udp.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#include "tcpip.h"

struct proto udp_p=init_proto2("udp", udp_decode, udp_dprint, udp_match, udp_commit);
struct proto_req udp_r[]={
	proto_request("ip", 17),
	null_request()
};

/* Generator */
struct generator udp_gen=init_generator("sig.udp", NULL);

int udp_dprint(struct layer *l, char *buf, int buflen)
{
	return snprintf(buf, buflen,
		"%u > %u len=%u csum=0x%x",
		htons(l->h.udp->sport),
		htons(l->h.udp->dport),
		htons(l->h.udp->len),
		htons(l->h.udp->csum));
}

void udp_decode(struct packet *p)
{
	struct proto_child *pc;
	struct layer *l=&p->layer[p->llen];

	if ( (p->layer[p->llen+1].h.raw=
		l->h.raw+sizeof(struct pkt_udphdr))
		> p->end ) {
		goto err;
	}

	p->llen++;

	if ( p->llen >= PKT_LAYERS ) goto err;

	for(pc=l->proto->children; pc; pc=pc->next)
	{
		if ( l->h.udp->dport == pc->id ||
			l->h.udp->sport == pc->id ) {
			p->layer[p->llen].flags=0;
			p->layer[p->llen].session=NULL;
			p->layer[p->llen].proto=pc->proto;
			pc->proto->decode(p);
			return;
		}
	}

	if ( p->layer[p->llen].h.raw<p->end )
		p->layer[p->llen++].proto=NULL;
	dispatch(p);
err:
	return;
}


/* ===================================================
 * PACKET MATCHING STUFF BEYOND THIS POINT
 * ===================================================
 */

struct sig_node udp_root;

void udp_match(struct packet *p, unsigned int l)
{
	l--;
	detect_set(&cur_alert, &alert_depth);
	detect(udp_root.child, p, l);
	if ( cur_alert ) alert(&udp_gen, p, cur_alert);
}

int udp_commit(struct rule *r)
{
	struct criteria *c;
	struct sig_node *x;
	struct matcher *m;
	struct alert *a;
	unsigned int i;

	/* Can't handle this case */
	if ( r->num_criteria==0 ) return 0;

	if ( !(x=calloc(r->num_criteria, sizeof(*x))) ) return 0;

	/* Copy the alert data */
	if ( !(a=calloc(1, sizeof(*a))) ) {
		free(x);
		return 0;
	}
	memcpy(a, &r->alert, sizeof(*a));

	/* Build an array of all the nodes we want to add */
	for(c=r->criteria,i=0; c; c=c->next,i++) {
		char *key;

		if ( !strcmp(c->crit, "src") ) {
			key="ip_src";
		}else if ( !strcmp(c->crit, "dst") ) {
			key="ip_dst";
		}else if ( !strcmp(c->crit, "sport") ) {
			key="udp_sport";
		}else if ( !strcmp(c->crit, "dport") ) {
			key="udp_dport";
		}else key=c->crit;

		if ( !(m=matcher_find(key)) ) {
			mesg(M_ERR,"udp_commit: cannot find '%s' matcher", key);
			detect_free_sig(x, i);
			return 0;
		}

		x[i].match=m;
		x[i].n=c->negate;
		x[i].cost=m->cost;
		if ( !(x[i].m=m->validate(c->args,
			&x[i].p, c->modifier, &x[i].cost)) ) {
			detect_free_sig(x, i);
			return 0;
		}
	}

	return detect_add_sig(x, r->num_criteria, &udp_root, a);
}