[Snort-devel] plug-in

anon anonpoet at ...284...
Sun Feb 18 17:12:24 EST 2001


Here are the mods and code for the interface plugin. I've attached
the sp_interface[c,h] just drop it into plugbase in the usual
manner.

--diff snort.c
line 1278
-if(pcap_loop(pds[myint], pv.pkt_cnt, (pcap_handler) ProcessPacket,
NULL) < 0)
+if(pcap_loop(pds[myint], pv.pkt_cnt, (pcap_handler) ProcessPacket,
(void*)myint) < 0)

line 414
-(*grinder) (&p, pkthdr, pkt);
+(*grinder) (&p, pkthdr, pkt);
+p.interface_num=(int)user;

--diff decode.h
line 530
-typedef struct _Packet
-{
+typedef struct _Packet
+{
+int	interface_num;

-------------- next part --------------
#include "sp_interface.h"

extern char *file_name;  /* this is the file name from rules.c, generally used
                            for error messages */

extern int file_line;    /* this is the file line number from rules.c that is
                            used to indicate file lines for error messages */
							
/****************************************************************************
*
****************************************************************************/
void SetupSpInterface()
{
    /* map the keyword to an initialization/processing function */
    RegisterPlugin("interface", SpInterfaceInit);

#ifdef DEBUG
    printf("Plugin: Interface Initialized\n");
#endif
}


/****************************************************************************
*
****************************************************************************/
void SpInterfaceInit(char *data, OptTreeNode *otn, int protocol)
{

#ifdef DEBUG
	printf("Initializing Interface Plugin\n");
#endif

    /* allocate the data structure and attach it to the
       rule's data struct list */
    otn->ds_list[PLUGIN_INTERFACE] = (SpInterfaceData *) calloc(sizeof(SpInterfaceData), sizeof(char));

    /* this is where the keyword arguments are processed and placed into the 
       rule option's data structure */
    ParseSpInterface(data, otn);

    /* finally, attach the option's detection function to the rule's 
       detect function pointer list */
    AddOptFuncToList(InterfaceCheckEq, otn);
}



/****************************************************************************
*
****************************************************************************/
void ParseSpInterface(char *data, OptTreeNode *otn)
{
    SpInterfaceData *ds_ptr;  /* data struct pointer */
	int	i;

    /* set the ds pointer to make it easier to reference the option's
       particular data struct */
    ds_ptr = otn->ds_list[PLUGIN_INTERFACE];

    /* get rid of any whitespace */
    while(isspace((int)*data))
    {
        data++;
    }

	for (i=0;i<MAX_INTERFACES; i++){
		if (pv.interfaces[i])
		if (strcmp((char*)data, (char*)pv.interfaces[i])==0){
#ifdef DEBUG
			printf("Found Interface %s->%s\n",data, pv.interfaces[i]);
#endif
			ds_ptr->interface_num = i;	
			return;
		}
	}

	printf("Interface not found %s\nAssuming 0\n",data);
	ds_ptr->interface_num = 0;
    /*ds_ptr->interface_num = atoi(data);*/

#ifdef DEBUG
    printf("Interface set to %d\n", ds_ptr->interface_num);
#endif

}


/****************************************************************************
*
****************************************************************************/
int InterfaceCheckEq(Packet *p, struct _OptTreeNode *otn, OptFpList *fp_list)
{

#ifdef DEBUG
	printf("Recieved on interface: %s\n", pv.interfaces[p->interface_num]);
#endif

    if(((SpInterfaceData *)otn->ds_list[PLUGIN_INTERFACE])->interface_num == p->interface_num)
    {
        /* call the next function in the function list recursively */
        return fp_list->next->OptTestFunc(p, otn, fp_list->next);
    }
#ifdef DEBUG
    else
    {
        /* you can put debug comments here or not */
        printf("No match\n");
    }
#endif

    /* if the test isn't successful, return 0 */
    return 0;
}
-------------- next part --------------
#ifndef __SP_INTERFACE_H__
#define __SP_INTERFACE_H__

#include "snort.h"

#define PLUGIN_INTERFACE  22

typedef struct _SpInterfaceData
{
    u_int8_t interface_num;

} SpInterfaceData;

void SpInterfaceInit(char *, OptTreeNode *, int);
void SetupSpInterface();
void ParseSpInterface(char *, OptTreeNode *);
int InterfaceCheckEq(Packet *, struct _OptTreeNode *, OptFpList *);

#endif  


More information about the Snort-devel mailing list