idmef-path
The High level IDMEF API.
The IDMEF path API provide a methodes to define a "path" in the IDMEF tree.
Once this path is defined, the user might set or retrieve this path.
Here is an example of how to use this API in order to set a given path within
a #idmef_message_t root object:
First, we need to create a path to the object we want to create. If for example,
we wish to create the alert.classification.text path within our message, we will use:
int ret;
idmef_path_t *path;
ret = idmef_path_new(&path, "alert.classification.text");
if ( ret < 0 )
return ret;
Using the above, we just created a "pointer" to a given path in our #idmef_message_t. This
path doesn't yet exist, but might be used to read, or to write a value.
int ret;
idmef_value_t *value;
ret = idmef_value_new_from_path(&value, path, "A value");
if ( ret < 0 )
return ret;
Here we just created a value applicable to the previously created path. That is, if our path
is pointing to a value of type string, the created #idmef_value_t object will be of this type.
idmef_message_t *idmef;
/*
* create our top message
*/
ret = idmef_message_new(&idmef);
/*
* Set the previously defined path to the previously created value
* in the top level idmef message 'idmef'.
*/
ret = idmef_path_set(path, idmef, value);
And finally, we create our top level #idmef_message_t object and set the created #idmef_value_t
as the value for our created #idmef_path_t.
Given our previous example, we can write the following function:
static int set_idmef_path(idmef_message_t *message, const char *pathname, const char *value)
{
int ret;
idmef_value_t *val;
idmef_path_t *path;
ret = idmef_path_new(&path, pathname);
if ( ret < 0 )
return ret;
ret = idmef_value_new_from_path(&val, path, value);
if ( ret < 0 ) {
idmef_path_destroy(path);
return ret;
}
ret = idmef_path_set(path, message, val);
idmef_value_destroy(val);
idmef_path_destroy(path);
return ret;
}
You will then be able to set any field of the IDMEF message using:
idmef_message_t *idmef;
ret = idmef_message_new(&idmef);
if ( ret < 0 )
return ret;
set_idmef_path(idmef, "alert.classification.text", "My classification text");
set_idmef_path(idmef, "alert.classification.reference(0).name", "OSVDB-XXXX");
set_idmef_path(idmef, "alert.classification.reference(0).origin", "osvdb");
set_idmef_path(idmef, "alert.classification.reference(0).url", "http://my.url/");
set_idmef_path(idmef, "alert.source(0).node.address(0).address", "127.0.0.1");
#idmef_value_t for setting #idmef_path_t value.
@path:
@message:
@ret:
@Returns:
@path:
@message:
@value:
@Returns:
@path:
@format:
@Varargs:
@Returns:
@path:
@format:
@args:
@Returns:
@path:
@buffer:
@Returns:
@path:
@depth:
@Returns:
@path:
@depth:
@Returns:
@path:
@depth:
@index:
@Returns:
@path:
@depth:
@Returns:
@path:
@depth:
@Returns:
@path:
@child_name:
@index:
@Returns:
@path:
@Returns:
@path:
@p1:
@p2:
@depth:
@Returns:
@p1:
@p2:
@Returns:
@src:
@dst:
@Returns:
@path:
@Returns:
@path:
@depth:
@Returns:
@path:
@Returns:
@path:
@Returns:
@path:
@depth:
@Returns:
@path:
@Returns: