/***** * * Copyright (C) 2002 Vincent Glaume , Baptiste Malguy * All Rights Reserved * * This file is part of the Prelude program. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2, or (at your option) * any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; see the file COPYING. If not, write to * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. * *****/ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "plugin-cm-trigger.h" static LIST_HEAD(cm_trigger_plugins_list); /* * We may have several CM triggering plugins subscribed but only one must be used for a given alert * we call it the valid plugin, and it is stored in the following var: */ static plugin_container_t *valid_cm_trigger_plugin = NULL; /* * */ static int subscribe(plugin_container_t *pc) { if ( !valid_cm_trigger_plugin ) { valid_cm_trigger_plugin = pc; log(LOG_INFO, "- Subscribing and selecting %s to activate counter-measure triggering plugins.\n", pc->plugin->name); } else log(LOG_INFO, "- Subscribing %s to activate counter-measure triggering plugins.\n", pc->plugin->name); return plugin_add(pc, &cm_trigger_plugins_list, NULL); } static void unsubscribe(plugin_container_t *pc) { log(LOG_INFO, "- Un-subscribing %s from active counter-measure plugins.\n", pc->plugin->name); plugin_del(pc); if ( !list_empty(&cm_trigger_plugins_list) ) { valid_cm_trigger_plugin = list_entry(&cm_trigger_plugins_list, plugin_container_t, ext_list); log(LOG_INFO, "\tNew selected counter-measure triggering plugin is %s.\n", valid_cm_trigger_plugin->plugin->name); } else valid_cm_trigger_plugin = NULL; } int cm_trigger_plugin_run(idmef_alert_t *msg) { int ret; plugin_run_with_return_value(valid_cm_trigger_plugin, plugin_cm_trigger_t, run, ret, msg); return ret; } /* * Open the plugin directory (dirname), * and try to load all plugins located in it. */ int cm_trigger_plugins_init(const char *dirname, int argc, char **argv) { int ret; ret = plugin_load_from_dir(dirname, argc, argv, subscribe, unsubscribe); /* * don't return an error if the report directory doesn't exist. * this could happen as it's normal to not use report plugins on * certain system. */ if ( ret < 0 && errno != ENOENT ) { log(LOG_ERR, "couldn't load plugin subsystem.\n"); return -1; } return ret; } /* * report_plugins_available: * * Returns: 0 if there is active REPORT plugins, -1 otherwise. */ int cm_trigger_plugin_available(void) { return ( list_empty(&cm_trigger_plugins_list) || !valid_cm_trigger_plugin) ? -1 : 0; }