Broccoli API Documentation  1.100
Broccoli API Documentation
broccoli.h
Go to the documentation of this file.
1 
5 /*
6  B R O C C O L I -- The Bro Client Communications Library
7 
8 Copyright (C) 2004-2007 Christian Kreibich <christian (at) icir.org>
9 
10 Permission is hereby granted, free of charge, to any person obtaining a copy
11 of this software and associated documentation files (the "Software"), to
12 deal in the Software without restriction, including without limitation the
13 rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
14 sell copies of the Software, and to permit persons to whom the Software is
15 furnished to do so, subject to the following conditions:
16 
17 The above copyright notice and this permission notice shall be included in
18 all copies of the Software and its documentation and acknowledgment shall be
19 given in the documentation and software packages that this Software was
20 used.
21 
22 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
25 THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
26 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
27 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
28 
29 */
30 #ifndef broccoli_h
31 #define broccoli_h
32 
33 #include <inttypes.h>
34 #include <unistd.h>
35 #include <sys/types.h>
36 #include <stdlib.h>
37 #ifdef __MINGW32__
38 #include <winsock.h>
39 #else
40 #include <netinet/in.h>
41 #endif
42 #include <openssl/crypto.h>
43 
44 #ifdef __cplusplus
45 extern "C" {
46 #endif
47 
55 extern int bro_debug_calltrace;
56 
64 extern int bro_debug_messages;
65 
66 #ifndef FALSE
67 #define FALSE (0)
68 #endif
69 
70 #ifndef TRUE
71 #define TRUE (!FALSE)
72 #endif
73 
74 /* Numeric values of Bro type identifiers, corresponding
75  * to the values of the TypeTag enum in Bro's Type.h. Use
76  * these values with bro_event_add_val(), bro_record_add_val(),
77  * bro_record_get_nth_val() and bro_record_get_named_val().
78  */
84 #define BRO_TYPE_UNKNOWN 0
85 #define BRO_TYPE_BOOL 1
86 #define BRO_TYPE_INT 2
87 #define BRO_TYPE_COUNT 3
88 #define BRO_TYPE_COUNTER 4
89 #define BRO_TYPE_DOUBLE 5
90 #define BRO_TYPE_TIME 6
91 #define BRO_TYPE_INTERVAL 7
92 #define BRO_TYPE_STRING 8
93 #define BRO_TYPE_PATTERN 9
94 #define BRO_TYPE_ENUM 10
95 #define BRO_TYPE_TIMER 11
96 #define BRO_TYPE_PORT 12
97 #define BRO_TYPE_IPADDR 13
98 #define BRO_TYPE_SUBNET 14
99 #define BRO_TYPE_ANY 15
100 #define BRO_TYPE_TABLE 16
101 #define BRO_TYPE_UNION 17
102 #define BRO_TYPE_RECORD 18
103 #define BRO_TYPE_LIST 19
104 #define BRO_TYPE_FUNC 20
105 #define BRO_TYPE_FILE 21
106 #define BRO_TYPE_VECTOR 22
107 #define BRO_TYPE_ERROR 23
108 #define BRO_TYPE_PACKET 24 /* CAUTION -- not defined in Bro! */
109 #define BRO_TYPE_SET 25 /* CAUTION -- not defined in Bro! */
110 #define BRO_TYPE_MAX 26
111 
112 /* Flags for new connections, to pass to bro_conn_new()
113  * and bro_conn_new_str(). See manual for details.
114  */
115 #define BRO_CFLAG_NONE 0
116 #define BRO_CFLAG_RECONNECT (1 << 0)
117 #define BRO_CFLAG_ALWAYS_QUEUE (1 << 1)
118 #define BRO_CFLAG_SHAREABLE (1 << 2)
119 #define BRO_CFLAG_DONTCACHE (1 << 3)
120 #define BRO_CFLAG_YIELD (1 << 4)
121 #define BRO_CFLAG_CACHE (1 << 5)
124 /* ---------------------------- Typedefs ----------------------------- */
125 
126 
127 typedef uint64_t uint64;
128 typedef uint32_t uint32;
129 typedef uint16_t uint16;
130 typedef uint8_t uint8;
131 typedef unsigned char uchar;
132 
133 typedef struct bro_conn BroConn;
134 typedef struct bro_event BroEvent;
135 typedef struct bro_buf BroBuf;
136 typedef struct bro_record BroRecord;
137 typedef struct bro_table BroTable;
138 typedef struct bro_table BroSet;
139 typedef struct bro_vector BroVector;
140 typedef struct bro_ev_meta BroEvMeta;
141 typedef struct bro_packet BroPacket;
142 
143 /* ----------------------- Callback Signatures ----------------------- */
144 
155 typedef void (*BroEventFunc) (BroConn *bc, void *user_data, ...);
156 
167 typedef void (*BroCompactEventFunc) (BroConn *bc, void *user_data, BroEvMeta *meta);
168 
169 typedef void (*BroPacketFunc) (BroConn *bc, void *user_data,
170  const BroPacket *packet);
171 
190 typedef void (*OpenSSL_lock_func) (int mode, int n, const char *file, int line);
191 
199 typedef unsigned long (*OpenSSL_thread_id_func) (void);
200 
201 
210 typedef struct CRYPTO_dynlock_value* (*OpenSSL_dynlock_create_func) (const char *file, int line);
211 
222 typedef void (*OpenSSL_dynlock_lock_func) (int mode, struct CRYPTO_dynlock_value *mutex,
223  const char *file, int line);
224 
234 typedef void (*OpenSSL_dynlock_free_func) (struct CRYPTO_dynlock_value *mutex,
235  const char *file, int line);
236 
237 
238 /* ---------------------------- Structures --------------------------- */
239 
240 
242 typedef struct bro_ctx {
248 } BroCtx;
249 
251 typedef struct bro_conn_stats {
252  int tx_buflen;
253  int rx_buflen;
254 } BroConnStats;
255 
258 typedef struct bro_string {
259  uint32 str_len;
260  uchar *str_val;
261 } BroString;
262 
266 typedef struct bro_port {
267  uint64 port_num;
269 } BroPort;
270 
275 typedef struct bro_addr
276 {
277  uint32 addr[4];
278 } BroAddr;
279 
282 typedef struct bro_subnet
283 {
285  uint32 sn_width;
286 } BroSubnet;
287 
291 typedef struct bro_ev_arg
292 {
293  void *arg_data;
294  int arg_type;
295 } BroEvArg;
296 
301 {
302  const char *ev_name;
303  double ev_ts;
306  const uchar *ev_start;
307  const uchar *ev_end;
308 };
309 
310 #define BRO_PCAP_SUPPORT
311 #ifdef BRO_PCAP_SUPPORT
312 #include <pcap.h>
313 
318 {
319  double pkt_time;
320  uint32 pkt_hdr_size;
322 
323  struct pcap_pkthdr pkt_pcap_hdr;
324  const u_char *pkt_data;
325  const char *pkt_tag;
326 
327 };
328 
329 #endif
330 
331 /* ============================ API ================================== */
332 
333 /* -------------------------- Initialization ------------------------- */
334 
347 int bro_init(const BroCtx *ctx);
348 
349 
354 void bro_ctx_init(BroCtx *ctx);
355 
356 
357 /* ----------------------- Connection Handling ----------------------- */
358 
374 BroConn *bro_conn_new(struct in_addr *ip_addr, uint16 port, int flags);
375 
391 BroConn *bro_conn_new6(struct in6_addr *ip_addr, uint16 port, int flags);
392 
407 BroConn *bro_conn_new_str(const char *hostname, int flags);
408 
423 BroConn *bro_conn_new_socket(int socket, int flags);
424 
438 void bro_conn_set_class(BroConn *bc, const char *classname);
439 
447 const char *bro_conn_get_peer_class(const BroConn *bc);
448 
449 
458 void bro_conn_get_connstats(const BroConn *bc, BroConnStats *cs);
459 
460 
470 int bro_conn_connect(BroConn *bc);
471 
472 
485 int bro_conn_reconnect(BroConn *bc);
486 
487 
498 int bro_conn_delete(BroConn *bc);
499 
500 
519 int bro_conn_alive(const BroConn *bc);
520 
521 
530 void bro_conn_adopt_events(BroConn *src, BroConn *dst);
531 
532 
543 int bro_conn_get_fd(BroConn *bc);
544 
545 
560 
561 
562 /* ---------------------- Connection data storage -------------------- */
563 
564 /* Connection handles come with a faciity to store and retrieve
565  * arbitrary data items. Use the following functions to store,
566  * query, and remove items from a connection handle.
567  */
568 
579 void bro_conn_data_set(BroConn *bc, const char *key, void *val);
580 
581 
592 void *bro_conn_data_get(BroConn *bc, const char *key);
593 
594 
604 void *bro_conn_data_del(BroConn *bc, const char *key);
605 
606 
607 /* ----------------------------- Bro Events -------------------------- */
608 
618 BroEvent *bro_event_new(const char *event_name);
619 
620 
628 void bro_event_free(BroEvent *be);
629 
630 
647 int bro_event_add_val(BroEvent *be, int type,
648  const char *type_name,const void *val);
649 
650 
668 int bro_event_set_val(BroEvent *be, int val_num,
669  int type, const char *type_name,
670  const void *val);
671 
688 int bro_event_send(BroConn *bc, BroEvent *be);
689 
690 
702 int bro_event_send_raw(BroConn *bc, const uchar *data, int data_len);
703 
704 
715 
716 
727 
728 
739 
740 
741 /* ------------------------ Bro Event Callbacks ---------------------- */
742 
765  const char *event_name,
766  BroEventFunc func,
767  void *user_data);
768 
784  const char *event_name,
785  BroCompactEventFunc func,
786  void *user_data);
787 
796 void bro_event_registry_remove(BroConn *bc, const char *event_name);
797 
806 
807 
808 
809 /* ------------------------ Dynamic-size Buffers --------------------- */
810 
817 BroBuf *bro_buf_new(void);
818 
826 void bro_buf_free(BroBuf *buf);
827 
844 int bro_buf_append(BroBuf *buf, void *data, int data_len);
845 
846 
858 void bro_buf_consume(BroBuf *buf);
859 
860 
868 void bro_buf_reset(BroBuf *buf);
869 
870 
877 uchar *bro_buf_get(BroBuf *buf);
878 
879 
887 uchar *bro_buf_get_end(BroBuf *buf);
888 
889 
897 uint bro_buf_get_size(BroBuf *buf);
898 
899 
906 uint bro_buf_get_used_size(BroBuf *buf);
907 
908 
915 uchar *bro_buf_ptr_get(BroBuf *buf);
916 
917 
924 uint32 bro_buf_ptr_tell(BroBuf *buf);
925 
926 
943 int bro_buf_ptr_seek(BroBuf *buf, int offset, int whence);
944 
945 
956 int bro_buf_ptr_check(BroBuf *buf, int size);
957 
958 
974 int bro_buf_ptr_read(BroBuf *buf, void *data, int size);
975 
990 int bro_buf_ptr_write(BroBuf *buf, void *data, int size);
991 
992 
993 /* ------------------------ Configuration Access --------------------- */
994 
1005 void bro_conf_set_domain(const char *domain);
1006 
1007 
1019 int bro_conf_get_int(const char *val_name, int *val);
1020 
1021 
1033 int bro_conf_get_dbl(const char *val_name, double *val);
1034 
1035 
1047 const char *bro_conf_get_str(const char *val_name);
1048 
1049 
1050 
1051 /* ------------------------------ Strings ---------------------------- */
1052 
1061 void bro_string_init(BroString *bs);
1062 
1075 int bro_string_set(BroString *bs, const char *s);
1076 
1089 int bro_string_set_data(BroString *bs, const uchar *data, int data_len);
1090 
1101 const uchar *bro_string_get_data(const BroString *bs);
1102 
1109 uint32 bro_string_get_length(const BroString *bs);
1110 
1119 
1129 void bro_string_assign(BroString *src, BroString *dst);
1130 
1140 void bro_string_cleanup(BroString *bs);
1141 
1149 void bro_string_free(BroString *bs);
1150 
1151 
1152 /* -------------------------- Record Handling ------------------------ */
1153 
1166 BroRecord *bro_record_new(void);
1167 
1175 void bro_record_free(BroRecord *rec);
1176 
1184 
1207 int bro_record_add_val(BroRecord *rec, const char *name,
1208  int type, const char *type_name,
1209  const void *val);
1210 
1231 void* bro_record_get_nth_val(BroRecord *rec, int num, int *type);
1232 
1233 
1243 const char* bro_record_get_nth_name(BroRecord *rec, int num);
1244 
1245 
1259 void* bro_record_get_named_val(BroRecord *rec, const char *name, int *type);
1260 
1261 
1279 int bro_record_set_nth_val(BroRecord *rec, int num,
1280  int type, const char *type_name,
1281  const void *val);
1282 
1300 int bro_record_set_named_val(BroRecord *rec, const char *name,
1301  int type, const char *type_name,
1302  const void *val);
1303 
1304 
1305 /* -------------------------- Tables & Sets -------------------------- */
1306 
1318 typedef int (*BroTableCallback) (void *key, void *val, void *user_data);
1319 
1320 
1321 BroTable *bro_table_new(void);
1322 void bro_table_free(BroTable *tbl);
1323 
1324 int bro_table_insert(BroTable *tbl,
1325  int key_type, const void *key,
1326  int val_type, const void *val);
1327 
1328 void *bro_table_find(BroTable *tbl, const void *key);
1329 
1330 int bro_table_get_size(BroTable *tbl);
1331 
1333  void *user_data);
1334 
1335 void bro_table_get_types(BroTable *tbl,
1336  int *key_type, int *val_type);
1337 
1338 
1349 typedef int (*BroSetCallback) (void *val, void *user_data);
1350 
1351 BroSet *bro_set_new(void);
1352 void bro_set_free(BroSet *set);
1353 
1354 int bro_set_insert(BroSet *set, int type, const void *val);
1355 
1356 int bro_set_find(BroSet *set, const void *key);
1357 
1358 int bro_set_get_size(BroSet *set);
1359 
1360 void bro_set_foreach(BroSet *set, BroSetCallback cb,
1361  void *user_data);
1362 
1363 void bro_set_get_type(BroSet *set, int *type);
1364 
1365 /* ----------------------------- Vectors ----------------------------- */
1366 
1374 BroVector *bro_vector_new(void);
1375 
1383 void bro_vector_free(BroVector *vec);
1384 
1392 
1414 int bro_vector_add_val(BroVector *vec,
1415  int type, const char *type_name,
1416  const void *val);
1417 
1438 void* bro_vector_get_nth_val(BroVector *vec, int num, int *type);
1439 
1440 
1458 int bro_vector_set_nth_val(BroVector *vec, int num,
1459  int type, const char *type_name,
1460  const void *val);
1461 
1462 
1463 /* ----------------------- Pcap Packet Handling ---------------------- */
1464 #ifdef BRO_PCAP_SUPPORT
1465 
1474 void bro_conn_set_packet_ctxt(BroConn *bc, int link_type);
1475 
1483 void bro_conn_get_packet_ctxt(BroConn *bc, int *link_type);
1484 
1495 BroPacket *bro_packet_new(const struct pcap_pkthdr *hdr, const u_char *data, const char* tag);
1496 
1503 BroPacket *bro_packet_clone(const BroPacket *packet);
1504 
1512 void bro_packet_free(BroPacket *packet);
1513 
1523 int bro_packet_send(BroConn *bc, BroPacket *packet);
1524 
1525 #endif
1526 
1527 /* --------------------------- Miscellaneous ------------------------- */
1528 
1535 double bro_util_current_time(void);
1536 
1544 double bro_util_timeval_to_double(const struct timeval *tv);
1545 
1552 int bro_util_is_v4_addr(const BroAddr *a);
1553 
1558 extern const uint8 BRO_IPV4_MAPPED_PREFIX[12];
1559 
1560 #ifdef __cplusplus
1561 }
1562 #endif
1563 
1564 #endif
void(* BroCompactEventFunc)(BroConn *bc, void *user_data, BroEvMeta *meta)
BroCompactEventFunc - The signature of compact event callbacks.
Definition: broccoli.h:167
Initialization context for the Broccoli library.
Definition: broccoli.h:242
OpenSSL_dynlock_lock_func dl_lock_func
Definition: broccoli.h:246
uint64_t uint64
Definition: broccoli.h:127
void * bro_table_find(BroTable *tbl, const void *key)
int(* BroSetCallback)(void *val, void *user_data)
BroTableCallback - The signature of callbacks for iterating over sets.
Definition: broccoli.h:1349
unsigned long(* OpenSSL_thread_id_func)(void)
OpenSSL_thread_id_func - thread ID function for OpenSSL thread safeness.
Definition: broccoli.h:199
IP addresses are 16-bytes in network byte order.
Definition: broccoli.h:275
Statistical properties of a given connection.
Definition: broccoli.h:251
void * bro_conn_data_del(BroConn *bc, const char *key)
bro_conn_data_del - Removes a data item.
unsigned char uchar
Definition: broccoli.h:131
uchar * bro_buf_get_end(BroBuf *buf)
bro_buf_get_end - Returns pointer to the end of the buffer.
int bro_debug_calltrace
bro_debug_calltrace - Debugging output switch for call tracing.
void bro_table_free(BroTable *tbl)
uchar * bro_buf_ptr_get(BroBuf *buf)
bro_buf_ptr_get - Returns current buffer content pointer.
BroStrings are used to access string parameters in received events.
Definition: broccoli.h:258
int bro_conf_get_int(const char *val_name, int *val)
bro_conf_get_int - Retrieves an integer from the configuration.
int bro_record_set_nth_val(BroRecord *rec, int num, int type, const char *type_name, const void *val)
bro_record_set_nth_val - Replaces a value in a record, identified by field index. ...
double pkt_time
Definition: broccoli.h:319
uint8_t uint8
Definition: broccoli.h:130
BroConn * bro_conn_new(struct in_addr *ip_addr, uint16 port, int flags)
bro_conn_new - Creates and returns a handle for a connection to a remote Bro.
struct bro_event BroEvent
Definition: broccoli.h:134
struct bro_addr BroAddr
IP addresses are 16-bytes in network byte order.
struct bro_subnet BroSubnet
Subnets are a 16-byte address with a prefix width in bits.
int bro_string_set(BroString *bs, const char *s)
bro_string_set - Sets a BroString&#39;s contents.
Encapsulation of arguments passed to an event callback, for the compact style of argument passing...
Definition: broccoli.h:291
struct bro_string BroString
BroStrings are used to access string parameters in received events.
BroConn * bro_conn_new_str(const char *hostname, int flags)
bro_conn_new_str - Same as bro_conn_new(), but accepts strings for hostname and port.
struct bro_vector BroVector
Definition: broccoli.h:139
int bro_conn_alive(const BroConn *bc)
bro_conn_alive - Reports whether a connection is currently alive or has died.
uint bro_buf_get_used_size(BroBuf *buf)
bro_buf_get_used_size - Returns number of bytes currently used.
int bro_vector_get_length(BroVector *vec)
bro_vector_get_length - Returns number of elements in vector.
int bro_conn_reconnect(BroConn *bc)
bro_conn_reconnect - Drop the current connection and reconnect, reusing all settings.
int bro_event_send_raw(BroConn *bc, const uchar *data, int data_len)
bro_event_send_raw - Enqueues a serialized event directly into a connection&#39;s send buffer...
OpenSSL_dynlock_create_func dl_create_func
Definition: broccoli.h:245
void(* OpenSSL_dynlock_free_func)(struct CRYPTO_dynlock_value *mutex, const char *file, int line)
OpenSSL_dynlock_free_func - dynamic lock deallocator, for OpenSSL thread safeness.
Definition: broccoli.h:234
void bro_conn_get_packet_ctxt(BroConn *bc, int *link_type)
bro_conn_get_packet_ctxt - Gets current packet context for connection.
void bro_packet_free(BroPacket *packet)
bro_packet_free - Releases a packet.
uint bro_buf_get_size(BroBuf *buf)
bro_buf_get_size - Returns number of bytes allocated for buffer.
BroTable * bro_table_new(void)
void bro_string_free(BroString *bs)
bro_string_free - Cleans up dynamically allocated BroString.
int bro_debug_messages
bro_debug_messages - Output switch for debugging messages.
uint32 pkt_link_type
Definition: broccoli.h:321
int bro_conn_get_fd(BroConn *bc)
bro_conn_get_fd - Returns file descriptor of a Bro connection.
void bro_conn_adopt_events(BroConn *src, BroConn *dst)
bro_conn_adopt_events - Makes one connection send out the same events as another. ...
int bro_record_set_named_val(BroRecord *rec, const char *name, int type, const char *type_name, const void *val)
bro_record_set_named_val - Replaces a value in a record, identified by name.
int bro_buf_ptr_write(BroBuf *buf, void *data, int size)
bro_buf_ptr_write - Writes a number of bytes into buffer.
int tx_buflen
Number of bytes to process in output buffer.
Definition: broccoli.h:252
uchar * bro_buf_get(BroBuf *buf)
bro_buf_get - Returns pointer to actual start of buffer.
void bro_record_free(BroRecord *rec)
bro_record_free - Releases a record.
int bro_buf_append(BroBuf *buf, void *data, int data_len)
bro_buf_append - appends data to the end of the buffer.
void bro_buf_free(BroBuf *buf)
bro_buf_free - Releases a dynamically allocated buffer object.
void bro_event_registry_add_compact(BroConn *bc, const char *event_name, BroCompactEventFunc func, void *user_data)
bro_event_registry_add_compact - Adds a compact-argument event callback to the event registry...
BroString * bro_string_copy(BroString *bs)
bro_string_copy - Duplicates a BroString.
double ev_ts
Timestamp of event, taken from BroEvent itself.
Definition: broccoli.h:303
void bro_conn_get_connstats(const BroConn *bc, BroConnStats *cs)
bro_conn_get_connstats - Reports connection properties.
int bro_event_queue_length(BroConn *bc)
bro_event_queue_length - Returns current queue length.
void bro_conn_data_set(BroConn *bc, const char *key, void *val)
bro_conn_data_set - Puts a data item into the registry.
int bro_buf_ptr_read(BroBuf *buf, void *data, int size)
bro_buf_ptr_read - Extracts a number of bytes from buffer.
void bro_buf_consume(BroBuf *buf)
bro_buf_consume - shrinks the buffer.
int bro_set_insert(BroSet *set, int type, const void *val)
const char * pkt_tag
Definition: broccoli.h:325
int bro_vector_set_nth_val(BroVector *vec, int num, int type, const char *type_name, const void *val)
bro_vector_set_nth_val - Replaces a value in a vector, identified by index.
BroBuf * bro_buf_new(void)
bro_buf_new - Creates a new buffer object.
uint32 bro_string_get_length(const BroString *bs)
bro_string_get_length - Returns string&#39;s length.
BroEvArg * ev_args
Array of BroEvArgs, one for each argument.
Definition: broccoli.h:305
int bro_conn_connect(BroConn *bc)
bro_conn_connect - Establish connection to peer.
void * bro_conn_data_get(BroConn *bc, const char *key)
bro_conn_data_get - Looks up a data item.
struct bro_table BroTable
Definition: broccoli.h:137
int arg_type
A BRO_TYPE_xxx constant.
Definition: broccoli.h:294
BroSet * bro_set_new(void)
const u_char * pkt_data
Definition: broccoli.h:324
void bro_conf_set_domain(const char *domain)
bro_conf_set_domain - Sets the current domain to use in a config file.
BroPacket * bro_packet_new(const struct pcap_pkthdr *hdr, const u_char *data, const char *tag)
bro_packet_new - Creates a new packet.
int bro_record_get_length(BroRecord *rec)
bro_record_get_length - Returns number of fields in record.
Subnets are a 16-byte address with a prefix width in bits.
Definition: broccoli.h:282
uint32 bro_buf_ptr_tell(BroBuf *buf)
bro_buf_ptr_tell - Returns current offset of buffer content pointer.
uint16_t uint16
Definition: broccoli.h:129
double bro_util_current_time(void)
bro_util_current_time - Gets current time.
uint32_t uint32
Definition: broccoli.h:128
struct CRYPTO_dynlock_value *(* OpenSSL_dynlock_create_func)(const char *file, int line)
OpenSSL_dynlock_create_func - allocator for dynamic locks, for OpenSSL thread safeness.
Definition: broccoli.h:210
void(* OpenSSL_dynlock_lock_func)(int mode, struct CRYPTO_dynlock_value *mutex, const char *file, int line)
OpenSSL_dynlock_lock_func - lock/unlock dynamic locks, for OpenSSL thread safeness.
Definition: broccoli.h:222
BroConn * bro_conn_new6(struct in6_addr *ip_addr, uint16 port, int flags)
bro_conn_new6 - Creates and returns a handle for a connection to a remote Bro.
uint32 str_len
Definition: broccoli.h:259
void bro_event_registry_add(BroConn *bc, const char *event_name, BroEventFunc func, void *user_data)
bro_event_registry_add - Adds an expanded-argument event callback to the event registry.
struct bro_record BroRecord
Definition: broccoli.h:136
OpenSSL_lock_func lock_func
Definition: broccoli.h:243
int bro_event_add_val(BroEvent *be, int type, const char *type_name, const void *val)
bro_event_add_val - Adds a parameter to an event.
struct bro_table BroSet
Definition: broccoli.h:138
BroPacket * bro_packet_clone(const BroPacket *packet)
bro_packet_clone - Clones a packet.
struct bro_ev_arg BroEvArg
Encapsulation of arguments passed to an event callback, for the compact style of argument passing...
int port_proto
IPPROTO_xxx.
Definition: broccoli.h:268
Broccoli can send and receive pcap-captured packets, wrapped into the following structure: ...
Definition: broccoli.h:317
struct bro_port BroPort
Ports in Broccoli do not only consist of a number but also indicate whether they are TCP or UDP...
void(* BroPacketFunc)(BroConn *bc, void *user_data, const BroPacket *packet)
Definition: broccoli.h:169
OpenSSL_thread_id_func id_func
Definition: broccoli.h:244
void bro_string_cleanup(BroString *bs)
bro_string_cleanup - Cleans up existing BroString.
int bro_event_send(BroConn *bc, BroEvent *be)
bro_event_send - Tries to send an event to a Bro agent.
Metadata for an event, passed to callbacks of the BroCompactEventFunc prototype.
Definition: broccoli.h:300
const uchar * ev_end
End pointer to serialized version of currently processed event.
Definition: broccoli.h:307
uint32 sn_width
Length of prefix to consider.
Definition: broccoli.h:285
int bro_table_get_size(BroTable *tbl)
int rx_buflen
Number of bytes to process in input buffer.
Definition: broccoli.h:253
int bro_set_get_size(BroSet *set)
void * arg_data
Pointer to the actual event argument.
Definition: broccoli.h:293
BroRecord * bro_record_new(void)
bro_record_new - Creates a new record.
BroVector * bro_vector_new(void)
bro_vector_new - Creates a new vector.
void * bro_record_get_named_val(BroRecord *rec, const char *name, int *type)
bro_record_get_named_val - Retrieves a value from a record by field name.
void * bro_vector_get_nth_val(BroVector *vec, int num, int *type)
bro_vector_get_nth_val - Retrieves a value from a vector by index.
uint32 pkt_hdr_size
Definition: broccoli.h:320
void bro_set_get_type(BroSet *set, int *type)
struct bro_buf BroBuf
Definition: broccoli.h:135
void bro_event_registry_remove(BroConn *bc, const char *event_name)
bro_event_registry_remove - Removes an event handler.
uint64 port_num
Port number in host byte order.
Definition: broccoli.h:267
const uchar * bro_string_get_data(const BroString *bs)
bro_string_get_data - Returns pointer to the string data.
const char * ev_name
The name of the event.
Definition: broccoli.h:302
void bro_buf_reset(BroBuf *buf)
bro_buf_reset - resets the buffer.
Ports in Broccoli do not only consist of a number but also indicate whether they are TCP or UDP...
Definition: broccoli.h:266
int bro_event_set_val(BroEvent *be, int val_num, int type, const char *type_name, const void *val)
bro_event_set_val - Replace a value in an event.
void bro_event_registry_request(BroConn *bc)
bro_event_registry_request - Notifies peering Bro to send events.
void bro_conn_set_packet_ctxt(BroConn *bc, int link_type)
bro_conn_set_packet_ctxt - Sets current packet context for connection.
const char * bro_record_get_nth_name(BroRecord *rec, int num)
bro_record_get_nth_name - Retrieves a name from a record by field index.
int bro_event_queue_flush(BroConn *bc)
bro_event_queue_flush - Tries to flush the send queue of a connection.
int bro_record_add_val(BroRecord *rec, const char *name, int type, const char *type_name, const void *val)
bro_record_add_val - Adds a value to a record.
const char * bro_conf_get_str(const char *val_name)
bro_conf_get_str - Retrieves an integer from the configuration.
void bro_event_free(BroEvent *be)
bro_event_free - Releases all memory associated with an event.
void bro_set_free(BroSet *set)
void bro_table_get_types(BroTable *tbl, int *key_type, int *val_type)
int bro_string_set_data(BroString *bs, const uchar *data, int data_len)
bro_string_set_data - Sets a BroString&#39;s contents.
void bro_ctx_init(BroCtx *ctx)
bro_ctx_init - Initializes initialization context to default values.
int bro_set_find(BroSet *set, const void *key)
int bro_conn_process_input(BroConn *bc)
bro_conn_process_input - Processes input sent to the sensor by Bro.
int bro_event_queue_length_max(BroConn *bc)
bro_event_queue_length_max - Returns maximum queue length.
void(* OpenSSL_lock_func)(int mode, int n, const char *file, int line)
OpenSSL_lockfunc - locking function for OpenSSL thread safeness.
Definition: broccoli.h:190
int bro_init(const BroCtx *ctx)
bro_init - Initializes the library.
int ev_numargs
How many arguments are passed.
Definition: broccoli.h:304
double bro_util_timeval_to_double(const struct timeval *tv)
bro_util_timeval_to_double - Converts timeval struct to double.
struct bro_conn_stats BroConnStats
Statistical properties of a given connection.
int bro_util_is_v4_addr(const BroAddr *a)
bro_util_is_v4_addr - Checks if an address is IPv4.
const uint8 BRO_IPV4_MAPPED_PREFIX[12]
The standard 12-byte prefix of a 16-byte IPv6 address that indicates it&#39;s a mapped IPv4 address...
const char * bro_conn_get_peer_class(const BroConn *bc)
bro_conn_get_peer_class - Reports connection class indicated by peer.
struct bro_ctx BroCtx
Initialization context for the Broccoli library.
void bro_string_assign(BroString *src, BroString *dst)
bro_string_assign - Duplicates a BroString&#39;s content, assigning it to an existing one...
struct bro_conn BroConn
Definition: broccoli.h:133
void bro_table_foreach(BroTable *tbl, BroTableCallback cb, void *user_data)
void bro_conn_set_class(BroConn *bc, const char *classname)
bro_conn_set_class - Sets a connection&#39;s class identifier.
int(* BroTableCallback)(void *key, void *val, void *user_data)
BroTableCallback - The signature of callbacks for iterating over tables.
Definition: broccoli.h:1318
int bro_vector_add_val(BroVector *vec, int type, const char *type_name, const void *val)
bro_vector_add_val - Adds a value to a vector.
void bro_set_foreach(BroSet *set, BroSetCallback cb, void *user_data)
void bro_string_init(BroString *bs)
bro_string_init - Initializes an existing string structure.
int bro_table_insert(BroTable *tbl, int key_type, const void *key, int val_type, const void *val)
int bro_packet_send(BroConn *bc, BroPacket *packet)
bro_packet_send - Sends a packet over a given connection.
const uchar * ev_start
Start pointer to serialized version of currently processed event.
Definition: broccoli.h:306
void(* BroEventFunc)(BroConn *bc, void *user_data,...)
BroEventFunc - The signature of expanded event callbacks.
Definition: broccoli.h:155
int bro_conf_get_dbl(const char *val_name, double *val)
bro_conf_get_dbl - Retrieves a double float from the configuration.
void * bro_record_get_nth_val(BroRecord *rec, int num, int *type)
bro_record_get_nth_val - Retrieves a value from a record by field index.
BroEvent * bro_event_new(const char *event_name)
bro_event_new - Creates a new empty event with a given name.
BroConn * bro_conn_new_socket(int socket, int flags)
bro_conn_new_socket - Same as bro_conn_new(), but uses existing socket.
int bro_buf_ptr_seek(BroBuf *buf, int offset, int whence)
bro_buf_ptr_seek - Adjusts buffer content pointer.
int bro_conn_delete(BroConn *bc)
bro_conn_delete - terminates and releases connection.
BroAddr sn_net
IP address in network byte order.
Definition: broccoli.h:284
void bro_vector_free(BroVector *vec)
bro_vector_free - Releases a vector.
int bro_buf_ptr_check(BroBuf *buf, int size)
bro_buf_ptr_check - Checks whether a number of bytes can be read.
uchar * str_val
Definition: broccoli.h:260
OpenSSL_dynlock_free_func dl_free_func
Definition: broccoli.h:247