corsaro_pcap.c File Reference

Corsaro raw pcap pass-through plugin. More...

Go to the source code of this file.

Macros
#define	CORSARO_PCAP_MAGIC   0x50434150
	The magic number for this plugin - "PCAP". More...
#define	PLUGIN_NAME   "pcap"
	The name of this plugin. More...
#define	OUTFILE_POINTERS   2
	The number of output file pointers to support non-blocking close at the end of an interval. More...
#define	STATE(corsaro)   (CORSARO_PLUGIN_STATE(corsaro, pcap, CORSARO_PLUGIN_ID_PCAP))
	Extends the generic plugin state convenience macro in corsaro_plugin.h. More...
#define	PLUGIN(corsaro)   (CORSARO_PLUGIN_PLUGIN(corsaro, CORSARO_PLUGIN_ID_PCAP))
	Extends the generic plugin plugin convenience macro in corsaro_plugin.h. More...

Functions
corsaro_plugin_t *	corsaro_pcap_alloc (corsaro_t *corsaro)
	Implements the alloc function of the plugin API. More...
int	corsaro_pcap_probe_filename (const char *fname)
	Implements the probe_filename function of the plugin API. More...
int	corsaro_pcap_probe_magic (corsaro_in_t *corsaro, corsaro_file_in_t *file)
	Implements the probe_magic function of the plugin API. More...
int	corsaro_pcap_init_output (corsaro_t *corsaro)
	Implements the init_output function of the plugin API. More...
int	corsaro_pcap_init_input (corsaro_in_t *corsaro)
	Implements the init_output function of the plugin API. More...
int	corsaro_pcap_close_input (corsaro_in_t *corsaro)
	Implements the close_input function of the plugin API. More...
int	corsaro_pcap_close_output (corsaro_t *corsaro)
	Implements the close_output function of the plugin API. More...
off_t	corsaro_pcap_read_record (struct corsaro_in *corsaro, corsaro_in_record_type_t *record_type, corsaro_in_record_t *record)
	Implements the read_record function of the plugin API. More...
off_t	corsaro_pcap_read_global_data_record (struct corsaro_in *corsaro, enum corsaro_in_record_type *record_type, struct corsaro_in_record *record)
	Implements the read_global_data_record function of the plugin API. More...
int	corsaro_pcap_start_interval (corsaro_t *corsaro, corsaro_interval_t *int_start)
	Implements the start_interval function of the plugin API. More...
int	corsaro_pcap_end_interval (corsaro_t *corsaro, corsaro_interval_t *int_end)
	Implements the end_interval function of the plugin API. More...
int	corsaro_pcap_process_packet (corsaro_t *corsaro, corsaro_packet_t *packet)
	Implements the process_packet function of the plugin API. More...

Variables
static corsaro_plugin_t	corsaro_pcap_plugin
	Common plugin information across all instances. More...

Detailed Description

Corsaro raw pcap pass-through plugin.

Author

Alistair King

Definition in file corsaro_pcap.c.

Macro Definition Documentation

#define CORSARO_PCAP_MAGIC   0x50434150

The magic number for this plugin - "PCAP".

Definition at line 55 of file corsaro_pcap.c.

#define OUTFILE_POINTERS   2

The number of output file pointers to support non-blocking close at the end of an interval.

If the wandio buffers are large enough that it takes more than 1 interval to drain the buffers, consider increasing this number

Definition at line 63 of file corsaro_pcap.c.

Referenced by corsaro_pcap_close_output(), and corsaro_pcap_end_interval().

#define PLUGIN

(

corsaro

)

(CORSARO_PLUGIN_PLUGIN(corsaro, CORSARO_PLUGIN_ID_PCAP))

Extends the generic plugin plugin convenience macro in corsaro_plugin.h.

Definition at line 88 of file corsaro_pcap.c.

Referenced by corsaro_pcap_close_output(), corsaro_pcap_init_output(), and corsaro_pcap_start_interval().

#define PLUGIN_NAME   "pcap"

The name of this plugin.

Definition at line 58 of file corsaro_pcap.c.

#define STATE

(

corsaro

)

(CORSARO_PLUGIN_STATE(corsaro, pcap, CORSARO_PLUGIN_ID_PCAP))

Extends the generic plugin state convenience macro in corsaro_plugin.h.

Definition at line 85 of file corsaro_pcap.c.

Referenced by corsaro_pcap_close_output(), corsaro_pcap_end_interval(), corsaro_pcap_process_packet(), and corsaro_pcap_start_interval().

Function Documentation

corsaro_plugin_t* corsaro_pcap_alloc

(

corsaro_t *

corsaro

)

Implements the alloc function of the plugin API.

Definition at line 94 of file corsaro_pcap.c.

References corsaro_pcap_plugin.

int corsaro_pcap_close_input

(

corsaro_in_t *

corsaro

)

Implements the close_input function of the plugin API.

Definition at line 144 of file corsaro_pcap.c.

int corsaro_pcap_close_output

(

corsaro_t *

corsaro

)

Implements the close_output function of the plugin API.

Definition at line 150 of file corsaro_pcap.c.

References corsaro_file_close(), corsaro_plugin_free_state(), OUTFILE_POINTERS, PLUGIN, corsaro::plugin_manager, and STATE.

Referenced by corsaro_pcap_init_output().

int corsaro_pcap_end_interval	(	corsaro_t *	corsaro,
		corsaro_interval_t *	int_end
	)

Implements the end_interval function of the plugin API.

Definition at line 221 of file corsaro_pcap.c.

References corsaro_file_close(), corsaro_is_rotate_interval(), OUTFILE_POINTERS, and STATE.

int corsaro_pcap_init_input

(

corsaro_in_t *

corsaro

)

Implements the init_output function of the plugin API.

Definition at line 138 of file corsaro_pcap.c.

int corsaro_pcap_init_output

(

corsaro_t *

corsaro

)

Implements the init_output function of the plugin API.

Definition at line 114 of file corsaro_pcap.c.

References corsaro_log(), corsaro_pcap_close_output(), corsaro_plugin_register_state(), malloc_zero(), PLUGIN, and corsaro::plugin_manager.

int corsaro_pcap_probe_filename

(

const char *

fname

)

Implements the probe_filename function of the plugin API.

Definition at line 100 of file corsaro_pcap.c.

int corsaro_pcap_probe_magic	(	corsaro_in_t *	corsaro,
		corsaro_file_in_t *	file
	)

Implements the probe_magic function of the plugin API.

Definition at line 107 of file corsaro_pcap.c.

int corsaro_pcap_process_packet	(	corsaro_t *	corsaro,
		corsaro_packet_t *	packet
	)

Implements the process_packet function of the plugin API.

Definition at line 249 of file corsaro_pcap.c.

References corsaro_file_write_packet(), corsaro_log(), LT_PKT, and STATE.

off_t corsaro_pcap_read_global_data_record	(	struct corsaro_in *	corsaro,
		enum corsaro_in_record_type *	record_type,
		struct corsaro_in_record *	record
	)

Implements the read_global_data_record function of the plugin API.

Definition at line 186 of file corsaro_pcap.c.

off_t corsaro_pcap_read_record	(	struct corsaro_in *	corsaro,
		corsaro_in_record_type_t *	record_type,
		corsaro_in_record_t *	record
	)

Implements the read_record function of the plugin API.

Definition at line 175 of file corsaro_pcap.c.

References corsaro_log_in().

int corsaro_pcap_start_interval	(	corsaro_t *	corsaro,
		corsaro_interval_t *	int_start
	)

Implements the start_interval function of the plugin API.

Definition at line 195 of file corsaro_pcap.c.

References corsaro::compress, corsaro::compress_level, CORSARO_FILE_MODE_TRACE, corsaro_io_prepare_file_full(), corsaro_log(), PLUGIN, and STATE.

Variable Documentation

corsaro_plugin_t corsaro_pcap_plugin

static

Initial value:

= {
  PLUGIN_NAME,                                 
  CORSARO_PLUGIN_ID_PCAP,                      
  CORSARO_PCAP_MAGIC,                          
  CORSARO_PLUGIN_GENERATE_PTRS(corsaro_pcap),  
  CORSARO_PLUGIN_GENERATE_TAIL,
}

Common plugin information across all instances.

Definition at line 66 of file corsaro_pcap.c.

Referenced by corsaro_pcap_alloc().