match_ip.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __MATCH_IP_HEADER_INCLUDED__
#define __MATCH_IP_HEADER_INCLUDED__

#include <ctype.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include <firestorm.h>
#include <packet.h>
#include <alert.h>
#include <signature.h>
#include <matcher.h>
#include <plugin.h>

/* ipaddr (src,dst) matching */
struct ipaddr_priv {
	u_int32_t	addr;
	u_int32_t	mask;
};

proc_template template_shortrange;

/* ip_src/ip_dst */
int ipaddr_compare(void *, void *);
proc_match_match ip_src_validate(char *, void **, struct criteria *, u_int32_t *);
proc_match_match ip_dst_validate(char *, void **, struct criteria *, u_int32_t *);

/* sameip */
proc_match_match sip_validate(char *, void **, struct criteria *, u_int32_t *);
int sip_compare(void *, void *);

/* fragment matching */
proc_match_match id_validate(char *, void **, struct criteria *, u_int32_t *);
proc_match_match fo_validate(char *, void **, struct criteria *, u_int32_t *);
proc_match_match fb_validate(char *, void **, struct criteria *, u_int32_t *);
int fb_compare(void *, void *);

/* option matching */
proc_match_match ipopts_validate(char *, void **, struct criteria *, u_int32_t *);

/* proto matching */
proc_match_match proto_validate(char *, void **, struct criteria *, u_int32_t *);

/* ttl matching */
proc_match_match ttl_validate(char *, void **, struct criteria *, u_int32_t *);

#endif /* __MATCH_IP_HEADER_INCLUDED__ */