101 #include <yaf/autoinc.h>
102 #include <fixbuf/public.h>
110 #define CERT_PEN 6871
117 #define YAF_ERROR_DOMAIN (g_quark_from_string("certYAFError"))
119 #define YAF_ERROR_HEADER 1
121 #define YAF_ERROR_ARGUMENT 2
123 #define YAF_ERROR_IO 3
125 #define YAF_ERROR_IPFIX 4
127 #define YAF_ERROR_IMPL 5
129 #define YAF_ERROR_INTERNAL 6
131 #define YAF_ERROR_LIMIT 7
133 #define YAF_ERROR_EOF 8
135 #define YAF_ERROR_ALIGNMENT 9
137 #define YAF_ERROR_PACKET_PAYLOAD 10
145 #define YAF_FLOW_ACTIVE 0
147 #define YAF_END_IDLE 1
149 #define YAF_END_ACTIVE 2
151 #define YAF_END_CLOSED 3
153 #define YAF_END_FORCED 4
155 #define YAF_END_RESOURCE 5
157 #define YAF_END_UDPFORCE 0x1F
159 #define YAF_SAME_SIZE 0x01
161 #define YAF_OUT_OF_SEQUENCE 0x02
163 #define YAF_FRAG_ACTIVE 0x03
165 #define YAF_FRAG_PASSIVE 0x04
167 #define YAF_END_MASK 0x7F
170 #define YAF_ENDF_ISCONT 0x80
173 #define YAF_IP_ICMP 1
177 #define YAF_IP_UDP 17
182 #define YFP_IPTCPHEADER_SIZE 128
184 #define ETHERNET_MAC_ADDR_LENGTH 6
186 #define YAF_MAX_HOOKS 4
190 #define YAF_HOOKS_MAX_EXPORT 1500
192 #define YAF_MAX_PKT_BOUNDARY 25
194 #define YAF_PCAP_MAX 5000000
196 #define YAF_MAX_MPLS_LABELS 3
218 #if YAF_ENABLE_DAG_SEPARATE_INTERFACES || YAF_ENABLE_SEPARATE_INTERFACES
275 # if YAF_ENABLE_PAYLOAD
297 # if YAF_ENABLE_SEPARATE_INTERFACES
300 # if YAF_ENABLE_ENTROPY
318 # if YAF_ENABLE_FPEXPORT
320 uint32_t firstPacketLen;
322 uint32_t secondPacketLen;
324 uint8_t *firstPacket;
326 uint8_t *secondPacket;
333 typedef struct yfMPLSNode_st {
354 #ifdef YAF_ENABLE_HOOKS
366 #if YAF_ENABLE_APPLABEL
493 fBuf_t *yfWriterForSpread(
494 fbSpreadParams_t *params,
496 uint16_t *spreadGroupIndex,
604 fbListenerAppInit_fn appinit,
605 fbListenerAppFree_fn appfree,
725 fbInfoModel_t *yfDPIInfoModel();
uint32_t nonemptypktct
total number of non empty pkts
Definition: yafcore.h:255
uint32_t sip
Source IPv4 address.
Definition: yafcore.h:225
uint8_t pktdir
non empty packet directions, 1, or 0
Definition: yafcore.h:381
uint8_t destinationMacAddr[ETHERNET_MAC_ADDR_LENGTH]
destination Mac Address
Definition: yafcore.h:377
uint64_t oct
Octet count.
Definition: yafcore.h:272
uint16_t maxpktsize
largest pkt size
Definition: yafcore.h:263
uint32_t aitime
average interarrival time in milliseconds
Definition: yafcore.h:259
uint8_t uflags
Union of remaining TCP flags.
Definition: yafcore.h:294
struct yfFlowKey_st yfFlowKey_t
A YAF flow key.
uint16_t first_pkt_size
First Packet Size - to determine whether to turn on fixed size flag.
Definition: yafcore.h:288
uint8_t pcap_file_no
Pcap File "ID" so we know when to make entries in metadata file.
Definition: yafcore.h:379
uint8_t sourceMacAddr[ETHERNET_MAC_ADDR_LENGTH]
src Mac Address
Definition: yafcore.h:375
uint8_t appkt
packets with payload - don't care if this wraps.
Definition: yafcore.h:296
yfFlowVal_t val
Forward value.
Definition: yafcore.h:392
uint8_t pcap_serial
Keep track of number of pcap files for this flow.
Definition: yafcore.h:373
gboolean yfPrint(FILE *out, yfFlow_t *flow, GError **err)
Print a YAF flow to a file.
fBuf_t * yfReaderForFP(fBuf_t *fbuf, FILE *fp, GError **err)
Get an IPFIX message buffer for reading YAF flows from an open file pointer.
uint64_t etime
Flow end time in epoch milliseconds.
Definition: yafcore.h:353
void yfPrintDelimitedString(GString *rstr, yfFlow_t *flow, gboolean yaft_mac)
Print a YAF flow to a GString in pipe-delimited (tabular) format.
uint32_t isn
Initial TCP sequence number.
Definition: yafcore.h:284
yfFlowVal_t rval
Reverse value.
Definition: yafcore.h:394
void yfAlignmentCheck(void)
yfAlignmentCheck
void yfWriterExportMappedV6(gboolean map_mode)
FIXME doc.
gboolean yfReadFlow(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
gboolean yfReadFlowExtended(fBuf_t *fbuf, yfFlow_t *flow, GError **err)
Read a single flow from an IPFIX message buffer.
uint16_t attributes
flowAttributes
Definition: yafcore.h:290
uint32_t smallpktct
Number of packets with 60 bytes or less of data.
Definition: yafcore.h:253
A YAF flow.
Definition: yafcore.h:349
uint64_t ltime
used to calculate interarrival time
Definition: yafcore.h:249
void yfPrintColumnHeaders(FILE *out, gboolean yaft_mac, GError **err)
Print column headers for the pipe-delimited (tabular) format.
#define YAF_MAX_MPLS_LABELS
Maximum number of labels we're going to keep around.
Definition: yafcore.h:196
void yfFlowCleanup(yfFlow_t *flow)
Clean up after a static flow buffer prepared by yfFlowPrepare.
A YAF uniflow value.
Definition: yafcore.h:270
void yfPrintString(GString *rstr, yfFlow_t *flow)
Print a YAF flow to a GString.
uint16_t pktsize[10]
to calculate distribution of packet payload size
Definition: yafcore.h:245
uint16_t vlanId
VLAN Tag - only fwd.
Definition: yafcore.h:212
yfFlowStats_t * stats
yaf flow statistics
Definition: yafcore.h:329
uint8_t iflags
Initial TCP flags.
Definition: yafcore.h:292
void yfFlowPrepare(yfFlow_t *flow)
Prepare a static flow buffer for use with yaf_flow_read().
uint64_t stime
Flow start time in epoch milliseconds.
Definition: yafcore.h:351
uint8_t tos
Type of Service/Traffic Class.
Definition: yafcore.h:214
uint8_t version
IP Version.
Definition: yafcore.h:210
void yfWriterExportPayload(int max_payload)
FIXME doc.
fbListener_t * yfListenerForSpec(fbConnSpec_t *spec, fbListenerAppInit_fn appinit, fbListenerAppFree_fn appfree, GError **err)
Get an IPFIX connection listener for collecting YAF flows via IPFIX from the network.
fBuf_t * yfWriterForFP(FILE *fp, uint32_t domain, GError **err)
Get an IPFIX message buffer for writing YAF flows to an open file pointer.
uint16_t dp
Destination transport port.
Definition: yafcore.h:206
uint32_t lsn
Last TCP sequence number.
Definition: yafcore.h:286
#define YAF_MAX_HOOKS
maximum number of hooks (plugins) allowed at one time
Definition: yafcore.h:186
uint8_t reason
Flow termination reason (YAF_END_ macros, per IPFIX standard)
Definition: yafcore.h:371
uint8_t proto
IP protocol.
Definition: yafcore.h:208
A YAF flow key.
Definition: yafcore.h:202
pcap_dumper_t * pcap
Pcap File Ptr.
Definition: yafcore.h:385
union yfFlowKey_st::@0 addr
for DAG cards need to record the interface, may only be seeing unidirectional flows on each interface...
gboolean yfPrintDelimited(FILE *out, yfFlow_t *flow, gboolean yaft_mac, GError **err)
Print a YAF flow to a file in pipe-delimited (tabular) format.
uint64_t pkt
Packet count.
Definition: yafcore.h:274
#define ETHERNET_MAC_ADDR_LENGTH
length of Ethernet MAC Address
Definition: yafcore.h:184
gboolean yfWriterClose(fBuf_t *fbuf, gboolean flush, GError **err)
Close the connection underlying an IPFIX message buffer created by yfWriterForFP() or yfWriterForSpec...
uint32_t dip
Destination IPv4 address.
Definition: yafcore.h:227
uint8_t rtos
reverse ToS (fwd in flowKey)
Definition: yafcore.h:383
struct yfFlowStats_st yfFlowStats_t
yaf flow statistics
gboolean yfWriteStatsFlow(void *yfContext, uint32_t pcap_drop, GTimer *timer, GError **err)
Write an options data record to an IPFIX Message buffer.
uint32_t tcpurgct
Number of urgent packets.
Definition: yafcore.h:251
fBuf_t * yfWriterForSpec(fbConnSpec_t *spec, uint32_t domain, GError **err)
Get an IPFIX message buffer for writing YAF flows to a socket.
struct yfFlowVal_st yfFlowVal_t
A YAF uniflow value.
uint64_t payoct
total amount of payload data
Definition: yafcore.h:247
gboolean yfWriteFlow(void *yfContext, yfFlow_t *flow, GError **err)
Write a single flow to an IPFIX message buffer.
fBuf_t * yfWriterForFile(const char *path, uint32_t domain, GError **err)
Get an IPFIX message buffer for writing YAF flows to a named file.
uint16_t sp
Source transport port.
Definition: yafcore.h:204
struct yfFlow_st yfFlow_t
A YAF flow.
uint16_t firstpktsize
payload length of first non-empty pkt
Definition: yafcore.h:261
yaf flow statistics
Definition: yafcore.h:241
uint32_t largepktct
total number of packets with 225 bytes or more
Definition: yafcore.h:257
uint64_t iaarray[10]
to calculate inter-packet delay
Definition: yafcore.h:243
yfFlowKey_t key
Flow key.
Definition: yafcore.h:396