serialization of idmef events
Hauke Mehrtens <[email protected]> Fri, 14 May 2010 15:41:23 +0200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hi,
We want to serialize idmef events (idmef_message_t or IDMEF), into a
void * and a length. Then we want to send it with an own network
protocol and deserialize it on the other side back into an idmef event.
I have attached the code we use for {de}serialization for now, but it
does not work. ;-) Is it the correct way to do this, or is there a
better and working way? I removed some error handling.
Is there any other documentation that the API doku available or are
there some examples available on the Internet on how to do
{de}serialization?
Some bytes are send through the network but the reveived idmef event is
completely empty. The transmitted contains some data.
Hauke
---------
For serialization we use a prelude_msgbuf_t and a prelude_io_t.
event_sender::event_sender(sema_queue<IDMEF *>* sq){
prelude_msgbuf_new(&msgbuf);
prelude_io_new(&io);
prelude_msgbuf_set_callback(msgbuf, msgbuf_callback_io);
prelude_msgbuf_set_data(msgbuf, io);
prelude_io_set_write_callback(io, io_write_callback);
}
event_sender::~event_sender(){
prelude_msgbuf_destroy(msgbuf);
prelude_io_destroy(io);
return;
}
void event_sender::send_events(){
while (1) {
IDMEF *event = getevent();
serilze_message(*event);
delete event;
}
}
void event_sender::serilze_message(idmef_message_t *message) {
idmef_message_write(message, msgbuf);
prelude_msgbuf_mark_end(msgbuf);
}
int msgbuf_callback_io(prelude_msgbuf_t *msgbuf, prelude_msg_t *msg) {
int ret;
prelude_io_t *io = (prelude_io_t *)prelude_msgbuf_get_data(msgbuf);
ret = prelude_msg_write(msg, io);
if ( ret < 0 )
return ret;
return 0;
}
ssize_t io_write_callback(prelude_io_t *io, const void *buf, size_t count) {
// TODO send data
return count;
}
-------
To deserialization we use the following code:
struct event_dispatcher {
prelude_io_t *pio;
};
static ssize_t io_read_callback(prelude_io_t *io, void *buf, size_t count) {
// TODO: add read
return count;
}
int event_dispatcher_init(struct event_dispatcher **io) {
struct event_dispatcher *dispatcher;
dispatcher = (struct event_dispatcher *)malloc(sizeof(struct
event_dispatcher));
prelude_io_new(&(dispatcher->pio));
prelude_io_set_read_callback(dispatcher->pio, io_read_callback);
*io = dispatcher;
return 0;
}
int event_dispatcher_read(struct event_dispatcher *io, idmef_message_t
*message) {
prelude_msg_t *msg = NULL;
prelude_msg_read(&msg, io->pio);
idmef_message_new(&message);
idmef_message_read(message, msg);
idmef_message_set_pmsg(message, msg);
return 0;
}
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user