"lan : (addr_src = @ipsrc ) & (addr_dest = @ipdst ) & ( tcp ) -> permit ;"
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
lan 192.168.1.0 192.168.1.1 tcp -> permit
lan 192.168.1.0 192.168.1.2 tcp -> permit
wan 192.168.1.0 192.168.1.1 tcp -> permit
lan wan
192.168.1.0 192.168.1.0
[192.168.1.1, 192.168.1.2] 192.168.1.1
tcp tcp
permit permit
Améliorer votre expérience CodeS-SourceS avec ce plugin:
http://codes-sources.commentcamarche.net/forum/affich-10000111-plugin-better-cs-2#cptpingu-signature
lan : (addr_src = 192.168.1.1/24) | (addr_dest = 192.168.1.0/20) | ( http 80 ) -> permit ;"
out : (addr_src = 192.168.1.1/24 ) | (addr_dest = 192.168.1.2/20 ) | ( tcp 1000 ... 2000 ) -> alert ;"
in : (addr_src = 192.168.1.1 ) | (addr_dest = 192.168.1.5) | ( udp ) -> deny ;"
lan : (addr_src = 192.168.1.0/24) | (addr_dest = 192.168.1.0/20) | ( http 80 ) -> permit ;"
lan : (addr_src = 192.168.1.1/24) | (addr_dest = 192.168.1.0/20) | ( http 80 ) -> permit ;"
lan : (addr_src = 192.168.1.1/24) | (addr_dest = 192.168.1.2/20) | ( http 80 ) -> permit ;"
lan : (addr_src = 192.168.1.1/24) | (addr_dest = 192.168.1.2/20) | ( tcp 1000 ... 2000 ) -> permit ;"
out : (addr_src = 192.168.1.1/24 ) | (addr_dest = 192.168.1.2/20 ) | ( tcp 1000 ... 2000 ) -> alert ;"
in : (addr_src = 192.168.1.1 ) | (addr_dest = 192.168.1.5) | ( udp ) -> deny ;"
lan out in
/ \ | |
192.168.1.0/24 192.168.1.1/24 192.168.1.1/24 192.168.1.1
| / \ | |
192.168.1.0/20 192.168.1.0/20 192.168.1.2/20 192.168.1.2/20 192.168.1.5
| | / \ | |
http 80 http 80 http 80 tcp 1000 ... 2000 tcp 1000 ... 2000 udp
| | | | | |
permit permit permit permit alert deny
typedef struct { unsigned short action; // permit, alert, deny, ... } action_node; typedef struct { proto_packet proto_protocole; // tcp 1000..2000, http 80, etc... action_node** nodes; unsigned int nodes_size; } type_service_node; typedef struct { addresse addr; // ip_dest type_service_node** nodes; unsigned int nodes_size; } addr_dest_node; typedef struct { addresse addr; // ip_src addr_dest_node** nodes; unsigned int nodes_size; } addr_src_node; typedef struct { unsigned short proto; // lan, in, out addr_src_node** nodes; unsigned int nodes_size; } rule_node; typedef struct { rule_node** nodes; unsigned int nodes_size; } tree_type;
Améliorer votre expérience CodeS-SourceS avec ce plugin:
http://codes-sources.commentcamarche.net/forum/affich-10000111-plugin-better-cs-2#cptpingu-signature
juste une petite question, peut-on transformer cet arbre général en Radix trie "facilement"
typedef struct { addresse addr; // ip_src addr_dest_node** nodes; unsigned int nodes_size; } addr_src_node; // Deviendra: typedef struct { addresse* addr; // tableau d'ip_src addr_dest_node** nodes; unsigned int nodes_size; } addr_src_node;
est ce que je peut utiliser (cprpos: http://cprops.sourceforge.net) qui offre une meilleur implémentation de radix trie)
typedef struct
{
proto_packet proto_protocole; // tcp 1000..2000, http 80, etc...
action_node** nodes;
unsigned int nodes_size;
} type_service_node;
// structure pour representer reste selon type de protocole (TCP-UDP //ou ICMP)
typedef struct s_proto{
struct s_tcp_udp {
port port_s;
port port_d;
short flags ;
short egal_flags;
} tcp_udp;
struct s_icmp{
short egal_type;
short type;
short egal_code;
short code;
} icmp;
} proto_packet;
// ligne du tableau pour representer la politique de securite
typedef struct s_tableau {
unsigned short action; // permit,deny,alert
unsigned short proto; // type de service tcp,udp,...
addresse addr_s;
addresse addr_d;
proto_packet proto_protocole; // reste du protocole suivant le ype de service
} tab_donnees;
typedef struct
{
unsigned short action; // permit, alert, deny, ...
} action_node;
typedef struct
{
unsigned short type_proto; // tcp,udp,http,...........
} type_proto_node;
typedef struct
{
proto_packet proto_protocole; // rest du proto 1000..2000, 80, etc...
action_node** nodes;
type_proto_node** nodes;
unsigned int nodes_size;
} type_service_node;
typedef struct { proto_packet proto_protocole; // rest du proto 1000..2000, 80, etc... unsigned short action; // permit, alert, deny, ... unsigned short type_proto; // tcp,udp,http,........... } type_service_node;
Améliorer votre expérience CodeS-SourceS avec ce plugin:
http://codes-sources.commentcamarche.net/forum/affich-10000111-plugin-better-cs-2#cptpingu-signature
unsigned int nodes_size;pour toutes les structures.
Améliorer votre expérience CodeS-SourceS avec ce plugin:
http://codes-sources.commentcamarche.net/forum/affich-10000111-plugin-better-cs-2#cptpingu-signature
action_node *get_Action_Node(unsigned short action){
action_node *pNode=NULL;
pNode=(action_node *)malloc(sizeof(action_node));
if(pNode)
{
pNode->action=action;
}
return pNode;
}
//------------------------------------------------------------------------
type_service_node *get_Service_Node(unsigned short type_service,proto_packet reste_proto,unsigned int size_node,action_node *action_node){
type_service_node *pNode=NULL;
pNode=(type_service_node *)malloc(sizeof(type_service_node));
int i;
pNode->nodes_size=size_node;
if(pNode)
{
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=action_node;
}
pNode->type_proto=type_service;
pNode->proto_protocole=reste_proto;
}
return pNode;
}
//----------------------------------------------------------------------------------------
addr_dest_node *get_addr_dest_Node(addresse addr_dst,unsigned int size_node,type_service_node *service_node){
addr_dest_node *pNode=NULL;
pNode=(addr_dest_node *)malloc(sizeof(addr_dest_node));
int i;
pNode->nodes_size=size_node;
if(pNode)
{
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=service_node;
}
pNode->addr=addr_dst;
}
return pNode;
}
//
addr_src_node *get_addr_src_Node(addresse addr_src,unsigned int size_node,addr_dest_node *addr_dst_node){
addr_src_node *pNode=NULL;
pNode=(addr_src_node *)malloc(sizeof(addr_src_node));
int i;
pNode->nodes_size=size_node;
if(pNode)
{
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=addr_dst_node;
}
pNode->addr=addr_src;
}
return pNode;
}
//
rule_node *get_type_rule_Node(unsigned short rule_type,unsigned int size_node,addr_src_node *addr_src_node){
rule_node *pNode=NULL;
pNode=(rule_node *)malloc(sizeof(rule_node));
int i;
pNode->nodes_size=size_node;
if(pNode)
{
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=addr_src_node;
}
pNode->type_rule=rule_type;
}
return pNode;
}
tree_type *get_tree_type_Node(unsigned int size_node,rule_node *rule_node){
tree_type *pNode=NULL;
pNode=(tree_type *)malloc(sizeof(tree_type));
int i;
pNode->nodes_size=size_node;
if(pNode)
{
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=rule_node;
}
}
return pNode;
}
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes=action_node;
}
for(i=0;i<pNode->nodes_size;i++)
{
pNode->nodes[i]=action_node;
}