//-----------------------------------------------------------------------------------------------
typedef struct _IPHdr
{
u_int8_t ip_verhl; /* version & header length */
u_int8_t ip_tos; /* type of service */
u_int16_t ip_len; /* datagram length */
u_int16_t ip_id; /* identification */
u_int16_t ip_off; /* fragment offset */
u_int8_t ip_ttl; /* time to live field */
u_int8_t ip_proto; /* datagram protocol */
u_int16_t ip_csum; /* checksum */
struct in_addr ip_src; /* source IP */
struct in_addr ip_dst; /* dest IP */
} IPHdr;
typedef struct _TCPHdr
{
u_int16_t th_sport; /* source port */
u_int16_t th_dport; /* destination port */
u_int32_t th_seq; /* sequence number */
u_int32_t th_ack; /* acknowledgement number */
u_int8_t th_offx2; /* offset and reserved */
u_int8_t th_flags;
u_int16_t th_win; /* window */
u_int16_t th_sum; /* checksum */
u_int16_t th_urp; /* urgent pointer */
} TCPHdr;
typedef struct _UDPHdr
{
u_int16_t uh_sport;
u_int16_t uh_dport;
u_int16_t uh_len;
u_int16_t uh_chk;
} UDPHdr;
typedef struct _ICMPHdr
{
u_int8_t type;
u_int8_t code;
u_int16_t csum;
union
{
u_int8_t pptr;
struct in_addr gwaddr;
struct idseq
{
u_int16_t id;
u_int16_t seq;
} idseq;
int sih_void;
struct pmtu
{
u_int16_t ipm_void;
u_int16_t nextmtu;
} pmtu;
struct rtradv
{
u_int8_t num_addrs;
u_int8_t wpa;
u_int16_t lifetime;
} rtradv;
} icmp_hun;
#define s_icmp_pptr icmp_hun.pptr
#define s_icmp_gwaddr icmp_hun.gwaddr
#define s_icmp_id icmp_hun.idseq.id
#define s_icmp_seq icmp_hun.idseq.seq
#define s_icmp_void icmp_hun.sih_void
#define s_icmp_pmvoid icmp_hun.pmtu.ipm_void
#define s_icmp_nextmtu icmp_hun.pmtu.nextmtu
#define s_icmp_num_addrs icmp_hun.rtradv.num_addrs
#define s_icmp_wpa icmp_hun.rtradv.wpa
#define s_icmp_lifetime icmp_hun.rtradv.lifetime
union
{
/* timestamp */
struct ts
{
u_int32_t otime;
u_int32_t rtime;
u_int32_t ttime;
} ts;
/* IP header for unreach */
struct ih_ip
{
IPHdr *ip;
/* options and then 64 bits of data */
} ip;
struct ra_addr
{
u_int32_t addr;
u_int32_t preference;
} radv;
u_int32_t mask;
char data[1];
} icmp_dun;
#define s_icmp_otime icmp_dun.ts.otime
#define s_icmp_rtime icmp_dun.ts.rtime
#define s_icmp_ttime icmp_dun.ts.ttime
#define s_icmp_ip icmp_dun.ih_ip
#define s_icmp_radv icmp_dun.radv
#define s_icmp_mask icmp_dun.mask
#define s_icmp_data icmp_dun.data
} ICMPHdr;
------------------------------------------------------------------------------------
全局变量
typedef struct _progvars //program variable 程序变量
{
int stateful;
int line_buffer_flag;
int checksums_mode;
int assurance_mode;
int max_pattern;
int test_mode_flag;
int alert_interface_flag;
int verbose_bytedump_flag;
int obfuscation_flag;
int log_cmd_override;
int alert_cmd_override;
int char_data_flag;
int data_flag;
int verbose_flag;
int readmode_flag;
int show2hdr_flag;
int showwifimgmt_flag;
#ifdef GIDS
int inline_flag;
#ifndef IPFW
char layer2_resets;
u_char enet_src[6];
#endif
#ifdef IPFW
int divert_port;
#endif /* USE IPFW DIVERT socket instead of IPtables */
#endif /* GIDS */
#ifdef WIN32
int syslog_remote_flag;
char syslog_server[STD_BUF];
int syslog_server_port;
#ifdef ENABLE_WIN32_SERVICE
int terminate_service_flag;
int pause_service_flag;
#endif /* ENABLE_WIN32_SERVICE */
#endif /* WIN32 */
int promisc_flag;
int rules_order_flag;
int track_flag;
int daemon_flag;
int quiet_flag;
int pkt_cnt;
int pkt_snaplen;
u_long homenet;
u_long netmask;
u_int32_t obfuscation_net;
u_int32_t obfuscation_mask;
int alert_mode;
int log_plugin_active;
int alert_plugin_active;
u_int32_t log_bitmap;
char pid_filename[STD_BUF];
char *config_file;
char *config_dir;
char *log_dir;
char readfile[STD_BUF];
char pid_path[STD_BUF];
char *interface;
char *pcap_cmd;
char *alert_filename;
char *binLogFile;
int use_utc;
int include_year;
char *chroot_dir;
u_int8_t min_ttl;
u_int8_t log_mode;
int num_rule_types;
char pidfile_suffix[MAX_PIDFILE_SUFFIX+1]; /* room for a null */
DecoderFlags decoder_flags; /* if decode.c alerts are going to be enabled */
#ifdef NEW_DECODER
char *daq_method;
char *interface_list[MAX_IFS];
int interface_count;
char *pcap_filename;
char *daq_filter_string;
#endif // NEW_DECODER
} PV;
//处理函数的链表数据结构
/* function pointer list for rule head nodes */
typedef struct _RuleFpList{
/* context data for this test */
void *context; /* rule check function pointer */ int (*RuleHeadFunc)(Packet *, struct _RuleTreeNode *, struct _RuleFpList *); /* pointer to the next rule function node */ struct _RuleFpList *next;
} RuleFpList;/* same as the rule header FP list */typedef struct _OptFpList{ /* context data for this test */ void *context; int (*OptTestFunc)(Packet *, struct _OptTreeNode *, struct _OptFpList *); struct _OptFpList *next;} OptFpList;typedef struct _RspFpList{ int (* ResponseFunc)(Packet *, struct _RspFpList *); void *params; /* params for the plugin.. type defined by plugin */ struct _RspFpList *next;} RspFpList;
------------------------------------------------------------------------------------------------------------------（待续）
