147#include <yaf/autoinc.h>
148#include <yaf/decode.h>
151#if YAF_ENABLE_APPLABEL
156#define YAF_HOOK_INTERFACE_VERSION 6
233 uint32_t max_payload,
236 gboolean applabelmode,
237 gboolean entropymode,
238 gboolean fingerprintmode,
239 gboolean fpExportMode,
240 gboolean udp_max_payload,
241 uint16_t udp_uniflow_port);
302 fbSession_t *session);
315 fbSubTemplateMultiList_t *rec,
316 fbSubTemplateMultiListEntry_t *stml,
335 const char *hookName,
336 const char *hookOpts,
337 const char *hookConf,
341#if YAF_ENABLE_APPLABEL
437 fbSubTemplateMultiList_t *rec,
438 fbSubTemplateMultiListEntry_t *stml,
448 fbSession_t *session);
452 const char *pluginOpt,
457 const char *pluginConf,
460#if YAF_ENABLE_APPLABEL
477 uint32_t max_payload,
480 gboolean applabelmode,
481 gboolean entropymode,
482 gboolean fingerprintmode,
483 gboolean fpExportMode,
484 gboolean udp_max_payload,
485 uint16_t udp_uniflow_port,
A YAF flow.
Definition yafcore.h:377
A YAF flow key.
Definition yafcore.h:212
A YAF uniflow value.
Definition yafcore.h:282
Datalink layer information structure.
Definition decode.h:106
TCP information structure.
Definition decode.h:136
void yfHookFlowFree(yfFlow_t *flow)
Frees all memory associated with the flow state in all of the attached plugins.
void yfHookFlowPacket(yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
gboolean yfHookFlowWrite(fbSubTemplateMultiList_t *rec, fbSubTemplateMultiListEntry_t *stml, yfFlow_t *flow, GError **err)
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
gboolean yfHookAddNewHook(const char *hookName, const char *hookOpts, const char *hookConf, void **yfctx, GError **err)
Adds another hook (plugin) into yaf.
gboolean yfHookGetTemplate(fbSession_t *session)
Gets the IPFIX info model template for the export data from all the plugins and turns it into a singl...
fbInfoElement_t * yfHookGetInfoModel(void)
Returns the IPFIX info model aggregated for all plugins.
uint8_t yfHookGetTemplateCount(yfFlow_t *flow)
Returns the amount of templates to add to the SubtemplateMultiList from all plugins hooked.
gboolean yfHookPacket(yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Function called to do processing on each packet as it comes in.
void yfHookFreeLists(yfFlow_t *flow)
Sends control back to the plugin to free any BasicLists, SubTemplateLists, or SubTemplateMultiLists t...
gboolean yfHookFlowClose(yfFlow_t *flow)
Called upon flow close to do any necessary plugin processing upon flow close.
void yfHookFlowAlloc(yfFlow_t *flow, void **yfctx)
Allow plugins to allocate flow state information for each flow captured by yaf at the time of flow cr...
void yfHookValidateFlowTab(void **yfctx, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port)
Validation function to make sure the plugin can and should operate based on the flowtable options.
Flow generation interface for YAF.