serialization of idmef events

Hauke Mehrtens <[email protected]> Fri, 14 May 2010 15:41:23 +0200
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
Hi,

We want to serialize idmef events (idmef_message_t or IDMEF), into a
void * and a length. Then we want to send it with an own network
protocol and deserialize it on the other side back into an idmef event.

I have attached the code we use for {de}serialization for now, but it
does not work. ;-) Is it the correct way to do this, or is there a
better and working way? I removed some error handling.
Is there any other documentation that the API doku available or are
there some examples available on the Internet on how to do
{de}serialization?

Some bytes are send through the network but the reveived idmef event is
completely empty. The transmitted contains some data.

Hauke

---------
For serialization we use a prelude_msgbuf_t and a prelude_io_t.

event_sender::event_sender(sema_queue<IDMEF *>* sq){
  prelude_msgbuf_new(&msgbuf);
  prelude_io_new(&io);
  prelude_msgbuf_set_callback(msgbuf, msgbuf_callback_io);
  prelude_msgbuf_set_data(msgbuf, io);
  prelude_io_set_write_callback(io, io_write_callback);
}
event_sender::~event_sender(){
  prelude_msgbuf_destroy(msgbuf);
  prelude_io_destroy(io);
  return;
}
void event_sender::send_events(){
  while (1) {
    IDMEF *event = getevent();
    serilze_message(*event);
    delete event;
  }
}
void event_sender::serilze_message(idmef_message_t *message) {
  idmef_message_write(message, msgbuf);
  prelude_msgbuf_mark_end(msgbuf);
}
int msgbuf_callback_io(prelude_msgbuf_t *msgbuf, prelude_msg_t *msg) {
  int ret;
  prelude_io_t *io = (prelude_io_t *)prelude_msgbuf_get_data(msgbuf);
  ret = prelude_msg_write(msg, io);
  if ( ret < 0 )
    return ret;
  return 0;
}
ssize_t io_write_callback(prelude_io_t *io, const void *buf, size_t count) {
  // TODO send data
  return count;
}

-------
To deserialization we use the following code:

struct event_dispatcher {
  prelude_io_t *pio;
};

static ssize_t io_read_callback(prelude_io_t *io, void *buf, size_t count) {
  // TODO: add read
  return count;
}
int event_dispatcher_init(struct event_dispatcher **io) {
  struct event_dispatcher *dispatcher;
  dispatcher = (struct event_dispatcher *)malloc(sizeof(struct
event_dispatcher));
  prelude_io_new(&(dispatcher->pio));
  prelude_io_set_read_callback(dispatcher->pio, io_read_callback);
  *io = dispatcher;
  return 0;
}
int event_dispatcher_read(struct event_dispatcher *io, idmef_message_t
*message) {
  prelude_msg_t *msg = NULL;
  prelude_msg_read(&msg, io->pio);
  idmef_message_new(&message);
  idmef_message_read(message, msg);
  idmef_message_set_pmsg(message, msg);
  return 0;
}
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user