static int analyzer_docsis_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer *analyzer = obj; struct analyzer_docsis_priv *priv = analyzer->priv; if (has_listeners) { // Check if we are already listening if (priv->pkt_listener) return POM_OK; if (!priv->filter) { priv->filter = packet_filter_compile("docsis_mgmt.type > 3"); if (!priv->filter) { pomlog(POMLOG_ERR "Error while building filter"); return POM_ERR; } } priv->pkt_listener = proto_packet_listener_register(proto_get("docsis_mgmt"), 0, obj, analyzer_docsis_pkt_process, priv->filter); if (!priv->pkt_listener) return POM_ERR; } else { if (event_has_listener(priv->evt_cm_new) || event_has_listener(priv->evt_cm_reg_status)) return POM_OK; if (proto_packet_listener_unregister(priv->pkt_listener) != POM_OK) return POM_ERR; priv->pkt_listener = NULL; } return POM_OK; }
static int analyzer_arp_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer *analyzer = obj; struct analyzer_arp_priv *priv = analyzer->priv; if (has_listeners) { // Check if we are already listening if (priv->pkt_listener) return POM_OK; priv->pkt_listener = proto_packet_listener_register(proto_get("arp"), 0, obj, analyzer_arp_pkt_process); if (!priv->pkt_listener) return POM_ERR; } else { // Check if there is still an event being listened if (event_has_listener(priv->evt_new_sta) || event_has_listener(priv->evt_sta_changed)) return POM_OK; if (proto_packet_listener_unregister(priv->pkt_listener) != POM_OK) return POM_ERR; priv->pkt_listener = NULL; } return POM_OK; }
int output_tap_close(void *output_priv) { struct output_tap_priv *priv = output_priv; proto_packet_listener_unregister(priv->listener); if (priv->fd != -1) { close(priv->fd); priv->fd = -1; } return POM_OK; }
static int analyzer_rtp_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer *analyzer = obj; struct analyzer_rtp_priv *priv = analyzer->priv; if (has_listeners) { priv->rtp_listener = proto_packet_listener_register(priv->proto_rtp, PROTO_PACKET_LISTENER_PLOAD_ONLY, analyzer, analyzer_rtp_pload_process, NULL); if (!priv->rtp_listener) return POM_ERR; } else { if (!priv->rtp_listener || proto_packet_listener_unregister(priv->rtp_listener) != POM_OK) return POM_ERR; } return POM_OK; }
static int analyzer_smtp_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer *analyzer = obj; struct analyzer_smtp_priv *priv = analyzer->priv; if (evt_reg == priv->evt_msg) { if (has_listeners) { priv->pkt_listener = proto_packet_listener_register(proto_get("smtp"), PROTO_PACKET_LISTENER_PLOAD_ONLY, obj, analyzer_smtp_pkt_process, NULL); if (!priv->pkt_listener) return POM_ERR; } else { if (proto_packet_listener_unregister(priv->pkt_listener) != POM_OK) return POM_ERR; priv->pkt_listener = NULL; } } if (!priv->listening && (event_has_listener(priv->evt_msg) || event_has_listener(priv->evt_auth))) { if (event_listener_register(priv->evt_cmd, analyzer, analyzer_smtp_event_process_begin, analyzer_smtp_event_process_end) != POM_OK) { return POM_ERR; } else if (event_listener_register(priv->evt_reply, analyzer, analyzer_smtp_event_process_begin, analyzer_smtp_event_process_end) != POM_OK) { event_listener_unregister(priv->evt_cmd, analyzer); return POM_ERR; } priv->listening = 1; } else if (priv->listening && !event_has_listener(priv->evt_msg) && !event_has_listener(priv->evt_auth)) { event_listener_unregister(priv->evt_cmd, analyzer); event_listener_unregister(priv->evt_reply, analyzer); priv->listening = 0; } return POM_OK; }
static int analyzer_tftp_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer_tftp_priv *priv = obj; if (has_listeners) { if (priv->pkt_listener) return POM_OK; priv->pkt_listener = proto_packet_listener_register(proto_get("tftp"), PROTO_PACKET_LISTENER_PLOAD_ONLY, obj, analyzer_tftp_pkt_process, NULL); if (!priv->pkt_listener) return POM_ERR; } else { if (proto_packet_listener_unregister(priv->pkt_listener) != POM_OK) return POM_ERR; priv->pkt_listener = NULL; } return POM_OK; }
static int output_inject_close(void *output_priv) { struct output_inject_priv *priv = output_priv; if (!priv) return POM_ERR; if (proto_packet_listener_unregister(priv->listener) != POM_OK) return POM_ERR; priv->listener = NULL; if (priv->p) { pcap_close(priv->p); priv->p = NULL; } return POM_OK; }
static int analyzer_docsis_event_listeners_notify(void *obj, struct event_reg *evt_reg, int has_listeners) { struct analyzer *analyzer = obj; struct analyzer_docsis_priv *priv = analyzer->priv; if (has_listeners) { // Check if we are already listening if (priv->pkt_listener) return POM_OK; if (!priv->filter) { priv->filter = filter_proto_build("docsis_mgmt", "type", PTYPE_OP_GT, "3"); if (!priv->filter) { pomlog(POMLOG_ERR "Error while building filter"); return POM_ERR; } } priv->pkt_listener = proto_packet_listener_register(proto_get("docsis_mgmt"), 0, obj, analyzer_docsis_pkt_process); if (!priv->pkt_listener) return POM_ERR; // Filter out useless broadcast docsis_mgmt packets proto_packet_listener_set_filter(priv->pkt_listener, priv->filter); } else { if (event_has_listener(priv->evt_cm_new) || event_has_listener(priv->evt_cm_reg_status)) return POM_OK; if (proto_packet_listener_unregister(priv->pkt_listener) != POM_OK) return POM_ERR; priv->pkt_listener = NULL; } return POM_OK; }
static int analyzer_smtp_cleanup(struct analyzer *analyzer) { struct analyzer_smtp_priv *priv = analyzer->priv; if (priv->pkt_listener) { proto_packet_listener_unregister(priv->pkt_listener); } if (priv->listening) { event_listener_unregister(priv->evt_cmd, analyzer); event_listener_unregister(priv->evt_reply, analyzer); } if (priv->evt_msg) event_unregister(priv->evt_msg); if (priv->evt_auth) event_unregister(priv->evt_auth); free(priv); return POM_OK; }