signature.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __SIGNATURE_HEADER_INCLUDED__
#define __SIGNATURE_HEADER_INCLUDED__

/* A rule criterial in a struct rule */
struct criteria {
	struct criteria	*next;
	char		*crit;
	char		*args;

	/* If the low bit is 1 then negate */
	u_int8_t	negate;

	/* Modifiers */
	struct criteria	*modifier;
};


/* A temporary rule structure for parsers */
struct rule {
	struct proto *protocol;

	/* Rule criteria */
	unsigned int num_criteria;
	struct criteria	*criteria;
	struct criteria	*crit_end;

	struct alert	alert;
};

typedef struct rule *(*proc_sig_rule)(char *);
typedef void (*proc_sig_abort)(struct rule *);
typedef int (*proc_sig_criteria)(struct rule *, int, char *, char *);
typedef proc_sig_criteria proc_sig_modifier;
typedef int (*proc_sig_alert)(struct rule *, char *, u_int32_t,
		u_int32_t, unsigned long, unsigned long, u_int8_t);
typedef int (*proc_sig_commit)(struct rule *);

#ifndef __PLUGIN__
extern unsigned int signature_count;

struct rule *signature_rule(char *);
void signature_abort(struct rule *);
int signature_criteria(struct rule *, int, char *, char *);
int signature_modifier(struct rule *, int, char *, char *);
int signature_alert(struct rule *, char *, u_int32_t, u_int32_t,
	unsigned long, unsigned long, u_int8_t);
int signature_commit(struct rule *);
#endif

#endif /* __SIGNATURE_HEADER_INCLUDED__ */