Processing hook interface for YAF. More...
#include <yaf/autoinc.h>
#include <yaf/decode.h>
#include <yaf/yafcore.h>
#include <yaf/yaftab.h>
Go to the source code of this file.
Data Structures | |
struct | yfHookMetaData |
Exported from the plugin to tell YAF about its export data & interface version. More... | |
Defines | |
#define | YAF_HOOK_INTERFACE_VERSION 2 |
Functions | |
gboolean | yfHookPacket (yfFlowKey_t *key, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info) |
Function called to do processing on each packet as it comes in. | |
void | yfHookFlowPacket (yfFlow_t *flow, yfFlowVal_t *val, const uint8_t *pkt, size_t caplen, uint16_t iplen, yfTCPInfo_t *tcpinfo, yfL2Info_t *l2info) |
Similar to yfHookPacket but also given yfFlowVal_t struct for processing per flow direction. | |
void | yfHookValidateFlowTab (uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port) |
Validation function to make sure the plugin can and should operate based on the flowtable options. | |
gboolean | yfHookFlowClose (yfFlow_t *flow) |
Called upon flow close to do any necessary plugin processing upon flow close. | |
void | yfHookFlowAlloc (yfFlow_t *flow) |
Allow plugins to allocate flow state information for each flow captured by yaf. | |
void | yfHookFlowFree (yfFlow_t *flow) |
Frees all memory associated with the flow state in all of the attached plugins. | |
fbInfoElement_t * | yfHookGetInfoModel (void) |
returns the IPFIX info model aggregated for all plugins | |
fbInfoElementSpec_t * | yfHookGetTemplate (void) |
gets the IPFIX info model template for the export data from _all_ the plugins and turns it into a single template to return. | |
gboolean | yfWriteFlowHook (void *rec, size_t rec_sz, yfFlow_t *flow, GError **err) |
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record | |
gboolean | yfHookAddNewHook (const char *hookName, const char *hookOpts, GError **err) |
yfHookAddNewHook |
Processing hook interface for YAF.
Not yet documented.
gboolean yfHookAddNewHook | ( | const char * | hookName, | |
const char * | hookOpts, | |||
GError ** | err | |||
) |
yfHookAddNewHook
adds another hook (plugin) into yaf
hookName | the file name of the plugin to load | |
hookOpts | a string of command line options for the plugin to process | |
err | the error value that gets set if this call didn't work |
void yfHookFlowAlloc | ( | yfFlow_t * | flow | ) |
Allow plugins to allocate flow state information for each flow captured by yaf.
flow | the pointer to the flow context state structure, but more importantly contains the array of pointers (hfctx) which hold the plugin context state |
gboolean yfHookFlowClose | ( | yfFlow_t * | flow | ) |
Called upon flow close to do any necessary plugin processing upon flow close.
void yfHookFlowFree | ( | yfFlow_t * | flow | ) |
Frees all memory associated with the flow state in all of the attached plugins.
flow | - a pointer to the flow context structure |
fbInfoElement_t* yfHookGetInfoModel | ( | void | ) |
returns the IPFIX info model aggregated for all plugins
fbInfoElementSpec_t* yfHookGetTemplate | ( | void | ) |
gets the IPFIX info model template for the export data from _all_ the plugins and turns it into a single template to return.
It caches the results so that future queries are a lot faster. It can validate the cached result if the numer of plugins registered changes.
pointer | to an array of fbInfoElementSpec_t structures that describes the info model template |
gboolean yfHookPacket | ( | yfFlowKey_t * | key, | |
const uint8_t * | pkt, | |||
size_t | caplen, | |||
uint16_t | iplen, | |||
yfTCPInfo_t * | tcpinfo, | |||
yfL2Info_t * | l2info | |||
) |
Function called to do processing on each packet as it comes in.
void yfHookValidateFlowTab | ( | uint32_t | max_payload, | |
gboolean | uniflow, | |||
gboolean | silkmode, | |||
gboolean | applabelmode, | |||
gboolean | entropymode, | |||
gboolean | fingerprintmode, | |||
gboolean | fpExportMode, | |||
gboolean | udp_max_payload, | |||
uint16_t | udp_uniflow_port | |||
) |
Validation function to make sure the plugin can and should operate based on the flowtable options.
max | payload value | |
uniflow | ||
silkmode | ||
applabelmode | ||
p0f | finger printing mode | |
handshake | header export mode | |
udp | max payload - concatenate udp payloads similar to TCP | |
udp | uniflow port - export all udp packets if have this src or dst port |
gboolean yfWriteFlowHook | ( | void * | rec, | |
size_t | rec_sz, | |||
yfFlow_t * | flow, | |||
GError ** | err | |||
) |
called by yfWriteFlow to add the data from all registered plugins to the outgoing IPFIX record
outgoing | yfIpfixFlow_t record | |
size | of record | |
pointer | to the flow context structure | |
Error |