match_ip_ttl.c

来自「Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目」· C语言 代码 · 共 57 行

#include "match_ip.h"

/* ttl - Match the time-to-live field of an IP packet */
int ttl_match_eq(struct packet *p, void *priv, unsigned int l, int n)
{
	unsigned char ttl=(unsigned char)((unsigned int)priv&0xff);
	return n ^ ( p->layer[l].h.ip->ttl==ttl );
}

/* ttl - Match the time-to-live field of an IP packet */
int ttl_match_lt(struct packet *p, void *priv, unsigned int l, int n)
{
	unsigned char ttl=(unsigned char)((unsigned int)priv&0xff);
	return n ^ ( p->layer[l].h.ip->ttl<ttl );
}

/* ttl - Match the time-to-live field of an IP packet */
int ttl_match_gt(struct packet *p, void *priv, unsigned int l, int n)
{
	unsigned char ttl=(unsigned char)((unsigned int)priv&0xff);
	return n ^ ( p->layer[l].h.ip->ttl>ttl );
}

proc_match_match ttl_validate(char *args, void **priv,
	struct criteria *m, u_int32_t *c)
{
	unsigned int val;
	proc_match_match ret=ttl_match_eq;
	char *foo;
	
	if ( !args ) return NULL;

	for(foo=args; *foo; foo++) {
		if ( *foo=='<' ) {
			args++;
			ret=ttl_match_lt;
		}else if ( *foo=='>' ){
			args++;
			ret=ttl_match_gt;
		}else if ( isspace(*foo) ){
			args++;
		}else{
			break;
		}
	}
	
	if ( strtouint(args, &val) ) return NULL;

	/* Its a char */
	if ( val>255 ) return NULL;

	/* Store it directly in the pointer, hehe */
	*((unsigned int *)priv)=(unsigned int)val&0xff;

	return ret;
}