capdev.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

/*
* This file is part of Firestorm NIDS
* Copyright (c) 2002 Gianni Tedesco
* This program is released under the terms of the GNU GPL version 2
*
*    This file represents the capdev subsystem. All capture
*    types are registered and found here.
*/
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>

#include <firestorm.h>
#include <loader.h>
#include <packet.h>
#include <cleanup.h>
#include <args.h>
#include <alert.h>
#include <signature.h>
#include <decode.h>
#include <capture.h>

/* Packet serial number */
serial_t the_serial=0;

struct capdev *capdevs=NULL;

void capdev_load(void)
{
	struct plugin *p;
	proc_capdev_load fn;
	static struct capture_api capi={
		.size=sizeof(capi),
		.capdev_add=capdev_add,
		.serial_number=serial_number,
		.decode_proto=decode_proto,
		.decode_subproto=decode_subproto,
		.args_parse=args_parse,
	};

	for(p=ld_list; p; p=p->next) {
		if ( !(fn=loader_symbol(p, plugin_capdev)) )
			continue;

		loader_perror(p, "capdev", fn(&capi));
	}
}

/* Fetch a new serial number */
void serial_number(serial_t *s)
{
	*s=the_serial++;
}

/* Find a capdev with the specified name */
struct capdev *capdev_find(const char *name)
{
	struct capdev *c;

	if ( !name ) return NULL;

	for(c=capdevs; c; c=c->next) {
		if ( !strcmp(c->name, name) ) return c;
	}

	return NULL;
}

/* plugins call this to register capdevs */
int capdev_add(struct capdev *cap)
{
	if ( !cap || cap->next || !cap->name )
		return 0;

	if ( capdev_find(cap->name) ) {
		mesg(M_DEBUG,"capdev: error: '%s' capdev is "
			"already registered", cap->name);
		return 0;
	}

	cap->next=capdevs;
	capdevs=cap;

	return 1;
}