Go to the documentation of this file.
140 #ifndef _YAF_HOOKS_H_
141 #define _YAF_HOOKS_H_
143 #include <yaf/autoinc.h>
144 #include <yaf/decode.h>
147 #if YAF_ENABLE_APPLABEL
152 #define YAF_HOOK_INTERFACE_VERSION 6
223 uint32_t max_payload,
226 gboolean applabelmode,
227 gboolean entropymode,
228 gboolean fingerprintmode,
229 gboolean fpExportMode,
230 gboolean udp_max_payload,
231 uint16_t udp_uniflow_port);
287 fbSession_t *session);
298 fbSubTemplateMultiList_t *rec,
299 fbSubTemplateMultiListEntry_t *stml,
317 const char *hookName,
318 const char *hookOpts,
319 const char *hookConf,
323 #if YAF_ENABLE_APPLABEL
336 void yfHookScanPayload (
gboolean yfHookFlowClose(yfFlow_t *flow)
Called upon flow close to do any necessary plugin processing upon flow close.
gboolean yfHookGetTemplate(fbSession_t *session)
Gets the IPFIX info model template for the export data from all the plugins and turns it into a singl...
TCP information structure.
Definition: decode.h:139
gboolean yfHookPacket(yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Function called to do processing on each packet as it comes in.
fbInfoElement_t * yfHookGetInfoModel(void)
Returns the IPFIX info model aggregated for all plugins.
A YAF uniflow value.
Definition: yafcore.h:276
A YAF flow key.
Definition: yafcore.h:208
gboolean yfHookAddNewHook(const char *hookName, const char *hookOpts, const char *hookConf, void **yfctx, GError **err)
Adds another hook (plugin) into yaf.
void yfHookFlowPacket(yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
void yfHookFlowAlloc(yfFlow_t *flow, void **yfctx)
Allow plugins to allocate flow state information for each flow captured by yaf at the time of flow cr...
Flow generation interface for YAF.
uint8_t yfHookGetTemplateCount(yfFlow_t *flow)
Returns the amount of templates to add to the SubtemplateMultiList from all plugins hooked.
Datalink layer information structure.
Definition: decode.h:109
void yfHookFreeLists(yfFlow_t *flow)
Sends control back to the plugin to free any BasicLists, SubTemplateLists, or SubTemplateMultiLists t...
void yfHookValidateFlowTab(void **yfctx, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port)
Validation function to make sure the plugin can and should operate based on the flowtable options.
gboolean yfWriteFlowHook(fbSubTemplateMultiList_t *rec, fbSubTemplateMultiListEntry_t *stml, yfFlow_t *flow, GError **err)
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
void yfHookFlowFree(yfFlow_t *flow)
Frees all memory associated with the flow state in all of the attached plugins.
A YAF flow.
Definition: yafcore.h:371