Main Page   Alphabetical List   Compound List   File List   Compound Members   File Members   Related Pages  

rubicon_snort.c File Reference

Do snort-style signature-based IDS test. More...

#include "../../main/anplug.h"
#include "../../main/packet.h"
#include "../../main/memory.h"

Go to the source code of this file.

Defines

#define DEBUG_FILE   0

Functions

int pluginRegister (INPLUG **inp, ANPLUG **anp, PROTOPLUG **protop, OUTPLUG **outp, int(*DecodeCallback)(PACKET*,PROTO))
 Registration function. More...

int pluginInit (int ct, char **inits)
 Initialise the plugin. More...

int pluginCleanup (int reason)
 Cleanup the plugin. More...

char* pluginAnalyse (PACKET *p, char *anType, char *args)
 Analyses a packet. More...


Variables

int (* Decode )(PACKET*, PROTO)
ANPLUGap = (ANPLUG*)0


Detailed Description

Do snort-style signature-based IDS test.

Definition in file rubicon_snort.c.


Define Documentation

#define DEBUG_FILE   0
 

Definition at line 16 of file rubicon_snort.c.


Function Documentation

char * pluginAnalyse ( PACKET * p,
char * anType,
char * args )
 

Analyses a packet.

Parameters:
p   (PACKET*) The packet to analyse
anType   (char*) The type of analysis to perform
args   (char*) Other invocation arguments
Returns:
(char*) NULL on error, otherwise a string specifying the result

This function performs some form of analysis on the packet, the type of which is given in anType. It returns a string describing the result. Additionally, the function may append a 'special' protocol to the packet with further information. If this is done, the plugin should also implement the protocol plugin interface to enable the 'special' protocol (i.e. the test results) to be tested.

Definition at line 119 of file rubicon_snort.c.

int pluginCleanup ( int reason )
 

Cleanup the plugin.

Parameters:
reason   (int) The reason for the cleanup.

This call should always be made before closing the program, or reinitialising the plugin. It frees all the memory allocated and still held internally (i.e. it doesn't free memory that it has a pointer to but has passed elsewhere). Additionally, files are closed etc.

Definition at line 90 of file rubicon_snort.c.

int pluginInit ( int ct,
char ** inits )
 

Initialise the plugin.

Parameters:
ct   (int) Number of initialisation strings
inits   (char **) Array of ct initialisation strings

Definition at line 73 of file rubicon_snort.c.

int pluginRegister ( INPLUG ** inp,
ANPLUG ** anp,
PROTOPLUG ** protop,
OUTPLUG ** outp,
int(* DecodeCallback)(PACKET *,PROTO) )
 

Registration function.

Parameters:
inp   (INPLUG**) Placeholder for input plugin descriptor
anp   (ANPLUG**) Placeholder for analysis plugin descriptor
protop   (PROTOPLUG**) Placeholder for protocol plugin descriptor
outp   (OUTPLUG**) Placeholder for output plugin descriptor
DecodeCallback   (function ptr) Pointer to generic decode function

This function is called by the main process in order to register the plugin. The function then populates the placeholders for the plugin types it supports, and sets all others to null. The DecodeCallback function is stored in case the plugin ever wants to decode anything.

Definition at line 39 of file rubicon_snort.c.


Variable Documentation

int(* Decode)(PACKET *,PROTO)
 

Pointer to generic protocol decoding function

Definition at line 22 of file rubicon_udp.c.

ANPLUG * ap = (ANPLUG*)0
 

Definition at line 23 of file rubicon_snort.c.


Generated at Mon Jul 8 15:16:50 2002 for RUBICON by doxygen1.2.1 written by Dimitri van Heesch, © 1997-2000