engine/hlbr.h File Reference

#include "../config.h"
#include "hlbrlib.h"
#include <sys/time.h>
#include "num_list.h"
#include "session.h"

Go to the source code of this file.

Data Structures

struct  decoder_data
struct  packet_rec
struct  interface_rec
struct  test_node
struct  test_rec
struct  module_rec
struct  decoder_rec
struct  action_item
struct  action_rec
struct  message_item
struct  rule_rec
struct  route_rec
struct  mangle_rec
struct  global_list
struct  func_list
struct  timer_rec
struct  global_vars

Defines

#define DBG(a)
#define DEBUGPATH   ;
#define DEBUGLOCKS
#define MAJOR_VERSION   1
#define MINOR_VERSION   1
#define MAX_PACKET_SIZE   65536+14+1
#define TYPICAL_PACKET_SIZE   16000
#define MAX_NAME_LEN   20
#define MAX_RULES   10240
#define MAX_INTERFACES   8
#define MAX_DECODERS   128
#define MAX_TESTS   1024
#define IDLE_TIMEOUT   200
#define MAX_DECODER_DEPTH   16
#define MAX_MESSAGE_LEN   256
#define MAX_ACTIONS   16
#define MAX_ACTION_ITEMS   64
#define MAX_ITEMS_PER_ACTION   16
#define MAX_ROUTES   16
#define MAX_MANGLERS   8
#define MAX_MODULES   16
#define MAX_LISTS   16
#define MAX_TIMERS   16
#define MAX_PACKETS   512
#define DEFAULT_SENSOR_NAME   "Default Sensor"
#define DEFAULT_SENSOR_ID   0
#define MAX_INTERFACE_NAME_LEN   256
#define LIST_TYPE_IP   1
#define LIST_TYPE_NUM   2
#define LIST_TYPE_PORT   3
#define LIST_TYPE_IPPORT   4
#define USER_RULE_START   50000
#define PRINT(msg)   printf(msg)
#define PRINT1(msg, p1)   printf(msg, p1)
#define PRINT2(msg, p1, p2)   printf(msg, p1, p2)
#define PRINT3(msg, p1, p2, p3)   printf(msg, p1, p2, p3)
#define PRINTERROR(msg)   fprintf(stderr, msg)
#define PRINTERROR1(msg, p1)   fprintf(stderr, msg, p1)
#define PRINTERROR2(msg, p1, p2)   fprintf(stderr, msg, p1, p2)
#define PRINTERROR3(msg, p1, p2, p3)   fprintf(stderr, msg, p1, p2, p3)
#define PRINTERROR4(msg, p1, p2, p3, p4)   fprintf(stderr, msg, p1, p2, p3, p4)
#define PRINTERROR5(msg, p1, p2, p3, p4, p5)   fprintf(stderr, msg, p1, p2, p3, p4, p5)
#define PRINTERROR6(msg, p1, p2, p3, p4, p5, p6)   fprintf(stderr, msg, p1, p2, p3, p4, p5, p6)
#define PRINTPKTERROR(p, ip, tcp, cr)   PrintPacketSummary(stderr, p, ip, tcp, cr)
#define PRINTSESERROR(pp, cr)   PrintSessionSummary(stderr, pp, cr)
#define ARRAYSIZE(array)   (sizeof(array)/sizeof(array[0]))
#define MALLOC   malloc
#define MALLOC_CHECK(x)
#define FREE(x)
#define FREE_IF(x)
#define IP_BYTES(IP)   IP>>24, (IP & 0x00ff0000)>>16, (IP & 0x0000ff00)>>8, (IP & 0x000000ff)
#define GET_SESSION_1   1001
#define GET_SESSION_2   1002
#define GET_SESSION_3   1003
#define ADD_PACKET_1   2001
#define POP_PACKET_1   3001
#define GET_PACKET_1   4001
#define RETURN_PACKET_1   5001
#define FREE_SAVED_1   6001
#define TIMEOUT_SAVED_1   7001
#define TIMEOUT_SAVED_2   7002
#define SAVE_PACKET_1   8001
#define SAVE_PACKET_2   8002
#define GET_SAVED_1   9001
#define GET_SAVED_2   9002
#define GET_SAVED_3   9003
#define UNLOCK_SAVED_1   10001
#define FRAG_LOCK_1   11001
#define LIST_NONE   -1
#define TIMER_NONE   -1

Typedefs

typedef decoder_data DecoderData
typedef packet_rec PacketRec
typedef interface_rec InterfaceRec
typedef test_node TestNode
typedef test_rec TestRec
typedef module_rec ModuleRec
typedef decoder_rec DecoderRec
typedef action_item ActionItem
typedef action_rec ActionRec
typedef message_item MessageItem
typedef rule_rec RuleRec
typedef route_rec RouteRec
typedef mangle_rec MangleRec
typedef global_list GlobalList
typedef func_list FuncList
typedef timer_rec TimerRec
typedef global_vars GlobalVars

Functions

int hlbr_mutex_lock (pthread_mutex_t *mutex, int ID, int *LockID)
int hlbr_mutex_trylock (pthread_mutex_t *mutex, int ID, int *LockID)
int hlbr_mutex_unlock (pthread_mutex_t *mutex)
int GetListByName (char *Name)
int AddShutdownHandler (int(*func)(void *data), void *data)
int CreateTimer (char *Name, unsigned int Interval, int(*TimerFunc)(int TimerID, int Time, void *user), void *User)

Define Documentation

#define ADD_PACKET_1   2001

Definition at line 409 of file hlbr.h.

Referenced by AddPacketToPending().

#define ARRAYSIZE ( array   )     (sizeof(array)/sizeof(array[0]))

Definition at line 113 of file hlbr.h.

Referenced by AlertSyslogParseArgs().

#define DBG ( a   ) 

Definition at line 7 of file hlbr.h.

Referenced by ActionAlertSyslogShutdownFunc(), AlertSyslogAction(), AlertSyslogMessage(), AlertSyslogParseArgs(), AssignSessionTCP(), CreateDecoder(), Decode(), DecodeARP(), DecodeTCP(), FindPortPair(), GetDataByID(), InitActionAlertSyslog(), InitDecoderTCP(), ParseCmp(), ParseDecoderLine(), ParseRule(), ProcessPacket(), RemovePort(), RouteAndSend(), SyslogInit(), TCPDstAddNode(), TestTCPDst(), and TestTCPDstOld().

#define DEBUGLOCKS

Definition at line 25 of file hlbr.h.

#define DEBUGPATH   ;

Definition at line 23 of file hlbr.h.

Referenced by ActionAlertSyslogShutdownFunc(), AddIPRanges(), AddPacketToPending(), AddRange(), AddRangesString(), AddRangeTime(), AddSessionCreateHandler(), AddSessionDestroyHandler(), AddShutdownHandler(), AddStringJTree(), AddStringJTreeReal(), AddSubList(), AddToTime(), AlertFileAction(), AlertFileMessage(), AlertFileParseArgs(), AlertSyslogAction(), AlertSyslogMessage(), AlertSyslogParseArgs(), ApplyMessage(), AssignSessionTCP(), CallCreateFuncs(), CallDestroyFuncs(), CallShutdownHandlers(), ClearNumList(), CompressJTree(), ConvertNode(), CreateDecoder(), CreateRoute(), Decode(), DecodeARP(), DecodeEthernet(), DecodeICMP(), DecodeInterface(), DecodeIP(), DecodeIPDefrag(), DecoderAddDecoder(), DecoderAddModule(), DecoderAddTest(), DecodeTCP(), DecodeUDP(), DestroyNumList(), FinalizeJTree(), FindIPPair(), FindOptimalNode(), FindPortPair(), GetDataByID(), GetDecoderByName(), GetEmptyPacket(), GetHash(), GetInterfaceByName(), GetListByName(), GetMac(), GetPacketProtoByName(), GetPacketRoleByName(), GetPacketTypeByName(), GetRouteByName(), HandleSignal(), HandleTimers(), IdleFunc(), InitActionAlertFile(), InitActionAlertSyslog(), InitDecoderARP(), InitDecoderEthernet(), InitDecoderICMP(), InitDecoderInterface(), InitDecoderIP(), InitDecoderIPDefrag(), InitDecoders(), InitDecoderTCP(), InitDecoderUDP(), InitJTree(), InitMacFilter(), InitNumList(), InitRoutes(), InitSession(), InitTestTCPContent(), InitTestTCPDst(), IPDstAddNode(), IsInList(), IsInListTime(), LogMessage(), LogMessageAllActions(), MainLoop(), MainLoopPoll(), MainLoopThreaded(), MatchStrings(), NumListCompare(), OpenInterface(), OpenInterfaces(), ParseArgs(), ParseDecoderLine(), ParseRule(), ParseRules(), PopFromPending(), PrintUsage(), ProcessPacket(), ProcessPacketThread(), ReadPacket(), RemoveFromList(), RemovePort(), ReplaceAliases(), ReturnEmptyPacket(), Route(), RouteAdd(), RouteAndSend(), RouteMacFilter(), RouteMacFilterAddNode(), RuleIsActive(), SetAction(), SetRuleInactive(), SortFragArray(), StartInterfaceThread(), SyslogInit(), TCPContentAddNode(), TCPDstAddNode(), TestIPDst(), TestTCPContent(), TestTCPContentFinishedSetup(), TestTCPDst(), TestTCPDstOld(), TestTCPNoCase(), TimeoutSessions(), UpdateTime(), and WritePacket().

#define DEFAULT_SENSOR_ID   0

Definition at line 60 of file hlbr.h.

#define DEFAULT_SENSOR_NAME   "Default Sensor"

Definition at line 59 of file hlbr.h.

Referenced by ParseSystem().

#define FRAG_LOCK_1   11001

Definition at line 422 of file hlbr.h.

Referenced by DecodeIPDefrag().

#define FREE ( x   ) 

Value:

{ \
        if (x != NULL) { \
                free(x); \
        } else { \
                PRINTERROR3("Attempting to free a NULL pointer at 0x%x (%s():%d)\n", x, __FUNCTION__, __LINE__); \
        } \
}

Definition at line 123 of file hlbr.h.

Referenced by AlertSyslogParseArgs(), ListAdd(), ListClear(), ListDel(), and RemovePort().

#define FREE_IF ( x   ) 

Value:

{ \
  if (x != NULL) { \
    free(x); \
  } \
}

Definition at line 131 of file hlbr.h.

#define FREE_SAVED_1   6001

Definition at line 413 of file hlbr.h.

Referenced by FreeSaveQuery().

#define GET_PACKET_1   4001

Definition at line 411 of file hlbr.h.

Referenced by GetEmptyPacket().

#define GET_SAVED_1   9001

Definition at line 418 of file hlbr.h.

Referenced by GetAndLockSavedPackets().

#define GET_SAVED_2   9002

Definition at line 419 of file hlbr.h.

Referenced by GetAndLockSavedPackets().

#define GET_SAVED_3   9003

Definition at line 420 of file hlbr.h.

Referenced by GetAndLockSavedPackets().

#define GET_SESSION_1   1001

Definition at line 406 of file hlbr.h.

#define GET_SESSION_2   1002

Definition at line 407 of file hlbr.h.

#define GET_SESSION_3   1003

Definition at line 408 of file hlbr.h.

#define IDLE_TIMEOUT   200

Definition at line 45 of file hlbr.h.

Referenced by MainLoopPoll().

#define IP_BYTES ( IP   )     IP>>24, (IP & 0x00ff0000)>>16, (IP & 0x0000ff00)>>8, (IP & 0x000000ff)

Definition at line 141 of file hlbr.h.

Referenced by AssignSessionTCP(), FindPortPair(), PrintPacketSummary(), PrintSessionBuffer(), and RemovePort().

#define LIST_NONE   -1

Definition at line 429 of file hlbr.h.

Referenced by AddIPRanges(), GetListByName(), and ParseList().

#define LIST_TYPE_IP   1

Definition at line 64 of file hlbr.h.

Referenced by ParseConfig(), and ParseList().

#define LIST_TYPE_IPPORT   4

Definition at line 67 of file hlbr.h.

#define LIST_TYPE_NUM   2

Definition at line 65 of file hlbr.h.

#define LIST_TYPE_PORT   3

Definition at line 66 of file hlbr.h.

#define MAJOR_VERSION   1

Definition at line 28 of file hlbr.h.

Referenced by PrintVersion().

#define MALLOC   malloc

Definition at line 115 of file hlbr.h.

Referenced by AssignSessionTCP(), DecodeARP(), and ListAdd().

#define MALLOC_CHECK ( x   ) 

Value:

{ \
        if (x == NULL) { \
                PRINTERROR2("Couldn't allocate memory! (%s():%d)\n", __FUNCTION__, __LINE__); \
                return NULL; \
        } \
}

Definition at line 116 of file hlbr.h.

Referenced by ListAdd().

#define MAX_ACTION_ITEMS   64

Definition at line 50 of file hlbr.h.

#define MAX_ACTIONS   16

Definition at line 49 of file hlbr.h.

#define MAX_DECODER_DEPTH   16

Definition at line 47 of file hlbr.h.

Referenced by Decode().

#define MAX_DECODERS   128

Definition at line 40 of file hlbr.h.

#define MAX_INTERFACE_NAME_LEN   256

Definition at line 62 of file hlbr.h.

Referenced by ParseInterface().

#define MAX_INTERFACES   8

Definition at line 39 of file hlbr.h.

Referenced by InitRouteDIP(), InitRouteSIP(), and ParseInterface().

#define MAX_ITEMS_PER_ACTION   16

Definition at line 51 of file hlbr.h.

#define MAX_LISTS   16

Definition at line 55 of file hlbr.h.

#define MAX_MANGLERS   8

Definition at line 53 of file hlbr.h.

#define MAX_MESSAGE_LEN   256

Definition at line 48 of file hlbr.h.

Referenced by ParseRule().

#define MAX_MODULES   16

Definition at line 54 of file hlbr.h.

#define MAX_NAME_LEN   20

Definition at line 37 of file hlbr.h.

Referenced by CreateAction(), CreateDecoder(), CreateRoute(), CreateTest(), CreateTimer(), InitTestEthernetDst(), InitTestEthernetSrc(), InitTestEthernetType(), InitTestICMPCode(), InitTestICMPType(), InitTestInterfaceName(), InitTestIPCheck(), InitTestIPDst(), InitTestIPProto(), InitTestIPSrc(), InitTestIPTTL(), InitTestTCPContent(), InitTestTCPDst(), InitTestTCPFlags(), InitTestTCPListContent(), InitTestTCPListNoCase(), InitTestTCPNoCase(), InitTestTCPOffset(), InitTestTCPPort(), InitTestTCPRegExp(), InitTestTCPSrc(), InitTestUDPContent(), InitTestUDPDst(), InitTestUDPNoCase(), InitTestUDPRegExp(), InitTestUDPSrc(), ParseAction(), and ParseList().

#define MAX_PACKET_SIZE   65536+14+1

Definition at line 35 of file hlbr.h.

Referenced by RebuildPacket().

#define MAX_PACKETS   512

Definition at line 57 of file hlbr.h.

Referenced by GetEmptyPacket(), main(), and PopFromPending().

#define MAX_ROUTES   16

Definition at line 52 of file hlbr.h.

#define MAX_RULES   10240

Definition at line 38 of file hlbr.h.

Referenced by MatchStrings(), and MatchStringTree().

#define MAX_TESTS   1024

Definition at line 41 of file hlbr.h.

#define MAX_TIMERS   16

Definition at line 56 of file hlbr.h.

Referenced by CreateTimer(), and HandleTimers().

#define MINOR_VERSION   1

Definition at line 29 of file hlbr.h.

Referenced by PrintVersion().

#define POP_PACKET_1   3001

Definition at line 410 of file hlbr.h.

Referenced by BlockPacket(), DropPacket(), and PopFromPending().

#define PRINT ( msg   )     printf(msg)

Definition at line 86 of file hlbr.h.

Referenced by AssignSessionTCP(), ParseArgs(), and ParseRule().

#define PRINT1 ( msg,
p1   )     printf(msg, p1)

Definition at line 87 of file hlbr.h.

Referenced by FindPortPair(), ParseArgs(), ParseDecoderLine(), ParseRule(), and RemovePort().

#define PRINT2 ( msg,
p1,
p2   )     printf(msg, p1, p2)

Definition at line 88 of file hlbr.h.

Referenced by AssignSessionTCP().

#define PRINT3 ( msg,
p1,
p2,
p3   )     printf(msg, p1, p2, p3)

Definition at line 89 of file hlbr.h.

#define PRINTERROR ( msg   )     fprintf(stderr, msg)

Definition at line 90 of file hlbr.h.

Referenced by AddStringJTree(), AddToTime(), AlertFileAction(), AlertFileMessage(), AssignSessionTCP(), Decode(), DecodeARP(), DecodeTCP(), FindPortPair(), IdleFunc(), InitActionAlertFile(), InitDecoderARP(), InitDecoders(), InitDecoderTCP(), InitTestTCPDst(), MainLoop(), ParseDecoderLine(), ParseRule(), ProcessPacket(), RemovePort(), RouteAndSend(), TCPDstAddNode(), TestTCPDst(), and TestTCPDstOld().

#define PRINTERROR1 ( msg,
p1   )     fprintf(stderr, msg, p1)

Definition at line 91 of file hlbr.h.

Referenced by AddStringJTree(), AlertFileAction(), AlertFileParseArgs(), ApplyMessage(), Decode(), DecodeARP(), DecodeTCP(), FindPortPair(), GetDataByID(), IdleFunc(), LogFile(), ParseDecoderLine(), ParseRule(), ProcessPacket(), and TCPDstAddNode().

#define PRINTERROR2 ( msg,
p1,
p2   )     fprintf(stderr, msg, p1, p2)

Definition at line 92 of file hlbr.h.

Referenced by CreateDecoder(), DecoderAddDecoder(), DecoderAddModule(), DecoderAddTest(), ParseDecoderLine(), and ParseRule().

#define PRINTERROR3 ( msg,
p1,
p2,
p3   )     fprintf(stderr, msg, p1, p2, p3)

Definition at line 93 of file hlbr.h.

Referenced by DecodeTCP(), and ParseCmp().

#define PRINTERROR4 ( msg,
p1,
p2,
p3,
p4   )     fprintf(stderr, msg, p1, p2, p3, p4)

Definition at line 94 of file hlbr.h.

Referenced by AssignSessionTCP().

#define PRINTERROR5 ( msg,
p1,
p2,
p3,
p4,
p5   )     fprintf(stderr, msg, p1, p2, p3, p4, p5)

Definition at line 95 of file hlbr.h.

#define PRINTERROR6 ( msg,
p1,
p2,
p3,
p4,
p5,
p6   )     fprintf(stderr, msg, p1, p2, p3, p4, p5, p6)

Definition at line 96 of file hlbr.h.

Referenced by DecodeARP().

#define PRINTPKTERROR ( p,
ip,
tcp,
cr   )     PrintPacketSummary(stderr, p, ip, tcp, cr)

Definition at line 102 of file hlbr.h.

Referenced by AssignSessionTCP().

#define PRINTSESERROR ( pp,
cr   )     PrintSessionSummary(stderr, pp, cr)

Definition at line 103 of file hlbr.h.

Referenced by AssignSessionTCP().

#define RETURN_PACKET_1   5001

Definition at line 412 of file hlbr.h.

Referenced by ReturnEmptyPacket().

#define SAVE_PACKET_1   8001

Definition at line 416 of file hlbr.h.

Referenced by SavePacket().

#define SAVE_PACKET_2   8002

Definition at line 417 of file hlbr.h.

Referenced by SavePacket().

#define TIMEOUT_SAVED_1   7001

Definition at line 414 of file hlbr.h.

Referenced by TimeoutSavedPackets().

#define TIMEOUT_SAVED_2   7002

Definition at line 415 of file hlbr.h.

#define TIMER_NONE   -1

Definition at line 433 of file hlbr.h.

Referenced by CreateTimer().

#define TYPICAL_PACKET_SIZE   16000

Definition at line 36 of file hlbr.h.

#define UNLOCK_SAVED_1   10001

Definition at line 421 of file hlbr.h.

Referenced by UnlockSavedQuery().

#define USER_RULE_START   50000

Definition at line 69 of file hlbr.h.

Referenced by ParseRule().

Typedef Documentation

typedef struct action_item ActionItem

typedef struct action_rec ActionRec

typedef struct decoder_data DecoderData

Holds the data from a decoder already applied. Each packet struct holds an array of this struct; here every decoder applied to a packet store its own data

typedef struct decoder_rec DecoderRec

typedef struct func_list FuncList

typedef struct global_list GlobalList

typedef struct global_vars GlobalVars

typedef struct interface_rec InterfaceRec

typedef struct mangle_rec MangleRec

typedef struct message_item MessageItem

typedef struct module_rec ModuleRec

typedef struct packet_rec PacketRec

The packet, as it is stored in memory.

typedef struct route_rec RouteRec

typedef struct rule_rec RuleRec

typedef struct test_node TestNode

typedef struct test_rec TestRec

Structure for a test (like 'tcp nocase', for example)

See also:
InitTests()

typedef struct timer_rec TimerRec

Function Documentation

int AddShutdownHandler ( int(*)(void *data)  func,
void *  data 
)

Add a function to be called during shutdown. Defines a callback function.

Definition at line 458 of file hlbr.c.

References func_list::Data, DEBUGPATH, func_list::Func, Globals, global_vars::ShutdownFuncs, and TRUE.

Referenced by SyslogInit().

int CreateTimer ( char *  Name,
unsigned int  Interval,
int(*)(int TimerID, int Time, void *user)  TimerFunc,
void *  User 
)

int GetListByName ( char *  Name  ) 

Definition at line 441 of file hlbr.c.

References DEBUGPATH, Globals, LIST_NONE, global_vars::Lists, global_list::Name, and global_vars::NumLists.

Referenced by AddIPRanges(), and ParseList().

int hlbr_mutex_lock ( pthread_mutex_t *  mutex,
int  ID,
int *  LockID 
)

Definition at line 281 of file hlbr.c.

References Globals, TRUE, and global_vars::UseThreads.

Referenced by AddPacketToPending(), BlockPacket(), DecodeIPDefrag(), DropPacket(), FreeSaveQuery(), GetAndLockSavedPackets(), GetEmptyPacket(), PopFromPending(), ReturnEmptyPacket(), SavePacket(), TimeoutSavedPackets(), and UnlockSavedQuery().

int hlbr_mutex_trylock ( pthread_mutex_t *  mutex,
int  ID,
int *  LockID 
)

Definition at line 300 of file hlbr.c.

References Globals, TRUE, and global_vars::UseThreads.

int hlbr_mutex_unlock ( pthread_mutex_t *  mutex  ) 

Definition at line 319 of file hlbr.c.

References Globals, TRUE, and global_vars::UseThreads.

Referenced by AddPacketToPending(), BlockPacket(), DecodeIPDefrag(), DropPacket(), FreeSaved(), FreeSaveQuery(), GetAndLockSavedPackets(), PopFromPending(), SavePacket(), TimeoutSavedPackets(), and UnlockSavedQuery().

Generated on Sat Jul 7 23:33:10 2007 for HLBR by  doxygen 1.5.2