core

type ConversationInfo struct {
	Data              DataFragments
	Ident             string
	FirstClientPacket time.Time
	FirstServerPacket time.Time

	ClientIP   string
	ServerIP   string
	ClientPort int32
	ServerPort int32

	// CommunityID is the Corelight Community ID v1 for this stream.
	// This provides a standardized flow identifier compatible with
	// Zeek, Suricata, and other network monitoring tools.
	// See: https://github.com/corelight/community-id-spec
	CommunityID string
}

type DataFragments []dataFragment

type DecoderAPI interface {

	// PostInitFunc is called after the decoder has been initialized
	PostInitFunc() error

	// DeInitFunc is called prior to teardown
	DeInitFunc() error

	// GetName returns the name of the decoder
	GetName() string

	// SetWriter sets the netcap writer to use for the decoder
	SetWriter(io.AuditRecordWriter)

	// GetWriter returns the current writer
	GetWriter() io.AuditRecordWriter

	// GetType returns the netcap type of the decoder
	GetType() types.Type

	// GetDescription returns the description of the decoder
	GetDescription() string

	// GetChan returns a channel to receive serialized audit records from the decoder
	GetChan() <-chan []byte

	// Destroy initiates teardown
	Destroy() (string, int64)

	// NumRecords returns the number of processed audit records
	NumRecords() int64

	// FlushCurrentState writes the current state of accumulating records to disk
	// without clearing the in-memory state. This is used during live capture
	// to periodically make data visible while continuing to track state.
	// Returns the number of records flushed.
	FlushCurrentState() int64
}

type StreamData struct {
	// raw binary data
	RawData []byte

	// tcp specific fields
	AssemblerContext reassembly.AssemblerContext
	Dir              reassembly.TCPFlowDirection

	// udp specific fields
	CaptureInformation gopacket.CaptureInfo
	Net                gopacket.Flow
	Trans              gopacket.Flow
}

type StreamDecoderAPI interface {
	DecoderAPI

	// CanDecodeStream determines if this decoder can understand the protocol used
	CanDecodeStream(client []byte, server []byte) bool

	// GetReaderFactory returns a factory for processing streams of the current decoder
	GetReaderFactory() StreamDecoderFactory

	Transport() TransportProtocol
}

type StreamDecoderFactory interface {

	// New StreamDecoderInterface
	New(conversation *ConversationInfo) StreamDecoderInterface
}

type StreamDecoderInterface interface {

	// Decode parses the stream according to the identified protocol.
	Decode()
}

type TransportProtocol int