#include <glib.h>

Data Structures
struct	severity_filter
	A severity_filter is a named collection of severity_overrides. More...

struct	severity_override
	A severity_override maps a severity of a message under certain. More...

Typedefs
typedef struct severity_filter	severity_filter_t
	A severity_filter is a named collection of severity_overrides. More...

typedef struct severity_override	severity_override_t
	A severity_override maps a severity of a message under certain. More...

Functions
severity_filter_t *	severity_filter_new (const gchar , const gchar )
	Creates a new empty severity_filter with a name. More...

void	severity_filter_free (severity_filter_t *)
	Frees the severity filter and all overrides it contains. More...

gboolean	severity_filter_contains_conflicting_override (const severity_filter_t filter, const severity_override_t override)
	Returns TRUE if a similar (in the sense of the. More...

gboolean	severity_filter_contains_conflicting (const severity_filter_t filter, const gchar host, const gchar port, const gchar oid, const gchar *from)
	Returns TRUE if a severity_override with given parameters exist. More...

gboolean	severity_filter_add (severity_filter_t , const severity_override_t )
	Adds a severity_override to a severity_filter and saves its. More...

const gchar *	severity_filter_apply (const gchar , const gchar , const gchar , const gchar )
	Applies the global filter to the given alert. More...

gboolean	severity_filter_remove (severity_filter_t filter, severity_override_t override)
	Removes and frees a override from a filter and saves the filter to. More...

const severity_override_t *	severity_override_new (const gchar , const gchar , const gchar , const gchar , const gchar , const gchar , const gchar *, gboolean)
	Creates a new severity override. More...

const severity_override_t *	severity_override_duplicate (const severity_override_t *)
	Duplicates a severity_override. More...

void	severity_override_free (severity_override_t *)
	Frees the severity_override and all its associated data. More...

severity_filter_t *	severity_filter_from_xml (const gchar *)
	Imports a severity_filter from an xml file that has been written by. More...

Variables
severity_filter_t *	global_filter

Typedef Documentation

typedef struct severity_filter severity_filter_t

A severity_filter is a named collection of severity_overrides.

typedef struct severity_override severity_override_t

A severity_override maps a severity of a message under certain.

conditions to a new severity.

The conditions to be met are:

OID of script that issued the message.
Certain host (target).
Certain port or port "family".

A severity_override furthermore own a name and reason (user-relavant only) and an active-flag (is it en- or disabled?).

severity_overrides are bundled in severity_filters.

Function Documentation

gboolean severity_filter_add	(	severity_filter_t *	filter,
		const severity_override_t *	override
	)

Adds a severity_override to a severity_filter and saves its.

representation to disk.

It is assumed that an override is added only once to a filter

severity_filter_remove might otherwise create a mess.

Parameters

filter	The severity_filter to add a override to.
override	The severity_override to add to the filter. The object is used directly, no copy created. Upon free'ing the filter, the override will be free'd as well.

Returns: FALSE in case the add operation failed (e.g. file not found), else; TRUE.

const gchar* severity_filter_apply	(	const gchar *	host,
		const gchar *	port,
		const gchar *	oid,
		const gchar *	severity
	)

Applies the global filter to the given alert.

Parameters

host	Name of the host for the alert.
port	Port of the alert.
oid	OID of the NVT that produced the alert.
severity	Severity that was given by the NVT.

This function iterates over all severity overrides of the global filter. If a match of host, port, oid and severity is found, then the overriding severity is returned.

Returns: NULL in case no suitable filter rule was found or any parameter equals NULL. Else a string with the new severity is returned.

gboolean severity_filter_contains_conflicting	(	const severity_filter_t *	filter,
		const gchar *	host,
		const gchar *	port,
		const gchar *	oid,
		const gchar *	from
	)

Returns TRUE if a severity_override with given parameters exist.

already in a filter.

Parameters

filter	The filter to ask if its overrides conflict against the override.
host	Hostname of eventually conflicting severity_override.
port	Port of eventually conflicting severity_override.
oid	OID of NVT in eventually conflicting severity_override.
from	Severity-to-be-overriden of eventually conflicting severity_override.

Returns: TRUE if an override wiht given parameter should not be added because of a conflict-to-be, FALSE otherwise or if one of the arguments is NULL.

gboolean severity_filter_contains_conflicting_override	(	const severity_filter_t *	filter,
		const severity_override_t *	override
	)

Returns TRUE if a similar (in the sense of the.

severity_override_similarity_predicate) override is contained in a filter.

Parameters

filter	The filter to ask if its overrides conflict against the override.
override	The questinable override.

Returns: TRUE if the override should not be added because of a conflict-to-be, FALSE otherwise or if one of the arguments is NULL.

void severity_filter_free ( severity_filter_t * filter)

Frees the severity filter and all overrides it contains.

Parameters

filter The filter to be free'd.

severity_filter_t* severity_filter_from_xml ( const gchar * filename)

Imports a severity_filter from an xml file that has been written by.

severity_filter_to_xml.

An examplary xml file is included in the documentation for this file.

Parameters

filename Path of file to parse.

Returns: If the file exists and error while parsing occured, a fresh severity_filter as described in the file (parameter), NULL otherwise.

severity_filter_t* severity_filter_new	(	const gchar *	name,
		const gchar *	filename
	)

Creates a new empty severity_filter with a name.

Note that if a file with the filename parameter already exists, the file will be overwritten.

Parameters

name	User-defined name for the severity_filter.
filname	Storage location for the severity_filter (no checks performed).

Returns: Fresh, named severity_filter.

gboolean severity_filter_remove	(	severity_filter_t *	filter,
		severity_override_t *	override
	)

Removes and frees a override from a filter and saves the filter to.

disk.

Note that is assumed that the same override has not been added twice to a severity_filter.

Parameters

filter	The filter from wich to remove the override.
override	The override to remove from the filter.

Returns: TRUE if file-writing was successfull, FALSE otherwise.

const severity_override_t* severity_override_duplicate ( const severity_override_t * override)

Duplicates a severity_override.

Parameters

override The severity_override to duplicate.

Returns: Duplicate of override or NULL if override is underspecified.

void severity_override_free ( severity_override_t * )

Frees the severity_override and all its associated data.

const severity_override_t* severity_override_new	(	const gchar *	name,
		const gchar *	host,
		const gchar *	port,
		const gchar *	oid,
		const gchar *	reason,
		const gchar *	severity_from,
		const gchar *	severity_to,
		gboolean	active
	)

Creates a new severity override.

If any of the parameter equals NULL, NULL will be returned. The severity_override will be returned enabled (active == TRUE).

Returns: If none of the parameters equalled NULL, returns fresh severity_override, NULL otherwise.

Variable Documentation

severity_filter_t* global_filter

Data Structures

Typedefs

Functions

Variables

Typedef Documentation

Function Documentation

Variable Documentation