Header file dealing with the low-level file IO. More...

This graph shows which files directly or indirectly include this file:

Data Structures
struct	corsaro_file
	An opaque structure defining an corsaro output file. More...

struct	corsaro_file_in
	An opaque structure defining an corsaro input file. More...

Macros
#define	CORSARO_FILE_COMPRESS_LEVEL_DEFAULT 6
	The default compression level. More...

#define	CORSARO_FILE_ZLIB_SUFFIX ".gz"
	The suffix used to detect gzip output is desired. More...

#define	CORSARO_FILE_BZ2_SUFFIX ".bz2"
	The suffix used to detect bzip output is desired. More...

#define	CORSARO_FILE_MODE(file) (file->mode)
	Accessor macro for getting the mode of a file. More...

#define	state_wandio mode_state.ms_wandio
	Shortcut to the non-trace (wandio) state structure. More...

#define	wand_io mode_state.ms_wandio.io
	Shortcut to a non-trace io object. More...

#define	state_trace mode_state.ms_trace
	Shortcut to the trace state structure. More...

#define	trace_io mode_state.ms_trace.trace
	Shortcut to the libtrace object. More...

Typedefs
typedef struct corsaro_file	corsaro_file_t
	An opaque structure defining an corsaro output file. More...

typedef struct corsaro_file_in	corsaro_file_in_t
	An opaque structure defining an corsaro input file. More...

Functions
Corsaro file output API functions
These are the functions that should be called by the plugins to open and write to files with the corsaro IO sub-system.
corsaro_file_compress_t	corsaro_file_detect_compression (char *filename)
	Attempts to detect the type of compression for a file based on the suffix. More...

corsaro_file_t *	corsaro_file_open (struct corsaro corsaro, const char filename, corsaro_file_mode_t mode, corsaro_file_compress_t compress_type, int compress_level, int flags)
	Creates a new corsaro file write and opens the provided file for writing. More...

off_t	corsaro_file_write (struct corsaro corsaro, corsaro_file_t file, const void *buffer, off_t len)
	Writes the contents of a buffer using an corsaro output file. More...

off_t	corsaro_file_write_packet (struct corsaro corsaro, corsaro_file_t file, libtrace_packet_t *packet)
	Write a libtrace packet to an corsaro output file. More...

off_t	corsaro_file_vprintf (struct corsaro corsaro, corsaro_file_t file, const char *format, va_list args)
	Print a string to an corsaro file. More...

off_t	corsaro_file_printf (struct corsaro corsaro, corsaro_file_t file, const char *format,...)
	Print a string to an corsaro file. More...

void	corsaro_file_flush (struct corsaro corsaro, corsaro_file_t file)
	Force all buffered data for the file to be written out. More...

void	corsaro_file_close (struct corsaro corsaro, corsaro_file_t file)
	Closes an corsaro output file and frees the writer structure. More...

Corsaro file input API functions
These are the functions that should be called by the plugins to open and read from files with the corsaro IO sub-system. Todo: create a corsaro_file_rreadline function?
corsaro_file_in_t *	corsaro_file_ropen (const char *filename)
	Creates a new corsaro file reader and opens the provided file for reading. More...

off_t	corsaro_file_rread (corsaro_file_in_t file, void buffer, off_t len)
	Reads from an corsaro input file into the provided buffer. More...

off_t	corsaro_file_rgets (corsaro_file_in_t file, void buffer, off_t len)
	Reads a string from an corsaro input file into the provided buffer. More...

off_t	corsaro_file_rread_packet (corsaro_file_in_t file, libtrace_packet_t packet, uint16_t len)
	Read a libtrace packet from an corsaro input file. More...

off_t	corsaro_file_rpeek (corsaro_file_in_t file, void buffer, off_t len)
	Reads from an corsaro input file into the provided buffer, but does not update the read pointer. More...

off_t	corsaro_file_rseek (corsaro_file_in_t *file, off_t offset, int whence)
	Changes the read pointer offset to the specified value for an corsaro input file. More...

off_t	corsaro_file_rtell (corsaro_file_in_t *file)
	Returns the current offset of the read pointer for an corsaro input file. More...

void	corsaro_file_rclose (corsaro_file_in_t *file)
	Closes an corsaro input file and frees the reader structure. More...

Detailed Description

Header file dealing with the low-level file IO.

Author: Alistair King

Definition in file corsaro_file.h.

Macro Definition Documentation

#define CORSARO_FILE_BZ2_SUFFIX ".bz2"

The suffix used to detect bzip output is desired.

Definition at line 57 of file corsaro_file.h.

#define CORSARO_FILE_COMPRESS_LEVEL_DEFAULT 6

The default compression level.

Todo:: make this an option to corsaro_main.c and corsaro_alloc_output

Definition at line 51 of file corsaro_file.h.

Referenced by corsaro_init().

#define CORSARO_FILE_MODE ( file ) (file->mode)

Accessor macro for getting the mode of a file.

Definition at line 113 of file corsaro_file.h.

Referenced by corsaro_dos_end_interval(), corsaro_flowtuple_end_interval(), corsaro_flowtuple_probe_file(), corsaro_io_write_header(), corsaro_io_write_interval_end(), corsaro_io_write_interval_start(), corsaro_io_write_plugin_end(), corsaro_io_write_plugin_start(), and corsaro_io_write_trailer().

#define CORSARO_FILE_ZLIB_SUFFIX ".gz"

The suffix used to detect gzip output is desired.

Definition at line 54 of file corsaro_file.h.

#define state_trace mode_state.ms_trace

Shortcut to the trace state structure.

Definition at line 121 of file corsaro_file.h.

#define state_wandio mode_state.ms_wandio

Shortcut to the non-trace (wandio) state structure.

Definition at line 116 of file corsaro_file.h.

#define trace_io mode_state.ms_trace.trace

Shortcut to the libtrace object.

Definition at line 123 of file corsaro_file.h.

#define wand_io mode_state.ms_wandio.io

Shortcut to a non-trace io object.

Definition at line 118 of file corsaro_file.h.

Typedef Documentation

typedef struct corsaro_file_in corsaro_file_in_t

An opaque structure defining an corsaro input file.

typedef struct corsaro_file corsaro_file_t

An opaque structure defining an corsaro output file.

Function Documentation

void corsaro_file_close	(	struct corsaro *	corsaro,
		corsaro_file_t *	file
	)

Closes an corsaro output file and frees the writer structure.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to close

Definition at line 230 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, and corsaro_file::mode.

Referenced by corsaro_dos_close_output(), corsaro_dos_end_interval(), corsaro_flowtuple_close_output(), corsaro_flowtuple_end_interval(), corsaro_free(), corsaro_log_close(), corsaro_pcap_close_output(), corsaro_pcap_end_interval(), corsaro_smee_close_output(), corsaro_smee_start_interval(), and end_interval().

corsaro_file_compress_t corsaro_file_detect_compression ( char * filename )

Attempts to detect the type of compression for a file based on the suffix.

Parameters

filename The name of the file to check

Returns: the compression type to use, -1 if an error occurs

Definition at line 54 of file corsaro_file.c.

Referenced by corsaro_init().

void corsaro_file_flush	(	struct corsaro *	corsaro,
		corsaro_file_t *	file
	)

Force all buffered data for the file to be written out.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to flush

Definition at line 224 of file corsaro_file.c.

corsaro_file_t* corsaro_file_open	(	struct corsaro *	corsaro,
		const char *	filename,
		corsaro_file_mode_t	mode,
		corsaro_file_compress_t	compress_type,
		int	compress_level,
		int	flags
	)

Creates a new corsaro file write and opens the provided file for writing.

Parameters

corsaro	The corsaro object the file is associated with
filename	The name of the file to open
mode	The corsaro output mode to use when writing
compress_type	Compression type
compress_level	The compression level to use when writing
flags	Flags to apply when opening the file, e.g. O_CREATE

Returns: A pointer to a new corsaro output file, or NULL if an error occurs

Definition at line 59 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, corsaro_log(), and corsaro_file::mode.

Referenced by corsaro_io_prepare_file_full().

off_t corsaro_file_printf	(	struct corsaro *	corsaro,
		corsaro_file_t *	file,
		const char *	format,
			...
	)

Print a string to an corsaro file.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to write to
format	The format string to write
...	The arguments to the format string

Returns: The amount of data written, or -1 if an error occurs

The arguments for this function are the same as those for printf(3). See the printf(3) manpage for more details.

Definition at line 214 of file corsaro_file.c.

References corsaro_file_vprintf().

Referenced by ascii_dump(), corsaro_dos_attack_vector_fprint(), corsaro_dos_end_interval(), corsaro_dos_global_header_fprint(), corsaro_dos_header_fprint(), corsaro_flowtuple_class_end_fprint(), corsaro_flowtuple_class_start_fprint(), and corsaro_flowtuple_fprint().

void corsaro_file_rclose ( corsaro_file_in_t * file )

Closes an corsaro input file and frees the reader structure.

Parameters

file	The file to close

Definition at line 428 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

Referenced by corsaro_filtergeo_init_output(), corsaro_filterpfx_init_output(), corsaro_flowtuple_probe_file(), corsaro_geodb_init_output(), corsaro_in_free(), and corsaro_pfx2as_init_output().

off_t corsaro_file_rgets	(	corsaro_file_in_t *	file,
		void *	buffer,
		off_t	len
	)

Reads a string from an corsaro input file into the provided buffer.

Parameters

file	The file to read from
buffer	The buffer to read into
len	The size of the buffer

Returns: The amount of bytes read, 0 if EOF is reached, -1 if an error occurs

This function is almost identical to fgets(3), it will read at most one less than len bytes from the file and store them in buffer. Reading stops after an EOF or a newline. If a newline is read, it is stored in the buffer. A null byte will also be stored after the last character in the buffer.

Definition at line 343 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

Referenced by read_country_file(), read_pfx_file(), and read_routeviews().

corsaro_file_in_t* corsaro_file_ropen ( const char * filename )

Creates a new corsaro file reader and opens the provided file for reading.

Parameters

filename The name of the file to open

Returns: A pointer to a new corsaro input file, or NULL if an error occurs

This function will use wandio/libtrace to attempt to detect the compression format used for given file (if any), provided that libtrace was built with the appropriate libraries. It will also attempt to detect the mode that was used to write the file.

Definition at line 256 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

Referenced by corsaro_filtergeo_init_output(), corsaro_filterpfx_init_output(), corsaro_flowtuple_probe_file(), corsaro_geodb_init_output(), corsaro_pfx2as_init_output(), and corsaro_start_input().

off_t corsaro_file_rpeek	(	corsaro_file_in_t *	file,
		void *	buffer,
		off_t	len
	)

Reads from an corsaro input file into the provided buffer, but does not update the read pointer.

Parameters

file	The file to read from
buffer	The buffer to read into
len	The size of the buffer

Returns: The amount of bytes read, 0 if EOF is reached, -1 if an error occurs

Definition at line 395 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

Referenced by check_global_magic(), corsaro_flowtuple_probe_magic(), is_plugin_data_or_interval(), and is_trailer_or_interval().

off_t corsaro_file_rread	(	corsaro_file_in_t *	file,
		void *	buffer,
		off_t	len
	)

Reads from an corsaro input file into the provided buffer.

Parameters

file	The file to read from
buffer	The buffer to read into
len	The size of the buffer

Returns: The amount of bytes read, 0 if EOF is reached, -1 if an error occurs

Definition at line 332 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

Referenced by corsaro_io_read_bytes(), corsaro_io_read_bytes_offset(), read_blocks(), and read_locations().

off_t corsaro_file_rread_packet	(	corsaro_file_in_t *	file,
		libtrace_packet_t *	packet,
		uint16_t	len
	)

Read a libtrace packet from an corsaro input file.

Parameters

file	The file to read from
packet	The packet to read into
len	The size of the packet to be read

Returns: The amount of bytes read, 0 if EOF is reached, -1 if an error occurs

This can be used on Corsaro Binary and Libtrace mode file to retrieve a single packet. If the file is in trace mode, the len parameter is ignored.

Definition at line 356 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

off_t corsaro_file_rseek	(	corsaro_file_in_t *	file,
		off_t	offset,
		int	whence
	)

Changes the read pointer offset to the specified value for an corsaro input file.

Parameters

file	The file to adjust the read pointer for
offset	The new offset for the read pointer
whence	Indicates where to set the read pointer from. Can be one of SEEK_SET, SEEK_CUR or SEEK_END.

Returns: The new value for the read pointer, or -1 if an error occurs

The arguments for this function are the same as those for lseek(2). See the lseek(2) manpage for more details.

Definition at line 406 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

off_t corsaro_file_rtell ( corsaro_file_in_t * file )

Returns the current offset of the read pointer for an corsaro input file.

Parameters

file	The file to get the read offset for

Returns: The offset of the read pointer, or -1 if an error occurs

Definition at line 417 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file_in::mode.

off_t corsaro_file_vprintf	(	struct corsaro *	corsaro,
		corsaro_file_t *	file,
		const char *	format,
		va_list	args
	)

Print a string to an corsaro file.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to write to
format	The format string to write
args	The arguments to the format string

Returns: The amount of data written, or -1 if an error occurs

The arguments for this function are the same as those for vprintf(3). See the vprintf(3) manpage for more details.

Definition at line 200 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file::mode.

Referenced by corsaro_file_printf().

off_t corsaro_file_write	(	struct corsaro *	corsaro,
		corsaro_file_t *	file,
		const void *	buffer,
		off_t	len
	)

Writes the contents of a buffer using an corsaro output file.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to write the data to
buffer	The buffer to write out
len	The amount of writable data in the buffer

Returns: The amount of data written, or -1 if an error occurs

Definition at line 142 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_UNKNOWN, and corsaro_file::mode.

Referenced by binary_dump(), corsaro_dos_end_interval(), and corsaro_file_write_packet().

off_t corsaro_file_write_packet	(	struct corsaro *	corsaro,
		corsaro_file_t *	file,
		libtrace_packet_t *	packet
	)

Write a libtrace packet to an corsaro output file.

Parameters

corsaro	The corsaro object the file is associated with
file	The file to write the packet to
packet	The packet to written

Returns: The amount of bytes written, 0 if EOF is reached, -1 if an error occurs

This can be used on Corsaro Binary and Libtrace mode file to write a single packet.

Definition at line 154 of file corsaro_file.c.

References CORSARO_FILE_MODE_ASCII, CORSARO_FILE_MODE_BINARY, CORSARO_FILE_MODE_TRACE, corsaro_file_write(), corsaro_log(), and corsaro_file::mode.

Referenced by corsaro_pcap_process_packet().

Data Structures

Macros

Typedefs

Functions

Detailed Description

Macro Definition Documentation

Typedef Documentation

Function Documentation