yafhooks.h File Reference

Processing hook interface for YAF. More...

#include <yaf/autoinc.h>
#include <yaf/decode.h>
#include <yaf/yafcore.h>
#include <yaf/yaftab.h>

Go to the source code of this file.

Data Structures

struct  yfHookMetaData
 Exported from the plugin to tell YAF about its export data & interface version. More...

Defines

#define YAF_HOOK_INTERFACE_VERSION   2

Functions

gboolean yfHookPacket (yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
 Function called to do processing on each packet as it comes in.
void yfHookFlowPacket (yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info)
 Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction.
void yfHookValidateFlowTab (uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port)
 Validation function to make sure the plugin can and should operate based on the flowtable options.
gboolean yfHookFlowClose (yfFlow_t *flow)
 Called upon flow close to do any necessary plugin processing upon flow close.
void yfHookFlowAlloc (yfFlow_t *flow)
 Allow plugins to allocate flow state information for each flow captured by yaf.
void yfHookFlowFree (yfFlow_t *flow)
 Frees all memory associated with the flow state in all of the attached plugins.
fbInfoElement_t * yfHookGetInfoModel (void)
 returns the IPFIX info model aggregated for all plugins
fbInfoElementSpec_t * yfHookGetTemplate (void)
 gets the IPFIX info model template for the export data from _all_ the plugins and turns it into a single template to return.
gboolean yfWriteFlowHook (void *rec, size_t rec_sz, yfFlow_t *flow, GError **err)
 called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
gboolean yfHookAddNewHook (const char *hookName, const char *hookOpts, GError **err)
 yfHookAddNewHook

Detailed Description

Processing hook interface for YAF.

Not yet documented.


Function Documentation

gboolean yfHookAddNewHook ( const char *  hookName,
const char *  hookOpts,
GError **  err 
)

yfHookAddNewHook

adds another hook (plugin) into yaf

Parameters:
hookName the file name of the plugin to load
hookOpts a string of command line options for the plugin to process
err the error value that gets set if this call didn't work
Returns:
TRUE if plugin loaded fine, other FALSE
void yfHookFlowAlloc ( yfFlow_t flow  ) 

Allow plugins to allocate flow state information for each flow captured by yaf.

Parameters:
flow the pointer to the flow context state structure, but more importantly contains the array of pointers (hfctx) which hold the plugin context state
gboolean yfHookFlowClose ( yfFlow_t flow  ) 

Called upon flow close to do any necessary plugin processing upon flow close.

void yfHookFlowFree ( yfFlow_t flow  ) 

Frees all memory associated with the flow state in all of the attached plugins.

Parameters:
flow - a pointer to the flow context structure
fbInfoElement_t* yfHookGetInfoModel ( void   ) 

returns the IPFIX info model aggregated for all plugins

Returns:
pointer to an arry of fbInfoElement_t that contains the sum of the IPFIX IE's from all active plugins
fbInfoElementSpec_t* yfHookGetTemplate ( void   ) 

gets the IPFIX info model template for the export data from _all_ the plugins and turns it into a single template to return.

It caches the results so that future queries are a lot faster. It can validate the cached result if the numer of plugins registered changes.

Parameters:
pointer to an array of fbInfoElementSpec_t structures that describes the info model template
gboolean yfHookPacket ( yfFlowKey_t key,
const uint8_t *  pkt,
size_t  caplen,
uint16_t  iplen,
yfTCPInfo_t tcpinfo,
yfL2Info_t l2info 
)

Function called to do processing on each packet as it comes in.

void yfHookValidateFlowTab ( uint32_t  max_payload,
gboolean  uniflow,
gboolean  silkmode,
gboolean  applabelmode,
gboolean  entropymode,
gboolean  fingerprintmode,
gboolean  fpExportMode,
gboolean  udp_max_payload,
uint16_t  udp_uniflow_port 
)

Validation function to make sure the plugin can and should operate based on the flowtable options.

Parameters:
max payload value
uniflow 
silkmode 
applabelmode 
p0f finger printing mode
handshake header export mode
udp max payload - concatenate udp payloads similar to TCP
udp uniflow port - export all udp packets if have this src or dst port
gboolean yfWriteFlowHook ( void *  rec,
size_t  rec_sz,
yfFlow_t flow,
GError **  err 
)

called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record

Parameters:
outgoing yfIpfixFlow_t record
size of record
pointer to the flow context structure
Error