suricata
detect-threshold.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2013 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Breno Silva <breno.silva@gmail.com>
22
*/
23
24
#ifndef __DETECT_THRESHOLD_H__
25
#define __DETECT_THRESHOLD_H__
26
27
#include "
decode-events.h
"
28
#include "
decode-ipv4.h
"
29
#include "
decode-tcp.h
"
30
31
#define TYPE_LIMIT 1
32
#define TYPE_BOTH 2
33
#define TYPE_THRESHOLD 3
34
#define TYPE_DETECTION 4
35
#define TYPE_RATE 5
36
#define TYPE_SUPPRESS 6
37
38
#define TRACK_DST 1
39
#define TRACK_SRC 2
40
#define TRACK_RULE 3
41
#define TRACK_EITHER 4
/**< either src or dst: only used by suppress */
42
#define TRACK_BOTH 5
/* used by rate_filter to match detections by both src and dst addresses */
43
44
/* Get the new action to take */
45
#define TH_ACTION_ALERT 0x01
46
#define TH_ACTION_DROP 0x02
47
#define TH_ACTION_PASS 0x04
48
#define TH_ACTION_LOG 0x08
49
#define TH_ACTION_SDROP 0x10
50
#define TH_ACTION_REJECT 0x20
51
52
/**
53
* \typedef DetectThresholdData
54
* A typedef for DetectThresholdData_
55
*/
56
57
typedef
struct
DetectThresholdData_
{
58
uint32_t
count
;
/**< Event count */
59
uint32_t
seconds
;
/**< Event seconds */
60
uint8_t
type
;
/**< Threshold type : limit , threshold, both, detection_filter */
61
uint8_t
track
;
/**< Track type: by_src, by_dst */
62
uint8_t
new_action
;
/**< new_action alert|drop|pass|log|sdrop|reject */
63
uint32_t
timeout
;
/**< timeout */
64
uint32_t
flags
;
/**< flags used to set option */
65
DetectAddressHead
addrs
;
66
}
DetectThresholdData
;
67
68
typedef
struct
DetectThresholdEntry_
{
69
uint32_t
sid
;
/**< Signature id */
70
uint32_t
gid
;
/**< Signature group id */
71
72
uint32_t
tv_timeout
;
/**< Timeout for new_action (for rate_filter)
73
its not "seconds", that define the time interval */
74
uint32_t
seconds
;
/**< Event seconds */
75
uint32_t
current_count
;
/**< Var for count control */
76
int
track
;
/**< Track type: by_src, by_src */
77
78
struct
timeval
tv1
;
/**< Var for time control */
79
struct
DetectThresholdEntry_
*
next
;
80
}
DetectThresholdEntry
;
81
82
83
/**
84
* Registration function for threshold: keyword
85
*/
86
87
void
DetectThresholdRegister
(
void
);
88
DetectThresholdData
*
DetectThresholdDataCopy
(
DetectThresholdData
*);
89
90
#endif
/*__DETECT_THRESHOLD_H__ */
DetectThresholdData_::timeout
uint32_t timeout
Definition:
detect-threshold.h:63
decode-tcp.h
DetectAddressHead_
Definition:
detect.h:154
DetectThresholdData_::count
uint32_t count
Definition:
detect-threshold.h:58
DetectThresholdEntry_::tv1
struct timeval tv1
Definition:
detect-threshold.h:78
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition:
detect-threshold.c:78
DetectThresholdData_::new_action
uint8_t new_action
Definition:
detect-threshold.h:62
DetectThresholdEntry_
Definition:
detect-threshold.h:68
DetectThresholdEntry_::sid
uint32_t sid
Definition:
detect-threshold.h:69
DetectThresholdEntry_::seconds
uint32_t seconds
Definition:
detect-threshold.h:74
DetectThresholdData_::type
uint8_t type
Definition:
detect-threshold.h:60
DetectThresholdEntry_::track
int track
Definition:
detect-threshold.h:76
DetectThresholdEntry_::tv_timeout
uint32_t tv_timeout
Definition:
detect-threshold.h:72
DetectThresholdEntry
struct DetectThresholdEntry_ DetectThresholdEntry
DetectThresholdDataCopy
DetectThresholdData * DetectThresholdDataCopy(DetectThresholdData *)
Make a deep-copy of an extant DetectTHresholdData object.
Definition:
detect-threshold.c:294
decode-events.h
DetectThresholdData_::track
uint8_t track
Definition:
detect-threshold.h:61
decode-ipv4.h
DetectThresholdEntry_::current_count
uint32_t current_count
Definition:
detect-threshold.h:75
DetectThresholdData_
Definition:
detect-threshold.h:57
DetectThresholdData_::flags
uint32_t flags
Definition:
detect-threshold.h:64
DetectThresholdEntry_::next
struct DetectThresholdEntry_ * next
Definition:
detect-threshold.h:79
DetectThresholdEntry_::gid
uint32_t gid
Definition:
detect-threshold.h:70
DetectThresholdData
struct DetectThresholdData_ DetectThresholdData
DetectThresholdData_::seconds
uint32_t seconds
Definition:
detect-threshold.h:59
DetectThresholdData_::addrs
DetectAddressHead addrs
Definition:
detect-threshold.h:65
src
detect-threshold.h
Generated on Thu May 19 2022 23:30:35 for suricata by
1.8.18