matcher.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __MATCHER_HEADER_INCLUDED__
#define __MATCHER_HEADER_INCLUDED__

#include <strtouint.h>

/* Cleanup said data structure */
typedef void(*proc_match_cleanup)(void *);

/* Compare two private data structures */
typedef int(*proc_match_compare)(void *, void *);

/* match a packet against private data */
typedef int(*proc_match_match)(struct packet *, void *, unsigned int, int);

/* Takes a parsed token and creates a private data structure */
typedef proc_match_match(*proc_match_validate)(char *, void **,
	struct criteria *, u_int32_t *cost);

/* Matcher cost offsets */
#define MCOST_LINK	1000
#define MCOST_NET	2000
#define MCOST_TRANS	3000
#define MCOST_APP	4000
#define MCOST_DATA	5000

/* The matcher structure */
struct matcher {
	struct matcher		*next;
	char			*name;
	proc_match_compare	compare;
	proc_match_validate	validate;
	proc_match_cleanup	cleanup;
	u_int32_t		cost;
};

/* Initialization macros */
#define matcher_null() {.name=NULL}
#define matcher_init(a,b,c,d,e) { \
	.name=a, .cost=b, .validate=c, \
	.compare=d, .cleanup=e}

/* If you set this value for your cleanup function then your private
 * data will be cleaned up by calling free(3) on the pointer */
#define MATCHER_FREE ((void *) -1)

/* Set one of these values for your compare function if your datatype
 * is struct (long|short)range, defined below. */
#define MCMP_SR ((void *) -1)
#define MCMP_LR ((void *) -2)

struct longrange {
	u_int32_t	min;
	u_int32_t	max;
};

struct shortrange {
	u_int16_t	min;
	u_int16_t	max;
};

typedef int (*proc_matcher_add)(struct matcher *);
typedef int (*proc_template)(char *, void **);

struct matcher_api {
	size_t size;
	proc_matcher_add matcher_add;
	proc_template template_longrange;
	proc_template template_shortrange;
};
typedef int (*proc_matcher_load)(struct matcher_api *);

#ifndef __PLUGIN__
void matcher_load(void);
struct matcher *matcher_find(char *);
int matcher_add(struct matcher *);
int template_longrange(char *, void **);
int template_shortrange(char *, void **);
int template_cmp_lr(void *, void *);
int template_cmp_sr(void *, void *);
void template_ptr(void *);
#else
typedef struct matcher *(*proc_matcher_find)(char *);
#endif

#endif /* __MATCHER_HEADER_INCLUDED__ */