tcpip.h

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

#ifndef __PLUGIN_TCPIP__
#define __PLUGIN_TCPIP__

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include <firestorm.h>
#include <packet.h>
#include <alert.h>
#include <signature.h>
#include <matcher.h>
#include <plugin.h>
#include <args.h>
#include <decode.h>
#include <capture.h>
#include <preproc.h>
#include <args.h>
#include <detect.h>

/* Imported functions */
extern unsigned short ipfmask;
extern proc_preproc_activate preproc_activate;
extern proc_serial_number serial_number;
extern proc_matcher_find matcher_find;
extern proc_args_parse args_parse;
extern proc_alert alert;
extern proc_detect_add_sig detect_add_sig;
extern proc_detect_free_sig detect_free_sig;
extern proc_detect_set detect_set;
extern proc_detect detect;
extern proc_dispatch dispatch;

extern unsigned int use_ipfrag;
extern unsigned int tcp_stateful;

int ipfrag_init(char *);
int tcpstream_init(char *);

int ipfrag_process(struct packet *, unsigned int);
void tcpstream_process(struct packet *, unsigned int);
void icmperr_process(struct packet *, unsigned int);

void ipfrag_free(void);
void tcpstream_free(void);

void ipq_kill(struct ipq *);
void tcp_free(struct tcp_session *);

/* Protocols */
extern struct proto ipv4_p;
extern struct proto icmp_p;
extern struct proto tcp_p;
extern struct proto udp_p;

/* Protocol requests */
extern struct proto_req ipv4_r[];
extern struct proto_req icmp_r[];
extern struct proto_req tcp_r[];
extern struct proto_req udp_r[];

/* Decode functions */
void ipv4_decode(struct packet *);
void icmp_decode(struct packet *);
void tcp_decode(struct packet *);
void udp_decode(struct packet *);

/* Print functions */
int ipv4_dprint(struct layer*, char *, int);
int icmp_dprint(struct layer*, char *, int);
int tcp_dprint(struct layer*, char *, int);
int udp_dprint(struct layer*, char *, int);

/* Generators */
extern struct generator ip_gen;
extern struct generator dip_gen;
extern struct generator tcp_gen;
extern struct generator udp_gen;
extern struct generator icmp_gen;
extern struct generator ipfrag_gen;
extern struct generator tcpstream_gen;

/* Token buckets for alert rate-limiting */
extern struct tokenbucket ip_tb;

/* Match functions */
void ip_match(struct packet *, unsigned int);
void tcp_match(struct packet *, unsigned int);
void udp_match(struct packet *, unsigned int);
void icmp_match(struct packet *, unsigned int);

/* Rule commital */
int ip_commit(struct rule *);
int tcp_commit(struct rule *);
int udp_commit(struct rule *);
int icmp_commit(struct rule *);

extern unsigned int cur_depth;
extern unsigned int alert_depth;
extern struct alert *cur_alert;

#endif /* __PLUGIN_TCPIP__ */