Go to the documentation of this file.
101 #include <yaf/autoinc.h>
102 #include <fixbuf/public.h>
110 #define CERT_PEN 6871
117 #define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
119 #define YAF_ERROR_HEADER 1
121 #define YAF_ERROR_ARGUMENT 2
123 #define YAF_ERROR_IO 3
125 #define YAF_ERROR_IPFIX 4
127 #define YAF_ERROR_IMPL 5
129 #define YAF_ERROR_INTERNAL 6
131 #define YAF_ERROR_LIMIT 7
133 #define YAF_ERROR_EOF 8
135 #define YAF_ERROR_ALIGNMENT 9
137 #define YAF_ERROR_PACKET_PAYLOAD 10
145 #define YAF_FLOW_ACTIVE 0
147 #define YAF_END_IDLE 1
149 #define YAF_END_ACTIVE 2
151 #define YAF_END_CLOSED 3
153 #define YAF_END_FORCED 4
155 #define YAF_END_RESOURCE 5
157 #define YAF_END_UDPFORCE 0x1F
159 #define YAF_SAME_SIZE 0x01
161 #define YAF_OUT_OF_SEQUENCE 0x02
163 #define YAF_MP_CAPABLE 0x04
165 #define YAF_FRAGMENTS 0x08
167 #define YAF_PARTIAL_FRAGS 0x10
169 #define YAF_FRAG_ACTIVE 0x03
171 #define YAF_FRAG_PASSIVE 0x04
173 #define YAF_END_MASK 0x7F
176 #define YAF_ENDF_ISCONT 0x80
179 #define YAF_IP_ICMP 1
183 #define YAF_IP_UDP 17
188 #define YFP_IPTCPHEADER_SIZE 128
190 #define ETHERNET_MAC_ADDR_LENGTH 6
192 #define YAF_MAX_HOOKS 4
196 #define YAF_HOOKS_MAX_EXPORT 1500
198 #define YAF_MAX_PKT_BOUNDARY 25
200 #define YAF_PCAP_MAX 5000000
202 #define YAF_MAX_MPLS_LABELS 3
224 #if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_SEPARATE_INTERFACES
281 # if YAF_ENABLE_PAYLOAD
305 # if YAF_ENABLE_SEPARATE_INTERFACES
308 # if YAF_ENABLE_ENTROPY
326 # if YAF_ENABLE_FPEXPORT
328 uint32_t firstPacketLen;
330 uint32_t secondPacketLen;
332 uint8_t *firstPacket;
334 uint8_t *secondPacket;
341 typedef struct yfMPLSNode_st {
376 #ifdef YAF_ENABLE_HOOKS
388 #if YAF_ENABLE_APPLABEL
393 uint16_t ndpi_master;
475 gboolean export_meta,
495 gboolean export_meta,
511 gboolean export_meta,
530 fbSpreadParams_t *params,
532 uint16_t *spreadGroupIndex,
533 gboolean export_meta,
678 fbListenerAppInit_fn appinit,
679 fbListenerAppFree_fn appfree,
yfFlowVal_t rval
Reverse value.
Definition: yafcore.h:421
uint64_t ltime
used to calculate interarrival time
Definition: yafcore.h:255
uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH]
src Mac Address
Definition: yafcore.h:401
uint8_t uflags
Union of remaining TCP flags.
Definition: yafcore.h:300
yfFlowVal_t val
Forward value.
Definition: yafcore.h:419
uint64_t pkt
Packet count.
Definition: yafcore.h:280
gboolean yfWriteTombstoneFlow(void *yfContext, GError **err)
Write a tombstone options data record to an IPFIX Message buffer.
uint16_t vlan
VLAN TAG (also in key, but want to record both sides)
Definition: yafcore.h:304
uint32_t dip
Destination IPv4 address.
Definition: yafcore.h:233
uint16_t sp
Source transport port.
Definition: yafcore.h:210
uint16_t maxpktsize
largest pkt size
Definition: yafcore.h:269
A YAF uniflow value.
Definition: yafcore.h:276
uint32_t largepktct
total number of packets with 225 bytes or more
Definition: yafcore.h:263
uint8_t flags
hash_flags
Definition: yafcore.h:361
yfFlowStats_t * stats
yaf flow statistics
Definition: yafcore.h:337
uint16_t mss
max segment size
Definition: yafcore.h:357
A YAF flow key.
Definition: yafcore.h:208
gboolean yfReadFlowExtended(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
uint64_t oct
Octet count.
Definition: yafcore.h:278
struct yfFlow_st yfFlow_t
A YAF flow.
uint16_t attributes
flowAttributes
Definition: yafcore.h:296
uint32_t tcpurgct
Number of urgent packets.
Definition: yafcore.h:257
void yfPrintDelimitedString(GString *rstr, yfFlow_t *flow, gboolean yaft_mac)
Print a YAF flow to a GString in pipe-delimited (tabular) format.
uint16_t vlanId
VLAN Tag - only fwd.
Definition: yafcore.h:218
uint16_t firstpktsize
payload length of first non-empty pkt
Definition: yafcore.h:267
uint64_t iaarray[10]
to calculate inter-packet delay
Definition: yafcore.h:249
uint64_t etime
Flow end time in epoch milliseconds.
Definition: yafcore.h:375
gboolean yfPrint(FILE *out, yfFlow_t *flow, GError **err)
Print a YAF flow to a file.
fBuf_t * yfWriterForFP(FILE *fp, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to an open file pointer.
fBuf_t * yfWriterForSpec(fbConnSpec_t *spec, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a socket.
void yfAlignmentCheck(void)
yfAlignmentCheck
uint8_t addrid
addr id
Definition: yafcore.h:359
fBuf_t * yfReaderForFP(fBuf_t *fbuf, FILE *fp, GError **err)
Get an IPFIX message buffer for reading YAF flows from an open file pointer.
uint16_t dp
Destination transport port.
Definition: yafcore.h:212
void yfFlowPrepare(yfFlow_t *flow)
Prepare a static flow buffer for use with yaf_flow_read().
#define YAF_MAX_MPLS_LABELS
Maximum number of labels we're going to keep around.
Definition: yafcore.h:202
uint8_t pcap_serial
Keep track of number of pcap files for this flow.
Definition: yafcore.h:399
yfFlowKey_t key
Flow key.
Definition: yafcore.h:423
gboolean yfReadFlow(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
uint64_t stime
Flow start time in epoch milliseconds.
Definition: yafcore.h:373
uint32_t nonemptypktct
total number of non empty pkts
Definition: yafcore.h:261
yaf flow statistics
Definition: yafcore.h:247
uint32_t aitime
average interarrival time in milliseconds
Definition: yafcore.h:265
uint8_t appkt
packets with payload - don't care if this wraps.
Definition: yafcore.h:302
void yfFlowCleanup(yfFlow_t *flow)
Clean up after a static flow buffer prepared by yfFlowPrepare.
yfMPTCPFlow_t mptcp
MPTCP Flow.
Definition: yafcore.h:417
fbListener_t * yfListenerForSpec(fbConnSpec_t *spec, fbListenerAppInit_fn appinit, fbListenerAppFree_fn appfree, GError **err)
Get an IPFIX connection listener for collecting YAF flows via IPFIX from the network.
uint32_t smallpktct
Number of packets with 60 bytes or less of data.
Definition: yafcore.h:259
void yfWriterExportMappedV6(gboolean map_mode)
FIXME doc.
uint8_t reason
Flow termination reason (YAF_END_ macros, per IPFIX standard)
Definition: yafcore.h:397
#define YAF_MAX_HOOKS
maximum number of hooks (plugins) allowed at one time
Definition: yafcore.h:192
pcap_dumper_t * pcap
Pcap File Ptr.
Definition: yafcore.h:411
uint8_t rtos
reverse ToS (fwd in flowKey)
Definition: yafcore.h:409
void yfPrintColumnHeaders(FILE *out, gboolean yaft_mac, GError **err)
Print column headers for the pipe-delimited (tabular) format.
gboolean yfWriteOptionsDataFlows(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
A wrapper that calls both yfWriteStatsFlow and yfWriteDataFlow with appropriate condition checking.
uint8_t proto
IP protocol.
Definition: yafcore.h:214
uint8_t iflags
Initial TCP flags.
Definition: yafcore.h:298
gboolean yfWriterClose(fBuf_t *fbuf, gboolean flush, GError **err)
Close the connection underlying an IPFIX message buffer created by yfWriterForFP() or yfWriterForSpec...
void yfWriterExportPayload(int max_payload)
FIXME doc.
void yfPrintString(GString *rstr, yfFlow_t *flow)
Print a YAF flow to a GString.
union yfFlowKey_st::@0 addr
for DAG cards need to record the interface, may only be seeing unidirectional flows on each interface...
uint16_t pktsize[10]
to calculate distribution of packet payload size
Definition: yafcore.h:251
struct yfFlowVal_st yfFlowVal_t
A YAF uniflow value.
uint32_t token
receiver token
Definition: yafcore.h:355
uint64_t idsn
initial data seq no.
Definition: yafcore.h:353
uint32_t lsn
Last TCP sequence number.
Definition: yafcore.h:292
struct yfFlowStats_st yfFlowStats_t
yaf flow statistics
#define ETHERNET_MAC_ADDR_LENGTH
length of Ethernet MAC Address
Definition: yafcore.h:190
uint8_t version
IP Version.
Definition: yafcore.h:216
gboolean yfPrintDelimited(FILE *out, yfFlow_t *flow, gboolean yaft_mac, GError **err)
Print a YAF flow to a file in pipe-delimited (tabular) format.
Definition: yafcore.h:351
struct yfFlowKey_st yfFlowKey_t
A YAF flow key.
uint8_t tos
Type of Service/Traffic Class.
Definition: yafcore.h:220
gboolean yfWriteStatsFlow(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
Write a statistics options data record to an IPFIX Message buffer.
gboolean yfWriteFlow(void *yfContext, yfFlow_t *flow, GError **err)
Write a single flow to an IPFIX message buffer.
uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH]
destination Mac Address
Definition: yafcore.h:403
fBuf_t * yfWriterForFile(const char *path, uint32_t domain, gboolean export_meta, GError **err)
Get an IPFIX message buffer for writing YAF flows to a named file.
uint8_t pktdir
non empty packet directions, 1, or 0
Definition: yafcore.h:407
uint16_t first_pkt_size
First Packet Size - to determine whether to turn on fixed size flag.
Definition: yafcore.h:294
uint32_t sip
Source IPv4 address.
Definition: yafcore.h:231
uint32_t isn
Initial TCP sequence number.
Definition: yafcore.h:290
uint64_t payoct
total amount of payload data
Definition: yafcore.h:253
A YAF flow.
Definition: yafcore.h:371
uint8_t pcap_file_no
Pcap File "ID" so we know when to make entries in metadata file.
Definition: yafcore.h:405