fixbuf
libfixbuf: public.h File ReferenceGo to the source code of this file.
Macros | |
| #define | FB_CISCO_ASA_EVENT_ID 9998 |
| #define | FB_CISCO_ASA_EVENT_XTRA 9997 |
| #define | FB_CISCO_GENERIC 9999 |
| #define | FB_CONNSPEC_INIT |
| #define | FB_ERROR_BUFSZ 5 |
| #define | FB_ERROR_CONN 11 |
| #define | FB_ERROR_DOMAIN g_quark_from_string("fixbufError") |
| #define | FB_ERROR_EOF 3 |
| #define | FB_ERROR_EOM 2 |
| #define | FB_ERROR_IMPL 6 |
| #define | FB_ERROR_IO 7 |
| #define | FB_ERROR_IPFIX 4 |
| #define | FB_ERROR_LAXSIZE 16 |
| #define | FB_ERROR_NETFLOWV9 12 |
| #define | FB_ERROR_NLREAD 8 |
| #define | FB_ERROR_NLWRITE 9 |
| #define | FB_ERROR_NOELEMENT 10 |
| #define | FB_ERROR_SETUP 15 |
| #define | FB_ERROR_SFLOW 14 |
| #define | FB_ERROR_TMPL 1 |
| #define | FB_ERROR_TRANSMISC 13 |
| #define | FB_IE_BASIC_LIST 291 |
| #define | FB_IE_DEFAULT 0x00000000 |
| #define | FB_IE_DELTACOUNTER 0x00000300 |
| #define | FB_IE_F_ALIEN 0x00000080 |
| #define | FB_IE_F_ENDIAN 0x00000001 |
| #define | FB_IE_F_NONE 0x00000000 |
| #define | FB_IE_F_REVERSIBLE 0x00000040 |
| #define | FB_IE_FLAGS 0x00000500 |
| #define | FB_IE_IDENTIFIER 0x00000400 |
| #define | FB_IE_INIT(_name_, _ent_, _num_, _len_, _flags_) FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, 0, 0, 0, (char*)NULL) |
| #define | FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_) { {(const struct fbInfoElement_st*)_name_}, 0, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_ } |
| #define | FB_IE_LIST 0x00000600 |
| #define | FB_IE_NULL FB_IE_INIT(NULL, 0, 0, 0, 0) |
| #define | FB_IE_PEN_REVERSE 29305 |
| #define | FB_IE_QUANTITY 0x00000100 |
| #define | FB_IE_REVERSE_STR "reverse" |
| #define | FB_IE_REVERSE_STRLEN 7 |
| #define | FB_IE_SEMANTIC(flags) ((flags & 0x0000ff00) >> 8) |
| #define | FB_IE_SNMPCOUNTER 0x00000700 |
| #define | FB_IE_SNMPGAUGE 0x00000800 |
| #define | FB_IE_SUBTEMPLATE_LIST 292 |
| #define | FB_IE_SUBTEMPLATE_MULTILIST 293 |
| #define | FB_IE_TOTALCOUNTER 0x00000200 |
| #define | FB_IE_UNITS(flags) ((flags & 0xFFFF0000) >> 16) |
| #define | FB_IE_VARLEN 65535 |
| #define | FB_IE_VENDOR_BIT_REVERSE 0x4000 |
| #define | FB_IESPEC_NULL { NULL, 0, 0 } |
| #define | FB_LIST_SEM_ALL_OF 0x03 |
| #define | FB_LIST_SEM_EXACTLY_ONE_OF 0x01 |
| #define | FB_LIST_SEM_NONE_OF 0x00 |
| #define | FB_LIST_SEM_ONE_OR_MORE_OF 0x02 |
| #define | FB_LIST_SEM_ORDERED 0x04 |
| #define | FB_LIST_SEM_UNDEFINED 0xFF |
| #define | FB_SPREADPARAMS_INIT { 0, 0, 0 } |
| #define | FB_TID_AUTO 0 |
| #define | FB_TID_MIN_DATA 256 |
| #define | FB_TID_OTS 3 |
| #define | FB_TID_TS 2 |
| #define | FB_UNITS_BITS 0x00010000 |
| #define | FB_UNITS_ENTRIES 0x000C0000 |
| #define | FB_UNITS_FLOWS 0x00040000 |
| #define | FB_UNITS_FRAMES 0x000D0000 |
| #define | FB_UNITS_HOPS 0x000B0000 |
| #define | FB_UNITS_INFERRED 0x000F0000 |
| #define | FB_UNITS_MESSAGES 0x000A0000 |
| #define | FB_UNITS_MICROSECONDS 0x00070000 |
| #define | FB_UNITS_MILLISECONDS 0x00060000 |
| #define | FB_UNITS_NANOSECONDS 0x00080000 |
| #define | FB_UNITS_OCTETS 0x00020000 |
| #define | FB_UNITS_PACKETS 0x00030000 |
| #define | FB_UNITS_PORTS 0x000E0000 |
| #define | FB_UNITS_SECONDS 0x00050000 |
| #define | FB_UNITS_WORDS 0x00090000 |
| #define | FIXBUF_CHECK_VERSION(major, minor, release) |
Enumerations | |
| enum | fbInfoElementDataType_en { FB_OCTET_ARRAY , FB_UINT_8 , FB_UINT_16 , FB_UINT_32 , FB_UINT_64 , FB_INT_8 , FB_INT_16 , FB_INT_32 , FB_INT_64 , FB_FLOAT_32 , FB_FLOAT_64 , FB_BOOL , FB_MAC_ADDR , FB_STRING , FB_DT_SEC , FB_DT_MILSEC , FB_DT_MICROSEC , FB_DT_NANOSEC , FB_IP4_ADDR , FB_IP6_ADDR , FB_BASIC_LIST , FB_SUB_TMPL_LIST , FB_SUB_TMPL_MULTI_LIST } |
| enum | fbTransport_en { FB_SCTP , FB_TCP , FB_UDP , FB_DTLS_SCTP , FB_TLS_TCP , FB_DTLS_UDP } |
Data Structures | |
| struct | fbBasicList_st |
| struct | fbConnSpec_st |
| struct | fbInfoElement_st |
| union | fbInfoElement_st.ref |
| struct | fbInfoElementOptRec_st |
| struct | fbInfoElementSpec_st |
| struct | fbListenerEntry_st |
| struct | fbListenerGroupResult_st |
| struct | fbSpreadParams_st |
| struct | fbSubTemplateList_st |
| union | fbSubTemplateList_st.dataLength |
| struct | fbSubTemplateMultiList_st |
| struct | fbSubTemplateMultiListEntry_st |
| struct | fbVarfield_st |
Detailed Description
Fixbuf IPFIX protocol library public interface.
Typedef Documentation
◆ fBuf_t
| typedef struct fBuf_st fBuf_t |
An IPFIX message buffer.
Used to encode and decode records from IPFIX Messages. The internals of this structure are private to libfixbuf.
◆ fbVarfield_t
| typedef struct fbVarfield_st fbVarfield_t |
A variable-length field value.
Variable-length information element content is represented by an fbVarfield_t on the internal side of the transcoder; that is, variable length fields in an IPFIX Message must be represented by this structure within the application record.
◆ fbInfoModel_t
| typedef struct fbInfoModel_st fbInfoModel_t |
An IPFIX information model.
Contains information element definitions. The internals of this structure are private to libfixbuf.
◆ fbInfoModelIter_t
| typedef GHashTableIter fbInfoModelIter_t |
An iterator over the information elements in an information model.
◆ fbInfoElementDataType_t
| typedef enum fbInfoElementDataType_en fbInfoElementDataType_t |
From RFC 5610: A description of the abstract data type of an IPFIX information element as registered in the IANA IPFIX IE Data Type subregistry.
https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-data-types
◆ fbInfoElement_t
| typedef struct fbInfoElement_st fbInfoElement_t |
A single IPFIX Information Element definition.
An Information Element defines the type of data in each field of a record. This structure may be contained in an fbInfoModel_t, in which case the name field contians the information element name, or an an fbTemplate_t, in which case the canon field references the fbInfoElement_t contained within the Information Model.
◆ fbInfoElementOptRec_t
| typedef struct fbInfoElementOptRec_st fbInfoElementOptRec_t |
The corresponding C struct for a record whose template is the RFC5610 Information Element Type Options Template.
If collecting this record, use the function fbInfoElementAddOptRecElement() to add the fbInfoElement_t it describes to the fbInfoModel_t.
To export RFC5610 elements, use fbSessionSetMetadataExportElements().
◆ fbTemplate_t
| typedef struct fbTemplate_st fbTemplate_t |
An IPFIX Template or Options Template.
Templates define the structure of data records and options records within an IPFIX Message. The internals of this structure are private to libfixbuf.
◆ fbInfoElementSpec_t
| typedef struct fbInfoElementSpec_st fbInfoElementSpec_t |
A single IPFIX Information Element specification.
Used to name an information element (fbInfoElement_t) for inclusion in an fbTemplate_t by fbTemplateAppendSpecArray() and for querying whether a template contains an element via fbTemplateContainsElementByName().
◆ fbSession_t
| typedef struct fbSession_st fbSession_t |
An IPFIX Transport Session state container.
Though Session creation and lifetime are managed by the fbCollector_t and fbExporter_t types, each fBuf_t buffer uses this type to store session state, including internal and external Templates and Message Sequence Number information.
◆ fbTransport_t
| typedef enum fbTransport_en fbTransport_t |
Transport protocol for connection specifier.
◆ fbConnSpec_t
| typedef struct fbConnSpec_st fbConnSpec_t |
Connection specifier.
Used to define a peer address for fbExporter_t, or a passive address for fbListener_t.
◆ fbSpreadParams_t
| typedef struct fbSpreadParams_st fbSpreadParams_t |
Spread connection parameters.
Used to define a spread daemon and group or list of groups for spread.
◆ fbExporter_t
| typedef struct fbExporter_st fbExporter_t |
IPFIX Exporting Process endpoint.
Used to export messages from an associated IPFIX Message Buffer to a remote Collecting Process, or to an IPFIX File. The internals of this structure are private to libfixbuf.
◆ fbCollector_t
| typedef struct fbCollector_st fbCollector_t |
IPFIX Collecting Process endpoint.
Used to collect messages into an associated IPFIX Message Buffer from a remote Exporting Process, or from an IPFIX File. Use this with the fbListener_t structure to implement a full Collecting Process, including Transport Session setup. The internals of this structure are private to libfixbuf.
◆ fbListener_t
| typedef struct fbListener_st fbListener_t |
IPFIX Collecting Process session listener.
Used to wait for connections from IPFIX Exporting Processes, and to manage open connections via a select(2)-based mechanism. The internals of this structure are private to libfixbuf.
◆ fbListenerGroup_t
| typedef struct fbListenerGroup_st fbListenerGroup_t |
Structure that represents a group of listeners.
◆ fbListenerEntry_t
| typedef struct fbListenerEntry_st fbListenerEntry_t |
ListenerEntry's make up an fbListenerGroup_t as a linked list.
◆ fbListenerGroupResult_t
| typedef struct fbListenerGroupResult_st fbListenerGroupResult_t |
A ListenerGroupResult contains the fbListener whose listening socket got a new connection (cf.
fbListenerGroupWait()). It is tied to the fBuf_t that is produced for the connection. These comprise a linked list.
◆ fbTemplateCtxFree_fn
| typedef void(* fbTemplateCtxFree_fn) (void *tmpl_ctx, void *app_ctx) |
A callback function that is called when a template is freed.
This function should be set during the fbNewTemplateCallback_fn.
- Parameters
-
tmpl_ctx a pointer to the ctx that is stored within the fbTemplate. This is the context to be cleaned up. app_ctx the app_ctx pointer that was passed to the fbSessionAddNewTemplateCallback() call. This is for context only and should not be cleaned up.
◆ fbNewTemplateCallback_fn
| typedef void(* fbNewTemplateCallback_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void *app_ctx, void **tmpl_ctx, fbTemplateCtxFree_fn *tmpl_ctx_free_fn) |
A callback function that will be called when the session receives a new external template.
This callback can be used to assign an internal template to an incoming external template for nested template records using fbSessionAddTemplatePair() or to apply some context variable to a template.
The callback should be set using fbSessionAddNewTemplateCallback(), and that function should be called after fbSessionAlloc(). Libfixbuf often clones session upon receiving a connection (particularly in the UDP case since a collector and fbuf can have multiple sessions), and this callback is carried over to cloned sessions.
- Parameters
-
session a pointer to the session that received the template tid the template ID for the template that was received tmpl pointer to the template information of the received template app_ctx the app_ctx pointer that was passed to the fbSessionAddNewTemplateCallback() call tmpl_ctx pointer that is stored in the fbTemplate structure. tmpl_ctx_free_fn a callback function that should be called to free the tmpl_ctx when the template is freed/replaced.
◆ fbBasicList_t
| typedef struct fbBasicList_st fbBasicList_t |
A basic list element in a template which structure represents a basic list on the internal side, basic lists in an IPFIX Message must be represented by this structure within the application record.
◆ fbSubTemplateList_t
| typedef struct fbSubTemplateList_st fbSubTemplateList_t |
Structure used to hold information of a sub template list.
This structure is filled in by the user in an exporter to tell fixbuf how to encode the data. This structure is filled in by the transcoder in a collector, feeding the useful information up to the user
◆ fbSubTemplateMultiListEntry_t
| typedef struct fbSubTemplateMultiListEntry_st fbSubTemplateMultiListEntry_t |
Entries contain the same type of information at SubTemplateLists: template ID and template pointers to describe the data the number of data elements and the data pointer and data length.
Sub template multi lists are inherently nested constructions. At a high level, they are a list of sub template lists. The first level is a list of fbSubTemplateMultiListEntry_t's, which each contain the information that describes the data contained in them. Initializing a fbSubTemplateMultiList_t with a semantic and number of elements returns memory that contains numElements blocks of memory containing fbSubTemplateMultiListEntry_t's. It is not ready to accept data. Each of the fbSubTemplateMultiListEntry_t's needed to be set up then data is copied into the entries.
◆ fbSubTemplateMultiList_t
| typedef struct fbSubTemplateMultiList_st fbSubTemplateMultiList_t |
Multilists just contain the semantic to describe the sub lists, the number of sub lists, and a pointer to the first entry.
◆ fbListenerAppInit_fn
| typedef gboolean(* fbListenerAppInit_fn) (fbListener_t *listener, void **ctx, int fd, struct sockaddr *peer, size_t peerlen, GError **err) |
Application context initialization function type for fbListener_t.
Set this function when creating the fbListener_t with fbListenerAlloc(). This function is called after accept(2) for TCP or SCTP with the peer address in the peer argument. For UDP, it is called during fbListener_t initialization and the peer address will be NULL. If the Collector is in multi-session mode, the appinit function will be called when a new UDP connection occurs with the peer address, similiar to the TCP case. Use fbCollectorSetUDPMultiSession() to turn on multi-session mode (off by default). The application may veto fbCollector_t creation by returning FALSE. In multi-session mode, if the connection is to be ignored, the application should set error code FB_ERROR_NLREAD on the err and return FALSE. If the application returns FALSE, fixbuf will maintain information about that peer, and will reject connections from that peer until shutdown or until that session times out. Fixbuf will return FB_ERROR_NLREAD for previously rejected sessions. The context (returned via out-parameter ctx) will be stored in the fbCollector_t, and is retrievable via a call to fbCollectorGetContext(). If not in multi-session mode and using the appinit fn, the ctx will be associated with all UDP sessions.
◆ fbListenerAppFree_fn
| typedef void(* fbListenerAppFree_fn) (void *ctx) |
Application context free function type for fbListener_t.
Set this function when creating the fbListener_t with fbListenerAlloc(). For TCP and SCTP collectors, this is called when the connection is closed. If a UDP Collector is in multi-session mode (see appinit fn), then the appfree function is called if a session is timed out (does not receive a UDP message for more than 30 minutes.) Called during fbCollector_t cleanup.
Macro Definition Documentation
◆ FIXBUF_CHECK_VERSION
| #define FIXBUF_CHECK_VERSION | ( | major, | |
| minor, | |||
| release | |||
| ) |
Evaluates to a non-zero value if the version number of libfixbuf is at least major.minor.release.
◆ FB_ERROR_DOMAIN
| #define FB_ERROR_DOMAIN g_quark_from_string("fixbufError") |
All fixbuf errors are returned within the FB_ERROR_DOMAIN domain.
◆ FB_ERROR_TMPL
| #define FB_ERROR_TMPL 1 |
No template was available for the given template ID.
◆ FB_ERROR_EOM
| #define FB_ERROR_EOM 2 |
End of IPFIX message.
Either there are no more records present in the message on read, or the message MTU has been reached on write.
◆ FB_ERROR_EOF
| #define FB_ERROR_EOF 3 |
End of IPFIX Message stream.
No more messages are available from the transport layer on read, either because the session has closed, or the file has been processed.
◆ FB_ERROR_IPFIX
| #define FB_ERROR_IPFIX 4 |
Illegal IPFIX message content on read.
The input stream is malformed, or is not an IPFIX Message after all.
◆ FB_ERROR_BUFSZ
| #define FB_ERROR_BUFSZ 5 |
A message was received larger than the collector buffer size.
Should never occur. This condition is checked at the transport layer in case future versions of fixbuf support dynamic buffer sizing.
◆ FB_ERROR_IMPL
| #define FB_ERROR_IMPL 6 |
The requested feature is not yet implemented.
◆ FB_ERROR_IO
| #define FB_ERROR_IO 7 |
An unspecified I/O error occured.
◆ FB_ERROR_NLREAD
| #define FB_ERROR_NLREAD 8 |
No data is available for reading from the transport layer.
Either a transport layer read was interrupted, or timed out.
◆ FB_ERROR_NLWRITE
| #define FB_ERROR_NLWRITE 9 |
An attempt to write data to the transport layer failed due to closure of the remote end of the connection.
Currently only occurs with the TCP transport layer.
◆ FB_ERROR_NOELEMENT
| #define FB_ERROR_NOELEMENT 10 |
The specified Information Element does not exist in the Information Model.
◆ FB_ERROR_CONN
| #define FB_ERROR_CONN 11 |
A connection or association could not be established or maintained.
◆ FB_ERROR_NETFLOWV9
| #define FB_ERROR_NETFLOWV9 12 |
Illegal NetflowV9 content on a read.
Can't parse the Netflow header or the stream is not a NetflowV9 stream
◆ FB_ERROR_TRANSMISC
| #define FB_ERROR_TRANSMISC 13 |
Miscellaneous error occured during translator operation.
◆ FB_ERROR_SFLOW
| #define FB_ERROR_SFLOW 14 |
Illegal sFlow content on a read.
◆ FB_ERROR_SETUP
| #define FB_ERROR_SETUP 15 |
Setup error.
◆ FB_ERROR_LAXSIZE
| #define FB_ERROR_LAXSIZE 16 |
Internal template with defaulted element sizes.
◆ FB_IE_INIT_FULL
| #define FB_IE_INIT_FULL | ( | _name_, | |
| _ent_, | |||
| _num_, | |||
| _len_, | |||
| _flags_, | |||
| _min_, | |||
| _max_, | |||
| _type_, | |||
| _desc_ | |||
| ) | { {(const struct fbInfoElement_st*)_name_}, 0, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_ } |
Convenience macro for creating full fbInfoElement_t static initializers.
Used for creating information element arrays suitable for passing to fbInfoModelAddElementArray().
◆ FB_IE_INIT
| #define FB_IE_INIT | ( | _name_, | |
| _ent_, | |||
| _num_, | |||
| _len_, | |||
| _flags_ | |||
| ) | FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, 0, 0, 0, (char*)NULL) |
Convenience macro for creating default fbInfoElement_t static initializers.
Used for creating information element arrays suitable for passing to fbInfoModelAddElementArray().
- Deprecated:
- Use FB_IE_INIT_FULL instead.
◆ FB_IE_NULL
| #define FB_IE_NULL FB_IE_INIT(NULL, 0, 0, 0, 0) |
Convenience macro defining a null fbInfoElement_t initializer to terminate a constant information element array for passing to fbInfoModelAddElementArray().
◆ FB_IE_SEMANTIC
| #define FB_IE_SEMANTIC | ( | flags | ) | ((flags & 0x0000ff00) >> 8) |
Convenience macro for extracting the information element semantic value from the flags member of the fbInfoElement_t struct.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-semantics
◆ FB_IE_UNITS
| #define FB_IE_UNITS | ( | flags | ) | ((flags & 0xFFFF0000) >> 16) |
Convenience macro for extracting the information element units value from the flags member of the fbInfoElement_t struct.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-units.
◆ FB_IE_F_NONE
| #define FB_IE_F_NONE 0x00000000 |
Default treatment flags value.
Provided for initializer convenience. Corresponds to octet-array semantics for a non-reversible, non-alien IE.
◆ FB_IE_F_ENDIAN
| #define FB_IE_F_ENDIAN 0x00000001 |
Information element endian conversion bit in the flags member of fbInfoElement_t.
If set, IE is an integer and will be endian-converted on transcode.
◆ FB_IE_F_REVERSIBLE
| #define FB_IE_F_REVERSIBLE 0x00000040 |
Information element reversible bit in the flags member of fbInfoElement_t.
Adding the information element via fbInfoModelAddElement() or fbInfoModelAddElementArray() will cause a second, reverse information element to be added to the model following the conventions in IETF RFC 5103. This means that, if there is no enterprise number, the reverse element will get an enterprise number of FB_IE_PEN_REVERSE, and if there is an enterprise number, the reverse element's numeric identifier will have its FB_IE_VENDOR_BIT_REVERSE bit set.
◆ FB_IE_F_ALIEN
| #define FB_IE_F_ALIEN 0x00000080 |
Information element alien bit in the flags member of fbInfoElement_t.
If set, IE is enterprise-specific and was recieved via an external template at a Collecting Process. It is therefore subject to semantic typing via options (not yet implemented). Do not set this flag on information elements added programmatically to an information model via fbInfoModelAddElement() or fbInfoModelAddElementArray().
◆ FB_IE_QUANTITY
| #define FB_IE_QUANTITY 0x00000100 |
An Information Element Semantics Flags used to describe an information element as a quantity.
◆ FB_IE_TOTALCOUNTER
| #define FB_IE_TOTALCOUNTER 0x00000200 |
An Information Element Semantics Flags used to describe an information element as a totalCounter.
◆ FB_IE_DELTACOUNTER
| #define FB_IE_DELTACOUNTER 0x00000300 |
An Information Element Semantics Flag used to describe an information element as a deltaCounter.
◆ FB_IE_IDENTIFIER
| #define FB_IE_IDENTIFIER 0x00000400 |
An Information Element Semantics Flag used to describe an information element as an identifier.
◆ FB_IE_FLAGS
| #define FB_IE_FLAGS 0x00000500 |
An Information Element Semantics Flag used to describe an information element as a flags element.
◆ FB_IE_LIST
| #define FB_IE_LIST 0x00000600 |
An Information Element Semantics Flag used to describe an information element as a List Element.
◆ FB_IE_SNMPCOUNTER
| #define FB_IE_SNMPCOUNTER 0x00000700 |
An Information Element Semantics Flag used to describe an information element as an SNMP counter.
◆ FB_IE_SNMPGAUGE
| #define FB_IE_SNMPGAUGE 0x00000800 |
An Information Element Semantics Flag used to describe an information element as a SNMP gauge.
◆ FB_IE_DEFAULT
| #define FB_IE_DEFAULT 0x00000000 |
An Information Element Semantics Flag used to describe an information element as a Default element.
◆ FB_UNITS_BITS
| #define FB_UNITS_BITS 0x00010000 |
Information Element Units - See RFC 5610.
An Information Element Units Flag used to describe the units of an information element. See RFC 5610
◆ FB_UNITS_OCTETS
| #define FB_UNITS_OCTETS 0x00020000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_PACKETS
| #define FB_UNITS_PACKETS 0x00030000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_FLOWS
| #define FB_UNITS_FLOWS 0x00040000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_SECONDS
| #define FB_UNITS_SECONDS 0x00050000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_MILLISECONDS
| #define FB_UNITS_MILLISECONDS 0x00060000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_MICROSECONDS
| #define FB_UNITS_MICROSECONDS 0x00070000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_NANOSECONDS
| #define FB_UNITS_NANOSECONDS 0x00080000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_WORDS
| #define FB_UNITS_WORDS 0x00090000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_MESSAGES
| #define FB_UNITS_MESSAGES 0x000A0000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_HOPS
| #define FB_UNITS_HOPS 0x000B0000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_ENTRIES
| #define FB_UNITS_ENTRIES 0x000C0000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5610
◆ FB_UNITS_FRAMES
| #define FB_UNITS_FRAMES 0x000D0000 |
An Information Element Units Flag used to describe the units of an information element.
Added for layer 2 frames
◆ FB_UNITS_PORTS
| #define FB_UNITS_PORTS 0x000E0000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 8045.
◆ FB_UNITS_INFERRED
| #define FB_UNITS_INFERRED 0x000F0000 |
An Information Element Units Flag used to describe the units of an information element.
See RFC 5477.
◆ FB_IE_VARLEN
| #define FB_IE_VARLEN 65535 |
Information element length constant for variable-length IE.
◆ FB_IE_BASIC_LIST
| #define FB_IE_BASIC_LIST 291 |
Information element number constant for basic lists.
This may change upon updates to the specification.
- Deprecated:
- Collectors should use the
typemember of the fbInfoElement_t or use fbInfoModelGetElementByName() to query the fbInfoModel_t, and libfixbuf will remove this value in a future release.
◆ FB_IE_SUBTEMPLATE_LIST
| #define FB_IE_SUBTEMPLATE_LIST 292 |
Information element number constant for sub template lists.
This may change upon updates to the IPFIX lists specification.
- Deprecated:
- Collectors should use the
typemember of the fbInfoElement_t or use fbInfoModelGetElementByName() to query the fbInfoModel_t, and libfixbuf will remove this value in a future release.
◆ FB_IE_SUBTEMPLATE_MULTILIST
| #define FB_IE_SUBTEMPLATE_MULTILIST 293 |
Information element number constant for sub template multi lists.
This may change upon updates to the IPFIX lists specification.
- Deprecated:
- Collectors should use the
typemember of the fbInfoElement_t or use fbInfoModelGetElementByName() to query the fbInfoModel_t, and libfixbuf will remove this value in a future release.
◆ FB_IE_PEN_REVERSE
| #define FB_IE_PEN_REVERSE 29305 |
Private enterprise number for reverse information elements (see RFC 5103 section 6.1).
If an information element with FB_IE_F_REVERSIBLE and a zero enterprise number (i.e., an IANA-assigned information element) is added to a model, the reverse IE will be generated by setting the enterprise number to this constant.
◆ FB_IE_VENDOR_BIT_REVERSE
| #define FB_IE_VENDOR_BIT_REVERSE 0x4000 |
Reverse information element bit for vendor-specific information elements (see RFC 5103 section 6.2).
If an information element with FB_IE_F_REVERSIBLE and a non-zero enterprise number (i.e., a vendor-specific information element) is added to a model, the reverse IE number will be generated by ORing this bit with the given forward information element number.
◆ FB_CISCO_GENERIC
| #define FB_CISCO_GENERIC 9999 |
Generic Information Element ID for undefined Cisco NetFlow v9 Elements.
◆ FB_CISCO_ASA_EVENT_ID
| #define FB_CISCO_ASA_EVENT_ID 9998 |
Information Element ID for Cisco NSEL Element NF_F_FW_EVENT often exported by Cisco's ASA Device.
This must be converted to a different Information Element ID due to the reverse IE bit in IPFIX. Cisco uses IE ID 40005. http://www.cisco.com/en/US/docs/security/asa/asa82/netflow/netflow.html
◆ FB_CISCO_ASA_EVENT_XTRA
| #define FB_CISCO_ASA_EVENT_XTRA 9997 |
Information Element ID for Cisco NSEL Element NF_F_FW_EXT_EVENT often exported by Cisco's ASA Device.
This must be converted to a different Information Element ID due to the reverse IE bit in IPFIX. Cisco uses IE ID 33002 http://www.cisco.com/en/US/docs/security/asa/asa82/netflow/netflow.html More Information about event codes can be found here: http://www.cisco.com/en/US/docs/security/asa/asa84/system/netflow/netflow.pdf
◆ FB_IE_REVERSE_STR
| #define FB_IE_REVERSE_STR "reverse" |
Reverse information element name prefix.
This string is prepended to an information element name, and the first character after this string is capitalized, when generating a reverse information element.
◆ FB_IE_REVERSE_STRLEN
| #define FB_IE_REVERSE_STRLEN 7 |
Length of reverse information element name prefix.
◆ FB_TID_AUTO
| #define FB_TID_AUTO 0 |
Template ID argument used when adding an fbTemplate_t to an fbSession_t that automatically assigns a template ID.
Functions that accept this value include fbSessionAddTemplate(), fbSessionAddTemplatesMulticast(), and others.
For internal templates, FB_TID_AUTO starts from 65535 and decrements. For external templates, FB_TID_AUTO starts from 256 and increments. This is to avoid inadvertant unrelated external and internal templates having the same ID.
◆ FB_TID_TS
| #define FB_TID_TS 2 |
Reserved set ID for template sets, per RFC 7011.
◆ FB_TID_OTS
| #define FB_TID_OTS 3 |
Reserved set ID for options template sets, per RFC 7011.
◆ FB_TID_MIN_DATA
| #define FB_TID_MIN_DATA 256 |
Minimum non-reserved template ID available for data sets, per RFC 7011.
◆ FB_IESPEC_NULL
| #define FB_IESPEC_NULL { NULL, 0, 0 } |
Convenience macro defining a null information element specification initializer (fbInfoElementSpec_t) to terminate a constant information element specifier array for passing to fbTemplateAppendSpecArray().
◆ FB_CONNSPEC_INIT
| #define FB_CONNSPEC_INIT |
Convenience macro defining a null static fbConnSpec_t.
◆ FB_SPREADPARAMS_INIT
| #define FB_SPREADPARAMS_INIT { 0, 0, 0 } |
Initialization macro for fbSpreadParams_t.
◆ FB_LIST_SEM_UNDEFINED
| #define FB_LIST_SEM_UNDEFINED 0xFF |
The following Semantic values are for use in the structured Data Types: basicLists, subTemplateLists, and subTemplateMultiLists.
Semantic field for indicating the value has not been set
◆ FB_LIST_SEM_NONE_OF
| #define FB_LIST_SEM_NONE_OF 0x00 |
Semantic field for none-of value defined in RFC 6313.
◆ FB_LIST_SEM_EXACTLY_ONE_OF
| #define FB_LIST_SEM_EXACTLY_ONE_OF 0x01 |
Semantic field for exactly-one-of value defined in RFC 6313.
◆ FB_LIST_SEM_ONE_OR_MORE_OF
| #define FB_LIST_SEM_ONE_OR_MORE_OF 0x02 |
Semantic field for the one-or-more-of value defined in RFC 6313.
◆ FB_LIST_SEM_ALL_OF
| #define FB_LIST_SEM_ALL_OF 0x03 |
Semantic field for the all-of value defined in RFC 6313.
◆ FB_LIST_SEM_ORDERED
| #define FB_LIST_SEM_ORDERED 0x04 |
Semantic field for the ordered value defined in RFC 6313.
Enumeration Type Documentation
◆ fbInfoElementDataType_en
From RFC 5610: A description of the abstract data type of an IPFIX information element as registered in the IANA IPFIX IE Data Type subregistry.
https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-data-types
◆ fbTransport_en
| enum fbTransport_en |
Transport protocol for connection specifier.
Function Documentation
◆ fbListValidSemantic()
| gboolean fbListValidSemantic | ( | uint8_t | semantic | ) |
Validates the value of a structured data types semantic field, as defined in RFC 6313 and listed at IANA.
- Parameters
-
semantic The value of the semantic field to be checked
- Returns
- TRUE if valid (0xFF, 0x00-0x04), FALSE otherwise
◆ fbBasicListAlloc()
| fbBasicList_t * fbBasicListAlloc | ( | void | ) |
Allocates and returns an empty Basic List Structure.
- Returns
- a pointer to the allocated basic list in memory
◆ fbBasicListInit()
| void * fbBasicListInit | ( | fbBasicList_t * | basicList, |
| uint8_t | semantic, | ||
| const fbInfoElement_t * | infoElement, | ||
| uint16_t | numElements | ||
| ) |
Initializes the basic list structure based on the parameters.
This function allocates a buffer large enough to hold num elements amount of the infoElements.
- Parameters
-
basicList a pointer to the basic list structure to fill semantic the semantic value to be used in the basic list infoElement a pointer to the info element to be used in the list numElements number of elements in the list
- Returns
- a pointer to the memory where the list data is to be written
◆ fbBasicListInitWithOwnBuffer()
| void * fbBasicListInitWithOwnBuffer | ( | fbBasicList_t * | basicList, |
| uint8_t | semantic, | ||
| const fbInfoElement_t * | infoElement, | ||
| uint16_t | numElements, | ||
| uint16_t | dataLength, | ||
| uint8_t * | dataPtr | ||
| ) |
use this function to initialize the basic list, but it gets the pointer to a buffer and its length allocated independently from these functions This will generally be used by a collector that does not want to free and allocate new buffers for each incoming message
- Parameters
-
basicList a pointer to the basic list structure to fill semantic the semantic value to be used in the basic list infoElement a pointer to the info element to be used in the list numElements number of elements in the list dataLength length of the buffer passed to the function dataPtr pointer to the buffer previously allocated for the list
- Returns
- a pointer to the beginning of the buffer on success, NULL on failure
◆ fbBasicListCollectorInit()
| void fbBasicListCollectorInit | ( | fbBasicList_t * | basicList | ) |
Initializes a basic list structure for collection.
The key part of this function is it sets the dataPtr to NULL. If your basic list is declared as a pointer, then allocated using something like g_slice_alloc0 which sets it all to zero, you do not need to call this function. But if your basic list struct isn't a pointer, there dataPtr parameter will be set to garbage, which will break other fixbuf calls, so this function is required
- Parameters
-
basicList pointer to the basic list to be initialized
◆ fbBasicListCountElements()
| uint16_t fbBasicListCountElements | ( | const fbBasicList_t * | basicList | ) |
Returns the number of elements the basic list is capable of holding.
- Parameters
-
basicList pointer to the basic list
- Returns
- the number of elements on the basic list
- Since
- libfixbuf 2.3.0
◆ fbBasicListGetSemantic()
| uint8_t fbBasicListGetSemantic | ( | fbBasicList_t * | basicList | ) |
Gets the Semantic field for Basic List.
presumably used in collectors after decoding
- Parameters
-
basicList pointer to the basic list to retrieve the semantic from
- Returns
- the 8-bit semantic value describing the basic list
◆ fbBasicListSetSemantic()
| void fbBasicListSetSemantic | ( | fbBasicList_t * | basicList, |
| uint8_t | semantic | ||
| ) |
Sets the semantic for describing a basic list.
generally used in exporters before decoding
- Parameters
-
basicList pointer to the basic list to set the semantic semantic value to set the semantic field to
◆ fbBasicListGetInfoElement()
| const fbInfoElement_t * fbBasicListGetInfoElement | ( | fbBasicList_t * | basicList | ) |
Returns a pointer to the information element used in the basic list.
It is mainly used in an fbCollector_t to retrieve information.
- Parameters
-
basicList pointer to the basic list to get the infoElement from
- Returns
- pointer to the information element from the list
◆ fbBasicListGetDataPtr()
| void * fbBasicListGetDataPtr | ( | fbBasicList_t * | basicList | ) |
Gets a pointer to the data buffer for the basic list.
- Parameters
-
basicList pointer to the basic list to get the data pointer from
- Returns
- the pointer to the data held by the basic list
◆ fbBasicListGetIndexedDataPtr()
| void * fbBasicListGetIndexedDataPtr | ( | fbBasicList_t * | basicList, |
| uint16_t | index | ||
| ) |
Retrieves the element at position index in the basic list or returns NULL if index is out of range.
The first element is at index 0, and the last at fbBasicListCountElements()-1.
- Parameters
-
basicList pointer to the basic list to retrieve the dataPtr index the index of the element to retrieve (0-based)
- Returns
- a pointer to the data in the index'th slot in the list, or NULL if the index is past the bounds of the list
◆ fbBasicListGetNextPtr()
| void * fbBasicListGetNextPtr | ( | fbBasicList_t * | basicList, |
| void * | currentPtr | ||
| ) |
Retrieves a pointer to the data element in the basicList that follows the one at currentPtr.
Retrieves the first element if currentPtr is NULL. Returns NULL when there are no more elements or when currentPtr is outside the buffer used by the basic list.
- Parameters
-
basicList pointer to the basic list currentPtr pointer to the current element being used. Set to NULL to retrieve the first element.
- Returns
- a pointer to the next data slot, based on the current pointer. NULL if the new pointer is passed the end of the buffer
◆ fbBasicListRealloc()
| void * fbBasicListRealloc | ( | fbBasicList_t * | basicList, |
| uint16_t | newNumElements | ||
| ) |
Potentially reallocates the list's internal buffer and returns a handle to it.
Specifically, when newNumElements differs from fbBasicListCountElements(), frees the current buffer that holds the elements, allocates a new buffer to accomodate newNumElements elements, and returns the buffer. The remaining properties of the list are unchanged. If the number of elements are the same, the existing buffer is returned.
- Parameters
-
basicList pointer to the basic list to realloc newNumElements new number of elements to allocate for the list
- Returns
- pointer to the data pointer for the list after realloc
- See also
- fbBasicListAddNewElements() to add elements to an existing list.
◆ fbBasicListAddNewElements()
| void * fbBasicListAddNewElements | ( | fbBasicList_t * | basicList, |
| uint16_t | numNewElements | ||
| ) |
Allocates numNewElements additional element(s) into the basic list.
May only be called after calling fbBasicListInit().
- Parameters
-
basicList pointer to the basic list to add elements to numNewElements number of elements to add to the list
- Returns
- a pointer to the newly allocated element(s)
◆ fbBasicListClear()
| void fbBasicListClear | ( | fbBasicList_t * | basicList | ) |
Clears the parameters of the basic list and frees the data buffer.
To re-use the basicList after this call, it must be re-initialized via fbBasicListInit() or fbBasicListCollectorInit().
- Parameters
-
basicList pointer to the basic list to clear
- See also
- fBufListFree()
◆ fbBasicListClearWithoutFree()
| void fbBasicListClearWithoutFree | ( | fbBasicList_t * | basicList | ) |
Clears the parameters of the basic list, but does not free the buffer.
This should get used when the user provides their own buffer (fbBasicListInitWithOwnBuffer()).
- Parameters
-
basicList pointer to the basic list to clear without freeing
◆ fbBasicListFree()
| void fbBasicListFree | ( | fbBasicList_t * | basicList | ) |
Clears the basic list (fbBasicListClear()), then frees the basic list itself.
This is typically paired with fbBasicListAlloc(), and it not normally needed.
- Parameters
-
basicList pointer to the basic list to free
◆ fbSubTemplateListAlloc()
| fbSubTemplateList_t * fbSubTemplateListAlloc | ( | void | ) |
Allocates and returns an empty subTemplateList structure.
Based on how subTemplateLists will be used and set up amidst data structures, this function may never be used.
- Returns
- pointer to the new sub template list
◆ fbSubTemplateListInit()
| void * fbSubTemplateListInit | ( | fbSubTemplateList_t * | sTL, |
| uint8_t | semantic, | ||
| uint16_t | tmplID, | ||
| const fbTemplate_t * | tmpl, | ||
| uint16_t | numElements | ||
| ) |
Initializes a subTemplateList structure and allocates the internal buffer to a size capable of holding numElements records matching the template.
This is mainly used when preparing to encode data for output by an fbExporter_t. When reading data, use fbSubTemplateListCollectorInit() to initialize the subTemplateList. The tmpl should exist on the fbSession_t that will be used when exporting the record holding this subTemplateList.
- Parameters
-
sTL pointer to the sub template list to initialize semantic the semantic value used to describe the list contents tmplID id of the template used for encoding the list data tmpl pointer to the template struct used for encoding the list data numElements number of elements in the list
- Returns
- a pointer to the allocated buffer (location of first element)
- See also
- fbSubTemplateListInitWithOwnBuffer() to manage the memory yourself.
◆ fbSubTemplateListInitWithOwnBuffer()
| void * fbSubTemplateListInitWithOwnBuffer | ( | fbSubTemplateList_t * | subTemplateList, |
| uint8_t | semantic, | ||
| uint16_t | tmplID, | ||
| const fbTemplate_t * | tmpl, | ||
| uint16_t | numElements, | ||
| uint16_t | dataLength, | ||
| uint8_t * | dataPtr | ||
| ) |
Initializes the subTemplateList but does not allocate a buffer.
It accepts a previously allocated buffer and data length and uses it. This will generally be used in collectors providing their own buffer
- Parameters
-
subTemplateList pointer to the sub template list to initialize semantic the semantic value used to describe the list contents tmplID id of the template used for encoding the list data tmpl pointer to the template struct used for encoding the list data numElements number of elements in the list dataLength length of the data buffer dataPtr pointer to the previously allocated data buffer
- Returns
- a pointer to that buffer
- See also
- fbSubTemplateListInit() to have libfixbuf manage the memory.
◆ fbSubTemplateListCollectorInit()
| void fbSubTemplateListCollectorInit | ( | fbSubTemplateList_t * | STL | ) |
Initializes a sub template list variable on a fbCollector_t.
If the fbSubTemplateList variable is in a struct, it will likely not be set to 0's If not, the dataPtr will not be NULL, so the transcoder will not allocate the right memory for it, as it will assuming it's set up. This will break. Call this function right after declaring the struct variable that contains the fbSubTemplateList. It only needs to be called once for each STL.
When using an fbExporter_t, use fbSubTemplateListInit() to initialize the subTemplateList.
- Parameters
-
STL pointer to the sub template list to initialize for collection
◆ fbSubTemplateListGetDataPtr()
| void * fbSubTemplateListGetDataPtr | ( | const fbSubTemplateList_t * | subTemplateList | ) |
Returns a pointer to the buffer that contains the data for the list.
- Parameters
-
subTemplateList pointer to the STL to get the pointer from
- Returns
- a pointer to the data buffer used by the sub template list
◆ fbSubTemplateListGetIndexedDataPtr()
| void * fbSubTemplateListGetIndexedDataPtr | ( | const fbSubTemplateList_t * | subTemplateList, |
| uint16_t | index | ||
| ) |
Returns the data for the record at position index in the sub template list, or returns NULL if index is out of range.
The first element is at index 0, the last at fbSubTemplateListCountElements()-1.
- Parameters
-
subTemplateList pointer to the STL index The index of the element to be retrieved (0-based)
- Returns
- a pointer to the desired element, or NULL when out of range
◆ fbSubTemplateListGetNextPtr()
| void * fbSubTemplateListGetNextPtr | ( | const fbSubTemplateList_t * | subTemplateList, |
| void * | currentPtr | ||
| ) |
Retrieves a pointer to the data record in the sub template list that follows the one at currentPtr.
Retrieves the first record if currentPtr is NULL. Returns NULL when there are no more records or when currentPtr is outside the buffer used by the sub template list.
- Parameters
-
subTemplateList pointer to the STL to get data from currentPtr pointer to the last element accessed. NULL causes the pointer to the first element to be returned
- Returns
- the pointer to the next element in the list. Returns NULL if currentPtr points to the last element in the list.
◆ fbSubTemplateListCountElements()
| uint16_t fbSubTemplateListCountElements | ( | const fbSubTemplateList_t * | subTemplateList | ) |
Returns the number of elements the sub template list is capable of holding.
- Parameters
-
subTemplateList pointer to the sub template list
- Returns
- the number of records on the sub template list
- Since
- libfixbuf 2.3.0
◆ fbSubTemplateListSetSemantic()
| void fbSubTemplateListSetSemantic | ( | fbSubTemplateList_t * | subTemplateList, |
| uint8_t | semantic | ||
| ) |
Sets the semantic parameter of a subTemplateList.
- Parameters
-
subTemplateList pointer to the sub template list semantic Semantic value for the list
◆ fbSubTemplateListGetSemantic()
| uint8_t fbSubTemplateListGetSemantic | ( | fbSubTemplateList_t * | subTemplateList | ) |
Gets the semantic value from a sub template list.
- Parameters
-
subTemplateList pointer to the sub template list
- Returns
- the semantic field from the list
◆ fbSubTemplateListGetTemplate()
| const fbTemplate_t * fbSubTemplateListGetTemplate | ( | fbSubTemplateList_t * | subTemplateList | ) |
Gets the template pointer from the list structure.
- Parameters
-
subTemplateList pointer to the sub template list
- Returns
- a pointer to the template used by the sub template list
◆ fbSubTemplateListGetTemplateID()
| uint16_t fbSubTemplateListGetTemplateID | ( | fbSubTemplateList_t * | subTemplateList | ) |
Gets the template ID for the template used by the list.
- Parameters
-
subTemplateList pointer to the sub template list
- Returns
- the template ID used by the sub template list
◆ fbSubTemplateListRealloc()
| void * fbSubTemplateListRealloc | ( | fbSubTemplateList_t * | subTemplateList, |
| uint16_t | newNumElements | ||
| ) |
Potentially reallocates the list's internal buffer and returns a handle to it.
Specifically, when newNumElements differs from fbSubTemplateListCountElements(), frees the sub template list's internal data-record buffer, allocates a new buffer to accomodate newNumElements elements, and returns the buffer. The remaining properties of the sub template list are unchanged. If the number of elements are the same, the existing buffer is returned. This function does not free any recursive structured-data records used by the existing buffer before reallocating it.
- Parameters
-
subTemplateList pointer to the sub template list to realloc newNumElements value for the new number of elements for the list
- Returns
- pointer to the data buffer after realloc
- See also
- fbSubTemplateListAddNewElements() to add elements to an existing list.
◆ fbSubTemplateListAddNewElements()
| void * fbSubTemplateListAddNewElements | ( | fbSubTemplateList_t * | subTemplateList, |
| uint16_t | numNewElements | ||
| ) |
Allocates space for numNewElements additional element in the subTemplateList.
May only be called after the list has been initialized with fbSubTemplateListInit().
- Parameters
-
subTemplateList pointer to the sub template list numNewElements number of new elements to add to the list
- Returns
- a pointer to the first newly allocated element
◆ fbSubTemplateListClear()
| void fbSubTemplateListClear | ( | fbSubTemplateList_t * | subTemplateList | ) |
Clears a subTemplateList structure, notably freeing the internal buffer and setting it to NULL.
This should be used after each call to fBufNext(): If the dataPtr is not NULL in DecodeSubTemplateList, it will not allocate new memory for the new record, which could cause a buffer overflow if the new record has a longer list than the current one. An alternative is to allocate a large buffer and assign it to dataPtr on your own, then never clear it with this. Be certain this buffer is longer than needed for all possible lists
- Parameters
-
subTemplateList pointer to the sub template list to clear
- See also
- fBufListFree()
◆ fbSubTemplateListClearWithoutFree()
| void fbSubTemplateListClearWithoutFree | ( | fbSubTemplateList_t * | subTemplateList | ) |
Clears the sub template list parameters but does not free the data ptr.
This is used in conjuction with fbSubTemplateListInitWithOwnBuffer() because that buffer is allocated at the beginning by the user and will be freed at the end by the user, outside of fixbuf api calls
- Parameters
-
subTemplateList pointer to the sub template list to clear
◆ fbSubTemplateListFree()
| void fbSubTemplateListFree | ( | fbSubTemplateList_t * | subTemplateList | ) |
Clears the sub template list (fbSubTemplateListClear()) then frees the subTemplateList itself.
This is typically paired with subTemplateListAlloc(), and it is unlikely to be used.
- Parameters
-
subTemplateList pointer to the sub template list to free
◆ fbSubTemplateMultiListAlloc()
| fbSubTemplateMultiList_t * fbSubTemplateMultiListAlloc | ( | void | ) |
Allocates and returns an empty subTemplateMultiList structure.
Based on how subTemplateMultiLists will be used and set up amidst data structures, this function may never be used.
- Returns
- pointer to the new sub template multi list
◆ fbSubTemplateMultiListInit()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListInit | ( | fbSubTemplateMultiList_t * | STML, |
| uint8_t | semantic, | ||
| uint16_t | numElements | ||
| ) |
Initializes the multi list with the list semantic and allocates memory to store numElements entries.
- Parameters
-
STML pointer to the sub template multi list to initialize semantic value used to describe the entries in the multi list numElements number of entries in the multi list
- Returns
- pointer to the first uninitialized entry
◆ fbSubTemplateMultiListCountElements()
| uint16_t fbSubTemplateMultiListCountElements | ( | const fbSubTemplateMultiList_t * | STML | ) |
Returns the number of entries the sub template multi list is capable of holding.
- Parameters
-
STML pointer to the sub template multi list
- Returns
- the number of entries on the sub template multi list
- Since
- libfixbuf 2.3.0
◆ fbSubTemplateMultiListSetSemantic()
| void fbSubTemplateMultiListSetSemantic | ( | fbSubTemplateMultiList_t * | STML, |
| uint8_t | semantic | ||
| ) |
Sets the semantic field for the multi list.
- Parameters
-
STML pointer to the sub template multi list semantic Value for the semantic field of the sub template multi list
◆ fbSubTemplateMultiListGetSemantic()
| uint8_t fbSubTemplateMultiListGetSemantic | ( | fbSubTemplateMultiList_t * | STML | ) |
Gets the semantic paramter from the multi list.
- Parameters
-
STML pointer to the sub template multi list
- Returns
- semantic parameter describing the contents of the multi list
◆ fbSubTemplateMultiListClear()
| void fbSubTemplateMultiListClear | ( | fbSubTemplateMultiList_t * | STML | ) |
Clears all of the fbSubTemplateMultiListEntry_t objects on this STML (see fbSubTemplateMultiListClearEntries()), then frees the memory containing the entries.
- Parameters
-
STML pointer to the sub template mutli list to clear
- See also
- fBufListFree()
◆ fbSubTemplateMultiListClearEntries()
| void fbSubTemplateMultiListClearEntries | ( | fbSubTemplateMultiList_t * | STML | ) |
Clears the memory used by all the entries of a sub template multi list.
That is, it calls fbSubTemplateMultiListEntryClear() for each entry. To free the memory in the STML that holds these entries, call fbSubTemplateMultiListClear().
- Note
- If any of the entries contain another layer of structures, that second layer must be freed by the user, as this function cannot do that. For example, if an entry's template contains an element of type basicList, the memory used by that basicList is not freed by this function.
- Parameters
-
STML pointer to the sub template multi list
◆ fbSubTemplateMultiListFree()
| void fbSubTemplateMultiListFree | ( | fbSubTemplateMultiList_t * | STML | ) |
Clears the multi list (fbSubTemplateMultiListClear()), then frees the STML itself.
This is typically paired with fbSubTemplateMultiListAlloc(), and it not normally needed.
- Parameters
-
STML pointer to the sub template multi list
◆ fbSubTemplateMultiListRealloc()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListRealloc | ( | fbSubTemplateMultiList_t * | STML, |
| uint16_t | newNumEntries | ||
| ) |
Potentially reallocates the list's internal buffer for entries and returns a handle to it.
Specifically, calls fbSubTemplateMultiListClearEntries(), then if newNumElements differs from fbSubTemplateMultiListCountElements(), frees the entries buffer, allocates a new one to accomodate newNumElements entries, and returns the buffer. If the number of elements are the same, the existing buffer is returned.
- Parameters
-
STML pointer to the sub template mutli list newNumEntries the new number of entries for the STML
- Returns
- pointer to the first entry
- See also
- fbSubTemplateMultiListAddNewEntries() to add additional entries to an existing STML.
◆ fbSubTemplateMultiListAddNewEntries()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListAddNewEntries | ( | fbSubTemplateMultiList_t * | STML, |
| uint16_t | numNewEntries | ||
| ) |
Adds numNewElements entries to the multi list of entries.
May only be used after the list has been initialized.
- Parameters
-
STML pointer to the sub template multi list numNewEntries number of entries to add to the list
- Returns
- a pointer to the new entry
◆ fbSubTemplateMultiListGetFirstEntry()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListGetFirstEntry | ( | fbSubTemplateMultiList_t * | STML | ) |
Retrieves the first entry in the multi list.
- Parameters
-
STML pointer to the sub template multi list
- Returns
- pointer to the first entry used by the list
◆ fbSubTemplateMultiListGetIndexedEntry()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListGetIndexedEntry | ( | fbSubTemplateMultiList_t * | STML, |
| uint16_t | index | ||
| ) |
Retrieves a pointer to the entry at a specific index, or returns NULL if index is out of range.
The first entry is at index 0, the last at fbSubTemplateMultiListCountElements()-1.
- Parameters
-
STML pointer to the sub template mutli list index index of the entry to be returned (0-based)
- Returns
- the index'th entry used by the list, or NULL if out of range
◆ fbSubTemplateMultiListGetNextEntry()
| fbSubTemplateMultiListEntry_t * fbSubTemplateMultiListGetNextEntry | ( | fbSubTemplateMultiList_t * | STML, |
| fbSubTemplateMultiListEntry_t * | currentEntry | ||
| ) |
Retrieves a pointer to the entry in the mutli list that follows the one at currentEntry.
Retrieves the first entry if currentEntry is NULL. Returns NULL when there are no more entries or when currentEntry is outside the buffer used by the multi list.
- Parameters
-
STML pointer to the sub template multi list to get data from currentEntry pointer to the last element accessed. NULL means none have been accessed yet
- Returns
- the pointer to the next element in the list. Returns the NULL if currentEntry points to the last entry.
◆ fbSubTemplateMultiListEntryInit()
| void * fbSubTemplateMultiListEntryInit | ( | fbSubTemplateMultiListEntry_t * | entry, |
| uint16_t | tmplID, | ||
| fbTemplate_t * | tmpl, | ||
| uint16_t | numElements | ||
| ) |
Initializes the multi list entry with the template values, and allocates the memory used by the entry to hold the data.
This is mainly used when preparing to encode data for output by an fbExporter_t. The tmpl should exist on the fbSession_t that will be used when exporting the record holding the subTemplateMultiList.
- Parameters
-
entry pointer to the entry to initialize tmplID ID of the template used to structure the data elements tmpl pointer to the template used to structure the data elements numElements number of data elements in the entry
- Returns
- pointer to the data buffer to be filled in
◆ fbSubTemplateMultiListEntryRealloc()
| void * fbSubTemplateMultiListEntryRealloc | ( | fbSubTemplateMultiListEntry_t * | entry, |
| uint16_t | newNumElements | ||
| ) |
Potentially reallocates the entry's internal buffer and returns a handle to it.
Specifically, when newNumEntries differs from fbSubTemplateMultiListEntryCountElements(), frees the buffer used to store the entry's data records, allocates a new buffer based on the size of the template and newNumElements, and returns a handle to that buffer. The template of the entry is unchanged. If the number of elements are the same, the existing buffer is returned. This function does not free any recursive structured-data records used by the existing buffer before reallocating it.
- Parameters
-
entry pointer to the entry to realloc newNumElements the new number of elements for the entry
- Returns
- pointer to buffer to write data to
- See also
- fbSubTemplateMultiListEntryAddNewElements() to add additional elements to an existing sub template multi list entry.
◆ fbSubTemplateMultiListEntryAddNewElements()
| void * fbSubTemplateMultiListEntryAddNewElements | ( | fbSubTemplateMultiListEntry_t * | entry, |
| uint16_t | numNewElements | ||
| ) |
Allocates space for numNewEntries additional elements in the sub template multi list entry.
May only be called after the STML entry has been initialized with fbSubTemplateMultiListEntryInit().
- Parameters
-
entry pointer to the STML entry to add additional elements to numNewElements number of new elements to add to the STML entry
- Returns
- a pointer to the first newly allocated element
◆ fbSubTemplateMultiListEntryClear()
| void fbSubTemplateMultiListEntryClear | ( | fbSubTemplateMultiListEntry_t * | entry | ) |
Frees the memory holding the records' data used by this entry.
Use fbSubTemplateMultiListClearEntries() to clear all entries in an fbSubTemplateMultiList_t, and fbSubTemplateMultiListClear() to clear the entire sub template multi list.
- Parameters
-
entry pointer to the entry to clear the contents of.
◆ fbSubTemplateMultiListEntryGetDataPtr()
| void * fbSubTemplateMultiListEntryGetDataPtr | ( | fbSubTemplateMultiListEntry_t * | entry | ) |
Retrieves the data pointer for this entry.
- Parameters
-
entry pointer to the entry to get the data pointer from
- Returns
- pointer to the buffer used to store data for this entry
◆ fbSubTemplateMultiListEntryNextDataPtr()
| void * fbSubTemplateMultiListEntryNextDataPtr | ( | fbSubTemplateMultiListEntry_t * | entry, |
| void * | currentPtr | ||
| ) |
Retrieves a pointer to the data record in this entry that follows the one at currentPtr.
Retrieves the first record if currentPtr is NULL. Returns NULL when there are no more records or when currentPtr is outside the buffer used by the multi list entry.
- Parameters
-
entry pointer to the entry to get the next element from currentPtr pointer to the last element accessed. NULL means return a pointer to the first element.
- Returns
- the pointer to the next element in the list. Returns NULL if currentPtr points to the last element in the list
◆ fbSubTemplateMultiListEntryGetIndexedPtr()
| void * fbSubTemplateMultiListEntryGetIndexedPtr | ( | fbSubTemplateMultiListEntry_t * | entry, |
| uint16_t | index | ||
| ) |
Retrieves a pointer to the data element in the entry at position index, or returns NULL when index is out of range.
The first element is at index 0, the last at fbSubTemplateMultiListEntryCountElements()-1.
- Parameters
-
entry pointer to the entry to get a data pointer from. index the number of the element in the list to return
- Returns
- the pointer to the index'th element used by the entry, or NULL when out of range
◆ fbSubTemplateMultiListEntryCountElements()
| uint16_t fbSubTemplateMultiListEntryCountElements | ( | const fbSubTemplateMultiListEntry_t * | entry | ) |
Returns the number of entries the sub template multi list entry is capable of holding.
- Parameters
-
entry pointer to the sub template multi list entry
- Returns
- the number of records on the sub template multi list entry
- Since
- libfixbuf 2.3.0
◆ fbSubTemplateMultiListEntryGetTemplate()
| const fbTemplate_t * fbSubTemplateMultiListEntryGetTemplate | ( | fbSubTemplateMultiListEntry_t * | entry | ) |
Retrieves the template pointer used to structure the data elements.
- Parameters
-
entry pointer to the entry to get the template from
- Returns
- the template pointer used to describe the contents of the entry
◆ fbSubTemplateMultiListEntryGetTemplateID()
| uint16_t fbSubTemplateMultiListEntryGetTemplateID | ( | fbSubTemplateMultiListEntry_t * | entry | ) |
Retrieves the template ID for the template used to structure the data.
- Parameters
-
entry pointer to the entry to get the template ID from
- Returns
- the template ID for template that describes the data
◆ fBufListFree()
| void fBufListFree | ( | fbTemplate_t * | tmpl, |
| uint8_t * | record | ||
| ) |
Clears all of the memory that fixbuf allocated during transcode of this record.
This frees all of the memory allocated for list structures, recursively, when fixbuf was encoding or decoding the record.
The template provided is the internal template that was set on the fBuf before fBufNext() or fBufAppend() was called with the data. The template MUST match the record or bad things WILL happen without indication. This does not free the record itself. It will only free any list information elements and nested list information elements.
- Parameters
-
tmpl pointer to the internal template that MUST match the record record pointer to the data
◆ fbListenerGroupAlloc()
| fbListenerGroup_t * fbListenerGroupAlloc | ( | void | ) |
Allocates and returns an empty listenerGroup.
Use fbListenerGroupAddListener() to populate the listenerGroup, fbListenerGroupWait() to wait for connections on those listeners, and fbListenerGroupFree() when the group is no longer needed.
- Returns
- a pointer to the created fbListenerGroup_t, or NULL on error
◆ fbListenerGroupFree()
| void fbListenerGroupFree | ( | fbListenerGroup_t * | group | ) |
Frees a listener group.
- Parameters
-
group fbListenerGroup
◆ fbListenerGroupAddListener()
| int fbListenerGroupAddListener | ( | fbListenerGroup_t * | group, |
| const fbListener_t * | listener | ||
| ) |
Adds a previously allocated listener to the previously allocated group.
The listener is placed at the head of the list
- Parameters
-
group pointer to the allocated group to add the listener to listener pointer to the listener structure to add to the group
- Returns
- 0 upon success. "1" if entry couldn't be allocated "2" if either of the incoming pointers are NULL
◆ fbListenerGroupDeleteListener()
| int fbListenerGroupDeleteListener | ( | fbListenerGroup_t * | group, |
| const fbListener_t * | listener | ||
| ) |
Removes the listener from the group.
IT DOES NOT FREE THE LISTENER OR THE GROUP
- Parameters
-
group pointer to the group to remove from the listener from listener pointer to the listener to remove from the group
- Returns
- 0 on success, and "1" if the listener is not found "2" if either of the pointers are NULL
◆ fbListenerGroupWait()
| fbListenerGroupResult_t * fbListenerGroupWait | ( | fbListenerGroup_t * | group, |
| GError ** | err | ||
| ) |
Accepts connections for multiple listeners.
Works similarly to fbListenerWait(), except that is looks for connections for any listener that is part of a previously allocated and filled listener group. It returns a pointer to the head of a list of listenerGroupResults. The caller is responsible for freeing the listenerGroupResult (fbListenerFreeGroupResult()).
- Parameters
-
group pointer to the group of listeners to wait on err error string structure seen throughout fixbuf
- Returns
- pointer to the head of the listener group result list NULL on error, and sets the error string
◆ fbListenerFreeGroupResult()
| void fbListenerFreeGroupResult | ( | fbListenerGroupResult_t * | result | ) |
Frees the listener group result returned from fbListenerGroupWait().
- Parameters
-
result A listener group result
◆ fbListenerOwnSocketCollectorTCP()
| fBuf_t * fbListenerOwnSocketCollectorTCP | ( | fbListener_t * | listener, |
| int | sock, | ||
| GError ** | err | ||
| ) |
Returns an fBuf wrapped around an independently managed socket and a properly created listener for TCP connections.
The caller is only responsible for creating the socket. The existing collector code will close the socket and cleanup everything.
- Parameters
-
listener pointer to the listener to wrap around the socket sock the socket descriptor of the independently managed socket err standard fixbuf err structure pointer
- Returns
- pointer to the fbuf for the collector. NULL if sock is 0, 1, or 2 (stdin, stdout, or stderr)
◆ fbListenerOwnSocketCollectorTLS()
| fBuf_t * fbListenerOwnSocketCollectorTLS | ( | fbListener_t * | listener, |
| int | sock, | ||
| GError ** | err | ||
| ) |
Same as fbListenerOwnSocketCollectorTCP() but for TLS (not tested)
- Parameters
-
listener pointer to the listener to wait on sock independently managed socket descriptor err standard fixbuf err structure pointer
- Returns
- pointer to the fbuf for the collector NULL if sock is 0, 1, or 2 (stdin, stdout, or stderr)
◆ fBufInterruptSocket()
| void fBufInterruptSocket | ( | fBuf_t * | fbuf | ) |
Interrupts the select call of a specific collector by way of its fBuf.
This is mainly used by fbListenerInterrupt() to interrupt all of the collector sockets well.
◆ fBufSetInternalTemplate()
| gboolean fBufSetInternalTemplate | ( | fBuf_t * | fbuf, |
| uint16_t | int_tid, | ||
| GError ** | err | ||
| ) |
Sets the internal template on a buffer to the given template ID.
The internal template describes the format of the record pointed to by the recbase parameter to fBufAppend() (for export) and fBufNext() (for collection). The given template ID must identify a current internal template in the buffer's associated session.
An internal template must be set on a buffer before calling fBufAppend() or fBufNext().
- Parameters
-
fbuf an IPFIX message buffer int_tid template ID of the new internal template err An error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufSetExportTemplate()
| gboolean fBufSetExportTemplate | ( | fBuf_t * | fbuf, |
| uint16_t | ext_tid, | ||
| GError ** | err | ||
| ) |
Sets the external template for export on a buffer to the given template ID.
The external template describes the record that will be written to the IPFIX message. The buffer must be initialized for export. The given ID is scoped to the observation domain of the associated session (see fbSessionSetDomain()), and must identify a current external template for the current domain in the buffer's associated session.
An export template must be set on a buffer before calling fBufAppend().
- Parameters
-
fbuf an IPFIX message buffer ext_tid template ID of the new external template within the current domain. err An error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufSetSpreadExportGroup()
| void fBufSetSpreadExportGroup | ( | fBuf_t * | fbuf, |
| char ** | groups, | ||
| int | num_groups, | ||
| GError ** | err | ||
| ) |
This function checks to see if the groups you are setting on the buffer are different than the groups previously set.
If so, it will emit the buffer, set the first group on the session (to get templates & sequence numbers) and THEN set the desired group(s) for export on a buffer. This should be called before setting external templates with fbSessionAddTemplate() and before calling fBufAppend(). If using fbSessionAddTemplatesMulticast(), it is not necessary to call this before because it is called within this function.
- Parameters
-
fbuf an IPFIX message buffer groups an array of Spread Export Groups num_groups number of groups from groups to be added err an error description, set on failure.
◆ fBufSetAutomaticMode()
| void fBufSetAutomaticMode | ( | fBuf_t * | fbuf, |
| gboolean | automatic | ||
| ) |
Sets the automatic (read/write) mode flag on a buffer.
Buffers are created in automatic mode by default.
In automatic write mode, a call to fBufAppend(), fbSessionAddTemplate(), or fbSessionExportTemplates() that overruns the available space in the buffer will cause a call to fBufEmit() to emit the message in the buffer to the fbExporter_t before starting a new message.
In automatic read mode, a call to fBufNext() that overruns the buffer will cause a call to fBufNextMessage() to read another message from the fbCollector_t before attempting to read a record.
In manual mode, the end of message on any buffer read/write call results in the call returning an error with a GError code of FB_ERROR_EOM.
- Parameters
-
fbuf an IPFIX message buffer automatic TRUE for this buffer to be automatic, FALSE for manual.
◆ fBufSetAutomaticInsert()
| gboolean fBufSetAutomaticInsert | ( | fBuf_t * | fbuf, |
| GError ** | err | ||
| ) |
Enables automatic insertion of RFC 5610 elements read from a Buffer.
RFC 5610 records allow an application to retrieve information about a non-standard information elements. By default, automatic insertion mode is disabled.
In automatic insertion mode, when the buffer reads an information element type record that has a non-zero value for the privateEnterpriseNumber, a new information element (fbInfoElement_t) is created and added to the buffer's session's information model (fbInfoModel_t). This function creates the internal template for the Info Element Type Record (fbInfoElementOptRec_t) and adds it to the buffer's session.
For export of RFC 5610 elements, use fbSessionSetMetadataExportElements().
- Parameters
-
fbuf an IPFIX message buffer err Gerror pointer
- Returns
- TRUE on success, FALSE if the internal template could not be created
◆ fBufGetSession()
| fbSession_t * fBufGetSession | ( | fBuf_t * | fbuf | ) |
Retrieves the session associated with a buffer.
- Parameters
-
fbuf an IPFIX message buffer
- Returns
- the associated session
◆ fBufFree()
| void fBufFree | ( | fBuf_t * | fbuf | ) |
Frees a buffer.
Also frees any associated session, exporter, or collector, closing exporting process or collecting process endpoint connections and removing collecting process endpoints from any listeners, as necessary.
- Parameters
-
fbuf an IPFIX message buffer
◆ fBufAllocForExport()
| fBuf_t * fBufAllocForExport | ( | fbSession_t * | session, |
| fbExporter_t * | exporter | ||
| ) |
Allocates a new buffer for export.
Associates the buffer with a given session and exporting process endpoint; these become owned by the buffer. Session and exporter are freed by fBufFree(). Must never be freed by user
- Parameters
-
session a session initialized with appropriate internal and external templates exporter an exporting process endpoint
- Returns
- a new IPFIX message buffer, owning the session and exporter, for export use via fBufAppend() and fBufEmit().
◆ fBufGetExporter()
| fbExporter_t * fBufGetExporter | ( | fBuf_t * | fbuf | ) |
Retrieves the exporting process endpoint associated with a buffer.
The buffer must have been allocated with fBufAllocForExport(); otherwise, returns NULL.
- Parameters
-
fbuf an IPFIX message buffer
- Returns
- the associated exporting process endpoint
◆ fBufSetExporter()
| void fBufSetExporter | ( | fBuf_t * | fbuf, |
| fbExporter_t * | exporter | ||
| ) |
Associates an exporting process endpoint with a buffer.
The exporter will be used to write IPFIX messgaes to a transport. The exporter becomes owned by the buffer; any previous exporter associated with the buffer is closed if necessary and freed.
- Parameters
-
fbuf an IPFIX message buffer exporter an exporting process endpoint
◆ fBufRemaining()
| size_t fBufRemaining | ( | fBuf_t * | fbuf | ) |
Retrieves the length of the buffer that is remaining after processing.
An IPFIX collector that is not using fixbuf to handle connections would use this function upon receiving an FB_ERROR_BUFSZ error to determine how many bytes are left in the buffer (set by fBufSetBuffer()) that are not processed.
- Parameters
-
fbuf an IPFIX message buffer
- Returns
- length of buffer not read
◆ fBufSetBuffer()
| void fBufSetBuffer | ( | fBuf_t * | fbuf, |
| uint8_t * | buf, | ||
| size_t | buflen | ||
| ) |
Sets a buffer on an fBuf for collection.
This can be used by applications that want to handle their own connections, file reading, etc. This call should be made after the call to read and before calling fBufNext. fBufNext() will return FB_ERROR_BUFSZ when there is not enough buffer space to read a full IPFIX message.
- Parameters
-
fbuf an IPFIX message buffer buf the data buffer to use for processing IPFIX buflen the length of IPFIX data in buf
- See also
- Connection-less Collector Connection-less collector
◆ fBufAppend()
| gboolean fBufAppend | ( | fBuf_t * | fbuf, |
| uint8_t * | recbase, | ||
| size_t | recsize, | ||
| GError ** | err | ||
| ) |
Appends a record to a buffer.
Uses the present internal template set via fBufSetInternalTemplate() to describe the record of size recsize located in memory at recbase. Uses the present export template set via fBufSetExportTemplate() to describe the record structure to be written to the buffer. Information Elements present in the external template that are not present in the internal template are transcoded into the message as zeroes. If the buffer is in automatic mode, may cause a message to be emitted via fBufEmit() if there is insufficient space in the buffer for the record.
If the internal template contains any variable length Information Elements, those must be represented in the record by fbVarfield_t structures.
- Parameters
-
fbuf an IPFIX message buffer recbase pointer to internal record recsize size of internal record in bytes err an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufEmit()
| gboolean fBufEmit | ( | fBuf_t * | fbuf, |
| GError ** | err | ||
| ) |
Emits the message currently in a buffer using the associated exporting process endpoint.
- Parameters
-
fbuf an IPFIX message buffer err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufSetExportTime()
| void fBufSetExportTime | ( | fBuf_t * | fbuf, |
| uint32_t | extime | ||
| ) |
Sets the export time on the message currently in a buffer.
This will be used as the export time of the message created by the first call to fBufAppend() after the current message, if any, is emitted. Use 0 for the export time to cause the export time to be taken from the system clock at message creation time.
- Parameters
-
fbuf an IPFIX message buffer extime the export time in epoch seconds.
◆ fBufAllocForCollection()
| fBuf_t * fBufAllocForCollection | ( | fbSession_t * | session, |
| fbCollector_t * | collector | ||
| ) |
Allocates a new buffer for collection.
Associates the buffer with a given session and collecting process endpoint; these become owned by the buffer and must not be freed by the user. The session and collector are freed by fBufFree().
When using libfixbuf to process a buffer of IPFIX data (see fBufSetBuffer()), invoke this function with a NULL collector.
- Parameters
-
session a session initialized with appropriate internal templates collector an collecting process endpoint
- Returns
- a new IPFIX message buffer, owning the session and collector, for collection use via fBufNext() and fBufNextMessage().
◆ fBufGetCollector()
| fbCollector_t * fBufGetCollector | ( | fBuf_t * | fbuf | ) |
Retrieves the collecting process endpoint associated with a buffer.
The buffer must have been allocated with fBufAllocForCollection(); otherwise, returns NULL.
- Parameters
-
fbuf an IPFIX message buffer
- Returns
- the associated collecting process endpoint
◆ fBufSetCollector()
| void fBufSetCollector | ( | fBuf_t * | fbuf, |
| fbCollector_t * | collector | ||
| ) |
Associates an collecting process endpoint with a buffer.
The collector will be used to read IPFIX messgaes from a transport. The collector becomes owned by the buffer; any previous collector associated with the buffer is closed if necessary and freed.
- Parameters
-
fbuf an IPFIX message buffer collector an collecting process endpoint
◆ fBufNext()
| gboolean fBufNext | ( | fBuf_t * | fbuf, |
| uint8_t * | recbase, | ||
| size_t * | recsize, | ||
| GError ** | err | ||
| ) |
Retrieves a record from a Buffer associated with a collecting process.
Uses the external template taken from the message to read the next record available from a data set in the message. Copies the record to a data buffer at recbase, with a maximum record size pointed to by recsize, described by the present internal template set via fBufSetInternalTemplate(). Reads and processes any templates and options templates between the last record read (or beginning of message) and the next data record. Information Elements present in the internal template that are not present in the external template are transcoded into the record at recbase as zeroes. If the buffer is in automatic mode, may cause a message to be read via fBufNextMessage() if there are no more records available in the message buffer.
If the internal template contains any variable length Information Elements, those must be represented in the record at recbase by fbVarfield_t structures.
- Parameters
-
fbuf an IPFIX message buffer recbase pointer to internal record buffer; will contain record data after call. recsize On call, pointer to size of internal record buffer in bytes. Contains number of bytes actually transcoded at end of call. err an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufNextMessage()
| gboolean fBufNextMessage | ( | fBuf_t * | fbuf, |
| GError ** | err | ||
| ) |
Reads a new message into a buffer using the associated collecting process endpoint.
Called by fBufNext() on end of message in automatic mode; should be called after an FB_ERROR_EOM return from fBufNext() in manual mode, or to skip the current message and go on to the next in the stream.
- Parameters
-
fbuf an IPFIX message buffer err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fBufGetExportTime()
| uint32_t fBufGetExportTime | ( | fBuf_t * | fbuf | ) |
Retrieves the export time on the message currently in a buffer.
- Parameters
-
fbuf an IPFIX message buffer
- Returns
- the export time in epoch seconds.
◆ fBufGetCollectionTemplate()
| fbTemplate_t * fBufGetCollectionTemplate | ( | fBuf_t * | fbuf, |
| uint16_t * | ext_tid | ||
| ) |
Retrieves the external template used to read the last record from the buffer.
If no record has been read, returns NULL. Stores the external template ID within the current domain in ext_tid, if not NULL.
This routine is not particularly useful to applications, as it would be called after the record described by the external template had been transcoded, and as such could not be used to select an appropriate internal template for a given external template. However, it is used by fBufNextCollectionTemplate(), and may be useful in certain contexts, so is made public.
Usually, you'll want to use fBufNextCollectionTemplate() instead.
- Parameters
-
fbuf an IPFIX message buffer ext_tid pointer to external template ID storage, or NULL.
- Returns
- the external template describing the last record read.
◆ fBufNextCollectionTemplate()
| fbTemplate_t * fBufNextCollectionTemplate | ( | fBuf_t * | fbuf, |
| uint16_t * | ext_tid, | ||
| GError ** | err | ||
| ) |
Retrieves the external template that will be used to read the next record from the buffer.
If no next record is available, returns NULL. Stores the external template ID within the current domain in ext_tid, if not NULL. Reads and processes any templates and options templates between the last record read (or beginning of message) and the next data record. If the buffer is in automatic mode, may cause a message to be read via fBufNextMessage() if there are no more records available in the message buffer.
- Parameters
-
fbuf an IPFIX message buffer ext_tid pointer to external template ID storage, or NULL. err an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.
- Returns
- the external template describing the last record read.
◆ fbInfoModelAlloc()
| fbInfoModel_t * fbInfoModelAlloc | ( | void | ) |
Allocates a new information model.
The information model contains all the default information elements in the IANA-managed number space, and may be extended via fbInfoModelAddElement(), fbInfoModelAddElementArray(), fbInfoModelReadXMLFile(), and fbInfoModelReadXMLData().
An Information Model is required to create Templates and Sessions. Each application should have only one Information Model.
- Returns
- a new Information Model
◆ fbInfoModelFree()
| void fbInfoModelFree | ( | fbInfoModel_t * | model | ) |
Frees an information model.
Must not be called until all sessions and templates depending on the information model have also been freed; i.e., at application cleanup time.
- Parameters
-
model An information model
◆ fbInfoModelAddElement()
| void fbInfoModelAddElement | ( | fbInfoModel_t * | model, |
| fbInfoElement_t * | ie | ||
| ) |
Adds a single information element to an information model.
The information element is assumed to be in "canonical" form; that is, its ref.name field should contain the information element name. The information element and its name are copied into the model; the caller may free or reuse its storage after this call.
See fbInfoModelAddElementArray() for a more convenient method of statically adding information elements to information models.
- Parameters
-
model An information model ie Pointer to an information element to copy into the model
◆ fbInfoModelAddElementArray()
| void fbInfoModelAddElementArray | ( | fbInfoModel_t * | model, |
| fbInfoElement_t * | ie | ||
| ) |
Adds multiple information elements in an array to an information model.
The information elements are assumed to be in "canonical" form; that is, their ref.name fields should contain the information element name. Each information element and its name are copied into the model; the caller may free or reuse its storage after this call.
The ie parameter points to the first information element in an array, usually statically initialized with an array of FB_IE_INIT_FULL macros followed by an FB_IE_NULL macro.
- Parameters
-
model An information model ie Pointer to an IE array to copy into the model
- See also
- fbInfoModelReadXMLFile() and fbInfoModelReadXMLData() for alternate ways to add information elements to information models.
◆ fbInfoModelReadXMLFile()
| gboolean fbInfoModelReadXMLFile | ( | fbInfoModel_t * | model, |
| const gchar * | filename, | ||
| GError ** | err | ||
| ) |
Adds information specified in the given XML file to the information model.
The XML file is expected to be in the format used by the IANA IPFIX Entities registry, with the following two additions:
- A
<cert:enterpriseId>field may be used to mark the enterprise ID for an element. - A
<cert:reversible>field may be used to mark an element as reversible (as per RFC 5103). Valid values for this field are true, false, yes, no, 1, and 0.
If the XML being parsed contains registries for the element data types, semantics, or units, those will be parsed and used to interpret the corresponding fields in the element records. (These registries exist in IANA's registry.)
A parsed element that already exists in the given InfoModel will be replace the existing element.
- Parameters
-
model An information model filename The file containing the XML description err Return location for a GError
- Returns
FALSEif an error occurred, TRUE on success
- Since
- libfixbuf 2.1.0
- See also
- fbInfoModelReadXMLData()
◆ fbInfoModelReadXMLData()
| gboolean fbInfoModelReadXMLData | ( | fbInfoModel_t * | model, |
| const gchar * | xml_data, | ||
| gssize | xml_data_len, | ||
| GError ** | err | ||
| ) |
Adds information specified in the given XML data to the information model.
The XML data is expected to be in the format used by the IANA IPFIX Entities registry, with the following two additions:
- A
<cert:enterpriseId>field may be used to mark the enterprise ID for an element. - A
<cert:reversible>field may be used to mark an element as reversible (as per RFC 5103). Valid values for this field are true, false, yes, no, 1, and 0.
If the XML being parsed contains registries for the element data types, semantics, or units, those will be parsed and used to interpret the corresponding fields in the element records. (These registries exist in IANA's registry.)
A parsed element that already exists in the given InfoModel will be replace the existing element.
- Parameters
-
model An information model xml_data A pointer to the XML data xml_data_len The length of xml_datain byteserr Return location for a GError
- Returns
FALSEif an error occurred, TRUE on success
- Since
- libfixbuf 2.1.0
- See also
- fbInfoModelReadXMLFile()
◆ fbInfoModelGetElementByName()
| const fbInfoElement_t * fbInfoModelGetElementByName | ( | fbInfoModel_t * | model, |
| const char * | name | ||
| ) |
Returns a pointer to the canonical information element within an information model given the information element name.
The returned information element is owned by the information model and must not be modified.
- Parameters
-
model An information model name The name of the information element to look up
- Returns
- The named information element within the model, or NULL if no such element exists.
◆ fbInfoModelGetElementByID()
| const fbInfoElement_t * fbInfoModelGetElementByID | ( | fbInfoModel_t * | model, |
| uint16_t | id, | ||
| uint32_t | ent | ||
| ) |
Returns a pointer to the canonical information element within an information model given the information element ID and enterprise ID.
The returned information element is owned by the information model and must not be modified.
- Parameters
-
model An information model id An information element id ent An enterprise id
- Returns
- The named information element within the model, or NULL if no such element exists.
◆ fbInfoModelCountElements()
| guint fbInfoModelCountElements | ( | const fbInfoModel_t * | model | ) |
Returns the number of information elements in the information model.
- Parameters
-
model An information model
- Returns
- The number of information elements in the information model
◆ fbInfoModelIterInit()
| void fbInfoModelIterInit | ( | fbInfoModelIter_t * | iter, |
| const fbInfoModel_t * | model | ||
| ) |
Initializes an information model iterator for iteration over the information elements (fbInfoElement_t) in the model.
The caller uses fbInfoModelIterNext() to visit the elements.
- Parameters
-
iter A pointer to the iterator to initialize model An information model
◆ fbInfoModelIterNext()
| const fbInfoElement_t * fbInfoModelIterNext | ( | fbInfoModelIter_t * | iter | ) |
Returns a pointer to the next information element in the information model.
Returns NULL once all information elements have been returned.
- Parameters
-
iter An information model iterator
- Returns
- The next information element within the model, or NULL if there are no more elements.
◆ fbInfoElementAllocTypeTemplate()
| fbTemplate_t * fbInfoElementAllocTypeTemplate | ( | fbInfoModel_t * | model, |
| GError ** | err | ||
| ) |
Allocates and returns the Options Template that will be used to define Information Element Type Records.
This function does not add the template to the session or fbuf. This function allocates the template, appends the appropriate elements to the template, and sets the scope on the template. See RFC 5610 for more info.
- Parameters
-
model A pointer to an existing info model err GError
- Returns
- The pointer to the newly allocated template.
◆ fbInfoElementWriteOptionsRecord()
| gboolean fbInfoElementWriteOptionsRecord | ( | fBuf_t * | fbuf, |
| const fbInfoElement_t * | model_ie, | ||
| uint16_t | itid, | ||
| uint16_t | etid, | ||
| GError ** | err | ||
| ) |
Exports an options record to the given fbuf with information element type information about the given information element.
See RFC 5610 for details. Use fbInfoElementAllocTypeTemplate() and add the returned template to the session, before calling this function.
- Parameters
-
fbuf An existing fbuf model_ie A pointer to the information element to export type info. itid The internal template id of the Options Template. etid The external template id of the Options Template. err GError
- Returns
- TRUE if successful, FALSE if an error occurred.
◆ fbInfoElementAddOptRecElement()
| gboolean fbInfoElementAddOptRecElement | ( | fbInfoModel_t * | model, |
| fbInfoElementOptRec_t * | rec | ||
| ) |
Adds an element that we received via an RFC 5610 Options Record to the given info model.
Returns True if the element was successfully added. False, if it couldn't be added. This function does not add elements that have a private enterprise number of 0, for security reasons.
- Parameters
-
model An information model rec A pointer to the received fbInfoElementOptRec.
- Returns
- TRUE if item was successfully added to info model.
◆ fbInfoModelTypeInfoRecord()
| gboolean fbInfoModelTypeInfoRecord | ( | fbTemplate_t * | tmpl | ) |
Checks to see if a template contains all of the elements required by RFC 5610 for describing an information element type (type metadata).
- Parameters
-
tmpl A pointer to the template
- Returns
- TRUE if template contains all the info elements
- See also
- fbInfoElementAddOptRecElement()
◆ fbTemplateAlloc()
| fbTemplate_t * fbTemplateAlloc | ( | fbInfoModel_t * | model | ) |
Allocates a new empty template.
The template will be associated with the given Information Model, and only able to use Information Elements defined within that Information Model. Templates may be associated with multiple sessions, with different template IDs each time, and as such are reference counted and owned by sessions. A template must be associated with at least one session or it will be leaked; each template is freed after its last associated session is freed. To free a template that has not yet been added to a session, use fbTemplateFreeUnused().
Use fbTemplateAppend(), fbTemplateAppendSpec(), and fbTemplateAppendSpecArray() to "fill in" a template after creating it, and before associating it with any session.
- Parameters
-
model An information model
- Returns
- a new, empty Template.
◆ fbTemplateAppend()
| gboolean fbTemplateAppend | ( | fbTemplate_t * | tmpl, |
| fbInfoElement_t * | ex_ie, | ||
| GError ** | err | ||
| ) |
Appends an information element to a template.
The information element is taken to be an example; the canonical element from the template's associated model is looked up by enterprise and element number and copied. If no information element exists in the model with the given enterprise and element number, it is copied to the model with the name "_alienInformationElement".
This call is intended primarily for use by fBuf_t's template reader, but can also be useful to simulate receipt of templates over the wire.
- Parameters
-
tmpl Template to append information element to ex_ie Example IE to add to the template err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fbTemplateAppendSpec()
| gboolean fbTemplateAppendSpec | ( | fbTemplate_t * | tmpl, |
| fbInfoElementSpec_t * | spec, | ||
| uint32_t | flags, | ||
| GError ** | err | ||
| ) |
Appends an information element described by specifier to a template.
The fbInfoElement_t named by the specifier is copied from the template's associated fbInfoModel_t, and the length and flags are overriden from the specifier.
- Parameters
-
tmpl Template to append information element to. spec Specifier describing information element to append. flags Application flags. Must contain all bits of spec flags word or the append will be silently skipped. Used for building multiple templates with different information element features from a single specifier. err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
- See also
- fbTemplateAppendSpecArray()
◆ fbTemplateAppendSpecArray()
| gboolean fbTemplateAppendSpecArray | ( | fbTemplate_t * | tmpl, |
| fbInfoElementSpec_t * | spec, | ||
| uint32_t | flags, | ||
| GError ** | err | ||
| ) |
Appends information elements described by a specifier array to a template.
Calls fbTemplateAppendSpec() for each member of the array until the FB_IESPEC_NULL convenience macro is encountered.
- Parameters
-
tmpl Template to append information element to. spec Pointer to first specifier in specifier array to append. flags Application flags. Must contain all bits of spec flags word or the append will be silently skipped. Used for building multiple templates with different information element features from a single specifier. err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fbTemplateCountElements()
| uint32_t fbTemplateCountElements | ( | fbTemplate_t * | tmpl | ) |
Determines number of information elements in a template.
- Parameters
-
tmpl A template
- Returns
- information element count
◆ fbTemplateSetOptionsScope()
| void fbTemplateSetOptionsScope | ( | fbTemplate_t * | tmpl, |
| uint16_t | scope_count | ||
| ) |
Sets the number of information elements in a template that are scope.
This causes the template to become an options template, and must be called after all the scope information elements have been appended to the template.
The scope count may not be greater than the number of IEs in the template. A scope_count argument of zero sets the scope count to the number of IEs.
It is expected that this function is only called once per template.
- Parameters
-
tmpl Template to set scope on scope_count Number of scope information elements
◆ fbTemplateGetOptionsScope()
| uint32_t fbTemplateGetOptionsScope | ( | fbTemplate_t * | tmpl | ) |
Determines number of scope information elements in a template.
The template is an options template if nonzero.
- Parameters
-
tmpl A template
- Returns
- scope information element count
◆ fbTemplateContainsElement()
| gboolean fbTemplateContainsElement | ( | fbTemplate_t * | tmpl, |
| const fbInfoElement_t * | ex_ie | ||
| ) |
Determines if a template contains a given information element.
Matches against information element private enterprise number, number, and multiple-IE index (i.e., to determine if a given template contains six instances of a given information element, set ex_ie->midx = 5 before this call).
- Parameters
-
tmpl Template to search ex_ie Pointer to an information element to search for
- Returns
- TRUE if the template contains the given IE
◆ fbTemplateContainsElementByName()
| gboolean fbTemplateContainsElementByName | ( | fbTemplate_t * | tmpl, |
| fbInfoElementSpec_t * | spec | ||
| ) |
Determines if a template contains at least one instance of a given information element, specified by name in the template's information model.
- Parameters
-
tmpl Template to search spec Specifier of information element to search for
- Returns
- TRUE if the template contains the given IE
◆ fbTemplateContainsAllElementsByName()
| gboolean fbTemplateContainsAllElementsByName | ( | fbTemplate_t * | tmpl, |
| fbInfoElementSpec_t * | spec | ||
| ) |
Determines if a template contains at least one instance of each fbInfoElement_t in a given information element specifier array.
- Parameters
-
tmpl Template to search spec Pointer to specifier array to search for
- Returns
- TRUE if the template contains all the given IEs
◆ fbTemplateContainsAllFlaggedElementsByName()
| gboolean fbTemplateContainsAllFlaggedElementsByName | ( | fbTemplate_t * | tmpl, |
| fbInfoElementSpec_t * | spec, | ||
| uint32_t | flags | ||
| ) |
Determines if a template contains at least one instance of each information element in a given information element specifier array that match the given flags argument.
- Parameters
-
tmpl Template to search spec Pointer to specifier array to search for flags Flags to match info elements. Specifier elements whose flags member is non-zero and do not match all the bits of the flags parameter are not checked.
- Returns
- TRUE if the template contains all the given IEs
◆ fbTemplateGetIndexedIE()
| fbInfoElement_t * fbTemplateGetIndexedIE | ( | fbTemplate_t * | tmpl, |
| uint32_t | IEindex | ||
| ) |
Returns the information element in the template referenced by the index.
- Parameters
-
tmpl Pointer to the template IEindex index of the information element to return
- Returns
- A pointer to the information element at index IEindex, NULL if IEindex is greater than number of elements
◆ fbTemplateGetInfoModel()
| fbInfoModel_t * fbTemplateGetInfoModel | ( | fbTemplate_t * | tmpl | ) |
Returns the information model, as understood by the template.
- Parameters
-
tmpl Template Pointer
- Returns
- The information model
- Since
- libfixbuf 2.1.0
◆ fbTemplateFreeUnused()
| void fbTemplateFreeUnused | ( | fbTemplate_t * | tmpl | ) |
Frees a template if it is not currently in use by any Session.
Use this to clean up while creating templates in case of error.
- Parameters
-
tmpl template to free
◆ fbTemplateGetContext()
| void * fbTemplateGetContext | ( | fbTemplate_t * | tmpl | ) |
Gets the ctx pointer associated with a Template.
The ctx pointer is set during the fbNewTemplateCallback_fn when the new template is received.
- Parameters
-
tmpl Template Pointer
- Returns
- ctx The application Context Pointer
◆ fbTemplateGetIELenOfMemBuffer()
| uint16_t fbTemplateGetIELenOfMemBuffer | ( | fbTemplate_t * | tmpl | ) |
Returns the number of octets required for a data buffer (an octet array) to store a data record described by this template.
Another description is this is the length of the record when this template is used as an internal template.
- Since
- libfixbuf 2.2.0
◆ fbSessionAlloc()
| fbSession_t * fbSessionAlloc | ( | fbInfoModel_t * | model | ) |
Allocates a transport session state container.
The new session is associated with the given information model, contains no templates, and is usable either for collection or export.
Each fbExporter_t, fbListener_t, and fbCollector_t must have its own session; session state cannot be shared.
The fbSession_t returned by this function is not freed by calling fBufFree() or fbListenerFree(). It should be freed by the application by calling fbSessionFree().
- Parameters
-
model An information model. Not freed by sessionFree. Must be freed by user after calling SessionFree
- Returns
- a new, empty session state container.
◆ fbSessionEnableTypeMetadata()
| gboolean fbSessionEnableTypeMetadata | ( | fbSession_t * | session, |
| gboolean | enabled, | ||
| GError ** | err | ||
| ) |
Configures a session to export type information for enterprise-specific information elements as options records according to RFC 5610.
This function is a wrapper over fbSessionSetMetadataExportElements() with tid set to FB_TID_AUTO.
- Parameters
-
session pointer enabled TRUE to enable type metadata export, FALSE to disable err error mesasge
- Returns
- TRUE on success, FALSE on failure
- Deprecated:
- Use fbSessionSetMetadataExportElements() instead.
◆ fbSessionSetMetadataExportElements()
| uint16_t fbSessionSetMetadataExportElements | ( | fbSession_t * | session, |
| gboolean | enabled, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Configures a session to export type information for enterprise-specific information elements as options records according to RFC 5610.
Regardless of the enabled value, this function creates the type information template and adds it to the session with the template ID tid or an arbitrary ID when tid is FB_TID_AUTO.
If enabled is TRUE, the information metadata is exported each time fbSessionExportTemplates() is called.
When collecting, use fBufSetAutomaticInsert() to automatically update the information model with these RFC 5610 elements.
- Parameters
-
session pointer enabled TRUE to enable type metadata export, FALSE to disable tid the template id to use for type-information records err error mesasge
- Returns
- the template id for type-information records or 0 if the template could not be added to the session.
- Since
- libfixbuf 2.3.0
◆ fbSessionEnableTemplateMetadata()
| gboolean fbSessionEnableTemplateMetadata | ( | fbSession_t * | session, |
| gboolean | enabled, | ||
| GError ** | err | ||
| ) |
Configures a session to export template metadata as options records.
This function is a wrapper over fbSessionSetMetadataExportTemplates() with tid set to FB_TID_AUTO.
- Parameters
-
session pointer enabled TRUE to enable template metadata export, FALSE to disable err error mesasge
- Returns
- TRUE on success, FALSE on failure
- Deprecated:
- Use fbSessionSetMetadataExportTemplates() instead.
◆ fbSessionSetMetadataExportTemplates()
| uint16_t fbSessionSetMetadataExportTemplates | ( | fbSession_t * | session, |
| gboolean | enabled, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Configures a session to export template metadata as options records.
Template metadata is the name and description specified by fbSessionAddTemplateWithMetadata().
If enabled, the metadata is exported each time fbSessionExportTemplates() or fbSessionExportTemplate() is called. In addition, the metadata is exported when fbSessionAddTemplateWithMetadata() is called if the session is associated with an fbExporter_t.
Regardless of the enabled value, this function creates the template-metadata template and adds it to the session with the template ID tid or an arbitrary ID when tid is FB_TID_AUTO.
- Parameters
-
session pointer enabled TRUE to enable template metadata export, FALSE to disable tid the template id to use for template metadata records err error mesasge
- Returns
- the template id for template-metadata records or 0 if the template could not be added to the session.
- Since
- libfixbuf 2.3.0
◆ fbSessionAddTemplateWithMetadata()
| uint16_t fbSessionAddTemplateWithMetadata | ( | fbSession_t * | session, |
| gboolean | internal, | ||
| uint16_t | tid, | ||
| fbTemplate_t * | tmpl, | ||
| const char * | name, | ||
| const char * | description, | ||
| GError ** | err | ||
| ) |
Adds a template to the session, as fbSessionAddTemplate(), with the provided metadata.
This function appends the template's metadata to the buffer (if currently enabled; c.f. fbSessionSetMetadataExportTemplates()) as well as the template.
- Parameters
-
session A session state container internal TRUE if the template is internal, FALSE if external. tid Template ID to assign, replacing any current template in case of collision; or FB_TID_AUTO to assign a new tId. tmpl Template to add name Template name, may not be NULL description Template description, may be NULL err error message
- Returns
- template id of newly added template, 0 on error
- See also
- fbSessionAddTemplate() for additional information.
◆ fbSessionGetInfoModel()
| fbInfoModel_t * fbSessionGetInfoModel | ( | fbSession_t * | session | ) |
Gets the info model for the session.
- Parameters
-
session
- Returns
- a pointer to the info model for the session
◆ fbSessionAddNewTemplateCallback()
| void fbSessionAddNewTemplateCallback | ( | fbSession_t * | session, |
| fbNewTemplateCallback_fn | callback, | ||
| void * | app_ctx | ||
| ) |
This function sets the callback that allows the application to set its own context variable with a new incoming template.
Assigning a callback is not required and is only useful if the application either needs to store some information about the template or to prevent certain nested templates from being transcoded. If the application's template contains a subTemplateMultiList or subTemplateList and the callback is not used, all incoming templates contained in these lists will be fully transcoded and the application is responsible for freeing any nested lists contained within those objects.
This function should be called after fbSessionAlloc(). Fixbuf often clones sessions upon receiving a connection. In the TCP case, the application has access to the session right after fbListenerWait() returns by calling fBufGetSession(). In the UDP case, the application does not have access to the fbSession until after a call to fBufNext() for fBufNextCollectionTemplate() and by this time the application may have already received some templates. Therefore, it is important to call this function before fBufNext(). Any callbacks added to the session will be carried over to cloned sessions.
- Parameters
-
session pointer session to assign the callback to callback the function that should be called when a new template is received app_ctx parameter that gets passed into the callback function. This can be used to pass session-specific information state information to the callback function.
◆ fbSessionAddTemplatePair()
| void fbSessionAddTemplatePair | ( | fbSession_t * | session, |
| uint16_t | ent_tid, | ||
| uint16_t | int_tid | ||
| ) |
Adds an external-internal template pair to the session.
This tells the transcoder which internal template to use for a given external template used in a sub template list, or a sub template multi list.
If the value of int_tid is 0, it tells fixbuf NOT to decode any list where the external template is ent_tid. This allows a collector to specify which templates that are included in lists it can handle.
If ent_tid and int_tid are set equal to each other, it tells the transcoder to decode all of the fields from the external template, by using the external template also as the internal template (lining up all the fields) The exception to this is if there is an existing internal template with the same template ID as the external template. In this case, the internal template with the appropriate ID will be used. To avoid this potentially unintended consequence, be careful and deliberate with template IDs.
- Parameters
-
session pointer to the session to add the pair to ent_tid the external template ID int_tid the internal template ID used to decode the data when the associated external template is used
◆ fbSessionRemoveTemplatePair()
| void fbSessionRemoveTemplatePair | ( | fbSession_t * | session, |
| uint16_t | ext_tid | ||
| ) |
Removes a template pair from the list this is called by fixbuf when a template is revoked from the session by the node on the other end of the connection.
- Parameters
-
session pointer to the session to remove the pair from ext_tid the external template ID for the pair
◆ fbSessionLookupTemplatePair()
| uint16_t fbSessionLookupTemplatePair | ( | fbSession_t * | session, |
| uint16_t | ext_tid | ||
| ) |
Function to find a pair, uniquely identified by the external ID, and return the associated internal template ID.
- Parameters
-
session pointer to the session used to find the pair ext_tid external template ID used to find a pair
- Returns
- the internal template ID from the pair. 0 if the pair isn't found
◆ fbSessionFree()
| void fbSessionFree | ( | fbSession_t * | session | ) |
Frees a transport session state container.
This is done automatically when freeing the listener or buffer with which the session is associated. Use this call if a session needs to be destroyed before it is associated.
- Parameters
-
session session state container to free.
◆ fbSessionResetExternal()
| void fbSessionResetExternal | ( | fbSession_t * | session | ) |
Resets the external state (sequence numbers and templates) in a session state container.
FIXME: Verify that this call actually makes sense; either that a session is reassociatable with a new collector, or that you need to do this when reassociating a collector with a connection. Once this is done, rewrite this documentation
- Parameters
-
session session state container to reset
◆ fbSessionSetDomain()
| void fbSessionSetDomain | ( | fbSession_t * | session, |
| uint32_t | domain | ||
| ) |
Sets the current observation domain on a session.
The domain is used to scope sequence numbers and external templates. This is called automatically during collection, but must be called to set the domain for export before adding external templates or writing records.
Notice that a domain change does not automatically cause any associated export buffers to emit messages; a domain change takes effect with the next message started. Therefore, call fBufEmit() before setting the domain on the buffer's associated session.
- Parameters
-
session a session state container domain ID of the observation domain to set
◆ fbSessionGetDomain()
| uint32_t fbSessionGetDomain | ( | fbSession_t * | session | ) |
Retrieves the current domain on a session.
- Parameters
-
session a session state container
- Returns
- the ID of the session's current observation domain
◆ fbSessionGetLargestInternalTemplateSize()
| uint16_t fbSessionGetLargestInternalTemplateSize | ( | fbSession_t * | session | ) |
Gets the largest decoded size of an internal template in the session.
This is the number of bytes needed by store the largest record described by an internal template in the session.
- Parameters
-
session a session
- Returns
- The number of bytes needed to store the largest record described by an internal template in the session
- Since
- libfixbuf 2.2.0
◆ fbSessionGetCollector()
| fbCollector_t * fbSessionGetCollector | ( | fbSession_t * | session | ) |
Retrieves the collector that was created with the session.
- Parameters
-
session a session state container
- Returns
- fbCollector_t the collector that was created with the session
◆ fbSessionAddTemplatesMulticast()
| uint16_t fbSessionAddTemplatesMulticast | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | internal, | ||
| uint16_t | tid, | ||
| fbTemplate_t * | tmpl, | ||
| GError ** | err | ||
| ) |
Sets and sends templates for 1 or more groups.
This loops through the groups and adds the template to each group's session and adds the template to the buffer. This function is really meant for external templates, since they are exported, although can be used for internal templates. Since internal templates are not managed per group, they can simply be added with fbSessionAddTemplate(). It is necessary to use this function if you plan on managing templates per group. Using fbSessionAddTemplate() will not allow you to send a tmpl(s) to more than 1 group.
- Parameters
-
session a session state container groups group names internal TRUE for internal tmpl, FALSE for external tid template id, or FB_TID_AUTO for an arbitrary ID tmpl pointer to template with template id tid err error mesasge
- Returns
- template ID or 0 on failure
- See also
- fbSessionAddTemplatesMulticastWithMetadata(), fbSessionAddTemplate() for additional information
◆ fbSessionAddTemplatesMulticastWithMetadata()
| uint16_t fbSessionAddTemplatesMulticastWithMetadata | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | internal, | ||
| uint16_t | tid, | ||
| fbTemplate_t * | tmpl, | ||
| char * | name, | ||
| char * | description, | ||
| GError ** | err | ||
| ) |
Sets and sends templates for 1 or more groups.
This loops through the groups and adds the template to each group's session and adds the template to the buffer. This function is really meant for external templates, since they are exported, although can be used for internal templates. Since internal templates are not managed per group, they can simply be added with fbSessionAddTemplate(). It is necessary to use this function if you plan on managing templates per group. Using fbSessionAddTemplate() will not allow you to send a tmpl(s) to more than 1 group.
- Parameters
-
session a session state container groups group names internal TRUE for internal tmpl, FALSE for external tid template id tmpl pointer to template with template id tid name name of template (required) description description of template (optional) err error mesasge
- Returns
- template ID, or 0 on error
◆ fbSessionSpreadEnableTemplateMetadata()
| gboolean fbSessionSpreadEnableTemplateMetadata | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | enabled, | ||
| GError ** | err | ||
| ) |
Enables template metadata export for Spread Sessions.
This function is a wrapper over fbSessionSpreadSetMetadataExportTemplates() with tid set to FB_TID_AUTO.
- Parameters
-
session pointer groups spread groups to enable enabled TRUE to enable template metadata export, FALSE to disable err error message
- Returns
- TRUE on sucess, FALSE if IE template-metadata template could not be added to the session.
◆ fbSessionSpreadSetMetadataExportTemplates()
| uint16_t fbSessionSpreadSetMetadataExportTemplates | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | enabled, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Enables template metadata export for Spread Sessions.
Template metadata is the name and description specified by fbSessionAddTemplatesMulticastWithMetadata(). When enabled is TRUE, configures a session to send option records that describe templates. Regardless of the enabled value, this function creates the template-metadata template and adds it to the session with the template ID tid or an arbitrary ID when tid is FB_TID_AUTO.
- Parameters
-
session pointer groups spread groups to enable enabled TRUE to enable template metadata export, FALSE to disable tid the template id to use for template-metadata records err error message
- Returns
- the template id for template-metadata records or 0 if the template could not be added to the session.
◆ fbSessionSpreadEnableTypeMetadata()
| gboolean fbSessionSpreadEnableTypeMetadata | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | enabled, | ||
| GError ** | err | ||
| ) |
Enables RFC 5610 information element metadata export for Spread Sessions.
When enabled is TRUE, configures the session to send option records for each private enterprise element added to the information model. This function is a wrapper over fbSessionSpreadSetMetadataExportElements() with tid set to FB_TID_AUTO.
- Parameters
-
session pointer groups spread groups to enable enabled TRUE to enable metadata export, FALSE to disable err error message
- Returns
- TRUE on sucess, FALSE if IE type template could not be added to the session.
◆ fbSessionSpreadSetMetadataExportElements()
| uint16_t fbSessionSpreadSetMetadataExportElements | ( | fbSession_t * | session, |
| char ** | groups, | ||
| gboolean | enabled, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Enables RFC 5610 information element metadata export for Spread Sessions.
When enabled is TRUE, configures a session to send option records for each private enterprise element added to the information model. Regardless of the enabled value, this function creates the type information template and adds it to the session with the template ID tid or an arbitrary ID when tid is FB_TID_AUTO.
- Parameters
-
session pointer groups spread groups to enable enabled TRUE to enable metadata export, FALSE to disable tid the template id to use for type metadata records err error message
- Returns
- the template id for type-information records or 0 if the template could not be added to the session.
- Since
- libfixbuf 2.3.0
◆ fbSessionExportTemplate()
| gboolean fbSessionExportTemplate | ( | fbSession_t * | session, |
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Exports a single external template in the current domain of a given session.
Writes the template to the associated export buffer. May cause a message to be emitted if the associated export buffer is in automatic mode, or return with FB_ERROR_EOM if the associated export buffer is not in automatic mode.
Also exports an options record containing the template's name and description if they were specified (fbSessionAddTemplateWithMetadata()) and metadata export is enabled (fbSessionSetMetadataExportTemplates()).
- Parameters
-
session a session state container associated with an export buffer tid template ID within current domain to export err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
◆ fbSessionExportTemplates()
| gboolean fbSessionExportTemplates | ( | fbSession_t * | session, |
| GError ** | err | ||
| ) |
Exports all external templates in the current domain of a given session.
Writes templates to the associated export buffer. May cause a message to be emitted if the associated export buffer is in automatic mode, or return with FB_ERROR_EOM if the associated export buffer is not in automatic mode.
When template and/or information element metadata is enabled, those options records are also exported.
All external templates are exported each time this function is called.
- Parameters
-
session a session state container associated with an export buffer err an error description, set on failure.
- Returns
- TRUE on success, FALSE on failure.
- See also
- fbSessionSetMetadataExportTemplates() to enable template metadata, fbSessionSetMetadataExportElements() to enable information element metadata
◆ fbSessionAddTemplate()
| uint16_t fbSessionAddTemplate | ( | fbSession_t * | session, |
| gboolean | internal, | ||
| uint16_t | tid, | ||
| fbTemplate_t * | tmpl, | ||
| GError ** | err | ||
| ) |
Adds a template to a session.
If external, adds the template to the current domain, and exports the template if the session is associated with an export buffer. Gives the template the ID specified in tid, or assigns the template an arbitrary ID if tid is FB_TID_AUTO.
Calling this function twice with the same parameters may cause the template to be freed and the session to keep a handle to the invalid template. If necessary, first use fbSessionGetTemplate() to check for the presence of the template on the session.
- Parameters
-
session A session state container internal TRUE if the template is internal, FALSE if external. tid Template ID to assign, replacing any current template in case of collision; or FB_TID_AUTO to assign a new tId. tmpl Template to add err An error description, set on failure
- Returns
- the template ID of the added template, or 0 on failure.
◆ fbSessionRemoveTemplate()
| gboolean fbSessionRemoveTemplate | ( | fbSession_t * | session, |
| gboolean | internal, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Removes a template from a session.
If external, removes the template from the current domain, and exports a template revocation set if the session is associated with an export buffer.
- Parameters
-
session A session state container internal TRUE if the template is internal, FALSE if external. tid Template ID to remove. err An error description, set on failure
- Returns
- TRUE on success, FALSE on failure.
◆ fbSessionGetTemplate()
| fbTemplate_t * fbSessionGetTemplate | ( | fbSession_t * | session, |
| gboolean | internal, | ||
| uint16_t | tid, | ||
| GError ** | err | ||
| ) |
Retrieves a template from a session by ID.
If external, retrieves the template within the current domain.
- Parameters
-
session A session state container internal TRUE if the template is internal, FALSE if external. tid ID of the template to retrieve. err An error description, set on failure. May be NULL.
- Returns
- The template with the given ID, or NULL on failure.
◆ fbExporterAllocNet()
| fbExporter_t * fbExporterAllocNet | ( | fbConnSpec_t * | spec | ) |
Allocates an exporting process endpoint for a network connection.
The remote collecting process is specified by the given connection specifier. The underlying socket connection will not be opened until the first message is emitted from the buffer associated with the exporter.
- Parameters
-
spec remote endpoint connection specifier. A copy is made for the exporter, it is freed later. User is responsible for original spec pointer
- Returns
- a new exporting process endpoint
◆ fbCollectorGetSpreadReturnGroups()
| int fbCollectorGetSpreadReturnGroups | ( | fbCollector_t * | collector, |
| char * | groups[] | ||
| ) |
This function is useful if need to know what groups were set on the message.
Also useful if you are subscribed to more than 1 group, or want to know what other groups the message published to.
- Parameters
-
collector groups of groups
- Returns
- number in the array of groups
◆ fbExporterAllocSpread()
| fbExporter_t * fbExporterAllocSpread | ( | fbSpreadParams_t * | params | ) |
Allocates an exporting process endpoint for a Spread connection.
This connection will use the Spread toolkit for exporting and collecting IPFIX records. Note that the connection to the Spread daemon will not take place until the first message is emitted from the buffer. This is not synonymous with appending the first record to the buffer. NOTE: unlike the other connection specifiers, the session MUST be set in the fbSpreadSpec_t structure BEFORE it is passed to this method.
- Parameters
-
params Spread connection specifier
- Returns
- a new exporting process endpoint
◆ fbExporterAllocFile()
| fbExporter_t * fbExporterAllocFile | ( | const char * | path | ) |
Allocates an exporting process endpoint for a named file.
The underlying file will not be opened until the first message is emitted from the buffer associated with the exporter.
- Parameters
-
path pathname of the IPFIX File to write, or "-" to open standard output. Path is duplicated and handled. Original pointer is up to the user.
- Returns
- a new exporting process endpoint
◆ fbExporterAllocBuffer()
| fbExporter_t * fbExporterAllocBuffer | ( | uint8_t * | buf, |
| uint16_t | bufsize | ||
| ) |
Allocates an exporting process to use the existing buffer buf having the specified size.
Each call to fBufEmit() copies data into buf starting at buf[0]; use fbExporterGetMsgLen() to get the number of bytes copied into buf.
- Parameters
-
buf existing buffer that IPFIX messages are copied to bufsize size of the buffer
- Returns
- a new exporting process endpoint
◆ fbExporterAllocFP()
| fbExporter_t * fbExporterAllocFP | ( | FILE * | fp | ) |
Allocates an exporting process endpoint for an opened ANSI C file pointer.
- Parameters
-
fp open file pointer to write to. File pointer is created and freed outside of the Exporter functions.
- Returns
- a new exporting process endpoint
◆ fbExporterSetStream()
| void fbExporterSetStream | ( | fbExporter_t * | exporter, |
| int | sctp_stream | ||
| ) |
Sets the SCTP stream for the next message exported.
To change the SCTP stream used for export, first emit any message in the exporter's associated buffer with fbufEmit(), then use this call to set the stream for the next message. This call cancels automatic stream selection, use fbExporterAutoStream() to re-enable it. This call is a no-op for non-SCTP exporters.
- Parameters
-
exporter an exporting process endpoint. sctp_stream SCTP stream to use for next message.
◆ fbExporterAutoStream()
| void fbExporterAutoStream | ( | fbExporter_t * | exporter | ) |
Enables automatic SCTP stream selection for the next message exported.
Automatic stream selection is the default; use this call to re-enable it on a given exporter after using fbExporterSetStream(). With automatic stream selection, the minimal behavior specified in the original IPFIX protocol (RFC xxxx) is used: all templates and options templates are exported on stream 0, and all data is exported on stream 1. This call is a no-op for non-SCTP exporters.
- Parameters
-
exporter an exporting process endpoint.
◆ fbExporterClose()
| void fbExporterClose | ( | fbExporter_t * | exporter | ) |
Forces the file or socket underlying an exporting process endpoint to close.
No effect on open file endpoints. The file or socket may be reopened on a subsequent message emission from the associated buffer.
- Parameters
-
exporter an exporting process endpoint.
◆ fbExporterGetMsgLen()
| size_t fbExporterGetMsgLen | ( | fbExporter_t * | exporter | ) |
Gets the (transcoded) message length that was copied to the exporting buffer upon fBufEmit() when using fbExporterAllocBuffer().
- Parameters
-
exporter an exporting process endpoint.
◆ fbCollectorAllocFile()
| fbCollector_t * fbCollectorAllocFile | ( | void * | ctx, |
| const char * | path, | ||
| GError ** | err | ||
| ) |
Allocates a collecting process endpoint for a named file.
The underlying file will be opened immediately.
- Parameters
-
ctx application context; for application use, retrievable by fbCollectorGetContext() path path of file to read, or "-" to read standard input. Used to get fp, user creates and frees. err An error description, set on failure.
- Returns
- a collecting process endpoint, or NULL on failure.
◆ fbCollectorAllocFP()
| fbCollector_t * fbCollectorAllocFP | ( | void * | ctx, |
| FILE * | fp | ||
| ) |
Allocates a collecting process endpoint for an open file.
- Parameters
-
ctx application context; for application use, retrievable by fbCollectorGetContext() fp file pointer to file to read. Created and freed by user. Must be kept around for the life of the collector.
- Returns
- a collecting process endpoint.
◆ fbCollectorAllocSpread()
| fbCollector_t * fbCollectorAllocSpread | ( | void * | ctx, |
| fbSpreadParams_t * | params, | ||
| GError ** | err | ||
| ) |
Allocates a collecting process endpoint for the Spread transport.
- Parameters
-
ctx application context params point to fbSpreadSpec_t containing Spread params err error description, set on failure
- Returns
- a collecting endpoint, or null on failure
◆ fbCollectorGetContext()
| void * fbCollectorGetContext | ( | fbCollector_t * | collector | ) |
Retrieves the application context associated with a collector.
This context is taken from the ctx argument of fbCollectorAllocFile() or fbCollectorAllocFP(), or passed out via the ctx argument of the appinit function argument (fbListenerAppInit_fn) to fbListenerAlloc().
- Parameters
-
collector a collecting process endpoint.
- Returns
- the application context
◆ fbCollectorClose()
| void fbCollectorClose | ( | fbCollector_t * | collector | ) |
Closes the file or socket underlying a collecting process endpoint.
No effect on open file endpoints. If the collector is attached to a buffer managed by a listener, the buffer will be removed from the listener (that is, it will not be returned by subsequent fbListenerWait() calls).
- Parameters
-
collector a collecting process endpoint.
◆ fbCollectorSetAcceptOnly()
| void fbCollectorSetAcceptOnly | ( | fbCollector_t * | collector, |
| struct sockaddr * | address, | ||
| size_t | address_length | ||
| ) |
Sets the collector to only receive from the given IP address over UDP.
The port will be ignored. Use fbListenerGetCollector() to get the pointer to the collector after calling fbListenerAlloc(). ONLY valid for UDP. Set the address family in address.
- Parameters
-
collector pointer to collector address pointer to sockaddr struct with IP address and family. address_length address length
◆ fbListenerAlloc()
| fbListener_t * fbListenerAlloc | ( | fbConnSpec_t * | spec, |
| fbSession_t * | session, | ||
| fbListenerAppInit_fn | appinit, | ||
| fbListenerAppFree_fn | appfree, | ||
| GError ** | err | ||
| ) |
Allocates a listener.
The listener will listen on a specified local endpoint, and create a new collecting process endpoint and collection buffer for each incoming connection. Each new buffer will be associated with a clone of a given session state container.
The application may associate context with each created collecting process endpoint, or veto a connection attempt, via a function colled on each connection attempt passed in via the appinit parameter. If this function will create application context, provide a function via the appfree parameter which will free it.
The fbListener_t returned should be freed by the application by calling fbListenerFree().
- Parameters
-
spec local endpoint connection specifier. A copy is made of this, which is freed by listener. Original pointer freeing is up to the user. session session state container to clone for each collection buffer created by the listener. Not freed by listener. Must be kept alive while listener exists. appinit application connection initiation function. Called on each collection attempt; vetoes connection attempts and creates application context. appfree application context free function. err An error description, set on failure.
- Returns
- a new listener, or NULL on failure.
◆ fbListenerFree()
| void fbListenerFree | ( | fbListener_t * | listener | ) |
Frees a listener.
Stops listening on the local endpoint, and frees any open buffers still managed by the listener.
- Parameters
-
listener a listener
◆ fbListenerWait()
| fBuf_t * fbListenerWait | ( | fbListener_t * | listener, |
| GError ** | err | ||
| ) |
Waits on a listener.
Accepts pending connections from exporting processes. Returns the next collection buffer with available data to read; if the collection buffer returned by the last call to fbListenerWait() is available, it is preferred. Blocks forever (or until fbListenerInterrupt() is called) if no messages or connections are available.
To effectively use fbListenerWait(), the application should set up an session state container with internal templates, call fbListenerWait() to accept a first connection, then read records from the collector buffer to end of message (FB_ERROR_EOM). At end of message, the application should then call fbListenerWait() to accept pending connections or switch to another collector buffer with available data. Note that each collector buffer returned created by fbListenerWait() is set to automatic mode using fBufSetAutomaticMode(). To modify this behavior, call fBufSetAutomaticMode(fbuf, TRUE) on the fbuf returned from this function.
- Parameters
-
listener a listener err An error description, set on failure.
- Returns
- a collection buffer with available data, or NULL on failure.
◆ fbListenerWaitNoCollectors()
| fBuf_t * fbListenerWaitNoCollectors | ( | fbListener_t * | listener, |
| GError ** | err | ||
| ) |
Waits for an incoming connection, just like fbListenerWait(), except that this function doesn't monitor active collectors.
This allows for a multi threaded application to have one thread monitoring the listeners, and one keeping track of collectors
- Parameters
-
listener The listener to wait for connections on err An error description, set on failure.
- Returns
- a collection buffer for the new connection, NULL on failure.
◆ fbListenerInterrupt()
| void fbListenerInterrupt | ( | fbListener_t * | listener | ) |
Causes the current or next call to fbListenerWait() to unblock and return.
Use this from a thread or a signal handler to interrupt a blocked listener.
- Parameters
-
listener listener to interrupt.
◆ fbListenerGetCollector()
| gboolean fbListenerGetCollector | ( | fbListener_t * | listener, |
| fbCollector_t ** | collector, | ||
| GError ** | err | ||
| ) |
If a collector is associated with the listener class, this will return a handle to the collector state structure.
- Parameters
-
listener handle to the listener state collector pointer to a collector state pointer, set on return if there is no error err a GError structure holding an error message on error
- Returns
- FALSE on error, check err, TRUE on success
◆ fbCollectorClearTranslator()
| gboolean fbCollectorClearTranslator | ( | fbCollector_t * | collector, |
| GError ** | err | ||
| ) |
Removes an input translator from a given collector such that it will operate on IPFIX protocol again.
- Parameters
-
collector the collector on which to remove the translator err when an error occurs, a GLib GError structure is set with an error description
- Returns
- TRUE on success, FALSE on failure
◆ fbCollectorSetNetflowV9Translator()
| gboolean fbCollectorSetNetflowV9Translator | ( | fbCollector_t * | collector, |
| GError ** | err | ||
| ) |
Sets the collector input translator to convert NetFlowV9 into IPFIX for the given collector.
- Parameters
-
collector pointer to the collector state to perform Netflow V9 conversion on err GError structure that holds the error message if an error occurs
- Returns
- TRUE on success, FALSE on error
◆ fbCollectorSetSFlowTranslator()
| gboolean fbCollectorSetSFlowTranslator | ( | fbCollector_t * | collector, |
| GError ** | err | ||
| ) |
Sets the collector input translator to convert SFlow into IPFIX for the given collector.
- Parameters
-
collector pointer to the collector state to perform SFlow conversion on err GError structure that holds the error message if an error occurs
- Returns
- TRUE on success, FALSE on error
◆ fbCollectorGetNetflowMissed()
| uint32_t fbCollectorGetNetflowMissed | ( | fbCollector_t * | collector, |
| struct sockaddr * | peer, | ||
| size_t | peerlen, | ||
| uint32_t | obdomain | ||
| ) |
Returns the number of potential missed export packets of the Netflow v9 session that is currently set on the collector (the session is set on the collector when an export packet is received) if peer is NULL.
If peer is set, this will look up the session for that peer/obdomain pair and return the missed export packets associated with that peer and obdomain. If peer/obdomain pair doesn't exist, this function returns 0. This can't return the number of missed flow records since Netflow v9 increases sequence numbers by the number of export packets it has sent, NOT the number of flow records (like IPFIX and netflow v5 does).
- Parameters
-
collector peer [OPTIONAL] peer address of NetFlow v9 exporter peerlen size of peer object obdomain observation domain of NetFlow v9 exporter
- Returns
- number of missed packets since beginning of session
◆ fbCollectorGetSFlowMissed()
| uint32_t fbCollectorGetSFlowMissed | ( | fbCollector_t * | collector, |
| struct sockaddr * | peer, | ||
| size_t | peerlen, | ||
| uint32_t | obdomain | ||
| ) |
Returns the number of potential missed export packets of the SFlow session that is identified with the given ip/agentID.
The agent ID is a field that is in the sFlow header and is sent with every packet. Fixbuf keeps track of sequence numbers for sFlow sessions per agent ID.
- Parameters
-
collector peer address of exporter to lookup peerlen sizeof(peer) obdomain observation domain of peer exporter
- Returns
- number of missed packets since beginning of session
◆ fbCollectorGetPeer()
| struct sockaddr * fbCollectorGetPeer | ( | fbCollector_t * | collector | ) |
Retrieves information about the node connected to this collector.
- Parameters
-
collector pointer to the collector to get peer information from
- Returns
- pointer to sockaddr structure containing IP information of peer
◆ fbCollectorGetObservationDomain()
| uint32_t fbCollectorGetObservationDomain | ( | fbCollector_t * | collector | ) |
Retrieves the observation domain of the node connected to the UDP collector.
The observation domain only gets set on the collector when collecting via UDP. If the collector is using another mode of transport, use fbSessionGetDomain().
- Parameters
-
collector
◆ fbCollectorSetUDPMultiSession()
| void fbCollectorSetUDPMultiSession | ( | fbCollector_t * | collector, |
| gboolean | multi_session | ||
| ) |
Enables or disables multi-session mode for a fbCollector_t associated with a UDP fbListener_t.
The default setting is that multi-session mode is disabled.
When multi-session mode is enabled, libfixbuf invokes the appinit callback (fbListenerAppInit_fn) set on fbListenerAlloc() when a new UDP connection occurs, allowing the callback to examine the peer address and set a context for that UDP address. In addition, the appfree callback (fbListenerAppFree_fn) is invoked when the fbSession_t for that collector times-out.
Regardless of the multi-session mode setting, libfixbuf always calls the appinit function when a UDP listener is created, passing NULL as the peer address.
The caller may use fbListenerGetCollector() to get the collector given a listener.
- Parameters
-
collector pointer to collector associated with listener. multi_session TRUE to enable multi-session, FALSE to disable
Data Structure Documentation
◆ fbBasicList_st
| struct fbBasicList_st |
A basic list element in a template which structure represents a basic list on the internal side, basic lists in an IPFIX Message must be represented by this structure within the application record.
| Data Fields | ||
|---|---|---|
| const fbInfoElement_t * | infoElement | pointer to the information element that is repeated in the list |
| uint8_t * | dataPtr | pointer to the memory that stores the elements in the list |
| uint16_t | numElements | number of elements in the list |
| uint16_t | dataLength | length of the buffer used to store the elements in the list |
| uint8_t | semantic | semantic field to describe the list |
◆ fbConnSpec_st
| struct fbConnSpec_st |
Connection specifier.
Used to define a peer address for fbExporter_t, or a passive address for fbListener_t.
| Data Fields | ||
|---|---|---|
| fbTransport_t | transport | Transport protocol to use. |
| char * | host |
Hostname to connect/listen to. NULL to listen on all interfaces. |
| char * | svc | Service name or port number to connect/listen to. |
| char * | ssl_ca_file |
Path to certificate authority file. Only used for OpenSSL transport. |
| char * | ssl_cert_file |
Path to certificate file. Only used for OpenSSL transport. |
| char * | ssl_key_file |
Path to private key file. Only used for OpenSSL transport. |
| char * | ssl_key_pass |
Private key decryption password. Only used for OpenSSL transport. |
| void * | vai |
Pointer to address info cache. Initialize to NULL. For fixbuf internal use only. |
| void * | vssl_ctx |
Pointer to SSL context cache. Initialize to NULL. For fixbuf internal use only. |
◆ fbInfoElement_st
| struct fbInfoElement_st |
A single IPFIX Information Element definition.
An Information Element defines the type of data in each field of a record. This structure may be contained in an fbInfoModel_t, in which case the name field contians the information element name, or an an fbTemplate_t, in which case the canon field references the fbInfoElement_t contained within the Information Model.
| Data Fields | ||
|---|---|---|
| union fbInfoElement_st.ref | ref | Information element name. |
| uint32_t | midx |
Multiple IE index. Must be 0 for model IEs. Defines the ordering of identical IEs in templates. Set and managed automatically by the fbTemplate_t routines. |
| uint32_t | ent |
Private Enterprise Number. Set to 0 for IETF-defined IEs. |
| uint16_t | num |
Information Element number. Does not include the on-wire enterprise bit; i.e. num & 0x8000 == 0 even if ent > 0. |
| uint16_t | len | Information element length in octets. |
| uint32_t | flags |
Flags. Bitwise OR of FB_IE_F_* constants. Use Macros to get units and semantic |
| uint64_t | min | range min |
| uint64_t | max | range max |
| uint8_t | type | Data Type. |
| const char * | description | description |
◆ fbInfoElement_st.ref
| union fbInfoElement_st.ref |
Information element name.
| Data Fields | ||
|---|---|---|
| const struct fbInfoElement_st * | canon |
Pointer to canonical copy of IE. Set by fbInfoElementCopyToTemplate(), and valid only for template IEs. |
| const char * | name |
Information element name. Storage for this is managed by fbInfoModel. Valid only for model IEs. |
◆ fbInfoElementOptRec_st
| struct fbInfoElementOptRec_st |
The corresponding C struct for a record whose template is the RFC5610 Information Element Type Options Template.
If collecting this record, use the function fbInfoElementAddOptRecElement() to add the fbInfoElement_t it describes to the fbInfoModel_t.
To export RFC5610 elements, use fbSessionSetMetadataExportElements().
| Data Fields | ||
|---|---|---|
| uint32_t | ie_pen | private enterprise number |
| uint16_t | ie_id | information element id |
| uint8_t | ie_type | ie data type |
| uint8_t | ie_semantic | ie semantic |
| uint16_t | ie_units | ie units |
| uint8_t | padding[6] | padding to align with template |
| uint64_t | ie_range_begin | ie range min |
| uint64_t | ie_range_end | ie range max |
| fbVarfield_t | ie_name | information element name |
| fbVarfield_t | ie_desc | information element description |
◆ fbInfoElementSpec_st
| struct fbInfoElementSpec_st |
A single IPFIX Information Element specification.
Used to name an information element (fbInfoElement_t) for inclusion in an fbTemplate_t by fbTemplateAppendSpecArray() and for querying whether a template contains an element via fbTemplateContainsElementByName().
| Data Fields | ||
|---|---|---|
| char * | name | Information element name. |
| uint16_t | len_override |
The size of the information element in bytes. For internal templates, this is the size of the memory location that will be filled by the transcoder (i.e., the size of a field in a struct). Zero cannot be used to default the size of elements used in internal templates. This is so changes in the "default" length will not silently be different then the sizes of fields in an internal struct definition. Zero can be used as the size of FB_IE_VARLEN elements. This field can also be used to specify reduced-length encoding. |
| uint32_t | flags |
Application flags word. If nonzero, then the flags argument to fbTemplateAppendSpec(), fbTemplateAppendSpecArray(), or fbTemplateContainsAllFlaggedElementsByName() MUST match ALL the bits of this flags word in order for the information element to be considered. |
◆ fbListenerEntry_st
| struct fbListenerEntry_st |
ListenerEntry's make up an fbListenerGroup_t as a linked list.
| Data Fields | ||
|---|---|---|
| struct fbListenerEntry_st * | next | pointer to the next listener entry in the linked list |
| struct fbListenerEntry_st * | prev | pointer to the previous listener entry in the linked list |
| fbListener_t * | listener | pointer to the listener to add to the list |
◆ fbListenerGroupResult_st
| struct fbListenerGroupResult_st |
A ListenerGroupResult contains the fbListener whose listening socket got a new connection (cf.
fbListenerGroupWait()). It is tied to the fBuf_t that is produced for the connection. These comprise a linked list.
| Data Fields | ||
|---|---|---|
| struct fbListenerGroupResult_st * | next | Pointer to the next listener group result. |
| fbListener_t * | listener | pointer to the listener that received a new connection |
| fBuf_t * | fbuf | pointer to the fbuf created for that new connection |
◆ fbSpreadParams_st
| struct fbSpreadParams_st |
Spread connection parameters.
Used to define a spread daemon and group or list of groups for spread.
| Data Fields | ||
|---|---|---|
| fbSession_t * | session | pointer to the session, this MUST be set to a valid session before the spec is passed to fbExporterAllocSpread(). |
| char * | daemon |
pointer to the daemon host address, in Spread format. Must be set before the spec is passed to fbExporterAllocSpread() |
| char ** | groups | pointer to array of group names, must have at least one, and must be null term array |
◆ fbSubTemplateList_st
| struct fbSubTemplateList_st |
Structure used to hold information of a sub template list.
This structure is filled in by the user in an exporter to tell fixbuf how to encode the data. This structure is filled in by the transcoder in a collector, feeding the useful information up to the user
| Data Fields | ||
|---|---|---|
| union fbSubTemplateList_st.dataLength | dataLength |
length of the allocated buffer used to hold the data I made this a union to allow this to work on 64-bit archs |
| const fbTemplate_t * | tmpl | pointer to the template used to structure the data |
| uint8_t * | dataPtr | pointer to the buffer used to hold the data |
| uint16_t | tmplID | ID of the template used to structure the data. |
| uint16_t | numElements | number of elements in the list |
| uint8_t | semantic | value used to describe the contents of the list, all-of, one-of, etc |
◆ fbSubTemplateList_st.dataLength
| union fbSubTemplateList_st.dataLength |
◆ fbSubTemplateMultiList_st
| struct fbSubTemplateMultiList_st |
Multilists just contain the semantic to describe the sub lists, the number of sub lists, and a pointer to the first entry.
| Data Fields | ||
|---|---|---|
| fbSubTemplateMultiListEntry_t * | firstEntry | pointer to the first entry in the multi list |
| uint16_t | numElements | number of sub template lists in the multi list |
| uint8_t | semantic | value used to describe the list of sub templates |
◆ fbSubTemplateMultiListEntry_st
| struct fbSubTemplateMultiListEntry_st |
Entries contain the same type of information at SubTemplateLists: template ID and template pointers to describe the data the number of data elements and the data pointer and data length.
Sub template multi lists are inherently nested constructions. At a high level, they are a list of sub template lists. The first level is a list of fbSubTemplateMultiListEntry_t's, which each contain the information that describes the data contained in them. Initializing a fbSubTemplateMultiList_t with a semantic and number of elements returns memory that contains numElements blocks of memory containing fbSubTemplateMultiListEntry_t's. It is not ready to accept data. Each of the fbSubTemplateMultiListEntry_t's needed to be set up then data is copied into the entries.
| Data Fields | ||
|---|---|---|
| fbTemplate_t * | tmpl | pointer to the template used to structure the data in this entry |
| uint8_t * | dataPtr | pointer to the buffer used to hold the data in this entry |
| size_t | dataLength | length of the buffer used to hold the data in this entry |
| uint16_t | tmplID | ID of the template used to structure the data in this entry. |
| uint16_t | numElements | number of elements in this entry |
◆ fbVarfield_st
| struct fbVarfield_st |
A variable-length field value.
Variable-length information element content is represented by an fbVarfield_t on the internal side of the transcoder; that is, variable length fields in an IPFIX Message must be represented by this structure within the application record.
| Data Fields | ||
|---|---|---|
| size_t | len | Length of content in buffer. |
| uint8_t * | buf |
Content buffer. In network byte order as appropriate. On write, this buffer will be copied into the message buffer. On read, this buffer points into the message buffer and must be copied by the caller before any call to fBufNext(). |
