153#include <yaf/autoinc.h>
154#include <yaf/decode.h>
157#if YAF_ENABLE_APPLABEL
162#define YAF_HOOK_INTERFACE_VERSION 6
239 uint32_t max_payload,
242 gboolean applabelmode,
243 gboolean entropymode,
244 gboolean fingerprintmode,
245 gboolean fpExportMode,
246 gboolean udp_max_payload,
247 uint16_t udp_uniflow_port);
308 fbSession_t *session);
321 fbSubTemplateMultiList_t *rec,
322 fbSubTemplateMultiListEntry_t *stml,
341 const char *hookName,
342 const char *hookOpts,
343 const char *hookConf,
347#if YAF_ENABLE_APPLABEL
443 fbSubTemplateMultiList_t *rec,
444 fbSubTemplateMultiListEntry_t *stml,
454 fbSession_t *session);
458 const char *pluginOpt,
463 const char *pluginConf,
466#if YAF_ENABLE_APPLABEL
483 uint32_t max_payload,
486 gboolean applabelmode,
487 gboolean entropymode,
488 gboolean fingerprintmode,
489 gboolean fpExportMode,
490 gboolean udp_max_payload,
491 uint16_t udp_uniflow_port,
A YAF flow.
Definition: yafcore.h:374
A YAF flow key.
Definition: yafcore.h:211
A YAF uniflow value.
Definition: yafcore.h:279
Datalink layer information structure.
Definition: decode.h:112
TCP information structure.
Definition: decode.h:142
void yfHookFlowFree(yfFlow_t *flow)
Frees all memory associated with the flow state in all of the attached plugins.
void yfHookFlowPacket(yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
gboolean yfHookFlowWrite(fbSubTemplateMultiList_t *rec, fbSubTemplateMultiListEntry_t *stml, yfFlow_t *flow, GError **err)
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
gboolean yfHookAddNewHook(const char *hookName, const char *hookOpts, const char *hookConf, void **yfctx, GError **err)
Adds another hook (plugin) into yaf.
gboolean yfHookGetTemplate(fbSession_t *session)
Gets the IPFIX info model template for the export data from all the plugins and turns it into a singl...
fbInfoElement_t * yfHookGetInfoModel(void)
Returns the IPFIX info model aggregated for all plugins.
uint8_t yfHookGetTemplateCount(yfFlow_t *flow)
Returns the amount of templates to add to the SubtemplateMultiList from all plugins hooked.
gboolean yfHookPacket(yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint32_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Function called to do processing on each packet as it comes in.
void yfHookFreeLists(yfFlow_t *flow)
Sends control back to the plugin to free any BasicLists, SubTemplateLists, or SubTemplateMultiLists t...
gboolean yfHookFlowClose(yfFlow_t *flow)
Called upon flow close to do any necessary plugin processing upon flow close.
void yfHookFlowAlloc(yfFlow_t *flow, void **yfctx)
Allow plugins to allocate flow state information for each flow captured by yaf at the time of flow cr...
void yfHookValidateFlowTab(void **yfctx, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port)
Validation function to make sure the plugin can and should operate based on the flowtable options.
Flow generation interface for YAF.