detect.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __DETECT_HEADER_INCLUDED__
#define __DETECT_HEADER_INCLUDED__

/* requires: alert.h */
/* requires: matcher.h */

/* A node in the finished signature tree */
struct sig_node {
	u_int8_t n; /* negate ? */
	void *p; /* private data */
	proc_match_match m; /* match function */
	struct alert *a; /* alert (if leaf node) */

	/* this is a binary tree */
	struct sig_node *next;
	struct sig_node *child;

	/* Used only when creating the tree */
	u_int32_t cost;
	struct matcher *match;
};

#ifndef __PLUGIN__
int detect_add_sig(struct sig_node *, unsigned int, struct sig_node *, struct alert *);
void detect_free_sig(struct sig_node *, unsigned int);
void detect_set(struct alert **, unsigned int *);
void detect(struct sig_node *, struct packet *, unsigned int);
#else
typedef int (*proc_detect_add_sig)(struct sig_node *, unsigned int, struct sig_node *, struct alert *);
typedef void (*proc_detect_free_sig)(struct sig_node *, unsigned int);
typedef void (*proc_detect_set)(struct alert **, unsigned int *);
typedef void (*proc_detect)(struct sig_node *, struct packet *, unsigned int);
#endif

#endif /* __DETECT_HEADER_INCLUDED__ */