suricata
detect-threshold.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2013 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Breno Silva <breno.silva@gmail.com>
22
*/
23
24
#ifndef SURICATA_DETECT_THRESHOLD_H
25
#define SURICATA_DETECT_THRESHOLD_H
26
27
#define TYPE_LIMIT 1
28
#define TYPE_BOTH 2
29
#define TYPE_THRESHOLD 3
30
#define TYPE_DETECTION 4
31
#define TYPE_RATE 5
32
#define TYPE_SUPPRESS 6
33
34
#define TRACK_DST 1
35
#define TRACK_SRC 2
36
#define TRACK_RULE 3
37
#define TRACK_EITHER 4
/**< either src or dst: only used by suppress */
38
#define TRACK_BOTH 5
/* used by rate_filter to match detections by both src and dst addresses */
39
40
/* Get the new action to take */
41
#define TH_ACTION_ALERT 0x01
42
#define TH_ACTION_DROP 0x02
43
#define TH_ACTION_PASS 0x04
44
#define TH_ACTION_LOG 0x08
45
#define TH_ACTION_SDROP 0x10
46
#define TH_ACTION_REJECT 0x20
47
48
/**
49
* \typedef DetectThresholdData
50
* A typedef for DetectThresholdData_
51
*/
52
53
typedef
struct
DetectThresholdData_
{
54
uint32_t
count
;
/**< Event count */
55
uint32_t
seconds
;
/**< Event seconds */
56
uint8_t
type
;
/**< Threshold type : limit , threshold, both, detection_filter */
57
uint8_t
track
;
/**< Track type: by_src, by_dst */
58
uint8_t
new_action
;
/**< new_action alert|drop|pass|log|sdrop|reject */
59
uint32_t
timeout
;
/**< timeout */
60
uint32_t
flags
;
/**< flags used to set option */
61
DetectAddressHead
addrs
;
62
}
DetectThresholdData
;
63
64
typedef
struct
DetectThresholdEntry_
{
65
uint32_t
sid
;
/**< Signature id */
66
uint32_t
gid
;
/**< Signature group id */
67
68
uint32_t
tv_timeout
;
/**< Timeout for new_action (for rate_filter)
69
its not "seconds", that define the time interval */
70
uint32_t
seconds
;
/**< Event seconds */
71
uint32_t
current_count
;
/**< Var for count control */
72
int
track
;
/**< Track type: by_src, by_src */
73
74
SCTime_t
tv1
;
/**< Var for time control */
75
struct
DetectThresholdEntry_
*
next
;
76
}
DetectThresholdEntry
;
77
78
79
/**
80
* Registration function for threshold: keyword
81
*/
82
83
void
DetectThresholdRegister
(
void
);
84
DetectThresholdData
*
DetectThresholdDataCopy
(
DetectThresholdData
*);
85
86
#endif
/*SURICATA_DETECT_THRESHOLD_H */
DetectThresholdData_::timeout
uint32_t timeout
Definition:
detect-threshold.h:59
DetectAddressHead_
Definition:
detect.h:177
DetectThresholdData_::count
uint32_t count
Definition:
detect-threshold.h:54
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition:
detect-threshold.c:79
DetectThresholdData_::new_action
uint8_t new_action
Definition:
detect-threshold.h:58
DetectThresholdEntry_
Definition:
detect-threshold.h:64
DetectThresholdEntry_::sid
uint32_t sid
Definition:
detect-threshold.h:65
DetectThresholdEntry_::seconds
uint32_t seconds
Definition:
detect-threshold.h:70
DetectThresholdData_::type
uint8_t type
Definition:
detect-threshold.h:56
DetectThresholdEntry_::track
int track
Definition:
detect-threshold.h:72
DetectThresholdEntry_::tv_timeout
uint32_t tv_timeout
Definition:
detect-threshold.h:68
DetectThresholdEntry
struct DetectThresholdEntry_ DetectThresholdEntry
DetectThresholdDataCopy
DetectThresholdData * DetectThresholdDataCopy(DetectThresholdData *)
Make a deep-copy of an extant DetectTHresholdData object.
Definition:
detect-threshold.c:292
DetectThresholdEntry_::tv1
SCTime_t tv1
Definition:
detect-threshold.h:74
SCTime_t
Definition:
util-time.h:40
DetectThresholdData_::track
uint8_t track
Definition:
detect-threshold.h:57
DetectThresholdEntry_::current_count
uint32_t current_count
Definition:
detect-threshold.h:71
DetectThresholdData_
Definition:
detect-threshold.h:53
DetectThresholdData_::flags
uint32_t flags
Definition:
detect-threshold.h:60
DetectThresholdEntry_::next
struct DetectThresholdEntry_ * next
Definition:
detect-threshold.h:75
DetectThresholdEntry_::gid
uint32_t gid
Definition:
detect-threshold.h:66
DetectThresholdData
struct DetectThresholdData_ DetectThresholdData
DetectThresholdData_::seconds
uint32_t seconds
Definition:
detect-threshold.h:55
DetectThresholdData_::addrs
DetectAddressHead addrs
Definition:
detect-threshold.h:61
src
detect-threshold.h
Generated on Wed Mar 27 2024 23:30:40 for suricata by
1.8.18