/*
?*?Linux?Kernel?ICMP?Packet?Handling?Denial?of?Service
?*
?*?Copyright?（C）?2007?Sourcefire?Inc.?All?Rights?Reserved
?*
?*?Written?by?Patrick?Mullen?Sourcefire?VRT?
?*
?*?This?file?may?contain?proprietary?rules?that?were?created?tested?and
?*?certified?by?Sourcefire?Inc.?（the?“VRT?Certified?Rules“）?as?well?as
?*?rules?that?were?created?by?Sourcefire?and?other?third?parties?and
?*?distributed?under?the?GNU?General?Public?License?（the?“GPL?Rules“）.??The
?*?VRT?Certified?Rules?contained?in?this?file?are?the?property?of
?*?Sourcefire?Inc.?Copyright?2005?Sourcefire?Inc.?All?Rights?Reserved.
?*?The?GPL?Rules?created?by?Sourcefire?Inc.?are?the?property?of
?*?Sourcefire?Inc.?Copyright?2002-2005?Sourcefire?Inc.?All?Rights
?*?Reserved.??All?other?GPL?Rules?are?owned?and?copyrighted?by?their
?*?respective?owners?（please?see?www.snort.org/contributors?for?a?list?of
?*?owners?and?their?respective?copyrights）.??In?order?to?determine?what
?*?rules?are?VRT?Certified?Rules?or?GPL?Rules?please?refer?to?the?VRT
?*?Certified?Rules?License?Agreement.
?*/


#include?“sf_snort_plugin_api.h“
#include?“sf_snort_packet.h“

//#define?DEBUG
#ifdef?DEBUG
#define?DEBUG_WRAP（code）?code
#else
#define?DEBUG_WRAP（code）
#endif


/*?declare?detection?functions?*/
int?ruleLINUXICMPDOSeval（void?*p）;

/*?references?sid?LINUXICMPDOS?*/
static?RuleReference?ruleLINUXICMPDOSref1?=?
{
????“url“?
????“www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3“
};

static?RuleReference?ruleLINUXICMPDOSref2?=
{
????“cve“
????“2006-0454“
};

static?RuleReference?ruleLINUXICMPDOSref3?=
{
????“bugtraq“
????“16532“
};

static?RuleReference?*ruleLINUXICMPDOSrefs[]?=
{
????&ruleLINUXICMPDOSref1
????&ruleLINUXICMPDOSref2
????&ruleLINUXICMPDOSref3
????NULL
};

static?HdrOptCheck?ruleLINUXICMPDOSprotocheck0?=
{?
????IP_HDR_OPTIONS
????CHECK_EQ
????0x07
};

static?RuleOption?ruleLINUXICMPDOSoption0?=
{
????OPTION_TYPE_HDR_CHECK
????{
????????&ruleLINUXICMPDOSprotocheck0
????}
};

static?HdrOptCheck?ruleLINUXICMPDOSprotocheck1?=
{
????IP_HDR_OPTIONS
????CHECK_EQ
????0x44
};

static?RuleOption?ruleLINUXICMPDOSoption1?=
{
????OPTION_TYPE_HDR_CHECK
????{
????????&ruleLINUXICMPDOSprotocheck1
????}
};



RuleOption?*ruleLINUXICMPDOSoptions[]?=
{
????&ruleLINUXICMPDOSoption0
????&ruleLINUXICMPDOSoption1
????NULL
};

Rule?ruleLINUXICMPDOS?=?{
???/*?rule?header?akin?to?=>?tcp?any?any?->?any?any???????????????*/
???{
???????IPPROTO_IP?/*?proto?*/
???????EXTERNAL_NET???????/*?SRCIP?????*/
???????“any“????????/*?SRCPORT???*/
???????0???????????/*?DIRECTION?*/
???????HOME_NET???????/*?DSTIP?????*/
???????“any“???????/*?DSTPORT???*/
???}
???/*?metadata?*/
???{
???????3???????/*?genid?（HARDCODED!!!）?*/
???????13307???????/*?sid?ca4ab340-2c84-4e52-a149-0c115e648a95?*/
???????1???????/*?revision?db51aa91-f98f-4e94-8308-2e338761e9d0?*/
???????“denial-of-service“?/*?classification?generic?*/
???????0?????????????????/*?hardcoded?priority?XXX?NOT?PROVIDED?BY?GR