入侵检测系统首推开源项目snort，完善的匹配规则定义，灵活的插件扩充能力使其有强大的生命力，创建规则匹配的核心代码节选如下：
可以看出，在分解规则的时候，就已经用多个链表，将不同的规则进行分类了，可以根据分析的场景，有选择的去使用合适的规则，实现高效。
void ParseRule(char *prule, int inclevel)
{
char **toks; /* dbl ptr for mSplit call, holds rule tokens */
int num_toks; /* holds number of tokens found by mSplit */
int rule_type; /* rule type enumeration variable */
char rule[1024];
int protocol;
RuleTreeNode proto_node;
/* clean house */
bzero((char *) &proto_node, sizeof(RuleTreeNode));
/* chop off the <CR/LF> from the string */
strip(prule);
/* expand all variables */
strcpy(rule, ExpandVars(prule));
/* break out the tokens from the rule string */
toks = mSplit(rule, " ", 10, &num_toks, 0);
#ifdef DEBUG
printf("[*] Rule start\n");
#endif
/* figure out what we're looking at */
rule_type = RuleType(toks[0]);
#ifdef DEBUG
printf("Rule type: ");
#endif
/* handle non-rule entries */
switch (rule_type)
{
case RULE_PASS:
#ifdef DEBUG
printf("Pass\n");
#endif
break;
case RULE_LOG:
#ifdef DEBUG
printf("Log\n");
#endif
break;
case RULE_ALERT:
#ifdef DEBUG
printf("Alert\n");
#endif
break;
case RULE_INCLUDE:
#ifdef DEBUG
printf("Include\n");
#endif
ParseRulesFile(toks[1], inclevel + 1);
return;
case RULE_VAR:
#ifdef DEBUG
printf("Variable\n");
#endif
VarDefine(toks[1], toks[2]);
return;
case RULE_PREPROCESS:
#ifdef DEBUG
printf("Preprocessor\n");
#endif
ParsePreprocessor(rule);
return;
case RULE_OUTPUT:
#ifdef DEBUG
printf("Output Plugin\n");
#endif
ParseOutputPlugin(rule);
return;
case RULE_ACTIVATE:
#ifdef DEBUG
printf("Activation rule\n");
#endif
break;
case RULE_DYNAMIC:
#ifdef DEBUG
printf("Dynamic rule\n");
#endif
break;
case RULE_CONFIG:
#ifdef DEBUG
printf("Rule file config\n");
#endif
ParseConfig(rule);
return;
case RULE_DECLARE:
#ifdef DEBUG
printf("Rule type declaration\n");
#endif
ParseRuleTypeDeclaration(rule);
return;
case RULE_UNKNOWN:
#ifdef DEBUG
printf("Unknown rule type, might be declared\n");
#endif
ParseDeclaredRuleType(rule);
return;
default:
printf("Invalid input: %s\n", prule);
return;
}
proto_node.type = rule_type;
/* set the rule protocol */
protocol = WhichProto(toks[1]);
/* Process the IP address and CIDR netmask */
/* changed version 1.2.1 */
/*
* "any" IP's are now set to addr 0, netmask 0, and the normal rules are
* applied instead of checking the flag
*/
/*
* if we see a "!<ip number>" we need to set a flag so that we can
* properly deal with it when we are processing packets
*/
if (*toks[2] == '!') /* we found a negated address */
{
proto_node.flags |= EXCEPT_SRC_IP;
ParseIP(&toks[2][1], (u_long *) & proto_node.sip,
(u_long *) & proto_node.smask);
} else
{
ParseIP(toks[2], (u_long *) & proto_node.sip,
(u_long *) & proto_node.smask);
}
/* do the same for the port */
if (ParsePort(toks[3], (u_short *) & proto_node.hsp,
(u_short *) & proto_node.lsp, toks[1],
(int *) &proto_node.not_sp_flag))
{
proto_node.flags |= ANY_SRC_PORT;
}
if (proto_node.not_sp_flag)
proto_node.flags |= EXCEPT_SRC_PORT;
/* New in version 1.3: support for bidirectional rules */
/*
* this checks the rule "direction" token and sets the bidirectional flag
* if the token = '<>'
*/
if (!strncmp("<>", toks[4], 2))
{
#ifdef DEBUG
printf("Bidirectional rule!\n");
#endif
proto_node.flags |= BIDIRECTIONAL;
}
/* changed version 1.2.1 */
/*
* "any" IP's are now set to addr 0, netmask 0, and the normal rules are
* applied instead of checking the flag
*/
/*
* if we see a "!<ip number>" we need to set a flag so that we can
* properly deal with it when we are processing packets
*/
if (*toks[5] == '!') /* we found a negated address */
{
#ifdef DEBUG
printf("setting exception flag for dest IP\n");
#endif
proto_node.flags |= EXCEPT_DST_IP;
ParseIP(&toks[5][1], (u_long *) & proto_node.dip,
(u_long *) & proto_node.dmask);
} else
ParseIP(toks[5], (u_long *) & proto_node.dip,
(u_long *) & proto_node.dmask);
if (ParsePort(toks[6], (u_short *) & proto_node.hdp,
(u_short *) & proto_node.ldp, toks[1],
(int *) &proto_node.not_dp_flag))
{
proto_node.flags |= ANY_DST_PORT;
}
if (proto_node.not_dp_flag)
proto_node.flags |= EXCEPT_DST_PORT;
#ifdef DEBUG
printf("proto_node.flags = 0x%X\n", proto_node.flags);
printf("Processing Head Node....\n");
#endif
switch (rule_type)
{
case RULE_ALERT:
ProcessHeadNode(&proto_node, &Alert, protocol);
break;
case RULE_LOG:
ProcessHeadNode(&proto_node, &Log, protocol);
break;
case RULE_PASS:
ProcessHeadNode(&proto_node, &Pass, protocol);
break;
case RULE_ACTIVATE:
ProcessHeadNode(&proto_node, &Activation, protocol);
break;
case RULE_DYNAMIC:
ProcessHeadNode(&proto_node, &Dynamic, protocol);
break;
default:
FatalError("Unable to determine rule type (%s) for processing, exiting!\n", toks[0]);
}
rule_count++;
#ifdef DEBUG
printf("Parsing Rule Options...\n");
#endif
ParseRuleOptions(rule, rule_type, protocol);
free(toks);
return;
}
/****************************************************************************
*
* Function: ProcessHeadNode(RuleTreeNode *, ListHead *, int)
*
* Purpose: Process the header block info and add to the block list if
* necessary
*
* Arguments: test_node => data generated by the rules parsers
* list => List Block Header refernece
* protocol => ip protocol
*
* Returns: void function
*
***************************************************************************/
void ProcessHeadNode(RuleTreeNode * test_node, ListHead * list, int protocol)
{
int match = 0;
RuleTreeNode *rtn_idx;
int count = 0;
/* select the proper protocol list to attach the current rule to */
switch (protocol)
{
case IPPROTO_TCP:
rtn_idx = list->TcpList;
break;
case IPPROTO_UDP:
rtn_idx = list->UdpList;
break;
case IPPROTO_ICMP:
rtn_idx = list->IcmpList;
break;
default:
rtn_idx = NULL;
break;
}
/*
* if the list head is NULL (empty), make a new one and attach the
* ListHead to it
*/
if (rtn_idx == NULL)
{
head_count++;
switch (protocol)
{
case IPPROTO_TCP:
list->TcpList = (RuleTreeNode *) calloc(sizeof(RuleTreeNode), sizeof(char));
rtn_tmp = list->TcpList;
break;
case IPPROTO_UDP:
list->UdpList = (RuleTreeNode *) calloc(sizeof(RuleTreeNode), sizeof(char));
rtn_tmp = list->UdpList;
break;
case IPPROTO_ICMP:
list->IcmpList = (RuleTreeNode *) calloc(sizeof(RuleTreeNode), sizeof(char));
rtn_tmp = list->IcmpList;
break;
}
/* copy the prototype header data into the new node */
XferHeader(test_node, rtn_tmp);
rtn_tmp->head_node_number = head_count;
/* null out the down (options) pointer */
rtn_tmp->down = NULL;
/* add the function list to the new rule */
SetupRTNFuncList(rtn_tmp);
/* add link to parent listhead */
rtn_tmp->listhead = list;
return;
}
/* see if this prototype node matches any of the existing header nodes */
match = TestHeader(rtn_idx, test_node);
while ((rtn_idx->right != NULL) && !match)
{
count++;
match = TestHeader(rtn_idx, test_node);
if (!match)
rtn_idx = rtn_idx->right;
else
break;
}
/*
* have to check this twice since my loop above exits early, which sucks
* but it's not performance critical
*/
match = TestHeader(rtn_idx, test_node);
/*
* if it doesn't match any of the existing nodes, make a new node and
* stick it at the end of the list
*/
if (!match)
{
#ifdef DEBUG
printf("Building New Chain head node\n");
#endif
head_count++;
/* build a new node */
rtn_idx->right = (RuleTreeNode *) calloc(sizeof(RuleTreeNode), sizeof(char));
/* set the global ptr so we can play with this from anywhere */
rtn_tmp = rtn_idx->right;
/* uh oh */
if (rtn_tmp == NULL)
{
FatalError("ERROR: Unable to allocate Rule Head Node!!\n");
}
/* copy the prototype header info into the new header block */
XferHeader(test_node, rtn_tmp);
rtn_tmp->head_node_number = head_count;
rtn_tmp->down = NULL;
/* initialize the function list for the new RTN */
SetupRTNFuncList(rtn_tmp);
/* add link to parent listhead */
rtn_tmp->listhead = list;
#ifdef DEBUG
printf("New Chain head flags = 0x%X\n", rtn_tmp->flags);
#endif
} else
{
rtn_tmp = rtn_idx;
#ifdef DEBUG
printf("Chain head %d flags = 0x%X\n", count, rtn_tmp->flags);
#endif
#ifdef DEBUG
printf("Adding options to chain head %d\n", count);
#endif
}
}
/****************************************************************************
*
* Function: AddRuleFuncToList(int (*func)(), RuleTreeNode *)
*
* Purpose: Adds RuleTreeNode associated detection functions to the
* current rule's function list
*
* Arguments: *func => function pointer to the detection function
* rtn => pointer to the current rule
*
* Returns: void function
*
***************************************************************************/
void AddRuleFuncToList(int (*func) (Packet *, struct _RuleTreeNode *, struct _RuleFpList *), RuleTreeNode * rtn)
{
RuleFpList *idx;
#ifdef DEBUG
printf("Adding new rule to list\n");
#endif
idx = rtn->rule_func;
if (idx == NULL)
{
rtn->rule_func = (RuleFpList *) calloc(sizeof(RuleFpList), sizeof(char));
rtn->rule_func->RuleHeadFunc = func;
} else
{
while (idx->next != NULL)
idx = idx->next;
idx->next = (RuleFpList *) calloc(sizeof(RuleFpList), sizeof(char));
idx = idx->next;
idx->RuleHeadFunc = func;
}
}
/****************************************************************************
*
* Function: SetupRTNFuncList(RuleTreeNode *)
*
* Purpose: Configures the function list for the rule header detection
* functions (addrs and ports)
*
* Arguments: rtn => the pointer to the current rules list entry to attach to
*
* Returns: void function
*
***************************************************************************/
void SetupRTNFuncList(RuleTreeNode * rtn)
{
#ifdef DEBUG
printf("Initializing RTN function list!\n");
printf("Functions: ");
#endif
if (rtn->flags & BIDIRECTIONAL)
{
#ifdef DEBUG
printf("CheckBidirectional->\n");
#endif
AddRuleFuncToList(CheckBidirectional, rtn);
} else
{
/* link in the proper IP address detection function */
/*
* the in-line "if" determines whether or not the negation operator
* has been set for this rule and tells the AddrToFunc call which
* function it should be linking in
*/
AddrToFunc(rtn, rtn->sip, rtn->smask, (rtn->flags & EXCEPT_SRC_IP ? 1 : 0), SRC);
/* last verse, same as the first (but for dest IP) ;) */
AddrToFunc(rtn, rtn->dip, rtn->dmask, (rtn->flags & EXCEPT_DST_IP ? 1 : 0), DST);
/* Attach the proper port checking function to the function list */
/*
* the in-line "if's" check to see if the "any" or "not" flags have
* been set so the PortToFunc call can determine which port testing
* function to attach to the list
*/
PortToFunc(rtn, (rtn->flags & ANY_SRC_PORT ? 1 : 0),
(rtn->flags & EXCEPT_SRC_PORT ? 1 : 0), SRC);
/* as above */
PortToFunc(rtn, (rtn->flags & ANY_DST_PORT ? 1 : 0),
(rtn->flags & EXCEPT_DST_PORT ? 1 : 0), DST);
}
#ifdef DEBUG
printf("RuleListEnd\n");
#endif
/* tack the end (success) function to the list */
AddRuleFuncToList(RuleListEnd, rtn);
}
/****************************************************************************
*
* Function: AddrToFunc(RuleTreeNode *, u_long, u_long, int, int)
*
* Purpose: Links the proper IP address testing function to the current RTN
* based on the address, netmask, and addr flags
*
* Arguments: rtn => the pointer to the current rules list entry to attach to
* ip => IP address of the current rule
* mask => netmask of the current rule
* exception_flag => indicates that a "!" has been set for this
* address
* mode => indicates whether this is a rule for the source
* or destination IP for the rule
*
* Returns: void function
*
***************************************************************************/
void AddrToFunc(RuleTreeNode * rtn, u_long ip, u_long mask, int exception_flag, int mode)
{
/*
* if IP and mask are both 0, this is a "any" IP and we don't need to
* check it
*/
if ((ip == 0) && (mask == 0))
return;
/* if the exception flag is up, test with the exception function */
if (exception_flag)
{
switch (mode)
{
case SRC:
#ifdef DEBUG
printf("CheckSrcIPNotEq -> ");
#endif
AddRuleFuncToList(CheckSrcIPNotEq, rtn);
break;
case DST:
#ifdef DEBUG
printf("CheckDstIPNotEq -> ");
#endif
AddRuleFuncToList(CheckDstIPNotEq, rtn);
break;
}
return;
}
switch (mode)
{
case SRC:
#ifdef DEBUG
printf("CheckSrcIPEqual -> ");
#endif
AddRuleFuncToList(CheckSrcIPEqual, rtn);
break;
case DST:
#ifdef DEBUG
printf("CheckDstIPEqual -> ");
#endif
AddRuleFuncToList(CheckDstIPEqual, rtn);
break;
}
}
/****************************************************************************
*
* Function: PortToFunc(RuleTreeNode *, int, int, int)
*
* Purpose: Links in the port analysis function for the current rule
*
* Arguments: rtn => the pointer to the current rules list entry to attach to
* any_flag => accept any port if set
* except_flag => indicates negation (logical NOT) of the test
* mode => indicates whether this is a rule for the source
* or destination port for the rule
*
* Returns: void function
*
***************************************************************************/
void PortToFunc(RuleTreeNode * rtn, int any_flag, int except_flag, int mode)
{
/*
* if the any flag is set we don't need to perform any test to match on
* this port
*/
if (any_flag)
return;
/* if the except_flag is up, test with the "NotEq" funcs */
if (except_flag)
{
switch (mode)
{
case SRC:
#ifdef DEBUG
printf("CheckSrcPortNotEq -> ");
#endif
AddRuleFuncToList(CheckSrcPortNotEq, rtn);
break;
case DST:
#ifdef DEBUG
printf("CheckDstPortNotEq -> ");
#endif
AddRuleFuncToList(CheckDstPortNotEq, rtn);
break;
}
return;
}
/* default to setting the straight test function */
switch (mode)
{
case SRC:
#ifdef DEBUG
printf("CheckSrcPortEqual -> ");
#endif
AddRuleFuncToList(CheckSrcPortEqual, rtn);
break;
case DST:
#ifdef DEBUG
printf("CheckDstPortEqual -> ");
#endif
AddRuleFuncToList(CheckDstPortEqual, rtn);
break;
}
return;
}
/****************************************************************************
*
* Function: AddOptFuncToList(int (*func)(), OptTreeNode *)
*
* Purpose: Links the option detection module to the OTN
*
* Arguments: (*func)() => function pointer to the detection module
* otn => pointer to the current OptTreeNode
*
* Returns: void function
*
***************************************************************************/
void AddOptFuncToList(int (*func) (Packet *, struct _OptTreeNode *, struct _OptFpList *), OptTreeNode * otn)
{
OptFpList *idx; /* index pointer */
#ifdef DEBUG
printf("Adding new rule to list\n");
#endif
/* set the index pointer to the start of this OTN's function list */
idx = otn->opt_func;
/* if there are no nodes on the function list... */
if (idx == NULL)
{
/* calloc the list head */
otn->opt_func = (OptFpList *) calloc(sizeof(OptFpList), sizeof(char));
if (otn->opt_func == NULL)
{
FatalError("ERROR => AddOptFuncToList new node calloc failed: %s\n", strerror(errno));
}
/* set the head function */
otn->opt_func->OptTestFunc = func;
} else
{
/* walk to the end of the list */
while (idx->next != NULL)
{
idx = idx->next;
}
/* allocate a new node on the end of the list */
idx->next = (OptFpList *) calloc(sizeof(OptFpList), sizeof(char));
if (idx->next == NULL)
{
FatalError("ERROR => AddOptFuncToList new node calloc failed: %s\n", strerror(errno));
}
/* move up to the new node */
idx = idx->next;
/* link the function to the new node */
idx->OptTestFunc = func;
#ifdef DEBUG
printf("Set OptTestFunc to %p\n", func);
#endif
}
}
/****************************************************************************
*
* Function: ParsePreprocessor(char *)
*
* Purpose: Walks the preprocessor function list looking for the user provided
* keyword. Once found, call the preprocessor's initialization
* function.
*
* Arguments: rule => the preprocessor initialization string from the rules file
*
* Returns: void function
*
***************************************************************************/
void ParsePreprocessor(char *rule)
{
char **toks; /* pointer to the tokenized array parsed from
* the rules list */
char **pp_head; /* parsed keyword list, with preprocessor
* keyword being the 2nd element */
char *funcname; /* the ptr to the actual preprocessor keyword */
char *pp_args = NULL; /* parsed list of arguments to the
* preprocessor */
int num_toks; /* number of tokens returned by the mSplit
* function */
int found = 0; /* flag var */
PreprocessKeywordList *pl_idx; /* index into the preprocessor
* keyword/func list */
/* break out the arguments from the keywords */
toks = mSplit(rule, ":", 2, &num_toks, '\\');
if (num_toks >= 1)
{
#ifdef DEBUG
printf("toks[1] = %s\n", toks[1]);
#endif
/* the args are everything after the ":" */
pp_args = toks[1];
}
/* split the head section for the preprocessor keyword */
pp_head = mSplit(toks[0], " ", 2, &num_toks, '\\');
/* set a pointer to the actual keyword */
funcname = pp_head[1];
/* set the index to the head of the keyword list */
pl_idx = PreprocessKeywords;
/* walk the keyword list */
while (pl_idx != NULL)
{
#ifdef DEBUG
printf("comparing: \"%s\" => \"%s\"\n", funcname, pl_idx->entry.keyword);
#endif
/* compare the keyword against the current list element's keyword */
if (!strcasecmp(funcname, pl_idx->entry.keyword))
{
pl_idx->entry.func(pp_args);
found = 1;
}
if (!found)
{
pl_idx = pl_idx->next;
} else
break;
}
if (!found)
printf("\n*WARNING*: unknown preprocessor \"%s\", ignoring!\n\n",
funcname);
}
void AddFuncToPreprocList(void (*func) (Packet *))
{
PreprocessFuncNode *idx;
idx = PreprocessList;
if (idx == NULL)
{
PreprocessList = (PreprocessFuncNode *) calloc(sizeof(PreprocessFuncNode), sizeof(char));
PreprocessList->func = func;
} else
{
while (idx->next != NULL)
idx = idx->next;
idx->next = (PreprocessFuncNode *) calloc(sizeof(PreprocessFuncNode), sizeof(char));
idx = idx->next;
idx->func = func;
}
return;
}
void ParseOutputPlugin(char *rule)
{
char **toks;
char **pp_head;
char *funcname;
char *pp_args = NULL;
int num_toks;
int found = 0;
OutputKeywordList *pl_idx;
toks = mSplit(rule, ":", 2, &num_toks, '\\');
if (num_toks >= 1)
{
pp_args = toks[1];
}
pp_head = mSplit(toks[0], " ", 2, &num_toks, '\\');
funcname = pp_head[1];
pl_idx = OutputKeywords;
while (pl_idx != NULL)
{
#ifdef DEBUG
printf("comparing: \"%s\" => \"%s\"\n", funcname, pl_idx->entry.keyword);
#endif
if (!strcasecmp(funcname, pl_idx->entry.keyword))
{
switch (pl_idx->entry.node_type)
{
case NT_OUTPUT_ALERT:
if (!pv.alert_cmd_override)
{
if (AlertFunc == NULL)
{
AlertFunc = CallAlertPlugins;
}
/* call the configuration function for the plugin */
pl_idx->entry.func(pp_args);
} else
{
ErrorMessage("WARNING: command line overrides rules file alert plugin!\n");
}
break;
case NT_OUTPUT_LOG:
if (!pv.log_cmd_override)
{
if (LogFunc == NULL)
{
LogFunc = CallLogPlugins;
}
/* call the configuration function for the plugin */
pl_idx->entry.func(pp_args);
} else
{
ErrorMessage("WARNING: command line overrides rules file logging plugin!\n");
}
break;
}
found = 1;
}
if (!found)
{
pl_idx = pl_idx->next;
} else
break;
}
if (!found)
{
printf("\n*WARNING*: unknown output plugin \"%s\", ignoring!\n\n", funcname);
}
}
/*
* frees the existing OutputList ands sets it a single node for the
* function argument
*/
void SetOutputList(void (*func) (Packet *, char *, void *), char node_type,
void *arg)
{
OutputFuncNode *idx;
OutputFuncNode *prev;
switch (node_type)
{
case NT_OUTPUT_ALERT:
prev = AlertList;
break;
case NT_OUTPUT_LOG:
prev = LogList;
break;
default:
return;
}
while (prev != NULL)
{
idx = prev->next;
free(prev);
prev = idx;
}
return AddFuncToOutputList(func, node_type, arg);
}
void AddFuncToOutputList(void (*func) (Packet *, char *, void *), char node_type,
void *arg)
{
switch (node_type)
{
case NT_OUTPUT_ALERT:
if (head_tmp != NULL)
head_tmp->AlertList = AppendOutputFuncList(func, arg,
head_tmp->AlertList);
else
AlertList = AppendOutputFuncList(func, arg, AlertList);
break;
case NT_OUTPUT_LOG:
if (head_tmp != NULL)
head_tmp->LogList = AppendOutputFuncList(func, arg,
head_tmp->LogList);
else
LogList = AppendOutputFuncList(func, arg, LogList);
break;
default:
/* just to be error-prone */
FatalError("Unknown nodetype: %i. Possible bug. please report\n",
node_type);
}
}
OutputFuncNode *AppendOutputFuncList(void (*func) (Packet *, char *, void *),
void *arg, OutputFuncNode * list)
{
OutputFuncNode *idx = list;
if (idx == NULL)
{
idx = (OutputFuncNode *) calloc(sizeof(OutputFuncNode), sizeof(char));
idx->func = func;
idx->arg = arg;
list = idx;
} else
{
while (idx->next != NULL)
idx = idx->next;
idx->next = (OutputFuncNode *) calloc(sizeof(OutputFuncNode), sizeof(char));
idx = idx->next;
idx->func = func;
idx->arg = arg;
}
idx->next = NULL;
return list;
}
/****************************************************************************
*
* Function: ParseRuleOptions(char *, int)
*
* Purpose: Process an individual rule's options and add it to the
* appropriate rule chain
*
* Arguments: rule => rule string
* rule_type => enumerated rule type (alert, pass, log)
*
* Returns: void function
*
***************************************************************************/
void ParseRuleOptions(char *rule, int rule_type, int protocol)
{
char **toks = NULL;
char **opts;
char *idx;
char *aux;
int num_toks;
int i;
int num_opts;
int found = 0;
OptTreeNode *otn_idx;
KeywordXlateList *kw_idx;
/* set the OTN to the beginning of the list */
otn_idx = rtn_tmp->down;
/*
* make a new one and stick it either at the end of the list or hang it
* off the RTN pointer
*/
if (otn_idx != NULL)
{
/* loop to the end of the list */
while (otn_idx->next != NULL)
{
otn_idx = otn_idx->next;
}
/* setup the new node */
otn_idx->next = (OptTreeNode *) calloc(sizeof(OptTreeNode), sizeof(char));
/* set the global temp ptr */
otn_tmp = otn_idx->next;
if (otn_tmp == NULL)
{
FatalError("ERROR: Unable to alloc OTN: %s", strerror(errno));
}
otn_tmp->next = NULL;
opt_count++;
} else
{
/* first entry on the chain, make a new node and attach it */
otn_idx = (OptTreeNode *) calloc(sizeof(OptTreeNode), sizeof(char));
bzero((char *) otn_idx, sizeof(OptTreeNode));
otn_tmp = otn_idx;
if (otn_tmp == NULL)
{
FatalError("ERROR: Unable to alloc OTN!\n");
}
otn_tmp->next = NULL;
rtn_tmp->down = otn_tmp;
opt_count++;
}
otn_tmp->chain_node_number = opt_count;
otn_tmp->type = rule_type;
/* add link to parent RuleTreeNode */
otn_tmp->rtn = rtn_tmp;
/* find the start of the options block */
idx = index(rule, '(');
i = 0;
if (idx != NULL)
{
idx++;
/* find the end of the options block */
aux = strrchr(idx, ')');
/* get rid of the trailing ")" */
if (aux == NULL)
{
FatalError("ERROR: problems parsing rule file.\n");
}
*aux = 0;
/* seperate all the options out, the seperation token is a semicolon */
/*
* NOTE: if you want to include a semicolon in the content of your
* rule, it must be preceeded with a '\'
*/
toks = mSplit(idx, ";", 10, &num_toks, '\\');
#ifdef DEBUG
printf(" Got %d tokens\n", num_toks);
#endif
/* decrement the number of toks */
num_toks--;
#ifdef DEBUG
printf("Parsing options list: ");
#endif
while (num_toks)
{
#ifdef DEBUG
printf(" option: %s\n", toks[i]);
#endif
/* break out the option name from its data */
opts = mSplit(toks[i], ":", 4, &num_opts, '\\');
#ifdef DEBUG
printf(" option name: %s\n", opts[0]);
printf(" option args: %s\n", opts[1]);
#endif
/* advance to the beginning of the data (past the whitespace) */
while (isspace((int) *opts[0]))
opts[0]++;
/* figure out which option tag we're looking at */
if (!strncasecmp(opts[0], "msg", 3))
{
ParseMessage(opts[1]);
} else if (!strncasecmp(opts[0], "logto", 5))
{
ParseLogto(opts[1]);
} else if (!strncasecmp(opts[0], "activates", 9))
{
ParseActivates(opts[1]);
dynamic_rules_present++;
} else if (!strncasecmp(opts[0], "activated_by", 12))
{
ParseActivatedBy(opts[1]);
dynamic_rules_present++;
} else if (!strncasecmp(opts[0], "count", 5))
{
if (otn_tmp->type != RULE_DYNAMIC)
FatalError("The \"count\" option may only be used with the dynamic rule type!\n");
ParseCount(opts[1]);
}
#ifdef ENABLE_RESPONSE
else if (!strncasecmp(opts[0], "resp", 4))
{
otn_tmp->response_flag = RESP_RST_SND;
ParseResponse(opts[1]);
}
#endif
else
{
kw_idx = KeywordList;
found = 0;
while (kw_idx != NULL)
{
#ifdef DEBUG
printf("comparing: \"%s\" => \"%s\"\n", opts[0], kw_idx->entry.keyword);
#endif
if (!strcasecmp(opts[0], kw_idx->entry.keyword))
{
kw_idx->entry.func(opts[1], otn_tmp, protocol);
found = 1;
#ifdef DEBUG
printf("%s->", kw_idx->entry.keyword);
#endif
}
if (!found)
{
kw_idx = kw_idx->next;
} else
break;
}
if (!found)
{
if (!strcasecmp(opts[0], "minfrag"))
{
FatalError("\nERROR: %s (%d) => Minfrag is no longer a rule option, it is a\npreprocessor (please remove it from your rules file). See RULES.SAMPLE or\nsnort-lib for examples of using the new preprocessors!\n", file_name, file_line);
} else
{
FatalError("\nERROR: %s (%d) => Unknown keyword \"%s\" in rule!\n", file_name, file_line, opts[0]);
}
}
}
free(opts);
--num_toks;
i++;
}
#ifdef DEBUG
printf("OptListEnd\n");
#endif
AddOptFuncToList(OptListEnd, otn_tmp);
} else
{
#ifdef DEBUG
printf("OptListEnd\n");
#endif
AddOptFuncToList(OptListEnd, otn_tmp);
}
free(toks);
}
/****************************************************************************
*
* Function: RuleType(char *)
*
* Purpose: Determine what type of rule is being processed and return its
* equivalent value
*
* Arguments: func => string containing the rule type
*
* Returns: The rule type designation
*
***************************************************************************/
int RuleType(char *func)
{
if (func == NULL)
{
FatalError("ERROR line %s (%d) => Unknown rule type (%s)\n", file_name, file_line, func);
}
if (!strncasecmp(func, "log", 3))
return RULE_LOG;
if (!strncasecmp(func, "alert", 5))
return RULE_ALERT;
if (!strncasecmp(func, "pass", 4))
return RULE_PASS;
if (!strncasecmp(func, "var", 3))
return RULE_VAR;
if (!strncasecmp(func, "include", 7))
return RULE_INCLUDE;
if (!strncasecmp(func, "preprocessor", 12))
return RULE_PREPROCESS;
if (!strncasecmp(func, "output", 6))
return RULE_OUTPUT;
if (!strncasecmp(func, "activate", 8))
return RULE_ACTIVATE;
if (!strncasecmp(func, "dynamic", 7))
return RULE_DYNAMIC;
if (!strncasecmp(func, "config", 6))
return RULE_CONFIG;
if (!strncasecmp(func, "ruletype", 8))
return RULE_DECLARE;
return RULE_UNKNOWN;
}
/****************************************************************************
*
* Function: WhichProto(char *)
*
* Purpose: Figure out which protocol the current rule is talking about
*
* Arguments: proto_str => the protocol string
*
* Returns: The integer value of the protocol
*
***************************************************************************/
int WhichProto(char *proto_str)
{
if (!strncasecmp(proto_str, "tcp", 3))
return IPPROTO_TCP;
if (!strncasecmp(proto_str, "udp", 3))
return IPPROTO_UDP;
if (!strncasecmp(proto_str, "icmp", 4))
return IPPROTO_ICMP;
/*
* if we've gotten here, we have a protocol string we din't recognize and
* should exit
*/
FatalError("ERROR %s (%d) => Bad protocol: %s\n", file_name, file_line, proto_str);
return 0;
}
/****************************************************************************
*
* Function: ParseIP(char *, u_long *, u_long *)
*
* Purpose: Convert a supplied IP address to it's network order 32-bit long
value. Also convert the CIDR block notation into a real
* netmask.
*
* Arguments: addr => address string to convert
* ip_addr => storage point for the converted ip address
* netmask => storage point for the converted netmask
*
* Returns: 0 for normal addresses, 1 for an "any" address
*
***************************************************************************/
int ParseIP(char *paddr, u_long * ip_addr, u_long * netmask)
{
char **toks; /* token dbl buffer */
int num_toks; /* number of tokens found by mSplit() */
int cidr = 1; /* is network expressed in CIDR format */
int nmask; /* netmask temporary storage */
char *addr; /* string to parse, eventually a
* variable-contents */
struct hostent *host_info; /* various struct pointers for stuff */
struct sockaddr_in sin; /* addr struct */
/* check for variable */
if (!strncmp(paddr, "{1}quot;, 1))
{
if ((addr = VarGet(paddr + 1)) == NULL)
{
FatalError("ERROR %s (%d) => Undefined variable %s\n", file_name, file_line, paddr);
}
} else
addr = paddr;
/* check for wildcards */
if (!strncasecmp(addr, "any", 3))
{
*ip_addr = 0;
*netmask = 0;
return 1;
}
/* break out the CIDR notation from the IP address */
toks = mSplit(addr, "/", 2, &num_toks, 0);
/* "/" was not used as a delimeter, try ":" */
if (num_toks == 1)
toks = mSplit(addr, ":", 2, &num_toks, 0);
/*
* if we have a mask spec and it is more than two characters long, assume
* it is netmask format
*/
if ((num_toks > 1) && strlen(toks[1]) > 2)
cidr = 0;
switch (num_toks)
{
case 1:
*netmask = netmasks[32];
break;
case 2:
if (cidr)
{
/* convert the CIDR notation into a real live netmask */
nmask = atoi(toks[1]);
/* it's pain to differ whether toks[1] is correct if netmask */
/* is /0, so we deploy some sort of evil hack with isdigit */
if (!isdigit((int) toks[1][0]))
nmask = -1;
if ((nmask > -1) && (nmask < 33))
{
*netmask = netmasks[nmask];
} else
{
FatalError("ERROR %s (%d) => Invalid CIDR block for IP addr %s\n", file_name, file_line, addr);
}
} else
{
/* convert the netmask into its 32-bit value */
/* broadcast address fix from Steve Beaty <beaty@emess.mscd.edu> */
/*
* * if the address is the (v4) broadcast address, inet_addr *
* returns -1 which usually signifies an error, but in the *
* broadcast address case, is correct. we'd use inet_aton() *
* here, but it's less portable.
*/
if (!strncmp(toks[1], "255.255.255.255", 15))
{
*netmask = INADDR_BROADCAST;
} else if ((*netmask = inet_addr(toks[1])) == -1)
{
FatalError("ERROR %s (%d) => Rule netmask (%s) didn't x-late, WTF?\n", file_name, file_line, toks[1]);
}
}
break;
default:
FatalError("ERROR %s (%d) => Unrecognized IP address/netmask %s\n", file_name, file_line, addr);
break;
}
#ifndef WORDS_BIGENDIAN
/*
* since PC's store things the "wrong" way, shuffle the bytes into the
* right order. Non-CIDR netmasks are already correct.
*/
if (cidr)
{
*netmask = htonl(*netmask);
}
#endif
/* convert names to IP addrs */
if (isalpha((int) toks[0][0]))
{
/* get the hostname and fill in the host_info struct */
if ((host_info = gethostbyname(toks[0])))
{
bcopy(host_info->h_addr, (char *) &sin.sin_addr, host_info->h_length);
} else if ((sin.sin_addr.s_addr = inet_addr(toks[0])) == INADDR_NONE)
{
FatalError("ERROR %s (%d) => Couldn't resolve hostname %s\n",
file_name, file_line, toks[0]);
}
*ip_addr = ((u_long) (sin.sin_addr.s_addr) & (*netmask));
return 1;
}
/* convert the IP addr into its 32-bit value */
/* broadcast address fix from Steve Beaty <beaty@emess.mscd.edu> */
/*
* * if the address is the (v4) broadcast address, inet_addr returns -1 *
* which usually signifies an error, but in the broadcast address case, *
* is correct. we'd use inet_aton() here, but it's less portable.
*/
if (!strncmp(toks[0], "255.255.255.255", 15))
{
*ip_addr = INADDR_BROADCAST;
} else if ((*ip_addr = inet_addr(toks[0])) == -1)
{
FatalError("ERROR %s (%d) => Rule IP addr (%s) didn't x-late, WTF?\n", file_name, file_line, toks[0]);
} else
{
/* set the final homenet address up */
*ip_addr = ((u_long) (*ip_addr) & (*netmask));
}
free(toks);
return 0;
}
/****************************************************************************
*
* Function: ParsePort(char *, u_short *)
*
* Purpose: Convert the port string over to an integer value
*
* Arguments: prule_port => port rule string
* port => converted integer value of the port
*
* Returns: 0 for a normal port number, 1 for an "any" port
*
***************************************************************************/
int ParsePort(char *prule_port, u_short * hi_port, u_short * lo_port, char *proto, int *not_flag)
{
char **toks; /* token dbl buffer */
int num_toks; /* number of tokens found by mSplit() */
char *rule_port; /* port string */
*not_flag = 0;
/* check for variable */
if (!strncmp(prule_port, "{1}quot;, 1))
{
if ((rule_port = VarGet(prule_port + 1)) == NULL)
{
FatalError("ERROR %s (%d) => Undefined variable %s\n", file_name, file_line, prule_port);
}
} else
rule_port = prule_port;
/* check for wildcards */
if (!strncasecmp(rule_port, "any", 3))
{
*hi_port = 0;
*lo_port = 0;
return 1;
}
if (rule_port[0] == '!')
{
*not_flag = 1;
rule_port++;
}
if (rule_port[0] == ':')
{
*lo_port = 0;
}
toks = mSplit(rule_port, ":", 2, &num_toks, 0);
switch (num_toks)
{
case 1:
*hi_port = ConvPort(toks[0], proto);
if (rule_port[0] == ':')
{
*lo_port = 0;
} else
{
*lo_port = *hi_port;
if (index(rule_port, ':') != NULL)
{
*hi_port = 65535;
}
}
return 0;
case 2:
*lo_port = ConvPort(toks[0], proto);
if (toks[1][0] == 0)
*hi_port = 65535;
else
*hi_port = ConvPort(toks[1], proto);
return 0;
default:
FatalError("ERROR %s (%d) => port conversion failed on \"%s\"\n",
file_name, file_line, rule_port);
}
return 0;
}
/****************************************************************************
*
* Function: ConvPort(char *, char *)
*
* Purpose: Convert the port string over to an integer value
*
* Arguments: port => port string
* proto => converted integer value of the port
*
* Returns: the port number
*
***************************************************************************/
int ConvPort(char *port, char *proto)
{
int conv; /* storage for the converted number */
struct servent *service_info;
/*
* convert a "word port" (http, ftp, imap, whatever) to its corresponding
* numeric port value
*/
if (isalpha((int) port[0]) != 0)
{
service_info = getservbyname(port, proto);
if (service_info != NULL)
{
conv = ntohs(service_info->s_port);
return conv;
} else
{
FatalError("ERROR %s (%d) => getservbyname() failed on \"%s\"\n",
file_name, file_line, port);
}
}
if (!isdigit((int) port[0]))
{
FatalError("ERROR %s (%d) => Invalid port: %s\n", file_name,
file_line, port);
}
/* convert the value */
conv = atoi(port);
/* make sure it's in bounds */
if ((conv >= 0) && (conv < 65536))
{
return conv;
} else
{
FatalError("ERROR %s (%d) => bad port number: %s", file_name,
file_line, port);
}
return 0;
}
/****************************************************************************
*
* Function: ParseMessage(char *)
*
* Purpose: Stuff the alert message onto the rule
*
* Arguments: msg => the msg string
*
* Returns: void function
*
***************************************************************************/
void ParseMessage(char *msg)
{
char *ptr;
char *end;
int size;
/* figure out where the message starts */
ptr = index(msg, '"');
if (ptr == NULL)
{
ptr = msg;
} else
ptr++;
end = index(ptr, '"');
if (end != NULL)
*end = 0;
while (isspace((int) *ptr))
ptr++;
/* find the end of the alert string */
size = strlen(msg) + 1;
/* alloc space for the string and put it in the rule */
if (size > 0)
{
otn_tmp->message = (char *) calloc((sizeof(char) * size), sizeof(char));
strncpy(otn_tmp->message, ptr, size);
otn_tmp->message[size - 1] = 0;
#ifdef DEBUG
printf("Rule message set to: %s\n", otn_tmp->message);
#endif
} else
{
ErrorMessage("ERROR %s (%d): bad alert message size %d\n", file_name, file_line, size);
}
}
/****************************************************************************
*
* Function: ParseLogto(char *)
*
* Purpose: stuff the special log filename onto the proper rule option
*
* Arguments: filename => the file name
*
* Returns: void function
*
***************************************************************************/
void ParseLogto(char *filename)
{
char *sptr;
char *eptr;
/* grab everything between the starting " and the end one */
sptr = index(filename, '"');
eptr = strrchr(filename, '"');
if (sptr != NULL && eptr != NULL)
{
/* increment past the first quote */
sptr++;
/* zero out the second one */
*eptr = 0;
} else
{
sptr = filename;
}
/* malloc up a nice shiny clean buffer */
otn_tmp->logto = (char *) calloc(strlen(sptr) + 1, sizeof(char));
bzero((char *) otn_tmp->logto, strlen(sptr) + 1);
strncpy(otn_tmp->logto, sptr, strlen(sptr));
}
#ifdef ENABLE_RESPONSE
/****************************************************************************
*
* Function: ParseResponse(char *)
*
* Purpose: Figure out how to handle hostile connection attempts
*
* Arguments: type => string of comma-sepatared modifiers
*
* Returns: void function
*
***************************************************************************/
void ParseResponse(char *type)
{
char *p;
while (isspace((int) *type))
type++;
if (!type || !(*type))
return;
otn_tmp->response_flag = 0;
p = strtok(type, ",");
while (p)
{
if (!strncasecmp(p, "rst_snd", 7))
otn_tmp->response_flag |= RESP_RST_SND;
else if (!strncasecmp(p, "rst_rcv", 7))
otn_tmp->response_flag |= RESP_RST_RCV;
else if (!strncasecmp(p, "rst_all", 7))
otn_tmp->response_flag |= (RESP_RST_SND | RESP_RST_RCV);
else if (!strncasecmp(p, "icmp_net", 8))
otn_tmp->response_flag |= RESP_BAD_NET;
else if (!strncasecmp(p, "icmp_host", 9))
otn_tmp->response_flag |= RESP_BAD_HOST;
else if (!strncasecmp(p, "icmp_port", 9))
otn_tmp->response_flag |= RESP_BAD_PORT;
else if (!strncasecmp(p, "icmp_all", 9))
otn_tmp->response_flag |= (RESP_BAD_NET | RESP_BAD_HOST | RESP_BAD_PORT);
else
{
FatalError("ERROR %s (%d): invalid response modifier: %s\n", file_name, file_line, p);
}
p = strtok(NULL, ",");
}
}
#endif
/****************************************************************************
*
* Function: ParseActivates(char *)
*
* Purpose: Set an activation link record
*
* Arguments: act_num => rule number to be activated
*
* Returns: void function
*
****************************************************************************/
void ParseActivates(char *act_num)
{
/*
* allocate a new node on the RTN get rid of whitespace at the front of
* the list
*/
while (!isdigit((int) *act_num))
act_num++;
otn_tmp->activates = atoi(act_num);
}
/****************************************************************************
*
* Function: ParseActivatedBy(char *)
*
* Purpose: Set an activation link record
*
* Arguments: act_by => rule number to be activated
*
* Returns: void function
*
****************************************************************************/
void ParseActivatedBy(char *act_by)
{
ActivateList *al_ptr;
al_ptr = rtn_tmp->activate_list;
if (al_ptr == NULL)
{
rtn_tmp->activate_list = (ActivateList *) calloc(sizeof(ActivateList), sizeof(char));
if (rtn_tmp->activate_list == NULL)
{
FatalError("ERROR: ParseActivatedBy() calloc failed: %s\n", strerror(errno));
}
al_ptr = rtn_tmp->activate_list;
} else
{
while (al_ptr->next != NULL)
{
al_ptr = al_ptr->next;
}
al_ptr->next = (ActivateList *) calloc(sizeof(ActivateList), sizeof(char));
al_ptr = al_ptr->next;
if (al_ptr == NULL)
{
FatalError("ERROR: ParseActivatedBy() calloc failed: %s\n", strerror(errno));
}
}
/* get rid of whitespace at the front of the list */
while (!isdigit((int) *act_by))
act_by++;
/* set the RTN list node number */
al_ptr->activated_by = atoi(act_by);
/* set the OTN list node number */
otn_tmp->activated_by = atoi(act_by);
return;
}
void ParseCount(char *num)
{
while (!isdigit((int) *num))
num++;
otn_tmp->activation_counter = atoi(num);
#ifdef DEBUG
printf("Set activation counter to %d\n", otn_tmp->activation_counter);
#endif
return;
}
/****************************************************************************
*
* Function: XferHeader(RuleTreeNode *, RuleTreeNode *)
*
* Purpose: Transfer the rule block header data from point A to point B
*
* Arguments: rule => the place to xfer from
* rtn => the place to xfer to
*
* Returns: void function
*
***************************************************************************/
void XferHeader(RuleTreeNode * rule, RuleTreeNode * rtn)
{
rtn->type = rule->type;
rtn->sip = rule->sip;
rtn->dip = rule->dip;
rtn->smask = rule->smask;
rtn->dmask = rule->dmask;
rtn->hsp = rule->hsp;
rtn->lsp = rule->lsp;
rtn->hdp = rule->hdp;
rtn->ldp = rule->ldp;
rtn->flags = rule->flags;
}
/****************************************************************************
*
* Function: TestHeader(RuleTreeNode *, RuleTreeNode *)
*
* Purpose: Check to see if the two header blocks are identical
*
* Arguments: rule => uh
* rtn => uuuuhhhhh....
*
* Returns: 1 if they match, 0 if they don't
*
***************************************************************************/
int TestHeader(RuleTreeNode * rule, RuleTreeNode * rtn)
{
if (rtn->sip == rule->sip)
{
if (rtn->dip == rule->dip)
{
if (rtn->dmask == rule->dmask)
{
if (rtn->smask == rule->smask)
{
if (rtn->hsp == rule->hsp)
{
if (rtn->lsp == rule->lsp)
{
if (rtn->hdp == rule->hdp)
{
if (rtn->ldp == rule->ldp)
{
if (rtn->flags == rule->flags)
{
return 1;
}
}
}
}
}
}
}
}
}
return 0;
}
/****************************************************************************
*
* Function: VarAlloc()
*
* Purpose: allocates memory for a variable
*
* Arguments: none
*
* Returns: pointer to new VarEntry
*
***************************************************************************/
struct VarEntry *VarAlloc()
{
struct VarEntry *new;
if ((new = (struct VarEntry *) calloc(sizeof(struct VarEntry), sizeof(char))) == NULL)
{
FatalError("ERROR: cannot allocate memory for VarEntry.");
}
new->name = NULL;
new->value = NULL;
new->prev = NULL;
new->next = NULL;
return (new);
}
/****************************************************************************
*
* Function: VarDefine(char *, char *)
*
* Purpose: define the contents of a variable
*
* Arguments: name => the name of the variable
* value => the contents of the variable
*
* Returns: void function
*
***************************************************************************/
void VarDefine(char *name, char *value)
{
struct VarEntry *p;
int found = 0;
if (!VarHead)
{
p = VarAlloc();
p->name = strdup(name);
p->value = strdup(value);
p->prev = p;
p->next = p;
VarHead = p;
return;
}
p = VarHead;
do
{
if (strcasecmp(p->name, name) == 0)
{
found = 1;
break;
}
p = p->next;
} while (p != VarHead);
if (found)
{
if (p->value)
free(p->value);
p->value = strdup(value);
} else
{
p = VarAlloc();
p->name = strdup(name);
p->value = strdup(value);
p->prev = VarHead;
p->next = VarHead->next;
p->next->prev = p;
VarHead->next = p;
}
}
/****************************************************************************
*
* Function: VarDelete(char *)
*
* Purpose: deletes a defined variable
*
* Arguments: name => the name of the variable
*
* Returns: void function
*
***************************************************************************/
void VarDelete(char *name)
{
struct VarEntry *p;
if (!VarHead)
return;
p = VarHead;
do
{
if (strcasecmp(p->name, name) == 0)
{
p->prev->next = p->next;
p->next->prev = p->prev;
if (VarHead == p)
if ((VarHead = p->next) == p)
VarHead = NULL;
if (p->name)
free(p->name);
if (p->value)
free(p->value);
free(p);
return;
}
p = p->next;
} while (p != VarHead);
}
/****************************************************************************
*
* Function: VarGet(char *)
*
* Purpose: get the contents of a variable
*
* Arguments: name => the name of the variable
*
* Returns: char * to contents of variable or NULL
*
***************************************************************************/
char *VarGet(char *name)
{
struct VarEntry *p;
if (!VarHead)
return (NULL);
p = VarHead;
do
{
if (strcasecmp(p->name, name) == 0)
return (p->value);
p = p->next;
} while (p != VarHead);
return (NULL);
}
2808
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
