match_tcp_port.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#include "match_tcp.h"

int tcp_src_match(struct packet *pkt, void *priv, unsigned int l, int n)
{
	struct shortrange *p=(struct shortrange *)priv;
	u_int16_t port=ntohs(pkt->layer[l+1].h.tcp->sport);
	return n^(port>=p->min && port<=p->max);
}

int tcp_dst_match(struct packet *pkt, void *priv, unsigned int l, int n)
{
	struct shortrange *p=(struct shortrange *)priv;
	u_int16_t port=ntohs(pkt->layer[l+1].h.tcp->dport);
	return n^(port>=p->min && port<=p->max);
}

proc_match_match tcp_port_validate(proc_match_match fn, char *args,
	void **priv, struct criteria *m)
{
	if ( !args ) return NULL;
	if ( !template_shortrange(args, priv) ) return NULL;
	return fn;
}

proc_match_match tcp_src_validate(char *args, void **priv,
	struct criteria *m, u_int32_t *c)
{
	if ( !args ) return NULL;
	return tcp_port_validate(tcp_src_match, args, priv, m);
}

proc_match_match tcp_dst_validate(char *args, void **priv,
	struct criteria *m, u_int32_t *c)
{
	if ( !args ) return NULL;
	return tcp_port_validate(tcp_dst_match, args, priv, m);
}