plugbase.c

该源码是用C语言编写的,实现网络入侵检测系统的功能

    return rval;
}

/****************************************************************************
 *
 * Function: IPOptionValue(Options *o)
 *
 * Purpose: To return a string representing the value of an IP option
 *
 * Arguments: An Options struct.
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *IPOptionValue(Options * o)
{
    int j;
    char *rval;
    char tmp[6];

    rval = (char *)malloc(SMALLBUFFER);
    rval[0] = '\0';

    if(o->len)
    {
        for(j = 0; j < (int)(o->len-2); j+=2)
        {
            rval = (char *)realloc(rval, strlen(rval) + 5);
            snprintf(tmp, 5, "%02X%02X ", o->data[j], o->data[j+1]);
            strncat(rval, tmp, 6);
        }
    }

    return rval;
}

/****************************************************************************
 *
 * Function: GetTimestamp(time_t * tv_sec, int tz)
 *
 * Purpose: Get an ISO-8601 formatted timestamp for tv_sec within the tz
 *          timezone. 
 *
 * Arguments: tv_sec is a time_t pointer. tz is a timezone. 
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *GetTimestamp(time_t * tv_sec, int tz)
{
    struct tm *time;
    char * buf;

    buf = (char *)malloc(SMALLBUFFER);

    if(pv.use_utc == 1)
        time = gmtime(tv_sec);
    else
        time = localtime(tv_sec);

    if(tz < 0)
        snprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i%03i", 1900 + time->tm_year, time->tm_mon + 1, time->tm_mday, time->tm_hour, time->tm_min, time->tm_sec, tz);
    else
        snprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i+%02i", 1900 + time->tm_year, time->tm_mon + 1, time->tm_mday, time->tm_hour, time->tm_min, time->tm_sec, tz);

    return buf;
}

/****************************************************************************
 *
 * Function: GetLocalTimezone()
 *
 * Purpose: Find the offset from GMT for current host
 *
 * Arguments: none 
 *
 * Returns: int representing the offset from GMT
 *
 ***************************************************************************/
int GetLocalTimezone()
{
    struct timezone tz;
    struct timeval tv;

    gettimeofday(&tv,&tz);

    if(tz.tz_minuteswest > 720) return(24 - tz.tz_minuteswest/60);
    else          return(0 - tz.tz_minuteswest/60);
}

/****************************************************************************
 *
 * Function: GetCurrentTimestamp()
 *
 * Purpose: Generate an ISO-8601 formatted timestamp for the current time.
 *
 * Arguments: none 
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *GetCurrentTimestamp()
{
    struct tm *lt;
    struct timezone tz;
    struct timeval tv;
    struct timeval *tvp;
    char * buf;
    int tzone;

    buf = (char *)malloc(SMALLBUFFER);

    bzero((char *)&tz,sizeof(tz));
    gettimeofday(&tv,&tz);
    tvp = &tv;

    if(pv.use_utc == 1)
    {
        lt = gmtime((time_t *)&tvp->tv_sec);
        snprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i", 
                1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, 
                lt->tm_hour, lt->tm_min, lt->tm_sec);
    }
    else
    {
        lt = localtime((time_t *)&tvp->tv_sec);

    	tzone = GetLocalTimezone();

        if(tzone < 0)
            snprintf(buf, SMALLBUFFER, 
                    "%04i-%02i-%02i %02i:%02i:%02i%03i", 
                    1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, 
                    lt->tm_hour, lt->tm_min, lt->tm_sec, tzone);
        else
            snprintf(buf, SMALLBUFFER, 
                    "%04i-%02i-%02i %02i:%02i:%02i+%02i", 
                    1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, 
                    lt->tm_hour, lt->tm_min, lt->tm_sec, tzone);
    }

    return buf;
}

/*
 * Function: base64(char * xdata, int length)
 *
 * Purpose: Insert data into the database
 *
 * Arguments: xdata  => pointer to data to base64 encode
 *            length => how much data to encode 
 *
 * Make sure you allocate memory for the output before you pass
 * the output pointer into this function. You should allocate 
 * (1.5 * length) bytes to be safe.
 *
 * Returns: data base64 encoded as a char *
 *
 */
char * base64(u_char * xdata, int length)
{
    int count, cols, bits, c, char_count;
    unsigned char alpha[64] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    char * payloadptr;
    char * output;
    char_count = 0;
    bits = 0;
    cols = 0;

    output = (char *)malloc((unsigned int)(length * 1.5 + 4));

    payloadptr = output;

    for(count = 0; count < length; count++)
    {
        c = xdata[count];

        if(c > 255)
        {
            ErrorMessage("plugbase.c->base64(): encountered char > 255 (decimal %d)\n If you see this error message a char is more than one byte on your machine\n This means your base64 results can not be trusted", c);
        }

        bits += c;
        char_count++;

        if(char_count == 3)
        {
            *output = alpha[bits >> 18]; output++;
            *output = alpha[(bits >> 12) & 0x3f]; output++;
            *output = alpha[(bits >> 6) & 0x3f]; output++;
            *output = alpha[bits & 0x3f]; output++; 
            cols += 4;
            if(cols == 72)
            {
                *output = '\n'; output++;
                cols = 0;
            }
            bits = 0;
            char_count = 0;
        }
        else
        {
            bits <<= 8;
        }
    }

    if(char_count != 0)
    {
        bits <<= 16 - (8 * char_count);
        *output = alpha[bits >> 18]; output++;
        *output = alpha[(bits >> 12) & 0x3f]; output++;
        if(char_count == 1)
        {
            *output = '='; output++;
            *output = '='; output++;
        }
        else
        {
            *output = alpha[(bits >> 6) & 0x3f]; 
            output++; *output = '='; 
            output++;
        }
    }
    *output = '\0';
    return payloadptr;
} 

/****************************************************************************
 *
 * Function: ascii(u_char *xdata, int length)
 *
 * Purpose: This function takes takes a buffer "xdata" and its length then
 *          returns a string of only the printible ASCII characters.
 *
 * Arguments: xdata is the buffer, length is the length of the buffer in
 *            bytes
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *ascii(u_char *xdata, int length)
{
    int x;
    int y;
    char *ret;
    char *buf;

    buf = (char *)malloc((unsigned int)(length * 1.1 + 2));

    ret = buf;

    y = 0;

    for(x = 0; ((x < length) && (x + y + 4 < length * 1.1)); x++)
    {
        if((xdata[x] > 0x1F) && (xdata[x] < 0x7F))
        {
            if(xdata[x] == '<')
            {
                *buf = '&'; buf++; y++;
                *buf = 'l'; buf++; y++;
                *buf = 't'; buf++; y++;
                *buf = ';';
            }
            else if(xdata[x] == '&')
            {
                *buf = '&'; buf++; y++;
                *buf = 'a'; buf++; y++;
                *buf = 'm'; buf++; y++;
                *buf = 'p'; buf++; y++;
                *buf = ';'; 
            }
            else if(xdata[x] == '>')
            {
                *buf = '&'; buf++; y++;
                *buf = 'g'; buf++; y++;
                *buf = 't'; buf++; y++;
                *buf = ';';
            }
            else if(xdata[x] == '\'')
            {
                *buf = '\\'; buf++; y++;
                *buf = '\'';
            }
            else
            {
                *buf = xdata[x];
            }
            buf++;
        }
        else
        {
            *buf = '.'; buf++;
        }
    }

    *buf = '\0';
    return ret;
}

/****************************************************************************
 *
 * Function: hex(u_char *xdata, int length)
 *
 * Purpose: This function takes takes a buffer "xdata" and its length then
 *          returns a string of hex with no spaces
 *
 * Arguments: xdata is the buffer, length is the length of the buffer in
 *            bytes
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *hex(u_char *xdata, int length)
{
    int x;
    char *rval;
    char *buf;

    buf = (char *)malloc(length * 2 + 1);
    rval = buf;

    for(x=0; x < length; x++)
    {
        snprintf(buf, 3, "%02X", xdata[x]);
        buf += 2;
    } 

    rval[length * 2] = '\0';

    return rval;
}


/****************************************************************************
 *
 * Function: int2s(int val)
 *
 * Purpose:  int2s creates a string representing the integer supplied as
 *           the first argument. It returns a char * that needs to be freed
 *           after it is used. 
 *
 * Arguments: val is the integer you want to convert to a string
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *int2s(int val)
{
    char * ptr;

    ptr = (char *)malloc(SMALLBUFFER);

    if(val)
    {
        snprintf(ptr, SMALLBUFFER, "%u", val);
    }
    else
    {
        ptr[0] = '\0';
    }
    return ptr;
}


/****************************************************************************
 *
 * Function: str2s(char * val)
 *
 * Purpose: str2s returns a string that is an exact replica of the char 
 *          supplied as the first argument. The purpose of this
 *          function is to create a dynamically allocated copy of a
 *          string. It is used when populating data structures that
 *          have char * elements that are freed. The point is that
 *          this is a short way to avoid calling free() on a buffer
 *          that is not dynamically allocated by this process. 
 *
 * Arguments: val is the string you want to copy 
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *str2s(char * val)
{
    char * ptr;

    if(val)
    {
        ptr = (char *)malloc(strlen(val) + 1);
        strncpy(ptr, val, strlen(val) + 1);
        return ptr;
    }
    else
    {
        return val;
    }
}

/****************************************************************************
 *
 * Function: hex2s(int val)
 *
 * Purpose:  hex2s creates a string representing the hexidecimal conversion
 *           of an integer. It returns a char * that needs to be freed after
 *           it is used. 
 *
 * Arguments: val is the integer you want to convert to a string
 *
 * Returns: char * -- You must free this char * when you are done with it.
 *
 ***************************************************************************/
char *hex2s(int val)
{
    char * ptr;

    ptr = (char *)malloc(SMALLBUFFER);

    if(val)
    {
        snprintf(ptr, SMALLBUFFER, "0x%x", val);
    }
    else
    {
        ptr[0] = '\0';
    }
    return ptr;
}