is a network intrusion prevention and detection system (IDS/IPS) combining the benefits of signature, protocol and anomaly-based inspection.
| flow_key.h (snort3-3.1.28.0) | : | flow_key.h (snort3-3.1.29.0) |
|---|
| | |
| skipping to change at line 58 | | skipping to change at line 58 |
|---|
| unsigned do_hash(const unsigned char* k, int len) override; | | unsigned do_hash(const unsigned char* k, int len) override; |
| bool key_compare(const void* k1, const void* k2, size_t) override; | | bool key_compare(const void* k1, const void* k2, size_t) override; |
| }; | | }; |
| | |
| PADDING_GUARD_BEGIN | | PADDING_GUARD_BEGIN |
| struct SO_PUBLIC FlowKey | | struct SO_PUBLIC FlowKey |
| { | | { |
| uint32_t ip_l[4]; /* Low IP */ | | uint32_t ip_l[4]; /* Low IP */ |
| uint32_t ip_h[4]; /* High IP */ | | uint32_t ip_h[4]; /* High IP */ |
| uint32_t mplsLabel; | | uint32_t mplsLabel; |
|
| | uint32_t addressSpaceId; |
| uint16_t port_l; /* Low Port - 0 if ICMP */ | | uint16_t port_l; /* Low Port - 0 if ICMP */ |
| uint16_t port_h; /* High Port - 0 if ICMP */ | | uint16_t port_h; /* High Port - 0 if ICMP */ |
| int16_t group_l; | | int16_t group_l; |
| int16_t group_h; | | int16_t group_h; |
|
| uint16_t addressSpaceId; | | |
| uint16_t vlan_tag; | | uint16_t vlan_tag; |
|
| | uint16_t padding; |
| uint8_t ip_protocol; | | uint8_t ip_protocol; |
| PktType pkt_type; | | PktType pkt_type; |
| uint8_t version; | | uint8_t version; |
|
| struct { | | struct |
| uint8_t group_used:1; // Is group being used to build key. | | { |
| uint8_t ubits:7; | | bool group_used : 1; |
| | uint8_t padding_bits : 7; |
| } flags; | | } flags; |
| | |
| /* The init() functions return true if the key IP/port fields were actively | | /* The init() functions return true if the key IP/port fields were actively |
| normalized, reversing the source and destination addresses internally. | | normalized, reversing the source and destination addresses internally. |
| The IP-only init() will always return false as we will not reorder its | | The IP-only init() will always return false as we will not reorder its |
| addresses at this time. */ | | addresses at this time. */ |
| bool init( | | bool init( |
| const SnortConfig*, PktType, IpProtocol, | | const SnortConfig*, PktType, IpProtocol, |
| const snort::SfIp *srcIP, uint16_t srcPort, | | const snort::SfIp *srcIP, uint16_t srcPort, |
| const snort::SfIp *dstIP, uint16_t dstPort, | | const snort::SfIp *dstIP, uint16_t dstPort, |
|
| uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId, | | uint16_t vlanId, uint32_t mplsId, uint32_t addrSpaceId, |
| int16_t group_h = DAQ_PKTHDR_UNKNOWN, int16_t group_l = DAQ_PKTHDR_UNKNO
WN); | | int16_t group_h = DAQ_PKTHDR_UNKNOWN, int16_t group_l = DAQ_PKTHDR_UNKNO
WN); |
| | |
| bool init( | | bool init( |
| const SnortConfig*, PktType, IpProtocol, | | const SnortConfig*, PktType, IpProtocol, |
| const snort::SfIp *srcIP, const snort::SfIp *dstIP, | | const snort::SfIp *srcIP, const snort::SfIp *dstIP, |
| uint32_t id, uint16_t vlanId, | | uint32_t id, uint16_t vlanId, |
|
| uint32_t mplsId, uint16_t addrSpaceId, | | uint32_t mplsId, uint32_t addrSpaceId, |
| int16_t group_h = DAQ_PKTHDR_UNKNOWN, int16_t group_l = DAQ_PKTHDR_UNKNO
WN); | | int16_t group_h = DAQ_PKTHDR_UNKNOWN, int16_t group_l = DAQ_PKTHDR_UNKNO
WN); |
| | |
| bool init( | | bool init( |
| const SnortConfig*, PktType, IpProtocol, | | const SnortConfig*, PktType, IpProtocol, |
| const snort::SfIp *srcIP, uint16_t srcPort, | | const snort::SfIp *srcIP, uint16_t srcPort, |
| const snort::SfIp *dstIP, uint16_t dstPort, | | const snort::SfIp *dstIP, uint16_t dstPort, |
| uint16_t vlanId, uint32_t mplsId, const DAQ_PktHdr_t&); | | uint16_t vlanId, uint32_t mplsId, const DAQ_PktHdr_t&); |
| | |
| bool init( | | bool init( |
| const SnortConfig*, PktType, IpProtocol, | | const SnortConfig*, PktType, IpProtocol, |
| const snort::SfIp *srcIP, const snort::SfIp *dstIP, | | const snort::SfIp *srcIP, const snort::SfIp *dstIP, |
| uint32_t id, uint16_t vlanId, uint32_t mplsId, const DAQ_PktHdr_t&); | | uint32_t id, uint16_t vlanId, uint32_t mplsId, const DAQ_PktHdr_t&); |
| | |
| void init_mpls(const SnortConfig*, uint32_t); | | void init_mpls(const SnortConfig*, uint32_t); |
| void init_vlan(const SnortConfig*, uint16_t); | | void init_vlan(const SnortConfig*, uint16_t); |
|
| void init_address_space(const SnortConfig*, uint16_t); | | void init_address_space(const SnortConfig*, uint32_t); |
| void init_groups(int16_t, int16_t, bool); | | void init_groups(int16_t, int16_t, bool); |
| | |
| // If this data structure changes size, compare must be updated! | | // If this data structure changes size, compare must be updated! |
| static bool is_equal(const void* k1, const void* k2, size_t); | | static bool is_equal(const void* k1, const void* k2, size_t); |
| | |
| private: | | private: |
| bool init4(IpProtocol, const snort::SfIp *srcIP, uint16_t srcPort, | | bool init4(IpProtocol, const snort::SfIp *srcIP, uint16_t srcPort, |
| const snort::SfIp *dstIP, uint16_t dstPort, bool order = true); | | const snort::SfIp *dstIP, uint16_t dstPort, bool order = true); |
| | |
| bool init6(IpProtocol, const snort::SfIp *srcIP, uint16_t srcPort, | | bool init6(IpProtocol, const snort::SfIp *srcIP, uint16_t srcPort, |
| | | |
| End of changes. 7 change blocks. |
|---|
| 7 lines changed or deleted | | 9 lines changed or added |
|---|
"Fossies" - the Fresh Open Source Software Archive 