suricata
detect-tag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  */
24 
25 #ifndef __DETECT_TAG_H__
26 #define __DETECT_TAG_H__
27 
28 #include "suricata-common.h"
29 #include "suricata.h"
30 #include "util-time.h"
31 
32 /* Limit the number of times a session can be tagged by the
33  * same rule without finishing older tags */
34 #define DETECT_TAG_MATCH_LIMIT 10
35 
36 /* Limit the number of tags that a session can have */
37 #define DETECT_TAG_MAX_TAGS 50
38 
39 /* Limit the number of pkts to capture. Change this to
40  * zero to make it unlimited
41  * TODO: load it from config (var tagged_packet_limit) */
42 #define DETECT_TAG_MAX_PKTS 256
43 
44 /* Type of tag: session or host */
45 enum {
49 };
50 
51 enum {
55 };
56 
57 enum {
62 };
63 
64 /** This will be the rule options/parameters */
65 typedef struct DetectTagData_ {
66  uint8_t type; /**< tag type */
67  uint8_t direction; /**< host direction */
68  uint32_t count; /**< count */
69  uint32_t metric; /**< metric */
71 
72 /** This is the installed data at the session/global or host table */
73 typedef struct DetectTagDataEntry_ {
74  uint8_t flags:3;
75  uint8_t metric:5;
76  uint8_t pad0;
77  uint16_t cnt_match; /**< number of times this tag was reset/updated */
78 
79  uint32_t count; /**< count setting from rule */
80  uint32_t sid; /**< sid originating the tag */
81  uint32_t gid; /**< gid originating the tag */
82  union {
83  uint32_t packets; /**< number of packets (metric packets) */
84  uint32_t bytes; /**< number of bytes (metric bytes) */
85  };
86  uint32_t first_ts; /**< First time seen (for metric = seconds) */
87  uint32_t last_ts; /**< Last time seen (to prune old sessions) */
88 #if __WORDSIZE == 64
89  uint32_t pad1;
90 #endif
91  struct DetectTagDataEntry_ *next; /**< Pointer to the next tag of this
92  * session/src_host/dst_host (if any from other rule) */
94 
95 #define TAG_ENTRY_FLAG_DIR_SRC 0x01
96 #define TAG_ENTRY_FLAG_DIR_DST 0x02
97 #define TAG_ENTRY_FLAG_SKIPPED_FIRST 0x04
98 
99 /* prototypes */
100 void DetectTagRegister(void);
101 void DetectTagDataFree(void *ptr);
102 void DetectTagDataListFree(void *ptr);
103 
104 #endif /* __DETECT_TAG_H__ */
105 
uint8_t direction
Definition: detect-tag.h:67
uint32_t count
Definition: detect-tag.h:68
uint16_t flags
uint32_t metric
Definition: detect-tag.h:69
struct DetectTagDataEntry_ DetectTagDataEntry
struct DetectTagData_ DetectTagData
void DetectTagDataListFree(void *ptr)
this function will free all the entries of a list DetectTagDataEntry
Definition: detect-tag.c:325
void DetectTagDataFree(void *ptr)
this function will free memory associated with DetectTagData
Definition: detect-tag.c:344
uint16_t cnt_match
Definition: detect-tag.h:77
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
uint16_t pad1
uint8_t type
Definition: detect-tag.h:66
struct DetectTagDataEntry_ * next
Definition: detect-tag.h:91