98#include <yaf/autoinc.h>
99#include <fixbuf/public.h>
114#define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
116#define YAF_ERROR_HEADER 1
118#define YAF_ERROR_ARGUMENT 2
120#define YAF_ERROR_IO 3
122#define YAF_ERROR_IPFIX 4
124#define YAF_ERROR_IMPL 5
126#define YAF_ERROR_INTERNAL 6
128#define YAF_ERROR_LIMIT 7
130#define YAF_ERROR_EOF 8
132#define YAF_ERROR_ALIGNMENT 9
134#define YAF_ERROR_PACKET_PAYLOAD 10
142#define YAF_FLOW_ACTIVE 0
144#define YAF_END_IDLE 1
146#define YAF_END_ACTIVE 2
148#define YAF_END_CLOSED 3
150#define YAF_END_FORCED 4
152#define YAF_END_RESOURCE 5
154#define YAF_END_UDPFORCE 0x1F
156#define YAF_END_MASK 0x7F
158#define YAF_ENDF_ISCONT 0x80
161#define YAF_SAME_SIZE 0x01
163#define YAF_OUT_OF_SEQUENCE 0x02
165#define YAF_MP_CAPABLE 0x04
167#define YAF_FRAGMENTS 0x08
169#define YAF_PARTIAL_FRAGS 0x10
171#define YAF_FRAG_ACTIVE 0x03
173#define YAF_FRAG_PASSIVE 0x04
185#define YFP_IPTCPHEADER_SIZE 128
187#define ETHERNET_MAC_ADDR_LENGTH 6
189#define YAF_MAX_HOOKS 4
193#define YAF_HOOKS_MAX_EXPORT 1500
195#define YAF_MAX_PKT_BOUNDARY 25
197#define YAF_PCAP_MAX 5000000
199#define YAF_MAX_MPLS_LABELS 3
203#define YAF_SMALL_PKT_BOUND 60
206#define YAF_LARGE_PKT_BOUND 225
228#if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_SEPARATE_INTERFACES
287#if YAF_ENABLE_PAYLOAD
311#if YAF_ENABLE_SEPARATE_INTERFACES
314#if YAF_ENABLE_ENTROPY
332#if YAF_ENABLE_FPEXPORT
334 uint32_t firstPacketLen;
336 uint32_t secondPacketLen;
338 uint8_t *firstPacket;
340 uint8_t *secondPacket;
347typedef struct yfMPLSNode_st {
382#ifdef YAF_ENABLE_HOOKS
394#if YAF_ENABLE_APPLABEL
399 uint16_t ndpi_master;
481 gboolean export_meta,
501 gboolean export_meta,
517 gboolean export_meta,
536 fbSpreadParams_t *params,
538 uint16_t *spreadGroupIndex,
539 gboolean export_meta,
640#if YAF_ENABLE_APPLABEL
647yfWriterExportPayloadApplabels(
648 const GArray *applabels);
694 fbListenerAppInit_fn appinit,
695 fbListenerAppFree_fn appfree,
A YAF flow.
Definition yafcore.h:377
yfFlowVal_t rval
Reverse value.
Definition yafcore.h:427
uint8_t pcap_serial
Keep track of number of pcap files for this flow.
Definition yafcore.h:405
uint8_t rtos
reverse ToS (fwd in flowKey)
Definition yafcore.h:415
uint8_t pktdir
non empty packet directions, 1, or 0
Definition yafcore.h:413
yfFlowKey_t key
Flow key.
Definition yafcore.h:429
yfMPTCPFlow_t mptcp
MPTCP Flow.
Definition yafcore.h:423
uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH]
destination Mac Address
Definition yafcore.h:409
uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH]
src Mac Address
Definition yafcore.h:407
uint64_t stime
Flow start time in epoch milliseconds.
Definition yafcore.h:379
pcap_dumper_t * pcap
Pcap File Ptr.
Definition yafcore.h:417
yfFlowVal_t val
Forward value.
Definition yafcore.h:425
uint8_t pcap_file_no
Pcap File "ID" so we know when to make entries in metadata file.
Definition yafcore.h:411
uint64_t etime
Flow end time in epoch milliseconds.
Definition yafcore.h:381
uint8_t reason
Flow termination reason (YAF_END_ macros, per IPFIX standard)
Definition yafcore.h:403
A YAF flow key.
Definition yafcore.h:212
uint8_t tos
Type of Service/Traffic Class.
Definition yafcore.h:224
uint8_t version
IP Version.
Definition yafcore.h:220
uint32_t sip
Source IPv4 address.
Definition yafcore.h:237
uint32_t dip
Destination IPv4 address.
Definition yafcore.h:239
uint16_t sp
Source transport port.
Definition yafcore.h:214
uint16_t dp
Destination transport port.
Definition yafcore.h:216
uint16_t vlanId
VLAN Tag - only fwd.
Definition yafcore.h:222
union yfFlowKey_st::@0 addr
IP address two-tuple union.
uint8_t proto
IP protocol.
Definition yafcore.h:218
uint32_t layer2Id
for DAG cards need to record the interface, may only be seeing unidirectional flows on each interface...
Definition yafcore.h:232
yaf flow statistics
Definition yafcore.h:253
uint32_t smallpktct
Number of packets with fewer than YAF_SMALL_PKT_BOUND bytes of data.
Definition yafcore.h:265
uint32_t nonemptypktct
total number of non empty pkts
Definition yafcore.h:267
uint64_t ltime
used to calculate interarrival time
Definition yafcore.h:261
uint64_t iaarray[10]
to calculate inter-packet delay
Definition yafcore.h:255
uint32_t maxpktsize
largest pkt size
Definition yafcore.h:275
uint32_t largepktct
Number of packets with more than YAF_LARGE_PKT_BOUND bytes of data.
Definition yafcore.h:269
uint32_t aitime
average interarrival time in milliseconds
Definition yafcore.h:271
uint32_t firstpktsize
payload length of first non-empty pkt
Definition yafcore.h:273
uint32_t tcpurgct
Number of urgent packets.
Definition yafcore.h:263
uint32_t pktsize[10]
to calculate distribution of packet payload size
Definition yafcore.h:257
uint64_t payoct
total amount of payload data
Definition yafcore.h:259
A YAF uniflow value.
Definition yafcore.h:282
uint64_t pkt
Packet count.
Definition yafcore.h:286
uint32_t lsn
Last TCP sequence number.
Definition yafcore.h:298
uint8_t appkt
packets with payload - don't care if this wraps.
Definition yafcore.h:308
uint8_t iflags
Initial TCP flags.
Definition yafcore.h:304
yfFlowStats_t * stats
yaf flow statistics
Definition yafcore.h:343
uint64_t oct
Octet count.
Definition yafcore.h:284
uint16_t first_pkt_size
First Packet Size - to determine whether to turn on fixed size flag.
Definition yafcore.h:300
uint16_t attributes
flowAttributes
Definition yafcore.h:302
uint8_t uflags
Union of remaining TCP flags.
Definition yafcore.h:306
uint16_t vlan
VLAN TAG (also in key, but want to record both sides)
Definition yafcore.h:310
uint32_t isn
Initial TCP sequence number.
Definition yafcore.h:296
uint64_t idsn
initial data seq no.
Definition yafcore.h:359
uint16_t mss
max segment size
Definition yafcore.h:363
uint8_t addrid
addr id
Definition yafcore.h:365
uint32_t token
receiver token
Definition yafcore.h:361
uint8_t flags
hash_flags
Definition yafcore.h:367
#define YAF_MAX_MPLS_LABELS
Maximum number of labels we're going to keep around.
Definition yafcore.h:199
gboolean yfWriteOptionsDataFlows(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
A wrapper that calls both yfWriteStatsFlow and yfWriteDataFlow with appropriate condition checking.
void yfWriterExportPayload(int max_payload)
FIXME doc.
struct yfFlowKey_st yfFlowKey_t
A YAF flow key.
#define YAF_MAX_HOOKS
maximum number of hooks (plugins) allowed at one time
Definition yafcore.h:189
gboolean yfReadFlowExtended(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
fBuf_t * yfWriterForSpec(fbConnSpec_t *spec, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a socket.
fBuf_t * yfWriterForFP(FILE *fp, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to an open file pointer.
gboolean yfReadFlow(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
gboolean yfWriteFlow(void *yfContext, yfFlow_t *flow, GError **err)
Write a single flow to an IPFIX message buffer.
void yfPrintString(GString *rstr, yfFlow_t *flow)
Print a YAF flow to a GString.
void yfAlignmentCheck(void)
yfAlignmentCheck
void yfPrintDelimitedString(GString *rstr, yfFlow_t *flow, gboolean yaft_mac)
Print a YAF flow to a GString in pipe-delimited (tabular) format.
void yfFlowCleanup(yfFlow_t *flow)
Clean up after a static flow buffer prepared by yfFlowPrepare.
gboolean yfWriteTombstoneFlow(void *yfContext, GError **err)
Write a tombstone options data record to an IPFIX Message buffer.
fBuf_t * yfWriterForFile(const char *path, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a named file.
gboolean yfPrint(FILE *out, yfFlow_t *flow, GError **err)
Print a YAF flow to a file.
void yfFlowPrepare(yfFlow_t *flow)
Prepare a static flow buffer for use with yaf_flow_read().
struct yfFlowVal_st yfFlowVal_t
A YAF uniflow value.
#define ETHERNET_MAC_ADDR_LENGTH
length of Ethernet MAC Address
Definition yafcore.h:187
gboolean yfWriteStatsFlow(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
Write a statistics options data record to an IPFIX Message buffer.
fBuf_t * yfReaderForFP(fBuf_t *fbuf, FILE *fp, GError **err)
Get an IPFIX message buffer for reading YAF flows from an open file pointer.
gboolean yfPrintDelimited(FILE *out, yfFlow_t *flow, gboolean yaft_mac, GError **err)
Print a YAF flow to a file in pipe-delimited (tabular) format.
struct yfFlow_st yfFlow_t
A YAF flow.
gboolean yfWriterClose(fBuf_t *fbuf, gboolean flush, GError **err)
Close the connection underlying an IPFIX message buffer created by yfWriterForFP() or yfWriterForSpec...
void yfWriterExportMappedV6(gboolean map_mode)
FIXME doc.
void yfPrintColumnHeaders(FILE *out, gboolean yaft_mac, GError **err)
Print column headers for the pipe-delimited (tabular) format.
fbListener_t * yfListenerForSpec(fbConnSpec_t *spec, fbListenerAppInit_fn appinit, fbListenerAppFree_fn appfree, GError **err)
Get an IPFIX connection listener for collecting YAF flows via IPFIX from the network.
struct yfFlowStats_st yfFlowStats_t
yaf flow statistics