172#include <yaf/autoinc.h>
173#include <yaf/decode.h>
176#if YAF_ENABLE_APPLABEL
181#define YAF_HOOK_INTERFACE_VERSION 6
258 uint32_t max_payload,
261 gboolean applabelmode,
262 gboolean entropymode,
263 gboolean fingerprintmode,
264 gboolean fpExportMode,
265 gboolean udp_multipkt_payload,
266 uint16_t udp_uniflow_port);
327 fbSession_t *session);
340 fbSubTemplateMultiList_t *rec,
341 fbSubTemplateMultiListEntry_t *stml,
360 const char *hookName,
361 const char *hookOpts,
362 const char *hookConf,
366#if YAF_ENABLE_APPLABEL
462 fbSubTemplateMultiList_t *rec,
463 fbSubTemplateMultiListEntry_t *stml,
473 fbSession_t *session);
477 const char *pluginOpt,
482 const char *pluginConf,
485#if YAF_ENABLE_APPLABEL
502 uint32_t max_payload,
505 gboolean applabelmode,
506 gboolean entropymode,
507 gboolean fingerprintmode,
508 gboolean fpExportMode,
509 gboolean udp_multipkt_payload,
510 uint16_t udp_uniflow_port,
A YAF flow.
Definition yafcore.h:409
A YAF flow key.
Definition yafcore.h:244
A YAF uniflow value.
Definition yafcore.h:314
Datalink layer information structure.
Definition decode.h:93
TCP information structure.
Definition decode.h:123
void yfHookFlowFree(yfFlow_t *flow)
Frees all memory associated with the flow state in all of the attached plugins.
void yfHookFlowPacket(yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
void yfHookValidateFlowTab(void **yfctx, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_multipkt_payload, uint16_t udp_uniflow_port)
Validation function to make sure the plugin can and should operate based on the flowtable options.
gboolean yfHookFlowWrite(fbSubTemplateMultiList_t *rec, fbSubTemplateMultiListEntry_t *stml, yfFlow_t *flow, GError **err)
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
gboolean yfHookAddNewHook(const char *hookName, const char *hookOpts, const char *hookConf, void **yfctx, GError **err)
Adds another hook (plugin) into yaf.
gboolean yfHookGetTemplate(fbSession_t *session)
Gets the IPFIX info model template for the export data from all the plugins and turns it into a singl...
fbInfoElement_t * yfHookGetInfoModel(void)
Returns the IPFIX info model aggregated for all plugins.
uint8_t yfHookGetTemplateCount(yfFlow_t *flow)
Returns the amount of templates to add to the SubtemplateMultiList from all plugins hooked.
gboolean yfHookPacket(yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Function called to do processing on each packet as it comes in.
void yfHookFreeLists(yfFlow_t *flow)
Sends control back to the plugin to free any BasicLists, SubTemplateLists, or SubTemplateMultiLists t...
gboolean yfHookFlowClose(yfFlow_t *flow)
Called upon flow close to do any necessary plugin processing upon flow close.
void yfHookFlowAlloc(yfFlow_t *flow, void **yfctx)
Allow plugins to allocate flow state information for each flow captured by yaf at the time of flow cr...
Flow generation interface for YAF.