From 342c3c36b30a674d32f2cbd9574d5b6accc15483 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Tue, 12 Oct 2021 11:52:45 +0300 Subject: 将rulescan.h的编码由GBK转为utf8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/inc_internal/view_only/rulescan.h | 366 +++++++++++++++++----------------- 1 file changed, 183 insertions(+), 183 deletions(-) diff --git a/src/inc_internal/view_only/rulescan.h b/src/inc_internal/view_only/rulescan.h index 4397f18..f377cc4 100644 --- a/src/inc_internal/view_only/rulescan.h +++ b/src/inc_internal/view_only/rulescan.h @@ -1,4 +1,4 @@ -/* +/* * * Copyright (c) 2014 * String Algorithms Research Group @@ -23,294 +23,294 @@ extern "C" { #endif - /* rulescan_set_paramõIJ */ + /* rulescan_set_param函数可设置的参数类型 */ enum RULESCAN_PARA_NAME { - RULESCAN_DETAIL_RESULT=1, /* ־λʾϸλõϢ, optvalΪNULLoptlenΪ0ĬϲϸϢ*/ - RULESCAN_REGEX_GROUP =2, /* ־λʾʽƥķϢֶΣҪRULESCAN_DETAIL_RESULT־λ,optvalΪNULLoptlenΪ0ĬϲطϢ */ - RULEACAN_ERRLOG_CLOSE, /* ־λʾرRulescan־optvalΪNULLoptlenΪ0õĻĬϴRulescan־ */ - RULESCAN_ERRLOG_FILE_PATH, /* Rulescan־·ļû룬optvalֵΪļ־·optlenΪ·ȡû趨 - ־Ĭϴ洢ڿִгǰĿ¼µrulescan_tmp */ + RULESCAN_DETAIL_RESULT=1, /* 本标志位表示:返回详细命中位置等信息, optval设为NULL,optlen设为0。默认不返回详细信息*/ + RULESCAN_REGEX_GROUP =2, /* 本标志位表示:返回正则表达式匹配的分组信息;开启本字段,需要先设置RULESCAN_DETAIL_RESULT标志位,optval设为NULL,optlen设为0。默认不返回分组信息 */ + RULEACAN_ERRLOG_CLOSE, /* 本标志位表示:关闭Rulescan错误日志输出,optval设为NULL,optlen设为0。不设置的话默认打开Rulescan错误日志输出 */ + RULESCAN_ERRLOG_FILE_PATH, /* 设置Rulescan错误日志的路径名(包含文件名),由用户传入,optval的值为包含文件名的日志路径,optlen为路径长度。如果没有设定, + 则日志默认存储在可执行程序当前目录下的rulescan_tmp中 */ }; - #define MAX_REGEX_GROUP_NUM 5 /* ʽֵ֧ĸ */ + #define MAX_REGEX_GROUP_NUM 5 /* 对于正则表达式,所支持的最大分组的个数 */ - #define MAX_EXPR_ITEM_NUM (1U<<3) /* ÿʽMAX_EXPR_ITEM_NUM */ - #define MAX_MATCH_POS_NUM 1024 /* ÿصλõĸ */ - #define MATCH_POS_NUM_INC 64 /* ÿصλõĸʼֵֵ */ + #define MAX_EXPR_ITEM_NUM (1U<<3) /* 每条与表达式最多由MAX_EXPR_ITEM_NUM个规则组成 */ + #define MAX_MATCH_POS_NUM 1024 /* 每条规则最多允许返回的命中位置的个数 */ + #define MATCH_POS_NUM_INC 64 /* 每条规则允许返回的命中位置的个数初始值与增量值 */ - /* 岻ͬĹ */ - const unsigned int RULETYPE_STR = 0; /* ַƹ */ - const unsigned int RULETYPE_REG = 1; /* ʽ */ - const unsigned int RULETYPE_INT = 2; /* ֵ */ - const unsigned int RULETYPE_IPv4 = 3; /* IPv4 */ - const unsigned int RULETYPE_IPv6 = 4; /* IPv6 */ + /* 定义不同的规则类型 */ + const unsigned int RULETYPE_STR = 0; /* 字符串或二进制规则 */ + const unsigned int RULETYPE_REG = 1; /* 正则表达式规则 */ + const unsigned int RULETYPE_INT = 2; /* 数值区间规则 */ + const unsigned int RULETYPE_IPv4 = 3; /* IPv4规则 */ + const unsigned int RULETYPE_IPv6 = 4; /* IPv6规则 */ - const unsigned int MAX_RULETYPE = 5; /* */ - const unsigned int MAX_SUB_RULETYPE = 4096; /* */ + const unsigned int MAX_RULETYPE = 5; /* 规则类型数量 */ + const unsigned int MAX_SUB_RULETYPE = 4096; /* 规则子类型数量 */ - /* ַ͹򣨿ɱʾıַַʽ */ + /* 字符串类型规则(可表示文本字符串、二进制字符串、正则表达式) */ typedef struct _string_rule_t { - char * str; /* ַݣʽ'\0'ɲָ */ - unsigned int len; /* ַ */ - unsigned char case_sensitive; /* ǷСдƥ䣨1У0У */ - unsigned char match_mode; /* ƥģʽӴƥ䣨0ƥ䣨1ԾȷƥЧ */ - int l_offset; /* ʾģʽֻıΧ[l_offset, r_offset]г֣-1ʾ,-2ʾƥ䣻ԾȷƥЧ */ - int r_offset; /* ʾģʽֻıΧ[l_offset, r_offset]г֣-1ʾ,-2ʾƥ䣻ԾȷƥЧ */ + char * str; /* 字符串内容;如果是正则表达式,须以'\0'结束,可不指定长度 */ + unsigned int len; /* 字符串长度 */ + unsigned char case_sensitive; /* 是否大小写敏感匹配(1:敏感;0:不敏感) */ + unsigned char match_mode; /* 匹配模式:子串匹配(0),完整匹配(1);仅对精确串匹配有效 */ + int l_offset; /* 表示模式串只能在文本范围[l_offset, r_offset]中出现,-1表示无限制,-2表示左匹配;仅对精确串匹配有效 */ + int r_offset; /* 表示模式串只能在文本范围[l_offset, r_offset]中出现,-1表示无限制,-2表示右匹配;仅对精确串匹配有效 */ }string_rule_t; - /* ֵ򣬱ʾ[lb, ub] */ + /* 整数数值区间规则,表示整数区间[lb, ub] */ typedef struct _interval_rule_t { - unsigned int lb; /* ½磨lbĬΪ0 */ - unsigned int ub; /* ½磨ubĬΪ0 */ + unsigned int lb; /* 数据区间的下界(包含lb),无限制默认为0 */ + unsigned int ub; /* 数据区间的下界(包含ub),无限制默认为0 */ }interval_rule_t; - /* IPv4 */ + /* IPv4规则 */ typedef struct _ipv4_rule_t { - unsigned int min_saddr; /* Դַ½磻0ʾԱֶ */ - unsigned int max_saddr; /* ԴַϽ磻0ʾ̶IP=min_saddr */ - unsigned int min_daddr; /* Ŀĵַ½磻0ʾԱֶ */ - unsigned int max_daddr; /* ĿĵַϽ磻0ʾ̶IP=min_daddr */ - unsigned short min_sport; /* Դ˿ڷΧ½磻0ʾԱֶ */ - unsigned short max_sport; /* Դ˿ڷΧϽ磻0ʾ̶˿=min_sport */ - unsigned short min_dport; /* ĿĶ˿ڷΧ½磻0ʾԱֶ */ - unsigned short max_dport; /* ĿĶ˿ڷΧϽ磻0ʾ̶˿=min_dport */ - unsigned short proto; /* Э飬6ʾTCP17ʾUDP0ʾԱֶ */ - unsigned short direction; /* 0ʾ˫1ʾ */ + unsigned int min_saddr; /* 源地址下界;0表示忽略本字段 */ + unsigned int max_saddr; /* 源地址上界;0表示固定IP=min_saddr */ + unsigned int min_daddr; /* 目的地址下界;0表示忽略本字段 */ + unsigned int max_daddr; /* 目的地址上界;0表示固定IP=min_daddr */ + unsigned short min_sport; /* 源端口范围下界;0表示忽略本字段 */ + unsigned short max_sport; /* 源端口范围上界;0表示固定端口=min_sport */ + unsigned short min_dport; /* 目的端口范围下界;0表示忽略本字段 */ + unsigned short max_dport; /* 目的端口范围上界;0表示固定端口=min_dport */ + unsigned short proto; /* 传输层协议,6表示TCP,17表示UDP;0表示忽略本字段 */ + unsigned short direction; /* 方向,0表示双向,1表示单向 */ }ipv4_rule_t; - /* IPv6 */ + /* IPv6规则 */ typedef struct _ipv6_rule_t { - unsigned int min_saddr[4]; /* Դַ½磻ȫ0ʾԱֶ */ - unsigned int max_saddr[4]; /* ԴַϽ磻ȫ0ʾ̶IP=min_saddr */ - unsigned int min_daddr[4]; /* Ŀĵַ½磻ȫ0ʾԱֶ */ - unsigned int max_daddr[4]; /* ĿĵַϽ磻ȫ0ʾ̶IP=min_daddr */ - unsigned short min_sport; /* Դ˿ڷΧ½磻0ʾԱֶ */ - unsigned short max_sport; /* Դ˿ڷΧϽ磻0ʾ̶˿=min_sport */ - unsigned short min_dport; /* ĿĶ˿ڷΧ½磻0ʾԱֶ */ - unsigned short max_dport; /* ĿĶ˿ڷΧϽ磻0ʾ̶˿=min_dport */ - unsigned short proto; /* Э飬6ʾTCP17ʾUDPĬΪ0 */ - unsigned short direction; /* 0ʾ˫1ʾ */ + unsigned int min_saddr[4]; /* 源地址下界;全0表示忽略本字段 */ + unsigned int max_saddr[4]; /* 源地址上界;全0表示固定IP=min_saddr */ + unsigned int min_daddr[4]; /* 目的地址下界;全0表示忽略本字段 */ + unsigned int max_daddr[4]; /* 目的地址上界;全0表示固定IP=min_daddr */ + unsigned short min_sport; /* 源端口范围下界;0表示忽略本字段 */ + unsigned short max_sport; /* 源端口范围上界;0表示固定端口=min_sport */ + unsigned short min_dport; /* 目的端口范围下界;0表示忽略本字段 */ + unsigned short max_dport; /* 目的端口范围上界;0表示固定端口=min_dport */ + unsigned short proto; /* 传输层协议,6表示TCP,17表示UDP,无限制默认为0 */ + unsigned short direction; /* 方向,0表示双向,1表示单向 */ }ipv6_rule_t; - /* ͨõĹ */ + /* 通用的规则类型 */ typedef struct _scan_rule_t { - unsigned int rule_type; /* ͣΪöٹ֮һ */ - unsigned int sub_type; /* ͣûԶ壬͸MAX_SUB_RULETYPEǰĶ壩 */ - union /* rule_typeֵַ䡢IP */ + unsigned int rule_type; /* 规则类型,必须为上述枚举规则类型之一 */ + unsigned int sub_type; /* 子类类型,用户自定义,但子类型个数不允许超过MAX_SUB_RULETYPE(见前文定义) */ + union /* 根据rule_type决定规则是字符串、数值区间、还是IP规则 */ { - string_rule_t string_rule; /* ַַơʽ */ - interval_rule_t interval_rule; /* ֵ */ - ipv4_rule_t ipv4_rule; /* IPv4 */ - ipv6_rule_t ipv6_rule; /* IPv6 */ + string_rule_t string_rule; /* 字符串规则(字符串、二进制、正则表达式) */ + interval_rule_t interval_rule; /* 整数数值区间规则 */ + ipv4_rule_t ipv4_rule; /* 带掩码的IPv4规则 */ + ipv6_rule_t ipv6_rule; /* 带掩码的IPv6规则 */ }; }scan_rule_t; - /* һʽ */ + /* 一条与表达式规则 */ typedef struct _boolean_expr_t { - unsigned int expr_id; /* ʽID */ - unsigned int operation; /* ʽִеIJ0ʾӣ1ʾɾ */ - unsigned int rnum; /* ʽٸoperation=1rnum=0 */ - scan_rule_t * rules; /* ʽoperation=1rules=NULL */ - void * tag; /* ûԶݣʱƥ */ + unsigned int expr_id; /* 与表达式的ID */ + unsigned int operation; /* 对与表达式执行的操作:0表示增加,1表示删除 */ + unsigned int rnum; /* 该与表达式包含多少个项;如果operation=1,置rnum=0即可 */ + scan_rule_t * rules; /* 组成与表达式的项;如果operation=1,置rules=NULL即可 */ + void * tag; /* 用户自定义数据,命中时随匹配结果返回 */ }boolean_expr_t; - /* ɨı */ + /* 待扫描的文本数据类型 */ typedef struct _text_data_t { - const char * text; /* ı */ - unsigned int tlen; /* ıݳ */ - int toffset;/* ıеƫʽɨЧû룬Ϊ0(Ϊ0) */ + const char * text; /* 文本数据内容 */ + unsigned int tlen; /* 文本数据长度 */ + int toffset;/* 本段文本数据在整个流数据中的偏移量,流式扫描情况下有效,由用户传入,其它情况置为0(这个必须置为0) */ }text_data_t; - /* ɨIPv4Ԫ */ + /* 待扫描的IPv4元组 */ typedef struct _ipv4_data_t { - unsigned int saddr; /* ԴIPַ */ - unsigned int daddr; /* ĿIPַ */ - unsigned short int sport; /* Դ˿ */ - unsigned short int dport; /* ĿĶ˿ */ - unsigned short int proto; /* Э飬6ʾTCP17ʾUDP */ + unsigned int saddr; /* 源IP地址 */ + unsigned int daddr; /* 目的IP地址 */ + unsigned short int sport; /* 源端口 */ + unsigned short int dport; /* 目的端口 */ + unsigned short int proto; /* 传输层协议,6表示TCP,17表示UDP */ }ipv4_data_t; - /* ɨIPv6Ԫ */ + /* 待扫描的IPv6元组 */ typedef struct _ipv6_data_t { - unsigned int saddr[4]; /* ԴIPַ */ - unsigned int daddr[4]; /* ĿIPַ */ - unsigned short int sport; /* Դ˿ */ - unsigned short int dport; /* ĿĶ˿ */ - unsigned short int proto; /* Э飬6ʾTCP17ʾUDP */ + unsigned int saddr[4]; /* 源IP地址 */ + unsigned int daddr[4]; /* 目的IP地址 */ + unsigned short int sport; /* 源端口 */ + unsigned short int dport; /* 目的端口 */ + unsigned short int proto; /* 传输层协议,6表示TCP,17表示UDP */ }ipv6_data_t; - /* ͨõĴɨ */ + /* 通用的待扫描数据类型 */ typedef struct _scan_data_t { - unsigned int rule_type; /* ͣΪöٹ֮һ */ - unsigned int sub_type; /* ͣûԶ壬͸MAX_SUB_RULETYPEǰĶ壩 */ - union /* rule_typeݸֵַIPԪ */ + unsigned int rule_type; /* 规则类型,必须为上述枚举规则类型之一 */ + unsigned int sub_type; /* 子类类型,用户自定义,但子类型个数不允许超过MAX_SUB_RULETYPE(见前文定义) */ + union /* 根据rule_type决定数据负载是字符串、数值、还是IP元组 */ { - text_data_t text_data; /* ɨıݣƥַơʽ */ - unsigned int int_data; /* ֵƥֵ䣩 */ - ipv4_data_t ipv4_data; /* ɨIPv4Ԫ */ - ipv6_data_t ipv6_data; /* ɨIPv6Ԫ */ + text_data_t text_data; /* 待扫描文本数据(可匹配字符串、二进制、正则表达式) */ + unsigned int int_data; /* 整数数值(可匹配数值区间) */ + ipv4_data_t ipv4_data; /* 待扫描的IPv4元组 */ + ipv6_data_t ipv6_data; /* 待扫描的IPv6元组 */ }; }scan_data_t; /* - ɨscan_result_trule_result_t˵ - 1еÿʽһʽӦһscan_result_tòʽrnumÿӦһscan_result_t::result[k]0<=k