suricata
detect-tag.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2013 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
22
* \author Victor Julien <victor@inliniac.net>
23
*/
24
25
#ifndef __DETECT_TAG_H__
26
#define __DETECT_TAG_H__
27
28
#include "
suricata-common.h
"
29
#include "
suricata.h
"
30
#include "
util-time.h
"
31
32
/* Limit the number of times a session can be tagged by the
33
* same rule without finishing older tags */
34
#define DETECT_TAG_MATCH_LIMIT 10
35
36
/* Limit the number of tags that a session can have */
37
#define DETECT_TAG_MAX_TAGS 50
38
39
/* Limit the number of pkts to capture. Change this to
40
* zero to make it unlimited
41
* TODO: load it from config (var tagged_packet_limit) */
42
#define DETECT_TAG_MAX_PKTS 256
43
44
/* Type of tag: session or host */
45
enum
{
46
DETECT_TAG_TYPE_SESSION
,
47
DETECT_TAG_TYPE_HOST
,
48
DETECT_TAG_TYPE_MAX
49
};
50
51
enum
{
52
DETECT_TAG_DIR_SRC
,
53
DETECT_TAG_DIR_DST
,
54
DETECT_TAG_DIR_MAX
55
};
56
57
enum
{
58
DETECT_TAG_METRIC_PACKET
,
59
DETECT_TAG_METRIC_SECONDS
,
60
DETECT_TAG_METRIC_BYTES
,
61
DETECT_TAG_METRIC_MAX
62
};
63
64
/** This will be the rule options/parameters */
65
typedef
struct
DetectTagData_
{
66
uint8_t
type
;
/**< tag type */
67
uint8_t
direction
;
/**< host direction */
68
uint32_t
count
;
/**< count */
69
uint32_t
metric
;
/**< metric */
70
}
DetectTagData
;
71
72
/** This is the installed data at the session/global or host table */
73
typedef
struct
DetectTagDataEntry_
{
74
uint8_t
flags
:3;
75
uint8_t
metric
:5;
76
uint8_t
pad0
;
77
uint16_t
cnt_match
;
/**< number of times this tag was reset/updated */
78
79
uint32_t
count
;
/**< count setting from rule */
80
uint32_t
sid
;
/**< sid originating the tag */
81
uint32_t
gid
;
/**< gid originating the tag */
82
union
{
83
uint32_t
packets
;
/**< number of packets (metric packets) */
84
uint32_t
bytes
;
/**< number of bytes (metric bytes) */
85
};
86
uint32_t
first_ts
;
/**< First time seen (for metric = seconds) */
87
uint32_t
last_ts
;
/**< Last time seen (to prune old sessions) */
88
#if __WORDSIZE == 64
89
uint32_t
pad1
;
90
#endif
91
struct
DetectTagDataEntry_
*
next
;
/**< Pointer to the next tag of this
92
* session/src_host/dst_host (if any from other rule) */
93
}
DetectTagDataEntry
;
94
95
#define TAG_ENTRY_FLAG_DIR_SRC 0x01
96
#define TAG_ENTRY_FLAG_DIR_DST 0x02
97
#define TAG_ENTRY_FLAG_SKIPPED_FIRST 0x04
98
99
/* prototypes */
100
struct
DetectEngineCtx_
;
101
void
DetectTagRegister
(
void
);
102
void
DetectTagDataFree
(
struct
DetectEngineCtx_
*,
void
*ptr);
103
void
DetectTagDataListFree
(
void
*ptr);
104
105
#endif
/* __DETECT_TAG_H__ */
106
DetectTagDataEntry_::bytes
uint32_t bytes
Definition:
detect-tag.h:84
DETECT_TAG_METRIC_PACKET
@ DETECT_TAG_METRIC_PACKET
Definition:
detect-tag.h:58
DETECT_TAG_DIR_MAX
@ DETECT_TAG_DIR_MAX
Definition:
detect-tag.h:54
DetectTagDataEntry_::last_ts
uint32_t last_ts
Definition:
detect-tag.h:87
DetectTagDataEntry_
Definition:
detect-tag.h:73
DetectTagDataEntry_::cnt_match
uint16_t cnt_match
Definition:
detect-tag.h:77
DETECT_TAG_TYPE_SESSION
@ DETECT_TAG_TYPE_SESSION
Definition:
detect-tag.h:46
DETECT_TAG_METRIC_BYTES
@ DETECT_TAG_METRIC_BYTES
Definition:
detect-tag.h:60
DetectTagDataEntry_::sid
uint32_t sid
Definition:
detect-tag.h:80
DetectEngineCtx_
main detection engine ctx
Definition:
detect.h:811
DETECT_TAG_METRIC_SECONDS
@ DETECT_TAG_METRIC_SECONDS
Definition:
detect-tag.h:59
DETECT_TAG_TYPE_HOST
@ DETECT_TAG_TYPE_HOST
Definition:
detect-tag.h:47
DetectTagDataEntry_::pad0
uint8_t pad0
Definition:
detect-tag.h:76
DetectTagDataEntry_::metric
uint8_t metric
Definition:
detect-tag.h:75
DetectTagData_::direction
uint8_t direction
Definition:
detect-tag.h:67
DetectTagDataEntry_::flags
uint8_t flags
Definition:
detect-tag.h:74
DetectTagDataEntry_::gid
uint32_t gid
Definition:
detect-tag.h:81
DetectTagDataEntry_::count
uint32_t count
Definition:
detect-tag.h:79
DetectTagDataEntry_::first_ts
uint32_t first_ts
Definition:
detect-tag.h:86
DetectTagDataFree
void DetectTagDataFree(struct DetectEngineCtx_ *, void *ptr)
this function will free memory associated with DetectTagData
Definition:
detect-tag.c:349
DETECT_TAG_DIR_DST
@ DETECT_TAG_DIR_DST
Definition:
detect-tag.h:53
DetectTagData_::metric
uint32_t metric
Definition:
detect-tag.h:69
util-time.h
DETECT_TAG_DIR_SRC
@ DETECT_TAG_DIR_SRC
Definition:
detect-tag.h:52
pad1
uint16_t pad1
Definition:
decode-template.h:2
DetectTagDataListFree
void DetectTagDataListFree(void *ptr)
this function will free all the entries of a list DetectTagDataEntry
Definition:
detect-tag.c:330
DetectTagData
struct DetectTagData_ DetectTagData
DetectTagDataEntry_::packets
uint32_t packets
Definition:
detect-tag.h:83
suricata-common.h
DetectTagData_::count
uint32_t count
Definition:
detect-tag.h:68
DETECT_TAG_TYPE_MAX
@ DETECT_TAG_TYPE_MAX
Definition:
detect-tag.h:48
DetectTagDataEntry
struct DetectTagDataEntry_ DetectTagDataEntry
DETECT_TAG_METRIC_MAX
@ DETECT_TAG_METRIC_MAX
Definition:
detect-tag.h:61
DetectTagDataEntry_::next
struct DetectTagDataEntry_ * next
Definition:
detect-tag.h:91
suricata.h
DetectTagData_
Definition:
detect-tag.h:65
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition:
detect-tag.c:70
DetectTagData_::type
uint8_t type
Definition:
detect-tag.h:66
src
detect-tag.h
Generated on Mon May 16 2022 23:30:35 for suricata by
1.8.18