104#include <yaf/autoinc.h>
105#include <fixbuf/public.h>
120#define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
122#define YAF_ERROR_HEADER 1
124#define YAF_ERROR_ARGUMENT 2
126#define YAF_ERROR_IO 3
128#define YAF_ERROR_IPFIX 4
130#define YAF_ERROR_IMPL 5
132#define YAF_ERROR_INTERNAL 6
134#define YAF_ERROR_LIMIT 7
136#define YAF_ERROR_EOF 8
138#define YAF_ERROR_ALIGNMENT 9
140#define YAF_ERROR_PACKET_PAYLOAD 10
148#define YAF_FLOW_ACTIVE 0
150#define YAF_END_IDLE 1
152#define YAF_END_ACTIVE 2
154#define YAF_END_CLOSED 3
156#define YAF_END_FORCED 4
158#define YAF_END_RESOURCE 5
160#define YAF_END_UDPFORCE 0x1F
162#define YAF_SAME_SIZE 0x01
164#define YAF_OUT_OF_SEQUENCE 0x02
166#define YAF_MP_CAPABLE 0x04
168#define YAF_FRAGMENTS 0x08
170#define YAF_PARTIAL_FRAGS 0x10
172#define YAF_FRAG_ACTIVE 0x03
174#define YAF_FRAG_PASSIVE 0x04
176#define YAF_END_MASK 0x7F
179#define YAF_ENDF_ISCONT 0x80
191#define YFP_IPTCPHEADER_SIZE 128
193#define ETHERNET_MAC_ADDR_LENGTH 6
195#define YAF_MAX_HOOKS 4
199#define YAF_HOOKS_MAX_EXPORT 1500
201#define YAF_MAX_PKT_BOUNDARY 25
203#define YAF_PCAP_MAX 5000000
205#define YAF_MAX_MPLS_LABELS 3
227#if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_SEPARATE_INTERFACES
284# if YAF_ENABLE_PAYLOAD
308# if YAF_ENABLE_SEPARATE_INTERFACES
311# if YAF_ENABLE_ENTROPY
329# if YAF_ENABLE_FPEXPORT
331 uint32_t firstPacketLen;
333 uint32_t secondPacketLen;
335 uint8_t *firstPacket;
337 uint8_t *secondPacket;
344typedef struct yfMPLSNode_st {
379#ifdef YAF_ENABLE_HOOKS
391#if YAF_ENABLE_APPLABEL
396 uint16_t ndpi_master;
478 gboolean export_meta,
498 gboolean export_meta,
514 gboolean export_meta,
533 fbSpreadParams_t *params,
535 uint16_t *spreadGroupIndex,
536 gboolean export_meta,
638#if YAF_ENABLE_APPLABEL
645yfWriterExportPayloadApplabels(
646 const GArray *applabels);
692 fbListenerAppInit_fn appinit,
693 fbListenerAppFree_fn appfree,
A YAF flow.
Definition: yafcore.h:374
yfFlowVal_t rval
Reverse value.
Definition: yafcore.h:424
uint8_t pcap_serial
Keep track of number of pcap files for this flow.
Definition: yafcore.h:402
uint8_t rtos
reverse ToS (fwd in flowKey)
Definition: yafcore.h:412
uint8_t pktdir
non empty packet directions, 1, or 0
Definition: yafcore.h:410
yfFlowKey_t key
Flow key.
Definition: yafcore.h:426
yfMPTCPFlow_t mptcp
MPTCP Flow.
Definition: yafcore.h:420
uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH]
destination Mac Address
Definition: yafcore.h:406
uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH]
src Mac Address
Definition: yafcore.h:404
uint64_t stime
Flow start time in epoch milliseconds.
Definition: yafcore.h:376
pcap_dumper_t * pcap
Pcap File Ptr.
Definition: yafcore.h:414
yfFlowVal_t val
Forward value.
Definition: yafcore.h:422
uint8_t pcap_file_no
Pcap File "ID" so we know when to make entries in metadata file.
Definition: yafcore.h:408
uint64_t etime
Flow end time in epoch milliseconds.
Definition: yafcore.h:378
uint8_t reason
Flow termination reason (YAF_END_ macros, per IPFIX standard)
Definition: yafcore.h:400
A YAF flow key.
Definition: yafcore.h:211
uint8_t tos
Type of Service/Traffic Class.
Definition: yafcore.h:223
uint8_t version
IP Version.
Definition: yafcore.h:219
uint32_t sip
Source IPv4 address.
Definition: yafcore.h:234
uint32_t dip
Destination IPv4 address.
Definition: yafcore.h:236
uint16_t sp
Source transport port.
Definition: yafcore.h:213
uint16_t dp
Destination transport port.
Definition: yafcore.h:215
uint16_t vlanId
VLAN Tag - only fwd.
Definition: yafcore.h:221
union yfFlowKey_st::@0 addr
for DAG cards need to record the interface, may only be seeing unidirectional flows on each interface...
uint8_t proto
IP protocol.
Definition: yafcore.h:217
yaf flow statistics
Definition: yafcore.h:250
uint32_t smallpktct
Number of packets with 60 bytes or less of data.
Definition: yafcore.h:262
uint32_t nonemptypktct
total number of non empty pkts
Definition: yafcore.h:264
uint64_t ltime
used to calculate interarrival time
Definition: yafcore.h:258
uint64_t iaarray[10]
to calculate inter-packet delay
Definition: yafcore.h:252
uint32_t maxpktsize
largest pkt size
Definition: yafcore.h:272
uint32_t largepktct
total number of packets with 225 bytes or more
Definition: yafcore.h:266
uint32_t aitime
average interarrival time in milliseconds
Definition: yafcore.h:268
uint32_t firstpktsize
payload length of first non-empty pkt
Definition: yafcore.h:270
uint32_t tcpurgct
Number of urgent packets.
Definition: yafcore.h:260
uint32_t pktsize[10]
to calculate distribution of packet payload size
Definition: yafcore.h:254
uint64_t payoct
total amount of payload data
Definition: yafcore.h:256
A YAF uniflow value.
Definition: yafcore.h:279
uint64_t pkt
Packet count.
Definition: yafcore.h:283
uint32_t lsn
Last TCP sequence number.
Definition: yafcore.h:295
uint8_t appkt
packets with payload - don't care if this wraps.
Definition: yafcore.h:305
uint8_t iflags
Initial TCP flags.
Definition: yafcore.h:301
yfFlowStats_t * stats
yaf flow statistics
Definition: yafcore.h:340
uint64_t oct
Octet count.
Definition: yafcore.h:281
uint16_t first_pkt_size
First Packet Size - to determine whether to turn on fixed size flag.
Definition: yafcore.h:297
uint16_t attributes
flowAttributes
Definition: yafcore.h:299
uint8_t uflags
Union of remaining TCP flags.
Definition: yafcore.h:303
uint16_t vlan
VLAN TAG (also in key, but want to record both sides)
Definition: yafcore.h:307
uint32_t isn
Initial TCP sequence number.
Definition: yafcore.h:293
Definition: yafcore.h:354
uint64_t idsn
initial data seq no.
Definition: yafcore.h:356
uint16_t mss
max segment size
Definition: yafcore.h:360
uint8_t addrid
addr id
Definition: yafcore.h:362
uint32_t token
receiver token
Definition: yafcore.h:358
uint8_t flags
hash_flags
Definition: yafcore.h:364
#define YAF_MAX_MPLS_LABELS
Maximum number of labels we're going to keep around.
Definition: yafcore.h:205
gboolean yfWriteOptionsDataFlows(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
A wrapper that calls both yfWriteStatsFlow and yfWriteDataFlow with appropriate condition checking.
void yfWriterExportPayload(int max_payload)
FIXME doc.
struct yfFlowKey_st yfFlowKey_t
A YAF flow key.
#define YAF_MAX_HOOKS
maximum number of hooks (plugins) allowed at one time
Definition: yafcore.h:195
gboolean yfReadFlowExtended(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
fBuf_t * yfWriterForSpec(fbConnSpec_t *spec, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a socket.
fBuf_t * yfWriterForFP(FILE *fp, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to an open file pointer.
gboolean yfReadFlow(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
gboolean yfWriteFlow(void *yfContext, yfFlow_t *flow, GError **err)
Write a single flow to an IPFIX message buffer.
void yfPrintString(GString *rstr, yfFlow_t *flow)
Print a YAF flow to a GString.
void yfAlignmentCheck(void)
yfAlignmentCheck
void yfPrintDelimitedString(GString *rstr, yfFlow_t *flow, gboolean yaft_mac)
Print a YAF flow to a GString in pipe-delimited (tabular) format.
void yfFlowCleanup(yfFlow_t *flow)
Clean up after a static flow buffer prepared by yfFlowPrepare.
gboolean yfWriteTombstoneFlow(void *yfContext, GError **err)
Write a tombstone options data record to an IPFIX Message buffer.
fBuf_t * yfWriterForFile(const char *path, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a named file.
gboolean yfPrint(FILE *out, yfFlow_t *flow, GError **err)
Print a YAF flow to a file.
void yfFlowPrepare(yfFlow_t *flow)
Prepare a static flow buffer for use with yaf_flow_read().
struct yfFlowVal_st yfFlowVal_t
A YAF uniflow value.
#define ETHERNET_MAC_ADDR_LENGTH
length of Ethernet MAC Address
Definition: yafcore.h:193
gboolean yfWriteStatsFlow(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
Write a statistics options data record to an IPFIX Message buffer.
fBuf_t * yfReaderForFP(fBuf_t *fbuf, FILE *fp, GError **err)
Get an IPFIX message buffer for reading YAF flows from an open file pointer.
gboolean yfPrintDelimited(FILE *out, yfFlow_t *flow, gboolean yaft_mac, GError **err)
Print a YAF flow to a file in pipe-delimited (tabular) format.
struct yfFlow_st yfFlow_t
A YAF flow.
gboolean yfWriterClose(fBuf_t *fbuf, gboolean flush, GError **err)
Close the connection underlying an IPFIX message buffer created by yfWriterForFP() or yfWriterForSpec...
void yfWriterExportMappedV6(gboolean map_mode)
FIXME doc.
void yfPrintColumnHeaders(FILE *out, gboolean yaft_mac, GError **err)
Print column headers for the pipe-delimited (tabular) format.
fbListener_t * yfListenerForSpec(fbConnSpec_t *spec, fbListenerAppInit_fn appinit, fbListenerAppFree_fn appfree, GError **err)
Get an IPFIX connection listener for collecting YAF flows via IPFIX from the network.
struct yfFlowStats_st yfFlowStats_t
yaf flow statistics