This repository has been archived on 2025-09-14. You can view files and clone it, but cannot push or open issues or pull requests.
Files
tango-maat/vendor
zhengchao de53e4676b 更新ip_matcher,解决IPv6字节序问题。
根据rfc2553,ipv6地址是一个16字节的数组,用网络序存储。
3.2 IPv6 Address Structure
   A new in6_addr structure holds a single IPv6 address and is defined
   as a result of including <netinet/in.h>:
      struct in6_addr {
          uint8_t  s6_addr[16];      /* IPv6 address */
      };
This data structure contains an array of sixteen 8-bit elements, which make up one 128-bit IPv6 address. The IPv6 address is stored in network byte order.
IPv6地址由高位到低位存储在第0至15个uint8_t中。例如地址2001:0db8:1234::5210,rfc2553存储为(通过inet_pton):
static const uint8_t myaddr[16] = { 0x20, 0x01, 0x0d, 0xb8, 0x12, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0x10 };

上述地址转换为uint32_t网络序后:
static const uint32_t myaddr_network_byte_order[4]={ 0xb80d0120, 0x3412, 0x0, 0x10520000}

再转换为主机序后,这也是MAAT输入ipmatcher和rulescan的格式:
static const uint32_t myaddr_host_byte_order[4]={ 0x20010db8, 0x12340000, 0x0, 0x5210}

目前,ip_matcher中int数组高位到低位的顺序是a[3]a[2]a[1]a[0],与RFC2553、Linux都不一致。
2020-05-13 14:53:26 +08:00
..