public.h File Reference

Fixbuf IPFIX protocol library public interface. More...

#include <fixbuf/autoinc.h>

Go to the source code of this file.

Data Structures
struct	fbVarfield_st
	A variable-length field value. More...
struct	fbInfoModelIter_st
	An iterator over the information elements in an information model. More...
struct	fbInfoElement_st
	A single IPFIX Information Element definition. More...
struct	fbInfoElementOptRec_st
	The corresponding struct to the Information Element Type Options Template. More...
struct	fbInfoElementSpec_st
	A single IPFIX Information Element specification. More...
struct	fbConnSpec_st
	Connection specifier. More...
struct	fbListenerEntry_st
	ListenerEntry's make up a listener group as a linked list. More...
struct	fbListenerGroupResult_st
	ListenerGroupResult's contain the listener who's listening socket got a new connection. More...
struct	fbBasicList_st
	A basic list element in a template which structure represents a basic list on the internal side, basic lists in an IPFIX Message must be represented by this structure within the application record. More...
struct	fbSubTemplateList_st
	Structure used to hold information of a sub template list. More...
struct	fbSubTemplateMultiListEntry_st
	Entries contain the same type of information at SubTemplateLists: template ID and template pointers to describe the data the number of data elements and the data pointer and data length. More...
struct	fbSubTemplateMultiList_st
	Multilists just contain the semantic to describe the sub lists, the number of sub lists, and a pointer to the first entry. More...

Macros
#define	FB_ERROR_DOMAIN   g_quark_from_string("fixbufError")
	All fixbuf errors are returned within the FB_ERROR_DOMAIN domain. More...
#define	FB_ERROR_TMPL   1
	No template was available for the given template ID. More...
#define	FB_ERROR_EOM   2
	End of IPFIX message. More...
#define	FB_ERROR_EOF   3
	End of IPFIX Message stream. More...
#define	FB_ERROR_IPFIX   4
	Illegal IPFIX mesaage content on read. More...
#define	FB_ERROR_BUFSZ   5
	A message was received larger than the collector buffer size. More...
#define	FB_ERROR_IMPL   6
	The requested feature is not yet implemented. More...
#define	FB_ERROR_IO   7
	An unspecified I/O error occured. More...
#define	FB_ERROR_NLREAD   8
	No data is available for reading from the transport layer. More...
#define	FB_ERROR_NLWRITE   9
	An attempt to write data to the transport layer failed due to closure of the remote end of the connection. More...
#define	FB_ERROR_NOELEMENT   10
	The specified Information Element does not exist in the Information Model.
#define	FB_ERROR_CONN   11
	A connection or association could not be established or maintained.
#define	FB_ERROR_NETFLOWV9   12
	Illegal NetflowV9 content on a read. More...
#define	FB_ERROR_TRANSMISC   13
	Miscellaneous error occured during translator operation.
#define	FB_ERROR_SFLOW   14
	Illegal sFlow content on a read.
#define	FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_)   { {(const struct fbInfoElement_st*)_name_}, 0, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_ }
	NEW Convenience macro for creating full fbInfoElement_t static initializers. More...
#define	FB_IE_INIT(_name_, _ent_, _num_, _len_, _flags_)   FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, 0, 0, 0, (char*)NULL)
	Convenience macro for creating default fbInfoElement_t static initializers. More...
#define	FB_IE_NULL   FB_IE_INIT(NULL, 0, 0, 0, 0)
	Convenience macro defining a null information element initializer to terminate a constant information element array for passing to fbInfoModelAddElementArray().
#define	FB_IE_SEMANTIC(flags)   ((flags & 0x0000ff00) >> 8)
	Convenience macro for extracting the information element semantic value from the flags variable in the fbInfoElement_t struct. More...
#define	FB_IE_UNITS(flags)   ((flags & 0xFFFF0000) >> 16)
	Convenience macro for extracting the information element units value from the flags variable in the fbInfoElement_t struct. More...
#define	FB_IE_F_NONE   0x00000000
	Default treatment flags value. More...
#define	FB_IE_F_ENDIAN   0x00000001
	Information element endian conversion flag. More...
#define	FB_IE_F_REVERSIBLE   0x00000040
	Information element reversible flag. More...
#define	FB_IE_F_ALIEN   0x00000080
	Information element alien flag. More...
#define	FB_IE_QUANTITY   0x00000100
	An Information Element Semantics Flags used to describe an information element as a quantity.
#define	FB_IE_TOTALCOUNTER   0x00000200
	An Information Element Semantics Flags used to describe an information element as a totalCounter.
#define	FB_IE_DELTACOUNTER   0x00000300
	An Information Element Semantics Flag used to describe an information element as a deltaCounter.
#define	FB_IE_IDENTIFIER   0x00000400
	An Information Element Semantics Flag used to describe an information element as an identifier.
#define	FB_IE_FLAGS   0x00000500
	An Information Element Semantics Flag used to describe an information element as a flags element.
#define	FB_IE_LIST   0x00000600
	An Information Element Semantics Flag used to describe an information element as a List Element.
#define	FB_IE_DEFAULT   0x00000000
	An Information Element Semantics Flag used to describe an information element as a Default element.
#define	FB_UNITS_BITS   0x00010000
	Information Element Units - See RFC 5610. More...
#define	FB_UNITS_OCTETS   0x00020000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_PACKETS   0x00030000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_FLOWS   0x00040000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_SECONDS   0x00050000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_MILLISECONDS   0x00060000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_MICROSECONDS   0x00070000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_NANOSECONDS   0x00080000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_WORDS   0x00090000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_MESSAGES   0x000A0000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_HOPS   0x000B0000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_ENTRIES   0x000C0000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_UNITS_FRAMES   0x000D0000
	An Information Element Units Flag used to describe the units of an information element. More...
#define	FB_IE_VARLEN   65535
	Information element length constant for variable-length IE.
#define	FB_IE_BASIC_LIST   291
	Information element number constant for basic lists This will change upon updates to the specification.
#define	FB_IE_SUBTEMPLATE_LIST   292
	Information element number constant for sub template lists This will change upon updates to the IPFIX lists specification.
#define	FB_IE_SUBTEMPLATE_MULTILIST   293
	Information element number constant for sub template multi lists This will change upon updates to the IPFIX lists specification.
#define	FB_IE_PEN_REVERSE   29305
	Private enterprise number for reverse information elements (see draft-ietf-ipfix-biflow-03 section 6.1). More...
#define	FB_IE_VENDOR_BIT_REVERSE   0x4000
	Reverse information element bit for vendor-specific information elements (see draft-ietf-ipfix-biflow-03 section 6.2). More...
#define	FB_CISCO_GENERIC   9999
	Generic Information Element ID for undefined Cisco NetFlow v9 Elements.
#define	FB_CISCO_ASA_EVENT_ID   9998
	Information Element ID for Cisco NSEL Element NF_F_FW_EVENT often exported by Cisco's ASA Device. More...
#define	FB_CISCO_ASA_EVENT_XTRA   9997
	Information Element ID for Cisco NSEL Element NF_F_FW_EXT_EVENT often exported by Cisco's ASA Device. More...
#define	FB_IE_REVERSE_STR   "reverse"
	Reverse information element name prefix. More...
#define	FB_IE_REVERSE_STRLEN   7
	Length of reverse information element name prefix. More...
#define	FB_TID_AUTO   0
	Template ID argument to pass to fbSessionAddTemplate to automatically assign a template ID.
#define	FB_TID_TS   2
	Reserved set ID for template sets.
#define	FB_TID_OTS   3
	Reserved set ID for options template sets.
#define	FB_TID_MIN_DATA   256
	Minimum non-reserved template ID available for data sets.
#define	FB_IESPEC_NULL   { NULL, 0, 0 }
	Convenience macro defining a null information element specification initializer to terminate a constant information element specifier array for passing to fbTemplateAppendSpecArray().
#define	FB_CONNSPEC_INIT
	Convenience macro defining a null static fbConnSpec_t. More...
#define	FB_LIST_SEM_UNDEFINED   0xFF
	The following Semantic values are for use in the structured Data Types: basicLists, subTemplateLists, and subTemplateMultiLists. More...
#define	FB_LIST_SEM_NONE_OF   0x00
	Semantic field for none-of value defined in RFC 6313.
#define	FB_LIST_SEM_EXACTLY_ONE_OF   0x01
	Semantic field for exactly-one-of value defined in RFC 6313.
#define	FB_LIST_SEM_ONE_OR_MORE_OF   0x02
	Semantic field for the one-or-more-of value defined in RFC 6313.
#define	FB_LIST_SEM_ALL_OF   0x03
	Semantic field for the all-of value defined in RFC 6313.
#define	FB_LIST_SEM_ORDERED   0x04
	Semantic field for the ordered value defined in RFC 6313.

Typedefs
typedef struct fBuf_st	fBuf_t
	An IPFIX message buffer. More...
typedef struct fbVarfield_st	fbVarfield_t
	A variable-length field value. More...
typedef struct fbInfoModel_st	fbInfoModel_t
	An IPFIX information model. More...
typedef struct fbInfoModelIter_st	fbInfoModelIter_t
	An iterator over the information elements in an information model.
typedef enum fbInfoElementDataType_en	fbInfoElementDataType_t
	From RFC 5610: A description of the abstract data type of an IPFIX information element as registered in the IANA IPFIX IE Data Type subregistry.
typedef struct fbInfoElement_st	fbInfoElement_t
	A single IPFIX Information Element definition. More...
typedef struct fbInfoElementOptRec_st	fbInfoElementOptRec_t
	The corresponding struct to the Information Element Type Options Template. More...
typedef struct fbTemplate_st	fbTemplate_t
	An IPFIX Template or Options Template. More...
typedef struct fbInfoElementSpec_st	fbInfoElementSpec_t
	A single IPFIX Information Element specification. More...
typedef struct fbSession_st	fbSession_t
	An IPFIX Transport Session state container. More...
typedef enum fbTransport_en	fbTransport_t
	Transport protocol for connection specifier. More...
typedef struct fbConnSpec_st	fbConnSpec_t
	Connection specifier. More...
typedef struct fbExporter_st	fbExporter_t
	IPFIX Exporting Process endpoint. More...
typedef struct fbCollector_st	fbCollector_t
	IPFIX Collecting Process endpoint. More...
typedef struct fbListener_st	fbListener_t
	IPFIX Collecting Process session listener. More...
typedef struct fbListenerEntry_st	fbListenerEntry_t
	ListenerGroup and associated data type definitions.
typedef struct fbListenerGroupResult_st	fbListenerGroupResult_t
	typedef for listener group result
typedef struct fbListenerGroup_st	fbListenerGroup_t
	Structure that holds the listeners that are added to the group.
typedef void(*	fbNewTemplateCallback_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl)
	The callback function to be called when the session receives a new external template from the connected node. More...
typedef void(*	fbTemplateCtxFree_fn) (void *ctx)
	A callback function that is called when a template is freed. More...
typedef void(*	fbTemplateCtxFree2_fn) (void *tmpl_ctx, void *app_ctx)
	A callback function that is called when a template is freed. More...
typedef void(*	fbTemplateCtxCallback_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void **ctx, fbTemplateCtxFree_fn *fn)
	A callback function that will be called when the session receives a new external template. More...
typedef void(*	fbTemplateCtxCallback2_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void *app_ctx, void **tmpl_ctx, fbTemplateCtxFree2_fn *fn)
	A callback function that will be called when the session receives a new external template. More...
typedef struct fbBasicList_st	fbBasicList_t
	A basic list element in a template which structure represents a basic list on the internal side, basic lists in an IPFIX Message must be represented by this structure within the application record.
typedef struct fbSubTemplateList_st	fbSubTemplateList_t
	Structure used to hold information of a sub template list. More...
typedef struct fbSubTemplateMultiListEntry_st	fbSubTemplateMultiListEntry_t
	Entries contain the same type of information at SubTemplateLists: template ID and template pointers to describe the data the number of data elements and the data pointer and data length. More...
typedef struct fbSubTemplateMultiList_st	fbSubTemplateMultiList_t
	Multilists just contain the semantic to describe the sub lists, the number of sub lists, and a pointer to the first entry.
typedef gboolean(*	fbListenerAppInit_fn) (fbListener_t *listener, void **ctx, int fd, struct sockaddr *peer, size_t peerlen, GError **err)
	Application context initialization function type for fbListener_t. More...
typedef void(*	fbListenerAppFree_fn) (void *ctx)
	Application context free function type for fbListener_t. More...

Enumerations
enum	fbInfoElementDataType_en {   FB_OCTET_ARRAY, FB_UINT_8, FB_UINT_16, FB_UINT_32,   FB_UINT_64, FB_INT_8, FB_INT_16, FB_INT_32,   FB_INT_64, FB_FLOAT_32, FB_FLOAT_64, FB_BOOL,   FB_MAC_ADDR, FB_STRING, FB_DT_SEC, FB_DT_MILSEC,   FB_DT_MICROSEC, FB_DT_NANOSEC, FB_IP4_ADDR, FB_IP6_ADDR,   FB_BASIC_LIST, FB_SUB_TMPL_LIST, FB_SUB_TMPL_MULTI_LIST }
	From RFC 5610: A description of the abstract data type of an IPFIX information element as registered in the IANA IPFIX IE Data Type subregistry.
enum	fbTransport_en {   FB_SCTP, FB_TCP, FB_UDP, FB_DTLS_SCTP,   FB_TLS_TCP, FB_DTLS_UDP }
	Transport protocol for connection specifier. More...

Functions
gboolean	fbListValidSemantic (uint8_t semantic)
	validates the value of the semantic field, More...
fbBasicList_t *	fbBasicListAlloc (void)
	allocates a Basic List Structure More...
void *	fbBasicListInit (fbBasicList_t *basicListPtr, uint8_t semantic, const fbInfoElement_t *infoElement, uint16_t numElements)
	Initializes the basic list structure based on the parameters. More...
void *	fbBasicListInitWithOwnBuffer (fbBasicList_t *basicListPtr, uint8_t semantic, const fbInfoElement_t *infoElement, uint16_t numElements, uint16_t dataLength, uint8_t *dataPtr)
	use this function to initialize the basic list, but it gets the pointer to a buffer and its length allocated independently from these functions This will generally be used by a collector that does not want to free and allocate new buffers for each incoming message More...
void	fbBasicListCollectorInit (fbBasicList_t *basicListPtr)
	This initializes a basic list structure for collection. More...
uint8_t	fbBasicListGetSemantic (fbBasicList_t *basicListPtr)
	Get Semantic field for Basic List presumably used in collectors after decoding. More...
void	fbBasicListSetSemantic (fbBasicList_t *basicListPtr, uint8_t semantic)
	Sets the semantic for describing a basic list generally used in exporters before decoding. More...
const fbInfoElement_t *	fbBasicListGetInfoElement (fbBasicList_t *basicListPtr)
	This function returns a pointer to the information element used in the list it is mainly used in collectors to retrieve information. More...
void *	fbBasicListGetDataPtr (fbBasicList_t *basicListPtr)
void *	fbBasicListGetIndexedDataPtr (fbBasicList_t *basicListPtr, uint16_t bl_index)
	Function retrieves the index'th element in the list index is 0-based. More...
void *	fbBasicListGetNextPtr (fbBasicList_t *basicListPtr, void *currentPtr)
	Function returns the next element in the list based on the currentPtr. More...
void *	fbBasicListRealloc (fbBasicList_t *basicList, uint16_t newNumElements)
	Free the current data pointer, allocating a new buffer to accomodate the new number of elements. More...
void *	fbBasicListAddNewElements (fbBasicList_t *basicList, uint16_t numNewElements)
	Allocates an additional elememnt into the basic list must be called after calling BasicListInit. More...
void	fbBasicListClear (fbBasicList_t *basicListPtr)
	Clear the parameters of the basic list and free the data buffer. More...
void	fbBasicListClearWithoutFree (fbBasicList_t *basicList)
	Clear the parameters of the basic list, but do not free the buffer. More...
void	fbBasicListFree (fbBasicList_t *basicListPtr)
	Clear the basic list, then free the basic list pointer. More...
fbSubTemplateList_t *	fbSubTemplateListAlloc (void)
	Allocates a subTemplateList_t Based on how subTemplateLists will be used and set up amidst data structures, this function may never be used. More...
void *	fbSubTemplateListInit (fbSubTemplateList_t *sTL, uint8_t semantic, uint16_t tmplID, const fbTemplate_t *tmpl, uint16_t numElements)
	Initializes a subTemplateList structure and alloc's the dataPtr to get a buffer able to hold numElements in the template This will mainly be used in exporters preparing to encode. More...
void *	fbSubTemplateListInitWithOwnBuffer (fbSubTemplateList_t *subTemplateList, uint8_t semantic, uint16_t tmplID, const fbTemplate_t *tmpl, uint16_t numElements, uint16_t dataLength, uint8_t *dataPtr)
	Initializes the subTemplateList but does not allocate a buffer. More...
void	fbSubTemplateListCollectorInit (fbSubTemplateList_t *STL)
	Initializes a sub template list variable on a collector. More...
void *	fbSubTemplateListGetDataPtr (const fbSubTemplateList_t *subTemplateListPtr)
	Returns a pointer to the buffer that contains the data for the list. More...
void *	fbSubTemplateListGetIndexedDataPtr (const fbSubTemplateList_t *subTemplateListPtr, uint16_t index)
	This function is used to iterate over the elements in the list by passing in a counter to indicate which element is to be returned. More...
void *	fbSubTemplateListGetNextPtr (const fbSubTemplateList_t *subTemplateListPtr, void *currentPtr)
	This function also traverses the elements in the list by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element. More...
void	fbSubTemplateListSetSemantic (fbSubTemplateList_t *subTemplateListPtr, uint8_t semantic)
	Sets the semantic parameter of a subTemplateList. More...
uint8_t	fbSubTemplateListGetSemantic (fbSubTemplateList_t *subTemplateListPtr)
	Gets the semantic value from a sub template list. More...
const fbTemplate_t *	fbSubTemplateListGetTemplate (fbSubTemplateList_t *subTemplateListPtr)
	Gets the template pointer from the list structure. More...
uint16_t	fbSubTemplateListGetTemplateID (fbSubTemplateList_t *subTemplateListPtr)
	Gets the template ID for the template used by the list. More...
void *	fbSubTemplateListRealloc (fbSubTemplateList_t *subTemplateList, uint16_t newNumElements)
	Free the current data pointer, allocating a new buffer to accomodate the new number of elements. More...
void *	fbSubTemplateListAddNewElements (fbSubTemplateList_t *subTemplateList, uint16_t numNewElements)
	Allocates space for a number of additional element in the sub template list must be called after the list has been fbSubTemplateListInit()'d. More...
void	fbSubTemplateListClear (fbSubTemplateList_t *subTemplateListPtr)
	Clears a subtemplate list struct, notably freeing the dataPtr and setting it to NULL. More...
void	fbSubTemplateListClearWithoutFree (fbSubTemplateList_t *subTemplateListPtr)
	Clears the sub template list parameters but does not free the data ptr. More...
void	fbSubTemplateListFree (fbSubTemplateList_t *subTemplateListPtr)
	Frees and clears a subTemplateList struct. More...
fbSubTemplateMultiList_t *	fbSubTemplateMultiListAlloc (void)
	Allocates a subTemplateMultiList_t Based on how subTemplateMultiLists will be used and set up amidst data structures, this function may never be used. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListInit (fbSubTemplateMultiList_t *STML, uint8_t semantic, uint16_t numElements)
	Initializes the multi list with semantic, numbers of elements, and allocates memory to store numElements worth of entries. More...
void	fbSubTemplateMultiListSetSemantic (fbSubTemplateMultiList_t *STML, uint8_t semantic)
	Sets the semantic field for the multi list. More...
uint8_t	fbSubTemplateMultiListGetSemantic (fbSubTemplateMultiList_t *STML)
	Get the semantic paramter from the multi list. More...
void	fbSubTemplateMultiListClear (fbSubTemplateMultiList_t *STML)
	Clears all of the entries (frees their data pointers), then frees the memory containing the entries. More...
void	fbSubTemplateMultiListClearEntries (fbSubTemplateMultiList_t *STML)
	Clears the memory used by the entries of a sub template multi list NOTE: if any of those entries contain another layer of structures, that second layer must be freed by the user, this function cannot do that. More...
void	fbSubTemplateMultiListFree (fbSubTemplateMultiList_t *STML)
	Clears the multi list, then frees the memory pointed to by STML. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListRealloc (fbSubTemplateMultiList_t *STML, uint16_t newNumEntries)
	Clears the entries used by the multi list, then if newNumElements is different than numElements, frees the entries buffer and allocates a new one. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListAddNewEntries (fbSubTemplateMultiList_t *STML, uint16_t numNewEntries)
	Adds entries to the multi list of entries can only be run after the list has been initialized. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListGetFirstEntry (fbSubTemplateMultiList_t *STML)
	Retrieve the first entry in the multi list. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListGetIndexedEntry (fbSubTemplateMultiList_t *STML, uint16_t index)
	Retrieve a pointer to the entry of a specific index. More...
fbSubTemplateMultiListEntry_t *	fbSubTemplateMultiListGetNextEntry (fbSubTemplateMultiList_t *STML, fbSubTemplateMultiListEntry_t *currentEntry)
	This function also traverses the elements in the list by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element. More...
void *	fbSubTemplateMultiListEntryInit (fbSubTemplateMultiListEntry_t *entry, uint16_t tmplID, fbTemplate_t *tmpl, uint16_t numElements)
	Initializes the multi list entry with the template values, and allocates the memory used by the entry to hold the data. More...
void *	fbSubTemplateMultiListEntryRealloc (fbSubTemplateMultiListEntry_t *entry, uint16_t newNumElements)
	Frees the memory for the data used by the entry, then allocates a new buffer based on the size of the template and newNumElements. More...
void *	fbSubTemplateMultiListEntryAddNewElements (fbSubTemplateMultiListEntry_t *entry, uint16_t numNewElements)
	Allocates space for a number of additional elements in the sub template multi list entry. More...
void	fbSubTemplateMultiListEntryClear (fbSubTemplateMultiListEntry_t *entry)
	Frees the memory pointed to by the data buffer holding the data elements. More...
void *	fbSubTemplateMultiListEntryGetDataPtr (fbSubTemplateMultiListEntry_t *entry)
	Retrieves the data pointer for this entry. More...
void *	fbSubTemplateMultiListEntryNextDataPtr (fbSubTemplateMultiListEntry_t *entry, void *currentPtr)
	This function traverses the elements in the entry by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element. More...
void *	fbSubTemplateMultiListEntryGetIndexedPtr (fbSubTemplateMultiListEntry_t *entry, uint16_t index)
	Returns a pointer to a data element in the entry based on the index. More...
const fbTemplate_t *	fbSubTemplateMultiListEntryGetTemplate (fbSubTemplateMultiListEntry_t *entry)
	Retrieve the template pointer used to structure the data elements. More...
uint16_t	fbSubTemplateMultiListEntryGetTemplateID (fbSubTemplateMultiListEntry_t *entry)
	Retrieve the template ID for the template used to structure the data. More...
void	fBufListFree (fbTemplate_t *tmpl, uint8_t *record)
	Clear all of the memory that fixbuf allocated during transcode of this record. More...
fbListenerGroup_t *	fbListenerGroupAlloc (void)
	Allocates and returns a fbListenerGroup with no entries. More...
void	fbListenerGroupFree (fbListenerGroup_t *group)
	frees a listener group More...
int	fbListenerGroupAddListener (fbListenerGroup_t *group, const fbListener_t *listener)
	Adds a previously allocated listener to the previously allocated group. More...
int	fbListenerGroupDeleteListener (fbListenerGroup_t *group, const fbListener_t *listener)
	Removes the listener from the group. More...
fbListenerGroupResult_t *	fbListenerGroupWait (fbListenerGroup_t *group, GError **err)
	Similar to fbListenerWait, except that is looks for connections for multiple listeners. More...
void	fbListenerFreeGroupResult (fbListenerGroupResult_t *result)
	Free the fbListenerGroupResult_t returned from fbListenerGroupWait. More...
fBuf_t *	fbListenerOwnSocketCollectorTCP (fbListener_t *listener, int sock, GError **err)
	Returns an fBuf wrapped around an independently managed socket and a properly created listener for TCP connections. More...
fBuf_t *	fbListenerOwnSocketCollectorTLS (fbListener_t *listener, int sock, GError **err)
	Same as fbListenerOwnSocketCollectorTCP but for TLS (not tested) More...
void	fBufInterruptSocket (fBuf_t *fbuf)
	Interrupts the select call of a specific collector by way of its fBuf. More...
gboolean	fBufSetInternalTemplate (fBuf_t *fbuf, uint16_t int_tid, GError **err)
	Set the internal template on a buffer to the given template ID. More...
gboolean	fBufSetExportTemplate (fBuf_t *fbuf, uint16_t ext_tid, GError **err)
	Set the external template for export on a buffer to the given template ID. More...
void	fBufSetAutomaticMode (fBuf_t *fbuf, gboolean automatic)
	Set the automatic mode flag on a buffer. More...
gboolean	fBufSetAutomaticInsert (fBuf_t *fbuf, GError **err)
	Set the automatic insert flag on a buffer. More...
fbSession_t *	fBufGetSession (fBuf_t *fbuf)
	Retrieve the session associated with a buffer. More...
void	fBufFree (fBuf_t *fbuf)
	Free a buffer. More...
fBuf_t *	fBufAllocForExport (fbSession_t *session, fbExporter_t *exporter)
	Allocate a new buffer for export. More...
fbExporter_t *	fBufGetExporter (fBuf_t *fbuf)
	Retrieve the exporting process endpoint associated with a buffer. More...
void	fBufSetExporter (fBuf_t *fbuf, fbExporter_t *exporter)
	Associate an exporting process endpoint with a buffer. More...
size_t	fBufRemaining (fBuf_t *fbuf)
	Retrieve the length of the buffer that is remaining after processing. More...
void	fBufSetBuffer (fBuf_t *fbuf, uint8_t *buf, size_t buflen)
	Set a buffer on an fBuf for collection. More...
gboolean	fBufAppend (fBuf_t *fbuf, uint8_t *recbase, size_t recsize, GError **err)
	Append a record to a buffer. More...
gboolean	fBufEmit (fBuf_t *fbuf, GError **err)
	Emit the message currently in a buffer using the associated exporting process endpoint. More...
void	fBufSetExportTime (fBuf_t *fbuf, uint32_t extime)
	Set the export time on the message currently in a buffer. More...
fBuf_t *	fBufAllocForCollection (fbSession_t *session, fbCollector_t *collector)
	Allocate a new buffer for collection. More...
fbCollector_t *	fBufGetCollector (fBuf_t *fbuf)
	Retrieve the collecting process endpoint associated with a buffer. More...
void	fBufSetCollector (fBuf_t *fbuf, fbCollector_t *collector)
	Associate an collecting process endpoint with a buffer. More...
gboolean	fBufNext (fBuf_t *fbuf, uint8_t *recbase, size_t *recsize, GError **err)
	Retrieve a record from a buffer. More...
gboolean	fBufNextMessage (fBuf_t *fbuf, GError **err)
	Read a new message into a buffer using the associated collecting process endpoint. More...
uint32_t	fBufGetExportTime (fBuf_t *fbuf)
	Retrieve the export time on the message currently in a buffer. More...
fbTemplate_t *	fBufGetCollectionTemplate (fBuf_t *fbuf, uint16_t *ext_tid)
	Retrieve the external template used to read the last record from the buffer. More...
fbTemplate_t *	fBufNextCollectionTemplate (fBuf_t *fbuf, uint16_t *ext_tid, GError **err)
	Retrieve the external template that will be used to read the next record from the buffer. More...
fbInfoModel_t *	fbInfoModelAlloc (void)
	Allocate a new information model. More...
void	fbInfoModelFree (fbInfoModel_t *model)
	Free an information model. More...
void	fbInfoModelAddElement (fbInfoModel_t *model, fbInfoElement_t *ie)
	Add a single information element to an information model. More...
void	fbInfoModelAddElementArray (fbInfoModel_t *model, fbInfoElement_t *ie)
	Add multiple information elements in an array to an information model. More...
const fbInfoElement_t *	fbInfoModelGetElementByName (fbInfoModel_t *model, const char *name)
	Return a pointer to the canonical information element within an information model given the information element name. More...
const fbInfoElement_t *	fbInfoModelGetElementByID (fbInfoModel_t *model, uint16_t id, uint32_t ent)
	Return a pointer to the canonical information element within an information model given the information element ID and enterprise ID. More...
guint	fbInfoModelCountElements (const fbInfoModel_t *model)
	Return the number of information elements in the information model. More...
void	fbInfoModelIterInit (fbInfoModelIter_t *iter, const fbInfoModel_t *model)
	Initialize an information model iterator for iteration. More...
const fbInfoElement_t *	fbInfoModelIterNext (fbInfoModelIter_t *iter)
	Return a pointer to the next information element in the information model. More...
fbTemplate_t *	fbInfoElementAllocTypeTemplate (fbInfoModel_t *model, GError **err)
	Allocate the Options Template that will be used to define Information Element Type Records. More...
gboolean	fbInfoElementWriteOptionsRecord (fBuf_t *fbuf, const fbInfoElement_t *model_ie, uint16_t tid, GError **err)
	Export an options record to the given fbuf with information element type information about the given information element. More...
gboolean	fbInfoElementAddOptRecElement (fbInfoModel_t *model, fbInfoElementOptRec_t *rec)
	Add an element that we received via an Options Record to the given info model. More...
gboolean	fbInfoModelTypeInfoRecord (fbTemplate_t *tmpl)
	Checks to see if the template contains all of the elements the RFC 5610 info element type record should contain. More...
fbTemplate_t *	fbTemplateAlloc (fbInfoModel_t *model)
	Allocate a new empty template. More...
gboolean	fbTemplateAppend (fbTemplate_t *tmpl, fbInfoElement_t *ex_ie, GError **err)
	Append an information element to a template. More...
gboolean	fbTemplateAppendSpec (fbTemplate_t *tmpl, fbInfoElementSpec_t *spec, uint32_t flags, GError **err)
	Append an information element described by specifier to a template. More...
gboolean	fbTemplateAppendSpecArray (fbTemplate_t *tmpl, fbInfoElementSpec_t *spec, uint32_t flags, GError **err)
	Append information elements described by a specifier array to a template. More...
uint32_t	fbTemplateCountElements (fbTemplate_t *tmpl)
	Determine number of information elements in a template. More...
void	fbTemplateSetOptionsScope (fbTemplate_t *tmpl, uint16_t scope_count)
	Set the number of information elements in a template that are scope. More...
uint32_t	fbTemplateGetOptionsScope (fbTemplate_t *tmpl)
	Determine number of scope information elements in a template. More...
gboolean	fbTemplateContainsElement (fbTemplate_t *tmpl, const fbInfoElement_t *ex_ie)
	Determine if a template contains a given information element. More...
gboolean	fbTemplateContainsElementByName (fbTemplate_t *tmpl, fbInfoElementSpec_t *spec)
	Determine if a template contains at least one instance of a given information element, specified by name in the template's information model. More...
gboolean	fbTemplateContainsAllElementsByName (fbTemplate_t *tmpl, fbInfoElementSpec_t *spec)
	Determine if a template contains at least one instance of each information element in a given information element specifier array. More...
gboolean	fbTemplateContainsAllFlaggedElementsByName (fbTemplate_t *tmpl, fbInfoElementSpec_t *spec, uint32_t flags)
	Determine if a template contains at least one instance of each information element in a given information element specifier array that match the given flags argument. More...
fbInfoElement_t *	fbTemplateGetIndexedIE (fbTemplate_t *tmpl, uint32_t IEindex)
	Return the information element in the template referenced by the index. More...
void	fbTemplateFreeUnused (fbTemplate_t *tmpl)
	Free a template if it is not currently in use by any Session. More...
void *	fbTemplateGetContext (fbTemplate_t *tmpl)
	Get the ctx pointer associated with a Template. More...
fbSession_t *	fbSessionAlloc (fbInfoModel_t *model)
	Allocate a transport session state container. More...
fbInfoModel_t *	fbSessionGetInfoModel (fbSession_t *session)
	fbSessionGetInfoModel More...
void	fbSessionAddTemplateCallback (fbSession_t *session, fbNewTemplateCallback_fn callback)
	This function sets the callback to let the user know when a new template has arrived from the connected IPFIX node. More...
void	fbSessionAddTemplateCtxCallback (fbSession_t *session, fbTemplateCtxCallback_fn callback)
	This function sets the callback that allows the application to set its own context variable with a new incoming template. More...
void	fbSessionAddTemplateCtxCallback2 (fbSession_t *session, fbTemplateCtxCallback2_fn callback, void *app_ctx)
	This function sets the callback that allows the application to set its own context variable with a new incoming template. More...
void	fbSessionAddTemplatePair (fbSession_t *session, uint16_t ent_tid, uint16_t int_tid)
	Adds an external-internal template pair to the session. More...
void	fbSessionRemoveTemplatePair (fbSession_t *session, uint16_t ext_tid)
	remove a template pair from the list this is called by fixbuf when a template is revoked from the session by the node on the other end of the connection More...
uint16_t	fbSessionLookupTemplatePair (fbSession_t *session, uint16_t ext_tid)
	Function to find a pair, uniquely identified by the external ID, and return the associated internal template ID. More...
void	fbSessionFree (fbSession_t *session)
	Free a transport session state container. More...
void	fbSessionResetExternal (fbSession_t *session)
	Reset the external state (sequence numbers and templates) in a session state container. More...
void	fbSessionSetDomain (fbSession_t *session, uint32_t domain)
	Set the current observation domain on a session. More...
uint32_t	fbSessionGetDomain (fbSession_t *session)
	Retrieve the current domain on a session. More...
fbCollector_t *	fbSessionGetCollector (fbSession_t *session)
	Retrieve collector that was created with the session. More...
gboolean	fbSessionExportTemplate (fbSession_t *session, uint16_t tid, GError **err)
	Export a single external template in the current domain of a given session. More...
gboolean	fbSessionExportTemplates (fbSession_t *session, GError **err)
	Export all external templates in the current domain of a given session. More...
uint16_t	fbSessionAddTemplate (fbSession_t *session, gboolean internal, uint16_t tid, fbTemplate_t *tmpl, GError **err)
	Add a template to a session. More...
gboolean	fbSessionRemoveTemplate (fbSession_t *session, gboolean internal, uint16_t tid, GError **err)
	Remove a template from a session. More...
fbTemplate_t *	fbSessionGetTemplate (fbSession_t *session, gboolean internal, uint16_t tid, GError **err)
	Retrieve a template from a session by ID. More...
fbExporter_t *	fbExporterAllocNet (fbConnSpec_t *spec)
	Allocate an exporting process endpoint for a network connection. More...
fbExporter_t *	fbExporterAllocFile (const char *path)
	Allocate an exporting process endpoint for a named file. More...
fbExporter_t *	fbExporterAllocBuffer (uint8_t *buf, uint16_t bufsize)
	Allocate an exporting process for a buffer. More...
fbExporter_t *	fbExporterAllocFP (FILE *fp)
	Allocate an exporting process endpoint for an opened ANSI C file pointer. More...
void	fbExporterSetStream (fbExporter_t *exporter, int sctp_stream)
	Set the SCTP stream for the next message exported. More...
void	fbExporterAutoStream (fbExporter_t *exporter)
	Enable automatic SCTP stream selection for the next message exported. More...
void	fbExporterClose (fbExporter_t *exporter)
	Force the file or socket underlying an exporting process endpoint to close. More...
size_t	fbExporterGetMsgLen (fbExporter_t *exporter)
	Get the (transcoded) message length that was copied to the exporting buffer upon fBufEmit(). More...
fbCollector_t *	fbCollectorAllocFile (void *ctx, const char *path, GError **err)
	Allocate a collecting process endpoint for a named file. More...
fbCollector_t *	fbCollectorAllocFP (void *ctx, FILE *fp)
	Allocate a collecting process endpoint for an open file. More...
void *	fbCollectorGetContext (fbCollector_t *collector)
	Retrieve the application context associated with a collector. More...
void	fbCollectorClose (fbCollector_t *collector)
	Close the file or socket underlying a collecting process endpoint. More...
void	fbCollectorSetAcceptOnly (fbCollector_t *collector, struct sockaddr *address, size_t address_length)
	Set the collector to only receive from the given IP address over UDP. More...
fbListener_t *	fbListenerAlloc (fbConnSpec_t *spec, fbSession_t *session, fbListenerAppInit_fn appinit, fbListenerAppFree_fn appfree, GError **err)
	Allocate a listener. More...
void	fbListenerFree (fbListener_t *listener)
	Free a listener. More...
fBuf_t *	fbListenerWait (fbListener_t *listener, GError **err)
	Wait on a listener. More...
fBuf_t *	fbListenerWaitNoCollectors (fbListener_t *listener, GError **err)
	Waits for an incoming connection, just like fbListenerWait, except that this function doesn't monitor active collectors. More...
void	fbListenerInterrupt (fbListener_t *listener)
	Cause the current or next call to fbListenerWait to unblock and return. More...
gboolean	fbListenerGetCollector (fbListener_t *listener, fbCollector_t **collector, GError **err)
	fbListenerGetCollector More...
gboolean	fbCollectorClearTranslator (fbCollector_t *collector, GError **err)
	fbCollectorClearTranslator More...
gboolean	fbCollectorSetNetflowV9Translator (fbCollector_t *collector, GError **err)
	fbCollectorSetNetflowV9Translator More...
gboolean	fbCollectorSetSFlowTranslator (fbCollector_t *collector, GError **err)
	fbCollectorSetSFlowTranslator More...
uint32_t	fbCollectorGetNetflowMissed (fbCollector_t *collector, struct sockaddr *peer, size_t peerlen, uint32_t obdomain)
	fbCollectorGetNetflowMissed More...
uint32_t	fbCollectorGetSFlowMissed (fbCollector_t *collector, struct sockaddr *peer, size_t peerlen, uint32_t obdomain)
	fbCollectorGetSFlowMissed More...
struct sockaddr *	fbCollectorGetPeer (fbCollector_t *collector)
	Retrieves information about the node connected to this collector. More...
uint32_t	fbCollectorGetObservationDomain (fbCollector_t *collector)
	Retrieves the observation domain of the node connected to the UDP collector. More...
void	fbCollectorSetUDPMultiSession (fbCollector_t *collector, gboolean multi_session)
	Attempt to maintain backwards compatibility with UDP. More...
void	fbCollectorManageUDPStreamByPort (fbCollector_t *collector, gboolean manage_port)
	An attempt to fix what some netflow v9 exporters do wrong. More...

Detailed Description

Fixbuf IPFIX protocol library public interface.

Macro Definition Documentation

#define FB_CISCO_ASA_EVENT_ID   9998

Information Element ID for Cisco NSEL Element NF_F_FW_EVENT often exported by Cisco's ASA Device.

This must be converted to a different Information Element ID due to the reverse IE bit in IPFIX. Cisco uses IE ID 40005. http://www.cisco.com/en/US/docs/security/asa/asa82/netflow/netflow.html

#define FB_CISCO_ASA_EVENT_XTRA   9997

Information Element ID for Cisco NSEL Element NF_F_FW_EXT_EVENT often exported by Cisco's ASA Device.

This must be converted to a different Information Element ID due to the reverse IE bit in IPFIX. Cisco uses IE ID 33002 http://www.cisco.com/en/US/docs/security/asa/asa82/netflow/netflow.html More Information about event codes can be found here: http://www.cisco.com/en/US/docs/security/asa/asa84/system/netflow/netflow.pdf

#define FB_CONNSPEC_INIT

Value:

{ FB_SCTP, NULL, NULL,         \
                           NULL, NULL, NULL, NULL,      \
                           NULL, NULL }

Convenience macro defining a null static fbConnSpec_t.

#define FB_ERROR_BUFSZ   5

A message was received larger than the collector buffer size.

Should never occur. This condition is checked at the transport layer in case future versions of fixbuf support dynamic buffer sizing.

#define FB_ERROR_DOMAIN   g_quark_from_string("fixbufError")

All fixbuf errors are returned within the FB_ERROR_DOMAIN domain.

#define FB_ERROR_EOF   3

End of IPFIX Message stream.

No more messages are available from the transport layer on read, either because the session has closed, or the file has been processed.

#define FB_ERROR_EOM   2

End of IPFIX message.

Either there are no more records present in the message on read, or the message MTU has been reached on write.

#define FB_ERROR_IMPL   6

The requested feature is not yet implemented.

#define FB_ERROR_IO   7

An unspecified I/O error occured.

#define FB_ERROR_IPFIX   4

Illegal IPFIX mesaage content on read.

The input stream is malformed, or is not an IPFIX Message after all.

#define FB_ERROR_NETFLOWV9   12

Illegal NetflowV9 content on a read.

Can't parse the Netflow header or the stream is not a NetflowV9 stream

#define FB_ERROR_NLREAD   8

No data is available for reading from the transport layer.

Either a transport layer read was interrupted, or timed out.

#define FB_ERROR_NLWRITE   9

An attempt to write data to the transport layer failed due to closure of the remote end of the connection.

Currently only occurs with the TCP transport layer.

#define FB_ERROR_TMPL   1

No template was available for the given template ID.

#define FB_IE_F_ALIEN   0x00000080

Information element alien flag.

If set, IE is enterprise-specific and was recieved via an external template at a Collecting Process. It is therefore subject to semantic typing via options (not yet implemented). Do not set this flag on information elements added programmatically to an information model via fbInfoModelAddElement() or fbInfoModelAddElementArray().

#define FB_IE_F_ENDIAN   0x00000001

Information element endian conversion flag.

If set, IE is an integer and will be endian-converted on transcode.

#define FB_IE_F_NONE   0x00000000

Default treatment flags value.

Provided for initializer convenience. Corresponds to octet-array semantics for a non-reversible, non-alien IE.

#define FB_IE_F_REVERSIBLE   0x00000040

Information element reversible flag.

If set for an information element with an enterprise number of 0 (an IETF/IANA IE), adding the information element via fbInfoModelAddElement() or fbInfoModelAddElementArray() will cause a second, reverse information element to be added to the model following the conventions in IETF Internet-Draft draft-ietf-ipfix-biflow-03. Note that the reverse PEN has not yet been assigned, so this implementation uses a provisional reverse IE as defined by the macro FB_IE_PEN_REVERSE.

#define FB_IE_INIT	(		_name_,
			_ent_,
			_num_,
			_len_,
			_flags_
	)		FB_IE_INIT_FULL(_name_, _ent_, _num_, _len_, _flags_, 0, 0, 0, (char*)NULL)

Convenience macro for creating default fbInfoElement_t static initializers.

Used for creating information element arrays suitable for passing to fbInfoModelAddElementArray().

#define FB_IE_INIT_FULL	(		_name_,
			_ent_,
			_num_,
			_len_,
			_flags_,
			_min_,
			_max_,
			_type_,
			_desc_
	)		{ {(const struct fbInfoElement_st*)_name_}, 0, _ent_, _num_, _len_, _flags_, _min_, _max_, _type_, _desc_ }

NEW Convenience macro for creating full fbInfoElement_t static initializers.

Used for creating information element arrays suitable for passing to fbInfoModelAddElementArray().

#define FB_IE_PEN_REVERSE   29305

Private enterprise number for reverse information elements (see draft-ietf-ipfix-biflow-03 section 6.1).

If an information element with FB_IE_F_REVERSIBLE and a zero enterprise number (i.e., an IANA-assigned information element) is added to a model, the reverse IE will be generated by setting the enterprise number to this constant.

#define FB_IE_REVERSE_STR   "reverse"

Reverse information element name prefix.

This string is prepended to an information element name, and the first character after this string is capitalized, when generating a reverse information element.

#define FB_IE_REVERSE_STRLEN   7

Length of reverse information element name prefix.

#define FB_IE_SEMANTIC

(

flags

)

((flags & 0x0000ff00) >> 8)

Convenience macro for extracting the information element semantic value from the flags variable in the fbInfoElement_t struct.

#define FB_IE_UNITS

(

flags

)

((flags & 0xFFFF0000) >> 16)

Convenience macro for extracting the information element units value from the flags variable in the fbInfoElement_t struct.

#define FB_IE_VENDOR_BIT_REVERSE   0x4000

Reverse information element bit for vendor-specific information elements (see draft-ietf-ipfix-biflow-03 section 6.2).

If an information element with FB_IE_F_REVERSIBLE and a non-zero enterprise number (i.e., a vendor-specific information element) is added to a model, the reverse IE number will be generated by ORing this bit with the given forward information element number.

#define FB_LIST_SEM_UNDEFINED   0xFF

The following Semantic values are for use in the structured Data Types: basicLists, subTemplateLists, and subTemplateMultiLists.

Semantic field for indicating the value has not been set

#define FB_UNITS_BITS   0x00010000

Information Element Units - See RFC 5610.

An Information Element Units Flag used to describe the units of an information element. See RFC 5610

#define FB_UNITS_ENTRIES   0x000C0000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_FLOWS   0x00040000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_FRAMES   0x000D0000

An Information Element Units Flag used to describe the units of an information element.

Recently added for layer 2 frames

#define FB_UNITS_HOPS   0x000B0000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_MESSAGES   0x000A0000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_MICROSECONDS   0x00070000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_MILLISECONDS   0x00060000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_NANOSECONDS   0x00080000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_OCTETS   0x00020000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_PACKETS   0x00030000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_SECONDS   0x00050000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

#define FB_UNITS_WORDS   0x00090000

An Information Element Units Flag used to describe the units of an information element.

See RFC 5610

Typedef Documentation

typedef struct fbCollector_st fbCollector_t

IPFIX Collecting Process endpoint.

Used to collect messages into an associated IPFIX Message Buffer from a remote Exporting Process, or from an IPFIX File. Use this with the fbListener_t structure to implement a full Collecting Process, including Transport Session setup. The internals of this structure are private to libfixbuf.

typedef struct fbConnSpec_st fbConnSpec_t

Connection specifier.

Used to define a peer address for fbExporter_t, or a passive address for fbListener_t.

typedef struct fbExporter_st fbExporter_t

IPFIX Exporting Process endpoint.

Used to export messages from an associated IPFIX Message Buffer to a remote Collecting Process, or to an IPFIX File. The internals of this structure are private to libfixbuf.

typedef struct fbInfoElement_st fbInfoElement_t

A single IPFIX Information Element definition.

An Information Element defines the type of data in each field of a record. This structure may be contained in an fbInfoModel_t, in which case the name field contians the information element name, or an an fbTemplate_t, in which case the canon field references the fbInfoElement_t contained within the Information Model.

typedef struct fbInfoElementOptRec_st fbInfoElementOptRec_t

The corresponding struct to the Information Element Type Options Template.

If collecting this element, use the function fbInfoElementAddOptRecElem() to add this element to the info model.

typedef struct fbInfoElementSpec_st fbInfoElementSpec_t

A single IPFIX Information Element specification.

Used to name an information element for inclusion in a template by fbTemplateAppendSpecArray().

typedef struct fbInfoModel_st fbInfoModel_t

An IPFIX information model.

Contains information element definitions. The internals of this structure are private to libfixbuf.

typedef struct fbListener_st fbListener_t

IPFIX Collecting Process session listener.

Used to wait for connections from IPFIX Exporting Processes, and to manage open connections via a select(2)-based mechanism. The internals of this structure are private to libfixbuf.

typedef void(* fbListenerAppFree_fn) (void *ctx)

Application context free function type for fbListener_t.

If the Collector is in multi-session mode (see appinit fn), then the appfree function will be called if a session is timed out (does not receive a UDP message for more than 30 minutes.) Called during fbCollector_t cleanup.

typedef gboolean(* fbListenerAppInit_fn) (fbListener_t *listener, void **ctx, int fd, struct sockaddr *peer, size_t peerlen, GError **err)

Application context initialization function type for fbListener_t.

This function is called after accept(2) for TCP or SCTP with the peer address in the peer argument. For UDP, it is called during fbListener_t initialization and the peer address will be NULL. If the Collector is in multi-session mode, the appinit function will be called when a new UDP connection occurs with the peer address, similiar to the TCP case. Use fbCollectorSetUDPMultiSession() to turn on multi-session mode (off by default). The application may veto fbCollector_t creation by returning FALSE. In multi-session mode, if the connection is to be ignored, the application should set error code FB_ERROR_NLREAD on the err and return FALSE. If the application returns FALSE, fixbuf will maintain information about that peer, and will reject connections from that peer until shutdown or until that session times out. Fixbuf will return FB_ERROR_NLREAD for previously rejected sessions. The context (returned via out-parameter ctx) will be stored in the fbCollector_t, and is retrievable via a call to fbCollectorGetContext(). If not in multi-session mode and using the appinit fn, the ctx will be associated with all UDP sessions.

typedef void(* fbNewTemplateCallback_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl)

The callback function to be called when the session receives a new external template from the connected node.

The point of this callback is to be able to assign an internal template to a received external template for subTemplates or to apply some context variable to a template. The callback should be set using fbSessionAddTemplateCallback() and that function should be called upon session creation. Libfixbuf often clones sessions upon receiving a connection (particularly in the UDP case) and this callback function is carried over to cloned sessions.

Parameters

session	a pointer to the session that received the template
tid	the template ID for the template that was received
tmpl	pointer to the template information of the received template

Returns

NO return value

typedef struct fbSession_st fbSession_t

An IPFIX Transport Session state container.

Though Session creation and lifetime are managed by the fbCollector_t and fbExporter_t types, each fBuf_t buffer uses this type to store session state, including internal and external Templates and Message Sequence Number information.

typedef struct fbSubTemplateList_st fbSubTemplateList_t

Structure used to hold information of a sub template list.

This structure is filled in by the user in an exporter to tell fixbuf how to encode the data. This structure is filled in by the transcoder in a collector, feeding the useful information up to the user

typedef struct fbSubTemplateMultiListEntry_st fbSubTemplateMultiListEntry_t

Entries contain the same type of information at SubTemplateLists: template ID and template pointers to describe the data the number of data elements and the data pointer and data length.

Sub template multi lists are inherently nested constructions. At a high level, they are a list of sub template lists. The first level is a list of fbSubTemplateMultiListEntry_t's, which each contain the information that describes the data contained in them. Initializing a fbSubTemplateMultiList_t with a semantic and number of elements returns memory that contains numElements blocks of memory containing fbSubTemplateMultiListEntry_t's. It is not ready to accept data. Each of the fbSubTemplateMultiListEntry_t's needed to be set up then data is copied into the entries.

typedef struct fbTemplate_st fbTemplate_t

An IPFIX Template or Options Template.

Templates define the structure of data records and options records within an IPFIX Message. The internals of this structure are private to libfixbuf.

typedef void(* fbTemplateCtxCallback2_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void *app_ctx, void **tmpl_ctx, fbTemplateCtxFree2_fn *fn)

A callback function that will be called when the session receives a new external template.

This callback can be used to assign an internal template to an incoming external template for nested template records using fbSessionAddTemplatePair() or to apply some context variable to a template. The fbNewTemplateCallback_fn is retained for backwards compatibility.

The callback should be set using fbSessionAddTemplateCtxCallback2() and that function should be called after fbSessionAlloc(). Libfixbuf often clones session upon receiving a connection (particularly in the UDP case since a collector and fbuf can have multiple sessions) and this callback is carried over to cloned sessions.

Parameters

session	a pointer to the session that received the template
tid	the template ID for the template that was received
tmpl	pointer to the template information of the received template
app_ctx	the app_ctx pointer that was passed to the fbSessionAddTemplateCtxCallback2() call
tmpl_ctx	pointer that is stored in the fbTemplate structure.
fn	a callback function that should be called to free the ctx when the template is freed/replaced.

Returns

NO return value

typedef void(* fbTemplateCtxCallback_fn) (fbSession_t *session, uint16_t tid, fbTemplate_t *tmpl, void **ctx, fbTemplateCtxFree_fn *fn)

A callback function that will be called when the session receives a new external template.

This callback can be used to assign an internal template to an incoming external template for nested template records using fbSessionAddTemplatePair() or to apply some context variable to a template. The fbNewTemplateCallback_fn is retained for backwards compatibility.

The callback should be set using fbSessionAddTemplateCtxCallback() and that function should be called after fbSessionAlloc(). Libfixbuf often clones session upon receiving a connection (particularly in the UDP case since a collector and fbuf can have multiple sessions) and this callback is carried over to cloned sessions.

This callback function does not provide a way for the caller to pass their application's context into the function for making a C closure. For that, use fbSessionAddTemplateCtxCallback2().

Parameters

session	a pointer to the session that received the template
tid	the template ID for the template that was received
tmpl	pointer to the template information of the received template
ctx	pointer that is stored in the fbTemplate structure.
fn	a callback function that should be called to free the ctx when the template is freed/replaced.

Returns

NO return value

typedef void(* fbTemplateCtxFree2_fn) (void *tmpl_ctx, void *app_ctx)

A callback function that is called when a template is freed.

The free function should be set during the fbTemplateCtxCallback2.

Parameters

tmpl_ctx	a pointer to the ctx that is stored within the fbTemplate.
app_ctx	the app_ctx pointer that was passed to the fbSessionAddTemplateCtxCallback2() call

Returns

NO return value

typedef void(* fbTemplateCtxFree_fn) (void *ctx)

A callback function that is called when a template is freed.

The free function should be set during the fbTemplateCtxCallback.

Parameters

ctx	a pointer to the ctx that is stored within the fbTemplate.

Returns

NO return value

typedef enum fbTransport_en fbTransport_t

Transport protocol for connection specifier.

typedef struct fBuf_st fBuf_t

An IPFIX message buffer.

Used to encode and decode records from IPFIX Messages. The internals of this structure are private to libfixbuf.

typedef struct fbVarfield_st fbVarfield_t

A variable-length field value.

Variable-length information element content is represented by an fbVarfield_t on the internal side of the transcoder; that is, variable length fields in an IPFIX Message must be represented by this structure within the application record.

Enumeration Type Documentation

enum fbTransport_en

Transport protocol for connection specifier.

Enumerator
FB_SCTP	Partially reliable datagram transport via SCTP. Only available if fixbuf was built with SCTP support.
FB_TCP	Reliable stream transport via TCP.
FB_UDP	Unreliable datagram transport via UDP.
FB_DTLS_SCTP	Secure, partially reliable datagram transport via DTLS over SCTP. Only available if fixbuf was built with OpenSSL support. Requires an OpenSSL implementation of DLTS over SCTP, not yet available.
FB_TLS_TCP	Secure, reliable stream transport via TLS over TCP. Only available if fixbuf was built with OpenSSL support.
FB_DTLS_UDP	Secure, unreliable datagram transport via DTLS over UDP. Only available if fixbuf was built with OpenSSL support. Requires OpenSSL 0.9.8 or later with DTLS support.

Function Documentation

void* fbBasicListAddNewElements	(	fbBasicList_t *	basicList,
		uint16_t	numNewElements
	)

Allocates an additional elememnt into the basic list must be called after calling BasicListInit.

Parameters

basicList	pointer to the basic list to add elements to
numNewElements	number of elements to add to the list

Returns

a pointer to the newly allocated element(s)

fbBasicList_t* fbBasicListAlloc

(

void

)

allocates a Basic List Structure

Returns

a pointer a to the allocated basic list in memory

void fbBasicListClear

(

fbBasicList_t *

basicListPtr

)

Clear the parameters of the basic list and free the data buffer.

Parameters

basicListPtr

pointer to the basic list to clear

Returns

NONE

void fbBasicListClearWithoutFree

(

fbBasicList_t *

basicList

)

Clear the parameters of the basic list, but do not free the buffer.

This should get used when the user provides their own buffer

Parameters

basicList

pointer to the basic list to clear without freeing

Returns

NONE

void fbBasicListCollectorInit

(

fbBasicList_t *

basicListPtr

)

This initializes a basic list structure for collection.

The key part of this function is it sets the dataPtr to NULL. If your basic list is declared as a pointer, then allocated using something like g_slice_alloc0 which sets it all to zero, you do not need to call this function. But if your basic list struct isn't a pointer, there dataPtr parameter will be set to garbage, which will break other fixbuf calls, so this function is required

Parameters

basicListPtr

pointer to the basic list to be initialized

Returns

NONE

void fbBasicListFree

(

fbBasicList_t *

basicListPtr

)

Clear the basic list, then free the basic list pointer.

Parameters

basicListPtr

pointer to the basic list to free

Returns

NONE

void* fbBasicListGetDataPtr

(

fbBasicList_t *

basicListPtr

)

Parameters

basicListPtr

pointer to the basic list to get the data pointer from

Returns

the pointer to the data held by the basic list

void* fbBasicListGetIndexedDataPtr	(	fbBasicList_t *	basicListPtr,
		uint16_t	bl_index
	)

Function retrieves the index'th element in the list index is 0-based.

Goes from 0 - (numElements-1)

Parameters

basicListPtr	pointer to the basic list to retrieve the dataPtr
bl_index	the index of the element to retrieve

Returns

a pointer to the data in the index'th slot in the list, NULL if the index is past the bounds of the list

const fbInfoElement_t* fbBasicListGetInfoElement

(

fbBasicList_t *

basicListPtr

)

This function returns a pointer to the information element used in the list it is mainly used in collectors to retrieve information.

Parameters

basicListPtr

pointer to the basic list to get the infoElement from

Returns

pointer to the information element from the list

void* fbBasicListGetNextPtr	(	fbBasicList_t *	basicListPtr,
		void *	currentPtr
	)

Function returns the next element in the list based on the currentPtr.

Parameters

basicListPtr	pointer to the basic list
currentPtr	pointer to the current element being used. Set to NULL to retrieve the first element.

Returns

a pointer to the next data slot, based on the current pointer. NULL if the new pointer is passed the end of the buffer

uint8_t fbBasicListGetSemantic

(

fbBasicList_t *

basicListPtr

)

Get Semantic field for Basic List presumably used in collectors after decoding.

Parameters

basicListPtr

pointer to the basic list to retrieve the semantic from

Returns

the 8-bit semantic value describing the basic list

void* fbBasicListInit	(	fbBasicList_t *	basicListPtr,
		uint8_t	semantic,
		const fbInfoElement_t *	infoElement,
		uint16_t	numElements
	)

Initializes the basic list structure based on the parameters.

This function allocates a buffer large enough to hold num elements amount of the infoElements.

Parameters

basicListPtr	a pointer to the basic list structure to fill
semantic	the semantic value to be used in the basic list
infoElement	a pointer to the info element to be used in the list
numElements	number of elements in the list

Returns

a pointer to the memory where the list data is to be written

void* fbBasicListInitWithOwnBuffer	(	fbBasicList_t *	basicListPtr,
		uint8_t	semantic,
		const fbInfoElement_t *	infoElement,
		uint16_t	numElements,
		uint16_t	dataLength,
		uint8_t *	dataPtr
	)

use this function to initialize the basic list, but it gets the pointer to a buffer and its length allocated independently from these functions This will generally be used by a collector that does not want to free and allocate new buffers for each incoming message

Parameters

basicListPtr	a pointer to the basic list structure to fill
semantic	the semantic value to be used in the basic list
infoElement	a pointer to the info element to be used in the list
numElements	number of elements in the list
dataLength	length of the buffer passed to the function
dataPtr	pointer to the buffer previously allocated for the list

Returns

a pointer to the beginning of the buffer on success, NULL on failure

void* fbBasicListRealloc	(	fbBasicList_t *	basicList,
		uint16_t	newNumElements
	)

Free the current data pointer, allocating a new buffer to accomodate the new number of elements.

The remaining parameters are unchanged. If the number of elements hasn't changed the original buffer is used and its pointer is returned

Parameters

basicList	pointer to the basic list to realloc
newNumElements	new number of elements to allocate for the list

Returns

pointer to the data pointer for the list after realloc

void fbBasicListSetSemantic	(	fbBasicList_t *	basicListPtr,
		uint8_t	semantic
	)

Sets the semantic for describing a basic list generally used in exporters before decoding.

Parameters

basicListPtr	pointer to the basic list to set the semantic
semantic	value to set the semantic field to

Returns

NONE

fbCollector_t* fbCollectorAllocFile	(	void *	ctx,
		const char *	path,
		GError **	err
	)

Allocate a collecting process endpoint for a named file.

The underlying file will be opened immediately.

Parameters

ctx	application context; for application use, retrievable by fbCollectorGetContext
path	path of file to read, or "-" to read standard input. Used to get fp, user creates and frees.
err	An error description, set on failure.

Returns

a collecting process endpoint, or NULL on failure.

fbCollector_t* fbCollectorAllocFP	(	void *	ctx,
		FILE *	fp
	)

Allocate a collecting process endpoint for an open file.

Parameters

ctx	application context; for application use, retrievable by fbCollectorGetContext
fp	file pointer to file to read. Created and freed by user. Must be kept around for the life of the collector.

Returns

a collecting process endpoint.

gboolean fbCollectorClearTranslator	(	fbCollector_t *	collector,
		GError **	err
	)

fbCollectorClearTranslator

this removes an input translator from a given collector such that it will operate on IPFIX protocol again

Parameters

collector	the collector on which to remove the translator
err	when an error occurs, a Glib GError structure is set with an error description

Returns

TRUE on success, FALSE on failure

void fbCollectorClose

(

fbCollector_t *

collector

)

Close the file or socket underlying a collecting process endpoint.

No effect on open file endpoints. If the collector is attached to a buffer managed by a listener, the buffer will be removed from the listener (that is, it will not be returned by subsequent fbListenerWait() calls).

Parameters

collector

a collecting process endpoint.

void* fbCollectorGetContext

(

fbCollector_t *

collector

)

Retrieve the application context associated with a collector.

This context is taken from the ctx argument of fbCollectorAllocFile() or fbCollectorAllocFP(), or passed out via the ctx argument to the appinit function argument to fbListenerAlloc().

Parameters

collector

a collecting process endpoint.

Returns

the application context

uint32_t fbCollectorGetNetflowMissed	(	fbCollector_t *	collector,
		struct sockaddr *	peer,
		size_t	peerlen,
		uint32_t	obdomain
	)

fbCollectorGetNetflowMissed

Returns the number of potential missed export packets of the Netflow v9 session that is currently set on the collector (the session is set on the collector when an export packet is received) if peer is NULL. If peer is set, this will look up the session for that peer/obdomain pair and return the missed export packets associated with that peer and obdomain. If peer/obdomain pair doesn't exist, this function returns 0. This can't return the number of missed flow records since Netflow v9 increases sequence numbers by the number of export packets it has sent, NOT the number of flow records (like IPFIX and netflow v5 does).

Parameters

collector
peer	[OPTIONAL] peer address of NetFlow v9 exporter
peerlen	size of peer object
obdomain	observation domain of NetFlow v9 exporter

Returns

number of missed packets since beginning of session

uint32_t fbCollectorGetObservationDomain

(

fbCollector_t *

collector

)

Retrieves the observation domain of the node connected to the UDP collector.

The observation domain only gets set on the collector when collecting via UDP. If the collector is using another mode of transport, use fbSessionGetDomain().

Parameters

collector

struct sockaddr* fbCollectorGetPeer

(

fbCollector_t *

collector

)

Retrieves information about the node connected to this collector.

Parameters

collector

pointer to the collector to get peer information from

Returns

pointer to sockaddr structure containing IP information of peer

uint32_t fbCollectorGetSFlowMissed	(	fbCollector_t *	collector,
		struct sockaddr *	peer,
		size_t	peerlen,
		uint32_t	obdomain
	)

fbCollectorGetSFlowMissed

Returns the number of potential missed export packets of the SFlow session that is identified with the given ip/agentID. The agent ID is a field that is in the sFlow header and is sent with every packet. Fixbuf keeps track of sequence numbers for sFlow sessions per agent ID.

Parameters

collector
peer	address of exporter to lookup
peerlen	sizeof(peer)
obdomain	observation domain of peer exporter

Returns

number of missed packets since beginning of session

void fbCollectorManageUDPStreamByPort	(	fbCollector_t *	collector,
		gboolean	manage_port
	)

An attempt to fix what some netflow v9 exporters do wrong.

Netflow v9 rfc 3954 states that collectors should use a combination of peer IP address and observation domain to manage netflow streams. However, some devices send two separate streams on the same IP, obdomain, and the only way to differentiate is by using peer port. Turning this flag on will prevent fixbuf from zeroing out the port before comparing sockaddr structs and makes fixbuf manage streams by ip, port, and obdomain.

Parameters

collector	pointer to collector associated with listener.
manage_port	TRUE if fixbuf should manage UDP streams by port, FALSE by default.

void fbCollectorSetAcceptOnly	(	fbCollector_t *	collector,
		struct sockaddr *	address,
		size_t	address_length
	)

Set the collector to only receive from the given IP address over UDP.

The port will be ignored. Use fbListenerGetCollector() to get the pointer to the collector after calling fbListenerAlloc(). ONLY valid for UDP. Set the address family in address.

Parameters

collector	pointer to collector
address	pointer to sockaddr struct with IP address and family.
address_length	address length

gboolean fbCollectorSetNetflowV9Translator	(	fbCollector_t *	collector,
		GError **	err
	)

fbCollectorSetNetflowV9Translator

this sets the collector input translator to convert NetFlowV9 into IPFIX for the given collector

Parameters

collector	pointer to the collector state to perform Netflow V9 conversion on
err	GError structure that holds the error message if an error occurs

Returns

TRUE on success, FALSE on error

gboolean fbCollectorSetSFlowTranslator	(	fbCollector_t *	collector,
		GError **	err
	)

fbCollectorSetSFlowTranslator

this sets the collector input translator to convert SFlow into IPFIX for the given collector

Parameters

collector	pointer to the collector state to perform SFlow conversion on
err	GError structure that holds the error message if an error occurs

Returns

TRUE on success, FALSE on error

void fbCollectorSetUDPMultiSession	(	fbCollector_t *	collector,
		gboolean	multi_session
	)

Attempt to maintain backwards compatibility with UDP.

As of version 1.2, fixbuf calls the appinit functions when a new UDP connection occurs, as opposed to calling it during fbListenerAlloc. To maintain compatibility, with old applications, fixbuf will still call appinit in fbListenerAlloc with a null peer address. If UDP multi session is turned on, it will ALSO call appinit() when a new UDP connection occurs. Likewise with appfree(). Call fbListenerGetCollector() to obtain collector.

Parameters

collector	pointer to collector associated with listener.
multi_session	TRUE if multi-session enabled, FALSE by default.

fbExporter_t* fbExporterAllocBuffer	(	uint8_t *	buf,
		uint16_t	bufsize
	)

Allocate an exporting process for a buffer.

The underlying buffer will be allocated to the given size.

Parameters

buf	buffer that will be allocated and used to copy IPFIX to.
bufsize	size of buffer that will be allocated.

Returns

a new exporting process endpoint

fbExporter_t* fbExporterAllocFile

(

const char *

path

)

Allocate an exporting process endpoint for a named file.

The underlying file will not be opened until the first message is emitted from the buffer associated with the exporter.

Parameters

path	pathname of the IPFIX File to write, or "-" to open standard output. Path is duplicated and handled. Original pointer is up to the user.

Returns

a new exporting process endpoint

fbExporter_t* fbExporterAllocFP

(

FILE *

fp

)

Allocate an exporting process endpoint for an opened ANSI C file pointer.

Parameters

fp	open file pointer to write to. File pointer is created and freed outside of the Exporter functions.

Returns

a new exporting process endpoint

fbExporter_t* fbExporterAllocNet

(

fbConnSpec_t *

spec

)

Allocate an exporting process endpoint for a network connection.

The remote collecting process is specified by the given connection specifier. The underlying socket connection will not be opened until the first message is emitted from the buffer associated with the exporter.

Parameters

spec	remote endpoint connection specifier. A copy is made for the exporter, it is freed later. User is responsible for original spec pointer

Returns

a new exporting process endpoint

void fbExporterAutoStream

(

fbExporter_t *

exporter

)

Enable automatic SCTP stream selection for the next message exported.

Automatic stream selection is the default; use this call to re-enable it on a given exporter after using fbExporterSetStream(). With automatic stream selection, the minimal behavior specified in the original IPFIX protocol (RFC xxxx) is used: all templates and options templates are exported on stream 0, and all data is exported on stream 1. This call is a no-op for non-SCTP exporters.

Parameters

exporter

an exporting process endpoint.

void fbExporterClose

(

fbExporter_t *

exporter

)

Force the file or socket underlying an exporting process endpoint to close.

No effect on open file endpoints. The file or socket may be reopened on a subsequent message emission from the associated buffer.

Parameters

exporter

an exporting process endpoint.

size_t fbExporterGetMsgLen

(

fbExporter_t *

exporter

)

Get the (transcoded) message length that was copied to the exporting buffer upon fBufEmit().

Parameters

exporter

an exporting process endpoint.

void fbExporterSetStream	(	fbExporter_t *	exporter,
		int	sctp_stream
	)

Set the SCTP stream for the next message exported.

To change the SCTP stream used for export, first emit any message in the exporter's associated buffer with fbufEmit(), then use this call to set the stream for the next message. This call cancels automatic stream selection, use fbExporterAutoStream() to re-enable it. This call is a no-op for non-SCTP exporters.

Parameters

exporter	an exporting process endpoint.
sctp_stream	SCTP stream to use for next message.

gboolean fbInfoElementAddOptRecElement	(	fbInfoModel_t *	model,
		fbInfoElementOptRec_t *	rec
	)

Add an element that we received via an Options Record to the given info model.

Returns True if the element was successfully added. False, if it couldn't be added. This function will not add elements that have a private enterprise number of 0, for security reasons.

Parameters

model	An information model
rec	A pointer to the received fbInfoElementOptRec.

Returns

TRUE if item was successfully added to info model.

fbTemplate_t* fbInfoElementAllocTypeTemplate	(	fbInfoModel_t *	model,
		GError **	err
	)

Allocate the Options Template that will be used to define Information Element Type Records.

This function does not add the template to the session or fbuf. This function allocates the template, appends the appropriate elements to the template, and sets the scope on the template. See RFC 5610 for more info.

Parameters

model	A pointer to an existing info model
err	GError

Returns

The pointer to the newly allocated template.

gboolean fbInfoElementWriteOptionsRecord	(	fBuf_t *	fbuf,
		const fbInfoElement_t *	model_ie,
		uint16_t	tid,
		GError **	err
	)

Export an options record to the given fbuf with information element type information about the given information element.

See RFC 5610 for details. Use fbInfoElementAllocTypeTemplate() and add the returned template to the session, before calling this function.

Parameters

fbuf	An existing fbuf
model_ie	A pointer to the information element to export type info.
tid	The template id of the Options Template.
err	GError

Returns

TRUE if successful, FALSE if an error occurred.

void fbInfoModelAddElement	(	fbInfoModel_t *	model,
		fbInfoElement_t *	ie
	)

Add a single information element to an information model.

The information element is assumed to be in "canonical" form; that is, its ref.name field should contain the information element name. The information element and its name are copied into the model; the caller may free or reuse its storage after this call.

See fbInfoModelAddElementArray() for a more convenient method of statically adding information elements to information models.

Parameters

model	An information model
ie	Pointer to an information element to copy into the model

void fbInfoModelAddElementArray	(	fbInfoModel_t *	model,
		fbInfoElement_t *	ie
	)

Add multiple information elements in an array to an information model.

The information elements are assumed to be in "canonical" form; that is, their ref.name fields should contain the information element name. Each information element and its name are copied into the model; the caller may free or reuse its storage after this call.

The ie parameter points to the first information element in an array, usually statically initialized with an array of FB_IE_INIT macros followed by an FB_IE_NULL macro.

Parameters

model	An information model
ie	Pointer to an IE array to copy into the model

fbInfoModel_t* fbInfoModelAlloc

(

void

)

Allocate a new information model.

The information model will contain all the default information elements in the IANA-managed number space, and may be extended via fbInfoModelAddElement() and fbInfoModelAddElementArray().

An Information Model is required to create Templates and Sessions. Each application should have only one Information Model.

Returns

a new Information Model

guint fbInfoModelCountElements

(

const fbInfoModel_t *

model

)

Return the number of information elements in the information model.

Parameters

model

An information model

Returns

The number of information elements in the information model

void fbInfoModelFree

(

fbInfoModel_t *

model

)

Free an information model.

Must not be called until all sessions and templates depending on the information model have also been freed; i.e., at application cleanup time.

Parameters

model

An information model

const fbInfoElement_t* fbInfoModelGetElementByID	(	fbInfoModel_t *	model,
		uint16_t	id,
		uint32_t	ent
	)

Return a pointer to the canonical information element within an information model given the information element ID and enterprise ID.

The returned information element is owned by the information model and must not be modified.

Parameters

model	An information model
id	An information element id
ent	An enterprise id

Returns

The named information element within the model, or NULL if no such element exists.

const fbInfoElement_t* fbInfoModelGetElementByName	(	fbInfoModel_t *	model,
		const char *	name
	)

Return a pointer to the canonical information element within an information model given the information element name.

The returned information element is owned by the information model and must not be modified.

Parameters

model	An information model
name	The name of the information element to look up

Returns

The named information element within the model, or NULL if no such element exists.

void fbInfoModelIterInit	(	fbInfoModelIter_t *	iter,
		const fbInfoModel_t *	model
	)

Initialize an information model iterator for iteration.

Parameters

iter	A pointer to the iterator to initialize
model	An information model

const fbInfoElement_t* fbInfoModelIterNext

(

fbInfoModelIter_t *

iter

)

Return a pointer to the next information element in the information model.

Returns NULL once all information elements have been returned.

Parameters

iter	An information model iterator

Returns

The next information element within the model, or NULL if there are no more elements.

gboolean fbInfoModelTypeInfoRecord

(

fbTemplate_t *

tmpl

)

Checks to see if the template contains all of the elements the RFC 5610 info element type record should contain.

If so, and the fbuf is in "automatic insert" mode, we'll insert the elements in our own info model.

Parameters

tmpl	A pointer to the template

Returns

TRUE if template contains all the info elements

fbListener_t* fbListenerAlloc	(	fbConnSpec_t *	spec,
		fbSession_t *	session,
		fbListenerAppInit_fn	appinit,
		fbListenerAppFree_fn	appfree,
		GError **	err
	)

Allocate a listener.

The listener will listen on a specified local endpoint, and create a new collecting process endpoint and collection buffer for each incoming connection. Each new buffer will be associated with a clone of a given session state container.

The application may associate context with each created collecting process endpoint, or veto a connection attempt, via a function colled on each connection attempt passed in via the appinit parameter. If this function will create application context, provide a function via the appfree parameter which will free it.

The fbListener_t returned should be freed by the application by calling fbListenerFree().

Parameters

spec	local endpoint connection specifier. A copy is made of this, which is freed by listener. Original pointer freeing is up to the user.
session	session state container to clone for each collection buffer created by the listener. Not freed by listener. Must be kept alive while listener exists.
appinit	application connection initiation function. Called on each collection attempt; vetoes connection attempts and creates application context.
appfree	application context free function.
err	An error description, set on failure.

Returns

a new listener, or NULL on failure.

void fbListenerFree

(

fbListener_t *

listener

)

Free a listener.

Stops listening on the local endpoint, and frees any open buffers still managed by the listener.

Parameters

listener

a listener

void fbListenerFreeGroupResult

(

fbListenerGroupResult_t *

result

)

Free the fbListenerGroupResult_t returned from fbListenerGroupWait.

Parameters

result

fbListenerGroupResult_t

Returns

nothing

gboolean fbListenerGetCollector	(	fbListener_t *	listener,
		fbCollector_t **	collector,
		GError **	err
	)

fbListenerGetCollector

If a collector is associated with the listener class, this will return a handle to the collector state structure.

Parameters

listener	handle to the listener state
collector	pointer to a collector state pointer, set on return if there is no error
err	a GError structure holding an error message on error

Returns

FALSE on error, check err, TRUE on success

int fbListenerGroupAddListener	(	fbListenerGroup_t *	group,
		const fbListener_t *	listener
	)

Adds a previously allocated listener to the previously allocated group.

The listener is placed at the head of the list

Parameters

group	pointer to the allocated group to add the listener to
listener	pointer to the listener structure to add to the group

Returns

0 upon success. "1" if entry couldn't be allocated "2" if either of the incoming pointers are NULL

fbListenerGroup_t* fbListenerGroupAlloc

(

void

)

Allocates and returns a fbListenerGroup with no entries.

Returns

a pointer to the created fbListenerGroup_t, or NULL on error

int fbListenerGroupDeleteListener	(	fbListenerGroup_t *	group,
		const fbListener_t *	listener
	)

Removes the listener from the group.

IT DOES NOT FREE THE LISTENER OR THE GROUP

Parameters

group	pointer to the group to remove from the listener from
listener	pointer to the listener to remove from the group

Returns

0 on success, and "1" if the listener is not found "2" if either of the pointers are NULL

void fbListenerGroupFree

(

fbListenerGroup_t *

group

)

frees a listener group

Parameters

group

fbListenerGroup

Returns

nothing

fbListenerGroupResult_t* fbListenerGroupWait	(	fbListenerGroup_t *	group,
		GError **	err
	)

Similar to fbListenerWait, except that is looks for connections for multiple listeners.

It takes a previously allocated and filled listener group. It returns a pointer to the head of a list of listenerGroupResults.

Parameters

group	pointer to the group of listeners to wait on
err	error string structure seen throughout fixbuf

Returns

pointer to the head of the listener group result list NULL on error, and sets the error string

void fbListenerInterrupt

(

fbListener_t *

listener

)

Cause the current or next call to fbListenerWait to unblock and return.

Use this from a thread or a signal handler to interrupt a blocked listener.

Parameters

listener

listener to interrupt.

fBuf_t* fbListenerOwnSocketCollectorTCP	(	fbListener_t *	listener,
		int	sock,
		GError **	err
	)

Returns an fBuf wrapped around an independently managed socket and a properly created listener for TCP connections.

The caller is only responsible for creating the socket. The existing collector code will close the socket and cleanup everything.

Parameters

listener	pointer to the listener to wrap around the socket
sock	the socket descriptor of the independently managed socket
err	standard fixbuf err structure pointer

Returns

pointer to the fbuf for the collector. NULL if sock is 0, 1, or 2 (stdin, stdout, or stderr)

fBuf_t* fbListenerOwnSocketCollectorTLS	(	fbListener_t *	listener,
		int	sock,
		GError **	err
	)

Same as fbListenerOwnSocketCollectorTCP but for TLS (not tested)

Parameters

listener	pointer to the listener to wait on
sock	independently managed socket descriptor
err	standard fixbuf err structure pointer

Returns

pointer to the fbuf for the collector NULL if sock is 0, 1, or 2 (stdin, stdout, or stderr)

fBuf_t* fbListenerWait	(	fbListener_t *	listener,
		GError **	err
	)

Wait on a listener.

Accepts pending connections from exporting processes. Returns the next collection buffer with available data to read; if the collection buffer returned by the last call to fbListenerWait() is available, it is preferred. Blocks forever (or until fbListenerInterrupt() is called) if no messages or connections are available.

To effectively use fbListenerWait(), the application should set up an session state container with internal templates, call fbListenerWait() to accept a first connection, then read records from the collector buffer to end of message (FB_ERROR_EOM). At end of message, the application should then call fbListenerWait() to accept pending connections or switch to another collector buffer with available data. Note that each collector buffer returned created by fbListenerWait() is set to automatic mode using fBufSetAutomaticMode(). To modify this behavior, call fBufSetAutomaticMode(fbuf, TRUE) on the fbuf returned from this function.

Parameters

listener	a listener
err	An error description, set on failure.

Returns

a collection buffer with available data, or NULL on failure.

fBuf_t* fbListenerWaitNoCollectors	(	fbListener_t *	listener,
		GError **	err
	)

Waits for an incoming connection, just like fbListenerWait, except that this function doesn't monitor active collectors.

This allows for a multi threaded application to have one thread monitoring the listeners, and one keeping track of collectors

Parameters

listener	The listener to wait for connections on
err	An error description, set on failure.

Returns

a collection buffer for the new connection, NULL on failure.

gboolean fbListValidSemantic

(

uint8_t

semantic

)

validates the value of the semantic field,

Parameters

semantic

The value of the semantic field to be validated *

Returns

TRUE is valid {0xFF, 0x00-0x04}, FALSE if not

uint16_t fbSessionAddTemplate	(	fbSession_t *	session,
		gboolean	internal,
		uint16_t	tid,
		fbTemplate_t *	tmpl,
		GError **	err
	)

Add a template to a session.

If external, adds the template to the current domain, and exports the template if the session is associated with an export buffer. Assigns the template ID given in tid, or assigns a template ID if tid is FB_TID_AUTO. If using FB_TID_AUTO, external templates start at 256 and count up, internal templates start at 65535 and count down. This is to avoid inadvertant unrelated external and internal templates having the same ID

Parameters

session	A session state container
internal	TRUE if the template is internal, FALSE if external.
tid	Template ID to assign, replacing any current template in case of collision; or FB_TID_AUTO to assign a new tId.
tmpl	Template to add
err	An error description, set on failure

Returns

the template ID of the added template, or 0 on failure.

void fbSessionAddTemplateCallback	(	fbSession_t *	session,
		fbNewTemplateCallback_fn	callback
	)

This function sets the callback to let the user know when a new template has arrived from the connected IPFIX node.

Assigning a callback here is NOT required. Not using one will cause all sub templates to be fully decoded, transcoding all information elements in the external template.

This function should be called after fbSessionAlloc(). Fixbuf often clones sessions upon receiving a connection. In the TCP case, the application has access to the session right after fbListenerWait() returns by calling fBufGetSession(). In the UDP case, the application does not have access to the fbSession until after a call to fBufNext() for fBufNextCollectionTemplate() and by this time the application may have already received some templates. Therefore, it is important to call this function before fBufNext(). Any callbacks added to the session will be carried over to cloned sessions.

In order to add application context to a template use the newer API call fbSessionAddTemplateCtxCallback2() instead.

Parameters

session	pointer to the session to assign the callback to
callback	the function to be called when a new template is received

Returns

NONE

void fbSessionAddTemplateCtxCallback	(	fbSession_t *	session,
		fbTemplateCtxCallback_fn	callback
	)

This function sets the callback that allows the application to set its own context variable with a new incoming template.

Assigning a callback is not required and is only useful if the application either needs to store some information about the template or to prevent certain nested templates from being transcoded. If the application's template contains a subTemplateMultiList or subTemplateList and the callback is not used, all incoming templates contained in these lists will be fully transcoded and the application is responsible for freeing any nested lists contained within those objects.

This function should be called after fbSessionAlloc(). Fixbuf often clones sessions upon receiving a connection. In the TCP case, the application has access to the session right after fbListenerWait() returns by calling fBufGetSession(). In the UDP case, the application does not have access to the fbSession until after a call to fBufNext() for fBufNextCollectionTemplate() and by this time the application may have already received some templates. Therefore, it is important to call this function before fBufNext(). Any callbacks added to the session will be carried over to cloned sessions.

This function replaced the deprecated function fbSessionAddTemplateCallback(), and should be used with the fbNewTemplateCallback_fn. This function should be used with the fbTemplateCtxCallback_fn.

The callback function passed to this function does not provide a way for the caller to pass their application's context into the function for making a C closure. For that, use fbSessionAddTemplateCtxCallback2(). (Only one of fbSessionAddTemplateCtxCallback() and fbSessionAddTemplateCtxCallback2() should be used.

Parameters

session	pointer session to assign the callback to
callback	the function that should be called when a new template is received

Returns

NONE

void fbSessionAddTemplateCtxCallback2	(	fbSession_t *	session,
		fbTemplateCtxCallback2_fn	callback,
		void *	app_ctx
	)

This function sets the callback that allows the application to set its own context variable with a new incoming template.

Assigning a callback is not required and is only useful if the application either needs to store some information about the template or to prevent certain nested templates from being transcoded. If the application's template contains a subTemplateMultiList or subTemplateList and the callback is not used, all incoming templates contained in these lists will be fully transcoded and the application is responsible for freeing any nested lists contained within those objects.

This function should be called after fbSessionAlloc(). Fixbuf often clones sessions upon receiving a connection. In the TCP case, the application has access to the session right after fbListenerWait() returns by calling fBufGetSession(). In the UDP case, the application does not have access to the fbSession until after a call to fBufNext() for fBufNextCollectionTemplate() and by this time the application may have already received some templates. Therefore, it is important to call this function before fBufNext(). Any callbacks added to the session will be carried over to cloned sessions.

This function updates and subsumes the functionality of fbSessionAddTemplateCtxCallback() by adding an application context pointer. (Only one of fbSessionAddTemplateCtxCallback() and fbSessionAddTemplateCtxCallback2() should be used.)

Parameters

session	pointer session to assign the callback to
callback	the function that should be called when a new template is received
app_ctx	parameter that gets passed onto the callback function

Returns

NONE

void fbSessionAddTemplatePair	(	fbSession_t *	session,
		uint16_t	ent_tid,
		uint16_t	int_tid
	)

Adds an external-internal template pair to the session.

This tells the transcoder which internal template to use for a given external template used in a sub template list, or a sub template multi list.

If the value of int_tid is 0, it tells fixbuf NOT to decode any list where the external template is ent_tid. This allows a collector to specify which templates that are included in lists it can handle.

If ent_tid and int_tid are set equal to each other, it tells the transcoder to decode all of the fields from the external template, by using the external template also as the internal template (lining up all the fields) The exception to this is if there is an existing internal template with the same template ID as the external template. In this case, the internal template with the appropriate ID will be used. To avoid this potentially unintended consequence, be careful and deliberate with template IDs.

Parameters

session	pointer to the session to add the pair to
ent_tid	the external template ID
int_tid	the internal template ID used to decode the data when the associated external template is used

Returns

NONE

fbSession_t* fbSessionAlloc

(

fbInfoModel_t *

model

)

Allocate a transport session state container.

The new session is associated with the given information model, contains no templates, and is usable either for collection or export.

Each fbExporter_t, fbListener_t, and fbCollector_t must have its own session; session state cannot be shared.

The fbSession_t returned by this function is not freed by calling fBufFree() or fbListenerFree(). It should be freed by the application by calling fbSessionFree().

Parameters

model

An information model. Not freed by sessionFree. Must be freed by user after calling SessionFree

Returns

a new, empty session state container.

gboolean fbSessionExportTemplate	(	fbSession_t *	session,
		uint16_t	tid,
		GError **	err
	)

Export a single external template in the current domain of a given session.

Writes the template to the associated export buffer. May cause a message to be emitted if the associated export buffer is in automatic mode, or return with FB_ERROR_EOM if the associated export buffer is not in automatic mode.

Parameters

session	a session state container associated with an export buffer
tid	template ID within current domain to export
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

gboolean fbSessionExportTemplates	(	fbSession_t *	session,
		GError **	err
	)

Export all external templates in the current domain of a given session.

Writes templates to the associated export buffer. May cause a message to be emitted if the associated export buffer is in automatic mode, or return with FB_ERROR_EOM if the associated export buffer is not in automatic mode.

Parameters

session	a session state container associated with an export buffer
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

void fbSessionFree

(

fbSession_t *

session

)

Free a transport session state container.

This is done automatically when freeing the listener or buffer with which the session is associated. Use this call if a session needs to be destroyed before it is associated.

Parameters

session

session state container to free.

fbCollector_t* fbSessionGetCollector

(

fbSession_t *

session

)

Retrieve collector that was created with the session.

Parameters

session

a session state container

Returns

fbCollector_t the collector that was created with the session

uint32_t fbSessionGetDomain

(

fbSession_t *

session

)

Retrieve the current domain on a session.

Parameters

session

a session state container

Returns

the ID of the session's current observation domain

fbInfoModel_t* fbSessionGetInfoModel

(

fbSession_t *

session

)

fbSessionGetInfoModel

Parameters

session

Returns

a pointer to the info model for the session

fbTemplate_t* fbSessionGetTemplate	(	fbSession_t *	session,
		gboolean	internal,
		uint16_t	tid,
		GError **	err
	)

Retrieve a template from a session by ID.

If external, retrieves the template within the current domain.

Parameters

session	A session state container
internal	TRUE if the template is internal, FALSE if external.
tid	ID of the template to retrieve.
err	An error description, set on failure.

Returns

The template with the given ID, or NULL on failure.

uint16_t fbSessionLookupTemplatePair	(	fbSession_t *	session,
		uint16_t	ext_tid
	)

Function to find a pair, uniquely identified by the external ID, and return the associated internal template ID.

Parameters

session	pointer to the session used to find the pair
ext_tid	external template ID used to find a pair

Returns

the internal template ID from the pair. 0 if the pair isn't found

gboolean fbSessionRemoveTemplate	(	fbSession_t *	session,
		gboolean	internal,
		uint16_t	tid,
		GError **	err
	)

Remove a template from a session.

If external, removes the template from the current domain, and exports a template revocation set if the session is associated with an export buffer.

Parameters

session	A session state container
internal	TRUE if the template is internal, FALSE if external.
tid	Template ID to remove.
err	An error description, set on failure

Returns

TRUE on success, FALSE on failure.

void fbSessionRemoveTemplatePair	(	fbSession_t *	session,
		uint16_t	ext_tid
	)

remove a template pair from the list this is called by fixbuf when a template is revoked from the session by the node on the other end of the connection

Parameters

session	pointer to the session to remove the pair from
ext_tid	the external template ID for the pair

Returns

NONE

void fbSessionResetExternal

(

fbSession_t *

session

)

Reset the external state (sequence numbers and templates) in a session state container.

FIXME: Verify that this call actually makes sense; either that a session is reassociatable with a new collector, or that you need to do this when reassociating a collector with a connection. Once this is done, rewrite this documentation

Parameters

session

session state container to reset

void fbSessionSetDomain	(	fbSession_t *	session,
		uint32_t	domain
	)

Set the current observation domain on a session.

The domain is used to scope sequence numbers and external templates. This is called automatically during collection, but must be called to set the domain for export before adding external templates or writing records.

Notice that a domain change does not automatically cause any associated export buffers to emit messages; a domain change takes effect with the next message started. Therefore, call fBufEmit() before setting the domain on the buffer's associated session.

Parameters

session	a session state container
domain	ID of the observation domain to set

void* fbSubTemplateListAddNewElements	(	fbSubTemplateList_t *	subTemplateList,
		uint16_t	numNewElements
	)

Allocates space for a number of additional element in the sub template list must be called after the list has been fbSubTemplateListInit()'d.

Parameters

subTemplateList	pointer to the sub template list
numNewElements	number of new elements to add to the list

Returns

a pointer to the first newly allocated element

fbSubTemplateList_t* fbSubTemplateListAlloc

(

void

)

Allocates a subTemplateList_t Based on how subTemplateLists will be used and set up amidst data structures, this function may never be used.

Returns

pointer to the new sub template list

void fbSubTemplateListClear

(

fbSubTemplateList_t *

subTemplateListPtr

)

Clears a subtemplate list struct, notably freeing the dataPtr and setting it to NULL.

This should be used after each call to fBufNext: If the dataPtr is not NULL in DecodeSubTemplateList, it will not allocate new memory for the new record, which could cause a buffer overflow if the new record has a longer list than the current one. An alternative is to allocate a large buffer and assign it to dataPtr on your own, then never clear it with this. Be certain this buffer is longer than needed for all possible lists

Parameters

subTemplateListPtr

pointer to the sub template list to clear

Returns

NONE

void fbSubTemplateListClearWithoutFree

(

fbSubTemplateList_t *

subTemplateListPtr

)

Clears the sub template list parameters but does not free the data ptr.

This is used in conjuction with STLInitOwnBuffer because that buffer is allocated at the beginning by the user and will be freed at the end by the user, outside of fixbuf api calls

Parameters

subTemplateListPtr

pointer to the sub template list to clear

Returns

NONE

void fbSubTemplateListCollectorInit

(

fbSubTemplateList_t *

STL

)

Initializes a sub template list variable on a collector.

If the fbSubTemplateList variable is in a struct, it will likely not be set to 0's If not, the dataPtr will not be NULL, so the transcoder will not allocate the right memory for it, as it will assuming it's set up. This will break. Call this function right after declaring the struct variable that contains the fbSubTemplateList. It only needs to be called once for each STL

Parameters

STL	pointer to the sub template list to initialize for collection

Returns

NONE

void fbSubTemplateListFree

(

fbSubTemplateList_t *

subTemplateListPtr

)

Frees and clears a subTemplateList struct.

This frees the dataPtr AND frees the memory pointed to by the subTemplateListPtr Used in conjunction with subTemplateListAlloc(), unlikely to be used

Parameters

subTemplateListPtr

pointer to the sub template list to free

Returns

NONE

void* fbSubTemplateListGetDataPtr

(

const fbSubTemplateList_t *

subTemplateListPtr

)

Returns a pointer to the buffer that contains the data for the list.

Parameters

subTemplateListPtr

pointer to the STL to get the pointer from

Returns

a pointer to the data buffer used by the sub template list

void* fbSubTemplateListGetIndexedDataPtr	(	const fbSubTemplateList_t *	subTemplateListPtr,
		uint16_t	index
	)

This function is used to iterate over the elements in the list by passing in a counter to indicate which element is to be returned.

Parameters

subTemplateListPtr	pointer to the STL
index	The index of the element to be retrieved (0-based)

Returns

a pointer to the desired element. NULL if index >= numElements

void* fbSubTemplateListGetNextPtr	(	const fbSubTemplateList_t *	subTemplateListPtr,
		void *	currentPtr
	)

This function also traverses the elements in the list by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element.

A current element of NULL tells the function to return the first element in the list.

Parameters

subTemplateListPtr	pointer to the STL to get data from
currentPtr	pointer to the last element accessed. NULL causes the pointer to the first element to be returned

Returns

the pointer to the next element in the list. Returns NULL if currentPtr points to the last element in the list.

uint8_t fbSubTemplateListGetSemantic

(

fbSubTemplateList_t *

subTemplateListPtr

)

Gets the semantic value from a sub template list.

Parameters

subTemplateListPtr

pointer to the sub template list

Returns

the semantic field from the list

const fbTemplate_t* fbSubTemplateListGetTemplate

(

fbSubTemplateList_t *

subTemplateListPtr

)

Gets the template pointer from the list structure.

Parameters

subTemplateListPtr

pointer to the sub template list

Returns

a pointer to the template used by the sub template list

uint16_t fbSubTemplateListGetTemplateID

(

fbSubTemplateList_t *

subTemplateListPtr

)

Gets the template ID for the template used by the list.

Parameters

subTemplateListPtr

pointer to the sub template list

Returns

the template ID used by the sub template list

void* fbSubTemplateListInit	(	fbSubTemplateList_t *	sTL,
		uint8_t	semantic,
		uint16_t	tmplID,
		const fbTemplate_t *	tmpl,
		uint16_t	numElements
	)

Initializes a subTemplateList structure and alloc's the dataPtr to get a buffer able to hold numElements in the template This will mainly be used in exporters preparing to encode.

Parameters

sTL	pointer to the sub template list to initialize
semantic	the semantic value used to describe the list contents
tmplID	id of the template used for encoding the list data
tmpl	pointer to the template struct used for encoding the list data
numElements	number of elements in the list

Returns

a pointer to the allocated buffer (location of first element)

void* fbSubTemplateListInitWithOwnBuffer	(	fbSubTemplateList_t *	subTemplateList,
		uint8_t	semantic,
		uint16_t	tmplID,
		const fbTemplate_t *	tmpl,
		uint16_t	numElements,
		uint16_t	dataLength,
		uint8_t *	dataPtr
	)

Initializes the subTemplateList but does not allocate a buffer.

It accepts a previously allocated buffer and data length and uses it. This will generally be used in collectors providing their own buffer

Parameters

subTemplateList	pointer to the sub template list to initialize
semantic	the semantic value used to describe the list contents
tmplID	id of the template used for encoding the list data
tmpl	pointer to the template struct used for encoding the list data
numElements	number of elements in the list
dataLength	length of the data buffer
dataPtr	pointer to the previously allocated data buffer

Returns

a pointer to that buffer

void* fbSubTemplateListRealloc	(	fbSubTemplateList_t *	subTemplateList,
		uint16_t	newNumElements
	)

Free the current data pointer, allocating a new buffer to accomodate the new number of elements.

The remaining parameters are unchanged. If the number of elements hasn't changed the original buffer is used and its pointer is returned

Parameters

subTemplateList	pointer to the sub template list to realloc
newNumElements	value for the new number of elements for the list

Returns

pointer to the data buffer after realloc

void fbSubTemplateListSetSemantic	(	fbSubTemplateList_t *	subTemplateListPtr,
		uint8_t	semantic
	)

Sets the semantic parameter of a subTemplateList.

Parameters

subTemplateListPtr	pointer to the sub template list
semantic	Semantic value for the list

Returns

NONE

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListAddNewEntries	(	fbSubTemplateMultiList_t *	STML,
		uint16_t	numNewEntries
	)

Adds entries to the multi list of entries can only be run after the list has been initialized.

Parameters

STML	pointer to the sub template multi list
numNewEntries	number of entries to add to the list

Returns

a pointer to the new entry

fbSubTemplateMultiList_t* fbSubTemplateMultiListAlloc

(

void

)

Allocates a subTemplateMultiList_t Based on how subTemplateMultiLists will be used and set up amidst data structures, this function may never be used.

Returns

pointer to the new sub template multi list

void fbSubTemplateMultiListClear

(

fbSubTemplateMultiList_t *

STML

)

Clears all of the entries (frees their data pointers), then frees the memory containing the entries.

Parameters

STML	pointer to the sub template mutli list to clear

Returns

NONE

void fbSubTemplateMultiListClearEntries

(

fbSubTemplateMultiList_t *

STML

)

Clears the memory used by the entries of a sub template multi list NOTE: if any of those entries contain another layer of structures, that second layer must be freed by the user, this function cannot do that.

example: an entry's template contains an element of type basicList. The memory used by that basicList isn't freed by this function

Parameters

STML	pointer to the sub template multi list

Returns

NONE

void* fbSubTemplateMultiListEntryAddNewElements	(	fbSubTemplateMultiListEntry_t *	entry,
		uint16_t	numNewElements
	)

Allocates space for a number of additional elements in the sub template multi list entry.

May only be called after the STML entry has been initialized with fbSubTemplateMultiListEntryInit().

Parameters

entry	pointer to the STML entry to add additional elements to
numNewElements	number of new elements to add to the STML entry

Returns

a pointer to the first newly allocated element

void fbSubTemplateMultiListEntryClear

(

fbSubTemplateMultiListEntry_t *

entry

)

Frees the memory pointed to by the data buffer holding the data elements.

Parameters

entry

pointer to the entry to clear the contents of.

Returns

NONE

void* fbSubTemplateMultiListEntryGetDataPtr

(

fbSubTemplateMultiListEntry_t *

entry

)

Retrieves the data pointer for this entry.

Parameters

entry

pointer to the entry to get the data pointer from

Returns

pointer to the buffer used to store data for this entry

void* fbSubTemplateMultiListEntryGetIndexedPtr	(	fbSubTemplateMultiListEntry_t *	entry,
		uint16_t	index
	)

Returns a pointer to a data element in the entry based on the index.

If the index is >= to the number of elements in the list, NULL is returned. The elements are 0-based, so index = 0 is returns the first elements.

Parameters

entry	pointer to the entry to get a data pointer from.
index	the number of the element in the list to return

Returns

the pointer to the index'th element used by the entry NULL if the index is >= numElements

const fbTemplate_t* fbSubTemplateMultiListEntryGetTemplate

(

fbSubTemplateMultiListEntry_t *

entry

)

Retrieve the template pointer used to structure the data elements.

Parameters

entry

pointer to the entry to get the template from

Returns

the template pointer used to describe the contents of the entry

uint16_t fbSubTemplateMultiListEntryGetTemplateID

(

fbSubTemplateMultiListEntry_t *

entry

)

Retrieve the template ID for the template used to structure the data.

Parameters

entry

pointer to the entry to get the template ID from

Returns

the template ID for template that describes the data

void* fbSubTemplateMultiListEntryInit	(	fbSubTemplateMultiListEntry_t *	entry,
		uint16_t	tmplID,
		fbTemplate_t *	tmpl,
		uint16_t	numElements
	)

Initializes the multi list entry with the template values, and allocates the memory used by the entry to hold the data.

Parameters

entry	pointer to the entry to initialize
tmplID	ID of the template used to structure the data elements
tmpl	pointer to the template used to structure the data elements
numElements	number of data elements in the entry

Returns

pointer to the data buffer to be filled in

void* fbSubTemplateMultiListEntryNextDataPtr	(	fbSubTemplateMultiListEntry_t *	entry,
		void *	currentPtr
	)

This function traverses the elements in the entry by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element.

A current element of NULL tells the function to return the first element in the list.

Parameters

entry	pointer to the entry to get the next element from
currentPtr	pointer to the last element accessed. NULL means return a pointer to the first element.

Returns

the pointer to the next element in the list. Returns NULL if currentPtr points to the last element in the list

void* fbSubTemplateMultiListEntryRealloc	(	fbSubTemplateMultiListEntry_t *	entry,
		uint16_t	newNumElements
	)

Frees the memory for the data used by the entry, then allocates a new buffer based on the size of the template and newNumElements.

(if numElements doesn't change, the pointer is returned without freeing and allocating)

Parameters

entry	pointer to the entry to realloc
newNumElements	the new number of elements for the entry

Returns

pointer to buffer to write data to

void fbSubTemplateMultiListFree

(

fbSubTemplateMultiList_t *

STML

)

Clears the multi list, then frees the memory pointed to by STML.

Parameters

STML	pointer to the sub template multi list

Returns

NONE

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListGetFirstEntry

(

fbSubTemplateMultiList_t *

STML

)

Retrieve the first entry in the multi list.

Parameters

STML	pointer to the sub template multi list

Returns

pointer to the first entry used by the list

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListGetIndexedEntry	(	fbSubTemplateMultiList_t *	STML,
		uint16_t	index
	)

Retrieve a pointer to the entry of a specific index.

The entry indexes are zero based. NULL is returned if the index requested is too high

Parameters

STML	pointer to the sub template mutli list
index	index of the entry to be returned

Returns

the index'th entry used by the list. NULL If index >= numElements

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListGetNextEntry	(	fbSubTemplateMultiList_t *	STML,
		fbSubTemplateMultiListEntry_t *	currentEntry
	)

This function also traverses the elements in the list by accepting a pointer to the last element the user accessed, moves it to the next element and returns a pointer to the next element.

A current element of NULL tells the function to return the first element in the list.

Parameters

STML	pointer to the sub template multi list to get data from
currentEntry	pointer to the last element accessed. NULL means none have been accessed yet

Returns

the pointer to the next element in the list. Returns the NULL if currentEntry points to the last entry.

uint8_t fbSubTemplateMultiListGetSemantic

(

fbSubTemplateMultiList_t *

STML

)

Get the semantic paramter from the multi list.

Parameters

STML	pointer to the sub template multi list

Returns

semantic parameter describing the contents of the multi list

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListInit	(	fbSubTemplateMultiList_t *	STML,
		uint8_t	semantic,
		uint16_t	numElements
	)

Initializes the multi list with semantic, numbers of elements, and allocates memory to store numElements worth of entries.

Parameters

STML	pointer to the sub template multi list to initialize
semantic	value used to describe the entries in the multi list
numElements	number of entries in the multi list

Returns

pointer to the first uninitialized entry

fbSubTemplateMultiListEntry_t* fbSubTemplateMultiListRealloc	(	fbSubTemplateMultiList_t *	STML,
		uint16_t	newNumEntries
	)

Clears the entries used by the multi list, then if newNumElements is different than numElements, frees the entries buffer and allocates a new one.

Parameters

STML	pointer to the sub template mutli list
newNumEntries	the new number of entries for the STML

Returns

pointer to the first entry

void fbSubTemplateMultiListSetSemantic	(	fbSubTemplateMultiList_t *	STML,
		uint8_t	semantic
	)

Sets the semantic field for the multi list.

Parameters

STML	pointer to the sub template multi list
semantic	Value for the semantic field of the sub template multi list

Returns

NONE

fbTemplate_t* fbTemplateAlloc

(

fbInfoModel_t *

model

)

Allocate a new empty template.

The template will be associated with the given Information Model, and only able to use Information Elements defined within that Information Model. Templates may be associated with multiple sessions, with different template IDs each time, and as such are reference counted and owned by sessions. A template must be associated with at least one session or it will be leaked; each template is freed after its last associated session is freed.

Use fbTemplateAppend(), fbTemplateAppendSpec(), and fbTemplateAppendSpecArray() to "fill in" a template after creating it, and before associating it with any session.

Parameters

model

An information model

Returns

a new, empty Template.

gboolean fbTemplateAppend	(	fbTemplate_t *	tmpl,
		fbInfoElement_t *	ex_ie,
		GError **	err
	)

Append an information element to a template.

The information element is taken to be an example; the canonical element from the template's associated model is looked up by enterprise and element number and copied. If no information element exists in the model with the given enterprise and element number, it is copied to the model with the name "_alienInformationElement".

This call is intended primarily for use by fBuf_t's template reader, but can also be useful to simulate receipt of templates over the wire.

Parameters

tmpl	Template to append information element to
ex_ie	Example IE to add to the template
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

gboolean fbTemplateAppendSpec	(	fbTemplate_t *	tmpl,
		fbInfoElementSpec_t *	spec,
		uint32_t	flags,
		GError **	err
	)

Append an information element described by specifier to a template.

The information element named by the specifier is copied from the template's associated model, and the length and flags are overriden from the specifier.

Parameters

tmpl	Template to append information element to.
spec	Specifier describing information element to append.
flags	Application flags. Must match one bit of spec flags word or the append will be silently skipped. Used for building multiple templates with different information element features from a single specifier.
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

gboolean fbTemplateAppendSpecArray	(	fbTemplate_t *	tmpl,
		fbInfoElementSpec_t *	spec,
		uint32_t	flags,
		GError **	err
	)

Append information elements described by a specifier array to a template.

The information elements named by the specifiers are copied from the template's associated model, and the length and flags are overriden from each specifier. The array is read until the FB_IESPEC_NULL convenience macro is encountered.

Parameters

tmpl	Template to append information element to.
spec	Pointer to first specifier in specifier array to append.
flags	Application flags. Must contain all bits of spec flags word or the append will be silently skipped. Used for building multiple templates with different information element features from a single specifier.
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

gboolean fbTemplateContainsAllElementsByName	(	fbTemplate_t *	tmpl,
		fbInfoElementSpec_t *	spec
	)

Determine if a template contains at least one instance of each information element in a given information element specifier array.

Parameters

tmpl	Template to search
spec	Pointer to specifier array to search for

Returns

TRUE if the template contains all the given IEs

gboolean fbTemplateContainsAllFlaggedElementsByName	(	fbTemplate_t *	tmpl,
		fbInfoElementSpec_t *	spec,
		uint32_t	flags
	)

Determine if a template contains at least one instance of each information element in a given information element specifier array that match the given flags argument.

Parameters

tmpl	Template to search
spec	Pointer to specifier array to search for
flags	Flags to match info elements

Returns

TRUE if the template contains all the given IEs

gboolean fbTemplateContainsElement	(	fbTemplate_t *	tmpl,
		const fbInfoElement_t *	ex_ie
	)

Determine if a template contains a given information element.

Matches against information element private enterprise number, number, and multiple-IE index (i.e., to determine if a given template contains six instances of a given information element, set ex_ie->midx = 5 before this call).

Parameters

tmpl	Template to search
ex_ie	Pointer to an information element to search for

Returns

TRUE if the template contains the given IE

gboolean fbTemplateContainsElementByName	(	fbTemplate_t *	tmpl,
		fbInfoElementSpec_t *	spec
	)

Determine if a template contains at least one instance of a given information element, specified by name in the template's information model.

Parameters

tmpl	Template to search
spec	Specifier of information element to search for

Returns

TRUE if the template contains the given IE

uint32_t fbTemplateCountElements

(

fbTemplate_t *

tmpl

)

Determine number of information elements in a template.

Parameters

tmpl	A template

Returns

information element count

void fbTemplateFreeUnused

(

fbTemplate_t *

tmpl

)

Free a template if it is not currently in use by any Session.

Use this to clean up while creating templates in case of error.

Parameters

tmpl	template to free

void* fbTemplateGetContext

(

fbTemplate_t *

tmpl

)

Get the ctx pointer associated with a Template.

The ctx pointer is typically set during the template callback when the new template is received.

Parameters

tmpl	Template Pointer

Returns

ctx The application Context Pointer

fbInfoElement_t* fbTemplateGetIndexedIE	(	fbTemplate_t *	tmpl,
		uint32_t	IEindex
	)

Return the information element in the template referenced by the index.

Parameters

tmpl	Pointer to the template
IEindex	index of the information element to return

Returns

A pointer to the information element at index IEindex, NULL if IEindex is greater than number of elements

uint32_t fbTemplateGetOptionsScope

(

fbTemplate_t *

tmpl

)

Determine number of scope information elements in a template.

The template is an options template if nonzero.

Parameters

tmpl	A template

Returns

scope information element count

void fbTemplateSetOptionsScope	(	fbTemplate_t *	tmpl,
		uint16_t	scope_count
	)

Set the number of information elements in a template that are scope.

This causes the template to become an options template, and must be called after all the scope information elements have been appended to the template.

Parameters

tmpl	Template to set scope on
scope_count	Number of scope information elements

fBuf_t* fBufAllocForCollection	(	fbSession_t *	session,
		fbCollector_t *	collector
	)

Allocate a new buffer for collection.

Associates the buffer with a given session and collecting process endpoint; these become owned by the buffer. Session and collector are freed by fBufFree. Must not be freed by user

Parameters

session	a session initialized with appropriate internal templates
collector	an collecting process endpoint

Returns

a new IPFIX message buffer, owning the session and collector, for collection use via fBufNext() and fBufNextMessage().

fBuf_t* fBufAllocForExport	(	fbSession_t *	session,
		fbExporter_t *	exporter
	)

Allocate a new buffer for export.

Associates the buffer with a given session and exporting process endpoint; these become owned by the buffer. Session and exporter are freed by fBufFree. Must never be freed by user

Parameters

session	a session initialized with appropriate internal and external templates
exporter	an exporting process endpoint

Returns

a new IPFIX message buffer, owning the session and exporter, for export use via fBufAppend() and fBufEmit().

gboolean fBufAppend	(	fBuf_t *	fbuf,
		uint8_t *	recbase,
		size_t	recsize,
		GError **	err
	)

Append a record to a buffer.

Uses the present internal template set via fBufSetInternalTemplate() to describe the record of size recsize located in memory at recbase. Uses the present export template set via fBufSetExportTemplate() to describe the record structure to be written to the buffer. Information Elements present in the external template that are not present in the internal template are transcoded into the message as zeroes. If the buffer is in automatic mode, may cause a message to be emitted via fBufEmit() if there is insufficient space in the buffer for the record.

If the internal template contains any variable length Information Elements, those must be represented in the record by fbVarfield_t structures.

Parameters

fbuf	an IPFIX message buffer
recbase	pointer to internal record
recsize	size of internal record in bytes
err	an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.

Returns

TRUE on success, FALSE on failure.

gboolean fBufEmit	(	fBuf_t *	fbuf,
		GError **	err
	)

Emit the message currently in a buffer using the associated exporting process endpoint.

Parameters

fbuf	an IPFIX message buffer
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

void fBufFree

(

fBuf_t *

fbuf

)

Free a buffer.

Also frees any associated session, exporter, or collector, closing exporting process or collecting process endpoint connections and removing collecting process endpoints from any listeners, as necessary.

Parameters

fbuf	an IPFIX message buffer

fbTemplate_t* fBufGetCollectionTemplate	(	fBuf_t *	fbuf,
		uint16_t *	ext_tid
	)

Retrieve the external template used to read the last record from the buffer.

If no record has been read, returns NULL. Stores the external template ID within the current domain in ext_tid, if not NULL.

This routine is not particularly useful to applications, as it would be called after the record described by the external template had been transcoded, and as such could not be used to select an appropriate internal template for a given external template. However, it is used by fBufNextCollectionTemplate(), and may be useful in certain contexts, so is made public.

Usually, you'll want to use fBufNextCollectionTemplate() instead.

Parameters

fbuf	an IPFIX message buffer
ext_tid	pointer to external template ID storage, or NULL.

Returns

the external template describing the last record read.

fbCollector_t* fBufGetCollector

(

fBuf_t *

fbuf

)

Retrieve the collecting process endpoint associated with a buffer.

The buffer must have been allocated with fBufAllocForCollection(); otherwise, returns NULL.

Parameters

fbuf	an IPFIX message buffer

Returns

the associated collecting process endpoint

fbExporter_t* fBufGetExporter

(

fBuf_t *

fbuf

)

Retrieve the exporting process endpoint associated with a buffer.

The buffer must have been allocated with fBufAllocForExport(); otherwise, returns NULL.

Parameters

fbuf	an IPFIX message buffer

Returns

the associated exporting process endpoint

uint32_t fBufGetExportTime

(

fBuf_t *

fbuf

)

Retrieve the export time on the message currently in a buffer.

Parameters

fbuf	an IPFIX message buffer

Returns

the export time in epoch seconds.

fbSession_t* fBufGetSession

(

fBuf_t *

fbuf

)

Retrieve the session associated with a buffer.

Parameters

fbuf	an IPFIX message buffer

Returns

the associated session

void fBufInterruptSocket

(

fBuf_t *

fbuf

)

Interrupts the select call of a specific collector by way of its fBuf.

This is mainly used by fbListenerInterrupt to interrupt all of the collector sockets well.

void fBufListFree	(	fbTemplate_t *	tmpl,
		uint8_t *	record
	)

Clear all of the memory that fixbuf allocated during transcode of this record.

This will free all of the memory allocated for list structures when fixbuf was encoding or decoding the record. The template provided is the internal template that was set on the fBuf before fBufNext() or fBufAppend() was called with the data. The template MUST match the record or bad things WILL happen without indication. This does not free the record itself. It will only free any list information elements and nested list information elements.

Parameters

template	pointer to the internal template that MUST match the record
record	pointer to the data

Returns

NONE

gboolean fBufNext	(	fBuf_t *	fbuf,
		uint8_t *	recbase,
		size_t *	recsize,
		GError **	err
	)

Retrieve a record from a buffer.

Uses the external template taken from the message to read the next record available from a data set in the message. Copies the record to a buffer at recbase, with a maximum record size pointed to by recsize, described by the present internal template set via fBufSetInternalTemplate(). Reads and processes any templates and options templates between the last record read (or beginning of message) and the next data record. Information Elements present in the internal template that are not present in the external template are transcoded into the record at recbase as zeroes. If the buffer is in automatic mode, may cause a message to be read via fBufNextMessage() if there are no more records available in the message buffer.

If the internal template contains any variable length Information Elements, those must be represented in the record at recbase by fbVarfield_t structures.

Parameters

fbuf	an IPFIX message buffer
recbase	pointer to internal record buffer; will contain record data after call.
recsize	On call, pointer to size of internal record buffer in bytes. Contains number of bytes actually transcoded at end of call.
err	an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.

Returns

TRUE on success, FALSE on failure.

fbTemplate_t* fBufNextCollectionTemplate	(	fBuf_t *	fbuf,
		uint16_t *	ext_tid,
		GError **	err
	)

Retrieve the external template that will be used to read the next record from the buffer.

If no next record is available, returns NULL. Stores the external template ID within the current domain in ext_tid, if not NULL. Reads and processes any templates and options templates between the last record read (or beginning of message) and the next data record. If the buffer is in automatic mode, may cause a message to be read via fBufNextMessage() if there are no more records available in the message buffer.

Parameters

fbuf	an IPFIX message buffer
ext_tid	pointer to external template ID storage, or NULL.
err	an error description, set on failure. Must not be NULL, as it is used internally in automatic mode to detect message restart.

Returns

the external template describing the last record read.

gboolean fBufNextMessage	(	fBuf_t *	fbuf,
		GError **	err
	)

Read a new message into a buffer using the associated collecting process endpoint.

Called by fBufNext() on end of message in automatic mode; should be called after an FB_ERROR_EOM return from fBufNext in manual mode, or to skip the current message and go on to the next in the stream.

Parameters

fbuf	an IPFIX message buffer
err	an error description, set on failure.

Returns

TRUE on success, FALSE on failure.

size_t fBufRemaining

(

fBuf_t *

fbuf

)

Retrieve the length of the buffer that is remaining after processing.

An IPFIX collector that is not using fixbuf to handle connections would use this function upon receiving an FB_ERROR_BUFSZ error to determine how many bytes are left in the buffer (set by fBufSetBuffer) that are not processed.

Parameters

fbuf	an IPFIX message buffer

Returns

length of buffer not read

gboolean fBufSetAutomaticInsert	(	fBuf_t *	fbuf,
		GError **	err
	)

Set the automatic insert flag on a buffer.

In automatic insert mode, any information element type records that are collected, will automatically be inserted into the information model that is set on the fbuf's session. This allows an application to retrieve information about a non-standard information. This should be called after the fbuf is created. This function creates the internal template for the Info Element Type Record and adds it to the session.

Parameters

fbuf	an IPFIX message buffer
err	Gerror pointer

Returns

TRUE or FALSE if the internal template could not be created

void fBufSetAutomaticMode	(	fBuf_t *	fbuf,
		gboolean	automatic
	)

Set the automatic mode flag on a buffer.

In automatic mode, a call to fBufAppend() or fbSessionExportTemplates() that overruns the available space in the buffer will cause a call to fBufEmit() to emit the message in the buffer to the exporter before starting a new message; and a call to fBufNext() that overruns the buffer will cause a call to fBufNextMessage() to read another message from the collector before attempting to read a record. In manual mode, end of message on any buffer read/write call results in FB_ERROR_EOM. Buffers are created in automatic mode by default.

Parameters

fbuf	an IPFIX message buffer
automatic	TRUE for this buffer to be automatic, FALSE for manual.

void fBufSetBuffer	(	fBuf_t *	fbuf,
		uint8_t *	buf,
		size_t	buflen
	)

Set a buffer on an fBuf for collection.

This can be used by applications that want to handle their own connections, file reading, etc. This call should be made after the call to read and before calling fBufNext. fBufNext will return FB_ERROR_BUFSZ when there is not enough buffer space to read a full IPFIX message.

Parameters

fbuf	an IPFIX message buffer
buf	the data buffer to use for processing IPFIX
buflen	the length of IPFIX data in buf

void fBufSetCollector	(	fBuf_t *	fbuf,
		fbCollector_t *	collector
	)

Associate an collecting process endpoint with a buffer.

The collector will be used to read IPFIX messgaes from a transport. The collector becomes owned by the buffer; any previous collector associated with the buffer is closed if necessary and freed.

Parameters

fbuf	an IPFIX message buffer
collector	an collecting process endpoint

void fBufSetExporter	(	fBuf_t *	fbuf,
		fbExporter_t *	exporter
	)

Associate an exporting process endpoint with a buffer.

The exporter will be used to write IPFIX messgaes to a transport. The exporter becomes owned by the buffer; any previous exporter associated with the buffer is closed if necessary and freed.

Parameters

fbuf	an IPFIX message buffer
exporter	an exporting process endpoint

gboolean fBufSetExportTemplate	(	fBuf_t *	fbuf,
		uint16_t	ext_tid,
		GError **	err
	)

Set the external template for export on a buffer to the given template ID.

The external template describes the record that will be written to the IPFIX message. The buffer must be initialized for export. The given ID is scoped to the observation domain of the associated session (see fbSessionSetDomain()), and must identify a current external template for the current domain in the buffer's associated session.

An export template must be set on a buffer before calling fBufAppend().

Parameters

fbuf	an IPFIX message buffer
ext_tid	template ID of the new external template within the current domain.
err	An error description, set on failure.

Returns

TRUE on success, FALSE on failure.

void fBufSetExportTime	(	fBuf_t *	fbuf,
		uint32_t	extime
	)

Set the export time on the message currently in a buffer.

This will be used as the export time of the message created by the first call to fBufAppend() after the current message, if any, is emitted. Use 0 for the export time to cause the export time to be taken from the system clock at message creation time.

Parameters

fbuf	an IPFIX message buffer
extime	the export time in epoch seconds.

gboolean fBufSetInternalTemplate	(	fBuf_t *	fbuf,
		uint16_t	int_tid,
		GError **	err
	)

Set the internal template on a buffer to the given template ID.

The internal template describes the format of the record pointed to by the recbase parameter to fBufAppend() (for export) and fBufNext() (for collection). The given template ID must identify a current internal template in the buffer's associated session.

An internal template must be set on a buffer before calling fBufAppend() or fBufNext().

Parameters

fbuf	an IPFIX message buffer
int_tid	template ID of the new internal template
err	An error description, set on failure.

Returns

TRUE on success, FALSE on failure.