Skip to content

Stream object

Philippe Proulx edited this page Sep 10, 2020 · 10 revisions

A CTF stream.

Stream objects are used in the streams property of the metadata object.

Properties

Property Type Description Required? Default value
$default Boolean True if this stream is the default stream Optional false
packet-context-type Type object or string (alias name) Type of packet context (must be a Structure type object) Required N/A
event-header-type Type object or string (alias name) Type of event header (must be a Structure type object) Optional No event header
event-context-type Type object or string (alias name) Type of stream event context (must be a Structure type object) Optional No stream event context
events Associative array of event names (string) to Event objects Stream events Required N/A
$include (Including external YAML files) String or array of strings Include base properties from external YAML file(s) Optional []

All the properties which have a default value can also be set to null to force this default value. This is especially useful when including external YAML files.

The $default property, if true, must not be set to false in other streams. Note that you can also set the default stream by name with the $default-stream property of the metadata object.

Each field of the packet context structure type (packet-context-type property) corresponds to one parameter of the generated packet opening function (prefixed with pc_), except for the following special fields, which are automatically written if present:

The timestamp_end field must exist if the timestamp_begin field exists, and vice versa.

Each field of the event header structure type (event-header-type property) corresponds to one parameter of the generated tracing function (prefixed with ecc_) (for a given event), except for the following special fields, which are automatically written if present:

The id field must exist if there's more than one defined event in the stream.

Each field of the stream event context structure type (event-context-type property) corresponds to one parameter of the generated tracing function (prefixed with eh_) (for a given event).

Each field name of the packet-context-type, event-header-type, and event-context-type properties must be a valid C identifier.

The events property must contain at least one entry.

Example

$default: true
packet-context-type:
  class: struct
  fields:
    timestamp_begin: clock-int
    timestamp_end: clock-int
    packet_size: uint32
    content_size: uint32
    events_discarded: uint16
    my_custom_field: int12
event-header-type:
  class: struct
  fields:
    id: uint16
    timestamp: clock-int
event-context-type:
  class: struct
  fields:
    obj_id: uint8
events:
  msg_in:
    payload-type: msg-type