sfeventq.c File Reference

This provides generic functions for queuing events and inserting the events with a provided function. All memory management for events is provided here. More...

#include <stdlib.h>

Go to the source code of this file.

Typedefs
typedef s_SF_EVENTQ_NODE	SF_EVENTQ_NODE
typedef s_SF_EVENTQ	SF_EVENTQ
Functions
int	sfeventq_init (int max_nodes, int log_nodes, int event_size, int(*sort)(void *, void *))
void *	sfeventq_event_alloc (void)
void	sfeventq_reset (void)
static SF_EVENTQ_NODE *	get_eventq_node (void *event)
int	sfeventq_add (void *event)
int	sfeventq_action (int(*action_func)(void *, void *), void *user)
Variables
static SF_EVENTQ	s_eventq

---

Detailed Description

This provides generic functions for queuing events and inserting the events with a provided function. All memory management for events is provided here.

Author:

Daniel Roelker <droelker@sourcefire.com>

Copyright (C) 2004, Daniel Roelker and Sourcefire, Inc.

The sfeventq functions provide a generic way for handling events, prioritizing those events, and acting on the highest ranked events with a user function.

Example on using sfeventq:

1. Initialize event queue sfeventq_init()

2. Add events to queue sfeventq_event_alloc() allocates the memory for storing the event. sfeventq_add() adds the event and prioritizes the event in the queue. You should only allocate and add one event at a time. Otherwise, event_alloc() will return NULL on memory exhaustion.

3. Event actions sfeventq_action() will call the provided function on the initialized number of events to log.

Definition in file sfeventq.c.

---

Typedef Documentation

typedef struct s_SF_EVENTQ SF_EVENTQ

typedef struct s_SF_EVENTQ_NODE SF_EVENTQ_NODE

---

Function Documentation

static SF_EVENTQ_NODE* get_eventq_node (  void *  event  )  [static]

This function returns a ptr to the node to use. We allocate the last event node if we have exhausted the event queue. Before we allocate the last node, we determine if the incoming event has a higher priority than the last node. If it does, we allocate the node, otherwise we drop it because it is lower priority. If the last node is allocated, we have to point the reserve_event to the allocated event memory, since the reserved_event memory was used for the incoming event. Returns: SF_EVENTQ_NODE * Return values: NULL  resource exhaustion and event is lower priority than last node !NULL  ptr to node memory. Definition at line 213 of file sfeventq.c. References s_SF_EVENTQ::cur_nodes, s_SF_EVENTQ_NODE::event, s_SF_EVENTQ::last, s_SF_EVENTQ::max_nodes, s_SF_EVENTQ_NODE::next, s_SF_EVENTQ::node_mem, NULL, s_SF_EVENTQ_NODE::prev, s_SF_EVENTQ::reserve_event, and s_SF_EVENTQ::sort. Referenced by sfeventq_add().

int sfeventq_action (  int(*)(void *, void *)  action_func, void *  user )

Call the supplied user action function on the highest priority events. Returns: integer Return values: -1  action function failed on an event 0  no events logged 1  events logged Definition at line 350 of file sfeventq.c. References s_SF_EVENTQ_NODE::event, s_SF_EVENTQ::head, s_SF_EVENTQ::log_nodes, and s_SF_EVENTQ_NODE::next. Referenced by SnortEventqLog().

int sfeventq_add (  void *  event  )

Add this event to the queue using the supplied ordering function. If the queue is exhausted, then we compare the event to be added with the last event, and decide whether it is a higher priority than the last node. Returns: integer Return values: -1  add event failed 0  add event succeeded Definition at line 270 of file sfeventq.c. References s_SF_EVENTQ::cur_nodes, s_SF_EVENTQ_NODE::event, get_eventq_node(), s_SF_EVENTQ::head, s_SF_EVENTQ::last, s_SF_EVENTQ_NODE::next, NULL, s_SF_EVENTQ_NODE::prev, and s_SF_EVENTQ::sort. Referenced by SnortEventqAdd().

void* sfeventq_event_alloc (  void   )

Allocate the memory for an event to add to the event queue. This function is meant to be called first, the event structure filled in, and then added to the queue. While you can allocate several times before adding to the queue, this is not recommended as you may get a NULL ptr if you allocate more than the max node number. Returns: void * Return values: NULL  unable to allocate memory. !NULL  ptr to memory. Definition at line 148 of file sfeventq.c. References s_SF_EVENTQ::cur_events, s_SF_EVENTQ::event_mem, s_SF_EVENTQ::event_size, s_SF_EVENTQ::max_nodes, NULL, and s_SF_EVENTQ::reserve_event. Referenced by SnortEventqAdd().

int sfeventq_init (  int  max_nodes, int  log_nodes, int  event_size, int(*)(void *, void *)  sort )

Initialize the event queue. Provide the max number of nodes that this queue will support, the number of top nodes to log in the queue, the size of the event structure that the user will fill in, and the function to determine where to insert the incoming events in the queue. Returns: integer Return values: -1  failure 0  success Definition at line 102 of file sfeventq.c. References s_SF_EVENTQ::cur_events, s_SF_EVENTQ::cur_nodes, s_SF_EVENTQ::event_mem, s_SF_EVENTQ::event_size, s_SF_EVENTQ::log_nodes, s_SF_EVENTQ::max_nodes, s_SF_EVENTQ::node_mem, s_SF_EVENTQ::reserve_event, and s_SF_EVENTQ::sort. Referenced by SnortEventqInit().

void sfeventq_reset (  void   )

Resets the event queue. We also set the reserve event back to the last event in the queue. Returns: void Definition at line 182 of file sfeventq.c. References s_SF_EVENTQ::cur_events, s_SF_EVENTQ::cur_nodes, s_SF_EVENTQ::event_mem, s_SF_EVENTQ::event_size, s_SF_EVENTQ::head, s_SF_EVENTQ::max_nodes, NULL, and s_SF_EVENTQ::reserve_event. Referenced by SnortEventqReset().

---

Variable Documentation

SF_EVENTQ s_eventq [static]

Definition at line 85 of file sfeventq.c.

---