#pragma once #include #include #include #include "maat.h" #ifdef __cplusplus extern "C" { #endif enum ATTRIBUTE_SCHEMA { ATTRIBUTE_SCHEMA_UNKNOWN=0, // tunnel ATTRIBUTE_SCHEMA_TUNNEL_LEVEL, ATTRIBUTE_SCHEMA_TUNNEL_OBJECT, ATTRIBUTE_SCHEMA_TUNNEL_GTP_ENDPOINT, ATTRIBUTE_SCHEMA_TUNNEL_GRE_ENDPOINT, ATTRIBUTE_SCHEMA_TUNNEL_IP_IN_IP_ENDPOINT, ATTRIBUTE_SCHEMA_TUNNEL_UUID_LIST, ATTRIBUTE_SCHEMA_INTERNAL_IP, ATTRIBUTE_SCHEMA_EXTERNAL_IP, ATTRIBUTE_SCHEMA_INTERNAL_PORT, ATTRIBUTE_SCHEMA_EXTERNAL_PORT, ATTRIBUTE_SCHEMA_INTERNAL_ASN_ID, ATTRIBUTE_SCHEMA_EXTERNAL_ASN_ID, // tcp ATTRIBUTE_SCHEMA_TCP_PAYLOAD, ATTRIBUTE_SCHEMA_TCP_PAYLOAD_COMMIT, ATTRIBUTE_SCHEMA_TCP_PAYLOAD_C2S_FIRST_DATA, ATTRIBUTE_SCHEMA_TCP_PAYLOAD_C2S_FIRST_DATA_LEN, ATTRIBUTE_SCHEMA_TCP_PAYLOAD_S2C_FIRST_DATA, ATTRIBUTE_SCHEMA_TCP_PAYLOAD_S2C_FIRST_DATA_LEN, // udp ATTRIBUTE_SCHEMA_UDP_PAYLOAD, ATTRIBUTE_SCHEMA_UDP_PAYLOAD_COMMIT, ATTRIBUTE_SCHEMA_UDP_PAYLOAD_C2S_FIRST_DATA, ATTRIBUTE_SCHEMA_UDP_PAYLOAD_C2S_FIRST_DATA_LEN, ATTRIBUTE_SCHEMA_UDP_PAYLOAD_S2C_FIRST_DATA, ATTRIBUTE_SCHEMA_UDP_PAYLOAD_S2C_FIRST_DATA_LEN, // http ATTRIBUTE_SCHEMA_HTTP_HOST, ATTRIBUTE_SCHEMA_HTTP_URL, ATTRIBUTE_SCHEMA_HTTP_URL_DECODED, ATTRIBUTE_SCHEMA_HTTP_REQUEST_LINE, ATTRIBUTE_SCHEMA_HTTP_REQUEST_USER_AGENT, ATTRIBUTE_SCHEMA_HTTP_REQUEST_REFERER, ATTRIBUTE_SCHEMA_HTTP_REQUEST_COOKIE, ATTRIBUTE_SCHEMA_HTTP_REQUEST_CONTENT_TYPE, ATTRIBUTE_SCHEMA_HTTP_REQUEST_CONTENT_LENGTH, ATTRIBUTE_SCHEMA_HTTP_REQUEST_BODY, ATTRIBUTE_SCHEMA_HTTP_REQUEST_BODY_COMMIT, ATTRIBUTE_SCHEMA_HTTP_REQUEST_HEADER, ATTRIBUTE_SCHEMA_HTTP_REQUEST_HEADER_COMMIT, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_LINE, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_STATUS_CODE, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_USER_AGENT, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_REFERER, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_COOKIE, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_CONTENT_TYPE, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_CONTENT_LENGTH, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_BODY, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_BODY_COMMIT, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_HEADER, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_HEADER_COMMIT, ATTRIBUTE_SCHEMA_HTTP_VERSION, ATTRIBUTE_SCHEMA_HTTP_SEQUENCE, ATTRIBUTE_SCHEMA_HTTP_SNAPSHOT, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_SET_COOKIE, ATTRIBUTE_SCHEMA_HTTP_RESPONSE_LATENCY_MS, ATTRIBUTE_SCHEMA_HTTP_SESSION_DURATION_MS, ATTRIBUTE_SCHEMA_HTTP_ACTION_FILE_SIZE, // mail ATTRIBUTE_SCHEMA_MAIL_PROTOCOL_TYPE, ATTRIBUTE_SCHEMA_MAIL_ACCOUNT, ATTRIBUTE_SCHEMA_MAIL_PASSWORD, ATTRIBUTE_SCHEMA_MAIL_FROM_CMD, ATTRIBUTE_SCHEMA_MAIL_TO_CMD, ATTRIBUTE_SCHEMA_MAIL_TO_CMD_LOG, ATTRIBUTE_SCHEMA_MAIL_FROM, ATTRIBUTE_SCHEMA_MAIL_TO, ATTRIBUTE_SCHEMA_MAIL_TO_LOG, ATTRIBUTE_SCHEMA_MAIL_CC, ATTRIBUTE_SCHEMA_MAIL_CC_LOG, ATTRIBUTE_SCHEMA_MAIL_BCC, ATTRIBUTE_SCHEMA_MAIL_BCC_LOG, ATTRIBUTE_SCHEMA_MAIL_SUBJECT, ATTRIBUTE_SCHEMA_MAIL_SUBJECT_LOG, ATTRIBUTE_SCHEMA_MAIL_SUBJECT_CHARSET, ATTRIBUTE_SCHEMA_MAIL_CONTENT, ATTRIBUTE_SCHEMA_MAIL_CONTENT_COMMIT, ATTRIBUTE_SCHEMA_MAIL_CONTENT_CHARSET, ATTRIBUTE_SCHEMA_MAIL_ATTACHMENT_NAME, ATTRIBUTE_SCHEMA_MAIL_ATTACHMENT_NAME_LOG, ATTRIBUTE_SCHEMA_MAIL_ATTACHMENT_NAME_CHARSET, ATTRIBUTE_SCHEMA_MAIL_ATTACHMENT_CONTENT, ATTRIBUTE_SCHEMA_MAIL_ATTACHMENT_CONTENT_COMMIT, ATTRIBUTE_SCHEMA_MAIL_EML_FILE, ATTRIBUTE_SCHEMA_MAIL_STARTTLS_CMD, // dns ATTRIBUTE_SCHEMA_DNS_MESSAGE_ID, ATTRIBUTE_SCHEMA_DNS_QR, ATTRIBUTE_SCHEMA_DNS_OPCODE, ATTRIBUTE_SCHEMA_DNS_AA, ATTRIBUTE_SCHEMA_DNS_TC, ATTRIBUTE_SCHEMA_DNS_RD, ATTRIBUTE_SCHEMA_DNS_RA, ATTRIBUTE_SCHEMA_DNS_RCODE, ATTRIBUTE_SCHEMA_DNS_QDCOUNT, ATTRIBUTE_SCHEMA_DNS_ANCOUNT, ATTRIBUTE_SCHEMA_DNS_NSCOUNT, ATTRIBUTE_SCHEMA_DNS_ARCOUNT, ATTRIBUTE_SCHEMA_DNS_QNAME, ATTRIBUTE_SCHEMA_DNS_QTYPE, ATTRIBUTE_SCHEMA_DNS_QCLASS, ATTRIBUTE_SCHEMA_DNS_RR, ATTRIBUTE_SCHEMA_DNS_CNAME, ATTRIBUTE_SCHEMA_DNS_SUB, ATTRIBUTE_SCHEMA_DNS_RESPONSE_LATENCY_MS, // ssl ATTRIBUTE_SCHEMA_SSL_VERSION, ATTRIBUTE_SCHEMA_SSL_SNI, ATTRIBUTE_SCHEMA_SSL_SAN_LOG, ATTRIBUTE_SCHEMA_SSL_SAN, ATTRIBUTE_SCHEMA_SSL_SAN_COMMIT, ATTRIBUTE_SCHEMA_SSL_CN, ATTRIBUTE_SCHEMA_SSL_HANDSHAKE_LATENCY_MS, ATTRIBUTE_SCHEMA_SSL_JA3_HASH, ATTRIBUTE_SCHEMA_SSL_JA3S_HASH, ATTRIBUTE_SCHEMA_SSL_JA4_HASH, ATTRIBUTE_SCHEMA_SSL_JA4S_HASH, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ISSUER, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_SUBJECT, ATTRIBUTE_SCHEMA_SSL_ESNI, ATTRIBUTE_SCHEMA_SSL_ESNI_FLAG, ATTRIBUTE_SCHEMA_SSL_ECH, ATTRIBUTE_SCHEMA_SSL_ECH_FLAG, ATTRIBUTE_SCHEMA_SSL_NO_SNI, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ALGORITHM_IDENTIFIER, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_SERIAL_NUMBER, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ISSUER_COMMON_NAME, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ISSUER_ORGANIZATION_NAME, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ISSUER_COUNTRY_NAME, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_SUBJECT_COUNTRY_NAME, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_SUBJECT_ORGANIZATION_NAME, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_NOT_VALID_BEFORE, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_NOT_VALID_AFTER, ATTRIBUTE_SCHEMA_SSL_CERTIFICATE_ALGORITHM_ID, // dtls ATTRIBUTE_SCHEMA_DTLS_COOKIE, ATTRIBUTE_SCHEMA_DTLS_VERSION, ATTRIBUTE_SCHEMA_DTLS_SNI, ATTRIBUTE_SCHEMA_DTLS_CN, ATTRIBUTE_SCHEMA_DTLS_SAN, ATTRIBUTE_SCHEMA_DTLS_HANDSHAKE_LATENCY_MS, ATTRIBUTE_SCHEMA_DTLS_JA3_HASH, ATTRIBUTE_SCHEMA_DTLS_JA3S_HASH, ATTRIBUTE_SCHEMA_DTLS_CERTIFICATE_ISSUER, ATTRIBUTE_SCHEMA_DTLS_CERTIFICATE_SUBJECT, // quic ATTRIBUTE_SCHEMA_QUIC_SNI, ATTRIBUTE_SCHEMA_QUIC_VERSION, ATTRIBUTE_SCHEMA_QUIC_USER_AGENT, // ftp ATTRIBUTE_SCHEMA_FTP_ACCOUNT, ATTRIBUTE_SCHEMA_FTP_PASSWORD, ATTRIBUTE_SCHEMA_FTP_URL, ATTRIBUTE_SCHEMA_FTP_CONTENT, ATTRIBUTE_SCHEMA_FTP_CONTENT_COMMIT, ATTRIBUTE_SCHEMA_FTP_LINK_TYPE, //sip ATTRIBUTE_SCHEMA_SIP_CALL_ID, ATTRIBUTE_SCHEMA_SIP_ORIGINATOR_DESCRIPTION, ATTRIBUTE_SCHEMA_SIP_RESPONDER_DESCRIPTION, ATTRIBUTE_SCHEMA_SIP_USER_AGENT, ATTRIBUTE_SCHEMA_SIP_SERVER, ATTRIBUTE_SCHEMA_SIP_ORIGINATOR_SDP_CONNECT_IP, ATTRIBUTE_SCHEMA_SIP_RESPONDER_SDP_CONNECT_IP, ATTRIBUTE_SCHEMA_SIP_ORIGINATOR_SDP_MEDIA_PORT, ATTRIBUTE_SCHEMA_SIP_RESPONDER_SDP_MEDIA_PORT, ATTRIBUTE_SCHEMA_SIP_ORIGINATOR_SDP_MEDIA_TYPE, ATTRIBUTE_SCHEMA_SIP_RESPONDER_SDP_MEDIA_TYPE, ATTRIBUTE_SCHEMA_SIP_ORIGINATOR_SDP_CONTENT, ATTRIBUTE_SCHEMA_SIP_RESPONDER_SDP_CONTENT, ATTRIBUTE_SCHEMA_SIP_DURATION_S, ATTRIBUTE_SCHEMA_SIP_BYE, ATTRIBUTE_SCHEMA_SIP_BYE_REASON, ATTRIBUTE_SCHEMA_SIP_VIA, ATTRIBUTE_SCHEMA_SIP_CSEQ, // rtp ATTRIBUTE_SCHEMA_RTP_PAYLOAD_TYPE_C2S, ATTRIBUTE_SCHEMA_RTP_PAYLOAD_TYPE_S2C, ATTRIBUTE_SCHEMA_RTP_PCAP_PATH, ATTRIBUTE_SCHEMA_RTP_ORIGINATOR_DIR, // ssh ATTRIBUTE_SCHEMA_SSH_VERSION, ATTRIBUTE_SCHEMA_SSH_AUTH_SUCCESS, ATTRIBUTE_SCHEMA_SSH_CLIENT_VERSION, ATTRIBUTE_SCHEMA_SSH_SERVER_VERSION, ATTRIBUTE_SCHEMA_SSH_CIPHER_ALG, ATTRIBUTE_SCHEMA_SSH_MAC_ALG, ATTRIBUTE_SCHEMA_SSH_COMPRESSION_ALG, ATTRIBUTE_SCHEMA_SSH_KEX_ALG, ATTRIBUTE_SCHEMA_SSH_HOST_KEY_ALG, ATTRIBUTE_SCHEMA_SSH_HOST_KEY, ATTRIBUTE_SCHEMA_SSH_HASSH, // stratum ATTRIBUTE_SCHEMA_STRATUM_CRYPTOCURRENCY, ATTRIBUTE_SCHEMA_STRATUM_MINING_POOLS, ATTRIBUTE_SCHEMA_STRATUM_MINING_PROGRAM, ATTRIBUTE_SCHEMA_STRATUM_MINING_SUBSCRIBE, // rdp ATTRIBUTE_SCHEMA_RDP_COOKIE, ATTRIBUTE_SCHEMA_RDP_SECURITY_PROTOCOL, ATTRIBUTE_SCHEMA_RDP_CLIENT_CHANNELS, ATTRIBUTE_SCHEMA_RDP_KEYBOARD_LAYOUT, ATTRIBUTE_SCHEMA_RDP_CLIENT_VERSION, ATTRIBUTE_SCHEMA_RDP_CLIENT_NAME, ATTRIBUTE_SCHEMA_RDP_CLIENT_PRODUCT_ID, ATTRIBUTE_SCHEMA_RDP_DESKTOP_WIDTH, ATTRIBUTE_SCHEMA_RDP_DESKTOP_HEIGHT, ATTRIBUTE_SCHEMA_RDP_REQUESTED_COLOR_DEPTH, ATTRIBUTE_SCHEMA_RDP_CERTIFICATE_TYPE, ATTRIBUTE_SCHEMA_RDP_CERTIFICATE_COUNT, ATTRIBUTE_SCHEMA_RDP_CERTIFICATE_PERMANENT, ATTRIBUTE_SCHEMA_RDP_ENCRYPTION_LEVEL, ATTRIBUTE_SCHEMA_RDP_ENCRYPTION_METHOD, // general ATTRIBUTE_SCHEMA_GENERAL_SESSION_DIRECTION, ATTRIBUTE_SCHEMA_GENERAL_DECODED_AS, ATTRIBUTE_SCHEMA_GENERAL_SESSION_ID, ATTRIBUTE_SCHEMA_GENERAL_START_TIMESTAMP_MS, ATTRIBUTE_SCHEMA_GENERAL_END_TIMESTAMP_MS, ATTRIBUTE_SCHEMA_GENERAL_DURATION_MS, ATTRIBUTE_SCHEMA_GENERAL_TCP_HANDSHAKE_LATENCY_MS, ATTRIBUTE_SCHEMA_GENERAL_DEVICE_ID, ATTRIBUTE_SCHEMA_GENERAL_OUT_LINK_ID, ATTRIBUTE_SCHEMA_GENERAL_IN_LINK_ID, ATTRIBUTE_SCHEMA_GENERAL_DEVICE_TAG, ATTRIBUTE_SCHEMA_GENERAL_DATA_CENTER, ATTRIBUTE_SCHEMA_GENERAL_DEVICE_GROUP, ATTRIBUTE_SCHEMA_GENERAL_SLED_IP, ATTRIBUTE_SCHEMA_GENERAL_VSYS_ID, ATTRIBUTE_SCHEMA_GENERAL_T_VSYS_ID, ATTRIBUTE_SCHEMA_GENERAL_FLAGS, ATTRIBUTE_SCHEMA_GENERAL_FLAGS_IDENTIFY_INFO, ATTRIBUTE_SCHEMA_TREATMENT_SECURITY_RULE_LIST, ATTRIBUTE_SCHEMA_TREATMENT_SECURITY_ACTION, ATTRIBUTE_SCHEMA_TREATMENT_MONITOR_RULE_LIST, ATTRIBUTE_SCHEMA_TREATMENT_MONITOR_MIRRORED_PKTS, ATTRIBUTE_SCHEMA_TREATMENT_MONITOR_MIRRORED_BYTES, ATTRIBUTE_SCHEMA_TREATMENT_STATISTICS_RULE_LIST, // client and server ATTRIBUTE_SCHEMA_GENERAL_ADDRESS_TYPE, ATTRIBUTE_SCHEMA_IP_PROTOCOL, ATTRIBUTE_SCHEMA_CLIENT_IP, ATTRIBUTE_SCHEMA_CLIENT_IP_TAGS, ATTRIBUTE_SCHEMA_CLIENT_IP_TAG_UUIDS, ATTRIBUTE_SCHEMA_CLIENT_IP_COMMIT, ATTRIBUTE_SCHEMA_CLIENT_PORT, ATTRIBUTE_SCHEMA_CLIENT_PORT_COMMIT, ATTRIBUTE_SCHEMA_CLIENT_OS_DESC, ATTRIBUTE_SCHEMA_CLIENT_COUNTRY_CODE, ATTRIBUTE_SCHEMA_CLIENT_ASN_ID, ATTRIBUTE_SCHEMA_CLIENT_ASN_ID_STR, ATTRIBUTE_SCHEMA_CLIENT_SUBSCRIBER_ID, // imsi, apn, phone number, imei ATTRIBUTE_SCHEMA_CLIENT_IMEI, ATTRIBUTE_SCHEMA_CLIENT_IMSI, ATTRIBUTE_SCHEMA_CLIENT_MSISDN, ATTRIBUTE_SCHEMA_CLIENT_APN, ATTRIBUTE_SCHEMA_CLIENT_FISRT_PKT_TTL, ATTRIBUTE_SCHEMA_SERVER_IP, ATTRIBUTE_SCHEMA_SERVER_IP_TAGS, ATTRIBUTE_SCHEMA_SERVER_IP_TAG_UUIDS, ATTRIBUTE_SCHEMA_SERVER_IP_COMMIT, ATTRIBUTE_SCHEMA_SERVER_PORT, ATTRIBUTE_SCHEMA_SERVER_PORT_COMMIT, ATTRIBUTE_SCHEMA_SERVER_OS_DESC, ATTRIBUTE_SCHEMA_SERVER_COUNTRY_CODE, ATTRIBUTE_SCHEMA_SERVER_ASN_ID, ATTRIBUTE_SCHEMA_SERVER_ASN_ID_STR, ATTRIBUTE_SCHEMA_SERVER_FQDN, ATTRIBUTE_SCHEMA_SERVER_FQDN_COMMIT, ATTRIBUTE_SCHEMA_SERVER_FQDN_LOG, ATTRIBUTE_SCHEMA_SERVER_FQDN_TAGS, ATTRIBUTE_SCHEMA_SERVER_DOMAIN_LOG, ATTRIBUTE_SCHEMA_SERVER_FISRT_PKT_TTL, // application ATTRIBUTE_SCHEMA_APPLICATION_TRANSITION, ATTRIBUTE_SCHEMA_APPLICATION, ATTRIBUTE_SCHEMA_APPLICATION_CATEGORY, ATTRIBUTE_SCHEMA_APPLICATION_EXTRA_INFO, ATTRIBUTE_SCHEMA_APPLICATION_DEBUG_INFO, ATTRIBUTE_SCHEMA_APPLICATION_CONTENT, ATTRIBUTE_SCHEMA_APPLICATION_PROTOCOL_PATH, ATTRIBUTE_SCHEMA_APPLICATION_FQDN_CATEGORY_LIST, ATTRIBUTE_SCHEMA_ANALYSIS_APPLICATION_ID, ATTRIBUTE_SCHEMA_ANALYSIS_APPLICATION_ID_COMMIT, ATTRIBUTE_SCHEMA_DECODED_PATH, ATTRIBUTE_SCHEMA_TRANS_PROTOCOL, // transmission ATTRIBUTE_SCHEMA_TRANSMISSION_SENT_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_SENT_BYTES, ATTRIBUTE_SCHEMA_TRANSMISSION_RECEIVED_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_RECEIVED_BYTES, // transmission tcp ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_C2S_IP_FRAGMENTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_S2C_IP_FRAGMENTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_C2S_LOST_BYTES, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_S2C_LOST_BYTES, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_C2S_O3_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_S2C_O3_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_C2S_RTX_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_S2C_RTX_PKTS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_C2S_RTX_BYTES, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_S2C_RTX_BYTES, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_RTT_MS, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_CLEINT_ISN, ATTRIBUTE_SCHEMA_TRANSMISSION_TCP_SERVER_ISN, // other ATTRIBUTE_SCHEMA_OTHER_PACKET_CAPTURE_FILE, ATTRIBUTE_SCHEMA_OTHER_ENCAPSULATION_TYPE, ATTRIBUTE_SCHEMA_OTHER_IN_SRC_MAC, ATTRIBUTE_SCHEMA_OTHER_IN_DEST_MAC, ATTRIBUTE_SCHEMA_OTHER_OUT_SRC_MAC, ATTRIBUTE_SCHEMA_OTHER_OUT_DEST_MAC, ATTRIBUTE_SCHEMA_OTHER_ENCAPSULATION, ATTRIBUTE_SCHEMA_OTHER_DUP_TRAFFIC_FLAG, // encapsulation ATTRIBUTE_SCHEMA_TUNNELS_SCHEMA_TYPE, ATTRIBUTE_SCHEMA_TUNNELS_GTP_ENDPOINT_A_IP, ATTRIBUTE_SCHEMA_TUNNELS_GTP_ENDPOINT_B_IP, ATTRIBUTE_SCHEMA_TUNNELS_GTP_ENDPOINT_A_PORT, ATTRIBUTE_SCHEMA_TUNNELS_GTP_ENDPOINT_B_PORT, ATTRIBUTE_SCHEMA_TUNNELS_GTP_A2B_TEID, ATTRIBUTE_SCHEMA_TUNNELS_GTP_B2A_TEID, ATTRIBUTE_SCHEMA_TUNNELS_MPLS_C2S_DIRECTION_LABEL, ATTRIBUTE_SCHEMA_TUNNELS_MPLS_S2C_DIRECTION_LABEL, ATTRIBUTE_SCHEMA_TUNNELS_VLAN_C2S_DIRECTION_ID, ATTRIBUTE_SCHEMA_TUNNELS_VLAN_S2C_DIRECTION_ID, ATTRIBUTE_SCHEMA_TUNNELS_SOURCE_MAC, ATTRIBUTE_SCHEMA_TUNNELS_DESTINATION_MAC, ATTRIBUTE_SCHEMA_TUNNELS_C2S_SOURCE_MAC, ATTRIBUTE_SCHEMA_TUNNELS_C2S_DESTINATION_MAC, ATTRIBUTE_SCHEMA_TUNNELS_S2C_SOURCE_MAC, ATTRIBUTE_SCHEMA_TUNNELS_S2C_DESTINATION_MAC, ATTRIBUTE_SCHEMA_TUNNELS_CLIENT_IP, ATTRIBUTE_SCHEMA_TUNNELS_SERVER_IP, ATTRIBUTE_SCHEMA_TUNNELS_PPTP_UPLINK_TUNNEL_ID, ATTRIBUTE_SCHEMA_TUNNELS_PPTP_DOWNLINK_TUNNEL_ID, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_VERSION, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_LAC2LNS_TUNNEL_ID, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_LNS2LAC_TUNNEL_ID, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_LAC2LNS_SESSION_ID, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_LNS2LAC_SESSION_ID, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_ACCESS_CONCENTRATOR_IP, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_NETWORK_SERVER_IP, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_ACCESS_CONCENTRATOR_PORT, ATTRIBUTE_SCHEMA_TUNNELS_L2TP_NETWORK_SERVER_PORT, ATTRIBUTE_SCHEMA_MAX }; enum ATTRIBUTE_VALUE_TYPE { ATTRIBUTE_VALUE_TYPE_UNKNOWN = 0, ATTRIBUTE_VALUE_TYPE_STRING, ATTRIBUTE_VALUE_TYPE_INTEGER, ATTRIBUTE_VALUE_TYPE_MAAT_OBJECT, ATTRIBUTE_VALUE_TYPE_FLAG, ATTRIBUTE_VALUE_TYPE_IPV4, ATTRIBUTE_VALUE_TYPE_IPV6, ATTRIBUTE_VALUE_TYPE_STREAM, ATTRIBUTE_VALUE_TYPE_NOT_LOGIC, ATTRIBUTE_VALUE_TYPE_STRING_ARRAY, ATTRIBUTE_VALUE_TYPE_MAX }; #define SCHEMA_DEFAULT_TABLE_ID -1 #define SCHEMA_SCAN_NOT_LOGIC_TRUE 1 #define SCHEMA_SCAN_NOT_LOGIC_FALSE 0 #define SCHEMA_SCAN_HIT_OBJECT_DEFAULT_IDX -1 #define SCHEMA_SCAN_HIT_OBJECT_CLIENT_IP_IDX 1 #define SCHEMA_SCAN_HIT_OBJECT_SERVER_IP_IDX 2 #define SCHEMA_SCAN_HIT_OBJECT_OTHER_ATTR_IDX 3 #define SCHEMA_DEFAULT_LOG_FIELD_NAME_SZ 0 struct attribute_schema { enum ATTRIBUTE_SCHEMA attr_idx; int scan_not_logic_flag; char *scan_attribute_name; size_t log_field_name_sz; char *log_field_name; }; #define FREE_FALSE 0 #define FREE_TRUE 1 struct attribute_value_borrow_string { size_t value_sz; char *value; }; struct attribute_value_string_array { size_t n_value; size_t *value_sz; char **value; }; struct attribute_value_ipv4_port { int32_t port; uint32_t ipv4; }; struct attribute_value_ipv6_port { int32_t port; uint32_t ipv6[4]; }; #define MAX_MAAT_GROUP_ID 128 struct attribute_value_maat_object { size_t n_uuid; uuid_t *item_uuid; uuid_t *object_uuid; }; struct attribute_scratch { struct attribute_schema *schema; enum ATTRIBUTE_VALUE_TYPE value_type; int is_free_schema; int is_free_value; union { uint64_t flag; long long integer; void *null_ptr; // ATTRIBUTE_VALUE_TYPE_NOT_LOGIC struct attribute_value_borrow_string string; // ATTRIBUTE_VALUE_TYPE_STRING struct attribute_value_borrow_string chunk; //ATTR_VALUE_TYPE_STREAM struct attribute_value_maat_object maat_object; struct attribute_value_ipv4_port ipv4_port; struct attribute_value_ipv6_port ipv6_port; struct attribute_value_string_array string_array; }; }; void attribute_schema_init(struct attribute_schema *attr_schema, size_t attr_schema_sz); void attribute_scratch_reset(struct attribute_scratch *attr, size_t n_attr); void attribute_scratch_string_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, char *value, size_t value_sz); void attribute_scratch_string_array_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, char **value, size_t value_sz[], size_t n_value); void attribute_scratch_chunk_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, char *value, size_t value_sz); void attribute_scratch_integer_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, long long value); void attribute_scratch_flag_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, uint64_t value); void attribute_scratch_ipv4_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, uint32_t ipv4, int32_t port); void attribute_scratch_ipv6_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, uint8_t ipv6[16], int32_t port); void attribute_scratch_maat_object_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value, uuid_t item_uuid[], uuid_t object_uuid[], size_t n_uuid); void attribute_scratch_not_logic_fill(struct attribute_scratch *attr, size_t attr_max, size_t *attr_offset, int is_free_schema, struct attribute_schema *schema, int is_free_value); #ifdef __cplusplus } #endif