The event manager keeps track of the current time in the cur_loop_time field of the Orchids context. When you want to reschedule an event to take place in, say, 5 seconds, it is tempting to write:
heap_entry_t *he; /* ... */ he->date = ctx->cur_loop_time + 5; register_rtaction(ctx, he);
This post explains why this is a bad idea, and how it should be done. Continue reading
Orchids takes input from various data sources, and breaks them down into events. The purpose of this post is to explain what it means, how it works, and how one should write event-generating modules. Continue reading
Some data sources, such as mod_udp, only know how to fetch data in fixed-size blocks. The modules that take those data and dissect them into Orchids events, on the other hand, may require a variable number of bytes. The mod_utils.[ch] files provide a general-purpose API to solve this impedance match problem: the blox API. Continue reading
All primitives and all constructions of the Orchids language must behave in a thread-local way (except for a few special-purpose features). This is incompatible with the way some libraries work, such as libxml2. We explain the problem, and a standard solution: thread-local objects. We illustrate this on the mod_xml module. Continue reading
The ovm_ipv6_t type is the OrchIDS type of IPv6 addresses.
Continue reading
Once Orchids has completed all initializations, it calls event_dispatcher_main_loop(), which repeatedly collects events from various sources, and launches threads to monitor signatures. The event_dispatcher_main_loop() function can be found in file evt_mgr.c. Here is how it works.
Continue reading
The ANSI C standards were obviously largely influenced by compiler writers. This is a good thing: these are the guys would should know about the language. However, they sometimes enforce semantics assumptions that allow for very efficient optimizations. Ultimately, the main problem is that these assumptions are not or only partially checked by the compiler, but the compiler will still do as though these assumptions are true, and modify your code accordingly. I will concentrate on one of these assumptions here: the strict aliasing rule, and its pretty bad way of mixing with type-punning. Continue reading
Some functions in the C code of Orchids use objects of type char, some others of type unsigned char. You will sometimes see strange sequences of casts in the code of Orchids, such as: Continue reading
Imagine you want to add a new construction to the Orchids language. A simple way is to just add a new primitive. However, in some cases this is not enough. Imagine Orchids did not have multiplication. We might add it as a primitive, and name it mult for example. However you would then be forced to write, say, $x = mult($y, $z) to multiply $y with $z in Orchids signatures instead of the cosier $x = $y*$z. Continue reading
The language of Orchids includes several primitives, but you may want to add new ones.
The main primitives of Orchids are coded in lang.c. Some others are provided by modules. Let us look at a simple example, that of the function int_from_str, which converts a string such as "12" to the corresponding integer (12 here). Continue reading