First version of the reputation API

src/Makefile.am

@@ -33,6 +33,7 @@ flow-bit.c flow-bit.h \
 flow-alert-sid.c flow-alert-sid.h \
 pkt-var.c pkt-var.h \
 host.c host.h \
+reputation.c reputation.h \
 detect.c detect.h \
 detect-engine-sigorder.c detect-engine-sigorder.h \
 detect-engine.c detect-engine.h \

src/reputation.h

@@ -1,14 +1,19 @@
-#ifndef __REPUTATION_H__
-#define __REPUTATION_H__
-
-/** \file
- *  \author Victor Julien
+/**
+ * Copyright (c) 2009 Open Information Security Foundation
+ *
+ * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
+ * \author Victor Julien <victor@inliniac.net>
+ *         Original Idea by Matt Jonkman
  *
  *  General reputation for ip's (ipv4/ipv6) and (maybe later) host names
  */
 
-/* Reputation numbers that we can use to lookup the reps in an array */
+#ifndef __REPUTATION_H__
+#define __REPUTATION_H__
 
+/** Reputation numbers (types) that we can use to lookup/update, etc
+ *  Please, dont convert this to a enum since we want the same reputation
+ *  codes always. */
 #define REPUTATION_SPAM             0   /**< spammer */
 #define REPUTATION_CNC              1   /**< CnC server */
 #define REPUTATION_SCAN             2   /**< scanner */
@@ -18,20 +23,60 @@
 #define REPUTATION_PROXY            6   /**< known tor out nodes, proxy servers, etc */
 #define REPUTATION_P2P              7   /**< Heavy p2p node, torrent server, other sharing services */
 #define REPUTATION_UTILITY          8   /**< known good places like google, yahoo, msn.com, etc */
-#define REPUTATION_DDOS             9   /**< Known ddos participant. */
-#define REPUTATION_PHISH            10  /**< Known Phishing site. */
-#define REPUTATION_MALWARE          11  /**< Known Malware distribution site. (Hacked web server etc) */
-#define REPUTATION_ZOMBIE           12  /**< Known Zombie (botnet member) (They typically are Scanner or Hostile,
+#define REPUTATION_DDOS             9   /**< Known ddos participant */
+#define REPUTATION_PHISH            10  /**< Known Phishing site */
+#define REPUTATION_MALWARE          11  /**< Known Malware distribution site. Hacked web server, etc */
+#define REPUTATION_ZOMBIE           12  /**< Known Zombie (botnet member) They typically are Scanner or Hostile,
                                              but if collaboration with botnet snooping, like we did back in
                                              2005 or so, can proactively identify online zombies that joined a
-                                             botnet, you may want to break those out separately.) */
-#define REPUTATION_NUMBER           13  /**< number of rep types we have for data structure size */
+                                             botnet, you may want to break those out separately */
+#define REPUTATION_NUMBER           13  /**< number of rep types we have for data structure size (be careful with this) */
+
 
+/* Flags for reputation */
 #define REPUTATION_FLAG_NEEDSYNC    0x01 /**< rep was changed by engine, needs sync with external hub */
 
+/** Reputation Context for IPV4 IPV6 */
+typedef struct IPReputationCtx_ {
+    /** Radix trees that holds the host reputation information */
+    SCRadixTree *reputationIPV4_tree;
+    SCRadixTree *reputationIPV6_tree;
+
+    /** Mutex to support concurrent access */
+    SCMutex reputationIPV4_lock;
+    SCMutex reputationIPV6_lock;
+}IPReputationCtx;
+
+/** Reputation Data */
+//TODO: Add a timestamp here to know the last update of this reputation.
 typedef struct Reputation_ {
     uint8_t reps[REPUTATION_NUMBER]; /**< array of 8 bit reputations */
     uint8_t flags; /**< reputation flags */
+    time_t ctime; /**< creation time (epoch) */
+    time_t mtime; /**< modification time (epoch) */
 } Reputation;
 
+/* flags for transactions */
+#define TRANSACTION_FLAG_NEEDSYNC 0x01 /**< We will apply the transaction only if necesary */
+#define TRANSACTION_FLAG_INCS     0x02 /**< We will increment only if necesary */
+#define TRANSACTION_FLAG_DECS     0x03 /**< We will decrement only if necesary */
+
+/* transaction for feedback */
+typedef struct ReputationTransaction_ {
+    uint16_t inc[REPUTATION_NUMBER];
+    uint16_t dec[REPUTATION_NUMBER];
+    uint8_t flags;
+}ReputationTransaction;
+
+/* API */
+Reputation *SCReputationAllocData();
+Reputation *SCReputationClone(Reputation *);
+void SCReputationFreeData(void *);
+
+IPReputationCtx *SCReputationInitCtx();
+void SCReputationFreeCtx();
+
+void SCReputationPrint(Reputation *);
+void SCReputationRegisterTests(void);
+
 #endif /* __REPUTATION_H__ */

src/suricata.c

@@ -88,6 +88,7 @@
 #include "util-error.h"
 #include "detect-engine-siggroup.h"
 #include "util-daemon.h"
+#include "reputation.h"
 
 #include "output.h"
 
@@ -505,6 +506,7 @@ int main(int argc, char **argv)
     SigParsePrepare();
     //PatternMatchPrepare(mpm_ctx, MPM_B2G);
     SCPerfInitCounterApi();
+    SCReputationInitCtx();
 
     /** \todo we need an api for these */
     AppLayerDetectProtoThreadInit();
@@ -549,6 +551,7 @@ int main(int argc, char **argv)
         }
         UtInitialize();
         UTHRegisterTests();
+        SCReputationRegisterTests();
         TmModuleRegisterTests();
         SigTableRegisterTests();
         HashTableRegisterTests();

src/util-error.h

@@ -93,6 +93,9 @@ typedef enum {
     SC_ERR_LOGDIR_CMDLINE,
     SC_RADIX_TREE_GENERIC_ERROR,
     SC_ERR_MISSING_QUOTE,
+    SC_ERR_MUTEX,
+    SC_REPUTATION_INVALID_OPERATION,
+    SC_REPUTATION_INVALID_TYPE
 } SCError;
 
 const char *SCErrorToString(SCError);

src/util-radix-tree.c

@@ -86,7 +86,7 @@ struct in6_addr *SCRadixValidateIPV6Address(const char *addr_str)
  * \param stream  Pointer the ip address that has to be chopped.
  * \param netmask The netmask value to which the ip address has to be chopped.
  */
-static void SCRadixChopIPAddressAgainstNetmask(uint8_t *stream, uint8_t netmask,
+void SCRadixChopIPAddressAgainstNetmask(uint8_t *stream, uint8_t netmask,
                                                uint16_t key_bitlen)
 {
     int mask = 0;

src/util-radix-tree.h

@@ -79,6 +79,7 @@ typedef struct SCRadixTree_ {
 
 struct in_addr *SCRadixValidateIPV4Address(const char *);
 struct in6_addr *SCRadixValidateIPV6Address(const char *);
+void SCRadixChopIPAddressAgainstNetmask(uint8_t *, uint8_t, uint16_t);
 
 SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*));
 void SCRadixReleaseRadixTree(SCRadixTree *);