUCCESS;
}
#endif

#ifdef RAWNETCAP

int ip6tun_get_packet_rawnetcap  (unsigned char **buf, packet_info_t *packet_info, ip6tun_input_private_t *plugin_private)
{
        return EXIT_FAILURE;
}
#endif

#ifdef SNF

int ip6tun_get_packet_snf (unsigned char **buf, packet_info_t *packet_info, ip6tun_input_private_t *plugin_private)
{
        return EXIT_FAILURE;
}
#endif



void *plugin_input_init(char *params, flow_record_getter_t **getter_list, int full_packet, int data_offset)
{
        ip6tun_input_private_t *retval;
        char *source = NULL, *next_param = NULL, *next_value = NULL, *endptr = NULL;
        int (*init_packet_getter) (ip6tun_input_private_t*, char*);
        
        init_packet_getter = NULL;

        DBG("IP6TUN: Params: %s\n", params);

        retval = malloc (sizeof(ip6tun_input_private_t));
        if (!retval) {
                return (NULL);
        }

        retval->id = 0;

        /* Init getters */
        plugin_input_getter_init(retval, getter_list);


#ifdef HANIC
        strncpy(retval->card, "/dev/szedataII0", BUFSIZE - 1);
#endif

        if (params == NULL) {
                fprintf(stderr, "Parameters: \n");
                return (NULL);
        }

        /* Set default shutdown function */
        retval->shutdown = &ip6tun_shutdown_uni;

        next_param =  strtok (params, "=");
        while (next_param) {
                // each parameter must have a value
                if ((next_value = strtok (NULL, ",")) == NULL) {
                        break;
                }
                
                if (strcmp("pcap_file", next_param) == 0) {
                        init_packet_getter = &ip6tun_init_pcap_file;
                        retval->packet_getter = &ip6tun_get_packet_pcap_file;
                        source = strdup(next_value);
                        DBG("IP6TUN: PCAP file as a source\n");
                } else 
                if (strcmp("pcap_if", next_param) == 0) {
                        init_packet_getter = &ip6tun_init_pcap_if;
                        retval->packet_getter = &ip6tun_get_packet_pcap_if;
                        source = strdup(next_value);
                        DBG("IP6TUN: PCAP interface as a source\n");
                } else 
                if (strcmp("id", next_param) == 0) {
                        retval->id = strtol(next_value, &endptr, 10);
                        if (*endptr != '\0') {
                                fprintf(stderr, "IP6TUN: id number must be a valid number!\n");
                                return (NULL);
                        }
                } else
#ifdef RAWNETCAP
                if (strcmp("rawnetcap", next_param) == 0) {
                        init_packet_getter = &ip6tun_init_rawnetcap;
                        retval->packet_getter = &ip6tun_get_packet_rawnetcap;
                        source = strdup(next_value);
                        DBG("IP6TUN: rawnetcap interface as a source\n");
                } else 
#endif
#ifdef SNF
                if (strcmp("snf", next_param) == 0) {
                        init_packet_getter = &ip6tun_init_snf;
                        retval->packet_getter = &ip6tun_get_packet_snf;
                        source = strdup(next_value);
                        DBG("IP6TUN: snf interface as a source\n");
                } else 
#endif
#ifdef HANIC
                if (strcmp("hanic", next_param) == 0) {
                        init_packet_getter = &ip6tun_init_hanic;
                        retval->packet_getter = &ip6tun_get_packet_hanic;
                        source = strdup(next_value);
                        retval->id = -1;
                        retval->shutdown = &ip6tun_shutdown_hanic;
                } else
                if (strcmp("card", next_param) == 0) {
                        strtol(next_value, &endptr, 10);
                        if (*endptr != '\0') {
                                fprintf(stderr, "IP6TUN: Card number must be a valid number!\n");
                                return (NULL);
                        }
                        strncpy(retval->card + strlen(retval->card) - 1, next_value, BUFSIZE - strlen(retval->card) - 1);
                } else
#endif
                {
                        fprintf(stderr, "IP6TUN: Unknown parameter '%s'\n", next_param);
                        return (NULL);          
                }
                
                next_param = strtok (NULL, "=");        
        }
        
        if (init_packet_getter == NULL) {
                fprintf(stderr, "IP6TUN: You must select an input\n");
                return (NULL);
        }
        
        if (next_value == NULL) {
                fprintf(stderr, "IP6TUN: Parameter '%s' requires value\n", next_param);
                return (NULL);
        }

        if (init_packet_getter (retval, source) == EXIT_SUCCESS) {
                DBG("IP6TUN: source initialized\n");
                retval->data_offset = ip6tun_input_record_offset = data_offset;
        } else {
                DBG("IP6TUN: source initialized failed\n");
                return (NULL);
        }

        DBG("IP6TUN: ID: %ld\n", retval->id);

        return (retval);
}

uint64_t plugin_input_get_flow(void *plugin_private, flow_record_t *record)
{
        ip6tun_input_private_t *ip6tun_private = (ip6tun_input_private_t*) plugin_private;
        ip6tun_record_t *ip6tun_record = PLUGIN_DATA(record, ip6tun_private->data_offset);

        packet_info_t packet_info;
        int ret;
        uint64_t hash[2];
        unsigned char *buf = NULL;

        memset ((void*) ip6tun_record, 0, sizeof(ip6tun_record_t));

        /* No packet processed yet */
        ip6tun_private->packet_data = NULL;
        ip6tun_private->packet_data_offset = 0;
        ip6tun_private->packet_length = 0;

        if (ip6tun_private->packet_getter(&buf, &packet_info, ip6tun_private) == EXIT_SUCCESS) {

                record->flow_end = record->flow_start = packet_info.arrival_time;
                // record->flow_octets = packet_info.length;
                record->flow_packets = 1;

                MD5_Init (&md5);
                
                // Store the original buf pointer to global variable to be accessible for all parse_ functions
                ip6tun_packet_data = buf;

                ret = parse_eth (buf, (uint32_t) packet_info.cap_length,record, ip6tun_record);
                record->flow_input_interface_id = packet_info.input_interface;

                if (ret != EXIT_SUCCESS) {
                        return GET_FAILED;
                } else {
                        MD5_Final ((unsigned char *) hash, &md5);

                        /* Store info for get_flow_packet */
                        ip6tun_private->packet_data = buf;
                        ip6tun_private->packet_data_offset = ip6tun_packet_data_offset;
                        ip6tun_private->packet_length = packet_info.cap_length;

                        return ((hash[0] ^ hash[1]) | FLOW_OK_BIT);
                }
        }

        return GET_FAILED;
}

unsigned char *plugin_input_get_flow_packet(void *plugin_private, unsigned int *length, unsigned int *data_offset)
{
        ip6tun_input_private_t *ip6tun_private = (ip6tun_input_private_t*) plugin_private;

        *length = ip6tun_private->packet_length;
        *data_offset = ip6tun_private->packet_data_offset;

        return ip6tun_private->packet_data;
}

int plugin_input_shutdown(void * plugin_private)
{
        ip6tun_input_private_t *ip6tun_private = (ip6tun_input_private_t*) plugin_private;

        return ip6tun_private->shutdown(ip6tun_private);
}

int parse_eth (unsigned char* buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record)
{
        uint64_t internal_hash = 0;
        uint16_t ethtype;
        uint32_t orig_caplen = caplen;
        struct ethhdr *eth;
        unsigned char* next_hdr = buf;
        int ret = EXIT_SUCCESS;
        //~ vlan_t *vlan;
        //~ mpls_t *mpls;
        l2_t *mac;
        uint8_t hlen;

        //~ uint32_t bytes = record->flow_octets; /* store it for later use */

        if (caplen < ETH_HLEN) {
                return (EXIT_FAILURE);
        }

        eth = (struct ethhdr*) buf;
        ethtype = ntohs (eth->h_proto);

        if (ethtype > ETH_DATA_LEN) {
                if ((mac = record_mac(record)) != NULL) {
                        memcpy (mac->src_mac, eth->h_source, ETH_ALEN);
                        memcpy (mac->dst_mac, eth->h_dest, ETH_ALEN);
                        MD5_Update (&md5, mac, 2 * ETH_ALEN);
                }

                /* move from simple 802.3 header to PDU */
                next_hdr += ETH_HLEN;
                caplen -= ETH_HLEN;
        }

        recurse:
        switch (ethtype) {
                case ETH_P_IP: {
                        if ((internal_hash = record_process_packet (buf, (int) orig_caplen, record)) == 0) {
                                return (EXIT_FAILURE);
                        }
                        ip6tun_record->ttl_hop = *(uint8_t *) (next_hdr + IP_TTL_OFFSET);
                        ip6tun_record->validity_map |= IP6TUN_RECORD_TTL_HOP;
                        
                        // Get data offset 
                        get_packet_data(&orig_caplen, &ip6tun_packet_data_offset);

                        // jump the ip header
                        hlen = (*(uint8_t *) next_hdr & IP_HLEN_MASK) * 4;
                        next_hdr += hlen;
                        caplen -= hlen;
                        
                        if (caplen > IPV6_HLEN) {
                                if (record->l4.protocol == IPPROTO_41) {
                                        parse_proto41 (next_hdr, caplen, record, ip6tun_record);
                                } else
                                if ((record->l4.protocol == IPPROTO_UDP) && ((record->l4.src_port == AYIYA_PORT) || (record->l4.dst_port == AYIYA_PORT))) {
                                        // jump the udp header
                                        next_hdr += UDP_HLEN;
                                        caplen -= UDP_HLEN;
                                        
                                        if (caplen > (AYIYA_BASE_HLEN + IPV6_HLEN)) {
                                                DBG("IP6TUN: possible ayiya udp packet found\n");
                                                parse_ayiya (next_hdr, caplen, record, ip6tun_record);
                                        }
                                } else
                                if (record->l4.protocol == IPPROTO_UDP) {
                                        // jump the udp header
                                        next_hdr += UDP_HLEN;
                                        caplen -= UDP_HLEN;

                                        parse_teredo (next_hdr, caplen, record, ip6tun_record);
                                } else
                                if (record->l4.protocol == IPPROTO_TCP  && ((record->l4.src_port == AYIYA_PORT) || (record->l4.dst_port == AYIYA_PORT))) {
                                        // jump the tcp header
                                        hlen = ((*(uint8_t *) (next_hdr + TCP_DATA_OFFSET_OFFSET)) >> TCP_DATA_OFFSET_SHIFT) * 4;
                                        next_hdr += hlen;
                                        caplen -= hlen;
                                        
                                        if (caplen > (AYIYA_BASE_HLEN + IPV6_HLEN)) {
                                                DBG("IP6TUN: possible ayiya tcp packet found\n");
                                                parse_ayiya (next_hdr, caplen, record, ip6tun_record);
                                        }
                                }
                        }
                        
                        MD5_Update (&md5, &internal_hash, 8);

                        break;
                }
                case ETH_P_IPV6: {
                        if ((internal_hash = record_process_packet (buf, (int) orig_caplen, record)) == 0) {
                                return (EXIT_FAILURE);
                        }

                        ip6tun_record->ttl_hop = *(uint8_t *) (next_hdr + IPV6_HOP_OFFSET);
                        ip6tun_record->validity_map |= IP6TUN_RECORD_TTL_HOP;

                        MD5_Update (&md5, &internal_hash, 8);

                        // Get data offset
                        get_packet_data(&orig_caplen, &ip6tun_packet_data_offset);

                        break;
                }
                case ETH_P_8021Q:
                case _ETH_P_8021QINQ:
                case _ETH_P_8021QINQ_DOUBLE:
                case _ETH_P_8021QINQ_TRIPPLE:
                case _ETH_P_8021AD: {

                        if (caplen < VLAN_HLEN) {
                                return (EXIT_FAILURE);
                        }

                        // not sure if we should fill these or record_process_packet takes care of that
                        //~ if ((vlan = record_vlan (record)) != NULL) {
                                //~ if (vlan->count < VLAN_MAX) {
                                        //~ vlan->id[vlan->count] = htons((*(uint16_t *) next_hdr) & VLAN_ID_MASK);
                                        //~ MD5_Update (&md5, &(vlan->id[vlan->count]), 2);
                                        //~ vlan->count++;
                                //~ }
                        //~ }

                        ethtype = ntohs (*(uint16_t *) (next_hdr + 2));
                        next_hdr += VLAN_HLEN;
                        caplen -= VLAN_HLEN;

                        goto recurse;
                }
                case ETH_P_MPLS_UC:
                case ETH_P_MPLS_MC: {

                        if (caplen < MPLS_HLEN) {
                                return (EXIT_FAILURE);
                        }
                        
                        // not sure if we should fill these or record_process_packet takes care of that
                        //~ if ((mpls = record_mpls (record)) != NULL) {
                                //~ if (mpls->count < MPLS_MAX) {
                                        //~ mpls->id[mpls->count] = htonl((*(uint32_t *) next_hdr) >> MPLS_LABEL_SHIFT);
                                        //~ MD5_Update (&md5, &(mpls->id[mpls->count]), 2);
                                        //~ mpls->count++;
                                //~ }
                        //~ }
                        
                        if ((*(uint32_t *) next_hdr) & MPLS_STACK_MASK) {
                                // try to guess the ethtype
                                switch(*(uint8_t *) (next_hdr + MPLS_HLEN) >> 4) {
                                        case 4: {
                                                        ethtype = ETH_P_IP;
                                                        break;
                                                }
                                        case 6: {
                                                        ethtype = ETH_P_IPV6;
                                                        break;
                                                }
                                        default:
                                                return (EXIT_FAILURE);
                                }
                        }
                        
                        next_hdr += MPLS_HLEN;
                        caplen -= MPLS_HLEN;

                        goto recurse;
                }
                default: {
                        // we dont know it -> dont process it
                        DBG("IP6TUN: probably non IP packet detected\n");
                        return (EXIT_FAILURE);
                }
        }

        return (ret);
}

int parse_ipv6 (unsigned char *buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record, int teredo)
{
        int retval = EXIT_SUCCESS;
        struct teredo_trailer_hdr *trailer;
        uint16_t payload_length = 0;
        unsigned char *next_header;
        int caplen_trailer;
        
        if (caplen < IPV6_HLEN) {
                return (EXIT_FAILURE);
        }
        
        struct ip6_hdr *ip6 = (struct ip6_hdr*) buf;
        
        ip6tun_record->l3.protocol = (ip6->ip6_vfc) >> 4;
        ip6tun_record->l4.protocol = ip6->ip6_nxt;

        if (ip6tun_record->l3.protocol != 0x6) {
                return (EXIT_FAILURE);
        }

        payload_length = ntohs(ip6->ip6_plen);
        
        if (payload_length < (caplen - IPV6_HLEN)) {
                
                if (teredo == 0) {
                        return (EXIT_FAILURE);
                }
                
                next_header = buf + IPV6_HLEN + payload_length;
                caplen_trailer = caplen - IPV6_HLEN - payload_length;
                
        recurse:
                
                if (caplen_trailer < TEREDO_TRAILER_BASIC_LEN) {
                        return (EXIT_FAILURE);
                }
        
                trailer = (struct teredo_trailer_hdr *) (next_header);

                switch (trailer->type) {
                        case 0x01: /* Nonce Trailer */
                                DBG("IP6TUN: Nonce Trailer\n");
                                ip6tun_record->teredo.trailers |= TEREDO_TRL_NONCE;
                                break;
                        case 0x03: /* Alternate Address Trailer */
                                DBG("IP6TUN: Alternate Address Trailer\n");
                                ip6tun_record->teredo.trailers |= TEREDO_TRL_AADDR;
                                break;
                        case 0x04: /* Neighbor Discovery Option Trailer */
                                DBG("IP6TUN: Neighbor Discovery Option Trailer\n");
                                ip6tun_record->teredo.trailers |= TEREDO_TRL_NDISC;
                                break;
                        case 0x05: /* Random Port Trailer */
                                DBG("IP6TUN: Random Port Trailer\n");
                                ip6tun_record->teredo.trailers |= TEREDO_TRL_RPORT;
                                break;                  
                        default:
                                        return (EXIT_FAILURE);
                }

                next_header += TEREDO_TRAILER_BASIC_LEN + trailer->len;
                caplen_trailer -= TEREDO_TRAILER_BASIC_LEN + trailer->len;

                if (caplen_trailer > 0) {
                        goto recurse;
                } else if (caplen_trailer < 0) {
                        return (EXIT_FAILURE);
                }
                
                ip6tun_record->validity_map |= IP6TUN_RECORD_TEREDO_TRL;
                
                retval = EXIT_TEREDO_TRAILER;
        } else if (payload_length > (caplen - IPV6_HLEN)) {
                return (EXIT_FAILURE);
        }

        ip6tun_record->validity_map |= IP6TUN_RECORD_L3_PROTO;
        ip6tun_record->validity_map |= IP6TUN_RECORD_L4_PROTO;

        memcpy (&(ip6tun_record->l3.addr.ipv6.src), &(ip6->ip6_src), sizeof(struct in6_addr));
        memcpy (&(ip6tun_record->l3.addr.ipv6.dst), &(ip6->ip6_dst), sizeof(struct in6_addr));

        ip6tun_record->hop = ip6->ip6_hops;
        ip6tun_record->validity_map |= IP6TUN_RECORD_HOP;

        ip6tun_record->validity_map |= IP6TUN_RECORD_IPV6;
        
        MD5_Update (&md5, &(ip6tun_record->l3.addr.ipv6.src), 16);
        MD5_Update (&md5, &(ip6tun_record->l3.addr.ipv6.dst), 16);
        MD5_Update (&md5, &(ip6tun_record->l4.protocol), 1);
        
        buf += IPV6_HLEN;

        //~ recurse:
        switch (ip6tun_record->l4.protocol) {
                case IPPROTO_TCP:
                case IPPROTO_UDP:
                case IPPROTO_SCTP:
                /*case IPPROTO_DCCP:*/ {
                                ip6tun_record->l4.src_port = *(uint16_t*) (buf + TCP_SPORT_OFFSET);
                                ip6tun_record->l4.dst_port = *(uint16_t*) (buf + TCP_DPORT_OFFSET);
                                
                                ip6tun_record->validity_map |= IP6TUN_RECORD_PORTS;

                                MD5_Update (&md5, &(ip6tun_record->l4.src_port), 2);
                                MD5_Update (&md5, &(ip6tun_record->l4.dst_port), 2);
                                
                                if (ip6tun_record->l4.protocol == IPPROTO_TCP) {
                                        ip6tun_record->l4.tcp_flags = *(uint8_t*) (buf + TCP_FLAGS_OFFSET);
                                        ip6tun_record->validity_map |= IP6TUN_RECORD_FLAGS;
                                }

                                break;
                        }
                case IPPROTO_ICMP:
                case IPPROTO_ICMPV6: {
                //              ip6tun_record->l4.src_port = 0;
                //              ip6tun_record->l4.dst_port = 0;

                //              ip6tun_record->validity_map |= IP6TUN_RECORD_PORTS;
                                
                                ip6tun_record->l4.icmp_type_code = ntohs(*(uint16_t*) buf);
                                ip6tun_record->validity_map |= IP6TUN_RECORD_ICMP;

                                break;
                        }
                //~ case IPPROTO_FRAGMENT: {
                                //~ ip6tun_record->l4.protocol = *(uint8_t*) buf;
                                //~ buf += 8;
                        //~ 
                                //~ goto recurse;       
                        //~ break;
                //~ }
        }

        // IPv6 tunnel header is parsed, set data offset
        ip6tun_packet_data_offset = buf - ip6tun_packet_data;
        switch (ip6tun_record->l4.protocol) {
                case IPPROTO_TCP:
                        ip6tun_packet_data_offset += ((*(uint8_t *) (buf + TCP_DATA_OFFSET_OFFSET)) >> TCP_DATA_OFFSET_SHIFT) * 4;
                        break;
                case IPPROTO_UDP:
                        ip6tun_packet_data_offset += UDP_HLEN;
                        break;
                case IPPROTO_SCTP:
                        ip6tun_packet_data_offset += 12; /* SCTP common header length */
                        break;
                case IPPROTO_ICMP:
                case IPPROTO_ICMPV6:
                        ip6tun_packet_data_offset +=  4; /* The first part is 4 byte constant */
                        break;
        }

        
        return (retval);
}

int parse_proto41 (unsigned char* buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record)
{
        if (parse_ipv6 (buf, caplen, record, ip6tun_record, 0) == EXIT_SUCCESS) {
                /* ipv6tun record shoudl be filled 
                 * - now try to detect the mechanism 
                 * - or more likely try to guess it */
                
                if ((record->l3.addr.ipv4.src.ip4_addr32[0] == _6TO4_RELAY) || (record->l3.addr.ipv4.dst.ip4_addr32[0] == _6TO4_RELAY)) {
                        // this one is solid as a rock
                        DBG("IP6TUN: 6to4 packet found\n");
                        ip6tun_record->mechanism |= IP6TUN_TMECH_6TO4;
                        ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                } else {
                        // based on source address
                        if (ip6tun_record->l3.addr.ipv6.src.ip6_addr16[0] == _6TO4_PREFIX_NO) {
                                DBG("IP6TUN: 6to4 packet found (SRC)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_6TO4;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        } else
                        if (ip6tun_record->l3.addr.ipv6.src.ip6_addr16[5] == ISATAP_MARK_NO) {
                                DBG("IP6TUN: ISATAP packet found (SRC)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_ISATAP;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        } else
                        if ((ip6tun_record->l3.addr.ipv6.src.ip6_addr16[0] == _6OVER4_PREFIX_NO) && (ip6tun_record->l3.addr.ipv6.src.ip6_addr16[5] == 0x0000)) {
                                DBG("IP6TUN: 6over4 packet found (SRC)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_6OVER4;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        }
                        
                        // based on destination address
                        if (ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[0] == _6TO4_PREFIX_NO) {
                                DBG("IP6TUN: 6to4 packet found (DST)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_6TO4;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        } else
                        if (ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[5] == ISATAP_MARK_NO) {
                                DBG("IP6TUN: ISATAP packet found (DST)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_ISATAP;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        } else
                        if ((ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[0] == _6OVER4_PREFIX_NO) && (ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[5] == 0x0000)) {
                                DBG("IP6TUN: 6over4 packet found (DST)\n");
                                ip6tun_record->mechanism |= IP6TUN_TMECH_6OVER4;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                        }
                        
                        // this way we can get possible mechanism type set
                }
                
                if (!ip6tun_record->mechanism) {
                        DBG("IP6TUN: proto 41 packet found (DST)\n");
                        ip6tun_record->mechanism |= IP6TUN_TMECH_OTHER41;
                }
                
                ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                MD5_Update (&md5, &(ip6tun_record->validity_map), sizeof(uint32_t));
                
        } else {
                return (EXIT_FAILURE);
        }
        
        return (EXIT_SUCCESS);
}

int parse_teredo (unsigned char* buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record)
{
        unsigned char* next_hdr = buf;
        int hlen, parse_retval;
        uint16_t preamble;

        recurse:
        if (caplen < IPV6_HLEN) {
                return EXIT_FAILURE;
        }

        preamble = *(uint16_t*) (next_hdr);
        
        switch (preamble) {
                case TEREDO_ORIG_PRE_NO: {
                                DBG("IP6TUN: teredo origin header found\n");
                                // fixed length skip it
                                next_hdr += TEREDO_ORIG_HLEN;
                                caplen -= TEREDO_ORIG_HLEN;
                                ip6tun_record->teredo.headers |= TEREDO_HDR_ORIG;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TEREDO_HDR;
                                goto recurse;
                        }
                case TEREDO_AUTH_PRE_NO: {
                                DBG("IP6TUN: teredo authentication header found\n");
                                struct teredo_basic_auth_hdr *teredo_auth = (struct teredo_basic_auth_hdr*) next_hdr;
                                hlen = TEREDO_AUTH_BASIC_HLEN + teredo_auth->idlen + teredo_auth->aulen;
                                next_hdr += hlen;
                                caplen -= hlen;
                                ip6tun_record->teredo.headers |= TEREDO_HDR_AUTH;
                                ip6tun_record->validity_map |= IP6TUN_RECORD_TEREDO_HDR;
                                goto recurse;
                        }
                default: {
                        parse_retval = parse_ipv6 (next_hdr, caplen, record, ip6tun_record,1);
                        if ((parse_retval == EXIT_SUCCESS) || (parse_retval == EXIT_TEREDO_TRAILER)) {
                                
                                if ((ip6tun_record->l3.addr.ipv6.src.ip6_addr16[0] == TEREDO_PREFIX_NO)
                                        || (ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[0] == TEREDO_PREFIX_NO))
                                {
                                        DBG("IP6TUN: valid teredo packet found\n");
                                        ip6tun_record->mechanism |= IP6TUN_TMECH_TEREDO;
                                        ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                                } else {
                                        // most likely there vas no ipv6 header just the first 4 bits were the same
                                        // possible dns traffic
                                        if ((record->l4.src_port == UDP_DNS_PORT) || (record->l4.dst_port == UDP_DNS_PORT)) {
                                                // invalidate ip6 record
                                                ip6tun_record->validity_map = IP6TUN_RECORD_INVALID;
                                                // reinit the hash so we dont break the flow
                                                MD5_Init (&md5);
                                        } else {
                                                // this is possible teredo traffic - check if there are some lokal link addresses present
                                                if (((ip6tun_record->l3.addr.ipv6.src.ip6_addr16[0] & IPV6_LL_MASK_NO) == IPV6_LL_MASK_NO)
                                                        || ((ip6tun_record->l3.addr.ipv6.dst.ip6_addr16[0] & IPV6_LL_MASK_NO) == IPV6_LL_MASK_NO)) {
                                                        // local link address found -> teredo
                                                        DBG("IP6TUN: valid teredo packet found (LL address)\n");
                                                        ip6tun_record->mechanism |= IP6TUN_TMECH_TEREDO;
                                                        ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;                                                             
                                                } else {
                                                        // invalidate ip6 record
                                                        ip6tun_record->validity_map = IP6TUN_RECORD_INVALID;
                                                        // reinit the hash so we dont break the flow
                                                        MD5_Init (&md5);                                                        
                                                }
                                        }
                                }                               
                        } else {
                                return EXIT_FAILURE;
                        }
                }
        }
        
        return EXIT_SUCCESS;
}

int parse_ayiya (unsigned char* buf, uint32_t caplen, flow_record_t *record, ip6tun_record_t *ip6tun_record)
{
        struct ayiya_hdr *ayiya = (struct ayiya_hdr*) buf;
        int hlen;
        unsigned char* next_hdr = buf;

        
        if (((ayiya->gethshmeth) < 0x03) && ((ayiya->getautmeth) < 0x03)
         && ((ayiya->getopcode) < 0x08) && ((ayiya->next_header) == IPPROTO_41)) {
                // check the timestamp ayiya one is in utc - dont check it now
                //~ if (abs((record->flow_start / NSEC_IN_SEC) - ntohl(ayiya->timestamp)) < AYIYA_TIME_TOL)
                //~ {
                                hlen = AYIYA_BASE_HLEN + (4 * ayiya->getsiglen) + (0x01 << ayiya->getidlen);
                                next_hdr += hlen;
                                caplen -= hlen;
                                
                                if (parse_ipv6 (next_hdr, caplen, record, ip6tun_record, 0) == EXIT_SUCCESS) {
                                        DBG("IP6TUN: valid ayiya packet found\n");
                                        ip6tun_record->mechanism |= IP6TUN_TMECH_AYIYA;
                                        ip6tun_record->validity_map |= IP6TUN_RECORD_TMECH;
                                } else {
                                        return EXIT_FAILURE;
                                }
                //~ } else {
                        //~ return EXIT_FAILURE;
                //~ }
        } else {
                return EXIT_FAILURE;
        }
        
        return EXIT_SUCCESS;
}