26 #ifndef __CORSARO_IO_H
27 #define __CORSARO_IO_H
45 #define CORSARO_IO_HEADER_FIXED_BYTE_LEN (4+4+1+1+4+2)
48 #define CORSARO_IO_INTERVAL_HEADER_BYTE_LEN sizeof(corsaro_interval_t)
52 #define CORSARO_IO_TRAILER_BYTE_LEN sizeof(corsaro_trailer_t)
56 #define CORSARO_IO_PLUGIN_PATTERN 'P'
58 #define CORSARO_IO_PLUGIN_PATTERN_STR "%P"
61 #define CORSARO_IO_MONITOR_PATTERN 'N'
63 #define CORSARO_IO_MONITOR_PATTERN_STR "%N"
66 #define CORSARO_IO_GLOBAL_NAME "global"
68 #define CORSARO_IO_LOG_NAME "log"
83 const char *plugin_name,
99 const char *plugin_name,
327 off_t offset, off_t len);
Structure representing the start or end of an interval.
An opaque structure defining an corsaro input file.
off_t corsaro_io_write_record(corsaro_t *corsaro, corsaro_file_t *file, corsaro_in_record_type_t record_type, corsaro_in_record_t *record)
Write a generic corsaro record to the file.
off_t corsaro_io_read_plugin_start(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read the appropriate plugin header from the file.
Header file dealing with the corsaro plugin manager.
void corsaro_io_print_interval_start(corsaro_interval_t *int_start)
Write the interval headers to stdout.
An opaque structure defining an corsaro output file.
A reusable opaque structure for corsaro to read an input record into.
void corsaro_io_print_interval_end(corsaro_interval_t *int_end)
Write the interval trailers to stdout.
corsaro_file_t * corsaro_io_prepare_file_full(corsaro_t *corsaro, const char *plugin_name, corsaro_interval_t *interval, corsaro_file_mode_t mode, corsaro_file_compress_t compress, int compress_level, int flags)
Uses the given settings to open an corsaro file for the given plugin.
off_t corsaro_io_read_plugin_end(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read the appropriate plugin trailer from the file.
off_t corsaro_io_read_trailer(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read the corsaro trailers from the file.
void corsaro_io_print_trailer(corsaro_trailer_t *trailer)
Write the corsaro trailers to stdout.
off_t corsaro_io_read_bytes_offset(corsaro_in_t *corsaro, corsaro_in_record_t *record, off_t offset, off_t len)
Read the given number of bytes into the record buffer at the given offset.
Holds the metadata for the plugin manager.
Structure representing a corsaro file trailer.
corsaro_file_t * corsaro_io_prepare_file(corsaro_t *corsaro, const char *plugin_name, corsaro_interval_t *interval)
Uses the current settings to open an corsaro file for the given plugin.
off_t corsaro_io_read_interval_end(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read the appropriate interval trailers from the file.
off_t corsaro_io_write_interval_end(corsaro_t *corsaro, corsaro_file_t *file, corsaro_interval_t *int_end)
Write the appropriate interval trailers to the file.
Header file dealing with the low-level file IO.
off_t corsaro_io_write_header(corsaro_t *corsaro, corsaro_file_t *file, corsaro_header_t *header)
Write the corsaro headers to the file.
static int interval
The amount of time to wait until we dump the hash.
static corsaro_in_record_t * record
A pointer to a corsaro record.
off_t corsaro_io_read_interval_start(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read the appropriate interval headers from the file.
int corsaro_io_template_has_timestamp(corsaro_t *corsaro)
Determines whether there are any time-related patterns in the file template.
off_t corsaro_io_read_bytes(corsaro_in_t *corsaro, corsaro_in_record_t *record, off_t len)
Read the given number of bytes into the record.
int corsaro_io_print_record(corsaro_plugin_manager_t *plugin_manager, corsaro_in_record_type_t record_type, corsaro_in_record_t *record)
Print a generic corsaro record to stdout.
enum corsaro_file_compress corsaro_file_compress_t
Supported compression types (must be kept in sync with wandio)
int corsaro_io_validate_template(corsaro_t *corsaro, char *template)
Validates a output file template for needed features.
off_t corsaro_io_write_plugin_end(corsaro_t *corsaro, corsaro_file_t *file, corsaro_plugin_t *plugin)
Write the appropriate plugin trailer to the file.
void corsaro_io_print_header(corsaro_plugin_manager_t *plugin_manager, corsaro_header_t *header)
Write the corsaro headers to stdout.
off_t corsaro_io_write_trailer(corsaro_t *corsaro, corsaro_file_t *file, corsaro_trailer_t *trailer)
Write the corsaro trailers to the file.
off_t corsaro_io_write_interval_start(corsaro_t *corsaro, corsaro_file_t *file, corsaro_interval_t *int_start)
Write the appropriate interval headers to the file.
enum corsaro_file_mode corsaro_file_mode_t
Enum of supported file modes.
off_t corsaro_io_write_plugin_start(corsaro_t *corsaro, corsaro_file_t *file, corsaro_plugin_t *plugin)
Write the appropriate plugin header to the file.
off_t corsaro_io_read_header(corsaro_in_t *corsaro, corsaro_file_in_t *file, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
Read an corsaro header from the file.
enum corsaro_in_record_type corsaro_in_record_type_t
Corsaro input record types.
An corsaro packet processing plugin.
Header file dealing with the internal corsaro functions.