match_ip_opts.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#include "match_ip.h"

struct {
	char *name;
	unsigned int val;
}ipopts[]={
	{"eol",		IPOPT_EOL},
	{"nop",		IPOPT_NOP},
	{"rr",		IPOPT_RR},
	{"rtralt",	IPOPT_RTRALT},
	{"ts",		IPOPT_TS},
	{"sec",		IPOPT_SECURITY},
	{"lsrr",	IPOPT_LSRR},
	{"lsrre",	IPOPT_LSRR_E},
	{"satid",	IPOPT_SATID},
	{"ssrr",	IPOPT_SSRR},
	{"any",		0xff},
	{NULL, 0}
};

int ipopts_match(struct packet *p, void *priv, unsigned int l, int n)
{
	struct pkt_iphdr *iph=p->layer[l].h.ip;
	unsigned char val=(unsigned char)(unsigned int)priv;
	unsigned char *tmp, *end;

	if ( val==0xff ) return n ^ (iph->ihl!=5);
	if (iph->ihl==5 ) return n^0;

	end=tmp=(unsigned char *)iph;
	tmp+=20;
	end+=iph->ihl<<2;

	if ( end < (unsigned char *)p->end ) end=(unsigned char *)p->end;

	while ( tmp < end ) {
		if ( *tmp == val  ) return n ^ 1;

		switch ( *tmp ) {
			case IPOPT_EOL:
				goto err;
			case IPOPT_NOP:
			case IPOPT_RTRALT:
				tmp++;
				break;
			case IPOPT_SECURITY:
				tmp+=11;
				break;
			case IPOPT_SATID:
				tmp+=4;
				break;
			default:
				if ( ++tmp < end ) {
					tmp+=*tmp;
					break;
				}else goto err;
		}
		tmp++;
	}

err:
	return n ^ 0;
}

/* IP Options */
proc_match_match ipopts_validate(char *args, void **priv,
	struct criteria *m, u_int32_t *c)
{
	int i;
	char *tmp;

	if ( !args )
		return NULL;

	/* Strip trailing and leading whitespace */
	while ( *args==' ' || *args=='\t' ) args++;
	for(tmp=args; *tmp; tmp++) {
		if ( *tmp==' ' || *tmp=='\t' ) {
			*tmp=0;
			break;
		}
	}

	for(i=0; ipopts[i].name; i++) {
		if ( !strcasecmp(args, ipopts[i].name) ) {
			*priv=(void *)ipopts[i].val;
			return ipopts_match;
		}
	}

	return NULL;
}