mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
104 lines
3.6 KiB
C
104 lines
3.6 KiB
C
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
|
|
* \author Victor Julien <victor@inliniac.net>
|
|
*/
|
|
|
|
#ifndef __DETECT_TAG_H__
|
|
#define __DETECT_TAG_H__
|
|
|
|
#include "suricata-common.h"
|
|
#include "suricata.h"
|
|
#include "util-time.h"
|
|
|
|
/* Limit the number of times a session can be tagged by the
|
|
* same rule without finishing older tags */
|
|
#define DETECT_TAG_MATCH_LIMIT 10
|
|
|
|
/* Limit the number of tags that a session can have */
|
|
#define DETECT_TAG_MAX_TAGS 50
|
|
|
|
/* Limit the number of pkts to capture. Change this to
|
|
* zero to make it unlimited
|
|
* TODO: load it from config (var tagged_packet_limit) */
|
|
#define DETECT_TAG_MAX_PKTS 256
|
|
|
|
/* Type of tag: session or host */
|
|
enum {
|
|
DETECT_TAG_TYPE_SESSION,
|
|
DETECT_TAG_TYPE_HOST,
|
|
DETECT_TAG_TYPE_MAX
|
|
};
|
|
|
|
enum {
|
|
DETECT_TAG_DIR_SRC,
|
|
DETECT_TAG_DIR_DST,
|
|
DETECT_TAG_DIR_MAX
|
|
};
|
|
|
|
enum {
|
|
DETECT_TAG_METRIC_PACKET,
|
|
DETECT_TAG_METRIC_SECONDS,
|
|
DETECT_TAG_METRIC_BYTES,
|
|
DETECT_TAG_METRIC_MAX
|
|
};
|
|
|
|
/** This will be the rule options/parameters */
|
|
typedef struct DetectTagData_ {
|
|
uint8_t type; /**< tag type */
|
|
uint8_t direction; /**< host direction */
|
|
uint32_t count; /**< count */
|
|
uint32_t metric; /**< metric */
|
|
} DetectTagData;
|
|
|
|
/** This is the installed data at the session/global or host table */
|
|
typedef struct DetectTagDataEntry_ {
|
|
DetectTagData *td; /**< Pointer referencing the tag parameters */
|
|
uint32_t sid; /**< sid originating the tag */
|
|
uint32_t gid; /**< gid originating the tag */
|
|
uint32_t packets; /**< number of packets */
|
|
uint32_t bytes; /**< number of bytes */
|
|
struct timeval first_ts; /**< First time seen (for metric = seconds) */
|
|
struct timeval last_ts; /**< Last time seen (to prune old sessions) */
|
|
struct DetectTagDataEntry_ *next; /**< Pointer to the next tag of this
|
|
* session/src_host/dst_host (if any from other rule) */
|
|
uint16_t cnt_match; /**< number of times this tag was reset/updated */
|
|
uint8_t skipped_first; /**< Used for output. The first packet write the
|
|
header with the data of the sig. The next packets use
|
|
gid/sid/rev of the tagging engine */
|
|
} DetectTagDataEntry;
|
|
|
|
typedef struct DetectTagDataEntryList_ {
|
|
DetectTagDataEntry *header_entry;
|
|
Address addr; /**< Var used to store dst or src addr */
|
|
uint8_t ipv; /**< IP Version */
|
|
} DetectTagDataEntryList;
|
|
|
|
/* prototypes */
|
|
void DetectTagRegister (void);
|
|
void DetectTagDataFree(void *ptr);
|
|
void DetectTagDataEntryFree(void *ptr);
|
|
void DetectTagDataListFree(void *ptr);
|
|
DetectTagDataEntry *DetectTagDataCopy(DetectTagDataEntry *dtd);
|
|
|
|
#endif /* __DETECT_TAG_H__ */
|
|
|