Header file dealing with the corsaro plugin manager. More...

This graph shows which files directly or indirectly include this file:

Data Structures
struct	corsaro_plugin
	An corsaro packet processing plugin. More...

struct	corsaro_plugin_manager
	Holds the metadata for the plugin manager. More...

Macros
#define	CORSARO_PLUGIN_GENERATE_PROTOS(plugin)
	Convenience macro that defines all the function prototypes for the corsaro plugin API. More...

#define	CORSARO_PLUGIN_GENERATE_PTRS(plugin)
	Convenience macro that defines all the function pointers for the corsaro plugin API. More...

#define	CORSARO_PLUGIN_GENERATE_TAIL
	Convenience macro that defines all the 'remaining' blank fields in a corsaro plugin object. More...

#define	CORSARO_PLUGIN_STATE(corsaro, type, id)
	Convenience macro to cast the state pointer in the plugin. More...

#define	CORSARO_PLUGIN_PLUGIN(corsaro, id) ((corsaro)->plugin_manager->plugins[(id)-1])
	Convenience macro to get this plugin from corsaro. More...

Typedefs
typedef enum corsaro_plugin_id	corsaro_plugin_id_t
	A unique identifier for a plugin, used when writing binary data. More...

typedef struct corsaro_plugin	corsaro_plugin_t
	An corsaro packet processing plugin. More...

typedef struct corsaro_plugin_manager	corsaro_plugin_manager_t
	Holds the metadata for the plugin manager. More...

Enumerations
enum	corsaro_plugin_id { CORSARO_PLUGIN_ID_PCAP = 1, CORSARO_PLUGIN_ID_ANON = 2, CORSARO_PLUGIN_ID_PFX2AS = 3, CORSARO_PLUGIN_ID_FILTERGEO = 6, CORSARO_PLUGIN_ID_FILTERPFX = 7, CORSARO_PLUGIN_ID_GEODB = 9, CORSARO_PLUGIN_ID_FLOWTUPLE = 20, CORSARO_PLUGIN_ID_DOS = 30, CORSARO_PLUGIN_ID_SMEE = 80, CORSARO_PLUGIN_ID_MAX = CORSARO_PLUGIN_ID_SMEE }
	A unique identifier for a plugin, used when writing binary data. More...

Functions
corsaro_plugin_manager_t *	corsaro_plugin_manager_init ()
	Initialize the plugin manager and all in-use plugins. More...

int	corsaro_plugin_manager_start (corsaro_plugin_manager_t *manager)
	Start the plugin manager. More...

void	corsaro_plugin_manager_free (corsaro_plugin_manager_t *manager)
	Free the plugin manager and all in-use plugins. More...

corsaro_plugin_t *	corsaro_plugin_get_by_id (corsaro_plugin_manager_t *manager, int id)
	Attempt to retrieve a plugin by id. More...

corsaro_plugin_t *	corsaro_plugin_get_by_magic (corsaro_plugin_manager_t *manager, uint32_t id)
	Attempt to retrieve a plugin by magic number (not by using magic) More...

corsaro_plugin_t *	corsaro_plugin_get_by_name (corsaro_plugin_manager_t manager, const char name)
	Attempt to retrieve a plugin by name. More...

corsaro_plugin_t *	corsaro_plugin_next (corsaro_plugin_manager_t manager, corsaro_plugin_t plugin)
	Retrieve the next plugin in the list. More...

void	corsaro_plugin_register_state (corsaro_plugin_manager_t manager, corsaro_plugin_t plugin, void *state)
	Register the state for a plugin. More...

void	corsaro_plugin_free_state (corsaro_plugin_manager_t manager, corsaro_plugin_t plugin)
	Free the state for a plugin. More...

int	corsaro_plugin_probe_filename (const char fname, corsaro_plugin_t plugin)
	Check a filename to see if it contains a plugin's name. More...

const char *	corsaro_plugin_get_name_by_id (corsaro_plugin_manager_t *manager, int id)
	Get the name of a plugin given it's ID number. More...

const char *	corsaro_plugin_get_name_by_magic (corsaro_plugin_manager_t *manager, uint32_t magic)
	Get the name of a plugin given it's magic number. More...

int	corsaro_plugin_is_enabled (corsaro_plugin_manager_t manager, corsaro_plugin_t plugin)
	Determine whether this plugin is enabled for use. More...

int	corsaro_plugin_enable_plugin (corsaro_plugin_manager_t manager, const char plugin_name, const char *plugin_args)
	Attempt to enable a plugin by its name. More...

Detailed Description

Header file dealing with the corsaro plugin manager.

Author: Alistair King

Definition in file corsaro_plugin.h.

Macro Definition Documentation

#define CORSARO_PLUGIN_GENERATE_PROTOS ( plugin )

Value:

corsaro_plugin_t * plugin##_alloc();                                    \
  int plugin##_probe_filename(const char *fname);                       \
  int plugin##_probe_magic(struct corsaro_in * corsaro, corsaro_file_in_t *file); \
  int plugin##_init_input(struct corsaro_in *corsaro);                  \
  int plugin##_init_output(struct corsaro *corsaro);                    \
  int plugin##_close_input(struct corsaro_in *corsaro);                 \
  int plugin##_close_output(struct corsaro *corsaro);                   \
  off_t plugin##_read_record(struct corsaro_in *corsaro,                        \
                           enum corsaro_in_record_type *record_type,    \
                           struct corsaro_in_record *record);           \
  off_t plugin##_read_global_data_record(struct corsaro_in *corsaro,    \
                           enum corsaro_in_record_type *record_type,    \
                           struct corsaro_in_record *record);           \
  int plugin##_start_interval(struct corsaro *corsaro,                  \
                              struct corsaro_interval *int_start);      \
  int plugin##_end_interval(struct corsaro *corsaro,                    \
                            struct corsaro_interval *int_end);          \
  int plugin##_process_packet(struct corsaro *corsaro,                  \
                              struct corsaro_packet *packet);

Convenience macro that defines all the function prototypes for the corsaro plugin API.

Todo:: split this into corsaro-out and corsaro-in macros

Definition at line 44 of file corsaro_plugin.h.

#define CORSARO_PLUGIN_GENERATE_PTRS ( plugin )

Value:

plugin##_probe_filename,                                \
    plugin##_probe_magic,                               \
    plugin##_init_input,                                \
    plugin##_init_output,                               \
    plugin##_close_input,                               \
    plugin##_close_output,                              \
    plugin##_read_record,                               \
    plugin##_read_global_data_record,                   \
    plugin##_start_interval,                            \
    plugin##_end_interval,                              \
    plugin##_process_packet

Convenience macro that defines all the function pointers for the corsaro plugin API.

If the FlowTuple plugin is enabled, we by default set the pointer to NULL and expect plugins which support this feature to set this manually

Todo:: split this into corsaro-out and corsaro-in macros

Definition at line 117 of file corsaro_plugin.h.

Referenced by KHASH_INIT().

#define CORSARO_PLUGIN_GENERATE_TAIL

Value:

NULL,                           /* next */      \
    0,                          /* argc */      \
    NULL                        /* argv */

Convenience macro that defines all the 'remaining' blank fields in a corsaro plugin object.

This becomes useful if we add more fields to the end of the plugin structure, because each plugin does not need to be updated in order to correctly 'zero' these fields.

Definition at line 138 of file corsaro_plugin.h.

Referenced by KHASH_INIT().

#define CORSARO_PLUGIN_PLUGIN	(	corsaro,
		id
	)	((corsaro)->plugin_manager->plugins[(id)-1])

Convenience macro to get this plugin from corsaro.

Plugins should use extend this macro to provide access to themself

Definition at line 155 of file corsaro_plugin.h.

#define CORSARO_PLUGIN_STATE	(	corsaro,
		type,
		id
	)

Value:

((struct corsaro_##type##_state_t*) \

((corsaro)->plugin_manager->plugins_state[(id)-1]))

corsaro

Corsaro output state.

Definition: corsaro_int.h:230

Convenience macro to cast the state pointer in the plugin.

Plugins should use extend this macro to provide access to their state

Definition at line 147 of file corsaro_plugin.h.

Typedef Documentation

typedef enum corsaro_plugin_id corsaro_plugin_id_t

A unique identifier for a plugin, used when writing binary data.

Note: this identifier does not affect the order in which plugins are passed packets. Plugin precedence is determined either by the order of the ED_WITH_PLUGIN macros in configure.ac, or by the order of the plugins that have been explicitly enabled using corsaro_enable_plugin

typedef struct corsaro_plugin_manager corsaro_plugin_manager_t

Holds the metadata for the plugin manager.

This allows both corsaro_t and corsaro_in_t objects to use the plugin infrastructure without needing to pass references to themselves

typedef struct corsaro_plugin corsaro_plugin_t

An corsaro packet processing plugin.

Enumeration Type Documentation

enum corsaro_plugin_id

A unique identifier for a plugin, used when writing binary data.

Note: this identifier does not affect the order in which plugins are passed packets. Plugin precedence is determined either by the order of the ED_WITH_PLUGIN macros in configure.ac, or by the order of the plugins that have been explicitly enabled using corsaro_enable_plugin

Enumerator
CORSARO_PLUGIN_ID_PCAP	Pass-through PCAP plugin. Allows Corsaro to be used to capture PCAP files from a live interface. This should always be the highest priority plugin
CORSARO_PLUGIN_ID_ANON	IP address anonymization plugin.
CORSARO_PLUGIN_ID_PFX2AS	CAIDA Prefix2AS lookup plugin.
CORSARO_PLUGIN_ID_FILTERGEO	FilterGeo plugin.
CORSARO_PLUGIN_ID_FILTERPFX	FilterPfx plugin.
CORSARO_PLUGIN_ID_GEODB	Geolocation Database Lookup Plugin.
CORSARO_PLUGIN_ID_FLOWTUPLE	FlowTuple plugin.
CORSARO_PLUGIN_ID_DOS	RS DoS plugin.
CORSARO_PLUGIN_ID_SMEE	Smee plugin.
CORSARO_PLUGIN_ID_MAX	Maximum plugin ID assigned.

Definition at line 166 of file corsaro_plugin.h.

Function Documentation

int corsaro_plugin_enable_plugin	(	corsaro_plugin_manager_t *	manager,
		const char *	plugin_name,
		const char *	plugin_args
	)

Attempt to enable a plugin by its name.

Parameters

manager	The plugin manager associated with the state
plugin_name	The name of the plugin to enable
plugin_args	The arguments to pass to the plugin (for config)

Returns: 0 if the plugin was successfully enabled, -1 otherwise

See corsaro_enable_plugin for more details.

Definition at line 532 of file corsaro_plugin.c.

References corsaro_plugin::argc, corsaro_plugin::argv, corsaro_log(), corsaro_log_file(), corsaro_plugin_get_by_name(), corsaro_plugin::id, corsaro_plugin_manager::plugins_enabled, and corsaro_plugin_manager::plugins_enabled_cnt.

Referenced by corsaro_enable_plugin().

void corsaro_plugin_free_state	(	corsaro_plugin_manager_t *	manager,
		corsaro_plugin_t *	plugin
	)

Free the state for a plugin.

Parameters

manager	The plugin manager associated with the state
plugin	The plugin to free state for

Definition at line 465 of file corsaro_plugin.c.

References corsaro_plugin::id, and corsaro_plugin_manager::plugins_state.

Referenced by corsaro_dos_close_input(), corsaro_dos_close_output(), corsaro_filtergeo_close_output(), corsaro_filterpfx_close_output(), corsaro_flowtuple_close_input(), corsaro_flowtuple_close_output(), corsaro_geodb_close_output(), corsaro_pcap_close_output(), corsaro_pfx2as_close_output(), and corsaro_smee_close_output().

corsaro_plugin_t* corsaro_plugin_get_by_id	(	corsaro_plugin_manager_t *	manager,
		int	id
	)

Attempt to retrieve a plugin by id.

Parameters

manager	The plugin manager to search with
id	The id of the plugin to get

Returns: the plugin corresponding to the id if found, NULL otherwise

Definition at line 395 of file corsaro_plugin.c.

References CORSARO_PLUGIN_ID_MAX, and corsaro_plugin_manager::plugins.

Referenced by corsaro_plugin_get_name_by_id().

corsaro_plugin_t* corsaro_plugin_get_by_magic	(	corsaro_plugin_manager_t *	manager,
		uint32_t	id
	)

Attempt to retrieve a plugin by magic number (not by using magic)

Parameters

manager	The plugin manager to search with
id	The magic number of the plugin to get

Returns: the plugin corresponding to the magic number if found, NULL otherwise

Definition at line 407 of file corsaro_plugin.c.

References corsaro_plugin_next(), and corsaro_plugin::magic.

Referenced by corsaro_io_print_record(), corsaro_io_write_record(), corsaro_plugin_get_name_by_magic(), and read_record().

corsaro_plugin_t* corsaro_plugin_get_by_name	(	corsaro_plugin_manager_t *	manager,
		const char *	name
	)

Attempt to retrieve a plugin by name.

Parameters

manager	The plugin manager to search with
name	The name of the plugin to get

Returns: the plugin corresponding to the name if found, NULL otherwise

Definition at line 422 of file corsaro_plugin.c.

References corsaro_plugin_next(), and corsaro_plugin::name.

Referenced by corsaro_plugin_enable_plugin().

const char* corsaro_plugin_get_name_by_id	(	corsaro_plugin_manager_t *	manager,
		int	id
	)

Get the name of a plugin given it's ID number.

Parameters

manager	The plugin manager associated with the state
id	The plugin id to retrieve the name for

Returns: the name of the plugin as a string, NULL if no plugin matches the given id

Definition at line 487 of file corsaro_plugin.c.

References corsaro_plugin_get_by_id(), and corsaro_plugin::name.

const char* corsaro_plugin_get_name_by_magic	(	corsaro_plugin_manager_t *	manager,
		uint32_t	magic
	)

Get the name of a plugin given it's magic number.

Parameters

manager	The plugin manager associated with the state
magic	The plugin magic number to retrieve the name for

Returns: the name of the plugin as a string, NULL if no plugin matches the given magic number

Definition at line 498 of file corsaro_plugin.c.

References corsaro_plugin_get_by_magic(), and corsaro_plugin::name.

Referenced by corsaro_io_print_header().

int corsaro_plugin_is_enabled	(	corsaro_plugin_manager_t *	manager,
		corsaro_plugin_t *	plugin
	)

Determine whether this plugin is enabled for use.

Parameters

manager	The plugin manager associated with the state
plugin	The plugin to check the status of

Returns: 1 if the plugin is enabled, 0 if it is disabled

A plugin is enabled either explicitly by the corsaro_enable_plugin() function, or implicitly because all plugins are enabled.

Definition at line 509 of file corsaro_plugin.c.

References corsaro_plugin::id, corsaro_plugin_manager::plugins_enabled, and corsaro_plugin_manager::plugins_enabled_cnt.

void corsaro_plugin_manager_free ( corsaro_plugin_manager_t * manager )

Free the plugin manager and all in-use plugins.

Parameters

manager The plugin manager to free

Note: the plugins registered with the manager MUST have already been closed (either plugin->close_output or plugin->close_input). Also, the logfile is NOT closed, as it is assumed to be shared with another object (corsaro_t or corsaro_in_t).

Definition at line 341 of file corsaro_plugin.c.

References corsaro_plugin::argc, corsaro_plugin::argv, CORSARO_PLUGIN_ID_MAX, corsaro_plugin_manager::first_plugin, corsaro_plugin_manager::plugins, corsaro_plugin_manager::plugins_cnt, corsaro_plugin_manager::plugins_enabled, and corsaro_plugin_manager::plugins_state.

Referenced by corsaro_free(), corsaro_get_plugin_names(), and corsaro_in_free().

corsaro_plugin_manager_t* corsaro_plugin_manager_init ( )

Initialize the plugin manager and all in-use plugins.

Returns: A pointer to the plugin manager state or NULL if an error occurs

Referenced by corsaro_get_plugin_names(), corsaro_in_init(), and corsaro_init().

int corsaro_plugin_manager_start ( corsaro_plugin_manager_t * manager )

Start the plugin manager.

Parameters

manager The manager to start

Definition at line 296 of file corsaro_plugin.c.

References corsaro_plugin_manager::first_plugin, corsaro_plugin::next, corsaro_plugin_manager::plugins, corsaro_plugin_manager::plugins_enabled, and corsaro_plugin_manager::plugins_enabled_cnt.

Referenced by corsaro_start_output().

corsaro_plugin_t* corsaro_plugin_next	(	corsaro_plugin_manager_t *	manager,
		corsaro_plugin_t *	plugin
	)

Retrieve the next plugin in the list.

Parameters

manager	The plugin manager to get the next plugin for
plugin	The current plugin

Returns: the plugin which follows the current plugin, NULL if the end of the plugin list has been reached. If plugin is NULL, the first plugin will be returned.

Definition at line 437 of file corsaro_plugin.c.

References corsaro_plugin_manager::first_plugin, corsaro_plugin::next, corsaro_plugin_manager::plugins, and corsaro_plugin_manager::plugins_cnt.

Referenced by corsaro_free(), corsaro_get_plugin_names(), corsaro_plugin_get_by_magic(), corsaro_plugin_get_by_name(), corsaro_start_input(), corsaro_start_output(), end_interval(), process_packet(), and start_interval().