aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Changing the veredict actions to flags to allow simultaneous veredict

Browse Source
remotes/origin/master-1.0.x
Pablo Rincon 17 years ago committed by Victor Julien
parent 2b7b78f1bf
commit 51dc773eec
7 changed files with 36 additions and 36 deletions
Show Stats Download Patch File Download Diff File

17
src/action-globals.h
Unescape Escape View File

@ -2,13 +2,14 @@
#ifndef __ACTION_GLOBALS_H__
#define __ACTION_GLOBALS_H__
typedef enum {
ACTION_ALERT,
ACTION_DROP,
ACTION_REJECT,
ACTION_REJECT_DST,
ACTION_REJECT_BOTH,
ACTION_PASS
} ActionType;
/* Changing them as flags, so later we can have alerts
* and drop simultaneously */
#define ACTION_ALERT 0x01
#define ACTION_DROP 0x02
#define ACTION_REJECT 0x04
#define ACTION_REJECT_DST 0x08
#define ACTION_REJECT_BOTH 0x10
#define ACTION_PASS 0x20
#endif /* __ACTION_GLOBALS_H__ */

4
src/alert-unified2-alert.c
Unescape Escape View File

@ -331,7 +331,7 @@ int Unified2IPv6TypeAlert (ThreadVars *t, Packet *p, void *data, PacketQueue *pq
phdr.dst_ip = *(struct in6_addr*)GET_IPV6_DST_ADDR(p);
phdr.protocol = IPV6_GET_NH(p);
if(p->action == ACTION_DROP)
if(p->action & ACTION_DROP)
phdr.packet_action = UNIFIED2_BLOCKED_FLAG;
else
phdr.packet_action = 0;
@ -442,7 +442,7 @@ int Unified2IPv4TypeAlert (ThreadVars *tv, Packet *p, void *data, PacketQueue *p
phdr.dst_ip = p->ip4h->ip_dst.s_addr;
phdr.protocol = IPV4_GET_RAW_IPPROTO(p->ip4h);
if(p->action == ACTION_DROP)
if(p->action & ACTION_DROP)
phdr.packet_action = UNIFIED2_BLOCKED_FLAG;
else
phdr.packet_action = 0;

2
src/decode.h
Unescape Escape View File

@ -300,7 +300,7 @@ typedef struct Packet_
PacketAlerts alerts;
/* IPS action to take */
ActionType action;
uint8_t action;
/* double linked list ptrs */
struct Packet_ *next;

2
src/detect-engine-iponly.c
Unescape Escape View File

@ -380,7 +380,7 @@ void IPOnlyMatchPacket(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx,
if (!(s->flags & SIG_FLAG_NOALERT)) {
PacketAlertHandle(de_ctx,s,p);
/* set verdict on packet */
p->action = s->action;
p->action |= s->action;
}
}
}

6
src/detect.c
Unescape Escape View File

@ -686,7 +686,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
if (!(s->flags & SIG_FLAG_NOALERT)) {
PacketAlertHandle(de_ctx,s,p);
/* set verdict on packet */
p->action = s->action;
p->action |= s->action;
}
} else {
/* reset pkt ptr and offset */
@ -725,7 +725,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
if (rmatch == 0) {
PacketAlertHandle(de_ctx,s,p);
/* set verdict on packet */
p->action = s->action;
p->action |= s->action;
}
}
rmatch = fmatch = 1;
@ -771,7 +771,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
PacketAlertHandle(de_ctx,s,p);
/* set verdict on packet */
p->action = s->action;
p->action |= s->action;
}
}
} else {

16
src/respond-reject.c
Unescape Escape View File

@ -41,8 +41,8 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq
int ret = 0;
/* ACTION_REJECT defaults to rejecting the SRC */
if (p->action != ACTION_REJECT && p->action != ACTION_REJECT_DST &&
p->action != ACTION_REJECT_BOTH) {
if (!(p->action & ACTION_REJECT) && !(p->action & ACTION_REJECT_DST) &&
(p->action & ACTION_REJECT_BOTH)) {
return TM_ECODE_OK;
}
@ -73,11 +73,11 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq
}
int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) {
if (p->action == ACTION_REJECT) {
if (p->action & ACTION_REJECT) {
return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC);
} else if (p->action == ACTION_REJECT_DST) {
} else if (p->action & ACTION_REJECT_DST) {
return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST);
} else if(p->action == ACTION_REJECT_BOTH) {
} else if(p->action & ACTION_REJECT_BOTH) {
if (RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC) == 0 &&
RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST) == 0) {
return 0;
@ -89,11 +89,11 @@ int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) {
}
int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data) {
if (p->action == ACTION_REJECT) {
if (p->action & ACTION_REJECT) {
return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
} else if (p->action == ACTION_REJECT_DST) {
} else if (p->action & ACTION_REJECT_DST) {
return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST);
} else if(p->action == ACTION_REJECT_BOTH) {
} else if(p->action & ACTION_REJECT_BOTH) {
if (RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC) == 0 &&
RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST) == 0) {
return 0;

25
src/source-nfq.c
Unescape Escape View File

@ -407,23 +407,22 @@ void NFQSetVerdict(NFQThreadVars *t, Packet *p) {
//printf("%p verdicting on queue %" PRIu32 "\n", t, t->queue_num);
switch (p->action) {
case ACTION_ALERT:
case ACTION_PASS:
verdict = NF_ACCEPT;
if (p->action & ACTION_REJECT || p->action & ACTION_REJECT_BOTH ||
p->action & ACTION_REJECT_DST || p->action & ACTION_DROP) {
verdict = NF_DROP;
#ifdef COUNTERS
t->accepted++;
t->dropped++;
#endif /* COUNTERS */
break;
case ACTION_REJECT:
case ACTION_REJECT_DST:
case ACTION_REJECT_BOTH:
case ACTION_DROP:
default:
} else if (p->action & ACTION_ALERT || p->action & ACTION_ALERT) {
verdict = NF_ACCEPT;
#ifdef COUNTERS
t->accepted++;
#endif /* COUNTERS */
} else {
/* a verdict we don't know about, drop to be sure */
verdict = NF_DROP;
verdict = NF_DROP;
#ifdef COUNTERS
t->dropped++;
t->dropped++;
#endif /* COUNTERS */
}

Write Preview
Loading…
Cancel
Save