template.c

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

/*
* This file is part of Firestorm NIDS
* Copyright (c) 2002 Gianni Tedesco
* This program is released under the terms of the GNU GPL version 2
*/
#include <string.h>
#include <stdlib.h>
#include <cleanup.h>
#include <packet.h>
#include <alert.h>
#include <signature.h>
#include <matcher.h>

int p_range(char *str,
	unsigned int *min,
	unsigned int *max,
	unsigned int mask)
{
	unsigned int num;
	char *lo=NULL, *hi=NULL;
	char *tmp;
	int state=0;

	/* Parse the string out */
	for(tmp=str; *tmp; tmp++) {
		if ( state==0 ) {
			if ( *tmp==':' ) {
				state=2;
			}else if ( *tmp!=' ' && *tmp!='\t' ) {
				lo=tmp;
				state=1;
			}
		}else if ( state==1 ) {
			if ( *tmp==' ' || *tmp=='\t' ) {
				*tmp=0;
			}else if ( *tmp==':' ) {
				state=2;
				*tmp=0;
			}
		}else if ( state==2 ) {
			if ( *tmp!=' ' && *tmp!='\t' ) {
				hi=tmp;
				state=3;
			}
		}else if ( state==3 ) {
			if ( *tmp==' ' || *tmp=='\t' ) {
				*tmp=0;
				break;
			}
		}
	}

	/* Low part is easy */
	if ( lo && *lo ) {
		if ( strtouint(lo, &num) ) return 0;
		if ( num & ~mask ) return 0;
		*min=num&mask;
	} else *min=0;

	if ( hi ) {
		if ( strtouint(hi, &num) ) return 0;
		if ( num & ~mask ) return 0;
		*max=num&mask;
	}else{
		/* If state is 1 that means there was a colon
		 * eg: 1024: otherwise it was just a single
		 * number, eg: '23' in which case max
		 * is just equal to min */
		if ( state>1 )
			*max=mask;
		else
			*max=*min;
	}

	return 1;
}

/* C O M P A R E  F U N C T I O N S */
int template_cmp_lr(void *p1, void *p2)
{
	struct longrange *c1=(struct longrange *)p1;
	struct longrange *c2=(struct longrange *)p2;

	if ( c1->min==c2->min && c1->max==c2->max ) return 0;
	return 1;
}

int template_cmp_sr(void *p1, void *p2)
{
	struct shortrange *c1=(struct shortrange *)p1;
	struct shortrange *c2=(struct shortrange *)p2;

	if ( c1->min==c2->min && c1->max==c2->max ) return 0;
	return 1;
}

/* V A L I D A T E  F U N C T I O N S */
int template_longrange(char *args, void **priv)
{
	struct longrange *ret;

	if ( !(ret=malloc(sizeof(*ret))) ) {
		cperror("malloc");
	}

	if ( !p_range(args, &ret->min, &ret->max, -1) ){
		free(ret);
		return 0;
	}

	*priv=ret;

	return 1;
}

int template_shortrange(char *args, void **priv)
{
	struct longrange tmp;
	struct shortrange *ret;

	if ( !p_range(args, &tmp.min, &tmp.max, 0xffff) ){
		return 0;
	}

	if ( !(ret=malloc(sizeof(*ret))) ) {
		cperror("malloc");
	}

	ret->min=tmp.min;
	ret->max=tmp.max;

	*priv=ret;

	return 1;
}

/* C L E A N U P  F U N C T I O N S */

/* Cleanup a ptr to something */
void template_ptr(void *p){
	if ( p ) free(p);
}