capture.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __CAPTURE_HEADER_INCLUDED__
#define __CAPTURE_HEADER_INCLUDED__

#include <signal.h> /* For sig_atomic_t */

#define CAP_STATE_NULL		0 /* Not started */
#define CAP_STATE_ENDED		0 /* Finished */
#define CAP_STATE_INIT		1 /* Initialised */
#define CAP_STATE_CAPTURE	2 /* mid-capture */
#define CAP_STATE_STOP		3 /* Stopping */
#define CAP_STATE_INT		4 /* Interrupted */

struct capture {
	struct capdev		*capdev;
	sig_atomic_t		state;
	char			*args;
	void			*priv;
};

typedef void *(*proc_capdev_init)(char *);
typedef void (*proc_capdev_end)(void *);
typedef void (*proc_capdev_go)(void *, struct capture *);

struct capdev {
	struct capdev		*next;
	const char		*name;
	proc_capdev_init	init;
	proc_capdev_end		end;
	proc_capdev_go		go;
};

#ifndef __PLUGIN__
void capture_init(void);
void capture_setup(char *, char *);
void capture_go(void);
void capture_stop(void);
void capture_interrupt(void);
void capdev_stats(void);
int capdev_add(struct capdev *);
void serial_number(serial_t *);
extern serial_t the_serial;
#endif

typedef int(*proc_capdev_add)(struct capdev *);
typedef void (*proc_serial_number)(serial_t *);

struct capture_api {
	size_t size;
	proc_capdev_add capdev_add;
	proc_args_parse args_parse;
	proc_serial_number serial_number;
	proc_decode_proto decode_proto;
	proc_decode_subproto decode_subproto;
};
typedef int (*proc_capdev_load)(struct capture_api *);

#ifndef __PLUGIN__
struct capdev *capdev_find(const char *);
void capdev_load(void);
#else
typedef struct capdev *(*proc_capdev_find)(const char *);
#endif

#endif /* __CAPTURE_HEADER_INCLUDED__ */