preproc.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

/*
* This file is part of Firestorm NIDS
* Copyright (c) 2002 Gianni Tedesco
* This program is released under the terms of the GNU GPL version 2
*
*    This is the preprocessor subsystem. We keep track of all
*    registered preprocessors and we also manage the instanciation
*    and execution of preprocessors.
*
*    All preprocessors register themselves at plugin load time
*    with preproc_add(). Only preprocessors specified in the
*    configuration are actually used. preproc_setup() is called
*    once for each preprocessor that is specified. The plugin then
*    calls preproc_activate() to stitch itself in to pp_active[]
*    which is an array of preprocessing functions to call for
*    each packet.
*
*/
#include <stdlib.h>
#include <string.h>

#include <firestorm.h>
#include <args.h>
#include <loader.h>
#include <cleanup.h>
#include <packet.h>
#include <preproc.h>
#include <alert.h>
#include <signature.h>
#include <decode.h>

/* All registered preprocessors */
struct preproc *preprocs=NULL;
unsigned int num_preproc=0;
unsigned int preproc_warn=0;

/* Active preprocessors */
#define PP_ALLOC 8

#define MAX_PREPROC 64

void preproc_load(void)
{
	struct plugin *p;
	proc_preproc_load fn;
	static struct preproc_api papi={
		.size=sizeof(papi),
		.preproc_add=preproc_add,
		.preproc_activate=preproc_activate,
		.args_parse=args_parse,
	};

	for(p=ld_list; p; p=p->next) {
		if ( !(fn=loader_symbol(p, plugin_preproc)) )
			continue;

		loader_perror(p, "preproc", fn(&papi));
	}
}

/* Load a preprocessor */
int preproc_setup(char *name, char *args)
{
	struct preproc *p;

	if ( !(p=preproc_find(name)) )
		return 0;

	return p->init(args);
}

/* Add a preprocessor in to the active list */
int preproc_activate(char *proto,
	proc_preprocess proc,
	proc_preproc_free pfree,
	void *priv)
{
	struct proto *r;

	if ( !(r=decode_proto(proto)) ) return 0;

	if ( !r->preproc ) {
		if ( !(r->preproc=calloc(PP_ALLOC,
			sizeof(struct pp_active))) ) {
			cperror("calloc");
		}
		r->max_active=PP_ALLOC;
	}

	/* Grow the array by PP_ALLOC elements */
	if ( r->num_active>=r->max_active ) {
		if ( !(r->preproc=realloc(r->preproc,
			(r->num_active+PP_ALLOC)*
			sizeof(struct pp_active))) ) {
			cperror("realloc");
		}
	}

	r->preproc[r->num_active].process=proc;
	r->preproc[r->num_active].free=pfree;
	r->preproc[r->num_active].priv=priv;
	r->num_active++;

	return 1;
}

/* Find a preprocessor with a given name */
struct preproc *preproc_find(const char *n)
{
	struct preproc *p;

	for(p=preprocs; p; p=p->next) {
		if ( !strcmp(p->name, n) )
			return p;
	}

	return NULL;
}

void preproc_cleanup(int code, void *priv)
{
	struct preproc *foo, *bar;

	for(foo=preprocs; foo;) {
		bar=foo;
		foo=foo->next;
		free(bar);
	}
}

void preproc_init(void)
{
	cleanup_add(preproc_cleanup, NULL);
}

/* Plugins call this to register a preprocessor */
int preproc_add(const char *name, proc_preproc_init init)
{
	struct preproc *p;

	if ( !name || !init || preproc_find(name) ) return 0;

	if ( num_preproc >= MAX_PREPROC ) {
		if ( !preproc_warn ) {
			preproc_warn++;
			mesg(M_WARN,"preproc: MAX_PREPROC exceeded.");
		}
		return 0;
	}

	if ( !(p=malloc(sizeof(struct preproc))) ) {
		cperror("malloc");
	}

	p->name=name;
	p->init=init;
	p->next=preprocs;
	preprocs=p;

	num_preproc++;

	return 1;
}