decode.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __DECODE_HEADER_INCLUDED__
#define __DECODE_HEADER_INCLUDED__

#define PROTO_LEN 15

typedef unsigned int proto_id_t;

struct proto_child {
	struct proto_child	*next;
	proto_id_t		id;
	struct proto		*proto;
};

#define proto_request(x, y) {x, y}
#define null_request() {NULL, 0}
struct proto_req {
	char			*name;
	proto_id_t		id;
};

#ifndef __PLUGIN__
/* temporary structure used internally */
struct preq_list {
	struct preq_list	*next;
	struct proto		*proto;
	struct proto_req	*arr;
};
#endif

/* decode a packet */
typedef void (*proc_decode)(struct packet *);
typedef int  (*proc_sdecode)(struct packet *);

/* print it in human-readable form */
typedef int  (*proc_dprint)(struct layer*, char *, int);

/* signature engine */
typedef int  (*proc_sig_add)(struct rule *);
typedef void (*proc_sig_match)(struct packet *, unsigned int);

/* serialize/deserialize session data for file storage */
typedef int  (*proc_serialize)(struct packet*, unsigned int, char *, int);
typedef void *(*proc_deserialize)(struct packet*, unsigned int, char *, int);
typedef void (*proc_session_free)(void *);

/* struct proto, and some initializer macros */
#define init_proto(x,y,z)        { .name=x, .decode=y, .print=z, }
#define init_proto2(x,y,z,a,b)   { .name=x, .decode=y, .print=z, .sig_match=a, .sig_add=b, }
#define null_proto()             { /* all-zero by default */ }
struct proto {
	proc_decode		decode;
	proc_sdecode		sdecode;

	/* preprocessors */
	u_int16_t		num_active;
	u_int16_t 		max_active;
	struct pp_active	*preproc;

	/* linkages */
	struct proto_child	*children;
	struct proto		*next;

	/* Signature engine */
	proc_sig_add		sig_add;
	proc_sig_match		sig_match;

	/* Size of application layer state data */
	size_t			state_len;

	/* Session save/restore */
	proc_session_free	free;
	proc_serialize		serialize;
	proc_deserialize	deserialize;

	/* print out a one line summary given a header */
	proc_dprint		print;

	/* Misc, meta data */
	const char		*name;
};

#ifndef __PLUGIN__
void decode_init(void);
void decode_load(void);
struct proto *decode_proto(char *);
struct proto *decode_subproto(char *, unsigned int);
int decode_add(struct proto *, struct proto_req *);
void dispatch(struct packet *);
#endif

typedef int(*proc_decode_add)(struct proto *, struct proto_req *);
typedef void (*proc_dispatch)(struct packet *);
typedef struct proto *(*proc_decode_proto)(char *);
typedef struct proto *(*proc_decode_subproto)(char *, unsigned int);

/* Plugin callback API */
struct decode_api {
	size_t size;
	proc_decode_add decode_add;
	proc_dispatch dispatch;
};
typedef int (*proc_decode_load)(struct decode_api *);

#endif /* __DECODE_HEADER_INCLUDED__ */