Event mechanism in Snort

In Program Event. H, event_queue.h, event_queue.c, event_wrapper.h, event_wrapper.c, and fsutil/sfeventq. H,/fsutil/sfeventq. c
1. Event mainly defines the data structure of an event // Event Data Structure
Typedef Struct _ Event
{
U_int32_t sig_generator; /**/ /*Which part of Snort generated the alert?*/
U_int32_t sig_id; /**/ /*Sig id for this generator*/
U_int32_t sig_rev; /**/ /*SIG revision for this ID*/
U_int32_t classification; /**/ /*Event Classification*/
U_int32_t priority; /**/ /*Event priority*/
U_int32_t event_id; /**/ /*Event ID*/
U_int32_t event_reference; /**/ /*Reference to other events that have gone off ,*/
/* Such as in the case of tagged packets*/
Struct Timeval ref_time; /**/ /*Reference time for the event reference*/
} Event;

2, event_queue.h and event_queue.c define Typedef Struct S_snort_eventq_user
{
CharRule_alert;
Void *Pkt;/* generally packet */

} Snort_eventq_user;

Typedef Struct S_snort_event_queue
{
IntMax_events;
IntLog_events;
IntOrder;

} Snort_event_queue;

Typedef Struct _ Eventnode
{
Unsigned Int GID;
Unsigned Int Sid;
Unsigned Int Rev;
Unsigned Int Classification;
Unsigned Int Priority;
Char * MSG;
Void * Rule_info;

} Eventnode; // the data structure of the event is roughly the same as that of the event.
// The specific implementation of the following functions calls the implementation of fsutil/fseventq. *
Int Snorteventqinit ( Void );
Void Snorteventqreset ( Void );
Int Snorteventqlog (Packet * );
Int Snorteventqadd (unsigned Int GID, unsigned Int Sid, unsigned Int Rev,
Unsigned Int Classification, unsigned Int PRI, Char   * MSG,
Void   * Rule_info );

Three static functions are available in event_queue.c.
Static int orderpriority (void * event1, void * event2) // compare the priority of event1 and event2 (priority Member size ),
If (event1-> priority <event2-> priority) return 1;
Static int ordercontentlength (void * event1, void * event2) // compare the length of Rule Information of event1 and event2 (length of rule_info). If event1 is large, 1 is returned.

Static int logsnortevents (void * event, void * User)

3. Two functions are defined in event_wrapper.h and event_wrapper.c. // Call setevent in log. C and calllogfuncs in detect. C to set the generated event and return event. event_id.
U_int32_t generatesnortevent (Packet * P,
U_int32_t gen_id,
U_int32_t sig_id,
U_int32_t sig_rev,
U_int32_t classification,
U_int32_t priority,
Char   * MSG );

// Similar to the previous function, only an event reference (event_ref) and time (ref_sec) are added, and 0 or 1 is returned.
// If both event_ref and ref_sec are not empty, 1 is returned.
Int Logtagdata (Packet * P,
u_int32_t gen_id,
u_int32_t sig_id,
u_int32_t sig_rev,
u_int32_t classification,
u_int32_t priority,
u_int32_t event_ref,
time_t ref_sec,
Char   * MSG );

4. sfeventq. h and sfenentq. c files
Five functions are defined in sfeventq. h. Void   * Sfeventq_event_alloc ( Void );
// Clear sfeventq
Void Sfeventq_reset ( Void );
// Add an event to the sfeventq queue
Int Sfeventq_add ( Void   * Event );
// Process according to action_func
Int Sfeventq_action ( Int ( * Action_func )( Void   * Event , Void   * User ), Void   * User );
// Space allocation of sfeventq
Int Sfeventq_init ( Int Max_nodes, Int Log_nodes, Int Event_size,
Int ( * Sort )( Void   * , Void   * ));