Go to the documentation of this file.
149 #ifndef _YAF_HOOKS_H_
150 #define _YAF_HOOKS_H_
152 #include <yaf/autoinc.h>
153 #include <yaf/decode.h>
156 #if YAF_ENABLE_APPLABEL
161 #define YAF_HOOK_INTERFACE_VERSION 6
238 uint32_t max_payload,
241 gboolean applabelmode,
242 gboolean entropymode,
243 gboolean fingerprintmode,
244 gboolean fpExportMode,
245 gboolean udp_max_payload,
246 uint16_t udp_uniflow_port);
307 fbSession_t *session);
320 fbSubTemplateMultiList_t *rec,
321 fbSubTemplateMultiListEntry_t *stml,
340 const char *hookName,
341 const char *hookOpts,
342 const char *hookConf,
346 #if YAF_ENABLE_APPLABEL
442 fbSubTemplateMultiList_t *rec,
443 fbSubTemplateMultiListEntry_t *stml,
453 fbSession_t *session);
457 const char *pluginOpt,
462 const char *pluginConf,
465 #if YAF_ENABLE_APPLABEL
482 uint32_t max_payload,
485 gboolean applabelmode,
486 gboolean entropymode,
487 gboolean fingerprintmode,
488 gboolean fpExportMode,
489 gboolean udp_max_payload,
490 uint16_t udp_uniflow_port,
gboolean yfHookFlowClose(yfFlow_t *flow)
Called upon flow close to do any necessary plugin processing upon flow close.
gboolean yfHookGetTemplate(fbSession_t *session)
Gets the IPFIX info model template for the export data from all the plugins and turns it into a singl...
TCP information structure.
Definition: decode.h:140
gboolean yfHookPacket(yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Function called to do processing on each packet as it comes in.
fbInfoElement_t * yfHookGetInfoModel(void)
Returns the IPFIX info model aggregated for all plugins.
A YAF uniflow value.
Definition: yafcore.h:276
A YAF flow key.
Definition: yafcore.h:208
gboolean yfHookAddNewHook(const char *hookName, const char *hookOpts, const char *hookConf, void **yfctx, GError **err)
Adds another hook (plugin) into yaf.
gboolean yfHookFlowWrite(fbSubTemplateMultiList_t *rec, fbSubTemplateMultiListEntry_t *stml, yfFlow_t *flow, GError **err)
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
void yfHookFlowPacket(yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
void yfHookFlowAlloc(yfFlow_t *flow, void **yfctx)
Allow plugins to allocate flow state information for each flow captured by yaf at the time of flow cr...
Flow generation interface for YAF.
uint8_t yfHookGetTemplateCount(yfFlow_t *flow)
Returns the amount of templates to add to the SubtemplateMultiList from all plugins hooked.
Datalink layer information structure.
Definition: decode.h:110
void yfHookFreeLists(yfFlow_t *flow)
Sends control back to the plugin to free any BasicLists, SubTemplateLists, or SubTemplateMultiLists t...
void yfHookValidateFlowTab(void **yfctx, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port)
Validation function to make sure the plugin can and should operate based on the flowtable options.
void yfHookFlowFree(yfFlow_t *flow)
Frees all memory associated with the flow state in all of the attached plugins.
A YAF flow.
Definition: yafcore.h:371