CERT_IE.h
1 /*
2  *
3  ** @file CERT_IE.h
4  ** Definition of the CERT "standard" information elements extension to
5  ** the IETF standard RFC 5102 information elements
6  **
7  ** ------------------------------------------------------------------------
8  ** Copyright (C) 2009-2015 Carnegie Mellon University. All Rights Reserved.
9  ** ------------------------------------------------------------------------
10  ** Authors: Brian Trammell, Chris Inacio, Emily Ecoff <ecoff@cert.org>
11  ** <netsa-help@cert.org>
12  ** ------------------------------------------------------------------------
13  ** Use of the YAF system and related source code is subject to the terms
14  ** of the following licenses:
15  **
16  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
17  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
18  **
19  ** NO WARRANTY
20  **
21  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER
22  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY
23  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN
24  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
25  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT
26  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE,
27  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE
28  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT,
29  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY
30  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF
31  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES.
32  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF
33  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON
34  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE
35  ** DELIVERABLES UNDER THIS LICENSE.
36  **
37  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie
38  ** Mellon University, its trustees, officers, employees, and agents from
39  ** all claims or demands made against them (and any related losses,
40  ** expenses, or attorney's fees) arising out of, or relating to Licensee's
41  ** and/or its sub licensees' negligent use or willful misuse of or
42  ** negligent conduct or willful misconduct regarding the Software,
43  ** facilities, or other rights or assistance granted by Carnegie Mellon
44  ** University under this License, including, but not limited to, any
45  ** claims of product liability, personal injury, death, damage to
46  ** property, or violation of any laws or regulations.
47  **
48  ** Carnegie Mellon University Software Engineering Institute authored
49  ** documents are sponsored by the U.S. Department of Defense under
50  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains
51  ** copyrights in all material produced under this contract. The U.S.
52  ** Government retains a non-exclusive, royalty-free license to publish or
53  ** reproduce these documents, or allow others to do so, for U.S.
54  ** Government purposes only pursuant to the copyright license under the
55  ** contract clause at 252.227.7013.
56  **
57  ** ------------------------------------------------------------------------
58  */
59 
60 
61 #ifndef CERT_IE_H_
62 #define CERT_IE_H_
63 
64 #define NONE FB_IE_F_NONE
65 #define ER FB_IE_F_ENDIAN | FB_IE_F_REVERSIBLE
66 
73 #ifndef YAF_NEW_FIXBUF
74 static fbInfoElement_t yaf_info_elements[] = {
75  FB_IE_INIT("initialTCPFlags", CERT_PEN, 14, 1, ER),
76  FB_IE_INIT("unionTCPFlags", CERT_PEN, 15, 1, ER),
77  FB_IE_INIT("payload", CERT_PEN, 18, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
78  FB_IE_INIT("reverseFlowDeltaMilliseconds", CERT_PEN, 21, 4, FB_IE_F_ENDIAN),
79  FB_IE_INIT("silkAppLabel", CERT_PEN, 33, 2, FB_IE_F_ENDIAN),
80  FB_IE_INIT("payloadEntropy", CERT_PEN, 35, 1, FB_IE_F_REVERSIBLE),
81  FB_IE_INIT("osName", CERT_PEN, 36, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
82  FB_IE_INIT("osVersion", CERT_PEN, 37, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
83  FB_IE_INIT("firstPacketBanner", CERT_PEN, 38, FB_IE_VARLEN,
84  FB_IE_F_REVERSIBLE),
85  FB_IE_INIT("secondPacketBanner", CERT_PEN, 39, FB_IE_VARLEN,
86  FB_IE_F_REVERSIBLE),
87  FB_IE_INIT("flowAttributes", CERT_PEN, 40, 2, ER),
88  FB_IE_INIT("osFingerPrint",CERT_PEN, 107, FB_IE_VARLEN, FB_IE_F_REVERSIBLE),
89  FB_IE_INIT("expiredFragmentCount", CERT_PEN, 100, 4, FB_IE_F_ENDIAN),
90  FB_IE_INIT("assembledFragmentCount", CERT_PEN, 101, 4, FB_IE_F_ENDIAN),
91  FB_IE_INIT("meanFlowRate", CERT_PEN, 102, 4, FB_IE_F_ENDIAN),
92  FB_IE_INIT("meanPacketRate", CERT_PEN, 103, 4, FB_IE_F_ENDIAN),
93  FB_IE_INIT("flowTableFlushEventCount", CERT_PEN, 104, 4, FB_IE_F_ENDIAN),
94  FB_IE_INIT("flowTablePeakCount", CERT_PEN, 105, 4, FB_IE_F_ENDIAN),
95  FB_IE_INIT("yafFlowKeyHash", CERT_PEN, 106, 4, ER),
96  /* flow stats */
97  FB_IE_INIT("smallPacketCount", CERT_PEN, 500, 4, ER),
98  FB_IE_INIT("nonEmptyPacketCount", CERT_PEN, 501, 4, ER),
99  FB_IE_INIT("dataByteCount", CERT_PEN, 502, 8, ER),
100  FB_IE_INIT("averageInterarrivalTime", CERT_PEN, 503, 8, ER),
101  FB_IE_INIT("standardDeviationInterarrivalTime", CERT_PEN, 504, 8, ER),
102  FB_IE_INIT("firstNonEmptyPacketSize", CERT_PEN, 505, 2, ER),
103  FB_IE_INIT("maxPacketSize", CERT_PEN, 506, 2, ER),
104  FB_IE_INIT("firstEightNonEmptyPacketDirections", CERT_PEN, 507, 1, ER),
105  FB_IE_INIT("standardDeviationPayloadLength", CERT_PEN, 508, 2, ER),
106  FB_IE_INIT("tcpUrgentCount", CERT_PEN, 509, 4, ER),
107  FB_IE_INIT("largePacketCount", CERT_PEN, 510, 4, ER),
108  FB_IE_NULL
109 };
110 #else
111 
112 static fbInfoElement_t yaf_info_elements[] = {
113  FB_IE_INIT_FULL("initialTCPFlags", CERT_PEN, 14, 1, ER | FB_IE_FLAGS,
114  0, 0, FB_UINT_8, NULL),
115  FB_IE_INIT_FULL("unionTCPFlags", CERT_PEN, 15, 1, ER | FB_IE_FLAGS, 0, 0,
116  FB_UINT_8, NULL),
117  FB_IE_INIT_FULL("payload", CERT_PEN, 18, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
118  0, 0, FB_OCTET_ARRAY, NULL),
119  FB_IE_INIT_FULL("reverseFlowDeltaMilliseconds", CERT_PEN, 21, 4,
120  FB_IE_F_ENDIAN | FB_IE_QUANTITY | FB_UNITS_MILLISECONDS,
121  0, 0, FB_UINT_32, NULL),
122  FB_IE_INIT_FULL("silkAppLabel", CERT_PEN, 33, 2,
123  FB_IE_F_ENDIAN | FB_IE_IDENTIFIER, 0, 0, FB_UINT_16, NULL),
124  FB_IE_INIT_FULL("payloadEntropy", CERT_PEN, 35, 1, ER, 0, 0,
125  FB_UINT_8, NULL),
126  FB_IE_INIT_FULL("osName", CERT_PEN, 36, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
127  0, 0, FB_STRING, NULL),
128  FB_IE_INIT_FULL("osVersion",CERT_PEN, 37, FB_IE_VARLEN, FB_IE_F_REVERSIBLE,
129  0, 0, FB_STRING, NULL),
130  FB_IE_INIT_FULL("firstPacketBanner", CERT_PEN, 38, FB_IE_VARLEN,
131  FB_IE_F_REVERSIBLE, 0, 0, FB_OCTET_ARRAY, NULL),
132  FB_IE_INIT_FULL("secondPacketBanner", CERT_PEN, 39, FB_IE_VARLEN,
133  FB_IE_F_REVERSIBLE, 0, 0, FB_OCTET_ARRAY, NULL),
134  FB_IE_INIT_FULL("flowAttributes", CERT_PEN, 40, 2, ER | FB_IE_FLAGS, 0, 0,
135  FB_UINT_16, NULL),
136  FB_IE_INIT_FULL("osFingerPrint",CERT_PEN, 107, FB_IE_VARLEN,
137  FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
138  FB_IE_INIT_FULL("expiredFragmentCount", CERT_PEN, 100, 4,
139  FB_IE_F_ENDIAN | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS,
140  0, 0, FB_UINT_32, NULL),
141  FB_IE_INIT_FULL("assembledFragmentCount", CERT_PEN, 101, 4,
142  FB_IE_F_ENDIAN | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS,
143  0, 0, FB_UINT_32, NULL),
144  FB_IE_INIT_FULL("meanFlowRate", CERT_PEN, 102, 4,
145  FB_IE_F_ENDIAN | FB_UNITS_FLOWS, 0, 0, FB_UINT_32, NULL),
146  FB_IE_INIT_FULL("meanPacketRate", CERT_PEN, 103, 4,
147  FB_IE_F_ENDIAN | FB_UNITS_PACKETS, 0, 0, FB_UINT_32, NULL),
148  FB_IE_INIT_FULL("flowTableFlushEventCount", CERT_PEN, 104, 4,
149  FB_IE_F_ENDIAN | FB_UNITS_FLOWS | FB_IE_TOTALCOUNTER,
150  0, 0, FB_UINT_32, NULL),
151  FB_IE_INIT_FULL("flowTablePeakCount", CERT_PEN, 105, 4,
152  FB_IE_F_ENDIAN | FB_UNITS_FLOWS, 0, 0, FB_UINT_32, NULL),
153  FB_IE_INIT_FULL("yafFlowKeyHash", CERT_PEN, 106, 4,
154  FB_IE_F_ENDIAN | FB_IE_IDENTIFIER, 0, 0, FB_UINT_32, NULL),
155  /* flow stats */
156  FB_IE_INIT_FULL("smallPacketCount", CERT_PEN, 500, 4,
157  ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
158  FB_UINT_32, NULL),
159  FB_IE_INIT_FULL("nonEmptyPacketCount", CERT_PEN, 501, 4,
160  ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
161  FB_UINT_32, NULL),
162  FB_IE_INIT_FULL("dataByteCount", CERT_PEN, 502, 8,
163  ER | FB_IE_TOTALCOUNTER | FB_UNITS_OCTETS, 0, 0,
164  FB_UINT_64,NULL),
165  FB_IE_INIT_FULL("averageInterarrivalTime", CERT_PEN, 503, 8,
166  ER | FB_UNITS_MILLISECONDS, 0, 0, FB_DT_MILSEC, NULL),
167  FB_IE_INIT_FULL("standardDeviationInterarrivalTime", CERT_PEN, 504, 8,
168  ER | FB_UNITS_MILLISECONDS, 0, 0, FB_DT_MILSEC, NULL),
169  FB_IE_INIT_FULL("firstNonEmptyPacketSize", CERT_PEN, 505, 2,
170  ER | FB_IE_QUANTITY | FB_UNITS_OCTETS, 0, 0,
171  FB_UINT_16, NULL),
172  FB_IE_INIT_FULL("maxPacketSize", CERT_PEN, 506, 2,
173  ER | FB_IE_QUANTITY | FB_UNITS_OCTETS, 0, 0,
174  FB_UINT_16, NULL),
175  FB_IE_INIT_FULL("firstEightNonEmptyPacketDirections", CERT_PEN, 507, 1,
176  ER | FB_IE_FLAGS, 0, 0, FB_UINT_8, NULL),
177  FB_IE_INIT_FULL("standardDeviationPayloadLength", CERT_PEN, 508, 2,
178  ER | FB_UNITS_OCTETS, 0, 0, FB_UINT_16, NULL),
179  FB_IE_INIT_FULL("tcpUrgentCount", CERT_PEN, 509, 4,
180  ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
181  FB_UINT_32, NULL),
182  FB_IE_INIT_FULL("largePacketCount", CERT_PEN, 510, 4,
183  ER | FB_IE_TOTALCOUNTER | FB_UNITS_PACKETS, 0, 0,
184  FB_UINT_32, NULL),
185  FB_IE_NULL
186 };
187 #endif
188 
189 
190 /* IE numbers 110-280 */
191 
192 #if YAF_ENABLE_HOOKS
193 
194 #ifndef YAF_NEW_FIXBUF
195 
196 static fbInfoElement_t yaf_dpi_info_elements[] = {
197  FB_IE_INIT("httpServerString", CERT_PEN, 110, FB_IE_VARLEN, NONE),
198  FB_IE_INIT("httpUserAgent", CERT_PEN, 111, FB_IE_VARLEN, NONE),
199  FB_IE_INIT("httpGet", CERT_PEN, 112, FB_IE_VARLEN, NONE),
200  FB_IE_INIT("httpConnection", CERT_PEN, 113, FB_IE_VARLEN, NONE),
201  FB_IE_INIT("httpVersion", CERT_PEN, 114, FB_IE_VARLEN, NONE),
202  FB_IE_INIT("httpReferer", CERT_PEN, 115, FB_IE_VARLEN, NONE),
203  FB_IE_INIT("httpLocation", CERT_PEN, 116, FB_IE_VARLEN, NONE),
204  FB_IE_INIT("httpHost", CERT_PEN, 117, FB_IE_VARLEN, NONE),
205  FB_IE_INIT("httpContentLength", CERT_PEN, 118, FB_IE_VARLEN, NONE),
206  FB_IE_INIT("httpAge", CERT_PEN, 119, FB_IE_VARLEN, NONE),
207  FB_IE_INIT("httpAccept", CERT_PEN, 120, FB_IE_VARLEN, NONE),
208  FB_IE_INIT("httpAcceptLanguage", CERT_PEN, 121, FB_IE_VARLEN, NONE),
209  FB_IE_INIT("httpContentType", CERT_PEN, 122, FB_IE_VARLEN, NONE),
210  FB_IE_INIT("httpResponse", CERT_PEN, 123, FB_IE_VARLEN, NONE),
211  FB_IE_INIT("httpCookie", CERT_PEN, 220, FB_IE_VARLEN, NONE),
212  FB_IE_INIT("httpSetCookie", CERT_PEN, 221, FB_IE_VARLEN, NONE),
213  FB_IE_INIT("httpAuthorization", CERT_PEN, 252, FB_IE_VARLEN, NONE),
214  FB_IE_INIT("httpVia", CERT_PEN, 253, FB_IE_VARLEN, NONE),
215  FB_IE_INIT("httpX-Forwarded-For", CERT_PEN, 254, FB_IE_VARLEN, NONE),
216  FB_IE_INIT("httpRefresh", CERT_PEN, 256, FB_IE_VARLEN, NONE),
217  /* http mobile fields - turned off by default */
218  FB_IE_INIT("httpIMEI", CERT_PEN, 257, FB_IE_VARLEN, NONE),
219  FB_IE_INIT("httpIMSI", CERT_PEN, 258, FB_IE_VARLEN, NONE),
220  FB_IE_INIT("httpMSISDN", CERT_PEN, 259, FB_IE_VARLEN, NONE),
221  FB_IE_INIT("httpSubscriber", CERT_PEN, 260, FB_IE_VARLEN, NONE),
222  /* http extra fields - turned off by default */
223  FB_IE_INIT("httpExpires", CERT_PEN, 255, FB_IE_VARLEN, NONE),
224  FB_IE_INIT("httpAcceptCharset", CERT_PEN, 261, FB_IE_VARLEN, NONE),
225  FB_IE_INIT("httpAcceptEncoding", CERT_PEN, 262, FB_IE_VARLEN, NONE),
226  FB_IE_INIT("httpAllow", CERT_PEN, 263, FB_IE_VARLEN, NONE),
227  FB_IE_INIT("httpDate", CERT_PEN, 264, FB_IE_VARLEN, NONE),
228  FB_IE_INIT("httpExpect", CERT_PEN, 265, FB_IE_VARLEN, NONE),
229  FB_IE_INIT("httpFrom", CERT_PEN, 266, FB_IE_VARLEN, NONE),
230  FB_IE_INIT("httpProxyAuthentication", CERT_PEN, 267, FB_IE_VARLEN, NONE),
231  FB_IE_INIT("httpUpgrade", CERT_PEN, 268, FB_IE_VARLEN, NONE),
232  FB_IE_INIT("httpWarning", CERT_PEN, 269, FB_IE_VARLEN, NONE),
233  FB_IE_INIT("httpDNT", CERT_PEN, 270, FB_IE_VARLEN, NONE),
234  FB_IE_INIT("httpX-Forwarded-Proto", CERT_PEN, 271, FB_IE_VARLEN, NONE),
235  FB_IE_INIT("httpX-Forwarded-Host", CERT_PEN, 272, FB_IE_VARLEN, NONE),
236  FB_IE_INIT("httpX-Forwarded-Server", CERT_PEN, 273, FB_IE_VARLEN, NONE),
237  FB_IE_INIT("httpX-DeviceID", CERT_PEN, 274, FB_IE_VARLEN, NONE),
238  FB_IE_INIT("httpX-Profile", CERT_PEN, 275, FB_IE_VARLEN, NONE),
239  FB_IE_INIT("httpLastModified", CERT_PEN, 276, FB_IE_VARLEN, NONE),
240  FB_IE_INIT("httpContentEncoding", CERT_PEN, 277, FB_IE_VARLEN, NONE),
241  FB_IE_INIT("httpContentLanguage", CERT_PEN, 278, FB_IE_VARLEN, NONE),
242  FB_IE_INIT("httpContentLocation", CERT_PEN, 279, FB_IE_VARLEN, NONE),
243  FB_IE_INIT("httpX-UA-Compatible", CERT_PEN, 280, FB_IE_VARLEN, NONE),
244  /* POP3 IEs */
245  FB_IE_INIT("pop3TextMessage", CERT_PEN, 124, FB_IE_VARLEN, NONE),
246  /* IRC IEs */
247  FB_IE_INIT("ircTextMessage", CERT_PEN, 125, FB_IE_VARLEN, NONE),
248  /* TFTP IEs */
249  FB_IE_INIT("tftpFilename", CERT_PEN, 126, FB_IE_VARLEN, NONE),
250  FB_IE_INIT("tftpMode", CERT_PEN, 127, FB_IE_VARLEN, NONE),
251  /* SLP IEs */
252  FB_IE_INIT("slpVersion", CERT_PEN, 128, 1, FB_IE_F_ENDIAN),
253  FB_IE_INIT("slpMessageType", CERT_PEN, 129, 1, FB_IE_F_ENDIAN),
254  FB_IE_INIT("slpString", CERT_PEN, 130, FB_IE_VARLEN, NONE),
255  /* FTP IEs */
256  FB_IE_INIT("ftpReturn", CERT_PEN, 131, FB_IE_VARLEN, NONE),
257  FB_IE_INIT("ftpUser", CERT_PEN, 132, FB_IE_VARLEN, NONE),
258  FB_IE_INIT("ftpPass", CERT_PEN,133, FB_IE_VARLEN, NONE),
259  FB_IE_INIT("ftpType", CERT_PEN,134, FB_IE_VARLEN, NONE),
260  FB_IE_INIT("ftpRespCode", CERT_PEN,135, FB_IE_VARLEN, NONE),
261  /* IMAP IEs */
262  FB_IE_INIT("imapCapability", CERT_PEN, 136, FB_IE_VARLEN, NONE),
263  FB_IE_INIT("imapLogin", CERT_PEN, 137, FB_IE_VARLEN, NONE),
264  FB_IE_INIT("imapStartTLS", CERT_PEN, 138, FB_IE_VARLEN, NONE),
265  FB_IE_INIT("imapAuthenticate", CERT_PEN, 139, FB_IE_VARLEN, NONE),
266  FB_IE_INIT("imapCommand", CERT_PEN, 140, FB_IE_VARLEN, NONE),
267  FB_IE_INIT("imapExists", CERT_PEN, 141, FB_IE_VARLEN, NONE),
268  FB_IE_INIT("imapRecent", CERT_PEN, 142, FB_IE_VARLEN, NONE),
269  /* rtsp IEs */
270  FB_IE_INIT("rtspURL", CERT_PEN, 143, FB_IE_VARLEN, NONE),
271  FB_IE_INIT("rtspVersion", CERT_PEN, 144, FB_IE_VARLEN, NONE),
272  FB_IE_INIT("rtspReturnCode", CERT_PEN, 145, FB_IE_VARLEN, NONE),
273  FB_IE_INIT("rtspContentLength", CERT_PEN, 146, FB_IE_VARLEN, NONE),
274  FB_IE_INIT("rtspCommand", CERT_PEN, 147, FB_IE_VARLEN, NONE),
275  FB_IE_INIT("rtspContentType", CERT_PEN, 148, FB_IE_VARLEN, NONE),
276  FB_IE_INIT("rtspTransport", CERT_PEN, 149, FB_IE_VARLEN, NONE),
277  FB_IE_INIT("rtspCSeq", CERT_PEN, 150, FB_IE_VARLEN, NONE),
278  FB_IE_INIT("rtspLocation", CERT_PEN, 151, FB_IE_VARLEN, NONE),
279  FB_IE_INIT("rtspPacketsReceived", CERT_PEN, 152, FB_IE_VARLEN, NONE),
280  FB_IE_INIT("rtspUserAgent", CERT_PEN, 153, FB_IE_VARLEN, NONE),
281  FB_IE_INIT("rtspJitter", CERT_PEN, 154, FB_IE_VARLEN, NONE),
282  /* sip IEs */
283  FB_IE_INIT("sipInvite", CERT_PEN, 155, FB_IE_VARLEN, NONE),
284  FB_IE_INIT("sipCommand", CERT_PEN, 156, FB_IE_VARLEN, NONE),
285  FB_IE_INIT("sipVia", CERT_PEN, 157, FB_IE_VARLEN, NONE),
286  FB_IE_INIT("sipMaxForwards", CERT_PEN, 158, FB_IE_VARLEN, NONE),
287  FB_IE_INIT("sipAddress", CERT_PEN, 159, FB_IE_VARLEN, NONE),
288  FB_IE_INIT("sipContentLength", CERT_PEN, 160, FB_IE_VARLEN, NONE),
289  FB_IE_INIT("sipUserAgent", CERT_PEN, 161, FB_IE_VARLEN, NONE),
290  /* smtp IEs */
291  FB_IE_INIT("smtpHello", CERT_PEN, 162, FB_IE_VARLEN, NONE),
292  FB_IE_INIT("smtpFrom", CERT_PEN, 163, FB_IE_VARLEN, NONE),
293  FB_IE_INIT("smtpTo", CERT_PEN, 164, FB_IE_VARLEN, NONE),
294  FB_IE_INIT("smtpContentType", CERT_PEN, 165, FB_IE_VARLEN, NONE),
295  FB_IE_INIT("smtpSubject", CERT_PEN, 166, FB_IE_VARLEN, NONE),
296  FB_IE_INIT("smtpFilename", CERT_PEN, 167, FB_IE_VARLEN, NONE),
297  FB_IE_INIT("smtpContentDisposition", CERT_PEN, 168, FB_IE_VARLEN, NONE),
298  FB_IE_INIT("smtpResponse", CERT_PEN, 169, FB_IE_VARLEN, NONE),
299  FB_IE_INIT("smtpEnhanced", CERT_PEN, 170, FB_IE_VARLEN, NONE),
300  FB_IE_INIT("smtpSize", CERT_PEN, 222, FB_IE_VARLEN, NONE),
301  FB_IE_INIT("smtpDate", CERT_PEN, 251, FB_IE_VARLEN, NONE),
302  /* ssh IEs */
303  FB_IE_INIT("sshVersion", CERT_PEN, 171, FB_IE_VARLEN, NONE),
304  /* nntp IEs */
305  FB_IE_INIT("nntpResponse", CERT_PEN, 172, FB_IE_VARLEN, NONE),
306  FB_IE_INIT("nntpCommand", CERT_PEN, 173, FB_IE_VARLEN, NONE),
307  /* dns IEs */
308  FB_IE_INIT("dnsQueryResponse", CERT_PEN, 174, 1, FB_IE_F_ENDIAN),
309  FB_IE_INIT("dnsQRType", CERT_PEN, 175, 2, FB_IE_F_ENDIAN),
310  FB_IE_INIT("dnsAuthoritative", CERT_PEN, 176, 1, FB_IE_F_ENDIAN),
311  FB_IE_INIT("dnsNXDomain", CERT_PEN, 177, 1, FB_IE_F_ENDIAN),
312  FB_IE_INIT("dnsRRSection", CERT_PEN, 178, 1, FB_IE_F_ENDIAN),
313  FB_IE_INIT("dnsQName", CERT_PEN, 179, FB_IE_VARLEN, NONE),
314  FB_IE_INIT("dnsCName", CERT_PEN, 180, FB_IE_VARLEN, NONE),
315  FB_IE_INIT("dnsMXPreference", CERT_PEN, 181, 2, FB_IE_F_ENDIAN),
316  FB_IE_INIT("dnsMXExchange", CERT_PEN, 182, FB_IE_VARLEN, NONE),
317  FB_IE_INIT("dnsNSDName", CERT_PEN, 183, FB_IE_VARLEN, NONE),
318  FB_IE_INIT("dnsPTRDName", CERT_PEN, 184, FB_IE_VARLEN, NONE),
319  FB_IE_INIT("dnsTTL", CERT_PEN, 199, 4, FB_IE_F_ENDIAN),
320  FB_IE_INIT("dnsTXTData", CERT_PEN, 208, FB_IE_VARLEN, NONE),
321  FB_IE_INIT("dnsSOASerial", CERT_PEN, 209, 4, FB_IE_F_ENDIAN),
322  FB_IE_INIT("dnsSOARefresh", CERT_PEN, 210, 4, FB_IE_F_ENDIAN),
323  FB_IE_INIT("dnsSOARetry", CERT_PEN, 211, 4, FB_IE_F_ENDIAN),
324  FB_IE_INIT("dnsSOAExpire", CERT_PEN, 212, 4, FB_IE_F_ENDIAN),
325  FB_IE_INIT("dnsSOAMinimum", CERT_PEN, 213, 4, FB_IE_F_ENDIAN),
326  FB_IE_INIT("dnsSOAMName", CERT_PEN, 214, FB_IE_VARLEN, NONE),
327  FB_IE_INIT("dnsSOARName", CERT_PEN, 215, FB_IE_VARLEN, NONE),
328  FB_IE_INIT("dnsSRVPriority", CERT_PEN, 216, 2, FB_IE_F_ENDIAN),
329  FB_IE_INIT("dnsSRVWeight", CERT_PEN, 217, 2, FB_IE_F_ENDIAN),
330  FB_IE_INIT("dnsSRVPort", CERT_PEN, 218, 2, FB_IE_F_ENDIAN),
331  FB_IE_INIT("dnsSRVTarget", CERT_PEN, 219, FB_IE_VARLEN, NONE),
332  FB_IE_INIT("dnsID", CERT_PEN, 226, 2, FB_IE_F_ENDIAN),
333  /* dnssec IEs */
334  FB_IE_INIT("dnsAlgorithm", CERT_PEN, 227, 1, FB_IE_F_ENDIAN),
335  FB_IE_INIT("dnsKeyTag", CERT_PEN, 228, 2, FB_IE_F_ENDIAN),
336  FB_IE_INIT("dnsSigner", CERT_PEN, 229, FB_IE_VARLEN, NONE),
337  FB_IE_INIT("dnsSignature", CERT_PEN, 230, FB_IE_VARLEN, NONE),
338  FB_IE_INIT("dnsDigest", CERT_PEN, 231, FB_IE_VARLEN, NONE),
339  FB_IE_INIT("dnsPublicKey", CERT_PEN, 232, FB_IE_VARLEN, NONE),
340  FB_IE_INIT("dnsSalt", CERT_PEN, 233, FB_IE_VARLEN, NONE),
341  FB_IE_INIT("dnsHashData", CERT_PEN, 234, FB_IE_VARLEN, NONE),
342  FB_IE_INIT("dnsIterations", CERT_PEN, 235, 2, FB_IE_F_ENDIAN),
343  FB_IE_INIT("dnsSignatureExpiration", CERT_PEN, 236, 4, FB_IE_F_ENDIAN),
344  FB_IE_INIT("dnsSignatureInception", CERT_PEN, 237, 4, FB_IE_F_ENDIAN),
345  FB_IE_INIT("dnsDigestType", CERT_PEN, 238, 1, FB_IE_F_ENDIAN),
346  FB_IE_INIT("dnsLabels", CERT_PEN, 239, 1, FB_IE_F_ENDIAN),
347  FB_IE_INIT("dnsTypeCovered", CERT_PEN, 240, 2, FB_IE_F_ENDIAN),
348  FB_IE_INIT("dnsFlags", CERT_PEN, 241, 2, FB_IE_F_ENDIAN),
349  /* ssl IEs */
350  FB_IE_INIT("sslCipher", CERT_PEN, 185, 4, FB_IE_F_ENDIAN),
351  FB_IE_INIT("sslClientVersion", CERT_PEN, 186, 1, FB_IE_F_ENDIAN),
352  FB_IE_INIT("sslServerCipher", CERT_PEN, 187, 4, FB_IE_F_ENDIAN),
353  FB_IE_INIT("sslCompressionMethod", CERT_PEN, 188, 1, FB_IE_F_ENDIAN),
354  FB_IE_INIT("sslCertVersion", CERT_PEN, 189, 1, FB_IE_F_ENDIAN),
355  FB_IE_INIT("sslCertSignature", CERT_PEN, 190, FB_IE_VARLEN, NONE),
356  FB_IE_INIT("sslCertSerialNumber", CERT_PEN, 244, FB_IE_VARLEN, NONE),
357  FB_IE_INIT("sslObjectType", CERT_PEN, 245, 1, FB_IE_F_ENDIAN),
358  FB_IE_INIT("sslObjectValue", CERT_PEN, 246, FB_IE_VARLEN, NONE),
359  FB_IE_INIT("sslCertValidityNotBefore", CERT_PEN, 247, FB_IE_VARLEN, NONE),
360  FB_IE_INIT("sslCertValidityNotAfter", CERT_PEN, 248, FB_IE_VARLEN, NONE),
361  FB_IE_INIT("sslPublicKeyAlgorithm", CERT_PEN, 249, FB_IE_VARLEN, NONE),
362  FB_IE_INIT("sslPublicKeyLength", CERT_PEN, 250, 2, FB_IE_F_ENDIAN),
363  /* mysql IEs */
364  FB_IE_INIT("mysqlUsername", CERT_PEN, 223, FB_IE_VARLEN, NONE),
365  FB_IE_INIT("mysqlCommandCode", CERT_PEN, 224, 1, FB_IE_F_ENDIAN),
366  FB_IE_INIT("mysqlCommandText", CERT_PEN, 225, FB_IE_VARLEN, NONE),
367  /* dnp3.0 IEs */
368  FB_IE_INIT("dnp3SourceAddress", CERT_PEN, 281, 2, FB_IE_F_ENDIAN),
369  FB_IE_INIT("dnp3DestinationAddress", CERT_PEN, 282, 2, FB_IE_F_ENDIAN),
370  FB_IE_INIT("dnp3Function", CERT_PEN, 283, 1, FB_IE_F_ENDIAN),
371  FB_IE_INIT("dnp3ObjectData", CERT_PEN, 284, FB_IE_VARLEN, NONE),
372  FB_IE_INIT("modbusData", CERT_PEN, 285, FB_IE_VARLEN, NONE),
373  FB_IE_INIT("ethernetIPData", CERT_PEN, 286, FB_IE_VARLEN, NONE),
374  FB_IE_INIT("rtpPayloadType", CERT_PEN, 287, 1, ER),
375  FB_IE_INIT("sslRecordVersion", CERT_PEN, 288, 2, FB_IE_F_ENDIAN),
376  FB_IE_NULL
377 };
378 
379 static fbInfoElement_t yaf_dhcp_info_elements[] = {
380  FB_IE_INIT("dhcpFingerPrint", CERT_PEN, 242, FB_IE_VARLEN,
381  FB_IE_F_REVERSIBLE),
382  FB_IE_INIT("dhcpVendorCode", CERT_PEN, 243, FB_IE_VARLEN,
383  FB_IE_F_REVERSIBLE),
384  FB_IE_NULL
385 };
386 
387 #else
388 
389 
390 
391 static fbInfoElement_t yaf_dpi_info_elements[] = {
392  FB_IE_INIT_FULL("httpServerString", CERT_PEN, 110, FB_IE_VARLEN, NONE,
393  0, 0, FB_STRING, NULL),
394  FB_IE_INIT_FULL("httpUserAgent", CERT_PEN, 111, FB_IE_VARLEN, NONE,
395  0, 0, FB_STRING, NULL),
396  FB_IE_INIT_FULL("httpGet", CERT_PEN, 112, FB_IE_VARLEN, NONE,
397  0, 0, FB_STRING, NULL),
398  FB_IE_INIT_FULL("httpConnection", CERT_PEN, 113, FB_IE_VARLEN, NONE,
399  0, 0, FB_STRING, NULL),
400  FB_IE_INIT_FULL("httpVersion", CERT_PEN, 114, FB_IE_VARLEN, NONE,
401  0, 0, FB_STRING, NULL),
402  FB_IE_INIT_FULL("httpReferer", CERT_PEN, 115, FB_IE_VARLEN, NONE,
403  0, 0, FB_STRING, NULL),
404  FB_IE_INIT_FULL("httpLocation", CERT_PEN, 116, FB_IE_VARLEN, NONE,
405  0, 0, FB_STRING, NULL),
406  FB_IE_INIT_FULL("httpHost", CERT_PEN, 117, FB_IE_VARLEN, NONE,
407  0, 0, FB_STRING, NULL),
408  FB_IE_INIT_FULL("httpContentLength", CERT_PEN, 118, FB_IE_VARLEN, NONE,
409  0, 0, FB_STRING, NULL),
410  FB_IE_INIT_FULL("httpAge", CERT_PEN, 119, FB_IE_VARLEN, NONE,
411  0, 0, FB_STRING, NULL),
412  FB_IE_INIT_FULL("httpAccept", CERT_PEN, 120, FB_IE_VARLEN, NONE,
413  0, 0, FB_STRING, NULL),
414  FB_IE_INIT_FULL("httpAcceptLanguage", CERT_PEN, 121, FB_IE_VARLEN, NONE,
415  0, 0, FB_STRING, NULL),
416  FB_IE_INIT_FULL("httpContentType", CERT_PEN, 122, FB_IE_VARLEN, NONE,
417  0, 0, FB_STRING, NULL),
418  FB_IE_INIT_FULL("httpResponse", CERT_PEN, 123, FB_IE_VARLEN, NONE,
419  0, 0, FB_STRING, NULL),
420  FB_IE_INIT_FULL("httpCookie", CERT_PEN, 220, FB_IE_VARLEN, NONE,
421  0, 0, FB_STRING, NULL),
422  FB_IE_INIT_FULL("httpSetCookie", CERT_PEN, 221, FB_IE_VARLEN, NONE,
423  0, 0, FB_STRING, NULL),
424  FB_IE_INIT_FULL("httpAuthorization", CERT_PEN, 252, FB_IE_VARLEN, NONE,
425  0, 0, FB_STRING, NULL),
426  FB_IE_INIT_FULL("httpVia", CERT_PEN, 253, FB_IE_VARLEN, NONE,
427  0, 0, FB_STRING, NULL),
428  FB_IE_INIT_FULL("httpX-Forwarded-For", CERT_PEN, 254, FB_IE_VARLEN, NONE,
429  0, 0, FB_STRING, NULL),
430  FB_IE_INIT_FULL("httpRefresh", CERT_PEN, 256, FB_IE_VARLEN, NONE,
431  0, 0, FB_STRING, NULL),
432  /* http mobile fields - turned off by default */
433  FB_IE_INIT_FULL("httpIMEI", CERT_PEN, 257, FB_IE_VARLEN, NONE,
434  0, 0, FB_STRING, NULL),
435  FB_IE_INIT_FULL("httpIMSI", CERT_PEN, 258, FB_IE_VARLEN, NONE,
436  0, 0, FB_STRING, NULL),
437  FB_IE_INIT_FULL("httpMSISDN", CERT_PEN, 259, FB_IE_VARLEN, NONE,
438  0, 0, FB_STRING, NULL),
439  FB_IE_INIT_FULL("httpSubscriber", CERT_PEN, 260, FB_IE_VARLEN, NONE,
440  0, 0, FB_STRING, NULL),
441  /* http extra fields - turned off by default */
442  FB_IE_INIT_FULL("httpExpires", CERT_PEN, 255, FB_IE_VARLEN, NONE,
443  0, 0, FB_STRING, NULL),
444  FB_IE_INIT_FULL("httpAcceptCharset", CERT_PEN, 261, FB_IE_VARLEN, NONE,
445  0, 0, FB_STRING, NULL),
446  FB_IE_INIT_FULL("httpAcceptEncoding", CERT_PEN, 262, FB_IE_VARLEN, NONE,
447  0, 0, FB_STRING, NULL),
448  FB_IE_INIT_FULL("httpAllow", CERT_PEN, 263, FB_IE_VARLEN, NONE,
449  0, 0, FB_STRING, NULL),
450  FB_IE_INIT_FULL("httpDate", CERT_PEN, 264, FB_IE_VARLEN, NONE,
451  0, 0, FB_STRING, NULL),
452  FB_IE_INIT_FULL("httpExpect", CERT_PEN, 265, FB_IE_VARLEN, NONE,
453  0, 0, FB_STRING, NULL),
454  FB_IE_INIT_FULL("httpFrom", CERT_PEN, 266, FB_IE_VARLEN, NONE,
455  0, 0, FB_STRING, NULL),
456  FB_IE_INIT_FULL("httpProxyAuthentication", CERT_PEN, 267, FB_IE_VARLEN,
457  NONE, 0, 0, FB_STRING, NULL),
458  FB_IE_INIT_FULL("httpUpgrade", CERT_PEN, 268, FB_IE_VARLEN, NONE,
459  0, 0, FB_STRING, NULL),
460  FB_IE_INIT_FULL("httpWarning", CERT_PEN, 269, FB_IE_VARLEN, NONE,
461  0, 0, FB_STRING, NULL),
462  FB_IE_INIT_FULL("httpDNT", CERT_PEN, 270, FB_IE_VARLEN, NONE,
463  0, 0, FB_STRING, NULL),
464  FB_IE_INIT_FULL("httpX-Forwarded-Proto", CERT_PEN, 271, FB_IE_VARLEN,
465  NONE, 0, 0, FB_STRING, NULL),
466  FB_IE_INIT_FULL("httpX-Forwarded-Host", CERT_PEN, 272, FB_IE_VARLEN, NONE,
467  0, 0, FB_STRING, NULL),
468  FB_IE_INIT_FULL("httpX-Forwarded-Server", CERT_PEN, 273, FB_IE_VARLEN,
469  NONE, 0, 0, FB_STRING, NULL),
470  FB_IE_INIT_FULL("httpX-DeviceID", CERT_PEN, 274, FB_IE_VARLEN, NONE,
471  0, 0, FB_STRING, NULL),
472  FB_IE_INIT_FULL("httpX-Profile", CERT_PEN, 275, FB_IE_VARLEN, NONE,
473  0, 0, FB_STRING, NULL),
474  FB_IE_INIT_FULL("httpLastModified", CERT_PEN, 276, FB_IE_VARLEN, NONE,
475  0, 0, FB_STRING, NULL),
476  FB_IE_INIT_FULL("httpContentEncoding", CERT_PEN, 277, FB_IE_VARLEN, NONE,
477  0, 0, FB_STRING, NULL),
478  FB_IE_INIT_FULL("httpContentLanguage", CERT_PEN, 278, FB_IE_VARLEN, NONE,
479  0, 0, FB_STRING, NULL),
480  FB_IE_INIT_FULL("httpContentLocation", CERT_PEN, 279, FB_IE_VARLEN, NONE,
481  0, 0, FB_STRING, NULL),
482  FB_IE_INIT_FULL("httpX-UA-Compatible", CERT_PEN, 280, FB_IE_VARLEN, NONE,
483  0, 0, FB_STRING, NULL),
484  /* POP3 IEs */
485  FB_IE_INIT_FULL("pop3TextMessage", CERT_PEN, 124, FB_IE_VARLEN, NONE,
486  0, 0, FB_STRING, NULL),
487  /* IRC IEs */
488  FB_IE_INIT_FULL("ircTextMessage", CERT_PEN, 125, FB_IE_VARLEN, NONE,
489  0, 0, FB_STRING, NULL),
490  /* TFTP IEs */
491  FB_IE_INIT_FULL("tftpFilename", CERT_PEN, 126, FB_IE_VARLEN, NONE,
492  0, 0, FB_STRING, NULL),
493  FB_IE_INIT_FULL("tftpMode", CERT_PEN, 127, FB_IE_VARLEN, NONE,
494  0, 0, FB_STRING, NULL),
495  /* SLP IEs */
496  FB_IE_INIT_FULL("slpVersion", CERT_PEN, 128, 1, FB_IE_F_ENDIAN,
497  0, 0, FB_UINT_8, NULL),
498  FB_IE_INIT_FULL("slpMessageType", CERT_PEN, 129, 1, FB_IE_F_ENDIAN,
499  0, 0, FB_UINT_8, NULL),
500  FB_IE_INIT_FULL("slpString", CERT_PEN, 130, FB_IE_VARLEN, NONE,
501  0, 0, FB_STRING, NULL),
502  /* FTP IEs */
503  FB_IE_INIT_FULL("ftpReturn", CERT_PEN, 131, FB_IE_VARLEN, NONE,
504  0, 0, FB_STRING, NULL),
505  FB_IE_INIT_FULL("ftpUser", CERT_PEN, 132, FB_IE_VARLEN, NONE,
506  0, 0, FB_STRING, NULL),
507  FB_IE_INIT_FULL("ftpPass", CERT_PEN,133, FB_IE_VARLEN, NONE,
508  0, 0, FB_STRING, NULL),
509  FB_IE_INIT_FULL("ftpType", CERT_PEN,134, FB_IE_VARLEN, NONE,
510  0, 0, FB_STRING, NULL),
511  FB_IE_INIT_FULL("ftpRespCode", CERT_PEN,135, FB_IE_VARLEN, NONE,
512  0, 0, FB_STRING, NULL),
513  /* IMAP IEs */
514  FB_IE_INIT_FULL("imapCapability", CERT_PEN, 136, FB_IE_VARLEN, NONE,
515  0, 0, FB_STRING, NULL),
516  FB_IE_INIT_FULL("imapLogin", CERT_PEN, 137, FB_IE_VARLEN, NONE,
517  0, 0, FB_STRING, NULL),
518  FB_IE_INIT_FULL("imapStartTLS", CERT_PEN, 138, FB_IE_VARLEN, NONE,
519  0, 0, FB_STRING, NULL),
520  FB_IE_INIT_FULL("imapAuthenticate", CERT_PEN, 139, FB_IE_VARLEN, NONE,
521  0, 0, FB_STRING, NULL),
522  FB_IE_INIT_FULL("imapCommand", CERT_PEN, 140, FB_IE_VARLEN, NONE,
523  0, 0, FB_STRING, NULL),
524  FB_IE_INIT_FULL("imapExists", CERT_PEN, 141, FB_IE_VARLEN, NONE,
525  0, 0, FB_STRING, NULL),
526  FB_IE_INIT_FULL("imapRecent", CERT_PEN, 142, FB_IE_VARLEN, NONE,
527  0, 0, FB_STRING, NULL),
528  /* rtsp IEs */
529  FB_IE_INIT_FULL("rtspURL", CERT_PEN, 143, FB_IE_VARLEN, NONE,
530  0, 0, FB_STRING, NULL),
531  FB_IE_INIT_FULL("rtspVersion", CERT_PEN, 144, FB_IE_VARLEN, NONE,
532  0, 0, FB_STRING, NULL),
533  FB_IE_INIT_FULL("rtspReturnCode", CERT_PEN, 145, FB_IE_VARLEN, NONE,
534  0, 0, FB_STRING, NULL),
535  FB_IE_INIT_FULL("rtspContentLength", CERT_PEN, 146, FB_IE_VARLEN, NONE,
536  0, 0, FB_STRING, NULL),
537  FB_IE_INIT_FULL("rtspCommand", CERT_PEN, 147, FB_IE_VARLEN, NONE,
538  0, 0, FB_STRING, NULL),
539  FB_IE_INIT_FULL("rtspContentType", CERT_PEN, 148, FB_IE_VARLEN, NONE,
540  0, 0, FB_STRING, NULL),
541  FB_IE_INIT_FULL("rtspTransport", CERT_PEN, 149, FB_IE_VARLEN, NONE,
542  0, 0, FB_STRING, NULL),
543  FB_IE_INIT_FULL("rtspCSeq", CERT_PEN, 150, FB_IE_VARLEN, NONE,
544  0, 0, FB_STRING, NULL),
545  FB_IE_INIT_FULL("rtspLocation", CERT_PEN, 151, FB_IE_VARLEN, NONE,
546  0, 0, FB_STRING, NULL),
547  FB_IE_INIT_FULL("rtspPacketsReceived", CERT_PEN, 152, FB_IE_VARLEN, NONE,
548  0, 0, FB_STRING, NULL),
549  FB_IE_INIT_FULL("rtspUserAgent", CERT_PEN, 153, FB_IE_VARLEN, NONE,
550  0, 0, FB_STRING, NULL),
551  FB_IE_INIT_FULL("rtspJitter", CERT_PEN, 154, FB_IE_VARLEN, NONE,
552  0, 0, FB_STRING, NULL),
553  /* sip IEs */
554  FB_IE_INIT_FULL("sipInvite", CERT_PEN, 155, FB_IE_VARLEN, NONE,
555  0, 0, FB_STRING, NULL),
556  FB_IE_INIT_FULL("sipCommand", CERT_PEN, 156, FB_IE_VARLEN, NONE,
557  0, 0, FB_STRING, NULL),
558  FB_IE_INIT_FULL("sipVia", CERT_PEN, 157, FB_IE_VARLEN, NONE,
559  0, 0, FB_STRING, NULL),
560  FB_IE_INIT_FULL("sipMaxForwards", CERT_PEN, 158, FB_IE_VARLEN, NONE,
561  0, 0, FB_STRING, NULL),
562  FB_IE_INIT_FULL("sipAddress", CERT_PEN, 159, FB_IE_VARLEN, NONE,
563  0, 0, FB_STRING, NULL),
564  FB_IE_INIT_FULL("sipContentLength", CERT_PEN, 160, FB_IE_VARLEN, NONE,
565  0, 0, FB_STRING, NULL),
566  FB_IE_INIT_FULL("sipUserAgent", CERT_PEN, 161, FB_IE_VARLEN, NONE,
567  0, 0, FB_STRING, NULL),
568  /* smtp IEs */
569  FB_IE_INIT_FULL("smtpHello", CERT_PEN, 162, FB_IE_VARLEN, NONE,
570  0, 0, FB_STRING, NULL),
571  FB_IE_INIT_FULL("smtpFrom", CERT_PEN, 163, FB_IE_VARLEN, NONE,
572  0, 0, FB_STRING, NULL),
573  FB_IE_INIT_FULL("smtpTo", CERT_PEN, 164, FB_IE_VARLEN, NONE,
574  0, 0, FB_STRING, NULL),
575  FB_IE_INIT_FULL("smtpContentType", CERT_PEN, 165, FB_IE_VARLEN, NONE,
576  0, 0, FB_STRING, NULL),
577  FB_IE_INIT_FULL("smtpSubject", CERT_PEN, 166, FB_IE_VARLEN, NONE,
578  0, 0, FB_STRING, NULL),
579  FB_IE_INIT_FULL("smtpFilename", CERT_PEN, 167, FB_IE_VARLEN, NONE,
580  0, 0, FB_STRING, NULL),
581  FB_IE_INIT_FULL("smtpContentDisposition", CERT_PEN, 168, FB_IE_VARLEN,
582  NONE, 0, 0, FB_STRING, NULL),
583  FB_IE_INIT_FULL("smtpResponse", CERT_PEN, 169, FB_IE_VARLEN, NONE,
584  0, 0, FB_STRING, NULL),
585  FB_IE_INIT_FULL("smtpEnhanced", CERT_PEN, 170, FB_IE_VARLEN, NONE,
586  0, 0, FB_STRING, NULL),
587  FB_IE_INIT_FULL("smtpSize", CERT_PEN, 222, FB_IE_VARLEN, NONE,
588  0, 0, FB_STRING, NULL),
589  FB_IE_INIT_FULL("smtpDate", CERT_PEN, 251, FB_IE_VARLEN, NONE,
590  0, 0, FB_STRING, NULL),
591  /* ssh IEs */
592  FB_IE_INIT_FULL("sshVersion", CERT_PEN, 171, FB_IE_VARLEN, NONE,
593  0, 0, FB_STRING, NULL),
594  /* nntp IEs */
595  FB_IE_INIT_FULL("nntpResponse", CERT_PEN, 172, FB_IE_VARLEN, NONE,
596  0, 0, FB_STRING, NULL),
597  FB_IE_INIT_FULL("nntpCommand", CERT_PEN, 173, FB_IE_VARLEN, NONE,
598  0, 0, FB_STRING, NULL),
599  /* dns IEs */
600  FB_IE_INIT_FULL("dnsQueryResponse", CERT_PEN, 174, 1, FB_IE_F_ENDIAN,
601  0, 0, FB_UINT_8, NULL),
602  FB_IE_INIT_FULL("dnsQRType", CERT_PEN, 175, 2, FB_IE_F_ENDIAN,
603  0, 0, FB_UINT_16, NULL),
604  FB_IE_INIT_FULL("dnsAuthoritative", CERT_PEN, 176, 1, FB_IE_F_ENDIAN,
605  0, 0, FB_UINT_8, NULL),
606  FB_IE_INIT_FULL("dnsNXDomain", CERT_PEN, 177, 1, FB_IE_F_ENDIAN,
607  0, 0, FB_UINT_8, NULL),
608  FB_IE_INIT_FULL("dnsRRSection", CERT_PEN, 178, 1, FB_IE_F_ENDIAN,
609  0, 0, FB_UINT_8, NULL),
610  FB_IE_INIT_FULL("dnsQName", CERT_PEN, 179, FB_IE_VARLEN, NONE,
611  0, 0, FB_STRING, NULL),
612  FB_IE_INIT_FULL("dnsCName", CERT_PEN, 180, FB_IE_VARLEN, NONE,
613  0, 0, FB_STRING, NULL),
614  FB_IE_INIT_FULL("dnsMXPreference", CERT_PEN, 181, 2, FB_IE_F_ENDIAN,
615  0, 0, FB_STRING, NULL),
616  FB_IE_INIT_FULL("dnsMXExchange", CERT_PEN, 182, FB_IE_VARLEN, NONE,
617  0, 0, FB_STRING, NULL),
618  FB_IE_INIT_FULL("dnsNSDName", CERT_PEN, 183, FB_IE_VARLEN, NONE,
619  0, 0, FB_STRING, NULL),
620  FB_IE_INIT_FULL("dnsPTRDName", CERT_PEN, 184, FB_IE_VARLEN, NONE,
621  0, 0, FB_STRING, NULL),
622  FB_IE_INIT_FULL("dnsTTL", CERT_PEN, 199, 4, FB_IE_F_ENDIAN,
623  0, 0, FB_UINT_32, NULL),
624  FB_IE_INIT_FULL("dnsTXTData", CERT_PEN, 208, FB_IE_VARLEN, NONE,
625  0, 0, FB_STRING, NULL),
626  FB_IE_INIT_FULL("dnsSOASerial", CERT_PEN, 209, 4, FB_IE_F_ENDIAN,
627  0, 0, FB_UINT_32, NULL),
628  FB_IE_INIT_FULL("dnsSOARefresh", CERT_PEN, 210, 4, FB_IE_F_ENDIAN,
629  0, 0, FB_UINT_32, NULL),
630  FB_IE_INIT_FULL("dnsSOARetry", CERT_PEN, 211, 4, FB_IE_F_ENDIAN,
631  0, 0, FB_UINT_32, NULL),
632  FB_IE_INIT_FULL("dnsSOAExpire", CERT_PEN, 212, 4, FB_IE_F_ENDIAN,
633  0, 0, FB_UINT_32, NULL),
634  FB_IE_INIT_FULL("dnsSOAMinimum", CERT_PEN, 213, 4, FB_IE_F_ENDIAN,
635  0, 0, FB_UINT_32, NULL),
636  FB_IE_INIT_FULL("dnsSOAMName", CERT_PEN, 214, FB_IE_VARLEN, NONE,
637  0, 0, FB_STRING, NULL),
638  FB_IE_INIT_FULL("dnsSOARName", CERT_PEN, 215, FB_IE_VARLEN, NONE,
639  0, 0, FB_STRING, NULL),
640  FB_IE_INIT_FULL("dnsSRVPriority", CERT_PEN, 216, 2, FB_IE_F_ENDIAN,
641  0, 0, FB_UINT_16, NULL),
642  FB_IE_INIT_FULL("dnsSRVWeight", CERT_PEN, 217, 2, FB_IE_F_ENDIAN,
643  0, 0, FB_UINT_16, NULL),
644  FB_IE_INIT_FULL("dnsSRVPort", CERT_PEN, 218, 2, FB_IE_F_ENDIAN,
645  0, 0, FB_UINT_16, NULL),
646  FB_IE_INIT_FULL("dnsSRVTarget", CERT_PEN, 219, FB_IE_VARLEN, NONE,
647  0, 0, FB_STRING, NULL),
648  FB_IE_INIT_FULL("dnsID", CERT_PEN, 226, 2, FB_IE_F_ENDIAN,
649  0, 0, FB_UINT_16, NULL),
650  /* dnssec IEs */
651  FB_IE_INIT_FULL("dnsAlgorithm", CERT_PEN, 227, 1, FB_IE_F_ENDIAN,
652  0, 0, FB_UINT_8, NULL),
653  FB_IE_INIT_FULL("dnsKeyTag", CERT_PEN, 228, 2, FB_IE_F_ENDIAN,
654  0, 0, FB_UINT_16, NULL),
655  FB_IE_INIT_FULL("dnsSigner", CERT_PEN, 229, FB_IE_VARLEN, NONE,
656  0, 0, FB_STRING, NULL),
657  FB_IE_INIT_FULL("dnsSignature", CERT_PEN, 230, FB_IE_VARLEN, NONE,
658  0, 0, FB_OCTET_ARRAY, NULL),
659  FB_IE_INIT_FULL("dnsDigest", CERT_PEN, 231, FB_IE_VARLEN, NONE,
660  0, 0, FB_OCTET_ARRAY, NULL),
661  FB_IE_INIT_FULL("dnsPublicKey", CERT_PEN, 232, FB_IE_VARLEN, NONE,
662  0, 0, FB_OCTET_ARRAY, NULL),
663  FB_IE_INIT_FULL("dnsSalt", CERT_PEN, 233, FB_IE_VARLEN, NONE,
664  0, 0, FB_OCTET_ARRAY, NULL),
665  FB_IE_INIT_FULL("dnsHashData", CERT_PEN, 234, FB_IE_VARLEN, NONE,
666  0, 0, FB_OCTET_ARRAY, NULL),
667  FB_IE_INIT_FULL("dnsIterations", CERT_PEN, 235, 2, FB_IE_F_ENDIAN,
668  0, 0, FB_UINT_16, NULL),
669  FB_IE_INIT_FULL("dnsSignatureExpiration", CERT_PEN, 236, 4,
670  FB_IE_F_ENDIAN, 0, 0, FB_UINT_32, NULL),
671  FB_IE_INIT_FULL("dnsSignatureInception", CERT_PEN, 237, 4, FB_IE_F_ENDIAN,
672  0, 0, FB_UINT_32, NULL),
673  FB_IE_INIT_FULL("dnsDigestType", CERT_PEN, 238, 1, FB_IE_F_ENDIAN,
674  0, 0, FB_UINT_8, NULL),
675  FB_IE_INIT_FULL("dnsLabels", CERT_PEN, 239, 1, FB_IE_F_ENDIAN,
676  0, 0, FB_UINT_8, NULL),
677  FB_IE_INIT_FULL("dnsTypeCovered", CERT_PEN, 240, 2, FB_IE_F_ENDIAN,
678  0, 0, FB_UINT_16, NULL),
679  FB_IE_INIT_FULL("dnsFlags", CERT_PEN, 241, 2,
680  FB_IE_F_ENDIAN | FB_IE_FLAGS, 0, 0, FB_UINT_16, NULL),
681  /* ssl IEs */
682  FB_IE_INIT_FULL("sslCipher", CERT_PEN, 185, 4, FB_IE_F_ENDIAN,
683  0, 0, FB_UINT_32, NULL),
684  FB_IE_INIT_FULL("sslClientVersion", CERT_PEN, 186, 1, FB_IE_F_ENDIAN,
685  0, 0, FB_UINT_8, NULL),
686  FB_IE_INIT_FULL("sslServerCipher", CERT_PEN, 187, 4, FB_IE_F_ENDIAN,
687  0, 0, FB_UINT_32, NULL),
688  FB_IE_INIT_FULL("sslCompressionMethod", CERT_PEN, 188, 1, FB_IE_F_ENDIAN,
689  0, 0, FB_UINT_8, NULL),
690  FB_IE_INIT_FULL("sslCertVersion", CERT_PEN, 189, 1, FB_IE_F_ENDIAN,
691  0, 0, FB_UINT_8, NULL),
692  FB_IE_INIT_FULL("sslCertSignature", CERT_PEN, 190, FB_IE_VARLEN, NONE,
693  0, 0, FB_OCTET_ARRAY, NULL),
694  FB_IE_INIT_FULL("sslCertSerialNumber", CERT_PEN, 244, FB_IE_VARLEN, NONE,
695  0, 0, FB_STRING, NULL),
696  FB_IE_INIT_FULL("sslObjectType", CERT_PEN, 245, 1, FB_IE_F_ENDIAN,
697  0, 0, FB_UINT_8, NULL),
698  FB_IE_INIT_FULL("sslObjectValue", CERT_PEN, 246, FB_IE_VARLEN, NONE,
699  0, 0, FB_OCTET_ARRAY, NULL),
700  FB_IE_INIT_FULL("sslCertValidityNotBefore", CERT_PEN, 247, FB_IE_VARLEN,
701  NONE, 0, 0, FB_STRING, NULL),
702  FB_IE_INIT_FULL("sslCertValidityNotAfter", CERT_PEN, 248, FB_IE_VARLEN,
703  NONE, 0, 0, FB_STRING, NULL),
704  FB_IE_INIT_FULL("sslPublicKeyAlgorithm", CERT_PEN, 249, FB_IE_VARLEN,
705  NONE, 0, 0, FB_OCTET_ARRAY, NULL),
706  FB_IE_INIT_FULL("sslPublicKeyLength", CERT_PEN, 250, 2, FB_IE_F_ENDIAN,
707  0, 0, FB_UINT_16, NULL),
708  /* mysql IEs */
709  FB_IE_INIT_FULL("mysqlUsername", CERT_PEN, 223, FB_IE_VARLEN, NONE,
710  0, 0, FB_STRING, NULL),
711  FB_IE_INIT_FULL("mysqlCommandCode", CERT_PEN, 224, 1, FB_IE_F_ENDIAN,
712  0, 0, FB_UINT_8, NULL),
713  FB_IE_INIT_FULL("mysqlCommandText", CERT_PEN, 225, FB_IE_VARLEN, NONE,
714  0, 0, FB_STRING, NULL),
715  /* dnp3.0 IEs */
716  FB_IE_INIT_FULL("dnp3SourceAddress", CERT_PEN, 281, 2, FB_IE_F_ENDIAN,
717  0, 0, FB_UINT_16, NULL),
718  FB_IE_INIT_FULL("dnp3DestinationAddress", CERT_PEN, 282, 2,
719  FB_IE_F_ENDIAN, 0, 0, FB_UINT_16, NULL),
720  FB_IE_INIT_FULL("dnp3Function", CERT_PEN, 283, 1, FB_IE_F_ENDIAN,
721  0, 0, FB_UINT_8, NULL),
722  FB_IE_INIT_FULL("dnp3ObjectData", CERT_PEN, 284, FB_IE_VARLEN, NONE,
723  0, 0, FB_OCTET_ARRAY, NULL),
724  FB_IE_INIT_FULL("modbusData", CERT_PEN, 285, FB_IE_VARLEN, NONE,
725  0, 0, FB_OCTET_ARRAY, NULL),
726  FB_IE_INIT_FULL("ethernetIPData", CERT_PEN, 286, FB_IE_VARLEN, NONE,
727  0, 0, FB_OCTET_ARRAY, NULL),
728  FB_IE_INIT_FULL("rtpPayloadType", CERT_PEN, 287, 1, ER,
729  0, 0, FB_UINT_8, NULL),
730  FB_IE_INIT_FULL("sslRecordVersion", CERT_PEN, 288, 2, FB_IE_F_ENDIAN,
731  0, 0, FB_UINT_16, NULL),
732  FB_IE_NULL
733 };
734 
735 static fbInfoElement_t yaf_dhcp_info_elements[] = {
736  FB_IE_INIT_FULL("dhcpFingerPrint", CERT_PEN, 242, FB_IE_VARLEN,
737  FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
738  FB_IE_INIT_FULL("dhcpVendorCode", CERT_PEN, 243, FB_IE_VARLEN,
739  FB_IE_F_REVERSIBLE, 0, 0, FB_STRING, NULL),
740  FB_IE_NULL
741 };
742 
743 
744 
745 
746 #endif /* YAF_NEW_FIXBUF */
747 
748 #endif
749 
750 #endif
#define CERT_PEN
This is the CERT Private Enterprise Number (PEN) assigned by IANA, used to define our enterprise data...
Definition: yafcore.h:110