evl.h

Go to the documentation of this file.

/** \file  evl.h

  \brief Rule evaluation data structures
*/

#ifndef _EVL
#define _EVL

#ifdef __cplusplus
extern "C" {
#endif

#include "tcl.h"
#include "nm.h"
#include "pkt.h"
#include "rlp.h"
#include "q.h"
#include "bdd.h"


#define my_isupper( c ) ( ( c < 91 ) && ( c > 64 ) )
#define my_uppertolower( c ) ( ( c + 32 ) )


/** \brief Use this global to set how long the strings have to 
be before we add them to the FSM.
*/

static const int Evl_MinLengthFsmString = 3;

/** \brief  Macro for memcmp without a function call.
  
  Result is in tmpIndex,
  which is 0 iff the two are equal.
  
*/


#define EVL_MEMCMP( s1, s2, numBytes, match ) \
            while ( numBytes-- && ( s1[numBytes] == s2[numBytes] ) ); \
            match = ( numBytes == 0 ) ? true : false;


/**
  * \brief  A lookup table for finding potentially applicable
  * rules for a packet based on L4 header information.
  * 
  * A lookup table struct - walk the tree using dest port, src port,
  * dest ip, src ip bits, 8 at a time from MSB, and the terminal
  * will be 
  * an index that can be used to get into an array of var_set_t * that 
  * is the set of corresponding rules - not L4 rules, the 
  * actual rules, or 
  * an array of util_int_array_t * that is
  * the same set.
  * 
  * The logic for this is that in some cases we may want the
  * set representation, in others the array representation.
  * specifically, if we are traversing an automaton to see what strings
  * are present, then the set representation  is superior.  Conversely,
  * for rules with no strings, where we have to traverse 
  * the entire set  of rules associated with a class derived
  * from the lookup-table, we might as well do it with an array representation.
  */

struct Evl_L4LookupTable_t
{
  int *tree;
  int numClasses;       // not actually needed for eval, but useful
  // to have around, e.g., to traverse ruleSets
  var_set_t **ruleSets;
  util_int_array_t **ruleArrays;

  // following two entries are used for pruning searches
  // initialized to -1
  int *ruleArrayMin;        // ruleArrayMin[i] is smallest index appearing in ruleArrays[i]
  int *ruleArrayMax;        // ruleArrayMax[i] is largest index appearing in ruleArrays[i]
};

typedef struct Evl_L4LookupTable_t Evl_L4LookupTable_t;


/** \brief  A bdd_t and the level we are thinking of it as being at. */

struct Evl_BddLevelPair_t
{
  bdd_t *bdd;
  int level;
};

typedef struct Evl_BddLevelPair_t Evl_BddLevelPair_t;


/**
    \brief  A stucture for evaluating L7 rules
    
    Basically, we're going to be passed in an array of Rlp_Formula_t's
    each with some (maybe none) content checks.   
    
    We need to be able to seperate the checks that have no content 
    checks - there 156 distinct rules (one repeated), focusing  on

<pre>
    - icmp checks: id: dsize: itype: icmp_id: icmp_seq: ip_opts
    
    icmp 255.255.255.0/24 any -> HN any ( itype: 0; dsize: >1; )
    icmp 3.3.3.3/32 any -> EN any ( itype: 0; icmp_id: 666; )
    icmp any any -> any any ( itype: 3; icode: 10; )
    icmp any any -> any any ( itype: 3; icode: 13; )
    icmp any any -> any any ( itype: 3; icode: 9; )
    icmp EN any -> HN any ( dsize: 0; itype: 8; )
    icmp EN any -> HN any ( dsize: >800; )
    icmp EN any -> HN any ( dsize:8; itype:8; )
    icmp EN any -> HN any ( dsize:8; itype:8; id:13170; )
    icmp EN any -> HN any ( id: 666; dsize: 0; itype: 8; icmp_id: 666 ; icmp_seq: 0; )
    icmp EN any -> HN any ( ipopts: rr; itype: 0; )
    icmp EN any -> HN any ( itype: 0; )
    icmp EN any -> HN any ( itype: 0; icmp_id: 456; icmp_seq: 0; )
    icmp EN any -> HN any ( itype: 0; icmp_id: 51201; icmp_seq: 0; )
    icmp EN any -> HN any ( itype: 0; icode: 0; )
    icmp EN any -> HN any ( itype: 1; )
    icmp EN any -> HN any (itype:10; )
    icmp EN any -> HN any ( itype: 10; icode: 0; )
    icmp EN any -> HN any ( itype: 11; )
    icmp EN any -> HN any ( itype: 11; icode: 0; )
    icmp EN any -> HN any ( itype: 11; icode: 1; )
    icmp EN any -> HN any ( itype: 12; )
    icmp EN any -> HN any ( itype: 12; icode: 0; )
    icmp EN any -> HN any ( itype: 12; icode: 1; )
    icmp EN any -> HN any ( itype: 12; icode: 2; )
    icmp EN any -> HN any ( itype: 13; )
    icmp EN any -> HN any ( itype: 13; icode: 0; )
    icmp EN any -> HN any ( itype: 14; )
    icmp EN any -> HN any ( itype: 14; icode: 0; )
    icmp EN any -> HN any ( itype: 15; )
    icmp EN any -> HN any ( itype: 15; icode: 0; )
    icmp EN any -> HN any ( itype: 17; )
    icmp EN any -> HN any ( itype: 17; icode: 0; )
    icmp EN any -> HN any ( itype: 18; )
    icmp EN any -> HN any ( itype: 19; )
    icmp EN any -> HN any ( itype: 19; icode: 0; )
    icmp EN any -> HN any ( itype: 1; icode: 0; )
    icmp EN any -> HN any ( itype: 2; )
    icmp EN any -> HN any ( itype: 2; icode: 0; )
    icmp EN any -> HN any ( itype: 3; )
    icmp EN any -> HN any ( itype: 30; )
    icmp EN any -> HN any ( itype: 30; icode: 0; )
    icmp EN any -> HN any ( itype: 31; )
    icmp EN any -> HN any ( itype: 31; icode: 0; )
    icmp EN any -> HN any ( itype: 32; )
    icmp EN any -> HN any ( itype: 32; icode: 0; )
    icmp EN any -> HN any ( itype: 33; )
    icmp EN any -> HN any ( itype: 33; icode: 0; )
    icmp EN any -> HN any ( itype: 34; )
    icmp EN any -> HN any ( itype: 34; icode: 0; )
    icmp EN any -> HN any ( itype: 35; )
    icmp EN any -> HN any ( itype: 35; icode: 0; )
    icmp EN any -> HN any ( itype: 36; )
    icmp EN any -> HN any ( itype: 36; icode: 0; )
    icmp EN any -> HN any ( itype: 39; )
    icmp EN any -> HN any ( itype: 39; icode: 0; )
    icmp EN any -> HN any ( itype: 3; icode: 0; )
    icmp EN any -> HN any ( itype: 3; icode: 1; )
    icmp EN any -> HN any ( itype: 3; icode:11; )
    icmp EN any -> HN any ( itype: 3; icode: 12; )
    icmp EN any -> HN any ( itype: 3; icode: 14; )
    icmp EN any -> HN any ( itype: 3; icode: 15; )
    icmp EN any -> HN any ( itype: 3; icode: 2; )
    icmp EN any -> HN any ( itype: 3; icode: 3; )
    icmp EN any -> HN any ( itype: 3; icode:4; )
    icmp EN any -> HN any ( itype: 3; icode: 5; )
    icmp EN any -> HN any ( itype: 3; icode: 6; )
    icmp EN any -> HN any ( itype: 3; icode: 7; )
    icmp EN any -> HN any ( itype: 3; icode: 8; )
    icmp EN any -> HN any ( itype: 4; )
    icmp EN any -> HN any ( itype: 40; )
    icmp EN any -> HN any ( itype: 40; icode: 0; )
    icmp EN any -> HN any ( itype: 40; icode: 1; )
    icmp EN any -> HN any ( itype: 40; icode: 2; )
    icmp EN any -> HN any ( itype: 40; icode: 3; )
    icmp EN any -> HN any ( itype: 4; icode: 0; )
    icmp EN any -> HN any ( itype: 5; )
    icmp EN any -> HN any (itype:5;icode:0; )
    icmp EN any -> HN any (itype:5;icode:1; )
    icmp EN any -> HN any ( itype: 5; icode: 2; )
    icmp EN any -> HN any ( itype: 5; icode: 3; )
    icmp EN any -> HN any ( itype: 6; )
    icmp EN any -> HN any ( itype: 6; icode: 0; )
    icmp EN any -> HN any ( itype: 7; )
    icmp EN any -> HN any ( itype: 7; icode: 0; )
    icmp EN any -> HN any ( itype: 8; )
    icmp EN any -> HN any ( itype: 8; icmp_id: 0; icmp_seq: 0; dsize:4; )
    icmp EN any -> HN any ( itype: 8; icode: 0; )
    icmp EN any -> HN any (itype:9; )
    icmp EN any -> HN any ( itype: 9; icode: 0; )
    icmp EN any -> HN any (ttl:1;itype:8; )
    icmp HN any -> EN any ( itype: 16; )
    icmp HN any -> EN any ( itype: 16; icode: 0; )
    icmp HN any -> EN any ( itype: 18; icode: 0; )
    
    - ip checks: ipopts: fragbits: sameip: ip_proto: ttl: 
    
    ip 63.251.224.177 any -> HN any ( )
    ip any any -> 216.80.99.202 any ( )
    ip any any -> any any ( sameip; )
    ip EN any -> HN any ( fragbits:MD; )
    ip EN any -> HN any ( fragbits:M; dsize: < 25; )
    ip EN any -> HN any ( fragbits: M; dsize:408; )
    ip EN any -> HN any ( fragbits:R; )
    ip EN any -> HN any ( ipopts:lsrr; )
    ip EN any -> HN any ( ipopts:lsrre; )
    ip EN any -> HN any ( ipopts: ssrr ; )
    ip EN any -> HN any ( ip_proto:>134; )
    ip EN any -> HN any ( ip_proto:!1; ip_proto:!2; ip_proto:!6; ip_proto:!47; ip_proto:!50; ip_proto:!51; ip_proto:!89; )
    ip EN any -> HN any ( ttl:0; )
    
    - tcp checks: flags: rpc: dsize: seq: ack: id: 
    
    tcp 255.255.255.0/24 any -> HN any ( flags:A+; dsize: >1; )
    tcp any any -> 212.146.0.34 1963 ( )
    tcp any any -> [232.0.0.0/8,233.0.0.0/8,239.0.0.0/8] any ( flags:S+; )
    tcp EN 10101 -> HN any ( ttl: >220; ack: 0; flags: S; )
    tcp EN 20 -> HN :1023 ( flags:S; )
    tcp EN 53 -> HN :1023 ( flags:S; )
    tcp EN 6000:6005 -> HN any ( )
    tcp EN 80 -> HN 1054 ( seq: 101058054; ack: 101058054; flags: A; )
    tcp EN any -> HN 1080 ( flags:S; )
    tcp EN any -> HN 111 ( rpc:100009,*,*; )
    tcp EN any -> HN 111 ( rpc:100083,*,*; )
    tcp EN any -> HN 111 ( rpc:391029,*,*; )
    tcp EN any -> HN 135:139 ( flags: U+; )
    tcp EN any -> HN 15104 ( flags: S; )
    tcp EN any -> HN 161 ( )
    tcp EN any -> HN 162 ( )
    tcp EN any -> HN 20432 ( flags: A+; )
    tcp EN any -> HN 21 ( dsize:>100; )
    tcp EN any -> HN 3128 ( flags:S; )
    tcp EN any -> HN 3372 ( dsize:>1023; )
    tcp EN any -> HN 617 ( dsize:>1445; )
    tcp EN any -> HN 6789:6790 ( dsize:1; )
    tcp EN any -> HN 705 ( )
    tcp EN any -> HN 8080 ( flags:S; )
    tcp EN any -> HN 80 ( flags: SF12; dsize: 0; )
    tcp EN any -> HN any (flags:0; seq:0; ack:0; )
    tcp EN any -> HN any (flags:A;ack:0; )
    tcp EN any -> HN any ( flags: F; )
    tcp EN any -> HN any (flags:FPU; )
    tcp EN any -> HN any ( flags:S; dsize:>6; )
    tcp EN any -> HN any (flags:SF; )
    tcp EN any -> HN any (flags:SFPU; )
    tcp EN any -> HN any (flags:SRAFPU; )
    tcp EN any -> HN any ( flags:S; seq:1958810375; )
    tcp EN any -> HN any ( id:3868; seq: 3868; flags:S; )
    tcp EN any -> HN any ( id: 39426; flags: SF; )
    tcp HN 7161 -> EN any ( flags:SA; )
    
    - udp checks: dsize: rpc: fragbits: also a few specific ports
    
    udp any any -> 255.255.255.255 161 ( )
    udp any any -> 255.255.255.255 162 ( )
    udp EN 2140 -> HN 60000 ( )
    udp EN 60000 -> HN 2140 ( )
    udp EN any -> HN 111 ( rpc:100009,*,*; )
    udp EN any -> HN 111 ( rpc:100083,*,*; )
    udp EN any -> HN 123 ( dsize: >128; )
    udp EN any -> HN 161 ( )
    udp EN any -> HN 161 ( dsize:0; )
    udp EN any -> HN 162 ( )
    udp EN any -> HN any ( dsize: >4000; )
    udp EN any -> HN any ( id:242; fragbits:M; )
    
    The majority of the 4 checks above are EN -> HN type ; 
    only 12 are not - 
    
    icmp 255.255.255.0/24 any -> HN any ( itype: 0; dsize: >1; )
    icmp any any -> any any ( itype: 3; icode: 10; )
    icmp any any -> any any ( itype: 3; icode: 13; )
    icmp any any -> any any ( itype: 3; icode: 9; )
    ip 63.251.224.177 any -> HN any ( )
    ip any any -> 216.80.99.202 any ( )
    ip any any -> any any ( sameip; )
    tcp 255.255.255.0/24 any -> HN any ( flags:A+; dsize: >1; )
    tcp any any -> 212.146.0.34 1963 ( )
    tcp any any -> [232.0.0.0/8,233.0.0.0/8,239.0.0.0/8] any ( flags:S+; )
    udp any any -> 255.255.255.255 161 ( )
    udp any any -> 255.255.255.255 162 ( )

</pre>
    
    Putting aside the no-content checks for now,  we need to think how to
    organize the checks.  
    
    Let's start by restricting our attention to a single packet rather than
    a flow.
    
    The assumption is that we have got a bit-vector telling us exactly which 
    L4 rules matches - it's N-wide, where N is the total number of rules.
    
    For each rule, we extract the strings it checks for (will handle 
    the negation and the case-insensitive seperately, and for uri, 
    will have a special kill flag after the uri is done).  We then 
    have an automaton over these strings, which tells us when 
    we've seen any one of these strings (by the id of 
    the current state).  
    
    For each string, we have an array which ids the rules in which it
    appears -  since it's unlikely that a string will appear in many rules
    (the most common strings are content:"../../" content:"|00|"
    content:"|00 01 86 A5|" content:"|00 01 86 B8|" content:"|00 04 93 F3|" 
    content: "filename="  which appear 6 times each) we can just keep
    them in linear order in the array.
    
    When traversing the automaton with the payload, we record strings
    as we see them.  Whenever we hit a string, we record the offset at which
    we saw it, check which rules might be affected, and check them
    
    The check for the affected rules is as follows: we see the content checks
    in that rule, and look at the strings that the rules refers to.  We 
    have the latest string-occurance: offset mapping, which allows
    us to check foo U_[10,20] bar U_[10,20] widget type checks.
    
    We could keep all the occurence of the strings, which would allow us
    to check a more complex semantics, e.g., if we were looking at only
    the most recent occurrences, we'd miss
    
    foo 10 chars bar 12 chars bar 2 char widget 
    
    since the second bar would get priority.
    
    It's unlikely this is a major issue, so we'll stick to the simpler check.
*/

struct Evl_ContentMgr_t
{
  int numStrings;       // num distinct strings
  st_table *stringToId;     // hash from string to id
  st_table *idToString;     // given an id, return the corresp string
  array_t *idToRules;       // entries are array_t * of ints
  array_t *stringArray;     // array of util_byte_array_t *
  array_t *maxLengthArray;  // length of longest string in rule (-1 for no strings)
  array_t *maxLengthStringsArray;   // longest string in rule (NIL if none)
};

typedef struct Evl_ContentMgr_t Evl_ContentMgr_t;


/**
  * \brief  Fsm structure
  * 
  * Assumption is that there are no repeated
  * strings.  The initial state is the state whose id is numStrings,
  * and the states 0--numStrings-1 are the states corresponding
  * to the input strings.  
  * 
  * \sa Evl_BuildPrefixAutomaton 
  */

struct Evl_Fsm_t
{
  int N;            // number of states
  int numStrings;       // number of strings

  // array indexed by state ids (from 0 to N-1) returning a string
  util_byte_array_t **stateIdToPrefix;


  // evaluate the next state by computing entry at 256 * ps + in
  // it's conceivable that 256 * in + ps may be a better organization
  // from a cache persepective
  u_int16_t *nextStateFunction;

  int numInputValues;
  st_table *prefixHash;

  // array indexed by stateId, entry is an array_t 
  // containing id's of strings which are accepted at that state
  // these ids will be in the range 0--numStrings-1
  array_t *finalStates;

  // for performance we keep the set of final states ina bit vector
  // this makes for quick checks of whether a state is a final state
  // var_set_t *finalStatesVarSet; 
  u_int8_t *finalStatesVarSet;
  int *stateCount;      // use to see which states are visited the most frequently
};

typedef struct Evl_Fsm_t Evl_Fsm_t;


/** \brief  Need the typedefs below because C will
  not allow Evl_Manager_t to refer to Evl_TcpMaanger_t before
  it's declared, even as a pointer, and vice versa.
*/

typedef struct Evl_L4Manager_t Evl_L4Manager_t;
typedef struct Evl_GenericManager_t Evl_GenericManager_t;
typedef struct Evl_Bridge_t Evl_Bridge_t;


/**
  * \brief  A representation of rules and corresponding lookup table
  *
  * We will often refer to a rule by its index into the allRules array,
  * which is just the string formula of the rule.
  * 
  * For now we are assuming that the rules are partitioned into three
  * sets: those that depend on dest port, those that depend on src but
  * not dest, and those that depend on neither source nor destination.
  * 
  * The variable ordering is taken to be destPort < srcPort <  destIp < srcIp
  * for all the BDDs.
  * 
  * The destPort bits are MSB to LSB in the BDD, ditto for the other port
  * and IP bits.  This will also help with the actual lookup.
  * 
  * The distinctL4RulesTable keeps track of the distinct L4 rules
  * we've seen - it maps the BDD to an int id, which can be used
  * to index into L4RuleIdToL7ruleSetTable, which tells us for a
  * given L4 rule what the original rules were - the set of corresponding
  * rules is represented by a var_set_t of length numAllRules.
  * 
  * There are three arrays of L4 lookup tables - one for each of 
  * the groups - destPortRules, srcPortRules, noPortRules.  
  * See the  L4 lookup table structure for details.
  * 
  */

struct Evl_Manager_t
{

  array_t *rawRulesAndMacrosArray;  // of strings
  st_table *defineTable;    // maps macros (char *s) to their defn (also a char *)

  array_t *rawRules;        // of char *s - it's the text of the rules
  int numAllRules;      // equal to array_n( rawRules )

  int numPreprocessRules;
  int indexFirstContentRule;
  int indexLastContentRule;

  Evl_L4Manager_t *tcpMgr;
  Evl_L4Manager_t *udpMgr;
  Evl_L4Manager_t *icmpMgr;
  Evl_L4Manager_t *ipMgr;
  Evl_GenericManager_t *genericMgr; // used for rules that are in the generic category

  Evl_Bridge_t *bridge;

  array_t *rlpActionArray;  // of Rlp_Action_t, equal in length to num of rules
  array_t *actionArray;     // of Evl_Action_t, equal in length to num of rules
  st_table *queueTable;     // maps queue names (char *s) to a string encoding the queue parameters
  Heap_t *qHeap;

  Tcl_Interp *interp;       // used for implementing user-defined tcl commands
  ClientData cd;        // used to pass around wrappers to raw pointers

  st_table *ucodeNameToFunction;

  // these have been moved from Evl_ComputeRuleSetForEth
  // to avoid having global state, keep the system re-entrant
  array_t *preprocessorResult;
  array_t *genericResult;
  array_t *layer3Result;
  array_t *layer4Result;

};

typedef struct Evl_Manager_t Evl_Manager_t;


/** \brief  Struct encoding the action to be taken.  */

struct Evl_Action_t
{

  Rlp_Action_t *parsedAction;

  Pkt_LibNet_t *outIf;
  Q_Q_t *queue;
};

typedef struct Evl_Action_t Evl_Action_t;


/** \brief Generic checks */

struct Evl_GenericManager_t
{

  Evl_Manager_t *mgr;

  array_t *tcpIdToGlobalId; // maps rule id to id in the set of all rules. it's not a tcp rule but we use tcp for consistent nomenclature
  array_t *L7RuleArray;

  int numAllRules;

};


/** \brief Everything needed to check TCP packets */

struct Evl_L4Manager_t
{

  Evl_Manager_t *mgr;

  array_t *L4RuleArray;     // of Rlp_L4Rule_t, equal in length to num of TCP rules
  array_t *L7RuleArray;     // of Rlp_Formula_t, equal in length to num of TCP rules

  array_t *contentChecks;   // of array_t *; each array entry is of Rlp_L7Check_t *
  // contentChecks is equal in length to num of TCP rules

  Evl_ContentMgr_t *cm;     // content manager

  array_t *tcpIdToGlobalId; // maps TCP rule id to id in the set of all rules

  int numAllRules;

  bdd_manager *bddMgr;
  int numDistinctL4Rules;   // it's st_count( distinctL4RulesTable ), but convenient
  st_table *distinctL4RulesTable;   // bdd_t mapped to int id
  array_t *ruleToL4Bdd;     // array of bdd_t's, indexed by rule id
  array_t *L4RuleIdToL7ruleSetTable;    // l4 rule to set of corresp orig rules

  Evl_L4LookupTable_t *destPortRuleTable;
  Evl_L4LookupTable_t *srcPortRuleTable;
  Evl_L4LookupTable_t *noPortRuleTable;

  Evl_L4LookupTable_t *noContentCheckTable;
  Evl_L4LookupTable_t *shortStringRuleTable;

  Evl_Fsm_t *fsm;
  var_set_t *fsmAcceptingStates;    // tells us which fsm states are accepting
  var_set_t **fsmStateToRuleSet;    // given an fsm state, returns set of rules
  // that are matched by this state (specifically
  // yields rule that have the string that got
  // us to this state as their longest string)

  // these are entries that are used when computing
  // applicable rulesets.  we include them in the struct
  // to avoid expesive allocation/deallocation per eval
  array_t *potentialRulesFromFsm;
  array_t *rulesFromFsm;
  array_t *rulesFromShortStringTable;
  array_t *rulesFromNoContentTable;
};


/** \brief  Encapsulate L4 flow information
  specifically destPort,
  srcPort, destIP, srcIP
  
*/

struct Evl_L4Flow_t
{
  u_int16_t destPort;
  u_int16_t srcPort;
  u_int32_t destIp;
  u_int32_t srcIp;
};

typedef struct Evl_L4Flow_t Evl_L4Flow_t;

/** \brief Structure encapsulating various stats, used
  for testing purposes.
*/

struct Evl_BridgeStats_t
{
  util_timing_t startTime;
  util_timing_t finishTime;
  int numEntered;
  int numExited;
  int bytesWritten;
  int numDroppedAtWrite;
  int numDroppedFullRuleCacheArray;
  int numDroppedFullActionBuf;
  int numDroppedFullQueue;
  int numDroppedFullObuf;
  int numDroppedFullIbuf;
  int numDroppedBecauseOfAction;
  int numDroppedOverRate;
  int numDroppedOverFlowRate;
  util_timing_t firstPktRead;
  util_timing_t lastPktWritten;
  array_t *pcapInfo;
};

typedef struct Evl_BridgeStats_t Evl_BridgeStats_t;

/** \brief Basic structure used for pulling packets in and out */

struct Evl_Bridge_t
{
  Circbuf_t *iBuf;
  Circbuf_t *oBuf;
  Circbuf_t *ppCache;

  array_t *inArray;
  array_t *outArray;

  Pkt_LibPcap_t *activeInputInterface;
  Evl_BridgeStats_t *stats;
};


/**AutomaticStart*************************************************************/

/*---------------------------------------------------------------------------*/
/* Extern function prototypes                                                */
/*---------------------------------------------------------------------------*/

extern Heap_t *Evl_AllocateQueueHeap (st_table * queueTable);
extern int Evl_CompressDecompress (Pkt_EthernetHdr_t * pkt, int length,
                   Rlp_ActionEnum_t type);
extern int Evl_Decompress (Pkt_EthernetHdr_t * pkt, int length);
extern int Evl_Compress (Pkt_EthernetHdr_t * pkt, int length);
extern void Evl_Crypto (Evl_Action_t * action, Pkt_ProcessPkt_t * pp,
            Rlp_ActionEnum_t type);
extern void Evl_EncryptPkt (Evl_Action_t * action, Pkt_ProcessPkt_t * pp );
extern void Evl_DecryptPkt (Evl_Action_t * action, Pkt_ProcessPkt_t * pp );
extern void Evl_RoutePkt (Evl_Action_t * action, Evl_Bridge_t * bridge,
              Pkt_ProcessPkt_t * pp);
extern void Evl_UscriptAction (Rlp_Action_t * action, Evl_Manager_t * mgr,
                   Pkt_ProcessPkt_t * pp);
extern int Evl_UcodeAction (Rlp_Action_t * action, Evl_Manager_t * mgr,
                 Pkt_ProcessPkt_t * pp);
extern int Evl_ComputeL7RuleSet (Evl_L4LookupTable_t * aRuleTable,
                 Evl_L4Flow_t * aFlow);
extern util_int_array_t *Evl_ComputeL7RuleArray (Evl_L4LookupTable_t *
                         aRuleTable,
                         Evl_L4Flow_t * aFlow);
extern void Evl_ComputeRuleSetForEth (Pkt_ProcessPkt_t * pp,
                      Evl_Manager_t * globalMgr);
extern void Evl_L4ComputeRuleSetForEth (Pkt_ProcessPkt_t * pp,
                    Evl_L4Manager_t * l4mgr,
                    array_t * result);
extern int Evl_EthEvalL7RuleContentCheck (Pkt_EthernetHdr_t * anEth,
                      array_t * aL7CheckArray);
extern void Evl_EvalRuleArray (Evl_L4Manager_t * mgr, Pkt_ProcessPkt_t * pp,
                   array_t * ruleArray,
                   util_int_array_t * ruleIntArray,
                   array_t * result);
extern bool Evl_EthEvalL7Rule (Pkt_ProcessPkt_t * pp,
                   Rlp_Formula_t * aL7Formula,
                   array_t * aL7CheckArray);
extern void Evl_PktDecompress (Evl_L4Manager_t * l4mgr,
                   Pkt_ProcessPkt_t * pp);
extern void Evl_PktDecrypt (Evl_L4Manager_t * l4mgr, Pkt_ProcessPkt_t * pp);
extern Evl_Fsm_t *Evl_BuildPrefixAutomaton (array_t * byteArrayArray);
extern int Evl_FsmPrint (Evl_Fsm_t * anFsm);
extern int Evl_FsmProcessAcceptingState (Evl_Fsm_t * fsm, u_int32_t ps,
                     st_table * stringToId,
                     array_t * idToRules,
                     var_set_t * set1, var_set_t * set2,
                     var_set_t * set3,
                     array_t * resultPtr);
extern void Evl_FsmComputeRules (Evl_Fsm_t * fsm, st_table * stringToId,
                 array_t * idToRules, var_set_t * set1,
                 var_set_t * set2, var_set_t * set3,
                 char *payload, int length, array_t * result);
extern int Evl_Route (Evl_Manager_t * aMgr, array_t * pktArray, int iBufSize,
              int ppCacheSize, int oBufSize, int actionBufSize,
              int maxNumPktsToRead, int numIterations,
              bool useSynthetic, array_t * inArray,
              array_t * outArray, double basicSlice,
              int getPacketsWeight, int computeActionsWeight,
              int performActionsWeight, int queuingWeight,
              int writePacketsWeight, array_t * ackSeqArray,
              Evl_BridgeStats_t ** statsPtr);
extern int Evl_InsertPacketInQueue (Evl_Manager_t * aMgr, Q_Q_t * aQ,
                    Pkt_ProcessPkt_t * pp,
                    Evl_Action_t * action);
extern int Evl_TestManager (Evl_Manager_t * aMgr);
extern bool Evl_DoAction (Evl_Action_t * action, Evl_Manager_t * mgr,
              Evl_Bridge_t * bridge, Pkt_ProcessPkt_t * pp);
extern void Evl_BridgeInsertPktInIbuf (Evl_Bridge_t * aBridge,
                       Pkt_EthernetHdr_t * aPkt);
extern Evl_Manager_t *Evl_BuildManager (char *ruleFileString,
                    Tcl_Interp * interp, ClientData cd);
extern Evl_Action_t *Evl_AllocAction (Rlp_Action_t * parsedAction);
extern bdd_t *Evl_BuildBddFromL4Formula (Rlp_L4Check_t * L4Check,
                     st_table * defineTable,
                     bdd_manager * bddMgr);
extern bdd_t *Evl_BuildBddForIps (Rlp_Formula_t * srcIp, bdd_manager * bddMgr,
                  st_table * defineTable);
extern bdd_t *Evl_BuildBddForPorts (Rlp_Formula_t * portFormula,
                    bdd_manager * bddMgr,
                    st_table * defineTable);
extern bdd_t *Evl_BuildBddForPortRange (int lowPort, int highPort,
                    bdd_manager * bddMgr);
extern int Evl_BddCmp (char *aBdd, char *bBdd);
extern int Evl_BddHash (char *aBdd, int modulus);
extern Evl_L4LookupTable_t *Evl_RuleRelationToLookupTable (bdd_t * TR,
                               Evl_L4Manager_t *
                               L4Mgr,
                               array_t *
                               ruleVarArray);
extern Evl_L4LookupTable_t *Evl_L4BuildLookup (Evl_BddLevelPair_t * root,
                           int numClasses,
                           Evl_L4Manager_t * L4Mgr,
                           st_table * allDecisionNodes);
extern Evl_BddLevelPair_t *Evl_CreateBddLevelPair (bdd_t * aBdd, int level);
extern int Evl_BddLevelPairHash (char *aPtr, int modulus);
extern int Evl_BddLevelPairCmp (char *aPtr, char *bPtr);
extern Evl_L4Manager_t *Evl_L4ManagerAlloc (Evl_Manager_t * mgr, char *mode);
extern Evl_Manager_t *Evl_ManagerAlloc ();
extern int Evl_ManagerFree (Evl_Manager_t * result );
extern Evl_ContentMgr_t *Evl_BuildContentMgr (array_t * L7CheckArray);
extern Evl_ContentMgr_t *Evl_AllocContentMgr ();
extern void Evl_PrintContentMgr (Evl_ContentMgr_t * aCM);
extern int Evl_L4LookupTableAddRuleArrays (Evl_L4LookupTable_t * table);
extern Evl_ContentMgr_t
  * Evl_BuildContentMgrForLowerCaseStrings (Evl_ContentMgr_t * aCM);

/**AutomaticEnd***************************************************************/

#ifdef __cplusplus
}
#endif

#endif /* _EVL */