1 /* $Id: ssp_cisco_nullroute.h,v 2.2 2008/04/26 19:53:21 fknobbe Exp $
2  *
3  *
4  * Copyright (c) 2005-2008 Frank Knobbe <frank@knobbe.us>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  * Acknowledgements:
29  *
30  * Brent Erickson and Sergio Salazar for the idea and sample commands.
31  *
32  *
33  * ssp_cisco_nullroute.c
34  *
35  * Purpose:
36  *
37  * This SnortSam plugin telnet's into one or more Cisco routers and issues
38  * a route command to effectively "null-route" the intruding IP address.
39  * SnortSam will remove the added routes when the blocks expire.
40  *
41  *
42  */
43 
44 
45 #ifndef		__SSP_CISCO_NULLROUTE_H__
46 #define		__SSP_CISCO_NULLROUTE_H__
47 
48 
49 #define CNRPWLEN		50			/* Maximum password length */
50 #define CNRNETWAIT		20			/* Network timeout in sec */
51 
52 
53 typedef struct _cnrdata				/* List of Routers */
54 {	struct in_addr	ip;
55 	SOCKET 			routersocket;
56 	int				userlogin;
57 	int 			loggedin;
58 	char			*telnetpw;
59 	char			username[(CNRPWLEN+1)*2];
60 	char			enablepw[CNRPWLEN+1];
61 }	CISCONULLROUTEDATA;
62 
63 
64 void CiscoNullRouteParse(char *,char *,unsigned long,DATALIST *);
65 void CiscoNullRouteBlock(BLOCKINFO *,void *,unsigned long);
66 
67 #endif /* __SSP_CISCO_NULLROUTE_H__ */
68 
69