suricata
detect-tag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  */
24 
25 #ifndef SURICATA_DETECT_TAG_H
26 #define SURICATA_DETECT_TAG_H
27 
28 #include "suricata-common.h"
29 
30 /* Limit the number of times a session can be tagged by the
31  * same rule without finishing older tags */
32 #define DETECT_TAG_MATCH_LIMIT 10
33 
34 /* Limit the number of tags that a session can have */
35 #define DETECT_TAG_MAX_TAGS 50
36 
37 /* Limit the number of pkts to capture. Change this to
38  * zero to make it unlimited
39  * TODO: load it from config (var tagged_packet_limit) */
40 #define DETECT_TAG_MAX_PKTS 256
41 
42 /* Type of tag: session or host */
43 enum {
47 };
48 
49 enum {
52 };
53 
54 enum {
58 };
59 
60 /** This will be the rule options/parameters */
61 typedef struct DetectTagData_ {
62  uint8_t type; /**< tag type */
63  uint8_t direction; /**< host direction */
64  uint32_t count; /**< count */
65  uint8_t metric; /**< metric */
67 
68 /** This is the installed data at the session/global or host table */
69 typedef struct DetectTagDataEntry_ {
70  uint8_t flags:3;
71  uint8_t metric:5;
72  uint8_t pad0;
73  uint16_t cnt_match; /**< number of times this tag was reset/updated */
74 
75  uint32_t count; /**< count setting from rule */
76  uint32_t sid; /**< sid originating the tag */
77  uint32_t gid; /**< gid originating the tag */
78  union {
79  uint32_t packets; /**< number of packets (metric packets) */
80  uint32_t bytes; /**< number of bytes (metric bytes) */
81  };
82  uint32_t first_ts; /**< First time seen (for metric = seconds) */
83  uint32_t last_ts; /**< Last time seen (to prune old sessions) */
84 #if __WORDSIZE == 64
85  uint32_t pad1;
86 #endif
87  struct DetectTagDataEntry_ *next; /**< Pointer to the next tag of this
88  * session/src_host/dst_host (if any from other rule) */
90 
91 #define TAG_ENTRY_FLAG_DIR_SRC 0x01
92 #define TAG_ENTRY_FLAG_DIR_DST 0x02
93 #define TAG_ENTRY_FLAG_SKIPPED_FIRST 0x04
94 
95 /* prototypes */
96 struct DetectEngineCtx_ ;
97 void DetectTagRegister(void);
98 void DetectTagDataFree(struct DetectEngineCtx_ *, void *ptr);
99 void DetectTagDataListFree(void *ptr);
100 
101 #endif /* SURICATA_DETECT_TAG_H */
DetectTagDataEntry_::bytes
uint32_t bytes
Definition: detect-tag.h:80
DetectTagDataEntry_::last_ts
uint32_t last_ts
Definition: detect-tag.h:83
DETECT_TAG_METRIC_BYTES
@ DETECT_TAG_METRIC_BYTES
Definition: detect-tag.h:57
DetectTagDataEntry_
Definition: detect-tag.h:69
DetectTagDataEntry_::cnt_match
uint16_t cnt_match
Definition: detect-tag.h:73
DetectTagDataEntry_::sid
uint32_t sid
Definition: detect-tag.h:76
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
DetectTagDataEntry_::pad0
uint8_t pad0
Definition: detect-tag.h:72
DetectTagDataEntry_::metric
uint8_t metric
Definition: detect-tag.h:71
DetectTagData_::direction
uint8_t direction
Definition: detect-tag.h:63
DETECT_TAG_DIR_DST
@ DETECT_TAG_DIR_DST
Definition: detect-tag.h:51
DetectTagDataEntry_::flags
uint8_t flags
Definition: detect-tag.h:70
DetectTagDataEntry_::gid
uint32_t gid
Definition: detect-tag.h:77
DetectTagDataEntry_::count
uint32_t count
Definition: detect-tag.h:75
DETECT_TAG_METRIC_SECONDS
@ DETECT_TAG_METRIC_SECONDS
Definition: detect-tag.h:56
DetectTagDataEntry_::first_ts
uint32_t first_ts
Definition: detect-tag.h:82
DetectTagDataFree
void DetectTagDataFree(struct DetectEngineCtx_ *, void *ptr)
this function will free memory associated with DetectTagData
Definition: detect-tag.c:355
DETECT_TAG_METRIC_PACKET
@ DETECT_TAG_METRIC_PACKET
Definition: detect-tag.h:55
DETECT_TAG_TYPE_MAX
@ DETECT_TAG_TYPE_MAX
Definition: detect-tag.h:46
pad1
uint16_t pad1
Definition: decode-template.h:2
DetectTagDataListFree
void DetectTagDataListFree(void *ptr)
this function will free all the entries of a list DetectTagDataEntry
Definition: detect-tag.c:336
DetectTagData
struct DetectTagData_ DetectTagData
DetectTagDataEntry_::packets
uint32_t packets
Definition: detect-tag.h:79
suricata-common.h
DETECT_TAG_TYPE_SESSION
@ DETECT_TAG_TYPE_SESSION
Definition: detect-tag.h:44
DetectTagData_::count
uint32_t count
Definition: detect-tag.h:64
DETECT_TAG_DIR_SRC
@ DETECT_TAG_DIR_SRC
Definition: detect-tag.h:50
DetectTagDataEntry
struct DetectTagDataEntry_ DetectTagDataEntry
DetectTagDataEntry_::next
struct DetectTagDataEntry_ * next
Definition: detect-tag.h:87
DetectTagData_
Definition: detect-tag.h:61
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
DetectTagData_::type
uint8_t type
Definition: detect-tag.h:62
DetectTagData_::metric
uint8_t metric
Definition: detect-tag.h:65
DETECT_TAG_TYPE_HOST
@ DETECT_TAG_TYPE_HOST
Definition: detect-tag.h:45