Go to the source code of this file.
Typedefs | |
| typedef struct yfFragTab_st | yfFragTab_t |
| A fragment table. | |
Functions | |
| yfFragTab_t * | yfFragTabAlloc (uint32_t idle_ms, uint32_t max_frags, uint32_t max_payload) |
| Allocate a fragment table. | |
| void | yfFragTabFree (yfFragTab_t *fragtab) |
| Free a fragment table. | |
| gboolean | yfDefragPBuf (yfFragTab_t *fragtab, yfIPFragInfo_t *fraginfo, size_t pbuflen, yfPBuf_t *pbuf, const uint8_t *pkt, size_t hdr_len) |
| Defragment a fragment returned by yfDecodeToPBuf(). | |
| void | yfFragDumpStats (yfFragTab_t *fragtab, uint64_t packetTotal) |
| Print fragment reassembler statistics to the log. | |
| void | yfGetFragTabStats (yfFragTab_t *fragtab, uint32_t *dropped, uint32_t *assembled, uint32_t *frags) |
| Get Frag Stats to yfWriteStatsFlow for Stats Export. | |
Detailed Description
Fragment reassembly interface for YAF.
[TODO - new frontmatter]
This facility is used by the YAF flow generator.
Typedef Documentation
◆ yfFragTab_t
| typedef struct yfFragTab_st yfFragTab_t |
A fragment table.
Opaque. Create with yfFragTabAlloc() and free with yfFragTabFree().
Function Documentation
◆ yfDefragPBuf()
| gboolean yfDefragPBuf | ( | yfFragTab_t * | fragtab, |
| yfIPFragInfo_t * | fraginfo, | ||
| size_t | pbuflen, | ||
| yfPBuf_t * | pbuf, | ||
| const uint8_t * | pkt, | ||
| size_t | hdr_len ) |
Defragment a fragment returned by yfDecodeToPBuf().
This adds the fragment to the given fragment table. If the fragment completes a fragmented packet, copies the assembled packet into the given pbuf, overwriting it, and returns TRUE. If the packet is not fragmented (that is, if fraginfo->frag is 0), has no effect and returns TRUE.
- Parameters
-
fragtab fragment table to add fragment to fraginfo fragment information structure filled in by yfDecodeToPBuf() pbuflen size of the packet buffer pbuf pbuf packet buffer. On call, contains decoded fragmented packet to add to the fragment table. If this call returns TRUE, on return, contains assembled packet. pkt pkt buffer from libpcap. We need this to reassemble (memcpy) TCP header fragments when payload is not enabled. hdr_len size of the packet buffer pkt
- Returns
- TRUE if pbuf is valid and contains an assembled packet, FALSE otherwise.
◆ yfFragDumpStats()
| void yfFragDumpStats | ( | yfFragTab_t * | fragtab, |
| uint64_t | packetTotal ) |
Print fragment reassembler statistics to the log.
- Parameters
-
fragtab fragment table to dump stats for packetTotal total number of packets observed
◆ yfFragTabAlloc()
| yfFragTab_t * yfFragTabAlloc | ( | uint32_t | idle_ms, |
| uint32_t | max_frags, | ||
| uint32_t | max_payload ) |
Allocate a fragment table.
- Parameters
-
idle_ms idle timeout in milliseconds. A fragmented packet for which no fragments are received over an idle timeout is dropped. Most host IPv4 implementations use 30 seconds (30000); it is recommended to use the same here. max_frags maximum number of unreassembled fragmented packets. Fragmented packets exceeding this limit will be dropped in least-recent order. Used to limit resource usage of a fragment table. A value of 0 disables fragment count limits. max_payload maximum octets of payload to capture per fragmented packet. A value of 0 disables payload reassembly.
- Returns
- a new fragment table.
◆ yfFragTabFree()
| void yfFragTabFree | ( | yfFragTab_t * | fragtab | ) |
Free a fragment table.
Discards any outstanding fragmented packets within.
- Parameters
-
fragtab a fragment table.
◆ yfGetFragTabStats()
| void yfGetFragTabStats | ( | yfFragTab_t * | fragtab, |
| uint32_t * | dropped, | ||
| uint32_t * | assembled, | ||
| uint32_t * | frags ) |
Get Frag Stats to yfWriteStatsFlow for Stats Export.
- Parameters
-
fragtab pointer to fragmentation table dropped number of expired fragments assembled number of assembled packets frags number of fragments
