match_ip.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#include "match_ip.h"
PLUGIN_STD_DEFS();

int uci_compare(void *p1, void *p2)
{
	unsigned char t1=(unsigned char)((unsigned int)p1&0xff);
	unsigned char t2=(unsigned char)((unsigned int)p2&0xff);

	if ( t1==t2 ) return 0;
	return 1;
}

struct matcher ip_matchers[]={
	matcher_init("ip_dst", 10, ip_dst_validate, ipaddr_compare, MATCHER_FREE),
	matcher_init("ip_src", 11, ip_src_validate, ipaddr_compare, MATCHER_FREE),
	matcher_init("id", MCOST_NET+4, id_validate, MCMP_SR, NULL),
	matcher_init("fragoffset", MCOST_NET+5, fo_validate, MCMP_SR, MATCHER_FREE),
	matcher_init("fragbits", MCOST_NET+6, fb_validate, fb_compare, MATCHER_FREE),
	matcher_init("ttl", MCOST_NET+8, ttl_validate, uci_compare, NULL),
	matcher_init("ip_proto", MCOST_NET+9, proto_validate, uci_compare, NULL),
	matcher_init("sameip", MCOST_NET+16, sip_validate, sip_compare, NULL),
	matcher_init("ipopts", MCOST_NET+20, ipopts_validate, uci_compare, NULL),
	matcher_null()
};

int PLUGIN_MATCHER (struct matcher_api *m)
{
	object_check(m);

	template_shortrange=m->template_shortrange;

	if ( !m->matcher_add(ip_matchers) )
		return PLUGIN_ERR_FAIL;

	return PLUGIN_ERR_OK;
}

int PLUGIN_INIT (struct plugin_in *in, struct plugin_out *out)
{
	plugin_check(in, out);

	PLUGIN_ID("match.ip", "IP matching routines");
	PLUGIN_VERSION(2, 0);
	PLUGIN_AUTHOR("Gianni Tedesco", "[e-mail]");
	PLUGIN_LICENSE("GPL");

	return PLUGIN_ERR_OK;
}

int PLUGIN_UNLOAD (int code) {
	return PLUGIN_ERR_OK;
}